收藏本站 |切换到宽版 | 更换论坛皮肤
 找回密码  忘记邮箱  QQ快速登录  快速登录  快速注册

卡饭»论坛 › 软件区 › 解疑答难区 › 麻烦教教我怎么看
返回列表 发新帖
查看: 1687|回复: 7
收起左侧

[已解决] 麻烦教教我怎么看

 关闭 [复制链接]
qsw753
发表于 2010-2-12 22:34:27 | 显示全部楼层 |阅读模式
本帖最后由 qsw753 于 2010-2-14 23:44 编辑

你好，朋友！小弟初学看sreng报告，
我想请问一下，“浏览器加载项”“浏览器自定义组件”“关联文件”怎么分析？？？
谢谢~


以下是我的作业：



  2. 2010-02-12,20:38:08
  3. System Repair Engineer 2.8.2.1321
  4. Smallfrogs (http://www.KZTechs.com)
  5. Windows XP Professional Service Pack 3 (Build 2600) - 管理权限用户 - 完整功能
  6. 以下内容被选中：
  7.     所有的启动项目（包括注册表、启动文件夹、服务等）
  8.     浏览器加载项
  9.     正在运行的进程（包括进程模块信息）
  10.     文件关联
  11.     Winsock 提供者
  12.     Autorun.inf
  13.     HOSTS 文件
  14.     进程特权扫描
  15.     计划任务
  16.     Windows 安全更新检查
  17.     API HOOK
  18.     隐藏进程

