微点交流论坛

标题: userinit不正常(解决) [打印本页]

作者: 镰刀 时间: 2008-5-16 17:13 标题: userinit不正常(解决)

如题自从前天升级后就反复出现userinit注册表被修改，SRE扫描老是报USERINIT 注册表值被修改！其他清理专家和360均未报！但注册表值确实被修改！不是病毒！经卡巴，大蜘蛛，金山在线杀毒均为发现异常！我是预升级版本
系统是VISTA SP-1 每次用SRE修复后再开机依然如此！
微点主动防御软件预升级
程序版本： 1.2.10573.0084
特征版本： 1.6.710.080516
更新时间： 2008-05-16 15:53:58

版权所有 (C) 2005-2008 Micropoint Corporation

北京东方微点信息技术有限责任公司
福建东方微点信息安全有限责任公司

信箱：support@micropoint.com.cn
网址：http://www.micropoint.com.cn
微点技术支持信息已发送至support@micropoint.com.cn
并附带次此帖连接

[ Last edited by 镰刀 on 2008-5-18 at 14:45 ]

附件 1: 捕获1.JPG (2008-5-16 17:39, 97.27 K,下载次数： 24)

附件 2: 捕获2.JPG (2008-5-16 17:40, 99.68 K,下载次数： 54)

附件 3: 捕获.JPG (2008-5-16 17:56, 88.46 K,下载次数： 20)

附件 4: 捕获.JPG (2008-5-16 21:34, 63.33 K,下载次数： 69)

作者: Legend 时间: 2008-5-16 17:27
请楼主将SRE扫描报警的userinit注册表键值贴出来，好给您分析一下。

作者: Legend 时间: 2008-5-16 17:57
请楼主加入微点官方技术交流QQ群，联系在线管理员协助解决。在加群和联系管理员时，请告诉管理员您的论坛ID和帖子链接。
微点技术交流群: I. 16998902 Ⅱ. 1471553 Ⅲ. 630086
请您逐个尝试加入

楼主也可以使用QQ将微点在线管理员加为好友（QQ:383154254或466248167），让他协助您在线分析处理一下。

作者: 镰刀 时间: 2008-5-16 17:59
谢谢！

作者: 采薇蒹葭 时间: 2008-5-16 18:38
我也在卡饭也发现一个朋友用Windows清理助手扫描出这样的问题。。

[url]http://bbs.kafan.cn/viewthread.php?tid=252396&extra=page%3D1&page=1[/url]

然后我自己也扫描了一下，，Windows清理助手也发现了和卡饭楼主同样的问题。。但是没有此帖楼主发现的SREng扫描出来的问题。。

我的系统是SP3的，，

微点版本：
微点主动防御软件  预升级
程序版本： 1.2.10573.0084
特征版本： 1.6.711.080516
更新时间： 2008-05-16 15:53:58

