电脑启动项扫描的日志请高手帮忙分析一下谢谢了 bbs.ikaka.com

杭航 - 2006-5-20 16:26:00

Running processes:

C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
D:\Program Files\游戏文件夹\Rising\Rising\Rav\CCenter.exe
C:\WINDOWS\System32\svchost.exe
D:\Program Files\游戏文件夹\Rising\Rising\Rav\Ravmond.exe
d:\program files\游戏文件夹\rising\rfw\rfwsrv.exe
C:\WINDOWS\system32\spoolsv.exe
D:\Program Files\游戏文件夹\Rising\Rising\Rav\RavStub.exe
d:\program files\游戏文件夹\rising\rfw\RfwMain.exe
D:\Program Files\游戏文件夹\Rising\Rising\Rav\RavTask.exe
D:\Program Files\游戏文件夹\Rising\Rising\Rav\Ravmon.exe
C:\Program Files\HuaCi\huaci\zsearch.exe
C:\WINDOWS\system32\rundll32.exe
C:\Program Files\HuaCi\huaci\ZsUp.exe
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\System32\nvsvc32.exe
C:\Program Files\INTERNET EXPLORER\IEXPLORE.EXE
D:\Program Files\游戏文件夹\我的文件\qq\TIMPlatform.exe
D:\Program Files\游戏文件夹\我的文件\qq\QQ.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\explorer.exe
D:\Program Files\游戏文件夹\TT\TTraveler.exe
D:\Program Files\游戏文件夹\hijackthis1.97_qoo\HijackThis.exe
Checking Windows NT UserInit:

[HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
UserInit = userinit.exe

--------------------------------------------------

Autorun entries from Registry:
HKLM\Software\Microsoft\Windows\CurrentVersion\Run

RfwMain = "D:\Program Files\游戏文件夹\Rising\Rfw\rfwmain.exe" -Startup
RavTask = "D:\Program Files\游戏文件夹\Rising\Rising\Rav\RavTask.exe" -system
pspcsmt = C:\WINDOWS\system32\pspcsmt.exe
MoveSearch = C:\Program Files\HuaCi\huaci\zsearch.exe
spoolsv = C:\WINDOWS\system32\spoolsv\spoolsv.exe -printer
Desktop = C:\WINDOWS\system32\rundll32.exe "C:\Program Files\DeskAdTop\Run.dll" ,Rundll

--------------------------------------------------

Autorun entries from Registry:
HKCU\Software\Microsoft\Windows\CurrentVersion\Run

ctfmon.exe = C:\WINDOWS\system32\ctfmon.exe
IE广告窗口关闭器 = D:\Program Files\游戏文件夹\注册表终结者\注册表终结者\NoAD.exe
IE广告窗口杀手 = D:\Program Files\游戏文件夹\注册表终结者\注册

--------------------------------------------------

Autorun entries in Registry subkeys of:
HKLM\Software\Microsoft\Windows\CurrentVersion\Run

[OptionalComponents]
*No values found*

[RsAutorunsDisabled]
stup.exe = C:\PROGRA~1\TENCENT\Adplus\stup.exe
TkBellExe = "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot

--------------------------------------------------

杭航 - 2006-5-20 16:27:00

Enumerating Active Setup stub paths:
HKLM\Software\Microsoft\Active Setup\Installed Components
(* = disabled by HKCU twin)

[>{22d6f312-b0f6-11d0-94ab-0080c74c7e95}]
StubPath = C:\WINDOWS\inf\unregmp2.exe /ShowWMP

[>{26923b43-4d38-484f-9b9e-de460746276c}] *
StubPath = %systemroot%\system32\shmgrate.exe OCInstallUserConfigIE

[>{881dd1c5-3dcf-431b-b061-f3f88e8be88a}] *
StubPath = %systemroot%\system32\shmgrate.exe OCInstallUserConfigOE

[{2C7339CF-2B09-4501-B3F3-F3508C9228ED}] *
StubPath = %SystemRoot%\system32\regsvr32.exe /s /n /i:/UserInstall %SystemRoot%\system32\themeui.dll

[{44BBA840-CC51-11CF-AAFA-00AA00B6015C}] *
StubPath = "%ProgramFiles%\Outlook Express\setup50.exe" /APP:OE /CALLER:WINNT /user /install

[{7790769C-0471-11d2-AF11-00C04FA35D02}] *
StubPath = "%ProgramFiles%\Outlook Express\setup50.exe" /APP:WAB /CALLER:WINNT /user /install

[{89820200-ECBD-11cf-8B85-00AA005B4340}] *
StubPath = regsvr32.exe /s /n /i:U shell32.dll

