本帖最后由 独自丶飘零 于 2020-2-11 22:26 编辑
单位电脑。现在需要卸载金盾。。。但是其他电脑的快捷键都能卸载,就这一台电脑没反应,
我在虚拟机里用Total_Uninstall监视安装然后卸载一遍,有Total_Uninstall的修改和卸载日志,怎么弄,能不能把这个日志做成个bat来一键卸载
在虚拟机里测试已解决,明天去单位试试。方法用Total Uninstall记录安装一遍,然后重启电脑使金盾完全生效,然后用Total Uninstall卸载(我用的免安装版的Total Uninstall,拷走Total Uninstall的文件夹,软件安装的记录也会一起带走),卸载过程会一直报错,一直按确定就可以,Total Uninstall卸载的进度会走下去,然后Total Uninstall会提示程序部分卸载完成,重启电脑,金盾就剩一个后台进程了,结束任务就行,或者卸载完成后安装一个PE,进PE里用这个bat清一下文件这个是我根据导出的Total Uninstall的记录弄的(命令是一边百度一遍弄),删了一些文件与文件夹,注册表没动,运行完之后重启,后台就没金盾的任何进程了
但是我有一点奇怪的是,手动删除的话 把能删的删了,重启金盾就会自动还原,用Total Uninstall却不会
- 已监视程序
- 金盾
- 监视时间
- 2020/2/11 17:39:14
- 已监视程序路径
- "C:\Users\WeiYing\Desktop\Cis.Setup_信息技术科_142.190.0.4.exe"
- 安装前的快照名称
- 2020-02-11_17-37-34
- 安装后的快照名称
- 2020-02-11_17-39-12
- 比较配置文件名称
- 默认
-
- 检测到的修改
- 文件系统
- 创建的文件夹: 32
- 删除的文件夹: 0
- 创建的文件 : 338
- 删除的文件 : 1
- 修改的文件 : 1
- 大小 :84.26 MB
- 注册表
- 创建的注册表项: 352
- 删除的注册表项: 0
- 创建的注册表值: 541
- 删除的注册表值: 0
- 修改的注册表值: 14
- 大小 :48.16 KB
-
- 日志文件名称
- C:\ProgramData\Martau\Total Uninstall 6\Monitored Programs\金盾.tun
-
- 备份
- C:\ProgramData\Martau\Total Uninstall 6\Backup\金盾.Monitored.zip
- 文件系统详细信息 [查看:全部详细信息] (全部)
- -------------------------
- (+)(文件夹) C:\ChinaSoft
- (+)(文件夹) C:\cis7Backup
- (+)(文件) Desktop.ini = 2014/12/1 16:22, 108 字节, HSA
- (+)(文件夹) C:\Users\WeiYing\AppData\Local\GSSoft
- (+)(文件夹) C:\Users\WeiYing\AppData\Local\GSSoft\HrServ
- (+)(文件夹) C:\Users\WeiYing\AppData\Local\GSSoft\HrServ\log
- (+)(文件夹) C:\Users\WeiYing\AppData\Local\GSSoft\hruser
- (+)(文件夹) C:\Users\WeiYing\AppData\Local\GSSoft\hruser\data
- (+)(文件) 20200211173826.db = 2020/2/11 17:38, 13312 字节, A
- (+)(文件) dblog.xml = 2020/2/11 17:38, 115 字节, A
- (+)(文件夹) C:\Users\WeiYing\AppData\Local\GSSoft\hruser\log
- (+)(文件) 20200211173826_gddcl.dll-0.log = 2020/2/11 17:38, 230 字节, A
- (+)(文件) 20200211173826_hruser.exe-0.log = 2020/2/11 17:38, 0 字节, A
- (+)(文件) 20200211173827_usbmanager.dll-0.log = 2020/2/11 17:38, 0 字节, A
- (+)(文件) HttpMM.dll_20200211173825.log = 2020/2/11 17:38, 2 字节, A
- (+)(文件夹) C:\Users\WeiYing\AppData\Local\GSSoft\Hruser64
- (+)(文件夹) C:\Users\WeiYing\AppData\Local\GSSoft\Hruser64\log
- (+)(文件) 20200211173857_Hruser64.exe-0.log = 2020/2/11 17:38, 0 字节, A
- (+)(文件夹) C:\Users\WeiYing\AppData\Roaming\Microsoft\Ime
- (+)(文件夹) C:\Users\WeiYing\AppData\Roaming\Microsoft\Ime\IMSC5
- (+)(文件) PLearnL.DAT = 2020/2/11 17:38, 190528 字节, A
- (+)(文件) PLearnS.DAT = 2020/2/11 17:38, 67648 字节, A
- (文件夹) C:\Users\WeiYing\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar
- (*)(文件) desktop.ini
- 2019/12/25 18:44, 211 字节, HS ==> 2020/2/11 17:37, 146 字节, HS
- (-)(文件) Windows Media Player.lnk = 2010/11/21 11:40, 1547 字节, A
- (文件夹) C:\Windows
- (+)(文件) DexSendEMail.exe = 2014/12/1 16:22, 243352 字节, A
- (+)(文件) DexSendEMail.ini = 2014/12/1 16:22, 49 字节, A
- (+)(文件) SmtpSet.ini = 2014/12/1 16:22, 0 字节, A
- (文件夹) C:\Windows\System32\drivers
- (+)(文件) cisfm64.sys = 2014/12/1 16:22, 19400 字节, A
- (+)(文件) npf.sys = 2014/11/28 9:02, 36600 字节, A
- (文件夹) C:\Windows\SysWOW64
- (+)(文件) Bridge.exe = 2014/12/1 16:22, 22160 字节, A
- (+)(文件) cisfh.exe = 2014/12/1 16:22, 75416 字节, A
- (+)(文件) gdiplus.dll = 2014/12/1 16:22, 1705912 字节, A
- (+)(文件) IpLocker.dll = 2014/12/1 16:22, 423504 字节, A
- (+)(文件) logo.gif = 2014/12/1 16:22, 5990 字节, A
- (+)(文件) npptools.dll = 2014/12/1 16:22, 59832 字节, A
- (+)(文件) safe.htm = 2014/12/1 16:22, 1236 字节, A
- (+)(文件夹) C:\Windows\SysWOW64\ChinaSoft
- (+)(文件夹) C:\Windows\SysWOW64\ChinaSoft\cis7
- (+)(文件) Alert.exe = 2014/12/1 16:22, 236936 字节, A
- (+)(文件) Alert.htm = 2014/12/1 16:22, 7812 字节, A
- (+)(文件) AnalyzeLeakEx.exe = 2014/12/1 16:22, 198736 字节, A
- (+)(文件) AntiSc.dll = 2015/6/27 10:13, 132408 字节, A
- (+)(文件) AntiSc64.dll = 2015/6/27 10:13, 156984 字节, A
- (+)(文件) ArpDefense.dll = 2014/12/1 16:22, 88120 字节, A
- (+)(文件) avconfig.xml = 2015/6/26 14:14, 1760 字节, A
- (+)(文件) BackupFile.dll = 2014/12/1 16:22, 43704 字节, A
- (+)(文件) Bridge.exe = 2014/12/1 16:22, 22160 字节, A
- (+)(文件) Bulletin.dll = 2014/12/1 16:22, 179592 字节, A
- (+)(文件) ChatFile.dll = 2014/12/1 16:22, 118112 字节, A
- (+)(文件) ChatMM.dll = 2015/6/27 10:13, 117616 字节, A
- (+)(文件) CisCfg.dll = 2014/12/1 16:22, 133080 字节, A
- (+)(文件) cisfh.exe = 2014/12/1 16:22, 75416 字节, A
- (+)(文件) cisfm32.inf = 2014/12/1 16:22, 2651 字节, A
- (+)(文件) cisfm32.sys = 2014/12/1 16:22, 20584 字节, A
- (+)(文件) cisfm64.inf = 2014/12/1 16:22, 2651 字节, A
- (+)(文件) cisfm64.sys = 2014/12/1 16:22, 19400 字节, A
- (+)(文件) cisfminst.exe = 2014/12/1 16:22, 60008 字节, A
- (+)(文件) cishook32.dll = 2014/12/1 16:22, 236112 字节, A
- (+)(文件) cishook64.dll = 2014/12/1 16:22, 269392 字节, A
- (+)(文件) ciskernel.tad = 2020/2/11 17:38, 38258 字节, A
- (+)(文件) cispack.exe = 2014/12/1 16:22, 547072 字节, A
- (+)(文件) clear.bat = 2014/12/1 16:22, 666 字节, A
- (+)(文件) Config.ini = 2015/6/26 14:14, 289 字节, A
- (+)(文件) config.xml = 2015/6/27 10:13, 1553 字节, A
- (+)(文件) Conver.exe = 2014/12/1 16:22, 34888 字节, A
- (+)(文件) Desktop.ini = 2014/12/1 16:22, 108 字节, A
- (+)(文件) devcon32.dll = 2014/12/1 16:22, 84560 字节, A
- (+)(文件) devcon64.dll = 2014/12/1 16:22, 89680 字节, A
- (+)(文件) devctrl.dll = 2014/12/1 16:22, 30136 字节, A
- (+)(文件) DexSendEMail.exe = 2014/12/1 16:22, 243352 字节, A
- (+)(文件) DexSendEMail.ini = 2014/12/1 16:22, 49 字节, A
- (+)(文件) DocSecBase.dll = 2014/12/1 16:22, 241768 字节, A
- (+)(文件) dp.dll = 2015/1/13 8:44, 157288 字节, A
- (+)(文件) dp64.dll = 2015/1/13 8:44, 185448 字节, A
- (+)(文件) ExplorerExt.dll = 2014/12/26 14:46, 133800 字节, A
- (+)(文件) fctrl.dll = 2014/12/1 16:22, 62904 字节, A
- (+)(文件) fctrlr.dll = 2014/12/1 16:22, 62904 字节, A
- (+)(文件) FltEng.sys = 2014/11/28 9:03, 14280 字节, A
- (+)(文件) FltEng00.dll = 2014/11/28 9:03, 72520 字节, A
- (+)(文件) FltEng51.dll = 2014/11/28 9:03, 51016 字节, A
- (+)(文件) FltEng60.dll = 2014/11/28 9:03, 57160 字节, A
- (+)(文件) FluxMM.dll = 2015/6/27 10:13, 146288 字节, A
- (+)(文件) FoxLib.dll = 2014/12/1 16:22, 109224 字节, A
- (+)(文件) fpublic.dll = 2014/12/1 16:22, 67000 字节, A
- (+)(文件) ftmc.dll = 2014/12/1 16:22, 111208 字节, A
- (+)(文件) fwctl.dll = 2014/12/1 16:22, 16200 字节, A
- (+)(文件) gdassist.dll = 2014/12/1 16:20, 1621096 字节, A
- (+)(文件) gdassist32.exe = 2014/12/1 16:20, 1619560 字节, A
- (+)(文件) gdassist64.exe = 2014/12/1 16:20, 1760872 字节, A
- (+)(文件) gdassistldr.exe = 2014/12/1 16:22, 122984 字节, A
- (+)(文件) gdassistscreen.dll = 2014/12/1 16:22, 97896 字节, A
- (+)(文件) gdassistscreen64.dll = 2014/12/1 16:20, 110696 字节, A
- (+)(文件) gddcl.dll = 2015/6/27 10:13, 649016 字节, A
- (+)(文件) gdfm32.dll = 2014/11/29 10:12, 111208 字节, A
- (+)(文件) gdfm64.dll = 2014/11/29 10:12, 137320 字节, A
- (+)(文件) gdiplus.dll = 2014/12/1 16:22, 1705912 字节, A
- (+)(文件) gdtdi32.sys = 2014/12/1 16:22, 20632 字节, A
- (+)(文件) gdtdi64.sys = 2014/12/1 16:22, 20944 字节, A
- (+)(文件) gdwfp32.sys = 2014/12/1 16:22, 27240 字节, A
- (+)(文件) gdwfp64.sys = 2014/12/1 16:22, 28616 字节, A
- (+)(文件) gloomy.dll = 2014/12/1 16:22, 124560 字节, A
- (+)(文件) GoldShieldBHO.dll = 2014/12/1 16:22, 127304 字节, A
- (+)(文件) gtpclient.dll = 2014/12/1 16:22, 114768 字节, A
- (+)(文件) Hrbc.exe = 2014/12/1 16:22, 85152 字节, A
- (+)(文件) HrDac.exe = 2014/12/1 16:22, 27808 字节, A
- (+)(文件) HrExt.dll = 2014/12/26 14:35, 191592 字节, A
- (+)(文件) HrExt64.dll = 2014/12/26 14:35, 224872 字节, A
- (+)(文件) HrOutlookExt.dll = 2014/12/1 16:22, 95744 字节, A
- (+)(文件) HrServ.exe = 2015/1/20 9:03, 785064 字节, A
- (+)(文件) hrunins.exe = 2015/6/27 10:14, 873272 字节, A
- (+)(文件) hrunins.exe.0003EABB = 2015/6/27 10:14, 873272 字节, A
- (+)(文件) hrunins.msg = 2014/12/1 16:22, 6991 字节, A
- (+)(文件) hrunins.msg.0003EABB = 2020/2/11 17:38, 6991 字节, A
- (+)(文件) hruser.exe = 2015/6/27 10:14, 1870720 字节, A
- (+)(文件) hruser64.exe = 2015/6/27 10:13, 147256 字节, A
- (+)(文件) HttpMM.dll = 2015/6/27 10:13, 473968 字节, A
- (+)(文件) IllegalLiaison.dll = 2014/12/1 16:22, 173720 字节, A
- (+)(文件) InsPcap.exe = 2014/11/28 9:02, 50848 字节, A
- (+)(文件) IpLocker.dll = 2014/12/1 16:22, 423504 字节, A
- (+)(文件) LeakEx.xml = 2014/12/1 16:22, 629 字节, A
- (+)(文件) LeakScan.dll = 2014/12/1 16:22, 641928 字节, A
- (+)(文件) libmysql.dll = 2014/12/1 16:22, 1476600 字节, A
- (+)(文件) logo.gif = 2014/12/1 16:22, 5990 字节, A
- (+)(文件) MakeLowSecurity.exe = 2014/12/1 16:22, 42424 字节, A
- (+)(文件) MSNMsg.dll = 2014/12/1 16:22, 91464 字节, A
- (+)(文件) msvcp60.dll = 2014/12/1 16:22, 413696 字节, A
- (+)(文件) NetMon2.dll = 2014/12/1 16:22, 289448 字节, A
- (+)(文件) NetNail.exe = 2014/12/1 16:22, 236200 字节, A
- (+)(文件) Node.xml = 2014/12/1 16:22, 28284 字节, A
- (+)(文件) npf.sys = 2014/11/28 9:02, 36600 字节, A
- (+)(文件) npf64.sys = 2014/11/28 9:02, 36600 字节, A
- (+)(文件) npptools.dll = 2014/12/1 16:22, 59832 字节, A
- (+)(文件) office.dat = 2014/12/1 16:22, 439605 字节, A
- (+)(文件) office64.dat = 2014/12/1 16:22, 185533 字节, A
- (+)(文件) OptMark.dll = 2014/12/1 16:22, 64192 字节, A
- (+)(文件) Packet.dll = 2014/11/28 9:02, 98040 字节, A
- (+)(文件) PatchMark.dll = 2014/12/1 16:22, 220504 字节, A
- (+)(文件) PRINTINFO.XML = 2014/12/1 16:22, 2059 字节, A
- (+)(文件) Prints.dll = 2014/12/1 16:22, 186000 字节, A
- (+)(文件) ProcessMon2.dll = 2015/6/27 10:13, 838528 字节, A
- (+)(文件) PsConfig.xml = 2014/12/1 16:22, 214 字节, A
- (+)(文件) PsConfig.xml.0003EB09 = 2020/2/11 17:38, 2048 字节, A
- (+)(文件) PsSysConfig.xml = 2014/12/1 16:22, 3802 字节, A
- (+)(文件) PsSysConfig.xml.0003EB09 = 2020/2/11 17:38, 5120 字节, A
- (+)(文件) reffinsLru.dll = 2015/6/27 10:13, 582968 字节, A
- (+)(文件) scrReco.dll = 2014/12/1 16:22, 156776 字节, A
- (+)(文件) SmtpSet.ini = 2014/12/1 16:22, 0 字节, A
- (+)(文件) soft.dat = 2014/12/1 16:22, 171 字节, A
- (+)(文件) StatuMark.exe = 2015/6/27 10:13, 539448 字节, A
- (+)(文件) StatuMarkConfig.xml = 2014/12/25 8:58, 10924 字节, A
- (+)(文件) SubmitInfo.dll = 2014/12/1 16:22, 297640 字节, A
- (+)(文件) subtms.dll = 2015/6/27 10:13, 90936 字节, A
- (+)(文件) syscfg.dll = 2014/12/1 16:22, 63424 字节, A
- (+)(文件) system.dat = 2014/12/1 16:22, 2009056 字节, A
- (+)(文件) system64.dat = 2014/12/1 16:22, 1064067 字节, A
- (+)(文件) UKVerify.dll = 2014/12/1 16:22, 107088 字节, A
- (+)(文件) UKVerify64.dll = 2014/12/1 16:22, 117840 字节, A
- (+)(文件) unins000.exe = 2020/2/11 17:38, 873272 字节, A
- (+)(文件) UniqueMark.dll = 2014/12/1 16:22, 107624 字节, A
- (+)(文件) updatehelp.exe = 2014/12/1 16:22, 30136 字节, A
- (+)(文件) UsbCtrl.dll = 2014/12/1 16:22, 137904 字节, A
- (+)(文件) usbmanager.dll = 2014/12/1 16:22, 464488 字节, A
- (+)(文件) vd32.sys = 2014/12/1 16:22, 232296 字节, A
- (+)(文件) vd64.sys = 2014/12/1 16:22, 230856 字节, A
- (+)(文件) vdkey.dll = 2014/12/1 16:22, 206440 字节, A
- (+)(文件) vdkey64.dll = 2014/12/1 16:22, 255080 字节, A
- (+)(文件) volcrypt.dll = 2014/12/1 16:22, 1059432 字节, A
- (+)(文件) volmount.dll = 2014/12/1 16:22, 882792 字节, A
- (+)(文件) volumemgr.dll = 2014/12/26 18:17, 220776 字节, A
- (+)(文件) wpcap.dll = 2014/11/28 9:02, 282360 字节, A
- (+)(文件) xmlpackage.dll = 2014/12/1 16:22, 331344 字节, A
- (+)(文件夹) C:\Windows\SysWOW64\ChinaSoft\cis7\config
- (+)(文件) localdbdesc.xml = 2014/12/1 16:22, 2307 字节, A
- (+)(文件夹) C:\Windows\SysWOW64\ChinaSoft\cis7\crypto
- (+)(文件) appstorage.dll = 2014/12/1 16:22, 188704 字节, A
- (+)(文件) appstorage64.dll = 2014/12/1 16:22, 241440 字节, A
- (+)(文件) CfpShell.exe = 2014/12/1 16:22, 136856 字节, A
- (+)(文件) CfpViewer.exe = 2014/12/1 16:22, 1824360 字节, A
- (+)(文件) CisFilePacker.exe = 2014/12/1 16:22, 357992 字节, A
- (+)(文件) cishook32.dll = 2014/12/1 16:22, 236112 字节, A
- (+)(文件) cishook64.dll = 2014/12/1 16:22, 269392 字节, A
- (+)(文件) cryptocfg.dll = 2014/12/1 16:22, 127592 字节, A
- (+)(文件) Cryptoshell32.dll = 2014/12/1 16:22, 445544 字节, A
- (+)(文件) CryptoShell64.dll = 2014/12/1 16:22, 521832 字节, A
- (+)(文件) decrequest.exe = 2014/12/1 16:22, 332392 字节, A
- (+)(文件) DlpFileUploader.exe = 2014/12/1 16:22, 266856 字节, A
- (+)(文件) EncryptFileAnalyze.exe = 2014/12/1 16:22, 847688 字节, A
- (+)(文件) fileshipRequest.exe = 2015/1/22 8:48, 439912 字节, A
- (+)(文件) mailfilter.dll = 2015/6/27 10:13, 234296 字节, A
- (+)(文件) mailHelper.dll = 2014/12/1 16:22, 155240 字节, A
- (+)(文件) proclimit.dll = 2015/1/22 13:52, 381032 字节, A
- (+)(文件) proclimit64.dll = 2015/1/22 13:52, 382568 字节, A
- (+)(文件) SmtpAddin.dll = 2014/12/1 16:22, 133848 字节, A
- (+)(文件) trigger32.exe = 2015/6/27 10:13, 386872 字节, A
- (+)(文件) trigger64.exe = 2015/6/27 10:13, 218936 字节, A
- (+)(文件) volmanager.exe = 2014/12/1 16:22, 325784 字节, A
- (+)(文件夹) C:\Windows\SysWOW64\ChinaSoft\cis7\data
- (+)(文件夹) C:\Windows\SysWOW64\ChinaSoft\cis7\data\142.190.0.4
- (+)(文件夹) C:\Windows\SysWOW64\config\systemprofile\AppData\Local\GSSoft
- (+)(文件夹) C:\Windows\SysWOW64\config\systemprofile\AppData\Local\GSSoft\HrServ
- (+)(文件夹) C:\Windows\SysWOW64\config\systemprofile\AppData\Local\GSSoft\HrServ\log
- (+)(文件) 20200211173823_HrServ.exe-0.log = 2020/2/11 17:38, 640 字节, A
- (+)(文件) 20200211173827_UniqueMark.dll-0.log = 2020/2/11 17:38, 304 字节, A
- (+)(文件) 20200211173827_volumemgr.dll-0.log = 2020/2/11 17:38, 0 字节, A
- (文件夹) C:\Windows\SysWOW64\drivers
- (+)(文件) cisfm64.sys = 2014/12/1 16:22, 19400 字节, A
- (+)(文件夹) C:\Windows\SysWOW64\hrjdcache
- (+)(文件) FileMD5.xml = 2015/6/27 10:14, 21472 字节, A
- (+)(文件) PRINTINFO.xml = 2014/12/1 16:22, 2059 字节, A
