热点科技

标题: [求助] 帮忙看看：SREng、hijackthis、360safe分析文件 [打印本页]

---

作者: hyao    时间: 2007-3-29 20:59
标题: [求助] 帮忙看看：SREng、hijackthis、360safe分析文件
帮忙看看：SREng、hijackthis、360safe分析文件
感觉进程怪怪的，连任务管理器也是大写的。（MP**** 这几个文件不必怀疑，是正常的，微点的。）

1. 2007-03-29,15:09:56
2. System Repair Engineer 2.4.12.806
3. Smallfrogs (http://www.KZTechs.com)
4. Windows XP Professional Service Pack 2 (Build 2600) - 管理权限用户 - 完整功能
5. 以下内容被选中：
6.     所有的启动项目（包括注册表、启动文件夹、服务等）
7.     浏览器加载项
8.     正在运行的进程（包括进程模块信息）
9.     文件关联
10.     Winsock 提供者
11.     Autorun.inf
12.     HOSTS 文件
14. 启动项目
15. 注册表
16. [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
17.     <ctfmon.exe><; C:\WINDOWS\system32\ctfmon.exe>  [(Verified)Microsoft Windows Publisher]
18. [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
19.     <IgfxTray><C:\WINDOWS\system32\igfxtray.exe>  [(Verified)Microsoft Windows Hardware Compatibility Publisher]
20.     <HotKeysCmds><C:\WINDOWS\system32\hkcmd.exe>  [(Verified)Microsoft Windows Hardware Compatibility Publisher]
21.     <Cmaudio><; RunDll32 cmicnfg.cpl,CMICtrlWnd>  [N/A]
22.     <IMJPMIG8.1><; "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32>  [(Verified)Microsoft Windows Publisher]
23.     <PHIME2002A><; C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName>  [(Verified)Microsoft Windows Publisher]
24.     <PHIME2002ASync><; C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC>  [(Verified)Microsoft Windows Publisher]
25. [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
26.     <shell><Explorer.exe>  [(Verified)Microsoft Windows Publisher]
27.     <Userinit><C:\WINDOWS\SYSTEM32\USERINIT.EXE,>  [(Verified)Microsoft Windows Publisher]
28. [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Windows]
29.     <AppInit_DLLs><>  [N/A]
30. [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
31.     <UIHost><logonui.exe>  [(Verified)Microsoft Windows Publisher]
32. ==================================
33. 启动文件夹
34. N/A
35. ==================================
36. 服务
37. [Human Interface Device Access / HidServ][Stopped/Disabled]
38.   <C:\WINDOWS\System32\svchost.exe -k netsvcs-->%SystemRoot%\System32\hidserv.dll><N/A>
39. [MPSVC Service / MPSVCService][Running/Auto Start]
40.   <d:\Program Files\Micropoint\MPSVC.exe><Micropoint Corporation>
41. [MSSQLSERVER / MSSQLSERVER][Running/Auto Start]
42.   <C:\PROGRA~1\MICROS~2\MSSQL\binn\sqlservr.exe><Microsoft Corporation>
43. [MSSQLServerADHelper / MSSQLServerADHelper][Stopped/Manual Start]
44.   <C:\Program Files\Microsoft SQL Server\80\Tools\Binn\sqladhlp.exe><Microsoft Corporation>
45. [SQLSERVERAGENT / SQLSERVERAGENT][Stopped/Manual Start]
46.   <C:\PROGRA~1\MICROS~2\MSSQL\binn\sqlagent.exe><Microsoft Corporation>
47. ==================================
48. 驱动程序
49. [AVG Anti-Spyware Clean Driver / AvgAsCln][Stopped/System Start]
50.   <System32\DRIVERS\AvgAsCln.sys><N/A>
51. [C-Media WDM Audio Interface / cmuda][Running/Manual Start]
52.   <system32\drivers\cmuda.sys><C-Media Inc>
53. [ialm / ialm][Running/Manual Start]
54.   <system32\DRIVERS\ialmnt5.sys><Intel Corporation>
55. [IdeBusDr / IdeBusDr][Running/Boot Start]
56.   <\SystemRoot\system32\DRIVERS\IdeBusDr.sys><Intel Corporation>
