RootKit.Win32.CodeInj.a杀不死，每次出现的地址不定 - 瑞星卡卡安全论坛bbs.ikaka.com

瑞星卡卡安全论坛技术交流区 反病毒/反流氓软件论坛 RootKit.Win32.CodeInj.a杀不死，每次出现的地址不定

	瑞星“1+2”全新解决方案巡展在广州画上圆满句号		叶院长揭秘：瑞星如何运用AI技术革新网络安全		俄乌冲突加剧网络攻击风险白俄罗斯政府遭APT攻击		瑞星ESM防病毒系统助力矿业大学筑牢网络安全防线
	实力拉满瑞星第五十次通过VB100测评		携手老友，拥抱新精彩 —— 新论坛新活动，感谢你的陪伴		护航司法，瑞星助力山西省高院构建安全防线		人工智能在网络安全领域的风险和机遇

1

1 / 1 页

跳转页

RootKit.Win32.CodeInj.a杀不死，每次出现的地址不定

menchong2002 初生襁褓狮帖子:6 注册: 2008-04-14 来自:	发表于： 2008-05-03 18:45 \| 只看楼主短消息资料字号：小中大 1楼 RootKit.Win32.CodeInj.a杀不死，每次出现的地址不定从4。27开始，每次开机都会自检，电脑还出现过乱分区，桌面无法正常显示的现象。只要开机不连接网络，系统就会自动地弹出对话框提示用户连接网络。用windows清理软件清理过，系统进入死循环，不停地重启，又无法进入安全模式，所以后来把清理软件卸载了，现在下了橙色八月，启动后能帮助开启瑞星杀毒，但是RootKit.Win32.CodeInj.a 始终无法杀尽，而且还经常衍生出其他木马病毒，我下过很多专杀工具，好象对它都无效，我该怎么办呀？[code]2008-05-03,18:03:32 System Repair Engineer 2.5.16.900 Smallfrogs (http://www.KZTechs.com) Windows XP Professional Service Pack 2 (Build 2600) - 管理权限用户 - 完整功能以下内容被选中：所有的启动项目（包括注册表、启动文件夹、服务等）浏览器加载项正在运行的进程（包括进程模块信息）文件关联 Winsock 提供者 Autorun.inf HOSTS 文件进程特权扫描启动项目注册表 [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run] <ctfmon.exe><C:\WINDOWS\system32\ctfmon.exe> [(Verified)Microsoft Windows Publisher] [HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows] <load><> [N/A] [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run] <PHIME2002ASync><C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC> [(Verified)Microsoft Windows Publisher] <IMJPMIG8.1><"C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32> [(Verified)Microsoft Windows Publisher] <SoundMan><SOUNDMAN.EXE> [(Verified)Microsoft Windows Hardware Compatibility Publisher] <SrtWatch><C:\Program Files\RT 6050\SrtWatch.exe> [] <KernelFaultCheck><%systemroot%\system32\dumprep 0 -k> [N/A] <runeip><"C:\Program Files\Rising\AntiSpyware\runiep.exe" /startup> [Beijing Rising Technology Co., Ltd.] <BHDCRegC><C:\WINDOWS\system32\BHDCRegC.exe> [SHHIC] <RfwMain><"C:\Program Files\Rising\Rfw\rfwmain.exe" -Startup> [(Verified)BEIJING RISING SCIENCE AND TECHNOLOGY CORPORATION LIMITED] <RavTask><"C:\Program Files\Rising\Rav\RavTask.exe" -system> [(Verified)Beijing Rising Science and Technology Corporation Limited] <Regtool><C:\Program Files\Gemplus\GemSafe Libraries\BIN\Regtool.exe> [] <360Safetray><C:\Program Files\360safe\safemon\360tray.exe /start> [(Verified)Qizhi Software (beijing) Co. Ltd] <360Safebox><"C:\Program Files\360Safebox\safeboxTray.exe" /r> [(Verified)Qizhi Software (beijing) Co. Ltd] [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon] <shell><Explorer.exe> [(Verified)] <Userinit><C:\WINDOWS\system32\userinit.exe,> [(Verified)Microsoft Windows Publisher] [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Windows] <AppInit_DLLs><> [N/A] [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon] <UIHost><%windir%\logonui.exe> [Cubiz] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks] <{32CD708B-60A7-4C00-9377-D73EAA495F0F}><C:\WINDOWS\system32\RavExt.dll> [(Verified)Beijing Rising Science and Technology Corporation Limited] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\igfxcui] <WinlogonNotify: igfxcui><igfxdev.dll> [(Verified)Microsoft