- (+)(文件夹) C:\Windows\SysWOW64\hrjdcache\Bulletin
- (+)(文件夹) C:\Windows\SysWOW64\hrjdcache\hrjdfiles
- (+)(文件) Alert.exe = 2014/12/1 16:22, 236936 字节, A
- (+)(文件) Alert.htm = 2014/12/1 16:22, 7812 字节, A
- (+)(文件) AnalyzeLeakEx.exe = 2014/12/1 16:22, 198736 字节, A
- (+)(文件) AntiSc.dll = 2015/6/27 10:13, 132408 字节, A
- (+)(文件) AntiSc64.dll = 2015/6/27 10:13, 156984 字节, A
- (+)(文件) ArpDefense.dll = 2014/12/1 16:22, 88120 字节, A
- (+)(文件) avconfig.xml = 2015/6/26 14:14, 1760 字节, A
- (+)(文件) BackupFile.dll = 2014/12/1 16:22, 43704 字节, A
- (+)(文件) Bridge.exe = 2014/12/1 16:22, 22160 字节, A
- (+)(文件) Bulletin.dll = 2014/12/1 16:22, 179592 字节, A
- (+)(文件) ChatFile.dll = 2014/12/1 16:22, 118112 字节, A
- (+)(文件) ChatMM.dll = 2015/6/27 10:13, 117616 字节, A
- (+)(文件) CisCfg.dll = 2014/12/1 16:22, 133080 字节, A
- (+)(文件) cisfh.exe = 2014/12/1 16:22, 75416 字节, A
- (+)(文件) cisfm32.inf = 2014/12/1 16:22, 2651 字节, A
- (+)(文件) cisfm32.sys = 2014/12/1 16:22, 20584 字节, A
- (+)(文件) cisfm64.inf = 2014/12/1 16:22, 2651 字节, A
- (+)(文件) cisfm64.sys = 2014/12/1 16:22, 19400 字节, A
- (+)(文件) cisfminst.exe = 2014/12/1 16:22, 60008 字节, A
- (+)(文件) cishook32.dll = 2014/12/1 16:22, 236112 字节, A
- (+)(文件) cishook64.dll = 2014/12/1 16:22, 269392 字节, A
- (+)(文件) cispack.exe = 2014/12/1 16:22, 547072 字节, A
- (+)(文件) clear.bat = 2014/12/1 16:22, 666 字节, A
- (+)(文件) Config.ini = 2015/6/26 14:14, 289 字节, A
- (+)(文件) config.xml = 2015/6/27 10:13, 1553 字节, A
- (+)(文件) Conver.exe = 2014/12/1 16:22, 34888 字节, A
- (+)(文件) Desktop.ini = 2014/12/1 16:22, 108 字节, A
- (+)(文件) devcon32.dll = 2014/12/1 16:22, 84560 字节, A
- (+)(文件) devcon64.dll = 2014/12/1 16:22, 89680 字节, A
- (+)(文件) devctrl.dll = 2014/12/1 16:22, 30136 字节, A
- (+)(文件) DexSendEMail.exe = 2014/12/1 16:22, 243352 字节, A
- (+)(文件) DexSendEMail.ini = 2014/12/1 16:22, 49 字节, A
- (+)(文件) DocSecBase.dll = 2014/12/1 16:22, 241768 字节, A
- (+)(文件) dp.dll = 2015/1/13 8:44, 157288 字节, A
- (+)(文件) dp64.dll = 2015/1/13 8:44, 185448 字节, A
- (+)(文件) ExplorerExt.dll = 2014/12/26 14:46, 133800 字节, A
- (+)(文件) fctrl.dll = 2014/12/1 16:22, 62904 字节, A
- (+)(文件) fctrlr.dll = 2014/12/1 16:22, 62904 字节, A
- (+)(文件) FileMD5.xml = 2015/6/27 10:14, 21472 字节, A
- (+)(文件) FluxMM.dll = 2015/6/27 10:13, 146288 字节, A
- (+)(文件) FoxLib.dll = 2014/12/1 16:22, 109224 字节, A
- (+)(文件) fpublic.dll = 2014/12/1 16:22, 67000 字节, A
- (+)(文件) ftmc.dll = 2014/12/1 16:22, 111208 字节, A
- (+)(文件) fwctl.dll = 2014/12/1 16:22, 16200 字节, A
- (+)(文件) gdassist.dll = 2014/12/1 16:20, 1621096 字节, A
- (+)(文件) gdassist32.exe = 2014/12/1 16:20, 1619560 字节, A
- (+)(文件) gdassist64.exe = 2014/12/1 16:20, 1760872 字节, A
- (+)(文件) gdassistldr.exe = 2014/12/1 16:22, 122984 字节, A
- (+)(文件) gdassistscreen.dll = 2014/12/1 16:22, 97896 字节, A
- (+)(文件) gdassistscreen64.dll = 2014/12/1 16:20, 110696 字节, A
- (+)(文件) gddcl.dll = 2015/6/27 10:13, 649016 字节, A
- (+)(文件) gdfm32.dll = 2014/11/29 10:12, 111208 字节, A
- (+)(文件) gdfm64.dll = 2014/11/29 10:12, 137320 字节, A
- (+)(文件) gdiplus.dll = 2014/12/1 16:22, 1705912 字节, A
- (+)(文件) gdtdi32.sys = 2014/12/1 16:22, 20632 字节, A
- (+)(文件) gdtdi64.sys = 2014/12/1 16:22, 20944 字节, A
- (+)(文件) gdwfp32.sys = 2014/12/1 16:22, 27240 字节, A
- (+)(文件) gdwfp64.sys = 2014/12/1 16:22, 28616 字节, A
- (+)(文件) gloomy.dll = 2014/12/1 16:22, 124560 字节, A
- (+)(文件) GoldShieldBHO.dll = 2014/12/1 16:22, 127304 字节, A
- (+)(文件) gtpclient.dll = 2014/12/1 16:22, 114768 字节, A
- (+)(文件) Hrbc.exe = 2014/12/1 16:22, 85152 字节, A
- (+)(文件) HrDac.exe = 2014/12/1 16:22, 27808 字节, A
- (+)(文件) HrExt.dll = 2014/12/26 14:35, 191592 字节, A
- (+)(文件) HrExt64.dll = 2014/12/26 14:35, 224872 字节, A
- (+)(文件) HrOutlookExt.dll = 2014/12/1 16:22, 95744 字节, A
- (+)(文件) hrunins.exe = 2015/6/27 10:14, 873272 字节, A
- (+)(文件) hrunins.msg = 2014/12/1 16:22, 6991 字节, A
- (+)(文件) hruser.exe = 2015/6/27 10:14, 1870720 字节, A
- (+)(文件) HrUser64.exe = 2015/6/27 10:13, 147256 字节, A
- (+)(文件) HttpMM.dll = 2015/6/27 10:13, 473968 字节, A
- (+)(文件) IllegalLiaison.dll = 2014/12/1 16:22, 173720 字节, A
- (+)(文件) IpLocker.dll = 2014/12/1 16:22, 423504 字节, A
- (+)(文件) LeakEx.xml = 2014/12/1 16:22, 629 字节, A
- (+)(文件) LeakScan.dll = 2014/12/1 16:22, 641928 字节, A
- (+)(文件) libmysql.dll = 2014/12/1 16:22, 1476600 字节, A
- (+)(文件) logo.gif = 2014/12/1 16:22, 5990 字节, A
- (+)(文件) MakeLowSecurity.exe = 2014/12/1 16:22, 42424 字节, A
- (+)(文件) MSNMsg.dll = 2014/12/1 16:22, 91464 字节, A
- (+)(文件) msvcp60.dll = 2014/12/1 16:22, 413696 字节, A
- (+)(文件) NetMon2.dll = 2014/12/1 16:22, 289448 字节, A
- (+)(文件) NetNail.exe = 2014/12/1 16:22, 236200 字节, A
- (+)(文件) Node.xml = 2014/12/1 16:22, 28284 字节, A
- (+)(文件) npptools.dll = 2014/12/1 16:22, 59832 字节, A
- (+)(文件) office.dat = 2014/12/1 16:22, 439605 字节, A
- (+)(文件) office64.dat = 2014/12/1 16:22, 185533 字节, A
- (+)(文件) OptMark.dll = 2014/12/1 16:22, 64192 字节, A
- (+)(文件) PatchMark.dll = 2014/12/1 16:22, 220504 字节, A
- (+)(文件) PRINTINFO.XML = 2014/12/1 16:22, 2059 字节, A
- (+)(文件) Prints.dll = 2014/12/1 16:22, 186000 字节, A
- (+)(文件) ProcessMon2.dll = 2015/6/27 10:13, 838528 字节, A
- (+)(文件) PsConfig.xml = 2014/12/1 16:22, 214 字节, A
- (+)(文件) PsSysConfig.xml = 2014/12/1 16:22, 3802 字节, A
- (+)(文件) reffinsLru.dll = 2015/6/27 10:13, 582968 字节, A
- (+)(文件) safe.htm = 2014/12/1 16:22, 1236 字节, A
- (+)(文件) scrReco.dll = 2014/12/1 16:22, 156776 字节, A
- (+)(文件) SmtpSet.ini = 2014/12/1 16:22, 0 字节, A
- (+)(文件) soft.dat = 2014/12/1 16:22, 171 字节, A
- (+)(文件) StatuMark.exe = 2015/6/27 10:13, 539448 字节, A
- (+)(文件) StatuMarkConfig.xml = 2014/12/25 8:58, 10924 字节, A
- (+)(文件) SubmitInfo.dll = 2014/12/1 16:22, 297640 字节, A
- (+)(文件) subtms.dll = 2015/6/27 10:13, 90936 字节, A
- (+)(文件) syscfg.dll = 2014/12/1 16:22, 63424 字节, A
- (+)(文件) system.dat = 2014/12/1 16:22, 2009056 字节, A
- (+)(文件) system64.dat = 2014/12/1 16:22, 1064067 字节, A
- (+)(文件) UKVerify.dll = 2014/12/1 16:22, 107088 字节, A
- (+)(文件) UKVerify64.dll = 2014/12/1 16:22, 117840 字节, A
- (+)(文件) UniqueMark.dll = 2014/12/1 16:22, 107624 字节, A
- (+)(文件) updatehelp.exe = 2014/12/1 16:22, 30136 字节, A
- (+)(文件) UsbCtrl.dll = 2014/12/1 16:22, 137904 字节, A
- (+)(文件) usbmanager.dll = 2014/12/1 16:22, 464488 字节, A
- (+)(文件) vd32.sys = 2014/12/1 16:22, 232296 字节, A
- (+)(文件) vd64.sys = 2014/12/1 16:22, 230856 字节, A
- (+)(文件) vdkey.dll = 2014/12/1 16:22, 206440 字节, A
- (+)(文件) vdkey64.dll = 2014/12/1 16:22, 255080 字节, A
- (+)(文件) volcrypt.dll = 2014/12/1 16:22, 1059432 字节, A
- (+)(文件) volmount.dll = 2014/12/1 16:22, 882792 字节, A
- (+)(文件) volumemgr.dll = 2014/12/26 18:17, 220776 字节, A
- (+)(文件) xmlpackage.dll = 2014/12/1 16:22, 331344 字节, A
- (+)(文件夹) C:\Windows\SysWOW64\hrjdcache\hrjdfiles\config
- (+)(文件) localdbdesc.xml = 2014/12/1 16:22, 2307 字节, A
- (+)(文件夹) C:\Windows\SysWOW64\hrjdcache\hrjdfiles\crypto
- (+)(文件) appstorage.dll = 2014/12/1 16:22, 188704 字节, A
- (+)(文件) appstorage64.dll = 2014/12/1 16:22, 241440 字节, A
- (+)(文件) CfpShell.exe = 2014/12/1 16:22, 136856 字节, A
- (+)(文件) CfpViewer.exe = 2014/12/1 16:22, 1824360 字节, A
- (+)(文件) CisFilePacker.exe = 2014/12/1 16:22, 357992 字节, A
- (+)(文件) cishook32.dll = 2014/12/1 16:22, 236112 字节, A
- (+)(文件) cishook64.dll = 2014/12/1 16:22, 269392 字节, A
- (+)(文件) cryptocfg.dll = 2014/12/1 16:22, 127592 字节, A
- (+)(文件) CryptoShell32.dll = 2014/12/1 16:22, 445544 字节, A
- (+)(文件) CryptoShell64.dll = 2014/12/1 16:22, 521832 字节, A
- (+)(文件) decrequest.exe = 2014/12/1 16:22, 332392 字节, A
- (+)(文件) DlpFileUploader.exe = 2014/12/1 16:22, 266856 字节, A
- (+)(文件) EncryptFileAnalyze.exe = 2014/12/1 16:22, 847688 字节, A
- (+)(文件) fileshipRequest.exe = 2015/1/22 8:48, 439912 字节, A
- (+)(文件) mailfilter.dll = 2015/6/27 10:13, 234296 字节, A
- (+)(文件) mailHelper.dll = 2014/12/1 16:22, 155240 字节, A
- (+)(文件) proclimit.dll = 2015/1/22 13:52, 381032 字节, A
- (+)(文件) proclimit64.dll = 2015/1/22 13:52, 382568 字节, A
- (+)(文件) SmtpAddin.dll = 2014/12/1 16:22, 133848 字节, A
- (+)(文件) trigger32.exe = 2015/6/27 10:13, 386872 字节, A
- (+)(文件) trigger64.exe = 2015/6/27 10:13, 218936 字节, A
- (+)(文件) volmanager.exe = 2014/12/1 16:22, 325784 字节, A
- (+)(文件夹) C:\Windows\SysWOW64\hrjdcache\IconBase
- (+)(文件) default.ico = 2020/2/11 17:38, 766 字节, A
- (+)(文件夹) C:\Windows\SysWOW64\hrjdcache\Mail
- (+)(文件夹) C:\Windows\SysWOW64\hrjdcache\ndis
- (+)(文件) FltEng.sys = 2014/11/28 9:03, 14280 字节, A
- (+)(文件) FltEng00.dll = 2014/11/28 9:03, 72520 字节, A
- (+)(文件) FltEng51.dll = 2014/11/28 9:03, 51016 字节, A
- (+)(文件) FltEng60.dll = 2014/11/28 9:03, 57160 字节, A
- (+)(文件) HrServ.exe = 2015/1/20 9:03, 785064 字节, A
- (+)(文件夹) C:\Windows\SysWOW64\hrjdcache\Offline
- (+)(文件夹) C:\Windows\SysWOW64\hrjdcache\winpcap
- (+)(文件) InsPcap.exe = 2014/11/28 9:02, 50848 字节, A
- (+)(文件) npf.sys = 2014/11/28 9:02, 36600 字节, A
- (+)(文件) npf64.sys = 2014/11/28 9:02, 36600 字节, A
- (+)(文件) Packet.dll = 2014/11/28 9:02, 98040 字节, A
- (+)(文件) wpcap.dll = 2014/11/28 9:02, 282360 字节, A
- (+)(文件夹) C:\Windows\SysWOW64\tmp
- (+)(文件) Desktop.ini = 2014/12/1 16:22, 108 字节, A
- 注册表详细信息 [查看: 全部详细信息] (全部)
- -------------------------
- (+)(注册表项) HKEY_LOCAL_MACHINE\SOFTWARE\Classes\*\shellex\ContextMenuHandlers\CryptoShell
- (+)(注册表值) (默认) = REG_SZ, "{5232B85A-0A72-4F02-BC8C-35834403D37C}"
- (+)(注册表项) HKEY_LOCAL_MACHINE\SOFTWARE\Classes\*\shellex\ContextMenuHandlers\ExpExt
- (+)(注册表值) (默认) = REG_SZ, "{2C60B4D9-E530-4BA0-8BDE-82E2A286DDE4}"
- (+)(注册表项) HKEY_LOCAL_MACHINE\SOFTWARE\Classes\*\shellex\ContextMenuHandlers\HrContextMenu
- (+)(注册表值) (默认) = REG_SZ, "{33D55355-C20C-455E-9EF2-B8B8C858E472}"
- (+)(注册表项) HKEY_LOCAL_MACHINE\SOFTWARE\Classes\*\shellex\PropertySheetHandlers\CryptoShell
- (+)(注册表值) (默认) = REG_SZ, "{5232B85A-0A72-4F02-BC8C-35834403D37C}"
- (+)(注册表项) HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.backup
- (+)(注册表值) (默认) = REG_SZ, "backupfile"
- (+)(注册表项) HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\{5961388F-B729-4633-908C-7E7172B3E681}
- (+)(注册表值) (默认) = REG_SZ, "PropertyDemo"
- (+)(注册表项) HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\{7C70FD12-5967-41B8-ABB3-14FB9F0CA1BE}
- (+)(注册表值) (默认) = REG_SZ, "GoldShieldBHO"
- (+)(注册表项) HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\GoldShieldBHO.DLL
- (+)(注册表值) AppID = REG_SZ, "{7C70FD12-5967-41B8-ABB3-14FB9F0CA1BE}"
- (+)(注册表项) HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\PropertyDemo.DLL
- (+)(注册表值) AppID = REG_SZ, "{5961388F-B729-4633-908C-7E7172B3E681}"
- (+)(注册表项) HKEY_LOCAL_MACHINE\SOFTWARE\Classes\backupfile
- (+)(注册表值) (默认) = REG_SZ, "金盾备份文件"
- (+)(注册表项) HKEY_LOCAL_MACHINE\SOFTWARE\Classes\backupfile\DefaultIcon
- (+)(注册表值) (默认) = REG_SZ, "C:\Windows\SysWOW64\ChinaSoft\cis7\conver.exe, 0"
- (+)(注册表项) HKEY_LOCAL_MACHINE\SOFTWARE\Classes\backupfile\shell
- (+)(注册表项) HKEY_LOCAL_MACHINE\SOFTWARE\Classes\backupfile\shell\conver
- (+)(注册表值) (默认) = REG_SZ, "还原(&R)"
- (+)(注册表项) HKEY_LOCAL_MACHINE\SOFTWARE\Classes\backupfile\shell\conver\command
- (+)(注册表值) (默认) = REG_SZ, ""C:\Windows\SysWOW64\ChinaSoft\cis7\conver.exe" -c "%1""
- (+)(注册表项) HKEY_LOCAL_MACHINE\SOFTWARE\Classes\backupfile\shell\open
- (+)(注册表项) HKEY_LOCAL_MACHINE\SOFTWARE\Classes\backupfile\shell\open\command
- (+)(注册表值) (默认) = REG_SZ, ""C:\Windows\SysWOW64\ChinaSoft\cis7\conver.exe" -o "%1""
- (+)(注册表项) HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{33D55355-C20C-455E-9EF2-B8B8C858E472}
- (+)(注册表值) (默认) = REG_SZ, "HrContextMenu Class"
- (+)(注册表项) HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{33D55355-C20C-455E-9EF2-B8B8C858E472}\InprocServer32
- (+)(注册表值) (默认) = REG_SZ, "C:\Windows\SysWOW64\ChinaSoft\cis7\HrExt64.dll"
- (+)(注册表值) ThreadingModel = REG_SZ, "Apartment"
- (+)(注册表项) HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{5232B85A-0A72-4F02-BC8C-35834403D37C}
- (+)(注册表值) (默认) = REG_SZ, "CryptoShell Class"
- (+)(注册表项) HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{5232B85A-0A72-4F02-BC8C-35834403D37C}\InprocServer32
- (+)(注册表值) (默认) = REG_SZ, "C:\Windows\SysWOW64\ChinaSoft\cis7\crypto\cryptoshell64.dll"
- (+)(注册表值) ThreadingModel = REG_SZ, "Apartment"
- (+)(注册表项) HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{BDC992EF-1A3D-43EB-8EE4-25EC554D34AC}
- (+)(注册表值) (默认) = REG_SZ, "OverlayIcon Class"
- (+)(注册表项) HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{BDC992EF-1A3D-43EB-8EE4-25EC554D34AC}\InprocServer32
- (+)(注册表值) (默认) = REG_SZ, "C:\Windows\SysWOW64\ChinaSoft\cis7\crypto\cryptoshell64.dll"
- (+)(注册表值) ThreadingModel = REG_SZ, "Apartment"
- (+)(注册表项) HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{BDC992EF-1A3D-43EB-8EE4-25EC554D34AD}
- (+)(注册表值) (默认) = REG_SZ, "OverlayIcon Class"
- (+)(注册表项) HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{BDC992EF-1A3D-43EB-8EE4-25EC554D34AD}\InprocServer32
- (+)(注册表值) (默认) = REG_SZ, "C:\Windows\SysWOW64\ChinaSoft\cis7\crypto\cryptoshell64.dll"
- (+)(注册表值) ThreadingModel = REG_SZ, "Apartment"
- (+)(注册表项) HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Directory\Background\shellex\ContextMenuHandlers\ExpExt
- (+)(注册表值) (默认) = REG_SZ, "{2C60B4D9-E530-4BA0-8BDE-82E2A286DDE4}"
