123   1  /  3  页   跳转页

中了Backdoor.Gpigeon.fok 怎么解决？

收藏
★心剑☆
头像
初生襁褓狮
  • 帖子:14
  • 注册: 2006-08-30
  • 来自:
发表于： 2006-08-30 11:16 | 只看楼主 短消息 资料
字号： 小 中 大 1楼

中了Backdoor.Gpigeon.fok 怎么解决？

Logfile of HijackThis v1.99.1
Scan saved at 10:54:49, on 2006-8-30
Platform: Windows 2000 SP4 (WinNT 5.00.2195)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINNT\System32\smss.exe
C:\WINNT\system32\csrss.exe
C:\WINNT\system32\winlogon.exe
C:\WINNT\system32\services.exe
C:\WINNT\system32\lsass.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\system32\spoolsv.exe
C:\WINNT\system32\DRIVERS\CDANTSRV.EXE
C:\WINNT\system32\svchost.exe
C:\WINNT\system32\regsvc.exe
C:\WINNT\system32\MSTask.exe
C:\WINNT\System32\WBEM\WinMgmt.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\Explorer.exe
C:\WINNT\system32\internat.exe
C:\WINNT\system32\wdfmgr32.exe
C:\WINNT\system32\NTdhcp.exe
C:\WINNT\SMSS.EXE
C:\WINNT\system32\conime.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Documents and Settings\Administrator\桌面\HijackThis V1[1].99.1汉化版\HijackThis.exe

