中毒9505，日志附上，救我！ - 瑞星卡卡安全论坛bbs.ikaka.com

瑞星卡卡安全论坛技术交流区 反病毒/反流氓软件论坛中毒9505，日志附上，救我！

	瑞星“1+2”全新解决方案巡展在广州画上圆满句号		叶院长揭秘：瑞星如何运用AI技术革新网络安全		俄乌冲突加剧网络攻击风险白俄罗斯政府遭APT攻击		瑞星ESM防病毒系统助力矿业大学筑牢网络安全防线
	实力拉满瑞星第五十次通过VB100测评		携手老友，拥抱新精彩 —— 新论坛新活动，感谢你的陪伴		护航司法，瑞星助力山西省高院构建安全防线		人工智能在网络安全领域的风险和机遇

4 / 5 页

跳转页

中毒9505，日志附上，救我！

looye2004 初生襁褓狮帖子:65 注册: 2006-10-07 来自:	发表于： 2006-10-08 22:25 \| 显示全部短消息资料字号：小中大 31楼 [Shdoclc] 1_FileSize=498176 1_FileDate=2004-8-23 16:00:00 1_FileVersion=6.0.2900.2180 Max=1 [AppInit_DLLs] 1_HKey=HKEY_LOCAL_MACHINE 1_Key=SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows 1_Name=AppInit_DLLs 1_Value= 2_HKey=HKEY_LOCAL_MACHINE 2_Key=SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon 2_Name=Userinit 2_Value=C:\WINDOWS\system32\Userinit.exe, 2_FileSize=23552 2_FileDate=2004-8-23 16:00:00 3_HKey=HKEY_LOCAL_MACHINE 3_Key=SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon 3_Name=Shell 3_Value=Explorer.exe 4_HKey=HKEY_LOCAL_MACHINE 4_Key=SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon 4_Name=System 3_Value= Max=4 [WinSock2NameSpace] 1_HKey=HKEY_LOCAL_MACHINE 1_Key=SYSTEM\CurrentControlSet\Services\WinSock2\Parameters\NameSpace_Catalog5\Catalog_Entries\000000000001 1_Name=DisplayString 1_Value=Tcpip 1_Enabled=1 1_LibraryPath=%SystemRoot%\System32\mswsock.dll 1_FileSize=240640 1_FileDate=2004-8-23 16:00:00 2_HKey=HKEY_LOCAL_MACHINE 2_Key=SYSTEM\CurrentControlSet\Services\WinSock2\Parameters\NameSpace_Catalog5\Catalog_Entries\000000000002 2_Name=DisplayString 2_Value=NTDS 2_Enabled=1 2_LibraryPath=%SystemRoot%\System32\winrnr.dll 2_FileSize=16896 2_FileDate=2004-8-23 16:00:00 3_HKey=HKEY_LOCAL_MACHINE 3_Key=SYSTEM\CurrentControlSet\Services\WinSock2\Parameters\NameSpace_Catalog5\Catalog_Entries\000000000003 3_Name=DisplayString 3_Value=网络位置知晓 (NLA) 名称空间 3_Enabled=1 3_LibraryPath=%SystemRoot%\System32\mswsock.dll 3_FileSize=240640 3_FileDate=2004-8-23 16:00:00 Max=3
looye2004 初生襁褓狮帖子:65 注册: 2006-10-07 来自:

looye2004 初生襁褓狮帖子:65 注册: 2006-10-07 来自:	发表于： 2006-10-08 22:28 \| 显示全部短消息资料字号：小中大 32楼 [WinSock2Protocol] 1_HKey=HKEY_LOCAL_MACHINE 1_Key=SYSTEM\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000001 1_Name=PackedCatalogItem 1_FileName=%SystemRoot%\system32\mswsock.dll F 1_Value= ?? ?? 最?? ? ?? ? ?? ?? ?? ?? ?? ? ?? ? ?? ?? ?? 攀? ?? ? ?? ?? ?? ?? ?? ?? ? ??f ?诧?谑￡往?? MSAFD Tcpip [TCP/IP] 2_HKey=HKEY_LOCAL_MACHINE 2_Key=SYSTEM\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000002 2_Name=PackedCatalogItem 2_FileName=%SystemRoot%\system32\mswsock.dll F 2_Value= ?? ?? 最?? ? ?? ? ?? ?? ?? ?? ?? ? ?? ? ?? ?? ?? 攀? ?? ? ?? ?? ?? ?? ?? ?? ? ??? ?诧?谑￡往?? ? ?匀????吀挀瀀椀瀀?嬀唀?倀??倀崀 3_HKey=HKEY_LOCAL_MACHINE 3_Key=SYSTEM\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000003 3_Name=PackedCatalogItem 3_FileName=%SystemRoot%\system32\mswsock.dll F 3_Value= ?? ?? 最?? ? ?? ? ?? ?? ?? ?? ?? ? ?? ? ?? ?? ?? 攀? ?? ? ?? ?? ?? ?? ?? ?? ? ??? ?诧?谑￡往?? ? ? ?匀????吀挀瀀椀瀀?嬀刀?圀??倀崀 4_HKey=HKEY_LOCAL_MACHINE 4_Key=SYSTEM\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000004 4_Name=PackedCatalogItem 4_FileName=%SystemRoot%\system32\rsvpsp.dll 4_Value=? ?? ?? 最?? ? ?? ? ?? ?? ?? ?? ?? ? ?? ? ?? ?? ?? 攀? ?? ? ?? ?? ?? ?? ?? ?? ? ??☉ ?鵠????? ???蠂??嚤聵?畕聆? ? 刀匀嘀倀?唀?倀?匀攀爀瘀椀挀攀?倀爀漀瘀椀搀攀爀 ā ?? 退? ?粒? ??粒?粒 ??鋻??????鋮硼鋻??燿鋻??具??畕? ? ??耀?@ 唿屵?攀瘀椀挀攀尀笀?????????　??????????????????????????紀 ??????????紀 ?琂????粓錿塼??? ?垊幵?? ???粓錿? 堀? ??錿?粓 ??粓錿\| 堀 ?粓 ?? ? 倀??? ????? ??尀?甀爀爀攀? ? ? ā ?粓 5_HKey=HKEY_LOCAL_MACHINE 5_Key=SYSTEM\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000005 5_Name=PackedCatalogItem 5_FileName=%SystemRoot%\system32\rsvpsp.dll 5_Value=? ?? ?? 最?? ? ?? ? ?? ?? ?? ?? ?? ? ?? ? ?? ?? ?? 攀? ?? ? ?? ?? ?? ?? ?? ?? ? ??? ?鵠????? ? ?? 谀?専錍\|?? ? ? ? ā ? 刀匀嘀倀?吀?倀?匀攀爀瘀椀挀攀?倀爀漀瘀椀搀攀爀 ? ??婄u 怀?簀??? ?専錍\|? 全尿錍\|??粓??粓埀? ? ? 兰? ? ?????瀿???? ? 瀀?? ? ?粓? ?? ?@ 鴰?? 浏ā埜怿 ? ????錏? ????? ?専錍\|??粓??粓?? ? ? 耀 ?? ? ???? @ ?栁???倂?ī嘼畕 ??? ?????粒?粒?? ?? 6_HKey=HKEY_LOCAL_MACHINE 6_Key=SYSTEM\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000006 6_Name=PackedCatalogItem 6_FileName=%SystemRoot%\system32\mswsock.dll F 6_Value= ?? ?? 最?? ? ?? ? ?? ?? ?? ?? ?? ? ?? ? ?? ?? ?? 攀? ?? ? ?? ?? ?? ?? ?? ?? ? ?? ?赟???耀?銡А ＿? MSAFD NetBIOS [\Device\NetBT_Tcpip_{3C5B3249-2A9F-48A2-B319-2478F020FC4C}] SEQPACKET 4 7_HKey=HKEY_LOCAL_MACHINE 7_Key=SYSTEM\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000007 7_Name=PackedCatalogItem 7_FileName=%SystemRoot%\system32\mswsock.dll F 7_Value= ?? ?? 最?? ? ?? ? ?? ?? ?? ?? ?? ? ?? ? ?? ?? ?? 攀? ?? ? ?? ?? ?? ?? ?? ?? ? ??? ?赟???耀?銡Б ＿? MSAFD NetBIOS [\Device\NetBT_Tcpip_{3C5B3249-2A9F-48A2-B319-2478F020FC4C}] DATAGRAM 4 8_HKey=HKEY_LOCAL_MACHINE 8_Key=SYSTEM\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000008 8_Name=PackedCatalogItem 8_FileName=%SystemRoot%\system32\mswsock.dll F 8_Value= ?? ?? 最?? ? ?? ? ?? ?? ?? ?? ?? ? ?? ? ?? ?? ?? 攀? ?? ? ?? ?? ?? ?? ?? ?? ? ?? ?赟???耀?銡В ＿? MSAFD NetBIOS [\Device\NetBT_Tcpip_{5F72B432-44AC-43D5-AF19-E84F608D66BD}] SEQPACKET 3 9_HKey=HKEY_LOCAL_MACHINE 9_Key=SYSTEM\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000009 9_Name=PackedCatalogItem 9_FileName=%SystemRoot%\system32\mswsock.dll F 9_Value= ?? ?? 最?? ? ?? ? ?? ?? ?? ?? ?? ? ?? ? ?? ?? ?? 攀? ?? ? ?? ?? ?? ?? ?? ?? ? ??? ?赟???耀?銡Г ＿? MSAFD NetBIOS [\Device\NetBT_Tcpip_{5F72B432-44AC-43D5-AF19-E84F608D66BD}] DATAGRAM 3
looye2004 初生襁褓狮帖子:65 注册: 2006-10-07 来自:

looye2004 初生襁褓狮帖子:65 注册: 2006-10-07 来自:	发表于： 2006-10-08 22:29 \| 显示全部短消息资料字号：小中大 33楼 10_HKey=HKEY_LOCAL_MACHINE 10_Key=SYSTEM\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000010 10_Name=PackedCatalogItem 10_FileName=%SystemRoot%\system32\mswsock.dll F 10_Value= ?? ?? 最?? ? ?? ? ?? ?? ?? ?? ?? ? ?? ? ?? ?? ?? 攀? ?? ? ?? ?? ?? ?? ?? ?? ? ?? ?赟???耀?銡Д 耀 ?匀????一攀琀??伀匀?嬀尀?攀瘀椀挀攀尀一攀琀?吀开吀挀瀀椀瀀开笀?????　????　?　???????????????????????紀崀?匀?儀倀????吀?　 11_HKey=HKEY_LOCAL_MACHINE 11_Key=SYSTEM\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000011 11_Name=PackedCatalogItem 11_FileName=%SystemRoot%\system32\mswsock.dll F 11_Value= ?? ?? 最?? ? ?? ? ?? ?? ?? ?? ?? ? ?? ? ?? ?? ?? 攀? ?? ? ?? ?? ?? ?? ?? ?? ? ??? ?赟???耀?銡Е 耀 ?匀????一攀琀??伀匀?嬀尀?攀瘀椀挀攀尀一攀琀?吀开吀挀瀀椀瀀开笀?????　????　?　???????????????????????紀崀???吀??刀???　 12_HKey=HKEY_LOCAL_MACHINE 12_Key=SYSTEM\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000012 12_Name=PackedCatalogItem 12_FileName=%SystemRoot%\system32\mswsock.dll F 12_Value= ?? ?? 最?? ? ?? ? ?? ?? ?? ?? ?? ? ?? ? ?? ?? ?? 攀? ?? ? ?? ?? ?? ?? ?? ?? ? ?? ?赟???耀?銡Ж ?? ?匀????一攀琀??伀匀?嬀尀?攀瘀椀挀攀尀一攀琀?吀开吀挀瀀椀瀀开笀??????　???????????????????　　????????紀崀?匀?儀倀????吀?? 13_HKey=HKEY_LOCAL_MACHINE 13_Key=SYSTEM\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000013 13_Name=PackedCatalogItem 13_FileName=%SystemRoot%\system32\mswsock.dll F 13_Value= ?? ?? 最?? ? ?? ? ?? ?? ?? ?? ?? ? ?? ? ?? ?? ?? 攀? ?? ? ?? ?? ?? ?? ?? ?? ? ??? ?赟???耀?銡З ?? ?匀????一攀琀??伀匀?嬀尀?攀瘀椀挀攀尀一攀琀?吀开吀挀瀀椀瀀开笀??????　???????????????????　　????????紀崀???吀??刀???? 14_HKey=HKEY_LOCAL_MACHINE 14_Key=SYSTEM\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000014 14_Name=PackedCatalogItem 14_FileName=%SystemRoot%\system32\mswsock.dll F 14_Value= ?? ?? 最?? ? ?? ? ?? ?? ?? ?? ?? ? ?? ? ?? ?? ?? 攀? ?? ? ?? ?? ?? ?? ?? ?? ? ?? ?赟???耀?銡И ＿? MSAFD NetBIOS [\Device\NetBT_Tcpip_{4DAFA87D-7ED3-4416-99F7-F0CA25413912}] SEQPACKET 2 15_HKey=HKEY_LOCAL_MACHINE 15_Key=SYSTEM\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000015 15_Name=PackedCatalogItem 15_FileName=%SystemRoot%\system32\mswsock.dll F 15_Value= ?? ?? 最?? ? ?? ? ?? ?? ?? ?? ?? ? ?? ? ?? ?? ?? 攀? ?? ? ?? ?? ?? ?? ?? ?? ? ??? ?赟???耀?銡Й ＿? MSAFD NetBIOS [\Device\NetBT_Tcpip_{4DAFA87D-7ED3-4416-99F7-F0CA25413912}] DATAGRAM 2 16_HKey=HKEY_LOCAL_MACHINE 16_Key=SYSTEM\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000016 16_Name=PackedCatalogItem 16_FileName=%SystemRoot%\system32\mswsock.dll F 16_Value= ?? ?? 最?? ? ?? ? ?? ?? ?? ?? ?? ? ?? ? ?? ?? ?? 攀? ?? ? ?? ?? ?? ?? ?? ?? ? ?? ?赟???耀?銡К ＿? MSAFD NetBIOS [\Device\NetBT_Tcpip_{A939BF0C-E452-4981-AD92-F079E82B69D1}] SEQPACKET 5 17_HKey=HKEY_LOCAL_MACHINE 17_Key=SYSTEM\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000017 17_Name=PackedCatalogItem 17_FileName=%SystemRoot%\system32\mswsock.dll F 17_Value= ?? ?? 最?? ? ?? ? ?? ?? ?? ?? ?? ? ?? ? ?? ?? ?? 攀? ?? ? ?? ?? ?? ?? ?? ?? ? ??? ?赟???耀?銡Л ＿? MSAFD NetBIOS [\Device\NetBT_Tcpip_{A939BF0C-E452-4981-AD92-F079E82B69D1}] DATAGRAM 5 18_HKey=HKEY_LOCAL_MACHINE 18_Key=SYSTEM\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000018 18_Name=PackedCatalogItem 18_FileName=%SystemRoot%\system32\mswsock.dll F 18_Value= ?? ?? 最?? ? ?? ? ?? ?? ?? ?? ?? ? ?? ? ?? ?? ?? 攀? ?? ? ?? ?? ?? ?? ?? ?? ? ?? ?赟???耀?銡М ＿? MSAFD NetBIOS [\Device\NetBT_Tcpip_{BA2F8BEE-176A-4BDE-82D6-42469B61CED4}] SEQPACKET 6 19_HKey=HKEY_LOCAL_MACHINE 19_Key=SYSTEM\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000019 19_Name=PackedCatalogItem 19_FileName=%SystemRoot%\system32\mswsock.dll F 19_Value= ?? ?? 最?? ? ?? ? ?? ?? ?? ?? ?? ? ?? ? ?? ?? ?? 攀? ?? ? ?? ?? ?? ?? ?? ?? ? ??? ?赟???耀?銡Н ＿? MSAFD NetBIOS [\Device\NetBT_Tcpip_{BA2F8BEE-176A-4BDE-82D6-42469B61CED4}] DATAGRAM 6 Max=19
looye2004 初生襁褓狮帖子:65 注册: 2006-10-07 来自:

looye2004 初生襁褓狮帖子:65 注册: 2006-10-07 来自:	发表于： 2006-10-08 22:30 \| 显示全部短消息资料字号：小中大 34楼 [WinSock2Winsock] 1_HKey=HKEY_LOCAL_MACHINE 1_Key=System\CurrentControlSet\Services\Winsock2\Winsock 1_Name=PathName 1_Value= 1_Found=0 Max=1 [WOW] 1_HKey=HKEY_LOCAL_MACHINE 1_Key=SYSTEM\CurrentControlSet\Control\WOW 1_Name=cmdline 1_Value=%SystemRoot%\system32\ntvdm.exe -o 1_Filename=C:\WINDOWS\SYSTEM32\NTVDM.EXE 1_FileSize=417280 1_FileDate=2004-8-23 16:00:00 2_HKey=HKEY_LOCAL_MACHINE 2_Key=SYSTEM\CurrentControlSet\Control\WOW 2_Name=wowcmdline 2_Value=%SystemRoot%\system32\ntvdm.exe -a %SystemRoot%\system32\krnl386 2_Filename=C:\WINDOWS\SYSTEM32\NTVDM.EXE 2_FileSize=417280 2_FileDate=2004-8-23 16:00:00 Max=2
looye2004 初生襁褓狮帖子:65 注册: 2006-10-07 来自:

looye2004 初生襁褓狮帖子:65 注册: 2006-10-07 来自:	发表于： 2006-10-08 22:30 \| 显示全部短消息资料字号：小中大 35楼 [ShellExecuteHooks] 1_HKey=HKEY_LOCAL_MACHINE 1_Key=SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks 1_Name={AEB6717E-7E19-11d0-97EE-00C04FD91972} 1_ClsidName=URL 执行挂钩 1_FileName=C:\WINDOWS\system32\shell32.dll 1_FileSize=8241664 1_FileDate=2004-8-23 16:00:00 Max=1 [ShellServiceObjectDelayLoad] 1_HKey=HKEY_LOCAL_MACHINE 1_Key=SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad 1_Name=PostBootReminder 1_Value={7849596a-48ea-486e-8937-a2a3009f31a9} 1_ClsidName=PostBootReminder 对象 1_FileName=%SystemRoot%\system32\SHELL32.dll 1_FileSize=8241664 1_FileDate=2004-8-23 16:00:00 2_HKey=HKEY_LOCAL_MACHINE 2_Key=SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad 2_Name=CDBurn 2_Value={fbeb8a05-beee-4442-804e-409d6c4515e9} 2_ClsidName=烧 CD 的 ShellFolder 2_FileName=%SystemRoot%\system32\SHELL32.dll 2_FileSize=8241664 2_FileDate=2004-8-23 16:00:00 3_HKey=HKEY_LOCAL_MACHINE 3_Key=SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad 3_Name=WebCheck 3_Value={E6FB5E20-DE35-11CF-9C87-00AA005127ED} 3_ClsidName=WebCheck 3_FileName=%SystemRoot%\system32\webcheck.dll 3_FileSize=265728 3_FileDate=2004-8-23 16:00:00 4_HKey=HKEY_LOCAL_MACHINE 4_Key=SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad 4_Name=SysTray 4_Value={35CEC8A3-2BE6-11D2-8773-92E220524153} 4_ClsidName=SysTray 4_FileName=C:\WINDOWS\system32\stobject.dll 4_FileSize=121344 4_FileDate=2004-8-23 16:00:00 Max=4
looye2004 初生襁褓狮帖子:65 注册: 2006-10-07 来自:

looye2004 初生襁褓狮帖子:65 注册: 2006-10-07 来自:	发表于： 2006-10-08 22:31 \| 显示全部短消息资料字号：小中大 36楼 [SharedTaskScheduler] 1_HKey=HKEY_LOCAL_MACHINE 1_Key=SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler 1_Name={438755C2-A8BA-11D1-B96B-00A0C90312E1} 1_Value=Browseui 预加载程序 1_FileName=%SystemRoot%\system32\browseui.dll 1_FileSize=1016832 1_FileDate=2004-9-30 2:48:08 2_HKey=HKEY_LOCAL_MACHINE 2_Key=SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler 2_Name={8C7461EF-2B13-11d2-BE35-3078302C2030} 2_Value=组件类别缓存程序 2_FileName=%SystemRoot%\system32\browseui.dll 2_FileSize=1016832 2_FileDate=2004-9-30 2:48:08 Max=2 [ProtocolDefaults] 1_HKey=HKEY_LOCAL_MACHINE 1_Key=SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProtocolDefaults 1_Name=http 1_Value=3 2_HKey=HKEY_LOCAL_MACHINE 2_Key=SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProtocolDefaults 2_Name=https 2_Value=3 3_HKey=HKEY_LOCAL_MACHINE 3_Key=SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProtocolDefaults 3_Name=ftp 3_Value=3 4_HKey=HKEY_LOCAL_MACHINE 4_Key=SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProtocolDefaults 4_Name=file 4_Value=3 5_HKey=HKEY_LOCAL_MACHINE 5_Key=SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProtocolDefaults 5_Name=@ivt 5_Value=1 6_HKey=HKEY_LOCAL_MACHINE 6_Key=SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProtocolDefaults 6_Name=shell 6_Value=0 Max=6 [BootExecute] 1_HKey=HKEY_LOCAL_MACHINE 1_Key=SYSTEM\CurrentControlSet\Control\Session Manager 1_Name=BootExecute 1_Value=autocheck autochk * Max=1
looye2004 初生襁褓狮帖子:65 注册: 2006-10-07 来自:

looye2004 初生襁褓狮帖子:65 注册: 2006-10-07 来自:	发表于： 2006-10-08 22:31 \| 显示全部短消息资料字号：小中大 37楼 [AutoRun] 1_HKey=HKEY_LOCAL_MACHINE 1_Key=Software\Microsoft\Windows\CurrentVersion\Run 1_Name=RavTask 1_Value="c:\program files\rising\rav\ravtask.exe" -system 1_FileSize=114688 1_FileDate=2005-12-28 20:51:50 1_FileVersion=18.0.0.22 2_HKey=HKEY_LOCAL_MACHINE 2_Key=Software\Microsoft\Windows\CurrentVersion\Run 2_Name=ControlCenter2.0 2_Value=; c:\program files\brother\controlcenter2\brctrcen.exe /autorun 2_FileSize=864256 2_FileDate=2005-1-7 17:30:56 2_FileVersion=2.0.15.7 3_HKey=HKEY_LOCAL_MACHINE 3_Key=Software\Microsoft\Windows\CurrentVersion\Run 3_Name=IMJPMIG8.1 3_Value=; "c:\windows\ime\imjp8_1\imjpmig.exe" /spoil /remadvdef /migration32 3_FileSize=208952 3_FileDate=2004-8-24 3_FileVersion=8.1.4202.0 4_HKey=HKEY_LOCAL_MACHINE 4_Key=Software\Microsoft\Windows\CurrentVersion\Run 4_Name=PHIME2002A 4_Value=; c:\windows\system32\ime\tintlgnt\tintsetp.exe /imename 4_FileSize=455168 4_FileDate=2004-8-24 4_FileVersion=5.2.0.2801 5_HKey=HKEY_LOCAL_MACHINE 5_Key=Software\Microsoft\Windows\CurrentVersion\Run 5_Name=PHIME2002ASync 5_Value=; c:\windows\system32\ime\tintlgnt\tintsetp.exe /sync 5_FileSize=455168 5_FileDate=2004-8-24 5_FileVersion=5.2.0.2801 6_HKey=HKEY_LOCAL_MACHINE 6_Key=Software\Microsoft\Windows\CurrentVersion\Run 6_Name=POPO2004 6_Value=; 7_HKey=HKEY_LOCAL_MACHINE 7_Key=Software\Microsoft\Windows\CurrentVersion\Run 7_Name=RfwMain 7_Value=; c:\program files\rising\rfw\rfwmain.exe 7_FileSize=163840 7_FileDate=2006-9-23 21:08:28 7_FileVersion= 8_HKey=HKEY_LOCAL_MACHINE 8_Key=Software\Microsoft\Windows\CurrentVersion\Run 8_Name=SetDefPrt 8_Value=; c:\program files\brother\brmfl04g\brstdvpt.exe 8_FileSize=49152 8_FileDate=2004-11-11 17:14:38 8_FileVersion=1.0.1.1 9_HKey=HKEY_LOCAL_MACHINE 9_Key=Software\Microsoft\Windows\CurrentVersion\Run 9_Name=SysExplr 9_Value=; c:\herosoft\herov8\sysexplr.exe 9_FileSize=172032 9_FileDate=2005-3-14 10:33:24 9_FileVersion= 10_HKey=HKEY_LOCAL_MACHINE 10_Key=Software\Microsoft\Windows\CurrentVersion\Run 10_Name=TkBellExe 10_Value=; "c:\program files\common files\real\update_ob\realsched.exe" -osboot 10_FileSize=180269 10_FileDate=2005-7-16 0:14:20 10_FileVersion=0.1.0.3292 11_HKey=HKEY_LOCAL_MACHINE 11_Key=Software\Microsoft\Windows\CurrentVersion\Run 11_Name=VTTimer 11_Value=; vttimer.exe 12_HKey=HKEY_LOCAL_MACHINE 12_Key=Software\Microsoft\Windows\CurrentVersion\RunOnce 12_Name=RavStub 12_Value="c:\program files\rising\rav\ravstub.exe" /runonce 12_FileSize=90112 12_FileDate=2006-6-22 14:29:00 12_FileVersion=18.0.0.16 13_HKey=HKEY_LOCAL_MACHINE 13_Key=Software\Microsoft\Windows NT\CurrentVersion\Windows 13_Name=load 13_Value= 14_HKey=HKEY_CURRENT_USER 14_Key=Software\Microsoft\Windows\CurrentVersion\Run 14_Name=ctfmon.exe 14_Value=c:\windows\system32\ctfmon.exe 14_FileSize=15360 14_FileDate=2004-8-23 16:00:00 14_FileVersion=5.1.2600.2180 15_HKey=HKEY_CURRENT_USER 15_Key=Software\Microsoft\Windows NT\CurrentVersion\Windows 15_Name=load 15_Value= 16_HKey=HKEY_CURRENT_USER 16_Key=SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\Run 16_Name=run 16_Value= Max=16
looye2004 初生襁褓狮帖子:65 注册: 2006-10-07 来自:

looye2004 初生襁褓狮帖子:65 注册: 2006-10-07 来自:	发表于： 2006-10-08 22:32 \| 显示全部短消息资料字号：小中大 38楼 [ModuleUsage] 1_HKey=HKEY_LOCAL_MACHINE 1_Key=SOFTWARE\Microsoft\Windows\CurrentVersion\ModuleUsage\C:/Program Files/Tencent/qq/mfc42.dll 1_Name=.Owner 1_Value=Unknown Owner 1_Clsid= 1_FileName=C:\Program Files\Tencent\qq\mfc42.dll 1_FileSize=995383 1_FileDate=2005-6-14 10:21:40 1_FileVersion=6.0.8665.0 2_HKey=HKEY_LOCAL_MACHINE 2_Key=SOFTWARE\Microsoft\Windows\CurrentVersion\ModuleUsage\C:/WINDOWS/Downloaded Program Files/MsnPUpld.dll 2_Name=.Owner 2_Value={4F1E5B1A-2A80-42CA-8532-2D05CB959537} 2_Clsid=MSN Photo Upload Tool 2_FileName=C:\WINDOWS\Downloaded Program Files\MsnPUpld.dll 2_FileSize=379704 2_FileDate=2006-6-20 15:44:04 2_FileVersion=10.0.913.0 3_HKey=HKEY_LOCAL_MACHINE 3_Key=SOFTWARE\Microsoft\Windows\CurrentVersion\ModuleUsage\C:/WINDOWS/Downloaded Program Files/OL2005.dll 3_Name=.Owner 3_Value={E4E2F180-CB8B-4DE9-ACBB-DA745D3BA153} 3_Clsid=Rising Web Scan Object 3_FileName=C:\WINDOWS\Downloaded Program Files\OL2005.dll 3_FileSize=278528 3_FileDate=2006-2-13 15:57:38 3_FileVersion=18.0.0.6 4_HKey=HKEY_LOCAL_MACHINE 4_Key=SOFTWARE\Microsoft\Windows\CurrentVersion\ModuleUsage\C:/WINDOWS/Downloaded Program Files/PowerPlr.ocx 4_Name=.Owner 4_Value={2354A44B-3CEB-4829-9940-545B03103538} 4_Clsid=PowerPlr Control 4_FileName=C:\WINDOWS\Downloaded Program Files\PowerPlr.ocx 4_FileSize=207080 4_FileDate=2005-6-22 21:36:34 4_FileVersion=3.2.0.0 5_HKey=HKEY_LOCAL_MACHINE 5_Key=SOFTWARE\Microsoft\Windows\CurrentVersion\ModuleUsage\C:/WINDOWS/Downloaded Program Files/PURen-us.dll 5_Name=.Owner 5_Value={4F1E5B1A-2A80-42CA-8532-2D05CB959537} 5_Clsid=MSN Photo Upload Tool 5_FileName=C:\WINDOWS\Downloaded Program Files\PURen-us.dll 5_FileSize=117560 5_FileDate=2006-6-20 15:44:02 5_FileVersion=10.0.913.0 6_HKey=HKEY_LOCAL_MACHINE 6_Key=SOFTWARE\Microsoft\Windows\CurrentVersion\ModuleUsage\C:/WINDOWS/Downloaded Program Files/RsOnline.dll 6_Name=.Owner 6_Value={DA984A6D-508E-11D6-AA49-0050FF3C628D} 6_Clsid=Ravonline 6_FileName=C:\WINDOWS\Downloaded Program Files\RsOnline.dll 6_FileSize=389120 6_FileDate=2004-5-12 16:53:20 6_FileVersion=2.0.3.56 7_HKey=HKEY_LOCAL_MACHINE 7_Key=SOFTWARE\Microsoft\Windows\CurrentVersion\ModuleUsage\C:/WINDOWS/system32/msvcrt.dll 7_Name=.Owner 7_Value=Unknown Owner 7_Clsid= 7_FileName=C:\WINDOWS\system32\msvcrt.dll 7_FileSize=343040 7_FileDate=2004-8-23 16:00:00 7_FileVersion=7.0.2600.2180 8_HKey=HKEY_LOCAL_MACHINE 8_Key=SOFTWARE\Microsoft\Windows\CurrentVersion\ModuleUsage\C:/WINDOWS/system32/olepro32.dll 8_Name=.Owner 8_Value=Unknown Owner 8_Clsid= 8_FileName=C:\WINDOWS\system32\olepro32.dll 8_FileSize=83456 8_FileDate=2004-8-23 16:00:00 8_FileVersion=5.1.2600.2180 9_HKey=HKEY_LOCAL_MACHINE 9_Key=SOFTWARE\Microsoft\Windows\CurrentVersion\ModuleUsage\C:/WINDOWS/system32/WebActivater.ocx 9_Name=.Owner 9_Value={3D8F74EE-8692-4F8F-B8D2-7522E732519E} 9_Clsid=WebActivater Control 9_FileName=C:\WINDOWS\system32\WebActivater.ocx 9_FileSize=266240 9_FileDate=2004-7-23 17:00:20 9_FileVersion=1.0.0.1 Max=9
looye2004 初生襁褓狮帖子:65 注册: 2006-10-07 来自:

looye2004 初生襁褓狮帖子:65 注册: 2006-10-07 来自:	发表于： 2006-10-08 22:32 \| 显示全部短消息资料字号：小中大 39楼 [Process] 1_FileName=C:\WINDOWS\SYSTEM32\SMSS.EXE 1_FileSize=50688 1_FileDate=2004-8-23 16:00:00 1_FileVersion=5.1.2600.2180 2_FileName=C:\WINDOWS\SYSTEM32\WINLOGON.EXE 2_FileSize=487424 2_FileDate=2004-8-23 16:00:00 2_FileVersion=5.1.2600.2180 3_FileName=C:\WINDOWS\SYSTEM32\SERVICES.EXE 3_FileSize=108032 3_FileDate=2004-8-23 16:00:00 3_FileVersion=5.1.2600.2180 4_FileName=C:\WINDOWS\SYSTEM32\LSASS.EXE 4_FileSize=13312 4_FileDate=2004-8-23 16:00:00 4_FileVersion=5.1.2600.2180 5_FileName=C:\WINDOWS\SYSTEM32\SVCHOST.EXE 5_FileSize=14336 5_FileDate=2004-8-23 16:00:00 5_FileVersion=5.1.2600.2180 6_FileName=C:\PROGRAM FILES\RISING\RAV\CCENTER.EXE 6_FileSize=110592 6_FileDate=2005-12-28 20:51:48 6_FileVersion=18.0.0.3 7_FileName=C:\WINDOWS\SYSTEM32\SVCHOST.EXE 7_FileSize=14336 7_FileDate=2004-8-23 16:00:00 7_FileVersion=5.1.2600.2180 8_FileName=C:\PROGRAM FILES\RISING\RAV\RAVMOND.EXE 8_FileSize=233472 8_FileDate=2006-8-28 14:29:42 8_FileVersion=18.0.1.35 9_FileName=C:\WINDOWS\EXPLORER.EXE 9_FileSize=976896 9_FileDate=2004-8-23 16:00:00 9_FileVersion=6.0.2900.2180 10_FileName=C:\WINDOWS\SYSTEM32\SPOOLSV.EXE 10_FileSize=57856 10_FileDate=2004-8-23 16:00:00 10_FileVersion=5.1.2600.2180 11_FileName=C:\PROGRAM FILES\RISING\RAV\RAVSTUB.EXE 11_FileSize=90112 11_FileDate=2006-6-22 14:29:00 11_FileVersion=18.0.0.16 12_FileName=C:\PROGRAM FILES\RISING\RAV\RAVTASK.EXE 12_FileSize=114688 12_FileDate=2005-12-28 20:51:50 12_FileVersion=18.0.0.22 13_FileName=C:\PROGRAM FILES\RISING\RAV\RAVMON.EXE 13_FileSize=610304 13_FileDate=2006-8-28 14:29:42 13_FileVersion=18.0.1.33 14_FileName=C:\WINDOWS\SYSTEM32\CTFMON.EXE 14_FileSize=15360 14_FileDate=2004-8-23 16:00:00 14_FileVersion=5.1.2600.2180 15_FileName=C:\WINDOWS\SYSTEM32\DRIVERS\CDAC11BA.EXE 15_FileSize=54784 15_FileDate=2006-9-3 20:27:16 15_FileVersion=4.20.20.0 16_FileName=C:\PROGRAM FILES\RISING\RFW\RFWSRV.EXE 16_FileSize=49152 16_FileDate=2006-9-25 9:25:00 16_FileVersion=3.0.0.85 17_FileName=C:\WINDOWS\SYSTEM32\SVCHOST.EXE 17_FileSize=14336 17_FileDate=2004-8-23 16:00:00 17_FileVersion=5.1.2600.2180 18_FileName=C:\WINDOWS\SYSTEM32\CONIME.EXE 18_FileSize=27648 18_FileDate=2004-8-23 16:00:00 18_FileVersion=5.1.2600.2180 19_FileName=C:\WINDOWS\SYSTEM32\SVCHOST.EXE 19_FileSize=14336 19_FileDate=2004-8-23 16:00:00 19_FileVersion=5.1.2600.2180 20_FileName=C:\DOCUMENTS AND SETTINGS\USER\桌面\WINSPEED778BETA\IEHELP.EXE 20_FileSize=737792 20_FileDate=2006-8-31 12:39:22 20_FileVersion=7.78.0.0 21_FileName=C:\WINDOWS\SYSTEM32\NOTEPAD.EXE 21_FileSize=66560 21_FileDate=2004-8-23 16:00:00 21_FileVersion=5.1.2600.2180 22_FileName=C:\WINDOWS\REGEDIT.EXE 22_FileSize=132608 22_FileDate=2004-8-23 16:00:00 22_FileVersion=5.1.2600.2180 23_FileName=[SYSTEM PROCESS] 24_FileName=C:\WINDOWS\system32\CSRSS.EXE 24_FileSize=6144 24_FileDate=2004-8-23 16:00:00 24_FileVersion=5.1.2600.2180 25_FileName=C:\WINDOWS\system32\WDFMGR.EXE 25_FileSize=38912 25_FileDate=2004-8-10 22:05:14 25_FileVersion=5.2.3790.1230 26_FileName=C:\WINDOWS\system32\ALG.EXE 26_FileSize=44544 26_FileDate=2004-8-23 16:00:00 26_FileVersion=5.1.2600.2180 Max=26
looye2004 初生襁褓狮帖子:65 注册: 2006-10-07 来自:

looye2004 初生襁褓狮帖子:65 注册: 2006-10-07 来自:	发表于： 2006-10-08 22:33 \| 显示全部短消息资料字号：小中大 40楼 [Hosts] HostsFile=C:\WINDOWS\system32\Drivers\Etc\Hosts 1_Host=127.0.0.1 localhost Max=1 [Service] 1_ServiceName=C-DillaCdaC11BA 1_DisplayName=C-DillaCdaC11BA 1_Description= 1_Status=已启动 1_StartType=自动 1_ServiceDll= 1_ImagePath=C:\WINDOWS\SYSTEM32\DRIVERS\CDAC11BA.EXE 2_ServiceName=DcomLaunch 2_DisplayName=DCOM Server Process Launcher 2_Description=为 DCOM 服务提供加载功能。 2_Status=已启动 2_StartType=自动 2_ServiceDll=C:\WINDOWS\SYSTEM32\RPCSS.DLL 2_ImagePath=C:\WINDOWS\SYSTEM32\SVCHOST -K DCOMLAUNCH 3_ServiceName=HTTPFilter 3_DisplayName=HTTP SSL 3_Description=此服务通过安全套接字层(SSL)实现 HTTP 服务的安全超文本传送协议(HTTPS)。如果此服务被禁用，任何依赖它的服务将无法启动。 3_Status=已启动 3_StartType=手动 3_ServiceDll=C:\WINDOWS\SYSTEM32\W3SSL.DLL 3_ImagePath=C:\WINDOWS\SYSTEM32\SVCHOST.EXE -K HTTPFILTER 4_ServiceName=NetDDEdsdm 4_DisplayName=Network DDE DSDM 4_Description=管理动态数据交换 (DDE) 网络共享。如果此服务终止，DDE 网络共享将不可用。如果此服务被禁用，任何依赖它的服务将无法启动。 4_Status=停止 4_StartType=已禁用 4_ServiceDll= 4_ImagePath=C:\WINDOWS\SYSTEM32\NETDDE.EXE 5_ServiceName=RfwService 5_DisplayName=Rising Personal Firewall Service 5_Description=Rising Personal Firewall Service 5_Status=已启动 5_StartType=自动 5_ServiceDll= 5_ImagePath=C:\PROGRAM FILES\RISING\RFW\RFWSRV.EXE 6_ServiceName=RsCCenter 6_DisplayName=Rising Process Communication Center 6_Description= 6_Status=已启动 6_StartType=自动 6_ServiceDll= 6_ImagePath="C:\PROGRAM FILES\RISING\RAV\CCENTER.EXE" 7_ServiceName=RsRavMon 7_DisplayName=RsRavMon Service 7_Description= 7_Status=已启动 7_StartType=自动 7_ServiceDll= 7_ImagePath="C:\PROGRAM FILES\RISING\RAV\RAVMOND.EXE" 8_ServiceName=UMWdf 8_DisplayName=Windows User Mode Driver Framework 8_Description=启用 Windows 用户模式驱动程序。 8_Status=已启动 8_StartType=自动 8_ServiceDll= 8_ImagePath=C:\WINDOWS\SYSTEM32\WDFMGR.EXE 9_ServiceName=usnsvc 9_DisplayName=共享 USN 杂志阅读器服务 9_Description=Messenger 上安装的启用共享情况的服务 9_Status=停止 9_StartType=手动 9_ServiceDll=C:\PROGRAM FILES\MSN MESSENGER\USNSVC.DLL 9_ImagePath=C:\WINDOWS\SYSTEM32\SVCHOST.EXE -K USNSVC 10_ServiceName=WmdmPmSN 10_DisplayName=Portable Media Serial Number Service 10_Description=Retrieves the serial number of any portable media player connected to this computer. If this service is stopped, protected content might not be down loaded to the device. 10_Status=停止 10_StartType=手动 10_ServiceDll=C:\WINDOWS\SYSTEM32\MSPMSNSV.DLL 10_ImagePath=C:\WINDOWS\SYSTEM32\SVCHOST.EXE -K NETSVCS 11_ServiceName=wscsvc 11_DisplayName=Security Center 11_Description=监视系统安全设置和配置。 11_Status=已启动 11_StartType=自动 11_ServiceDll=C:\WINDOWS\SYSTEM32\WSCSVC.DLL 11_ImagePath=C:\WINDOWS\SYSTEM32\SVCHOST.EXE -K NETSVCS 12_ServiceName=xmlprov 12_DisplayName=Network Provisioning Service 12_Description=为自动网络提供管理基于域的 XML 配置文件。 12_Status=停止 12_StartType=手动 12_ServiceDll=C:\WINDOWS\SYSTEM32\XMLPROV.DLL 12_ImagePath=C:\WINDOWS\SYSTEM32\SVCHOST.EXE -K NETSVCS Max=12 [END] Max=1
looye2004 初生襁褓狮帖子:65 注册: 2006-10-07 来自:

<<上一主题|下一主题>>

4 / 5 页

跳转页

页面顶部

Powered by Discuz!NT