- (+)(注册表项) HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Directory\Background\shellex\ContextMenuHandlers\HrContextMenu
- (+)(注册表值) (默认) = REG_SZ, "{33D55355-C20C-455E-9EF2-B8B8C858E472}"
- (+)(注册表项) HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Directory\shellex\ContextMenuHandlers\ExpExt
- (+)(注册表值) (默认) = REG_SZ, "{2C60B4D9-E530-4BA0-8BDE-82E2A286DDE4}"
- (+)(注册表项) HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Directory\shellex\ContextMenuHandlers\HrContextMenu
- (+)(注册表值) (默认) = REG_SZ, "{33D55355-C20C-455E-9EF2-B8B8C858E472}"
- (+)(注册表项) HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Drive\shellex\ContextMenuHandlers\ExpExt
- (+)(注册表值) (默认) = REG_SZ, "{2C60B4D9-E530-4BA0-8BDE-82E2A286DDE4}"
- (+)(注册表项) HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Drive\shellex\ContextMenuHandlers\HrContextMenu
- (+)(注册表值) (默认) = REG_SZ, "{33D55355-C20C-455E-9EF2-B8B8C858E472}"
- (+)(注册表项) HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Folder\ShellEx\PropertySheetHandlers\CryptoShell
- (+)(注册表值) (默认) = REG_SZ, "{5232B85A-0A72-4F02-BC8C-35834403D37C}"
- (+)(注册表项) HKEY_LOCAL_MACHINE\SOFTWARE\Classes\GoldShieldBHO.GSBHO
- (+)(注册表值) (默认) = REG_SZ, "GSBHO Class"
- (+)(注册表项) HKEY_LOCAL_MACHINE\SOFTWARE\Classes\GoldShieldBHO.GSBHO\CLSID
- (+)(注册表值) (默认) = REG_SZ, "{FE9D7AFD-731C-46BD-BF78-220AD77C88BD}"
- (+)(注册表项) HKEY_LOCAL_MACHINE\SOFTWARE\Classes\GoldShieldBHO.GSBHO\CurVer
- (+)(注册表值) (默认) = REG_SZ, "GoldShieldBHO.GSBHO.1"
- (+)(注册表项) HKEY_LOCAL_MACHINE\SOFTWARE\Classes\GoldShieldBHO.GSBHO.1
- (+)(注册表值) (默认) = REG_SZ, "GSBHO Class"
- (+)(注册表项) HKEY_LOCAL_MACHINE\SOFTWARE\Classes\GoldShieldBHO.GSBHO.1\CLSID
- (+)(注册表值) (默认) = REG_SZ, "{FE9D7AFD-731C-46BD-BF78-220AD77C88BD}"
- (+)(注册表项) HKEY_LOCAL_MACHINE\SOFTWARE\Classes\GoldShieldBHO.GSDownloader
- (+)(注册表值) (默认) = REG_SZ, "GSDownloader Class"
- (+)(注册表项) HKEY_LOCAL_MACHINE\SOFTWARE\Classes\GoldShieldBHO.GSDownloader\CLSID
- (+)(注册表值) (默认) = REG_SZ, "{31E1A66E-638C-4F8F-A891-D9A9D09A7F55}"
- (+)(注册表项) HKEY_LOCAL_MACHINE\SOFTWARE\Classes\GoldShieldBHO.GSDownloader\CurVer
- (+)(注册表值) (默认) = REG_SZ, "GoldShieldBHO.GSDownloader.1"
- (+)(注册表项) HKEY_LOCAL_MACHINE\SOFTWARE\Classes\GoldShieldBHO.GSDownloader.1
- (+)(注册表值) (默认) = REG_SZ, "GSDownloader Class"
- (+)(注册表项) HKEY_LOCAL_MACHINE\SOFTWARE\Classes\GoldShieldBHO.GSDownloader.1\CLSID
- (+)(注册表值) (默认) = REG_SZ, "{31E1A66E-638C-4F8F-A891-D9A9D09A7F55}"
- (+)(注册表项) HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{5F731851-0351-4DE2-97A2-1FDEA9E53879}
- (+)(注册表值) (默认) = REG_SZ, "IGSDownloader"
- (+)(注册表项) HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{5F731851-0351-4DE2-97A2-1FDEA9E53879}\ProxyStubClsid32
- (+)(注册表值) (默认) = REG_SZ, "{00020424-0000-0000-C000-000000000046}"
- (+)(注册表项) HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{5F731851-0351-4DE2-97A2-1FDEA9E53879}\TypeLib
- (+)(注册表值) (默认) = REG_SZ, "{558E22E4-E135-4592-AA94-A07F03C63D65}"
- (+)(注册表值) Version = REG_SZ, "1.0"
- (+)(注册表项) HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{61A8621C-CEF4-4498-8C71-4D6D394FA79B}
- (+)(注册表值) (默认) = REG_SZ, "IGSBHO"
- (+)(注册表项) HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{61A8621C-CEF4-4498-8C71-4D6D394FA79B}\ProxyStubClsid32
- (+)(注册表值) (默认) = REG_SZ, "{00020424-0000-0000-C000-000000000046}"
- (+)(注册表项) HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{61A8621C-CEF4-4498-8C71-4D6D394FA79B}\TypeLib
- (+)(注册表值) (默认) = REG_SZ, "{558E22E4-E135-4592-AA94-A07F03C63D65}"
- (+)(注册表值) Version = REG_SZ, "1.0"
- (+)(注册表项) HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{7CD136D6-C382-4188-8D49-6803E7A45844}
- (+)(注册表值) (默认) = REG_SZ, "IHrContextMenu"
- (+)(注册表项) HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{7CD136D6-C382-4188-8D49-6803E7A45844}\ProxyStubClsid32
- (+)(注册表值) (默认) = REG_SZ, "{00020424-0000-0000-C000-000000000046}"
- (+)(注册表项) HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{7CD136D6-C382-4188-8D49-6803E7A45844}\TypeLib
- (+)(注册表值) (默认) = REG_SZ, "{F4239AEE-2D0F-4FCE-8A18-BA01B9266296}"
- (+)(注册表值) Version = REG_SZ, "1.0"
- (+)(注册表项) HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{8739A505-78ED-4271-B456-87B684AB3D76}
- (+)(注册表值) (默认) = REG_SZ, "IOverlayIconCanDec"
- (+)(注册表项) HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{8739A505-78ED-4271-B456-87B684AB3D76}\ProxyStubClsid32
- (+)(注册表值) (默认) = REG_SZ, "{00020424-0000-0000-C000-000000000046}"
- (+)(注册表项) HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{8739A505-78ED-4271-B456-87B684AB3D76}\TypeLib
- (+)(注册表值) (默认) = REG_SZ, "{347FBE49-9210-43FE-815F-C1B3049CD2FE}"
- (+)(注册表值) Version = REG_SZ, "1.0"
- (+)(注册表项) HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{8739A505-78ED-4271-B456-87B684AB3D77}
- (+)(注册表值) (默认) = REG_SZ, "IOverlayIconCanNotDec"
- (+)(注册表项) HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{8739A505-78ED-4271-B456-87B684AB3D77}\ProxyStubClsid32
- (+)(注册表值) (默认) = REG_SZ, "{00020424-0000-0000-C000-000000000046}"
- (+)(注册表项) HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{8739A505-78ED-4271-B456-87B684AB3D77}\TypeLib
- (+)(注册表值) (默认) = REG_SZ, "{347FBE49-9210-43FE-815F-C1B3049CD2FE}"
- (+)(注册表值) Version = REG_SZ, "1.0"
- (+)(注册表项) HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{E1BD0FDF-FCC1-4723-8C05-5A6E0267A4A0}
- (+)(注册表值) (默认) = REG_SZ, "IShellExt"
- (+)(注册表项) HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{E1BD0FDF-FCC1-4723-8C05-5A6E0267A4A0}\ProxyStubClsid32
- (+)(注册表值) (默认) = REG_SZ, "{00020424-0000-0000-C000-000000000046}"
- (+)(注册表项) HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{E1BD0FDF-FCC1-4723-8C05-5A6E0267A4A0}\TypeLib
- (+)(注册表值) (默认) = REG_SZ, "{347FBE49-9210-43FE-815F-C1B3049CD2FE}"
- (+)(注册表值) Version = REG_SZ, "1.0"
- (+)(注册表项) HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{347FBE49-9210-43FE-815F-C1B3049CD2FE}
- (+)(注册表项) HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{347FBE49-9210-43FE-815F-C1B3049CD2FE}\1.0
- (+)(注册表值) (默认) = REG_SZ, "CryptoShell 1.0 类型库"
- (+)(注册表项) HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{347FBE49-9210-43FE-815F-C1B3049CD2FE}\1.0\0
- (+)(注册表项) HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{347FBE49-9210-43FE-815F-C1B3049CD2FE}\1.0\0\win32
- (+)(注册表值) (默认) = REG_SZ, "C:\Windows\SysWOW64\ChinaSoft\cis7\crypto\cryptoshell32.dll"
- (+)(注册表项) HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{347FBE49-9210-43FE-815F-C1B3049CD2FE}\1.0\0\win64
- (+)(注册表值) (默认) = REG_SZ, "C:\Windows\SysWOW64\ChinaSoft\cis7\crypto\cryptoshell64.dll"
- (+)(注册表项) HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{347FBE49-9210-43FE-815F-C1B3049CD2FE}\1.0\FLAGS
- (+)(注册表值) (默认) = REG_SZ, "0"
- (+)(注册表项) HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{347FBE49-9210-43FE-815F-C1B3049CD2FE}\1.0\HELPDIR
- (+)(注册表值) (默认) = REG_SZ, "C:\Windows\SysWOW64\ChinaSoft\cis7\crypto"
- (+)(注册表项) HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{558E22E4-E135-4592-AA94-A07F03C63D65}
- (+)(注册表项) HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{558E22E4-E135-4592-AA94-A07F03C63D65}\1.0
- (+)(注册表值) (默认) = REG_SZ, "GoldShieldBHO 1.0 类型库"
- (+)(注册表项) HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{558E22E4-E135-4592-AA94-A07F03C63D65}\1.0\0
- (+)(注册表项) HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{558E22E4-E135-4592-AA94-A07F03C63D65}\1.0\0\win32
- (+)(注册表值) (默认) = REG_SZ, "C:\Windows\SysWOW64\ChinaSoft\cis7\GoldShieldBHO.dll"
- (+)(注册表项) HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{558E22E4-E135-4592-AA94-A07F03C63D65}\1.0\FLAGS
- (+)(注册表值) (默认) = REG_SZ, "0"
- (+)(注册表项) HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{558E22E4-E135-4592-AA94-A07F03C63D65}\1.0\HELPDIR
- (+)(注册表值) (默认) = REG_SZ, "C:\Windows\SysWOW64\ChinaSoft\cis7"
- (+)(注册表项) HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{F4239AEE-2D0F-4FCE-8A18-BA01B9266296}
- (+)(注册表项) HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{F4239AEE-2D0F-4FCE-8A18-BA01B9266296}\1.0
- (+)(注册表值) (默认) = REG_SZ, "HrExt 1.0 类型库"
- (+)(注册表项) HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{F4239AEE-2D0F-4FCE-8A18-BA01B9266296}\1.0\0
- (+)(注册表项) HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{F4239AEE-2D0F-4FCE-8A18-BA01B9266296}\1.0\0\win32
- (+)(注册表值) (默认) = REG_SZ, "C:\Windows\SysWOW64\ChinaSoft\cis7\HrExt.dll"
- (+)(注册表项) HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{F4239AEE-2D0F-4FCE-8A18-BA01B9266296}\1.0\0\win64
- (+)(注册表值) (默认) = REG_SZ, "C:\Windows\SysWOW64\ChinaSoft\cis7\HrExt64.dll"
- (+)(注册表项) HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{F4239AEE-2D0F-4FCE-8A18-BA01B9266296}\1.0\FLAGS
- (+)(注册表值) (默认) = REG_SZ, "0"
- (+)(注册表项) HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{F4239AEE-2D0F-4FCE-8A18-BA01B9266296}\1.0\HELPDIR
- (+)(注册表值) (默认) = REG_SZ, "C:\Windows\SysWOW64\ChinaSoft\cis7"
- (+)(注册表项) HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{2C60B4D9-E530-4BA0-8BDE-82E2A286DDE4}
- (+)(注册表值) (默认) = REG_SZ, "ExpExt Class"
- (+)(注册表项) HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{2C60B4D9-E530-4BA0-8BDE-82E2A286DDE4}\InprocServer32
- (+)(注册表值) (默认) = REG_SZ, "C:\Windows\SysWow64\ChinaSoft\cis7\ExplorerExt.dll"
- (+)(注册表值) ThreadingModel = REG_SZ, "Apartment"
- (+)(注册表项) HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{2C60B4D9-E530-4BA0-8BDE-82E2A286DDE4}\Programmable
- (+)(注册表项) HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{2C60B4D9-E530-4BA0-8BDE-82E2A286DDE4}\ShellEx
- (+)(注册表项) HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{2C60B4D9-E530-4BA0-8BDE-82E2A286DDE4}\ShellEx\MayChangeDefaultMenu
- (+)(注册表值) (默认) = REG_SZ, ""
- (+)(注册表项) HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{31E1A66E-638C-4F8F-A891-D9A9D09A7F55}
- (+)(注册表值) (默认) = REG_SZ, "GSDownloader Class"
- (+)(注册表项) HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{31E1A66E-638C-4F8F-A891-D9A9D09A7F55}\InprocServer32
- (+)(注册表值) (默认) = REG_SZ, "C:\Windows\SysWOW64\ChinaSoft\cis7\GoldShieldBHO.dll"
- (+)(注册表值) ThreadingModel = REG_SZ, "Apartment"
- (+)(注册表项) HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{31E1A66E-638C-4F8F-A891-D9A9D09A7F55}\ProgID
- (+)(注册表值) (默认) = REG_SZ, "GoldShieldBHO.GSDownloader.1"
- (+)(注册表项) HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{31E1A66E-638C-4F8F-A891-D9A9D09A7F55}\Programmable
- (+)(注册表项) HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{31E1A66E-638C-4F8F-A891-D9A9D09A7F55}\TypeLib
- (+)(注册表值) (默认) = REG_SZ, "{558E22E4-E135-4592-AA94-A07F03C63D65}"
- (+)(注册表项) HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{31E1A66E-638C-4F8F-A891-D9A9D09A7F55}\VersionIndependentProgID
- (+)(注册表值) (默认) = REG_SZ, "GoldShieldBHO.GSDownloader"
- (+)(注册表项) HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{33D55355-C20C-455E-9EF2-B8B8C858E472}
- (+)(注册表值) (默认) = REG_SZ, "HrContextMenu Class"
- (+)(注册表项) HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{33D55355-C20C-455E-9EF2-B8B8C858E472}\InprocServer32
- (+)(注册表值) (默认) = REG_SZ, "C:\Windows\SysWOW64\ChinaSoft\cis7\HrExt.dll"
- (+)(注册表值) ThreadingModel = REG_SZ, "Apartment"
- (+)(注册表项) HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{5232B85A-0A72-4F02-BC8C-35834403D37C}
- (+)(注册表值) (默认) = REG_SZ, "CryptoShell Class"
- (+)(注册表项) HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{5232B85A-0A72-4F02-BC8C-35834403D37C}\InprocServer32
- (+)(注册表值) (默认) = REG_SZ, "C:\Windows\SysWOW64\ChinaSoft\cis7\crypto\cryptoshell32.dll"
- (+)(注册表值) ThreadingModel = REG_SZ, "Apartment"
- (+)(注册表项) HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{BDC992EF-1A3D-43EB-8EE4-25EC554D34AC}
- (+)(注册表值) (默认) = REG_SZ, "OverlayIcon Class"
- (+)(注册表项) HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{BDC992EF-1A3D-43EB-8EE4-25EC554D34AC}\InprocServer32
- (+)(注册表值) (默认) = REG_SZ, "C:\Windows\SysWOW64\ChinaSoft\cis7\crypto\cryptoshell32.dll"
- (+)(注册表值) ThreadingModel = REG_SZ, "Apartment"
- (+)(注册表项) HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{BDC992EF-1A3D-43EB-8EE4-25EC554D34AD}
- (+)(注册表值) (默认) = REG_SZ, "OverlayIcon Class"
- (+)(注册表项) HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{BDC992EF-1A3D-43EB-8EE4-25EC554D34AD}\InprocServer32
- (+)(注册表值) (默认) = REG_SZ, "C:\Windows\SysWOW64\ChinaSoft\cis7\crypto\cryptoshell32.dll"
- (+)(注册表值) ThreadingModel = REG_SZ, "Apartment"
- (+)(注册表项) HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{FE9D7AFD-731C-46BD-BF78-220AD77C88BD}
- (+)(注册表值) (默认) = REG_SZ, "GSBHO Class"
- (+)(注册表项) HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{FE9D7AFD-731C-46BD-BF78-220AD77C88BD}\InprocServer32
- (+)(注册表值) (默认) = REG_SZ, "C:\Windows\SysWOW64\ChinaSoft\cis7\GoldShieldBHO.dll"
- (+)(注册表值) ThreadingModel = REG_SZ, "Apartment"
- (+)(注册表项) HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{FE9D7AFD-731C-46BD-BF78-220AD77C88BD}\ProgID
- (+)(注册表值) (默认) = REG_SZ, "GoldShieldBHO.GSBHO.1"
