注册表值UIHOST被修改为非正常值（默认值是logonui.exe)附日志 bbs.ikaka.com

飞舞的风筝 - 2007-5-17 12:08:00

[CODE]

2007-05-17,11:47:56

System Repair Engineer 2.4.12.806
Smallfrogs (http://www.KZTechs.com)

Windows XP Professional Service Pack 1 (Build 2600) - 管理权限用户 - 完整功能

以下内容被选中：
所有的启动项目（包括注册表、启动文件夹、服务等）
浏览器加载项
正在运行的进程（包括进程模块信息）
文件关联
Winsock 提供者
Autorun.inf
HOSTS 文件

启动项目
注册表
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
<ctfmon.exe><C:\WINDOWS\System32\ctfmon.exe> [(Verified)Microsoft Windows XP Publisher]
<MSMSGS><; "C:\Program Files\Messenger\MSMSGS.EXE" /background> [(Verified)Microsoft Corporation]
<STYLEXP><; C:\Program Files\TGTSoft\StyleXP\StyleXP.exe -Hide> []
[HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows]
<load><> [N/A]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
<PHIME2002ASync><C:\WINDOWS\System32\IME\TINTLGNT\TINTSETP.EXE /SYNC> [(Verified)Microsoft Windows XP Publisher]
<PHIME2002A><C:\WINDOWS\System32\IME\TINTLGNT\TINTSETP.EXE /IMEName> [(Verified)Microsoft Windows XP Publisher]
<IgfxTray><C:\WINDOWS\System32\igfxtray.exe> [(Verified)Microsoft Windows Hardware Compatibility Publisher]
<HotKeysCmds><C:\WINDOWS\System32\hkcmd.exe> [(Verified)Microsoft Windows Hardware Compatibility Publisher]
<OrderReminder><C:\Program Files\Hewlett-Packard\OrderReminder\OrderReminder.exe> [Hewlett-Packard]
<paTray><"C:\Program Files\AhnLab\APC2\Policy Agent\patray.exe"> []
<AHNSD><"C:\Program Files\AhnLab\Smart Update Utility\AhnSD.exe"> [(Verified)AhnLab Inc.]
<IMJPMIG8.1><; "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32> [(Verified)Microsoft Windows XP Publisher]
<MpAgent><; C:\Program Files\Zarvasoft\Policy Center\Policy Agent\MaDmon.exe> [Ahnlab, Inc.]
<RemoteControl><; C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe> [Cyberlink Corp.]
<SoundMan><; SOUNDMAN.EXE> [(Verified)Microsoft Windows Hardware Compatibility Publisher]
<Super Rabbit SRRestore><; C:\PROGRA~1\SUPERR~1\MAGICSET\SRRest.exe /FIRST> [N/A]
<SysHotKey_DFDD><; C:\Program Files\Common Files\!SUNV\GraspWord\SysHotKey.exe> [N/A]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
<shell><Explorer.exe> [(Verified)Microsoft Windows XP Publisher]
<Userinit><C:\WINDOWS\system32\userinit.exe,> [(Verified)Microsoft Windows XP Publisher]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Windows]
<AppInit_DLLs><> [N/A]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
<UIHost><C:\Program Files\TGTSoft\StyleXP\CurrentLogon.EXE> []
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\WgaLogon]
<WinlogonNotify: WgaLogon><WgaLogon.dll> [(Verified)Microsoft Corporation]
[HKEY_CURRENT_USER\Control Panel\Desktop]
<SCRNSAVE.EXE><C:\WINDOWS\System32\EARTH3~1.SCR> []

