求助，请帮忙看下这个怎么解决？？？ - 瑞星卡卡安全论坛bbs.ikaka.com

瑞星卡卡安全论坛技术交流区 反病毒/反流氓软件论坛求助，请帮忙看下这个怎么解决？？？

	瑞星“1+2”全新解决方案巡展在广州画上圆满句号		叶院长揭秘：瑞星如何运用AI技术革新网络安全		俄乌冲突加剧网络攻击风险白俄罗斯政府遭APT攻击		瑞星ESM防病毒系统助力矿业大学筑牢网络安全防线
	实力拉满瑞星第五十次通过VB100测评		携手老友，拥抱新精彩 —— 新论坛新活动，感谢你的陪伴		护航司法，瑞星助力山西省高院构建安全防线		人工智能在网络安全领域的风险和机遇

1

1 / 1 页

跳转页

求助，请帮忙看下这个怎么解决？？？

满天飞雪初生襁褓狮帖子:211 注册: 2006-06-17 来自:	发表于： 2006-06-17 22:44 \| 只看楼主短消息资料字号：小中大 1楼求助，请帮忙看下这个怎么解决？？？现在把扫描的日志发上来。未知家族病毒分析扫描结果: C:\WINNT\LSASS.exe --> 与 Trojan.PSW.Misc 88%相似. 系统活动进程 C:\WINNT\SYSTEM32\SMSS.EXE C:\WINNT\SYSTEM32\CSRSS.EXE C:\WINNT\SYSTEM32\WINLOGON.EXE C:\WINNT\SYSTEM32\WDMAUD.DRV C:\WINNT\SYSTEM32\MSACM32.DRV C:\WINNT\SYSTEM32\SERVICES.EXE C:\WINNT\VMAILDOG.DLL C:\WINNT\SYSTEM32\LSASS.EXE C:\WINNT\VMAILDOG.DLL C:\WINNT\SYSTEM32\LOCATOR.EXE C:\WINNT\SYSTEM32\SVCHOST.EXE C:\WINNT\VMAILDOG.DLL C:\WINNT\SYSTEM32\SVCHOST.EXE C:\PROGRAM FILES\ICDREAMSERVER\ICDBIGBROTHER.EXE C:\WINNT\VMAILDOG.DLL C:\PROGRAM FILES\ICDREAMSERVER\ICDREAMCHECKSERVICE.EXE C:\WINNT\VMAILDOG.DLL C:\PROGRAM FILES\ICDREAMSERVER\ICDREAMDCSERVICE.EXE C:\PROGRAM FILES\ICDREAMSERVER\ATL71.DLL C:\WINNT\VMAILDOG.DLL C:\PROGRAM FILES\ICDREAMSERVER\ICDREAMSERVER.EXE C:\PROGRAM FILES\ICDREAMSERVER\COMMMODULE.DLL C:\PROGRAM FILES\ICDREAMSERVER\MFC71D.DLL C:\PROGRAM FILES\ICDREAMSERVER\MSVCR71D.DLL C:\PROGRAM FILES\ICDREAMSERVER\MSVCP71D.DLL C:\PROGRAM FILES\ICDREAMSERVER\ZIPDLL.DLL C:\WINNT\VMAILDOG.DLL C:\WINNT\SYSTEM32\LLSSRV.EXE C:\PROGRAM FILES\ICDREAMSERVER\REMOTESERVER.EXE C:\WINNT\VMAILDOG.DLL C:\WINNT\SYSTEM32\SVCHOST.EXE C:\WINNT\SYSTEM32\UNIMDM.TSP C:\WINNT\SYSTEM32\KMDDSP.TSP C:\WINNT\SYSTEM32\NDPTSP.TSP C:\WINNT\SYSTEM32\IPCONF.TSP C:\WINNT\SYSTEM32\H323.TSP C:\WINNT\SYSTEM32\TERMSRV.EXE C:\WINNT\SYSTEM32\WBEM\WINMGMT.EXE C:\WINNT\SYSTEM32\SVCHOST.EXE C:\WINNT\VMAILDOG.DLL C:\WINNT\SYSTEM32\SVCHOST.EXE C:\WINNT\VMAILDOG.DLL C:\WINNT\SYSTEM32\DFSSVC.EXE C:\WINNT\SYSTEM32\MSDTC.EXE C:\WINNT\VMAILDOG.DLL C:\WINNT\EXPLORER.EXE C:\PROGRA~1\WINKLD\WINKLD.DAT C:\WINNT\SYSTEM32\RAVEXT.DLL C:\WINNT\SYSTEM32\IGFXPPH.DLL C:\WINNT\SYSTEM32\HCCUTILS.DLL C:\WINNT\SYSTEM32\IGFXRES.DLL C:\WINNT\SYSTEM32\IGFXSRVC.DLL C:\WINNT\SYSTEM32\IGFXDEV.DLL C:\WINNT\SYSTEM32\XUNLEIBHO_V14.DLL C:\WINNT\SYSTEM32\MSVCP60.DLL C:\WINNT\SYSTEM32\WDMAUD.DRV