  20. 启动项目
  21. 注册表
  22. [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
  23.     <ctfmon.exe><C:\WINDOWS\system32\ctfmon.exe> （这项是office）
  24. [(Verified)Microsoft Windows Component Publisher]
  25.     <newwork><C:\WINDOWS\run1.vbs>  [File is missing]
  26. （这项是开机修改IE主页的恶意程序，因为系统都是在网上下载的，有这个也正常，不过我们可以手动删掉）
  27.     <LeyuBoxData><; C:\Program Files\Leyu\LeyuBox.exe p2p>  [File is missing]
  28. （这项是乐鱼影音盒）
  29.     <SandboxieControl><"C:\Program Files\Sandboxie\SbieCtrl.exe">  [(Verified)SANDBOXIE L.T.D]
  30. （这项是沙盘）
  31. [HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows]
  32.     <load><>  [N/A]
  33. [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
  34.     <NvCplDaemon><RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup>  [(Verified)Microsoft Windows Hardware Compatibility Publisher]
  35. （NVIDIA显示卡相关动态链接库文件）
  36.     <nwiz><nwiz.exe /install>  [NVIDIA Corporation]
  37. （NVidia的Nview特性相关程序）
  38.     <NvMediaCenter><RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit>  [(Verified)Microsoft Windows Hardware Compatibility Publisher]
  39. （是NVidia显示卡相关文件）
  40. [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
  41.     <shell><Explorer.exe>  [(Verified)Microsoft Windows Component Publisher]
  42.     <Userinit><C:\WINDOWS\system32\userinit.exe,>  [(Verified)Microsoft Windows Component Publisher]
  43. （是Windows操作系统一个关键进程。用于管理不同的启动顺序，例如在建立网络链接和Windows壳的启动。 ）
  44. [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Windows]
  45.     <AppInit_DLLs><>  [N/A]
  46. （是初始化动态链接库相关的）
  47. [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
  48.     <UIHost><logonui.exe>  [(Verified)Microsoft Windows Component Publisher]
  49. （是一个系统进程，用于显示微软Windows XP系统用户切换界面）
  50. [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
  51.     <{AEB6717E-7E19-11d0-97EE-00C04FD91972}><shell32.dll>  [(Verified)Microsoft Windows Component Publisher]
  52. （微软视窗外壳要求生效的命令代码集合）
  53. [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
  54.     <PostBootReminder><%SystemRoot%\system32\SHELL32.dll>  [(Verified)Microsoft Windows Component Publisher]
  55.     <CDBurn><%SystemRoot%\system32\SHELL32.dll>  [(Verified)Microsoft Windows Component Publisher]
  56.     <WebCheck><%SystemRoot%\system32\webcheck.dll>  [(Verified)Microsoft Windows Component Publisher]
  57. （是用于对网站进行监视的COM接口，一般是打印机接口或连接路由器的接口）
  58.     <SysTray><C:\WINDOWS\system32\stobject.dll>  [(Verified)Microsoft Windows Component Publisher]
  59. （资源文件，用于图标等）
  60. [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\crypt32chain]
  61.     <WinlogonNotify: crypt32chain><crypt32.dll>  [(Verified)Microsoft Windows Component Publisher]
  62. （是Windows加密API应用程序接口模块）
  63. [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\cryptnet]
  64.     <WinlogonNotify: cryptnet><cryptnet.dll>  [(Verified)Microsoft Windows Component Publisher]
  65. （加密网络相关的API模块 ）
  66. [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\cscdll]
  67.     <WinlogonNotify: cscdll><cscdll.dll>  [(Verified)Microsoft Windows Component Publisher]
  68. （是微软关于网络的一个进程，这个进程非常危险）
  69. [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\dimsntfy]
  70.     <WinlogonNotify: dimsntfy><%SystemRoot%\System32\dimsntfy.dll>  [(Verified)Microsoft Windows Component Publisher]
  71. （MS也是微软的）
  72. [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\ScCertProp]
  73.     <WinlogonNotify: ScCertProp><wlnotify.dll>  [(Verified)Microsoft Windows Component Publisher]
  74. （是对Windows事件提醒相关应用程序接口，例如Windows登陆、关机、注销等。）
  75. [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\Schedule]
  76.     <WinlogonNotify: Schedule><wlnotify.dll>  [(Verified)Microsoft Windows Component Publisher]
  77. [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\sclgntfy]
  78.     <WinlogonNotify: sclgntfy><sclgntfy.dll>  [(Verified)Microsoft Windows Component Publisher]
  79. （MS也是微软的一个东东）
  80. [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\SensLogn]
  81.     <WinlogonNotify: SensLogn><WlNotify.dll>  [(Verified)Microsoft Windows Component Publisher]
  82. [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\termsrv]
  83.     <WinlogonNotify: termsrv><wlnotify.dll>  [(Verified)Microsoft Windows Component Publisher]
  84. [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\wlballoon]
  85.     <WinlogonNotify: wlballoon><wlnotify.dll>  [(Verified)Microsoft Windows Component Publisher]
  86. [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
  87.     <{438755C2-A8BA-11D1-B96B-00A0C90312E1}><%SystemRoot%\system32\browseui.dll>  [(Verified)Microsoft Windows Component Publisher]
  88. （用于浏览器UI界面的管理）
  89.     <{8C7461EF-2B13-11d2-BE35-3078302C2030}><%SystemRoot%\system32\browseui.dll>  [(Verified)Microsoft Windows Component Publisher]
  90. [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\>{22d6f312-b0f6-11d0-94ab-0080c74c7e95}]
  91.     <Microsoft Windows Media Player><C:\WINDOWS\inf\unregmp2.exe /ShowWMP>  [(Verified)Microsoft Windows Component Publisher]
  92. （是Microsoft Windows Media Player的相关程序）
  93. [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\>{26923b43-4d38-484f-9b9e-de460746276c}]
  94.     <Internet Explorer><%systemroot%\system32\shmgrate.exe OCInstallUserConfigIE>  [File is missing]
  95. （是Windows NT User Data Migration Tool的相关程序）
  96. [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\>{60B49E34-C7CC-11D0-8953-00A0C90347FF}MICROS]



