瑞星卡卡安全论坛

2006-09-13,13:52:29

System Repair Engineer 2.0.21.505 (2.0 RC 2)
Smallfrogs (http://www.KZTechs.com)

Windows Server 2003 Enterprise Edition  (Build 3790)
- 管理权限用户 - 完整功能

以下内容被选中：
    所有的启动项目（包括注册表、启动文件夹、服务等）
    浏览器加载项
    正在运行的进程（包括进程模块信息）
    文件关联


启动项目
注册表
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
    <ctfmon.exe><C:\WINDOWS\system32\ctfmon.exe>  [Microsoft Corporation]
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\RunServices]
    <MSDN for Windows with NT's><msdn-nt.exe>  []
[HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows]
    <load><>  []
    <run><>  []
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
    <IMJPMIG8.1><"C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32>  [Microsoft Corporation]
    <PHIME2002ASync><C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC>  [Microsoft Corporation]
    <PHIME2002A><C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName>  [Microsoft Corporation]
    <RavTray><"C:\Program Files\Rising\Rav\RavTray.exe">  [Rising]
    <IMSCMig><C:\PROGRA~1\COMMON~1\MICROS~1\IME\IMSC40A\IMSCMIG.EXE /Preload>  [Microsoft Corporation]
    <RavTask><"C:\Program Files\Rising\Rav\RavTask.exe" -system>  [Beijing Rising Technology Co., Ltd.]
    <ShutdownEventCheck><%systemroot%\system32\dumprep 0 -s>  []
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunServices]
    <MSDN for Windows with NT's><msdn-nt.exe>  []
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
    <shell><Explorer.exe>  [Microsoft Corporation]
    <Userinit><userinit.exe,>  [Microsoft Corporation]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Windows]
    <AppInit_DLLs><>  []
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
    <UIHost><%SystemRoot%\system32\logonui.exe>  [Microsoft Corporation]
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    <MsnMsgr><; "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background>  [Microsoft Corporation]

==================================

启动文件夹
[服务管理器]
  <C:\Documents and Settings\All Users\「开始」菜单\程序\启动\服务管理器.lnk><N>
[通达应用服务监视器]
  <C:\Documents and Settings\All Users\「开始」菜单\程序\启动\通达应用服务监视器.lnk><N>

==================================
服务
[IMA_Server / IMA_Server]
  <D:\MYOA\IMA\IMAServer.exe><N/A>
[MeChat / MeChat]
  <D:\MYOA\MeChat\MeChat.exe><N/A>
[MySQL_OA / MySQL_OA]
  <D:\MYOA\mysql\bin\mysqld-nt.exe MySQL_OA><N/A>
[Office_Anywhere / Office_Anywhere]
  <"D:\MYOA\bin\apache.exe" -k runservice><Apache Software Foundation>
[Rav Net Agent / RavAgent]
  <C:\Program Files\Rising\Rav\RavAgent.exe><北京瑞星科技股份有限公司>
[Rav Net Alert / RavAlert]
  <C:\Program Files\Rising\Rav\RavAlert.exe><瑞星科技股份发展有限公司>
[RavService / RavService]
  <"C:\Program Files\Rising\Rav\RavService.exe" /service><Beijing Rising Technology Co., Ltd.>
[RavUpdate / RavUpdate]
  <"C:\Program Files\Rising\Rav\RavUpdate.exe" ><Beijing Rising Technology Co., Ltd.>
[RNReport / RNReport]
  <"C:\Program Files\Rising\Rav\RNReport.exe"><瑞星科技股份发展有限公司>
[Remote Packet Capture Protocol v.0 (experimental) / rpcapd]
  <"C:\Program Files\WinPcap\rpcapd.exe" -d -f "C:\Program Files\WinPcap\rpcapd.ini"><N/A>
[Rising Process Communication Center / RsCCenter]
  <C:\PROGRAM FILES\RISING\RAV\CCENTER.EXE><Beijing Rising Technology Co., Ltd.>
[RsRavMon Service / RsRavMon]
  <"C:\Program Files\Rising\Rav\Ravmond.exe"><Beijing Rising Technology Co., Ltd.>
[Windows help / Windows help服务]
  <C:\WINDOWS\system32\winhe1p.exe><N/A>

==================================

浏览器加载项
[AlxTB BHO Class]
  {F1FABE79-25FC-46de-8C5A-2C6DB9D64333} <C:\WINDOWS\system32\AlxTB1.dll, Alexa Internet>
[@shdoclc.dll,-866]
  {c95fe080-8f5d-11d2-a20b-00aa003c157a} <, N/A>
[@msdxmLC.dll,-1@2052,电台(&R)]
  {8E718888-423F-11D2-876E-00A0C9082467} <C:\WINDOWS\system32\msdxm.ocx, Microsoft Corporation>
[Alexa]
  {3CEFF6CD-6F08-4e4d-BCCD-FF7415288C3B} <C:\WINDOWS\system32\SHDOCVW.DLL, Microsoft Corporation>
[Edit Class]
  {0CA54D3F-CEAE-48AF-9A2B-31909CB9515D} <C:\WINDOWS\system32\CMBEdit.dll, >
[Shockwave Flash Object]
  {D27CDB6E-AE6D-11CF-96B8-444553540000} <C:\WINDOWS\system32\Macromed\Flash\Flash8b.ocx, Macromedia, Inc.>
[导出到 Microsoft Office Excel(&X)]
  <res://C:\PROGRA~1\MICROS~1\OFFICE11\EXCEL.EXE/3000, N/A>

[D:\MYOA\modules\mod_cgi.so]  <Apache Software Foundation><2.0.54>
    [D:\MYOA\modules\mod_isapi.so]  <Apache Software Foundation><2.0.54>
    [D:\MYOA\bin\sapi\php4apache2.dll]  <N/A><N/A>
    [D:\MYOA\bin\php4ts.dll]  <The PHP Group><4.3.10.10>
    [D:\MYOA\bin\mmcache.dll]  <N/A><N/A>
    [D:\MYOA\bin\ZendOptimizer.dll]  <N/A><N/A>
    [D:\MYOA\bin\php_gd2.dll]  <N/A><N/A>
    [D:\MYOA\bin\php_iconv.dll]  <N/A><N/A>
    [D:\MYOA\bin\iconv.dll]  <Free Software Foundation><1.9>


==================================

没有一个帮忙的？

帮个忙~

C:\WINDOWS\system32\winhe1p.exe

日志贴全。。。楼上的偶见你老是找一个出来，解决方法都不写。。。灌水嫌疑哦

引用:

【deadmanzj的贴子】日志贴全。。。楼上的偶见你老是找一个出来，解决方法都不写。。。灌水嫌疑哦 ………………

误会误会..因为觉得这项有点嫌疑.所以先指出来.待更有经验的人来证实..我则去网上查查