该用户帖子内容已被屏蔽

希望老师给于点评  让我们知道错在哪里  加以改正

这个就不一定了，比如：<C:\windows\System32\svchost.exe -k netsvcs-->%SystemRoot%\System32\hidserv.dll><N/A>
这样的没签名也是正常的，主要还是要靠经验的积累。

C:\WINDOWS\system32\NsPass0.sys
C:\WINDOWS\system32\NsPass1.sys
C:\WINDOWS\system32\NsPass2.sys
C:\WINDOWS\system32\NsPass3.sys
C:\WINDOWS\system32\NsPass4.sys
C:\WINDOWS\system32\Nskhelper2.sys

似乎就是这些驱动..

1.[MosIrUsb.sys / MosIrUsb][Stopped/Manual Start]
  <system32\DRIVERS\MosIrUsb.sys><>
[NsDlRK250 / NsDlRK250][Stopped/Manual Start]
  <\??\C:\WINDOWS\system32\Nskhelper2.sys><N/A>
[NsPsDk00 / NsPsDk00][Stopped/Manual Start]
  <\??\C:\WINDOWS\system32\NsPass0.sys><N/A>
[NsPsDk01 / NsPsDk01][Stopped/Manual Start]
  <\??\C:\WINDOWS\system32\NsPass1.sys><N/A>
[NsPsDk02 / NsPsDk02][Stopped/Manual Start]
  <\??\C:\WINDOWS\system32\NsPass2.sys><N/A>
[NsPsDk03 / NsPsDk03][Stopped/Manual Start]
  <\??\C:\WINDOWS\system32\NsPass3.sys><N/A>
[NsPsDk04 / NsPsDk04][Stopped/Manual Start]
  <\??\C:\WINDOWS\system32\NsPass4.sys><N/A>
停止运行？是不是可以删除啊？
2.那计划任务是怎么回事啊？

驱动
[NsDlRK250 / NsDlRK250][Stopped/Manual Start]
  <\??\C:\WINDOWS\system32\Nskhelper2.sys><N/A>
[NsPsDk00 / NsPsDk00][Stopped/Manual Start]
  <\??\C:\WINDOWS\system32\NsPass0.sys><N/A>
[NsPsDk01 / NsPsDk01][Stopped/Manual Start]
  <\??\C:\WINDOWS\system32\NsPass1.sys><N/A>
[NsPsDk02 / NsPsDk02][Stopped/Manual Start]
  <\??\C:\WINDOWS\system32\NsPass2.sys><N/A>
[NsPsDk03 / NsPsDk03][Stopped/Manual Start]
  <\??\C:\WINDOWS\system32\NsPass3.sys><N/A>
综上有问题


[System Restore Filter Driver / sr][Stopped/Boot Start]
  <\SystemRoot\system32\DRIVERS\sr.sys><N/A>

[upperdev / upperdev][Stopped/Manual Start]
  <system32\DRIVERS\usbser_lowerflt.sys><N/A>
[Apple Mobile USB Driver / USBAAPL][Stopped/Manual Start]
  <System32\Drivers\usbaapl.sys><N/A>综上没问题

意思是Drivers\目录下没有签名和公司的可以看做是正常

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Windows]
    <AppInit_DLLs><D:\PROGRA~1\KASPER~1\KASPER~1\mzvkbd.dll,D:\PROGRA~1\KASPER~1\KASPER~1\mzvkbd3.dll,D:\PROGRA~1\KASPER~1\KASPER~1\adialhk.dll>  [File is missing]

[NsPsDk00 / NsPsDk00][Stopped/Manual Start]
  <\??\C:\WINDOWS\system32\NsPass0.sys><N/A>
[NsPsDk01 / NsPsDk01][Stopped/Manual Start]
  <\??\C:\WINDOWS\system32\NsPass1.sys><N/A>
[NsPsDk02 / NsPsDk02][Stopped/Manual Start]
  <\??\C:\WINDOWS\system32\NsPass2.sys><N/A>
[NsPsDk03 / NsPsDk03][Stopped/Manual Start]
  <\??\C:\WINDOWS\system32\NsPass3.sys><N/A>
[NsPsDk04 / NsPsDk04][Stopped/Manual Start]
  <\??\C:\WINDOWS\system32\NsPass4.sys><N/A>

[PID: 1480 / SYSTEM][\??\C:\WINDOWS\system32\winlogon.exe]  [(Verified) Microsoft Corporation, 5.1.2600.5512 (xpsp.080413-2113)]
    [D:\PROGRA~1\KASPER~1\KASPER~1\mzvkbd.dll]  [Kaspersky Lab, 8.0.0.454]
    [D:\PROGRA~1\KASPER~1\KASPER~1\mzvkbd3.dll]  [Kaspersky Lab, 8.0.0.454]
    [D:\PROGRA~1\KASPER~1\KASPER~1\adialhk.dll]  [Kaspersky Lab, 8.0.0.454]

[PID: 1480 / SYSTEM][\??\C:\WINDOWS\system32\winlogon.exe]  [(Verified) Microsoft Corporation, 5.1.2600.5512 (xpsp.080413-2113)]
    [D:\PROGRA~1\KASPER~1\KASPER~1\mzvkbd.dll]  [Kaspersky Lab, 8.0.0.454]
    [D:\PROGRA~1\KASPER~1\KASPER~1\mzvkbd3.dll]  [Kaspersky Lab, 8.0.0.454]
    [D:\PROGRA~1\KASPER~1\KASPER~1\adialhk.dll]  [Kaspersky Lab, 8.0.0.454]

计划任务
[已启用] At5.job
        rundll32.exe
[已启用] At4.job
        rundll32.exe
[已启用] At3.job
        rundll32.exe
[已启用] At2.job
        rundll32.exe
[已启用] At1.job
        rundll32.exe
[已启用] At10.job
        rundll32.exe
[已启用] At9.job
        rundll32.exe
[已启用] At8.job
        rundll32.exe
[已启用] At7.job
        rundll32.exe
[已启用] At6.job
        rundll32.exe
[已启用] At15.job
        rundll32.exe
[已启用] At14.job
        rundll32.exe
[已启用] At13.job
        rundll32.exe
[已启用] At12.job
        rundll32.exe
[已启用] At11.job
        rundll32.exe
[已启用] At20.job
        rundll32.exe
[已启用] At19.job
        rundll32.exe
[已启用] At18.job
        rundll32.exe
[已启用] At17.job
        rundll32.exe
[已启用] At16.job
        rundll32.exe
[已启用] At21.job
        rundll32.exe