火绒能扫出来病毒，360杀毒一点反应都没有，还闪退
AI找出来的，恶意注入框架检测工具(IOC: 2026-09-15 SZ-DV-01 事件 / MemloadX64)
目标机器: SZ-DV-06 时间: 09/16/2026 09:57:20
==========================================================================
扫描 C:\Users\Public 下的伪造路径树与载荷文件 ...
发现伪造路径树 26 处:
C:\Users\Public\Videos\Globalization
C:\Users\Public\Videos\Common Files\Microsoft Shared\TextConv
C:\Users\Public\Videos\Common Files\Microsoft Shared\MSEnv
C:\Users\Public\Videos\Common Files\Common Files
C:\Users\Public\Videos\Dbg\sym\ntkrnlmp.pdb
C:\Users\Public\Videos\Dolby\DAX2
C:\Users\Public\Videos\Google\Chrome\Application\SetupMetrics
C:\Users\Public\Videos\Kingsoft\KIS\kich7
C:\Users\Public\Videos\Thunder Network\XLLiveUD
C:\Users\Public\Videos\WindowsApp2\WDF
C:\Users\Public\Videos\WindowsAppSvc\Sqm\Upload
C:\Users\Public\Videos\WindowsAssist\WinMSIPC\Server
C:\Users\Public\Videos\WindowsSvc\ClipSVC\Archive\KeyHolder
C:\Users\Public\Pictures\Globalization
C:\Users\Public\Pictures\Common Files\Microsoft Shared\TextConv
C:\Users\Public\Pictures\Common Files\Microsoft Shared\MSEnv
C:\Users\Public\Pictures\Common Files\Common Files
C:\Users\Public\Pictures\Dbg\sym\ntkrnlmp.pdb
C:\Users\Public\Pictures\Dolby\DAX2
C:\Users\Public\Pictures\Google\Chrome\Application\SetupMetrics
C:\Users\Public\Pictures\Kingsoft\KIS\kich7
C:\Users\Public\Pictures\Thunder Network\XLLiveUD
C:\Users\Public\Pictures\WindowsApp2\WDF
C:\Users\Public\Pictures\WindowsAppSvc\Sqm\Upload
C:\Users\Public\Pictures\WindowsAssist\WinMSIPC\Server
C:\Users\Public\Pictures\WindowsSvc\ClipSVC\Archive\KeyHolder
可疑载荷文件(特征扩展名或 48640 字节): 78 个
C:\Users\Public\Videos\Common Files\Common Files\Windows\textcov\360CenterX86.cdat48640B09/14/2026 05:28:45厂商=Microsoft Corporation
C:\Users\Public\Videos\Common Files\Common Files\Windows\textcov\DefenderCenter64.sgvx48640B08/13/2026 14:47:54厂商=Microsoft Corporation
C:\Users\Public\Videos\Common Files\Microsoft Shared\MSEnv\360CenterX86.nlxs48640B09/14/2026 06:07:45厂商=Microsoft Corporation
C:\Users\Public\Videos\Common Files\Microsoft Shared\TextConv\DefenderCenter64.agvx48640B07/29/2026 00:10:00厂商=Microsoft Corporation
C:\Users\Public\Videos\Common Files\Microsoft Shared\TextConv\SetupCenteri6.dbx48640B06/19/2026 22:47:10厂商=Microsoft Corporation
C:\Users\Public\Videos\Common Files\Microsoft Shared\TextConv\WeChatXGoWinX9.sbin48640B09/14/2026 06:22:05厂商=Microsoft Corporation
C:\Users\Public\Videos\Dbg\sym\ntkrnlmp.pdb\KingSoftAsX64.sbin48640B09/14/2026 06:42:25厂商=Microsoft Corporation
C:\Users\Public\Videos\Dbg\sym\ntkrnlmp.pdb\KingSoftAsX64.sgvx48640B09/14/2026 06:24:05厂商=Microsoft Corporation
C:\Users\Public\Videos\Dolby\DAX2\InputCenhelperi4.sbin48640B09/14/2026 06:37:45厂商=Microsoft Corporation
C:\Users\Public\Videos\Dolby\DAX2\KingSoftAsX64.sedx48640B09/14/2026 06:13:25厂商=Microsoft Corporation
