瑞星卡卡安全论坛

首页 » 技术交流区 » 反病毒/反流氓软件论坛 » 紧急求救!!!各位大侠拜托进来看看~跪求了!!
疯狂de蚂蚁 - 2005-7-30 16:57:00
小弟今天发现了个病毒(大概在世界上是头几例吧),瑞波最新变种BACKDOOR.RBOT.ATX,提示SYSTEM\SCRTKFG.EXE病毒....瑞星能发现,但查杀不了,同时系统很太非常特别的迟钝~~到GOOGLE搜索解决办法~没有中文网页介绍~~我晕了啊~~如何查杀~~求求您们救我一把把
时间time - 2005-7-30 17:01:00
传日志吧
bobo无极限 - 2005-7-30 17:03:00
同意楼上的,上传你的日志,
以便朋友们帮助你分析分析
疯狂de蚂蚁 - 2005-7-30 17:06:00
Backdoor.Rbot.atx  删除成功        05-07-30 10:40  C:\WINDOWS\System32scrtkfg.exe\本机
Backdoor.Rbot.atx  删除成功        05-07-30 11:48  C:\WINDOWS\System32scrtkfg.exe\本机
Backdoor.Rbot.atx  删除成功        05-07-30 12:16  C:\WINDOWS\System32scrtkfg.exe\本机
Backdoor.Rbot.atx  删除成功        05-07-30 15:53  C:\WINDOWS\                                  每次开机都会有的唉~~~~~
时间time - 2005-7-30 17:11:00
这个,要传的是这个日志
先下载http://forum.ikaka.com/download.asp?id=6202404
疯狂de蚂蚁 - 2005-7-30 17:14:00
Logfile of HijackThis v1.99.1
Scan saved at 17:13:52, on 2005-7-30
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Internet Explorer\iexplore.exe
C:\WINDOWS\System32\ctfmon.exe
D:\Rav\Rav.exe
C:\WINDOWS\System32\psecure.exe
C:\PROGRA~1\3721\ske\TrojanAssistant.exe
C:\Documents and Settings\Administrator\桌面\155847200541134207\HijackThis.exe

