«678910111213   12  /  13  页   跳转

[日志分析 1 ]讲义

回复 108F 骑行天下 的帖子

360的提示,你一看即知,和SRENG无关了

至于是什么,路径文件名那你看不懂??

至于驱动那个X的问题,就是个X呗

百年以后,你的墓碑旁 刻着的名字不是我
gototop
 

回复 105F smallyou93 的帖子

该用户帖子内容已被屏蔽
发扬硅谷创业精神,开发世界领先技术。品质源于专注,实力成就梦想。
欢迎您访问:http://www.xsk.org.ru
gototop
 

回复:2009年7月7日[日志分析 1 ]讲义



引用:
原帖由 CPU_ring0 于 2009-7-8 13:30:00 发表
楼主误会了,,我是charme,,因为我要是申请实习生,但是我的帖子数不够,,CPU_Ring0大哥就借给了我这个号,,我直接就发帖了,,,不好意思,,是我没有说清楚。。。。我之前申请了个charme的号,后来密码忘了,进不去了。。。



对不起啊,误会了。请见谅
最后编辑smallyou93 最后编辑于 2009-07-08 21:27:25
gototop
 

回复: 2009年7月7日[日志分析 1 ]讲义

关于IFEO不太明白!求教
gototop
 

回复 91F 凡尘之沙 的帖子

谢谢啦~~~
gototop
 

回复:2009年7月7日[日志分析 1 ]讲义

人好多啊
gototop
 

回复:2009年7月7日[日志分析 1 ]讲义

第一次接触,学习学习
gototop
 

回复: 2009年7月7日[日志分析 1 ]讲义

引用 67楼的些内容
  [D:\Program Files\QQ2009\Plugin\com.tencent.snsapp\Bin\SNSApp.dll]  [Tencent, 1, 30, 860, 0]
    [D:\Program Files\QQ2009\Plugin\com.tencent.soso\Bin\Soso.dll]  [Tencent, 1, 30, 860, 0]
    [D:\Program Files\QQ2009\Plugin\com.tencent.paycenter\Bin\PayCenter.dll]  [Tencent, 1, 30, 860, 0]
    [D:\Program Files\QQ2009\Plugin\com.tencent.qbar\Bin\QBar.dll]  [Tencent, 1, 30, 860, 0]
    [D:\Program Files\QQ2009\Plugin\com.tencent.qqvipmisc\Bin\QQVipMisc.dll]  [Tencent, 1, 30, 860, 0]
    [D:\Program Files\QQ2009\Plugin\com.tencent.wenwen\Bin\WenWen.dll]  [Tencent, 1, 30, 860, 0]
    [D:\Program Files\QQ2009\Plugin\com.tencent.NetBar\Bin\NetBar.dll]  [Tencent, 1, 30, 860, 0]
    [D:\Program Files\QQ2009\Plugin\com.tencent.paipai\Bin\PaiPai.dll]  [Tencent, 1, 30, 860, 0]
    [D:\Program Files\QQ2009\Plugin\com.tencent.wireless\Bin\Wireless.dll]  [Tencent, 1, 30, 860, 0]
    [D:\Program Files\QQ2009\Plugin\com.tencent.paipaigift\Bin\PaiPaiGift.dll]  [Tencent, 1, 30, 860, 0]
    [D:\Program Files\QQ2009\Plugin\com.tencent.qqshow\Bin\QQShow.dll]  [Tencent, 1, 30, 860, 0]
    [D:\Program Files\QQ2009\Plugin\com.tencent.qzone\Bin\Qzone.dll]  [Tencent, 1, 30, 860, 0]
    [D:\Program Files\QQ2009\Plugin\com.tencent.audiovideo\Bin\AudioVideo.dll]  [Tencent, 1, 30, 860, 0]
    [D:\Program Files\QQ2009\Plugin\com.tencent.weather\Bin\Weather.dll]  [Tencent, 1, 30, 860, 0]
    [D:\Program Files\QQ2009\Plugin\com.tencent.crm\Bin\CRM.dll]  [Tencent, 1, 30, 860, 0]
    [D:\Program Files\QQ2009\Plugin\com.tencent.mmog\Bin\MMOG.dll]  [Tencent, 1, 30, 860, 0]
    [D:\Program Files\QQ2009\Plugin\com.tencent.qqgame\Bin\QQGame.dll]  [Tencent, 1, 30, 860, 0]
    [D:\Program Files\QQ2009\Plugin\com.tencent.qqlive\Bin\QQLive.dll]  [Tencent, 1, 30, 860, 0]
    [D:\Program Files\QQ2009\Plugin\com.tencent.qqmusic\Bin\QQMusic.dll]  [Tencent, 1, 30, 860, 0]
    [D:\Program Files\QQ2009\Plugin\com.tencent.qqpet\Bin\QQPet.dll]  [Tencent, 1, 30, 860, 0]
    [D:\Program Files\QQ2009\Plugin\com.tencent.taotao\Bin\taotao.dll]  [Tencent, 1, 30, 860, 0]
    [D:\Program Files\QQ2009\Plugin\com.tencent.mail\Bin\Mail.dll]  [Tencent, 1, 30, 860, 0]
    [D:\Program Files\QQ2009\Plugin\com.tencent.memo\Bin\Memo.dll]  [Tencent, 1, 30, 860, 0]
    [D:\Program Files\QQ2009\Plugin\com.tencent.advertisement\Bin\Advertisement.dll]  [Tencent, 1, 30, 860, 0]
----------------------------------------------------------------------------------------------------
请问老师呀。 tx的2009qq太恶心了 很多我们不需要的服务都随QQ加载进来了,有没有可能让这些dll文件不让其启动1~? 删除这些dll大约不行 以前09出来的时候 只要有文件被删除,tx就提示文件受损,请重装QQ
gototop
 

