系统禁止本地services.exe发送UDP数据包，地址为：0.0.0.0:1027[灰鸽子] => 211.92.8.161:53[域名解析]程序名称为：C:\WINNT\system32\services.exe


这是什么意思啊,该怎么解决呢?

应该是灰鸽子访问的端口被禁止
并不一定代表就中了灰鸽子

【回复“不言放弃”的帖子】谢谢你,我试着用kboot杀过,kboot提示有病毒,但不知道为什么杀了以后还提示问杀毒吗,没弄懂

http://forum.ikaka.com/topic.asp?board=28&artid=6979213
下载HIJACKTHIS
导出日志

请看

HijackThis_zww汉化版扫描日志 V1.99.1
保存于      14:11:54, 日期 2006-2-21
操作系统：  Windows 2000 SP4 (WinNT 5.00.2195)
浏览器：    Internet Explorer v6.00 SP1

(6.00.2800.1106)

当前运行的进程：         
C:\WINNT\System32\smss.exe
C:\WINNT\system32\winlogon.exe
C:\WINNT\system32\services.exe
C:\WINNT\system32\lsass.exe
c:\program files\rising\rfw\rfwsrv.exe
C:\WINNT\system32\svchost.exe
C:\Program Files\rising\Rav\CCenter.exe
C:\Program Files\rising\Rav\Ravmond.exe
C:\WINNT\system32\spoolsv.exe
C:\WINNT\System32\svchost.exe
C:\WINNT\system32\regsvc.exe
C:\WINNT\System32\WBEM\WinMgmt.exe
C:\WINNT\system32\svchost.exe
C:\Program Files\rising\Rav\RavStub.exe
C:\WINNT\Explorer.EXE
c:\program files\rising\rfw\RfwMain.exe
C:\Program Files\rising\Rav\RavTask.exe
C:\WINNT\system32\internat.exe
C:\Program Files\rising\Rav\Ravmon.exe
C:\Program Files\Tencent\QQ\QQ.exe
C:\Program Files\Tencent\QQ\TIMPlatform.exe
C:\Program Files\Winamp5\winamp.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\rising\Rav\RsAgent.exe
C:\WINNT\msagent\AgentSvr.exe
E:\down\HijackThis\HijackThis1991zww.exe

F2 - REG:system.ini: UserInit=
O2 - BHO: (no name) - AutorunsDisabled - (no file)
O3 - IE工具栏增项: UCmore - The Search Accelerator

Toolbar - {44BE0690-5429-47f0-85BB-3FFD8020233E} -

C:\Program Files\TheSearchAccelerator\UCMTSAIE.dll
O3 - IE工具栏增项: 电台(&R) -

{8E718888-423F-11D2-876E-00A0C9082467} -

C:\WINNT\system32\msdxm.ocx
O3 - IE工具栏增项: (no name) -

{F60C7D81-8471-4D40-AAFE-56D318F34C2D} - (no file)
O3 - IE工具栏增项: (no name) -

{1B0E7716-898E-48cc-9690-4E338E8DE1D3} - (no file)
O4 - 启动项HKLM\\Run: [RavTask] "C:\Program

Files\rising\Rav\RavTask.exe" -system
O4 - HKCU\..\Run: [internat.exe] internat.exe
O4 - Global Startup: Microsoft Office.lnk =

C:\Program Files\Microsoft Office\Office\OSA9.EXE
O8 - IE右键菜单中的新增项目: 使用影音传送带下载 -

C:\Program Files\NETTRA~1\NTAddLink.html
O8 - IE右键菜单中的新增项目: 使用影音传送带下载全部

链接 - C:\Program Files\NETTRA~1\NTAddList.html
O8 - IE右键菜单中的新增项目: 使用网际快车下载 -

C:\Program Files\FlashGet\jc_link.htm
O8 - IE右键菜单中的新增项目: 使用网际快车下载全部链

接 - C:\Program Files\FlashGet\jc_all.htm
O8 - IE右键菜单中的新增项目: 添加到QQ自定义面板 -

C:\Program Files\Tencent\QQ\AddPanel.htm
O8 - IE右键菜单中的新增项目: 添加到QQ表情 -

C:\Program Files\Tencent\QQ\AddEmotion.htm
O8 - IE右键菜单中的新增项目: 用QQ彩信发送该图片 -

C:\Program Files\Tencent\QQ\SendMMS.htm
O8 - IE右键菜单中的新增项目: 黄河&Flash播放器 -

C:\Program Files\黄河Flash播放器\geturl.htm
O9 - 浏览器额外的按钮: (no name) - AutorunsDisabled