  100.     <浏览器自定义组件><RunDLL32 IEDKCS32.DLL,BrandIE4 SIGNUP>  [(Verified)Microsoft Windows Component Publisher]
  101. [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\>{881dd1c5-3dcf-431b-b061-f3f88e8be88a}]
  102.     <Outlook Express><%systemroot%\system32\shmgrate.exe OCInstallUserConfigOE>  [File is missing]
  103. [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{2C7339CF-2B09-4501-B3F3-F3508C9228ED}]
  104.     <Themes Setup><%SystemRoot%\system32\regsvr32.exe /s /n /i:/UserInstall
  105. （是用于注册Windows操作系统的动态链接库和ActiveX控件。）
  106. %SystemRoot%\system32\themeui.dll>  [File is missing]
  107. [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{44BBA840-CC51-11CF-AAFA-00AA00B6015C}]
  108.     <Microsoft Outlook Express 6><"%ProgramFiles%\Outlook Express\setup50.exe" /APP:OE /CALLER:WINNT /user /install>  [File is missing]
  109. [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{44BBA842-CC51-11CF-AAFA-00AA00B6015B}]
  110.     <NetMeeting 3.01><rundll32.exe advpack.dll,LaunchINFSection C:\WINDOWS\INF\msnetmtg.inf,NetMtg.Remove.PerUser.NT>  [(Verified)Microsoft Windows Component Publisher]
  111. [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{5945c046-1e7d-11d1-bc44-00c04fd912be}]
  112.     <Windows Messenger 4.7><rundll32.exe advpack.dll,LaunchINFSection C:\WINDOWS\INF\msmsgs.inf,BLC.QuietInstall.PerUser>  [(Verified)Microsoft Windows Component Publisher]
  113. [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{6BF52A52-394A-11d3-B153-00C04F79FAA6}]
  114.     <Microsoft Windows Media Player><rundll32.exe advpack.dll,LaunchINFSection C:\WINDOWS\INF\wmp10.inf,PerUserStub>  [(Verified)Microsoft Windows Component Publisher]
  115. [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{7790769C-0471-11d2-AF11-00C04FA35D02}]
  116.     <通讯簿 6><"%ProgramFiles%\Outlook Express\setup50.exe" /APP:WAB /CALLER:WINNT /user /install>  [File is missing]
  117. [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{89820200-ECBD-11cf-8B85-00AA005B4340}]
  118.     <Windows 桌面更新><regsvr32.exe /s /n /i:U shell32.dll>  [(Verified)Microsoft Windows Component Publisher]
  119. [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{89820200-ECBD-11cf-8B85-00AA005B4383}]
  120.     <Internet Explorer 6><%SystemRoot%\system32\ie4uinit.exe>  [(Verified)Microsoft Windows Component Publisher]
  121. [HKEY_CURRENT_USER\Control Panel\Desktop]
  122.     <SCRNSAVE.EXE><C:\WINDOWS\system32\MARINE~1.SCR>  []




  127. ==================================
  128. 启动文件夹
  129. N/A
  130. ==================================
  131. 服务
  132. [Help and Support / helpsvc][Stopped/Disabled]
  133.   <C:\WINDOWS\System32\svchost.exe -k netsvcs-->%WINDIR%\PCHealth\HelpCtr\Binaries\pchsvc.dll><N/A>
  134. [HID Input Service / HidServ][Stopped/Auto Start]
  135. （是从动态链接库 (DLL) 中运行的服务的通用主机进程名称。）
  136.   <C:\WINDOWS\System32\svchost.exe -k netsvcs-->%SystemRoot%\System32\hidserv.dll><N/A>
  137. [NVIDIA Display Driver Service / NVSvc][Running/Auto Start]
  138.   <C:\WINDOWS\system32\nvsvc32.exe><NVIDIA Corporation>
  139. [System Restore Service / srservice][Stopped/Disabled]
  140.   <C:\WINDOWS\system32\svchost.exe -k netsvcs-->C:\WINDOWS\system32\srsvc.dll><N/A>
  141. [Sandboxie Service / SbieSvc][Running/Auto Start]
  142.   <"C:\Program Files\Sandboxie\SbieSvc.exe"><tzuk>
  143. ==================================
  144. 驱动程序
  145. [360SelfProtection / 360SelfProtection][Running/System Start]
  146.   <system32\drivers\360SelfProtection.sys><360安全中心>
  147. [AmdK8 Compatible Device / AmdK8][Stopped/Manual Start]
  148.   <System32\drivers\amdk8.sys><Advanced Micro Devices>
  149. [BFSDRV / BFSDRV][Running/System Start]
  150.   <\??\C:\WINDOWS\system32\drivers\bfsdrv.sys><360安全中心>
  151. [BREGDRV / BREGDRV][Running/System Start]
  152.   <\??\C:\WINDOWS\system32\drivers\bregdrv.sys><360安全中心>
  153. [EfiSystemMon / EfiMon][Running/System Start]
  154.   <System32\Drivers\Efimon.sys><奇虎网>
  155. [Creative AudioPCI (ES1371,ES1373) (WDM) / es1371][Stopped/Manual Start]
  156.   <system32\drivers\es1371mp.sys><Creative Technology Ltd.>
  157. [HookPort / HookPort][Running/Boot Start]
  158.   <\SystemRoot\System32\Drivers\Hookport.sys><360安全中心>
  159. [nv / nv][Running/Manual Start]
  160.   <system32\DRIVERS\nv4_mini.sys><NVIDIA Corporation>
  161. [AMD PCNET Compatable Adapter Driver / PCnet][Stopped/Manual Start]
  162.   <system32\DRIVERS\pcntpci5.sys><AMD Inc.>
  163. [Direct Parallel Link Driver / Ptilink][Running/Manual Start]
  164.   <system32\DRIVERS\ptilink.sys><Parallel Technologies, Inc.>
  165. [qutmipc / qutmipc][Running/System Start]
  166.   <\??\C:\WINDOWS\system32\drivers\qutmipc.sys><360安全中心>
  167. [Realtek 10/100/1000 PCI NIC Family NDIS XP Driver / RTL8023xp][Running/Manual Start]
  168.   <system32\DRIVERS\Rtnicxp.sys><Realtek Semiconductor Corporation>
  169. [Realtek RTL8139(A/B/C)-based PCI Fast Ethernet Adapter NT Driver / rtl8139][Stopped/Manual Start]
  170.   <system32\DRIVERS\RTL8139.SYS><Realtek Semiconductor Corporation>
  171. [Secdrv / Secdrv][Stopped/Manual Start]
  172.   <system32\DRIVERS\secdrv.sys><Macrovision Corporation, Macrovision Europe Limited, and Macrovision Japan and Asia K.K.>
  173. [SiS AGP winXP Filter / sisagp][Running/Boot Start]
  174.   <\SystemRoot\system32\DRIVERS\SISAGPX.sys><Silicon Integrated Systems Corporation>
  175. [SiSide / SiSide][Running/Boot Start]
  176.   <\SystemRoot\system32\DRIVERS\siside.sys><Silicon Integrated Systems Corp.>
  177. [System Restore Filter Driver / sr][Stopped/Boot Start]
  178.   <\SystemRoot\system32\DRIVERS\sr.sys><N/A>
  179. [TCP/IP Protocol Driver / Tcpip][Running/System Start]
  180.   <system32\DRIVERS\tcpip.sys><Microsoft Corporation>
  181. [SbieDrv / SbieDrv][Running/Manual Start]
  182.   <\??\C:\Program Files\Sandboxie\SbieDrv.sys><tzuk>
  183. ==================================