Windows Component Publisher] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\>{26923b43-4d38-484f-9b9e-de460746276c}] <Internet Explorer><%systemroot%\system32\shmgrate.exe OCInstallUserConfigIE> [N/A] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\>{881dd1c5-3dcf-431b-b061-f3f88e8be88a}] <Outlook Express><%systemroot%\system32\shmgrate.exe OCInstallUserConfigOE> [N/A] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{2C7339CF-2B09-4501-B3F3-F3508C9228ED}] <Themes Setup><%SystemRoot%\system32\regsvr32.exe /s /n /i:/UserInstall %SystemRoot%\system32\themeui.dll> [N/A] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{44BBA840-CC51-11CF-AAFA-00AA00B6015C}] <Microsoft Outlook Express 6><"%ProgramFiles%\Outlook Express\setup50.exe" /APP:OE /CALLER:WINNT /user /install> [N/A] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{44BBA842-CC51-11CF-AAFA-00AA00B6015B}] <NetMeeting 3.01><rundll32.exe advpack.dll,LaunchINFSection C:\WINDOWS\INF\msnetmtg.inf,NetMtg.Install.PerUser.NT> [(Verified)Microsoft Windows Publisher] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{5945c046-1e7d-11d1-bc44-00c04fd912be}] <Windows Messenger 4.7><rundll32.exe advpack.dll,LaunchINFSection C:\WINDOWS\INF\msmsgs.inf,BLC.QuietInstall.PerUser> [(Verified)Microsoft Windows Publisher] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{6BF52A52-394A-11d3-B153-00C04F79FAA6}] <Microsoft Windows Media Player><rundll32.exe advpack.dll,LaunchINFSection C:\WINDOWS\INF\wmp10.inf,PerUserStub> [(Verified)Microsoft Windows Component Publisher] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{7790769C-0471-11d2-AF11-00C04FA35D02}] <通讯簿 6><"%ProgramFiles%\Outlook Express\setup50.exe" /APP:WAB /CALLER:WINNT /user /install> [N/A] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{89B4C1CD-B018-4511-B0A1-5476DBF70820}] <N/A><C:\WINDOWS\system32\Rundll32.exe C:\WINDOWS\system32\mscories.dll,Install> [Microsoft Corporation] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ati2evxx.exe] <IFEO[ati2evxx.exe]><C:\WINDOWS\system32\svchost.exe> [(Verified)Microsoft Windows Publisher] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\egui.exe] <IFEO[egui.exe]><C:\WINDOWS\system32\svchost.exe> [(Verified)Microsoft Windows Publisher] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\esafe.exe] <IFEO[esafe.exe]><C:\WINDOWS\system32\svchost.exe> [(Verified)Microsoft Windows XP Publisher] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\idag.exe] <IFEO[idag.exe]><C:\WINDOWS\system32\svchost.exe> [(Verified)Microsoft Windows Publisher] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\kaccore.exe] <IFEO[kaccore.exe]><C:\WINDOWS\system32\svchost.exe> [(Verified)Microsoft Windows Publisher] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\kissvc.exe] <IFEO[kissvc.exe]><C:\WINDOWS\system32\svchost.exe> [(Verified)Microsoft Windows Publisher] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KPPMain.exe] <IFEO[KPPMain.exe]><C:\WINDOWS\system32\svchost.exe> [(Verified)Microsoft Windows