C:\Users\Public\Videos\Dolby\DAX2\SetupCenteri6.sgvx48640B09/14/2026 06:38:25厂商=Microsoft Corporation
C:\Users\Public\Videos\Globalization\Sorting\SortDefault\360CenterX86.nlxs48640B08/19/2026 23:50:00厂商=Microsoft Corporation
C:\Users\Public\Videos\Globalization\Sorting\SortDefault\DefenderCenter64.nlxs48640B09/14/2026 05:26:05厂商=Microsoft Corporation
C:\Users\Public\Videos\Globalization\Sorting\SortDefault\QQCenteri4.sedx48640B09/13/2026 15:18:04厂商=Microsoft Corporation
C:\Users\Public\Videos\Globalization\Sorting\SortDefault\WeChatXGoWinX9.sdat48640B09/14/2026 06:26:05厂商=Microsoft Corporation
C:\Users\Public\Videos\Google\Chrome\Application\SetupMetrics\AvastDeHelperX7.outx48640B09/14/2026 06:36:45厂商=Microsoft Corporation
C:\Users\Public\Videos\Google\Chrome\Application\SetupMetrics\InputCenhelperi4.dbx48640B09/14/2026 06:09:45厂商=Microsoft Corporation
C:\Users\Public\Videos\Kingsoft\KIS\kich7\WeChatXGoWinX9.agvx48640B09/14/2026 05:29:05厂商=Microsoft Corporation
C:\Users\Public\Videos\Kingsoft\KIS\kich7\WindowsAsisstX32.sbin48640B07/25/2026 16:54:06厂商=Microsoft Corporation
C:\Users\Public\Videos\Thunder Network\XLLiveUD\KingSoftAsX64.outx48640B08/28/2026 12:30:21厂商=Microsoft Corporation
C:\Users\Public\Videos\Thunder Network\XLLiveUD\KingSoftAsX64.sgvx48640B09/14/2026 06:45:25厂商=Microsoft Corporation
C:\Users\Public\Videos\WindowsApp2\WDF\360CenterX86.agvx48640B09/14/2026 06:25:05厂商=Microsoft Corporation
C:\Users\Public\Videos\WindowsApp2\WDF\AvastDeHelperX7.sedx48640B09/14/2026 06:08:45厂商=Microsoft Corporation
C:\Users\Public\Videos\WindowsAppSvc\Sqm\Upload\DefenderCenter64.nlxs48640B09/14/2026 06:12:25厂商=Microsoft Corporation
C:\Users\Public\Videos\WindowsAppSvc\Sqm\Upload\pfDefenderMainX64.sedx48640B09/14/2026 06:39:25厂商=Microsoft Corporation
C:\Users\Public\Videos\WindowsAppSvc\Sqm\Upload\QQCenteri4.agvx48640B09/14/2026 06:11:45厂商=Microsoft Corporation
C:\Users\Public\Videos\WindowsAppSvc\Sqm\Upload\SetupCenteri6.sbin48640B09/14/2026 06:38:45厂商=Microsoft Corporation
C:\Users\Public\Videos\WindowsAssist\WinMSIPC\Server\360CenterX86.dbx48640B09/14/2026 06:35:45厂商=Microsoft Corporation
C:\Users\Public\Videos\WindowsAssist\WinMSIPC\Server\AvastDeHelperX7.cdat48640B08/19/2026 07:30:03厂商=Microsoft Corporation
C:\Users\Public\Videos\WindowsAssist\WinMSIPC\Server\InputCenhelperi4.bocx48640B09/14/2026 06:44:25厂商=Microsoft Corporation
C:\Users\Public\Videos\WindowsAssist\WinMSIPC\Server\WindowsAsisstX32.agvx48640B09/14/2026 06:09:25厂商=Microsoft Corporation
C:\Users\Public\Videos\WindowsSvc\ClipSVC\Archive\KeyHolder\DefenderCenter64.bocx48640B09/14/2026 06:23:05厂商=Microsoft Corporation
C:\Users\Public\Videos\WindowsSvc\ClipSVC\Archive\KeyHolder\pfDefenderMainX64.dbx48640B09/14/2026 06:14:25厂商=Microsoft Corporation