回复: 2009年7月7日[日志分析 1 ]讲义



引用:
原帖由 CPU_ring0 于 2009-7-8 4:09:00 发表
之前出了点问题,,通过测试。确实是最简单的r3的隐藏进程sreng也查不出来。

我写了段代码,注入记事本隐藏进程,扫描日志:
[CODE]
2009-07-08,03:57:12
System Repair Engineer 2.7.1.1261
Smallfrogs (http://www.KZTechs.com




论坛果然有高手存在
gototop
 

回复:2009年7月7日[日志分析 1 ]讲义

我的问题比较多啊,因为上课时没怎么看明白,昨晚又加班看看,发现好多不懂得,希望高手给解决。
1.LenovoWallPaper><c:\Windows\Resources\Themes\Lenovo\ThemeWallPaperSetting.exe>  [Accelerate]
    <LenovoScreenSaver><c:\Windows\Resources\Themes\Lenovo\ScreenSaveModify.exe>  [Accelerate]
这里的[Accelerate]是什么意思?

2.还有启动项是不是太多了

3.<Themes Setup><%SystemRoot%\system32\regsvr32.exe /s /n /i:/UserInstall %SystemRoot%\system32\themeui.dll>  [File is missing]
[File is missing]是怎么回事?


4.==================================
启动文件夹
[Adobe Gamma Loader]
  <C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Adobe Gamma Loader.lnk --> C:\PROGRA~1\COMMON~1\Adobe\CALIBR~1\ADOBEG~1.EXE [Adobe Systems, Inc.]><N>
[Adobe Gamma Loader]
  <C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Adobe Gamma Loader.lnk --> C:\PROGRA~1\COMMON~1\Adobe\CALIBR~1\ADOBEG~1.EXE [Adobe Systems, Inc.]><N>

==================================我怎么有这个?老师给的讲义里没有啊


5.[WinDefend / WinDefend][Stopped/Disabled]
  <2 - 系统找不到指定的文件。
><(File is missing)>
[WMPNetworkSvc / WMPNetworkSvc][Stopped/Manual Start]
  <2 - 系统找不到指定的文件。
><(File is missing)>
这怎么回事?系统找不到指定文件怎么解决?

