1   1  /  1  页   跳转页

请高人帮看看这个日志~谢谢!~

收藏
3Q你
头像
初生襁褓狮
  • 帖子:149
  • 注册: 2005-07-07
  • 来自:
发表于： 2007-01-26 19:53 | 只看楼主 短消息 资料
字号： 小 中 大 1楼

请高人帮看看这个日志~谢谢!~

启动项目
注册表
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
    <ctfmon.exe><C:\WINDOWS\system32\ctfmon.exe>  [(Verified)Microsoft Corporation]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
    <PHIME2002A><C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName>  [(Verified)Microsoft Corporation]
    <ATIPTA><C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe>  [ATI Technologies, Inc.]
    <MSPY2002><C:\WINDOWS\system32\IME\PINTLGNT\ImScInst.exe /SYNC>  [(Verified)N/A]
    <PHIME2002ASync><C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC>  [(Verified)Microsoft Corporation]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
    <shell><Explorer.exe>  [(Verified)Microsoft Corporation]
    <Userinit><C:\WINDOWS\system32\userinit.exe,>  [(Verified)Microsoft Corporation]
    <UIHost><logonui.exe>  [(Verified)Microsoft Corporation]

==================================
启动文件夹
N/A

==================================
服务
[Ati HotKey Poller / Ati HotKey Poller]
  <C:\WINDOWS\system32\Ati2evxx.exe><N/A>
[ATI Smart / ATI Smart]
  <C:\WINDOWS\system32\ati2sgag.exe><N/A>
[Human Interface Device Access / HidServ]
  <C:\WINDOWS\System32\svchost.exe -k netsvcs-->%SystemRoot%\System32\hidserv.dll><N/A>
[Windows DHCP Service / WinDHCPsvc]
  <C:\WINDOWS\system32\\rundll32.exe windhcp.ocx,start><Microsoft Corporation>

==================================
驱动程序
[Intel(r) 82801 Audio Driver Install Service (WDM) / ac97intc]
  <system32\drivers\ac97intc.sys><Intel Corporation>
[Enhanced Display Driver Helper Service / asuskbnt]
  <system32\drivers\atkkbnt.sys><ASUSTeK COMPUTER INC.>
[ati2mtag / ati2mtag]
  <system32\DRIVERS\ati2mtag.sys><ATI Technologies Inc.>
[Sony Ericsson K510 Driver driver (WDM) / k510bus]
  <system32\DRIVERS\k510bus.sys><MCCI>
[Sony Ericsson K510 USB WMC Modem Filter / k510mdfl]
  <system32\DRIVERS\k510mdfl.sys><MCCI>
[Sony Ericsson K510 USB WMC Modem Driver / k510mdm]
  <system32\DRIVERS\k510mdm.sys><MCCI>
[Sony Ericsson K510 USB WMC Device Management Drivers (WDM) / k510mgmt]
  <system32\DRIVERS\k510mgmt.sys><MCCI>
[Sony Ericsson K510 USB WMC OBEX Interface / k510obex]
  <system32\DRIVERS\k510obex.sys><MCCI>
[Netgroup Packet Filter / NPF]
  <system32\DRIVERS\npf.sys><CACE Technologies>
[Direct Parallel Link Driver / Ptilink]
  <system32\DRIVERS\ptilink.sys><Parallel Technologies, Inc.>
[Realtek RTL8139(A/B/C)-based PCI Fast Ethernet Adapter NT Driver / rtl8139]
  <system32\DRIVERS\RTL8139.SYS><Realtek Semiconductor Corporation>
[Secdrv / Secdrv]
  <system32\DRIVERS\secdrv.sys><N/A>

