别沉啊

我顶

我前办个月中了一次威金,用江民的专杀全盘杀了,今天用江民的专杀(上次用过的没有升级的)再杀过,又杀出一大堆的威金,高手指点下是怎么回事

浮起来

再顶

顶上来

再顶

高手来了继续顶

我是个菜鸟，说错了，大家别见怪！
我觉得这些有点可凝：
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
<{1496D5ED-7A09-46D0-8C92-B8E71A4304DF}><C:\WINDOWS\system32\msacn.dll> []
[PID: 608][\SystemRoot\System32\smss.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 672][\??\C:\WINDOWS\system32\csrss.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 696][\??\C:\WINDOWS\system32\winlogon.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[C:\WINDOWS\system32\msacm32.drv] [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)]
[PID: 740][C:\WINDOWS\system32\services.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 1708][C:\WINDOWS\Explorer.EXE] [Microsoft Corporation, 6.00.2900.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 740][C:\WINDOWS\system32\services.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 1708][C:\WINDOWS\Explorer.EXE] [Microsoft Corporation, 6.00.2900.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 1928][c:\program files\rising\rfw\RfwMain.exe] [Beijing Rising Technology Co., Ltd., 5, 0, 0, 70]
[PID: 1976][C:\Program Files\Rising\AntiSpyware\runiep.exe] [Beijing Rising Technology Co., Ltd., 1, 0, 1, 6]
[PID: 212][C:\WINDOWS\system32\ctfmon.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[C:\Program Files\Rising\AntiSpyware\ieprot.dll] [Beijing Rising Technology Co., Ltd., 1, 0, 0, 10]
[C:\WINDOWS\system32\hreax.dll] [N/A, ]
[C:\WINDOWS\system32\wtrmm.dll] [N/A, ]
[C:\WINDOWS\system32\wgptl.dll] [N/A, ]
[C:\WINDOWS\system32\fksdy.dll] [N/A, ]
[C:\WINDOWS\system32\msport.dll] [N/A, ]
[PID: 2936][C:\Program Files\WinRAR\WinRAR.exe] [N/A, ]
[C:\WINDOWS\system32\hreax.dll] [N/A, ]
[C:\WINDOWS\system32\wtrmm.dll] [N/A, ]
[C:\WINDOWS\system32\wgptl.dll] [N/A, ]
[C:\WINDOWS\system32\fksdy.dll] [N/A, ]
[C:\WINDOWS\system32\msport.dll] [N/A, ]
[PID: 2964][C:\DOCUME~1\new\LOCALS~1\Temp\Rar$EX00.391\SREng.EXE] [Smallfrogs Studio, 2.4.12.806]

引用:

【wbxhs的贴子】我是个菜鸟，说错了，大家别见怪！ 我觉得这些有点可凝： [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks] <{1496D5ED-7A09-46D0-8C92-B8E71A4304DF}><C:\WINDOWS\system32\msacn.dll> [] [PID: 608][\SystemRoot\System32\smss.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)] 这是系统进程 [PID: 672][\??\C:\WINDOWS\system32\csrss.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)] 这也是系统进程 [PID: 696][\??\C:\WINDOWS\system32\winlogon.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)] 这个还是系统进程 [C:\WINDOWS\system32\msacm32.drv] [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)] [PID: 740][C:\WINDOWS\system32\services.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)] 系统进程 [PID: 1708][C:\WINDOWS\Explorer.EXE] [Microsoft Corporation, 6.00.2900.2180 (xpsp_sp2_rtm.040803-2158)] 系统进程,关了就没桌面了.. [PID: 740][C:\WINDOWS\system32\services.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)] 系统进程,容易被更改,用control+alt+del打开任务管理器,看services.exe 的执行者是不是system,如果不是system就是病毒伪装的 [PID: 1708][C:\WINDOWS\Explorer.EXE] [Microsoft Corporation, 6.00.2900.2180 (xpsp_sp2_rtm.040803-2158)] [PID: 1928][c:\program files\rising\rfw\RfwMain.exe] [Beijing Rising Technology Co., Ltd., 5, 0, 0, 70] 瑞星防火墙主进程 [PID: 1976][C:\Program Files\Rising\AntiSpyware\runiep.exe] [Beijing Rising Technology Co., Ltd., 1, 0, 1, 6] 瑞星反间谍软件 [PID: 212][C:\WINDOWS\system32\ctfmon.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)] 系统输入法进程 [C:\Program Files\Rising\AntiSpyware\ieprot.dll] [Beijing Rising Technology Co., Ltd., 1, 0, 0, 10] 瑞星反间谍软件 [C:\WINDOWS\system32\hreax.dll] [N/A, ] [C:\WINDOWS\system32\wtrmm.dll] [N/A, ] [C:\WINDOWS\system32\wgptl.dll] [N/A, ] [C:\WINDOWS\system32\fksdy.dll] [N/A, ] [C:\WINDOWS\system32\msport.dll] [N/A, ] [PID: 2936][C:\Program Files\WinRAR\WinRAR.exe] [N/A, ] [C:\WINDOWS\system32\hreax.dll] [N/A, ] [C:\WINDOWS\system32\wtrmm.dll] [N/A, ] [C:\WINDOWS\system32\wgptl.dll] [N/A, ] [C:\WINDOWS\system32\fksdy.dll] [N/A, ] [C:\WINDOWS\system32\msport.dll] [N/A, ] [PID: 2964][C:\DOCUME~1\new\LOCALS~1\Temp\Rar$EX00.391\SREng.EXE] [Smallfrogs Studio, 2.4.12.806] SREng进程 ………………