收藏本站 |切换到宽版 | 更换论坛皮肤
 找回密码  忘记邮箱  QQ快速登录  快速登录  快速注册

卡饭»论坛 › 软件区 › 解疑答难区 › 怀疑木马，窗口自动弹出一二秒钟自动关闭！
12下一页
返回列表 发新帖
查看: 4250|回复: 16
收起左侧

[已解决] 怀疑木马，窗口自动弹出一二秒钟自动关闭！

 关闭 [复制链接]
yzjxue
发表于 2011-10-16 10:34:49 | 显示全部楼层 |阅读模式
本帖最后由 yzjxue 于 2011-10-16 10:36 编辑

有时窗口自动跳出 1 .  2  秒 还没用看清然后就自动关闭，（窗口感觉像CMD 的窗口，不过不确定）
系统WIN7 32 位

最近有时候网速会突然变慢，网页打不开，Q显示正常。不过断网后，重新连接，重新打开浏览器又正常了！杀毒也没杀到什么
也没有发现其他什么问题！怀疑木马 ？


  3. 2011-10-11,18:36:51

  5. System Repair Engineer 2.8.4.1331
  6. Smallfrogs (http://www.KZTechs.com)

  8. Windows 7 Ultimate Edition Service Pack 1 (Build 7601) - 管理权限用户 - 完整功能

  10. 以下内容被选中：
  11.     所有的启动项目（包括注册表、启动文件夹、服务等）
  12.     浏览器加载项
  13.     正在运行的进程（包括进程模块信息）
  14.     文件关联
  15.     Winsock 提供者
  16.     Autorun.inf
  17.     HOSTS 文件
  18.     进程特权扫描
  19.     计划任务
  20.     Windows 安全更新检查
  21.     API HOOK
  22.     隐藏进程


  25. 启动项目
  26. 注册表
  27. [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
  28.     <Sidebar><C:\Program Files\Windows Sidebar\sidebar.exe /autoRun>  [(Verified)Microsoft Windows]
  29.     <YY><; G:\Program Files\duowan\yy-3.0\yylauncher.exe>  [(Verified)Duowan Entertainment Information Technology (Beijing) Co., Ltd.]
  30. [HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows]
  31.     <load><>  [N/A]
  32. [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
  33.     <RTHDVCPL><C:\Program Files\Realtek\Audio\HDA\RtHDVCpl.exe -s>  [(Verified)Realtek Semiconductor Corp]
  34.     <BeatTrojanWall><C:\Program Files\木马清除大师2010安全套装\木马清除大师防火墙2010\BeatTrojanWall.exe>  [Lofocus(洛克思)安全实验室]
  35.     <!!QQKav><; F:\杀毒\qqkav.exe>  [Jsing.Net & QQKav.Com]
  36.     <Stormtray><; G:\Program Files\StormII\Stormtray.exe /Start>  [(Verified)北京暴风网际]
  37. [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
  38.     <shell><explorer.exe>  [(Verified)Microsoft Windows]
  39.     <Userinit><C:\Windows\system32\userinit.exe,>  [(Verified)Microsoft Windows]
  40. [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Windows]
  41.     <AppInit_DLLs><>  [N/A]
  42. [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
  43.     <WebCheck><>  [N/A]
  44. [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\>{22d6f312-b0f6-11d0-94ab-0080c74c7e95}]
  45.     <Microsoft Windows Media Player><%SystemRoot%\system32\unregmp2.exe /ShowWMP>  [(Verified)Microsoft Windows]
  46. [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\>{26923b43-4d38-484f-9b9e-de460746276c}]
  47.     <Internet Explorer><C:\Windows\System32\ie4uinit.exe -UserIconConfig>  [(Verified)Microsoft Windows]
  48. [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\>{60B49E34-C7CC-11D0-8953-00A0C90347FF}]
  49.     <Browser Customizations><"C:\Windows\System32\rundll32.exe" "C:\Windows\System32\iedkcs32.dll",BrandIEActiveSetup SIGNUP>  [(Verified)Microsoft Windows]
  50. [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{2C7339CF-2B09-4501-B3F3-F3508C9228ED}]
  51.     <Themes Setup><%SystemRoot%\system32\regsvr32.exe /s /n /i:/UserInstall %SystemRoot%\system32\themeui.dll>  [File is missing]
  52. [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{44BBA840-CC51-11CF-AAFA-00AA00B6015C}]
  53.     <Microsoft Windows><"%ProgramFiles%\Windows Mail\WinMail.exe" OCInstallUserConfigOE>  [File is missing]
  54. [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{6BF52A52-394A-11d3-B153-00C04F79FAA6}]
  55.     <Microsoft Windows Media Player><%SystemRoot%\system32\unregmp2.exe /FirstLogon /Shortcuts /RegBrowsers /ResetMUI>  [(Verified)Microsoft Windows]
  56. [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{89820200-ECBD-11cf-8B85-00AA005B4340}]
  57.     <Windows Desktop Update><regsvr32.exe /s /n /i:U shell32.dll>  [(Verified)Microsoft Windows]
  58. [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{89820200-ECBD-11cf-8B85-00AA005B4383}]
  59.     <Web Platform Customizations><C:\Windows\System32\ie4uinit.exe -BaseSettings>  [(Verified)Microsoft Windows]
  60. [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{89B4C1CD-B018-4511-B0A1-5476DBF70820}]
  61.     <N/A><C:\Windows\system32\Rundll32.exe C:\Windows\system32\mscories.dll,Install>  [(Verified)Microsoft Corporation]

  63. ==================================
  64. 启动文件夹
  65. N/A

  67. ==================================
  68. 服务
  69. [ICBC Daemon Service / ICBC Daemon Service][Running/Auto Start]
  70.   <C:\Program Files\ICBCEbankTools\ICBCAntiPhishing\ICBC_WIN32\IcbcDaemon.exe><N/A>
  71. [MPAV Service / MPAVService][Running/Auto Start]
  72.   <f:\Program Files\MPAV\MPAVSvc.exe><Micropoint Corporation>
  73. [MPSVC Service / MPSVCService][Running/Auto Start]
  74.   <f:\Program Files\Micropoint\MPSvc.exe><Micropoint Corporation>
  75. [NVIDIA Driver Helper Service / NVSvc][Running/Auto Start]
  76.   <C:\Windows\system32\nvvsvc.exe><NVIDIA Corporation>
  77. [木马清除大师配置性服务 / 木马清除大师配置性服务][Stopped/Auto Start]
  78.   <C:\Program Files\木马清除大师2010安全套装\木马清除大师2010\BeatTrojanSvc.exe><Lofocus(洛克思)安全实验室>

