木马（3）

O4 - Startup: ~.pif = ?O8 - Extra context menu item: &使用迅雷下载 - e:尀Program Files尀Thunder Network尀Thunder尀Program尀geturl.htmO8 - Extra context menu item: &使用迅雷下载全部链接 - e:尀Program Files尀Thunder Network尀Thunder尀Program尀getallurl.htmO8 - Extra context menu item: 导出到 Microsoft Excel(&X) - res://E:尀PROGRA~1尀MICROS~1尀Office12尀EXCEL.EXE/3000O8 - Extra context menu item: 导出到 Microsoft Office Excel(&X) - res://C:尀PROGRA~1尀MICROS~2尀OFFICE11尀EXCEL.EXE/3000O9 - Extra button: 启动迅雷5 - {09BA8F6D-CB54-424B-839C-C2A6C8E6B436} - e:尀Program Files尀Thunder Network尀Thunder尀Thunder.exeO9 - Extra ✀Tools✀ menuitem: 启动迅雷5 - {09BA8F6D-CB54-424B-839C-C2A6C8E6B436} - e:尀Program Files尀Thunder Network尀Thunder尀Thunder.exeO11 - Options group: [INTERNATIONAL] International*O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1166692590750O18 - Protocol: ms-help - {314111C7-A502-11D2-BBCA-00C04F8EC294} - C:尀Program Files尀Common Files尀Microsoft Shared尀Help尀hxds.dllO18 - Filter hijack: text/xml - {807563E5-5146-11D5-A672-00B0D022E945} - C:尀PROGRA~1尀COMMON~1尀MICROS~1尀OFFICE12尀MSOXMLMF.DLLO21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:尀WINDOWS尀system32尀WPDShServiceObj.dllO23 - Service: Adobe LM Service - Adobe Systems - C:尀Program Files尀Common Files尀Adobe Systems Shared尀Service尀Adobelmsvc.exeO23 - Service: avast! iAVS4 Control Service (aswUpdSv) - Unknown owner - e:尀Program Files尀Alwil Software尀Avast4尀aswUpdSv.exeO23 - Service: avast! Antivirus - Unknown owner - e:尀Program Files尀Alwil Software尀Avast4尀ashServ.exeO23 - Service: avast! Mail Scanner - Unknown owner - e:尀Program Files尀Alwil Software尀Avast4尀ashMaiSv.exe" /service (file missing)O23 - Service: avast! Web Scanner - Unknown owner - e:尀Program Files尀Alwil Software尀Avast4尀ashWebSv.exe" /service (file missing)O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:尀Program Files尀Common Files尀InstallShield尀Driver尀1150尀Intel 32尀IDriverT.exeO23 - Service: NBService - Unknown owner - E:尀Nero 7尀Nero BackItUp尀NBService.exeO23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:尀WINDOWS尀system32尀nvsvc32.exeO23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - C:尀Program Files尀Cyberlink尀Shared files尀RichVideo.exe安全模式下删除C:尀WINDOWS尀system32尀drivers尀lsass.exe 后又在C:尀WINDOWS尀system32尀drivers目录下发现wmilib.sys文件，删除后一直自动还原