当前长度: 20105 字节
系统限制: 0 到 20000 字节
更好更弓虽大。接着分段。
浏览器加载项 分析方法：Hijackthis的作用在这里就显示出来啦！对应hijackhtis的02、03、08、09、016项，可以用 Hijackthis辅助分析，注意假冒假冒microsoft和macromedia的项
Hijackthis的使用及分析方法可以看Full-Moon版主的置顶帖:lol 。
不过要讲的是SREng日志的分析方法，这一项也不能略过……
这次引用下竹风铃的日志……
引用:
浏览器加载项
[Thunder Browser Helper]
{06849E9E-C8D7-4D59-B87D-784B7D6BE0B3} D:\迅雷\ComDlls\XunLeiBHO_007.dll, Thunder Networking Technologies,LTD>
[AcroIEHlprObj Class]
{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}
[启动迅雷5]
{09BA8F6D-CB54-424B-839C-C2A6C8E6B436}
[豪杰超级解霸V8]
{367E0A21-8601-4986-9C9A-153BF5ACA118}
[信息检索(&R)]
{92780B25-18CC-41C8-B9BE-3C9C571A8263}
[Windows Genuine Advantage Validation Tool]
{17492023-C23A-453E-A040-C7C580BBF700}
[Tencent Safety Online Base Module]
{C09B522F-8AED-4E21-A65C-DC1AB652BAEE}
[ScienceWord Control 5.0]
{C29E7AB7-8C79-421A-AB75-0AE00E848C2D}
[Shockwave Flash Object]
{D27CDB6E-AE6D-11CF-96B8-444553540000}
[CPasswordEditCtrl Object]
{E787FD25-8D7C-4693-AE67-9406BC6E22DF}
[Thunder Browser Helper]
{06849E9E-C8D7-4D59-B87D-784B7D6BE0B3}
[AcroIEHlprObj Class]
{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}
[HTML Document]
{25336920-03F9-11CF-8FD0-00AA00686F13}
[Windows Media Player]
{6BF52A52-394A-11D3-B153-00C04F79FAA6}
[Thunder Browser Helper]
{889D2FEB-5411-4565-8998-1DD2C5261283}
[SearchAssistantOC]
{B45FF030-4447-11D2-85DE-00C04FA35C89}
[AUDIO__MP3 Moniker Class]
{CD3AFA76-B84F-48F0-9393-7EDC34128127}
[VIDEO__X_MS_ASF Moniker Class]
{CD3AFA8F-B84F-48F0-9393-7EDC34128127}
[Shockwave Flash Object]
{D27CDB6E-AE6D-11CF-96B8-444553540000}
[&使用迅雷下载]
[&使用迅雷下载全部链接]
[上传到QQ网络硬盘]
[导出到 Microsoft Office Excel(&X)]
[添加到QQ自定义面板]
[添加到QQ表情]
[用QQ彩信发送该图片]
[豪杰超级解霸V8实时播放]
D:\豪杰超级解霸V8\MPURLGET.HTM, N/A>
==================================粉色的是浏览器加载项名（也就是常说的BHO），蓝色部分是CLSID（有的BHO没有CLSID），一般每一种BHO都有唯一的CLSID，否则可能会有冲突，不用去分析。橙色部分是文件路径，紫色部分为公司名称。
分析的时候还是要注意公司名称，对公司名为N/A的，Google搜索一下。
下列几个为排除项目：
[HTML Document]
{25336920-03F9-11CF-8FD0-00AA00686F13}
[SearchAssistantOC]
{B45FF030-4447-11D2-85DE-00C04FA35C89}
还有最下面那几项QQ和迅雷的，如果文件路径没有问题，也可以排除。
感谢ho121在我写这一项时对我的帮助！^_^
正在运行的进程 分析方法：这一项可以说是整个日志的主体部分，一般来说也是最长的一部分！（有时驱动可能会更长）虽然分析这一项时需要注意的事项并不多，但是一定要细心，还要有耐心！不要错过任何一个可能是病毒的项目！
这次用谁的日志好呢……这次就用我自己的好了……o(∩_∩)o...哈哈
引用:
正在运行的进程
[PID: 712][\SystemRoot\System32\smss.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 776][\??\C:\WINDOWS\system32\csrss.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 292][C:\WINDOWS\system32\ctfmon.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[C:\Program Files\Rising\AntiSpyware\ieprot.dll] [Beijing Rising Technology Co., Ltd., 1, 0, 0, 10]
[C:\Syswm1j\Ghook.dll] [N/A, ]
[PID: 320][e:\program files\rising\rfw\RfwMain.exe] [Beijing Rising Technology Co., Ltd., 5, 0, 0, 70]
[e:\program files\rising\rfw\RsGuiLib.dll] [Beijing Rising Technology Co., Ltd., 19, 0, 0, 33]
[e:\program files\rising\rfw\RSCOMMON.DLL] [Beijing Rising Technology Co., Ltd., 19, 0, 0, 5]