  80. ==================================
  81. 驱动程序
  82. [adp94xx / adp94xx][Stopped/Manual Start]
  83.   <\SystemRoot\system32\drivers\adp94xx.sys><Adaptec, Inc.>
  84. [adpahci / adpahci][Stopped/Manual Start]
  85.   <\SystemRoot\system32\drivers\adpahci.sys><Adaptec, Inc.>
  86. [adpu320 / adpu320][Stopped/Manual Start]
  87.   <\SystemRoot\system32\drivers\adpu320.sys><Adaptec, Inc.>
  88. [aic78xx / aic78xx][Stopped/Manual Start]
  89.   <\SystemRoot\system32\drivers\djsvs.sys><Adaptec, Inc.>
  90. [aliide / aliide][Stopped/Manual Start]
  91.   <\SystemRoot\system32\drivers\aliide.sys><Acer Laboratories Inc.>
  92. [amdsata / amdsata][Stopped/Manual Start]
  93.   <\SystemRoot\system32\drivers\amdsata.sys><Advanced Micro Devices>
  94. [amdsbs / amdsbs][Stopped/Manual Start]
  95.   <\SystemRoot\system32\drivers\amdsbs.sys><AMD Technologies Inc.>
  96. [amdxata / amdxata][Running/Boot Start]
  97.   <\SystemRoot\system32\drivers\amdxata.sys><Advanced Micro Devices>
  98. [arc / arc][Stopped/Manual Start]
  99.   <\SystemRoot\system32\drivers\arc.sys><Adaptec, Inc.>
  100. [arcsas / arcsas][Stopped/Manual Start]
  101.   <\SystemRoot\system32\drivers\arcsas.sys><Adaptec, Inc.>
  102. [Broadcom NetXtreme II VBD / b06bdrv][Stopped/Manual Start]
  103.   <\SystemRoot\system32\drivers\bxvbdx.sys><Broadcom Corporation>
  104. [Broadcom NetXtreme Gigabit Ethernet - NDIS 6.0 / b57nd60x][Stopped/Manual Start]
  105.   <system32\DRIVERS\b57nd60x.sys><Broadcom Corporation>
  106. [BeatTrojanHelperOne / BeatTrojanHelperOne][Running/Auto Start]
  107.   <\??\C:\Program Files\木马清除大师2010安全套装\木马清除大师2010\BeatTrojanHelperOne.sys><N/A>
  108. [Brother USB Mass-Storage Lower Filter Driver / BrFiltLo][Stopped/Manual Start]
  109.   <\SystemRoot\system32\drivers\BrFiltLo.sys><Brother Industries, Ltd.>
  110. [Brother USB Mass-Storage Upper Filter Driver / BrFiltUp][Stopped/Manual Start]
  111.   <\SystemRoot\system32\drivers\BrFiltUp.sys><Brother Industries, Ltd.>
  112. [Brother MFC Serial Port Interface Driver (WDM) / Brserid][Stopped/Manual Start]
  113.   <\SystemRoot\System32\Drivers\Brserid.sys><Brother Industries Ltd.>
  114. [Brother WDM Serial driver / BrSerWdm][Stopped/Manual Start]
  115.   <\SystemRoot\System32\Drivers\BrSerWdm.sys><Brother Industries Ltd.>
  116. [Brother MFC USB Fax Only Modem / BrUsbMdm][Stopped/Manual Start]
  117.   <\SystemRoot\System32\Drivers\BrUsbMdm.sys><Brother Industries Ltd.>
  118. [Brother MFC USB Serial WDM Driver / BrUsbSer][Stopped/Manual Start]
  119.   <\SystemRoot\System32\Drivers\BrUsbSer.sys><Brother Industries Ltd.>
  120. [cmdide / cmdide][Stopped/Manual Start]
  121.   <\SystemRoot\system32\drivers\cmdide.sys><CMD Technology, Inc.>
  122. [cpuz132 / cpuz132][Stopped/Manual Start]
  123.   <\??\C:\Users\mdtx\AppData\Local\Temp\DTL132\DTL132_x32.sys><N/A>
  124. [Broadcom NetXtreme II 10 GigE VBD / ebdrv][Stopped/Manual Start]
  125.   <\SystemRoot\system32\drivers\evbdx.sys><Broadcom Corporation>
  126. [elxstor / elxstor][Stopped/Manual Start]
  127.   <\SystemRoot\system32\drivers\elxstor.sys><Emulex>
  128. [Hauppauge Consumer Infrared Receiver / hcw85cir][Stopped/Manual Start]
  129.   <\SystemRoot\system32\drivers\hcw85cir.sys><Hauppauge Computer Works, Inc.>
  130. [HpSAMD / HpSAMD][Stopped/Manual Start]
  131.   <\SystemRoot\system32\drivers\HpSAMD.sys><Hewlett-Packard Company>
  132. [HTC Device Driver / HTCAND32][Stopped/Manual Start]
  133.   <System32\Drivers\ANDROIDUSB.sys><HTC1124 Inc>
  134. [HWiNFO32/64 Kernel Driver / HWiNFO32][Running/System Start]
  135.   <\??\g:\Program Files\MyDrivers\DriverGenius2011\Mydrivers32.SYS><REALiX(tm)>
  136. [iaStorV / iaStorV][Stopped/Manual Start]
  137.   <\SystemRoot\system32\drivers\iaStorV.sys><Intel Corporation>
  138. [iirsp / iirsp][Stopped/Manual Start]
  139.   <\SystemRoot\system32\drivers\iirsp.sys><Intel Corp./ICP vortex GmbH>
  140. [Service for Realtek HD Audio (WDM) / IntcAzAudAddService][Running/Manual Start]
  141.   <system32\drivers\RTKVHDA.sys><Realtek Semiconductor Corp.>
  142. [LSI_FC / LSI_FC][Stopped/Manual Start]
  143.   <\SystemRoot\system32\drivers\lsi_fc.sys><LSI Corporation>
  144. [LSI_SAS / LSI_SAS][Stopped/Manual Start]
  145.   <\SystemRoot\system32\drivers\lsi_sas.sys><LSI Corporation>
  146. [LSI_SAS2 / LSI_SAS2][Stopped/Manual Start]
  147.   <\SystemRoot\system32\drivers\lsi_sas2.sys><LSI Corporation>
  148. [LSI_SCSI / LSI_SCSI][Stopped/Manual Start]
  149.   <\SystemRoot\system32\drivers\lsi_scsi.sys><LSI Corporation>
  150. [megasas / megasas][Stopped/Manual Start]
  151.   <\SystemRoot\system32\drivers\megasas.sys><LSI Corporation>
  152. [MegaSR / MegaSR][Stopped/Manual Start]
  153.   <\SystemRoot\system32\drivers\MegaSR.sys><LSI Corporation, Inc.>
  154. [mp110001 / mp110001][Running/Auto Start]
  155.   <system32\drivers\mp110001.sys><Micropoint Corporation>
  156. [mp110002 / mp110002][Running/Auto Start]
  157.   <system32\drivers\mp110002.sys><Micropoint Corporation>
  158. [mp110003 / mp110003][Running/Boot Start]
  159.   <\SystemRoot\system32\drivers\mp110003.sys><Micropoint Corporation>
  160. [mp110004 / mp110004][Running/Auto Start]
  161.   <system32\drivers\mp110004.sys><Micropoint Corporation>
  162. [mp110005 / mp110005][Running/Manual Start]
  163.   <system32\drivers\mp110005.sys><Micropoint Corporation>
  164. [mp110006 / mp110006][Running/System Start]
  165.   <system32\DRIVERS\mp110006.sys><Micropoint Corporation>
  166. [mp110007 / mp110007][Running/System Start]
  167.   <system32\DRIVERS\mp110007.sys><Micropoint Corporation>
  168. [mp110008 / mp110008][Running/Auto Start]
  169.   <system32\drivers\mp110008.sys><Micropoint Corporation>
  170. [mp110009 / mp110009][Running/System Start]
  171.   <system32\drivers\mp110009.sys><Micropoint Corporation>
  172. [mp110010 / mp110010][Running/Boot Start]
  173.   <\SystemRoot\system32\drivers\mp110010.sys><Micropoint Corporation>
  174. [mp110011 / mp110011][Running/System Start]
  175.   <system32\drivers\mp110011.sys><Micropoint Corporation>
  176. [mp110012 / mp110012][Running/Boot Start]
  177.   <\SystemRoot\system32\drivers\mp110012.sys><Micropoint Corporation>
  178. [mp110013 / mp110013][Running/Boot Start]
  179.   <\SystemRoot\system32\drivers\mp110013.sys><Micropoint Corporation>
  180. [Micropoint Net Filter / mp110014][Running/Manual Start]
  181.   <system32\DRIVERS\mp110014.sys><Micropoint Corporation>
  182. [mp110020 / mp110020][Running/Boot Start]
  183.   <\SystemRoot\system32\drivers\mp110020.sys><Micropoint Corporation>
  184. [mp110021 / mp110021][Running/System Start]
  185.   <system32\drivers\mp110021.sys><Micropoint Corporation>
  186. [mp110022 / mp110022][Running/System Start]
  187.   <system32\drivers\mp110022.sys><Micropoint Corporation>
  188. [ATK0110 ACPI UTILITY / MTsensor][Running/Manual Start]
  189.   <system32\DRIVERS\ASACPI.sys><>
  190. [nfrd960 / nfrd960][Stopped/Manual Start]
  191.   <\SystemRoot\system32\drivers\nfrd960.sys><IBM Corporation>
  192. [Service for NVIDIA High Definition Audio Driver / NVHDA][Running/Manual Start]
  193.   <system32\drivers\nvhda32v.sys><NVIDIA Corporation>
  194. [nvlddmkm / nvlddmkm][Running/Manual Start]
  195.   <system32\DRIVERS\nvlddmkm.sys><NVIDIA Corporation>
  196. [nvraid / nvraid][Stopped/Manual Start]
  197.   <\SystemRoot\system32\drivers\nvraid.sys><NVIDIA Corporation>
  198. [nvstor / nvstor][Stopped/Manual Start]
  199.   <\SystemRoot\system32\drivers\nvstor.sys><NVIDIA Corporation>
  200. [ql2300 / ql2300][Stopped/Manual Start]
  201.   <\SystemRoot\system32\drivers\ql2300.sys><QLogic Corporation>
  202. [ql40xx / ql40xx][Stopped/Manual Start]
  203.   <\SystemRoot\system32\drivers\ql40xx.sys><QLogic Corporation>
  204. [Realtek 8167 NT Driver / RTL8167][Running/Manual Start]
  205.   <system32\DRIVERS\Rt86win7.sys><Realtek>
  206. [SiSRaid2 / SiSRaid2][Stopped/Manual Start]
  207.   <\SystemRoot\system32\drivers\SiSRaid2.sys><Silicon Integrated Systems Corp.>
  208. [SiSRaid4 / SiSRaid4][Stopped/Manual Start]
  209.   <\SystemRoot\system32\drivers\sisraid4.sys><Silicon Integrated Systems>
  210. [stexstor / stexstor][Stopped/Manual Start]
  211.   <\SystemRoot\system32\drivers\stexstor.sys><Promise Technology>
  212. [VGPU / VGPU][Stopped/Manual Start]
  213.   <System32\drivers\rdvgkmd.sys><N/A>
  214. [viaide / viaide][Stopped/Manual Start]
  215.   <\SystemRoot\system32\drivers\viaide.sys><VIA Technologies, Inc.>
  216. [vsmraid / vsmraid][Stopped/Manual Start]
  217.   <\SystemRoot\system32\drivers\vsmraid.sys><VIA Technologies Inc.,Ltd>
  218. [Look 312P / ZSMC301b][Stopped/Manual Start]
  219.   <System32\Drivers\usbVM31b.sys><VM>

