【讨论】大家帮我评论下我分析的扫描日志对不对?谢谢!
因为我屡次粘帖之后就是发不上去帖子,只好发文本附件了.希望大家谅解.谢谢!
我认为有几个可疑的地方.
1.<QkOnBtn><C:\PROGRA~1\QBU\QkOnBtn.EXE> [Dritek System Inc.]
2. <High Definition Audio Property Page Shortcut><CHDAudPropShortcut.exe> [(Verified)Microsoft Windows Hardware Compatibility Publisher]
<Nod23 Service><nod23.exe> [N/A]
<startdrv><C:\WINDOWS\Temp\startdrv.exe> [N/A]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunServices]
<Nod23 Service><nod23.exe> [N/A]
3.[P4P Service / P4P Service][Running/Auto Start]
<C:\Program Files\Common Files\Sogou PXP\p2psvr.exe><Sohu.com Inc.>
4.[Check Point SecuRemote Service / SR_Service][Running/Auto Start]
<"C:\Program Files\CheckPoint\SecuRemote\bin\SR_Service.exe"><Check Point Software Technologies>
[Check Point SecuRemote WatchDog / SR_WatchDog][Running/Auto Start]
<"C:\Program Files\CheckPoint\SecuRemote\bin\SR_WatchDog.exe"><Check Point Software Technologies>
5.隐藏进程
[784] C:\Program Files\Internet Explorer\IEXPLORE.EXE
目前首要的问题是,只要他联上网线,再跟我联Net meeting的时候就会蓝屏死机.
[用户系统信息]Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; InfoPath.1)