C:\Users\Public\Videos\WindowsSvc\ClipSVC\Archive\KeyHolder\WindowsAsisstX32.cdat48640B09/07/2026 19:47:04厂商=Microsoft Corporation
C:\Users\Public\Pictures\Common Files\Common Files\Windows\textcov\KingSoftAsX64.sbin48640B09/14/2026 06:45:45厂商=Microsoft Corporation
C:\Users\Public\Pictures\Common Files\Common Files\Windows\textcov\WeChatXGoWinX9.dbx48640B09/14/2026 06:12:05厂商=Microsoft Corporation
C:\Users\Public\Pictures\Common Files\Microsoft Shared\MSEnv\360CenterX86.bocx48640B09/14/2026 06:42:05厂商=Microsoft Corporation
C:\Users\Public\Pictures\Common Files\Microsoft Shared\MSEnv\DefenderCenter64.sbin48640B07/12/2026 14:04:57厂商=Microsoft Corporation
C:\Users\Public\Pictures\Common Files\Microsoft Shared\MSEnv\pfDefenderMainX64.agvx48640B09/14/2026 06:07:05厂商=Microsoft Corporation
C:\Users\Public\Pictures\Common Files\Microsoft Shared\MSEnv\pfDefenderMainX64.sdat48640B09/14/2026 06:42:45厂商=Microsoft Corporation
C:\Users\Public\Pictures\Common Files\Microsoft Shared\TextConv\AvastDeHelperX7.agvx48640B09/14/2026 06:22:45厂商=Microsoft Corporation
C:\Users\Public\Pictures\Common Files\Microsoft Shared\TextConv\DefenderCenter64.sdat48640B06/05/2026 02:31:29厂商=Microsoft Corporation
C:\Users\Public\Pictures\Common Files\Microsoft Shared\TextConv\SetupCenteri6.sedx48640B07/14/2026 17:39:21厂商=Microsoft Corporation
C:\Users\Public\Pictures\Common Files\Microsoft Shared\TextConv\WindowsAsisstX32.outx48640B09/14/2026 06:23:25厂商=Microsoft Corporation
C:\Users\Public\Pictures\Dbg\sym\ntkrnlmp.pdb\KingSoftAsX64.dbx48640B07/02/2026 04:41:05厂商=Microsoft Corporation
C:\Users\Public\Pictures\Dbg\sym\ntkrnlmp.pdb\pfDefenderMainX64.nlxs48640B09/14/2026 06:14:45厂商=Microsoft Corporation
C:\Users\Public\Pictures\Dolby\DAX2\360CenterX86.outx48640B09/14/2026 06:14:05厂商=Microsoft Corporation
C:\Users\Public\Pictures\Dolby\DAX2\WindowsAsisstX32.sbin48640B09/15/2026 08:18:45厂商=Microsoft Corporation
C:\Users\Public\Pictures\Globalization\Sorting\SortDefault\360CenterX86.cdat48640B09/14/2026 06:24:45厂商=Microsoft Corporation
C:\Users\Public\Pictures\Globalization\Sorting\SortDefault\AvastDeHelperX7.nlxs48640B09/14/2026 06:26:45厂商=Microsoft Corporation
C:\Users\Public\Pictures\Globalization\Sorting\SortDefault\pfDefenderMainX64.bocx48640B09/14/2026 06:25:25厂商=Microsoft Corporation
C:\Users\Public\Pictures\Google\Chrome\Application\SetupMetrics\pfDefenderMainX64.nlxs48640B09/14/2026 06:36:05厂商=Microsoft Corporation
C:\Users\Public\Pictures\Google\Chrome\Application\SetupMetrics\QQCenteri4.dbx48640B09/15/2026 08:18:43厂商=Microsoft Corporation
C:\Users\Public\Pictures\Google\Chrome\Application\SetupMetrics\WeChatXGoWinX9.dbx48640B06/16/2026 01:18:52厂商=Microsoft Corporation
C:\Users\Public\Pictures\Google\Chrome\Application\SetupMetrics\WindowsAsisstX32.bocx48640B09/14/2026 06:37:25厂商=Microsoft Corporation