  188. 浏览器加载项
  189. [ThunderAtOnce Class]
  190.   {01443AEC-0FD1-40fd-9C87-E93D1494C233} <C:\Program Files\Thunder Network\Thunder\ComDlls\TDAtOnce_Now.dll, (Signed) 深圳市迅雷网络技术有限公司>
  191. [Thunder Browser Helper]
  192.   {889D2FEB-5411-4565-8998-1DD2C5261283} <C:\Program Files\Thunder Network\Thunder\ComDlls\xunleiBHO_Now.dll, (Signed) 深圳市迅雷网络技术有限公司>
  193. []
  194.   {e2e2dd38-d088-4134-82b7-f2ba38496583} <%windir%\Network Diagnostic\xpnetdiag.exe, (Signed) N/A>
  195. [ThunderAtOnce Class]
  196.   {01443AEC-0FD1-40FD-9C87-E93D1494C233} <C:\Program Files\Thunder Network\Thunder\ComDlls\TDAtOnce_Now.dll, (Signed) 深圳市迅雷网络技术有限公司>
  197. [Windows Genuine Advantage Validation Tool]
  198.   {17492023-C23A-453E-A040-C7C580BBF700} <C:\WINDOWS\system32\legitcheckcontrol.dll, (Signed) Microsoft Corporation>
  199. [InstallHelper Class]
  200.   {1DABF8D5-8430-4985-9B7F-A30E53D709B3} <D:\Program Files\Tencent\QQ\Plugin\Com.Tencent.QQMusic\bin\QQMusic\MMInstaller.dll, (Signed) Tencent>
  201. [HallToolkit Class]
  202.   {1E36C446-29F0-4773-A3FB-59C5501446EB} <C:\Program Files\Thunder Network\Thunder\Program\HallTool.dll, (Signed) 深圳市迅雷网络技术有限公司>
  203. [Thunder Agent Class]
  204.   {485463B7-8FB2-4B3B-B29B-8B919B0EACCE} <C:\Program Files\Thunder Network\Thunder\ComDlls\ThunderAgent5.9.14.1246.dll, (Signed) 深圳市迅雷网络技术有限公司>
  205. [WUWebControl Class]
  206.   {6414512B-B978-451D-A0D8-FCFDF33E833C} <C:\WINDOWS\system32\wuweb.dll, (Signed) Microsoft Corporation>
  207. [Windows Media Player]
  208.   {6BF52A52-394A-11D3-B153-00C04F79FAA6} <C:\WINDOWS\system32\wmp.dll, (Signed) Microsoft Corporation>
  209. [MediaComm Class]
  210.   {7670648D-461B-42AF-BDFE-46D26AF5EFF2} <C:\Program Files\Thunder Network\Thunder\userdata\Components\InMedia\MediaAddin.dll, (Signed) 深圳市迅雷网络技术有限公司>
  211. [360SafeLive]
  212.   {87515F61-A66C-4319-A0E0-D416CB8059E3} <, >
  213. [Thunder Browser Helper]
  214.   {889D2FEB-5411-4565-8998-1DD2C5261283} <C:\Program Files\Thunder Network\Thunder\ComDlls\xunleiBHO_Now.dll, (Signed) 深圳市迅雷网络技术有限公司>
  215. [OFrameObject Class]
  216.   {9701758C-4373-482E-B13C-776C048EC890} <C:\Program Files\Common Files\Thunder Network\KanKan\DapCtrl.2.3.5913.258.(590).dll, (Signed) 深圳市迅雷网络技术有限公司>
  217. [VersionDetector Class]
  218.   {9EFF1953-9694-47B1-AEF6-B2A3FE8BFE9B} <C:\Program Files\Common Files\Thunder Network\KanKan\vd.1.1.0.29.(590).dll, (Signed) 深圳市迅雷网络技术有限公司>
  219. [APlayer Control]
  220.   {A9322148-C691-4B9D-91FC-B9C461DBE9DD} <C:\Program Files\Common Files\Thunder Network\APlayer\APlayer_001.dll, (Signed) ShenZhen Thunder Networking Technologies, LTD>
  221. [DapCtrl Class]
  222.   {ACACC6EB-1FBA-4E13-A729-53AEB2DF54F8} <C:\Program Files\Common Files\Thunder Network\KanKan\DapCtrl.2.3.5913.258.(590).dll, (Signed) 深圳市迅雷网络技术有限公司>
  223. [Shockwave Flash Object]
  224.   {D27CDB6E-AE6D-11CF-96B8-444553540000} <C:\WINDOWS\system32\Macromed\Flash\Flash10c.ocx, (Signed) Adobe Systems, Inc.>
  225. []
  226.   {E2E2DD38-D088-4134-82B7-F2BA38496583} <, >
  227. [XPPlayer Class]
  228.   {F3E70CEA-956E-49CC-B444-73AFE593AD7F} <C:\Program Files\Common Files\Thunder Network\KanKan\PPlayer.2.1.5914.257.(590).dll, (Signed) 深圳市迅雷网络技术有限公司>
  229. []
  230.   {FB5F1910-F110-11D2-BB9E-00C04F795683} <, >
  231. [使用迅雷下载]
  232.   <C:\Program Files\Thunder Network\Thunder\Program\GetUrl.htm, N/A>
  233. [使用迅雷下载全部链接]
  234.   <C:\Program Files\Thunder Network\Thunder\Program\GetAllUrl.htm, N/A>
  235. [使用迅雷离线下载]
  236.   <C:\Program Files\Thunder Network\Thunder\Program\OfflineDownload.htm, N/A>
  237. [导出到 Microsoft Office Excel(&X)]
  238.   <res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000, N/A>
  239. [添加到QQ表情]
  240.   <D:\Program Files\Tencent\QQ\Bin\AddEmotion.htm, N/A>




