【求助】WIN32服务中被植入木马,斑竹和各位大虾看看怎么解决啊,小弟谢拉 - 瑞星卡卡安全论坛bbs.ikaka.com

瑞星卡卡安全论坛技术交流区 反病毒/反流氓软件论坛【求助】WIN32服务中被植入木马,斑竹和各位大虾看看怎么解决啊,小弟谢拉

	瑞星“1+2”全新解决方案巡展在广州画上圆满句号		叶院长揭秘：瑞星如何运用AI技术革新网络安全		俄乌冲突加剧网络攻击风险白俄罗斯政府遭APT攻击		瑞星ESM防病毒系统助力矿业大学筑牢网络安全防线
	实力拉满瑞星第五十次通过VB100测评		携手老友，拥抱新精彩 —— 新论坛新活动，感谢你的陪伴		护航司法，瑞星助力山西省高院构建安全防线		人工智能在网络安全领域的风险和机遇

1

1 / 1 页

跳转页

【求助】WIN32服务中被植入木马,斑竹和各位大虾看看怎么解决啊,小弟谢拉

⒏ヤＦēｎ掱初生襁褓狮帖子:28 注册: 2006-08-13 来自:	发表于： 2007-02-13 22:24 \| 只看楼主短消息资料字号：小中大 1楼【求助】WIN32服务中被植入木马,斑竹和各位大虾看看怎么解决啊,小弟谢拉 [复制到剪贴板] CODE: 2007-02-13,22:10:31 System Repair Engineer 2.3.13.690 Smallfrogs (http://www.KZTechs.com) Windows XP Home Edition Service Pack 1 (Build 2600) - 管理权限用户 - 完整功能以下内容被选中：所有的启动项目（包括注册表、启动文件夹、服务等）启动项目注册表 [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run] <ctfmon.exe><C:\WINDOWS\System32\ctfmon.exe> [(Verified)Microsoft Corporation] <RegBar><regsvr32.exe /u C:\progra~1\blogmark\bocaitoolbar.dll /s /i /n> [N/A] [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run] <PHIME2002ASync><C:\WINDOWS\System32\IME\TINTLGNT\TINTSETP.EXE /SYNC> [(Verified)Microsoft Corporation] <PHIME2002A><C:\WINDOWS\System32\IME\TINTLGNT\TINTSETP.EXE /IMEName> [(Verified)Microsoft Corporation] <IgfxTray><C:\WINDOWS\System32\igfxtray.exe> [(Verified)Intel Corporation] <HotKeysCmds><C:\WINDOWS\System32\hkcmd.exe> [(Verified)Intel Corporation] <PmProxy><C:\Program Files\Analog Devices\SoundMAX\PmProxy.exe> [adi] <00THotkey><C:\WINDOWS\System32\00THotkey.exe> [东芝公司] <000StTHK><000StTHK.exe> [N/A] <LTSMMSG><LTSMMSG.exe> [LT] <Tpwrtray><TPWRTRAY.EXE> [东芝公司] <TFNF5><TFNF5.exe> [Toshiba Corp.] <Apoint><C:\Program Files\Apoint2K\Apoint.exe> [(Verified)Alps Electric Co., Ltd.] <TouchED><C:\Program Files\TOSHIBA\TouchED\TouchED.Exe> [东芝公司] <Drag'n Drop CD+DVD><C:\Program Files\Drag'n Drop CD+DVD\BinFiles\DragDrop.exe /StartUp> [N/A] <MSPY2002><C:\WINDOWS\System32\IME\PINTLGNT\ImScInst.exe /SYNC> [(Verified)N/A] <KernelFaultCheck><%systemroot%\system32\dumprep 0 -k> [N/A] <StormCodec_Helper><"C:\Program Files\Ringz Studio\Storm Codec\StormSet.exe" /S /opti> [N/A] <RfwMain><"C:\Program Files\Rising\Rfw\rfwmain.exe" -Startup> [Beijing Rising Technology Co., Ltd.] <RavTask><"C:\Program Files\Rising\Rav\RavTask.exe" -system> [Beijing Rising Technology Co., Ltd.] <runeip><C:\Program Files\Rising\KakaToolBar\runiep.exe> [Beijing Rising Technology Co., Ltd.] <360Safetray><C:\Program Files\360safe\safemon\360Tray.exe /start> [奇虎网] [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon] <shell><Explorer.exe> [(Verified)Microsoft Corporation] <Userinit><C:\WINDOWS\System32\userinit.exe,> [(Verified)Microsoft Corporation] <UIHost><logonui.exe> [(Verified)Microsoft Corporation] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks] <{32CD708B-60A7-4C00-9377-D73EAA495F0F}><C:\WINDOWS\system32\RavExt.dll> [Beijing Rising Technology Co., Ltd.] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\Updatenm] <WinlogonNotify: Updatenm><upern.dll> [Microsoft Corporation] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\xyzDown] <WinlogonNotify: xyzDown><xyzDown.dll> [N/A] ================================== 启动文件夹 N/A ================================== 服务 [Application Management / AppMgmt][Stopped/Manual Start] <C:\WINDOWS\system32\svchost.exe -k netsvcs-->%SystemRoot%\System32\appmgmts.dll><N/A> [Logical Disk Manager / dmserver][Stopped/Disabled] <C:\WINDOWS\System32\svchost.exe -k netsvcs-->%SystemRoot%\System32\pwkbypkr.d1l><N/A> [DVD-RAM_Service / DVD-RAM_Service][Running/Auto Start] <C:\WINDOWS\System32\DVDRAMSV.exe><Matsushita Electric Industrial Co., Ltd.