[e:\program files\rising\rfw\RfwCtrl.dll] [Beijing Rising Technology Co., Ltd., 5, 0, 0, 11]
[e:\program files\rising\rfw\RsXML.dll] [Beijing Rising Technology Co., Ltd., 19, 0, 0, 2]
[e:\program files\rising\rfw\PngDll.dll] [Beijing Rising Technology Co., Ltd., 18, 0, 0, 5]
[C:\Program Files\Rising\AntiSpyware\ieprot.dll] [Beijing Rising Technology Co., Ltd., 1, 0, 0, 10]
[C:\Syswm1j\Ghook.dll] [N/A, ]
[C:\DOCUME~1\李牧原\LOCALS~1\Temp\Qqzo0.dll] [N/A, ]
[PID: 1164][C:\Program Files\ATI Technologies\ATI.ACE\cli.exe] [ATI Technologies Inc., 1.11.0.0]
[C:\WINDOWS\system32\mscoree.dll] [Microsoft Corporation, 1.1.4322.573]
[C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\mscorwks.dll] [Microsoft Corporation, 1.1.4322.573]
[C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\MSVCR71.dll] [Microsoft Corporation, 7.10.3052.4]
[C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\fusion.dll] [Microsoft Corporation, 1.1.4322.573]
[c:\windows\microsoft.net\framework\v1.1.4322\mscorlib.dll] [Microsoft Corporation, 1.1.4322.573]
[c:\windows\assembly\nativeimages1_v1.1.4322\mscorlib\1.0.5000.0__b77a5c561934e089_422c3599\mscorlib.dll] [N/A, ]
[C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\mscorsn.dll] [Microsoft Corporation, 1.1.4322.573]
[C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\MSCORJIT.DLL] [Microsoft Corporation, 1.1.4322.573]
[c:\windows\assembly\gac\system.windows.forms\1.0.5000.0__b77a5c561934e089\system.windows.forms.dll] [Microsoft Corporation, 1.1.4322.573]
[c:\windows\assembly\nativeimages1_v1.1.4322\system.windows.forms\1.0.5000.0__b77a5c561934e089_14cb2b7b\system.windows.forms.dll] [N/A, ]
[c:\program files\ati technologies\ati.ace\cli.implementation.dll] [ATI Technologies Inc., 1.2.2114.465]
[c:\program files\ati technologies\ati.ace\log.foundation.dll] [ATI Technologies Inc., 1.2.2026.29944]
[c:\program files\ati technologies\ati.ace\cli.foundation.dll] [ATI Technologies Inc., 1.2.2026.29944]
[c:\program files\ati technologies\ati.ace\log.foundation.service.dll] [ATI Technologies Inc., 1.2.2114.464]
[c:\program files\ati technologies\ati.ace\log.foundation.shared.dll] [ATI Technologies Inc., 1.2.2026.29970]
[c:\windows\assembly\gac\system\1.0.5000.0__b77a5c561934e089\system.dll] [Microsoft Corporation, 1.1.4322.573]
[c:\windows\assembly\nativeimages1_v1.1.4322\system\1.0.5000.0__b77a5c561934e089_96df10ff\system.dll] [N/A, ]
[c:\program files\ati technologies\ati.ace\cli.foundation.xmanifestation.dll] [ATI Technologies Inc., 1.2.2114.464]
[c:\windows\assembly\gac\system.xml\1.0.5000.0__b77a5c561934e089\system.xml.dll] [Microsoft Corporation, 1.1.4322.573]
[c:\windows\assembly\nativeimages1_v1.1.4322\system.xml\1.0.5000.0__b77a5c561934e089_b39e651e\system.xml.dll] [N/A, ]