- (+)(注册表项) HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{FE9D7AFD-731C-46BD-BF78-220AD77C88BD}\Programmable
- (+)(注册表项) HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{FE9D7AFD-731C-46BD-BF78-220AD77C88BD}\TypeLib
- (+)(注册表值) (默认) = REG_SZ, "{558E22E4-E135-4592-AA94-A07F03C63D65}"
- (+)(注册表项) HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{FE9D7AFD-731C-46BD-BF78-220AD77C88BD}\VersionIndependentProgID
- (+)(注册表值) (默认) = REG_SZ, "GoldShieldBHO.GSBHO"
- (+)(注册表项) HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{5F731851-0351-4DE2-97A2-1FDEA9E53879}
- (+)(注册表值) (默认) = REG_SZ, "IGSDownloader"
- (+)(注册表项) HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{5F731851-0351-4DE2-97A2-1FDEA9E53879}\ProxyStubClsid32
- (+)(注册表值) (默认) = REG_SZ, "{00020424-0000-0000-C000-000000000046}"
- (+)(注册表项) HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{5F731851-0351-4DE2-97A2-1FDEA9E53879}\TypeLib
- (+)(注册表值) (默认) = REG_SZ, "{558E22E4-E135-4592-AA94-A07F03C63D65}"
- (+)(注册表值) Version = REG_SZ, "1.0"
- (+)(注册表项) HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{61A8621C-CEF4-4498-8C71-4D6D394FA79B}
- (+)(注册表值) (默认) = REG_SZ, "IGSBHO"
- (+)(注册表项) HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{61A8621C-CEF4-4498-8C71-4D6D394FA79B}\ProxyStubClsid32
- (+)(注册表值) (默认) = REG_SZ, "{00020424-0000-0000-C000-000000000046}"
- (+)(注册表项) HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{61A8621C-CEF4-4498-8C71-4D6D394FA79B}\TypeLib
- (+)(注册表值) (默认) = REG_SZ, "{558E22E4-E135-4592-AA94-A07F03C63D65}"
- (+)(注册表值) Version = REG_SZ, "1.0"
- (+)(注册表项) HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{7CD136D6-C382-4188-8D49-6803E7A45844}
- (+)(注册表值) (默认) = REG_SZ, "IHrContextMenu"
- (+)(注册表项) HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{7CD136D6-C382-4188-8D49-6803E7A45844}\ProxyStubClsid32
- (+)(注册表值) (默认) = REG_SZ, "{00020424-0000-0000-C000-000000000046}"
- (+)(注册表项) HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{7CD136D6-C382-4188-8D49-6803E7A45844}\TypeLib
- (+)(注册表值) (默认) = REG_SZ, "{F4239AEE-2D0F-4FCE-8A18-BA01B9266296}"
- (+)(注册表值) Version = REG_SZ, "1.0"
- (+)(注册表项) HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{8739A505-78ED-4271-B456-87B684AB3D76}
- (+)(注册表值) (默认) = REG_SZ, "IOverlayIconCanDec"
- (+)(注册表项) HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{8739A505-78ED-4271-B456-87B684AB3D76}\ProxyStubClsid32
- (+)(注册表值) (默认) = REG_SZ, "{00020424-0000-0000-C000-000000000046}"
- (+)(注册表项) HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{8739A505-78ED-4271-B456-87B684AB3D76}\TypeLib
- (+)(注册表值) (默认) = REG_SZ, "{347FBE49-9210-43FE-815F-C1B3049CD2FE}"
- (+)(注册表值) Version = REG_SZ, "1.0"
- (+)(注册表项) HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{8739A505-78ED-4271-B456-87B684AB3D77}
- (+)(注册表值) (默认) = REG_SZ, "IOverlayIconCanNotDec"
- (+)(注册表项) HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{8739A505-78ED-4271-B456-87B684AB3D77}\ProxyStubClsid32
- (+)(注册表值) (默认) = REG_SZ, "{00020424-0000-0000-C000-000000000046}"
- (+)(注册表项) HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{8739A505-78ED-4271-B456-87B684AB3D77}\TypeLib
- (+)(注册表值) (默认) = REG_SZ, "{347FBE49-9210-43FE-815F-C1B3049CD2FE}"
- (+)(注册表值) Version = REG_SZ, "1.0"
- (+)(注册表项) HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E1BD0FDF-FCC1-4723-8C05-5A6E0267A4A0}
- (+)(注册表值) (默认) = REG_SZ, "IShellExt"
- (+)(注册表项) HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E1BD0FDF-FCC1-4723-8C05-5A6E0267A4A0}\ProxyStubClsid32
- (+)(注册表值) (默认) = REG_SZ, "{00020424-0000-0000-C000-000000000046}"
- (+)(注册表项) HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E1BD0FDF-FCC1-4723-8C05-5A6E0267A4A0}\TypeLib
- (+)(注册表值) (默认) = REG_SZ, "{347FBE49-9210-43FE-815F-C1B3049CD2FE}"
- (+)(注册表值) Version = REG_SZ, "1.0"
- (+)(注册表项) HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\CTF\DisplayAttributeCache
- (+)(注册表值) (默认) = REG_BINARY, ................../...................!.
- (+)(注册表值) CheckNum = REG_DWORD, 0x00000002 (2)
- (注册表项) HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SQMClient\Windows
- (*)(注册表值) WSqmConsLastRunTime
- REG_QWORD, 0x1d5e007cf7ce780 (132258088227760000) ==> REG_QWORD, 0x1d5e0bf19f09430 (132258875455870000)
- (+)(注册表项) HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\E12DFB4B41D7D9C32B30514BAC1D81D8385E2D46
- (+)(注册表值) Blob = REG_BINARY, .....................................................................usertrust............................................. .........................................................................................................................................................................................................................1................................................................................................................................................................................................................................................................................................................................................................
- (+)(注册表项) HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellIconOverlayIdentifiers\.FstEncCanDec
- (+)(注册表值) (默认) = REG_SZ, "{BDC992EF-1A3D-43EB-8EE4-25EC554D34AC}"
- (+)(注册表项) HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellIconOverlayIdentifiers\.FstEncCanNotDec
- (+)(注册表值) (默认) = REG_SZ, "{BDC992EF-1A3D-43EB-8EE4-25EC554D34AD}"
- (+)(注册表项) HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellIconOverlayIdentifiers\HrExt
- (+)(注册表值) (默认) = REG_SZ, "{33D55355-C20C-455E-9EF2-B8B8C858E472}"
- (+)(注册表项) HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run
- (+)(注册表值) HRJD = REG_SZ, "C:\Windows\SysWOW64\cisfh.exe"
- (注册表项) HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System
- (*)(注册表值) EnableLUA
- REG_DWORD, 0x00000001 (1) ==> REG_DWORD, 0x00000000 (0)
- (*)(注册表值) PromptOnSecureDesktop
- REG_DWORD, 0x00000001 (1) ==> REG_DWORD, 0x00000000 (0)
- (+)(注册表项) HKEY_LOCAL_MACHINE\SOFTWARE\TightVNC
- (+)(注册表项) HKEY_LOCAL_MACHINE\SOFTWARE\TightVNC\Server
- (+)(注册表项) HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\GSSoft
- (+)(注册表项) HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\GSSoft\cis75
- (+)(注册表项) HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\GSSoft\cis75\debug
- (+)(注册表项) HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\GSSoft\cis75\debug\thread
- (+)(注册表项) HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\GSSoft\cis75\debug\thread\HrServ.exe
- (+)(注册表值) 3400 = REG_SZ, "驱动加载线程"
- (+)(注册表项) HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\GSSoft\cis75\debug\thread\hruser.exe
- (+)(注册表值) 3512 = REG_SZ, "FileRecv.cpp ListenThreadProc"
- (+)(注册表值) 3892 = REG_SZ, "CheckRegServerThread"
- (+)(注册表值) 3896 = REG_SZ, "hruser.FluxMMStartThread"
- (+)(注册表值) 3900 = REG_SZ, "UsbDetectThread"
- (+)(注册表值) 3904 = REG_SZ, "BOnLineThread"
- (+)(注册表项) HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\GSSoft\cis75\debug\thread\Hruser64.exe
- (+)(注册表值) 4032 = REG_SZ, "64位打印审计策略监听线程"
- (+)(注册表项) HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\GSSoft\gdlog
- (+)(注册表值) SYSTEM = REG_SZ, "C:\Windows\system32\config\systemprofile\AppData\Local\GSSoft\HrServ\log\20200211173827_volumemgr.dll-0.log"
- (+)(注册表值) WeiYing = REG_SZ, "C:\Users\WeiYing\AppData\Local\GSSoft\Hruser64\log\20200211173857_Hruser64.exe-0.log"
- (+)(注册表项) HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\hrjd
- (+)(注册表项) HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\hrjd\cis7
- (+)(注册表值) InitDepartment = REG_SZ, "信息技术科"
- (+)(注册表值) InitUserName = REG_SZ, ""
- (+)(注册表项) HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\hrjd\cis7\BackUpUniqueMark
- (+)(注册表值) UniqueMark = REG_SZ, "pc@dc81a94aa006"
- (+)(注册表项) HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\hrjd\cis7\cis7config
- (+)(注册表值) value1 = REG_SZ, "wQmdpeRGwxXNpem="
- (+)(注册表值) value2 = REG_SZ, "wQRB"
- (+)(注册表值) value3 = REG_SZ, "wxXNpe5vw5=="
- (+)(注册表项) HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\hrjd\cis7\DeviceChange
- (+)(注册表项) HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\hrjd\cis7\DeviceChange\023CA301
- (+)(注册表值) DeviceName = REG_SZ, "Teredo Tunneling Pseudo-Interface"
- (+)(注册表项) HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\hrjd\cis7\DeviceChange\0594CFA4
- (+)(注册表值) DeviceName = REG_SZ, "System speaker"
- (+)(注册表项) HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\hrjd\cis7\DeviceChange\0716F29C
- (+)(注册表值) DeviceName = REG_SZ, "Microsoft ACPI-Compliant System"
- (+)(注册表项) HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\hrjd\cis7\DeviceChange\084AABFA
- (+)(注册表值) DeviceName = REG_SZ, "System timer"
- (+)(注册表项) HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\hrjd\cis7\DeviceChange\08867E8B
- (+)(注册表值) DeviceName = REG_SZ, "VMware VMCI Host Device"
- (+)(注册表项) HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\hrjd\cis7\DeviceChange\0A0DACC3
- (+)(注册表值) DeviceName = REG_SZ, "TCP/IP 协议驱动程序"
- (+)(注册表项) HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\hrjd\cis7\DeviceChange\0C5DA420
- (+)(注册表值) DeviceName = REG_SZ, "NDIS System Driver"
- (+)(注册表项) HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\hrjd\cis7\DeviceChange\0D83EB5D
- (+)(注册表值) DeviceName = REG_SZ, "Bitlocker 驱动器加密筛选器驱动程序"
- (+)(注册表项) HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\hrjd\cis7\DeviceChange\0DAE305F
- (+)(注册表值) DeviceName = REG_SZ, "Beep"
- (+)(注册表项) HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\hrjd\cis7\DeviceChange\11789304
- (+)(注册表值) DeviceName = REG_SZ, "Intel(R) PRO/1000 MT Network Connection"
- (+)(注册表项) HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\hrjd\cis7\DeviceChange\11F430A3
- (+)(注册表值) DeviceName = REG_SZ, "Intel 82443BX Pentium(R) II Processor to PCI Bridge"
- (+)(注册表项) HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\hrjd\cis7\DeviceChange\13751984
- (+)(注册表值) DeviceName = REG_SZ, "Link-Layer Topology Discovery Responder"
- (+)(注册表项) HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\hrjd\cis7\DeviceChange\17AD9554
- (+)(注册表值) DeviceName = REG_SZ, "Generic USB Hub"
- (+)(注册表项) HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\hrjd\cis7\DeviceChange\1850A593
- (+)(注册表值) DeviceName = REG_SZ, "通用卷影复制"
- (+)(注册表项) HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\hrjd\cis7\DeviceChange\186DADBE
- (+)(注册表值) DeviceName = REG_SZ, "ATA Channel 22"
- (+)(注册表项) HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\hrjd\cis7\DeviceChange\18DF0B16
- (+)(注册表值) DeviceName = REG_SZ, "脱机文件驱动程序"
- (+)(注册表项) HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\hrjd\cis7\DeviceChange\190F4B67
- (+)(注册表值) DeviceName = REG_SZ, "QoS 数据包计划程序"
- (+)(注册表项) HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\hrjd\cis7\DeviceChange\1BB8238D
- (+)(注册表值) DeviceName = REG_SZ, "Intel 82371AB/EB PCI to ISA bridge (ISA mode)"
- (+)(注册表项) HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\hrjd\cis7\DeviceChange\1F0069A7
- (+)(注册表值) DeviceName = REG_SZ, "ATA Channel 26"
- (+)(注册表项) HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\hrjd\cis7\DeviceChange\2D9560FB
- (+)(注册表值) DeviceName = REG_SZ, "VMware Physical Disk Helper"
- (+)(注册表项) HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\hrjd\cis7\DeviceChange\3340FE7D
- (+)(注册表值) DeviceName = REG_SZ, "ATA Channel 12"
- (+)(注册表项) HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\hrjd\cis7\DeviceChange\338DA8FA
- (+)(注册表值) DeviceName = REG_SZ, "Link-Layer Topology Discovery Mapper I/O Driver"
- (+)(注册表项) HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\hrjd\cis7\DeviceChange\33A5FD6F
- (+)(注册表值) DeviceName = REG_SZ, "NDProxy"
- (+)(注册表项) HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\hrjd\cis7\DeviceChange\342D3A64
- (+)(注册表值) DeviceName = REG_SZ, "ATA Channel 16"
- (+)(注册表项) HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\hrjd\cis7\DeviceChange\34E159F7
- (+)(注册表值) DeviceName = REG_SZ, "VMware VMCI Bus Device"
- (+)(注册表项) HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\hrjd\cis7\DeviceChange\355550DD
- (+)(注册表值) DeviceName = REG_SZ, "ATA Channel 8"
- (+)(注册表项) HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\hrjd\cis7\DeviceChange\3B8ED8EF
- (+)(注册表值) DeviceName = REG_SZ, "ATA Channel 0"
- (+)(注册表项) HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\hrjd\cis7\DeviceChange\3C20C9D9
- (+)(注册表值) DeviceName = REG_SZ, "WAN 微型端口(网络监视器)"
- (+)(注册表项) HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\hrjd\cis7\DeviceChange\3CE31CF6
- (+)(注册表值) DeviceName = REG_SZ, "ATA Channel 4"
- (+)(注册表项) HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\hrjd\cis7\DeviceChange\3FB16943
- (+)(注册表值) DeviceName = REG_SZ, "WAN Miniport (IKEv2)"
- (+)(注册表项) HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\hrjd\cis7\DeviceChange\41D97842
- (+)(注册表值) DeviceName = REG_SZ, "NSI proxy service driver."