C:\WINNT\SYSTEM32\MSACM32.DRV C:\WINNT\SYSTEM32\MSADP32.ACM C:\PROGRAM FILES\RISING\RAV\RAVSCRCH.DLL C:\PROGRAM FILES\WINRAR\RAREXT.DLL C:\PROGRAM FILES\ICDREAMSERVER\REMOTESERVER.EXE C:\WINNT\VMAILDOG.DLL C:\PROGRAM FILES\COMMON FILES\REAL\UPDATE_OB\REALSCHED.EXE C:\WINNT\SYSTEM32\INTERNAT.EXE C:\PROGRAM FILES\INTERNET EXPLORER\IEXPLORE.EXE C:\WINNT\SYSTEM32\XUNLEIBHO_V14.DLL C:\WINNT\SYSTEM32\MSVCP60.DLL C:\PROGRAM FILES\JAVA\JRE1.5.0_06\BIN\SSV.DLL C:\WINNT\VMAILDOG.DLL C:\PROGRAM FILES\RISING\RAV\RAVSCRCH.DLL C:\WINNT\SYSTEM32\MACROMED\FLASH\FLASH8A.OCX C:\WINNT\SYSTEM32\WDMAUD.DRV C:\WINNT\SYSTEM32\MSACM32.DRV C:\WINNT\SYSTEM32\MSADP32.ACM C:\WINNT\SYSTEM32\MACROMED\COMMON\SWSUPPORT.DLL C:\WINNT\SYSTEM32\WINABC.IME C:\PROGRAM FILES\ICDREAMSERVER\RAVSYS.EXE C:\PROGRAM FILES\ICDREAMSERVER\MSVCP71D.DLL C:\PROGRAM FILES\ICDREAMSERVER\MSVCR71D.DLL C:\PROGRAM FILES\ICDREAMSERVER\MFC71D.DLL C:\WINNT\VMAILDOG.DLL C:\WINNT\LSASS.EXE C:\WINNT\SYSTEM32\MSVBVM50.DLL C:\WINNT\SYSTEM32\VB5CHS.DLL C:\PROGRAM FILES\RISING\RAV\PSAPI.DLL C:\WINNT\VMAILDOG.DLL C:\PROGRAM FILES\RISING\RAV\RAVSCRCH.DLL C:\PROGRAM FILES\HINTSOFT\PUBSRV\PUBSRV.EXE C:\WINNT\SYSTEM32\MSVBVM60.DLL C:\WINNT\SYSTEM32\RZX_CARDID.DLL C:\WINNT\VMAILDOG.DLL C:\WINNT\SYSTEM32\MSADO15.DLL C:\PROGRAM FILES\HINTSOFT\DATAMNG\CTRLMEMOBJS.DLL C:\PROGRAM FILES\HINTSOFT\PUBSRV\GCARDBUSOBJS.DLL C:\WINNT\SYSTEM32\FM20.DLL C:\WINNT\SYSTEM32\FM20CHS.DLL C:\WINNT\SYSTEM32\WDMAUD.DRV C:\WINNT\SYSTEM32\MSACM32.DRV C:\PROGRAM FILES\HINTSOFT\DATAMNG\CTRLDBOBJS.DLL C:\PROGRAM FILES\HINTSOFT\PUBSRV\RECBMP.EXE C:\WINNT\VMAILDOG.DLL C:\PROGRAM FILES\HINTSOFT\PUBSRV\LOCKCLIENT.EXE C:\WINNT\VMAILDOG.DLL C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\RSDETECT.EXE 普通自启动项 HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run ToP = C:\WINNT\LSASS.EXE ICDRemoteServer = C:\PROGRAM FILES\ICDREAMSERVER\REMOTESERVER.EXE TkBellExe = "C:\PROGRAM FILES\COMMON FILES\REAL\UPDATE_OB\REALSCHED.EXE" -OSBOOT RavTask = "C:\PROGRAM FILES\RISING\RAV\RAVTASK.EXE" -SYSTEM RavScanBD = "C:\PROGRAM FILES\RISING\RAV\SCANBD.EXE" /INST HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run internat.exe = INTERNAT.EXE HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\Run DhcpCep = C:\WINNT\SYSTEM32\PYJJKIME.EXE