Publisher] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KVFW.EXE] <IFEO[KVFW.EXE]><C:\WINDOWS\system32\svchost.exe> [(Verified)Microsoft Windows Publisher] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\OllyDBG.EXE] <IFEO[OllyDBG.EXE]><C:\WINDOWS\system32\svchost.exe> [(Verified)Microsoft Windows Publisher] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\OllyICE.EXE] <IFEO[OllyICE.EXE]><C:\WINDOWS\system32\svchost.exe> [(Verified)Microsoft Windows Publisher] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\procexp.exe] <IFEO[procexp.exe]><C:\WINDOWS\system32\svchost.exe> [(Verified)Microsoft Windows Publisher] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\qqsc.exe] <IFEO[qqsc.exe]><C:\WINDOWS\system32\svchost.exe> [(Verified)Microsoft Windows Publisher] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ravtool.exe] <IFEO[ravtool.exe]><C:\WINDOWS\system32\svchost.exe> [(Verified)Microsoft Windows Publisher] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\regtool.exe] <IFEO[regtool.exe]><C:\WINDOWS\system32\svchost.exe> [(Verified)Microsoft Windows Publisher] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rfwproxy.exeFYFireWall.exe] <IFEO[rfwproxy.exeFYFireWall.exe]><C:\WINDOWS\system32\svchost.exe> [(Verified)Microsoft Windows Publisher] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rfwstub.exe] <IFEO[rfwstub.exe]><C:\WINDOWS\system32\svchost.exe> [(Verified)Microsoft Windows Publisher] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\WinDbg.exe] <IFEO[WinDbg.exe]><C:\WINDOWS\system32\svchost.exe> [(Verified)Microsoft Windows Publisher] ================================== 启动文件夹 N/A ================================== 服务 [ASP.NET State Service / aspnet_state][Stopped/Manual Start] <C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\aspnet_state.exe><Microsoft Corporation> [Human Intexxxce Device Access / HidServ][Stopped/Disabled] <C:\WINDOWS\System32\svchost.exe -k netsvcs-->%SystemRoot%\System32\hidserv.dll><N/A> [InstallDriver Table Manager / IDriverT][Stopped/Manual Start] <"C:\Program Files\Common Files\InstallShield\Driver\1150\Intel 32\IDriverT.exe"><Macrovision Corporation> [NkPtpEnumP2 / NkPtpEnumP2][Running/Auto Start] <"C:\Program Files\Nikon\Wireless Camera Setup Utility\NkPtpEnum.exe" -a -d="C:\Program Files\Nikon\Wireless Camera Setup Utility\NkPtpip.dll"><Nikon Corporation> [Qvod Terminal / Qvod Terminal][Stopped/Auto Start] <F:\Program Files\QvodPlayer\QvodTerminal.exe><Shenzhen QVOD Technology Co.,Ltd> [Rising Proxy Service / RfwProxySrv][Running/Auto Start] <c:\program files\rising\rfw\rfwproxy.exe><Beijing Rising Technology Co., Ltd.> [Rising Personal Firewall Service / RfwService][Running/Auto Start] <c:\program files\rising\rfw\rfwsrv.exe><Beijing Rising Technology Co., Ltd.> [Rising Process Communication Center / RsCCenter][Running/Auto Start] <"C:\Program Files\Rising\Rav\CCenter.exe"><Beijing Rising Technology Co., Ltd.> [Rising RealTime Monitor / RsRavMon][Stopped/Auto Start] <"C:\PROGRAM FILES\RISING\RAV\Ravmond.exe"><Beijing Rising Technology Co., Ltd.