> [Human Interface Device Access / HidServ][Stopped/Disabled] <C:\WINDOWS\System32\svchost.exe -k netsvcs-->%SystemRoot%\System32\hidserv.dll><N/A> [Rising Proxy Service / RfwProxySrv][Stopped/Manual Start] <c:\program files\rising\rfw\rfwproxy.exe><Beijing Rising Technology Co., Ltd.> [Rising Personal Firewall Service / RfwService][Running/Auto Start] <c:\program files\rising\rfw\rfwsrv.exe><Beijing Rising Technology Co., Ltd.> [Rising Process Communication Center / RsCCenter][Running/Auto Start] <"C:\Program Files\Rising\Rav\CCenter.exe"><Beijing Rising Technology Co., Ltd.> [Rising RealTime Monitor / RsRavMon][Running/Auto Start] <"C:\Program Files\Rising\Rav\Ravmond.exe"><Beijing Rising Technology Co., Ltd.> [SoundMAX Agent Service / SoundMAX Agent Service (default)][Running/Auto Start] <C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe><Analog Devices, Inc.> ================================== 驱动程序 [ADProt / ADProt][Stopped/System Start] <system32\drivers\ADProt.sys><腾讯科技（深圳）有限公司> [aeaudio / aeaudio][Running/Manual Start] <system32\drivers\aeaudio.sys><Andrea Electronics Corporation> [Alps Pointing-device Filter Driver / ApfiltrService][Running/Manual Start] <System32\DRIVERS\Apfiltr.sys><Alps Electric Co., Ltd.> [Rising TDI Base Driver / BaseTDI][Running/Auto Start] <System32\DRIVERS\BaseTDI.SYS><Beijing Rising Technology Co., Ltd.> [Cdsys / Cdsys][Stopped/Manual Start] <\??\C:\WINDOWS\System32\cdcd.sys><N/A> [Intel(R) PRO Adapter Driver / E100B][Running/Manual Start] <System32\DRIVERS\e100b325.sys><Intel Corporation> [ExpScaner / ExpScaner][Running/Auto Start] <\??\C:\Program Files\Rising\Rav\ExpScan.sys><> [fsjajkr / fsjajkr][Running/Boot Start] <\SystemRoot\system32\drivers\fsjajkr.sys><> [HookCont / HookCont][Running/Auto Start] <\??\C:\Program Files\Rising\Rav\HOOKCONT.sys><Rising> [HookReg / HookReg][Running/Auto Start] <\??\C:\Program Files\Rising\Rav\HookReg.sys><> [HookSys / HookSys][Running/Auto Start] <\??\C:\Program Files\Rising\Rav\HookSys.sys><Rising> [HookUrl / HookUrl][Running/Auto Start] <\??\C:\Program Files\Rising\Rfw\HookUrl.sys><Beijing Rising Technology Co., Ltd.> [ialm / ialm][Running/Manual Start] <System32\DRIVERS\ialmnt5.sys><Intel Corporation> [kmsinput / kmsinput][Stopped/Manual Start] <\??\C:\WINDOWS\System32\drivers\kmsinput.sys><N/A> [KWatch3 / KWatch3][Running/System Start] <\??\C:\WINDOWS\System32\drivers\KWatch3.SYS><Kingsoft Corporation> [meiudf / meiudf][Running/System Start] <System32\Drivers\meiudf.sys><Matsushita Electric Industrial Co.,Ltd.> [MEMSCAN / MEMSCAN][Running/Auto Start] <\??\C:\Program Files\Rising\Rav\MEMSCAN.sys><瑞星软件有限公司> [mProcRs / mProcRs][Running/Auto Start] <\??\c:\program files\rising\rfw\mProcRs.sys><Beijing Rising Technology Co., Ltd.> [New0 / New0][Running/Auto Start] <\??\C:\WINDOWS\System32\new.sys><N/A> [npkcrypt / npkcrypt][Running/Auto Start] <\??\C:\Program Files\Tencent\QQ\npkcrypt.sys><INCA Internet Co., Ltd.