C:\Users\Public\Pictures\Kingsoft\KIS\kich7\AvastDeHelperX7.outx48640B08/14/2026 13:38:59厂商=Microsoft Corporation
C:\Users\Public\Pictures\Thunder Network\XLLiveUD\DefenderCenter64.cdat48640B09/14/2026 06:09:05厂商=Microsoft Corporation
C:\Users\Public\Pictures\Thunder Network\XLLiveUD\DefenderCenter64.sgvx48640B09/14/2026 06:26:25厂商=Microsoft Corporation
C:\Users\Public\Pictures\Thunder Network\XLLiveUD\KingSoftAsX64.outx48640B09/14/2026 05:52:45厂商=Microsoft Corporation
C:\Users\Public\Pictures\Thunder Network\XLLiveUD\WindowsAsisstX32.sbin48640B09/14/2026 06:44:45厂商=Microsoft Corporation
C:\Users\Public\Pictures\WindowsApp2\WDF\KingSoftAsX64.sgvx48640B06/07/2026 03:15:12厂商=Microsoft Corporation
C:\Users\Public\Pictures\WindowsApp2\WDF\QQCenteri4.cdat48640B09/14/2026 06:25:45厂商=Microsoft Corporation
C:\Users\Public\Pictures\WindowsAppSvc\Sqm\Upload\360CenterX86.sgvx48640B09/14/2026 06:21:45厂商=Microsoft Corporation
C:\Users\Public\Pictures\WindowsAppSvc\Sqm\Upload\AvastDeHelperX7.agvx48640B08/18/2026 18:00:46厂商=Microsoft Corporation
C:\Users\Public\Pictures\WindowsAppSvc\Sqm\Upload\InputCenhelperi4.dbx48640B09/15/2026 08:19:05厂商=Microsoft Corporation
C:\Users\Public\Pictures\WindowsAppSvc\Sqm\Upload\InputCenhelperi4.outx48640B09/14/2026 06:13:05厂商=Microsoft Corporation
C:\Users\Public\Pictures\WindowsAppSvc\Sqm\Upload\KingSoftAsX64.dbx48640B09/14/2026 06:38:05厂商=Microsoft Corporation
C:\Users\Public\Pictures\WindowsAppSvc\Sqm\Upload\pfDefenderMainX64.cdat48640B09/14/2026 06:46:05厂商=Microsoft Corporation
C:\Users\Public\Pictures\WindowsAppSvc\Sqm\Upload\SetupCenteri6.cdat48640B09/14/2026 06:13:45厂商=Microsoft Corporation
C:\Users\Public\Pictures\WindowsAssist\WinMSIPC\Server\360CenterX86.sgvx48640B09/14/2026 06:43:05厂商=Microsoft Corporation
C:\Users\Public\Pictures\WindowsAssist\WinMSIPC\Server\DefenderCenter64.sedx48640B09/14/2026 06:37:05厂商=Microsoft Corporation
C:\Users\Public\Pictures\WindowsAssist\WinMSIPC\Server\pfDefenderMainX64.nlxs48640B09/10/2026 15:30:04厂商=Microsoft Corporation
C:\Users\Public\Pictures\WindowsAssist\WinMSIPC\Server\QQCenteri4.sbin48640B09/14/2026 06:36:25厂商=Microsoft Corporation
C:\Users\Public\Pictures\WindowsAssist\WinMSIPC\Server\SetupCenteri6.sdat48640B09/14/2026 06:45:05厂商=Microsoft Corporation
C:\Users\Public\Pictures\WindowsAssist\WinMSIPC\Server\WeChatXGoWinX9.nlxs48640B09/15/2026 08:19:05厂商=Microsoft Corporation
C:\Users\Public\Pictures\WindowsSvc\ClipSVC\Archive\KeyHolder\InputCenhelperi4.sdat48640B09/14/2026 06:23:45厂商=Microsoft Corporation
C:\Users\Public\Pictures\WindowsSvc\ClipSVC\Archive\KeyHolder\QQCenteri4.cdat48640B09/14/2026 06:22:25厂商=Microsoft Corporation
C:\Users\Public\Pictures\WindowsSvc\ClipSVC\Archive\KeyHolder\SetupCenteri6.sbin48640B09/14/2026 06:24:25厂商=Microsoft Corporation
扫描运行中进程的被注入模块(lsass 等全部进程) ...
