瑞星卡卡安全论坛技术交流区反病毒/反流氓软件论坛 【求助】高手帮忙看看有没有可疑的病毒驱动?

1   1  /  1  页   跳转

【求助】高手帮忙看看有没有可疑的病毒驱动?

【求助】高手帮忙看看有没有可疑的病毒驱动?

启动项目
注册表

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run]
    <intenet><C:\WINDOWS\system32\intenet.exe>  [N/A]

=============================================================================
这个intenet.exe主程序已经被我删除
可就是注册表自动运行项里每次删除后,到下次开机它又会再次出现!

高手帮忙看看,怎么解决????是不是有哪个驱动文件保护它啊??

intenet.exe好像是中文上网cnnic卸载后的残留,(cdnprot.sys这个中文上网的保护驱动我已经删了,是不是还有其他驱动没删干净?)

附件附件:

下载次数:178
文件类型:image/pjpeg
文件大小:
上传时间:2006-12-25 19:57:08
描述:
预览信息:EXIF信息



最后编辑2006-12-25 23:46:06
分享到:
gototop
 

驱动程序
[Service for Avance AC97 Audio (WDM) / ALCXWDM]
  <system32\drivers\ALCXWDM.SYS><Avance Logic, Inc.>
[chbfbjgg / chbfbjgg]
  <system32\drivers\chbfbjgg.sys><N/A>
[jgfbfdhj / jgfbfdhj]
  <system32\drivers\jgfbfdhj.sys><N/A>
[kmsinput / kmsinput]
  <\??\C:\WINDOWS\system32\drivers\kmsinput.sys><N/A>
[NAVAP / NAVAP]
  <\??\C:\Program Files\Symantec_Client_Security\Symantec AntiVirus\NAVAP.sys><Symantec Corporation>
[NAVAPEL / NAVAPEL]
  <\??\C:\Program Files\Symantec_Client_Security\Symantec AntiVirus\NAVAPEL.SYS><Symantec Corporation>
[NAVENG / NAVENG]
  <\??\C:\PROGRA~1\COMMON~1\SYMANT~1\VIRUSD~1\20061220.018\NAVENG.sys><Symantec Corporation>
[NAVEX15 / NAVEX15]
  <\??\C:\PROGRA~1\COMMON~1\SYMANT~1\VIRUSD~1\20061220.018\NAVEX15.sys><Symantec Corporation>
[Netgroup Packet Filter / NPF]
  <system32\DRIVERS\npf.sys><CACE Technologies>
[npkcrypt / npkcrypt]
  <\??\D:\Program Files\Tencent\QQ\npkcrypt.sys><INCA Internet Co., Ltd.>
[npkycryp / npkycryp]
  <\??\D:\Program Files\Tencent\QQ\npkycryp.sys><N/A>
[nv / nv]
  <system32\DRIVERS\nv4_mini.sys><NVIDIA Corporation>
[pfauvw9 / pfauvw98]
  <\SystemRoot\System32\DRIVERS\pfauvw98.sys><N/A>
[Direct Parallel Link Driver / Ptilink]
  <system32\DRIVERS\ptilink.sys><Parallel Technologies, Inc.>
[Realtek RTL8139(A/B/C)-based PCI Fast Ethernet Adapter NT Driver / rtl8139]
  <system32\DRIVERS\RTL8139.SYS><Realtek Semiconductor Corporation>
[Secdrv / Secdrv]
  <system32\DRIVERS\secdrv.sys><N/A>
[SiS AGP Filter / SISAGP]
  <\SystemRoot\system32\DRIVERS\SISAGPX.sys><Silicon Integrated Systems Corporation>
[SiSide / SiSide]
  <\SystemRoot\system32\DRIVERS\siside.sys><Silicon Integrated Systems Corp.>
[sisidex / sisidex]
  <\SystemRoot\system32\drivers\sisidex.sys><Windows (R) 2000 DDK provider>
[Add Performance Filter Driver / sisperf]
  <\SystemRoot\system32\drivers\sisperf.sys><Silicon Integrated Systems Corp.>
[PC Camera (6029 CIF) / SNPP106]
  <system32\DRIVERS\snpp106.sys><>
[SymEvent / SymEvent]
  <\??\C:\Program Files\Symantec\SYMEVENT.SYS><Symantec Corporation>
[WiseGroup device driver / VendorJoystickEnabler]
  <system32\DRIVERS\psjoy.sys><Beijing WiseGrup.,Ltd (gamepad.yeah.net)>
[World Standard Teletext Codec / WSTCODEC]
  <system32\DRIVERS\WSTCODEC.SYS><Microsoft Corporation>
[yrvq / yrvqo]
  <\SystemRoot\System32\DRIVERS\yrvqo.sys><N/A>