==================================
浏览器加载项
[@shdoclc.dll,-866]
  {c95fe080-8f5d-11d2-a20b-00aa003c157a} <, N/A>
[Messenger]
  {FB5F1910-F110-11d2-BB9E-00C04F795683} <C:\Program Files\Messenger\msmsgs.exe, Microsoft Corporation>
[电台(&R)]
  {8E718888-423F-11D2-876E-00A0C9082467} <C:\WINDOWS\system32\msdxm.ocx, Microsoft Corporation>
[Windows Media Player]
  {22D6F312-B0F6-11D0-94AB-0080C74C7E95} <C:\WINDOWS\system32\wmpdxm.dll, Microsoft Corporation>
[HTML Document]
  {25336920-03F9-11CF-8FD0-00AA00686F13} <%SystemRoot%\system32\mshtml.dll, N/A>
[Passport 的批处理服务]
  {2D2307C8-7DB4-40D6-9100-D52AF4F97A5B} <%SystemRoot%\system32\netplwiz.dll, N/A>
[HHCtrl Object]
  {41B23C28-488E-4E5C-ACE2-BB0BBABE99E8} <C:\WINDOWS\system32\hhctrl.ocx, Microsoft Corporation>
[Windows Media Player]
  {6BF52A52-394A-11D3-B153-00C04F79FAA6} <C:\WINDOWS\system32\wmp.dll, Microsoft Corporation>
[Microsoft Web 浏览器]
  {8856F961-340A-11D0-A96B-00C04FD705A2} <C:\WINDOWS\system32\shdocvw.dll, Microsoft Corporation>
[Microsoft Scriptlet Component]
  {AE24FDAE-03C6-11D1-8B76-0080C744F389} <C:\WINDOWS\system32\mshtml.dll, Microsoft Corporation>
[SearchAssistantOC]
  {B45FF030-4447-11D2-85DE-00C04FA35C89} <%SystemRoot%\system32\shdocvw.dll, N/A>
[RDS.DataSpace]
  {BD96C556-65A3-11D0-983A-00C04FC29E36} <C:\Program Files\Common Files\System\msadc\msadco.dll, Microsoft Corporation>
[Shockwave Flash Object]
  {D27CDB6E-AE6D-11CF-96B8-444553540000} <C:\WINDOWS\system32\macromed\flash\swflash.ocx, Macromedia, Inc.>
[上传到QQ网络硬盘]
  <D:\QQ\AddToNetDisk.htm, N/A>
[添加到QQ自定义面板]
  <D:\QQ\AddPanel.htm, N/A>
[添加到QQ表情]
  <D:\QQ\AddEmotion.htm, N/A>
[用QQ彩信发送该图片]
  <D:\QQ\SendMMS.htm, N/A>