- (+)(注册表项) HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\hrjd\cis7\DeviceChange\4252604B
- (+)(注册表值) DeviceName = REG_SZ, "ATA Channel 9"
- (+)(注册表项) HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\hrjd\cis7\DeviceChange\432A0AF2
- (+)(注册表值) DeviceName = REG_SZ, "ATA Channel 17"
- (+)(注册表项) HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\hrjd\cis7\DeviceChange\43330872
- (+)(注册表值) DeviceName = REG_SZ, "HID-compliant mouse"
- (+)(注册表项) HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\hrjd\cis7\DeviceChange\4447CEEB
- (+)(注册表值) DeviceName = REG_SZ, "ATA Channel 13"
- (+)(注册表项) HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\hrjd\cis7\DeviceChange\4634A776
- (+)(注册表值) DeviceName = REG_SZ, "Reflector Display Driver used to gain access to graphics data"
- (+)(注册表项) HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\hrjd\cis7\DeviceChange\4AD765AA
- (+)(注册表值) DeviceName = REG_SZ, "WAN 微型端口(IP)"
- (+)(注册表项) HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\hrjd\cis7\DeviceChange\4AFD39BB
- (+)(注册表值) DeviceName = REG_SZ, "KSecPkg"
- (+)(注册表项) HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\hrjd\cis7\DeviceChange\4BE42C60
- (+)(注册表值) DeviceName = REG_SZ, "ATA Channel 5"
- (+)(注册表项) HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\hrjd\cis7\DeviceChange\4C89E879
- (+)(注册表值) DeviceName = REG_SZ, "ATA Channel 1"
- (+)(注册表项) HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\hrjd\cis7\DeviceChange\4D9ABE13
- (+)(注册表值) DeviceName = REG_SZ, "磁盘虚拟机总线加速筛选器驱动程序"
- (+)(注册表项) HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\hrjd\cis7\DeviceChange\4E9FE873
- (+)(注册表值) DeviceName = REG_SZ, "LSI Adapter, SAS 3000 series, 8-port with 1068"
- (+)(注册表项) HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\hrjd\cis7\DeviceChange\4F76999C
- (+)(注册表值) DeviceName = REG_SZ, "Standard Enhanced PCI to USB Host Controller"
- (+)(注册表项) HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\hrjd\cis7\DeviceChange\5397256D
- (+)(注册表值) DeviceName = REG_SZ, "复合总线枚举器"
- (+)(注册表项) HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\hrjd\cis7\DeviceChange\54C7A459
- (+)(注册表值) DeviceName = REG_SZ, "NECVMWar VMware SATA CD01 ATA Device"
- (+)(注册表项) HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\hrjd\cis7\DeviceChange\555C3B2B
- (+)(注册表值) DeviceName = REG_SZ, "VMware SVGA 3D"
- (+)(注册表项) HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\hrjd\cis7\DeviceChange\561CDC55
- (+)(注册表值) DeviceName = REG_SZ, "EISA programmable interrupt controller"
- (+)(注册表项) HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\hrjd\cis7\DeviceChange\57C2F7A8
- (+)(注册表值) DeviceName = REG_SZ, "System Attribute Cache"
- (+)(注册表项) HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\hrjd\cis7\DeviceChange\5CA8D444
- (+)(注册表值) DeviceName = REG_SZ, "Microsoft System Management BIOS Driver"
- (+)(注册表项) HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\hrjd\cis7\DeviceChange\5FECD2AA
- (+)(注册表值) DeviceName = REG_SZ, "Ancillary Function Driver for Winsock"
- (+)(注册表项) HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\hrjd\cis7\DeviceChange\625CBD07
- (+)(注册表值) DeviceName = REG_SZ, "VMware USB Pointing Device"
- (+)(注册表项) HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\hrjd\cis7\DeviceChange\62FA0F62
- (+)(注册表值) DeviceName = REG_SZ, "PEAUTH"
- (+)(注册表项) HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\hrjd\cis7\DeviceChange\6341AC78
- (+)(注册表值) DeviceName = REG_SZ, "Intel(R) Core(TM) i7-4710MQ CPU @ 2.50GHz"
- (+)(注册表项) HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\hrjd\cis7\DeviceChange\655BA593
- (+)(注册表值) DeviceName = REG_SZ, "PCI standard PCI-to-PCI bridge"
- (+)(注册表项) HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\hrjd\cis7\DeviceChange\67D787C9
- (+)(注册表值) DeviceName = REG_SZ, "Security Driver"
- (+)(注册表项) HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\hrjd\cis7\DeviceChange\68075931
- (+)(注册表值) DeviceName = REG_SZ, "ATA Channel 27"
- (+)(注册表项) HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\hrjd\cis7\DeviceChange\6880B2F8
- (+)(注册表值) DeviceName = REG_SZ, "标准 AHCI 1.0 串行 ATA 控制器"
- (+)(注册表项) HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\hrjd\cis7\DeviceChange\692EB144
- (+)(注册表值) DeviceName = REG_SZ, "Plug and Play Software Device Enumerator"
- (+)(注册表项) HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\hrjd\cis7\DeviceChange\6D8EE1EF
- (+)(注册表值) DeviceName = REG_SZ, "Standard Universal PCI to USB Host Controller"
- (+)(注册表项) HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\hrjd\cis7\DeviceChange\6D8FC053
- (+)(注册表值) DeviceName = REG_SZ, "NetIO 旧 TDI 支持驱动程序"
- (+)(注册表项) HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\hrjd\cis7\DeviceChange\6EE2C766
- (+)(注册表值) DeviceName = REG_SZ, "CNG"
- (+)(注册表项) HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\hrjd\cis7\DeviceChange\6F6A9D28
- (+)(注册表值) DeviceName = REG_SZ, "ATA Channel 23"
- (+)(注册表项) HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\hrjd\cis7\DeviceChange\779E007D
- (+)(注册表值) DeviceName = REG_SZ, "Hardware Policy Driver"
- (+)(注册表项) HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\hrjd\cis7\DeviceChange\791D3077
- (+)(注册表值) DeviceName = REG_SZ, "Remote Access IPv6 ARP Driver"
- (+)(注册表项) HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\hrjd\cis7\DeviceChange\7CC89AC6
- (+)(注册表值) DeviceName = REG_SZ, "PCI Express standard Root Port"
- (+)(注册表项) HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\hrjd\cis7\DeviceChange\7CE80D42
- (+)(注册表值) DeviceName = REG_SZ, "Microsoft Composite Battery"
- (+)(注册表项) HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\hrjd\cis7\DeviceChange\80A75F18
- (+)(注册表值) DeviceName = REG_SZ, "vm3dmp"
- (+)(注册表项) HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\hrjd\cis7\DeviceChange\80F774F2
- (+)(注册表值) DeviceName = REG_SZ, "动态卷管理器"
- (+)(注册表项) HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\hrjd\cis7\DeviceChange\8164FC04
- (+)(注册表值) DeviceName = REG_SZ, "ATA Channel 21"
- (+)(注册表项) HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\hrjd\cis7\DeviceChange\822DAA9E
- (+)(注册表值) DeviceName = REG_SZ, "WFP Lightweight Filter"
- (+)(注册表项) HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\hrjd\cis7\DeviceChange\8431644F
- (+)(注册表值) DeviceName = REG_SZ, "Microsoft Bluetooth Enumerator"
- (+)(注册表项) HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\hrjd\cis7\DeviceChange\84A6D8D6
- (+)(注册表值) DeviceName = REG_SZ, "Microsoft ISATAP Adapter #2"
- (+)(注册表项) HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\hrjd\cis7\DeviceChange\84A7F908
- (+)(注册表值) DeviceName = REG_SZ, "WAN 微型端口(IPv6)"
- (+)(注册表项) HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\hrjd\cis7\DeviceChange\8609381D
- (+)(注册表值) DeviceName = REG_SZ, "ATA Channel 25"
- (+)(注册表项) HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\hrjd\cis7\DeviceChange\8864E022
- (+)(注册表值) DeviceName = REG_SZ, "LDDM Graphics Subsystem"
- (+)(注册表项) HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\hrjd\cis7\DeviceChange\88663AC7
- (+)(注册表值) DeviceName = REG_SZ, "Bluetooth 设备(RFCOMM 协议 TDI)"
- (+)(注册表项) HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\hrjd\cis7\DeviceChange\89B0C080
- (+)(注册表值) DeviceName = REG_SZ, "USB Composite Device"
- (+)(注册表项) HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\hrjd\cis7\DeviceChange\8AC566ED
- (+)(注册表值) DeviceName = REG_SZ, "Memory Control Driver"
- (+)(注册表项) HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\hrjd\cis7\DeviceChange\8FBF7436
- (+)(注册表值) DeviceName = REG_SZ, "ATA Channel 29"
- (+)(注册表项) HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\hrjd\cis7\DeviceChange\96DCB841
- (+)(注册表值) DeviceName = REG_SZ, "Terminal Server Mouse Driver"
- (+)(注册表项) HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\hrjd\cis7\DeviceChange\97D1B578
- (+)(注册表值) DeviceName = REG_SZ, "System CMOS/real time clock"
- (+)(注册表项) HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\hrjd\cis7\DeviceChange\99639A90
- (+)(注册表值) DeviceName = REG_SZ, "VMware, VMware Virtual S SCSI Disk Device"
- (+)(注册表项) HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\hrjd\cis7\DeviceChange\9A6D5056
- (+)(注册表值) DeviceName = REG_SZ, "装载点管理器"
- (+)(注册表项) HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\hrjd\cis7\DeviceChange\9E9DCB91
- (+)(注册表值) DeviceName = REG_SZ, "Null"
- (+)(注册表项) HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\hrjd\cis7\DeviceChange\9F86B1C3
- (+)(注册表值) DeviceName = REG_SZ, "Terminal Server Keyboard Driver"
- (+)(注册表项) HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\hrjd\cis7\DeviceChange\A128369B
- (+)(注册表值) DeviceName = REG_SZ, "RDPCDD"
- (+)(注册表项) HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\hrjd\cis7\DeviceChange\A2878955
- (+)(注册表值) DeviceName = REG_SZ, "ATA Channel 3"
- (+)(注册表项) HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\hrjd\cis7\DeviceChange\A46597E0
- (+)(注册表值) DeviceName = REG_SZ, "msisadrv"
- (+)(注册表项) HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\hrjd\cis7\DeviceChange\A49227F5
- (+)(注册表值) DeviceName = REG_SZ, "ATA Channel 19"
- (+)(注册表项) HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\hrjd\cis7\DeviceChange\A5EA4D4C
- (+)(注册表值) DeviceName = REG_SZ, "ATA Channel 7"
- (+)(注册表项) HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\hrjd\cis7\DeviceChange\A78AAC23
- (+)(注册表值) DeviceName = REG_SZ, "Microsoft ISATAP Adapter"
- (+)(注册表项) HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\hrjd\cis7\DeviceChange\A8896029
- (+)(注册表值) DeviceName = REG_SZ, "KSecDD"
- (+)(注册表项) HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\hrjd\cis7\DeviceChange\A9D5FD49
- (+)(注册表值) DeviceName = REG_SZ, "Generic Bluetooth Adapter"
- (+)(注册表项) HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\hrjd\cis7\DeviceChange\AA49AFC7
- (+)(注册表值) DeviceName = REG_SZ, "ATA Channel 11"
- (+)(注册表项) HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\hrjd\cis7\DeviceChange\AD078CEF
- (+)(注册表值) DeviceName = REG_SZ, "WAN 微型端口(PPPOE)"
- (+)(注册表项) HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\hrjd\cis7\DeviceChange\AD246BDE
- (+)(注册表值) DeviceName = REG_SZ, "ATA Channel 15"
- (+)(注册表项) HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\hrjd\cis7\DeviceChange\B03B6D2B
- (+)(注册表值) DeviceName = REG_SZ, "UMBus Enumerator"
- (+)(注册表项) HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\hrjd\cis7\DeviceChange\B18C5C44
- (+)(注册表值) DeviceName = REG_SZ, "Bluetooth 设备(个人区域网)"
- (+)(注册表项) HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\hrjd\cis7\DeviceChange\B42C876A
- (+)(注册表值) DeviceName = REG_SZ, "WAN 微型端口(SSTP)"
- (+)(注册表项) HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\hrjd\cis7\DeviceChange\B5ADEC0B
- (+)(注册表值) DeviceName = REG_SZ, "PS/2 标准键盘"
- (+)(注册表项) HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\hrjd\cis7\DeviceChange\BA8978E6
- (+)(注册表值) DeviceName = REG_SZ, "HTTP"
- (+)(注册表项) HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\hrjd\cis7\DeviceChange\C0B6FE54
- (+)(注册表值) DeviceName = REG_SZ, "公用日志(CLFS)"
- (+)(注册表项) HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\hrjd\cis7\DeviceChange\C1057265
- (+)(注册表值) DeviceName = REG_SZ, "Windows Firewall Authorization Driver"
- (+)(注册表项) HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\hrjd\cis7\DeviceChange\C12DB5DB
- (+)(注册表值) DeviceName = REG_SZ, "通用卷"
- (+)(注册表项) HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\hrjd\cis7\DeviceChange\C219172D
- (+)(注册表值) DeviceName = REG_SZ, "ACPI Fixed Feature Button"
- (+)(注册表项) HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\hrjd\cis7\DeviceChange\C294C01C
- (+)(注册表值) DeviceName = REG_SZ, "Performance Counters for Windows Driver"
- (+)(注册表项) HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\hrjd\cis7\DeviceChange\C43A2205
- (+)(注册表值) DeviceName = REG_SZ, "Kernel Mode Driver Frameworks service"
- (+)(注册表项) HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\hrjd\cis7\DeviceChange\C6DC3B96
- (+)(注册表值) DeviceName = REG_SZ, "Generic Bus"
- (+)(注册表项) HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\hrjd\cis7\DeviceChange\C741FC7E
- (+)(注册表值) DeviceName = REG_SZ, "High precision event timer"
