给猫叔一份小礼物 ^^ - 瑞星卡卡安全论坛bbs.ikaka.com

瑞星卡卡安全论坛技术交流区 反病毒/反流氓软件论坛给猫叔一份小礼物 ^^

	瑞星“1+2”全新解决方案巡展在广州画上圆满句号		叶院长揭秘：瑞星如何运用AI技术革新网络安全		俄乌冲突加剧网络攻击风险白俄罗斯政府遭APT攻击		瑞星ESM防病毒系统助力矿业大学筑牢网络安全防线
	实力拉满瑞星第五十次通过VB100测评		携手老友，拥抱新精彩 —— 新论坛新活动，感谢你的陪伴		护航司法，瑞星助力山西省高院构建安全防线		人工智能在网络安全领域的风险和机遇

1

1 / 1 页

跳转页

给猫叔一份小礼物 ^^

新版小欧自信弱冠狮帖子:384 注册: 2007-01-31 来自:	发表于： 2007-05-19 11:36 \| 只看楼主短消息资料字号：小中大 1楼给猫叔一份小礼物 ^^ 这是偶今天早刚接手的一台单位用机客户称总觉得有问题叫帮瞧瞧用SREng一扫描偶发现了个老早以前见过的问题进程加载了一些好似无关紧要的DLL文件日志如下对于启动项里的那几个小东东本人已经清除 [CODE] 2007-05-19,10:59:35 System Repair Engineer 2.4.12.806 Smallfrogs (http://www.KZTechs.com) Windows XP Professional Service Pack 2 (Build 2600) - 管理权限用户 - 完整功能以下内容被选中：所有的启动项目（包括注册表、启动文件夹、服务等）浏览器加载项正在运行的进程（包括进程模块信息）文件关联 Winsock 提供者 Autorun.inf HOSTS 文件启动项目注册表 [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run] <ctfmon.exe><C:\WINDOWS\system32\ctfmon.exe> [(Verified)Microsoft Windows Publisher] <8fjy><C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\avp.exe> [N/A] <l81u><C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\iexpl0re.exe> [N/A] [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run] <KernelFaultCheck><%systemroot%\system32\dumprep 0 -k> [N/A] <SoundMan><SOUNDMAN.EXE> [(Verified)Microsoft Windows Hardware Compatibility Publisher] <Cmaudio><RunDll32 cmicnfg.cpl,CMICtrlWnd> [N/A] <CSMContext><C:\WINDOWS\system32\CSMContext.exe> [中文之星] <kav><"D:\下载软件\卡巴\avp.exe"> [Kaspersky Lab] [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon] <shell><Explorer.exe> [(Verified)Microsoft Windows Publisher] <Userinit><C:\WINDOWS\system32\userinit.exe,> [(Verified)Microsoft Windows Publisher] <UIHost><logonui.exe> [(Verified)Microsoft Windows Publisher] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks] <{AEB6717E-7E19-11d0-97EE-00C04FD91972}><shell32.dll> [Microsoft Corporation] <{A6011F8F-A7F8-49AA-9ADA-49127D43138F}><> [N/A] <{754FB7D8-B8FE-4810-B363-A788CD060F1F}><> [N/A] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad] <PostBootReminder><%SystemRoot%\system32\SHELL32.dll> [Microsoft Corporation] <CDBurn><%SystemRoot%\system32\SHELL32.dll> [Microsoft Corporation] <WebCheck><%SystemRoot%\system32\webcheck.dll> [(Verified)Microsoft Windows Publisher] <SysTray><C:\WINDOWS\system32\stobject.dll> [(Verified)Microsoft Windows Publisher] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\crypt32chain] <WinlogonNotify: crypt32chain><crypt32.dll> [(Verified)Microsoft Windows Publisher] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\cryptnet] <WinlogonNotify: cryptnet><cryptnet.dll> [(Verified)Microsoft Windows Publisher] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\cscdll] <WinlogonNotify: cscdll><cscdll.dll> [(Verified)Microsoft Windows Publisher] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\klogon] <WinlogonNotify: klogon><C:\WINDOWS\system32\klogon.dll> [Kaspersky Lab] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\ScCertProp] <WinlogonNotify: ScCertProp><wlnotify.dll> [(Verified)Microsoft Windows Publisher] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\Schedule] <WinlogonNotify: Schedule><wlnotify.dll> [(Verified)Microsoft Windows Publisher] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\sclgntfy] <WinlogonNotify: sclgntfy><sclgntfy.dll> [(Verified)Microsoft Windows Publisher] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\SensLogn] <WinlogonNotify: SensLogn><WlNotify.dll> [(Verified)Microsoft Windows Publisher] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\termsrv] <WinlogonNotify: termsrv><wlnotify.dll> [(Verified)Microsoft Windows Publisher] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\wlballoon] <WinlogonNotify: wlballoon><wlnotify.dll> [(Verified)Microsoft Windows Publisher] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler] <{438755C2-A8BA-11D1-B96B-00A0C90312E1}><%SystemRoot%\system32\browseui.dll> [Microsoft Corporation] <{8C7461EF-2B13-11d2-BE35-3078302C2030}><%SystemRoot%\system32\browseui.dll> [Microsoft Corporation] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\>{22d6f312-b0f6-11d0-94ab-0080c74c7e95}] <Microsoft Windows Media Player><C:\WINDOWS\inf\unregmp2.exe /ShowWMP> [(Verified)Microsoft Windows Publisher] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\>{60B49E34-C7CC-11D0-8953-00A0C90347FF}MICROS] <浏览器自定义组件><RunDLL32 IEDKCS32.DLL,BrandIE4 SIGNUP> [(Verified)Microsoft Windows Publisher] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{89820200-ECBD-11cf-8B85-00AA005B4340}] <Windows 桌面更新><regsvr32.exe /s /n /i:U shell32.dll> [(Verified)Microsoft Windows Publisher] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{89820200-ECBD-11cf-8B85-00AA005B4383}] <Internet Explorer 6><%SystemRoot%\system32\ie4uinit.exe> [(Verified)Microsoft Windows Publisher] [HKEY_CURRENT_USER\Control Panel\Desktop] <SCRNSAVE.EXE><C:\WINDOWS\system32\ssmypics.scr> [(Verified)Microsoft Windows Publisher] ================================== 启动文件夹 [服务管理器] <C:\Documents and Settings\All Users\「开始」菜单\程序\启动\服务管理器.lnk --> C:\PROGRA~1\MICROS~3\80\Tools\Binn\sqlmangr.exe [Microsoft Corporation]><N> ================================== 服务 [卡巴斯基反病毒6.0 / AVP][Running/Auto Start] <D:\下载软件\卡巴\avp.exe -r><Kaspersky Lab> [DCOM Server Process Launcher / DcomLaunch][Running/Auto Start] <C:\WINDOWS\system32\svchost -k DcomLaunch-->%SystemRoot%\system32\rpcss.dll><Microsoft Corporation> [DHCP Client / Dhcp][Running/Auto Start] <C:\WINDOWS\system32\svchost.exe -k netsvcs-->%SystemRoot%\System32\dhcpcsvc.dll><Microsoft Corporation> [COM+ Event System / EventSystem][Running/Manual Start] <C:\WINDOWS\system32\svchost.exe -k netsvcs-->C:\WINDOWS\system32\es.dll><Microsoft Corporation> [Human Interface Device Access / HidServ][Stopped/Disabled] <C:\WINDOWS\System32\svchost.exe -k netsvcs-->%SystemRoot%\System32\hidserv.dll><N/A> [Server / lanmanserver][Running/Auto Start] <C:\WINDOWS\system32\svchost.exe -k netsvcs-->%SystemRoot%\System32\srvsvc.dll><Microsoft Corporation> [Workstation / lanmanworkstation][Running/Auto Start] <C:\WINDOWS\system32\svchost.exe -k netsvcs-->%SystemRoot%\System32\wkssvc.dll><Microsoft Corporation> [MSSQL$HC / MSSQL$HC][Running/Auto Start] <C:\PROGRA~1\MICROS~3\MSSQL$HC\binn\sqlservr.exe -sHC><Microsoft Corporation> [MSSQLServerADHelper / MSSQLServerADHelper][Stopped/Manual Start] <C:\Program Files\Microsoft SQL Server\80\Tools\Binn\sqladhlp.exe><Microsoft Corporation> [Network Connections / Netman][Running/Manual Start] <C:\WINDOWS\System32\svchost.exe -k netsvcs-->%SystemRoot%\System32\netman.dll><Microsoft Corporation> [Remote Access Connection Manager / RasMan][Running/Manual Start] <C:\WINDOWS\system32\svchost.exe -k netsvcs-->%SystemRoot%\System32\rasmans.dll><Microsoft Corporation> [Remote Procedure Call (RPC) / RpcSs][Running/Auto Start] <C:\WINDOWS\system32\svchost -k rpcss-->%SystemRoot%\system32\rpcss.dll><Microsoft Corporation> [Print Spooler / Spooler][Running/Auto Start] <C:\WINDOWS\system32\spoolsv.exe><Microsoft Corporation> [SQLAgent$HC / SQLAgent$HC][Stopped/Manual Start] <C:\PROGRA~1\MICROS~3\MSSQL$HC\binn\sqlagent.exe -i HC><Microsoft Corporation> [Telephony / TapiSrv][Running/Manual Start] <C:\WINDOWS\System32\svchost.exe -k netsvcs-->%SystemRoot%\System32\tapisrv.dll><Microsoft Corporation> [WebClient / WebClient][Stopped/Manual Start] <C:\WINDOWS\system32\svchost.exe -k LocalService-->%SystemRoot%\System32\webclnt.dll><Microsoft Corporation> ================================== 驱动程序 [Microsoft Kernel Acoustic Echo Canceller / aec][Stopped/Manual Start] <system32\drivers\aec.sys><Microsoft Corporation> [Service for Realtek AC97 Audio (WDM) / ALCXWDM][Stopped/Manual Start] <system32\drivers\ALCXWDM.SYS><Realtek Semiconductor Corp.> [C-Media WDM Audio Interface / cmuda][Running/Manual Start] <system32\drivers\cmuda.sys><C-Media Inc> [FltMgr / FltMgr][Running/Boot Start] <\SystemRoot\system32\DRIVERS\fltMgr.sys><Microsoft Corporation> [GrandDog USB Driver / Grand][Stopped/Manual Start] <System32\Drivers\GrandUsb.sys><SafeNet China Ltd.> [HOSTNT / HOSTNT][Running/Auto Start] <\??\C:\WINDOWS\system32\drivers\hostnt.sys><N/A> [HTTP / HTTP][Stopped/Manual Start] <System32\Drivers\HTTP.sys><Microsoft Corporation> [IP Network Address Translator / IpNat][Running/Manual Start] <system32\DRIVERS\ipnat.sys><Microsoft Corporation> [kl1 / kl1][Running/Boot Start] <\SystemRoot\system32\drivers\kl1.sys><Kaspersky Lab> [klif / klif][Running/System Start] <\??\C:\WINDOWS\system32\drivers\klif.sys><Kaspersky Lab> [Microsoft Kernel Wave Audio Mixer / kmixer][Stopped/Manual Start] <system32\drivers\kmixer.sys><Microsoft Corporation> [MRxSmb / MRxSmb][Running/System Start] <system32\DRIVERS\mrxsmb.sys><Microsoft Corporation> [npkcrypt / npkcrypt][Running/Auto Start] <\??\D:\Program Files\QQ2006\npkcrypt.sys><INCA Internet Co., Ltd.> [npkycryp / npkycryp][Stopped/Manual Start] <\??\D:\Program Files\QQ2006\npkycryp.sys><N/A> [Direct Parallel Link Driver / Ptilink][Running/Manual Start] <system32\DRIVERS\ptilink.sys><Parallel Technologies, Inc.> [Rdbss / Rdbss][Running/System Start] <system32\DRIVERS\rdbss.sys><Microsoft Corporation> [Realtek RTL8139(A/B/C)-based PCI Fast Ethernet Adapter NT Driver / rtl8139][Running/Manual Start] <system32\DRIVERS\RTL8139.SYS><Realtek Semiconductor Corporation> [Secdrv / Secdrv][Stopped/Manual Start] <system32\DRIVERS\secdrv.sys><N/A> [SiS315 / SiS315][Running/Manual Start] <system32\DRIVERS\sisgrp.sys><Silicon Integrated Systems Corporation> [Service for AC'97 Sample Driver (WDM) / SiS7012][Stopped/Manual Start] <system32\drivers\sis7012.sys><Silicon Integrated Systems Corporation> [SiS AGP Filter / sisagp][Running/Boot Start] <\SystemRoot\system32\DRIVERS\SISAGPX.sys><Silicon Integrated Systems Corporation> [SiSkp / SiSkp][Running/System Start] <system32\DRIVERS\srvkp.sys><Silicon Integrated Systems Corporation> [Microsoft Kernel Audio Splitter / splitter][Stopped/Manual Start] <system32\drivers\splitter.sys><Microsoft Corporation> [Srv / Srv][Running/Manual Start] <system32\DRIVERS\srv.sys><Microsoft Corporation> [TCP/IP Protocol Driver / Tcpip][Running/System Start] <system32\DRIVERS\tcpip.sys><Microsoft Corporation> [Microcode Update Driver / Update][Running/Manual Start] <system32\DRIVERS\update.sys><Microsoft Corporation> [Microsoft WINMM WDM Audio Compatibility Driver / wdmaud][Running/Manual Start] <system32\drivers\wdmaud.sys><Microsoft Corporation> 加个图附件: 文件名:8345092007519112640.jpg 下载次数:238 文件类型:image/pjpeg 文件大小: 上传时间:2007-5-19 11:36:43 描述: 2007-05-19 13:36:14
新版小欧自信弱冠狮帖子:384 注册: 2007-01-31 来自:	分享到：

