求助 backdoor.rbot 杀了开机又有 N次 - 瑞星卡卡安全论坛bbs.ikaka.com

瑞星卡卡安全论坛技术交流区 反病毒/反流氓软件论坛求助 backdoor.rbot 杀了开机又有 N次

	瑞星“1+2”全新解决方案巡展在广州画上圆满句号		叶院长揭秘：瑞星如何运用AI技术革新网络安全		俄乌冲突加剧网络攻击风险白俄罗斯政府遭APT攻击		瑞星ESM防病毒系统助力矿业大学筑牢网络安全防线
	实力拉满瑞星第五十次通过VB100测评		携手老友，拥抱新精彩 —— 新论坛新活动，感谢你的陪伴		护航司法，瑞星助力山西省高院构建安全防线		人工智能在网络安全领域的风险和机遇

12

1 / 2 页

跳转页

求助 backdoor.rbot 杀了开机又有 N次

蚩尤天棒初生襁褓狮帖子:12 注册: 2006-08-02 来自:	发表于： 2006-08-02 18:32 \| 只看楼主短消息资料字号：小中大 1楼求助 backdoor.rbot 杀了开机又有 N次我用瑞星扫的：扫描结果: C:\WINDOWS\System32\winsystems.exe --> 与 Backdoor.Rbot 100%相似. 系统活动进程 E:\下载\RSDETECT.EXE C:\PROGRA~1\YAHOO!\ASSIST~1\YHELPER.DLL C:\WINDOWS\EXPLORER.EXE C:\WINDOWS\SYSTEM32\VTUTS.DLL C:\WINDOWS\SYSTEM32\RAVEXT.DLL C:\PROGRA~1\YAHOO!\ASSIST~1\YHELPER.DLL C:\WINDOWS\SYSTEM32\WDMAUD.DRV C:\WINDOWS\SYSTEM32\MSACM32.DRV C:\PROGRA~1\YAHOO!\ASSIST~1\YALIVE.DLL C:\PROGRA~1\YAHOO!\ASSIST~1\YALLIVEEX.DLL C:\PROGRA~1\YAHOO!\ASSIST~1\ASSIST\YWIPER.DLL G:\PROGRAM FILES\WINRAR\RAREXT.DLL C:\PROGRAM FILES\RISING\RAV\RSCOMMON.DLL C:\PROGRA~1\YAHOO!\ASSIST~1\YLIVE.EXE C:\PROGRA~1\YAHOO!\ASSIST~1\YHELPER.DLL C:\PROGRA~1\YAHOO!\ASSIST~1\YALIVE.DLL C:\PROGRA~1\YAHOO!\ASSIST~1\YALLIVEEX.DLL C:\WINDOWS\SOUNDMAN.EXE C:\PROGRA~1\YAHOO!\ASSIST~1\YHELPER.DLL C:\PROGRA~1\YAHOO!\ASSISTANT\YASSISTSE.EXE C:\PROGRA~1\YAHOO!\ASSIST~1\YHELPER.DLL C:\PROGRA~1\YAHOO!\ASSISTANT\SHELL\YASMENU.DLL C:\PROGRA~1\YAHOO!\ASSISTANT\SHELL\YASSECBLK.DLL C:\PROGRA~1\YAHOO!\ASSISTANT\SHELL\YIEANGEL.DLL C:\PROGRA~1\YAHOO!\ASSISTANT\SHELL\YMENUINFO.DLL C:\PROGRAM FILES\RISING\RFW\RFW.EXE C:\PROGRAM FILES\RISING\RFW\BMPFACE.DLL C:\PROGRAM FILES\RISING\RFW\RFW.DLL C:\PROGRAM FILES\RISING\RFW\CHN\RFW.LAG C:\PROGRA~1\YAHOO!\ASSIST~1\YHELPER.DLL C:\PROGRAM FILES\RISING\RFW\PSAPI.DLL C:\WINDOWS\SYSTEM32\WINSYSTEMS.EXE C:\WINDOWS\SYSTEM32\CTFMON.EXE C:\PROGRA~1\YAHOO!\ASSIST~1\YHELPER.DLL 普通自启动项 HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run IMJPMIG8.1 = "C:\WINDOWS\IME\IMJP8_1\IMJPMIG.EXE" /SPOIL /REMADVDEF /MIGRATION32 PHIME2002ASync = C:\WINDOWS\SYSTEM32\IME\TINTLGNT\TINTSETP.EXE /SYNC PHIME2002A = C:\WINDOWS\SYSTEM32\IME\TINTLGNT\TINTSETP.EXE /IMENAME SKYNET Personal FireWall = G:\PROGRAM FILES\SKYNET\FIREWALL\PFW.EXE YLive.exe = C:\PROGRA~1\YAHOO!\ASSIST~1\YLIVE.EXE StormCodec_Helper = "G:\PROGRAM FILES\RINGZ STUDIO\STORM CODEC\STORMSET.EXE" /S /OPTI SoundMan = SOUNDMAN.EXE yassistse = "C:\PROGRA~1\YAHOO!\ASSISTANT\YASSISTSE.EXE" rfw = C:\PROGRAM FILES\RISING\RFW\RFW.EXE RavTask = "C:\PROGRAM FILES\RISING\RAV\RAVTASK.EXE" -SYSTEM winsystems25 = WINSYSTEMS.EXE HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce RavStub = "C:\PROGRAM FILES\RISING\RAV\RAVSTUB.EXE" /RUNONCE HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServices winsystems25 = WINSYSTEMS.EXE HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run ctfmon.exe = C:\WINDOWS\SYSTEM32\CTFMON.EXE AppInit_DLLs HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows AppInit_DLLs = 系统文件关联 .exe ==> exefile = "%1" %* .com ==> comfile = "%1" %* .cmd ==> cmdfile = "%1" %* .bat ==> batfile = "%1" %* .txt ==> txtfile = %SystemRoot%\system32\NOTEPAD.EXE %1 .scr ==> scrfile = "%1" /S .reg ==> regfile = regedit.exe "%1" .doc ==> WordPad.Document.1 = "%ProgramFiles%\Windows NT\Accessories\WORDPAD.EXE" "%1" 其它启动项 WIN.INI 无信息 SYSTEM.INI SHELL = Explorer.exe Winlogon 启动项 HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify crypt32chain = CRYPT32.DLL cryptnet = CRYPTNET.DLL cscdll = CSCDLL.DLL H323TSP = C:\WINDOWS\SYSTEM32\QLV.DLL RunOnce = C:\WINDOWS\SYSTEM32\SOECLI.DLL ScCertProp = WLNOTIFY.DLL Schedule = WLNOTIFY.DLL sclgntfy = SCLGNTFY.DLL SensLogn = WLNOTIFY.DLL SMDEn = C:\WINDOWS\SYSTEM32\K6800GLME6QA0.DLL termsrv = WLNOTIFY.DLL vtuts = C:\WINDOWS\SYSTEM32\VTUTS.DLL wlballoon = WLNOTIFY.DLL HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon Userinit = C:\WINDOWS\SYSTEM32\USERINIT.EXE, shell = EXPLORER.EXE IE - BHO HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects {B6643E71-05A8-43E5-AAC6-A2BF9E7AB0AC} = C:\WINDOWS\System32\vtuts.dll Winsock SPI MSAFD Tcpip [TCP/IP] = C:\WINDOWS\SYSTEM32\MSWSOCK.DLL MSAFD Tcpip [UDP/IP] = C:\WINDOWS\SYSTEM32\MSWSOCK.DLL MSAFD Tcpip [RAW/IP] = C:\WINDOWS\SYSTEM32\MSWSOCK.DLL RSVP UDP Service Provider = C:\WINDOWS\SYSTEM32\RSVPSP.DLL RSVP TCP Service Provider = C:\WINDOWS\SYSTEM32\RSVPSP.DLL MSAFD NetBIOS [\Device\NetBT_Tcpip_{6D216F09-784F-4650-8E35-F9867474EAF7}] SEQPACKET 3 = C:\WINDOWS\SYSTEM32\MSWSOCK.DLL MSAFD NetBIOS [\Device\NetBT_Tcpip_{6D216F09-784F-4650-8E35-F9867474EAF7}] DATAGRAM 3 = C:\WINDOWS\SYSTEM32\MSWSOCK.DLL MSAFD NetBIOS [\Device\NetBT_Tcpip_{298FF124-9448-4797-A5D0-EA62E8C977BD}] SEQPACKET 0 = C:\WINDOWS\SYSTEM32\MSWSOCK.DLL MSAFD NetBIOS [\Device\NetBT_Tcpip_{298FF124-9448-4797-A5D0-EA62E8C977BD}] DATAGRAM 0 = C:\WINDOWS\SYSTEM32\MSWSOCK.DLL MSAFD NetBIOS [\Device\NetBT_Tcpip_{EC059CA4-447D-4417-87B1-302CFEA98DB0}] SEQPACKET 1 = C:\WINDOWS\SYSTEM32\MSWSOCK.DLL MSAFD NetBIOS [\Device\NetBT_Tcpip_{EC059CA4-447D-4417-87B1-302CFEA98DB0}] DATAGRAM 1 = C:\WINDOWS\SYSTEM32\MSWSOCK.DLL MSAFD NetBIOS [\Device\NetBT_Tcpip_{FD19B233-CDAD-489F-9C74-E7E2FC1C0189}] SEQPACKET 2 = C:\WINDOWS\SYSTEM32\MSWSOCK.DLL MSAFD NetBIOS [\Device\NetBT_Tcpip_{FD19B233-CDAD-489F-9C74-E7E2FC1C0189}] DATAGRAM 2 = C:\WINDOWS\SYSTEM32\MSWSOCK.DLL MSAFD NetBIOS [\Device\NetBT_Tcpip_{4361CE09-2286-4973-A7BA-62BD83BF135E}] SEQPACKET 4 = C:\WINDOWS\SYSTEM32\MSWSOCK.DLL MSAFD NetBIOS [\Device\NetBT_Tcpip_{4361CE09-2286-4973-A7BA-62BD83BF135E}] DATAGRAM 4 = C:\WINDOWS\SYSTEM32\MSWSOCK.DLL MSAFD NetBIOS [\Device\NetBT_Tcpip_{E6358598-B871-4DCD-9672-29427D6194EA}] SEQPACKET 5 = C:\WINDOWS\SYSTEM32\MSWSOCK.DLL MSAFD NetBIOS [\Device\NetBT_Tcpip_{E6358598-B871-4DCD-9672-29427D6194EA}] DATAGRAM 5 = C:\WINDOWS\SYSTEM32\MSWSOCK.DLL 2006-08-02 19:36:15.593000000
蚩尤天棒初生襁褓狮帖子:12 注册: 2006-08-02 来自:	分享到：