  221. ==================================
  222. 浏览器加载项
  223. [ICBC Anti-Phishing class]
  224.   {BB4491A2-D11A-4c6b-91C0-B53246A3122B} <C:\Program Files\ICBCEbankTools\ICBCAntiPhishing\ICBC_WIN32\Icbc_AntiPhishing.dll, (Signed) 中国工商银行>
  225. [Axcleanctrl Class]
  226.   {36C9539B-49D2-01C7-9C6D-10DACDFEA59C} <C:\Windows\system32\icbcclean.dll, (Signed) >
  227. [GDGetTokenInfo Class]
  228.   {3AA9CF07-DF20-48FF-98BE-DED276E40146} <C:\Windows\system32\GDREAD~1.DLL, (Signed) >
  229. [EditCtrl Class]
  230.   {488A4255-3236-44B3-8F27-FA1AECAA8844} <C:\Windows\system32\aliedit\aliedit.dll, (Signed) >
  231. [SfEdit32 Control]
  232.   {69A5F9C4-01CB-470B-8161-CE67313E3CF4} <C:\Windows\system32\99Bill\SfEdit32.dll, (Signed) 99BILL Corp.>
  233. [AxInputControl Class]
  234.   {73E4740C-08EB-4133-896B-8D0A7C9EE3CD} <C:\Windows\system32\InputControl.dll, (Signed) >
  235. [GDGetVer Class]
  236.   {7CCE07A5-A590-4554-B5C3-082840D7012E} <C:\Windows\DOWNLO~1\ICBC_G~1.DLL, (Signed) >
  237. [InfoSecICBCNetSign Class]
  238.   {B1FBC1AD-5644-4084-882A-0F8BA85E7506} <C:\Windows\DOWNLO~1\ICBC_N~1.DLL, (Signed) Infosec Technologies Co., Ltd.>
  239. [Shockwave Flash Object]
  240.   {D27CDB6E-AE6D-11CF-96B8-444553540000} <C:\Windows\system32\Macromed\Flash\Flash10u.ocx, (Signed) Adobe Systems, Inc.>
  241. [InstallHelper Class]
  242.   {1DABF8D5-8430-4985-9B7F-A30E53D709B3} <G:\绿色软件\QQ\Plugin\Com.Tencent.QQMusic\bin\QQMusic\MMInstaller.dll, (Signed) Tencent>
  243. [HTML Document]
  244.   {25336920-03F9-11CF-8FD0-00AA00686F13} <C:\Windows\System32\mshtml.dll, (Signed) Microsoft Corporation>
  245. [Axcleanctrl Class]
  246.   {36C9539B-49D2-01C7-9C6D-10DACDFEA59C} <C:\Windows\system32\icbcclean.dll, (Signed) >
  247. [GDGetTokenInfo Class]
  248.   {3AA9CF07-DF20-48FF-98BE-DED276E40146} <C:\Windows\system32\GDREAD~1.DLL, (Signed) >
  249. [EditCtrl Class]
  250.   {488A4255-3236-44B3-8F27-FA1AECAA8844} <C:\Windows\system32\aliedit\aliedit.dll, (Signed) >
  251. [SfEdit32 Control]
  252.   {69A5F9C4-01CB-470B-8161-CE67313E3CF4} <C:\Windows\system32\99Bill\SfEdit32.dll, (Signed) 99BILL Corp.>
  253. [Windows Media Player]
  254.   {6BF52A52-394A-11D3-B153-00C04F79FAA6} <%SystemRoot%\system32\wmp.dll, (Signed) N/A>
  255. [AxInputControl Class]
  256.   {73E4740C-08EB-4133-896B-8D0A7C9EE3CD} <C:\Windows\system32\InputControl.dll, (Signed) >
  257. [GDGetVer Class]
  258.   {7CCE07A5-A590-4554-B5C3-082840D7012E} <C:\Windows\DOWNLO~1\ICBC_G~1.DLL, (Signed) >
  259. [Microsoft Web Browser]
  260.   {8856F961-340A-11D0-A96B-00C04FD705A2} <C:\Windows\System32\ieframe.dll, (Signed) Microsoft Corporation>
  261. [XML DOM Document 6.0]
  262.   {88D96A05-F192-11D4-A65F-0040963251E5} <%SystemRoot%\System32\msxml6.dll, (Signed) N/A>
  263. [InfoSecICBCNetSign Class]
  264.   {B1FBC1AD-5644-4084-882A-0F8BA85E7506} <C:\Windows\DOWNLO~1\ICBC_N~1.DLL, (Signed) Infosec Technologies Co., Ltd.>
  265. [Shockwave Flash Object]
  266.   {D27CDB6E-AE6D-11CF-96B8-444553540000} <C:\Windows\system32\Macromed\Flash\Flash10u.ocx, (Signed) Adobe Systems, Inc.>
  267. [PlayerCtrl Class]
  268.   {E05BC2A3-9A46-4a32-80C9-023A473F5B23} <G:\绿色软件\QQ\Plugin\Com.Tencent.QQMusic\bin\QQMusic\QzoneMusic.dll, (Signed) Tencent>
  269. [SSOForPTLogin2 Class]
  270.   {EAAED308-7322-4B9B-965E-171933ADD473} <C:\Program Files\Common Files\Tencent\TXSSO\1.2.1.30\Bin\SSOAxCtrlForPTLogin.dll, (Signed) >
  271. [TimwpDll.TimwpCheck]
  272.   {ED4CA2E5-0EEA-44C1-AD7E-74A07A7507A4} <G:\绿色软件\QQ\Bin\Timwp.dll, (Signed) Tencent>
  273. [XML HTTP Request]
  274.   {ED8C108E-4349-11D2-91A4-00C04F7969E8} <%SystemRoot%\System32\msxml3.dll, (Signed) N/A>
  275. [XML HTTP]
  276.   {F6D90F16-9C73-11D3-B32E-00C04F990BB4} <%SystemRoot%\System32\msxml3.dll, (Signed) N/A>