新版小欧自信弱冠狮帖子:384 注册: 2007-01-31 来自:	发表于： 2007-05-19 11:38 \| 只看楼主短消息资料字号：小中大 2楼 ================================== 浏览器加载项 [KPBHO Class] {7C7DE9B8-CAA6-4B31-BC09-45AFC6B90FDE} <C:\WINDOWS\system32\iesense.dll, 天索网> [Thunder Browser Helper] {889D2FEB-5411-4565-8998-1DD2C5261283} <C:\Program Files\Thunder Network\Thunder\ComDlls\XunLeiBHO_001.dll, Thunder Networking Technologies,LTD> [NavigatMon Class] {B69F34DD-F0F9-42DC-9EDD-957187DA688D} <C:\Program Files\360safe\safemon\safemon.dll, > [Web反病毒保护] {1F460357-8A94-4D71-9CA3-AA4ACF32ED8E} <D:\下载软件\卡巴\scieplugin.dll, Kaspersky Lab> [信息检索(&R)] {92780B25-18CC-41C8-B9BE-3C9C571A8263} <C:\PROGRA~1\MICROS~1\OFFICE11\REFIEBAR.DLL, Microsoft Corporation> [ActiveMovieControl Object] {05589FA1-C356-11CE-BF01-00AA0055595A} <C:\WINDOWS\system32\wmpdxm.dll, Microsoft Corporation> [Windows Media Player] {22D6F312-B0F6-11D0-94AB-0080C74C7E95} <C:\WINDOWS\system32\wmpdxm.dll, Microsoft Corporation> [HTML Document] {25336920-03F9-11CF-8FD0-00AA00686F13} <%SystemRoot%\system32\Mshtml.dll, N/A> [Tabular Data Control] {333C7BC4-460F-11D0-BC04-0080C7055A83} <C:\WINDOWS\system32\tdc.ocx, Microsoft Corporation> [IETag Factory] {38481807-CA0E-42D2-BF39-B33AF135CC4D} <C:\PROGRA~1\COMMON~1\MICROS~1\SMARTT~1\IETAG.DLL, Microsoft Corporation> [Shell Name Space] {55136805-B2DE-11D1-B9F2-00A0C98BC547} <%SystemRoot%\system32\shdocvw.dll, N/A> [Windows Media Player] {6BF52A52-394A-11D3-B153-00C04F79FAA6} <C:\WINDOWS\system32\wmp.dll, Microsoft Corporation> [CCtInf Class] {6DBB2904-082D-4DB0-944A-21C22BA121F4} <C:\WINDOWS\system32\BANKCE~1.DLL, > [KPBHO Class] {7C7DE9B8-CAA6-4B31-BC09-45AFC6B90FDE} <C:\WINDOWS\system32\iesense.dll, 天索网> [Microsoft Web 浏览器] {8856F961-340A-11D0-A96B-00C04FD705A2} <C:\WINDOWS\system32\shdocvw.dll, Microsoft Corporation> [Thunder Browser Helper] {889D2FEB-5411-4565-8998-1DD2C5261283} <C:\Program Files\Thunder Network\Thunder\ComDlls\XunLeiBHO_001.dll, Thunder Networking Technologies,LTD> [WebVGPlayer Class] {AA899B43-24BD-4B6B-BBD0-45557D8D11E0} <C:\PROGRA~1\NETPLA~1.5\VGPlayer.dll, > [SearchAssistantOC] {B45FF030-4447-11D2-85DE-00C04FA35C89} <%SystemRoot%\system32\shdocvw.dll, N/A> [NavigatMon Class] {B69F34DD-F0F9-42DC-9EDD-957187DA688D} <C:\Program Files\360safe\safemon\safemon.dll, > [RDS.DataSpace] {BD96C556-65A3-11D0-983A-00C04FC29E36} <C:\Program Files\Common Files\System\msadc\msadco.dll, Microsoft Corporation> [RealPlayer G2 Control] {CFCDAA03-8BE4-11CF-B84B-0020AFBBCCFA} <C:\WINDOWS\system32\rmoc3260.dll, RealNetworks, Inc.> [Shockwave Flash Object] {D27CDB6E-AE6D-11CF-96B8-444553540000} <C:\WINDOWS\system32\Macromed\Flash\Flash9b.ocx, Adobe Systems, Inc.> [使用迅雷下载] <C:\Program Files\Thunder Network\Thunder\Program\GetUrl.htm, N/A> [使用迅雷下载全部链接] <C:\Program Files\Thunder Network\Thunder\Program\GetAllUrl.htm, N/A> [导出到 Microsoft Office Excel(&X)] <res://C:\PROGRA~1\MICROS~1\OFFICE11\EXCEL.EXE/3000, N/A>
新版小欧自信弱冠狮帖子:384 注册: 2007-01-31 来自:

新版小欧自信弱冠狮帖子:384 注册: 2007-01-31 来自:	发表于： 2007-05-19 11:38 \| 只看楼主短消息资料字号：小中大 3楼 ================================== 正在运行的进程 [PID: 500][\SystemRoot\System32\smss.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)] [PID: 568][\??\C:\WINDOWS\system32\csrss.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)] [C:\WINDOWS\system32\winsrv.dll] [Microsoft Corporation, 5.1.2600.2751 (xpsp_sp2_gdr.050831-1520)] [C:\WINDOWS\system32\GDI32.dll] [Microsoft Corporation, 5.1.2600.2818 (xpsp_sp2_gdr.051228-1427)] [C:\WINDOWS\system32\KERNEL32.dll] [Microsoft Corporation, 5.1.2600.2945 (xpsp_sp2_gdr.060704-2349)] [C:\WINDOWS\system32\USER32.dll] [Microsoft Corporation, 5.1.2600.2622 (xpsp_sp2_gdr.050301-1519)] [C:\WINDOWS\system32\sxs.dll] [Microsoft Corporation, 5.1.2600.3019 (xpsp_sp2_gdr.061019-0414)] [PID: 1248][C:\WINDOWS\Explorer.EXE] [Microsoft Corporation, 6.00.2900.2180 (xpsp_sp2_rtm.040803-2158)] [C:\WINDOWS\system32\kernel32.dll] [Microsoft Corporation, 5.1.2600.2945 (xpsp_sp2_gdr.060704-2349)] [C:\WINDOWS\system32\GDI32.dll] [Microsoft Corporation, 5.1.2600.2818 (xpsp_sp2_gdr.051228-1427)] [C:\WINDOWS\system32\USER32.dll] [Microsoft Corporation, 5.1.2600.2622 (xpsp_sp2_gdr.050301-1519)] [C:\WINDOWS\system32\SHLWAPI.dll] [Microsoft Corporation, 6.00.2900.3020 (xpsp_sp2_gdr.061023-0214)] [C:\WINDOWS\system32\SHELL32.dll] [Microsoft Corporation, 6.00.2900.2951 (xpsp_sp2_gdr.060713-0009)] [C:\WINDOWS\system32\ole32.dll] [Microsoft Corporation, 5.1.2600.2726 (xpsp_sp2_gdr.050725-1528)] [C:\WINDOWS\system32\BROWSEUI.dll] [Microsoft Corporation, 6.00.2900.3020 (xpsp_sp2_gdr.061023-0214)] [C:\WINDOWS\system32\SHDOCVW.dll] [Microsoft Corporation, 6.00.2900.3020 (xpsp_sp2_gdr.061023-0214)] [C:\WINDOWS\system32\NETAPI32.dll] [Microsoft Corporation, 5.1.2600.2976 (xpsp_sp2_gdr.060817-0106)] [C:\WINDOWS\system32\WININET.dll] [Microsoft Corporation, 6.00.2900.3020 (xpsp_sp2_gdr.061023-0214)] [C:\WINDOWS\system32\UxTheme.dll] [Microsoft Corporation, 6.00.2900.2180 (xpsp_sp2_rtm.040803-2158)] [C:\WINDOWS\system32\comctl32.dll] [Microsoft Corporation, 5.82 (xpsp.060825-0040)] [C:\WINDOWS\system32\CLBCATQ.DLL] [Microsoft Corporation, 2001.12.4414.308] [C:\WINDOWS\system32\xpsp2res.dll] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)] [C:\WINDOWS\system32\urlmon.dll] [Microsoft Corporation, 6.00.2900.3020 (xpsp_sp2_gdr.061023-0214)] [C:\WINDOWS\system32\LINKINFO.dll] [Microsoft Corporation, 5.1.2600.2751 (xpsp_sp2_gdr.050831-1520)] [C:\WINDOWS\system32\iphlpapi.dll] [Microsoft Corporation, 5.1.2600.2912 (xpsp_sp2_gdr.060519-0003)] [C:\Program Files\Thunder Network\Thunder\ComDlls\XunLeiBHO_001.dll] [Thunder Networking Technologies,LTD, 5, 0, 0, 1] [C:\Program Files\360safe\safemon\safemon.dll] [, 1, 0, 0, 1004] [C:\WINDOWS\system32\SXS.DLL] [Microsoft Corporation, 5.1.2600.3019 (xpsp_sp2_gdr.061019-0414)] [C:\WINDOWS\system32\MLANG.dll] [Microsoft Corporation, 6.00.2900.2530 (xpsp.040919-1030)] [C:\Program Files\WinRAR\rarext.dll] [N/A, ] [D:\下载软件\卡巴\shellex.dll] [Kaspersky Lab, 6.0.0.299] [PID: 1712][C:\WINDOWS\SOUNDMAN.EXE] [Realtek Semiconductor Corp., 5.1.0.40] [C:\WINDOWS\system32\kernel32.dll] [Microsoft Corporation, 5.1.2600.2945 (xpsp_sp2_gdr.060704-2349)] [C:\WINDOWS\system32\USER32.dll] [Microsoft Corporation, 5.1.2600.2622 (xpsp_sp2_gdr.050301-1519)] [C:\WINDOWS\system32\GDI32.dll] [Microsoft Corporation, 5.1.2600.2818 (xpsp_sp2_gdr.051228-1427)] [C:\WINDOWS\system32\SHLWAPI.dll] [Microsoft Corporation, 6.00.2900.3020 (xpsp_sp2_gdr.061023-0214)] [C:\WINDOWS\system32\comctl32.dll] [Microsoft Corporation, 5.82 (xpsp.060825-0040)] [C:\WINDOWS\system32\uxtheme.dll] [Microsoft Corporation, 6.00.2900.2180 (xpsp_sp2_rtm.040803-2158)] [C:\WINDOWS\system32\ole32.dll] [Microsoft Corporation, 5.1.2600.2726 (xpsp_sp2_gdr.050725-1528)] [PID: 1720][C:\WINDOWS\system32\RunDll32.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)] [C:\WINDOWS\system32\kernel32.dll] [Microsoft Corporation, 5.1.2600.2945 (xpsp_sp2_gdr.060704-2349)] [C:\WINDOWS\system32\GDI32.dll] [Microsoft Corporation, 5.1.2600.2818 (xpsp_sp2_gdr.051228-1427)] [C:\WINDOWS\system32\USER32.dll] [Microsoft Corporation, 5.1.2600.2622 (xpsp_sp2_gdr.050301-1519)] [C:\WINDOWS\system32\ole32.dll] [Microsoft Corporation, 5.1.2600.2726 (xpsp_sp2_gdr.050725-1528)] [C:\WINDOWS\system32\SHELL32.dll] [Microsoft Corporation, 6.00.2900.2951 (xpsp_sp2_gdr.060713-0009)] [C:\WINDOWS\system32\SHLWAPI.dll] [Microsoft Corporation, 6.00.2900.3020 (xpsp_sp2_gdr.061023-0214)] [C:\WINDOWS\system32\UxTheme.dll] [Microsoft Corporation, 6.00.2900.2180 (xpsp_sp2_rtm.040803-2158)] [C:\WINDOWS\system32\comctl32.dll] [Microsoft Corporation, 5.82 (xpsp.060825-0040)] [C:\WINDOWS\system\cmicnfg.cpl] [C-Media Corporation, 1, 0, 0, 38] [C:\WINDOWS\system32\CLBCATQ.DLL] [Microsoft Corporation, 2001.12.4414.308] [C:\WINDOWS\System32\udaprop.dll] [C-Media Corporation, 1.0.2.2] [PID: 1728][C:\WINDOWS\system32\CSMContext.exe] [中文之星, 1, 0, 0, 1] [C:\WINDOWS\system32\kernel32.dll] [Microsoft Corporation, 5.1.2600.2945 (xpsp_sp2_gdr.060704-2349)] [C:\WINDOWS\system32\USER32.dll] [Microsoft Corporation, 5.1.2600.2622 (xpsp_sp2_gdr.050301-1519)] [C:\WINDOWS\system32\GDI32.dll] [Microsoft Corporation, 5.1.2600.2818 (xpsp_sp2_gdr.051228-1427)] [C:\WINDOWS\system32\WININET.dll] [Microsoft Corporation, 6.00.2900.3020 (xpsp_sp2_gdr.061023-0214)] [C:\WINDOWS\system32\COMCTL32.dll] [Microsoft Corporation, 5.82 (xpsp.060825-0040)] [C:\WINDOWS\system32\uxtheme.dll] [Microsoft Corporation, 6.00.2900.2180 (xpsp_sp2_rtm.040803-2158)] [C:\WINDOWS\system32\NETAPI32.dll] [Microsoft Corporation, 5.1.2600.2976 (xpsp_sp2_gdr.060817-0106)] [C:\WINDOWS\system32\CLBCATQ.DLL] [Microsoft Corporation, 2001.12.4414.308] [C:\WINDOWS\system32\shdocvw.dll] [Microsoft Corporation, 6.00.2900.3020 (xpsp_sp2_gdr.061023-0214)] [C:\WINDOWS\system32\urlmon.dll] [Microsoft Corporation, 6.00.2900.3020 (xpsp_sp2_gdr.061023-0214)] [PID: 1788][C:\WINDOWS\system32\ctfmon.