求怎样清除Backdoor.Gpigeon.kxh木马 - 瑞星卡卡安全论坛bbs.ikaka.com

瑞星卡卡安全论坛技术交流区 反病毒/反流氓软件论坛求怎样清除Backdoor.Gpigeon.kxh木马

	瑞星“1+2”全新解决方案巡展在广州画上圆满句号		叶院长揭秘：瑞星如何运用AI技术革新网络安全		俄乌冲突加剧网络攻击风险白俄罗斯政府遭APT攻击		瑞星ESM防病毒系统助力矿业大学筑牢网络安全防线
	实力拉满瑞星第五十次通过VB100测评		携手老友，拥抱新精彩 —— 新论坛新活动，感谢你的陪伴		护航司法，瑞星助力山西省高院构建安全防线		人工智能在网络安全领域的风险和机遇

12

1 / 2 页

跳转页

求怎样清除Backdoor.Gpigeon.kxh木马

xbqiu 初生襁褓狮帖子:43 注册: 2006-12-13 来自:	发表于： 2006-12-17 21:58 \| 只看楼主短消息资料字号：小中大 1楼求怎样清除Backdoor.Gpigeon.kxh木马瑞星查出IEXPLORE.EXE 中了Backdoor.Gpigeon.kxh木马，路径C:\program files\internet explorer\IEXPLORE.EXE ->Backdoor.Gpigeon.kxh，瑞星扫描后显示清除成功，但重启扫描木马依然还在，怎样处理？好几天都没法解决，再次求救了 2007-02-27 15:29:04
xbqiu 初生襁褓狮帖子:43 注册: 2006-12-13 来自:	分享到：

红夜鬼1 横据古稀狮帖子:8602 注册: 2006-10-18 来自:	发表于： 2006-12-17 22:00 \| 短消息资料字号：小中大 2楼请下载SREng2（最新版），使用“智能扫描”，按下“扫描”按钮进行扫描，扫描完成后按下“保存报告”按钮保存报告日志文件（SREng.LOG），把保存的报告日志文件内容复制-粘贴上来,,日志一次粘不完，分次粘完，请不要修改。下载地址 http://www.kztechs.com/sreng/sreng2.zip
红夜鬼1 横据古稀狮帖子:8602 注册: 2006-10-18 来自:

xbqiu 初生襁褓狮帖子:43 注册: 2006-12-13 来自:	发表于： 2006-12-19 22:54 \| 只看楼主短消息资料字号：小中大 3楼 HijackThis_815汉化版扫描日志 V1.99.1 保存于 XB Qiu22:43:26, 日期 2006-12-19 操作系统： Windows XP SP2 (WinNT 5.01.2600) 浏览器： Internet Explorer v6.00 SP2 (6.00.2900.2180) 当前运行的进程： C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe D:\Rising\Rav\CCenter.exe C:\WINDOWS\System32\svchost.exe D:\Rising\Rav\Ravmond.exe d:\rising\rfw\rfwsrv.exe C:\WINDOWS\system32\spoolsv.exe C:\Program Files\Common Files\LightScribe\LSSrvc.exe C:\WINDOWS\system32\nvsvc32.exe C:\WINDOWS\system32\svchost.exe D:\Rising\Rav\RavStub.exe C:\WINDOWS\Explorer.EXE d:\rising\rfw\RfwMain.exe D:\Rising\Rav\RavTask.exe C:\WINDOWS\SOUNDMAN.EXE D:\Rising\Rav\Ravmon.exe C:\Program Files\Rising\AntiSpyware\runiep.exe C:\WINDOWS\system32\ctfmon.exe C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe C:\Program Files\Common Files\Ahead\Lib\NMIndexStoreSvr.exe D:\Maxthon\Maxthon.exe D:\Rising\Rav\Rav.exe C:\Documents and Settings\qiuxiaobo\桌面\Hijackthis1991zww\HijackThis1991zww.exe O2 - BHO: 超级兔子上网精灵 - {7369D35A-5B70-4A5B-B789-B25FE09B4AF3} - D:\MagicSet\haokanbar.dll O3 - IE工具栏增项: 超级兔子上网精灵 - {43869BB3-22FD-4F15-9B46-238106BA2F4E} - D:\MagicSet\haokanbar.dll O4 - 启动项HKLM\\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup O4 - 启动项HKLM\\Run: [RavTask] "D:\Rising\Rav\RavTask.exe" -system O4 - 启动项HKLM\\Run: [SoundMan] SOUNDMAN.EXE O4 - 启动项HKLM\\Run: [RfwMain] "D:\Rising\Rfw\rfwmain.exe" -Startup O4 - 启动项HKLM\\Run: [MSConfig] C:\WINDOWS\PCHealth\HelpCtr\Binaries\MSConfig.exe /auto O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe" O8 - IE右键菜单中的新增项目: &使用迅雷下载 - D:\Thunder\Program\geturl.htm O8 - IE右键菜单中的新增项目: 上传到QQ网络硬盘 - D:\Tencent\QQ\AddToNetDisk.htm O8 - IE右键菜单中的新增项目: 添加到QQ自定义面板 - D:\Tencent\QQ\AddPanel.htm O8 - IE右键菜单中的新增项目: 添加到QQ表情 - D:\Tencent\QQ\AddEmotion.htm O8 - IE右键菜单中的新增项目: 用QQ彩信发送该图片 - D:\Tencent\QQ\SendMMS.htm O9 - 浏览器额外的按钮: 启动迅雷5 - {09BA8F6D-CB54-424B-839C-C2A6C8E6B436} - D:\Thunder\Thunder.exe O9 - 浏览器额外的“工具”菜单项: 启动迅雷5 - {09BA8F6D-CB54-424B-839C-C2A6C8E6B436} - D:\Thunder\Thunder.exe O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1162559432406 O16 - DPF: {9F1C11AA-197B-4942-BA54-47A8489BB47F} - https://v4.windowsupdate.microsoft.com/CAB/x86/unicode/iuctl.CAB?39024.2299652778 O17 - HKLM\System\CCS\Services\Tcpip\..\{5F368919-ECF8-4512-9CE7-DC9AB389785B}: NameServer = 202.96.134.133,202.96.128.86 O17 - HKLM\System\CS1\Services\Tcpip\..\{5F368919-ECF8-4512-9CE7-DC9AB389785B}: NameServer = 202.96.128.86,202.96.134.133 O17 - HKLM\System\CS2\Services\Tcpip\..\{5F368919-ECF8-4512-9CE7-DC9AB389785B}: NameServer = 202.96.134.133,202.96.128.86 O17 - HKLM\System\CS3\Services\Tcpip\..\{5F368919-ECF8-4512-9CE7-DC9AB389785B}: NameServer = 202.96.134.133,202.96.128.86 O18 - 列举现有的协议: KuGoo3 - {6AC4FBC7-AA38-45EC-9634-D6D20B679EFC} - D:\KuGoo3\InExtend\KuGoo3DownXControl.ocx O23 - NT 服务: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe O23 - NT 服务: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe O23 - NT 服务: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe O23 - NT 服务: Rising Proxy Service (RfwProxySrv) - Beijing Rising Technology Co., Ltd. - d:\rising\rfw\rfwproxy.exe O23 - NT 服务: Rising Personal Firewall Service (RfwService) - Beijing Rising Technology Co., Ltd. - d:\rising\rfw\rfwsrv.exe O23 - NT 服务: Rising Process Communication Center (RsCCenter) - Beijing Rising Technology Co., Ltd. - D:\Rising\Rav\CCenter.exe O23 - NT 服务: Rising RealTime Monitor (RsRavMon) - Beijing Rising Technology Co., Ltd. - D:\Rising\Rav\Ravmond.exe O23 - NT 服务: SoundMAX - Unknown owner - C:\Program Files\Common Files\Microsoft Shared\MSINFO\lsass.exe
xbqiu 初生襁褓狮帖子:43 注册: 2006-12-13 来自:

怀安LEDA電腦初生襁褓狮帖子:206 注册: 2006-11-18 来自:	发表于： 2006-12-19 23:02 \| 短消息资料字号：小中大 4楼应该在驱动文件里，但是你的扫描不全，建议去网上下个专杀工具试试吧/
怀安LEDA電腦初生襁褓狮帖子:206 注册: 2006-11-18 来自:

xbqiu 初生襁褓狮帖子:43 注册: 2006-12-13 来自:	发表于： 2006-12-19 23:10 \| 只看楼主短消息资料字号：小中大 5楼未知家族病毒分析扫描结果: C:\program files\internet explorer\IEXPLORE.EXE --> 与 Backdoor.RWX.2005 66%相似. 系统活动进程 C:\WINDOWS\SYSTEM32\ALG.EXE C:\WINDOWS\SYSTEM32\SMSS.EXE C:\WINDOWS\SYSTEM32\CSRSS.EXE C:\WINDOWS\SYSTEM32\WINLOGON.EXE C:\WINDOWS\SYSTEM32\MSACM32.DRV C:\WINDOWS\SYSTEM32\SERVICES.EXE C:\WINDOWS\SYSTEM32\LSASS.EXE C:\WINDOWS\SYSTEM32\SVCHOST.EXE C:\WINDOWS\SYSTEM32\SVCHOST.EXE C:\WINDOWS\SYSTEM32\SVCHOST.EXE C:\WINDOWS\EXPLORER.EXE C:\PROGRAM FILES\RISING\ANTISPYWARE\IEPROT.DLL C:\WINDOWS\SYSTEM32\MSACM32.DRV C:\WINDOWS\SYSTEM32\NVCPL.DLL C:\WINDOWS\SYSTEM32\NVRSZHC.DLL C:\WINDOWS\SYSTEM32\NVSHELL.DLL C:\WINDOWS\SYSTEM32\SVCHOST.EXE D:\RISING\RFW\RFWMAIN.EXE D:\RISING\RFW\RSGUILIB.DLL D:\RISING\RFW\RSCOMMON.DLL D:\RISING\RFW\RFWCTRL.DLL D:\RISING\RFW\RSXML.DLL D:\RISING\RFW\PNGDLL.DLL C:\PROGRAM FILES\RISING\ANTISPYWARE\IEPROT.DLL C:\WINDOWS\SYSTEM32\SVCHOST.EXE D:\RISING\RFW\RFWSRV.EXE D:\RISING\RFW\RFWRULE.DLL D:\RISING\RFW\RFWLOG.DLL D:\RISING\RFW\RFWDRV.DLL D:\RISING\RFW\PSAPI.DLL D:\RISING\RFW\MONDRV.DLL D:\RISING\RFW\PROCLIB.DLL D:\RISING\RFW\MPORTS.DLL C:\WINDOWS\SYSTEM32\SPOOLSV.EXE C:\WINDOWS\SYSTEM32\MDIMON.DLL C:\WINDOWS\SYSTEM32\VSMON1.DLL C:\WINDOWS\SYSTEM32\SPOOL\PRTPROCS\W32X86\MDIPPR.DLL C:\WINDOWS\SOUNDMAN.EXE C:\PROGRAM FILES\RISING\ANTISPYWARE\IEPROT.DLL C:\PROGRAM FILES\COMMON FILES\LIGHTSCRIBE\LSSRVC.EXE C:\PROGRAM FILES\COMMON FILES\LIGHTSCRIBE\MSVCR71.DLL C:\PROGRAM FILES\COMMON FILES\LIGHTSCRIBE\MSVCP71.DLL C:\WINDOWS\SYSTEM32\NVSVC32.EXE C:\WINDOWS\SYSTEM32\CTFMON.EXE C:\PROGRAM FILES\RISING\ANTISPYWARE\IEPROT.DLL C:\PROGRAM FILES\INTERNET EXPLORER\IEXPLORE.EXE C:\WINDOWS\SYSTEM32\SVCHOST.EXE C:\WINDOWS\SYSTEM32\WUAUCLT.EXE C:\DOCUMENTS AND SETTINGS\QIUXIAOBO\桌面\RSDETECT.EXE C:\PROGRAM FILES\RISING\ANTISPYWARE\IEPROT.DLL
xbqiu 初生襁褓狮帖子:43 注册: 2006-12-13 来自:

xbqiu 初生襁褓狮帖子:43 注册: 2006-12-13 来自:	发表于： 2006-12-19 23:10 \| 只看楼主短消息资料字号：小中大 6楼通自启动项 HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run NvCplDaemon = RUNDLL32.EXE C:\WINDOWS\SYSTEM32\NVCPL.DLL,NVSTARTUP RavTask = "D:\RISING\RAV\RAVTASK.EXE" -SYSTEM SoundMan = SOUNDMAN.EXE RfwMain = "D:\RISING\RFW\RFWMAIN.EXE" -STARTUP runeip = C:\PROGRAM FILES\RISING\ANTISPYWARE\RUNIEP.EXE HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run ctfmon.exe = C:\WINDOWS\SYSTEM32\CTFMON.EXE AppInit_DLLs HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows AppInit_DLLs = 系统文件关联 .exe ==> exefile = "%1" %* .com ==> comfile = "%1" %* .cmd ==> cmdfile = "%1" %* .bat ==> batfile = "%1" %* .txt ==> txtfile = %SystemRoot%\system32\NOTEPAD.EXE %1 .scr ==> scrfile = "%1" /S .reg ==> regfile = regedit.exe "%1" .doc ==> Word.Document.8 = "D:\Microsoft Office\OFFICE11\WINWORD.EXE" /n /dde 其它启动项 WIN.INI 无信息 SYSTEM.INI SHELL = Explorer.exe SCRNSAVE.EXE = C:\WINDOWS\system32\logon.scr Winlogon 启动项 HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify crypt32chain = CRYPT32.DLL cryptnet = CRYPTNET.DLL cscdll = CSCDLL.DLL ScCertProp = WLNOTIFY.DLL Schedule = WLNOTIFY.DLL sclgntfy = SCLGNTFY.DLL SensLogn = WLNOTIFY.DLL termsrv = WLNOTIFY.DLL wlballoon = WLNOTIFY.DLL HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon Userinit = C:\WINDOWS\SYSTEM32\USERINIT.EXE, shell = EXPLORER.EXE IE - BHO HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects {7369D359-5B70-4A5B-B789-B25FE09B4AF3} = D:\Thunder\ComDlls\XunLeiBHO_002.dll {7369D35A-5B70-4A5B-B789-B25FE09B4AF3} = D:\MagicSet\haokanbar.dll Winsock SPI MSAFD Tcpip [TCP/IP] = C:\WINDOWS\SYSTEM32\MSWSOCK.DLL MSAFD Tcpip [UDP/IP] = C:\WINDOWS\SYSTEM32\MSWSOCK.DLL MSAFD Tcpip [RAW/IP] = C:\WINDOWS\SYSTEM32\MSWSOCK.DLL RSVP UDP Service Provider = C:\WINDOWS\SYSTEM32\RSVPSP.DLL RSVP TCP Service Provider = C:\WINDOWS\SYSTEM32\RSVPSP.DLL MSAFD NetBIOS [\Device\NetBT_Tcpip_{5F368919-ECF8-4512-9CE7-DC9AB389785B}] SEQPACKET 0 = C:\WINDOWS\SYSTEM32\MSWSOCK.DLL MSAFD NetBIOS [\Device\NetBT_Tcpip_{5F368919-ECF8-4512-9CE7-DC9AB389785B}] DATAGRAM 0 = C:\WINDOWS\SYSTEM32\MSWSOCK.DLL MSAFD NetBIOS [\Device\NetBT_Tcpip_{B6B397DF-C1A6-45EA-B906-2445EA6A4DEC}] SEQPACKET 1 = C:\WINDOWS\SYSTEM32\MSWSOCK.DLL MSAFD NetBIOS [\Device\NetBT_Tcpip_{B6B397DF-C1A6-45EA-B906-2445EA6A4DEC}] DATAGRAM 1 = C:\WINDOWS\SYSTEM32\MSWSOCK.DLL MSAFD NetBIOS [\Device\NetBT_Tcpip_{70C8F65E-9BF3-47CF-9514-DBF01FB00612}] SEQPACKET 2 = C:\WINDOWS\SYSTEM32\MSWSOCK.DLL MSAFD NetBIOS [\Device\NetBT_Tcpip_{70C8F65E-9BF3-47CF-9514-DBF01FB00612}] DATAGRAM 2 = C:\WINDOWS\SYSTEM32\MSWSOCK.DLL
xbqiu 初生襁褓狮帖子:43 注册: 2006-12-13 来自:

鸟儿天上飞叱咤花甲狮帖子:2332 注册: 2006-11-30 来自:	发表于： 2006-12-19 23:11 \| 短消息资料字号：小中大 7楼请下载SREng2（最新版），使用“智能扫描”，按下“扫描”按钮进行扫描，扫描完成后按下“保存报告”按钮保存报告日志文件（SREng.LOG），把保存的报告日志文件内容复制-粘贴上来,,日志一次粘不完，分次粘完，请不要修改。下载地址 http://www.kztechs.com/sreng/sreng2.zip
鸟儿天上飞叱咤花甲狮帖子:2332 注册: 2006-11-30 来自:

xbqiu 初生襁褓狮帖子:43 注册: 2006-12-13 来自:	发表于： 2006-12-19 23:11 \| 只看楼主短消息资料字号：小中大 8楼系统服务项 HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services Adobe LM Service = "C:\PROGRAM FILES\COMMON FILES\ADOBE SYSTEMS SHARED\SERVICE\ADOBELMSVC.EXE" Alerter = C:\WINDOWS\SYSTEM32\SVCHOST.EXE -K LOCALSERVICE ALG = C:\WINDOWS\SYSTEM32\ALG.EXE AppMgmt = C:\WINDOWS\SYSTEM32\SVCHOST.EXE -K NETSVCS AudioSrv = C:\WINDOWS\SYSTEM32\SVCHOST.EXE -K NETSVCS BITS = C:\WINDOWS\SYSTEM32\SVCHOST.EXE -K NETSVCS Browser = C:\WINDOWS\SYSTEM32\SVCHOST.EXE -K NETSVCS CiSvc = C:\WINDOWS\SYSTEM32\CISVC.EXE ClipSrv = C:\WINDOWS\SYSTEM32\CLIPSRV.EXE COMSysApp = C:\WINDOWS\SYSTEM32\DLLHOST.EXE /PROCESSID:{02D4B3F1-FD88-11D1-960D-00805FC79235} CryptSvc = C:\WINDOWS\SYSTEM32\SVCHOST.EXE -K NETSVCS DcomLaunch = C:\WINDOWS\SYSTEM32\SVCHOST -K DCOMLAUNCH Dhcp = C:\WINDOWS\SYSTEM32\SVCHOST.EXE -K NETSVCS dmadmin = C:\WINDOWS\SYSTEM32\DMADMIN.EXE /COM dmserver = C:\WINDOWS\SYSTEM32\SVCHOST.EXE -K NETSVCS Dnscache = C:\WINDOWS\SYSTEM32\SVCHOST.EXE -K NETWORKSERVICE ERSvc = C:\WINDOWS\SYSTEM32\SVCHOST.EXE -K NETSVCS Eventlog = C:\WINDOWS\SYSTEM32\SERVICES.EXE EventSystem = C:\WINDOWS\SYSTEM32\SVCHOST.EXE -K NETSVCS FastUserSwitchingCompatibility = C:\WINDOWS\SYSTEM32\SVCHOST.EXE -K NETSVCS helpsvc = C:\WINDOWS\SYSTEM32\SVCHOST.EXE -K NETSVCS HidServ = C:\WINDOWS\SYSTEM32\SVCHOST.EXE -K NETSVCS HTTPFilter = C:\WINDOWS\SYSTEM32\SVCHOST.EXE -K HTTPFILTER ImapiService = C:\WINDOWS\SYSTEM32\IMAPI.EXE lanmanserver = C:\WINDOWS\SYSTEM32\SVCHOST.EXE -K NETSVCS lanmanworkstation = C:\WINDOWS\SYSTEM32\SVCHOST.EXE -K NETSVCS LightScribeService = "C:\PROGRAM FILES\COMMON FILES\LIGHTSCRIBE\LSSRVC.EXE" LmHosts = C:\WINDOWS\SYSTEM32\SVCHOST.EXE -K LOCALSERVICE Messenger = C:\WINDOWS\SYSTEM32\SVCHOST.EXE -K NETSVCS mnmsrvc = C:\WINDOWS\SYSTEM32\MNMSRVC.EXE MSDTC = C:\WINDOWS\SYSTEM32\MSDTC.EXE MSIServer = C:\WINDOWS\SYSTEM32\MSIEXEC.EXE /V NBService = C:\PROGRAM FILES\NERO\NERO 7\NERO BACKITUP\NBSERVICE.EXE NetDDE = C:\WINDOWS\SYSTEM32\NETDDE.EXE NetDDEdsdm = C:\WINDOWS\SYSTEM32\NETDDE.EXE Netlogon = C:\WINDOWS\SYSTEM32\LSASS.EXE Netman = C:\WINDOWS\SYSTEM32\SVCHOST.EXE -K NETSVCS Nla = C:\WINDOWS\SYSTEM32\SVCHOST.EXE -K NETSVCS NtLmSsp = C:\WINDOWS\SYSTEM32\LSASS.EXE NtmsSvc = C:\WINDOWS\SYSTEM32\SVCHOST.EXE -K NETSVCS