- (+)(注册表项) HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\hrjd\cis7\DeviceChange\C83DF6E7
- (+)(注册表值) DeviceName = REG_SZ, "Security Processor Loader Driver"
- (+)(注册表项) HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\hrjd\cis7\DeviceChange\CB3D2FF0
- (+)(注册表值) DeviceName = REG_SZ, "ACPI x64-based PC"
- (+)(注册表项) HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\hrjd\cis7\DeviceChange\CCC4502B
- (+)(注册表值) DeviceName = REG_SZ, "Volume Manager"
- (+)(注册表项) HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\hrjd\cis7\DeviceChange\CE05B862
- (+)(注册表值) DeviceName = REG_SZ, "High Definition Audio 设备"
- (+)(注册表项) HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\hrjd\cis7\DeviceChange\CE9ACF66
- (+)(注册表值) DeviceName = REG_SZ, "USB Root Hub"
- (+)(注册表项) HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\hrjd\cis7\DeviceChange\D0E279F8
- (+)(注册表值) DeviceName = REG_SZ, "Remote Desktop Device Redirector Bus"
- (+)(注册表项) HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\hrjd\cis7\DeviceChange\D2ED7DDA
- (+)(注册表值) DeviceName = REG_SZ, "ATA Channel 6"
- (+)(注册表项) HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\hrjd\cis7\DeviceChange\D3951763
- (+)(注册表值) DeviceName = REG_SZ, "ATA Channel 18"
- (+)(注册表项) HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\hrjd\cis7\DeviceChange\D506175F
- (+)(注册表值) DeviceName = REG_SZ, "WAN 微型端口(L2TP)"
- (+)(注册表项) HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\hrjd\cis7\DeviceChange\D580B9C3
- (+)(注册表值) DeviceName = REG_SZ, "ATA Channel 2"
- (+)(注册表项) HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\hrjd\cis7\DeviceChange\D8074B33
- (+)(注册表值) DeviceName = REG_SZ, "通用非即插即用监视器"
- (+)(注册表项) HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\hrjd\cis7\DeviceChange\D8E70DF6
- (+)(注册表值) DeviceName = REG_SZ, "Microsoft AC Adapter"
- (+)(注册表项) HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\hrjd\cis7\DeviceChange\D8F9B3CF
- (+)(注册表值) DeviceName = REG_SZ, "High Definition Audio 控制器"
- (+)(注册表项) HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\hrjd\cis7\DeviceChange\D99821E5
- (+)(注册表值) DeviceName = REG_SZ, "PCI bus"
- (+)(注册表项) HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\hrjd\cis7\DeviceChange\DA235B48
- (+)(注册表值) DeviceName = REG_SZ, "ATA Channel 14"
- (+)(注册表项) HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\hrjd\cis7\DeviceChange\DBB67C71
- (+)(注册表值) DeviceName = REG_SZ, "存储卷"
- (+)(注册表项) HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\hrjd\cis7\DeviceChange\DD4E9F51
- (+)(注册表值) DeviceName = REG_SZ, "ATA Channel 10"
- (+)(注册表项) HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\hrjd\cis7\DeviceChange\E1395254
- (+)(注册表值) DeviceName = REG_SZ, "WAN 微型端口(PPTP)"
- (+)(注册表项) HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\hrjd\cis7\DeviceChange\E203CCB2
- (+)(注册表值) DeviceName = REG_SZ, "文件作为卷驱动程序"
- (+)(注册表项) HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\hrjd\cis7\DeviceChange\E27F5DF8
- (+)(注册表值) DeviceName = REG_SZ, "VgaSave"
- (+)(注册表项) HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\hrjd\cis7\DeviceChange\E4C0F1EF
- (+)(注册表值) DeviceName = REG_SZ, "Intel(R) 82371AB/EB PCI Bus Master IDE Controller"
- (+)(注册表项) HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\hrjd\cis7\DeviceChange\E5A60D79
- (+)(注册表值) DeviceName = REG_SZ, "UMBus Root Bus Enumerator"
- (+)(注册表项) HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\hrjd\cis7\DeviceChange\E7219FAC
- (+)(注册表值) DeviceName = REG_SZ, "RDP Encoder Mirror Driver"
- (+)(注册表项) HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\hrjd\cis7\DeviceChange\E814114A
- (+)(注册表值) DeviceName = REG_SZ, "Direct memory access controller"
- (+)(注册表项) HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\hrjd\cis7\DeviceChange\E8C1CB43
- (+)(注册表值) DeviceName = REG_SZ, "Motherboard resources"
- (+)(注册表项) HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\hrjd\cis7\DeviceChange\E8C601DC
- (+)(注册表值) DeviceName = REG_SZ, "NETBT"
- (+)(注册表项) HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\hrjd\cis7\DeviceChange\EE3276C6
- (+)(注册表值) DeviceName = REG_SZ, "USB 输入设备"
- (+)(注册表项) HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\hrjd\cis7\DeviceChange\F0982A48
- (+)(注册表值) DeviceName = REG_SZ, "Windows 套接字 2 .0 Non-IFS 服务提供程序支持环境"
- (+)(注册表项) HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\hrjd\cis7\DeviceChange\F10E088B
- (+)(注册表值) DeviceName = REG_SZ, "ATA Channel 24"
- (+)(注册表项) HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\hrjd\cis7\DeviceChange\F3A1E840
- (+)(注册表值) DeviceName = REG_SZ, "Microsoft ISATAP Adapter #3"
- (+)(注册表项) HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\hrjd\cis7\DeviceChange\F663CC92
- (+)(注册表值) DeviceName = REG_SZ, "ATA Channel 20"
- (+)(注册表项) HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\hrjd\cis7\DeviceChange\F8B844A0
- (+)(注册表值) DeviceName = REG_SZ, "ATA Channel 28"
- (+)(注册表项) HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\hrjd\cis7\DeviceChange\F8F4B70A
- (+)(注册表值) DeviceName = REG_SZ, "VMware Pointing Device"
- (+)(注册表项) HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\hrjd\cis7\DeviceChange\F93BEB9D
- (+)(注册表值) DeviceName = REG_SZ, "Microsoft 虚拟驱动器枚举器驱动程序"
- (+)(注册表项) HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\hrjd\cis7\DeviceChange\FAC83CBD
- (+)(注册表值) DeviceName = REG_SZ, "TCP/IP Registry Compatibility"
- (+)(注册表项) HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\hrjd\cis7\DomainControl
- (+)(注册表值) 127.0.0.1 = REG_SZ, "环回地址"
- (+)(注册表值) 142.190.0.4 = REG_SZ, "服务器地址"
- (+)(注册表值) 192.168.23.128 = REG_SZ, "本地地址"
- (+)(注册表值) 192.168.23.2 = REG_SZ, "网关地址"
- (+)(注册表值) Server = REG_SZ, "142.190.0.4"
- (+)(注册表项) HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\hrjd\cis7\DomainControl\Addins
- (+)(注册表值) InsPcap = REG_SZ, "C:\Windows\SysWOW64\ChinaSoft\cis7\InsPcap.exe"
- (+)(注册表值) NetMon2.dll = REG_SZ, "C:\Windows\SysWOW64\ChinaSoft\cis7\NetMon2.dll"
- (+)(注册表值) OptMark.dll = REG_SZ, "C:\Windows\SysWOW64\ChinaSoft\cis7\OptMark.dll"
- (+)(注册表值) PatchMark.dll = REG_SZ, "C:\Windows\SysWOW64\ChinaSoft\cis7\PatchMark.dll"
- (+)(注册表值) ProcessMon2.dll = REG_SZ, "C:\Windows\SysWOW64\ChinaSoft\cis7\ProcessMon2.dll"
- (+)(注册表值) UniqueMark.dll = REG_SZ, "C:\Windows\SysWOW64\ChinaSoft\cis7\UniqueMark.dll"
- (+)(注册表值) volumemgr.dll = REG_SZ, "C:\Windows\SysWOW64\ChinaSoft\cis7\volumemgr.dll"
- (+)(注册表项) HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\hrjd\cis7\DomainControlDebugLog
- (+)(注册表值) Debug = REG_DWORD, 0x00000000 (0)
- (+)(注册表项) HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\hrjd\cis7\DomainControlDebugLog\Log
- (+)(注册表值) 856_0000000001 = REG_SZ, "@(2020-02-11 17:38:24.644) hrserv INITIALIZE 尝试初始化网络...
- "
- (+)(注册表值) 856_0000000002 = REG_SZ, "@(2020-02-11 17:38:24.644) hrserv INITIALIZE 检查并安装winpcap
- "
- (+)(注册表值) 856_0000000003 = REG_SZ, "@(2020-02-11 17:38:24.847) hrserv INITIALIZE 尝试启动插件插件管理模块...
- "
- (+)(注册表值) 856_0000000004 = REG_SZ, "@(2020-02-11 17:38:24.847) hrserv INITIALIZE 插件插件管理模块启动成功...
- "
- (+)(注册表值) 856_0000000005 = REG_SZ, "@(2020-02-11 17:38:24.847) hrserv 插件检查线程启动,线程ID:0x6f4(1780)"
- (+)(注册表值) 856_0000000006 = REG_SZ, "@(2020-02-11 17:38:25.003) hrserv INITIALIZE 尝试清空既有策略和数据文件...
- "
- (+)(注册表值) 856_0000000007 = REG_SZ, "@(2020-02-11 17:38:25.019) hrserv INITIALIZE 尝试启动域策略检查...
- "
- (+)(注册表值) 856_0000000008 = REG_SZ, "@(2020-02-11 17:38:25.019) hrserv INITIALIZE 尝试清空原有注册表信息...
- "
- (+)(注册表值) 856_0000000009 = REG_SZ, "@(2020-02-11 17:38:25.019) hrserv INITIALIZE 尝试获取服务器地址...
- "
- (+)(注册表值) 856_0000000010 = REG_SZ, "@(2020-02-11 17:38:25.019) hrserv INITIALIZE 尝试记录服务器地址...
- "
- (+)(注册表值) 856_0000000011 = REG_SZ, "@(2020-02-11 17:38:25.019) hrserv INITIALIZE 尝试保存主线程ID...
- "
- (+)(注册表值) 856_0000000012 = REG_SZ, "@(2020-02-11 17:38:25.019) hrserv INITIALIZE 尝试启动写入内核策略线程...
- "
- (+)(注册表值) 856_0000000013 = REG_SZ, "@(2020-02-11 17:38:25.019) hrserv INITIALIZE 尝试启动参考策略分析、上报线程...
- "
- (+)(注册表值) 856_0000000014 = REG_SZ, "@(2020-02-11 17:38:25.019) hrserv INITIALIZE 尝试启动监控服务器IP配置线程...
- "
- (+)(注册表值) 856_0000000015 = REG_SZ, "@(2020-02-11 17:38:25.019) hrserv INITIALIZE 尝试创建本地TCP监听端口...
- "
- (+)(注册表值) 856_0000000016 = REG_SZ, "@(2020-02-11 17:38:25.019) hrserv 尝试启动TCP数据接收线程。
- "
- (+)(注册表值) 856_0000000017 = REG_SZ, "@(2020-02-11 17:38:25.019) hrserv INITIALIZE 成功创建本地TCP监听端口。
- "
- (+)(注册表值) 856_0000000018 = REG_SZ, "@(2020-02-11 17:38:25.019) hrserv INITIALIZE 尝试创建本地UDP监听端口...
- "
- (+)(注册表值) 856_0000000019 = REG_SZ, "@(2020-02-11 17:38:25.019) hrserv 尝试启动UDP数据接收线程。
- "
- (+)(注册表值) 856_0000000020 = REG_SZ, "@(2020-02-11 17:38:25.019) hrserv INITIALIZE 成功创建本地UDP监听端口。
- "
- (+)(注册表值) 856_0000000021 = REG_SZ, "@(2020-02-11 17:38:25.019) hrserv INITIALIZE 尝试创建消息队列...
- "
- (+)(注册表值) 856_0000000022 = REG_SZ, "@(2020-02-11 17:38:25.019) hrserv 实时侦测:本地地址改变。
- "
- (+)(注册表值) 856_0000000023 = REG_SZ, "@(2020-02-11 17:38:25.019) hrserv INITIALIZE 尝试设定线程定时器...
- "
- (+)(注册表值) 856_0000000024 = REG_SZ, "@(2020-02-11 17:38:25.019) hrserv 计划任务,6秒后更新策略(xx:xx:04)。
- "
- (+)(注册表值) 856_0000000025 = REG_SZ, "@(2020-02-11 17:38:25.019) hrserv INITIALIZE 进入消息循环...
- "
- (+)(注册表值) 856_0000000026 = REG_SZ, "@(2020-02-11 17:38:25.924) hrserv 开始尝试处理插件“C:\Windows\SysWOW64\ChinaSoft\cis7\gdassist.dll”...
- "
- (+)(注册表值) 856_0000000027 = REG_SZ, "@(2020-02-11 17:38:25.924) hrserv 处理插件“C:\Windows\SysWOW64\ChinaSoft\cis7\gdassist.dll”结束。
- "
- (+)(注册表值) 856_0000000028 = REG_SZ, "@(2020-02-11 17:38:26.641) hrserv 开始尝试处理插件“C:\Windows\SysWOW64\ChinaSoft\cis7\NetMon2.dll”...
- "
- (+)(注册表值) 856_0000000029 = REG_SZ, "@(2020-02-11 17:38:26.641) hrserv 成功加载插件NetMon2.dll:C:\Windows\SysWOW64\ChinaSoft\cis7\NetMon2.dll。
- "
- (+)(注册表值) 856_0000000030 = REG_SZ, "@(2020-02-11 17:38:26.641) hrserv 处理插件“C:\Windows\SysWOW64\ChinaSoft\cis7\NetMon2.dll”结束。
- "
- (+)(注册表值) 856_0000000031 = REG_SZ, "@(2020-02-11 17:38:26.688) hrserv 开始尝试处理插件“C:\Windows\SysWOW64\ChinaSoft\cis7\OptMark.dll”...
- "
- (+)(注册表值) 856_0000000032 = REG_SZ, "@(2020-02-11 17:38:26.688) hrserv OptMark.dll GetAddinMark invoked.
- "
- (+)(注册表值) 856_0000000033 = REG_SZ, "@(2020-02-11 17:38:26.688) hrserv 成功加载插件OptMark.dll:C:\Windows\SysWOW64\ChinaSoft\cis7\OptMark.dll。
- "
- (+)(注册表值) 856_0000000034 = REG_SZ, "@(2020-02-11 17:38:26.688) hrserv 处理插件“C:\Windows\SysWOW64\ChinaSoft\cis7\OptMark.dll”结束。
- "
- (+)(注册表值) 856_0000000035 = REG_SZ, "@(2020-02-11 17:38:26.688) hrserv 开始尝试处理插件“C:\Windows\SysWOW64\ChinaSoft\cis7\PatchMark.dll”...
- "
- (+)(注册表值) 856_0000000036 = REG_SZ, "@(2020-02-11 17:38:26.688) hrserv 成功加载插件PatchMark.dll:C:\Windows\SysWOW64\ChinaSoft\cis7\PatchMark.dll。
- "
- (+)(注册表值) 856_0000000037 = REG_SZ, "@(2020-02-11 17:38:26.688) hrserv 处理插件“C:\Windows\SysWOW64\ChinaSoft\cis7\PatchMark.dll”结束。
- "
- (+)(注册表值) 856_0000000038 = REG_SZ, "@(2020-02-11 17:38:26.766) hrserv 开始尝试处理插件“C:\Windows\SysWOW64\ChinaSoft\cis7\ProcessMon2.dll”...
- "
- (+)(注册表值) 856_0000000039 = REG_SZ, "@(2020-02-11 17:38:26.766) hrserv 成功加载插件ProcessMon2.dll:C:\Windows\SysWOW64\ChinaSoft\cis7\ProcessMon2.dll。
- "
- (+)(注册表值) 856_0000000040 = REG_SZ, "@(2020-02-11 17:38:26.766) hrserv 处理插件“C:\Windows\SysWOW64\ChinaSoft\cis7\ProcessMon2.dll”结束。
- "
- (+)(注册表值) 856_0000000041 = REG_SZ, "@(2020-02-11 17:38:27.109) hrserv 开始尝试处理插件“C:\Windows\SysWOW64\ChinaSoft\cis7\UniqueMark.dll”...
- "
- (+)(注册表值) 856_0000000042 = REG_SZ, "@(2020-02-11 17:38:27.109) hrserv 成功加载插件UniqueMark.dll:C:\Windows\SysWOW64\ChinaSoft\cis7\UniqueMark.dll。
- "
- (+)(注册表值) 856_0000000043 = REG_SZ, "@(2020-02-11 17:38:27.109) hrserv 处理插件“C:\Windows\SysWOW64\ChinaSoft\cis7\UniqueMark.dll”结束。
- "
- (+)(注册表值) 856_0000000044 = REG_SZ, "@(2020-02-11 17:38:27.234) hrserv 开始尝试处理插件“C:\Windows\SysWOW64\ChinaSoft\cis7\volumemgr.dll”...
- "
- (+)(注册表值) 856_0000000045 = REG_SZ, "@(2020-02-11 17:38:27.250) hrserv 成功加载插件volumemgr.dll:C:\Windows\SysWOW64\ChinaSoft\cis7\volumemgr.dll。
- "
- (+)(注册表值) 856_0000000046 = REG_SZ, "@(2020-02-11 17:38:27.250) hrserv 处理插件“C:\Windows\SysWOW64\ChinaSoft\cis7\volumemgr.dll”结束。
- "
- (+)(注册表值) 856_0000000047 = REG_SZ, "@(2020-02-11 17:38:27.421) hrserv 开始尝试处理插件“C:\Windows\SysWOW64\ChinaSoft\cis7\InsPcap.exe”...