KB83072651 = C:\WINNT\SYSTEM32\APPEVENT.EXE AppInit_DLLs HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows AppInit_DLLs = 系统文件关联 .exe ==> WindowFiles = C:\WINNT\EXERT.exe "%1" %* .com ==> comfile = "%1" %* .cmd ==> cmdfile = "%1" %* .bat ==> batfile = "%1" %* .txt ==> txtfile = Notepad.exe %1 .scr ==> scrfile = "%1" /S .reg ==> regfile = regedit.exe "%1" 其它启动项 D:\Autorun.inf AUTORUN = D:\command.com WIN.INI 无信息 SYSTEM.INI SHELL = Explorer.exe 2006-06-17 22:46:52
满天飞雪初生襁褓狮帖子:211 注册: 2006-06-17 来自:	分享到：

满天飞雪初生襁褓狮帖子:211 注册: 2006-06-17 来自:	发表于： 2006-06-17 22:46 \| 只看楼主短消息资料字号：小中大 2楼 Winlogon 启动项 HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify crypt32chain = CRYPT32.DLL cryptnet = CRYPTNET.DLL cscdll = CSCDLL.DLL igfxcui = IGFXSRVC.DLL nwprovau = NWPROVAU.DLL sclgntfy = SCLGNTFY.DLL SensLogn = WLNOTIFY.DLL termsrv = WLNOTIFY.DLL wzcnotif = WZCDLG.DLL HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon Userinit = C:\WINNT\SYSTEM32\USERINIT.EXE shell = EXPLORER.EXE IE - BHO HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects {0005A87D-D626-4B3A-84F9-1D9571695F55} = C:\WINNT\system32\xunleibho_v14.dll {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} = C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll {F1FABE79-25FC-46de-8C5A-2C6DB9D64333} = C:\WINNT\system32\AlxTB1.dll Winsock SPI MSAFD Tcpip [TCP/IP] = C:\WINNT\VMAILDOG.DLL MSAFD Tcpip [UDP/IP] = C:\WINNT\VMAILDOG.DLL MSAFD Tcpip [RAW/IP] = C:\WINNT\VMAILDOG.DLL RSVP UDP Service Provider = C:\WINNT\VMAILDOG.DLL RSVP TCP Service Provider = C:\WINNT\VMAILDOG.DLL MSAFD nwlnkipx [IPX] = C:\WINNT\SYSTEM32\MSAFD.DLL MSAFD nwlnkspx [SPX] = C:\WINNT\SYSTEM32\MSAFD.DLL MSAFD nwlnkspx [SPX] [Pseudo Stream] = C:\WINNT\SYSTEM32\MSAFD.DLL MSAFD nwlnkspx [SPX II] = C:\WINNT\SYSTEM32\MSAFD.DLL MSAFD nwlnkspx [SPX II] [Pseudo Stream] = C:\WINNT\SYSTEM32\MSAFD.DLL MSAFD NetBIOS [\Device\NwlnkNb] SEQPACKET 7 = C:\WINNT\SYSTEM32\MSAFD.DLL MSAFD NetBIOS [\Device\NwlnkNb] DATAGRAM 7 = C:\WINNT\SYSTEM32\MSAFD.DLL MSAFD NetBIOS [\Device\Nbf_{68E34D2B-2F43-40BE-9E1C-94EFB64917A0}] SEQPACKET 14 = C:\WINNT\SYSTEM32\MSAFD.DLL MSAFD NetBIOS [\Device\Nbf_{68E34D2B-2F43-40BE-9E1C-94EFB64917A0}] DATAGRAM 14 = C:\WINNT\SYSTEM32\MSAFD.DLL MSAFD