==================================
启动文件夹
N/A

==================================
服务
[AhnLab Task Scheduler / AhnLab Task Scheduler][Running/Auto Start]
<"C:\Program Files\AhnLab\Smart Update Utility\AhnSDsv.exe"><AhnLab, Inc.>
[Diskeeper / Diskeeper][Running/Auto Start]
<C:\Program Files\Executive Software\Diskeeper\DkService.exe><Executive Software International, Inc.>
[Human Interface Device Access / HidServ][Stopped/Disabled]
<C:\WINDOWS\System32\svchost.exe -k netsvcs-->%SystemRoot%\System32\hidserv.dll><N/A>
[Messenger / Messenger][Stopped/Boot Start]
<\SystemRoot\C:\WINDOWS\System32\svchost.exe -k netsvcs-->%SystemRoot%\System32\msgsvc.dll><Microsoft Corporation>
[MonSvcNT / MonSvcNT][Running/Auto Start]
<C:\PROGRA~1\AhnLab\V3\MonSvcNT.exe><AhnLab, Inc.>
[Policy Agent Service V2.5 / paSvc][Running/Auto Start]
<"C:\Program Files\AhnLab\APC2\Policy Agent\pasvc.exe"><AhnLab, Inc.>
[StyleXPService / StyleXPService][Running/Auto Start]
<"C:\Program Files\TGTSoft\StyleXP\StyleXPService.exe"><>
[Portable Media Serial Number Service / WmdmPmSN][Stopped/Manual Start]
<C:\WINDOWS\System32\svchost.exe -k netsvcs-->C:\WINDOWS\System32\mspmsnsv.dll><Microsoft Corporation>

==================================
驱动程序
[AhnFlt2K / AhnFlt2K][Running/Manual Start]
<\??\C:\WINDOWS\System32\Drivers\AhnFlt2K.sys><AhnLab, Inc.>
[AhnRec2K / AhnRec2K][Running/Manual Start]
<\??\C:\WINDOWS\System32\Drivers\AhnRec2K.sys><AhnLab, Inc.>
[Service for WDM 3D Audio Driver / ALCXSENS][Running/Manual Start]
<system32\drivers\ALCXSENS.SYS><Sensaura>
[Service for Realtek AC97 Audio (WDM) / ALCXWDM][Running/Manual Start]
<system32\drivers\ALCXWDM.SYS><Realtek Semiconductor Corp.>
[AnfdIont / AnfdIont][Running/Auto Start]
<\??\C:\WINDOWS\System32\drivers\AnfdIont.sys><AhnLab, Inc.>
[AnfdTDnt / AnfdTDnt][Running/System Start]
<\??\C:\WINDOWS\System32\drivers\AnfdTDnt.sys><AhnLab, Inc.>
[ApfIPXX / ApfIPXX][Stopped/Manual Start]
<\??\C:\PROGRA~1\AhnLab\V3\ApfIPXX.sys><AhnLab, Inc.>
[HOSTNT / HOSTNT][Running/Auto Start]
<\??\C:\WINDOWS\System32\drivers\hostnt.sys><N/A>
[ialm / ialm][Running/Manual Start]
<System32\DRIVERS\ialmnt5.sys><Intel Corporation>
[IdeBusDr / IdeBusDr][Running/Boot Start]
<\SystemRoot\System32\DRIVERS\IdeBusDr.sys><Intel Corporation>
[Intel(R) Ultra ATA Controller / IdeChnDr][Running/Boot Start]
<\SystemRoot\System32\DRIVERS\IdeChnDr.sys><Intel Corporation>
[MHDRV / MHDRV][Running/Auto Start]
<\??\C:\WINDOWS\System32\drivers\mhdrv.sys><SafeNet China Ltd.>
[Direct Parallel Link Driver / Ptilink][Running/Manual Start]
<System32\DRIVERS\ptilink.sys><Parallel Technologies, Inc.>
[RCMHDOG / RCMHDOG][Running/Auto Start]
<\??\C:\WINDOWS\System32\drivers\rcmhdog.sys><SafeNet China Ltd.>
[Realtek RTL8139(A/B/C)-based PCI Fast Ethernet Adapter NT Driver / rtl8139][Running/Manual Start]
<System32\DRIVERS\RTL8139.SYS><Realtek Semiconductor Corporation>
[Secdrv / Secdrv][Stopped/Manual Start]
<System32\DRIVERS\secdrv.sys><N/A>
[Sony USB Filter Driver (SONYPVU1) / SONYPVU1][Stopped/Manual Start]
<System32\DRIVERS\SONYPVU1.SYS><Sony Corporation>
[StyleXPHelper / StyleXPHelper][Running/System Start]
<\??\C:\Program Files\TGTSoft\StyleXP\StyleXPHelper.exe><Windows (R) 2000 DDK provider>
[v3engine / v3engine][Running/Manual Start]
<\??\C:\WINDOWS\System32\drivers\v3engine.sys><AhnLab, Inc.>
[V3Flt2K / V3Flt2K][Running/Manual Start]
<\??\C:\PROGRA~1\AhnLab\V3\V3Flt2K.sys><AhnLab, Inc.>
[V3IFt2K / V3IFt2K][Running/Manual Start]
<\??\C:\PROGRA~1\AhnLab\V3\V3IFt2K.sys><AhnLab, Inc.>
[V3IPXX / V3IPXX][Stopped/Manual Start]
<\??\C:\PROGRA~1\AhnLab\V3\V3IPXX.sys><AhnLab, Inc.>
[V3NfeNt / V3NfeNt][Running/Auto Start]
<\??\C:\Program Files\AhnLab\V3\V3NfeNt.sys><AhnLab, Inc.>
[xmasbus / xmasbus][Running/Boot Start]
<\SystemRoot\System32\DRIVERS\xmasbus.sys><>
[xmasscsi / xmasscsi][Running/Boot Start]
<\SystemRoot\System32\Drivers\xmasscsi.sys><>