F2 - REG:system.ini: Shell=Explorer.exe 1
F2 - REG:system.ini: UserInit=C:\WINNT\system32\userinit.exe,,C:\WINNT\system32\internst.exe
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {3D898C55-74CC-4B7C-B5F1-45913F368388} - D:\白猫清理工\MsWinb.dll
O2 - BHO: NetAnts.IE.Monitor - {57E91B41-F40A-11D1-B792-444553540000} - D:\Program Files\NetAnts\AntAPI.dll
O2 - BHO: DownloadBHO T2BHO - {B1D147E7-873E-4909-8127-695D9BB78728} - (no file)
O2 - BHO: IE - {D157330A-9EF3-49F8-9A67-4141AC41ADD4} - C:\WINNT\DOWNLO~1\CnsHook.dll
O2 - BHO: ImageBHO ImageCapture - {FFFFA99F-2252-4ce4-8CC9-2D11B4FB940D} - (no file)
O3 - Toolbar: @msdxmLC.dll,-1@2052,电台(&R) - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINNT\system32\msdxm.ocx
O3 - Toolbar: (no name) - {E0E899AB-F487-11D5-8D29-0050BA6940E3} - (no file)
O3 - Toolbar: (no name) - {56A7DC70-E102-4408-A34A-AE06FEF01586} - (no file)
O4 - HKLM\..\Run: [Synchronization Manager] mobsync.exe /logon
O4 - HKLM\..\Run: [TProgram] C:\WINNT\SMSS.EXE
O4 - HKLM\..\Run: [wdfmgr32] C:\WINNT\system32\wdfmgr32.exe
O4 - HKLM\..\Run: [NTdhcp] C:\WINNT\system32\NTdhcp.exe
O4 - HKLM\..\Run: [zt] C:\Program Files\Intel\svhost32.exe
O4 - HKLM\..\RunServices: [TProgram] C:\WINNT\SMSS.EXE
O4 - HKCU\..\Run: [Internat.exe] internat.exe
O8 - Extra context menu item: !搜一搜 - res://C:\WINNT\DOWNLO~1\CnsMinEx.dll/1003
O8 - Extra context menu item: &Download by NetAnts - D:\PROGRA~1\NETANTS\NAGet.htm
O8 - Extra context menu item: Download &All by NetAnts - D:\PROGRA~1\NETANTS\NAGetAll.htm
O8 - Extra context menu item: 添加到QQ自定义面板 - \\Jh\D\Tencent\QQ\AddPanel.htm
O8 - Extra context menu item: 添加到QQ表情 - \\Jh\D\Tencent\QQ\AddEmotion.htm
O8 - Extra context menu item: 用QQ彩信发送该图片 - \\Jh\D\Tencent\QQ\SendMMS.htm
O8 - Extra context menu item: 豪杰超级解霸V8实时播放 - d:\Herosoft\HeroV8\MPURLGET.HTM
O9 - Extra button: 手机短信 - {00000000-0000-0001-0001-596BAEDD1289} - http://sms.3721.com/ie/index.htm?pid=U_7789_45999 (file missing)
O9 - Extra button: pp点点通 - {0713E8D2-850A-101B-AFC0-4210102A8DA7} - C:\WINNT\system32\shdocvw.dll
O9 - Extra button: 豪杰超级解霸V8 - {367E0A21-8601-4986-9C9A-153BF5ACA118} - d:\Herosoft\HeroV8\STHSDVD.EXE
O9 - Extra 'Tools' menuitem: 豪杰超级解霸V8 - {367E0A21-8601-4986-9C9A-153BF5ACA118} - d:\Herosoft\HeroV8\STHSDVD.EXE
O9 - Extra button: Yahoo 1G电邮 - {507F9113-CD77-4866-BA92-0E86DA3D0B97} - http://cn.mail.yahoo.com/promo/rd1 (file missing)
O9 - Extra button: NetAnts - {57E91B47-F40A-11D1-B792-444553540000} - D:\PROGRA~1\NETANTS\NetAnts.exe
O9 - Extra 'Tools' menuitem: &NetAnts - {57E91B47-F40A-11D1-B792-444553540000} - D:\PROGRA~1\NETANTS\NetAnts.exe
O9 - Extra button: 寻宝乐趣多 - {59BC54A2-56B3-44a0-93E5-432D58746E26} - http://hot.3721.com/rd/shop_btn.htm (file missing)
O9 - Extra button: 上网助手 - {5D73EE86-05F1-49ed-B850-E423120EC338} - http://assistant.3721.com/index.htm?fb=Cns (file missing)
O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINNT\web\related.htm
O9 - Extra 'Tools' menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINNT\web\related.htm
O9 - Extra button: QQ - {c95fe080-8f5d-11d2-a20b-00aa003c157b} - C:\Program Files\Tencent\QQ\QQ.exe
O9 - Extra 'Tools' menuitem: 腾讯QQ - {c95fe080-8f5d-11d2-a20b-00aa003c157b} - C:\Program Files\Tencent\QQ\QQ.exe
O9 - Extra button: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\WINNT\system32\shdocvw.dll
O9 - Extra 'Tools' menuitem: &FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\WINNT\system32\shdocvw.dll
O9 - Extra button: 金游世界 - {E36492E7-9613-4308-B3A0-9CBB1CCBF99F} - d:\Program Files\JgameII\hall\Hall.exe (file missing)
O9 - Extra 'Tools' menuitem: 金游世界 - {E36492E7-9613-4308-B3A0-9CBB1CCBF99F} - d:\Program Files\JgameII\hall\Hall.exe (file missing)
O9 - Extra button: 情景聊天 - {E5D12C4E-7B4F-11D3-B5C9-0050045C3C96} - http://cn.rd.yahoo.com/home/messenger/bjk/clientbtn/?http://cn.messenger.yahoo.com/ (file missing)
O9 - Extra button: (no name) - {ECF2E268-F28C-48d2-9AB7-8F69C11CCB71} - http://assistant.3721.com/security1.htm?fb=Cns (file missing)
O9 - Extra 'Tools' menuitem: 修复浏览器 - {ECF2E268-F28C-48d2-9AB7-8F69C11CCB71} - http://assistant.3721.com/security1.htm?fb=Cns (file missing)
O9 - Extra button: (no name) - {FD00D911-7529-4084-9946-A29F1BDF4FE5} - http://assistant.3721.com/clean1.htm?fb=Cns (file missing)
O9 - Extra 'Tools' menuitem: 清理上网记录 - {FD00D911-7529-4084-9946-A29F1BDF4FE5} - http://assistant.3721.com/clean1.htm?fb=Cns (file missing)
O11 - Options group: [!CNS]  网络实名
O16 - DPF: {B4FE8160-76DB-48C4-9803-68ED6278CA2C} (File  Uploader ) - http://mail.e165.com/main/uploaderx.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{97CA3DC3-8654-4103-91AB-924DE2F3B056}: NameServer = 221.228.255.1
O20 - Winlogon Notify: igfxcui - C:\WINNT\SYSTEM32\igfxsrvc.dll
O23 - Service: C-DillaSrv - C-Dilla Ltd - C:\WINNT\system32\DRIVERS\CDANTSRV.EXE
O23 - Service: Logical Disk Manager Administrative Service (dmadmin) - VERITAS Software Corp. - C:\WINNT\System32\dmadmin.exe
O23 - Service: Rising Proxy  Service (RfwProxySrv) - Beijing Rising Technology Co., Ltd. - d:\program files\rising\rfw\rfwproxy.exe
最后编辑2006-08-30 15:05:03
分享到：
gototop
 