5.==================================
驱动程序
[Lenovo Virtual Power Controller Driver / ACPIVPC][Running/Manual Start]
  <system32\DRIVERS\AcpiVpc.sys><Lenovo Corporation>
[adp94xx / adp94xx][Stopped/Disabled]
  <\SystemRoot\system32\drivers\adp94xx.sys><Adaptec, Inc.>
[adpahci / adpahci][Stopped/Disabled]
  <\SystemRoot\system32\drivers\adpahci.sys><Adaptec, Inc.>
[adpu160m / adpu160m][Stopped/Disabled]
  <\SystemRoot\system32\drivers\adpu160m.sys><Adaptec, Inc.>
[adpu320 / adpu320][Stopped/Disabled]
  <\SystemRoot\system32\drivers\adpu320.sys><Adaptec, Inc.>
[aic78xx / aic78xx][Stopped/Disabled]
  <\SystemRoot\system32\drivers\djsvs.sys><Adaptec, Inc.>
[aliide / aliide][Stopped/Disabled]
  <\SystemRoot\system32\drivers\aliide.sys><Acer Laboratories Inc.>
[arc / arc][Stopped/Disabled]
  <\SystemRoot\system32\drivers\arc.sys><Adaptec, Inc.>
[arcsas / arcsas][Stopped/Disabled]
  <\SystemRoot\system32\drivers\arcsas.sys><Adaptec, Inc.>
[Broadcom NetXtreme Gigabit Ethernet - NDIS 6.0 / b57nd60x][Running/Manual Start]
  <system32\DRIVERS\b57nd60x.sys><Broadcom Corporation>
[Broadcom 802.11 网络适配器驱动程序 / BCM43XX][Running/Manual Start]
  <system32\DRIVERS\bcmwl6.sys><Broadcom Corporation>
[BREGDRV / BREGDRV][Stopped/Manual Start]
  <\??\C:\Windows\system32\drivers\bregdrv.sys><360安全中心>
[Brother USB Mass-Storage Lower Filter Driver / BrFiltLo][Stopped/Manual Start]
  <\SystemRoot\system32\drivers\brfiltlo.sys><Brother Industries, Ltd.>
[Brother USB Mass-Storage Upper Filter Driver / BrFiltUp][Stopped/Manual Start]
  <\SystemRoot\system32\drivers\brfiltup.sys><Brother Industries, Ltd.>
[Brother MFC Serial Port Interface Driver (WDM) / Brserid][Stopped/Disabled]
  <\SystemRoot\system32\drivers\brserid.sys><Brother Industries Ltd.>
[Brother WDM Serial driver / BrSerWdm][Stopped/Disabled]
  <\SystemRoot\system32\drivers\brserwdm.sys><Brother Industries Ltd.>
[Brother MFC USB Fax Only Modem / BrUsbMdm][Stopped/Disabled]
  <\SystemRoot\system32\drivers\brusbmdm.sys><Brother Industries Ltd.>
[Brother MFC USB Serial WDM Driver / BrUsbSer][Stopped/Manual Start]
  <\SystemRoot\system32\drivers\brusbser.sys><Brother Industries Ltd.>
[蓝牙音频设备 / btwaudio][Stopped/Manual Start]
  <system32\drivers\btwaudio.sys><Broadcom Corporation.>
[Bluetooth AVDT / btwavdt][Stopped/Manual Start]
  <system32\drivers\btwavdt.sys><Broadcom Corporation.>
[Bluetooth L2CAP Service / btwl2cap][Stopped/Manual Start]
  <system32\DRIVERS\btwl2cap.sys><Broadcom Corporation.>
[btwrchid / btwrchid][Stopped/Manual Start]
  <system32\DRIVERS\btwrchid.sys><Broadcom Corporation.>
[Lenovo EasyCamera  / Cam5607][Running/Manual Start]
  <System32\Drivers\BisonC07.sys><Bison Electronics. Inc.>
[cmdide / cmdide][Stopped/Disabled]
  <\SystemRoot\system32\drivers\cmdide.sys><CMD Technology, Inc.>
[Conexant UAA Function Driver for High Definition Audio Service / CnxtHdAudService][Running/Manual Start]
  <system32\drivers\CHDRT32.sys><Conexant Systems Inc.>
[Intel(R) PRO/1000 NDIS 6 Adapter Driver / E1G60][Stopped/Manual Start]
  <system32\DRIVERS\E1G60I32.sys><Intel Corporation>
[elxstor / elxstor][Stopped/Disabled]
  <\SystemRoot\system32\drivers\elxstor.sys><Emulex>