==================================
浏览器加载项
[联想]
{6096E38F-5AC1-4391-8EC4-75DFA92FB32F} <http://www.lenovo.com, N/A>
[@shdoclc.dll,-866]
{c95fe080-8f5d-11d2-a20b-00aa003c157a} <, N/A>
[Messenger]
{FB5F1910-F110-11d2-BB9E-00C04F795683} <C:\Program Files\Messenger\MSMSGS.EXE, Microsoft Corporation>
[V3]
{9E3849D6-41EF-4B2F-86B7-632EF90758E4} <"C:\Program Files\AhnLab\V3\V3Bar.dll", N/A>
[Office Update Installation Engine]
{3E68E405-C6DE-49FF-83AE-41EE9F4C36CE} <C:\WINDOWS\opuc.dll, Microsoft Corporation>
[MUWebControl Class]
{6E32070A-766D-4EE6-879C-DC1FA91D2FC3} <C:\WINDOWS\System32\muweb.dll, Microsoft Corporation>
[Shockwave Flash Object]
{D27CDB6E-AE6D-11CF-96B8-444553540000} <C:\WINDOWS\System32\macromed\flash\Flash.ocx, Macromedia, Inc.>
[导出到 Microsoft Excel(&x)]
<res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000, N/A>

飞舞的风筝 - 2007-5-17 12:09:00

正在运行的进程
[PID: 472][\SystemRoot\System32\smss.exe] [Microsoft Corporation, 5.1.2600.1106 (xpsp1.020828-1920)]
[PID: 528][\??\C:\WINDOWS\system32\csrss.exe] [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)]
[PID: 560][\??\C:\WINDOWS\system32\winlogon.exe] [Microsoft Corporation, 5.1.2600.1106 (xpsp1.020828-1920)]
[C:\WINDOWS\system32\WgaLogon.dll] [Microsoft Corporation, 1.7.0018.5]
[C:\WINDOWS\system32\wdmaud.drv] [Microsoft Corporation, 5.1.2600.0 (XPClient.010817-1148)]
[C:\WINDOWS\system32\msacm32.drv] [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)]
[PID: 1264][C:\WINDOWS\Explorer.EXE] [Microsoft Corporation, 6.00.2800.1106 (xpsp1.020828-1920)]
[C:\WINDOWS\System32\wdmaud.drv] [Microsoft Corporation, 5.1.2600.0 (XPClient.010817-1148)]
[C:\WINDOWS\System32\msacm32.drv] [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)]
[C:\Program Files\AhnLab\V3\V3Bar.dll] [AhnLab, Inc., 6, 0, 0, 23]
[C:\Program Files\AhnLab\V3\NLS\bar0804.nls] [AhnLab, Inc., 6, 0, 0, 7]
[C:\WINDOWS\System32\igfxpph.dll] [Intel Corporation, 3.0.0.3762]
[C:\WINDOWS\System32\hccutils.DLL] [Intel Corporation, 3.0.0.3762]
[C:\WINDOWS\System32\igfxres.dll] [Intel Corporation, 3.0.0.3762]
[C:\WINDOWS\System32\igfxsrvc.dll] [Intel Corporation, 3.0.0.3762]
