HijackThis高手帮帮忙 - 瑞星卡卡安全论坛bbs.ikaka.com

瑞星卡卡安全论坛技术交流区 反病毒/反流氓软件论坛 HijackThis高手帮帮忙

	瑞星“1+2”全新解决方案巡展在广州画上圆满句号		叶院长揭秘：瑞星如何运用AI技术革新网络安全		俄乌冲突加剧网络攻击风险白俄罗斯政府遭APT攻击		瑞星ESM防病毒系统助力矿业大学筑牢网络安全防线
	实力拉满瑞星第四十七次通过VB100测评		携手老友，拥抱新精彩 —— 新论坛新活动，感谢你的陪伴		护航司法，瑞星助力山西省高院构建安全防线		人工智能在网络安全领域的风险和机遇

12

1 / 2 页

跳转页

HijackThis高手帮帮忙

seph 初生襁褓狮帖子:10 注册: 2005-08-09 来自:	发表于： 2005-08-09 23:04 \| 只看楼主短消息资料字号：小中大 1楼 HijackThis高手帮帮忙我的浏览器被劫持了,5555! 现象:开机时自动打开ie, 最先打开dns错误提示:从c:/wondows/system32/shdoclc/dnsrror.htm下载网页然后ie打开www.baid.77169.org 一闪之后打开http://freehost13.websamba.com/mon9p/goog.htm 然后就是www.y130.com等7\8个网页打开网页的共同特点:ie标题最后都有"紫色爱情"标记我曾 1) 用卡巴5.0372更新后查杀,无效, 2) 用Ad-Aware SE 更新查杀,无效 3) 在注册表中查这几个网页,没有 4) 检查了HKEY_CURRENT_USER,HKEY_CURRENT_MACHINE等下面的启动项,没找到 5) 删除过c:/wondows/syster32/mshta.exe(查hws等,没有) 日志如下,请高手帮忙看一下 HijackThis_zww汉化版扫描日志 V1.99.1 保存于 22:42:19, 日期 2005-8-9 操作系统： Windows XP SP1 (WinNT 5.01.2600) 浏览器： Internet Explorer v6.00 SP1 (6.00.2800.1106) 当前运行的进程： C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\Explorer.EXE C:\WINDOWS\System32\ctfmon.exe C:\WINDOWS\System32\nvsvc32.exe C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe C:\Program Files\Maxthon\Maxthon.exe C:\Documents and Settings\phil\桌面\4483172005624221516\HijackThis1991zww.exe O2 - BHO: (no name) - {A5366673-E8CA-11D3-9CD9-0090271D075B} - (no file) O3 - IE工具栏增项: 电台(&R) - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx O3 - IE工具栏增项: FlashGet Bar - {E0E899AB-F487-11D5-8D29-0050BA6940E3} - C:\PROGRA~1\FlashGet\fgiebar.dll O4 - 启动项HKLM\\Run: [IMJPMIG8.1] ; "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32 O4 - 启动项HKLM\\Run: [PHIME2002ASync] ; C:\WINDOWS\System32\IME\TINTLGNT\TINTSETP.EXE /SYNC O4 - 启动项HKLM\\Run: [PHIME2002A] ; C:\WINDOWS\System32\IME\TINTLGNT\TINTSETP.EXE /IMEName O4 - 启动项HKLM\\Run: [Smapp] ; C:\Program Files\Analog Devices\SoundMAX\Smtray.exe O4 - 启动项HKLM\\Run: [KAVPersonal50] "C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus Personal\kav.exe" /minimize O4 - 启动项HKLM\\Run: [Super Rabbit SRRestore] C:\Program Files\Super Rabbit\MagicSet\srrest.exe /autosave O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\System32\ctfmon.exe O4 - HKCU\..\Run: [Super Rabbit IEPro] ; C:\Program Files\Super Rabbit\MagicSet\SRIECLI.EXE /LOAD O4 - Global Startup: InterVideo WinCinema Manager.lnk = C:\Program Files\InterVideo\Common\Bin\WinCinemaMgr.exe O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE O8 - IE右键菜单中的新增项目: 使用网际快车下载 - C:\Program Files\FlashGet\jc_link.htm O8 - IE右键菜单中的新增项目: 使用网际快车下载全部链接 - C:\Program Files\FlashGet\jc_all.htm O9 - 浏览器额外的按钮: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\PROGRA~1\FlashGet\flashget.exe O9 - 浏览器额外的“工具”菜单项: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\PROGRA~1\FlashGet\flashget.exe O17 - HKLM\System\CCS\Services\Tcpip\..\{C19DF564-12BC-4D82-9CB3-499D370210FC}: NameServer = 61.134.1.4,61.134.1.9 O23 - NT 服务: kavsvc - Kaspersky Lab - C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus Personal\kavsvc.exe O23 - NT 服务: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe O23 - NT 服务: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe 另外: 1) 最初ie主页曾被窜改,注册表被锁定,我用兔子的ie专家修复了 2) 这几个恶意网页都是随开机时系统启动而启动,可一次性关闭(关闭后不在出现,但重新开机后还有) 2005-08-11 00:17:31
seph 初生襁褓狮帖子:10 注册: 2005-08-09 来自:	分享到：