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)] [C:\WINDOWS\system32\kernel32.dll] [Microsoft Corporation, 5.1.2600.2945 (xpsp_sp2_gdr.060704-2349)] [C:\WINDOWS\system32\USER32.dll] [Microsoft Corporation, 5.1.2600.2622 (xpsp_sp2_gdr.050301-1519)] [C:\WINDOWS\system32\GDI32.dll] [Microsoft Corporation, 5.1.2600.2818 (xpsp_sp2_gdr.051228-1427)] [C:\WINDOWS\system32\ole32.dll] [Microsoft Corporation, 5.1.2600.2726 (xpsp_sp2_gdr.050725-1528)] [C:\WINDOWS\system32\SHELL32.dll] [Microsoft Corporation, 6.00.2900.2951 (xpsp_sp2_gdr.060713-0009)] [C:\WINDOWS\system32\SHLWAPI.dll] [Microsoft Corporation, 6.00.2900.3020 (xpsp_sp2_gdr.061023-0214)] [C:\WINDOWS\system32\UxTheme.dll] [Microsoft Corporation, 6.00.2900.2180 (xpsp_sp2_rtm.040803-2158)] [PID: 1928][C:\Program Files\Microsoft SQL Server\80\Tools\Binn\sqlmangr.exe] [Microsoft Corporation, 2000.080.0194.00] [C:\WINDOWS\system32\kernel32.dll] [Microsoft Corporation, 5.1.2600.2945 (xpsp_sp2_gdr.060704-2349)] [C:\WINDOWS\system32\GDI32.dll] [Microsoft Corporation, 5.1.2600.2818 (xpsp_sp2_gdr.051228-1427)] [C:\WINDOWS\system32\USER32.dll] [Microsoft Corporation, 5.1.2600.2622 (xpsp_sp2_gdr.050301-1519)] [C:\WINDOWS\system32\COMCTL32.dll] [Microsoft Corporation, 5.82 (xpsp.060825-0040)] [C:\WINDOWS\system32\SHELL32.dll] [Microsoft Corporation, 6.00.2900.2951 (xpsp_sp2_gdr.060713-0009)] [C:\WINDOWS\system32\SHLWAPI.dll] [Microsoft Corporation, 6.00.2900.3020 (xpsp_sp2_gdr.061023-0214)] [C:\WINDOWS\system32\ole32.dll] [Microsoft Corporation, 5.1.2600.2726 (xpsp_sp2_gdr.050725-1528)] [C:\Program Files\Microsoft SQL Server\80\Tools\Binn\W95SCM.dll] [Microsoft Corporation, 2000.080.0194.00] [C:\Program Files\Microsoft SQL Server\80\Tools\Binn\Resources\2052\SQLSVC.RLL] [Microsoft Corporation, 2000.080.0194.00] [C:\Program Files\Microsoft SQL Server\80\Tools\Binn\Resources\2052\sqlmangr.RLL] [Microsoft Corporation, 2000.080.0194.00] [C:\WINDOWS\system32\uxtheme.dll] [Microsoft Corporation, 6.00.2900.2180 (xpsp_sp2_rtm.040803-2158)] [PID: 1112][F:\SOFTTOOL\防毒杀毒\SRENG2\SRENG.EXE] [Smallfrogs Studio, 2.4.12.806] [C:\WINDOWS\system32\kernel32.dll] [Microsoft Corporation, 5.1.2600.2945 (xpsp_sp2_gdr.060704-2349)] [C:\WINDOWS\system32\USER32.dll] [Microsoft Corporation, 5.1.2600.2622 (xpsp_sp2_gdr.050301-1519)] [C:\WINDOWS\system32\GDI32.dll] [Microsoft Corporation, 5.1.2600.2818 (xpsp_sp2_gdr.051228-1427)] [C:\WINDOWS\system32\SHLWAPI.dll] [Microsoft Corporation, 6.00.2900.3020 (xpsp_sp2_gdr.061023-0214)] [C:\WINDOWS\system32\SHELL32.dll] [Microsoft Corporation, 6.00.2900.2951 (xpsp_sp2_gdr.060713-0009)] [C:\WINDOWS\system32\ole32.dll] [Microsoft Corporation, 5.1.2600.2726 (xpsp_sp2_gdr.050725-1528)] [C:\WINDOWS\system32\WININET.dll] [Microsoft Corporation, 6.00.2900.3020 (xpsp_sp2_gdr.061023-0214)] [C:\WINDOWS\system32\uxtheme.dll] [Microsoft Corporation, 6.00.2900.2180 (xpsp_sp2_rtm.040803-2158)] [C:\WINDOWS\system32\sfc_os.dll] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)] [C:\WINDOWS\system32\xpsp2res.dll] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)] [C:\WINDOWS\system32\netapi32.dll] [Microsoft Corporation, 5.1.2600.2976 (xpsp_sp2_gdr.060817-0106)] [C:\WINDOWS\system32\CLBCATQ.DLL] [Microsoft Corporation, 2001.12.4414.308] [C:\WINDOWS\system32\LINKINFO.dll] [Microsoft Corporation, 5.1.2600.2751 (xpsp_sp2_gdr.050831-1520)] ================================== 文件关联 .TXT OK. [%SystemRoot%\system32\NOTEPAD.EXE %1] .EXE OK. ["%1" %] .COM OK. ["%1" %] .PIF OK. ["%1" %] .REG OK. [regedit.exe "%1"] .BAT OK. ["%1" %] .SCR OK. ["%1" /S] .CHM OK. ["C:\WINDOWS\hh.exe" %1] .HLP OK. [%SystemRoot%\System32\winhlp32.exe %1] .INI OK. [%SystemRoot%\System32\NOTEPAD.EXE %1] .INF OK. [%SystemRoot%\System32\NOTEPAD.EXE %1] .VBS OK. [%SystemRoot%\System32\WScript.exe "%1" %] .JS OK. [%SystemRoot%\System32\WScript.exe "%1" %] .LNK OK. [{00021401-0000-0000-C000-000000000046}] ================================== Winsock 提供者 N/A ================================== Autorun.inf N/A ================================== HOSTS 文件 127.0.0.1 localhost ================================== API HOOK RVA 错误： LoadLibraryA (危险等级: 一般, 被下面模块所HOOK: Dest Addr: 0xF67D2B25) RVA 错误： LoadLibraryExA (危险等级: 一般, 被下面模块所HOOK: Dest Addr: 0xF67D2D67) RVA 错误： LoadLibraryExW (危险等级: 一般, 被下面模块所HOOK: Dest Addr: 0xF67D2F0B) RVA 错误： LoadLibraryW (危险等级: 一般, 被下面模块所HOOK: Dest Addr: 0xF67D2C49) RVA 错误： GetProcAddress (危险等级: 高, 被下面模块所HOOK: Dest Addr: 0xF67D2E8F) ================================== 隐藏进程 N/A ================================== [/CODE]
新版小欧自信弱冠狮帖子:384 注册: 2007-01-31 来自:

baohe 大版主帖子:72578 注册: 2003-04-10 来自:	发表于： 2007-05-19 12:00 \| 短消息资料字号：小中大 4楼【回复“新版小欧”的帖子】日志中异常项N多！启动、服务、驱动——————都有异常项。不知你搞掂没？
baohe 大版主帖子:72578 注册: 2003-04-10 来自:

新版小欧自信弱冠狮帖子:384 注册: 2007-01-31 来自:	发表于： 2007-05-19 12:41 \| 只看楼主短消息资料字号：小中大 5楼搞是搞过了不知可否全但进程加载过多的DLL还是没有变化附上清理后日志 [CODE] 2007-05-19,12:17:33 System Repair Engineer 2.4.12.806 Smallfrogs (http://www.KZTechs.com) Windows XP Professional Service Pack 2 (Build 2600) - 管理权限用户 - 完整功能以下内容被选中：所有的启动项目（包括注册表、启动文件夹、服务等）浏览器加载项正在运行的进程（包括进程模块信息）文件关联 Winsock 提供者 Autorun.inf HOSTS 文件启动项目注册表 [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run] <ctfmon.exe><C:\WINDOWS\system32\ctfmon.exe> [(Verified)Microsoft Windows Publisher] [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run] <SoundMan><SOUNDMAN.EXE> [(Verified)Microsoft Windows Hardware Compatibility Publisher] <CSMContext><C:\WINDOWS\system32\CSMContext.exe> [中文之星] <kav><"D:\下载软件\卡巴\avp.exe"> [Kaspersky Lab] <runeip><C:\Program Files\Rising\AntiSpyware\runiep.exe> [Beijing Rising Technology Co., Ltd.] [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon] <shell><Explorer.exe> [(Verified)Microsoft Windows Publisher] <Userinit><C:\WINDOWS\system32\userinit.exe,> [(Verified)Microsoft Windows Publisher] <UIHost><logonui.exe> [(Verified)Microsoft Windows Publisher] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad] <PostBootReminder><%SystemRoot%\system32\SHELL32.dll> [Microsoft Corporation] <CDBurn><%SystemRoot%\system32\SHELL32.dll> [Microsoft Corporation] <WebCheck><%SystemRoot%\system32\webcheck.dll> [(Verified)Microsoft Windows Publisher] <SysTray><C:\WINDOWS\system32\stobject.dll> [(Verified)Microsoft Windows Publisher] ================================== 启动文件夹 [服务管理器] <C:\Documents and Settings\All Users\「开始」菜单\程序\启动\服务管理器.lnk --> C:\PROGRA~1\MICROS~3\80\Tools\Binn\sqlmangr.exe [Microsoft Corporation]><N> ================================== 服务 [卡巴斯基反病毒6.0 / AVP][Running/Auto Start] <D:\下载软件\卡巴\avp.exe -r><Kaspersky Lab> [DCOM Server Process Launcher / DcomLaunch][Running/Auto Start] <C:\WINDOWS\system32\svchost -k DcomLaunch-->%SystemRoot%\system32\rpcss.dll><Microsoft Corporation> [DHCP Client / Dhcp][Running/Auto Start] <C:\WINDOWS\system32\svchost.exe -k netsvcs-->%SystemRoot%\System32\dhcpcsvc.dll><Microsoft Corporation> [COM+ Event System / EventSystem][Running/Manual Start] <C:\WINDOWS\system32\svchost.exe -k netsvcs-->C:\WINDOWS\system32\es.dll><Microsoft Corporation> [Human Interface Device Access / HidServ][Stopped/Disabled] <C:\WINDOWS\System32\svchost.exe -k netsvcs-->%SystemRoot%\System32\hidserv.dll><N/A> [Server / lanmanserver][Running/Auto Start] <C:\WINDOWS\system32\svchost.exe -k netsvcs-->%SystemRoot%\System32\srvsvc.dll><Microsoft Corporation> [Workstation / lanmanworkstation][Running/Auto Start] <C:\WINDOWS\system32\svchost.exe -k netsvcs-->%SystemRoot%\System32\wkssvc.dll><Microsoft Corporation> [MSSQL$HC / MSSQL$HC][Running/Auto Start] <C:\PROGRA~1\MICROS~3\MSSQL$HC\binn\sqlservr.exe -sHC><Microsoft Corporation> [MSSQLServerADHelper / MSSQLServerADHelper][Stopped/Manual Start] <C:\Program Files\Microsoft SQL Server\80\Tools\Binn\sqladhlp.exe><Microsoft Corporation> [Network Connections / Netman][Running/Manual Start] <C:\WINDOWS\System32\svchost.exe -k netsvcs-->%SystemRoot%\System32\netman.dll><Microsoft Corporation> [Remote Access Connection Manager / RasMan][Running/Manual Start] <C:\WINDOWS\system32\svchost.exe -k netsvcs-->%SystemRoot%\System32\rasmans.dll><Microsoft Corporation> [Remote Procedure Call (RPC) / RpcSs][Running/Auto Start] <C:\WINDOWS\system32\svchost -k rpcss-->%SystemRoot%\system32\rpcss.dll><Microsoft Corporation> [Telephony / TapiSrv][Running/Manual Start] <C:\WINDOWS\System32\svchost.exe -k netsvcs-->%SystemRoot%\System32\tapisrv.dll><Microsoft Corporation> [WebClient / WebClient][Stopped/Manual Start] <C:\WINDOWS\system32\svchost.exe -k LocalService-->%SystemRoot%\System32\webclnt.dll><Microsoft Corporation> ================================== 驱动程序 [Microsoft Kernel Acoustic Echo Canceller / aec][Stopped/Manual Start] <system32\drivers\aec.sys><Microsoft Corporation> [Service for Realtek AC97 Audio (WDM) / ALCXWDM][Stopped/Manual Start] <system32\drivers\ALCXWDM.SYS><Realtek Semiconductor Corp.> [C-Media WDM Audio Interface / cmuda][Running/Manual Start] <system32\drivers\cmuda.sys><C-Media Inc> [FltMgr / FltMgr][Running/Boot Start] <\SystemRoot\system32\DRIVERS\fltMgr.sys><Microsoft Corporation> [GrandDog USB Driver / Grand][Stopped/Manual Start] <System32\Drivers\GrandUsb.sys><SafeNet China Ltd.> [HOSTNT / HOSTNT][Running/Auto Start] <\??\C:\WINDOWS\system32\drivers\hostnt.sys><N/A> [HTTP / HTTP][Stopped/Manual Start] <System32\Drivers\HTTP.sys><Microsoft Corporation> [IP Network Address Translator / IpNat][Running/Manual Start] <system32\DRIVERS\ipnat.sys><Microsoft Corporation> [kl1 / kl1][Running/Boot Start] <\SystemRoot\system32\drivers\kl1.sys><Kaspersky Lab> [klif / klif][Running/System Start] <\??\C:\WINDOWS\system32\drivers\klif.sys><Kaspersky Lab> [Microsoft Kernel Wave Audio Mixer / kmixer][Stopped/Manual Start] <system32\drivers\kmixer.sys><Microsoft Corporation> [MRxSmb / MRxSmb][Running/System Start] <system32\DRIVERS\mrxsmb.sys><Microsoft Corporation> [Rdbss / Rdbss][Running/System Start] <system32\DRIVERS\rdbss.sys><Microsoft Corporation> [Realtek RTL8139(A/B/C)-based PCI Fast Ethernet Adapter NT Driver / rtl8139][Running/Manual Start] <system32\DRIVERS\RTL8139.SYS><Realtek Semiconductor Corporation> [SiS315 / SiS315][Running/Manual Start] <system32\DRIVERS\sisgrp.sys><Silicon Integrated Systems Corporation> [Service for AC'97 Sample Driver (WDM) / SiS7012][Stopped/Manual Start] <system32\drivers\sis7012.sys><Silicon Integrated Systems Corporation> [SiS AGP Filter / sisagp][Running/Boot Start] <\SystemRoot\system32\DRIVERS\SISAGPX.sys><Silicon Integrated Systems Corporation> [SiSkp / SiSkp][Running/System Start] <system32\DRIVERS\srvkp.sys><Silicon Integrated Systems Corporation> [Microsoft Kernel Audio Splitter / splitter][Stopped/Manual Start] <system32\drivers\splitter.sys><Microsoft Corporation> [Srv / Srv][Running/Manual Start] <system32\DRIVERS\srv.sys><Microsoft Corporation> [TCP/IP Protocol Driver / Tcpip][Running/System Start] <system32\DRIVERS\tcpip.sys><Microsoft Corporation> [Microcode Update Driver / Update][Running/Manual Start] <system32\DRIVERS\update.sys><Microsoft Corporation> [Microsoft WINMM WDM Audio Compatibility Driver / wdmaud][Running/Manual Start] <system32\drivers\wdmaud.sys><Microsoft Corporation>
新版小欧自信弱冠狮帖子:384 注册: 2007-01-31 来自:

新版小欧自信弱冠狮帖子:384 注册: 2007-01-31 来自:	发表于： 2007-05-19 12:41 \| 只看楼主短消息资料字号：小中大 6楼 ================================== 浏览器加载项 [KPBHO Class] {7C7DE9B8-CAA6-4B31-BC09-45AFC6B90FDE} <C:\WINDOWS\system32\iesense.dll, 天索网> [Thunder Browser Helper] {889D2FEB-5411-4565-8998-1DD2C5261283} <C:\Program Files\Thunder Network\Thunder\ComDlls\XunLeiBHO_001.dll, Thunder Networking Technologies,LTD> [NavigatMon Class] {B69F34DD-F0F9-42DC-9EDD-957187DA688D} <C:\Program Files\360safe\safemon\safemon.dll, > [Web反病毒保护] {1F460357-8A94-4D71-9CA3-AA4ACF32ED8E} <D:\下载软件\卡巴\scieplugin.dll, Kaspersky Lab> [信息检索(&R)] {92780B25-18CC-41C8-B9BE-3C9C571A8263} <C:\PROGRA~1\MICROS~1\OFFICE11\REFIEBAR.DLL, Microsoft Corporation> [访问瑞星网站] {FF2DE7A6-ECB1-4CBC-9C0E-D92A9E66E444} <http://www.rising.com.cn/?u=RSTB, N/A> [访问卡卡社区] {FF2DE7A6-ECB1-4CBC-9C0E-D92A9E66E445} <http://www.ikaka.com/?u=RSTB, N/A> [ActiveMovieControl Object] {05589FA1-C356-11CE-BF01-00AA0055595A} <C:\WINDOWS\system32\wmpdxm.dll, Microsoft Corporation> [Windows Media Player] {22D6F312-B0F6-11D0-94AB-0080C74C7E95} <C:\WINDOWS\system32\wmpdxm.dll, Microsoft Corporation> [HTML Document] {25336920-03F9-11CF-8FD0-00AA00686F13} <%SystemRoot%\system32\Mshtml.dll, N/A> [Tabular Data Control] {333C7BC4-460F-11D0-BC04-0080C7055A83} <C:\WINDOWS\system32\tdc.ocx, Microsoft Corporation> [IETag Factory] {38481807-CA0E-42D2-BF39-B33AF135CC4D} <C:\PROGRA~1\COMMON~1\MICROS~1\SMARTT~1\IETAG.DLL, Microsoft Corporation> [Shell Name Space] {55136805-B2DE-11D1-B9F2-00A0C98BC547} <%SystemRoot%\system32\shdocvw.dll, N/A> [使用迅雷下载] <C:\Program Files\Thunder Network\Thunder\Program\GetUrl.htm, N/A> [使用迅雷下载全部链接] <C:\Program Files\Thunder Network\Thunder\Program\GetAllUrl.htm, N/A> [导出到 Microsoft Office Excel(&X)] <res://C:\PROGRA~1\MICROS~1\OFFICE11\EXCEL.EXE/3000, N/A> ================================== 正在运行的进程 [PID: 476][\SystemRoot\System32\smss.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)] [PID: 540][\??\C:\WINDOWS\system32\csrss.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)] [C:\WINDOWS\system32\winsrv.dll] [Microsoft Corporation, 5.1.2600.2751 (xpsp_sp2_gdr.050831-1520)] [C:\WINDOWS\system32\GDI32.dll] [Microsoft Corporation, 5.1.2600.2818 (xpsp_sp2_gdr.051228-1427)] [C:\WINDOWS\system32\KERNEL32.dll] [Microsoft Corporation, 5.1.2600.2945 (xpsp_sp2_gdr.060704-2349)] [C:\WINDOWS\system32\USER32.dll] [Microsoft Corporation, 5.1.2600.2622 (xpsp_sp2_gdr.050301-1519)] [C:\WINDOWS\system32\sxs.dll] [Microsoft Corporation, 5.1.2600.3019 (xpsp_sp2_gdr.061019-0414)] [PID: 1184][C:\WINDOWS\Explorer.EXE] [Microsoft Corporation, 6.00.2900.2180 (xpsp_sp2_rtm.040803-2158)] [C:\WINDOWS\system32\kernel32.dll] [Microsoft Corporation, 5.1.2600.2945 (xpsp_sp2_gdr.060704-2349)] [C:\WINDOWS\system32\GDI32.dll] [Microsoft Corporation, 5.1.2600.2818 (xpsp_sp2_gdr.051228-1427)] [C:\WINDOWS\system32\USER32.dll] [Microsoft Corporation, 5.1.2600.2622 (xpsp_sp2_gdr.050301-1519)] [C:\WINDOWS\system32\SHLWAPI.dll] [Microsoft Corporation, 6.00.2900.3020 (xpsp_sp2_gdr.061023-0214)] [C:\WINDOWS\system32\SHELL32.dll] [Microsoft Corporation, 6.00.2900.2951 (xpsp_sp2_gdr.060713-0009)] [C:\WINDOWS\system32\ole32.dll] [Microsoft Corporation, 5.1.2600.2726 (xpsp_sp2_gdr.050725-1528)] [C:\WINDOWS\system32\BROWSEUI.dll] [Microsoft Corporation, 6.00.2900.3020 (xpsp_sp2_gdr.061023-0214)] [C:\WINDOWS\system32\SHDOCVW.dll] [Microsoft Corporation, 6.00.2900.3020 (xpsp_sp2_gdr.061023-0214)] [C:\WINDOWS\system32\NETAPI32.dll] [Microsoft Corporation, 5.1.2600.2976 (xpsp_sp2_gdr.060817-0106)] [C:\WINDOWS\system32\WININET.dll] [Microsoft Corporation, 6.00.2900.3020 (xpsp_sp2_gdr.061023-0214)] [C:\WINDOWS\system32\UxTheme.dll] [Microsoft Corporation, 6.00.2900.2180 (xpsp_sp2_rtm.040803-2158)] [C:\WINDOWS\system32\comctl32.dll] [Microsoft Corporation, 5.82 (xpsp.060825-0040)] [C:\WINDOWS\system32\CLBCATQ.DLL] [Microsoft Corporation, 2001.12.4414.308] [C:\WINDOWS\system32\xpsp2res.dll] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)] [C:\WINDOWS\system32\LINKINFO.dll] [Microsoft Corporation, 5.1.2600.2751 (xpsp_sp2_gdr.050831-1520)] [C:\Program Files\Rising\AntiSpyware\ieprot.dll] [Beijing Rising Technology Co., Ltd., 1, 0, 0, 8] [C:\WINDOWS\system32\iphlpapi.dll] [Microsoft Corporation, 5.1.2600.2912 (xpsp_sp2_gdr.060519-0003)] [C:\Program Files\WinRAR\rarext.dll] [N/A, ] [D:\下载软件\卡巴\shellex.dll] [Kaspersky Lab, 6.0.0.299] [C:\Program Files\Thunder Network\Thunder\ComDlls\XunLeiBHO_001.dll] [Thunder Networking Technologies,LTD, 5, 0, 0, 1] [C:\Program Files\360safe\safemon\safemon.dll] [, 1, 0, 0, 1004] [C:\WINDOWS\system32\SXS.DLL] [Microsoft Corporation, 5.1.2600.3019 (xpsp_sp2_gdr.061019-0414)] [C:\WINDOWS\system32\MLANG.dll] [Microsoft Corporation, 6.00.2900.2530 (xpsp.040919-1030)] [C:\WINDOWS\system32\mscms.dll] [Microsoft Corporation, 5.1.2600.2709 (xpsp_sp2_gdr.050628-1518)]
新版小欧自信弱冠狮帖子:384 注册: 2007-01-31 来自:

新版小欧自信弱冠狮帖子:384 注册: 2007-01-31 来自:	发表于： 2007-05-19 12:42 \| 只看楼主短消息资料字号：小中大 7楼 [PID: 1324][C:\WINDOWS\SOUNDMAN.EXE] [Realtek Semiconductor Corp., 5.1.0.40] [C:\WINDOWS\system32\kernel32.dll] [Microsoft Corporation, 5.1.2600.2945 (xpsp_sp2_gdr.060704-2349)] [C:\WINDOWS\system32\USER32.dll] [Microsoft Corporation, 5.1.2600.2622 (xpsp_sp2_gdr.050301-1519)] [C:\WINDOWS\system32\GDI32.dll] [Microsoft Corporation, 5.1.2600.2818 (xpsp_sp2_gdr.051228-1427)] [C:\WINDOWS\system32\SHELL32.dll] [Microsoft Corporation, 6.00.2900.2951 (xpsp_sp2_gdr.060713-0009)] [C:\WINDOWS\system32\SHLWAPI.dll] [Microsoft Corporation, 6.00.2900.3020 (xpsp_sp2_gdr.061023-0214)] [C:\WINDOWS\system32\comctl32.dll] [Microsoft Corporation, 5.82 (xpsp.060825-0040)] [C:\WINDOWS\system32\uxtheme.dll] [Microsoft Corporation, 6.00.2900.2180 (xpsp_sp2_rtm.040803-2158)] [C:\WINDOWS\system32\ole32.dll] [Microsoft Corporation, 5.1.2600.2726 (xpsp_sp2_gdr.050725-1528)] [C:\Program Files\Rising\AntiSpyware\ieprot.dll] [Beijing Rising Technology Co., Ltd., 1, 0, 0, 8] [PID: 1336][C:\WINDOWS\system32\CSMContext.exe] [中文之星, 1, 0, 0, 1] [C:\WINDOWS\system32\kernel32.dll] [Microsoft Corporation, 5.1.2600.2945 (xpsp_sp2_gdr.060704-2349)] [C:\WINDOWS\system32\USER32.dll] [Microsoft Corporation, 5.1.2600.2622 (xpsp_sp2_gdr.050301-1519)] [C:\WINDOWS\system32\GDI32.dll] [Microsoft Corporation, 5.1.2600.2818 (xpsp_sp2_gdr.051228-1427)] [C:\WINDOWS\system32\SHELL32.dll] [Microsoft Corporation, 6.00.2900.2951 (xpsp_sp2_gdr.060713-0009)] [C:\WINDOWS\system32\SHLWAPI.dll] [Microsoft Corporation, 6.00.2900.3020 (xpsp_sp2_gdr.061023-0214)] [C:\WINDOWS\system32\ole32.dll] [Microsoft Corporation, 5.1.2600.2726 (xpsp_sp2_gdr.050725-1528)] [C:\WINDOWS\system32\WININET.dll] [Microsoft Corporation, 6.00.2900.3020 (xpsp_sp2_gdr.061023-0214)] [C:\WINDOWS\system32\NETAPI32.dll] [Microsoft Corporation, 5.1.2600.2976 (xpsp_sp2_gdr.060817-0106)] [C:\WINDOWS\system32\iphlpapi.dll] [Microsoft Corporation, 5.1.2600.2912 (xpsp_sp2_gdr.060519-0003)] [C:\WINDOWS\system32\urlmon.dll] [Microsoft Corporation, 6.00.2900.3020 (xpsp_sp2_gdr.061023-0214)] [C:\WINDOWS\system32\DNSAPI.dll] [Microsoft Corporation, 5.1.2600.2938 (xpsp_sp2_gdr.060626-0020)] [C:\WINDOWS\system32\rasadhlp.dll] [Microsoft Corporation, 5.1.2600.2938 (xpsp_sp2_gdr.060626-0020)] [C:\WINDOWS\system32\CLBCATQ.DLL] [Microsoft Corporation, 2001.12.4414.308] [C:\WINDOWS\system32\shdocvw.dll] [Microsoft Corporation, 6.00.2900.3020 (xpsp_sp2_gdr.061023-0214)] [C:\Program Files\Rising\AntiSpyware\ieprot.dll] [Beijing Rising Technology Co., Ltd., 1, 0, 0, 8] [PID: 1356][C:\Program Files\Rising\AntiSpyware\runiep.exe] [Beijing Rising Technology Co., Ltd., 1, 0, 1, 4] [C:\WINDOWS\system32\kernel32.dll] [Microsoft Corporation, 5.1.2600.2945 (xpsp_sp2_gdr.060704-2349)] [C:\WINDOWS\system32\GDI32.dll] [Microsoft Corporation, 5.1.2600.2818 (xpsp_sp2_gdr.051228-1427)] [C:\WINDOWS\system32\USER32.dll] [Microsoft Corporation, 5.1.2600.2622 (xpsp_sp2_gdr.050301-1519)] [C:\WINDOWS\system32\SHELL32.dll] [Microsoft Corporation, 6.00.2900.2951 (xpsp_sp2_gdr.060713-0009)] [C:\WINDOWS\system32\SHLWAPI.dll] [Microsoft Corporation, 6.00.2900.3020 (xpsp_sp2_gdr.061023-0214)] [C:\WINDOWS\system32\comctl32.dll] [Microsoft Corporation, 5.82 (xpsp.060825-0040)] [C:\Program Files\Rising\AntiSpyware\iep_ctrl.dll] [Beijing Rising Technology Co., Ltd., 1, 0, 0, 4] [C:\Program Files\Rising\AntiSpyware\ieprot.dll] [Beijing Rising Technology Co., Ltd., 1, 0, 0, 8] [C:\WINDOWS\system32\uxtheme.dll] [Microsoft Corporation, 6.00.2900.2180 (xpsp_sp2_rtm.040803-2158)] [C:\WINDOWS\system32\ole32.dll] [Microsoft Corporation, 5.1.2600.2726 (xpsp_sp2_gdr.050725-1528)] [PID: 1364][C:\WINDOWS\system32\ctfmon.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)] [C:\WINDOWS\system32\kernel32.dll] [Microsoft Corporation, 5.1.2600.2945 (xpsp_sp2_gdr.060704-2349)] [C:\WINDOWS\system32\USER32.dll] [Microsoft Corporation, 5.1.2600.2622 (xpsp_sp2_gdr.050301-1519)] [C:\WINDOWS\system32\GDI32.dll] [Microsoft Corporation, 5.1.2600.2818 (xpsp_sp2_gdr.051228-1427)] [C:\WINDOWS\system32\ole32.dll] [Microsoft Corporation, 5.1.2600.2726 (xpsp_sp2_gdr.050725-1528)] [C:\WINDOWS\system32\SHELL32.dll] [Microsoft Corporation, 6.00.2900.2951 (xpsp_sp2_gdr.060713-0009)] [C:\WINDOWS\system32\SHLWAPI.dll] [Microsoft Corporation, 6.00.2900.3020 (xpsp_sp2_gdr.061023-0214)] [C:\WINDOWS\system32\UxTheme.dll] [Microsoft Corporation, 6.00.2900.2180 (xpsp_sp2_rtm.040803-2158)] [C:\Program Files\Rising\AntiSpyware\ieprot.dll] [Beijing Rising Technology Co., Ltd., 1, 0, 0, 8] [PID: 1384][C:\Program Files\Microsoft SQL Server\80\Tools\Binn\sqlmangr.exe] [Microsoft Corporation, 