[C:\WINDOWS\System32\igfxdev.dll] [Intel Corporation, 3.0.0.3762]
[C:\Program Files\Microsoft Office\Office10\msohev.dll] [Microsoft Corporation, 10.0.2609]
[C:\Program Files\WinRAR\rarext.dll] [N/A, ]
[C:\Program Files\AhnLab\V3\V3ShllEx.dll] [AhnLab, Inc., 6, 0, 0, 13]
[C:\Program Files\AhnLab\V3\NLS\V3SH0804.nls] [AhnLab, Inc., 6, 0, 0, 7]
[C:\Program Files\EmEditor\EMEDSHL.DLL] [N/A, ]
[PID: 1428][C:\WINDOWS\System32\hkcmd.exe] [Intel Corporation, 3.0.0.3762]
[C:\WINDOWS\System32\hccutils.DLL] [Intel Corporation, 3.0.0.3762]
[C:\WINDOWS\System32\igfxdev.dll] [Intel Corporation, 3.0.0.3762]
[C:\WINDOWS\System32\igfxsrvc.dll] [Intel Corporation, 3.0.0.3762]
[C:\WINDOWS\System32\igfxres.dll] [Intel Corporation, 3.0.0.3762]
[C:\WINDOWS\System32\igfxhk.dll] [Intel Corporation, 3.0.0.3762]
[PID: 1448][C:\Program Files\Hewlett-Packard\OrderReminder\OrderReminder.exe] [Hewlett-Packard, 2, 0, 1, 26]
[PID: 1456][C:\Program Files\AhnLab\APC2\Policy Agent\patray.exe] [, 2, 5, 0, 9]
[C:\Program Files\AhnLab\APC2\Policy Agent\AhnInst.dll] [AhnLab, Inc., 6, 0, 0, 52]
[C:\Program Files\AhnLab\APC2\Policy Agent\MaCfgRw.dll] [AhnLab, 2, 5, 5, 11]
[C:\Program Files\AhnLab\APC2\Policy Agent\IniRW.dll] [AhnLab, 2, 1, 0, 0]
[C:\Program Files\AhnLab\APC2\Policy Agent\MSVCP60.dll] [Microsoft Corporation, 6.00.8168.0]
[C:\Program Files\AhnLab\APC2\Policy Agent\SBase64.dll] [AhnLab, 2, 1, 0, 0]
[C:\Program Files\AhnLab\APC2\Policy Agent\SLogW.dll] [AhnLab, 2, 1, 0, 0]
[C:\Program Files\AhnLab\APC2\Policy Agent\SSync.dll] [AhnLab, 2, 1, 0, 0]
[C:\Program Files\AhnLab\APC2\Policy Agent\AhnI18N.dll] [AhnLab, Inc., 6, 0, 0, 18]
[C:\Program Files\AhnLab\APC2\Policy Agent\MFC42.DLL] [Microsoft Corporation, 6.00.8665.0]
[C:\Program Files\AhnLab\APC2\Policy Agent\NLS\MTRY0804.nls] [, 2, 0, 0, 2]
[PID: 1468][C:\Program Files\AhnLab\Smart Update Utility\AhnSD.exe] [AhnLab, Inc., 5, 5, 0, 7]
[C:\Program Files\AhnLab\Smart Update Utility\NLS\ASD0804.nls] [AhnLab, Inc., 5, 0, 0, 6]
[PID: 1480][C:\WINDOWS\System32\ctfmon.exe] [Microsoft Corporation, 5.1.2600.1106 (xpsp1.020828-1920)]
[PID: 1500][C:\Program Files\Messenger\MSMSGS.EXE] [Microsoft Corporation, 4.7.2010]