魔法学徒卡卡技术团队帖子:11465 注册: 2004-10-03 来自:	发表于： 2005-08-09 23:15 \| 短消息资料字号：小中大 2楼请修复 O2 - BHO: (no name) - {A5366673-E8CA-11D3-9CD9-0090271D075B} - (no file) 问题仍在的话，麻烦楼主在安全模式下用最新版Hijackthis1.99.1扫描一个log贴上来。
魔法学徒卡卡技术团队帖子:11465 注册: 2004-10-03 来自:

seph 初生襁褓狮帖子:10 注册: 2005-08-09 来自:	发表于： 2005-08-10 00:49 \| 只看楼主短消息资料字号：小中大 3楼【回复“魔法学徒”的帖子】仍然存在,安全模式扫描 HijackThis_zww汉化版扫描日志 V1.99.1 保存于 0:45:22, 日期 2005-8-10 操作系统： Windows XP SP1 (WinNT 5.01.2600) 浏览器： Internet Explorer v6.00 SP1 (6.00.2800.1106) 当前运行的进程： C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\Explorer.EXE C:\Documents and Settings\phil\桌面\4483172005624221516\HijackThis1991zww.exe O3 - IE工具栏增项: 电台(&R) - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx O3 - IE工具栏增项: FlashGet Bar - {E0E899AB-F487-11D5-8D29-0050BA6940E3} - C:\PROGRA~1\FlashGet\fgiebar.dll O4 - 启动项HKLM\\Run: [IMJPMIG8.1] ; "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32 O4 - 启动项HKLM\\Run: [PHIME2002ASync] ; C:\WINDOWS\System32\IME\TINTLGNT\TINTSETP.EXE /SYNC O4 - 启动项HKLM\\Run: [PHIME2002A] ; C:\WINDOWS\System32\IME\TINTLGNT\TINTSETP.EXE /IMEName O4 - 启动项HKLM\\Run: [Smapp] ; C:\Program Files\Analog Devices\SoundMAX\Smtray.exe O4 - 启动项HKLM\\Run: [KAVPersonal50] "C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus Personal\kav.exe" /minimize O4 - 启动项HKLM\\Run: [Super Rabbit SRRestore] C:\Program Files\Super Rabbit\MagicSet\srrest.exe /autosave O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\System32\ctfmon.exe O4 - HKCU\..\Run: [Super Rabbit IEPro] ; C:\Program Files\Super Rabbit\MagicSet\SRIECLI.EXE /LOAD O4 - Global Startup: InterVideo WinCinema Manager.lnk = C:\Program Files\InterVideo\Common\Bin\WinCinemaMgr.exe O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE O8 - IE右键菜单中的新增项目: 使用网际快车下载 - C:\Program Files\FlashGet\jc_link.htm O8 - IE右键菜单中的新增项目: 使用网际快车下载全部链接 - C:\Program Files\FlashGet\jc_all.htm O9 - 浏览器额外的按钮: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\PROGRA~1\FlashGet\flashget.exe O9 - 浏览器额外的“工具”菜单项: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\PROGRA~1\FlashGet\flashget.exe O17 - HKLM\System\CCS\Services\Tcpip\..\{C19DF564-12BC-4D82-9CB3-499D370210FC}: NameServer = 61.134.1.4,61.134.1.9 O23 - NT 服务: kavsvc - Kaspersky Lab - C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus Personal\kavsvc.exe O23 - NT 服务: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe O23 - NT 服务: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe 谢谢!
seph 初生襁褓狮帖子:10 注册: 2005-08-09 来自:

魔法学徒卡卡技术团队帖子:11465 注册: 2004-10-03 来自:	发表于： 2005-08-10 01:01 \| 短消息资料字号：小中大 4楼请检查注册表启动项 HKLM\Software\Microsoft\Windows\CurrentVersion\Run HKCU\Software\Microsoft\Windows\CurrentVersion\Run HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnce HKLM\Software\Microsoft\Windows\CurrentVersion\RunServices HKCU\Software\Microsoft\Windows\CurrentVersion\RunServices HKLM\Software\Microsoft\Windows\CurrentVersion\RunServicesOnce HKCU\Software\Microsoft\Windows\CurrentVersion\RunServicesOnce HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnceEx HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit
魔法学徒卡卡技术团队帖子:11465 注册: 2004-10-03 来自:

seph 初生襁褓狮帖子:10 注册: 2005-08-09 来自:	发表于： 2005-08-10 01:38 \| 只看楼主短消息资料字号：小中大 5楼检查过,好象没什么异常啊
seph 初生襁褓狮帖子:10 注册: 2005-08-09 来自:

魔法学徒卡卡技术团队帖子:11465 注册: 2004-10-03 来自:	发表于： 2005-08-10 01:50 \| 短消息资料字号：小中大 6楼开机时自动打开ie说明启动项应该是有问题。请使用hijackthis中混合工具箱中的“生成启动项列表”（列出全部）贴上来
魔法学徒卡卡技术团队帖子:11465 注册: 2004-10-03 来自:

seph 初生襁褓狮帖子:10 注册: 2005-08-09 来自:	发表于： 2005-08-10 23:51 \| 只看楼主短消息资料字号：小中大 7楼启动项报告： 2005-8-10, 23:48:03 启动项扫描器版本： 1.52.2 开始于： C:\Documents and Settings\phil\桌面\4483172005624221516\HijackThis1991zww.EXE 系统检测： Windows XP SP1 (WinNT 5.01.2600) 系统检测： Internet Explorer v6.00 SP1 (6.00.2800.1106) * 使用默认选项 * 选择“列出全部(全面)”方式 ================================================== 当前运行的进程： C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\Explorer.EXE C:\WINDOWS\System32\ctfmon.exe C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\System32\nvsvc32.exe C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe C:\Program Files\Maxthon\Maxthon.exe C:\Documents and Settings\phil\桌面\4483172005624221516\HijackThis1991zww.exe -------------------------------------------------- 文件夹中的启动项 Shell folders Startup: [C:\Documents and Settings\phil\「开始」菜单\程序\启动] No files Shell folders AltStartup: Folder not found User shell folders Startup: Folder not found User shell folders AltStartup: Folder not found Shell folders Common Startup: [C:\Documents and Settings\All Users\「开始」菜单\程序\启动] InterVideo WinCinema Manager.lnk = C:\Program Files\InterVideo\Common\Bin\WinCinemaMgr.exe Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE Shell folders Common AltStartup: Folder not found User shell folders Common Startup: Folder not found User shell folders Alternate Common Startup: Folder not found -------------------------------------------------- Checking Windows NT UserInit: [HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon] UserInit = C:\WINDOWS\SYSTEM32\Userinit.exe, [HKLM\Software\Microsoft\Windows\CurrentVersion\Winlogon] * 未找到相关注册表键值 * [HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon] * 未找到相关注册表键值 * [HKCU\Software\Microsoft\Windows\CurrentVersion\Winlogon] * 未找到相关注册表键值 * -------------------------------------------------- 注册表中的启动项: HKLM\Software\Microsoft\Windows\CurrentVersion\Run IMJPMIG8.1 = ; "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32 PHIME2002ASync = ; C:\WINDOWS\System32\IME\TINTLGNT\TINTSETP.EXE /SYNC PHIME2002A = ; C:\WINDOWS\System32\IME\TINTLGNT\TINTSETP.EXE /IMEName Smapp = ; C:\Program Files\Analog Devices\SoundMAX\Smtray.exe KAVPersonal50 = "C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus Personal\kav.exe" /minimize Super Rabbit SRRestore = C:\Program Files\Super Rabbit\MagicSet\srrest.exe /autosave -------------------------------------------------- 注册表中的启动项: HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce * 未找到值 * -------------------------------------------------- 注册表中的启动项: HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnceEx * 未找到值 * -------------------------------------------------- 注册表中的启动项: HKLM\Software\Microsoft\Windows\CurrentVersion\RunServices * 未找到值 * -------------------------------------------------- 注册表中的启动项: HKLM\Software\Microsoft\Windows\CurrentVersion\RunServicesOnce * 未找到相关注册表键值 * -------------------------------------------------- 注册表中的启动项: HKCU\Software\Microsoft\Windows\CurrentVersion\Run ctfmon.exe = C:\WINDOWS\System32\ctfmon.exe Super Rabbit IEPro = ; C:\Program Files\Super Rabbit\MagicSet\SRIECLI.EXE /LOAD -------------------------------------------------- 注册表中的启动项: HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnce * 未找到值 * -------------------------------------------------- 注册表中的启动项: HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnceEx * 未找到相关注册表键值 * -------------------------------------------------- 注册表中的启动项: HKCU\Software\Microsoft\Windows\CurrentVersion\RunServices * 未找到相关注册表键值 * -------------------------------------------------- 注册表中的启动项: HKCU\Software\Microsoft\Windows\CurrentVersion\RunServicesOnce * 未找到相关注册表键值 * -------------------------------------------------- 注册表中的启动项: HKLM\Software\Microsoft\Windows NT\CurrentVersion\Run * 未找到相关注册表键值 * -------------------------------------------------- 注册表中的启动项: HKCU\Software\Microsoft\Windows NT\CurrentVersion\Run * 未找到相关注册表键值 * -------------------------------------------------- Autorun entries in Registry subkeys of: HKLM\Software\Microsoft\Windows\CurrentVersion\Run [OptionalComponents] * 未找到值 * -------------------------------------------------- Autorun entries in Registry subkeys of: HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce No subkeys found -------------------------------------------------- Autorun entries in Registry subkeys of: HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnceEx No subkeys found -------------------------------------------------- Autorun entries in Registry subkeys of: HKLM\Software\Microsoft\Windows\CurrentVersion\RunServices No subkeys found -------------------------------------------------- Autorun entries in Registry subkeys of: HKLM\Software\Microsoft\Windows\CurrentVersion\RunServicesOnce * 未找到相关注册表键值 * -------------------------------------------------- Autorun entries in Registry subkeys of: HKCU\Software\Microsoft\Windows\CurrentVersion\Run No subkeys found --------------------------------------------------
seph 初生襁褓狮帖子:10 注册: 2005-08-09 来自:

seph 初生襁褓狮帖子:10 注册: 2005-08-09 来自:	发表于： 2005-08-10 23:52 \| 只看楼主短消息资料字号：小中大 8楼 Autorun entries in Registry subkeys of: HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnce No subkeys found -------------------------------------------------- Autorun entries in Registry subkeys of: HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnceEx * 未找到相关注册表键值 * -------------------------------------------------- Autorun entries in Registry subkeys of: HKCU\Software\Microsoft\Windows\CurrentVersion\RunServices * 未找到相关注册表键值 * -------------------------------------------------- Autorun entries in Registry subkeys of: HKCU\Software\Microsoft\Windows\CurrentVersion\RunServicesOnce * 未找到相关注册表键值 * -------------------------------------------------- Autorun entries in Registry subkeys of: HKLM\Software\Microsoft\Windows NT\CurrentVersion\Run * 未找到相关注册表键值 * -------------------------------------------------- Autorun entries in Registry subkeys of: HKCU\Software\Microsoft\Windows NT\CurrentVersion\Run * 未找到相关注册表键值 * -------------------------------------------------- 文件打开方式关联 for .EXE: HKEY_CLASSES_ROOT\exefile\shell\open\command (黙认) = "%1" %* -------------------------------------------------- 文件打开方式关联 for .COM: HKEY_CLASSES_ROOT\comfile\shell\open\command (黙认) = "%1" %* -------------------------------------------------- 文件打开方式关联 for .BAT: HKEY_CLASSES_ROOT\batfile\shell\open\command (黙认) = "%1" %* -------------------------------------------------- 文件打开方式关联 for .PIF: HKEY_CLASSES_ROOT\piffile\shell\open\command (黙认) = "%1" %* -------------------------------------------------- 文件打开方式关联 for .SCR: HKEY_CLASSES_ROOT\scrfile\shell\open\command (黙认) = "%1" /S -------------------------------------------------- 文件打开方式关联 for .HTA: HKEY_CLASSES_ROOT\htafile\shell\open\command (黙认) = C:\WINDOWS\System32\mshta.exe "%1" %* -------------------------------------------------- 文件打开方式关联 for .TXT: HKEY_CLASSES_ROOT\txtfile\shell\open\command (黙认) = %SystemRoot%\system32\NOTEPAD.EXE %1 -------------------------------------------------- Enumerating ICQ Agent Autostart apps: HKCU\Software\Mirabilis\ICQ\Agent\Apps * 未找到相关注册表键值 * -------------------------------------------------- Load/Run keys from C:\WINDOWS\WIN.INI: load=* 未找到INI相关项目值 * run=* 未找到INI相关项目值 * Load/Run keys from Registry: HKLM\..\Windows NT\CurrentVersion\WinLogon: load=* 未找到相关注册表键值 * HKLM\..\Windows NT\CurrentVersion\WinLogon: run=* 未找到相关注册表键值 * HKLM\..\Windows\CurrentVersion\WinLogon: load=* 未找到相关注册表键值 * HKLM\..\Windows\CurrentVersion\WinLogon: run=* 未找到相关注册表键值 * HKCU\..\Windows NT\CurrentVersion\WinLogon: load=* 未找到相关注册表键值 * HKCU\..\Windows NT\CurrentVersion\WinLogon: run=* 未找到相关注册表键值 * HKCU\..\Windows\CurrentVersion\WinLogon: load=* 未找到相关注册表键值 * HKCU\..\Windows\CurrentVersion\WinLogon: run=* 未找到相关注册表键值 * HKCU\..\Windows NT\CurrentVersion\Windows: load= HKCU\..\Windows NT\CurrentVersion\Windows: run= HKLM\..\Windows NT\CurrentVersion\Windows: load= HKLM\..\Windows NT\CurrentVersion\Windows: run= HKLM\..\Windows NT\CurrentVersion\Windows: AppInit_DLLs= -------------------------------------------------- 外壳扩展和屏幕保护程序的键值从 C:\WINDOWS\SYSTEM.INI: Shell=* 未找到INI相关项目值 * SCRNSAVE.EXE=* 未找到INI相关项目值 * drivers=* 未找到INI相关项目值 * 外壳扩展和屏幕保护程序的键值从注册表 Shell=Explorer.exe SCRNSAVE.EXE=C:\WINDOWS\System32\logon.scr drivers=* 未找到相关注册表键值 * Policies Shell key: HKCU\..\Policies: Shell=* 未找到相关注册表键值 * HKLM\..