logonui.exe无法找到入口

你可以用expand 命令从xp安装光盘中提取文件. 启动项目注册表 [hkey_current_user\software\microsoft\windows\currentversion\run] <ctfmon.exe><c:\windows\system32\ctfmon.exe> [(verified)microsoft windows xp publ**her] [hkey_local_machine\software\microsoft\windows\currentversion\run] <imjpmig8.1><c:\windows\ime\imjp8_1\imjpmig.exe /spoil /remadvdef /migration32> [(verified)microsoft windows xp publ**her] <phime2002async><c:\windows\system32\ime\tintlgnt\tintsetp.exe /sync> [(verified)microsoft windows xp publ**her] <k**run><d:\金山毒~1\k**run.exe> [kingsoft] <kulansyn><d:\金山毒~1\kulansyn.exe> [kingsoft corp.] <360safetray><d:\360safe\safemon\360tray.exe /start> [奇虎网] [hkey_local_machine\software\microsoft\windows nt\currentversion\winlogon] <shell><explorer.exe> [(verified)microsoft windows xp publ**her] <userinit><c:\windows\system32\userinit.exe,> [(verified)microsoft windows xp publ**her] <uihost><logonui.exe> [(verified)microsoft windows xp publ**her] [hkey_local_machine\software\microsoft\active setup\installed components\{2c7339cf-2b09-4501-b3f3-f3508c9228ed}] <themes setup><%systemroot%\system32\regsvr32.exe /s /n /i:/userinstall %systemroot%\system32\themeui.dll> [n/a] [hkey_local_machine\software\microsoft\active setup\installed components\{44bba840-cc51-11cf-aafa-00aa00b6015c}] <microsoft outlook express 6><"%programfiles%\outlook express\setup50.exe" /app:oe /caller:winnt /user /install> [n/a] [hkey_local_machine\software\microsoft\active setup\installed components\{44bba842-cc51-11cf-aafa-00aa00b6015b}] <netmeeting 3.01><rundll32.exe advpack.dll,launchinfsection c:\windows\inf\msnetmtg.inf,netmtg.install.peruser.nt> [(verified)microsoft windows xp publ**her] [hkey_local_machine\software\microsoft\active setup\installed components\{5945c046-1e7d-11d1-bc44-00c04fd912be}] <windows messenger><rundll32.exe advpack.dll,launchinfsection %systemroot%\inf\msmsgs.inf,blc.install.peruser> [n/a] [hkey_local_machine\software\microsoft\active setup\installed components\{6bf52a52-394a-11d3-b153-00c04f79faa6}] <microsoft windows media player><rundll32.exe advpack.dll,launchinfsection c:\windows\inf\wmp10.inf,peruserstub> [(verified)microsoft windows component publ**her] [hkey_local_machine\software\microsoft\active setup\installed components\{7790769c-0471-11d2-af11-00c04fa35d02}] <通讯簿 6><"%programfiles%\outlook express\setup50.exe" /app:wab /caller:winnt /user /install> [n/a] ================================== 启动文件夹 n/a ================================== 服务 [application management / appmgmt][stopped/manual start] <c:\windows\system32\svchost.exe -k netsvcs-->%systemroot%\system32\appmgmts.dll><n/a> [crypkey license / crypkey license][running/auto start] <crypserv.exe><kenonic controls ltd.> [kingsoft antivirus service / k**svc][running/auto start] <d:\金山毒霸6\k**svc.exe><kingsoft antivirus> [macromedia licensing service / macromedia licensing service][stopped/manual start] <"c:\program files\common files\macromedia shared\service\macromedia licensing.exe"><> ================================== 驱动程序 [basic2 / basic2][running/manual start] <system32\drivers\hsf_bsc2.sys><conexant> [fallback / fallback][running/auto start] <system32\drivers\hsf_fall.sys><conexant> [fsks / fsks][running/auto start] <system32\drivers\hsf_fsks.sys><conexant> [hsf_msft / hsf_msft][running/manual start] <system32\drivers\hsf_msft.sys><conexant> [immdrv / immdrv][stopped/manual start] <\??\e:\tw**ter\immdrv.sys><filseclab corp.> [k56 / k56][running/auto start] <system32\drivers\hsf_k56k.sys><conexant> [kwatch / kwatch][running/manual start] <\??\c:\windows\system32\drivers\kwatch.sys><kingsoft corporation> [kwatch2 / kwatch2][stopped/manual start] <\??