2000.080.0194.00] [C:\WINDOWS\system32\kernel32.dll] [Microsoft Corporation, 5.1.2600.2945 (xpsp_sp2_gdr.060704-2349)] [C:\WINDOWS\system32\GDI32.dll] [Microsoft Corporation, 5.1.2600.2818 (xpsp_sp2_gdr.051228-1427)] [C:\WINDOWS\system32\USER32.dll] [Microsoft Corporation, 5.1.2600.2622 (xpsp_sp2_gdr.050301-1519)] [C:\WINDOWS\system32\COMCTL32.dll] [Microsoft Corporation, 5.82 (xpsp.060825-0040)] [C:\WINDOWS\system32\SHELL32.dll] [Microsoft Corporation, 6.00.2900.2951 (xpsp_sp2_gdr.060713-0009)] [C:\WINDOWS\system32\SHLWAPI.dll] [Microsoft Corporation, 6.00.2900.3020 (xpsp_sp2_gdr.061023-0214)] [C:\WINDOWS\system32\ole32.dll] [Microsoft Corporation, 5.1.2600.2726 (xpsp_sp2_gdr.050725-1528)] [C:\Program Files\Microsoft SQL Server\80\Tools\Binn\W95SCM.dll] [Microsoft Corporation, 2000.080.0194.00] [C:\Program Files\Microsoft SQL Server\80\Tools\Binn\Resources\2052\SQLSVC.RLL] [Microsoft Corporation, 2000.080.0194.00] [C:\Program Files\Microsoft SQL Server\80\Tools\Binn\Resources\2052\sqlmangr.RLL] [Microsoft Corporation, 2000.080.0194.00] [C:\WINDOWS\system32\uxtheme.dll] [Microsoft Corporation, 6.00.2900.2180 (xpsp_sp2_rtm.040803-2158)] [C:\Program Files\Rising\AntiSpyware\ieprot.dll] [Beijing Rising Technology Co., Ltd., 1, 0, 0, 8] [PID: 1000][F:\SOFTTOOL\防毒杀毒\SRENG2\SRENG.EXE] [Smallfrogs Studio, 2.4.12.806] [C:\WINDOWS\system32\kernel32.dll] [Microsoft Corporation, 5.1.2600.2945 (xpsp_sp2_gdr.060704-2349)] [C:\WINDOWS\system32\USER32.dll] [Microsoft Corporation, 5.1.2600.2622 (xpsp_sp2_gdr.050301-1519)] [C:\WINDOWS\system32\GDI32.dll] [Microsoft Corporation, 5.1.2600.2818 (xpsp_sp2_gdr.051228-1427)] [C:\WINDOWS\system32\SHLWAPI.dll] [Microsoft Corporation, 6.00.2900.3020 (xpsp_sp2_gdr.061023-0214)] [C:\WINDOWS\system32\SHELL32.dll] [Microsoft Corporation, 6.00.2900.2951 (xpsp_sp2_gdr.060713-0009)] [C:\WINDOWS\system32\ole32.dll] [Microsoft Corporation, 5.1.2600.2726 (xpsp_sp2_gdr.050725-1528)] [C:\WINDOWS\system32\WININET.dll] [Microsoft Corporation, 6.00.2900.3020 (xpsp_sp2_gdr.061023-0214)] [C:\WINDOWS\system32\uxtheme.dll] [Microsoft Corporation, 6.00.2900.2180 (xpsp_sp2_rtm.040803-2158)] [C:\Program Files\Rising\AntiSpyware\ieprot.dll] [Beijing Rising Technology Co., Ltd., 1, 0, 0, 8] [C:\WINDOWS\system32\sfc_os.dll] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)] [C:\WINDOWS\system32\NETAPI32.dll] [Microsoft Corporation, 5.1.2600.2976 (xpsp_sp2_gdr.060817-0106)] [C:\WINDOWS\system32\iphlpapi.dll] [Microsoft Corporation, 5.1.2600.2912 (xpsp_sp2_gdr.060519-0003)] [C:\WINDOWS\system32\urlmon.dll] [Microsoft Corporation, 6.00.2900.3020 (xpsp_sp2_gdr.061023-0214)] [C:\WINDOWS\system32\DNSAPI.dll] [Microsoft Corporation, 5.1.2600.2938 (xpsp_sp2_gdr.060626-0020)] [C:\WINDOWS\system32\rasadhlp.dll] [Microsoft Corporation, 5.1.2600.2938 (xpsp_sp2_gdr.060626-0020)] [C:\WINDOWS\system32\xpsp2res.dll] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)] [C:\WINDOWS\system32\CLBCATQ.DLL] [Microsoft Corporation, 2001.12.4414.308] [C:\WINDOWS\system32\LINKINFO.dll] [Microsoft Corporation, 5.1.2600.2751 (xpsp_sp2_gdr.050831-1520)] ================================== 文件关联 .TXT OK. [%SystemRoot%\system32\NOTEPAD.EXE %1] .EXE OK. ["%1" %] .COM OK. ["%1" %] .PIF OK. ["%1" %] .REG OK. [regedit.exe "%1"] .BAT OK. ["%1" %] .SCR OK. ["%1" /S] .CHM OK. ["C:\WINDOWS\hh.exe" %1] .HLP OK. [%SystemRoot%\System32\winhlp32.exe %1] .INI OK. [%SystemRoot%\System32\NOTEPAD.EXE %1] .INF OK. [%SystemRoot%\System32\NOTEPAD.EXE %1] .VBS OK. [%SystemRoot%\System32\WScript.exe "%1" %] .JS OK. [%SystemRoot%\System32\WScript.exe "%1" %] .LNK OK. [{00021401-0000-0000-C000-000000000046}] ================================== Winsock 提供者 N/A ================================== Autorun.inf N/A ================================== HOSTS 文件 127.0.0.1 localhost ================================== API HOOK RVA 错误： LoadLibraryA (危险等级: 一般, 被下面模块所HOOK: Dest Addr: 0xF67D2B25) RVA 错误： LoadLibraryExA (危险等级: 一般, 被下面模块所HOOK: Dest Addr: 0xF67D2D67) RVA 错误： LoadLibraryExW (危险等级: 一般, 被下面模块所HOOK: Dest Addr: 0xF67D2F0B) RVA 错误： LoadLibraryW (危险等级: 一般, 被下面模块所HOOK: Dest Addr: 0xF67D2C49) RVA 错误： GetProcAddress (危险等级: 高, 被下面模块所HOOK: Dest Addr: 0xF67D2E8F) ================================== 隐藏进程 N/A ================================== [/CODE]
新版小欧自信弱冠狮帖子:384 注册: 2007-01-31 来自:

新版小欧自信弱冠狮帖子:384 注册: 2007-01-31 来自:	发表于： 2007-05-19 12:44 \| 只看楼主短消息资料字号：小中大 8楼下面这几个DLL 我总不是很喜欢....... C:\WINDOWS\system32\GDI32.dll C:\WINDOWS\system32\KERNEL32.dll C:\WINDOWS\system32\USER32.dll
新版小欧自信弱冠狮帖子:384 注册: 2007-01-31 来自:

loveperday 初生襁褓狮帖子:824 注册: 2007-05-11 来自:	发表于： 2007-05-19 13:46 \| 短消息资料字号：小中大 9楼但似乎都是好同志。。。
loveperday 初生襁褓狮帖子:824 注册: 2007-05-11 来自:

<<上一主题|下一主题>>

1

1 / 1 页

跳转页

页面顶部

Powered by Discuz!NT