  278. ==================================
  279. 正在运行的进程
  280. [PID: 296 / SYSTEM][\SystemRoot\System32\smss.exe]  [(Verified) Microsoft Corporation, 6.1.7600.16385 (win7_rtm.090713-1255)]
  281. [PID: 456 / SYSTEM][C:\Windows\system32\csrss.exe]  [(Verified) Microsoft Corporation, 6.1.7600.16385 (win7_rtm.090713-1255)]
  282. [PID: 524 / SYSTEM][C:\Windows\system32\wininit.exe]  [(Verified) Microsoft Corporation, 6.1.7600.16385 (win7_rtm.090713-1255)]
  283.     [f:\Program Files\Micropoint\mp110031.dll]  [Micropoint Corporation, 2.0.47.1498]
  284. [PID: 532 / SYSTEM][C:\Windows\system32\csrss.exe]  [(Verified) Microsoft Corporation, 6.1.7600.16385 (win7_rtm.090713-1255)]
  285. [PID: 576 / SYSTEM][C:\Windows\system32\services.exe]  [(Verified) Microsoft Corporation, 6.1.7600.16385 (win7_rtm.090713-1255)]
  286.     [f:\Program Files\Micropoint\mp110031.dll]  [Micropoint Corporation, 2.0.47.1498]
  287.     [C:\Program Files\木马清除大师2010安全套装\木马清除大师防火墙2010\BeatWall.dll]  [Lofocus(洛克思)安全实验室, 2, 0, 0, 1]
  288. [PID: 600 / SYSTEM][C:\Windows\system32\lsass.exe]  [(Verified) Microsoft Corporation, 6.1.7600.16385 (win7_rtm.090713-1255)]
  289. [PID: 608 / SYSTEM][C:\Windows\system32\lsm.exe]  [(Verified) Microsoft Corporation, 6.1.7600.16385 (win7_rtm.090713-1255)]
  290.     [f:\Program Files\Micropoint\mp110031.dll]  [Micropoint Corporation, 2.0.47.1498]
  291. [PID: 644 / SYSTEM][C:\Windows\system32\winlogon.exe]  [(Verified) Microsoft Corporation, 6.1.7601.17514 (win7sp1_rtm.101119-1850)]
  292. [PID: 760 / SYSTEM][C:\Windows\system32\svchost.exe]  [(Verified) Microsoft Corporation, 6.1.7600.16385 (win7_rtm.090713-1255)]
  293.     [f:\Program Files\Micropoint\mp110031.dll]  [Micropoint Corporation, 2.0.47.1498]
  294. [PID: 824 / SYSTEM][C:\Windows\system32\nvvsvc.exe]  [NVIDIA Corporation, 8.17.12.7080]
  295.     [f:\Program Files\Micropoint\mp110031.dll]  [Micropoint Corporation, 2.0.47.1498]
  296.     [C:\Program Files\NVIDIA Corporation\Display\NVXDBat.dll]  [NVIDIA Corporation, 7.17.12.7080]
  297. [PID: 968 / NETWORK SERVICE][C:\Windows\system32\svchost.exe]  [(Verified) Microsoft Corporation, 6.1.7600.16385 (win7_rtm.090713-1255)]
  298.     [C:\Program Files\木马清除大师2010安全套装\木马清除大师防火墙2010\BeatWall.dll]  [Lofocus(洛克思)安全实验室, 2, 0, 0, 1]
  299.     [f:\Program Files\Micropoint\mp110031.dll]  [Micropoint Corporation, 2.0.47.1498]
  300. [PID: 1096 / LOCAL SERVICE][C:\Windows\System32\svchost.exe]  [(Verified) Microsoft Corporation, 6.1.7600.16385 (win7_rtm.090713-1255)]
  301.     [f:\Program Files\Micropoint\mp110031.dll]  [Micropoint Corporation, 2.0.47.1498]
  302. [PID: 1480 / SYSTEM][C:\Windows\System32\svchost.exe]  [(Verified) Microsoft Corporation, 6.1.7600.16385 (win7_rtm.090713-1255)]
  303.     [f:\Program Files\Micropoint\mp110031.dll]  [Micropoint Corporation, 2.0.47.1498]
  304. [PID: 1608 / SYSTEM][C:\Windows\system32\svchost.exe]  [(Verified) Microsoft Corporation, 6.1.7600.16385 (win7_rtm.090713-1255)]
  305.     [f:\Program Files\Micropoint\mp110031.dll]  [Micropoint Corporation, 2.0.47.1498]
  306.     [C:\Program Files\木马清除大师2010安全套装\木马清除大师防火墙2010\BeatWall.dll]  [Lofocus(洛克思)安全实验室, 2, 0, 0, 1]
  307. [PID: 1920 / LOCAL SERVICE][C:\Windows\system32\svchost.exe]  [(Verified) Microsoft Corporation, 6.1.7600.16385 (win7_rtm.090713-1255)]
  308.     [f:\Program Files\Micropoint\mp110031.dll]  [Micropoint Corporation, 2.0.47.1498]
  309. [PID: 128 / NETWORK SERVICE][C:\Windows\system32\svchost.exe]  [(Verified) Microsoft Corporation, 6.1.7600.16385 (win7_rtm.090713-1255)]
  310.     [f:\Program Files\Micropoint\mp110031.dll]  [Micropoint Corporation, 2.0.47.1498]
  311. [PID: 468 / SYSTEM][C:\Program Files\NVIDIA Corporation\Display\NvXDSync.exe]  [NVIDIA Corporation, 7.17.12.7080]
  312.     [f:\Program Files\Micropoint\mp110031.dll]  [Micropoint Corporation, 2.0.47.1498]
  313.     [C:\Program Files\NVIDIA Corporation\Display\NVXDApiX.dll]  [NVIDIA Corporation, 7.17.12.7080]
  314.     [C:\Program Files\NVIDIA Corporation\Display\NvUI.dll]  [NVIDIA Corporation, 7.17.12.7080]
  315.     [C:\Windows\system32\nvapi.dll]  [NVIDIA Corporation, 8.17.12.7080]
  316.     [C:\Program Files\NVIDIA Corporation\Display\NVXDBat.dll]  [NVIDIA Corporation, 7.17.12.7080]
  317. [PID: 348 / SYSTEM][C:\Windows\system32\nvvsvc.exe]  [NVIDIA Corporation, 8.17.12.7080]
  318.     [f:\Program Files\Micropoint\mp110031.dll]  [Micropoint Corporation, 2.0.47.1498]
  319.     [C:\Windows\system32\NVSVC.DLL]  [NVIDIA Corporation, 8.17.12.7080]
  320.     [C:\Windows\system32\nvapi.dll]  [NVIDIA Corporation, 8.17.12.7080]
  321.     [C:\Windows\system32\NVSVCR.DLL]  [NVIDIA Corporation, 8.17.12.7080]
  322.     [C:\Program Files\NVIDIA Corporation\Display\NVXDBat.dll]  [NVIDIA Corporation, 7.17.12.7080]
  323.     [C:\Program Files\NVIDIA Corporation\Display\NVXDPlcy.dll]  [NVIDIA Corporation, 7.17.12.7080]
  324. [PID: 1708 / SYSTEM][C:\Windows\System32\spoolsv.exe]  [(Verified) Microsoft Corporation, 6.1.7600.16385 (win7_rtm.090713-1255)]
  325.     [f:\Program Files\Micropoint\mp110031.dll]  [Micropoint Corporation, 2.0.47.1498]
  326.     [C:\Program Files\木马清除大师2010安全套装\木马清除大师防火墙2010\BeatWall.dll]  [Lofocus(洛克思)安全实验室, 2, 0, 0, 1]
  327. [PID: 1712 / SYSTEM][C:\Windows\system32\taskeng.exe]  [(Verified) Microsoft Corporation, 6.1.7600.16385 (win7_rtm.090713-1255)]