  245. ==================================
  246. 正在运行的进程
  247. [PID: 536 / SYSTEM][\SystemRoot\System32\smss.exe]  [(Verified) Microsoft Corporation, 5.1.2600.5512 (xpsp.080413-2111)]
  248. [PID: 600 / SYSTEM][\??\C:\WINDOWS\system32\csrss.exe]  [(Verified) Microsoft Corporation, 5.1.2600.5512 (xpsp.080413-2111)]
  249. [PID: 628 / SYSTEM][\??\C:\WINDOWS\system32\winlogon.exe]  [(Infected) Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
  250.     [C:\WINDOWS\system32\uxtheme.dll]  [Microsoft Corporation, 6.00.2900.5512 (xpsp.080413-2105)]
  251. [PID: 676 / SYSTEM][C:\WINDOWS\system32\services.exe]  [(Verified) Microsoft Corporation, 5.1.2600.5755 (xpsp_sp3_gdr.090206-1234)]
  252. [PID: 688 / SYSTEM][C:\WINDOWS\system32\lsass.exe]  [(Verified) Microsoft Corporation, 5.1.2600.5512 (xpsp.080413-2113)]
  253.     [C:\WINDOWS\system32\UxTheme.dll]  [Microsoft Corporation, 6.00.2900.5512 (xpsp.080413-2105)]
  254. [PID: 840 / SYSTEM][C:\WINDOWS\system32\svchost.exe]  [(Verified) Microsoft Corporation, 5.1.2600.5512 (xpsp.080413-2111)]
  255.     [C:\WINDOWS\system32\UxTheme.dll]  [Microsoft Corporation, 6.00.2900.5512 (xpsp.080413-2105)]
  256. [PID: 916 / NETWORK SERVICE][C:\WINDOWS\system32\svchost.exe]  [(Verified) Microsoft Corporation, 5.1.2600.5512 (xpsp.080413-2111)]
  257.     [C:\WINDOWS\system32\UxTheme.dll]  [Microsoft Corporation, 6.00.2900.5512 (xpsp.080413-2105)]
  258. [PID: 952 / SYSTEM][C:\WINDOWS\System32\svchost.exe]  [(Verified) Microsoft Corporation, 5.1.2600.5512 (xpsp.080413-2111)]
  259.     [C:\WINDOWS\System32\UxTheme.dll]  [Microsoft Corporation, 6.00.2900.5512 (xpsp.080413-2105)]
  260.     [c:\windows\system32\msi.dll]  [Microsoft Corporation, 4.5.6001.22159]
  261. [PID: 1004 / NETWORK SERVICE][C:\WINDOWS\system32\svchost.exe]  [(Verified) Microsoft Corporation, 5.1.2600.5512 (xpsp.080413-2111)]
  262.     [C:\WINDOWS\system32\UxTheme.dll]  [Microsoft Corporation, 6.00.2900.5512 (xpsp.080413-2105)]
  263. [PID: 1332 / Administrator][C:\WINDOWS\Explorer.EXE]  [(Verified) Microsoft Corporation, 6.00.2900.5512 (xpsp.080413-2105)]
  264.     [C:\WINDOWS\system32\UxTheme.dll]  [Microsoft Corporation, 6.00.2900.5512 (xpsp.080413-2105)]
  265.     [C:\WINDOWS\system32\msi.dll]  [Microsoft Corporation, 4.5.6001.22159]
  266.     [C:\WINDOWS\system32\nvshell.dll]  [NVIDIA Corporation, 6.14.10.10040]
  267.     [C:\Program Files\Thunder Network\Thunder\ComDlls\TDAtOnce_Now.dll]  [深圳市迅雷网络技术有限公司, 5,9,14,1246]
  268.     [C:\Program Files\Thunder Network\Thunder\ComDlls\ATL71.DLL]  [Microsoft Corporation, 7.10.6101.0]
  269.     [C:\Program Files\Thunder Network\Thunder\ComDlls\MSVCP71.dll]  [Microsoft Corporation, 7.10.6030.0]
  270.     [C:\Program Files\Thunder Network\Thunder\ComDlls\MSVCR71.dll]  [Microsoft Corporation, 7.10.6030.0]
  271.     [C:\Program Files\Thunder Network\Thunder\ComDlls\xunleiBHO_Now.dll]  [深圳市迅雷网络技术有限公司, 5,9,14,1246]
  272.     [C:\Program Files\Thunder Network\Thunder\userdata\Components\ResWorker\DsBho_00.dll]  [深圳市迅雷网络技术有限公司, 1, 0, 0, 26]
  273.     [C:\Program Files\Thunder Network\Thunder\userdata\Components\ResWorker\DataProcessor_00.dll]  [深圳市迅雷网络技术有限公司, 1, 0, 0, 20]