[{89820200-ECBD-11cf-8B85-00AA005B4383}] *
StubPath = %SystemRoot%\system32\ie4uinit.exe

[{89B4C1CD-B018-4511-B0A1-5476DBF70820}] *
StubPath = C:\WINDOWS\system32\Rundll32.exe C:\WINDOWS\system32\mscories.dll,Install

--------------------------------------------------

Shell & screensaver key from C:\WINDOWS\SYSTEM.INI:

Shell=*INI section not found*
SCRNSAVE.EXE=*INI section not found*
drivers=*INI section not found*

Shell & screensaver key from Registry:

Shell=Explorer.exe
SCRNSAVE.EXE=C:\WINDOWS\NIKEFO~1.SCR
drivers=*Registry value not found*

Policies Shell key:

HKCU\..\Policies: Shell=*Registry value not found*
HKLM\..\Policies: Shell=*Registry value not found*

--------------------------------------------------

Checking for EXPLORER.EXE instances:

C:\WINDOWS\Explorer.exe: PRESENT!

C:\Explorer.exe: not present
C:\WINDOWS\Explorer\Explorer.exe: not present
C:\WINDOWS\System\Explorer.exe: not present
C:\WINDOWS\System32\Explorer.exe: not present
C:\WINDOWS\Command\Explorer.exe: not present
C:\WINDOWS\Fonts\Explorer.exe: not present

--------------------------------------------------

Checking for superhidden extensions:

.lnk: HIDDEN! (arrow overlay: yes)
.pif: HIDDEN! (arrow overlay: yes)
.exe: not hidden
.com: not hidden
.bat: not hidden
.hta: not hidden
.scr: not hidden
.shs: HIDDEN!
.shb: HIDDEN!
.vbs: not hidden
.vbe: not hidden
.wsh: not hidden
.scf: HIDDEN! (arrow overlay: NO!)
.url: HIDDEN! (arrow overlay: yes)
.js: not hidden
.jse: not hidden

--------------------------------------------------

Enumerating Browser Helper Objects:

(no name) - C:\PROGRA~1\DESKAD~1\deskipn.dll - {08A312BB-5409-49FC-9347-54BB7D069AC6}
wmpdrm - C:\WINDOWS\system32\wmpdrm.dll - {0E674588-66B7-4E19-9D0E-2053B800F69F}
(no name) - C:\WINDOWS\Downlo~1\uy2q4e2.dll - {3CE496D1-1746-41CD-9489-3C0B93DF10E2}
网络加速 - C:\WINDOWS\system32\MicrosoftNet.dll - {5673A7C0-95CC-4646-BB07-3BD71234CEF9}
(no name) - c:\program files\google\googletoolbar1.dll (file missing) - {AA58ED58-01DD-4d91-8333-CF10577473F7}
(no name) - D:\PROGRA~1\游戏文~1\MagicSet\HAOKAN~1.DLL - {FEDF637B-F631-4583-A210-33CC828D42DB}

--------------------------------------------------

菰僤啲嫙箻 - 2006-5-20 16:27:00

顶..不要意思啊.我不懂啊

杭航 - 2006-5-20 16:28:00

Enumerating Task Scheduler jobs:

Symantec NetDetect.job

--------------------------------------------------

Enumerating Download Program Files:

[CEditCtrl Object]
InProcServer32 = C:\WINDOWS\system32\aliedit\AliEdit.dll
CODEBASE = https://img.alipay.com/download/1007/aliedit.cab

[{4AF6677A-373A-4BB9-BD9F-6196B6FC35B3}]
CODEBASE = http://bb.qq.com/media/QQTVOcxSetup.exe

[Downloader Class]
InProcServer32 = C:\WINDOWS\system32\iMopDl.dll
CODEBASE = http://eacs.eqifa.com/mop/iMopDl.cab

[WUWebControl Class]
InProcServer32 = C:\WINDOWS\System32\wuweb.dll
CODEBASE = http://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1123149542484

[QiconInstallerVer1 Control]
InProcServer32 = C:\WINDOWS\DOWNLO~1\QICONI~1.OCX
CODEBASE = http://qicon.cn/setup/QiconInstallerVer1.cab

[Filetran Control]
InProcServer32 = D:\PROGRA~1\游戏文~1\BLUESK~1\filetran.ocx
CODEBASE = http://www.bluesky.cn/download/filetran.cab

[Blueskyvoice Control]
InProcServer32 = D:\PROGRA~1\游戏文~1\BLUESK~1\BLUESK~2.OCX
CODEBASE = http://www.bluesky.cn/download/blueskyvoice_60.cab