R3 - Default URLSearchHook is missing
O2 - BHO: ThunderIEHelper Class - {0005A87D-D626-4B3A-84F9-1D9571695F55} - C:\WINDOWS\System32\xunleibho_v6.dll
O2 - BHO: Anti Fish - {38928D50-8A48-44C2-945F-D2F23F771410} - C:\Program Files\3721\Assist\Angling.dll
O2 - BHO: 360搜 - {472101C2-1109-43f4-9112-31F33E3F2127} - C:\Program Files\360so\360so.dll
O2 - BHO: IeCatch2 Class - {A5366673-E8CA-11D3-9CD9-0090271D075B} - C:\PROGRA~1\FlashGet\jccatch.dll
O2 - BHO: AssistII - {BB936323-19FA-4521-BA29-ECA6A121BC78} - C:\Program Files\3721\Assist\asbar.dll
O2 - BHO: IE - {D157330A-9EF3-49F8-9A67-4141AC41ADD4} - C:\WINDOWS\downlo~1\CnsHook.dll
O2 - BHO: Infofo 工具栏 - {D74EC18E-3DDD-4174-B1B1-949FE3B8366D} - C:\Program Files\Infofo Bar\infofobar.dll (file missing)
O3 - Toolbar: 电台(&R) - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O3 - Toolbar: FlashGet Bar - {E0E899AB-F487-11D5-8D29-0050BA6940E3} - C:\PROGRA~1\FlashGet\fgiebar.dll
O3 - Toolbar: 上网助手 - {BB936323-19FA-4521-BA29-ECA6A121BC78} - C:\Program Files\3721\Assist\asbar.dll
O3 - Toolbar: Infofo 工具栏 - {D74EC18E-3DDD-4174-B1B1-949FE3B8366D} - C:\Program Files\Infofo Bar\infofobar.dll (file missing)
O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\System32\IME\TINTLGNT\TINTSETP.EXE /SYNC
O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\System32\IME\TINTLGNT\TINTSETP.EXE /IMEName
O4 - HKLM\..\Run: [DAEMON Tools-1033] "C:\Program Files\D-Tools\daemon.exe"  -lang 1033
O4 - HKLM\..\Run: [rfw] D:\Rfw\Rfw.exe
O4 - HKLM\..\Run: [helper.dll] C:\WINDOWS\system32\rundll32.exe C:\PROGRA~1\3721\helper.dll,Rundll32
O4 - HKLM\..\Run: [assistse] "C:\PROGRA~1\3721\assistse.exe"
O4 - HKLM\..\Run: [360Main.exe] C:\PROGRA~1\360so\360Main.exe
O4 - HKLM\..\Run: [dl_accel] C:\Program Files\3721\Dlaccel\YDownloader.exe
O4 - HKLM\..\Run: [CnsMin] Rundll32.exe C:\WINDOWS\downlo~1\CnsMin.dll,Rundll32
O4 - HKLM\..\Run: [RavTimer] D:\RAV\RAVTIMER.EXE
O4 - HKLM\..\Run: [RavMon] D:\RAV\RAVMON.EXE -SYSTEM
O4 - HKLM\..\Run: [Provan Security] psecure.exe
O4 - HKLM\..\RunServices: [Provan Security] psecure.exe
O4 - HKLM\..\RunOnce: [RavStub] "D:\RAV\ravstub.exe" /RUNONCE
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\System32\ctfmon.exe
O9 - Extra button: 手机短信 - {00000000-0000-0001-0001-596BAEDD1289} - http://sms.3721.com/ie/index.htm (file missing)
O9 - Extra button: 浩方对战平台 - {0A155D3C-68E2-4215-A47A-E800A446447A} - D:\浩方对战平台\GameClient.exe
O9 - Extra button: Yahoo 1G电邮 - {507F9113-CD77-4866-BA92-0E86DA3D0B97} - http://cn.mail.yahoo.com/promo/rd1 (file missing)
O9 - Extra button: 寻宝乐趣多 - {59BC54A2-56B3-44a0-93E5-432D58746E26} - http://hot.3721.com/rd/shop_btn.htm (file missing)
O9 - Extra button: 上网助手 - {5D73EE86-05F1-49ed-B850-E423120EC338} - http://assistant.3721.com/index.htm?fb=Cns (file missing)
O9 - Extra button: Infofo 工具栏 - {8507326C-B5C1-4559-BB91-0919E753836F} - C:\Program Files\Infofo Bar\infofobar.dll (file missing)
O9 - Extra 'Tools' menuitem: Infofo 工具栏 - {8507326C-B5C1-4559-BB91-0919E753836F} - C:\Program Files\Infofo Bar\infofobar.dll (file missing)
O9 - Extra button: 易趣购物 - {BE9C13C3-9E46-4db1-BC05-BD8DA44599F2} - http://adfarm.mediaplex.com/ad/ck/4080-23171-9517-195?cn=song;icon;hp&mpro=http://www.ebay.com.cn (file missing)
O9 - Extra 'Tools' menuitem: 易趣购物 - {BE9C13C3-9E46-4db1-BC05-BD8DA44599F2} - http://adfarm.mediaplex.com/ad/ck/4080-23171-9517-195?cn=song;icon;hp&mpro=http://www.ebay.com.cn (file missing)
O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
O9 - Extra 'Tools' menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
O9 - Extra button: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\PROGRA~1\FlashGet\flashget.exe
O9 - Extra 'Tools' menuitem: &FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\PROGRA~1\FlashGet\flashget.exe
O9 - Extra button: 情景聊天 - {E5D12C4E-7B4F-11D3-B5C9-0050045C3C96} - http://cn.rd.yahoo.com/home/messenger/bjk/clientbtn/?http://cn.messenger.yahoo.com/ (file missing)
O9 - Extra button: (no name) - {ECF2E268-F28C-48d2-9AB7-8F69C11CCB71} - http://assistant.3721.com/security1.htm?fb=Cns (file missing)
O9 - Extra 'Tools' menuitem: 修复浏览器 - {ECF2E268-F28C-48d2-9AB7-8F69C11CCB71} - http://assistant.3721.com/security1.htm?fb=Cns (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O9 - Extra button: (no name) - {FD00D911-7529-4084-9946-A29F1BDF4FE5} - http://assistant.3721.com/clean1.htm?fb=Cns (file missing)
O9 - Extra 'Tools' menuitem: 清理上网记录 - {FD00D911-7529-4084-9946-A29F1BDF4FE5} - http://assistant.3721.com/clean1.htm?fb=Cns (file missing)
O11 - Options group: [!CNS]  上网助手-地址栏搜索
O14 - IERESET.INF: START_PAGE_URL=about:blank
O17 - HKLM\System\CCS\Services\Tcpip\..\{1C2058FD-BC17-4415-81D8-F96EA579A500}: NameServer = 211.97.168.129,211.97.184.100
O17 - HKLM\System\CS1\Services\Tcpip\..\{1C2058FD-BC17-4415-81D8-F96EA579A500}: NameServer = 211.97.168.129,211.97.184.100
O17 - HKLM\System\CS2\Services\Tcpip\..\{1C2058FD-BC17-4415-81D8-F96EA579A500}: NameServer = 211.97.168.129,211.97.184.100
O23 - Service: PsShutdown (PsShutdownSvc) - Unknown owner - C:\WINDOWS\System32\PSSDNSVC.EXE
O23 - Service: Rising Process Communication Center (RsCCenter) - rising - D:\RAV\CCENTER.EXE
O23 - Service: RsRavMon Service (RsRavMon) - Beijing Rising Technology Co., Ltd. - D:\RAV\Ravmond.exe

