瑞星卡卡安全论坛技术交流区反病毒/反流氓软件论坛 Backdoor.Gpigeon.dq 机子经常重起~无法看隐藏文件~无法改注册表~怎么办啊

123   2  /  3  页   跳转

Backdoor.Gpigeon.dq 机子经常重起~无法看隐藏文件~无法改注册表~怎么办啊

http://forum.ikaka.com/topic.asp?board=28&artid=6979213
一楼附件..下载HijackThis...把日志帖上来..
gototop
 

保存为修复.inf即可,点右键安装。
gototop
 

打开注册表编辑器,找到 HKEY_LOCAL_MACHINE \Software \Microsoft\Windows \CurrentVersion \explorer\Advanced \Folder\Hidden\SHOWALL分支,在右边的窗口中双击CheckedValue键值项,看它的键值是不是为"0".如果是,改为"1"
 

我打开了~他自己就是1了~
gototop
 


http://forum.ikaka.com/topic.asp?board=28&artid=6979213
一楼附件..下载HijackThis...把日志帖上来..
速度..
gototop
 

你已经打开了注册表编辑器,现在用sreng发个系统报告上来让我们分析一下。http://www.kztechs.com/

附件附件:

下载次数:152
文件类型:image/pjpeg
文件大小:
上传时间:2006-5-28 10:33:05
描述:



gototop
 

组策略  gpedit.msc
gototop
 

点扫描,结束后保存用附件形式发上来,我们帮你分析。

附件附件:

下载次数:148
文件类型:image/pjpeg
文件大小:
上传时间:2006-5-28 10:42:16
描述:



gototop
 

楼上说的HijackThis我一运行就自动关机~

还有SREng这个软件我没找到生成报告的地方~在哪啊
gototop
 

启动项目
注册表
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
  <ctfmon.exe><C:\WINDOWS\system32\ctfmon.exe>
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
  <Tok-Cirrhatus><"C:\Documents and Settings\xboy1983\Local Settings\Application Data\smss.exe">
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
  <eMuleAutoStart><; C:\Program Files\eMule\eMule.exe -AutoStart>
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
  <H/PC Connection Agent><; "C:\Program Files\Microsoft ActiveSync\wcescomm.exe">
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
  <KuGoo3><; "C:\PROGRA~1\KUGOO3\KUGOO.EXE">
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
  <MsnMsgr><; "C:\Program Files\MSN Messenger\msnmsgr.exe" /background>
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
  <Super Rabbit IEPro><; C:\Program Files\Super Rabbit\MagicSet\SRIECLI.EXE /LOAD>
[HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows]
gototop
 

<load><>
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
  <LaunchApp><Alaunch>
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
  <SoundMan><SOUNDMAN.EXE>
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
  <LManager><C:\PROGRA~1\LAUNCH~1\CPLFL32.EXE>
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
  <TkBellExe><; "C:\Program Files\Common Files\Real\Update_OB\realsched.exe"  -osboot>
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
  <StormCodec_Helper><; "C:\Program Files\Ringz Studio\Storm Codec\StormSet.exe" /S /opti>
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
  <Bron-Spizaetus><"C:\WINDOWS\ShellNew\sempalong.exe">
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
  <RavTask><"C:\Program Files\Rising\Rav\RavTask.exe" -system>
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
  <AGRSMMSG><; AGRSMMSG.exe>
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
  <ATIModeChange><; Ati2mdxx.exe>
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
  <ATIPTA><; C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe>
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
  <bgoomain.exe><; C:\PROGRA~1\baigoo\bgoomain.exe>
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
  <HotKeysCmds><; C:\WINDOWS\System32\hkcmd.exe>
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
  <IgfxTray><; C:\WINDOWS\System32\igfxtray.exe>
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
  <IMJPMIG8.1><; "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32>
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
  <iTunesHelper><; "C:\Program Files\iTunes\iTunesHelper.exe">
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
  <NTdhcp><; C:\WINDOWS\system32\NTdhcp.exe>
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
  <PCMService><; "C:\Program Files\Aspire Arcade\PCMService.exe">
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
  <PHIME2002A><; C:\WINDOWS\System32\IME\TINTLGNT\TINTSETP.EXE /IMEName>
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
  <PHIME2002ASync><; C:\WINDOWS\System32\IME\TINTLGNT\TINTSETP.EXE /SYNC>
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
  <ShowIcon_Chander_CRW Series Driver v1.17r019><; "C:\Program Files\CRW\shwicon.exe" -t"Chander\CRW Series Driver v1.17r019">
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
  <SunJavaUpdateSched><; C:\Program Files\Java\j2re1.4.2_01\bin\jusched.exe>
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
  <SynTPEnh><; C:\Program Files\Synaptics\SynTP\SynTPEnh.exe>
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
  <SynTPLpr><; C:\Program Files\Synaptics\SynTP\SynTPLpr.exe>
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
  <YLive.exe><; >
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
  <KernelFaultCheck><%systemroot%\system32\dumprep 0 -k>
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
  <shell><Explorer.exe "C:\WINDOWS\BerasJatah.exe">
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
  <Userinit><C:\WINDOWS\system32\userinit.exe,>
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Windows]
  <AppInit_DLLs><>
gototop
 
123   2  /  3  页   跳转
页面顶部
Powered by Discuz!NT