==================================
正在运行的进程
[PID: 416][\SystemRoot\System32\smss.exe]  [Microsoft Corporation, 5.1.2600.2096 (xpsp_sp2_rc1.040311-2315)]
[PID: 476][\??\C:\WINDOWS\system32\csrss.exe]  [Microsoft Corporation, 5.1.2600.2096 (xpsp_sp2_rc1.040311-2315)]
[PID: 500][\??\C:\WINDOWS\system32\winlogon.exe]  [Microsoft Corporation, 5.1.2600.2096 (xpsp_sp2_rc1.040311-2315)]
    [C:\WINDOWS\KB235780M.LOG]  [N/A, N/A]
    [C:\WINDOWS\system32\Ati2evxx.dll]  [ATI Technologies Inc., 6.14.10.4113]
[PID: 552][C:\WINDOWS\system32\services.exe]  [Microsoft Corporation, 5.1.2600.2096 (xpsp_sp2_rc1.040311-2315)]
    [C:\WINDOWS\KB235780M.LOG]  [N/A, N/A]
[PID: 564][C:\WINDOWS\system32\lsass.exe]  [Microsoft Corporation, 5.1.2600.2096 (xpsp_sp2_rc1.040311-2315)]
    [C:\WINDOWS\KB235780M.LOG]  [N/A, N/A]
[PID: 744][C:\WINDOWS\system32\svchost.exe]  [Microsoft Corporation, 5.1.2600.2096 (xpsp_sp2_rc1.040311-2315)]
    [C:\WINDOWS\KB235780M.LOG]  [N/A, N/A]
[PID: 784][C:\WINDOWS\system32\svchost.exe]  [Microsoft Corporation, 5.1.2600.2096 (xpsp_sp2_rc1.040311-2315)]
    [C:\WINDOWS\KB235780M.LOG]  [N/A, N/A]
[PID: 860][C:\WINDOWS\System32\svchost.exe]  [Microsoft Corporation, 5.1.2600.2096 (xpsp_sp2_rc1.040311-2315)]
    [C:\WINDOWS\KB235780M.LOG]  [N/A, N/A]
[PID: 964][C:\WINDOWS\system32\svchost.exe]  [Microsoft Corporation, 5.1.2600.2096 (xpsp_sp2_rc1.040311-2315)]
    [C:\WINDOWS\KB235780M.LOG]  [N/A, N/A]
[PID: 988][C:\WINDOWS\system32\svchost.exe]  [Microsoft Corporation, 5.1.2600.2096 (xpsp_sp2_rc1.040311-2315)]
    [C:\WINDOWS\KB235780M.LOG]  [N/A, N/A]
[PID: 1180][C:\WINDOWS\system32\spoolsv.exe]  [Microsoft Corporation, 5.1.2600.2096 (xpsp_sp2_rc1.040311-2315)]
    [C:\WINDOWS\KB235780M.LOG]  [N/A, N/A]
[PID: 1440][C:\WINDOWS\Explorer.EXE]  [Microsoft Corporation, 6.00.2900.2096 (xpsp_sp2_rc1.040311-2315)]
    [C:\WINDOWS\KB235780M.LOG]  [N/A, N/A]
    [C:\WINDOWS\system32\wsvbs.dll]  [N/A, N/A]
    [C:\DOCUME~1\czs\LOCALS~1\Temp\upxdn.dll]  [N/A, N/A]
    [d:\WinRAR\rarext.dll]  [N/A, N/A]
    [C:\WINDOWS\system32\windhcp.ocx]  [N/A, N/A]
[PID: 1536][C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe]  [ATI Technologies, Inc., 6.14.10.5142]
    [C:\WINDOWS\KB235780M.LOG]  [N/A, N/A]
    [C:\Program Files\ATI Technologies\ATI Control Panel\atipdsxx.dll]  [ATI Technologies, Inc., 6.14.10.5142]
    [C:\PROGRAM FILES\ATI TECHNOLOGIES\ATI CONTROL PANEL\ATRPUIXX.CHS]  [ATI Technologies, Inc., 6.14.10.5142]
    [C:\Program Files\ATI Technologies\ATI Control Panel\atipdxxx.dll]  [ATI Technologies, Inc., 6.14.10.5142]
[PID: 1668][C:\WINDOWS\system32\ctfmon.exe]  [Microsoft Corporation, 5.1.2600.2096 (xpsp_sp2_rc1.040311-2315)]
    [C:\WINDOWS\KB235780M.LOG]  [N/A, N/A]
[PID: 1804][C:\WINDOWS\system32\conime.exe]  [Microsoft Corporation, 5.1.2600.2096 (xpsp_sp2_rc1.040311-2315)]
    [C:\WINDOWS\KB235780M.LOG]  [N/A, N/A]
[PID: 1428][C:\WINDOWS\system32\wuauclt.exe]  [Microsoft Corporation, 5.4.3790.2096 (xpsp_sp2_rc1.040311-2315)]
    [C:\WINDOWS\KB235780M.LOG]  [N/A, N/A]
[PID: 184][C:\WINDOWS\EXPLoreR.EXe]  [Microsoft Corporation, 6.00.2900.2096 (xpsp_sp2_rc1.040311-2315)]
    [C:\WINDOWS\KB235780M.LOG]  [N/A, N/A]
[PID: 320][D:\新建文件夹 (2)\sreng2\SREng\SREng.exe]  [Smallfrogs Studio, 2.2.6.605]
[PID: 1948][D:\新建文件夹 (2)\sreng2\SREng\SREng.exe]  [Smallfrogs Studio, 2.2.6.605]