[Submit Class]
InProcServer32 = C:\WINDOWS\Downloaded Program Files\safein.dll
CODEBASE = https://pbank.95559.com.cn/personbank/ocx/safe.cab

[photo_uploader Control]
InProcServer32 = C:\WINDOWS\DOWNLO~1\PHOTO_~1.OCX
CODEBASE = http://upload.photo.163.com/photoup.cab

[Chaos Filter]
InProcServer32 = C:\WINDOWS\system32\chaos.ax
CODEBASE = http://download.mysee.com/Chaos.cab

[Qzone Media Tools]
InProcServer32 = D:\PROGRA~1\游戏文~1\我的文件\qq\VQQPLA~1.OCX
CODEBASE = http://imgcache.qq.com/music/QQMusicSetup.exe

[MsnMessengerSetupDownloadControl Class]
InProcServer32 = C:\WINDOWS\Downloaded Program Files\MsnMessengerSetupDownloader.ocx
CODEBASE = http://messenger.msn.com/download/MsnMessengerSetupDownloader.cab

[WebActivater Control]
InProcServer32 = C:\WINDOWS\system32\3DShowVM.ocx
CODEBASE = http://dl_dir.qq.com/3dshow/3DShowVM.cab

[Shockwave Flash Object]
InProcServer32 = C:\WINDOWS\system32\Macromed\Flash\Flash8.ocx
CODEBASE = http://fpdownload.macromedia.com/pub/shockwave/cabs/flash/swflash.cab

[Ravonline]
InProcServer32 = C:\WINDOWS\Downloaded Program Files\RsOnline.dll
CODEBASE = http://download.rising.com.cn/QQ/QQkill/rsonline.cab

[QPicControl Control]
InProcServer32 = C:\WINDOWS\system32\QPic\qpic.ocx
CODEBASE = http://dl_dir.qq.com/c2c_file/qpic.cab

[Rising Web Scan Object]
InProcServer32 = C:\WINDOWS\Downloaded Program Files\OL2005.dll
CODEBASE = http://download.rising.com.cn/register/pcver/autoupgradepad/pcver2006new/OL2006.cab

[CPasswordEditCtrl Object]
InProcServer32 = C:\WINDOWS\system32\qqedit\qqedit.dll
CODEBASE = https://tenpay.qq.com/download/qqedit.cab