57. [Intel(R) Ultra ATA Controller / IdeChnDr][Running/Boot Start]
58.   <\SystemRoot\system32\DRIVERS\IdeChnDr.sys><Intel Corporation>
59. [mp110001 / mp110001][Running/Auto Start]
60.   <system32\drivers\mp110001.sys><MicroPoint Corporation>
61. [mp110002 / mp110002][Running/Auto Start]
62.   <system32\drivers\mp110002.sys><Micropoint Corporation>
63. [mp110003 / mp110003][Running/Boot Start]
64.   <\SystemRoot\system32\drivers\mp110003.sys><Micropoint Corporation>
65. [mp110004 / mp110004][Running/Auto Start]
66.   <system32\drivers\mp110004.sys><Micropoint Corporation>
67. [mp110005 / mp110005][Running/Manual Start]
68.   <system32\drivers\mp110005.sys><Micropoint Corporation>
69. [mp110006 / mp110006][Running/System Start]
70.   <system32\drivers\mp110006.sys><Micropoint Corporation>
71. [mp110007 / mp110007][Running/System Start]
72.   <system32\drivers\mp110007.sys><Micropoint Corporation>
73. [mp110008 / mp110008][Running/Auto Start]
74.   <system32\drivers\mp110008.sys><Micropoint Corporation>
75. [mp110009 / mp110009][Running/System Start]
76.   <system32\drivers\mp110009.sys><Micropoint Corporation>
77. [mp110010 / mp110010][Running/Boot Start]
78.   <\SystemRoot\system32\drivers\mp110010.sys><Micropoint Corporation>
79. [mp110011 / mp110011][Running/System Start]
80.   <system32\drivers\mp110011.sys><Micropoint Corporation>
81. [mp110012 / mp110012][Stopped/Manual Start]
82.   <system32\drivers\mp110012.sys><Micropoint Corporation>
83. [mp110013 / mp110013][Running/Boot Start]
84.   <\SystemRoot\system32\drivers\mp110013.sys><Micropoint Corporation>
85. [npkcrypt / npkcrypt][Running/Auto Start]
86.   <\??\D:\Program Files\Tencent3\npkcrypt.sys><INCA Internet Co., Ltd.>
87. [Direct Parallel Link Driver / Ptilink][Running/Manual Start]
88.   <system32\DRIVERS\ptilink.sys><Parallel Technologies, Inc.>
89. [Realtek RTL8139/810x/8169/8110 all in one NDIS NT Driver / RTL8023][Running/Manual Start]
90.   <system32\DRIVERS\Rtlnic51.sys><Realtek Semiconductor Corporation>
91. [Realtek RTL8139(A/B/C)-based PCI Fast Ethernet Adapter NT Driver / rtl8139][Stopped/Manual Start]
92.   <system32\DRIVERS\RTL8139.SYS><Realtek Semiconductor Corporation>
93. [Secdrv / Secdrv][Stopped/Manual Start]
94.   <system32\DRIVERS\secdrv.sys><N/A>
95. ==================================
96. 浏览器加载项
97. [CLDown Object]
98.   {0BECAB3A-E1F8-45E6-8332-38DD750EBA01} <C:\Program Files\Tuotu\TuoTuHelper_v8.dll, Tuotu.com>
99. [Thunder Browser Helper]
100.   {889D2FEB-5411-4565-8998-1DD2C5261283} <D:\Downloads\上传下载\Thunder.v5.5.1.241.NoAD-Ayu\Thunder\ComDlls\XunLeiBHO_004.dll, Thunder Networking Technologies,LTD>
101. [浩方对战平台]
102.   {0A155D3C-68E2-4215-A47A-E800A446447A} <C:\Program Files\浩方对战平台\GameClient.exe, 上海浩方在线信息技术有限公司>
103. [Messenger]
104.   {FB5F1910-F110-11d2-BB9E-00C04F795683} <C:\Program Files\Messenger\msmsgs.exe, Microsoft Corporation>
105. [Easy-WebPrint]
106.   {327C2873-E90D-4c37-AA9D-10AC9BABA46C} <C:\Program Files\Canon\Easy-WebPrint\Toolband.dll, >
107. [CLDown Object]
108.   {0BECAB3A-E1F8-45E6-8332-38DD750EBA01} <C:\Program Files\Tuotu\TuoTuHelper_v8.dll, Tuotu.com>
109. [HTML Document]
110.   {25336920-03F9-11CF-8FD0-00AA00686F13} <%SystemRoot%\system32\Mshtml.dll, N/A>
111. [Easy-WebPrint]