yanmings
头像
锋芒艾服狮
  • 帖子:1698
  • 注册: 2005-01-10
  • 来自:
发表于： 2006-08-30 11:28 | 短消息 资料
字号： 小 中 大 2楼

先参考http://forum.ikaka.com/topic.asp?board=28&artid=8141143落雪"木马系列专杀
gototop
 
★心剑☆
头像
初生襁褓狮
  • 帖子:14
  • 注册: 2006-08-30
  • 来自:
发表于： 2006-08-30 11:29 | 只看楼主 短消息 资料
字号： 小 中 大 3楼

高手看看怎么解决
gototop
 
yanmings
头像
锋芒艾服狮
  • 帖子:1698
  • 注册: 2005-01-10
  • 来自:
发表于： 2006-08-30 11:30 | 短消息 资料
字号： 小 中 大 4楼

楼主的机子跟病毒库差不多了，汗
gototop
 
★心剑☆
头像
初生襁褓狮
  • 帖子:14
  • 注册: 2006-08-30
  • 来自:
发表于： 2006-08-30 12:45 | 只看楼主 短消息 资料
字号： 小 中 大 5楼

瑞星和狮子落雪系列专杀、江民专杀
都杀过了，还是没用，老是一会儿重启
gototop
 
★心剑☆
头像
初生襁褓狮
  • 帖子:14
  • 注册: 2006-08-30
  • 来自:
发表于： 2006-08-30 12:47 | 只看楼主 短消息 资料
字号： 小 中 大 6楼

Logfile of HijackThis v1.99.1
Scan saved at 12:43:01, on 2006-8-30
Platform: Windows 2000 SP4 (WinNT 5.00.2195)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINNT\System32\smss.exe
C:\WINNT\system32\winlogon.exe
C:\WINNT\system32\services.exe
C:\WINNT\system32\lsass.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\system32\spoolsv.exe
C:\WINNT\system32\DRIVERS\CDANTSRV.EXE
C:\WINNT\system32\svchost.exe
C:\WINNT\system32\regsvc.exe
C:\WINNT\system32\MSTask.exe
C:\WINNT\System32\WBEM\WinMgmt.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\Explorer.EXE
C:\WINNT\system32\winmer.exe
C:\WINNT\system32\internat.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Documents and Settings\Administrator\桌面\HijackThis V1[1].99.1汉化版\HijackThis.exe

