前段时间中了TROJ_ROOTKIT病毒,后来应该搞好了,现在却有新问题,机器开机使用正常,但是过一端时间就有某些程序不能运行,如winrar,word,cuteftppro等几个软件,而且任务管理器也打不开，奇怪啊,求高手帮忙

以下是HijackThis扫描结果
Logfile of HijackThis v1.99.1
Scan saved at 17:23:58, on 2005-8-12
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
D:\Program Files\D-Tools\daemon.exe
D:\Program Files\SkyNet\FireWall\PFW.exe
C:\WINDOWS\System32\ctfmon.exe
C:\Program Files\Tencent\RTX\rtxc.exe
d:\oracle\ora92\bin\omtsreco.exe
D:\Program Files\Tencent\QQ\QQ.exe
d:\Program Files\Tencent\qq\TIMPlatform.exe
D:\myie\MyIE.exe
D:\Jbuilder9\bin\JBuilder.exe
D:\Program Files\Winamp\winamp.exe
C:\Program Files\GlobalSCAPE\CuteFTP Professional\cuteftppro.exe
C:\Program Files\GlobalSCAPE\CuteFTP Professional\ftpte.exe
D:\Program Files\Inventec\Dreye\Dreye.exe
d:\Program Files\Inventec\Dreye\PeaDict\RtDict.exe
C:\Program Files\Adobe\Acrobat 5.0\Reader\AcroRd32.exe
C:\WINDOWS\System32\taskmgr.exe
D:\virustool\HijackThis.exe

O1 - Hosts: 61.152.114.191 test2.sportscn.com
O1 - Hosts: 61.152.114.247 test.sportscn.com
O3 - Toolbar: 电台(&R) - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O4 - HKLM\..\Run: [DAEMON Tools-1033] "D:\Program Files\D-Tools\daemon.exe"  -lang 1033
O4 - HKLM\..\Run: [SKYNET Personal FireWall] D:\Program Files\SkyNet\FireWall\PFW.exe
O4 - HKLM\..\Run: [KAVPersonal50] "d:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus Personal\kav.exe" /minimize
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\System32\ctfmon.exe
O4 - Global Startup: 腾讯通.lnk = C:\Program Files\Tencent\RTX\rtxc.exe
O8 - Extra context menu item: Edit with &XML Spy - C:\Program Files\Altova\xmlspy\spy.htm
O8 - Extra context menu item: 使用网际快车下载 - D:\Program Files\FlashGet\jc_link.htm
O8 - Extra context menu item: 使用网际快车下载全部链接 - D:\Program Files\FlashGet\jc_all.htm
O8 - Extra context menu item: 导出当前页到超星阅览器(&A) - d:\Program Files\SSREADER36\ss_all.htm
O8 - Extra context menu item: 导出选中部分到超星阅览器(&S) - d:\Program Files\SSREADER36\ss_select.htm
O8 - Extra context menu item: 添加到QQ自定义面板 - D:\Program Files\Tencent\QQ\AddPanel.htm
O8 - Extra context menu item: 添加到QQ表情 - D:\Program Files\Tencent\QQ\AddEmotion.htm
O8 - Extra context menu item: 用QQ彩信发送该图片 - D:\Program Files\Tencent\QQ\SendMMS.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\System32\msjava.dll
O9 - Extra 'Tools' menuitem: Sun Java 控制台 - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\System32\msjava.dll
O9 - Extra button: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - D:\Program Files\FlashGet\flashget.exe
O9 - Extra 'Tools' menuitem: &FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - D:\Program Files\FlashGet\flashget.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O9 - Extra 'Tools' menuitem: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O9 - Extra button: Edit with XML Spy - {2222EF56-F49E-4d07-A14E-8D2B08766958} - C:\Program Files\Altova\xmlspy\spy.htm (HKCU)
O9 - Extra 'Tools' menuitem: Edit with XML Spy - {2222EF56-F49E-4d07-A14E-8D2B08766958} - C:\Program Files\Altova\xmlspy\spy.htm (HKCU)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: Domain = cn21.com
O17 - HKLM\Software\..\Telephony: DomainName = cn21.com
O17 - HKLM\System\CCS\Services\Tcpip\..\{6A742D1D-FDB5-467B-A520-2C36FF4EBFC7}: NameServer = 10.21.10.1,202.96.209.5
O17 - HKLM\System\CS1\Services\Tcpip\Parameters: Domain = cn21.com
O17 - HKLM\System\CS1\Services\Tcpip\..\{6A742D1D-FDB5-467B-A520-2C36FF4EBFC7}: NameServer = 10.21.10.1,202.96.209.5
O17 - HKLM\System\CS2\Services\Tcpip\Parameters: Domain = cn21.com
O17 - HKLM\System\CS2\Services\Tcpip\..\{6A742D1D-FDB5-467B-A520-2C36FF4EBFC7}: NameServer = 10.21.10.1,202.96.209.5
O18 - Protocol: qrev - {9DE24BAC-FC3C-42C4-9FC4-76B3FAFDBD90} - D:\PROGRA~1\QUESTS~1\TOAD\RNetPin.dll
O23 - Service: kavsvc - Kaspersky Lab - d:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus Personal\kavsvc.exe
O23 - Service: OfficeScanNT 实时扫描 (ntrtscan) - Trend Micro Inc. - C:\Program Files\Trend Micro\OfficeScan Client\ntrtscan.exe
O23 - Service: OfficeScanNT 个人防火墙 (OfcPfwSvc) - Trend Micro Inc. - C:\Program Files\Trend Micro\OfficeScan Client\OfcPfwSvc.exe
O23 - Service: OracleMTSRecoveryService - Oracle Corporation - d:\oracle\ora92\bin\omtsreco.exe
O23 - Service: OracleOraHome92ClientCache - Unknown owner - d:\oracle\ora92\BIN\ONRSD.EXE
O23 - Service: OfficeScanNT 侦听程序 (tmlisten) - Trend Micro Inc. - C:\Program Files\Trend Micro\OfficeScan Client\tmlisten.exe

机器是xpsp1,补丁都打了,且用了咔吧司机和天网防火墙,应该很强劲啊,谁知有这个怪问题,请高手相助,非常感谢

应该没问题~~

任务管理器打不开??那么进程列表中怎么会有C:\windows\system32\taskmgr.exe??这个就是任务管理器的进程啊~~~可能是被病毒感染了,病毒把任务管理器替换了所造成的.

【回复“八神陆”的帖子】
rootkit木马是那么容易搞掂的？你说搞掂了，怎么证明？

引用:

【cathy123的贴子】【回复“八神陆”的帖子】 rootkit木马是那么容易搞掂的？你说搞掂了，怎么证明？ ...........................

现在杀毒软件不报了,我是参照一些方法手动弄的

引用:

【闪电风暴的贴子】任务管理器打不开??那么进程列表中怎么会有C:\windows\system32\taskmgr.exe??这个就是任务管理器的进程啊~~~可能是被病毒感染了,病毒把任务管理器替换了所造成的. ...........................

不是啊,我说了,要使用一段时间才会出问题,这个是我刚重起过,可以打开

你这个问题,我也遇到过.我是重装系统的.