电脑爱好者论坛's Archiver

tiacy000 发表于 2007-12-22 20:36

这样的帖要多点。。

wendi 发表于 2007-12-25 03:18

我是一个新手，请大家多多帮助，谢谢！

喾龙 发表于 2007-12-28 22:24

不错支持原创

luckyji 发表于 2007-12-29 08:27

有用！！要看一下

guchen134 发表于 2008-1-7 18:32

好好学习一下

vanpersie 发表于 2008-1-12 17:14

谢谢啊~~~

wyflyl2004 发表于 2008-1-13 18:35

试试，行不行啊。

lovediannao 发表于 2008-1-21 11:19

我试试！呵呵

2008-01-21 星期一,11:17:30.17
              
----------------进程及其启动命令--------------
  PROCESS            PID COMMAND LINE
smss.exe             448 \SystemRoot\System32\smss.exe
csrss.exe            504 C:\WINDOWS\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,3072,512 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ProfileControl=Off MaxRequestThreads=16
winlogon.exe         528 winlogon.exe
services.exe         572 C:\WINDOWS\system32\services.exe
lsass.exe            584 C:\WINDOWS\system32\lsass.exe
svchost.exe          732 C:\WINDOWS\system32\svchost -k DcomLaunch
svchost.exe          792 C:\WINDOWS\system32\svchost -k rpcss
svchost.exe          860 C:\WINDOWS\System32\svchost.exe -k netsvcs
svchost.exe          932 C:\WINDOWS\system32\svchost.exe -k NetworkService
svchost.exe          996 C:\WINDOWS\system32\svchost.exe -k LocalService
KPfwSvc.EXE         1112 "D:\jinshan\Kingsoft Internet Security 2008\KPfwSvc.EXE"
KWatch.EXE          1208 "D:\jinshan\Kingsoft Internet Security 2008\KWatch.EXE"
spoolsv.exe         1356 C:\WINDOWS\system32\spoolsv.exe
Explorer.EXE        1564 C:\WINDOWS\Explorer.EXE
RTHDCPL.EXE         1704 "C:\WINDOWS\RTHDCPL.EXE"
RUNDLL32.EXE        1736 "C:\WINDOWS\system32\RUNDLL32.EXE" C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
360tray.exe         1756 "C:\Program Files\360safe\safemon\360tray.exe" /start
KAVStart.exe        1784 "D:\jinshan\Kingsoft Internet Security 2008\KAVStart.exe" -startup
ctfmon.exe          1796 "C:\WINDOWS\system32\ctfmon.exe"
QQDownload.exe      1808 "D:\新建文件夹\QQDownload\QQDownload.exe" autostart
MiniQQLive.exe      1844 "C:\Program Files\Tencent\QQLive\MiniQQLive.exe"
KPFW32.EXE          1852 "D:\jinshan\Kingsoft Internet Security 2008\KPFW32.EXE"
stormliv.exe        1064 D:\暴风影音３\stormliv.exe /asservice
KISSvc.EXE           632 "D:\jinshan\Kingsoft Internet Security 2008\KISSvc.EXE"
KMailMon.EXE         680 "D:\jinshan\Kingsoft Internet Security 2008\KMailMon.EXE"
MDM.EXE             1496 "C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE"
nvsvc32.exe         1524 C:\WINDOWS\system32\nvsvc32.exe
svchost.exe         1592 C:\WINDOWS\system32\svchost.exe -k imgsvc
alg.exe             2632 C:\WINDOWS\System32\alg.exe
QQ.exe              2924 "D:\新建文件夹\QQ.exe"
TXPlatform.exe      2964 "D:\新建文件夹\TXPlatform.exe" -Embedding
QQ.exe              3108 "D:\新建文件夹\QQ.exe"
iexplore.exe        2900 "C:\Program Files\Internet Explorer\iexplore.exe"
辉少查毒.exe        3996 "F:\新建文件夹\辉少查毒.exe"
conime.exe          3096 C:\WINDOWS\system32\conime.exe
cmd.exe             3188 cmd.exe /c C:\DOCUME~1\OK\LOCALS~1\Temp\bt3500.bat
辉少查毒.com        3228 "辉少查毒.com" -l
-
-------------------注册表启动项-------------------------

! REG.EXE VERSION 3.0

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    IMJPMIG8.1        REG_SZ        "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
    PHIME2002ASync        REG_SZ        C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC
    PHIME2002A        REG_SZ        C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName
    IMSCMig        REG_SZ        C:\PROGRA~1\COMMON~1\MICROS~1\IME\IMSC40A\IMSCMIG.EXE /Preload
    RTHDCPL        REG_SZ        RTHDCPL.EXE
    Alcmtr        REG_SZ        ALCMTR.EXE
    NvCplDaemon        REG_SZ        RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
    nwiz        REG_SZ        nwiz.exe /install
    NvMediaCenter        REG_SZ        RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
    360Safetray        REG_SZ        C:\Program Files\360safe\safemon\360tray.exe /start
    SKYNET Personal FireWall        REG_SZ        D:\天网\pfw.e
    KavStart        REG_SZ        "D:\jinshan\Kingsoft Internet Security 2008\KAVStart.exe" -startup

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OptionalComponents

! REG.EXE VERSION 3.0

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce

! REG.EXE VERSION 3.0

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnceEx

! REG.EXE VERSION 3.0

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    ctfmon.exe        REG_SZ        C:\WINDOWS\system32\ctfmon.exe
    QQDownload        REG_SZ        "D:\新建文件夹\QQDownload\QQDownload.exe" auto
    miniqqlive        REG_SZ        "C:\Program Files\Tencent\QQLive\MiniQQLive.exe"
    KavPFW        REG_SZ        "D:\jinshan\Kingsoft Internet Security 2008\KPFW32.EXE"
-
-------------------引导执行----------------------------
-
-------------------初始程序----------------------------
-
-------------------资源管理器加载项---------------------

