麻烦高手给看看！ bbs.ikaka.com

qqwan - 2006-5-14 11:22:00

服务名称是否运行描述
RemoteRegistry [已停止] [说明:这个服务可能被利用远程操作注册表]
Windows Time [运行中] [说明:这个服务可能被黑客利用来启动木马]
Telnet [已停止] [说明:这个服务可能被黑客登录到您计算机]
Messenger [已停止] [说明:这个服务常被广告商用来发垃圾广告]
Server [运行中] [说明:如果你的电脑不用局域网中,可以关闭]

协议端口号端口类型
TCP 135 微软DCE RPC end-point mapper服务
TCP 445 Microsoft-DS
TCP 1028 未知类型
TCP 139 微软Netbios Name服务(用于文件及打印机共享)
TCP 445 公共Internet文件系统(CIFS)
TCP 500 Internet密钥交换
TCP 1036 未知类型
TCP 1104 RexxRave
TCP 4500 sae-urn
TCP 123 未知类型
TCP 1035 未知类型
TCP 1900 未知类型
TCP 123 未知类型
TCP 137 未知类型
TCP 138 未知类型
TCP 1900 未知类型

[编号:０]
[名称:\SystemRoot\System32\smss.exe]
[类型:运行进程]
[内容:未知]

[编号:1]
[名称:\??\C:\WINDOWS\system32\winlogon.exe]
[类型:运行进程]
[内容:未知]

[编号:2]
[名称:C:\WINDOWS\system32\services.exe]
[类型:运行进程]
[内容:Microsoft(R) Windows(R) Operating System (C) Microsoft Corporation. All rights reserved.]

[编号:3]
[名称:C:\WINDOWS\system32\lsass.exe]
[类型:运行进程]
[内容:Microsoft? Windows? Operating System ? Microsoft Corporation. All rights reserved.]

[编号:4]
[名称:C:\WINDOWS\system32\svchost.exe]
[类型:运行进程]
[内容:Microsoft? Windows? Operating System ? Microsoft Corporation. All rights reserved.]

[编号:5]
[名称:C:\WINDOWS\System32\svchost.exe]
[类型:运行进程]
[内容:Microsoft? Windows? Operating System ? Microsoft Corporation. All rights reserved.]

[编号:6]
[名称:C:\WINDOWS\Explorer.EXE]
[类型:运行进程]
[内容:Microsoft(R) Windows(R) Operating System (C) Microsoft Corporation. All rights reserved.]

[编号:7]
[名称:C:\WINDOWS\system32\spoolsv.exe]
[类型:运行进程]
[内容:Microsoft? Windows? Operating System ? Microsoft Corporation. All rights reserved.]

[编号:8]
[名称:C:\WINDOWS\system32\hkcmd.exe]
[类型:运行进程]
[内容:Intel(R) Common User Interface Copyright 1999-2003, Intel Corporation]

[编号:9]
[名称:C:\WINDOWS\system32\ctfmon.exe]
[类型:运行进程]
[内容:Microsoft? Windows? Operating System ? Microsoft Corporation. All rights reserved.]

[编号:10]
[名称:C:\PROGRA~1\Yahoo!\ASSIST~1\YLive.exe]
[类型:运行进程]
[内容: YLive Copyright ? 2005]

[编号:11]
[名称:C:\Program Files\完美卸载V2006\WmSysPro.exe]
[类型:运行进程]
[内容:系统保护+网络防火墙版权所有 (C)剑锋工作室]

[编号:12]
[名称:C:\Program Files\完美卸载V2006\MainCon.exe]
[类型:运行进程]
[内容:MainCon 应用程序版权所有 (C) 2004]

[编号:13]
[名称:C:\Program Files\完美卸载V2006\WmNetPro.exe]
[类型:运行进程]
[内容:NetSecurity 应用程序版权所有 (C) 2005 王剑锋]