[COMPAL Embedded System Control / EMSC][Running/Boot Start]
  <\SystemRoot\system32\DRIVERS\EMSC.SYS><Windows (R) Codename Longhorn DDK provider>
[ENE CIR Receiver / enecir][Running/Manual Start]
  <system32\DRIVERS\enecir.sys><ENE TECHNOLOGY INC.>
[ENE CIR HID Receiver / enecirhid][Running/Manual Start]
  <system32\DRIVERS\enecirhid.sys><ENE TECHNOLOGY INC.>
[ENE CIR HIDmini Filter / enecirhidma][Running/Manual Start]
  <system32\DRIVERS\enecirhidma.sys><ENE TECHNOLOGY INC.>
[hookcont / hookcont][Running/System Start]
  <system32\drivers\HookCont.sys><Beijing Rising Information Technology Co., Ltd.>
[hooksys / hooksys][Running/System Start]
  <system32\drivers\HookSys.sys><Beijing Rising Information Technology Co., Ltd.>
[HpCISSs / HpCISSs][Stopped/Disabled]
  <\SystemRoot\system32\drivers\hpcisss.sys><Hewlett-Packard Company>
[HSF_DPV / HSF_DPV][Running/Manual Start]
  <system32\DRIVERS\HSX_DPV.sys><Conexant Systems, Inc.>
[HSXHWAZL / HSXHWAZL][Running/Manual Start]
  <system32\DRIVERS\HSXHWAZL.sys><Conexant Systems, Inc.>
[Intel RAID Controller Vista / iaStorV][Stopped/Disabled]
  <\SystemRoot\system32\drivers\iastorv.sys><Intel Corporation>
[igfx / igfx][Running/Manual Start]
  <system32\DRIVERS\igdkmd32.sys><Intel Corporation>
[iirsp / iirsp][Stopped/Disabled]
  <\SystemRoot\system32\drivers\iirsp.sys><Intel Corp./ICP vortex GmbH>
[Intel(R) High Definition Audio HDMI / IntcHdmiAddService][Running/Manual Start]
  <system32\drivers\IntcHdmi.sys><Intel(R) Corporation>
[IP in IP Tunnel Driver / IpInIp][Stopped/Manual Start]
  <system32\DRIVERS\ipinip.sys><N/A>
[ITEATAPI_Service_Install / iteatapi][Stopped/Disabled]
  <\SystemRoot\system32\drivers\iteatapi.sys><Integrated Technology Express, Inc.>
[ITERAID_Service_Install / iteraid][Stopped/Disabled]
  <\SystemRoot\system32\drivers\iteraid.sys><Integrated Technology Express, Inc.>
[LSI_FC / LSI_FC][Stopped/Disabled]
  <\SystemRoot\system32\drivers\lsi_fc.sys><LSI Logic>
[LSI_SAS / LSI_SAS][Stopped/Disabled]
  <\SystemRoot\system32\drivers\lsi_sas.sys><LSI Logic>
[LSI_SCSI / LSI_SCSI][Stopped/Disabled]
  <\SystemRoot\system32\drivers\lsi_scsi.sys><LSI Logic>
[mdmxsdk / mdmxsdk][Running/Auto Start]
  <system32\DRIVERS\mdmxsdk.sys><Conexant>
[megasas / megasas][Stopped/Disabled]
  <\SystemRoot\system32\drivers\megasas.sys><LSI Corporation>
[MegaSR / MegaSR][Stopped/Disabled]
  <\SystemRoot\system32\drivers\megasr.sys><LSI Corporation, Inc.>
[Mraid35x / Mraid35x][Stopped/Disabled]
  <\SystemRoot\system32\drivers\mraid35x.sys><LSI Logic Corporation>
[nfrd960 / nfrd960][Stopped/Disabled]
  <\SystemRoot\system32\drivers\nfrd960.sys><IBM Corporation>
[N-trig HID Tablet Driver / ntrigdigi][Stopped/Disabled]
  <\SystemRoot\system32\drivers\ntrigdigi.sys><N-trig Innovative Technologies>
[NVIDIA nForce RAID Driver    / nvraid][Stopped/Disabled]
  <\SystemRoot\system32\drivers\nvraid.sys><NVIDIA Corporation>
[nvstor / nvstor][Stopped/Disabled]
  <\SystemRoot\system32\drivers\nvstor.sys><NVIDIA Corporation>
[IPX Traffic Filter Driver / NwlnkFlt][Stopped/Manual Start]
  <system32\DRIVERS\nwlnkflt.sys><N/A>
[IPX Traffic Forwarder Driver / NwlnkFwd][Stopped/Manual Start]