[c:\windows\assembly\gac\system.runtime.remoting\1.0.5000.0__b77a5c561934e089\system.runtime.remoting.dll] [Microsoft Corporation, 1.1.4322.573]
[C:\WINDOWS\system32\ldmedia4.dll] [N/A, ]
[c:\program files\ati technologies\ati.ace\cli.component.runtime.dll] [ATI Technologies Inc., 1.2.2114.465]
[c:\program files\ati technologies\ati.ace\aem.foundation.dll] [ATI Technologies Inc., 1.2.2026.29944]
[c:\windows\assembly\gac\system.drawing\1.0.5000.0__b03f5f7f11d50a3a\system.drawing.dll] [Microsoft Corporation, 1.1.4322.573]
[c:\windows\assembly\nativeimages1_v1.1.4322\system.drawing\1.0.5000.0__b03f5f7f11d50a3a_d3d144b1\system.drawing.dll] [N/A, ]
[C:\PROGRA~1\Yahoo!\ASSIST~1\Yhelper.dll] [N/A, ]
[c:\program files\ati technologies\ati.ace\cli.caste.graphics.runtime.dll] [ATI Technologies Inc., 1.2.2114.456]
[c:\program files\ati technologies\ati.ace\cli.component.runtime.shared.dll] [ATI Technologies Inc., 1.2.2026.29946]
[c:\program files\ati technologies\ati.ace\cli.caste.graphics.shared.dll] [ATI Technologies Inc., 1.2.2028.21076]
[c:\program files\ati technologies\ati.ace\dem.foundation.dll] [ATI Technologies Inc., 1.2.2026.29944]
[c:\program files\ati technologies\ati.ace\dem.graphics.displaysmanager.shared.dll] [ATI Technologies Inc., 1.2.2026.29945]
[c:\program files\ati technologies\ati.ace\dem.graphics.demosinfo.dll] [ATI Technologies Inc., 1.2.2026.29947]
[C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\perfcounter.dll] [Microsoft Corporation, 1.1.4322.573]
[c:\program files\ati technologies\ati.ace\dem.graphics.demosadapterinfo.dll] [ATI Technologies Inc., 1.2.2026.29960]
[c:\program files\ati technologies\ati.ace\dem.graphics.dematiadapterinfo.dll] [ATI Technologies Inc., 1.2.2095.19505]
[c:\program files\ati technologies\ati.ace\dem.graphics.demdriversettings.dll] [ATI Technologies Inc., 1.2.2026.29947]
[C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\aspnet_isapi.dll] [Microsoft Corporation, 1.1.4322.573]
[c:\windows\assembly\gac\system.web\1.0.5000.0__b03f5f7f11d50a3a\system.web.dll] [Microsoft Corporation, 1.1.4322.573]
[PID: 1152][D:\Program Files\CyberLink\PowerDVD\PDVDServ.exe] [Cyberlink Corp., 6.00.1027]
[D:\Program Files\CyberLink\PowerDVD\CLRCEngine2.dll] [CyberLink Corp., 3.2.2021 ]
[C:\Program Files\Rising\AntiSpyware\ieprot.dll] [Beijing Rising Technology Co., Ltd., 1, 0, 0, 10]
[C:\Syswm1j\Ghook.dll] [N/A, ]
[PID: 1532][C:\Program Files\Rising\AntiSpyware\runiep.exe] [Beijing Rising Technology Co., Ltd., 1, 0, 1, 6]
[C:\Program Files\Rising\AntiSpyware\iep_ctrl.dll] [Beijing Rising Technology Co., Ltd., 1, 0, 0, 4]
[C:\Program Files\Rising\AntiSpyware\ieprot.dll] [Beijing Rising Technology Co., Ltd., 1, 0, 0, 10]
[C:\Syswm1j\Ghook.dll] [N/A, ]
[PID: 1844][C:\Program Files\MSI\Live Update 3\LMonitor.exe] [, 1, 0, 0, 3]
[C:\Program Files\MSI\Live Update 3\Lang\res804.dll] [N/A, ]
[C:\Program Files\MSI\Live Update 3\nvgpio.dll] [NVIDIA Corporation, 1.0.1.5]