[编号:14]
[名称:C:\Program Files\完美卸载V2006\SysSec.exe]
[类型:运行进程]
[内容:完美卸载V2006-ChinaHijackThis 版权所有 (C) 2006]

[编号:15]
[分隔符:---------------------------------------------------------------------]

[编号:16]
[名称:C:\WINDOWS\system32\igfxsrvc.dll]
[类型:已加载DLL]
[内容:Intel(R) Common User Interface Copyright 1999-2003, Intel Corporation]

[编号:17]
[名称:C:\WINDOWS\system32\hccutils.DLL]
[类型:已加载DLL]
[内容:Intel(R) Common User Interface Copyright 1999-2003, Intel Corporation]

[编号:18]
[名称:C:\WINDOWS\DOWNLO~1\CnsMin.dll]
[类型:已加载DLL]
[内容:3721 CnsMin 版权所有 (C) 2001 - 2004]

[编号:19]
[名称:C:\WINDOWS\system32\igfxpph.dll]
[类型:已加载DLL]
[内容:Intel(R) Common User Interface Copyright 1999-2003, Intel Corporation]

[编号:20]
[名称:C:\WINDOWS\system32\igfxres.dll]
[类型:已加载DLL]
[内容:Intel(R) Common User Interface Copyright 1999-2003, Intel Corporation]

[编号:21]
[名称:C:\WINDOWS\system32\igfxdev.dll]
[类型:已加载DLL]
[内容:Intel(R) Common User Interface Copyright 1999-2003, Intel Corporation]

[编号:22]
[名称:C:\PROGRA~1\3721\AutoLive.dll]
[类型:已加载DLL]
[内容:AutoLive Module Copyright 2004]

[编号:23]
[名称:C:\WINDOWS\system32\xunleibho_v14.dll]
[类型:已加载DLL]
[内容:XunLeiBHO Module Copyright 2004-2006]

[编号:24]
[名称:C:\Program Files\WinRAR\rarext.dll]
[类型:已加载DLL]
[内容:未知]

[编号:25]
[名称:C:\PROGRA~1\Yahoo!\ASSIST~1\Yhelper.dll]
[类型:已加载DLL]
[内容:Helper Module Copyright 2004]

[编号:26]
[名称:C:\PROGRA~1\Yahoo!\ASSIST~1\YAlive.dll]
[类型:已加载DLL]
[内容:YAlive Module Copyright 2005]

[编号:27]
[名称:C:\WINDOWS\system32\igfxress.dll]
[类型:已加载DLL]
[内容:Intel(R) Common User Interface Copyright 1999-2003, Intel Corporation]

[编号:28]
[名称:C:\WINDOWS\system32\Protect.sys]
[类型:已加载DLL]
[内容:未知]

[编号:29]
[名称:C:\WINDOWS\system32\igfxhk.dll]
[类型:已加载DLL]
[内容:Intel(R) Common User Interface Copyright 1999-2003, Intel Corporation]

[编号:30]
[名称:C:\Program Files\完美卸载V2006\ScanEngine.dll]
[类型:已加载DLL]
[内容:ScanEngine 完美病毒引擎文件版权所有 (C) 2005]

[编号:31]
[名称:C:\Program Files\完美卸载V2006\WmSpiDrv.dll]
[类型:已加载DLL]
[内容:未知]

[编号:32]
[分隔符:---------------------------------------------------------------------]

[编号:33]
[名称:IgfxTray]
[类型:开机启动]
[内容:C:\WINDOWS\system32\igfxtray.exe]

[编号:34]
[名称:HotKeysCmds]
[类型:开机启动]
[内容:C:\WINDOWS\system32\hkcmd.exe]

[编号:35]
[名称:YLive.exe]
[类型:开机启动]
[内容:C:\PROGRA~1\Yahoo!\ASSIST~1\YLive.exe]

[编号:36]
[名称:RegFireWall]
[类型:开机启动]
[内容:C:\Program Files\完美卸载V2006\WmSysPro.exe -PowerOn]