112.   {327C2873-E90D-4C37-AA9D-10AC9BABA46C} <C:\Program Files\Canon\Easy-WebPrint\Toolband.dll, >
113. [Windows Media Player]
114.   {6BF52A52-394A-11D3-B153-00C04F79FAA6} <C:\WINDOWS\system32\wmp.dll, Microsoft Corporation>
115. [Active Desktop Mover]
116.   {72267F6A-A6F9-11D0-BC94-00C04FB67863} <%SystemRoot%\system32\SHELL32.dll, N/A>
117. [Microsoft Web 浏览器]
118.   {8856F961-340A-11D0-A96B-00C04FD705A2} <C:\WINDOWS\system32\shdocvw.dll, Microsoft Corporation>
119. [Thunder Browser Helper]
120.   {889D2FEB-5411-4565-8998-1DD2C5261283} <D:\Downloads\上传下载\Thunder.v5.5.1.241.NoAD-Ayu\Thunder\ComDlls\XunLeiBHO_004.dll, Thunder Networking Technologies,LTD>
121. [Microsoft Scriptlet Component]
122.   {AE24FDAE-03C6-11D1-8B76-0080C744F389} <C:\WINDOWS\system32\Mshtml.dll, Microsoft Corporation>
123. [SearchAssistantOC]
124.   {B45FF030-4447-11D2-85DE-00C04FA35C89} <%SystemRoot%\system32\shdocvw.dll, N/A>
125. [RDS.DataSpace]
126.   {BD96C556-65A3-11D0-983A-00C04FC29E36} <C:\Program Files\Common Files\System\msadc\msadco.dll, Microsoft Corporation>
127. [Shockwave Flash Object]
128.   {D27CDB6E-AE6D-11CF-96B8-444553540000} <C:\WINDOWS\system32\macromed\flash\flash.ocx, Macromedia, Inc.>
129. [Easy-WebPrint打印]
130.   <res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_Print.html, N/A>
131. [Easy-WebPrint添加到打印列表]
132.   <res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_AddToList.html, N/A>
133. [Easy-WebPrint预览]
134.   <res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_Preview.html, N/A>
135. [Easy-WebPrint高速打印]
136.   <res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_HSPrint.html, N/A>
137. [上传到QQ网络硬盘]
138.   <D:\Program Files\Tencent3\AddToNetDisk.htm, N/A>
139. [使用脱兔下载]
140.   <C:\Program Files\Tuotu\TT_one.htm, N/A>
141. [使用脱兔下载全部链接]
142.   <C:\Program Files\Tuotu\TT_all.htm, N/A>
143. [使用迅雷下载]
144.   <D:\Downloads\上传下载\Thunder.v5.5.1.241.NoAD-Ayu\Thunder\Program\geturl.htm, N/A>
145. [使用迅雷下载全部链接]
146.   <D:\Downloads\上传下载\Thunder.v5.5.1.241.NoAD-Ayu\Thunder\Program\getallurl.htm, N/A>
147. [导出到 Microsoft Office Excel(&X)]
148.   <res://C:\PROGRA~1\MICROS~3\OFFICE11\EXCEL.EXE/3000, N/A>
149. [添加到QQ自定义面板]
150.   <D:\Program Files\Tencent3\AddPanel.htm, N/A>
151. [添加到QQ表情]
152.   <D:\Program Files\Tencent3\AddEmotion.htm, N/A>
153. [用QQ彩信发送该图片]
154.   <D:\Program Files\Tencent3\SendMMS.htm, N/A>
155. ==================================
156. 正在运行的进程
157. [PID: 428][\SystemRoot\System32\smss.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
158. [PID: 496][\??\C:\WINDOWS\system32\csrss.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
159. [PID: 520][\??\C:\WINDOWS\system32\winlogon.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
160.     [d:\Program Files\Micropoint\mp110031.dll]  [Micropoint Corporation, 1.2.10032]
161.     [C:\WINDOWS\system32\FREEWB.IME]  [Delphi Fan Studio, 5.0]
162.     [C:\WINDOWS\system32\msacm32.drv]  [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)]
163. [PID: 1368][C:\WINDOWS\Explorer.EXE]  [Microsoft Corporation, 6.00.2900.2180 (xpsp_sp2_rtm.040803-2158)]
164.     [C:\WINDOWS\system32\FREEWB.IME]  [Delphi Fan Studio, 5.0]
165.     [d:\Program Files\Micropoint\mp110031.dll]  [Micropoint Corporation, 1.2.10032]