- "
- (+)(注册表值) 856_0000000048 = REG_SZ, "@(2020-02-11 17:38:27.421) hrserv 成功加载插件InsPcap:C:\Windows\SysWOW64\ChinaSoft\cis7\InsPcap.exe。
- "
- (+)(注册表值) 856_0000000049 = REG_SZ, "@(2020-02-11 17:38:27.437) hrserv 处理插件“C:\Windows\SysWOW64\ChinaSoft\cis7\InsPcap.exe”结束。
- "
- (+)(注册表值) 856_0000000050 = REG_SZ, "@(2020-02-11 17:38:29.231) hrserv 发送心跳失败(第1次)。
- "
- (+)(注册表值) 856_0000000051 = REG_SZ, "@(2020-02-11 17:38:30.728) hrserv 开始尝试处理插件“C:\Windows\SysWOW64\ChinaSoft\cis7\gdassist.dll”...
- "
- (+)(注册表值) 856_0000000052 = REG_SZ, "@(2020-02-11 17:38:30.728) hrserv 处理插件“C:\Windows\SysWOW64\ChinaSoft\cis7\gdassist.dll”结束。
- "
- (+)(注册表值) 856_0000000053 = REG_SZ, "@(2020-02-11 17:38:30.744) hrserv 开始尝试处理插件“C:\Windows\SysWOW64\ChinaSoft\cis7\gdassist.dll”...
- "
- (+)(注册表值) 856_0000000054 = REG_SZ, "@(2020-02-11 17:38:30.744) hrserv 处理插件“C:\Windows\SysWOW64\ChinaSoft\cis7\gdassist.dll”结束。
- "
- (+)(注册表值) 856_0000000055 = REG_SZ, "@(2020-02-11 17:38:31.025) hrserv 计划任务触发,更新策略(xx:xx:10)。
- "
- (+)(注册表值) 856_0000000056 = REG_SZ, "@(2020-02-11 17:38:37.343) hrserv 开始尝试处理插件“C:\Windows\SysWOW64\ChinaSoft\cis7\gdassist.dll”...
- "
- (+)(注册表值) 856_0000000057 = REG_SZ, "@(2020-02-11 17:38:37.343) hrserv 处理插件“C:\Windows\SysWOW64\ChinaSoft\cis7\gdassist.dll”结束。
- "
- (+)(注册表值) 856_0000000058 = REG_SZ, "@(2020-02-11 17:38:37.374) hrserv 开始尝试处理插件“C:\Windows\SysWOW64\ChinaSoft\cis7\gdassist.dll”...
- "
- (+)(注册表值) 856_0000000059 = REG_SZ, "@(2020-02-11 17:38:37.374) hrserv 处理插件“C:\Windows\SysWOW64\ChinaSoft\cis7\gdassist.dll”结束。
- "
- (+)(注册表值) 856_0000000060 = REG_SZ, "@(2020-02-11 17:38:37.421) hrserv 开始尝试处理插件“C:\Windows\SysWOW64\ChinaSoft\cis7\gdassist.dll”...
- "
- (+)(注册表值) 856_0000000061 = REG_SZ, "@(2020-02-11 17:38:37.421) hrserv 处理插件“C:\Windows\SysWOW64\ChinaSoft\cis7\gdassist.dll”结束。
- "
- (+)(注册表值) 856_0000000062 = REG_SZ, "@(2020-02-11 17:38:37.421) hrserv 开始尝试处理插件“C:\Windows\SysWOW64\ChinaSoft\cis7\gdassist.dll”...
- "
- (+)(注册表值) 856_0000000063 = REG_SZ, "@(2020-02-11 17:38:37.421) hrserv 处理插件“C:\Windows\SysWOW64\ChinaSoft\cis7\gdassist.dll”结束。
- "
- (+)(注册表值) 856_0000000064 = REG_SZ, "@(2020-02-11 17:38:40.213) hrserv 发送心跳失败(第2次)。
- "
- (+)(注册表值) 856_0000000065 = REG_SZ, "@(2020-02-11 17:38:51.367) hrserv 发送心跳失败(第3次)。
- "
- (+)(注册表值) 856_0000000066 = REG_SZ, "@(2020-02-11 17:39:02.514) hrserv 发送心跳失败(第4次)。
- "
- (+)(注册表项) HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\hrjd\cis7\DP
- (+)(注册表值) Website = REG_DWORD, 0x00000000 (0)
- (+)(注册表项) HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\hrjd\cis7\FileBackUp
- (+)(注册表值) FileServer = REG_SZ, "142.190.0.4"
- (+)(注册表项) HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\hrjd\cis7\HttpUrl
- (+)(注册表项) HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\hrjd\cis7\LoginLog
- (+)(注册表值) SessionInfo = REG_SZ, "0=;1=WeiYing;"
- (+)(注册表项) HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\hrjd\cis7\LoginLog\20200210224228
- (+)(注册表值) EventTime = REG_SZ, "2020-02-10 22:42:28"
- (+)(注册表值) EventType = REG_SZ, "2"
- (+)(注册表值) UserName = REG_SZ, "--"
- (+)(注册表项) HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\hrjd\cis7\LoginLog\20200211173435
- (+)(注册表值) EventTime = REG_SZ, "2020-02-11 17:34:35"
- (+)(注册表值) EventType = REG_SZ, "1"
- (+)(注册表值) UserName = REG_SZ, "--"
- (+)(注册表项) HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\hrjd\cis7\LoginLog\20200211173509
- (+)(注册表值) EventTime = REG_SZ, "2020-02-11 17:35:09"
- (+)(注册表值) EventType = REG_SZ, "3"
- (+)(注册表值) UserName = REG_SZ, "WeiYing"
- (+)(注册表项) HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\hrjd\cis7\MsgRecord
- (+)(注册表值) msg = REG_DWORD, 0x0000036a (874)
- (+)(注册表项) HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\hrjd\cis7\ProInfo
- (+)(注册表项) HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\hrjd\cis7\ProInfo\017f8f5c96c83cc3
- (+)(注册表值) CompanyName = REG_SZ, "Microsoft Corporation"
- (+)(注册表值) Description = REG_SZ, "Windows 资源管理器"
- (+)(注册表值) Identifer = REG_SZ, "017f8f5c96c83cc3"
- (+)(注册表值) ImageName = REG_SZ, "explorer.exe"
- (+)(注册表值) ImagePath = REG_SZ, "C:\Windows\explorer.exe"
- (+)(注册表值) ImageSize = REG_DWORD, 0x002bd400 (2872320)
- (+)(注册表值) State = REG_SZ, "0"
- (+)(注册表项) HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\hrjd\cis7\ProInfo\06c2fe9e05d916a8
- (+)(注册表值) CompanyName = REG_SZ, "Gavrila Martau"
- (+)(注册表值) Description = REG_SZ, "Total Uninstall Pro"
- (+)(注册表值) Identifer = REG_SZ, "06c2fe9e05d916a8"
- (+)(注册表值) ImageName = REG_SZ, "TUPortable.exe"
- (+)(注册表值) ImagePath = REG_SZ, "C:\Users\WeiYing\Desktop\TUPortable\TUPortable.exe"
- (+)(注册表值) ImageSize = REG_DWORD, 0x00045f4f (286543)
- (+)(注册表值) State = REG_SZ, "0"
- (+)(注册表项) HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\hrjd\cis7\ProInfo\1e618a6c165b0c25
- (+)(注册表值) CompanyName = REG_SZ, "Microsoft Corporation"
- (+)(注册表值) Description = REG_SZ, "网络命令外壳"
- (+)(注册表值) Identifer = REG_SZ, "1e618a6c165b0c25"
- (+)(注册表值) ImageName = REG_SZ, "netsh.exe"
- (+)(注册表值) ImagePath = REG_SZ, "C:\Windows\SysWOW64\netsh.exe"
- (+)(注册表值) ImageSize = REG_DWORD, 0x00017800 (96256)
- (+)(注册表值) State = REG_SZ, "0"
- (+)(注册表项) HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\hrjd\cis7\ProInfo\31c40f29b1ae7f40
- (+)(注册表值) CompanyName = REG_SZ, "Shan Dong Chinasoft Gold Shield Software Co.,Ltd"
- (+)(注册表值) Description = REG_SZ, "cisfh.exe"
- (+)(注册表值) Identifer = REG_SZ, "31c40f29b1ae7f40"
- (+)(注册表值) ImageName = REG_SZ, "cisfh.exe"
- (+)(注册表值) ImagePath = REG_SZ, "C:\Windows\SysWOW64\cisfh.exe"
- (+)(注册表值) ImageSize = REG_DWORD, 0x00012698 (75416)
- (+)(注册表值) State = REG_SZ, "0"
- (+)(注册表项) HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\hrjd\cis7\ProInfo\3259dee7de8bd094
- (+)(注册表值) Description = REG_SZ, "安装/卸载"
- (+)(注册表值) Identifer = REG_SZ, "3259dee7de8bd094"
- (+)(注册表值) ImageName = REG_SZ, "Cis.Setup_信息技术科_142.190.0.4.exe"
- (+)(注册表值) ImagePath = REG_SZ, "C:\Users\WeiYing\AppData\Local\Temp\TUPortableTemp\setup_00038861_1452\Cis.Setup_信息技术科_142.190.0.4.exe"
- (+)(注册表值) ImageSize = REG_DWORD, 0x000d5338 (873272)
- (+)(注册表值) State = REG_SZ, "0"
- (+)(注册表项) HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\hrjd\cis7\ProInfo\67b7fb0542d287d7
- (+)(注册表值) CompanyName = REG_SZ, "Shan Dong Chinasoft Gold Shield Software Co.,Ltd"
- (+)(注册表值) Description = REG_SZ, "金盾全面内网安全终端"
- (+)(注册表值) Identifer = REG_SZ, "67b7fb0542d287d7"
- (+)(注册表值) ImageName = REG_SZ, "hruser.exe"
- (+)(注册表值) ImagePath = REG_SZ, "C:\Windows\SysWOW64\ChinaSoft\cis7\hruser.exe"
- (+)(注册表值) ImageSize = REG_DWORD, 0x001c8b80 (1870720)
- (+)(注册表值) State = REG_SZ, "0"
- (+)(注册表项) HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\hrjd\cis7\ProInfo\8f072e6c8822d7ba
- (+)(注册表值) CompanyName = REG_SZ, "Shan Dong Chinasoft Gold Shield Software Co.,Ltd"
- (+)(注册表值) Description = REG_SZ, "金盾全面内网安全终端"
- (+)(注册表值) Identifer = REG_SZ, "8f072e6c8822d7ba"
- (+)(注册表值) ImageName = REG_SZ, "Cis.Setup_信息技术科_142.190.0.4.exe"
- (+)(注册表值) ImagePath = REG_SZ, "C:\Users\WeiYing\Desktop\Cis.Setup_信息技术科_142.190.0.4.exe"
- (+)(注册表值) ImageSize = REG_DWORD, 0x00a25b90 (10640272)
- (+)(注册表值) State = REG_SZ, "0"
- (+)(注册表项) HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\hrjd\cis7\ProInfo\ce8a5712e86e6602
- (+)(注册表值) CompanyName = REG_SZ, "VMware, Inc."
- (+)(注册表值) Description = REG_SZ, "VMware Tools Core Service"
- (+)(注册表值) Identifer = REG_SZ, "ce8a5712e86e6602"
- (+)(注册表值) ImageName = REG_SZ, "vmtoolsd.exe"
- (+)(注册表值) ImagePath = REG_SZ, "C:\Program Files\VMware\VMware Tools\vmtoolsd.exe"
- (+)(注册表值) ImageSize = REG_DWORD, 0x00016db0 (93616)
- (+)(注册表值) State = REG_SZ, "0"
- (+)(注册表项) HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\hrjd\cis7\ProInfo\da5018c10beef42d
- (+)(注册表值) CompanyName = REG_SZ, "Gavrila Martau"
- (+)(注册表值) Description = REG_SZ, "Total Uninstall - Installation monitor, uninstaller and cleaner"
- (+)(注册表值) Identifer = REG_SZ, "da5018c10beef42d"
- (+)(注册表值) ImageName = REG_SZ, "Tu.exe"
- (+)(注册表值) ImagePath = REG_SZ, "C:\Users\WeiYing\Desktop\TUPortable\App\TU64\Tu.exe"
- (+)(注册表值) ImageSize = REG_DWORD, 0x00710738 (7407416)
- (+)(注册表值) State = REG_SZ, "0"
- (+)(注册表项) HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\hrjd\cis7\RecvFile
- (+)(注册表值) DownLoadState = REG_DWORD, 0x00000000 (0)
- (+)(注册表项) HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\hrjd\cis7\StatuMark
- (+)(注册表值) ManualCheck = REG_DWORD, 0x00000000 (0)
- (+)(注册表项) HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\hrjd\cis7\UAC
- (+)(注册表值) closed = REG_DWORD, 0x00000001 (1)
- (+)(注册表项) HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\hrjd\cis7\UserLogin
- (+)(注册表值) UserName = REG_SZ, "WeiYing"
- (+)(注册表项) HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\hrjd\cis7\virtualmac
- (+)(注册表值) mac = REG_SZ, "F9-16-F7-5C-20-69"
- (+)(注册表项) HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\hrjd\usbmanager
- (+)(注册表项) HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\hrjd\usbmanager\SCSI#DISK&VEN_VMWARE_&PROD_VMWARE_VIRTUAL_S_0
- (+)(注册表项) HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\hrjd\usbmanager\SCSI#DISK&VEN_VMWARE_&PROD_VMWARE_VIRTUAL_S_0\1
- (+)(注册表值) volclass = REG_DWORD, 0x00000003 (3)
- (+)(注册表值) volnum = REG_DWORD, 0x00000001 (1)
- (+)(注册表值) volumename = REG_SZ, "\\?\Volume{14691e9c-2703-11ea-b612-806e6f6e6963}"
- (+)(注册表项) HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\hrjd\usbmanager\SCSI#DISK&VEN_VMWARE_&PROD_VMWARE_VIRTUAL_S_0\-1
- (+)(注册表值) volclass = REG_DWORD, 0x00000004 (4)
- (+)(注册表值) volnum = REG_DWORD, 0xffffffff (18446744073709551615)
- (+)(注册表值) volumename = REG_SZ, "\\?\Volume{14691e9f-2703-11ea-b612-806e6f6e6963}"
- (+)(注册表项) HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\HrTemp
- (+)(注册表值) cis = REG_SZ, "ci"
- (+)(注册表项) HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\HrTemp\cis7
- (+)(注册表项) HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\HrTemp\cis7\ErrorLog
- (+)(注册表值) InsPcap = REG_SZ, "2020-02-11 17:38:28.108 3408:3412 安装成功。"
- (+)(注册表项) HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\HrTemp\cis7\LoginLog
- (+)(注册表值) DebugMonkey = REG_SZ, "DebugMonkey"
- (+)(注册表值) WeiYing=20200211173509 = REG_SZ, ""
- (注册表项) HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Command Processor
- (+)(注册表值) AutoRun = REG_SZ, ""
- (+)(注册表项) HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects
- (+)(注册表项) HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{FE9D7AFD-731C-46BD-BF78-220AD77C88BD}
- (+)(注册表值) (默认) = REG_SZ, "GoldShieldBHO"
- (+)(注册表值) NoExplorer = REG_DWORD, 0x00000001 (1)
- (+)(注册表项) HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\ShellIconOverlayIdentifiers\.FstEncCanDec
- (+)(注册表值) (默认) = REG_SZ, "{BDC992EF-1A3D-43EB-8EE4-25EC554D34AC}"
- (+)(注册表项) HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\ShellIconOverlayIdentifiers\.FstEncCanNotDec
- (+)(注册表值) (默认) = REG_SZ, "{BDC992EF-1A3D-43EB-8EE4-25EC554D34AD}"
- (+)(注册表项) HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\ShellIconOverlayIdentifiers\HrExt
- (+)(注册表值) (默认) = REG_SZ, "{33D55355-C20C-455E-9EF2-B8B8C858E472}"
- (注册表项) HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run
- (+)(注册表值) HRJD = REG_SZ, "C:\Windows\SysWOW64\cisfh.exe"
- (+)(注册表项) HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\UniqueMark
- (+)(注册表值) UniqueMark = REG_SZ, "LaT5JawXwYRGTazyw85A"
- (注册表项) HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Class\{4D36E972-E325-11CE-BFC1-08002BE10318}\0009\Linkage
- (*)(注册表值) UpperBind
- REG_MULTI_SZ, "Tcpip6 " ==> REG_MULTI_SZ, "TCPIP6TUNNEL Tcpip6 "
- (注册表项) HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\GroupOrderList
- (*)(注册表值) FSFilter Content Screener
- REG_BINARY, .... ==> REG_BINARY, ......