[C:\Program Files\Messenger\MSGSLANG.DLL] [Microsoft Corporation, 4.7.2009]
[C:\PROGRA~1\MESSEN~1\rtcimsp.dll] [Microsoft Corporation, 4.0.3599.0 (Lab02_N(ntvbl02).020107-1351)]
[C:\WINDOWS\System32\wdmaud.drv] [Microsoft Corporation, 5.1.2600.0 (XPClient.010817-1148)]
[C:\WINDOWS\System32\msacm32.drv] [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)]
[C:\WINDOWS\System32\msdmo.dll] [, ]
[PID: 1680][C:\Program Files\AhnLab\V3\MonSysNT.exe] [AhnLab, Inc., 6, 1, 0, 91]
[C:\Program Files\AhnLab\V3\V3CfgE.dll] [AhnLab, Inc., 6, 0, 0, 96]
[C:\Program Files\AhnLab\V3\MSVCP60.dll] [Microsoft Corporation, 6.00.8972.0]
[C:\Program Files\AhnLab\V3\V3SSCtrl.dll] [AhnLab, Inc., 6, 0, 0, 100]
[C:\Program Files\AhnLab\V3\AhnI18N.dll] [AhnLab, Inc., 6, 0, 0, 18]
[C:\Program Files\AhnLab\V3\MFC42.DLL] [Microsoft Corporation, 6.00.8665.0]
[C:\Program Files\AhnLab\V3\NLS\Mon0804.nls] [AhnLab, Inc., 6, 0, 0, 26]
[C:\Program Files\AhnLab\V3\AhnAlert.dll] [AhnLab, Inc., 6, 0, 0, 17]
[PID: 1692][C:\Program Files\AhnLab\V3\V3P3AT.exe] [AhnLab, Inc., 6, 1, 0, 201]
[C:\Program Files\AhnLab\V3\v3if.dll] [AhnLab, Inc., 6, 1, 0, 3]
[C:\Program Files\AhnLab\V3\V3CfgE.dll] [AhnLab, Inc., 6, 0, 0, 96]
[C:\Program Files\AhnLab\V3\MSVCP60.dll] [Microsoft Corporation, 6.00.8972.0]
[C:\Program Files\AhnLab\V3\V3DrEx.dll] [AhnLab, Inc., 7, 0, 0, 112]
[C:\Program Files\AhnLab\V3\V3P3ATHL.dll] [AhnLab, Inc., 6, 0, 0, 23]
[C:\Program Files\AhnLab\V3\AhnI18N.dll] [AhnLab, Inc., 6, 0, 0, 18]
[C:\Program Files\AhnLab\V3\V3MsgFlt.dll] [AhnLab, Inc., 6, 0, 0, 63]
[C:\Program Files\AhnLab\V3\MFC42.DLL] [Microsoft Corporation, 6.00.8665.0]
[C:\Program Files\AhnLab\V3\V3NfCtl.dll] [AhnLab, Inc., 6, 0, 0, 3]
[C:\Program Files\AhnLab\V3\AnfdCtrl.dll] [AhnLab, Inc., 2, 0, 0, 12]
[C:\Program Files\AhnLab\V3\AhnCtlKD.dll] [AhnLab, Inc., 1, 0, 1, 7]
[C:\Program Files\AhnLab\V3\AhnIConv.dll] [AhnLab, Inc., 1, 0, 0, 1]
[C:\Program Files\AhnLab\V3\NLS\V3Dr0804.nls] [AhnLab, Inc., 7, 0, 0, 8]
[C:\Program Files\AhnLab\V3\NLS\V3MF0804.nls] [AhnLab, Inc., 6, 0, 0, 8]
[C:\Program Files\AhnLab\V3\v3logex.dll] [AhnLab, Inc., 6, 1, 0, 2]