  328. [PID: 1980 / SYSTEM][g:\PROGRA~1\SOGOUI~1\600~1.623\SGTool.exe]  [Sogou.com Inc., 6.0.0.6236]
  329.     [f:\Program Files\Micropoint\mp110031.dll]  [Micropoint Corporation, 2.0.47.1498]
  330. [PID: 316 / LOCAL SERVICE][C:\Windows\system32\svchost.exe]  [(Verified) Microsoft Corporation, 6.1.7600.16385 (win7_rtm.090713-1255)]
  331.     [f:\Program Files\Micropoint\mp110031.dll]  [Micropoint Corporation, 2.0.47.1498]
  332.     [C:\Program Files\木马清除大师2010安全套装\木马清除大师防火墙2010\BeatWall.dll]  [Lofocus(洛克思)安全实验室, 2, 0, 0, 1]
  333. [PID: 2164 / SYSTEM][C:\Program Files\ICBCEbankTools\ICBCAntiPhishing\ICBC_WIN32\IcbcDaemon.exe]  [N/A, ]
  334.     [f:\Program Files\Micropoint\mp110031.dll]  [Micropoint Corporation, 2.0.47.1498]
  335. [PID: 2276 / SYSTEM][C:\Program Files\木马清除大师2010安全套装\木马清除大师2010\BeatTrojanShields.exe]  [Lofocus(洛克思)安全实验室, 4, 6, 0, 0]
  336.     [f:\Program Files\Micropoint\mp110031.dll]  [Micropoint Corporation, 2.0.47.1498]
  337. [PID: 2772 / NETWORK SERVICE][C:\Windows\system32\svchost.exe]  [(Verified) Microsoft Corporation, 6.1.7600.16385 (win7_rtm.090713-1255)]
  338.     [f:\Program Files\Micropoint\mp110031.dll]  [Micropoint Corporation, 2.0.47.1498]
  339.     [C:\Program Files\木马清除大师2010安全套装\木马清除大师防火墙2010\BeatWall.dll]  [Lofocus(洛克思)安全实验室, 2, 0, 0, 1]
  340. [PID: 2964 / mdtx][C:\Windows\system32\taskhost.exe]  [(Verified) Microsoft Corporation, 6.1.7600.16385 (win7_rtm.090713-1255)]
  341. [PID: 3060 / mdtx][C:\Windows\system32\Dwm.exe]  [(Verified) Microsoft Corporation, 6.1.7600.16385 (win7_rtm.090713-1255)]
  342.     [C:\Windows\system32\nvwgf2um.dll]  [NVIDIA Corporation, 8.17.12.7080]
  343. [PID: 3108 / mdtx][C:\Windows\Explorer.EXE]  [(Verified) Microsoft Corporation, 6.1.7600.16385 (win7_rtm.090713-1255)]
  344.     [f:\Program Files\Micropoint\mp110031.dll]  [Micropoint Corporation, 2.0.47.1498]
  345.     [C:\Program Files\木马清除大师2010安全套装\木马清除大师2010\BtHelpSeven.dll]  [Lofocus (洛克思)安全实验室, 6, 0, 0, 0]
  346.     [C:\Windows\system32\FXSAPI.dll]  [Microsoft Corporation, 6.1.7600.16385 (win7_rtm.090713-1255)]
  347. [PID: 3576 / mdtx][C:\Program Files\Realtek\Audio\HDA\RtHDVCpl.exe]  [Realtek Semiconductor, 1, 0, 0, 667]
  348.     [f:\Program Files\Micropoint\mp110031.dll]  [Micropoint Corporation, 2.0.47.1498]
  349.     [C:\Windows\system32\RTCOM\RtkCfg.dll]  [Realtek Semiconductor Corp., 1.0.0.2]
  350.     [C:\Windows\system32\RtkAPO.dll]  [Realtek Semiconductor Corp., 11, 0, 6000, 216]
  351. [PID: 3604 / mdtx][C:\Program Files\木马清除大师2010安全套装\木马清除大师防火墙2010\BeatTrojanWall.exe]  [Lofocus(洛克思)安全实验室, 2.0.0.1]
  352.     [C:\Program Files\木马清除大师2010安全套装\木马清除大师防火墙2010\BeatWall.dll]  [Lofocus(洛克思)安全实验室, 2, 0, 0, 1]
  353.     [f:\Program Files\Micropoint\mp110031.dll]  [Micropoint Corporation, 2.0.47.1498]
  354.     [C:\Program Files\木马清除大师2010安全套装\木马清除大师防火墙2010\Office2007Black.dll]  [Codejock Software, 12, 0, 1, 0]
  355.     [C:\Program Files\木马清除大师2010安全套装\木马清除大师防火墙2010\CheckPE.dll]  [N/A, ]
  356. [PID: 3616 / mdtx][C:\Program Files\Windows Sidebar\sidebar.exe]  [Microsoft Corporation, 6.1.7600.16385 (win7_rtm.090713-1255)]
  357.     [f:\Program Files\MPAV\mp110200.dll]  [Micropoint Corporation, 1, 2, 10581, 19]
  358. [PID: 3808 / SYSTEM][C:\Windows\system32\wbem\wmiprvse.exe]  [(Verified) Microsoft Corporation, 6.1.7601.17514 (win7sp1_rtm.101119-1850)]
  359. [PID: 3932 / SYSTEM][C:\Program Files\木马清除大师2010安全套装\木马清除大师2010\BeatTrojanMon.exe]  [Lofocus(洛克思)安全实验室, 6, 0, 0, 0]
  360.     [f:\Program Files\Micropoint\mp110031.dll]  [Micropoint Corporation, 2.0.47.1498]
  361.     [C:\Program Files\木马清除大师2010安全套装\木马清除大师2010\BtHelpOne.dll]  [Lofocus(洛克思)安全实验室, 4, 6, 0, 0]
  362.     [C:\Program Files\木马清除大师2010安全套装\木马清除大师2010\EgHelperOne.dll]  [Lofocus(洛克思)安全实验室, 5, 0, 0, 0]
  363.     [C:\Program Files\木马清除大师2010安全套装\木马清除大师2010\BtHelpThree.dll]  [Lofocus(洛克思)安全实验室, 4, 6, 0, 0]
  364.     [C:\Program Files\木马清除大师2010安全套装\木马清除大师2010\SystemGuardDelete.dll]  [Lofocus(洛克思)安全实验室, 4, 6, 0, 0]
  365.     [C:\Program Files\木马清除大师2010安全套装\木马清除大师2010\BtHelpEight.dll]  [Lofocus(洛克思)安全实验室, 4, 6, 0, 0]
  366.     [C:\Program Files\木马清除大师2010安全套装\木马清除大师2010\SystemGuardHelper.dll]  [Lofocus(洛克思)安全实验室, 4, 6, 0, 0]
  367.     [C:\Program Files\木马清除大师2010安全套装\木马清除大师2010\BtHelpTwo.dll]  [Lofocus(洛克思)安全实验室, 5, 0, 0, 0]
  368.     [C:\Program Files\木马清除大师2010安全套装\木马清除大师2010\Office2007Black.dll]  [Codejock Software, 12, 0, 1, 0]
  369. [PID: 1748 / SYSTEM][C:\Windows\system32\SearchIndexer.exe]  [(Verified) Microsoft Corporation, 7.00.7600.16385 (win7_rtm.090713-1255)]
  370. [PID: 2500 / mdtx][C:\Windows\system32\SearchProtocolHost.exe]  [(Verified) Microsoft Corporation, 7.00.7600.16385 (win7_rtm.090713-1255)]
  371. [PID: 2488 / SYSTEM][C:\Windows\system32\SearchFilterHost.exe]  [(Verified) Microsoft Corporation, 7.00.7600.16385 (win7_rtm.090713-1255)]
  372. [PID: 3516 / mdtx][C:\Users\mdtx\AppData\Local\Temp\HZ$D.173.2516\HZ$D.173.2517\SREngLdr.EXE]  [Smallfrogs Studio, 2.8.4.1331]
  373.     [f:\Program Files\Micropoint\mp110031.dll]  [Micropoint Corporation, 2.0.47.1498]
  374. [PID: 3504 / mdtx][C:\Users\mdtx\AppData\Local\Temp\HZ$D.173.2516\HZ$D.173.2517\SRE2c5db0ca.EXE]  [Smallfrogs Studio, 2.8.4.1331]
  375.     [f:\Program Files\Micropoint\mp110031.dll]  [Micropoint Corporation, 2.0.47.1498]
  376.     [C:\Program Files\木马清除大师2010安全套装\木马清除大师防火墙2010\BeatWall.dll]  [Lofocus(洛克思)安全实验室, 2, 0, 0, 1]