NVSvc = C:\WINDOWS\SYSTEM32\NVSVC32.EXE ose = "C:\PROGRAM FILES\COMMON FILES\MICROSOFT SHARED\SOURCE ENGINE\OSE.EXE" PlugPlay = C:\WINDOWS\SYSTEM32\SERVICES.EXE PolicyAgent = C:\WINDOWS\SYSTEM32\LSASS.EXE ProtectedStorage = C:\WINDOWS\SYSTEM32\LSASS.EXE RasAuto = C:\WINDOWS\SYSTEM32\SVCHOST.EXE -K NETSVCS RasMan = C:\WINDOWS\SYSTEM32\SVCHOST.EXE -K NETSVCS RDSessMgr = C:\WINDOWS\SYSTEM32\SESSMGR.EXE RemoteAccess = C:\WINDOWS\SYSTEM32\SVCHOST.EXE -K NETSVCS RemoteRegistry = C:\WINDOWS\SYSTEM32\SVCHOST.EXE -K LOCALSERVICE RfwProxySrv = D:\RISING\RFW\RFWPROXY.EXE RfwService = D:\RISING\RFW\RFWSRV.EXE RpcLocator = C:\WINDOWS\SYSTEM32\LOCATOR.EXE RpcSs = C:\WINDOWS\SYSTEM32\SVCHOST -K RPCSS RsCCenter = "D:\RISING\RAV\CCENTER.EXE" RsRavMon = "D:\RISING\RAV\RAVMOND.EXE" RSVP = C:\WINDOWS\SYSTEM32\RSVP.EXE SamSs = C:\WINDOWS\SYSTEM32\LSASS.EXE SCardSvr = C:\WINDOWS\SYSTEM32\SCARDSVR.EXE Schedule = C:\WINDOWS\SYSTEM32\SVCHOST.EXE -K NETSVCS seclogon = C:\WINDOWS\SYSTEM32\SVCHOST.EXE -K NETSVCS SENS = C:\WINDOWS\SYSTEM32\SVCHOST.EXE -K NETSVCS SharedAccess = C:\WINDOWS\SYSTEM32\SVCHOST.EXE -K NETSVCS ShellHWDetection = C:\WINDOWS\SYSTEM32\SVCHOST.EXE -K NETSVCS SoundMAX = C:\PROGRAM FILES\COMMON FILES\MICROSOFT SHARED\MSINFO\LSASS.EXE Spooler = C:\WINDOWS\SYSTEM32\SPOOLSV.EXE srservice = C:\WINDOWS\SYSTEM32\SVCHOST.EXE -K NETSVCS SSDPSRV = C:\WINDOWS\SYSTEM32\SVCHOST.EXE -K LOCALSERVICE stisvc = C:\WINDOWS\SYSTEM32\SVCHOST.EXE -K IMGSVC SwPrv = C:\WINDOWS\SYSTEM32\DLLHOST.EXE /PROCESSID:{C6E3920F-A937-432E-ACD8-01D4634AE009} SysmonLog = C:\WINDOWS\SYSTEM32\SMLOGSVC.EXE TapiSrv = C:\WINDOWS\SYSTEM32\SVCHOST.EXE -K NETSVCS TermService = C:\WINDOWS\SYSTEM32\SVCHOST -K DCOMLAUNCH Themes = C:\WINDOWS\SYSTEM32\SVCHOST.EXE -K NETSVCS TlntSvr = C:\WINDOWS\SYSTEM32\TLNTSVR.EXE TrkWks = C:\WINDOWS\SYSTEM32\SVCHOST.EXE -K NETSVCS UMWdf = C:\WINDOWS\SYSTEM32\WDFMGR.EXE upnphost = C:\WINDOWS\SYSTEM32\SVCHOST.EXE -K LOCALSERVICE UPS = C:\WINDOWS\SYSTEM32\UPS.EXE VSS = C:\WINDOWS\SYSTEM32\VSSVC.EXE W32Time = C:\WINDOWS\SYSTEM32\SVCHOST.EXE -K NETSVCS WebClient = C:\WINDOWS\SYSTEM32\SVCHOST.EXE -K LOCALSERVICE winmgmt = C:\WINDOWS\SYSTEM32\SVCHOST.EXE -K NETSVCS WmdmPmSN = C:\WINDOWS\SYSTEM32\SVCHOST.EXE -K NETSVCS Wmi = C:\WINDOWS\SYSTEM32\SVCHOST.EXE -K NETSVCS WmiApSrv = C:\WINDOWS\SYSTEM32\WBEM\WMIAPSRV.EXE wscsvc = C:\WINDOWS\SYSTEM32\SVCHOST.EXE -K NETSVCS wuauserv = C:\WINDOWS\SYSTEM32\SVCHOST.EXE -K NETSVCS WZCSVC = C:\WINDOWS\SYSTEM32\SVCHOST.EXE -K NETSVCS xmlprov = C:\WINDOWS\SYSTEM32\SVCHOST.EXE -K NETSVCS
xbqiu 初生襁褓狮帖子:43 注册: 2006-12-13 来自:

xbqiu 初生襁褓狮帖子:43 注册: 2006-12-13 来自:	发表于： 2006-12-19 23:11 \| 只看楼主短消息资料字号：小中大 9楼文件驱动 HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services FltMgr = C:\WINDOWS\SYSTEM32\DRIVERS\FLTMGR.SYS MRxDAV = C:\WINDOWS\SYSTEM32\DRIVERS\MRXDAV.SYS MRxSmb = C:\WINDOWS\SYSTEM32\DRIVERS\MRXSMB.SYS NetBIOS = C:\WINDOWS\SYSTEM32\DRIVERS\NETBIOS.SYS Rdbss = C:\WINDOWS\SYSTEM32\DRIVERS\RDBSS.SYS sr = C:\WINDOWS\SYSTEM32\DRIVERS\SR.SYS Srv = C:\WINDOWS\SYSTEM32\DRIVERS\SRV.SYS 系统驱动项 HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services ACPI = C:\WINDOWS\SYSTEM32\DRIVERS\ACPI.SYS admjoy = C:\WINDOWS\SYSTEM32\DRIVERS\ADMJOY.SYS aec = C:\WINDOWS\SYSTEM32\DRIVERS\AEC.SYS AFD = C:\WINDOWS\SYSTEM32\DRIVERS\AFD.SYS ALCXWDM = C:\WINDOWS\SYSTEM32\DRIVERS\ALCXWDM.SYS AsyncMac = C:\WINDOWS\SYSTEM32\DRIVERS\ASYNCMAC.SYS atapi = C:\WINDOWS\SYSTEM32\DRIVERS\ATAPI.SYS Atmarpc = C:\WINDOWS\SYSTEM32\DRIVERS\ATMARPC.SYS audstub = C:\WINDOWS\SYSTEM32\DRIVERS\AUDSTUB.SYS BaseTDI = C:\WINDOWS\SYSTEM32\DRIVERS\BASETDI.SYS Cdrom = C:\WINDOWS\SYSTEM32\DRIVERS\CDROM.SYS Disk = C:\WINDOWS\SYSTEM32\DRIVERS\DISK.SYS dmboot = C:\WINDOWS\SYSTEM32\DRIVERS\DMBOOT.SYS dmio = C:\WINDOWS\SYSTEM32\DRIVERS\DMIO.SYS DMusic = C:\WINDOWS\SYSTEM32\DRIVERS\DMUSIC.SYS drmkaud = C:\WINDOWS\SYSTEM32\DRIVERS\DRMKAUD.SYS ExpScaner = D:\RISING\RAV\EXPSCAN.SYS FsVga = C:\WINDOWS\SYSTEM32\DRIVERS\FSVGA.SYS Ftdisk = C:\WINDOWS\SYSTEM32\DRIVERS\FTDISK.SYS GMSIPCI = G:\INSTALL\GMSIPCI.SYS Gpc = C:\WINDOWS\SYSTEM32\DRIVERS\MSGPC.SYS HOOKAPI = D:\RISING\RAV\HOOKAPI.SYS HookCont = D:\RISING\RAV\HOOKCONT.SYS HookReg = D:\RISING\RAV\HOOKREG.SYS HookSys = D:\RISING\RAV\HOOKSYS.SYS HookUrl = D:\RISING\RFW\HOOKURL.SYS HTTP = C:\WINDOWS\SYSTEM32\DRIVERS\HTTP.SYS i8042prt = C:\WINDOWS\SYSTEM32\DRIVERS\I8042PRT.SYS Imapi = C:\WINDOWS\SYSTEM32\DRIVERS\IMAPI.SYS intelppm = C:\WINDOWS\SYSTEM32\DRIVERS\INTELPPM.SYS Ip6Fw = C:\WINDOWS\SYSTEM32\DRIVERS\IP6FW.SYS IpFilterDriver = C:\WINDOWS\SYSTEM32\DRIVERS\IPFLTDRV.SYS IpInIp = C:\WINDOWS\SYSTEM32\DRIVERS\IPINIP.SYS IpNat = C:\WINDOWS\SYSTEM32\DRIVERS\IPNAT.SYS IPSec = C:\WINDOWS\SYSTEM32\DRIVERS\IPSEC.SYS IRENUM = C:\WINDOWS\SYSTEM32\DRIVERS\IRENUM.SYS isapnp = C:\WINDOWS\SYSTEM32\DRIVERS\ISAPNP.SYS k750bus = C:\WINDOWS\SYSTEM32\DRIVERS\K750BUS.SYS k750mdfl = C:\WINDOWS\SYSTEM32\DRIVERS\K750MDFL.SYS k750mdm = C:\WINDOWS\SYSTEM32\DRIVERS\K750MDM.SYS k750mgmt = C:\WINDOWS\SYSTEM32\DRIVERS\K750MGMT.SYS k750obex = C:\WINDOWS\SYSTEM32\DRIVERS\K750OBEX.SYS Kbdclass = C:\WINDOWS\SYSTEM32\DRIVERS\KBDCLASS.SYS kmixer = C:\WINDOWS\SYSTEM32\DRIVERS\KMIXER.SYS KRegEx = D:\D-TOOLS\KV2006\KREGEX.SYS MEMSCAN = D:\RISING\RAV\MEMSCAN.SYS mf = C:\WINDOWS\SYSTEM32\DRIVERS\MF.SYS Mouclass = C:\WINDOWS\SYSTEM32\DRIVERS\MOUCLASS.SYS mProcRs = D:\RISING\RFW\MPROCRS.SYS MSICPL = G:\INSTALL4\MSICPL.SYS MSKSSRV = C:\WINDOWS\SYSTEM32\DRIVERS\MSKSSRV.SYS MSPCLOCK = C:\WINDOWS\SYSTEM32\DRIVERS\MSPCLOCK.SYS MSPQM = C:\WINDOWS\SYSTEM32\DRIVERS\MSPQM.SYS mssmbios = C:\WINDOWS\SYSTEM32\DRIVERS\MSSMBIOS.SYS NdisTapi = C:\WINDOWS\SYSTEM32\DRIVERS\NDISTAPI.SYS Ndisuio = C:\WINDOWS\SYSTEM32\DRIVERS\NDISUIO.SYS NdisWan = C:\WINDOWS\SYSTEM32\DRIVERS\NDISWAN.SYS NetBT = C:\WINDOWS\SYSTEM32\DRIVERS\NETBT.SYS NPF = C:\WINDOWS\SYSTEM32\DRIVERS\NPF.SYS npkcrypt = D:\TENCENT\NPKCRYPT.SYS NTACCESS = G:\NTACCESS.SYS nv = C:\WINDOWS\SYSTEM32\DRIVERS\NV4_MINI.SYS NwlnkFlt = C:\WINDOWS\SYSTEM32\DRIVERS\NWLNKFLT.SYS NwlnkFwd = C:\WINDOWS\SYSTEM32\DRIVERS\NWLNKFWD.SYS Parport = C:\WINDOWS\SYSTEM32\DRIVERS\PARPORT.SYS PCI = C:\WINDOWS\SYSTEM32\DRIVERS\PCI.SYS PCIIde = C:\WINDOWS\SYSTEM32\DRIVERS\PCIIDE.SYS Pnpnt = C:\WINDOWS\SYSTEM32\DRIVERS\PNPNT.SYS PProtect = D:\D-TOOLS\KV2006\PPROTECT.SYS PptpMiniport = C:\WINDOWS\SYSTEM32\DRIVERS\RASPPTP.SYS PSched = C:\WINDOWS\SYSTEM32\DRIVERS\PSCHED.SYS Ptilink = C:\WINDOWS\SYSTEM32\DRIVERS\PTILINK.SYS RasAcd = C:\WINDOWS\SYSTEM32\DRIVERS\RASACD.SYS Rasl2tp = C:\WINDOWS\SYSTEM32\DRIVERS\RASL2TP.SYS RasPppoe = C:\WINDOWS\SYSTEM32\DRIVERS\RASPPPOE.SYS Raspti = C:\WINDOWS\SYSTEM32\DRIVERS\RASPTI.SYS RDPCDD = C:\WINDOWS\SYSTEM32\DRIVERS\RDPCDD.SYS rdpdr = C:\WINDOWS\SYSTEM32\DRIVERS\RDPDR.SYS redbook = C:\WINDOWS\SYSTEM32\DRIVERS\REDBOOK.SYS RsFwDrv = D:\RISING\RFW\RSFWDRV.SYS RsNTGDI = C:\WINDOWS\SYSTEM32\DRIVERS\RSNTGDI.SYS RSPPSYS = D:\RISING\RAV\RSPPSYS.SYS RTL8023xp = C:\WINDOWS\SYSTEM32\DRIVERS\RTNICXP.SYS Secdrv = C:\WINDOWS\SYSTEM32\DRIVERS\SECDRV.SYS Sentinel = C:\WINDOWS\SYSTEM32\DRIVERS\SENTINEL.SYS serenum = C:\WINDOWS\SYSTEM32\DRIVERS\SERENUM.SYS Serial = C:\WINDOWS\SYSTEM32\DRIVERS\SERIAL.SYS SetupNTGLM7X = G:\NTGLM7X.SYS splitter = C:\WINDOWS\SYSTEM32\DRIVERS\SPLITTER.SYS SSIPDDP = C:\WINDOWS\SYSTEM32\DRIVERS\SSIPDDP.SYS swenum = C:\WINDOWS\SYSTEM32\DRIVERS\SWENUM.SYS swmidi = C:\WINDOWS\SYSTEM32\DRIVERS\SWMIDI.SYS sysaudio = C:\WINDOWS\SYSTEM32\DRIVERS\SYSAUDIO.SYS Tcpip = C:\WINDOWS\SYSTEM32\DRIVERS\TCPIP.SYS TermDD = C:\WINDOWS\SYSTEM32\DRIVERS\TERMDD.SYS Update = C:\WINDOWS\SYSTEM32\DRIVERS\UPDATE.SYS usbehci = C:\WINDOWS\SYSTEM32\DRIVERS\USBEHCI.SYS usbhub = C:\WINDOWS\SYSTEM32\DRIVERS\USBHUB.SYS usbscan = C:\WINDOWS\SYSTEM32\DRIVERS\USBSCAN.SYS USBSTOR = C:\WINDOWS\SYSTEM32\DRIVERS\USBSTOR.SYS usbuhci = C:\WINDOWS\SYSTEM32\DRIVERS\USBUHCI.SYS VgaSave = C:\WINDOWS\SYSTEM32\DRIVERS\VGA.SYS Wanarp = C:\WINDOWS\SYSTEM32\DRIVERS\WANARP.SYS wdmaud = C:\WINDOWS\SYSTEM32\DRIVERS\WDMAUD.SYS wdm_au8830 = C:\WINDOWS\SYSTEM32\DRIVERS\ADM8830.SYS WS2IFSL = C:\WINDOWS\SYSTEM32\DRIVERS\WS2IFSL.SYS
xbqiu 初生襁褓狮帖子:43 注册: 2006-12-13 来自:

身居江湖初生襁褓狮帖子:5 注册: 2007-02-27 来自:	发表于： 2007-02-27 15:36 \| 短消息资料字号：小中大 10楼 [CODE] 2007-02-27,14:45:54 System Repair Engineer 2.3.13.690 Smallfrogs (http://www.KZTechs.com) Windows XP Professional Service Pack 2 (Build 2600) - 管理权限用户 - 完整功能以下内容被选中：所有的启动项目（包括注册表、启动文件夹、服务等）浏览器加载项正在运行的进程（包括进程模块信息）文件关联 Winsock 提供者 Autorun.inf HOSTS 文件启动项目注册表 [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run] <ctfmon.exe><C:\WINDOWS\system32\ctfmon.exe> [(Verified)Microsoft Corporation] <BaiduDS><E:\百度硬盘搜索\Disk Search\BaiduDiskSearch.exe -NoOpen> [Baidu.com, Inc.] [HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows] <load><> [N/A] <run><E:\写字板\win32\CUSTOM.EXE > [PenPower] [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run] <RavTask><"C:\Program Files\Rising\Rav\RavTask.exe" -system> [Beijing Rising Technology Co., Ltd.] <360Safetray><E:\卡巴斯基\360safe\safemon\360tray.exe /start> [奇虎网] <runeip><D:\Program Files\Rising\runiep.exe> [Beijing Rising Technology Co., Ltd.] <HP Component Manager><"C:\Program Files\HP\hpcoretech\hpcmpmgr.exe"> [Hewlett-Packard Company] [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon] <shell><Explorer.exe> [(Verified)Microsoft Corporation] <Userinit><C:\WINDOWS\system32\userinit.exe,> [(Verified)Microsoft Corporation] [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Windows] <AppInit_DLLs><> [N/A] [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon] <UIHost><logonui.exe> [(Verified)Microsoft Corporation] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] <BigDogPath><; > [N/A] <Cmaudio><; RunDll32 cmicnfg.cpl,CMICtrlWnd> [N/A] <helper.dll><; C:\WINDOWS\system32\rundll32.exe C:\PROGRA~1\3721\helper.dll,Rundll32> [N/A] <IMJPMIG8.1><; "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32> [(Verified)Microsoft Corporation] <KernelFaultCheck><; %systemroot%\system32\dumprep 0 -k> [N/A] <PHIME2002A><; > [N/A] <PHIME2002ASync><; > [N/A] <SoundMan><; SOUNDMAN.EXE> [N/A] <wallpaper><; c:\windows\system32\壁纸自动换.exe> [N/A] <YLive.exe><; > [N/A]
身居江湖初生襁褓狮帖子:5 注册: 2007-02-27 来自:

<<上一主题|下一主题>>

12

1 / 2 页

跳转页

页面顶部

Powered by Discuz!NT