注入: lsass(pid 840) -> C:\Users\Public\Pictures\WindowsAppSvc\Sqm\Upload\pfDefenderMainX64.cdat
注入: lsass(pid 840) -> C:\Users\Public\Pictures\Google\Chrome\Application\SetupMetrics\QQCenteri4.dbx
注入: lsass(pid 840) -> C:\Users\Public\Pictures\Dolby\DAX2\WindowsAsisstX32.sbin
注入: lsass(pid 840) -> C:\Users\Public\Pictures\WindowsAppSvc\Sqm\Upload\InputCenhelperi4.dbx
注入: mongod(pid 6684) -> C:\Users\Public\Pictures\WindowsAppSvc\Sqm\Upload\InputCenhelperi4.dbx
注入: mongod(pid 7100) -> C:\Users\Public\Pictures\WindowsAppSvc\Sqm\Upload\InputCenhelperi4.dbx
注入: mpdwsvc(pid 6108) -> C:\Users\Public\Pictures\Dolby\DAX2\WindowsAsisstX32.sbin
注入: mpdwsvc(pid 6108) -> C:\Users\Public\Pictures\WindowsAppSvc\Sqm\Upload\InputCenhelperi4.dbx
注入: mpdwsvc(pid 6116) -> C:\Users\Public\Pictures\WindowsAssist\WinMSIPC\Server\WeChatXGoWinX9.nlxs
注入: mpdwsvc(pid 6116) -> C:\Users\Public\Pictures\WindowsAppSvc\Sqm\Upload\InputCenhelperi4.dbx
注入: snmp(pid 3492) -> C:\Users\Public\Pictures\Google\Chrome\Application\SetupMetrics\QQCenteri4.dbx
注入: spoolsv(pid 3124) -> C:\Users\Public\Pictures\Google\Chrome\Application\SetupMetrics\QQCenteri4.dbx
注入: spoolsv(pid 3124) -> C:\Users\Public\Pictures\Dolby\DAX2\WindowsAsisstX32.sbin
注入: SQLAGENT(pid 5416) -> C:\Users\Public\Pictures\Dolby\DAX2\WindowsAsisstX32.sbin
注入: SQLAGENT(pid 5416) -> C:\Users\Public\Pictures\WindowsAppSvc\Sqm\Upload\InputCenhelperi4.dbx
注入: sqlservr(pid 4008) -> C:\Users\Public\Pictures\Dolby\DAX2\WindowsAsisstX32.sbin
注入: sqlservr(pid 4008) -> C:\Users\Public\Pictures\WindowsAppSvc\Sqm\Upload\InputCenhelperi4.dbx
注入: svchost(pid 500) -> C:\Users\Public\Pictures\WindowsAppSvc\Sqm\Upload\InputCenhelperi4.dbx
注入: svchost(pid 1300) -> C:\Users\Public\Pictures\Google\Chrome\Application\SetupMetrics\QQCenteri4.dbx
注入: svchost(pid 1300) -> C:\Users\Public\Pictures\Dolby\DAX2\WindowsAsisstX32.sbin
注入: svchost(pid 1324) -> C:\Users\Public\Pictures\Dolby\DAX2\WindowsAsisstX32.sbin
注入: svchost(pid 1324) -> C:\Users\Public\Pictures\WindowsAppSvc\Sqm\Upload\InputCenhelperi4.dbx
注入: svchost(pid 1576) -> C:\Users\Public\Pictures\Google\Chrome\Application\SetupMetrics\QQCenteri4.dbx
注入: svchost(pid 1576) -> C:\Users\Public\Pictures\Dolby\DAX2\WindowsAsisstX32.sbin
注入: svchost(pid 1576) -> C:\Users\Public\Pictures\WindowsAppSvc\Sqm\Upload\InputCenhelperi4.dbx