F2 - REG:system.ini: UserInit=C:\WINNT\system32\Userinit.exe
O1 - Hosts: 61.188.38.64 www.gamezt.com.cn
O1 - Hosts: 61.188.38.64 ert0003.e76.163ns.com
O1 - Hosts: 61.188.38.64 sky001.e11.163ns.com
O1 - Hosts: 61.188.38.64 woool.100888290cs.com
O1 - Hosts: 61.188.38.64 rxjh.100888290cs.com
O1 - Hosts: 61.188.38.64 www.yowoool.com
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {3D898C55-74CC-4B7C-B5F1-45913F368388} - D:\白猫清理工\MsWinb.dll
O2 - BHO: NetAnts.IE.Monitor - {57E91B41-F40A-11D1-B792-444553540000} - D:\Program Files\NetAnts\AntAPI.dll
O2 - BHO: DownloadBHO T2BHO - {B1D147E7-873E-4909-8127-695D9BB78728} - (no file)
O2 - BHO: IE - {D157330A-9EF3-49F8-9A67-4141AC41ADD4} - C:\WINNT\DOWNLO~1\CnsHook.dll
O2 - BHO: ImageBHO ImageCapture - {FFFFA99F-2252-4ce4-8CC9-2D11B4FB940D} - (no file)
O3 - Toolbar: @msdxmLC.dll,-1@2052,电台(&R) - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINNT\system32\msdxm.ocx
O3 - Toolbar: (no name) - {E0E899AB-F487-11D5-8D29-0050BA6940E3} - (no file)
O3 - Toolbar: (no name) - {56A7DC70-E102-4408-A34A-AE06FEF01586} - (no file)
O4 - HKLM\..\Run: [Synchronization Manager] mobsync.exe /logon
O4 - HKLM\..\Run: [zt] C:\Program Files\Intel\svhost32.exe
O4 - HKCU\..\Run: [Internat.exe] internat.exe
O8 - Extra context menu item: !搜一搜 - res://C:\WINNT\DOWNLO~1\CnsMinEx.dll/1003
O8 - Extra context menu item: &Download by NetAnts - D:\PROGRA~1\NETANTS\NAGet.htm
O8 - Extra context menu item: Download &All by NetAnts - D:\PROGRA~1\NETANTS\NAGetAll.htm
O8 - Extra context menu item: 添加到QQ自定义面板 - \\Jh\D\Tencent\QQ\AddPanel.htm
O8 - Extra context menu item: 添加到QQ表情 - \\Jh\D\Tencent\QQ\AddEmotion.htm
O8 - Extra context menu item: 用QQ彩信发送该图片 - \\Jh\D\Tencent\QQ\SendMMS.htm
O8 - Extra context menu item: 豪杰超级解霸V8实时播放 - d:\Herosoft\HeroV8\MPURLGET.HTM
O9 - Extra button: 手机短信 - {00000000-0000-0001-0001-596BAEDD1289} - http://sms.3721.com/ie/index.htm?pid=U_7789_45999 (file missing)
O9 - Extra button: pp点点通 - {0713E8D2-850A-101B-AFC0-4210102A8DA7} - C:\WINNT\system32\shdocvw.dll
O9 - Extra button: 豪杰超级解霸V8 - {367E0A21-8601-4986-9C9A-153BF5ACA118} - d:\Herosoft\HeroV8\STHSDVD.EXE
O9 - Extra 'Tools' menuitem: 豪杰超级解霸V8 - {367E0A21-8601-4986-9C9A-153BF5ACA118} - d:\Herosoft\HeroV8\STHSDVD.EXE
O9 - Extra button: Yahoo 1G电邮 - {507F9113-CD77-4866-BA92-0E86DA3D0B97} - http://cn.mail.yahoo.com/promo/rd1 (file missing)
O9 - Extra button: NetAnts - {57E91B47-F40A-11D1-B792-444553540000} - D:\PROGRA~1\NETANTS\NetAnts.exe
O9 - Extra 'Tools' menuitem: &NetAnts - {57E91B47-F40A-11D1-B792-444553540000} - D:\PROGRA~1\NETANTS\NetAnts.exe
O9 - Extra button: 寻宝乐趣多 - {59BC54A2-56B3-44a0-93E5-432D58746E26} - http://hot.3721.com/rd/shop_btn.htm (file missing)
O9 - Extra button: 上网助手 - {5D73EE86-05F1-49ed-B850-E423120EC338} - http://assistant.3721.com/index.htm?fb=Cns (file missing)
O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINNT\web\related.htm
O9 - Extra 'Tools' menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINNT\web\related.htm
O9 - Extra button: QQ - {c95fe080-8f5d-11d2-a20b-00aa003c157b} - C:\Program Files\Tencent\QQ\QQ.exe
O9 - Extra 'Tools' menuitem: 腾讯QQ - {c95fe080-8f5d-11d2-a20b-00aa003c157b} - C:\Program Files\Tencent\QQ\QQ.exe
O9 - Extra button: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\WINNT\system32\shdocvw.dll
O9 - Extra 'Tools' menuitem: &FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\WINNT\system32\shdocvw.dll
O9 - Extra button: 金游世界 - {E36492E7-9613-4308-B3A0-9CBB1CCBF99F} - d:\Program Files\JgameII\hall\Hall.exe (file missing)
O9 - Extra 'Tools' menuitem: 金游世界 - {E36492E7-9613-4308-B3A0-9CBB1CCBF99F} - d:\Program Files\JgameII\hall\Hall.exe (file missing)
O9 - Extra button: 情景聊天 - {E5D12C4E-7B4F-11D3-B5C9-0050045C3C96} - http://cn.rd.yahoo.com/home/messenger/bjk/clientbtn/?http://cn.messenger.yahoo.com/ (file missing)
O9 - Extra button: (no name) - {ECF2E268-F28C-48d2-9AB7-8F69C11CCB71} - http://assistant.3721.com/security1.htm?fb=Cns (file missing)
O9 - Extra 'Tools' menuitem: 修复浏览器 - {ECF2E268-F28C-48d2-9AB7-8F69C11CCB71} - http://assistant.3721.com/security1.htm?fb=Cns (file missing)
O9 - Extra button: (no name) - {FD00D911-7529-4084-9946-A29F1BDF4FE5} - http://assistant.3721.com/clean1.htm?fb=Cns (file missing)
O9 - Extra 'Tools' menuitem: 清理上网记录 - {FD00D911-7529-4084-9946-A29F1BDF4FE5} - http://assistant.3721.com/clean1.htm?fb=Cns (file missing)
O11 - Options group: [!CNS]  网络实名
O16 - DPF: {B4FE8160-76DB-48C4-9803-68ED6278CA2C} (File  Uploader ) - http://mail.e165.com/main/uploaderx.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{97CA3DC3-8654-4103-91AB-924DE2F3B056}: NameServer = 221.228.255.1
O20 - Winlogon Notify: igfxcui - C:\WINNT\SYSTEM32\igfxsrvc.dll
O23 - Service: C-DillaSrv - C-Dilla Ltd - C:\WINNT\system32\DRIVERS\CDANTSRV.EXE
O23 - Service: Logical Disk Manager Administrative Service (dmadmin) - VERITAS Software Corp. - C:\WINNT\System32\dmadmin.exe
O23 - Service: Rising Proxy  Service (RfwProxySrv) - Beijing Rising Technology Co., Ltd. - d:\program files\rising\rfw\rfwproxy.exe
O23 - Service: RsRavMon Service (RsRavMon) - Beijing Rising Technology Co., Ltd. - D:\Program Files\rising\Rav\Ravmond.exe
gototop
 