- (no file)
O9 - 浏览器额外的按钮: Yahoo 1G电邮 -

{507F9113-CD77-4866-BA92-0E86DA3D0B97} -

http://cn.mail.yahoo.com/promo/rd1 (file missing)
O9 - 浏览器额外的按钮: 上网助手 -

{5D73EE86-05F1-49ed-B850-E423120EC338} -

http://assistant.3721.com/index.htm?fb=Cns (file

missing)
O9 - 浏览器额外的按钮: QQ -

{c95fe080-8f5d-11d2-a20b-00aa003c157b} - C:\Program

Files\Tencent\QQ\QQ.EXE
O9 - 浏览器额外的“工具”菜单项: 腾讯QQ -

{c95fe080-8f5d-11d2-a20b-00aa003c157b} - C:\Program

Files\Tencent\QQ\QQ.EXE
O9 - 浏览器额外的按钮: FlashGet -

{D6E814A0-E0C5-11d4-8D29-0050BA6940E3} -

C:\PROGRA~1\FlashGet\flashget.exe
O9 - 浏览器额外的“工具”菜单项: &FlashGet -

{D6E814A0-E0C5-11d4-8D29-0050BA6940E3} -

C:\PROGRA~1\FlashGet\flashget.exe
O9 - 浏览器额外的按钮: (no name) -

{DEDEB80D-FA35-45d9-9460-4983E5A8AFE6} -

C:\WINNT\System32\shdocvw.dll
O9 - 浏览器额外的“工具”菜单项: QQ炫彩工具条设置 -

{DEDEB80D-FA35-45d9-9460-4983E5A8AFE6} -

C:\WINNT\System32\shdocvw.dll
O9 - 浏览器额外的按钮: (no name) -

{ECF2E268-F28C-48d2-9AB7-8F69C11CCB71} -

http://assistant.3721.com/security1.htm?fb=Cns

(file missing)
O9 - 浏览器额外的“工具”菜单项: 修复浏览器 -

{ECF2E268-F28C-48d2-9AB7-8F69C11CCB71} -

http://assistant.3721.com/security1.htm?fb=Cns

(file missing)
O9 - 浏览器额外的按钮: (no name) -

{FD00D911-7529-4084-9946-A29F1BDF4FE5} -

http://assistant.3721.com/clean1.htm?fb=Cns (file

missing)
O9 - 浏览器额外的“工具”菜单项: 清理上网记录 -

{FD00D911-7529-4084-9946-A29F1BDF4FE5} -

http://assistant.3721.com/clean1.htm?fb=Cns (file

missing)
O16 - DPF: {09F59435-7814-48ED-A73A-96FF861A91EB} -

http://download.china.alibaba.com/search/alibaba/2/

bar.cab
O16 - DPF: {0CA54D3F-CEAE-48AF-9A2B-31909CB9515D}

(Edit Class) -

https://www.sz1.cmbchina.com/download/CMBEdit.cab
O16 - DPF: {23739A7E-5741-4D1C-88D5-D50B18F7C347}

(iWebOffice Control) -

http://wing-arrow.noip.cn/ou/oa_cqzj/weboa/gl_gw/gw

_move/iWebOffice2003.ocx
O16 - DPF: {607DF741-7D0A-11D4-9EDC-005004189684} -

http://www.ucmore.com/download/UCmoreIEx.cab
O16 - DPF: {6CB5E471-C305-11D3-99A8-000086395495} -

http://toolbar.google.com/data/zh-CN/big/1.1.62-big

/GoogleNav.cab
O16 - DPF: {85599589-00AA-11D7-A7D0-00E04C3F6D70}

(SecClient Control) -

https://business.cmbc.com.cn:8103/secClientOcx.cab
O16 - DPF: {DA984A6D-508E-11D6-AA49-0050FF3C628D}

(Ravonline) -

http://download.rising.com.cn/QQ/QQkill/rsonline.ca

b
O16 - DPF: {E1999001-4FD8-46D9-8A6A-E04E31A4E694}

(FileClient Control) -

http://www.infosec365.com.cn/activex/FileClient.ocx
O16 - DPF: {F3F7FD70-3472-4908-B3E2-2126DC73E726}

(MachineInfo Class) -

http://218.70.111.54:8080/oa_/mac.dll
O17 -

HKLM\System\CCS\Services\Tcpip\..\{B620236B-F434-42

15-BB1C-393BB1C358A9}: NameServer = 211.92.8.161
O18 - 列举现有的协议: dic -

{C21F5C32-F57A-4A0D-8E0A-B672691C52D0} -

d:\PROGRA~1\Kingsoft\POWERW~1\XDictExB.dll (file

missing)
O20 - AppInit_DLLs: APIHookDll.dll
O20 - Winlogon Notify: igfxcui -

C:\WINNT\SYSTEM32\igfxsrvc.dll
O23 - NT 服务: Crypkey License - Unknown owner -

crypserv.exe (file missing)
O23 - NT 服务: Logical Disk Manager Administrative

Service (dmadmin) - VERITAS Software Corp. -

C:\WINNT\System32\dmadmin.exe
O23 - NT 服务: Rising Proxy  Service (RfwProxySrv)

- Beijing Rising Technology Co., Ltd. - c:\program

files\rising\rfw\rfwproxy.exe
O23 - NT 服务: Rising Personal Firewall Service

(RfwService) - Beijing Rising Technology Co., Ltd.

- c:\program files\rising\rfw\rfwsrv.exe
O23 - NT 服务: Rising Process Communication Center

(RsCCenter) - Beijing Rising Technology Co., Ltd. -

C:\Program Files\rising\Rav\CCenter.exe
O23 - NT 服务: RsRavMon Service (RsRavMon) -

Beijing Rising Technology Co., Ltd. - C:\Program

Files\rising\Rav\Ravmond.exe

这么乱的日志啊

日志没有问题
机器有什么异常

机器没什么异常,就是那个防火墙提示灰鸽子让人担心