\c:\windows\system32\drivers\kwatch2.sys><kingsoft antivirus> [networkx / networkx][stopped/system start] <\systemroot\system32\ckldrv.sys><n/a> [netgroup packet filter / npf][stopped/manual start] <system32\drivers\npf.sys><n/a> [nv4 / nv4][running/manual start] <system32\drivers\nv4.sys><nvidia corporation> [direct parallel link driver / ptilink][running/manual start] <system32\drivers\ptilink.sys><parallel technologies, inc.> [rksample / rksample][running/manual start] <system32\drivers\hsf_samp.sys><conexant> [realtek rtl8139(a/b/c)-based pci fast ethernet adapter nt driver / rtl8139][running/manual start] <system32\drivers\rtl8139.sys><realtek semiconductor corporation> [secdrv / secdrv][stopped/manual start] <system32\drivers\secdrv.sys><n/a> [service for ac'97 sample driver (wdm) / s**7012][running/manual start] <system32\drivers\s**7012.sys><silicon integrated systems corporation> [s** agp bus filter / s**agp][running/boot start] <\systemroot\system32\drivers\s**agp.sys><silicon integrated systems corporation> [ps/2 keyboard filter driver for win2000 / sk99202k][running/manual start] <system32\drivers\sk99202k.sys><silitek corp.> [ps/2 keyboard filter driver for nt 4.0 / sk9920nt][running/system start] <system32\drivers\sk9920nt.sys><silitek corp.> [softfax / softfax][running/auto start] <system32\drivers\hsf_faxx.sys><conexant> [tones / tones][running/auto start] <system32\drivers\hsf_tone.sys><conexant> [v124 / v124][running/auto start] <system32\drivers\hsf_v124.sys><conexant> ================================== 浏览器加载项 [safemon class] {b69f34dd-f0f9-42dc-9edd-957187da688d} <d:\360safe\safemon\safemon.dll, 奇虎网> [电台(&r)] {8e718888-423f-11d2-876e-00a0c9082467} <c:\windows\system32\msdxm.ocx, microsoft corporation> [shockw**e flash object] {d27cdb6e-ae6d-11cf-96b8-444553540000} <c:\windows\system32\macromed\flash\flash85.ocx, macromedia, inc.> [360safelive] {87515f61-a66c-4319-a0e0-d416cb8059e3} <d:\360safe\live.dll, 360safe.com> [用维棠(vidown)下载视频] <d:\下载工具\vidown_0.82i\vd_link.htm, n/a> ================================== 正在运行进程 [pid: 400 / system][\systemroot\system32\smss.exe] [microsoft corporation, 5.1.2600.0 (xpclient.010817-1148)] [pid: 460 / system][\??\c:\windows\system32\csrss.exe] [microsoft corporation, 5.1.2600.0 (xpclient.010817-1148)] [pid: 484 / system][\??\c:\windows\system32\winlogon.exe] [microsoft corporation, 5.1.2600.149 (xpclnt_qfe.021108-2107)] [c:\windows\system32\wdmaud.drv] [microsoft corporation, 5.1.2600.0 (xpclient.010817-1148)] [c:\windows\system32\msacm32.drv] [microsoft corporation, 5.1.2600.0 (xpclient.010817-1148)] [pid: 528 / system][c:\windows\system32\services.exe] [microsoft corporation, 5.1.2600.0 (xpclient.010817-1148)] [pid: 540 / system][c:\windows\system32\lsass.exe] [microsoft corporation, 5.1.2600.0 (xpclient.010817-1148)] [pid: 724 / system][c:\windows\system32\svchost.exe] [microsoft corporation, 5.1.2600.0 (xpclient.010817-1148)] [pid: 748 / system][c:\windows\system32\svchost.exe] [microsoft corporation, 5.1.2600.0 (xpclient.010817-1148)] [c:\windows\system32\winhttp.dll] [microsoft corporation, 5.1.2600.1557 (xpsp2_gdr.040517-1325)] [c:\windows\system32\wups.dll] [microsoft corporation, 5.8.0.2469 built by: lab01_n(wmbla)] [pid: 824 / network service][c:\windows\system32\svchost.exe] [microsoft corporation, 5.1.2600.0 (xpclient.010817-1148)] [pid: 848 / local service][c:\windows\system32\svchost.exe] [microsoft corporation, 5.1.2600.0 (xpclient.010817-1148)] [pid: 932 / system][c:\windows\system32\spoolsv.exe] [microsoft corporation, 5.1.2600.0 (xpclient.010817-1148)] [pid: 1052 / local service][c:\windows\system32\alg.exe] [microsoft