[编号:37]
[名称:SkyDune]
[类型:开机启动]
[内容:C:\Program Files\完美卸载V2006\WmNetPro.exe -Poweron]

[编号:38]
[分隔符:---------------------------------------------------------------------]

[编号:39]
[名称:AFD]
[类型:服务:未知]
[内容:\SystemRoot\System32\drivers\afd.sys]

[编号:40]
[名称:DCOM Server Process Launcher]
[类型:服务:未知]
[内容:C:\WINDOWS\system32\svchost ]

[编号:41]
[名称:npkcrypt]
[类型:服务:nProtect KeyCrypt Driver Copyright (C) INCA Internet. 2000-2005]
[内容:e:\新建文件夹\npkcrypt.sys]

[编号:42]
[名称:Remote Procedure Call (RPC)]
[类型:服务:未知]
[内容:C:\WINDOWS\system32\svchost ]

[编号:43]
[名称:Realtek RTL8139(A/B/C)-based PCI Fast Ethernet Adapter NT Driver]
[类型:服务:Realtek RTL8139 Family Fast Ethernet Adapter Copyright (C) 1994-2003 Realtek Semiconductor Corporation]
[内容:C:\WINDOWS\system32\drivers\rtl8139.sys]

[编号:44]
[名称:Secdrv]
[类型:服务:未知]
[内容:C:\WINDOWS\system32\drivers\secdrv.sys]

[编号:45]
[名称:Terminal Services]
[类型:服务:未知]
[内容:C:\WINDOWS\system32\svchost ]

[编号:46]
[名称:WmNdisDrv]
[类型:服务:未知]
[内容:C:\WINDOWS\system32\drivers\wmndisdrv.sys]

[编号:47]
[名称:WmRegProDrv]
[类型:服务:未知]
[内容:C:\WINDOWS\system32\drivers\wmregprodrv.sys]

[编号:48]
[名称:Intel(R) Graphics Platform (SoftBIOS) Driver]
[类型:服务:Intel Graphics Accelerator Drivers for Windows NT(R) Copyright (c) 1998-2003 Intel Corporation.]
[内容:C:\WINDOWS\system32\drivers\ialmsbw.sys]

[编号:49]
[名称:Intel(R) Graphics Chipset (KCH) Driver]
[类型:服务:Intel Graphics Accelerator Drivers for Windows NT(R) Copyright (c) 1998-2003 Intel Corporation.]
[内容:C:\WINDOWS\system32\drivers\ialmkchw.sys]

[编号:50]
[分隔符:---------------------------------------------------------------------]

[编号:51]
[名称:Start Page]
[类型:IE主页-当前用户]
[内容:about:blank]

[编号:52]
[名称:Search Page]
[类型:IE搜索-当前用户]
[内容:http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch]

[编号:53]
[名称:Start Page]
[类型:IE主页-所有用户]
[内容:http://www.microsoft.com/isapi/redir.dll?prd={SUB_PRD}&clcid={SUB_CLSID}&pver={SUB_PVER}&ar=home]

[编号:54]
[名称:Search Page]
[类型:IE搜索-所有用户]
[内容:http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch]

[编号:55]
[名称:Default_Page_URL]
[类型:默认IE主页-所有用户]
[内容:http://www.microsoft.com/isapi/redir.dll?prd=ie&pver=6&ar=msnhome]

[编号:56]
[名称:Default_Search_URL]
[类型:默认IE搜索-所有用户]
[内容:http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch]

[编号:57]
[分隔符:---------------------------------------------------------------------]

[编号:58]
[名称:ThunderIEHelper Class]
[类型:IE 嵌入对象]
[内容:C:\WINDOWS\system32\xunleibho_v14.dll]

[编号:59]
[分隔符:---------------------------------------------------------------------]

