瑞星卡卡安全论坛技术交流区反病毒/反流氓软件论坛 中了灰鸽子,我的进程如下,请帮忙看看,谢谢!

12   1  /  2  页   跳转

中了灰鸽子,我的进程如下,请帮忙看看,谢谢!

中了灰鸽子,我的进程如下,请帮忙看看,谢谢!

O9 - Extra 'Tools' menuitem: 易趣购物 - {DE607144-AC19-424e-860A-0D70ABDF119A} - http://click2.ad4all.net/url2/urlmanage/url.asp?id=5 (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {5DD731E6-D4F0-11D3-BE3F-00105A6FDA50} (V3ProX Control) - http://origin-www.ahn.com.cn/aspservice/plugin/myv3.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1127195342526
O17 - HKLM\System\CCS\Services\Tcpip\..\{5F3D1C28-6E63-426A-A28A-2874246204B9}: NameServer = 202.106.0.20
O17 - HKLM\System\CCS\Services\Tcpip\..\{85BDF2B0-FB4E-4BC6-8161-8ACCFC9D6B7F}: NameServer = 202.106.0.20 202.106.46.151
O23 - Service: Background Intel1igent Transfe - Unknown owner - C:\WINDOWS\dssa
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: PPPoE Service (PPPoEService) - Unknown owner - C:\PROGRA~1\北京通信\宽带E~1\app\pppoeservice.exe
O23 - Service: Rising Process Communication Center (RsCCenter) - rising - C:\PROGRAM FILES\RISING\RAV\CCENTER.EXE
O23 - Service: RsRavMon Service (RsRavMon) - Beijing Rising Technology Co., Ltd. - C:\PROGRAM FILES\RISING\RAV\Ravmond.exe
O23 - Service: SecuROM User Access Service (V7) (UserAccess7) - Sony DADC Austria AG. - C:\WINDOWS\system32\UAService7.exe
最后编辑2005-10-30 22:48:07
分享到:
gototop
 

O23 - Service: Background Intel1igent Transfe - Unknown owner - C:\WINDOWS\dssa
gototop
 

我在注册表
HKEY_LOCAL_MACHINE\ SYSTEM \ CURRENTCONTROLSET \ SERVICES分支  这里找不到dssa这一项......
gototop
 

找Background Intel1igent Transfe
gototop
 

在注册表中找这个吗?没有
gototop
 

你扫描出来的这个 C:\WINDOWS\dssa
怎么没后缀?
gototop
 

我也在奇怪这件事.我中的是backdoor.Gpigeon.sw.论坛里看到一位朋友发贴和我中的同样的毒,它发的进程中有C:\WINDOWS\dssa,还有C:\WINDOWS\diskman.exe,我就只有C:\WINDOWS\dssa
gototop
 

dssa
在注册表中,编辑查找dssa,找到这个所在的项删除
gototop
 

这个我也找过了,没有......
gototop
 

C:\WINDOWS\dssa
找到这个文件打包上传到virusdied@yahoo.com.cn
gototop
 
12   1  /  2  页   跳转
页面顶部
Powered by Discuz!NT