> [npkycryp / npkycryp][Stopped/Manual Start] <\??\C:\Program Files\Tencent\QQ\npkycryp.sys><N/A> [PSSdk21 / PSSdk21][Stopped/Manual Start] <\??\C:\WINDOWS\System32\Drivers\HNPsSdk.drv><N/A> [Direct Parallel Link Driver / Ptilink][Running/Manual Start] <System32\DRIVERS\ptilink.sys><Parallel Technologies, Inc.> [pwkbypkr / pwkbypkr][Stopped/Manual Start] <\??\C:\WINDOWS\System32\drivers\pwkbypkr.sys><N/A> [PxHelp20 / PxHelp20][Running/Boot Start] <\SystemRoot\System32\DRIVERS\PxHelp20.sys><VERITAS Software, Inc.> [RsAntiSpyware / RsAntiSpyware][Stopped/Disabled] <\SystemRoot\System32\drivers\RsBoot.sys><Beijing Rising> [RsFwDrv / RsFwDrv][Running/Auto Start] <\??\C:\Program Files\Rising\Rfw\RsFwDrv.sys><Beijing Rising Technology Co., Ltd.> [RsNTGDI / RsNTGDI][Running/Boot Start] <\SystemRoot\System32\Drivers\RsNTGdi.sys><Beijing Rising Technology Co., Ltd.> [RSPPSYS / RSPPSYS][Running/Auto Start] <\??\C:\Program Files\Rising\Rav\RSPPSYS.sys><Rising> [Secdrv / Secdrv][Stopped/Manual Start] <System32\DRIVERS\secdrv.sys><Macrovision Corporation, Macrovision Europe Limited, and Macrovision Japan and Asia K.K.> [smwdm / smwdm][Running/Manual Start] <system32\drivers\smwdm.sys><Analog Devices, Inc.> [Sony USB Filter Driver (SONYPVU1) / SONYPVU1][Stopped/Manual Start] <System32\DRIVERS\SONYPVU1.SYS><Sony Corporation> [STEC3 / STEC3][Running/Auto Start] <\??\C:\WINDOWS\System32\STEC3.sys><AntiCracking> [SVKP / SVKP][Running/Auto Start] <\??\C:\WINDOWS\System32\SVKP.sys><AntiCracking> [TOSHIBA Software Modem / TOSHIBASoftModem][Running/Manual Start] <System32\DRIVERS\LTSM.sys><LT> [Toshiba ACPI-Based Value Added Logical Device Driver / TVALD][Running/Boot Start] <\SystemRoot\System32\DRIVERS\TVALD.SYS><Toshiba Corporation> [Toshiba Value Added Logical and General Purpose Device Driver / TVALG][Running/Boot Start] <\SystemRoot\System32\DRIVERS\TVALG.SYS><TOSHIBA Corporation> [World Standard Teletext Codec / WSTCODEC][Stopped/Manual Start] <System32\DRIVERS\WSTCODEC.SYS><Microsoft Corporation> [NTPort Library Driver / zntport][Stopped/Auto Start] <\??\C:\WINDOWS\System32\zntport.sys><N/A> [VIMICRO USB PC Camera 301x / ZSMC301b][Running/Manual Start] <System32\Drivers\usbVM31b.sys><VM> [Intel(R) Graphics Platform (SoftBIOS) Driver / {6080A529-897E-4629-A488-ABA0C29B635E}][Running/Manual Start] <system32\drivers\ialmsbw.sys><Intel Corporation> [Intel(R) Graphics Chipset (KCH) Driver / {D31A0762-0CEB-444e-ACFF-B049A1F6FE91}][Running/Manual Start] <system32\drivers\ialmkchw.sys><Intel Corporation> [AIM 3.0 Part 01 Codec Driver CH-7009-A/CH-7011 / {E2B953A6-195A-44F9-9BA3-3D5F4E32BB55}][Stopped/Manual Start] <system32\drivers\wA301a.sys><Intel Corporation> ================================== 浏览器加载项 N/A ================================== 正在运行的进程 N/A ================================== 文件关联 N/A ================================== Winsock 提供者 N/A ================================== Autorun.inf N/A ================================== HOSTS 文件 N/A ================================== API HOOK 警告！System Repair Engineer 提醒你下面的函数内容与预期值不符，他们可能被一些恶意的软件所修改：入口点错误：CreateProcessA 入口点错误：CreateProcessW ================================== 2007-02-13 22:24:40.780000000
⒏ヤＦēｎ掱初生襁褓狮帖子:28 注册: 2006-08-13 来自:	分享到：

<<上一主题|下一主题>>

1

1 / 1 页

跳转页

页面顶部

Powered by Discuz!NT