> [SyGateService / SaService][Stopped/Manual Start] <><N/A> [Security Control / secctrl][Stopped/Auto Start] <c:\windows\system32\rundll32.exe vmvreg32.dll,scan><Microsoft Corporation> [Visual Studio Analyzer RPC bridge / Visual Studio Analyzer RPC bridge][Stopped/Manual Start] <C:\Program Files\Microsoft Visual Studio\Common\Tools\VS-Ent98\Vanalyzr\varpc.exe><Microsoft Corporation> ================================== 驱动程序 [Agere Systems Soft Modem / AgereSoftModem][Running/Manual Start] <system32\DRIVERS\AGRSM.sys><Agere Systems> [Service for Realtek AC97 Audio (WDM) / ALCXWDM][Running/Manual Start] <system32\drivers\ALCXWDM.SYS><Realtek Semiconductor Corp.> [ATSpy / ATSpy][Stopped/Manual Start] <\??\C:\WINDOWS\system32\ATSpy.sys><N/A> [Rising TDI Base Driver / BaseTDI][Running/Auto Start] <System32\DRIVERS\BaseTDI.SYS><Beijing Rising Technology Co., Ltd.> [BHDCKEY / BHDCKEY][Running/Manual Start] <System32\Drivers\usbdriver.sys><BHDC> [USB Storage Adapter FX (CY) / CY_FX_AT][Stopped/Manual Start] <system32\DRIVERS\CY_FX_AT.SYS><Cypress Semiconductor> [d347bus / d347bus][Running/Boot Start] <\SystemRoot\system32\DRIVERS\d347bus.sys><> [d347prt / d347prt][Running/Boot Start] <\SystemRoot\System32\Drivers\d347prt.sys><> [USB 2820 Video / DCamUSBEMPIA][Stopped/Manual Start] <system32\DRIVERS\emDevice.sys><eMPIA Technology, Inc.> [USB Device Lower Filter / FiltUSBEMPIA][Stopped/Manual Start] <system32\DRIVERS\emFilter.sys><eMPIA Technology, Inc.> [usb Card Device / ft2kEnum][Running/Manual Start] <system32\DRIVERS\ic2kenum.sys><OEM Corporation> [USB Chip Holder Service / GDBaseSmc][Running/Manual Start] <system32\DRIVERS\Chip_smc.sys><OEM> [USB Chip Service / GD_USB][Stopped/Manual Start] <system32\DRIVERS\Chip_usb.sys><> [GKeyUSB / GKeyUSB][Stopped/Manual Start] <System32\Drivers\GKeyUSB.sys><Gemplus> [HookCont / HookCont][Running/System Start] <\SystemRoot\system32\drivers\HookCont.sys><Beijing Rising Technology Co., Ltd> [HookNtos / HookNtos][Running/System Start] <\SystemRoot\system32\drivers\HookNtos.sys><Beijing Rising Technology Co., Ltd> [HookReg / HookReg][Running/System Start] <\SystemRoot\system32\drivers\HookReg.sys><Beijing Rising Technology Co., Ltd> [HookSys / HookSys][Running/System Start] <\SystemRoot\system32\drivers\HookSys.sys><Beijing Rising Technology Co., Ltd> [HookUrl / HookUrl][Running/Auto Start] <\??\C:\Program Files\Rising\Rfw\HookUrl.sys><Beijing Rising Technology Co., Ltd.> [ialm / ialm][Running/Manual Start] <system32\DRIVERS\ialmnt5.sys><Intel Corporation> [kmsinput / kmsinput][Stopped/Manual Start] <\??\C:\WINDOWS\system32\drivers\kmsinput.sys><N/A> [mxfp / mxfp][Stopped/Auto Start] <\??\C:\DOCUME~1\CHANGC~1\LOCALS~1\Temp\tmp22.tmp><N/A> [npkcrypt / npkcrypt][Running/Auto Start] <\??\C:\Program Files\tencent\QQ\npkcrypt.sys><INCA Internet Co., Ltd.> [RT 6050 Serial port driver / oxser][Stopped/System Start] <system32\DRIVERS\SRT5000.sys><OEM> [Direct Parallel Link Driver / Ptilink][Running/Manual Start] <system32\DRIVERS\ptilink.sys><Parallel Technologies, Inc.