未知家族病毒分析
扫描结果:
无可疑文件
系统活动进程
C:\WINDOWS\SYSTEM\KERNEL32.DLL
C:\WINDOWS\SYSTEM\KERNEL32.DLL
C:\WINDOWS\SYSTEM\MPREXE.EXE
C:\PROGRAM FILES\RISING\RAV\CCENTER.EXE
C:\WINDOWS\SYSTEM\KERNEL32.DLL
C:\PROGRAM FILES\RISING\RAV\RAVMON.EXE
C:\WINDOWS\EXPLORER.EXE
C:\WINDOWS\SYSTEM\RPCSS.EXE
C:\WINDOWS\SYSTEM\INTERNAT.EXE
C:\WINDOWS\SYSTEM\SYSTRAY.EXE
C:\PROGRAM FILES\RISING\RAV\RAVTASK.EXE
C:\WINDOWS\SOUNDMAN.EXE
C:\PROGRAM FILES\RACER-HENAN-CNC\RACER.EXE
C:\WINDOWS\SYSTEM\WMIEXE.EXE
C:\PROGRAM FILES\RACER-HENAN-CNC\RACERKP.EXE
C:\WINDOWS\SYSTEM\DDHELP.EXE
C:\PROGRAM FILES\RISING\RAV\RAVMOND.EXE
C:\WINDOWS\SYSTEM\KERNEL32.DLL
C:\PROGRAM FILES\INTERNET EXPLORER\IEXPLORE.EXE
C:\RSDETECT.EXE
普通自启动项
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
ScanRegistry = C:\WINDOWS\SCANREGW.EXE /AUTORUN
TaskMonitor = ; C:\WINDOWS\TASKMON.EXE
internat.exe = INTERNAT.EXE
SystemTray = SYSTRAY.EXE
LoadPowerProfile = ; RUNDLL32.EXE POWRPROF.DLL,LOADCURRENTPWRSCHEME
RavTask = "C:\PROGRAM FILES\RISING\RAV\RAVTASK.EXE" -SYSTEM
SoundMan = SOUNDMAN.EXE
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServices
LoadPowerProfile = ; RUNDLL32.EXE POWRPROF.DLL,LOADCURRENTPWRSCHEME
SchedulingAgent = ; C:\WINDOWS\SYSTEM\MSTASK.EXE
RsCcenter = "C:\PROGRAM FILES\RISING\RAV\CCENTER.EXE"
RavMond = "C:\PROGRAM FILES\RISING\RAV\RAVMOND.EXE"
RavMon = "C:\PROGRAM FILES\RISING\RAV\RAVMON.EXE" -SYSTEM
AppInit_DLLs
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows
AppInit_DLLs =
系统文件关联
.exe ==> exefile = "%1" %*
.com ==> comfile = "%1" %*
.bat ==> batfile = "%1" %*
.txt ==> txtfile = NOTEPAD.EXE %1
.scr ==> scrfile = "%1" /S
.reg ==> regfile = regedit.exe "%1"
.doc ==> Wordpad.Document.1 = C:\Progra~1\Access~1\WORDPAD.EXE "%1"
其它启动项
WIN.INI
无信息
SYSTEM.INI
SHELL = Explorer.exe
Winlogon 启动项
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon
IE - BHO
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper
Objects
{77FEF28E-EB96-44FF-B511-3185DEA48697} = C:\PROGRAM FILES\BAIDU\BAR\BAIDUBAR.DLL
{7369D35A-5B70-4A5B-B789-B25FE09B4AF3} = C:\PROGRAM FILES\SUPER RABBIT\MAGICSET\HAOKANBAR.DLL
Winsock SPI
MS.w95.spi.osp = C:\WINDOWS\SYSTEM\MSWSOSP.DLL
MS.w95.spi.tcp = C:\WINDOWS\SYSTEM\QUARTZ32.DLL
MS.w95.spi.udp = C:\WINDOWS\SYSTEM\QUARTZ32.DLL
MS.w95.spi.raw = C:\WINDOWS\SYSTEM\QUARTZ32.DLL
MS.w95.spi.rsvptcp = C:\WINDOWS\SYSTEM\QUARTZ32.DLL
MS.w95.spi.rsvpudp = C:\WINDOWS\SYSTEM\QUARTZ32.DLL
系统服务项
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services
文件驱动
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services
系统驱动项
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services
WDMFS = C:\WINDOWS\SYSTEM32\DRIVERS\WDMFS.SYS
wdmaud = C:\WINDOWS\SYSTEM32\DRIVERS\WDMAUD.SYS
redbook = C:\WINDOWS\SYSTEM32\DRIVERS\REDBOOK.SYS
sbemul = C:\WINDOWS\SYSTEM32\DRIVERS\SBEMUL.SYS