大家帮忙看下!谢谢
附件: jpg.rar (2010-3-28 17:16:43, 6.21 K)
该附件被下载次数 244
扫描以下项目：
进程、线程和模块
系统服务和设备驱动程序
自动启动的程序
计划任务
不包括通过数字签名验证的程序
-----------------------------
系统服务和设备驱动程序
<360SelfProtection>
[system32\drivers\360SelfProtection.sys] [360安全中心 / 1, 0, 0, 1028]
<3wareSrv>
[%SystemRoot%\System32\3wareSrv.exe] [ / ]
<AtcL002>
[system32\DRIVERS\l250x86.sys] [Atheros Communications, Inc. / 2.5.6000.5 built by: WinDDK]
<BAPIDRV>
[\??\C:\WINDOWS\system32\drivers\BAPIDRV.SYS] [360.cn / 1.0.0.1006]
<bb-run>
[system32\DRIVERS\bb-run.sys] [Promise Technology, Inc. / 1.0.1.2 built by: WinDDK]
<dontgo>
[system32\DRIVERS\DontGo.sys] [Promise Technology, Inc. / 1.0.0.3 built by: WinDDK]
<EfiMon>
[System32\Drivers\Efimon.sys] [奇虎网 / 1, 0, 0, 1004]
<hookcont>
[system32\drivers\HookCont.sys] [Beijing Rising Information Technology Co., Ltd. / 24, 0, 0, 5]
<HookPort>
[System32\Drivers\Hookport.sys] [360安全中心 / 1, 0, 0, 1009]
<hooksys>
[system32\drivers\HookSys.sys] [Beijing Rising Information Technology Co., Ltd. / 24, 0, 0, 31]
<IntcAzAudAddService>
[system32\drivers\RtkHDAud.sys] [Realtek Semiconductor Corp. / 5.10.0.5485 built by: WinDDK]
<MTsensor>
[system32\DRIVERS\ASACPI.sys] [ / 1043, 2, 15, 37]
<nv>
[system32\DRIVERS\nv4_mini.sys] [NVIDIA Corporation / 6.14.11.6316]
<nvrd32>
[system32\DRIVERS\nvrd32.sys] [NVIDIA Corporation / 10.1.0.12 built by: WinDDK]
<ose>
["C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"] [Microsoft Corporation / 11.0.5525]
<quxxxserv>
[\??\C:\WINDOWS\system32\drivers\quxxxrv.sys] [360.cn / 6.3.0.1009]
<qutmipc>
[\??\C:\WINDOWS\system32\drivers\qutmipc.sys] [360安全中心 / 6.2.0.1007]
<rsassist>
[system32\drivers\rsassist.sys] [Beijing Rising Information Technology Co., Ltd. / 1, 0, 0, 4]
<RsNTGDI>
[system32\Drivers\RsNTGdi.sys] [Beijing Rising Information Technology Co., Ltd. / 22.0.0.0]
<RsRavMon>
["C:\Program Files\Rising\Rav\RavMonD.exe"] [Beijing Rising Information Technology Co., Ltd. / 22, 0, 0, 2]
<SiRemFil>
[system32\DRIVERS\SiRemFil.sys] [Silicon Image, Inc. / 1, 1, 6, 0]
<SNPSTD3>
[system32\DRIVERS\snpstd3.sys] [Sonix Co. Ltd. / 1, 5, 4, 13]
<sptd>
[System32\Drivers\sptd.sys] [ / ]
<sr>
[system32\DRIVERS\sr.sys] [ / ] *** File Not Found ***
<Tcpip>
[system32\DRIVERS\tcpip.sys] [Microsoft Corporation / 5.1.2600.3394 (xpsp_sp2_gdr.080620-1245)]
<TSKSP>
[\??\d:\Program Files\QQ\QQDoctor\TSKSP.sys] [Tencent / 2010, 3, 3, 24]
<TSUSVC>
["C:\Program Files\Tencent\QQSoftMgr\1.0.302.203\TencentUpdateSvc.exe" -run] [Tencent / 1.0 Beta3 Build 302]
<ViBus>
[system32\DRIVERS\ViBus.sys] [ / ] *** File Not Found ***
<xfilt>
[system32\DRIVERS\xfilt.sys] [VIA Technologies,Inc / 6.0.5728.160]
<ZhuDongFangYu>
["C:\Program Files\360\360Safe\deepscan\zhudongfangyu.exe"] [360.cn / 3, 2, 2, 1001]
-----------------------------
进程、线程和模块
-----------------------------
自动启动的程序
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
<RTHDCPL>
[RTHDCPL.EXE] [Realtek Semiconductor Corp. / 2.1.6.0]
<360Safetray>
["C:\Program Files\360\360Safe\safemon\360tray.exe" /start] [360.CN / 6, 2, 0, 5001]
<RavTray>