\Policies: Shell=* 未找到相关注册表键值 * -------------------------------------------------- 列举IE浏览器辅助对象(BHO模块): * 没有发现 BHO 模块 * -------------------------------------------------- 列举“计划任务”服务: No jobs found -------------------------------------------------- 列举下载的程序文件： [DirectAnimation Java Classes] CODEBASE = file://C:\WINDOWS\Java\classes\dajava.cab OSD = C:\WINDOWS\Downloaded Program Files\DirectAnimation Java Classes.osd [Microsoft XML Parser for Java] CODEBASE = file://C:\WINDOWS\Java\classes\xmldso.cab OSD = C:\WINDOWS\Downloaded Program Files\Microsoft XML Parser for Java.osd [Shockwave Flash Object] InProcServer32 = C:\WINDOWS\System32\macromed\flash\Flash.ocx CODEBASE = http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab -------------------------------------------------- 列举 Winsock LSP 文件： NameSpace #1: C:\WINDOWS\System32\mswsock.dll NameSpace #2: C:\WINDOWS\System32\winrnr.dll NameSpace #3: C:\WINDOWS\System32\mswsock.dll Protocol #1: C:\WINDOWS\system32\mswsock.dll Protocol #2: C:\WINDOWS\system32\mswsock.dll Protocol #3: C:\WINDOWS\system32\mswsock.dll Protocol #4: C:\WINDOWS\system32\rsvpsp.dll Protocol #5: C:\WINDOWS\system32\rsvpsp.dll Protocol #6: C:\WINDOWS\system32\mswsock.dll Protocol #7: C:\WINDOWS\system32\mswsock.dll Protocol #8: C:\WINDOWS\system32\mswsock.dll Protocol #9: C:\WINDOWS\system32\mswsock.dll Protocol #10: C:\WINDOWS\system32\mswsock.dll Protocol #11: C:\WINDOWS\system32\mswsock.dll -------------------------------------------------- Enumerating Windows NT logon/logoff scripts: No scripts set to run Windows NT checkdisk command: BootExecute = autocheck autochk * Windows NT 'Wininit.ini': PendingFileRenameOperations: * 未找到相关注册表键值 * -------------------------------------------------- 列举 ShellServiceObjectDelayLoad 项目： PostBootReminder: C:\WINDOWS\system32\SHELL32.dll CDBurn: C:\WINDOWS\system32\SHELL32.dll WebCheck: C:\WINDOWS\System32\webcheck.dll SysTray: C:\WINDOWS\System32\stobject.dll -------------------------------------------------- 注册表中的启动项: HKCU\Software\Microsoft\Windows\CurrentVersion\policies\Explorer\Run IEXPLORE.EXE = -------------------------------------------------- 注册表中的启动项: HKLM\Software\Microsoft\Windows\CurrentVersion\policies\Explorer\Run IEXPLORE.EXE = IEXPLORE.EXE http://%62%61%69%64%69%2E%37%37%31%36%39%2E%6F%72%67 -------------------------------------------------- 报告完毕，共 13,097 字节报告生成用时：0.047秒 Command line options: /verbose - to add additional info on each section /complete - to include empty sections and unsuspicious data /full - to include several rarely-important sections /force9x - to include Win9x-only startups even if running on WinNT /forcent - to include WinNT-only startups even if running on Win9x /forceall - to include all Win9x and WinNT startups, regardless of platform /history - to list version history only
seph 初生襁褓狮帖子:10 注册: 2005-08-09 来自:

seph 初生襁褓狮帖子:10 注册: 2005-08-09 来自:	发表于： 2005-08-10 23:53 \| 只看楼主短消息资料字号：小中大 9楼是不是这个家伙在搞事? -------------------------------------------------- 注册表中的启动项: HKLM\Software\Microsoft\Windows\CurrentVersion\policies\Explorer\Run IEXPLORE.EXE = IEXPLORE.EXE http://%62%61%69%64%69%2E%37%37%31%36%39%2E%6F%72%67 --------------------------------------------------
seph 初生襁褓狮帖子:10 注册: 2005-08-09 来自:

seph 初生襁褓狮帖子:10 注册: 2005-08-09 来自:	发表于： 2005-08-10 23:58 \| 只看楼主短消息资料字号：小中大 10楼就是它在作怪,删除重启,暂时没事了
seph 初生襁褓狮帖子:10 注册: 2005-08-09 来自:

<<上一主题|下一主题>>

12

1 / 2 页

跳转页

页面顶部

Powered by Discuz!NT