166.     [C:\WINDOWS\system32\msacm32.drv]  [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)]
167.     [C:\Program Files\Tuotu\TuoTuHelper_v8.dll]  [Tuotu.com, 2.0.0.6]
168.     [D:\Downloads\上传下载\Thunder.v5.5.1.241.NoAD-Ayu\Thunder\ComDlls\XunLeiBHO_004.dll]  [Thunder Networking Technologies,LTD, 5, 0, 0, 3]
169.     [C:\Program Files\Microsoft Office\OFFICE11\msohev.dll]  [Microsoft Corporation, 11.0.5510]
170. [PID: 1248][C:\WINDOWS\system32\wscntfy.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
171.     [C:\WINDOWS\system32\FREEWB.IME]  [Delphi Fan Studio, 5.0]
172.     [d:\Program Files\Micropoint\mp110031.dll]  [Micropoint Corporation, 1.2.10032]
173. [PID: 1268][C:\WINDOWS\system32\hkcmd.exe]  [Intel Corporation, 3.0.0.4020]
174.     [C:\WINDOWS\system32\hccutils.DLL]  [Intel Corporation, 3.0.0.4020]
175.     [d:\Program Files\Micropoint\mp110031.dll]  [Micropoint Corporation, 1.2.10032]
176.     [C:\WINDOWS\system32\igfxdev.dll]  [Intel Corporation, 3.0.0.4020]
177.     [C:\WINDOWS\system32\FREEWB.IME]  [Delphi Fan Studio, 5.0]
178.     [C:\WINDOWS\system32\igfxsrvc.dll]  [Intel Corporation, 3.0.0.4020]
179.     [C:\WINDOWS\system32\igfxhk.dll]  [Intel Corporation, 3.0.0.4020]
180.     [C:\WINDOWS\system32\igfxres.dll]  [Intel Corporation, 3.0.0.4020]
181. [PID: 1292][C:\WINDOWS\system32\ctfmon.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
182.     [C:\WINDOWS\system32\FREEWB.IME]  [Delphi Fan Studio, 5.0]
183. [PID: 2364][C:\WINDOWS\system32\taskmgr.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
184.     [C:\WINDOWS\system32\FREEWB.IME]  [Delphi Fan Studio, 5.0]
185.     [d:\Program Files\Micropoint\mp110031.dll]  [Micropoint Corporation, 1.2.10032]
186. [PID: 2976][D:\Downloads\系统优化清理\sreng2\SREng.EXE]  [Smallfrogs Studio, 2.4.12.806]
187.     [C:\WINDOWS\system32\FREEWB.IME]  [Delphi Fan Studio, 5.0]
188.     [d:\Program Files\Micropoint\mp110031.dll]  [Micropoint Corporation, 1.2.10032]
189. ==================================
190. 文件关联
191. .TXT  OK. [%SystemRoot%\system32\NOTEPAD.EXE %1]
192. .EXE  OK. ["%1" %*]
193. .COM  OK. ["%1" %*]
194. .PIF  OK. ["%1" %*]
195. .REG  OK. [regedit.exe "%1"]
196. .BAT  OK. ["%1" %*]
197. .SCR  OK. ["%1" /S]
198. .CHM  OK. ["C:\WINDOWS\hh.exe" %1]
199. .HLP  OK. [%SystemRoot%\System32\winhlp32.exe %1]
200. .INI  OK. [%SystemRoot%\System32\NOTEPAD.EXE %1]
201. .INF  OK. [%SystemRoot%\System32\NOTEPAD.EXE %1]
202. .VBS  OK. [%SystemRoot%\System32\WScript.exe "%1" %*]
203. .JS   OK. [%SystemRoot%\System32\WScript.exe "%1" %*]
204. .LNK  OK. [{00021401-0000-0000-C000-000000000046}]
205. ==================================
206. Winsock 提供者
207. N/A
208. ==================================
209. Autorun.inf
210. N/A
211. ==================================
212. HOSTS 文件
213. 127.0.0.1       localhost
214. ==================================
215. API HOOK
216. N/A
217. ==================================
218. 隐藏进程
219.     [769] d:\Program Files\Micropoint\MPSVC.exe
220.     [797] d:\Program Files\Micropoint\MPSVC2.exe
221.     [941] d:\Program Files\Micropoint\MPSVC1.exe
222.     [1417] d:\Program Files\Micropoint\MPMon.exe
223. ==================================