["C:\Program Files\Rising\Rav\RsTray.exe" -system] [Beijing Rising Information Technology Co., Ltd. / 22.0.0.11]
<snpstd3>
[C:\WINDOWS\vsnpstd3.exe] [ / 1, 1, 5, 11]
<tsnpstd3>
[C:\WINDOWS\tsnpstd3.exe] [ / 1, 1, 5, 10]
<QQDoctorRTP>
["d:\Program Files\QQ\QQDoctor\QQDoctorRtp.exe" /regrun] [Tencent / 3, 2, 105, 400]
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad
SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon
SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler
HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks
HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options
HKLM\Software\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects
<Thunder AtOnce>
[{01443AEC-0FD1-40fd-9C87-E93D1494C233}] [深圳市迅雷网络技术有限公司 / 5,9,17,1334]
<XLLiteView BrowserHelper Object>
[{2D90D33C-DE76-42D0-9040-E4466DDC24AC}] [Xunlei / 1, 0, 1, 14]
<TSWebMon>
[{7C260B4B-F7A0-40B5-B403-BEFCDC6A4C3B}] [Tencent / 2010, 3, 9, 12]
<ThunderBHO>
[{889D2FEB-5411-4565-8998-1DD2C5261283}] [深圳市迅雷网络技术有限公司 / 5,9,17,1334]
<>
[{B69F34DD-F0F9-42DC-9EDD-957187DA688D}] [360安全中心 / 6, 0, 0, 1003]
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon
-----------------------------
********* 日志开始 **********
[键]HKEY_CLASSES_ROOT\CLSID\{0002DF01-0000-0000-C000-000000000046}\LOCALSERVER32
[值]@
[类型]REG_SZ
[内容]"c:\program files\internet explorer\iexplore.exe"
[键]HKEY_CLASSES_ROOT\CLSID\{25336920-03F9-11CF-8FD0-00AA00686F13}\DEFAULTICON
[值]@
[类型]REG_SZ
[内容]c:\program files\internet explorer\iexplore.exe.mui,-17
[键]HKEY_CLASSES_ROOT\CLSID\{3050F3D9-98B5-11CF-BB82-00AA00BDCE0B}\DEFAULTICON
[值]@
[类型]REG_SZ
[内容]c:\program files\internet explorer\iexplore.exe.mui,-17
[键]HKEY_CLASSES_ROOT\CLSID\{42042206-2D85-11D3-8CFF-005004838597}\OLD ICON\HTMLFILE\DEFAULTICON
[值]@
[类型]REG_SZ
[内容]c:\program files\internet explorer\iexplore.exe,-17
[键]HKEY_CLASSES_ROOT\CLSID\{42042206-2D85-11D3-8CFF-005004838597}\OLD ICON\MHTMLFILE\DEFAULTICON
[值]@
[类型]REG_SZ
[内容]c:\program files\internet explorer\iexplore.exe,-32554
[键]HKEY_CLASSES_ROOT\CLSID\{65014010-9F62-11D1-A651-00600811D5CE}\DEFAULTICON
[值]@
[类型]REG_EXPAND_SZ
[内容]c:\program files\internet explorer\iexplore.exe,1
[键]HKEY_CLASSES_ROOT\CLSID\{871C5380-42A0-1069-A2EA-08002B30309D}\SHELL\OPENHOMEPAGE\COMMAND
[值]@
[类型]REG_SZ
[内容]"c:\program files\internet explorer\iexplore.exe"
[键]HKEY_CLASSES_ROOT\CLSID\{AE24FDAE-03C6-11D1-8B76-0080C744F389}\TOOLBOXBITMAP32
[值]@
[类型]REG_SZ
[内容]c:\program files\internet explorer\iexplore.exe.mui,-17
[键]HKEY_CLASSES_ROOT\CLSID\{D5E8041D-920F-45E9-B8FB-B1DEB82C6E5E}\LOCALSERVER32
[值]@
[类型]REG_EXPAND_SZ
[内容]"%programfiles%\internet explorer\iexplore.exe" -startmediumtab
[键]HKEY_CLASSES_ROOT\CLSID\{FBF23B42-E3F0-101B-8488-00AA003E56F8}\DEFAULTICON
[值]@
[类型]REG_EXPAND_SZ
[内容]"%programfiles%\internet explorer\iexplore.exe",-32528
[键]HKEY_LOCAL_MACHINE\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\DESKTOP\NAMESPACE\{11016101-E366-4D22-BC06-4ADA335C892B}
[值]@
[类型]REG_SZ
[内容]ie history and feeds shell data source for windows search
