已经发送到virusdied@yahoo.com.cn，谢谢

引用:

【mycoffee的贴子】HijackThis@Qoo的扫描日志  V1.97.7 Scan saved at 22:01:35, on 2005-11-6 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\Ati2evxx.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\system32\inetsrv\inetinfo.exe D:\mysql\bin\mysqld-nt.exe d:\program files\rising\rfw\rfwsrv.exe D:\PROGRAM FILES\RISING\RAV\CCENTER.EXE D:\PROGRAM FILES\RISING\RAV\Ravmond.exe C:\WINDOWS\system32\Ati2evxx.exe C:\WINDOWS\services.exe D:\Program Files\Rising\Rfw\rfwmain.exe D:\Program Files\Rising\Rav\RavTimer.exe D:\Program Files\Rising\Rav\RavMon.exe C:\WINDOWS\system32\ctfmon.exe D:\Program Files\Thunder Network\Thunder\Thunder.exe C:\WINDOWS\system32\conime.exe C:\Program Files\Windows Media Player\wmplayer.exe C:\WINDOWS\system32\svchost.exe C:\Program Files\Internet Explorer\iexplore.exe D:\Program Files\Iparmor\Iparmor.exe C:\WINDOWS\explorer.exe C:\Documents and Settings\Coffee\桌面\hijackthis1.97_qoo\HijackThis.exe O2 - BHO: (no name) - {0005A87D-D626-4B3A-84F9-1D9571695F55} - C:\WINDOWS\system32\xunleibho_v8.dll O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName O4 - HKLM\..\Run: [NVMixerTray] ; "C:\Program Files\NVIDIA Corporation\NvMixer\NVMixerTray.exe" O4 - HKLM\..\Run: [RfwMain] d:\Program Files\Rising\Rfw\rfwmain.exe O4 - HKLM\..\Run: [RavTimer] d:\Program Files\Rising\Rav\RavTimer.exe O4 - HKLM\..\Run: [RavMon] d:\Program Files\Rising\Rav\RavMon.exe -system O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [Super Rabbit IEPro] D:\Program Files\Super Rabbit\MagicSet\SRIECLI.EXE /LOAD O4 - HKCU\..\Run: [services] C:\WINDOWS\services.exe O4 - HKCU\..\RunServices: [services] C:\WINDOWS\services.exe O4 - Startup: NTUSER.DAT O4 - Startup: ntuser.dat.LOG O4 - Startup: ntuser.ini O8 - Extra context menu item: &使用迅雷下载 - d:\Program Files\Thunder Network\Thunder\geturl.htm O8 - Extra context menu item: &使用迅雷下载全部链接 - d:\Program Files\Thunder Network\Thunder\getallurl.htm O8 - Extra context menu item: 导出到 Microsoft Excel(&x) - res://D:\PROGRA~1\MICROS~1\Office10\EXCEL.EXE/3000 O16 - DPF: {488A4255-3236-44B3-8F27-FA1AECAA8844} (CEditCtrl ) - https://img.alipay.com/download/aliedit.cab O18 - Protocol: about - {3050F406-98B5-11CF-BB82-00AA00BDCE0B} - %SystemRoot%\system32\mshtml.dll ...........................

C:\WINDOWS\services.exe
O4 - HKCU\..\Run: [services] C:\WINDOWS\services.exe
O4 - HKCU\..\RunServices: [services] C:\WINDOWS\services.exe
疑似木马或鸽子.
Hijackthis版本太低了,下个1.99.1吧
HijackThis1.99.1可以到【公告】反病毒论坛暂行条例（2005.9.12更新）及本版常用小工具1楼中下载
或.（反浏览器劫持版）置顶贴[必读]本版说明及常用小软件下载

好的，谢谢

以下是最新信息：

HijackThis_zww汉化版扫描日志 V1.99.1
保存于      22:31:55, 日期 2005-11-6
操作系统：  Windows XP SP2 (WinNT 5.01.2600)
浏览器：    Internet Explorer v6.00 SP2 (6.00.2900.2180)

当前运行的进程：         
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\inetsrv\inetinfo.exe
D:\mysql\bin\mysqld-nt.exe
d:\program files\rising\rfw\rfwsrv.exe
D:\PROGRAM FILES\RISING\RAV\CCENTER.EXE
D:\PROGRAM FILES\RISING\RAV\Ravmond.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\services.exe
C:\Program Files\Internet Explorer\iexplore.exe
d:\program files\rising\rfw\RfwMain.exe
C:\Documents and Settings\Coffee\桌面\2535952005811174944\HijackThis1991zww.exe