[C:\WINDOWS\system32\msdmo.dll] [, ]
[C:\PROGRA~1\Yahoo!\ASSIST~1\Yhelper.dll] [N/A, ]
[C:\Program Files\Rising\AntiSpyware\ieprot.dll] [Beijing Rising Technology Co., Ltd., 1, 0, 0, 10]
[C:\Syswm1j\Ghook.dll] [N/A, ]
[PID: 1972][C:\WINDOWS\SOUNDMAN.EXE] [Realtek Semiconductor Corp., 5, 1, 0, 58]
[C:\PROGRA~1\Yahoo!\ASSIST~1\Yhelper.dll] [N/A, ]
[C:\Program Files\Rising\AntiSpyware\ieprot.dll] [Beijing Rising Technology Co., Ltd., 1, 0, 0, 10]
[C:\Syswm1j\Ghook.dll] [N/A, ]
[PID: 1960][C:\Syswm1j\svchost.exe] [N/A, ]
[C:\Syswm1j\Ghook.dll] [N/A, ]
[PID: 556][C:\Program Files\ATI Technologies\ATI.ACE\CLI.exe] [ATI Technologies Inc., 1.11.0.0]
[C:\WINDOWS\system32\mscoree.dll] [Microsoft Corporation, 1.1.4322.573]
[C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\mscorwks.dll] [Microsoft Corporation, 1.1.4322.573]
[C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\MSVCR71.dll] [Microsoft Corporation, 7.10.3052.4]
[C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\fusion.dll] [Microsoft Corporation, 1.1.4322.573]
[c:\windows\microsoft.net\framework\v1.1.4322\mscorlib.dll] [Microsoft Corporation, 1.1.4322.573]
[c:\windows\assembly\nativeimages1_v1.1.4322\mscorlib\1.0.5000.0__b77a5c561934e089_422c3599\mscorlib.dll] [N/A, ]
[C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\mscorsn.dll] [Microsoft Corporation, 1.1.4322.573]
[C:\PROGRA~1\Yahoo!\ASSIST~1\Yhelper.dll] [N/A, ]
[C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\MSCORJIT.DLL] [Microsoft Corporation, 1.1.4322.573]
[c:\windows\assembly\gac\system.windows.forms\1.0.5000.0__b77a5c561934e089\system.windows.forms.dll] [Microsoft Corporation, 1.1.4322.573]
[c:\windows\assembly\nativeimages1_v1.1.4322\system.windows.forms\1.0.5000.0__b77a5c561934e089_14cb2b7b\system.windows.forms.dll] [N/A, ]
[c:\program files\ati technologies\ati.ace\cli.implementation.dll] [ATI Technologies Inc., 1.2.2114.465]
[c:\program files\ati technologies\ati.ace\log.foundation.dll] [ATI Technologies Inc., 1.2.2026.29944]
[c:\program files\ati technologies\ati.ace\cli.foundation.dll] [ATI Technologies Inc., 1.2.2026.29944]
[c:\program files\ati technologies\ati.ace\log.foundation.service.dll] [ATI Technologies Inc., 1.2.2114.464]
[c:\program files\ati technologies\ati.ace\log.foundation.shared.dll] [ATI Technologies Inc., 1.2.2026.29970]
[c:\windows\assembly\gac\system\1.0.5000.0__b77a5c561934e089\system.dll] [Microsoft Corporation, 1.1.4322.573]
[c:\windows\assembly\nativeimages1_v1.1.4322\system\1.0.5000.0__b77a5c561934e089_96df10ff\system.dll] [N/A, ]
[c:\program files\ati technologies\ati.ace\cli.foundation.xmanifestation.dll] [ATI Technologies Inc., 1.2.2114.464]
[c:\windows\assembly\gac\system.xml\1.0.5000.0__b77a5c561934e089\system.xml.dll] [Microsoft Corporation, 1.1.4322.573]