==================================
文件关联
.TXT  OK. [%SystemRoot%\system32\NOTEPAD.EXE %1]
.EXE  OK. ["%1" %*]
.COM  OK. ["%1" %*]
.PIF  OK. ["%1" %*]
.REG  OK. [regedit.exe "%1"]
.BAT  OK. ["%1" %*]
.SCR  OK. ["%1" /S]
.CHM  OK. ["C:\WINDOWS\hh.exe" %1]
.HLP  OK. [%SystemRoot%\System32\winhlp32.exe %1]
.INI  OK. [%SystemRoot%\System32\NOTEPAD.EXE %1]
.INF  OK. [%SystemRoot%\System32\NOTEPAD.EXE %1]
.VBS  OK. [%SystemRoot%\System32\WScript.exe "%1" %*]
.JS  OK. [%SystemRoot%\System32\WScript.exe "%1" %*]
.LNK  OK. [{00021401-0000-0000-C000-000000000046}]
最后编辑2007-01-26 20:50:30.950000000
分享到：
gototop
 
叶·幽思
头像
横据古稀狮
  • 帖子:7280
  • 注册: 2005-09-01
  • 来自:Town
冰激凌
发表于： 2007-01-26 20:04 | 短消息 资料
字号： 小 中 大 2楼

运行SREng后定位到:

启动项目--服务--Win32服务--隐藏已认证的微软服务--选中"Windows DHCP Service / WinDHCPsvc"--删除服务--设置--在弹出的对话框中点"否".

killbox删除:C:\WINDOWS\system32\windhcp.ocx

C:\WINDOWS\KB235780M.LOG

C:\WINDOWS\system32\wsvbs.dll

C:\DOCUME~1\czs\LOCALS~1\Temp\upxdn.dll

如果正常模式下删除不了可以在安全模式下删除(开机按F8进入安全模式).
gototop
 
高歌猛进
头像
初生襁褓狮
  • 帖子:2377
  • 注册: 2006-10-09
  • 来自:
发表于： 2007-01-26 20:10 | 短消息 资料
字号： 小 中 大 3楼

========Content========

怎么会有两个啊：
[PID: 184][C:\WINDOWS\EXPLoreR.EXe]
[PID: 1440][C:\WINDOWS\Explorer.EXE]
gototop
 
3Q你
头像
初生襁褓狮
  • 帖子:149
  • 注册: 2005-07-07
  • 来自:
发表于： 2007-01-26 20:22 | 只看楼主 短消息 资料
字号： 小 中 大 4楼

启动项目
注册表
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
    <ctfmon.exe><C:\WINDOWS\system32\ctfmon.exe>  [(Verified)Microsoft Corporation]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
    <PHIME2002A><C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName>  [(Verified)Microsoft Corporation]
    <ATIPTA><C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe>  [ATI Technologies, Inc.]
    <MSPY2002><C:\WINDOWS\system32\IME\PINTLGNT\ImScInst.exe /SYNC>  [(Verified)N/A]
    <PHIME2002ASync><C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC>  [(Verified)Microsoft Corporation]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
    <shell><Explorer.exe>  [(Verified)Microsoft Corporation]
    <Userinit><C:\WINDOWS\system32\userinit.exe,>  [(Verified)Microsoft Corporation]
    <UIHost><logonui.exe>  [(Verified)Microsoft Corporation]

==================================
启动文件夹
N/A

==================================
服务
[Ati HotKey Poller / Ati HotKey Poller]
  <C:\WINDOWS\system32\Ati2evxx.exe><N/A>
[ATI Smart / ATI Smart]
  <C:\WINDOWS\system32\ati2sgag.exe><N/A>
[Human Interface Device Access / HidServ]
  <C:\WINDOWS\System32\svchost.exe -k netsvcs-->%SystemRoot%\System32\hidserv.dll><N/A>
[Qlug and Play　 　　 / Qlug and Play　 　　　]
  <C:\WINDOWS\alg　><N/A>