[键]HKEY_LOCAL_MACHINE\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\DESKTOP\NAMESPACE\{1F4DE370-D627-11D1-BA4F-00A0C91EEDBA}
[值]@
[类型]REG_SZ
[内容]computer search results folder
[键]HKEY_LOCAL_MACHINE\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\DESKTOP\NAMESPACE\{450D8FBA-AD25-11D0-98A8-0800361B1103}
[值]@
[类型]REG_SZ
[内容]空
[键]HKEY_LOCAL_MACHINE\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\DESKTOP\NAMESPACE\{450D8FBA-AD25-11D0-98A8-0800361B1103}
[值]REMOVAL MESSAGE
[类型]REG_SZ
[内容]@mydocs.dll,-900
[键]HKEY_LOCAL_MACHINE\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\DESKTOP\NAMESPACE\{645FF040-5081-101B-9F08-00AA002F954E}
[值]@
[类型]REG_SZ
[内容]recycle bin
[键]HKEY_LOCAL_MACHINE\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\DESKTOP\NAMESPACE\{E17D4FC0-5564-11D1-83F2-00A0C90DC849}
[值]@
[类型]REG_SZ
[内容]search results folder
[键]HKEY_LOCAL_MACHINE\SYSTEM\CURRENTCONTROLSET\CONTROL\SESSION MANAGER
[值]PENDINGFILERENAMEOPERATIONS
[类型]REG_MULTI_SZ
[内容]\??\c:\program files\360\360safe\update\~tmc.tmp
[键]HKEY_LOCAL_MACHINE\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\BROWSER HELPER OBJECTS\{01443AEC-0FD1-40FD-9C87-E93D1494C233}
[值]@
[类型]REG_SZ
[内容]thunder atonce
[键]HKEY_LOCAL_MACHINE\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\BROWSER HELPER OBJECTS\{2D90D33C-DE76-42D0-9040-E4466DDC24AC}
[值]@
[类型]REG_SZ
[内容]xlliteview browserhelper object
[键]HKEY_LOCAL_MACHINE\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\BROWSER HELPER OBJECTS\{2D90D33C-DE76-42D0-9040-E4466DDC24AC}
[值]NOEXPLORER
[类型]REG_DWORD
[内容]0x00000001
[键]HKEY_LOCAL_MACHINE\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\BROWSER HELPER OBJECTS\{7C260B4B-F7A0-40B5-B403-BEFCDC6A4C3B}
[值]@
[类型]REG_SZ
[内容]tswebmon
[键]HKEY_LOCAL_MACHINE\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\BROWSER HELPER OBJECTS\{7C260B4B-F7A0-40B5-B403-BEFCDC6A4C3B}
[值]NOEXPLORER
[类型]REG_DWORD
[内容]0x00000001
[键]HKEY_LOCAL_MACHINE\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\BROWSER HELPER OBJECTS\{889D2FEB-5411-4565-8998-1DD2C5261283}
[值]@
[类型]REG_SZ
[内容]thunderbho
[键]HKEY_LOCAL_MACHINE\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\BROWSER HELPER OBJECTS\{B69F34DD-F0F9-42DC-9EDD-957187DA688D}
[值]NOEXPLORER
[类型]REG_DWORD
[内容]0x00000001
[键]HKEY_CURRENT_USER\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\CLSID\{450D8FBA-AD25-11D0-98A8-0800361B1103}\DEFAULTICON
[值]@
[类型]REG_EXPAND_SZ
[内容]%systemroot%\system32\mydocs.dll,0
[键]HKEY_CURRENT_USER\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\CLSID\{645FF040-5081-101B-9F08-00AA002F954E}\DEFAULTICON
[值]@
[类型]REG_EXPAND_SZ
[内容]%systemroot%\system32\shell32.dll,32
[键]HKEY_CURRENT_USER\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\CLSID\{645FF040-5081-101B-9F08-00AA002F954E}\DEFAULTICON
[值]FULL
[类型]REG_EXPAND_SZ
[内容]%systemroot%\system32\shell32.dll,32
[键]HKEY_CURRENT_USER\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\CLSID\{645FF040-5081-101B-9F08-00AA002F954E}\DEFAULTICON
[值]EMPTY
[类型]REG_EXPAND_SZ
[内容]%systemroot%\system32\shell32.dll,31