> [QKeyServiceDisplay / QKeyService][Running/Boot Start] <\SystemRoot\system32\KeyCrypt.sys><Tencent Technology (Shenzhen) Company Limited> [SmartCard Reader Device / Reader_Device][Running/Manual Start] <system32\DRIVERS\usbic2k.sys><OEM> [Rising Rfwbase Driver / RfwBase][Running/Auto Start] <System32\DRIVERS\rfwbase.SYS><Beijing Rising Technology Co., Ltd.> [RsAntiSpyware / RsAntiSpyware][Running/Boot Start] <\SystemRoot\system32\drivers\RsBoot.sys><Beijing Rising Technology Co., Ltd.> [RsFwDrv / RsFwDrv][Running/System Start] <\??\C:\Program Files\Rising\Rfw\RsFwDrv.sys><Beijing Rising Technology Co., Ltd.> [RsNTGDI / RsNTGDI][Running/Boot Start] <\SystemRoot\system32\Drivers\RsNTGdi.sys><Beijing Rising Technology Co., Ltd.> [Realtek RTL8139(A/B/C)-based PCI Fast Ethernet Adapter NT Driver / rtl8139][Running/Manual Start] <system32\DRIVERS\RTL8139.SYS><Realtek Semiconductor Corporation> [SafeBoxKrnl / SafeBoxKrnl][Running/System Start] <\??\C:\Program Files\360Safebox\SafeBoxKrnl.sys><360安全中心> [USB Still Image Capture Device / ScanUSBEMPIA][Stopped/Manual Start] <system32\DRIVERS\emScan.sys><eMPIA Technology, Inc.> [SENSE3 / SENSE3][Running/Auto Start] <system32\drivers\sense3.sys><Beijing Senselock> [Sentinel / Sentinel][Running/Auto Start] <\SystemRoot\System32\Drivers\SENTINEL.SYS><> [TesSafe / TesSafe][Stopped/Manual Start] <\??\C:\WINDOWS\system32\TesSafe.sys><TENCENT> [TVICHW32 / TVICHW32][Stopped/Manual Start] <\??\C:\WINDOWS\system32\DRIVERS\TVICHW32.SYS><N/A> [Virtual Bus / VBus][Running/Manual Start] <system32\DRIVERS\NkVBus.sys><Nikon Corporation> [Winbond Infrared Device Driver / WBFIRDMA][Running/Manual Start] <system32\DRIVERS\wbfirdma.sys><Winbond Electronics Corp.> [SyGate for NT, WG1N / WG1N][Running/Auto Start] <\SystemRoot\SYSTEM32\Drivers\WG1N.sys><Sygate Technologies, Inc.> [SyGate for NT, WG2N / WG2N][Running/Auto Start] <\SystemRoot\SYSTEM32\Drivers\WG2N.sys><Sygate Technologies, Inc.> [SyGate for NT, wg4n / wg4n][Running/Auto Start] <\SystemRoot\SYSTEM32\Drivers\wg4n.sys><Sygate Technologies, Inc.> [SyGate for NT, wg5n / wg5n][Running/Auto Start] <\SystemRoot\SYSTEM32\Drivers\wg5n.sys><Sygate Technologies, Inc.> [SyGate for NT, wg6n / wg6n][Running/Auto Start] <\SystemRoot\SYSTEM32\Drivers\wg6n.sys><Sygate Technologies, Inc.> [SyGate for NT, Wsdrv / Wsdrv][Running/Boot Start] <\SystemRoot\\SystemRoot\SYSTEM32\Drivers\Wsdrv.sys><N/A> [World Standard Teletext Codec / WSTCODEC][Stopped/Manual Start] <system32\DRIVERS\WSTCODEC.SYS><Microsoft Corporation> [VIMICRO USB PC Camera / ZSMC301b][Stopped/Manual Start] <System32\Drivers\usbVM31b.sys><VM> [FTCProtect / FTCProtect][Running/Manual Start] <System32\Drivers\FTCProtect.sys><N/A> [FTCProTime / FTCProTime][Running/Manual Start] <System32\Drivers\FTCProTime.sys><N/A> [FTCkillfile / FTCkillfile][Stopped/Manual Start] <System32\Drivers\FTCkillfile.sys><N/A> 用户系统信息：Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; Embedded Web Browser from: http://bsalsa.com/; Maxthon; .NET CLR 1.1.4322)
menchong2002 初生襁褓狮帖子:6 注册: 2008-04-14 来自:	分享到：

<<上一主题|下一主题>>

1

1 / 1 页

跳转页

页面顶部

Powered by Discuz!NT