  378. ==================================
  379. 文件关联
  380. .TXT  OK. [%SystemRoot%\system32\NOTEPAD.EXE %1]
  381. .EXE  OK. ["%1" %*]
  382. .COM  OK. ["%1" %*]
  383. .PIF  OK. ["%1" %*]
  384. .REG  OK. [regedit.exe "%1"]
  385. .BAT  OK. ["%1" %*]
  386. .SCR  OK. ["%1" /S]
  387. .CHM  OK. ["%SystemRoot%\hh.exe" %1]
  388. .HLP  OK. [%SystemRoot%\winhlp32.exe %1]
  389. .INI  OK. [%SystemRoot%\system32\NOTEPAD.EXE %1]
  390. .INF  OK. [%SystemRoot%\system32\NOTEPAD.EXE %1]
  391. .VBS  OK. ["%SystemRoot%\System32\WScript.exe" "%1" %*]
  392. .JS   OK. [%SystemRoot%\System32\WScript.exe "%1" %*]
  393. .LNK  OK. [{00021401-0000-0000-C000-000000000046}]

  395. ==================================
  396. Winsock 提供者
  397. BeatTrojanWall over [MSAFD Tcpip [TCP/IP]]
  398.     C:\Program Files\木马清除大师2010安全套装\木马清除大师防火墙2010\BeatWall.dll(Lofocus(洛克思)安全实验室, 木马清除大师防火墙组件)
  399. BeatTrojanWall over [MSAFD Tcpip [UDP/IP]]
  400.     C:\Program Files\木马清除大师2010安全套装\木马清除大师防火墙2010\BeatWall.dll(Lofocus(洛克思)安全实验室, 木马清除大师防火墙组件)
  401. BeatTrojanWall over [RSVP TCP 服务提供商]
  402.     C:\Program Files\木马清除大师2010安全套装\木马清除大师防火墙2010\BeatWall.dll(Lofocus(洛克思)安全实验室, 木马清除大师防火墙组件)
  403. BeatTrojanWall over [RSVP UDP 服务提供商]
  404.     C:\Program Files\木马清除大师2010安全套装\木马清除大师防火墙2010\BeatWall.dll(Lofocus(洛克思)安全实验室, 木马清除大师防火墙组件)
  405. BeatTrojanWall
  406.     C:\Program Files\木马清除大师2010安全套装\木马清除大师防火墙2010\BeatWall.dll(Lofocus(洛克思)安全实验室, 木马清除大师防火墙组件)