[键]HKEY_CURRENT_USER\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\CLSID\{871C5380-42A0-1069-A2EA-08002B30309D}\SHELLFOLDER
[值]ATTRIBUTES
[类型]REG_DWORD
[内容]0x00000000
[键]HKEY_LOCAL_MACHINE\SOFTWARE\CLASSES\CLSID\{0002DF01-0000-0000-C000-000000000046}\LOCALSERVER32
[值]@
[类型]REG_SZ
[内容]"c:\program files\internet explorer\iexplore.exe"
[键]HKEY_LOCAL_MACHINE\SOFTWARE\CLASSES\CLSID\{25336920-03F9-11CF-8FD0-00AA00686F13}\DEFAULTICON
[值]@
[类型]REG_SZ
[内容]c:\program files\internet explorer\iexplore.exe.mui,-17
[键]HKEY_LOCAL_MACHINE\SOFTWARE\CLASSES\CLSID\{3050F3D9-98B5-11CF-BB82-00AA00BDCE0B}\DEFAULTICON
[值]@
[类型]REG_SZ
[内容]c:\program files\internet explorer\iexplore.exe.mui,-17
[键]HKEY_LOCAL_MACHINE\SOFTWARE\CLASSES\CLSID\{42042206-2D85-11D3-8CFF-005004838597}\OLD ICON\HTMLFILE\DEFAULTICON
[值]@
[类型]REG_SZ
[内容]c:\program files\internet explorer\iexplore.exe,-17
[键]HKEY_LOCAL_MACHINE\SOFTWARE\CLASSES\CLSID\{42042206-2D85-11D3-8CFF-005004838597}\OLD ICON\MHTMLFILE\DEFAULTICON
[值]@
[类型]REG_SZ
[内容]c:\program files\internet explorer\iexplore.exe,-32554
[键]HKEY_LOCAL_MACHINE\SOFTWARE\CLASSES\CLSID\{65014010-9F62-11D1-A651-00600811D5CE}\DEFAULTICON
[值]@
[类型]REG_EXPAND_SZ
[内容]c:\program files\internet explorer\iexplore.exe,1
[键]HKEY_LOCAL_MACHINE\SOFTWARE\CLASSES\CLSID\{871C5380-42A0-1069-A2EA-08002B30309D}\SHELL\OPENHOMEPAGE\COMMAND
[值]@
[类型]REG_SZ
[内容]"c:\program files\internet explorer\iexplore.exe"
[键]HKEY_LOCAL_MACHINE\SOFTWARE\CLASSES\CLSID\{AE24FDAE-03C6-11D1-8B76-0080C744F389}\TOOLBOXBITMAP32
[值]@
[类型]REG_SZ
[内容]c:\program files\internet explorer\iexplore.exe.mui,-17
[键]HKEY_LOCAL_MACHINE\SOFTWARE\CLASSES\CLSID\{D5E8041D-920F-45E9-B8FB-B1DEB82C6E5E}\LOCALSERVER32
[值]@
[类型]REG_EXPAND_SZ
[内容]"%programfiles%\internet explorer\iexplore.exe" -startmediumtab
[键]HKEY_LOCAL_MACHINE\SOFTWARE\CLASSES\CLSID\{FBF23B42-E3F0-101B-8488-00AA003E56F8}\DEFAULTICON
[值]@
[类型]REG_EXPAND_SZ
[内容]"%programfiles%\internet explorer\iexplore.exe",-32528
[键]HKEY_CURRENT_USER\SOFTWARE\MICROSOFT\INTERNET EXPLORER\EXPLORER BARS\{C4EE31F3-4768-11D2-BE5C-00A0C9A83DA1}\COMPUTERNAMEMRU
[值]000
[类型]REG_SZ
[内容]xcdn
[键]HKEY_CLASSES_ROOT\HTTP\SHELL\OPEN\COMMAND
[值]@
[类型]REG_SZ
[内容]"c:\program files\internet explorer\iexplore.exe" -nohome
[键]HKEY_CURRENT_USER\SOFTWARE\MICROSOFT\INTERNET EXPLORER\MAIN
[值]START PAGE
[类型]REG_SZ
[内容]http://hao222.com
[键]HKEY_CURRENT_USER\SOFTWARE\MICROSOFT\INTERNET EXPLORER\MAIN
[值]SEARCH PAGE
[类型]REG_SZ
[内容]http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
[键]HKEY_LOCAL_MACHINE\SOFTWARE\MICROSOFT\INTERNET EXPLORER\MAIN
[值]DEFAULT_PAGE_URL
[类型]REG_SZ
[内容]http://go.microsoft.com/fwlink/?linkid=69157
[键]HKEY_LOCAL_MACHINE\SOFTWARE\MICROSOFT\INTERNET EXPLORER\MAIN
[值]LOCAL PAGE
[类型]REG_SZ
[内容]c:\windows\system32\blank.htm
[键]HKEY_LOCAL_MACHINE\SOFTWARE\MICROSOFT\INTERNET EXPLORER\MAIN
[值]SEARCH PAGE
[类型]REG_SZ
[内容]http://go.microsoft.com/fwlink/?linkid=54896
[键]HKEY_LOCAL_MACHINE\SOFTWARE\MICROSOFT\INTERNET EXPLORER\MAIN
[值]START PAGE
[类型]REG_SZ
[内容]http://go.microsoft.com/fwlink/?linkid=69157
用户系统信息：Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/4.0)