啊~~谢谢啊啊~~是这个吗???
时间time - 2005-7-30 17:25:00
O4 - HKLM\..\Run: [Provan Security] psecure.exe
O4 - HKLM\..\RunServices: [Provan Security] psecure.exe
是木马啊
O23 - Service: PsShutdown (PsShutdownSvc) - Unknown owner - C:\WINDOWS\System32\PSSDNSVC.EXE也是有问题的
rosecqu - 2005-7-30 17:25:00
其他的杀毒软件比如norton,能杀掉吗?你对系统备份了吗?
疯狂de蚂蚁 - 2005-7-30 17:37:00
其他的没试过~~太信任瑞星了啊~~昨天才装的系统~昨晚到处搜寻游戏插件~~大概在这个过程中染的~~补丁还没打呢~!!!!!
疯狂de蚂蚁 - 2005-7-30 17:38:00
时间time老大,那我怎么修正这些问题啊~~我是新手~请多指教
花落花又开 - 2005-7-30 17:45:00
【回复“疯狂de蚂蚁”的帖子】

您好,请重启电脑按F8进入安全模式

请修复以下:

R3 - Default URLSearchHook is missing

O2 - BHO: 360搜 - {472101C2-1109-43f4-9112-31F33E3F2127} - C:\Program Files\360so\360so.dll

O2 - BHO: Infofo 工具栏 - {D74EC18E-3DDD-4174-B1B1-949FE3B8366D} - C:\Program Files\Infofo Bar\infofobar.dll (file missing)

O4 - HKLM\..\Run: [Provan Security] psecure.exe

O4 - HKLM\..\RunServices: [Provan Security] psecure.exe

删除文件:

C:\Program Files\360so\360so.dll

psecure.exe(开始--搜索,功能)


展开注册表到HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run删除其键Provan Security






疯狂de蚂蚁 - 2005-7-30 17:52:00
上面的是在安全模式下查杀的日志~~以下的是在正常情况下的日志
Logfile of HijackThis v1.99.1
Scan saved at 17:51:35, on 2005-7-30
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
D:\RAV\CCENTER.EXE
C:\Program Files\D-Tools\daemon.exe
D:\Rfw\Rfw.exe
C:\WINDOWS\system32\rundll32.exe
C:\PROGRA~1\3721\assistse.exe
C:\PROGRA~1\360so\360Main.exe
C:\Program Files\3721\Dlaccel\YDownloader.exe
D:\RAV\RAVTIMER.EXE
C:\WINDOWS\System32\ctfmon.exe
C:\Program Files\MSN Messenger\MsnMsgr.Exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\WINDOWS\System32\conime.exe
D:\RAV\Ravmond.exe
D:\RAV\RavStub.exe
d:\rav\RAVMON.EXE
C:\WINDOWS\System32\wuauclt.exe
D:\浩方对战平台\GameClient.exe
C:\WINDOWS\System32\wuauclt.exe
C:\Documents and Settings\WangPei\桌面\155847200541134207\HijackThis.exe