[c:\windows\assembly\nativeimages1_v1.1.4322\system.xml\1.0.5000.0__b77a5c561934e089_b39e651e\system.xml.dll] [N/A, ]
[c:\windows\assembly\gac\system.runtime.remoting\1.0.5000.0__b77a5c561934e089\system.runtime.remoting.dll] [Microsoft Corporation, 1.1.4322.573]
[C:\WINDOWS\system32\ldmedia4.dll] [N/A, ]
[c:\program files\ati technologies\ati.ace\cli.component.systemtray.dll] [ATI Technologies Inc., 1.2.2114.432]
[c:\program files\ati technologies\ati.ace\cli.caste.graphics.shared.dll] [ATI Technologies Inc., 1.2.2028.21076]
[c:\program files\ati technologies\ati.ace\dem.graphics.displaysmanager.shared.dll] [ATI Technologies Inc., 1.2.2026.29945]
[c:\windows\assembly\gac\system.web\1.0.5000.0__b03f5f7f11d50a3a\system.web.dll] [Microsoft Corporation, 1.1.4322.573]
[C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\perfcounter.dll] [Microsoft Corporation, 1.1.4322.573]
[C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\aspnet_isapi.dll] [Microsoft Corporation, 1.1.4322.573]
[PID: 1400][E:\Program Files\Yahoo!\Messenger\ymsgr_tray.exe] [Yahoo! Inc., 8,1,0,0]
[E:\Program Files\Yahoo!\Messenger\MSVCP71.dll] [Microsoft Corporation, 7.10.3077.0]
[E:\Program Files\Yahoo!\Messenger\MSVCR71.dll] [Microsoft Corporation, 7.10.3052.4]
[C:\PROGRA~1\Yahoo!\ASSIST~1\Yhelper.dll] [N/A, ]
[C:\Program Files\Yahoo!\Shared\YbSkin2.dll] [Yahoo! Inc., 2006, 10, 11, 1]
[E:\Program Files\Yahoo!\Messenger\res_msgr.dll] [Yahoo! Inc., 8,5,0,1]
[C:\Program Files\Rising\AntiSpyware\ieprot.dll] [Beijing Rising Technology Co., Ltd., 1, 0, 0, 10]
[C:\Syswm1j\Ghook.dll] [N/A, ]
[PID: 2032][C:\WINDOWS\system32\wuauclt.exe] [Microsoft Corporation, 5.8.0.2469 built by: lab01_n(wmbla)]
[C:\PROGRA~1\Yahoo!\ASSIST~1\Yhelper.dll] [N/A, ]
[C:\Program Files\Rising\AntiSpyware\ieprot.dll] [Beijing Rising Technology Co., Ltd., 1, 0, 0, 10]
[C:\Syswm1j\Ghook.dll] [N/A, ]
[PID: 2468][E:\Program Files\Maxthon\Maxthon.exe] [Maxthon International Ltd., 1, 5, 9, 80]
[E:\Program Files\Maxthon\maxzlib.dll] [ , 1, 0, 0, 2]
[C:\PROGRA~1\Yahoo!\ASSIST~1\Yhelper.dll] [N/A, ]
[C:\WINDOWS\system32\mscoree.dll] [Microsoft Corporation, 1.1.4322.573]
[C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\CorperfmonExt.dll] [Microsoft Corporation, 1.1.4322.573]
[C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\MSVCR71.dll] [Microsoft Corporation, 7.10.3052.4]
[C:\Program Files\Rising\AntiSpyware\ieprot.dll] [Beijing Rising Technology Co., Ltd., 1, 0, 0, 10]
[C:\Syswm1j\Ghook.dll] [N/A, ]
[E:\Program Files\Maxthon\Services\RealTime\real_time.dll] [, 1, 0, 0, 1]
[C:\WINDOWS\system32\ldmedia4.dll] [N/A, ]
[C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\mscorie.dll] [Microsoft Corporation, 1.1.4322.573]
[C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\mscorld.dll] [Microsoft Corporation, 1.1.4322.573]
[C:\WINDOWS\system32\Macromed\Flash\Flash9b.ocx] [Adobe Systems, Inc., 9,0,28,0]