==================================
驱动程序
[Intel(r) 82801 Audio Driver Install Service (WDM) / ac97intc]
  <system32\drivers\ac97intc.sys><Intel Corporation>
[Enhanced Display Driver Helper Service / asuskbnt]
  <system32\drivers\atkkbnt.sys><ASUSTeK COMPUTER INC.>
[ati2mtag / ati2mtag]
  <system32\DRIVERS\ati2mtag.sys><ATI Technologies Inc.>
[Sony Ericsson K510 Driver driver (WDM) / k510bus]
  <system32\DRIVERS\k510bus.sys><MCCI>
[Sony Ericsson K510 USB WMC Modem Filter / k510mdfl]
  <system32\DRIVERS\k510mdfl.sys><MCCI>
[Sony Ericsson K510 USB WMC Modem Driver / k510mdm]
  <system32\DRIVERS\k510mdm.sys><MCCI>
[Sony Ericsson K510 USB WMC Device Management Drivers (WDM) / k510mgmt]
  <system32\DRIVERS\k510mgmt.sys><MCCI>
[Sony Ericsson K510 USB WMC OBEX Interface / k510obex]
  <system32\DRIVERS\k510obex.sys><MCCI>
[Netgroup Packet Filter / NPF]
  <system32\DRIVERS\npf.sys><CACE Technologies>
[Direct Parallel Link Driver / Ptilink]
  <system32\DRIVERS\ptilink.sys><Parallel Technologies, Inc.>
[Realtek RTL8139(A/B/C)-based PCI Fast Ethernet Adapter NT Driver / rtl8139]
  <system32\DRIVERS\RTL8139.SYS><Realtek Semiconductor Corporation>
[Secdrv / Secdrv]
  <system32\DRIVERS\secdrv.sys><N/A>

==================================
浏览器加载项
[@shdoclc.dll,-866]
  {c95fe080-8f5d-11d2-a20b-00aa003c157a} <, N/A>
[Messenger]
  {FB5F1910-F110-11d2-BB9E-00C04F795683} <C:\Program Files\Messenger\msmsgs.exe, Microsoft Corporation>
[电台(&R)]
  {8E718888-423F-11D2-876E-00A0C9082467} <C:\WINDOWS\system32\msdxm.ocx, Microsoft Corporation>
[Windows Media Player]
  {22D6F312-B0F6-11D0-94AB-0080C74C7E95} <C:\WINDOWS\system32\wmpdxm.dll, Microsoft Corporation>
[HTML Document]
  {25336920-03F9-11CF-8FD0-00AA00686F13} <%SystemRoot%\system32\mshtml.dll, N/A>
[Passport 的批处理服务]
  {2D2307C8-7DB4-40D6-9100-D52AF4F97A5B} <%SystemRoot%\system32\netplwiz.dll, N/A>
[HHCtrl Object]
  {41B23C28-488E-4E5C-ACE2-BB0BBABE99E8} <C:\WINDOWS\system32\hhctrl.ocx, Microsoft Corporation>
[Windows Media Player]
  {6BF52A52-394A-11D3-B153-00C04F79FAA6} <C:\WINDOWS\system32\wmp.dll, Microsoft Corporation>
[Microsoft Web 浏览器]
  {8856F961-340A-11D0-A96B-00C04FD705A2} <C:\WINDOWS\system32\shdocvw.dll, Microsoft Corporation>
[Microsoft Scriptlet Component]
  {AE24FDAE-03C6-11D1-8B76-0080C744F389} <C:\WINDOWS\system32\mshtml.dll, Microsoft Corporation>
[SearchAssistantOC]
  {B45FF030-4447-11D2-85DE-00C04FA35C89} <%SystemRoot%\system32\shdocvw.dll, N/A>
[RDS.DataSpace]
  {BD96C556-65A3-11D0-983A-00C04FC29E36} <C:\Program Files\Common Files\System\msadc\msadco.dll, Microsoft Corporation>
[Shockwave Flash Object]
  {D27CDB6E-AE6D-11CF-96B8-444553540000} <C:\WINDOWS\system32\macromed\flash\swflash.ocx, Macromedia, Inc.>
[上传到QQ网络硬盘]
  <D:\QQ\AddToNetDisk.htm, N/A>
[添加到QQ自定义面板]
  <D:\QQ\AddPanel.htm, N/A>
[添加到QQ表情]
  <D:\QQ\AddEmotion.htm, N/A>
[用QQ彩信发送该图片]
  <D:\QQ\SendMMS.htm, N/A>