附件附件:

下载次数:204
文件类型:image/pjpeg
文件大小:
上传时间:2006-12-25 19:57:39
描述:
预览信息:EXIF信息



gototop
 

chbfbigg.sys
jgfbfdhj.sys
kmsinput.sys
yrvqo.sys

这4个有人知道是什么吗?
gototop
 

机子没什么不良反应,就是看他很不爽?

帮帮我~怎么让我下次开机看不到他!!

附件附件:

下载次数:202
文件类型:image/pjpeg
文件大小:
上传时间:2006-12-25 22:38:28
描述:
预览信息:EXIF信息



gototop
 


启动项目
注册表

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run]
    <intenet><C:\WINDOWS\system32\intenet.exe>  [N/A]

==================================

驱动程序
[Service for Avance AC97 Audio (WDM) / ALCXWDM]
  <system32\drivers\ALCXWDM.SYS><Avance Logic, Inc.>
[kmsinput / kmsinput]
  <\??\C:\WINDOWS\system32\drivers\kmsinput.sys><N/A>
[NAVAP / NAVAP]
  <\??\C:\Program Files\Symantec_Client_Security\Symantec AntiVirus\NAVAP.sys><Symantec Corporation>
[NAVAPEL / NAVAPEL]
  <\??\C:\Program Files\Symantec_Client_Security\Symantec AntiVirus\NAVAPEL.SYS><Symantec Corporation>
[NAVENG / NAVENG]
  <\??\C:\PROGRA~1\COMMON~1\SYMANT~1\VIRUSD~1\20061220.018\NAVENG.sys><Symantec Corporation>
[NAVEX15 / NAVEX15]
  <\??\C:\PROGRA~1\COMMON~1\SYMANT~1\VIRUSD~1\20061220.018\NAVEX15.sys><Symantec Corporation>
[Netgroup Packet Filter / NPF]
  <system32\DRIVERS\npf.sys><CACE Technologies>
[nv / nv]
  <system32\DRIVERS\nv4_mini.sys><NVIDIA Corporation>
[Direct Parallel Link Driver / Ptilink]
  <system32\DRIVERS\ptilink.sys><Parallel Technologies, Inc.>
[Realtek RTL8139(A/B/C)-based PCI Fast Ethernet Adapter NT Driver / rtl8139]
  <system32\DRIVERS\RTL8139.SYS><Realtek Semiconductor Corporation>
[Secdrv / Secdrv]
  <system32\DRIVERS\secdrv.sys><N/A>
[SiS AGP Filter / SISAGP]
  <\SystemRoot\system32\DRIVERS\SISAGPX.sys><Silicon Integrated Systems Corporation>
[SiSide / SiSide]
  <\SystemRoot\system32\DRIVERS\siside.sys><Silicon Integrated Systems Corp.>
[sisidex / sisidex]
  <\SystemRoot\system32\drivers\sisidex.sys><Windows (R) 2000 DDK provider>
[Add Performance Filter Driver / sisperf]
  <\SystemRoot\system32\drivers\sisperf.sys><Silicon Integrated Systems Corp.>
[PC Camera (6029 CIF) / SNPP106]
  <system32\DRIVERS\snpp106.sys><>
[SymEvent / SymEvent]
  <\??\C:\Program Files\Symantec\SYMEVENT.SYS><Symantec Corporation>
[WiseGroup device driver / VendorJoystickEnabler]
  <system32\DRIVERS\psjoy.sys><Beijing WiseGrup.,Ltd (gamepad.yeah.net)>


===========================================================
已经删除,不过开机后还是看到了intenet.exe的启动项
5555~真的拿他没办法
gototop
 
1   1  /  1  页   跳转
页面顶部
Powered by Discuz!NT