注入: svchost(pid 1872) -> C:\Users\Public\Pictures\WindowsAppSvc\Sqm\Upload\pfDefenderMainX64.cdat
注入: svchost(pid 1872) -> C:\Users\Public\Pictures\Google\Chrome\Application\SetupMetrics\QQCenteri4.dbx
注入: svchost(pid 2436) -> C:\Users\Public\Pictures\WindowsAppSvc\Sqm\Upload\InputCenhelperi4.dbx
注入: svchost(pid 2812) -> C:\Users\Public\Pictures\Dolby\DAX2\WindowsAsisstX32.sbin
注入: svchost(pid 2940) -> C:\Users\Public\Pictures\Google\Chrome\Application\SetupMetrics\QQCenteri4.dbx
注入: svchost(pid 3244) -> C:\Users\Public\Pictures\WindowsAppSvc\Sqm\Upload\InputCenhelperi4.dbx
注入: svchost(pid 3408) -> C:\Users\Public\Pictures\WindowsAppSvc\Sqm\Upload\InputCenhelperi4.dbx
注入: svchost(pid 3524) -> C:\Users\Public\Pictures\WindowsAppSvc\Sqm\Upload\InputCenhelperi4.dbx
注入: svchost(pid 3624) -> C:\Users\Public\Pictures\WindowsAppSvc\Sqm\Upload\InputCenhelperi4.dbx
注入: svchost(pid 3876) -> C:\Users\Public\Pictures\Google\Chrome\Application\SetupMetrics\QQCenteri4.dbx
注入: svchost(pid 5780) -> C:\Users\Public\Pictures\WindowsAppSvc\Sqm\Upload\InputCenhelperi4.dbx
注入: WmiPrvSE(pid 2388) -> C:\Users\Public\Pictures\WindowsAppSvc\Sqm\Upload\InputCenhelperi4.dbx
检查 ghost 镜像遗留驱动 BAPIDRV(360.cn) ...
未发现 BAPIDRV
检查 WER 崩溃报告特征(BEX64 + MSCOREE, 近90天) ...
命中 100 份 CLR 启动劫持崩溃报告(DEP@mscoree):
AppCrash_KiteService.exe_c1a9b1d9294c9befe897767a8cf72defa4098db_0413ba1e_1507cf96
AppCrash_RemoteFXvGPUDisa_c45f23edfca17dfe76f48276fef3098a62c9aa9_586b8e06_148a25ae
AppCrash_RemoteFXvGPUDisa_c45f23edfca17dfe76f48276fef3098a62c9aa9_586b8e06_84c0255d
AppCrash_RemoteFXvGPUDisa_c45f23edfca17dfe76f48276fef3098a62c9aa9_586b8e06_f71a798b
AppCrash_RemoteFXvGPUDisa_c45f23edfca17dfe76f48276fef3098a62c9aa9_586b8e06_f760cdc9
AppCrash_ScenarioEngine.e_bf61f53efc82264b724c875a4e896385c3d3e7fc_4ae5e68a_f0153427
AppCrash_ScenarioEngine.e_bf61f53efc82264b724c875a4e896385c3d3e7fc_4ae5e68a_f3e10334
AppCrash_sqlceip.exe_7ec8e3d3cf3d3bd72a6d1f2e04554368914473b_b95463ec_0ad12596
检查 SQL 工具链 IFEO 防护(仅微软签名映像) ...
未防护: ScenarioEngine.exe
未防护: Microsoft.SqlServer.IntegrationServices.MasterServiceHost.exe
未防护: Microsoft.SqlServer.IntegrationServices.WorkerAgentServiceHost.exe
未防护: sqlceip.exe
未防护: MsDtsSrvr.exe
==========================================================================
判定: CONFIRMED —— 确认中招(铁证 115 条)
==========================================================================
但目前360杀毒装了快速扫描闪退 您好，您加下我的微信，我帮您看下具体的问题
页:
[1]