最近,用hijackthis 扫描,发现有个奇怪的服务:
023 NT服务 windows createddos (windows precessdos)
它的路径是 c:\windows\system32\svch0st.exe
幸好 后面注的是 (file missing) 所以这个服务实际上是不可能会活动的,因为记得以前已经把svch0st.exe删除了.
原以为,在hijackthis 中勾选--修复,就可以轻松把它驱逐出境的.谁知道,还驱除不掉.后来用SREng2,也不能删除windows createddos 服务,用360安全卫士也不能修复这项.
在注册表里找到不少和windows createddos ,windows precessdos 以及svch0st.exe有关的项,因为不太了解,不敢删.
虽然这个服务事实上已经不起作用,但是想把它从系统中删除,以免后患.
请问,有什么方法可以把它清除掉?
谢谢!
=====================================================
下面是日志
HijackThis_zww汉化版扫描日志 V1.99.1
保存于 14:54:06, 日期 2006-10-15
操作系统： Windows XP SP1 (WinNT 5.01.2600)
浏览器： Internet Explorer v6.00 SP1 (6.00.2800.1106)
当前运行的进程：
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Network Associates\VirusScan\SHSTAT.EXE
C:\WINDOWS\System32\ctfmon.exe
C:\Program Files\Network Associates\Common Framework\FrameworkService.exe
C:\Program Files\Network Associates\VirusScan\Mcshield.exe
C:\Program Files\Network Associates\VirusScan\VsTskMgr.exe
D:\悲愤\优选工具1\Ava find pro-G\AvaFind Pro\AvaFind Pro\AvaFind.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
D:\新18种工具\hijackThis\HijackThis1991zww.exe
O3 - IE工具栏增项: 电台(&R) - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O4 - 启动项HKLM\\Run: [ShStatEXE] "C:\Program Files\Network Associates\VirusScan\SHSTAT.EXE" /STANDALONE
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\System32\ctfmon.exe
O16 - DPF: {0CA54D3F-CEAE-48AF-9A2B-31909CB9515D} (Edit Class) - https://www.sz1.cmbchina.com/download/CMBEdit.cab
O16 - DPF: {ECCBA953-80E5-11D3-9285-0080ADB811C5} (safeInput Class) -
O17 - HKLM\System\CCS\Services\Tcpip\..\{0A35F636-BF73-4FA3-A625-CCF3C3B8E140}: NameServer = 211.167.97.200,211.167.97.67
O17 - HKLM\System\CCS\Services\Tcpip\..\{14C4942E-08CB-4960-8A4D-FAC13B0A5250}: NameServer = 211.167.97.200,211.167.97.67
O17 - HKLM\System\CCS\Services\Tcpip\..\{BCEA3C85-442E-4F98-9213-E1E9DC51E48A}: NameServer = 219.233.241.166,211.167.97.67
O17 - HKLM\System\CS1\Services\Tcpip\..\{0A35F636-BF73-4FA3-A625-CCF3C3B8E140}: NameServer = 211.167.97.200,211.167.97.67
O18 - 列举现有的协议: dic - {C21F5C32-F57A-4A0D-8E0A-B672691C52D0} - C:\Program Files\Kingsoft\Powerword 2003\XDictExB.dll
O18 - 列举现有的协议: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - 列举现有的协议: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O20 - Winlogon Notify: System Safety Monitor - C:\WINDOWS\SYSTEM32\SSMWinlogonEx.dll
O23 - NT 服务: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - NT 服务: McAfee Framework 服务 (McAfeeFramework) - Network Associates, Inc. - C:\Program Files\Network Associates\Common Framework\FrameworkService.exe
O23 - NT 服务: Network Associates McShield (McShield) - Network Associates, Inc. - C:\Program Files\Network Associates\VirusScan\Mcshield.exe
O23 - NT 服务: Network Associates Task Manager (McTaskManager) - Network Associates, Inc. - C:\Program Files\Network Associates\VirusScan\VsTskMgr.exe
O23 - NT 服务: Windows Createddos (Windows Processdos) - Unknown owner - C:\WINDOWS\System32\SVCH0ST.exe (file missing)