蚩尤天棒初生襁褓狮帖子:12 注册: 2006-08-02 来自:	发表于： 2006-08-02 18:32 \| 只看楼主短消息资料字号：小中大 2楼系统服务项 HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services Alerter = C:\WINDOWS\SYSTEM32\SVCHOST.EXE -K LOCALSERVICE ALG = C:\WINDOWS\SYSTEM32\ALG.EXE AppMgmt = C:\WINDOWS\SYSTEM32\SVCHOST.EXE -K NETSVCS AudioSrv = C:\WINDOWS\SYSTEM32\SVCHOST.EXE -K NETSVCS BITS = C:\WINDOWS\SYSTEM32\SVCHOST.EXE -K NETSVCS Browser = C:\WINDOWS\SYSTEM32\SVCHOST.EXE -K NETSVCS CiSvc = C:\WINDOWS\SYSTEM32\CISVC.EXE ClipSrv = C:\WINDOWS\SYSTEM32\CLIPSRV.EXE COMSysApp = C:\WINDOWS\SYSTEM32\DLLHOST.EXE /PROCESSID:{02D4B3F1-FD88-11D1-960D-00805FC79235} CryptSvc = C:\WINDOWS\SYSTEM32\SVCHOST.EXE -K NETSVCS Dhcp = C:\WINDOWS\SYSTEM32\SVCHOST.EXE -K NETSVCS dmadmin = C:\WINDOWS\SYSTEM32\DMADMIN.EXE /COM dmserver = C:\WINDOWS\SYSTEM32\SVCHOST.EXE -K NETSVCS Dnscache = C:\WINDOWS\SYSTEM32\SVCHOST.EXE -K NETWORKSERVICE ERSvc = C:\WINDOWS\SYSTEM32\SVCHOST.EXE -K NETSVCS Eventlog = C:\WINDOWS\SYSTEM32\SERVICES.EXE EventSystem = C:\WINDOWS\SYSTEM32\SVCHOST.EXE -K NETSVCS FastUserSwitchingCompatibility = C:\WINDOWS\SYSTEM32\SVCHOST.EXE -K NETSVCS helpsvc = C:\WINDOWS\SYSTEM32\SVCHOST.EXE -K NETSVCS HidServ = C:\WINDOWS\SYSTEM32\SVCHOST.EXE -K NETSVCS ImapiService = C:\WINDOWS\SYSTEM32\IMAPI.EXE lanmanserver = C:\WINDOWS\SYSTEM32\SVCHOST.EXE -K NETSVCS lanmanworkstation = C:\WINDOWS\SYSTEM32\SVCHOST.EXE -K NETSVCS LmHosts = C:\WINDOWS\SYSTEM32\SVCHOST.EXE -K LOCALSERVICE Messenger = C:\WINDOWS\SYSTEM32\SVCHOST.EXE -K NETSVCS mnmsrvc = C:\WINDOWS\SYSTEM32\MNMSRVC.EXE MSDTC = C:\WINDOWS\SYSTEM32\MSDTC.EXE MSIServer = C:\WINDOWS\SYSTEM32\MSIEXEC.EXE /V NetDDE = C:\WINDOWS\SYSTEM32\NETDDE.EXE NetDDEdsdm = C:\WINDOWS\SYSTEM32\NETDDE.EXE Netlogon = C:\WINDOWS\SYSTEM32\LSASS.EXE Netman = C:\WINDOWS\SYSTEM32\SVCHOST.EXE -K NETSVCS Network Monitor = C:\PROGRAM FILES\NETWORK MONITOR\NETMON.EXE SERVICE Nla = C:\WINDOWS\SYSTEM32\SVCHOST.EXE -K NETSVCS NtLmSsp = C:\WINDOWS\SYSTEM32\LSASS.EXE NtmsSvc = C:\WINDOWS\SYSTEM32\SVCHOST.EXE -K NETSVCS PlugPlay = C:\WINDOWS\SYSTEM32\SERVICES.EXE PolicyAgent = C:\WINDOWS\SYSTEM32\LSASS.EXE ProtectedStorage = C:\WINDOWS\SYSTEM32\LSASS.EXE RasAuto = C:\WINDOWS\SYSTEM32\SVCHOST.EXE -K NETSVCS RasMan = C:\WINDOWS\SYSTEM32\SVCHOST.EXE -K NETSVCS RDSessMgr = C:\WINDOWS\SYSTEM32\SESSMGR.EXE