  274.     [C:\Program Files\WinRAR\rarext.dll]  [, ]
  275.     [C:\WINDOWS\system32\shdoclc.dll]  [Microsoft Corporation, 6.00.2900.5512 (xpsp.080413-2105)]
  276. [PID: 1360 / SYSTEM][C:\WINDOWS\system32\spoolsv.exe]  [(Verified) Microsoft Corporation, 5.1.2600.5512 (xpsp.080413-0852)]
  277.     [C:\WINDOWS\system32\UxTheme.dll]  [Microsoft Corporation, 6.00.2900.5512 (xpsp.080413-2105)]
  278.     [C:\WINDOWS\system32\msi.dll]  [Microsoft Corporation, 4.5.6001.22159]
  279. [PID: 1528 / Administrator][C:\WINDOWS\system32\RUNDLL32.EXE]  [Microsoft Corporation, 5.1.2600.5512 (xpsp.080413-2105)]
  280.     [C:\WINDOWS\system32\UxTheme.dll]  [Microsoft Corporation, 6.00.2900.5512 (xpsp.080413-2105)]
  281.     [C:\WINDOWS\system32\NvMcTray.dll]  [NVIDIA Corporation, 6.14.10.7189]
  282.     [C:\WINDOWS\system32\NVRSZHC.DLL]  [NVIDIA Corporation, 6.14.10.7189]
  283. [PID: 1536 / Administrator][C:\WINDOWS\system32\ctfmon.exe]  [(Verified) Microsoft Corporation, 5.1.2600.5512 (xpsp.080413-2105)]
  284.     [C:\WINDOWS\system32\UxTheme.dll]  [Microsoft Corporation, 6.00.2900.5512 (xpsp.080413-2105)]
  285. [PID: 1616 / LOCAL SERVICE][C:\WINDOWS\system32\svchost.exe]  [(Verified) Microsoft Corporation, 5.1.2600.5512 (xpsp.080413-2111)]
  286.     [C:\WINDOWS\system32\UxTheme.dll]  [Microsoft Corporation, 6.00.2900.5512 (xpsp.080413-2105)]
  287. [PID: 1688 / SYSTEM][C:\WINDOWS\system32\nvsvc32.exe]  [NVIDIA Corporation, 6.14.10.7189]
  288.     [C:\WINDOWS\system32\uxtheme.dll]  [Microsoft Corporation, 6.00.2900.5512 (xpsp.080413-2105)]
  289.     [C:\WINDOWS\system32\NVRSZHC.DLL]  [NVIDIA Corporation, 6.14.10.7189]
  290. [PID: 1756 / LOCAL SERVICE][C:\WINDOWS\system32\wdfmgr.exe]  [Microsoft Corporation, 5.2.3790.1230 built by: dnsrv(bld4act)]
  291. [PID: 1932 / LOCAL SERVICE][C:\WINDOWS\system32\svchost.exe]  [(Verified) Microsoft Corporation, 5.1.2600.5512 (xpsp.080413-2111)]
  292.     [C:\WINDOWS\system32\UxTheme.dll]  [Microsoft Corporation, 6.00.2900.5512 (xpsp.080413-2105)]
  293. [PID: 2028 / LOCAL SERVICE][C:\WINDOWS\System32\alg.exe]  [(Verified) Microsoft Corporation, 5.1.2600.5512 (xpsp.080413-0852)]
  294.     [C:\WINDOWS\System32\UxTheme.dll]  [Microsoft Corporation, 6.00.2900.5512 (xpsp.080413-2105)]
  295. [PID: 1552 / Administrator][C:\WINDOWS\system32\conime.exe]  [(Verified) Microsoft Corporation, 5.1.2600.5512 (xpsp.080413-2105)]
  296.     [C:\WINDOWS\system32\UxTheme.dll]  [Microsoft Corporation, 6.00.2900.5512 (xpsp.080413-2105)]
  297. [PID: 1960 / SYSTEM][C:\Program Files\Sandboxie\SbieSvc.exe]  [tzuk, 3.44]
  298.     [C:\Program Files\Sandboxie\SbieDll.dll]  [tzuk, 3.44]
  299. [PID: 1592 / Administrator][C:\Documents and Settings\Administrator\桌面\sreng\SREngLdr.EXE]  [Smallfrogs Studio, 2.8.2.1321]
  300. [PID: 348 / Administrator][C:\Documents and Settings\Administrator\桌面\sreng\SRE27fbf4bb.EXE]  [Smallfrogs Studio, 2.8.2.1321]
  301.     [C:\WINDOWS\system32\uxtheme.dll]  [Microsoft Corporation, 6.00.2900.5512 (xpsp.080413-2105)]
  302.     [C:\Documents and Settings\Administrator\桌面\sreng\Upload\3rdUpd.DLL]  [Smallfrogs Studio, 2, 1, 0, 15]
  303. ==================================