NetBIOS [\Device\Nbf_{816B3CF8-62FA-4108-B9D1-E3F670F6A6A1}] SEQPACKET 22 = C:\WINNT\SYSTEM32\MSAFD.DLL MSAFD NetBIOS [\Device\Nbf_{816B3CF8-62FA-4108-B9D1-E3F670F6A6A1}] DATAGRAM 22 = C:\WINNT\SYSTEM32\MSAFD.DLL MSAFD NetBIOS [\Device\Nbf_{17F2521B-4B44-47DE-992B-B86087F4CC99}] SEQPACKET 20 = C:\WINNT\SYSTEM32\MSAFD.DLL MSAFD NetBIOS [\Device\Nbf_{17F2521B-4B44-47DE-992B-B86087F4CC99}] DATAGRAM 20 = C:\WINNT\SYSTEM32\MSAFD.DLL MSAFD NetBIOS [\Device\Nbf_{580EE6EE-6F27-4866-879A-5A7D1BA079AA}] SEQPACKET 18 = C:\WINNT\SYSTEM32\MSAFD.DLL MSAFD NetBIOS [\Device\Nbf_{580EE6EE-6F27-4866-879A-5A7D1BA079AA}] DATAGRAM 18 = C:\WINNT\SYSTEM32\MSAFD.DLL MSAFD NetBIOS [\Device\Nbf_{F7AAA2E5-2CDF-4D7C-B2BD-36DBBF810378}] SEQPACKET 16 = C:\WINNT\SYSTEM32\MSAFD.DLL MSAFD NetBIOS [\Device\Nbf_{F7AAA2E5-2CDF-4D7C-B2BD-36DBBF810378}] DATAGRAM 16 = C:\WINNT\SYSTEM32\MSAFD.DLL MSAFD NetBIOS [\Device\Nbf_{06680A5C-BFF7-4727-8D24-35AC0AC2E6B0}] SEQPACKET 10 = C:\WINNT\SYSTEM32\MSAFD.DLL MSAFD NetBIOS [\Device\Nbf_{06680A5C-BFF7-4727-8D24-35AC0AC2E6B0}] DATAGRAM 10 = C:\WINNT\SYSTEM32\MSAFD.DLL MSAFD NetBIOS [\Device\Nbf_{A9286C82-5B58-4FEC-8E40-65F5CC8E46C7}] SEQPACKET 0 = C:\WINNT\SYSTEM32\MSAFD.DLL MSAFD NetBIOS [\Device\Nbf_{A9286C82-5B58-4FEC-8E40-65F5CC8E46C7}] DATAGRAM 0 = C:\WINNT\SYSTEM32\MSAFD.DLL MSAFD NetBIOS [\Device\Nbf_NdisWanNbfIn{36F57B2A-B3EC-4DA6-A348-89F38C92A7FD}] SEQPACKET 4 = C:\WINNT\SYSTEM32\MSAFD.DLL MSAFD NetBIOS [\Device\Nbf_NdisWanNbfIn{36F57B2A-B3EC-4DA6-A348-89F38C92A7FD}] DATAGRAM 4 = C:\WINNT\SYSTEM32\MSAFD.DLL MSAFD NetBIOS [\Device\Nbf_NdisWanNbfIn{ACC31979-FCF3-4768-95D0-54A6BE1988E4}] SEQPACKET 5 = C:\WINNT\SYSTEM32\MSAFD.DLL MSAFD NetBIOS [\Device\Nbf_NdisWanNbfIn{ACC31979-FCF3-4768-95D0-54A6BE1988E4}] DATAGRAM 5 = C:\WINNT\SYSTEM32\MSAFD.DLL MSAFD NetBIOS [\Device\Nbf_NdisWanNbfOut{792FEB99-6CB7-495C-80F7-C816E6B058D1}] SEQPACKET 6 = C:\WINNT\SYSTEM32\MSAFD.DLL MSAFD NetBIOS [\Device\Nbf_NdisWanNbfOut{792FEB99-6CB7-495C-80F7-C816E6B058D1}] DATAGRAM 6 = C:\WINNT\SYSTEM32\MSAFD.DLL MSAFD NetBIOS [\Device\Nbf_NdisWanNbfOut{1E68B902-AFC4-4D3A-9C3B-0EA6DC11DB65}] SEQPACKET 8 = C:\WINNT\SYSTEM32\MSAFD.DLL MSAFD NetBIOS [\Device\Nbf_NdisWanNbfOut{1E68B902-AFC4-4D3A-9C3B-0EA6DC11DB65}] DATAGRAM 8 = C:\WINNT\SYSTEM32\MSAFD.DLL MSAFD NetBIOS [\Device\Nbf_NdisWanNbfOut{5DB39DC1-F0BC-45B5-A3FC-F42AEB86A624}] SEQPACKET 9 = C:\WINNT\SYSTEM32\MSAFD.DLL MSAFD NetBIOS [\Device\Nbf_NdisWanNbfOut{5DB39DC1-F0BC-45B5-A3FC-F42AEB86A624}] DATAGRAM 9 = C:\WINNT\SYSTEM32\MSAFD.DLL MSAFD NetBIOS [\Device\NetBT_Tcpip_{68E34D2B-2F43-40BE-9E1C-94EFB64917A0}] SEQPACKET 15 = C:\WINNT\SYSTEM32\MSAFD.DLL MSAFD NetBIOS [\Device\NetBT_Tcpip_{68E34D2B-2F43-40BE-9E1C-94EFB64917A0}] DATAGRAM 15 = C:\WINNT\SYSTEM32\MSAFD.DLL MSAFD NetBIOS [\Device\NetBT_Tcpip_{816B3CF8-62FA-4108-B9D1-E3F670F6A6A1}] SEQPACKET 23 = C:\WINNT\SYSTEM32\MSAFD.DLL MSAFD NetBIOS [\Device\NetBT_Tcpip_{816B3CF8-62FA-4108-B9D1-E3F670F6A6A1}] DATAGRAM 23 = C:\WINNT\SYSTEM32\MSAFD.DLL MSAFD NetBIOS [\Device\NetBT_Tcpip_{17F2521B-4B44-47DE-992B-B86087F4CC99}] SEQPACKET 21 = C:\WINNT\SYSTEM32\MSAFD.DLL MSAFD NetBIOS [\Device\NetBT_Tcpip_{17F2521B-4B44-47DE-992B-B86087F4CC99}] DATAGRAM 21 = C:\WINNT\SYSTEM32\MSAFD.DLL MSAFD NetBIOS [\Device\NetBT_Tcpip_{580EE6EE-6F27-4866-879A-5A7D1BA079AA}] SEQPACKET 19 = C:\WINNT\SYSTEM32\MSAFD.DLL MSAFD NetBIOS [\Device\NetBT_Tcpip_{580EE6EE-6F27-4866-879A-5A7D1BA079AA}] DATAGRAM 19 = C:\WINNT\SYSTEM32\MSAFD.DLL MSAFD NetBIOS [\Device\NetBT_Tcpip_{F7AAA2E5-2CDF-4D7C-B2BD-36DBBF810378}] SEQPACKET 17 = C:\WINNT\SYSTEM32\MSAFD.DLL MSAFD NetBIOS [\Device\NetBT_Tcpip_{F7AAA2E5-2CDF-4D7C-B2BD-36DBBF810378}] DATAGRAM 17 = C:\WINNT\SYSTEM32\MSAFD.DLL MSAFD NetBIOS [\Device\NetBT_Tcpip_{06680A5C-BFF7-4727-8D24-35AC0AC2E6B0}] SEQPACKET 11 = C:\WINNT\SYSTEM32\MSAFD.DLL MSAFD NetBIOS [\Device\NetBT_Tcpip_{06680A5C-BFF7-4727-8D24-35AC0AC2E6B0}] DATAGRAM 11 = C:\WINNT\SYSTEM32\MSAFD.DLL MSAFD NetBIOS [\Device\NetBT_Tcpip_{A9286C82-5B58-4FEC-8E40-65F5CC8E46C7}] SEQPACKET 3 = C:\WINNT\SYSTEM32\MSAFD.DLL MSAFD NetBIOS [\Device\NetBT_Tcpip_{A9286C82-5B58-4FEC-8E40-65F5CC8E46C7}] DATAGRAM 3 = C:\WINNT\SYSTEM32\MSAFD.DLL MSAFD NetBIOS [\Device\NetBT_Tcpip_{B1A5B1D2-DABC-42BD-8227-0E55C8D14E95}] SEQPACKET 1 = C:\WINNT\SYSTEM32\MSAFD.DLL MSAFD NetBIOS [\Device\NetBT_Tcpip_{B1A5B1D2-DABC-42BD-8227-0E55C8D14E95}] DATAGRAM 1 = C:\WINNT\SYSTEM32\MSAFD.DLL MSAFD NetBIOS [\Device\NetBT_Tcpip_{56E3E90D-387F-47DF-A6E6-8E2F44335079}] SEQPACKET 2 = C:\WINNT\SYSTEM32\MSAFD.DLL MSAFD