R3 - URLSearchHook: 上网助手 - {BB936323-19FA-4521-BA29-ECA6A121BC78} - C:\Program Files\3721\Assist\asbar.dll
O2 - BHO: ThunderIEHelper Class - {0005A87D-D626-4B3A-84F9-1D9571695F55} - C:\WINDOWS\System32\xunleibho_v6.dll
O2 - BHO: Anti Fish - {38928D50-8A48-44C2-945F-D2F23F771410} - C:\Program Files\3721\Assist\Angling.dll
O2 - BHO: 360搜 - {472101C2-1109-43f4-9112-31F33E3F2127} - C:\Program Files\360so\360so.dll
O2 - BHO: IeCatch2 Class - {A5366673-E8CA-11D3-9CD9-0090271D075B} - C:\PROGRA~1\FlashGet\jccatch.dll
O2 - BHO: AssistII - {BB936323-19FA-4521-BA29-ECA6A121BC78} - C:\Program Files\3721\Assist\asbar.dll
O2 - BHO: IE - {D157330A-9EF3-49F8-9A67-4141AC41ADD4} - C:\WINDOWS\downlo~1\CnsHook.dll
O2 - BHO: Infofo 工具栏 - {D74EC18E-3DDD-4174-B1B1-949FE3B8366D} - C:\Program Files\Infofo Bar\infofobar.dll (file missing)
O3 - Toolbar: 电台(&R) - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O3 - Toolbar: FlashGet Bar - {E0E899AB-F487-11D5-8D29-0050BA6940E3} - C:\PROGRA~1\FlashGet\fgiebar.dll
O3 - Toolbar: 上网助手 - {BB936323-19FA-4521-BA29-ECA6A121BC78} - C:\Program Files\3721\Assist\asbar.dll
O3 - Toolbar: Infofo 工具栏 - {D74EC18E-3DDD-4174-B1B1-949FE3B8366D} - C:\Program Files\Infofo Bar\infofobar.dll (file missing)
O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\System32\IME\TINTLGNT\TINTSETP.EXE /SYNC
O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\System32\IME\TINTLGNT\TINTSETP.EXE /IMEName
O4 - HKLM\..\Run: [DAEMON Tools-1033] "C:\Program Files\D-Tools\daemon.exe"  -lang 1033
O4 - HKLM\..\Run: [rfw] D:\Rfw\Rfw.exe
O4 - HKLM\..\Run: [helper.dll] C:\WINDOWS\system32\rundll32.exe C:\PROGRA~1\3721\helper.dll,Rundll32
O4 - HKLM\..\Run: [assistse] "C:\PROGRA~1\3721\assistse.exe"
O4 - HKLM\..\Run: [360Main.exe] C:\PROGRA~1\360so\360Main.exe
O4 - HKLM\..\Run: [dl_accel] C:\Program Files\3721\Dlaccel\YDownloader.exe
O4 - HKLM\..\Run: [CnsMin] Rundll32.exe C:\WINDOWS\downlo~1\CnsMin.dll,Rundll32
O4 - HKLM\..\Run: [RavTimer] D:\RAV\RAVTIMER.EXE
O4 - HKLM\..\Run: [RavMon] D:\RAV\RAVMON.EXE -SYSTEM
O4 - HKLM\..\Run: [Provan Security] psecure.exe
O4 - HKLM\..\RunServices: [Provan Security] psecure.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\System32\ctfmon.exe
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O8 - Extra context menu item: !搜一搜 - res://C:\WINDOWS\downlo~1\CnsMinEx.dll/1003
O8 - Extra context menu item: &使用下载加速专家下载 - C:\Program Files\3721\Dlaccel\geturl.htm
O8 - Extra context menu item: 使用网际快车下载 - C:\PROGRA~1\FlashGet\jc_link.htm
O8 - Extra context menu item: 使用网际快车下载全部链接 - C:\PROGRA~1\FlashGet\jc_all.htm
O8 - Extra context menu item: 添加到QQ自定义面板 - D:\qq\AddPanel.htm
O8 - Extra context menu item: 添加到QQ表情 - D:\qq\AddEmotion.htm
O8 - Extra context menu item: 用QQ彩信发送该图片 - D:\qq\SendMMS.htm
O9 - Extra button: 手机短信 - {00000000-0000-0001-0001-596BAEDD1289} - http://sms.3721.com/ie/index.htm (file missing)