[C:\DOCUME~1\李牧原\LOCALS~1\Temp\Qqzo0.dll] [N/A, ]
[PID: 3956][E:\Program Files\Rising\Rav\RsAgent.exe] [Beijing Rising Technology Co., Ltd., 19, 0, 0, 12]
[C:\PROGRA~1\Yahoo!\ASSIST~1\Yhelper.dll] [N/A, ]
[E:\Program Files\Rising\Rav\RsCommX.dll] [rising, 18, 0, 0, 1]
[C:\Program Files\Rising\AntiSpyware\ieprot.dll] [Beijing Rising Technology Co., Ltd., 1, 0, 0, 10]
[C:\Syswm1j\Ghook.dll] [N/A, ]
[PID: 4020][C:\WINDOWS\msagent\AgentSvr.exe] [Microsoft Corporation, 2.00.0.3424]
[C:\PROGRA~1\Yahoo!\ASSIST~1\Yhelper.dll] [N/A, ]
[C:\Program Files\Rising\AntiSpyware\ieprot.dll] [Beijing Rising Technology Co., Ltd., 1, 0, 0, 10]
[C:\Syswm1j\Ghook.dll] [N/A, ]
[PID: 2208][C:\WINDOWS\explorer.exe] [Microsoft Corporation, 6.00.2900.2180 (xpsp_sp2_rtm.040803-2158)]
[C:\Program Files\Rising\AntiSpyware\ieprot.dll] [Beijing Rising Technology Co., Ltd., 1, 0, 0, 10]
[C:\Syswm1j\Ghook.dll] [N/A, ]
[C:\Program Files\Common Files\Microsoft Shared\MSINFO\NewInfo.dll] [N/A, ]
[e:\program files\rising\rfw\jifvpyyl.dll] [N/A, ]
[D:\Program Files\Adobe\Acrobat 7.0\ActiveX\PDFShell.dll] [Adobe Systems, Inc., 7.0.0.0]
[C:\WINDOWS\system32\ldmedia4.dll] [N/A, ]
[C:\WINDOWS\system32\mppds.dll] [N/A, ]
[e:\program files\rising\rfw\zpkjuwgv.dll] [N/A, ]
[C:\DOCUME~1\李牧原\LOCALS~1\Temp\Qqzo0.dll] [N/A, ]
[PID: 3780][C:\WINDOWS\system32\conime.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[C:\Program Files\Rising\AntiSpyware\ieprot.dll] [Beijing Rising Technology Co., Ltd., 1, 0, 0, 10]
[C:\Syswm1j\Ghook.dll] [N/A, ]
[PID: 3624][C:\DOCUME~1\李牧原\LOCALS~1\Temp\Rar$EX02.359\SREng.EXE] [Smallfrogs Studio, 2.4.12.806]
[C:\Program Files\Rising\AntiSpyware\ieprot.dll] [Beijing Rising Technology Co., Ltd., 1, 0, 0, 10]
[C:\Syswm1j\Ghook.dll] [N/A, ]
[C:\DOCUME~1\李牧原\LOCALS~1\Temp\Qqzo0.dll] [N/A, ]
[C:\WINDOWS\system32\ldmedia4.dll] [N/A, ]
==================================http://bbs.pep.com.cn/viewthread.php?tid=90515
秋风树林的这个精华帖对于进程的名称已经讲得很明白了，对于进程名我就不想多说什么了。
下面讲一下分析方法：
PID:XXX：对于这一项，有兴趣的朋友可以自己查下什么是PID，据我的了解，好像是由同一个进程创建的几个进程，PID就会一样。
一般来说，进程前面没有[PID:XXXX]的进程是安全的，不用去分析。
我这个日志是用旧版的SREng扫描的，新版的SREng在进程前面的方括号[ ]里除了PID参数外，还有用户名。我的新版日志的方括号里面就是这样的：
[PID: 932 / SYSTEM][\SystemRoot\System32\smss.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 296 / 李牧原][C:\WINDOWS\Explorer.EXE] [Microsoft Corporation, 6.00.2900.2180 (xpsp_sp2_rtm.040803-2158)]
“PID:XXX/ ”后面的SYSTEM和李牧原就是运行这项进程的用户名。SYSTEM说明这项进程为系统进程。
PID参数后面的，就是进程路径了。SystemRoot，如果是NT和2000系统，就是X:\WINNT，如果是XP之类的，就是C:\WINDOWS。再后面，就是公司信息。和前几项一样，如果是[N/A]或者假冒Microsoft Corporation，那么就是有问题的。
进程名称的下几行（如果有的话）是进程加载的dll。一般来说，有[N/A]的就是有问题的。这时候应该用Google搜索一下这个dll，如果发现有问题或者根本搜索不到，就应该删除。有的dll名称是随机的n位字母数字，一般来说都是有问题的。如：
[C:\WINDOWS\system32\ldmedia4.dll] [N/A, ]
[C:\WINDOWS\system32\mppds.dll] [N/A, ]
[e:\program files\rising\rfw\zpkjuwgv.dll] [N/A, ]
对于Explorer.EXE加载的dll要格外注意！ |
发表于 2009-4-9 23:14:57
楼主
小李也来了，支持一下。