  408. ==================================
  409. Autorun.inf
  410. N/A

  412. ==================================
  413. HOSTS 文件
  414. N/A

  416. ==================================
  417. 进程特权扫描
  418. N/A

  420. ==================================
  421. 计划任务
  422. [已启用] \\Drivergenius drivers check service
  423.         g:\Program Files\MyDrivers\DriverGenius2011\DriverGenius.exe -static
  424. [已启用] \\SogouImeMgr
  425.         g:\PROGRA~1\SOGOUI~1\600~1.623\SGTool.exe --appid=pinyinrepair /S
  426. [已启用] \\WpsUpdateTask_mdtx
  427.         g:\Program Files\Kingsoft\WPS Office Personal\office6\wpsupdate.exe -from=task
  428. [已禁用] \Microsoft\Windows\Active Directory Rights Management Services Client\AD RMS Rights Policy Template Management (Automated)
  429.         N/A
  430. [已启用] \Microsoft\Windows\Active Directory Rights Management Services Client\AD RMS Rights Policy Template Management (Manual)
  431.         N/A
  432. [已禁用] \Microsoft\Windows\AppID\PolicyConverter
  433.         %windir%\system32\appidpolicyconverter.exe
  434. [已禁用] \Microsoft\Windows\AppID\VerifiedPublisherCertStoreCheck
  435.         %windir%\system32\appidcertstorecheck.exe
  436. [已启用] \Microsoft\Windows\Application Experience\AitAgent
  437.         aitagent
  438. [已启用] \Microsoft\Windows\Application Experience\ProgramDataUpdater
  439.         %windir%\system32\rundll32.exe aepdu.dll,AePduRunUpdate
  440. [已启用] \Microsoft\Windows\Autochk\Proxy
  441.         %windir%\system32\rundll32.exe /d acproxy.dll,PerformAutochkOperations
  442. [已启用] \Microsoft\Windows\Bluetooth\UninstallDeviceTask
  443.         BthUdTask.exe $(Arg0)
  444. [已启用] \Microsoft\Windows\CertificateServicesClient\SystemTask
  445.         N/A
  446. [已启用] \Microsoft\Windows\CertificateServicesClient\UserTask
  447.         N/A
  448. [已禁用] \Microsoft\Windows\CertificateServicesClient\UserTask-Roam
  449.         N/A
  450. [已启用] \Microsoft\Windows\Customer Experience Improvement Program\Consolidator
  451.         %SystemRoot%\System32\wsqmcons.exe
  452. [已启用] \Microsoft\Windows\Defrag\ScheduledDefrag
  453.         %windir%\system32\defrag.exe -c
  454. [已启用] \Microsoft\Windows\Location\Notifications
  455.         %windir%\System32\LocationNotifications.exe
  456. [已启用] \Microsoft\Windows\Maintenance\WinSAT
  457.         N/A
  458. [已启用] \Microsoft\Windows\Media Center\ActivateWindowsSearch
  459.         %SystemRoot%\ehome\ehPrivJob.exe /DoActivateWindowsSearch
  460. [已启用] \Microsoft\Windows\Media Center\ConfigureInternetTimeService
  461.         %SystemRoot%\ehome\ehPrivJob.exe /DoConfigureInternetTimeService
  462. [已启用] \Microsoft\Windows\Media Center\DispatchRecoveryTasks
  463.         %SystemRoot%\ehome\ehPrivJob.exe /DoRecoveryTasks $(Arg0)
  464. [已启用] \Microsoft\Windows\Media Center\ehDRMInit
  465.         %SystemRoot%\ehome\ehPrivJob.exe /DRMInit
  466. [已启用] \Microsoft\Windows\Media Center\InstallPlayReady
  467.         %SystemRoot%\ehome\ehPrivJob.exe /InstallPlayReady $(Arg0)
  468. [已启用] \Microsoft\Windows\Media Center\mcupdate
  469.         %SystemRoot%\ehome\mcupdate $(Arg0)
  470. [已启用] \Microsoft\Windows\Media Center\MediaCenterRecoveryTask
  471.         %SystemRoot%\ehome\mcupdate.exe -MediaCenterRecoveryTask
  472. [已启用] \Microsoft\Windows\Media Center\MediaCenterRecoveryTask
  473.         %SystemRoot%\ehome\mcupdate.exe -MediaCenterRecoveryTask
  474. [已启用] \Microsoft\Windows\Media Center\ObjectStoreRecoveryTask
  475.         %SystemRoot%\ehome\mcupdate.exe -ObjectStoreRecoveryTask
  476. [已启用] \Microsoft\Windows\Media Center\ObjectStoreRecoveryTask
  477.         %SystemRoot%\ehome\mcupdate.exe -ObjectStoreRecoveryTask
  478. [已启用] \Microsoft\Windows\Media Center\OCURActivate
  479.         %SystemRoot%\ehome\ehPrivJob.exe /OCURActivate
  480. [已启用] \Microsoft\Windows\Media Center\OCURDiscovery
  481.         %SystemRoot%\ehome\ehPrivJob.exe /OCURDiscovery $(Arg0)
  482. [已启用] \Microsoft\Windows\Media Center\PBDADiscovery
  483.         %SystemRoot%\ehome\ehPrivJob.exe /PBDADiscovery
  484. [已启用] \Microsoft\Windows\Media Center\PBDADiscoveryW1
  485.         %SystemRoot%\ehome\ehPrivJob.exe /wait:7 /PBDADiscovery
  486. [已启用] \Microsoft\Windows\Media Center\PBDADiscoveryW2
  487.         %SystemRoot%\ehome\ehPrivJob.exe /wait:90 /PBDADiscovery
  488. [已禁用] \Microsoft\Windows\Media Center\PeriodicScanRetry
  489.         %windir%\ehome\MCUpdate.exe -pscn 0
  490. [已启用] \Microsoft\Windows\Media Center\PvrRecoveryTask
  491.         %SystemRoot%\ehome\mcupdate.exe -PvrRecoveryTask
  492. [已启用] \Microsoft\Windows\Media Center\PvrRecoveryTask
  493.         %SystemRoot%\ehome\mcupdate.exe -PvrRecoveryTask
  494. [已启用] \Microsoft\Windows\Media Center\PvrScheduleTask
  495.         %SystemRoot%\ehome\mcupdate.exe -PvrSchedule
  496. [已启用] \Microsoft\Windows\Media Center\PvrScheduleTask
  497.         %SystemRoot%\ehome\mcupdate.exe -PvrSchedule
  498. [已禁用] \Microsoft\Windows\Media Center\RecordingRestart
  499.         %SystemRoot%\ehome\ehrec /RestartRecording
  500. [已启用] \Microsoft\Windows\Media Center\RegisterSearch
  501.         %SystemRoot%\ehome\ehPrivJob.exe /DoRegisterSearch $(Arg0)
  502. [已启用] \Microsoft\Windows\Media Center\ReindexSearchRoot
  503.         %SystemRoot%\ehome\ehPrivJob.exe /DoReindexSearchRoot
  504. [已启用] \Microsoft\Windows\Media Center\SqlLiteRecoveryTask
  505.         %SystemRoot%\ehome\mcupdate.exe -SqlLiteRecoveryTask
  506. [已启用] \Microsoft\Windows\Media Center\SqlLiteRecoveryTask
  507.         %SystemRoot%\ehome\mcupdate.exe -SqlLiteRecoveryTask
  508. [已启用] \Microsoft\Windows\Media Center\StartRecording
  509.         %SystemRoot%\ehome\ehrec /StartRecording
  510. [已启用] \Microsoft\Windows\Media Center\UpdateRecordPath
  511.         %SystemRoot%\ehome\ehPrivJob.exe /DoUpdateRecordPath $(Arg0)
  512. [已启用] \Microsoft\Windows\MobilePC\HotStart
  513.         N/A
  514. [已启用] \Microsoft\Windows\MUI\LPRemove
  515.         %windir%\system32\lpremove.exe
  516. [已启用] \Microsoft\Windows\Multimedia\SystemSoundsService
  517.         N/A
  518. [已启用] \Microsoft\Windows\NetTrace\GatherNetworkInfo
  519.         %windir%\system32\gatherNetworkInfo.vbs
  520. [已禁用] \Microsoft\Windows\Offline Files\Background Synchronization
  521.         N/A
  522. [已禁用] \Microsoft\Windows\Offline Files\Logon Synchronization
  523.         N/A
  524. [已启用] \Microsoft\Windows\Power Efficiency Diagnostics\AnalyzeSystem
  525.         %SystemRoot%\System32\powercfg.exe -energy -auto
  526. [已启用] \Microsoft\Windows\Ras\MobilityManager
  527.         N/A
  528. [已禁用] \Microsoft\Windows\SideShow\AutoWake
  529.         N/A
  530. [已启用] \Microsoft\Windows\SideShow\GadgetManager
  531.         N/A
  532. [已禁用] \Microsoft\Windows\SideShow\SessionAgent
  533.         N/A
  534. [已禁用] \Microsoft\Windows\SideShow\SystemDataProviders
  535.         N/A
  536. [已启用] \Microsoft\Windows\SystemRestore\SR
  537.         %windir%\system32\rundll32.exe /d srrstr.dll,ExecuteScheduledSPPCreation
  538. [已启用] \Microsoft\Windows\Tcpip\IpAddressConflict1
  539.         %windir%\system32\rundll32.exe ndfapi.dll,NdfRunDllDuplicateIPOffendingSystem
  540. [已启用] \Microsoft\Windows\Tcpip\IpAddressConflict2
  541.         %windir%\system32\rundll32.exe ndfapi.dll,NdfRunDllDuplicateIPDefendingSystem
  542. [已启用] \Microsoft\Windows\Time Synchronization\SynchronizeTime
  543.         %windir%\system32\sc.exe start w32time task_started
  544. [已启用] \Microsoft\Windows\UPnP\UPnPHostConfig
  545.         sc.exe config upnphost start= auto
  546. [已禁用] \Microsoft\Windows\User Profile Service\HiveUploadTask
  547.         N/A
  548. [已启用] \Microsoft\Windows\Windows Error Reporting\QueueReporting
  549.         %windir%\system32\wermgr.exe -queuereporting
  550. [已启用] \Microsoft\Windows\Windows Media Sharing\UpdateLibrary
  551.         "%ProgramFiles%\Windows Media Player\wmpnscfg.exe"
  552. [已启用] \Microsoft\Windows\WindowsBackup\ConfigNotification
  553.         %systemroot%\System32\sdclt.exe /CONFIGNOTIFICATION
  554. [已禁用] \Microsoft\Windows\WindowsColorSystem\Calibration Loader
  555.         N/A