O9 - Extra button: 浩方对战平台 - {0A155D3C-68E2-4215-A47A-E800A446447A} - D:\浩方对战平台\GameClient.exe
O9 - Extra button: Yahoo 1G电邮 - {507F9113-CD77-4866-BA92-0E86DA3D0B97} - http://cn.mail.yahoo.com/promo/rd1 (file missing)
O9 - Extra button: 寻宝乐趣多 - {59BC54A2-56B3-44a0-93E5-432D58746E26} - http://hot.3721.com/rd/shop_btn.htm (file missing)
O9 - Extra button: 上网助手 - {5D73EE86-05F1-49ed-B850-E423120EC338} - http://assistant.3721.com/index.htm?fb=Cns (file missing)
O9 - Extra button: Infofo 工具栏 - {8507326C-B5C1-4559-BB91-0919E753836F} - C:\Program Files\Infofo Bar\infofobar.dll (file missing)
O9 - Extra 'Tools' menuitem: Infofo 工具栏 - {8507326C-B5C1-4559-BB91-0919E753836F} - C:\Program Files\Infofo Bar\infofobar.dll (file missing)
O9 - Extra button: 易趣购物 - {BE9C13C3-9E46-4db1-BC05-BD8DA44599F2} - http://adfarm.mediaplex.com/ad/ck/4080-23171-9517-195?cn=song;icon;hp&mpro=http://www.ebay.com.cn (file missing)
O9 - Extra 'Tools' menuitem: 易趣购物 - {BE9C13C3-9E46-4db1-BC05-BD8DA44599F2} - http://adfarm.mediaplex.com/ad/ck/4080-23171-9517-195?cn=song;icon;hp&mpro=http://www.ebay.com.cn (file missing)
O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
O9 - Extra 'Tools' menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
O9 - Extra button: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\PROGRA~1\FlashGet\flashget.exe
O9 - Extra 'Tools' menuitem: &FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\PROGRA~1\FlashGet\flashget.exe
O9 - Extra button: 情景聊天 - {E5D12C4E-7B4F-11D3-B5C9-0050045C3C96} - http://cn.rd.yahoo.com/home/messenger/bjk/clientbtn/?http://cn.messenger.yahoo.com/ (file missing)
O9 - Extra button: (no name) - {ECF2E268-F28C-48d2-9AB7-8F69C11CCB71} - http://assistant.3721.com/security1.htm?fb=Cns (file missing)
O9 - Extra 'Tools' menuitem: 修复浏览器 - {ECF2E268-F28C-48d2-9AB7-8F69C11CCB71} - http://assistant.3721.com/security1.htm?fb=Cns (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O9 - Extra button: (no name) - {FD00D911-7529-4084-9946-A29F1BDF4FE5} - http://assistant.3721.com/clean1.htm?fb=Cns (file missing)
O9 - Extra 'Tools' menuitem: 清理上网记录 - {FD00D911-7529-4084-9946-A29F1BDF4FE5} - http://assistant.3721.com/clean1.htm?fb=Cns (file missing)
O11 - Options group: [!CNS]  上网助手-地址栏搜索
O14 - IERESET.INF: START_PAGE_URL=about:blank
O17 - HKLM\System\CCS\Services\Tcpip\..\{1C2058FD-BC17-4415-81D8-F96EA579A500}: NameServer = 211.97.168.129,211.97.184.100
O17 - HKLM\System\CS1\Services\Tcpip\..\{1C2058FD-BC17-4415-81D8-F96EA579A500}: NameServer = 211.97.168.129,211.97.184.100
O17 - HKLM\System\CS2\Services\Tcpip\..\{1C2058FD-BC17-4415-81D8-F96EA579A500}: NameServer = 211.97.168.129,211.97.184.100
O23 - Service: PsShutdown (PsShutdownSvc) - Unknown owner - C:\WINDOWS\System32\PSSDNSVC.EXE (file missing)
O23 - Service: Rising Process Communication Center (RsCCenter) - rising - D:\RAV\CCENTER.EXE
O23 - Service: RsRavMon Service (RsRavMon) - Beijing Rising Technology Co., Ltd. - D:\RAV\Ravmond.exe

