中毒9505，日志附上，救我！ - 瑞星卡卡安全论坛bbs.ikaka.com

瑞星卡卡安全论坛技术交流区 反病毒/反流氓软件论坛中毒9505，日志附上，救我！

	瑞星“1+2”全新解决方案巡展在广州画上圆满句号		叶院长揭秘：瑞星如何运用AI技术革新网络安全		俄乌冲突加剧网络攻击风险白俄罗斯政府遭APT攻击		瑞星ESM防病毒系统助力矿业大学筑牢网络安全防线
	实力拉满瑞星第五十次通过VB100测评		携手老友，拥抱新精彩 —— 新论坛新活动，感谢你的陪伴		护航司法，瑞星助力山西省高院构建安全防线		人工智能在网络安全领域的风险和机遇

5 / 6 页

跳转页

中毒9505，日志附上，救我！

looye2004 初生襁褓狮帖子:65 注册: 2006-10-07 来自:	发表于： 2006-10-08 22:30 \| 只看楼主短消息资料字号：小中大 41楼 [ShellExecuteHooks] 1_HKey=HKEY_LOCAL_MACHINE 1_Key=SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks 1_Name={AEB6717E-7E19-11d0-97EE-00C04FD91972} 1_ClsidName=URL 执行挂钩 1_FileName=C:\WINDOWS\system32\shell32.dll 1_FileSize=8241664 1_FileDate=2004-8-23 16:00:00 Max=1 [ShellServiceObjectDelayLoad] 1_HKey=HKEY_LOCAL_MACHINE 1_Key=SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad 1_Name=PostBootReminder 1_Value={7849596a-48ea-486e-8937-a2a3009f31a9} 1_ClsidName=PostBootReminder 对象 1_FileName=%SystemRoot%\system32\SHELL32.dll 1_FileSize=8241664 1_FileDate=2004-8-23 16:00:00 2_HKey=HKEY_LOCAL_MACHINE 2_Key=SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad 2_Name=CDBurn 2_Value={fbeb8a05-beee-4442-804e-409d6c4515e9} 2_ClsidName=烧 CD 的 ShellFolder 2_FileName=%SystemRoot%\system32\SHELL32.dll 2_FileSize=8241664 2_FileDate=2004-8-23 16:00:00 3_HKey=HKEY_LOCAL_MACHINE 3_Key=SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad 3_Name=WebCheck 3_Value={E6FB5E20-DE35-11CF-9C87-00AA005127ED} 3_ClsidName=WebCheck 3_FileName=%SystemRoot%\system32\webcheck.dll 3_FileSize=265728 3_FileDate=2004-8-23 16:00:00 4_HKey=HKEY_LOCAL_MACHINE 4_Key=SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad 4_Name=SysTray 4_Value={35CEC8A3-2BE6-11D2-8773-92E220524153} 4_ClsidName=SysTray 4_FileName=C:\WINDOWS\system32\stobject.dll 4_FileSize=121344 4_FileDate=2004-8-23 16:00:00 Max=4
looye2004 初生襁褓狮帖子:65 注册: 2006-10-07 来自:

looye2004 初生襁褓狮帖子:65 注册: 2006-10-07 来自:	发表于： 2006-10-08 22:31 \| 只看楼主短消息资料字号：小中大 42楼 [SharedTaskScheduler] 1_HKey=HKEY_LOCAL_MACHINE 1_Key=SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler 1_Name={438755C2-A8BA-11D1-B96B-00A0C90312E1} 1_Value=Browseui 预加载程序 1_FileName=%SystemRoot%\system32\browseui.dll 1_FileSize=1016832 1_FileDate=2004-9-30 2:48:08 2_HKey=HKEY_LOCAL_MACHINE 2_Key=SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler 2_Name={8C7461EF-2B13-11d2-BE35-3078302C2030} 2_Value=组件类别缓存程序 2_FileName=%SystemRoot%\system32\browseui.dll 2_FileSize=1016832 2_FileDate=2004-9-30 2:48:08 Max=2 [ProtocolDefaults] 1_HKey=HKEY_LOCAL_MACHINE 1_Key=SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProtocolDefaults 1_Name=http 1_Value=3 2_HKey=HKEY_LOCAL_MACHINE 2_Key=SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProtocolDefaults 2_Name=https 2_Value=3 3_HKey=HKEY_LOCAL_MACHINE 3_Key=SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProtocolDefaults 3_Name=ftp 3_Value=3 4_HKey=HKEY_LOCAL_MACHINE 4_Key=SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProtocolDefaults 4_Name=file 4_Value=3 5_HKey=HKEY_LOCAL_MACHINE 5_Key=SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProtocolDefaults 5_Name=@ivt 5_Value=1 6_HKey=HKEY_LOCAL_MACHINE 6_Key=SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProtocolDefaults 6_Name=shell 6_Value=0 Max=6 [BootExecute] 1_HKey=HKEY_LOCAL_MACHINE 1_Key=SYSTEM\CurrentControlSet\Control\Session Manager 1_Name=BootExecute 1_Value=autocheck autochk * Max=1
looye2004 初生襁褓狮帖子:65 注册: 2006-10-07 来自:

looye2004 初生襁褓狮帖子:65 注册: 2006-10-07 来自:	发表于： 2006-10-08 22:31 \| 只看楼主短消息资料字号：小中大 43楼 [AutoRun] 1_HKey=HKEY_LOCAL_MACHINE 1_Key=Software\Microsoft\Windows\CurrentVersion\Run 1_Name=RavTask 1_Value="c:\program files\rising\rav\ravtask.exe" -system 1_FileSize=114688 1_FileDate=2005-12-28 20:51:50 1_FileVersion=18.0.0.22 2_HKey=HKEY_LOCAL_MACHINE 2_Key=Software\Microsoft\Windows\CurrentVersion\Run 2_Name=ControlCenter2.0 2_Value=; c:\program files\brother\controlcenter2\brctrcen.exe /autorun 2_FileSize=864256 2_FileDate=2005-1-7 17:30:56 2_FileVersion=2.0.15.7 3_HKey=HKEY_LOCAL_MACHINE 3_Key=Software\Microsoft\Windows\CurrentVersion\Run 3_Name=IMJPMIG8.1 3_Value=; "c:\windows\ime\imjp8_1\imjpmig.exe" /spoil /remadvdef /migration32 3_FileSize=208952 3_FileDate=2004-8-24 3_FileVersion=8.1.4202.0 4_HKey=HKEY_LOCAL_MACHINE 4_Key=Software\Microsoft\Windows\CurrentVersion\Run 4_Name=PHIME2002A 4_Value=; c:\windows\system32\ime\tintlgnt\tintsetp.exe /imename 4_FileSize=455168 4_FileDate=2004-8-24 4_FileVersion=5.2.0.2801 5_HKey=HKEY_LOCAL_MACHINE 5_Key=Software\Microsoft\Windows\CurrentVersion\Run 5_Name=PHIME2002ASync 5_Value=; c:\windows\system32\ime\tintlgnt\tintsetp.exe /sync 5_FileSize=455168 5_FileDate=2004-8-24 5_FileVersion=5.2.0.2801 6_HKey=HKEY_LOCAL_MACHINE 6_Key=Software\Microsoft\Windows\CurrentVersion\Run 6_Name=POPO2004 6_Value=; 7_HKey=HKEY_LOCAL_MACHINE 7_Key=Software\Microsoft\Windows\CurrentVersion\Run 7_Name=RfwMain 7_Value=; c:\program files\rising\rfw\rfwmain.exe 7_FileSize=163840 7_FileDate=2006-9-23 21:08:28 7_FileVersion= 8_HKey=HKEY_LOCAL_MACHINE 8_Key=Software\Microsoft\Windows\CurrentVersion\Run 8_Name=SetDefPrt 8_Value=; c:\program files\brother\brmfl04g\brstdvpt.exe 8_FileSize=49152 8_FileDate=2004-11-11 17:14:38 8_FileVersion=1.0.1.1 9_HKey=HKEY_LOCAL_MACHINE 9_Key=Software\Microsoft\Windows\CurrentVersion\Run 9_Name=SysExplr 9_Value=; c:\herosoft\herov8\sysexplr.exe 9_FileSize=172032 9_FileDate=2005-3-14 10:33:24 9_FileVersion= 10_HKey=HKEY_LOCAL_MACHINE 10_Key=Software\Microsoft\Windows\CurrentVersion\Run 10_Name=TkBellExe 10_Value=; "c:\program files\common files\real\update_ob\realsched.exe" -osboot 10_FileSize=180269 10_FileDate=2005-7-16 0:14:20 10_FileVersion=0.1.0.3292 11_HKey=HKEY_LOCAL_MACHINE 11_Key=Software\Microsoft\Windows\CurrentVersion\Run 11_Name=VTTimer 11_Value=; vttimer.exe 12_HKey=HKEY_LOCAL_MACHINE 12_Key=Software\Microsoft\Windows\CurrentVersion\RunOnce 12_Name=RavStub 12_Value="c:\program files\rising\rav\ravstub.exe" /runonce 12_FileSize=90112 12_FileDate=2006-6-22 14:29:00 12_FileVersion=18.0.0.16 13_HKey=HKEY_LOCAL_MACHINE 13_Key=Software\Microsoft\Windows NT\CurrentVersion\Windows 13_Name=load 13_Value= 14_HKey=HKEY_CURRENT_USER 14_Key=Software\Microsoft\Windows\CurrentVersion\Run 14_Name=ctfmon.exe 14_Value=c:\windows\system32\ctfmon.exe 14_FileSize=15360 14_FileDate=2004-8-23 16:00:00 14_FileVersion=5.1.2600.2180 15_HKey=HKEY_CURRENT_USER 15_Key=Software\Microsoft\Windows NT\CurrentVersion\Windows 15_Name=load 15_Value= 16_HKey=HKEY_CURRENT_USER 16_Key=SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\Run 16_Name=run 16_Value= Max=16
looye2004 初生襁褓狮帖子:65 注册: 2006-10-07 来自:

looye2004 初生襁褓狮帖子:65 注册: 2006-10-07 来自:	发表于： 2006-10-08 22:32 \| 只看楼主短消息资料字号：小中大 44楼 [ModuleUsage] 1_HKey=HKEY_LOCAL_MACHINE 1_Key=SOFTWARE\Microsoft\Windows\CurrentVersion\ModuleUsage\C:/Program Files/Tencent/qq/mfc42.dll 1_Name=.Owner 1_Value=Unknown Owner 1_Clsid= 1_FileName=C:\Program Files\Tencent\qq\mfc42.dll 1_FileSize=995383 1_FileDate=2005-6-14 10:21:40 1_FileVersion=6.0.8665.0 2_HKey=HKEY_LOCAL_MACHINE 2_Key=SOFTWARE\Microsoft\Windows\CurrentVersion\ModuleUsage\C:/WINDOWS/Downloaded Program Files/MsnPUpld.dll 2_Name=.Owner 2_Value={4F1E5B1A-2A80-42CA-8532-2D05CB959537} 2_Clsid=MSN Photo Upload Tool 2_FileName=C:\WINDOWS\Downloaded Program Files\MsnPUpld.dll 2_FileSize=379704 2_FileDate=2006-6-20 15:44:04 2_FileVersion=10.0.913.0 3_HKey=HKEY_LOCAL_MACHINE 3_Key=SOFTWARE\Microsoft\Windows\CurrentVersion\ModuleUsage\C:/WINDOWS/Downloaded Program Files/OL2005.dll 3_Name=.Owner 3_Value={E4E2F180-CB8B-4DE9-ACBB-DA745D3BA153} 3_Clsid=Rising Web Scan Object 3_FileName=C:\WINDOWS\Downloaded Program Files\OL2005.dll 3_FileSize=278528 3_FileDate=2006-2-13 15:57:38 3_FileVersion=18.0.0.6 4_HKey=HKEY_LOCAL_MACHINE 4_Key=SOFTWARE\Microsoft\Windows\CurrentVersion\ModuleUsage\C:/WINDOWS/Downloaded Program Files/PowerPlr.ocx 4_Name=.Owner 4_Value={2354A44B-3CEB-4829-9940-545B03103538} 4_Clsid=PowerPlr Control 4_FileName=C:\WINDOWS\Downloaded Program Files\PowerPlr.ocx 4_FileSize=207080 4_FileDate=2005-6-22 21:36:34 4_FileVersion=3.2.0.0 5_HKey=HKEY_LOCAL_MACHINE 5_Key=SOFTWARE\Microsoft\Windows\CurrentVersion\ModuleUsage\C:/WINDOWS/Downloaded Program Files/PURen-us.dll 5_Name=.Owner 5_Value={4F1E5B1A-2A80-42CA-8532-2D05CB959537} 5_Clsid=MSN Photo Upload Tool 5_FileName=C:\WINDOWS\Downloaded Program Files\PURen-us.dll 5_FileSize=117560 5_FileDate=2006-6-20 15:44:02 5_FileVersion=10.0.913.0 6_HKey=HKEY_LOCAL_MACHINE 6_Key=SOFTWARE\Microsoft\Windows\CurrentVersion\ModuleUsage\C:/WINDOWS/Downloaded Program Files/RsOnline.dll 6_Name=.Owner 6_Value={DA984A6D-508E-11D6-AA49-0050FF3C628D} 6_Clsid=Ravonline 6_FileName=C:\WINDOWS\Downloaded Program Files\RsOnline.dll 6_FileSize=389120 6_FileDate=2004-5-12 16:53:20 6_FileVersion=2.0.3.56 7_HKey=HKEY_LOCAL_MACHINE 7_Key=SOFTWARE\Microsoft\Windows\CurrentVersion\ModuleUsage\C:/WINDOWS/system32/msvcrt.dll 7_Name=.Owner 7_Value=Unknown Owner 7_Clsid= 7_FileName=C:\WINDOWS\system32\msvcrt.dll 7_FileSize=343040 7_FileDate=2004-8-23 16:00:00 7_FileVersion=7.0.2600.2180 8_HKey=HKEY_LOCAL_MACHINE 8_Key=SOFTWARE\Microsoft\Windows\CurrentVersion\ModuleUsage\C:/WINDOWS/system32/olepro32.dll 8_Name=.Owner 8_Value=Unknown Owner 8_Clsid= 8_FileName=C:\WINDOWS\system32\olepro32.dll 8_FileSize=83456 8_FileDate=2004-8-23 16:00:00 8_FileVersion=5.1.2600.2180 9_HKey=HKEY_LOCAL_MACHINE 9_Key=SOFTWARE\Microsoft\Windows\CurrentVersion\ModuleUsage\C:/WINDOWS/system32/WebActivater.ocx 9_Name=.Owner 9_Value={3D8F74EE-8692-4F8F-B8D2-7522E732519E} 9_Clsid=WebActivater Control 9_FileName=C:\WINDOWS\system32\WebActivater.ocx 9_FileSize=266240 9_FileDate=2004-7-23 17:00:20 9_FileVersion=1.0.0.1 Max=9
looye2004 初生襁褓狮帖子:65 注册: 2006-10-07 来自:

looye2004 初生襁褓狮帖子:65 注册: 2006-10-07 来自:	发表于： 2006-10-08 22:32 \| 只看楼主短消息资料字号：小中大 45楼 [Process] 1_FileName=C:\WINDOWS\SYSTEM32\SMSS.EXE 1_FileSize=50688 1_FileDate=2004-8-23 16:00:00 1_FileVersion=5.1.2600.2180 2_FileName=C:\WINDOWS\SYSTEM32\WINLOGON.EXE 2_FileSize=487424 2_FileDate=2004-8-23 16:00:00 2_FileVersion=5.1.2600.2180 3_FileName=C:\WINDOWS\SYSTEM32\SERVICES.EXE 3_FileSize=108032 3_FileDate=2004-8-23 16:00:00 3_FileVersion=5.1.2600.2180 4_FileName=C:\WINDOWS\SYSTEM32\LSASS.EXE 4_FileSize=13312 4_FileDate=2004-8-23 16:00:00 4_FileVersion=5.1.2600.2180 5_FileName=C:\WINDOWS\SYSTEM32\SVCHOST.EXE 5_FileSize=14336 5_FileDate=2004-8-23 16:00:00 5_FileVersion=5.1.2600.2180 6_FileName=C:\PROGRAM FILES\RISING\RAV\CCENTER.EXE 6_FileSize=110592 6_FileDate=2005-12-28 20:51:48 6_FileVersion=18.0.0.3 7_FileName=C:\WINDOWS\SYSTEM32\SVCHOST.EXE 7_FileSize=14336 7_FileDate=2004-8-23 16:00:00 7_FileVersion=5.1.2600.2180 8_FileName=C:\PROGRAM FILES\RISING\RAV\RAVMOND.EXE 8_FileSize=233472 8_FileDate=2006-8-28 14:29:42 8_FileVersion=18.0.1.35 9_FileName=C:\WINDOWS\EXPLORER.EXE 9_FileSize=976896 9_FileDate=2004-8-23 16:00:00 9_FileVersion=6.0.2900.2180 10_FileName=C:\WINDOWS\SYSTEM32\SPOOLSV.EXE 10_FileSize=57856 10_FileDate=2004-8-23 16:00:00 10_FileVersion=5.1.2600.2180 11_FileName=C:\PROGRAM FILES\RISING\RAV\RAVSTUB.EXE 11_FileSize=90112 11_FileDate=2006-6-22 14:29:00 11_FileVersion=18.0.0.16 12_FileName=C:\PROGRAM FILES\RISING\RAV\RAVTASK.EXE 12_FileSize=114688 12_FileDate=2005-12-28 20:51:50 12_FileVersion=18.0.0.22 13_FileName=C:\PROGRAM FILES\RISING\RAV\RAVMON.EXE 13_FileSize=610304 13_FileDate=2006-8-28 14:29:42 13_FileVersion=18.0.1.33 14_FileName=C:\WINDOWS\SYSTEM32\CTFMON.EXE 14_FileSize=15360 14_FileDate=2004-8-23 16:00:00 14_FileVersion=5.1.2600.2180 15_FileName=C:\WINDOWS\SYSTEM32\DRIVERS\CDAC11BA.EXE 15_FileSize=54784 15_FileDate=2006-9-3 20:27:16 15_FileVersion=4.20.20.0 16_FileName=C:\PROGRAM FILES\RISING\RFW\RFWSRV.EXE 16_FileSize=49152 16_FileDate=2006-9-25 9:25:00 16_FileVersion=3.0.0.85 17_FileName=C:\WINDOWS\SYSTEM32\SVCHOST.EXE 17_FileSize=14336 17_FileDate=2004-8-23 16:00:00 17_FileVersion=5.1.2600.2180 18_FileName=C:\WINDOWS\SYSTEM32\CONIME.EXE 18_FileSize=27648 18_FileDate=2004-8-23 16:00:00 18_FileVersion=5.1.2600.2180 19_FileName=C:\WINDOWS\SYSTEM32\SVCHOST.EXE 19_FileSize=14336 19_FileDate=2004-8-23 16:00:00 19_FileVersion=5.1.2600.2180 20_FileName=C:\DOCUMENTS AND SETTINGS\USER\桌面\WINSPEED778BETA\IEHELP.EXE 20_FileSize=737792 20_FileDate=2006-8-31 12:39:22 20_FileVersion=7.78.0.0 21_FileName=C:\WINDOWS\SYSTEM32\NOTEPAD.EXE 21_FileSize=66560 21_FileDate=2004-8-23 16:00:00 21_FileVersion=5.1.2600.2180 22_FileName=C:\WINDOWS\REGEDIT.EXE 22_FileSize=132608 22_FileDate=2004-8-23 16:00:00 22_FileVersion=5.1.2600.2180 23_FileName=[SYSTEM PROCESS] 24_FileName=C:\WINDOWS\system32\CSRSS.EXE 24_FileSize=6144 24_FileDate=2004-8-23 16:00:00 24_FileVersion=5.1.2600.2180 25_FileName=C:\WINDOWS\system32\WDFMGR.EXE 25_FileSize=38912 25_FileDate=2004-8-10 22:05:14 25_FileVersion=5.2.3790.1230 26_FileName=C:\WINDOWS\system32\ALG.EXE 26_FileSize=44544 26_FileDate=2004-8-23 16:00:00 26_FileVersion=5.1.2600.2180 Max=26
looye2004 初生襁褓狮帖子:65 注册: 2006-10-07 来自:

looye2004 初生襁褓狮帖子:65 注册: 2006-10-07 来自:	发表于： 2006-10-08 22:33 \| 只看楼主短消息资料字号：小中大 46楼 [Hosts] HostsFile=C:\WINDOWS\system32\Drivers\Etc\Hosts 1_Host=127.0.0.1 localhost Max=1 [Service] 1_ServiceName=C-DillaCdaC11BA 1_DisplayName=C-DillaCdaC11BA 1_Description= 1_Status=已启动 1_StartType=自动 1_ServiceDll= 1_ImagePath=C:\WINDOWS\SYSTEM32\DRIVERS\CDAC11BA.EXE 2_ServiceName=DcomLaunch 2_DisplayName=DCOM Server Process Launcher 2_Description=为 DCOM 服务提供加载功能。 2_Status=已启动 2_StartType=自动 2_ServiceDll=C:\WINDOWS\SYSTEM32\RPCSS.DLL 2_ImagePath=C:\WINDOWS\SYSTEM32\SVCHOST -K DCOMLAUNCH 3_ServiceName=HTTPFilter 3_DisplayName=HTTP SSL 3_Description=此服务通过安全套接字层(SSL)实现 HTTP 服务的安全超文本传送协议(HTTPS)。如果此服务被禁用，任何依赖它的服务将无法启动。 3_Status=已启动 3_StartType=手动 3_ServiceDll=C:\WINDOWS\SYSTEM32\W3SSL.DLL 3_ImagePath=C:\WINDOWS\SYSTEM32\SVCHOST.EXE -K HTTPFILTER 4_ServiceName=NetDDEdsdm 4_DisplayName=Network DDE DSDM 4_Description=管理动态数据交换 (DDE) 网络共享。如果此服务终止，DDE 网络共享将不可用。如果此服务被禁用，任何依赖它的服务将无法启动。 4_Status=停止 4_StartType=已禁用 4_ServiceDll= 4_ImagePath=C:\WINDOWS\SYSTEM32\NETDDE.EXE 5_ServiceName=RfwService 5_DisplayName=Rising Personal Firewall Service 5_Description=Rising Personal Firewall Service 5_Status=已启动 5_StartType=自动 5_ServiceDll= 5_ImagePath=C:\PROGRAM FILES\RISING\RFW\RFWSRV.EXE 6_ServiceName=RsCCenter 6_DisplayName=Rising Process Communication Center 6_Description= 6_Status=已启动 6_StartType=自动 6_ServiceDll= 6_ImagePath="C:\PROGRAM FILES\RISING\RAV\CCENTER.EXE" 7_ServiceName=RsRavMon 7_DisplayName=RsRavMon Service 7_Description= 7_Status=已启动 7_StartType=自动 7_ServiceDll= 7_ImagePath="C:\PROGRAM FILES\RISING\RAV\RAVMOND.EXE" 8_ServiceName=UMWdf 8_DisplayName=Windows User Mode Driver Framework 8_Description=启用 Windows 用户模式驱动程序。 8_Status=已启动 8_StartType=自动 8_ServiceDll= 8_ImagePath=C:\WINDOWS\SYSTEM32\WDFMGR.EXE 9_ServiceName=usnsvc 9_DisplayName=共享 USN 杂志阅读器服务 9_Description=Messenger 上安装的启用共享情况的服务 9_Status=停止 9_StartType=手动 9_ServiceDll=C:\PROGRAM FILES\MSN MESSENGER\USNSVC.DLL 9_ImagePath=C:\WINDOWS\SYSTEM32\SVCHOST.EXE -K USNSVC 10_ServiceName=WmdmPmSN 10_DisplayName=Portable Media Serial Number Service 10_Description=Retrieves the serial number of any portable media player connected to this computer. If this service is stopped, protected content might not be down loaded to the device. 10_Status=停止 10_StartType=手动 10_ServiceDll=C:\WINDOWS\SYSTEM32\MSPMSNSV.DLL 10_ImagePath=C:\WINDOWS\SYSTEM32\SVCHOST.EXE -K NETSVCS 11_ServiceName=wscsvc 11_DisplayName=Security Center 11_Description=监视系统安全设置和配置。 11_Status=已启动 11_StartType=自动 11_ServiceDll=C:\WINDOWS\SYSTEM32\WSCSVC.DLL 11_ImagePath=C:\WINDOWS\SYSTEM32\SVCHOST.EXE -K NETSVCS 12_ServiceName=xmlprov 12_DisplayName=Network Provisioning Service 12_Description=为自动网络提供管理基于域的 XML 配置文件。 12_Status=停止 12_StartType=手动 12_ServiceDll=C:\WINDOWS\SYSTEM32\XMLPROV.DLL 12_ImagePath=C:\WINDOWS\SYSTEM32\SVCHOST.EXE -K NETSVCS Max=12 [END] Max=1
looye2004 初生襁褓狮帖子:65 注册: 2006-10-07 来自:

looye2004 初生襁褓狮帖子:65 注册: 2006-10-07 来自:	发表于： 2006-10-08 22:36 \| 只看楼主短消息资料字号：小中大 47楼发完了，好长呀！是不是只能重装IE了？为什么IE主页总是会被绑定呢？有没有什么办法阻止主页被绑定？
looye2004 初生襁褓狮帖子:65 注册: 2006-10-07 来自:

looye2004 初生襁褓狮帖子:65 注册: 2006-10-07 来自:	发表于： 2006-10-08 23:44 \| 只看楼主短消息资料字号：小中大 48楼再用SRENG扫了日志贴上： 2006-10-08,23:31:58 System Repair Engineer 2.2.6.605 Smallfrogs (http://www.KZTechs.com) Windows XP Professional Service Pack 2 (Build 2600) - 管理权限用户 - 完整功能以下内容被选中：所有的启动项目（包括注册表、启动文件夹、服务等）浏览器加载项正在运行的进程（包括进程模块信息）文件关联 Winsock 提供者 Autorun.inf HOSTS 文件启动项目注册表 [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run] <ctfmon.exe><C:\WINDOWS\system32\ctfmon.exe> [(Verified)Microsoft Corporation] [HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows] <load><> [N/A] <run><> [N/A] [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run] <RavTask><"C:\Program Files\Rising\Rav\RavTask.exe" -system> [Beijing Rising Technology Co., Ltd.] <ControlCenter2.0><; C:\Program Files\Brother\ControlCenter2\brctrcen.exe /autorun> [Brother Industries, Ltd.] <IMJPMIG8.1><; "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32> [(Verified)Microsoft Corporation] <PHIME2002A><; C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName> [(Verified)Microsoft Corporation] <PHIME2002ASync><; C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC> [(Verified)Microsoft Corporation] <POPO2004><; > [N/A] <RfwMain><; C:\Program Files\Rising\Rfw\rfwmain.exe> [N/A] <SetDefPrt><; C:\Program Files\Brother\Brmfl04g\BrStDvPt.exe> [Brother Industories, Ltd.] <SysExplr><; C:\Herosoft\HeroV8\SysExplr.EXE> [N/A] <TkBellExe><; "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot> [RealNetworks, Inc.] <VTTimer><; VTTimer.exe> [(Verified)S3 Graphics, Inc.] [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon] <shell><Explorer.exe> [(Verified)Microsoft Corporation] <Userinit><C:\WINDOWS\system32\Userinit.exe,> [(Verified)Microsoft Corporation] [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Windows] <AppInit_DLLs><> [N/A] [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon] <UIHost><Logonui.exe> [(Verified)Microsoft Corporation] ==================================
looye2004 初生襁褓狮帖子:65 注册: 2006-10-07 来自:

looye2004 初生襁褓狮帖子:65 注册: 2006-10-07 来自:	发表于： 2006-10-08 23:45 \| 只看楼主短消息资料字号：小中大 49楼启动文件夹 N/A ================================== 服务 [C-DillaCdaC11BA / C-DillaCdaC11BA] <C:\WINDOWS\system32\drivers\CDAC11BA.EXE><Macrovision> [Human Interface Device Access / HidServ] <C:\WINDOWS\System32\svchost.exe -k netsvcs-->%SystemRoot%\System32\hidserv.dll><N/A> [Rising Personal Firewall Service / RfwService] <c:\program files\rising\rfw\rfwsrv.exe><Beijing Rising Technology Corporation Limited> [Rising Process Communication Center / RsCCenter] <"C:\Program Files\Rising\Rav\CCenter.exe"><Beijing Rising Technology Co., Ltd.> [RsRavMon Service / RsRavMon] <"C:\Program Files\Rising\Rav\Ravmond.exe"><Beijing Rising Technology Co., Ltd.> ================================== 驱动程序 [Service for Realtek AC97 Audio (WDM) / ALCXWDM] <system32\drivers\ALCXWDM.SYS><Realtek Semiconductor Corp.> [AliIde / AliIde] <\SystemRoot\System32\DRIVERS\aliide.sys><N/A> [Rising TDI Base Driver / BaseTDI] <System32\DRIVERS\BaseTDI.SYS><Beijing Rising Technology Co., Ltd.> [Brother USB Still Image driver / BrScnUsb] <System32\Drivers\BrScnUsb.sys><Brother Industries Ltd.> [Brother MFC Serial Port Interface WDM Driver / BrSerIf] <System32\Drivers\BrSerIf.sys><Brother Industries Ltd.> [Brother MFC USB Serial WDM Driver / BrUsbSer] <System32\Drivers\BrUsbSer.sys><Brother Industries Ltd.> [CdaC15BA / CdaC15BA] <\??\C:\WINDOWS\system32\drivers\CDAC15BA.SYS><Macrovision Europe Ltd> [CmdIde / CmdIde] <\SystemRoot\System32\DRIVERS\cmdide.sys><CMD Technology, Inc.> [ExpScaner / ExpScaner] <\??\C:\Program Files\Rising\Rav\ExpScan.sys><> [VIA PCI 10/100Mb Fast Ethernet Adapter NT Driver / FETNDIS] <system32\DRIVERS\fetnd5.sys><VIA Technologies, Inc.> [VIA Rhine Family Fast Ethernet Adapter Driver Service / FETNDISB] <system32\DRIVERS\fetnd5b.sys><VIA Technologies, Inc.> [fsprot / fsprot] <system32\drivers\fsprot.sys><Microsoft Corporation> [FwDrv / FwDrv] <\??\c:\program files\rising\rfw\FwDrv.sys><Rising> [HookCont / HookCont] <\??\C:\Program Files\Rising\Rav\HOOKCONT.sys><Rising tech Co. ltd> [HookReg / HookReg] <\??\C:\Program Files\Rising\Rav\HookReg.sys><> [HookSys / HookSys] <\??\C:\Program Files\Rising\Rav\HookSys.sys><Rising> [kmsinput / kmsinput] <\??\C:\WINDOWS\system32\drivers\kmsinput.sys><N/A> [MegaIDE / MegaIDE] <\SystemRoot\System32\DRIVERS\MegaIDE.sys><LSI Logic Corporation.> [MEMSCAN / MEMSCAN] <\??\C:\Program Files\Rising\Rav\MEMSCAN.sys><瑞星软件有限公司> [moprot / moprot] <system32\drivers\moprot.sys><Windows System Internal> [npkcrypt / npkcrypt] <\??\C:\Program Files\Tencent\qq\npkcrypt.sys><INCA Internet Co., Ltd.> [npkycryp / npkycryp] <\??\C:\Program Files\Tencent\qq\npkycryp.sys><N/A> [NTSIM / NTSIM] <\??\C:\WINDOWS\system32\ntsim.sys><VIA Networking Technologies, Inc.> [nv / nv] <system32\DRIVERS\nv4_mini.sys><NVIDIA Corporation> [nwlnksipx / nwlnksipx] <\??\C:\WINDOWS\system32\drivers\nwlnksipx.sys><Microsoft Corporation> [Direct Parallel Link Driver / Ptilink] <system32\DRIVERS\ptilink.sys><Parallel Technologies, Inc.> [Realtek RTL8029(AS)-based PCI Ethernet Adapter NT Driver / rtl8029] <system32\DRIVERS\RTL8029.SYS><Realtek Semiconductor Corporation> [Realtek RTL8139(A/B/C)-based PCI Fast Ethernet Adapter NT Driver / rtl8139] <system32\DRIVERS\RTL8139.SYS><Realtek Semiconductor Corporation> [Secdrv / Secdrv] <system32\DRIVERS\secdrv.sys><N/A> [Prolific2 Serial port driver / Ser2pl] <system32\DRIVERS\ser2pl.sys><Prolific Technology Inc.> [Sony USB Filter Driver (SONYPVU1) / SONYPVU1] <system32\DRIVERS\SONYPVU1.SYS><Sony Corporation> [TCP/IP Protocol Driver / Tcpip] <system32\DRIVERS\tcpip.sys><Microsoft Corporation> ==================================
looye2004 初生襁褓狮帖子:65 注册: 2006-10-07 来自:

looye2004 初生襁褓狮帖子:65 注册: 2006-10-07 来自:	发表于： 2006-10-08 23:45 \| 只看楼主短消息资料字号：小中大 50楼浏览器加载项 [QQ] {c95fe080-8f5d-11d2-a20b-00aa003c157b} <C:\Program Files\Tencent\qq\QQ.EXE, TENCENT> [QQIEFloatBarCfgCmd Class] {DEDEB80D-FA35-45d9-9460-4983E5A8AFE6} <C:\Program Files\Tencent\qq\QQIEHelper.dll, N/A> [FlashGet Bar] {E0E899AB-F487-11D5-8D29-0050BA6940E3} <C:\PROGRA~1\FLASHGET\fgiebar.dll, Amaze Soft> [&Google] {2318C2B1-4965-11d4-9B18-009027A5CD4F} <c:\program files\google\googletoolbar2.dll, N/A> [BitComet工具栏] {3F1ABCDB-A875-46c1-8345-B72A4567E486} <C:\Program Files\BitComet\BitCometBar\BitCometBar0.6.dll, N/A> [PowerPlr Control] {2354A44B-3CEB-4829-9940-545B03103538} <C:\WINDOWS\DOWNLO~1\PowerPlr.ocx, Powerise Digital> [WebActivater Control] {3D8F74EE-8692-4F8F-B8D2-7522E732519E} <C:\WINDOWS\system32\WEBACT~1.OCX, QQ> [CEditCtrl Object] {488A4255-3236-44B3-8F27-FA1AECAA8844} <C:\WINDOWS\system32\aliedit\AliEdit.dll, www.alipay.com> [MSN Photo Upload Tool] {4F1E5B1A-2A80-42CA-8532-2D05CB959537} <C:\WINDOWS\Downloaded Program Files\MsnPUpld.dll, Microsoft? Corporation> [Ravonline] {DA984A6D-508E-11D6-AA49-0050FF3C628D} <C:\WINDOWS\Downloaded Program Files\RsOnline.dll, Beijing Rising Tech. Co., Ltd.> [Rising Web Scan Object] {E4E2F180-CB8B-4DE9-ACBB-DA745D3BA153} <C:\WINDOWS\Downloaded Program Files\OL2005.dll, Beijing Rising Technology Co., Ltd.> [Google 搜索(&G)] <res://c:\program files\google\GoogleToolbar2.dll/cmsearch.html, N/A> [上传到QQ网络硬盘] <C:\Program Files\Tencent\qq\AddToNetDisk.htm, N/A> [使用网际快车下载] <C:\PROGRA~1\FLASHGET\jc_link.htm, N/A> [使用网际快车下载全部链接] <C:\PROGRA~1\FLASHGET\jc_all.htm, N/A> [添加到QQ自定义面板] <C:\Program Files\Tencent\qq\AddPanel.htm, N/A> [添加到QQ表情] <C:\Program Files\Tencent\qq\AddEmotion.htm, N/A> [用QQ彩信发送该图片] <C:\Program Files\Tencent\qq\SendMMS.htm, N/A> ==================================
looye2004 初生襁褓狮帖子:65 注册: 2006-10-07 来自:

<<上一主题|下一主题>>

5 / 6 页

跳转页

页面顶部

Powered by Discuz!NT