复制代码

1. HijackThis_zww汉化版扫描日志 V1.99.1
2. 保存于      15:10:27, 日期 2007-03-29
3. 操作系统：  Windows XP SP2 (WinNT 5.01.2600)
4. 浏览器：    Internet Explorer v6.00 SP2 (6.00.2900.2180)
5. 当前运行的进程：         
6. C:\WINDOWS\System32\smss.exe
7. C:\WINDOWS\system32\winlogon.exe
8. C:\WINDOWS\system32\services.exe
9. C:\WINDOWS\system32\lsass.exe
10. C:\WINDOWS\system32\svchost.exe
11. C:\WINDOWS\System32\svchost.exe
12. C:\WINDOWS\Explorer.EXE
13. C:\WINDOWS\system32\spoolsv.exe
14. C:\PROGRA~1\MICROS~2\MSSQL\binn\sqlservr.exe
15. C:\WINDOWS\system32\wscntfy.exe
16. C:\WINDOWS\system32\hkcmd.exe
17. C:\WINDOWS\system32\ctfmon.exe
18. C:\WINDOWS\system32\taskmgr.exe
19. D:\Downloads\系统优化清理\HijackThis\HijackThis1991zww~.exe
20. O2 - BHO: TuoTuHelper.LDown - {0BECAB3A-E1F8-45E6-8332-38DD750EBA01} - C:\Program Files\Tuotu\TuoTuHelper_v8.dll
21. O2 - BHO: ThunderBHO - {889D2FEB-5411-4565-8998-1DD2C5261283} - D:\Downloads\上传下载\Thunder.v5.5.1.241.NoAD-Ayu\Thunder\ComDlls\XunLeiBHO_004.dll
22. O3 - IE工具栏增项: Easy-WebPrint - {327C2873-E90D-4c37-AA9D-10AC9BABA46C} - C:\Program Files\Canon\Easy-WebPrint\Toolband.dll
23. O4 - 启动项HKLM\\Run: [IgfxTray] C:\WINDOWS\system32\igfxtray.exe
24. O4 - 启动项HKLM\\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe
25. O4 - 启动项HKLM\\Run: [Cmaudio] ; RunDll32 cmicnfg.cpl,CMICtrlWnd
26. O4 - 启动项HKLM\\Run: [IMJPMIG8.1] ; "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
27. O4 - 启动项HKLM\\Run: [PHIME2002A] ; C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName
28. O4 - 启动项HKLM\\Run: [PHIME2002ASync] ; C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC
29. O4 - HKCU\..\Run: [ctfmon.exe] ; C:\WINDOWS\system32\ctfmon.exe
30. O8 - IE右键菜单中的新增项目: Easy-WebPrint打印 - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_Print.html
31. O8 - IE右键菜单中的新增项目: Easy-WebPrint添加到打印列表 - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_AddToList.html
32. O8 - IE右键菜单中的新增项目: Easy-WebPrint预览 - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_Preview.html
33. O8 - IE右键菜单中的新增项目: Easy-WebPrint高速打印 - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_HSPrint.html
34. O8 - IE右键菜单中的新增项目: 上传到QQ网络硬盘 - D:\Program Files\Tencent3\AddToNetDisk.htm
35. O8 - IE右键菜单中的新增项目: 使用脱兔下载 - C:\Program Files\Tuotu\TT_one.htm
36. O8 - IE右键菜单中的新增项目: 使用脱兔下载全部链接 - C:\Program Files\Tuotu\TT_all.htm
37. O8 - IE右键菜单中的新增项目: 使用迅雷下载 - D:\Downloads\上传下载\Thunder.v5.5.1.241.NoAD-Ayu\Thunder\Program\geturl.htm
38. O8 - IE右键菜单中的新增项目: 使用迅雷下载全部链接 - D:\Downloads\上传下载\Thunder.v5.5.1.241.NoAD-Ayu\Thunder\Program\getallurl.htm
39. O8 - IE右键菜单中的新增项目: 导出到 Microsoft Office Excel(&X) - res://C:\PROGRA~1\MICROS~3\OFFICE11\EXCEL.EXE/3000
40. O8 - IE右键菜单中的新增项目: 添加到QQ自定义面板 - D:\Program Files\Tencent3\AddPanel.htm
41. O8 - IE右键菜单中的新增项目: 添加到QQ表情 - D:\Program Files\Tencent3\AddEmotion.htm
42. O8 - IE右键菜单中的新增项目: 用QQ彩信发送该图片 - D:\Program Files\Tencent3\SendMMS.htm
43. O9 - 浏览器额外的按钮: 浩方对战平台 - {0A155D3C-68E2-4215-A47A-E800A446447A} - C:\Program Files\浩方对战平台\GameClient.exe
44. O9 - 浏览器额外的按钮: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
45. O9 - 浏览器额外的“工具”菜单项: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
46. O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxsrvc.dll
47. O23 - NT 服务: MPSVC Service (MPSVCService) - Micropoint Corporation - d:\Program Files\Micropoint\MPSVC.exe

