[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
<System><rem C:\Program Files\Common Files\System\Updaterun.exe> [N/A]
<upx1><rem C:\DOCUME~1\Boss\LOCALS~1\Temp\upx1.exe> [N/A]
<upxdnd1><rem C:\DOCUME~1\Boss\LOCALS~1\Temp\ztt.exe> [N/A]
<webService><C:\WINDOWS\services.exe> [N/A]
<Snewpeek><rem C:\DOCUME~1\Boss\LOCALS~1\Temp\6.exe> [N/A]
<wsvbs><rem C:\WINDOWS\wsvbs.exe> [N/A]
<sdafdsafds><rem C:\WINDOWS\temp\155.exe> [N/A]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
<{99F1D023-7CEB-4586-80F7-BB1A98DB7602}><C:\Program Files\Internet Explorer\IEXPLORE.Sys> [N/A]
<_{06A48AD9-FF57-4E73-937B-B493E72F4226}><> [N/A]
<_{9C0CFA58-3A6F-51ba-9EFE-5320F4F62FB1}><> [N/A]
<_{6E44887F-5214-41F2-AB46-4728735C4CC6}><> [N/A]
<{4ED6E0B5-F47A-4609-A940-11CF60FDC3C3}><C:\WINDOWS\system32\mctet.dll> []
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\cryptimg]
<WinlogonNotify: cryptimg><cryptimg.dll> [Microsoft Corporation]
服务
[4FEB270 / 4FEB270][Stopped/Auto Start]
<C:\WINDOWS\system32\4FEB270.EXE -service><Microsoft Corporation>
[9FFD0DA0 / 9FFD0DA0][Stopped/Auto Start]
<C:\WINDOWS\system32\9FFD0DA0.EXE -service><Microsoft Corporation>
[Imsvc / Imsvc][Running/Auto Start]
<C:\WINDOWS\System32\svchost.exe -k netsvcs-->C:\WINDOWS\system32\Webmail.dll><>
[Remote Registry Protect / Investor][Running/Auto Start]
<C:\WINDOWS\System32\svchost.exe -k netsvcs-->C:\WINDOWS\system32\cgjhq.dll><Microsoft Corporation>
[Logical Disk Manager Administrator Service / Logical Disk Manager Administrator Service][Running/Auto Start]
<C:\WINDOWS\System32\svchost.exe -k netsvcs-->C:\WINDOWS\system32\ntxml.dll><>
[SysServiceStart / ServiceStart][Running/Auto Start]
<C:\Windows\system32\RWBIQXEKRY.EXE><N/A>
[Security Machine Manager / SOCEESe][Running/Auto Start]
<C:\WINDOWS\SYSTEM32\RUNDLL32.EXE C:\WINDOWS\SYSTEM32\WBEM\EKBMM.DLL,Export 1087><N/A>
[Provisioning Transaction Service / ttt_14][Running/Auto Start]
<C:\WINDOWS\system32\win.exe><N/A>
[Vsn vsxx Service / vsxx][Running/Auto Start]
<C:\WINDOWS\system32\rundll32.exe C:\PROGRA~1\bfda\imkh.dll,Service><Microsoft Corporation>
[Windows DHCP Service / WinDHCPsvc][Stopped/Auto Start]
<C:\WINDOWS\system32\rundll32.exe windhcp.ocx,start><Microsoft Corporation>
[Windows_ServerDdos / Windows_ServerDdos][Stopped/Auto Start]
<C:\WINDOWS\system32\kaven.exe><N/A>
[WinXP DHCP Service / WinXPDHCPsvc][Stopped/Auto Start]
<C:\WINDOWS\system32\rundll32.exe xpdhcp.dll,start><Microsoft Corporation>
驱动还没有看....是不是我太笨了??怎么找到这么多???楼下分析吧.....不敢再写了..
可能我对你的服务不熟悉....叫高手继续...