疯狂de蚂蚁 - 2005-7-30 17:54:00
谢谢 啦~~~~~~~~感谢感谢~~~~~花落花又开~~~~~我马上试试啊
时间time - 2005-7-30 17:58:00
O23 - Service: PsShutdown (PsShutdownSvc) - Unknown owner - C:\WINDOWS\System32\PSSDNSVC.EXE (file missing)你也修了吧
花落花又开 - 2005-7-30 18:02:00
引用:
【时间time的贴子】O23 - Service: PsShutdown (PsShutdownSvc) - Unknown owner - C:\WINDOWS\System32\PSSDNSVC.EXE (file missing)你也修了吧
...........................


此项是sysinternals提供的PsShutdown关机命令PsShutdown类似Windows 2000 Resource Kit中的shutdown 工具,包括关机、重启本地和远程计算机,远程控制的东东。附PsShutdown介绍。



附——PsShutdown:
Copyright ? 2000-2004 Mark Russinovich
Last Updated: January 25, 2004 v2.41
Introduction
PsShutdown is a command-line utility similar to the shutdown utility from
the Windows 2000 Resource Kit, but with the ability to do much more. In
addition to supporting the same options for shutting down or rebooting the
local or a remote computer, PsShutdown can logoff the console user or lock
the console (locking requires Windows 2000 or higher). PsShutdown requires
no manual installation of client software.
Installation
Just copy PsShutdown onto your executable path, and type psshutdown with
command-line options defined below.
PsShutdown works on NT 4.0 and higher.
Usage
You can use PsShutdown to initiate a shutdown of the local or a remote
computer, logoff a user, lock a system, or to abort an imminent shutdown.
usage: psshutdown [[\\\\computer[,computer[,..] | @file [-u user [-p psswd]]]
-s|-r|-h|-d|-k|-a|-l|-o [-f] [-c] [-t nn|h:m] [-n s] [-e [u|p]:xx:yy] [-m
"message"]
-? Displays the supported options.
computer Perform the command on the remote computer or computers specified.
If you omit the computer name the command runs on the local system, and if
you specify a wildcard (\\\\*), the command runs on all computers in the
current domain.
@file Run the command on each computer listed in the text file specified. 
-u Specifies optional user name for login to remote computer.
-p Specifies optional password for user name. If you omit this you will be
prompted to enter a hidden password.
-a Aborts a shutdown (only possible while a countdown is in progress)
-c Allow the shutdown to be aborted by the interactive user 
-d Suspend the computer
-e Shutdown reason code.
Specify \'u\' for user reason codes and \'p\' for planned shutdown reason
codes.
xx is the major reason code (must be less than 256)
yy is the minor reason code (must be less than 65536)
-f Forces all running applications to exit during the shutdown instead of
giving them a chance to gracefully save their data
-h Hibernate the computer
-k Poweroff the computer (reboot if poweroff is not supported)
-l Lock the computer
-m This option lets you specify a message to display to logged-on users
when a shutdown countdown commences
-n Specifies timeout in seconds connecting to remote computers
-o Logoff the console user
-r Reboot after shutdown
-s Shutdown without poweroff
-t Specifies the countdown in seconds until the shutdown (default: 20
seconds) or the time of shutdown (in 24 hour notation)
PsTools
PsShutdown is part of a growing kit of Sysinternals command-line tools that
aid in the adminstration of local and remote Windows NT/2K systems named
PsTools.
Download PsShutdown (14KB) http://www.sysinternals.com/files/PsShutdn.zip
Download PsTools http://www.sysinternals.com/files/Pstools.zip

疯狂de蚂蚁 - 2005-7-31 20:59:00
啥也别说了~~谢谢啊~!!!
sfgsj - 2005-8-8 11:07:00
晕。我也遇到这种病毒了!安全模式下杀毒也杀了,没有。手工改注册表都改了,第二天开机还是这个结果。请大虾帮帮忙
1
查看完整版本: 紧急求救!!!各位大侠拜托进来看看~跪求了!!