碎甲(Anti-Rootkits)也清除不了VideoAti0.sys
这个东东是总会在启动项加上ATICardInit启动项,关键是在Windows启动之初就加载它的驱动VideoAti0.sys,然后在WINDOWS中,根本就发现不在这些文件的存在,在DOS+NTFS下可以发现,也可以删除,但启动WINDOWS时蓝屏,根本进不了WINDOWS.
各位也可以在百度上搜索VideoAti0,有无数的人中了这个,也没有办法解决。
我详细看了碎甲(Anti-Rootkits)技术,觉得应该可以杀得了VideoAti0.sys,可事实上是卡卡根本就发现不了,卡卡的版本号是3.008,特征库是3.004,以下是用RootkitReveal扫描的结果:
HKLM\SOFTWARE\Microsoft\Cryptography\RNG\Seed 2006-11-26 10:55 80 bytes Data mismatch between Windows API and raw hive data.
HKLM\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\VideoAti0 2006-6-17 21:26 0 bytes Hidden from Windows API.
HKLM\SYSTEM\ControlSet001\Control\SafeBoot\Network\VideoAti0 2006-6-17 21:26 0 bytes Hidden from Windows API.
HKLM\SYSTEM\ControlSet001\Enum\Root\LEGACY_VIDEOATI0 2006-6-17 21:26 0 bytes Hidden from Windows API.
HKLM\SYSTEM\ControlSet001\Services\d347prt\Cfg\0Jf40 2006-11-26 10:13 0 bytes Hidden from Windows API.
HKLM\SYSTEM\ControlSet001\Services\VideoAti0 2006-11-26 10:13 0 bytes Hidden from Windows API.
HKLM\SYSTEM\ControlSet002\Control\SafeBoot\Minimal\VideoAti0 2006-6-17 21:26 0 bytes Hidden from Windows API.
HKLM\SYSTEM\ControlSet002\Control\SafeBoot\Network\VideoAti0 2006-6-17 21:26 0 bytes Hidden from Windows API.
HKLM\SYSTEM\ControlSet002\Enum\Root\LEGACY_VIDEOATI0 2006-6-17 21:26 0 bytes Hidden from Windows API.
HKLM\SYSTEM\ControlSet002\Services\VideoAti0 2006-11-26 10:13 0 bytes Hidden from Windows API.
C:\WINDOWS\system32\drivers\VideoAti0.sys 2006-6-17 21:26 19.68 KB Hidden from Windows API.
C:\WINDOWS\system32\VideoAti0.dll 2006-8-6 9:34 144.00 KB Hidden from Windows API.