瑞星卡卡安全论坛技术交流区反病毒/反流氓软件论坛 奇怪的注册表项 是木马吗?!【求助】

12   2  /  2  页   跳转

奇怪的注册表项 是木马吗?!【求助】

各位大侠多帮忙!(作打千状)
gototop
 

啊~~~~~还在用98的系统
gototop
 

小黑们爱扫我机器的135端口,求助:怎么关闭?!
gototop
 

TCP0.0.0.0:1350.0.0.0:0LISTENING
TCP0.0.0.0:19790.0.0.0:0LISTENING
TCP10.4.168.53:1370.0.0.0:0LISTENING
TCP10.4.168.53:1380.0.0.0:0LISTENING
TCP10.4.168.53:1390.0.0.0:0LISTENING
TCP127.0.0.1:10290.0.0.0:0LISTENING
TCP127.0.0.1:10550.0.0.0:0LISTENING
TCP0.0.0.0:11850.0.0.0:0LISTENING
TCP10.4.168.53:1185219.238.233.238:80ESTABLISHED
TCP0.0.0.0:11860.0.0.0:0LISTENING
TCP0.0.0.0:11870.0.0.0:0LISTENING
TCP10.4.168.53:1186219.238.233.252:80ESTABLISHED
TCP10.4.168.53:1187218.17.247.25:80ESTABLISHED
TCP0.0.0.0:11880.0.0.0:0LISTENING
TCP10.4.168.53:1188219.238.233.249:80ESTABLISHED
TCP0.0.0.0:11890.0.0.0:0LISTENING
TCP10.4.168.53:1189219.238.233.252:80ESTABLISHED
TCP0.0.0.0:11910.0.0.0:0LISTENING
TCP10.4.168.53:1191219.133.38.144:80SYN_SENT
UDP10.4.168.53:137*:*
UDP10.4.168.53:138*:*
UDP127.0.0.1:1055*:*
gototop
 

以下是瑞星听诊器的扫描纪录:
自启动项
HKEY_LOCAL_MACHINE Software\Microsoft\Windows\Currentversion\Run
internat.exe = internat.exe
TaskMonitor = D:\WINDOWS\taskmon.exe
SystemTray = SysTray.Exe
C-Media Mixer = D:\Program Files\PCI Audio Applications\Mixer.exe /startup
RavTimer = D:\PROGRAM FILES\RISING\RAV\RavTimer.exe
CCenter = d:\Program Files\Rising\Rav\CCenter.exe
RavTray = d:\Program Files\Rising\Rav\RavTray.exe
SKYNET Personal FireWall = D:\PROGRAM FILES\SKYNET\FIREWALL\PFW.EXE
iparmor = C:\PROGRAM FILES\IPARMOR\IPARMOR.EXE mini
HKEY_LOCAL_MACHINE Software\Microsoft\Windows\Currentversion\RunServices
RavService = d:\Program Files\Rising\Rav\RavService.exe /service
RavMon = d:\Program Files\Rising\Rav\RavMon.exe -system
RavMond = d:\Program Files\Rising\Rav\RavMond.exe
HKEY_LOCAL_MACHINE Software\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks
shell32.dll =
HKEY_LOCAL_MACHINE Software\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad
WebCheck = D:\WINDOWS\SYSTEM\WEBCHECK.DLL
HKEY_LOCAL_MACHINE Software\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler
D:\WINDOWS\SYSTEM\BROWSEUI.DLL= Browseui 预加载程序
D:\WINDOWS\SYSTEM\BROWSEUI.DLL= 组件类别缓存程序

SYSTEM.INI BOOT SHELL Explorer.exe


其他相关项
HKEY_CURRENT_USER Software\Microsoft\Internet Explorer\Main start page ----> www.hao123.com/index3.htm
HKEY_LOCAL_MACHINE Software\Microsoft\Internet Explorer\Main local page ----> http://www.jsing.net/index1.htm
HKEY_LOCAL_MACHINE Software\Microsoft\Internet Explorer\Main SearchURL ----> http://www.jsing.net/index1.htm
HKEY_CURRENT_USER Software\Microsoft\Internet Explorer\Main search page ----> http://home.microsoft.com/intl/cn/access/allinone.asp
HKEY_LOCAL_MACHINE Software\Microsoft\Internet Explorer\Main search bar ----> http://www.jsing.net/index1.htm
HKEY_LOCAL_MACHINE SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows AppInit_DLLs ----> APIHookDll.dll
HKEY_USERS .Default\Software\Microsoft\Internet Explorer\Main start page ----> www.hao123.com/index3.htm
HKEY_USERS .Default\Software\Microsoft\Internet Explorer\Main search page ----> http://home.microsoft.com/intl/cn/access/allinone.asp



诊断信息


1 RAREXT.DLL 60% 您要搜索的 C:\PROGRAM FILES\WINRAR\RAREXT.DLL
2 NVDD32.DLL 60% 您要搜索的 D:\WINDOWS\SYSTEM\NVDD32.DLL

进程列表


D:\WINDOWS\SYSTEM\KERNEL32.DLL
D:\WINDOWS\SYSTEM\MSGSRV32.EXE
D:\WINDOWS\SYSTEM\MPREXE.EXE
D:\PROGRAM FILES\RISING\RAV\RAVSERVICE.EXE
D:\PROGRAM FILES\RISING\RAV\RAVMON.EXE
D:\WINDOWS\SYSTEM\mmtask.tsk
D:\WINDOWS\EXPLORER.EXE
D:\WINDOWS\SYSTEM\RPCSS.EXE
D:\WINDOWS\SYSTEM\INTERNAT.EXE
D:\WINDOWS\TASKMON.EXE
D:\WINDOWS\SYSTEM\SYSTRAY.EXE
D:\PROGRAM FILES\PCI AUDIO APPLICATIONS\MIXER.EXE
D:\PROGRAM FILES\RISING\RAV\RAVTIMER.EXE
D:\PROGRAM FILES\RISING\RAV\CCENTER.EXE
D:\PROGRAM FILES\RISING\RAV\RAVTRAY.EXE
D:\WINDOWS\SYSTEM\WMIEXE.EXE
D:\WINDOWS\SYSTEM\DDHELP.EXE
D:\PROGRAM FILES\INTERNET EXPLORER\IEXPLORE.EXE
F:\RISINGTOOLS\RAVDETECT.EXE

进程详细信息


D:\PROGRAM FILES\INTERNET EXPLORER\IEXPLORE.EXE

D:\PROGRAM FILES\COMMON FILES\MICROSOFT SHARED\WEB FOLDERS\MSONSEXT.DLL


D:\WINDOWS\SYSTEM\DDHELP.EXE

D:\WINDOWS\SYSTEM\NVDD32.DLL (made by NVidia Corporation)


D:\WINDOWS\SYSTEM\NVARCH32.DLL (made by NVidia Corporation)


D:\WINDOWS\EXPLORER.EXE

D:\WINDOWS\SYSTEM\WINABC.IME (made by PKUETI)


C:\PROGRAM FILES\WINRAR\RAREXT.DLL


D:\PROGRAM FILES\RISING\RAV\RAVSERVICE.EXE

D:\WINDOWS\SYSTEM\NETBIOS.DLL


gototop
 

help~help~help
gototop
 

高手们请进!!!
gototop
 

是的QQ是不是有QQ宠物啊
gototop
 
12   2  /  2  页   跳转
页面顶部
Powered by Discuz!NT