==================================
正在运行的进程
[PID: 416][\SystemRoot\System32\smss.exe]  [Microsoft Corporation, 5.1.2600.2096 (xpsp_sp2_rc1.040311-2315)]
[PID: 476][\??\C:\WINDOWS\system32\csrss.exe]  [Microsoft Corporation, 5.1.2600.2096 (xpsp_sp2_rc1.040311-2315)]
[PID: 500][\??\C:\WINDOWS\system32\winlogon.exe]  [Microsoft Corporation, 5.1.2600.2096 (xpsp_sp2_rc1.040311-2315)]
    [C:\WINDOWS\system32\Ati2evxx.dll]  [ATI Technologies Inc., 6.14.10.4113]
[PID: 544][C:\WINDOWS\system32\services.exe]  [Microsoft Corporation, 5.1.2600.2096 (xpsp_sp2_rc1.040311-2315)]
[PID: 556][C:\WINDOWS\system32\lsass.exe]  [Microsoft Corporation, 5.1.2600.2096 (xpsp_sp2_rc1.040311-2315)]
[PID: 716][C:\WINDOWS\system32\svchost.exe]  [Microsoft Corporation, 5.1.2600.2096 (xpsp_sp2_rc1.040311-2315)]
[PID: 752][C:\WINDOWS\system32\svchost.exe]  [Microsoft Corporation, 5.1.2600.2096 (xpsp_sp2_rc1.040311-2315)]
[PID: 820][C:\WINDOWS\System32\svchost.exe]  [Microsoft Corporation, 5.1.2600.2096 (xpsp_sp2_rc1.040311-2315)]
[PID: 864][C:\WINDOWS\system32\svchost.exe]  [Microsoft Corporation, 5.1.2600.2096 (xpsp_sp2_rc1.040311-2315)]
[PID: 932][C:\WINDOWS\system32\svchost.exe]  [Microsoft Corporation, 5.1.2600.2096 (xpsp_sp2_rc1.040311-2315)]
[PID: 1112][C:\WINDOWS\system32\spoolsv.exe]  [Microsoft Corporation, 5.1.2600.2096 (xpsp_sp2_rc1.040311-2315)]
[PID: 1344][C:\WINDOWS\Explorer.EXE]  [Microsoft Corporation, 6.00.2900.2096 (xpsp_sp2_rc1.040311-2315)]
[PID: 1432][C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe]  [ATI Technologies, Inc., 6.14.10.5142]
    [C:\Program Files\ATI Technologies\ATI Control Panel\atipdsxx.dll]  [ATI Technologies, Inc., 6.14.10.5142]
    [C:\PROGRAM FILES\ATI TECHNOLOGIES\ATI CONTROL PANEL\ATRPUIXX.CHS]  [ATI Technologies, Inc., 6.14.10.5142]
    [C:\Program Files\ATI Technologies\ATI Control Panel\atipdxxx.dll]  [ATI Technologies, Inc., 6.14.10.5142]
[PID: 1456][C:\WINDOWS\system32\ctfmon.exe]  [Microsoft Corporation, 5.1.2600.2096 (xpsp_sp2_rc1.040311-2315)]
[PID: 1524][C:\WINDOWS\system32\conime.exe]  [Microsoft Corporation, 5.1.2600.2096 (xpsp_sp2_rc1.040311-2315)]
[PID: 1624][D:\新建文件夹 (2)\sreng2\SREng\SREng.exe]  [Smallfrogs Studio, 2.2.6.605]
[PID: 216][C:\WINDOWS\EXPLoreR.EXe]  [Microsoft Corporation, 6.00.2900.2096 (xpsp_sp2_rc1.040311-2315)]
[PID: 336][C:\WINDOWS\system32\wuauclt.exe]  [Microsoft Corporation, 5.4.3790.2096 (xpsp_sp2_rc1.040311-2315)]