RemoteAccess = C:\WINDOWS\SYSTEM32\SVCHOST.EXE -K NETSVCS RemoteRegistry = C:\WINDOWS\SYSTEM32\SVCHOST.EXE -K LOCALSERVICE RpcLocator = C:\WINDOWS\SYSTEM32\LOCATOR.EXE RpcSs = C:\WINDOWS\SYSTEM32\SVCHOST -K RPCSS RsCCenter = "C:\PROGRAM FILES\RISING\RAV\CCENTER.EXE" RsRavMon = "C:\PROGRAM FILES\RISING\RAV\RAVMOND.EXE" RSVP = C:\WINDOWS\SYSTEM32\RSVP.EXE SamSs = C:\WINDOWS\SYSTEM32\LSASS.EXE SCardDrv = C:\WINDOWS\SYSTEM32\SCARDSVR.EXE SCardSvr = C:\WINDOWS\SYSTEM32\SCARDSVR.EXE Schedule = C:\WINDOWS\SYSTEM32\SVCHOST.EXE -K NETSVCS seclogon = C:\WINDOWS\SYSTEM32\SVCHOST.EXE -K NETSVCS SENS = C:\WINDOWS\SYSTEM32\SVCHOST.EXE -K NETSVCS SharedAccess = C:\WINDOWS\SYSTEM32\SVCHOST.EXE -K NETSVCS ShellHWDetection = C:\WINDOWS\SYSTEM32\SVCHOST.EXE -K NETSVCS Spooler = C:\WINDOWS\SYSTEM32\SPOOLSV.EXE srservice = C:\WINDOWS\SYSTEM32\SVCHOST.EXE -K NETSVCS SSDPSRV = C:\WINDOWS\SYSTEM32\SVCHOST.EXE -K LOCALSERVICE stisvc = C:\WINDOWS\SYSTEM32\SVCHOST.EXE -K IMGSVC SwPrv = C:\WINDOWS\SYSTEM32\DLLHOST.EXE /PROCESSID:{3B1908B8-DF15-45AD-8995-475CB36FA8C6} SysmonLog = C:\WINDOWS\SYSTEM32\SMLOGSVC.EXE TapiSrv = C:\WINDOWS\SYSTEM32\SVCHOST.EXE -K NETSVCS TermService = C:\WINDOWS\SYSTEM32\SVCHOST.EXE -K NETSVCS Themes = C:\WINDOWS\SYSTEM32\SVCHOST.EXE -K NETSVCS TlntSvr = C:\WINDOWS\SYSTEM32\TLNTSVR.EXE TrkWks = C:\WINDOWS\SYSTEM32\SVCHOST.EXE -K NETSVCS uploadmgr = C:\WINDOWS\SYSTEM32\SVCHOST.EXE -K NETSVCS upnphost = C:\WINDOWS\SYSTEM32\SVCHOST.EXE -K LOCALSERVICE UPS = C:\WINDOWS\SYSTEM32\UPS.EXE VSS = C:\WINDOWS\SYSTEM32\VSSVC.EXE W32Time = C:\WINDOWS\SYSTEM32\SVCHOST.EXE -K NETSVCS WebClient = C:\WINDOWS\SYSTEM32\SVCHOST.EXE -K LOCALSERVICE Windows Kernel Services = "C:\WINDOWS\WINLOGON.EXE" winmgmt = C:\WINDOWS\SYSTEM32\SVCHOST.EXE -K NETSVCS WmdmPmSp = C:\WINDOWS\SYSTEM32\SVCHOST.EXE -K NETSVCS Wmi = C:\WINDOWS\SYSTEM32\SVCHOST.EXE -K NETSVCS WmiApSrv = C:\WINDOWS\SYSTEM32\WBEM\WMIAPSRV.EXE wuauserv = C:\WINDOWS\SYSTEM32\SVCHOST.EXE -K NETSVCS WZCSVC = C:\WINDOWS\SYSTEM32\SVCHOST.EXE -K NETSVCS 文件驱动 HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services CnsMinKP = C:\WINDOWS\SYSTEM32\DRIVERS\CNSMINKP.SYS MRxDAV = C:\WINDOWS\SYSTEM32\DRIVERS\MRXDAV.SYS MRxSmb = C:\WINDOWS\SYSTEM32\DRIVERS\MRXSMB.SYS NetBIOS = C:\WINDOWS\SYSTEM32\DRIVERS\NETBIOS.SYS Rdbss = C:\WINDOWS\SYSTEM32\DRIVERS\RDBSS.SYS sr = C:\WINDOWS\SYSTEM32\DRIVERS\SR.SYS Srv = C:\WINDOWS\SYSTEM32\DRIVERS\SRV.SYS 系统驱动项 HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services ACPI = C:\WINDOWS\SYSTEM32\DRIVERS\ACPI.SYS aec = C:\WINDOWS\SYSTEM32\DRIVERS\AEC.SYS AFD = C:\WINDOWS\SYSTEM32\DRIVERS\AFD.SYS ALCXWDM = C:\WINDOWS\SYSTEM32\DRIVERS\ALCXWDM.SYS AsyncMac = C:\WINDOWS\SYSTEM32\DRIVERS\ASYNCMAC.SYS atapi = C:\WINDOWS\SYSTEM32\DRIVERS\ATAPI.SYS Atmarpc = C:\WINDOWS\SYSTEM32\DRIVERS\ATMARPC.SYS audstub = C:\WINDOWS\SYSTEM32\DRIVERS\AUDSTUB.SYS BaseTDI = C:\WINDOWS\SYSTEM32\DRIVERS\BASETDI.SYS Cdrom = C:\WINDOWS\SYSTEM32\DRIVERS\CDROM.SYS Disk = C:\WINDOWS\SYSTEM32\DRIVERS\DISK.SYS dmboot = C:\WINDOWS\SYSTEM32\DRIVERS\DMBOOT.SYS dmio = C:\WINDOWS\SYSTEM32\DRIVERS\DMIO.SYS dmload = C:\WINDOWS\SYSTEM32\DRIVERS\DMLOAD.SYS DMusic = C:\WINDOWS\SYSTEM32\DRIVERS\DMUSIC.SYS drmkaud = C:\WINDOWS\SYSTEM32\DRIVERS\DRMKAUD.SYS ExpScaner = C:\PROGRAM FILES\RISING\RAV\EXPSCAN.SYS Fdc = C:\WINDOWS\SYSTEM32\DRIVERS\FDC.SYS Flpydisk = C:\WINDOWS\SYSTEM32\DRIVERS\FLPYDISK.SYS FsVga = C:\WINDOWS\SYSTEM32\DRIVERS\FSVGA.SYS Ftdisk = C:\WINDOWS\SYSTEM32\DRIVERS\FTDISK.SYS gameenum = C:\WINDOWS\SYSTEM32\DRIVERS\GAMEENUM.SYS GMSIPCI = H:\INSTALL\GMSIPCI.SYS Gpc = C:\WINDOWS\SYSTEM32\DRIVERS\MSGPC.SYS HOOKAPI = C:\PROGRAM FILES\RISING\RAV\HOOKAPI.SYS HookCont = C:\PROGRAM FILES\RISING\RAV\HOOKCONT.SYS HookReg = C:\PROGRAM FILES\RISING\RAV\HOOKREG.SYS HookSys = C:\PROGRAM FILES\RISING\RAV\HOOKSYS.SYS i8042prt = C:\WINDOWS\SYSTEM32\DRIVERS\I8042PRT.SYS Imapi = C:\WINDOWS\SYSTEM32\DRIVERS\IMAPI.SYS IntelIde = C:\WINDOWS\SYSTEM32\DRIVERS\INTELIDE.SYS IpFilterDriver = C:\WINDOWS\SYSTEM32\DRIVERS\IPFLTDRV.SYS IPHOOK = C:\PROGRAM FILES\RISING\RFW\IPHOOK.SYS IpInIp = C:\WINDOWS\SYSTEM32\DRIVERS\IPINIP.SYS IpNat = C:\WINDOWS\SYSTEM32\DRIVERS\IPNAT.SYS IPSec = C:\WINDOWS\SYSTEM32\DRIVERS\IPSEC.SYS IRENUM = C:\WINDOWS\SYSTEM32\DRIVERS\IRENUM.SYS isapnp = C:\WINDOWS\SYSTEM32\DRIVERS\ISAPNP.SYS Kbdclass = C:\WINDOWS\SYSTEM32\DRIVERS\KBDCLASS.SYS kmixer = C:\WINDOWS\SYSTEM32\DRIVERS\KMIXER.SYS MEMSCAN = C:\PROGRAM FILES\RISING\RAV\MEMSCAN.SYS Mouclass = C:\WINDOWS\SYSTEM32\DRIVERS\MOUCLASS.SYS MSKSSRV = C:\WINDOWS\SYSTEM32\DRIVERS\MSKSSRV.SYS MSPCLOCK = C:\WINDOWS\SYSTEM32\DRIVERS\MSPCLOCK.SYS