[C:\Program Files\AhnLab\V3\NLS\p3at0804.nls] [AhnLab, Inc., 6, 0, 0, 14]
[C:\Program Files\AhnLab\V3\System\4\V3pro32e.dll] [AhnLab, Inc., 2007,05,16,01]
[C:\WINDOWS\System32\v3w32se2.dll] [Ahnlab, Inc., 2002, 12, 16, 1]
[C:\Program Files\AhnLab\V3\V3SR32.dll] [AhnLab, Inc., 5, 0, 0, 2]
[C:\Program Files\AhnLab\V3\V3azex.dll] [AhnLab, Inc., 5, 0, 0, 14]
[C:\Program Files\AhnLab\V3\AZMain.DLL] [ESTSoft Corp, 3.6.9.543]
[C:\Program Files\AhnLab\V3\V3MailDt.dll] [AhnLab, Inc., 6, 0, 0, 91]
[PID: 1956][C:\WINDOWS\System32\WgaTray.exe] [Microsoft Corporation, 1.7.0018.5]
[PID: 3692][C:\PROGRA~1\AhnLab\V3\V3IMPro.exe] [AhnLab, Inc., 6, 0, 0, 33]
[C:\PROGRA~1\AhnLab\V3\V3IM.dll] [AhnLab, Inc., 6, 0, 0, 47]
[C:\PROGRA~1\AhnLab\V3\V3Ift.dll] [AhnLab, Inc., 6, 0, 0, 5]
[C:\PROGRA~1\AhnLab\V3\AhnCtlKD.dll] [AhnLab, Inc., 1, 0, 1, 7]
[C:\PROGRA~1\AhnLab\V3\NLS\V3IM0804.nls] [AhnLab, Inc., 6, 0, 0, 8]
[C:\PROGRA~1\AhnLab\V3\V3CfgE.dll] [AhnLab, Inc., 6, 0, 0, 96]
[C:\PROGRA~1\AhnLab\V3\MSVCP60.dll] [Microsoft Corporation, 6.00.8972.0]
[PID: 2296][C:\Program Files\WinRAR\WinRAR.exe] [Eugene Roshal, 3.30]
[PID: 2292][C:\Program Files\WinRAR\WinRAR.exe] [Eugene Roshal, 3.30]
[PID: 2332][C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\Rar$EX03.203\SREng.EXE] [Smallfrogs Studio, 2.4.12.806]

==================================
文件关联
.TXT OK. [%SystemRoot%\system32\NOTEPAD.EXE %1]
.EXE OK. ["%1" %*]
.COM OK. ["%1" %*]
.PIF OK. ["%1" %*]
.REG OK. [regedit.exe "%1"]
.BAT OK. ["%1" %*]
.SCR OK. ["%1" /S]
.CHM OK. ["C:\WINDOWS\hh.exe" %1]
.HLP OK. [%SystemRoot%\system32\winhlp32.exe %1]
.INI OK. [%SystemRoot%\system32\NOTEPAD.EXE %1]
.INF OK. [%SystemRoot%\system32\NOTEPAD.EXE %1]
.VBS OK. [%SystemRoot%\System32\WScript.exe "%1" %*]
.JS OK. [%SystemRoot%\System32\WScript.exe "%1" %*]
.LNK OK. [{00021401-0000-0000-C000-000000000046}]

==================================
Winsock 提供者
N/A

==================================
Autorun.inf
N/A

==================================
HOSTS 文件
127.0.0.1 localhost

==================================
API HOOK
N/A

==================================
隐藏进程
N/A

==================================

[/CODE]

瑞星卡卡安全论坛