主要看这三个部份。对于不知道文件名的上百度搜索即可。当然也有一些遇系统重名的文件冒充正常系统文件的不过不可能完全一样。这个要心细些。
360日志分析方法：http://bbs.360safe.com//viewthread.php?tid=221900&extra=page%3D1
360报告的分析技巧
例
主要看下面的未知项
100 - 未知 - Process: xscan_gui.exe [] - C:\TDDOWNLOAD\X-Scan-v3.2\xscan_gui.exe
R0 - 未知 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant=http://ie.search.msn.com/{SUB_RFC1766}/srchasst/srchcust.htm
O18 - 未知 - Protocol: KuGoo3 - {6AC4FBC7-AA38-45EC-9634-D6D20B679EFC} - D:\KuGoo音乐\KuGoo3\InExtend\KuGoo3DownXControl.ocx
O23 - 未知 - Service: windtins [windtinins] - C:\WINDOWS\windrt - (not running)
=======================================
和系统加载进程项
=======================================
O40 - Explorer.EXE - Fygsoft and Microsoft - C:\PROGRA~1\ftc\FTCCOM~1.DLL - Com组件菜单 - ccdf1edbe51cd961bc31ae7894d73de0
O40 - Explorer.EXE - Anti-Malware Development a.s. - C:\Program Files\ewido anti-spyware 4.0\context.dll - Context-Menu (Shell Extension) - 1bb3bd0ef15e385716027bac1eb1b888
O40 - Explorer.EXE - Anti-Malware Development a.s. - C:\Program Files\ewido anti-spyware 4.0\shellexecutehook.dll - ewido anti-spyware guard - ba94ae54d7beeaa8a98bb98c81fd02ed
O40 - Explorer.EXE - Adobe Systems, Incorporated - C:\Program Files\Common Files\Adobe\Shell\PSICON.DLL - Icons for Adobe Photoshop - b3425c813804c01c0a7fc732f7ae60cb
=======================================
－
－
－略过
－
及驱动项
O41 - bootdrv - bootdrv - C:\WINDOWS\System32\Drivers\bootdrv.sys - (running) - - -
O41 - ewido anti-spyware 4.0 driver - ewido anti-spyware 4.0 driver - C:\Program Files\ewido anti-spyware 4.0\guard.sys - (running) - - - 9b6b54865bd0ec9ed2532dad89554969
O41 - NPF - npf - C:\WINDOWS\system32\drivers\npf.sys - (running) - npf - NetGroup - Politecnico di Torino - 05f6be0427ecb1d4f0985217f30f49f2
O41 - QKeyService - KeyCrypt Device Driver - C:\WINDOWS\system32\KeyCrypt.sys - (running) - KeyCrypt Device Driver - Tencent Technology (Shenzhen) Company Limited - 86aadf81964cc6c4c8ce9d27a7a0c533
O41 - RsAntiSpyware - Anti-RootKit Driver - C:\WINDOWS\system32\drivers\RsBoot.sys - (running) - Anti-RootKit Driver - Beijing Rising Technology Co., Ltd. - f9edc97f228c046832a24b5a76017912
O41 - Sentinel - Sentinel - C:\WINDOWS\system32\drivers\SENTINEL.SYS - (running) - - - 99c81af18c0bf4d3b2ce0b36941e150f
主要看这三个部份。对于不知道文件名的上百度搜索即可。当然也有一些遇系统重名的文件冒充正常系统文件的不过不可能完全一样。这个要心细些。
京公网安备 11010802021500号