  307. 文件关联
  308. .TXT  Error. [C:\WINDOWS\notepad.exe %1]
  309. .EXE  OK. ["%1" %*]
  310. .COM  OK. ["%1" %*]
  311. .PIF  OK. ["%1" %*]
  312. .REG  OK. [regedit.exe "%1"]
  313. .BAT  OK. ["%1" %*]
  314. .SCR  OK. ["%1" /S]
  315. .CHM  Error. ["hh.exe" %1]
  316. .HLP  OK. [%SystemRoot%\System32\winhlp32.exe %1]
  317. .INI  Error. [C:\WINDOWS\System32\NOTEPAD.EXE %1]
  318. .INF  OK. [%SystemRoot%\System32\NOTEPAD.EXE %1]
  319. .VBS  OK. [%SystemRoot%\System32\WScript.exe "%1" %*]
  320. .JS   OK. [%SystemRoot%\System32\WScript.exe "%1" %*]
  321. .LNK  OK. [{00021401-0000-0000-C000-000000000046}]




  326. ==================================
  327. Winsock 提供者
  328. N/A
  329. ==================================
  330. Autorun.inf
  331. N/A
  332. ==================================
  333. HOSTS 文件
  334. 127.0.0.1       localhost
  335. ==================================
  336. 进程特权扫描
  337. 特殊特权被允许： SeLoadDriverPrivilege [PID = 628, C:\WINDOWS\SYSTEM32\WINLOGON.EXE]
  338. ==================================
  339. 计划任务
  340. [已启用] SogouImeMgr.job
  341.         C:\PROGRA~1\SOGOUI~1\430~1.328\PinyinRepair.exe
  342. ==================================
  343. Windows 安全更新检查
  344. N/A
  345. ==================================
  346. API HOOK
  347. N/A
  348. ==================================
  349. 隐藏进程
  350. N/A
  351. ==================================