MSPQM = C:\WINDOWS\SYSTEM32\DRIVERS\MSPQM.SYS NdisTapi = C:\WINDOWS\SYSTEM32\DRIVERS\NDISTAPI.SYS Ndisuio = C:\WINDOWS\SYSTEM32\DRIVERS\NDISUIO.SYS NdisWan = C:\WINDOWS\SYSTEM32\DRIVERS\NDISWAN.SYS NetBT = C:\WINDOWS\SYSTEM32\DRIVERS\NETBT.SYS New0 = C:\WINDOWS\SYSTEM32\NEW.SYS npkcrypt = G:\PROGRAM FILES\TENCENT\QQ\NPKCRYPT.SYS npkycryp = G:\PROGRAM FILES\TENCENT\QQ\NPKYCRYP.SYS nv = C:\WINDOWS\SYSTEM32\DRIVERS\NV4_MINI.SYS NwlnkFlt = C:\WINDOWS\SYSTEM32\DRIVERS\NWLNKFLT.SYS NwlnkFwd = C:\WINDOWS\SYSTEM32\DRIVERS\NWLNKFWD.SYS Parport = C:\WINDOWS\SYSTEM32\DRIVERS\PARPORT.SYS PCI = C:\WINDOWS\SYSTEM32\DRIVERS\PCI.SYS PptpMiniport = C:\WINDOWS\SYSTEM32\DRIVERS\RASPPTP.SYS Processor = C:\WINDOWS\SYSTEM32\DRIVERS\PROCESSR.SYS PSched = C:\WINDOWS\SYSTEM32\DRIVERS\PSCHED.SYS Ptilink = C:\WINDOWS\SYSTEM32\DRIVERS\PTILINK.SYS RasAcd = C:\WINDOWS\SYSTEM32\DRIVERS\RASACD.SYS Rasl2tp = C:\WINDOWS\SYSTEM32\DRIVERS\RASL2TP.SYS RasPppoe = C:\WINDOWS\SYSTEM32\DRIVERS\RASPPPOE.SYS Raspti = C:\WINDOWS\SYSTEM32\DRIVERS\RASPTI.SYS RDPCDD = C:\WINDOWS\SYSTEM32\DRIVERS\RDPCDD.SYS rdpdr = C:\WINDOWS\SYSTEM32\DRIVERS\RDPDR.SYS redbook = C:\WINDOWS\SYSTEM32\DRIVERS\REDBOOK.SYS rtl8139 = C:\WINDOWS\SYSTEM32\DRIVERS\RTL8139.SYS Secdrv = C:\WINDOWS\SYSTEM32\DRIVERS\SECDRV.SYS serenum = C:\WINDOWS\SYSTEM32\DRIVERS\SERENUM.SYS Serial = C:\WINDOWS\SYSTEM32\DRIVERS\SERIAL.SYS SKNFW = C:\WINDOWS\SYSTEM32\DRIVERS\SKNFW.SYS SkyProcs = G:\PROGRAM FILES\SKYNET\FIREWALL\SKYPROCS.SYS splitter = C:\WINDOWS\SYSTEM32\DRIVERS\SPLITTER.SYS swenum = C:\WINDOWS\SYSTEM32\DRIVERS\SWENUM.SYS swmidi = C:\WINDOWS\SYSTEM32\DRIVERS\SWMIDI.SYS sysaudio = C:\WINDOWS\SYSTEM32\DRIVERS\SYSAUDIO.SYS Tcpip = C:\WINDOWS\SYSTEM32\DRIVERS\TCPIP.SYS TDIHOOK = C:\PROGRAM FILES\RISING\RFW\TDIHOOK.SYS TermDD = C:\WINDOWS\SYSTEM32\DRIVERS\TERMDD.SYS Update = C:\WINDOWS\SYSTEM32\DRIVERS\UPDATE.SYS usbehci = C:\WINDOWS\SYSTEM32\DRIVERS\USBEHCI.SYS usbhub = C:\WINDOWS\SYSTEM32\DRIVERS\USBHUB.SYS USBSTOR = C:\WINDOWS\SYSTEM32\DRIVERS\USBSTOR.SYS usbuhci = C:\WINDOWS\SYSTEM32\DRIVERS\USBUHCI.SYS vcddev = C:\WINDOWS\SYSTEM32\DRIVERS\VCDVNIC.SYS VgaSave = C:\WINDOWS\SYSTEM32\DRIVERS\VGA.SYS Wanarp = C:\WINDOWS\SYSTEM32\DRIVERS\WANARP.SYS wdmaud = C:\WINDOWS\SYSTEM32\DRIVERS\WDMAUD.SYS
蚩尤天棒初生襁褓狮帖子:12 注册: 2006-08-02 来自:

蚩尤天棒初生襁褓狮帖子:12 注册: 2006-08-02 来自:	发表于： 2006-08-02 18:33 \| 只看楼主短消息资料字号：小中大 3楼求大大帮帮忙～～感激不尽
蚩尤天棒初生襁褓狮帖子:12 注册: 2006-08-02 来自:

蚩尤天棒初生襁褓狮帖子:12 注册: 2006-08-02 来自:	发表于： 2006-08-02 18:38 \| 只看楼主短消息资料字号：小中大 4楼 hijackthis 扫的： Logfile of HijackThis v1.99.1 Scan saved at 18:28:07, on 2006-8-2 Platform: Windows XP SP1 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\Program Files\rising\Rav\CCenter.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\rising\Rav\Ravmond.exe C:\WINDOWS\Explorer.EXE C:\WINDOWS\system32\spoolsv.exe C:\Program Files\rising\Rav\RavStub.exe C:\PROGRA~1\Yahoo!\ASSIST~1\YLive.exe C:\WINDOWS\SOUNDMAN.EXE C:\PROGRA~1\Yahoo!\Assistant\yassistse.exe C:\Program Files\rising\Rfw\Rfw.exe C:\Program Files\rising\Rav\RavTask.exe C:\WINDOWS\System32\winsystems.exe C:\Program Files\rising\Rav\Ravmon.exe C:\WINDOWS\System32\ctfmon.exe C:\Program Files\Network Monitor\netmon.exe C:\WINDOWS\winlogon.exe C:\Program Files\Internet Explorer\iexplore.exe C:\WINDOWS\System32\conime.exe C:\Program Files\Internet Explorer\IEXPLORE.EXE E:\下载\HijackThis.exe R3 - URLSearchHook: 雅虎助手 - {406F94F0-504F-4a40-8DFD-58B0666ABEBD} - C:\PROGRA~1\Yahoo!\ASSIST~1\Assist\yasbar.dll O3 - Toolbar: 电台(&R) - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx O3 - Toolbar: BitComet工具栏 - {3F1ABCDB-A875-46c1-8345-B72A4567E486} - G:\Program Files\BitComet\BitCometBar\BitCometBar0.6.dll O3 - Toolbar: 雅虎助手 - {406F94F0-504F-4a40-8DFD-58B0666ABEBD} - C:\PROGRA~1\Yahoo!\ASSIST~1\Assist\yasbar.dll O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32 O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\System32\IME\TINTLGNT\TINTSETP.EXE /SYNC O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\System32\IME\TINTLGNT\TINTSETP.EXE /IMEName O4 - HKLM\..\Run: [SKYNET Personal FireWall] G:\Program Files\SkyNet\FireWall\PFW.exe O4 - HKLM\..\Run: [YLive.exe] C:\PROGRA~1\Yahoo!\ASSIST~1\YLive.exe O4 - HKLM\..\Run: [StormCodec_Helper] "G:\Program Files\Ringz Studio\Storm Codec\StormSet.exe" /S /opti O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE O4 - HKLM\..\Run: [yassistse] "C:\PROGRA~1\Yahoo!\Assistant\yassistse.exe" O4 - HKLM\..\Run: [rfw] C:\Program Files\rising\Rfw\Rfw.exe O4 - HKLM\..\Run: [RavTask] "C:\Program Files\rising\Rav\RavTask.exe" -system O4 - HKLM\..\Run: [winsystems25] winsystems.exe O4 - HKLM\..\RunServices: [winsystems25] winsystems.exe O4 - HKLM\..\RunOnce: [RavStub] "C:\Program Files\rising\Rav\ravstub.exe" /RUNONCE O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\System32\ctfmon.exe O8 - Extra context menu item: &使用迅雷下载 - G:\Program Files\Thunder Network\Thunder\Program\GetUrl.htm O8 - Extra context menu item: &使用迅雷下载全部链接 - G:\Program Files\Thunder Network\Thunder\Program\GetAllUrl.htm O8 - Extra context menu item: 上传到QQ网络硬盘 - G:\Program Files\Tencent\QQ\AddToNetDisk.htm O8 - Extra context menu item: 使用KuGoo3下载(&K) - G:\Program Files\KuGoo3\KuGoo3DownX.htm O8 - Extra context menu item: 添加到QQ自定义面板 - G:\Program Files\Tencent\QQ\AddPanel.htm O8 - Extra context menu item: 添加到QQ表情 - G:\Program Files\Tencent\QQ\AddEmotion.htm O8 - Extra context menu item: 添加到雅虎订阅(&Y) - res://C:\PROGRA~1\Yahoo!\ASSIST~1\Assist\yrss.dll/YRSSMENUEXT O8 - Extra context menu item: 用QQ彩信发送该图片 - G:\Program Files\Tencent\QQ\SendMMS.htm O8 - Extra context menu item: 雅虎搜索 - res://C:\PROGRA~1\Yahoo!\ASSIST~1\Assist\yasbar.dll/246 O9 - Extra button: 浩方对战平台 - {0A155D3C-68E2-4215-A47A-E800A446447A} - G:\Program Files\浩方对战平台\GameClient.exe O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm O9 - Extra 'Tools' menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm O9 - Extra button: QQ - {c95fe080-8f5d-11d2-a20b-00aa003c157b} - G:\Program Files\Tencent\QQ\QQ.EXE O9 - Extra 'Tools' menuitem: 腾讯QQ - {c95fe080-8f5d-11d2-a20b-00aa003c157b} - G:\Program Files\Tencent\QQ\QQ.EXE O9 - Extra button: 易趣购物 - {DE607145-AC19-425e-861A-1D70ABDF119A} - http://click2.ad4all.net/url2/urlmanage/url.asp?id=5 (file missing) O9 - Extra 'Tools' menuitem: 易趣购物 - {DE607145-AC19-425e-861A-1D70ABDF119A} - http://click2.ad4all.net/url2/urlmanage/url.asp?id=5 (file missing) O9 - Extra button: (no name) - {DEDEB80D-FA35-45d9-9460-4983E5A8AFE6} - G:\Program Files\Tencent\QQ\QQIEHelper.dll O9 - Extra 'Tools' menuitem: QQ炫彩工具条设置 - {DEDEB80D-FA35-45d9-9460-4983E5A8AFE6} - G:\Program Files\Tencent\QQ\QQIEHelper.dll O16 - DPF: {E4E2F180-CB8B-4DE9-ACBB-DA745D3BA153} (Rising Web Scan Object) - http://download.rising.com.cn/register/pcver/autoupgradepad/pcver2006new/OL2006.cab O17 - HKLM\System\CCS\Services\Tcpip\..\{E6358598-B871-4DCD-9672-29427D6194EA}: NameServer = 218.6.200.139 61.139.2.69 O23 - Service: Network Monitor - Unknown owner - C:\Program Files\Network Monitor\netmon.exe O23 - Service: Rising Process Communication Center (RsCCenter) - Beijing Rising Technology Co., Ltd. - C:\Program Files\rising\Rav\CCenter.exe O23 - Service: RsRavMon Service (RsRavMon) - Beijing Rising Technology Co., Ltd. - C:\Program Files\rising\Rav\Ravmond.exe O23 - Service: Windows Kernel Services - Unknown owner - C:\WINDOWS\winlogon.exe
蚩尤天棒初生襁褓狮帖子:12 注册: 2006-08-02 来自:

侃侠锋芒艾服狮帖子:1204 注册: 2005-06-22 来自:	发表于： 2006-08-02 18:42 \| 短消息资料字号：小中大 5楼修复 O4 - HKLM\..\Run: [winsystems25] winsystems.exe O23 - Service: Windows Kernel Services - Unknown owner - C:\WINDOWS\winlogon.exe 重启后删除 C:\WINDOWS\winlogon.exe C:\WINDOWS\System32\winsystems.exe
侃侠锋芒艾服狮帖子:1204 注册: 2005-06-22 来自:

蚩尤天棒初生襁褓狮帖子:12 注册: 2006-08-02 来自:	发表于： 2006-08-02 18:51 \| 只看楼主短消息资料字号：小中大 6楼请问侃侠大大：修复 O4 - HKLM\..\Run: [winsystems25] winsystems.exe O23 - Service: Windows Kernel Services - Unknown owner - C:\WINDOWS\winlogon.exe 我是菜鸟一个这两个怎么修复啊？要甚么工具吗？
蚩尤天棒初生襁褓狮帖子:12 注册: 2006-08-02 来自:

蚩尤天棒初生襁褓狮帖子:12 注册: 2006-08-02 来自:	发表于： 2006-08-02 18:54 \| 只看楼主短消息资料字号：小中大 7楼帮帮忙啊谢谢～！！！
蚩尤天棒初生襁褓狮帖子:12 注册: 2006-08-02 来自:

侃侠锋芒艾服狮帖子:1204 注册: 2005-06-22 来自:	发表于： 2006-08-02 18:55 \| 短消息资料字号：小中大 8楼 hijackthis
侃侠锋芒艾服狮帖子:1204 注册: 2005-06-22 来自:

蚩尤天棒初生襁褓狮帖子:12 注册: 2006-08-02 来自:	发表于： 2006-08-02 19:02 \| 只看楼主短消息资料字号：小中大 9楼好的～谢谢大大！！！
蚩尤天棒初生襁褓狮帖子:12 注册: 2006-08-02 来自:

蚩尤天棒初生襁褓狮帖子:12 注册: 2006-08-02 来自:	发表于： 2006-08-02 19:14 \| 只看楼主短消息资料字号：小中大 10楼重启后删除 C:\WINDOWS\winlogon.exe C:\WINDOWS\System32\winsystems.exe 我重启后怎么找不到这两个文件啊？
蚩尤天棒初生襁褓狮帖子:12 注册: 2006-08-02 来自:

<<上一主题|下一主题>>

12

1 / 2 页

跳转页

页面顶部

Powered by Discuz!NT