! REG.EXE VERSION 3.0

HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks
    {AEB6717E-7E19-11d0-97EE-00C04FD91972}        REG_SZ       

! REG.EXE VERSION 3.0

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad
    PostBootReminder        REG_SZ        {7849596a-48ea-486e-8937-a2a3009f31a9}
    CDBurn        REG_SZ        {fbeb8a05-beee-4442-804e-409d6c4515e9}
    WebCheck        REG_SZ        {E6FB5E20-DE35-11CF-9C87-00AA005127ED}
    SysTray        REG_SZ        {35CEC8A3-2BE6-11D2-8773-92E220524153}

! REG.EXE VERSION 3.0

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler
    {438755C2-A8BA-11D1-B96B-00A0C90312E1}        REG_SZ        Browseui 预加?
    {8C7461EF-2B13-11d2-BE35-3078302C2030}        REG_SZ        组件类别
-
-------------------IE加载项----------------------------

! REG.EXE VERSION 3.0

HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\UrlSearchHooks
    {CFBFAE00-17A6-11D0-99CB-00C04FD64497}        REG_SZ       

! REG.EXE VERSION 3.0

HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Extensions

HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Extensions\CmdMapping

! REG.EXE VERSION 3.0

HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Extensions

HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Extensions\{0A155D3C-68E2-4215-A47A-E800A446447A}

HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Extensions\{3AECD3C1-7085-4731-96DC-47B6CF7EF749}

HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Extensions\{92780B25-18CC-41C8-B9BE-3C9C571A8263}

HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Extensions\{95B3F550-91C4-4627-BCC4-521288C52977}

HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Extensions\{FB5F1910-F110-11d2-BB9E-00C04F795683}
-
-------------------映像劫持----------------------------

! REG.EXE VERSION 3.0

HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options

HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\apitrap.dll

HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ASSTE.dll

HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AVSTE.dll

HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Cleanup.dll

HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\cqw32.exe

HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\divx.dll

HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\divxdec.ax

HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\DJSMAR00.dll

HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\DRMINST.dll

HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\enc98.EXE

HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\EncodeDivXExt.dll

HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\EncryptPatchVer.dll

HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\front.exe

HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\fullsoft.dll

HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\GBROWSER.DLL

HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\htmlmarq.ocx

HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\htmlmm.ocx

HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\install.exe

HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ishscan.dll

HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ISSTE.dll

HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\javai.dll

HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\jvm.dll

HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\jvm_g.dll

HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\main123w.dll

HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mngreg32.exe

HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msci_uno.dll

HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mscoree.dll

HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mscorsvr.dll

HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mscorwks.dll

HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msjava.dll

HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mso.dll

HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\NAVOPTRF.dll

HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\NeVideoFX.dll

HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\NPMLIC.dll

HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\NSWSTE.dll

HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\photohse.EXE

HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\PMSTE.dll

HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ppw32hlp.dll

HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\printhse.EXE

HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\prwin8.EXE

HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ps80.EXE

HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\psdmt.exe

HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\qfinder.EXE

HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\qpw.EXE

HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\salwrap.dll

HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\setup.exe

HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\setup32.dll

HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sevinst.exe

HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\symlcnet.dll

HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\tcore_ebook.dll

HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\TFDTCTT8.DLL

HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ua80.EXE

HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\udtapi.dll

HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ums.dll

HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\vb40032.dll

HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\vbe6.dll

HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wpwin8.EXE

HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\xlmlEN.dll

HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\xwsetup.EXE

HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Your Image File Name Here without a path

HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\_INSTPGM.EXE
-
-------------------HOSTS文件内容----------------------------
# copyright (c) 1993-1999 microsoft corp.
#
# this is a sample hosts file used by microsoft tcp/ip for windows.
#
# this file contains the mappings of ip addresses to host names. each
# entry should be kept on an individual line. the ip address should
# be placed in the first column followed by the corresponding host name.
# the ip address and the host name should be separated by at least one
# space.
#
# additionally, comments (such as these) may be inserted on individual
# lines or following the machine name denoted by a '#' symbol.
#
# for example:
#
#      102.54.94.97     rhino.acme.com          # source server
#       38.25.63.10     x.acme.com              # x client host

127.0.0.1       localhost
-
-------------------各个盘的autorun.inf----------------------------

lovediannao 发表于 2008-1-21 11:20

辉少　是这样吗

lovediannao 发表于 2008-1-21 12:54

我发贴了，麻烦帮我看看

sdxly 发表于 2008-1-21 16:47

好好学习一下

caigh 发表于 2008-1-22 21:21

hz165hz还不知道怎么样呢？

linfeiyhy 发表于 2008-1-23 11:55

baidu
瞄瞄。。。。

ldq831226love 发表于 2008-1-23 21:47

刚接触，得好好学学~~~~~
呵呵~~~~~~~

runningteeth 发表于 2008-1-26 20:13

学习中……

xiaopei68 发表于 2008-2-9 16:06

谢谢楼主，下载看看！！！

wuqiulong 发表于 2008-2-23 10:36

顶一下。。看看。好用不？

dzx51696879 发表于 2008-3-8 12:05

回复 1# 的帖子

有时间的时候来试!!

sjj5201024 发表于 2008-3-12 18:45

确实挺简单

sjj5201024 发表于 2008-3-12 18:46

以后咄咄指教

页: 1 [2] 3 4 5

Powered by Discuz! Archiver 7.0.0  © 2001-2009 Comsenz Inc.