yanmings
头像
锋芒艾服狮
  • 帖子:1698
  • 注册: 2005-01-10
  • 来自:
发表于： 2006-08-30 12:54 | 短消息 资料
字号： 小 中 大 7楼

结束以下进程
C:\WINNT\system32\wdfmgr32.exe
C:\WINNT\system32\NTdhcp.exe
C:\WINNT\SMSS.EXE
修复
F2 - REG:system.ini: Shell=Explorer.exe 1
F2 - REG:system.ini: UserInit=C:\WINNT\system32\userinit.exe,,C:\WINNT\system32\internst.exe
O2 - BHO: DownloadBHO T2BHO - {B1D147E7-873E-4909-8127-695D9BB78728} - (no file)
O2 - BHO: ImageBHO ImageCapture - {FFFFA99F-2252-4ce4-8CC9-2D11B4FB940D} - (no file)
O3 - Toolbar: (no name) - {E0E899AB-F487-11D5-8D29-0050BA6940E3} - (no file)
O3 - Toolbar: (no name) - {56A7DC70-E102-4408-A34A-AE06FEF01586} - (no file)
O4 - HKLM\..\Run: [wdfmgr32] C:\WINNT\system32\wdfmgr32.exe
O4 - HKLM\..\Run: [NTdhcp] C:\WINNT\system32\NTdhcp.exe
O4 - HKLM\..\Run: [zt] C:\Program Files\Intel\svhost32.exe


O4 - HKLM\..\Run: [TProgram] C:\WINNT\SMSS.EXE
O4 - HKLM\..\RunServices: [TProgram] C:\WINNT\SMSS.EXE
参考http://forum.ikaka.com/topic.asp?board=28&artid=8046765&page=1