复制代码

---

作者: caoatcao    时间: 2007-3-29 23:42
大问题木油,
开始,运行,msconfig,启动,除了杀毒软件和输入法,其余全部去掉,服务,隐藏微软,其余除杀毒软件,全部去掉

---

作者: aabc123    时间: 2007-3-30 00:20
报告中没问题，如果这个补丁打过的话

Microsoft 安全公告 MS06-014
Microsoft Data Access Components (MDAC) 功能中的漏洞可能允许执行代码 (911562)

漏洞发布：2006.04.11
漏洞影响：远程执行代码
漏洞等级：严重
关键字：MS06-014, msadco.dll, BD96C556-65A3-11D0-983A-00C04FC29E36, mm.exe
补丁下载：http://www.microsoft.com/china/t ... letin/ms06-014.mspx
简单修补：运行 regsvr32 /u "C:\Program Files\Common Files\System\msadc\msadco.dll"

---

作者: hyxyl520    时间: 2007-3-30 01:39
我也一直没太弄明白一些进程名为什么有时大写有时小写（即使在系统安全的状态下）

---

作者: ttalex    时间: 2007-3-30 10:42
报告中看不出有问题来
大小写问题是正常的(虽然不知道怎么回事 )

---

作者: delight1202    时间: 2007-3-30 11:07
感谢各位
另外，有没有什么办法去掉smss.exe和csrss.exe这几个。
用各种工具 启动项里面找不到这两个

---

作者: 444642629    时间: 2007-3-30 16:53
CSRSS。EXE那2 个系统就有的

---

作者: KTWO    时间: 2007-3-30 16:55

原帖由 yz179 于 2007-3-30 16:53 发表
CSRSS。EXE那2 个系统就有的

以前从来没有过的~  就这几天才出现的。
不知道是装了什么软件搞得

---

作者: yangchunaini    时间: 2007-3-30 17:29
正常，csrss和smss是系统必须的。

---

欢迎光临 热点科技 (http://www.itheat.com/activity/)

Powered by Discuz! X3.2