corporation, 5.1.2600.0 (xpclient.010817-1148)] [pid: 1072 / system][c:\windows\system32\crypserv.exe] [kenonic controls ltd., 5.4.0] [pid: 1144 / system][d:\金山毒霸6\k**svc.exe] [kingsoft antivirus, 2003, 11, 12, 70] [d:\金山毒霸6\svccomm.dll] [kingsoft antivirus, 2004, 7, 28, 1] [d:\金山毒霸6\svctimer.dll] [kingsoft, 2004.4.29.79] [d:\金山毒霸6\k**comm.dll] [kingsoft corporation, 2003, 11, 12, 66] [d:\金山毒霸6\rpcbrge.dll] [kingsoft, 2003, 11, 12, 64] [d:\金山毒霸6\kwatchfn2.dll] [kingsoft corporation, 2004, 8, 24, 25] [d:\金山毒霸6\kaeplat.dll] [kingsoft corp., 2005, 12, 29, 56] [d:\金山毒霸6\kaemem.dat] [kingsoft, 2006, 4, 12, 13] [d:\金山毒霸6\kaeunpack.dat] [kingsoft corp., 2006, 6, 15, 44] [d:\金山毒霸6\k**utils.dll] [kingsoft corp, 2004, 2, 12, 69] [d:\金山毒霸6\mfc42.dll] [microsoft corporation, 6.00.8665.0] [d:\金山毒霸6\k**dlg.dll] [, 2004.7.20.81] [d:\金山毒霸6\k**logfn.dll] [, 2003, 11, 26, 16] [pid: 1192 / system][c:\windows\system32\svchost.exe] [microsoft corporation, 5.1.2600.0 (xpclient.010817-1148)] [pid: 1216 / local service][c:\windows\system32\wdfmgr.exe] [microsoft corporation, 5.2.3790.1230 built by: dnsrv(bld4act)] [pid: 1344 / donghai][c:\windows\explorer.exe] [microsoft corporation, 6.00.2600.0000 (xpclient.010817-1148)] [d:\360safe\safemon\safemon.dll] [奇虎网, 4, 0, 3, 1003] [c:\progra~1\direct~1\dfshel~1.dll] [n/a, ] [c:\program files\winrar 3.60beta2 简体中文注册版\rarext.dll] [n/a, ] [d:\绿色小软件\系统维护\unlocker1.8.6\unlockercom.dll] [n/a, ] [pid: 1552 / donghai][d:\金山毒~1\kwatchui.exe] [, 2004.1.6.119] [d:\金山毒~1\k**comm.dll] [kingsoft corporation, 2003, 11, 12, 66] [d:\金山毒~1\k**dlg.dll] [, 2004.7.20.81] [d:\金山毒~1\k**mlm.dll] [kingsoft corporation, 2003.11.12.10] [d:\金山毒~1\rpcbrge.dll] [kingsoft, 2003, 11, 12, 64] [pid: 1560 / donghai][d:\360safe\safemon\360tray.exe] [奇虎网, 4, 0, 3, 1004] [d:\360safe\safemon\safemon.dll] [奇虎网, 4, 0, 3, 1003] [d:\360safe\safemon\safekrnl.dll] [奇虎网, 4, 0, 3, 1008] [d:\360safe\antiadwa.dll] [360safe.com, 4, 0, 0, 1002] [d:\360safe\live.dll] [360safe.com, 1, 0, 1, 1023] [pid: 1572 / donghai][c:\windows\system32\ctfmon.exe] [microsoft corporation, 5.1.2600.0 (xpclient.010817-1148)] [pid: 1668 / donghai][d:\金山毒~1\k**plus.exe] [, 2004, 3, 3, 71] [d:\金山毒~1\mfc42.dll] [microsoft corporation, 6.00.8665.0] [d:\360safe\safemon\safemon.dll] [奇虎网, 4, 0, 3, 1003] [pid: 980 / donghai][c:\windows\system32\conime.exe] [microsoft corporation, 5.1.2600.0 (xpclient.010817-1148)] [d:\360safe\safemon\safemon.dll] [奇虎网, 4, 0, 3, 1003] [pid: 1136 / donghai][d:\绿色小软件\系统维护\sreng2crsky\crsky.exe] [smallfrogs studio, 2.5.16.900] [d:\360safe\safemon\safemon.dll] [奇虎网, 4, 0, 3, 1003] [d:\绿色小软件\系统维护\sreng2crsky\upload\3rdupd.dll] [smallfrogs studio, 2, 1, 0, 15] ================================== 文件关联 .txt ok. [%systemroot%\system32\notepad.exe %1] .exe ok. ["%1" %*] .com ok. ["%1" %*] .pif ok. ["%1" %*] .reg ok. [regedit.exe "%1"] .bat ok. ["%1" %*] .scr ok. ["%1" /s] .chm ok. ["c:\windows\hh.exe" %1] .hlp ok. [%systemroot%\system32\winhlp32.exe %1] .ini ok. [%systemroot%\system32\notepad.exe %1] .inf ok. [%systemroot%\system32\notepad.exe %1] .vbs ok. [%systemroot%\system32\wscript.exe "%1" %*] .js ok. [%systemroot%\system32\wscript.exe "%1" %*] .lnk ok. [{00021401-0000-0000-c000-000000000046}] ================================== winsock 提供者 n/a ================================== autorun.inf n/a ================================== hosts 文件 127.0.0.1 localhost ================================== 进程特权扫描特殊特权被允许： sedebugprivilege [pid = 1560, d:\360safe\safemon\360tray.exe] ================================== api hook n/a ================================== 隐藏进程 n/a ================================== 20210311