- (注册表项) HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Network
- (*)(注册表值) Config
- REG_BINARY, ....,...............(...ms_nativewifip..................8...ms_ndiscap......................ms_pacer........................ms_server...................(...ms_netbios..................(...ms_wfplwf...................(...ms_steelhead....................8...ms_rassrv...................(...ms_rasman.......................ms_msclient.................8...ms_agilevpn.................(...ms_tcpip6_tunnel....................(...ms_tcpip_tunnel.................(...ms_smb..................(...ms_wanarp...................8...ms_netbt_smb....................(...ms_netbt........................ms_tcpip6.......................ms_tcpip........................ms_lltdio.......................ms_rspndr...................(...ms_wanarpv6.................(...ms_pppoe....................8...ms_pptp.................8...ms_l2tp.................(...ms_ndiswan..................8...ms_sstp.................(...ms_ndisuio......................*teredo.root\*teredo\0000...................*isatap.root\*isatap\0002...................*isatap.root\*isatap\0001...................bth\ms_bthpan...bth\ms_bthpan\8&20f38eb4&0&2....................bth\ms_rfcomm...bth\ms_rfcomm\8&20f38eb4&0&0....................*isatap.root\*isatap\0000...................pci\ven_8086&dev_100f...pci\ven_8086&dev_100f&subsys_075015ad&rev_01\4&3ad87e0a&0&0888..............)...ms_agilevpnminiport.root\ms_agilevpnminiport\0000...............*...sw\{eeab7790-c514-11d1-b42b-00805fc1270e}...sw\{eeab7790-c514-11d1-b42b-00805fc1270e}\asyncmac..............)...ms_ndiswanip....root\ms_ndiswanip\0000..............)...ms_ndiswanbh....root\ms_ndiswanbh\0000..............)...ms_ndiswanipv6..root\ms_ndiswanipv6\0000................)...ms_pppoeminiport....root\ms_pppoeminiport\0000..............)...ms_pptpminiport.root\ms_pptpminiport\0000...............)...ms_l2tpminiport.root\ms_l2tpminiport\0000...............)...ms_sstpminiport.root\ms_sstpminiport\0000.......1.......".......".......".......%.......&.......'.......................................................................................................................!..............."..............."..............."..............."...............".......................................!.......".......................%.......................'.......#.......$.......(.......).......*.......+...............".......................!...............................................................................................................................................................................................................................................................%...............................................................................................................................'........................................................................................................... ==> REG_BINARY, ....,...............(...ms_nativewifip..................8...ms_ndiscap......................ms_pacer........................ms_server...................(...ms_netbios..................(...ms_wfplwf...................(...ms_steelhead....................8...ms_rassrv...................(...ms_rasman.......................ms_msclient.................8...ms_agilevpn.................(...ms_tcpip6_tunnel....................(...ms_tcpip_tunnel.................(...ms_smb..................(...ms_wanarp...................8...ms_netbt_smb....................(...ms_netbt........................ms_tcpip6.......................ms_tcpip........................ms_lltdio.......................ms_rspndr...................(...ms_wanarpv6.................(...ms_pppoe....................8...ms_pptp.................8...ms_l2tp.................(...ms_ndiswan..................8...ms_sstp.................(...ms_ndisuio......................*teredo.root\*teredo\0000...................*isatap.root\*isatap\0002...................*isatap.root\*isatap\0001...................bth\ms_bthpan...bth\ms_bthpan\8&20f38eb4&0&2....................bth\ms_rfcomm...bth\ms_rfcomm\8&20f38eb4&0&0....................*isatap.root\*isatap\0000...................pci\ven_8086&dev_100f...pci\ven_8086&dev_100f&subsys_075015ad&rev_01\4&3ad87e0a&0&0888..............)...ms_agilevpnminiport.root\ms_agilevpnminiport\0000...............*...sw\{eeab7790-c514-11d1-b42b-00805fc1270e}...sw\{eeab7790-c514-11d1-b42b-00805fc1270e}\asyncmac..............)...ms_ndiswanip....root\ms_ndiswanip\0000..............)...ms_ndiswanbh....root\ms_ndiswanbh\0000..............)...ms_ndiswanipv6..root\ms_ndiswanipv6\0000................)...ms_pppoeminiport....root\ms_pppoeminiport\0000..............)...ms_pptpminiport.root\ms_pptpminiport\0000...............)...ms_l2tpminiport.root\ms_l2tpminiport\0000...............)...ms_sstpminiport.root\ms_sstpminiport\0000.......1.......".......".......".......%.......&.......'.......................................................................................................................!..............."..............."..............."..............."...............".......................................!.......".......................%.......................'.......#.......$.......(.......).......*.......+..............."...........................................................................................................................................................................................................................................................................%...............................................................................................................................'...........................................................................................................
- (注册表项) HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Network\{4D36E972-E325-11CE-BFC1-08002BE10318}\{1087AC94-023E-4351-B616-0C986E3A7707}\Connection
- (*)(注册表值) Name
- REG_SZ, "Reusable ISATAP Interface {1087AC94-023E-4351-B616-0C986E3A7707}" ==> REG_SZ, "isatap.{71108A99-16AC-4F33-801A-67E3ED72EE3A}"
- (注册表项) HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Network\{4d36e975-e325-11ce-bfc1-08002be10318}\{2B07FAA1-8217-4E30-B5EC-FD4501E773BB}\Linkage
- (*)(注册表值) Bind
- REG_MULTI_SZ, "\Device\{A98487AA-8149-4D34-87CD-F5C79DB5B885} \Device\{9975164D-FC81-40FE-8021-58BFDC97316A} " ==> REG_MULTI_SZ, "\Device\{A98487AA-8149-4D34-87CD-F5C79DB5B885} \Device\{9975164D-FC81-40FE-8021-58BFDC97316A} \Device\{1087AC94-023E-4351-B616-0C986E3A7707} "
- (*)(注册表值) Export
- REG_MULTI_SZ, "\Device\TCPIP6TUNNEL_{A98487AA-8149-4D34-87CD-F5C79DB5B885} \Device\TCPIP6TUNNEL_{9975164D-FC81-40FE-8021-58BFDC97316A} " ==> REG_MULTI_SZ, "\Device\TCPIP6TUNNEL_{A98487AA-8149-4D34-87CD-F5C79DB5B885} \Device\TCPIP6TUNNEL_{9975164D-FC81-40FE-8021-58BFDC97316A} \Device\TCPIP6TUNNEL_{1087AC94-023E-4351-B616-0C986E3A7707} "
- (*)(注册表值) Route
- REG_MULTI_SZ, ""{A98487AA-8149-4D34-87CD-F5C79DB5B885}" "{9975164D-FC81-40FE-8021-58BFDC97316A}" " ==> REG_MULTI_SZ, ""{A98487AA-8149-4D34-87CD-F5C79DB5B885}" "{9975164D-FC81-40FE-8021-58BFDC97316A}" "{1087AC94-023E-4351-B616-0C986E3A7707}" "
- (+)(注册表项) HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\cisfm64
- (+)(注册表值) DependOnService = REG_MULTI_SZ, "FltMgr "
- (+)(注册表值) Description = REG_SZ, "cisfm64 mini-filter driver"
- (+)(注册表值) DisplayName = REG_SZ, "cisfm64"
- (+)(注册表值) ErrorControl = REG_DWORD, 0x00000001 (1)
- (+)(注册表值) Group = REG_SZ, "FSFilter Content Screener"
- (+)(注册表值) ImagePath = REG_EXPAND_SZ, "system32\DRIVERS\cisfm64.sys"
- (+)(注册表值) Start = REG_DWORD, 0x00000003 (3)
- (+)(注册表值) Tag = REG_DWORD, 0x00000002 (2)
- (+)(注册表值) Type = REG_DWORD, 0x00000002 (2)
- (+)(注册表值) WOW64 = REG_DWORD, 0x00000001 (1)
- (+)(注册表项) HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\cisfm64\Instances
- (+)(注册表值) DefaultInstance = REG_SZ, "cisfm64 Instance"
- (+)(注册表项) HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\cisfm64\Instances\cisfm64 Instance
- (+)(注册表值) Altitude = REG_SZ, "265000"
- (+)(注册表值) Flags = REG_DWORD, 0x00000000 (0)
- (+)(注册表项) HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\eventlog\Application\tvnserver
- (+)(注册表值) CategoryCount = REG_DWORD, 0x00000000 (0)
- (+)(注册表值) CategoryMessageFile = REG_SZ, "C:\Windows\SysWOW64\ChinaSoft\cis7\gdassist64.exe"
- (+)(注册表值) EventMessageFile = REG_SZ, "C:\Windows\SysWOW64\ChinaSoft\cis7\gdassist64.exe"
- (+)(注册表值) ParameterMessageFile = REG_SZ, "C:\Windows\SysWOW64\ChinaSoft\cis7\gdassist64.exe"
- (+)(注册表值) TypesSupported = REG_DWORD, 0x00000007 (7)
- (+)(注册表项) HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\gdwfp64
- (+)(注册表值) DisplayName = REG_SZ, "gdwfp64"
- (+)(注册表值) ErrorControl = REG_DWORD, 0x00000001 (1)
- (+)(注册表值) ImagePath = REG_EXPAND_SZ, "\??\C:\Windows\SysWOW64\ChinaSoft\cis7\gdwfp64.sys"
- (+)(注册表值) Start = REG_DWORD, 0x00000003 (3)
- (+)(注册表值) Type = REG_DWORD, 0x00000001 (1)
- (+)(注册表值) WOW64 = REG_DWORD, 0x00000001 (1)
- (+)(注册表项) HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\hrserv
- (+)(注册表值) DependOnService = REG_MULTI_SZ, "tcpip "
- (+)(注册表值) Description = REG_SZ, "全面保护内网计算机终端安全。"
- (+)(注册表值) DisplayName = REG_SZ, "Hr.Service"
- (+)(注册表值) ErrorControl = REG_DWORD, 0x00000001 (1)
- (+)(注册表值) ImagePath = REG_EXPAND_SZ, ""C:\Windows\SysWOW64\ChinaSoft\cis7\HrServ.exe" -s"
- (+)(注册表值) ObjectName = REG_SZ, "LocalSystem"
- (+)(注册表值) Start = REG_DWORD, 0x00000002 (2)
- (+)(注册表值) Type = REG_DWORD, 0x00000110 (272)
- (+)(注册表值) WOW64 = REG_DWORD, 0x00000001 (1)
- (+)(注册表项) HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\npf
- (+)(注册表值) DisplayName = REG_SZ, "NetGroup Packet Filter Driver"
- (+)(注册表值) ErrorControl = REG_DWORD, 0x00000001 (1)
- (+)(注册表值) ImagePath = REG_EXPAND_SZ, "system32\drivers\npf.sys"
- (+)(注册表值) Start = REG_DWORD, 0x00000003 (3)
- (+)(注册表值) TimestampMode = REG_DWORD, 0x00000000 (0)
- (+)(注册表值) Type = REG_DWORD, 0x00000001 (1)
- (+)(注册表值) WOW64 = REG_DWORD, 0x00000001 (1)
- (+)(注册表项) HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\npf\Enum
- (+)(注册表值) 0 = REG_SZ, "Root\LEGACY_NPF\0000"
- (+)(注册表值) Count = REG_DWORD, 0x00000001 (1)
- (+)(注册表值) NextInstance = REG_DWORD, 0x00000001 (1)
- (+)(注册表项) HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\VirtualVolume
- (+)(注册表值) DeleteFlag = REG_DWORD, 0x00000001 (1)
- (+)(注册表值) DisplayName = REG_SZ, "VirtualVolume"
- (+)(注册表值) ErrorControl = REG_DWORD, 0x00000001 (1)
- (+)(注册表值) ImagePath = REG_EXPAND_SZ, "\??\C:\Windows\SysWOW64\ChinaSoft\cis7\vd64.sys"
- (+)(注册表值) Start = REG_DWORD, 0x00000004 (4)
- (+)(注册表值) Type = REG_DWORD, 0x00000001 (1)
- (+)(注册表值) WOW64 = REG_DWORD, 0x00000001 (1)
- (+)(注册表项) HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\VirtualVolume\Enum
- (+)(注册表值) 0 = REG_SZ, "Root\LEGACY_VIRTUALVOLUME\0000"
- (+)(注册表值) Count = REG_DWORD, 0x00000001 (1)
- (+)(注册表值) NextInstance = REG_DWORD, 0x00000001 (1)
- (+)(注册表项) HKEY_LOCAL_MACHINE\SYSTEM\Setup\SetupapiLogStatus
- (+)(注册表值) setupapi.app.log = REG_DWORD, 0x00001000 (4096)
- (注册表项) HKEY_USERS\.DEFAULT\Software
- (+)(注册表值) SecondOrPlusTimeToRunInsPcap = REG_DWORD, 0x00000001 (1)
- (+)(注册表项) HKEY_USERS\S-1-5-21-3488340567-1937152611-980287941-1000\Software\hrjd
- (+)(注册表项) HKEY_USERS\S-1-5-21-3488340567-1937152611-980287941-1000\Software\hrjd\UsbAuth
- (+)(注册表值) version = REG_DWORD, 0x00000046 (70)
- (+)(注册表项) HKEY_USERS\S-1-5-21-3488340567-1937152611-980287941-1000\Software\hrjd\UsbAuth\3096
- (+)(注册表值) 15469c1b = REG_SZ, "Generic Bluetooth Adapter"
- (+)(注册表值) 33bf56dc = REG_SZ, "USB Composite Device"
- (+)(注册表项) HKEY_USERS\S-1-5-21-3488340567-1937152611-980287941-1000\Software\HrTemp
- (+)(注册表项) HKEY_USERS\S-1-5-21-3488340567-1937152611-980287941-1000\Software\HrTemp\cis7
- (+)(注册表项) HKEY_USERS\S-1-5-21-3488340567-1937152611-980287941-1000\Software\HrTemp\cis7\Flux
- (+)(注册表值) 3096_Flux = REG_BINARY, ................................................................................................................................................................................................................................................................................................................................
- (+)(注册表值) 3096_Flux2 = REG_BINARY, ................................................................................................................................................................................................................................................................................................................................
- (+)(注册表值) 3096_FluxT = REG_BINARY, ....................................n...........................................................................................................................................................................................................................................................................................
- (+)(注册表项) HKEY_USERS\S-1-5-21-3488340567-1937152611-980287941-1000\Software\Microsoft\CTF\CUAS
- (+)(注册表项) HKEY_USERS\S-1-5-21-3488340567-1937152611-980287941-1000\Software\Microsoft\CTF\CUAS\DefaultCompositionWindow
- (+)(注册表值) Left = REG_DWORD, 0x00000000 (0)
- (+)(注册表值) Top = REG_DWORD, 0x00000000 (0)
- (+)(注册表项) HKEY_USERS\S-1-5-21-3488340567-1937152611-980287941-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\CIDOpen
- (+)(注册表项) HKEY_USERS\S-1-5-21-3488340567-1937152611-980287941-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\CIDOpen\Modules
- (+)(注册表项) HKEY_USERS\S-1-5-21-3488340567-1937152611-980287941-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\CIDOpen\Modules\GlobalSettings
- (+)(注册表项) HKEY_USERS\S-1-5-21-3488340567-1937152611-980287941-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\CIDOpen\Modules\GlobalSettings\ProperTreeModuleInner
- (+)(注册表值) ProperTreeModuleInner = REG_BINARY, ..............;.*...............................navpane_showlibrarypane.........
- (注册表项) HKEY_USERS\S-1-5-21-3488340567-1937152611-980287941-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\StartPage2
- (*)(注册表值) ProgramsCacheTBP
- REG_BINARY, ......................................[...............................k...........[.........................................................................................................................................................................................................................................................................................................................r1........r<.......*............taskbar...2.... .......~.......*.........t..windows explorer.lnk.@shell32.dll,-22067..t....{f38bf404-1d43-42f2-9305-67de0b28fc23}\explorer.exe..........%windir%\explorer.exe...{f38bf404-1d43-42f2-9305-67de0b28fc23}\explorer.exe................{f38bf404-1d43-42f2-9305-67de0b28fc23}\explorer.exe.......................................[...............................k...........[...................................................................................................................................................................................................................................................................................................................... ==> REG_BINARY, ......................................[...............................k...........[.........................................................................................................................................................................................................................................................................................................................r1........r<.......*............taskbar...2.... .......~.......*.........t..windows explorer.lnk.@shell32.dll,-22067..t....{f38bf404-1d43-42f2-9305-67de0b28fc23}\explorer.exe..........%windir%\explorer.exe...{f38bf404-1d43-42f2-9305-67de0b28fc23}\explorer.exe................{f38bf404-1d43-42f2-9305-67de0b28fc23}\explorer.exe.....
- (注册表项) HKEY_USERS\S-1-5-21-3488340567-1937152611-980287941-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Taskband
- (*)(注册表值) Favorites
- REG_BINARY, ..................................[...............................k...........[..............................................................................................................................r1........r<.......*............taskbar...2.... .......~.......*.........t..windows explorer.lnk.@shell32.dll,-22067..t....{f38bf404-1d43-42f2-9305-67de0b28fc23}\explorer.exe.....................................[...............................k...........[................................................................................................................ ==> REG_BINARY, ..................................[...............................k...........[..............................................................................................................................r1........r<.......*............taskbar...2.... .......~.......*.........t..windows explorer.lnk.@shell32.dll,-22067..t....{f38bf404-1d43-42f2-9305-67de0b28fc23}\explorer.exe...
- (*)(注册表值) FavoritesChanges
- REG_DWORD, 0x00000006 (6) ==> REG_DWORD, 0x00000007 (7)
- (*)(注册表值) FavoritesResolve
- REG_BINARY, ..l........... ....................................r1........r<.......*............taskbar...2.... ...............*.........v..internet explorer.lnk.@c:\windows\system32\ie4uinit.exe,-734..r....microsoft.internetexplorer.default...........-........................................................................`...x..........e....................................l........... ....................................r1........r<.......*............taskbar...2.... .......~.......*.........t..windows explorer.lnk.@shell32.dll,-22067..t....{f38bf404-1d43-42f2-9305-67de0b28fc23}\explorer.exe...........-......................................................................k...........................................................................................................................[...............................k...........[..................................................................................................................................................................................................`...x..........e.................................. ==> REG_BINARY, ..l........... ....................................r1........r<.......*............taskbar...2.... ...............*.........v..internet explorer.lnk.@c:\windows\system32\ie4uinit.exe,-734..r....microsoft.internetexplorer.default...........-........................................................................`...x..........e....................................l........... ....................................r1........r<.......*............taskbar...2.... .......~.......*.........t..windows explorer.lnk.@shell32.dll,-22067..t....{f38bf404-1d43-42f2-9305-67de0b28fc23}\explorer.exe...........-......................................................................k..................................................
- (+)(注册表项) HKEY_USERS\S-1-5-21-3488340567-1937152611-980287941-1000\Software\Microsoft\Windows\CurrentVersion\GrpConv
- (注册表项) HKEY_USERS\S-1-5-21-3488340567-1937152611-980287941-1000\Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Compatibility Assistant\Persisted
- (+)(注册表值) C:\Users\WeiYing\Desktop\TUPortable\TUPortable.exe = REG_DWORD, 0x00000001 (1)
复制代码
|