================以下是SREng扫描注册表的结果：

注册表
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
<ctfmon.exe><C:\WINDOWS\system32\ctfmon.exe>  [(Verified)Microsoft Windows Component Publisher]
<Screen Calendar><"D:\Program Files\Screen Calendar\scrcal.exe" -m>  [FeatherySoft, Inc.]
<swg><C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe>  [(Verified)Google Inc]
<Lingoes><D:\Program Files\Lingoes\Translator2\Lingoes.exe>  [Lingoes Project]
<DWQueuedReporting><"C:\PROGRA~1\COMMON~1\MICROS~1\DW\dwtrig20.exe" -t>  [(Verified)Microsoft Corporation]
[HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows]
<run><>  [N/A]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
<Apoint><C:\Program Files\Apoint\Apoint.exe>  [(Verified)Microsoft Windows Hardware Compatibility Publisher]
<Dell QuickSet><C:\Program Files\Dell\QuickSet\quickset.exe>  [Dell Inc.]
<Google IME Autoupdater><C:\Program Files\Google\Google Pinyin\GooglePinyinDaemon.exe>  [(Verified)Google Inc]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
<shell><Explorer.exe>  [(Verified)Microsoft Windows Component Publisher]
<Userinit><C:\WINDOWS\SYSTEM32\USERINIT.EXE>  [(Verified)Microsoft Windows Component Publisher]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Windows]
<AppInit_DLLs><>  [N/A]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
<UIHost><logonui.exe>  [(Verified)Microsoft Windows Component Publisher]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
<WPDShServiceObj><C:\WINDOWS\system32\WPDShServiceObj.dll>  [(Verified)Microsoft Windows Component Publisher]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\ImpsSensor]
<WinlogonNotify: ImpsSensor><ImpsSensor.dll>  [N/A]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\>{26923b43-4d38-484f-9b9e-de460746276c}]
<Internet Explorer><%systemroot%\system32\shmgrate.exe OCInstallUserConfigIE>  [N/A]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\>{881dd1c5-3dcf-431b-b061-f3f88e8be88a}]
<Outlook Express><%systemroot%\system32\shmgrate.exe OCInstallUserConfigOE>  [N/A]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{2C7339CF-2B09-4501-B3F3-F3508C9228ED}]
<Themes Setup><%SystemRoot%\system32\regsvr32.exe /s /n /i:/UserInstall %SystemRoot%\system32\themeui.dll>  [N/A]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{44BBA840-CC51-11CF-AAFA-00AA00B6015C}]
<Microsoft Outlook Express 6><"%ProgramFiles%\Outlook Express\setup50.exe" /APP:OE /CALLER:WINNT /user /install>  [N/A]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{44BBA842-CC51-11CF-AAFA-00AA00B6015B}]
<NetMeeting 3.01><rundll32.exe advpack.dll,LaunchINFSection C:\WINDOWS\INF\msnetmtg.inf,NetMtg.Install.PerUser.NT>  [(Verified)Microsoft Windows Publisher]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{5945c046-1e7d-11d1-bc44-00c04fd912be}]
<Windows Messenger 4.7><rundll32.exe advpack.dll,LaunchINFSection C:\WINDOWS\INF\msmsgs.inf,BLC.QuietInstall.PerUser>  [(Verified)Microsoft Windows Publisher]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{6BF52A52-394A-11d3-B153-00C04F79FAA6}]
<Microsoft Windows Media Player><rundll32.exe advpack.dll,LaunchINFSection C:\WINDOWS\INF\wmp11.inf,PerUserStub>  [(Verified)Microsoft Windows Component Publisher]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{7790769C-0471-11d2-AF11-00C04FA35D02}]
<通讯簿 6><"%ProgramFiles%\Outlook Express\setup50.exe" /APP:WAB /CALLER:WINNT /user /install>  [N/A]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{89B4C1CD-B018-4511-B0A1-5476DBF70820}]
<N/A><C:\WINDOWS\system32\Rundll32.exe C:\WINDOWS\system32\mscories.dll,Install>  [(Verified)Microsoft Corporation]
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
<acdseemc.exe><; C:\Program Files\Common Files\ACD Systems\ACDSeeMC.EXE>  [(Verified)ACD Systems Ltd]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
<Acrobat Assistant 8.0><; "C:\Program Files\Adobe\Acrobat 8.0\Acrobat\Acrotray.exe">  [(Verified)"Adobe Systems, Incorporated"]
<Adobe Reader Speed Launcher><; "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe">  [(Verified)"Adobe Systems, Incorporated"]
<Broadcom Wireless Manager UI><; C:\WINDOWS\system32\WLTRAY.exe>  [Dell Inc.]
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
<Google IME Autoupdater><; C:\Program Files\Google\Google Pinyin\GooglePinyinDaemon.exe>  [(Verified)Google Inc]
<Google Update><; "C:\Documents and Settings\dell\Local Settings\Application Data\Google\Update\1.1.27.0\GoogleUpdate.exe" /lang en>  [(Verified)Google Inc]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
<IMJPMIG8.1><; "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32>  [(Verified)Microsoft Windows Publisher]
<IMSCMig><; C:\PROGRA~1\COMMON~1\MICROS~1\IME\IMSC40A\IMSCMIG.EXE /Preload>  [(Verified)Microsoft Corporation]
<ISUSPM Startup><; C:\PROGRA~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe -startup>  [InstallShield Software Corporation]
<ISUSScheduler><; "C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" -start>  [InstallShield Software Corporation]
<KernelFaultCheck><; %systemroot%\system32\dumprep 0 -k>  [N/A]
<Microsoft Pinyin IME Migration><; C:\PROGRA~1\COMMON~1\MICROS~1\IME12\IMESC\IMSCMIG.EXE /INSTALL>  [(Verified)Microsoft Corporation]
<NvCplDaemon><; RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup>  [(Verified)Microsoft Windows Hardware Compatibility Publisher]
<NVHotkey><; rundll32.exe nvHotkey.dll,Start>  [NVIDIA Corporation]
<nwiz><; nwiz.exe /installquiet>  []
<PHIME2002A><; C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName>  [(Verified)Microsoft Windows Publisher]
<PHIME2002ASync><; C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC>  [(Verified)Microsoft Windows Publisher]
<RoxioDragToDisc><; "C:\Program Files\Roxio\Drag-to-Disc\DrgToDsc.exe">  [(Verified)Sonic Solutions]
<SigmatelSysTrayApp><; stsystra.exe>  [SigmaTel, Inc.]
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
<SRS Audio Sandbox><; "C:\Program Files\SRS Labs\Audio Sandbox\SRSSSC.exe" /hideme>  [SRS Labs, Inc.]
<swg><; C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe>  [(Verified)Google Inc]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
<Synchronization Manager><; %SystemRoot%\system32\mobsync.exe /logon>  [(Verified)Microsoft Windows Component Publisher]
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
<TM2008><; "d:\Program Files\Tencent\TM2008\Bin\TM.exe" /background>  [(Verified)Tencent Technology(Shenzhen) Company Limited]
<WangWang><; "d:\Program Files\Alisoft\WangWang\WangWang.exe">  [(Verified)"Alibaba Software(Shanghai)Co,. Ltd"]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
<WebPlayerUpdater><; "C:\Program Files\VIEWGOOD\WebPlayer 2007\Updater.exe" /Hide>  [VIEWGOOD]

附件 1: 大家的注册表USERINIT出问题了吗 - 微点 - 国内杀软讨论区 - 卡饭论坛 - 计算机安全软件交流中心 - 傲游(Ma (2008-5-16 18:38, 69.79 K,下载次数： 51)

作者: zdlzp 时间: 2008-5-16 19:01
同样问题.................

作者: 纪念-蛋蛋 时间: 2008-5-16 19:43
我的也一样

作者: zdlzp 时间: 2008-5-16 20:01
HKEY_LOCAL_MACHINE,SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\WINLOGON,USERINIT,REG_SZ01%SYSTEMROOT%\SYSTEM32\USERINIT.EXE\,

作者: 纪念-蛋蛋 时间: 2008-5-18 14:41
昨天升级重启，好像这个问题解决了

作者: 镰刀 时间: 2008-5-18 14:43
已经解决了!升级后解决了!

欢迎光临微点交流论坛 (http://bbs.micropoint.com.cn/)

bbs.micropoint.com.cn