--------------------------------------------------

Enumerating Windows NT/2000/XP services

Alerter: %SystemRoot%\System32\svchost.exe -k LocalService (autostart)
Windows Audio: %SystemRoot%\System32\svchost.exe -k netsvcs (autostart)
Rising TDI Base Driver: System32\DRIVERS\BaseTDI.SYS (autostart)
Computer Browser: %SystemRoot%\System32\svchost.exe -k netsvcs (autostart)
Cryptographic Services: %SystemRoot%\system32\svchost.exe -k netsvcs (autostart)
DCOM 服务器进程启动器: %SystemRoot%\system32\svchost -k DcomLaunch (autostart)
DHCP Client: %SystemRoot%\System32\svchost.exe -k netsvcs (autostart)
Logical Disk Manager: %SystemRoot%\System32\svchost.exe -k netsvcs (autostart)
DNS Client: %SystemRoot%\System32\svchost.exe -k NetworkService (autostart)
Event Log: %SystemRoot%\system32\services.exe (autostart)
ExpScaner: \??\D:\Program Files\游戏文件夹\Rising\Rising\Rav\ExpScan.sys (autostart)
Fallback: System32\DRIVERS\HSF_FALL.sys (autostart)
Fsks: System32\DRIVERS\HSF_FSKS.sys (autostart)
Help and Support: %SystemRoot%\System32\svchost.exe -k netsvcs (autostart)
HookCont: \??\D:\Program Files\游戏文件夹\Rising\Rising\Rav\HOOKCONT.sys (autostart)
HookReg: \??\D:\Program Files\游戏文件夹\Rising\Rising\Rav\HookReg.sys (autostart)
HookSys: \??\D:\Program Files\游戏文件夹\Rising\Rising\Rav\HookSys.sys (autostart)
HookUrl: \??\D:\Program Files\游戏文件夹\Rising\Rfw\HookUrl.sys (autostart)
K56: System32\DRIVERS\HSF_K56K.sys (autostart)
Server: %SystemRoot%\System32\svchost.exe -k netsvcs (autostart)
Workstation: %SystemRoot%\System32\svchost.exe -k netsvcs (autostart)
TCP/IP NetBIOS Helper: %SystemRoot%\System32\svchost.exe -k LocalService (autostart)
mdmxsdk: System32\DRIVERS\mdmxsdk.sys (autostart)
MEMSCAN: \??\D:\Program Files\游戏文件夹\Rising\Rising\Rav\MEMSCAN.sys (autostart)
mProcRs: \??\d:\program files\游戏文件夹\rising\rfw\mProcRs.sys (autostart)
Networks DDE: C:\WINDOWS\svchsot.exe (autostart)
New0: \??\C:\WINDOWS\system32\new.sys (autostart)
npkcrypt: \??\D:\Program Files\游戏文件夹\我的文件\qq\npkcrypt.sys (autostart)
NVIDIA Display Driver Service: %SystemRoot%\System32\nvsvc32.exe (autostart)
Plug and Play: %SystemRoot%\system32\services.exe (autostart)
IPSEC Services: %SystemRoot%\System32\lsass.exe (autostart)
HTTP Secure Manager: %SystemRoot%\System32\svchost.exe -k netsvcs (autostart)
Protected Storage: %SystemRoot%\system32\lsass.exe (autostart)
Rising Personal Firewall Service: d:\program files\游戏文件夹\rising\rfw\rfwsrv.exe (autostart)
Remote Procedure Call (RPC): %SystemRoot%\system32\svchost -k rpcss (autostart)
Rising Process Communication Center: "D:\Program Files\游戏文件夹\Rising\Rising\Rav\CCenter.exe" (autostart)
RsFwDrv: \??\D:\Program Files\游戏文件夹\Rising\Rfw\RsFwDrv.sys (autostart)
RsRavMon Service: "D:\Program Files\游戏文件夹\Rising\Rising\Rav\Ravmond.exe" (autostart)
Security Accounts Manager: %SystemRoot%\system32\lsass.exe (autostart)
Task Scheduler: %SystemRoot%\System32\svchost.exe -k netsvcs (autostart)
Secondary Logon: %SystemRoot%\System32\svchost.exe -k netsvcs (autostart)
System Event Notification: %SystemRoot%\system32\svchost.exe -k netsvcs (autostart)
Windows Firewall/Internet Connection Sharing (ICS): %SystemRoot%\System32\svchost.exe -k netsvcs (autostart)
Shell Hardware Detection: %SystemRoot%\System32\svchost.exe -k netsvcs (autostart)
SoftFax: System32\DRIVERS\HSF_FAXX.sys (autostart)
Print Spooler: %SystemRoot%\system32\spoolsv.exe (autostart)
System Restore Service: %SystemRoot%\System32\svchost.exe -k netsvcs (autostart)
SVKP: \??\C:\WINDOWS\system32\SVKP.sys (autostart)
SymWMI Service: C:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exe (autostart)
Themes: %SystemRoot%\System32\svchost.exe -k netsvcs (autostart)
Tones: System32\DRIVERS\HSF_TONE.sys (autostart)
Distributed Link Tracking Client: %SystemRoot%\system32\svchost.exe -k netsvcs (autostart)
Windows User Mode Driver Framework: C:\WINDOWS\System32\wdfmgr.exe (autostart)
V124: System32\DRIVERS\HSF_V124.sys (autostart)
Windows Time: %SystemRoot%\System32\svchost.exe -k netsvcs (autostart)
WebClient: %SystemRoot%\System32\svchost.exe -k LocalService (autostart)
Windows Management Instrumentation: %systemroot%\system32\svchost.exe -k netsvcs (autostart)
Security Center: %SystemRoot%\System32\svchost.exe -k netsvcs (autostart)
Automatic Updates: %systemroot%\system32\svchost.exe -k netsvcs (autostart)
Wireless Zero Configuration: %SystemRoot%\System32\svchost.exe -k netsvcs (autostart)
XPROTECTOR: \??\C:\WINDOWS\system32\drivers\Xprotector.sys (autostart)

--------------------------------------------------

Enumerating ShellServiceObjectDelayLoad items:

PostBootReminder: C:\WINDOWS\system32\SHELL32.dll
CDBurn: C:\WINDOWS\system32\SHELL32.dll
WebCheck: C:\WINDOWS\system32\webcheck.dll
SysTray: C:\WINDOWS\System32\stobject.dll

--------------------------------------------------
End of report, 14,465 bytes
Report generated in 0.203 seconds

Command line options:
/verbose - to add additional info on each section
/complete - to include empty sections and unsuspicious data
/full - to include several rarely-important sections
/force9x - to include Win9x-only startups even if running on WinNT
/forcent - to include WinNT-only startups even if running on Win9x
/forceall - to include all Win9x and WinNT startups, regardless of platform
/history - to list version history only

瑞星卡卡安全论坛