今天看
http://bbs.ikaka.com/showtopic-8726509.aspx中的日志其中的一部分。
能不能帮忙讲解一下。
比如：[HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows]
<load><"C:\WINDOWS\system32\smss.exe:2075451338.vbs"> []这个的意思是不是开机加载smss.exe 和 这个VB脚本？
启动项目
注册表
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
<ctfmon.exe><C:\WINDOWS\system32\ctfmon.exe> [(Verified)Microsoft Windows Component Publisher]
<360sd><"D:\Program Files\360\360sd\360sd.exe" /autorun> [(Verified)Qizhi Software (beijing) Co. Ltd]
[HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows]
<load><"C:\WINDOWS\system32\smss.exe:2075451338.vbs"> []
==================================
文件关联
.TXT Error. [%SystemRoot%\System32\WScript.exe "C:\WINDOWS\explorer.exe:2075451338.vbs" %1 %* ]
.EXE OK. ["%1" %*]
.COM OK. ["%1" %*]
.PIF OK. ["%1" %*]
.REG Error. [%SystemRoot%\System32\WScript.exe "C:\WINDOWS\explorer.exe:2075451338.vbs" %1 %* ]
.BAT Error. [%SystemRoot%\System32\WScript.exe "C:\WINDOWS\explorer.exe:2075451338.vbs" %1 %* ]
.SCR OK. ["%1" /S]
.CHM Error. [%SystemRoot%\System32\WScript.exe "C:\WINDOWS\explorer.exe:2075451338.vbs" %1 %* ]
.HLP Error. [%SystemRoot%\System32\WScript.exe "C:\WINDOWS\explorer.exe:2075451338.vbs" %1 %* ]
.INI Error. [%SystemRoot%\System32\WScript.exe "C:\WINDOWS\explorer.exe:2075451338.vbs" %1 %* ]
.INF Error. [%SystemRoot%\System32\WScript.exe "C:\WINDOWS\explorer.exe:2075451338.vbs" %1 %* ]
.VBS OK. [%SystemRoot%\System32\WScript.exe "%1" %*]
.JS OK. [%SystemRoot%\System32\WScript.exe "%1" %*]
.LNK OK. [{00021401-0000-0000-C000-000000000046}]
==================================
Winsock 提供者
N/A
==================================
Autorun.inf
[C:\]
[AutoRun]
Shellexecute=WScript.exe 2075451338.vbs "AutoRun"
shell\open=打开(&O)
shell\open\command=WScript.exe 2075451338.vbs "AutoRun"
shell\open\Default=1
shell\explore=资源管理器(&X)
shell\explore\command=WScript.exe 2075451338.vbs "AutoRun"
[D:\]
[AutoRun]
Shellexecute=WScript.exe 809316412.vbs "AutoRun"
shell\open=打开(&O)
shell\open\command=WScript.exe 809316412.vbs "AutoRun"
shell\open\Default=1
shell\explore=资源管理器(&X)
shell\explore\command=WScript.exe 809316412.vbs "AutoRun"
[E:\]
[AutoRun]
Shellexecute=WScript.exe 751194252.vbs "AutoRun"
shell\open=打开(&O)
shell\open\command=WScript.exe 751194252.vbs "AutoRun"
shell\open\Default=1
shell\explore=资源管理器(&X)
shell\explore\command=WScript.exe 751194252.vbs "AutoRun"
[F:\]
[AutoRun]
Shellexecute=WScript.exe 801494726.vbs "AutoRun"
shell\open=打开(&O)
shell\open\command=WScript.exe 801494726.vbs "AutoRun"
shell\open\Default=1
shell\explore=资源管理器(&X)
shell\explore\command=WScript.exe 801494726.vbs "AutoRun"
用户系统信息：Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; SV1; Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1) ; Embedded Web Browser from: http://bsalsa.com/; .NET CLR 1.1.4322; .NET CLR 2.0.50727)