F3 - REG:win.ini: run=C:\WINDOWS\services.exe
O4 - 启动项HKLM\\Run: [services] C:\WINDOWS\services.exe
O4 - 启动项HKLM\\RunServices: [services] C:\WINDOWS\services.exe
O4 - HKCU\..\Run: [services] C:\WINDOWS\services.exe
O4 - 启动项HKCU\\RunServices: [services] C:\WINDOWS\services.exe
O4 - Startup: Adobe Gamma.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O20 - AppInit_DLLs: APIHookDll.dll
O23 - NT 服务: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - NT 服务: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - NT 服务: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - NT 服务: MySql - Unknown owner - D:/mysql/bin/mysqld-nt.exe
O23 - NT 服务: Rising Personal Firewall Service (RfwService) - Beijing Rising Technology Corporation Limited - d:\program files\rising\rfw\rfwsrv.exe
O23 - NT 服务: Rising Process Communication Center (RsCCenter) - rising - D:\PROGRAM FILES\RISING\RAV\CCENTER.EXE
O23 - NT 服务: RsRavMon Service (RsRavMon) - Beijing Rising Technology Co., Ltd. - D:\PROGRAM FILES\RISING\RAV\Ravmond.exe

O23 - NT 服务: MySql - Unknown owner - D:/mysql/bin/mysqld-nt.exe
这个服务是干什么用的。

我将C:\WINDOWS\system32\services.exe删除了，不知道有什么后果？

C:\WINDOWS\services.exe
O4 - 启动项HKLM\\Run: [services] C:\WINDOWS\services.exe
O4 - 启动项HKLM\\RunServices: [services] C:\WINDOWS\services.exe
O4 - HKCU\..\Run: [services] C:\WINDOWS\services.exe
O4 - 启动项HKCU\\RunServices: [services] C:\WINDOWS\services.exe
应该就是这个东东了。在安全模式下也没法删除吗。

引用:

【mycoffee的贴子】以下是最新信息： HijackThis_zww汉化版扫描日志 V1.99.1 保存于      22:31:55, 日期 2005-11-6 操作系统：  Windows XP SP2 (WinNT 5.01.2600) 浏览器：    Internet Explorer v6.00 SP2 (6.00.2900.2180) 当前运行的进程：          C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\Ati2evxx.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\system32\inetsrv\inetinfo.exe D:\mysql\bin\mysqld-nt.exe d:\program files\rising\rfw\rfwsrv.exe D:\PROGRAM FILES\RISING\RAV\CCENTER.EXE D:\PROGRAM FILES\RISING\RAV\Ravmond.exe C:\WINDOWS\system32\Ati2evxx.exe C:\WINDOWS\Explorer.EXE C:\WINDOWS\services.exe C:\Program Files\Internet Explorer\iexplore.exe d:\program files\rising\rfw\RfwMain.exe C:\Documents and Settings\Coffee\桌面\2535952005811174944\HijackThis1991zww.exe F3 - REG:win.ini: run=C:\WINDOWS\services.exe O4 - 启动项HKLM\\Run: [services] C:\WINDOWS\services.exe O4 - 启动项HKLM\\RunServices: [services] C:\WINDOWS\services.exe O4 - HKCU\..\Run: [services] C:\WINDOWS\services.exe O4 - 启动项HKCU\\RunServices: [services] C:\WINDOWS\services.exe O4 - Startup: Adobe Gamma.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe O20 - AppInit_DLLs: APIHookDll.dll O23 - NT 服务: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe O23 - NT 服务: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe O23 - NT 服务: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe O23 - NT 服务: MySql - Unknown owner - D:/mysql/bin/mysqld-nt.exe O23 - NT 服务: Rising Personal Firewall Service (RfwService) - Beijing Rising Technology Corporation Limited - d:\program files\rising\rfw\rfwsrv.exe O23 - NT 服务: Rising Process Communication Center (RsCCenter) - rising - D:\PROGRAM FILES\RISING\RAV\CCENTER.EXE O23 - NT 服务: RsRavMon Service (RsRavMon) - Beijing Rising Technology Co., Ltd. - D:\PROGRAM FILES\RISING\RAV\Ravmond.exe ...........................

C:\WINDOWS\services.exe
F3 - REG:win.ini: run=C:\WINDOWS\services.exe
O4 - 启动项HKLM\\Run: [services] C:\WINDOWS\services.exe
O4 - 启动项HKLM\\RunServices: [services] C:\WINDOWS\services.exe
O4 - HKCU\..\Run: [services] C:\WINDOWS\services.exe
O4 - 启动项HKCU\\RunServices: [services] C:\WINDOWS\services.exe
木马.
试试:
进安全模式,修复上述各项.
结束C:\WINDOWS\services.exe进程(用IS,或新版卡卡,可看见进程的程序路径,因为C:\WINDOWS\system32\services.exe是正常的).
删除C:\WINDOWS\services.exe文件.

引用:

【神无的贴子】O23 - NT 服务: MySql - Unknown owner - D:/mysql/bin/mysqld-nt.exe 这个服务是干什么用的。 ...........................

你好，这个是MYSQL数据库

好的，谢谢