复制代码
回复

举报

穿越星空
发表于 2010-2-13 11:37:18 | 显示全部楼层
　　一般要知道系统默认值，然后根据路径以及文件信息判断。
回复

举报

爱吃蔬菜
发表于 2010-2-13 14:28:37 | 显示全部楼层
这个我也不太懂，一般也是看名字看路径了，如果后面有(Verified)，比如微软或其他你知道的公司的一般也不用看了
回复

举报

卡巴007 该用户已被删除
发表于 2010-2-13 14:29:15 | 显示全部楼层
楼主看看这个：
http://bbs.kafan.cn/thread-430997-1-1.html
回复

举报

穿越星空
发表于 2010-2-13 22:57:59 | 显示全部楼层
回复 4# 卡巴007
　　说实话我都没耐心看完这个，佩服你的搜索能力，更佩服那帖楼主的毅力和见识。
回复

举报

卡巴007 该用户已被删除
发表于 2010-2-13 23:02:41 | 显示全部楼层
回复  卡巴007
　　说实话我都没耐心看完这个，佩服你的搜索能力，更佩服那帖楼主的毅力和见识。
穿越星空 发表于 2010-2-13 22:57



我也没看完！
分析日志很枯燥的！
回复

举报

穿越星空
发表于 2010-2-13 23:06:20 | 显示全部楼层
回复 6# 卡巴007
　　的确是，看日志枯燥，看如何看日志的教程更是枯燥。
回复

举报

qsw753
 楼主| 发表于 2010-2-14 23:43:49 | 显示全部楼层
哦，明白了。
谢谢大家~
回复

举报

返回列表 发新帖
高级模式
B Color Image Link Quote Code Smilies
您需要登录后才可以回帖 登录 | 快速注册

本版积分规则

手机版|杀毒软件|软件论坛| 卡饭论坛

Copyright © KaFan  KaFan.cn All Rights Reserved.

Powered by Discuz! X3.4( 沪ICP备2020031077号-2 ) GMT+8, 2025-6-9 05:48 , Processed in 0.157672 second(s), 18 queries .

卡饭网所发布的一切软件、样本、工具、文章等仅限用于学习和研究，不得将上述内容用于商业或者其他非法用途，否则产生的一切后果自负，本站信息来自网络，版权争议问题与本站无关，您必须在下载后的24小时之内从您的电脑中彻底删除上述信息，如有问题请通过邮件与我们联系。

快速回复 客服 返回顶部 返回列表