  557. ==================================
  558. Windows 安全更新检查
  559. N/A

  561. ==================================
  562. API HOOK
  563. N/A

  565. ==================================
  566. 隐藏进程
  567. N/A

  569. ==================================


复制代码
回复

举报

相惜，不离
发表于 2011-10-16 10:39:46 | 显示全部楼层
   告诉你一些简单的操作把。
1，查看有没有可疑进程。
2，查看开机启动项，服务什么的。
3，在你感觉电脑不正常的时候可以试试 CMD  ---  netstat -on   查看是否有可疑连接。


你还可以使用一些软件查看你加载的DLL文件什么的 去分辨他们。。






       菜鸟一个，也只有一些普通的建议，说的不好请别介意。
回复

举报

yzjxue
 楼主| 发表于 2011-10-16 10:47:56 | 显示全部楼层
相惜，不离 发表于 2011-10-16 10:39
告诉你一些简单的操作把。
1，查看有没有可疑进程。
2，查看开机启动项，服务什么的。

谢谢，不过不会看啊。！
回复

举报

相惜，不离
发表于 2011-10-16 10:50:59 | 显示全部楼层
yzjxue 发表于 2011-10-16 10:47
谢谢，不过不会看啊。！

  你是说netstat命令吗？  你打 netstat -no 之后他会把你现在的网络连接都列出来。而且 后面都会跟PID  标识出连接网络的进程    你可以在任务管理器-查看-PID  选项勾选 然后就可以在任务管理器 看出来 你的什么进程在连接网络。 然后判定可疑进程  如果没有就没有拉。。
回复

举报

强妈威武
发表于 2011-10-16 10:52:16 | 显示全部楼层
把Winsock重置一下，其实不行就把那个什么木马大师卸了换金山卫士，那个木马大师很鸡肋
回复

举报

zhou0197
发表于 2011-10-16 10:52:44 | 显示全部楼层
yzjxue 发表于 2011-10-16 10:47
谢谢，不过不会看啊。！

日志没有什么问题，建议先配合金山急救箱+windows清理助手做一下扫描，看看有无线索。CMD弹窗有无特定的触发条件？还有，看到你装了木马清除大师和qqkav，不知是否是这两个的影响？
回复

举报

相惜，不离
发表于 2011-10-16 10:57:02 | 显示全部楼层
  呵呵，专业的来了。LZ问问他们把。
回复

举报

yzjxue
 楼主| 发表于 2011-10-16 10:58:21 | 显示全部楼层
相惜，不离 发表于 2011-10-16 10:50
你是说netstat命令吗？  你打 netstat -no 之后他会把你现在的网络连接都列出来。而且 后面都会跟PID   ...

感谢我试试，！ 不过我时菜鸟。联网的进程 要判断出来那些是正常的联网那些是恶意的联网 有点难度！
回复

举报

相惜，不离
发表于 2011-10-16 10:59:52 | 显示全部楼层
yzjxue 发表于 2011-10-16 10:58
感谢我试试，！ 不过我时菜鸟。联网的进程 要判断出来那些是正常的联网那些是恶意的联网 有点难度！

  多百度，百度是个好东西、呵呵   而且 你可以把图发到论坛让人看看呗
回复

举报

yzjxue
 楼主| 发表于 2011-10-16 11:01:39 | 显示全部楼层
强妈威武 发表于 2011-10-16 10:52
把Winsock重置一下，其实不行就把那个什么木马大师卸了换金山卫士，那个木马大师很鸡肋

这个WINSOCK 重置 怎么操作！   这个木马清除大师应该还是又点用吧。前段时间 微点其他杀毒软件都没有杀出的木马也给他杀出了。！这二个都是买的！ 微点 和木马清除大师！ 金山卫士 应该不错，我想同时安装不知道会不会冲突
回复

举报

下一页 »
12下一页
返回列表 发新帖
高级模式
B Color Image Link Quote Code Smilies
您需要登录后才可以回帖 登录 | 快速注册

本版积分规则

手机版|杀毒软件|软件论坛| 卡饭论坛

Copyright © KaFan  KaFan.cn All Rights Reserved.

Powered by Discuz! X3.4( 沪ICP备2020031077号-2 ) GMT+8, 2025-6-6 09:07 , Processed in 0.159985 second(s), 16 queries .

卡饭网所发布的一切软件、样本、工具、文章等仅限用于学习和研究，不得将上述内容用于商业或者其他非法用途，否则产生的一切后果自负，本站信息来自网络，版权争议问题与本站无关，您必须在下载后的24小时之内从您的电脑中彻底删除上述信息，如有问题请通过邮件与我们联系。

快速回复 客服 返回顶部 返回列表