  <system32\DRIVERS\nwlnkfwd.sys><N/A>
[O2MDRDR / O2MDRDR][Running/Manual Start]
  <system32\DRIVERS\o2media.sys><O2Micro>
[O2SDRDR / O2SDRDR][Running/Manual Start]
  <system32\DRIVERS\o2sd.sys><O2Micro>
[Padus ASPI Shell / pfc][Running/Manual Start]
  <system32\drivers\pfc.sys><Padus, Inc.>
[QLogic Fibre Channel Miniport Driver / ql2300][Stopped/Disabled]
  <\SystemRoot\system32\drivers\ql2300.sys><QLogic Corporation>
[QLogic iSCSI Miniport Driver / ql40xx][Stopped/Disabled]
  <\SystemRoot\system32\drivers\ql40xx.sys><QLogic Corporation>
[RsNTGDI / RsNTGDI][Running/Boot Start]
  <\SystemRoot\system32\Drivers\RsNTGdi.sys><Beijing Rising Information Technology Co., Ltd.>
[SafeBoxKrnl / SafeBoxKrnl][Running/System Start]
  <\??\C:\Windows\system32\Drivers\safeboxkrnl.sys><360安全中心>
[SiSRaid4 / SiSRaid4][Stopped/Disabled]
  <\SystemRoot\system32\drivers\sisraid4.sys><Silicon Integrated Systems>
[smserial / smserial][Stopped/Manual Start]
  <system32\DRIVERS\smserial.sys><Motorola Inc.>
[Symc8xx / Symc8xx][Stopped/Disabled]
  <\SystemRoot\system32\drivers\symc8xx.sys><LSI Logic>
[Sym_hi / Sym_hi][Stopped/Disabled]
  <\SystemRoot\system32\drivers\sym_hi.sys><LSI Logic>
[Sym_u3 / Sym_u3][Stopped/Disabled]
  <\SystemRoot\system32\drivers\sym_u3.sys><LSI Logic>
[Synaptics TouchPad Driver / SynTP][Running/Manual Start]
  <system32\DRIVERS\SynTP.sys><Synaptics, Inc.>
[tvtumon / tvtumon][Running/Auto Start]
  <system32\drivers\tvtumon.sys><Lenovo>
[uliahci / uliahci][Stopped/Disabled]
  <\SystemRoot\system32\drivers\uliahci.sys><ULi Electronics Inc.>
[UlSata / UlSata][Stopped/Disabled]
  <\SystemRoot\system32\drivers\ulsata.sys><Promise Technology, Inc.>
[ulsata2 / ulsata2][Stopped/Disabled]
  <\SystemRoot\system32\drivers\ulsata2.sys><Promise Technology, Inc.>
[viaide / viaide][Stopped/Disabled]
  <\SystemRoot\system32\drivers\viaide.sys><VIA Technologies, Inc.>
[vsmraid / vsmraid][Stopped/Disabled]
  <\SystemRoot\system32\drivers\vsmraid.sys><VIA Technologies Inc.,Ltd>
[Lenovo RMCT KbdMou Service / Wdkbdmou][Running/Boot Start]
  <\SystemRoot\system32\DRIVERS\Wdkbdmou.sys><N/A>
[wdmirror / wdmirror][Running/Manual Start]
  <system32\DRIVERS\WDMirror.sys><Windows (R) Codename Longhorn DDK provider>
[winachsf / winachsf][Running/Manual Start]
  <system32\DRIVERS\HSX_CNXT.sys><Conexant Systems, Inc.>
[WSVD / WSVD][Stopped/Manual Start]
  <\??\C:\Windows\system32\drivers\WSVD.sys><CyberLink>
[XAudio / XAudio][Running/Auto Start]
  <system32\DRIVERS\xaudio.sys><Conexant Systems, Inc.>

==================================
这个有问题么?不会分析


6.关于浏览器加载项
[]
  {105E4D0C-5E21-41ED-90F9-013EEF271BD6} <C:\Windows\System32\widgetdownload.dll, 鱼鱼桌面秀widget插件下载工具>这个工具我卸载了了,怎么还有?如何处理?还重复出现

7.[]
  {6D53EC84-6AAE-4787-AEEE-F4628F01010C} <, >
[]
  {7670648D-461B-42AF-BDFE-46D26AF5EFF2} <, >
[]
  {77FEF28E-EB96-44FF-B511-3185DEA48697} <, >
[]
  {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} <, >怎么解释?



8.=================================
HOSTS 文件
127.0.0.1      localhost
::1            localhost


::1            localhost是什么?
希望能得到解决,谢谢!!!
gototop
 
«678910111213   12  /  13  页   跳转
页面顶部
Powered by Discuz!NT