[编号:60]
[名称:{367E0A21-8601-4986-9C9A-153BF5ACA118}]
[类型:IE 扩展按钮]
[内容:豪杰超级解霸9 路径:C:\Program Files\Herosoft\Hero 9\STHSDVD.EXE]

[编号:61]
[名称:{6096E38F-5AC1-4391-8EC4-75DFA92FB32F}]
[类型:IE 扩展按钮]
[内容:番茄花园路径:http://tomatolei.com]

[编号:62]
[分隔符:---------------------------------------------------------------------]

[编号:63]
[名称:&使用迅雷下载]
[类型:IE 右键按钮]
[内容: 路径:o]

[编号:64]
[名称:&使用迅雷下载全部链接]
[类型:IE 右键按钮]
[内容: 路径:o]

[编号:65]
[名称:上传到QQ网络硬盘]
[类型:IE 右键按钮]
[内容: 路径:o]

[编号:66]
[名称:使用超级解霸播放]
[类型:IE 右键按钮]
[内容: 路径:o]

[编号:67]
[名称:添加到QQ自定义面板]
[类型:IE 右键按钮]
[内容: 路径:o]

[编号:68]
[名称:添加到QQ表情]
[类型:IE 右键按钮]
[内容: 路径:o]

[编号:69]
[名称:用QQ彩信发送该图片]
[类型:IE 右键按钮]
[内容: 路径:o]

[编号:70]
[分隔符:---------------------------------------------------------------------]

[编号:71]
[名称:PostBootReminder]
[类型:正常嵌入对象]
[内容:%SystemRoot%\system32\SHELL32.dll]

[编号:72]
[名称:CDBurn]
[类型:正常嵌入对象]
[内容:%SystemRoot%\system32\SHELL32.dll]

[编号:73]
[名称:WebCheck]
[类型:正常嵌入对象]
[内容:%SystemRoot%\system32\webcheck.dll]

[编号:74]
[名称:SysTray]
[类型:正常嵌入对象]
[内容:C:\WINDOWS\system32\stobject.dll]

[编号:75]
[分隔符:---------------------------------------------------------------------]

[编号:76]
[名称:]
[类型:EXE关联]
[内容:"%1" %*]

[编号:77]
[名称:]
[类型:TXT关联]
[内容:%SystemRoot%\system32\NOTEPAD.EXE %1]

[编号:78]
[名称:]
[类型:vbs关联]
[内容:%SystemRoot%\System32\WScript.exe "%1" %*]

[编号:79]
[名称:]
[类型:Js关联]
[内容:%SystemRoot%\System32\WScript.exe "%1" %*]

[编号:80]
[名称:]
[类型:htmlfile关联]
[内容:"C:\Program Files\Internet Explorer\iexplore.exe" -nohome]

[编号:81]
[名称:]
[类型:HTTP协议]
[内容:"C:\Program Files\Internet Explorer\iexplore.exe" -nohome]

[编号:82]
[名称:]
[类型:FTP协议]
[内容:"C:\Program Files\Internet Explorer\iexplore.exe" %1]

[编号:83]
[分隔符:---------------------------------------------------------------------]

[编号:84]
[名称:c:\windows\system32\deskpan.dll]
[类型:第三方 COM/ActiveX组件]
[内容:显示摇曳 CPL 扩展---发布公司:未知]

[编号:85]
[名称:c:\windows\system32\recncl.dll]
[类型:第三方 COM/ActiveX组件]
[内容:Reconciliation interface ProxyStub Factory---发布公司:未知]

[编号:86]
[名称:c:\windows\system32\msir3jp.dll]
[类型:第三方 COM/ActiveX组件]
[内容:Japanese_Default Word Breaker Resources---发布公司:未知]

[编号:87]
[名称:c:\windows\system32\msir3jp.dll]
[类型:第三方 COM/ActiveX组件]
[内容:Japanese_Default Stemmer Resources---发布公司:未知]

瑞星卡卡安全论坛