==================================
文件关联
.TXT  OK. [%SystemRoot%\system32\NOTEPAD.EXE %1]
.EXE  OK. ["%1" %*]
.COM  OK. ["%1" %*]
.PIF  OK. ["%1" %*]
.REG  OK. [regedit.exe "%1"]
.BAT  OK. ["%1" %*]
.SCR  OK. ["%1" /S]
.CHM  OK. ["C:\WINDOWS\hh.exe" %1]
.HLP  OK. [%SystemRoot%\System32\winhlp32.exe %1]
.INI  OK. [%SystemRoot%\System32\NOTEPAD.EXE %1]
.INF  OK. [%SystemRoot%\System32\NOTEPAD.EXE %1]
.VBS  OK. [%SystemRoot%\System32\WScript.exe "%1" %*]
.JS  OK. [%SystemRoot%\System32\WScript.exe "%1" %*]
.LNK  OK. [{00021401-0000-0000-C000-000000000046}]

重新扫描的日志~~
gototop
 
54爱丽舍
头像
拙长孩提狮
  • 帖子:84
  • 注册: 2006-12-04
  • 来自:
发表于： 2007-01-26 20:23 | 短消息 资料
字号： 小 中 大 5楼

[Windows DHCP Service / WinDHCPsvc]
<C:\WINDOWS\system32\\rundll32.exe windhcp.ocx,start><Microsoft Corporation>
参看：http://bbs.54master.com/thread-126466-1-2.html

[C:\WINDOWS\KB235780M.LOG] [N/A, N/A]
可通过hijack来修复对应的020项，再搜索此文件，有时也不一定能找到
gototop
 
高歌猛进
头像
初生襁褓狮
  • 帖子:2377
  • 注册: 2006-10-09
  • 来自:
发表于： 2007-01-26 20:30 | 短消息 资料
字号： 小 中 大 6楼

========Content========

删除这个服务：

[Qlug and Play　 　　 / Qlug and Play　 　　　]
<C:\WINDOWS\alg　><N/A>

安全模式，删除：
C:\WINDOWS\alg　

请楼主查下C:\WINDOWS中，有几个Explorer.EXE

[PID: 216][C:\WINDOWS\EXPLoreR.EXe]
[PID: 1344][C:\WINDOWS\Explorer.EXE]
gototop
 
叶·幽思
头像
横据古稀狮
  • 帖子:7280
  • 注册: 2005-09-01
  • 来自:Town
冰激凌
发表于： 2007-01-26 20:50 | 短消息 资料
字号： 小 中 大 7楼

引用:
【高歌猛进的贴子】========Content========

删除这个服务：

[Qlug and Play　 　　 / Qlug and Play　 　　　]
<C:\WINDOWS\alg　><N/A>

安全模式，删除：
C:\WINDOWS\alg　

请楼主查下C:\WINDOWS中，有几个Explorer.EXE

[PID: 216][C:\WINDOWS\EXPLoreR.EXe]
[PID: 1344][C:\WINDOWS\Explorer.EXE]

………………


这是搂主的第一份日志:

[PID: 1440][C:\WINDOWS\Explorer.EXE] [Microsoft Corporation, 6.00.2900.2096 (xpsp_sp2_rc1.040311-2315)]

[PID: 184][C:\WINDOWS\EXPLoreR.EXe] [Microsoft Corporation, 6.00.2900.2096 (xpsp_sp2_rc1.040311-2315)]

不存在数字0与字母O的区别且同一文件夹下不可能有同名文件.

任务管理器中新建一个explorer.exe任务,就可以看到2个explorer.exe进程不过很快就会变为一个,所以一般日志中是看不到2个正常的explorer.exe进程.

偶看了N个日志就见了这一个.

附件附件:

下载次数:179
文件类型:image/pjpeg
文件大小:
上传时间:2007-1-26 20:50:30
描述:
gototop
 
<<上一主题|下一主题>>
1   1  /  1  页   跳转页
页面顶部
Powered by Discuz!NT