这个针对顶楼的日志的
gototop
 
yanmings
头像
锋芒艾服狮
  • 帖子:1698
  • 注册: 2005-01-10
  • 来自:
发表于： 2006-08-30 12:56 | 短消息 资料
字号： 小 中 大 8楼

修复
O1 - Hosts: 61.188.38.64 www.gamezt.com.cn
O1 - Hosts: 61.188.38.64 ert0003.e76.163ns.com
O1 - Hosts: 61.188.38.64 sky001.e11.163ns.com
O1 - Hosts: 61.188.38.64 woool.100888290cs.com
O1 - Hosts: 61.188.38.64 rxjh.100888290cs.com
O1 - Hosts: 61.188.38.64 www.yowoool.com
再到http://www.kztechs.com/sreng/sreng2.zip 下载System Repair Engineer 2.0.21.505（RC2）导出全部日志
gototop
 
★心剑☆
头像
初生襁褓狮
  • 帖子:14
  • 注册: 2006-08-30
  • 来自:
发表于： 2006-08-30 13:12 | 只看楼主 短消息 资料
字号： 小 中 大 9楼

提示启动项目中Userinit为非正常值
gototop
 
★心剑☆
头像
初生襁褓狮
  • 帖子:14
  • 注册: 2006-08-30
  • 来自:
发表于： 2006-08-30 13:13 | 只看楼主 短消息 资料
字号： 小 中 大 10楼

System Repair Engineer 2.0.21.505 (2.0 RC 2)
Smallfrogs (http://www.KZTechs.com)

Windows 2000 Professional Service Pack 4 (Build 2195)
- 管理权限用户 - 完整功能

以下内容被选中：
    所有的启动项目（包括注册表、启动文件夹、服务等）
    浏览器加载项
    正在运行的进程（包括进程模块信息）
    文件关联


启动项目
注册表
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
    <Internat.exe><internat.exe>  [Microsoft Corporation]
[HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows]
    <load><>  []
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
    <Synchronization Manager><mobsync.exe /logon>  [Microsoft Corporation]
    <zt><C:\Program Files\Intel\svhost32.exe>  []
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run]
    <9><C:\WINNT\system32\Ravdm.exe>  [Microsoft Corporation]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
    <shell><Explorer.exe>  [Microsoft Corporation]
    <Userinit><C:\WINNT\system32\Userinit.exe>  [Microsoft Corporation]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Windows]
    <AppInit_DLLs><>  []
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
    <{D157330A-9EF3-49F8-9A67-4141AC41ADD4}><C:\WINNT\DOWNLO~1\CnsHook.dll>  [北京三七二一科技有限公司]
    <{32CD708B-60A7-4C00-9377-D73EAA495F0F}><C:\WINNT\system32\RavExt.dll>  [Beijing Rising Technology Co., Ltd.]
    <{6E44887F-5214-41F2-AB46-4728735C4CC6}><C:\Program Files\Internet Explorer\PLUGINS\system.sys>  []
    <{4A92D428-A1BE-434B-B65E-FB7575BEB83C}><C:\WINNT\system32\wintfm.dll>  []

==================================
启动文件夹
服务
[C-DillaSrv / C-DillaSrv]
  <C:\WINNT\system32\DRIVERS\CDANTSRV.EXE><C-Dilla Ltd>
[Logical Disk Manager Administrative Service / dmadmin]
  <C:\WINNT\System32\dmadmin.exe /com><VERITAS Software Corp.>
[Rising Proxy  Service / RfwProxySrv]
  <d:\program files\rising\rfw\rfwproxy.exe><Beijing Rising Technology Co., Ltd.>
[Rising Personal Firewall Service / RfwService]
  <d:\program files\rising\rfw\rfwsrv.exe><N/A>
[Rising Process Communication Center / RsCCenter]
  <"d:\Program Files\Rising\Rav\CCenter.exe"><Beijing Rising Technology Co., Ltd.>
[RsRavMon Service / RsRavMon]
  <"D:\Program Files\rising\Rav\Ravmond.exe"><Beijing Rising Technology Co., Ltd.>
[System Event Notification Logs / System Event Notification Logs]
  <C:\WINNT\system32\drivers\lsass.exe><N/A>
gototop
 
<<上一主题|下一主题>>
123   1  /  3  页   跳转页
页面顶部
Powered by Discuz!NT