NetBIOS [\Device\NetBT_Tcpip_{56E3E90D-387F-47DF-A6E6-8E2F44335079}] DATAGRAM 2 = C:\WINNT\SYSTEM32\MSAFD.DLL MSAFD NetBIOS [\Device\NetBT_Tcpip_{E20AF233-AE53-4191-829F-7F3BA09F663F}] SEQPACKET 12 = C:\WINNT\SYSTEM32\MSAFD.DLL MSAFD NetBIOS [\Device\NetBT_Tcpip_{E20AF233-AE53-4191-829F-7F3BA09F663F}] DATAGRAM 12 = C:\WINNT\SYSTEM32\MSAFD.DLL MSAFD NetBIOS [\Device\NetBT_Tcpip_{DD10CEBC-2BF7-4F48-983F-DA5F4D6E2402}] SEQPACKET 13 = C:\WINNT\SYSTEM32\MSAFD.DLL MSAFD NetBIOS [\Device\NetBT_Tcpip_{DD10CEBC-2BF7-4F48-983F-DA5F4D6E2402}] DATAGRAM 13 = C:\WINNT\SYSTEM32\MSAFD.DLL 系统服务项 HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services Alerter = C:\WINNT\SYSTEM32\SERVICES.EXE AppMgmt = C:\WINNT\SYSTEM32\SERVICES.EXE BITS = C:\WINNT\SYSTEM32\SVCHOST.EXE -K BITSGROUP Browser = C:\WINNT\SYSTEM32\SERVICES.EXE cisvc = C:\WINNT\SYSTEM32\CISVC.EXE ClipSrv = C:\WINNT\SYSTEM32\CLIPSRV.EXE Dfs = C:\WINNT\SYSTEM32\DFSSVC.EXE Dhcp = C:\WINNT\SYSTEM32\SERVICES.EXE dmadmin = C:\WINNT\SYSTEM32\DMADMIN.EXE /COM dmserver = C:\WINNT\SYSTEM32\SERVICES.EXE Dnscache = C:\WINNT\SYSTEM32\SERVICES.EXE Eventlog = C:\WINNT\SYSTEM32\SERVICES.EXE EventSystem = C:\WINNT\SYSTEM32\SVCHOST.EXE -K NETSVCS Fax = C:\WINNT\SYSTEM32\FAXSVC.EXE ICDBigBrother = C:\PROGRAM FILES\ICDREAMSERVER\ICDBIGBROTHER.EXE ICDreamCheckService = C:\PROGRAM FILES\ICDREAMSERVER\ICDREAMCHECKSERVICE.EXE ICDreamDCService = C:\PROGRAM FILES\ICDREAMSERVER\ICDREAMDCSERVICE.EXE ICDreamServer = C:\PROGRAM FILES\ICDREAMSERVER\ICDREAMSERVER.EXE IISADMIN = C:\WINNT\SYSTEM32\INETSRV\INETINFO.EXE IpServicer = C:\WINNT\SYSTEM32\SVCIP.EXE IsmServ = C:\WINNT\SYSTEM32\ISMSERV.EXE kdc = C:\WINNT\SYSTEM32\LSASS.EXE lanmanserver = C:\WINNT\SYSTEM32\SERVICES.EXE lanmanworkstation = C:\WINNT\SYSTEM32\SERVICES.EXE LicenseService = C:\WINNT\SYSTEM32\LLSSRV.EXE LmHosts = C:\WINNT\SYSTEM32\SERVICES.EXE Messenger = C:\WINNT\SYSTEM32\SERVICES.EXE mnmsrvc = C:\WINNT\SYSTEM32\MNMSRVC.EXE MSDTC = C:\WINNT\SYSTEM32\MSDTC.EXE MSFTPSVC = C:\WINNT\SYSTEM32\INETSRV\INETINFO.EXE MSIServer = C:\WINNT\SYSTEM32\MSIEXEC.EXE /V NetDDE = C:\WINNT\SYSTEM32\NETDDE.EXE NetDDEdsdm = C:\WINNT\SYSTEM32\NETDDE.EXE Netlogon = C:\WINNT\SYSTEM32\LSASS.EXE Netman = C:\WINNT\SYSTEM32\SVCHOST.EXE -K NETSVCS NntpSvc = C:\WINNT\SYSTEM32\INETSRV\INETINFO.EXE NtFrs = C:\WINNT\SYSTEM32\NTFRS.EXE NtLmSsp = C:\WINNT\SYSTEM32\LSASS.EXE NtmsSvc = C:\WINNT\SYSTEM32\SVCHOST.EXE -K NETSVCS PlugPlay = C:\WINNT\SYSTEM32\SERVICES.EXE PolicyAgent = C:\WINNT\SYSTEM32\LSASS.EXE ProtectedStorage = C:\WINNT\SYSTEM32\SERVICES.EXE RasAuto = C:\WINNT\SYSTEM32\SVCHOST.EXE -K NETSVCS RasMan = C:\WINNT\SYSTEM32\SVCHOST.EXE -K NETSVCS RemoteAccess = C:\WINNT\SYSTEM32\SVCHOST.EXE -K NETSVCS RemoteBoot = C:\WINNT\RPL\RPLSVC.EXE RemoteRegistry = C:\WINNT\SYSTEM32\REGSVC.EXE RpcLocator = C:\WINNT\SYSTEM32\LOCATOR.EXE RpcSs = C:\WINNT\SYSTEM32\SVCHOST -K RPCSS RsCCenter = "C:\PROGRAM FILES\RISING\RAV\CCENTER.EXE" RsRavMon = "C:\PROGRAM FILES\RISING\RAV\RAVMOND.EXE" RSVP = C:\WINNT\SYSTEM32\RSVP.EXE -S RzxSevce = C:\PROGRAM FILES\RZX\NET110\RZXSEVCE.EXE SamSs = C:\WINNT\SYSTEM32\LSASS.EXE SaService = C:\PROGRAM FILES\SYGATE\SON\SGSERV.EXE SCardDrv = C:\WINNT\SYSTEM32\SCARDSVR.EXE SCardSvr = C:\WINNT\SYSTEM32\SCARDSVR.EXE Schedule = C:\WINNT\SYSTEM32\MSTASK.EXE seclogon = C:\WINNT\SYSTEM32\SERVICES.EXE SENS = C:\WINNT\SYSTEM32\SVCHOST.EXE -K NETSVCS SharedAccess = C:\WINNT\SYSTEM32\SVCHOST.EXE -K NETSVCS SkServer = C:\QQ\SK.EXE SMTPSVC = C:\WINNT\SYSTEM32\INETSRV\INETINFO.EXE Spooler = C:\WINNT\SYSTEM32\SPOOLSV.EXE SysmonLog = C:\WINNT\SYSTEM32\SMLOGSVC.EXE TapiSrv = C:\WINNT\SYSTEM32\SVCHOST.EXE -K TAPISRV TermService = C:\WINNT\SYSTEM32\TERMSRV.EXE TlntSvr = C:\WINNT\SYSTEM32\TLNTSVR.EXE TrkSvr = C:\WINNT\SYSTEM32\SERVICES.EXE TrkWks = C:\WINNT\SYSTEM32\SERVICES.EXE UPS = C:\WINNT\SYSTEM32\UPS.EXE usprserv = C:\WINNT\SYSTEM32\SVCHOST.EXE -K NETSVCS UtilMan = C:\WINNT\SYSTEM32\UTILMAN.EXE W32Time = C:\WINNT\SYSTEM32\SERVICES.EXE W3SVC = C:\WINNT\SYSTEM32\INETSRV\INETINFO.EXE Windows Management NetWork Service Extensions = NETMANAGER.EXE -EXE_START WinMgmt = C:\WINNT\SYSTEM32\WBEM\WINMGMT.EXE WintUPp = C:\DOCUME~1\ADMINI~1\LOCALS~1\TEMP\WT\WT.EXE -R WmdmPmSN = C:\WINNT\SYSTEM32\SVCHOST.EXE -K NETSVCS Wmi = C:\WINNT\SYSTEM32\SERVICES.EXE wuauserv = C:\WINNT\SYSTEM32\SVCHOST.EXE -K WUGROUP WZCSVC = C:\WINNT\SYSTEM32\SVCHOST.EXE -K NETSVCS
满天飞雪初生襁褓狮帖子:211 注册: 2006-06-17 来自:

满天飞雪初生襁褓狮帖子:211 注册: 2006-06-17 来自:	发表于： 2006-06-17 22:46 \| 只看楼主短消息资料字号：小中大 3楼文件驱动 HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services DfsDriver = C:\WINNT\SYSTEM32\DRIVERS\DFS.SYS FltMgr = C:\WINNT\SYSTEM32\DRIVERS\FLTMGR.SYS MRxSmb = C:\WINNT\SYSTEM32\DRIVERS\MRXSMB.SYS NetBIOS = C:\WINNT\SYSTEM32\DRIVERS\NETBIOS.SYS Rdbss = C:\WINNT\SYSTEM32\DRIVERS\RDBSS.SYS Srv = C:\WINNT\SYSTEM32\DRIVERS\SRV.SYS 系统驱动项 HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services ACPI = C:\WINNT\SYSTEM32\DRIVERS\ACPI.SYS AFD = C:\WINNT\SYSTEM32\DRIVERS\AFD.SYS ALCXWDM = C:\WINNT\SYSTEM32\DRIVERS\ALCXWDM.SYS AntiyNF = C:\WINNT\SYSTEM32\DRIVERS\ANTIYNF.SYS AsyncMac = C:\WINNT\SYSTEM32\DRIVERS\ASYNCMAC.SYS atapi = C:\WINNT\SYSTEM32\DRIVERS\ATAPI.SYS Atmarpc = C:\WINNT\SYSTEM32\DRIVERS\ATMARPC.SYS audstub = C:\WINNT\SYSTEM32\DRIVERS\AUDSTUB.SYS AWNPF = C:\WINNT\SYSTEM32\DRIVERS\AWNPF.SYS BaseTDI = C:\WINNT\SYSTEM32\DRIVERS\BASETDI.SYS CCDECODE = C:\WINNT\SYSTEM32\DRIVERS\CCDECODE.SYS Cdrom = C:\WINNT\SYSTEM32\DRIVERS\CDROM.SYS Cdsys = C:\WINNT\SYSTEM32\CDCD.SYS Disk = C:\WINNT\SYSTEM32\DRIVERS\DISK.SYS Dlc = C:\WINNT\SYSTEM32\DRIVERS\DLC.SYS dmboot = C:\WINNT\SYSTEM32\DRIVERS\DMBOOT.SYS dmio = C:\WINNT\SYSTEM32\DRIVERS\DMIO.SYS dmload = C:\WINNT\SYSTEM32\DRIVERS\DMLOAD.SYS DMusic = C:\WINNT\SYSTEM32\DRIVERS\DMUSIC.SYS dump_wmimmc = C:\WINNT\SYSTEM32\DRIVERS\DUMP_WMIMMC.SYS EagleNT = C:\WINNT\SYSTEM32\DRIVERS\EAGLENT.SYS ExpScaner = C:\PROGRAM FILES\RISING\RAV\EXPSCAN.SYS Fdc = C:\WINNT\SYSTEM32\DRIVERS\FDC.SYS FETNDIS = C:\WINNT\SYSTEM32\DRIVERS\DLKFET5B.SYS Flpydisk = C:\WINNT\SYSTEM32\DRIVERS\FLPYDISK.SYS FsVga = C:\WINNT\SYSTEM32\DRIVERS\FSVGA.SYS Ftdisk = C:\WINNT\SYSTEM32\DRIVERS\FTDISK.SYS gameenum = C:\WINNT\SYSTEM32\DRIVERS\GAMEENUM.SYS Gpc = C:\WINNT\SYSTEM32\DRIVERS\MSGPC.SYS HidUsb = C:\WINNT\SYSTEM32\DRIVERS\HIDUSB.SYS HookCont = C:\PROGRAM FILES\RISING\RAV\HOOKCONT.SYS HookReg = C:\PROGRAM FILES\RISING\RAV\HOOKREG.SYS HookSys = C:\PROGRAM FILES\RISING\RAV\HOOKSYS.SYS i8042prt = C:\WINNT\SYSTEM32\DRIVERS\I8042PRT.SYS ialm = C:\WINNT\SYSTEM32\DRIVERS\IALMNT5.SYS IntelIde = C:\WINNT\SYSTEM32\DRIVERS\INTELIDE.SYS IpFilterDriver = C:\WINNT\SYSTEM32\DRIVERS\IPFLTDRV.SYS IpInIp = C:\WINNT\SYSTEM32\DRIVERS\IPINIP.SYS IpNat = C:\WINNT\SYSTEM32\DRIVERS\IPNAT.SYS IPSEC = C:\WINNT\SYSTEM32\DRIVERS\IPSEC.SYS IRENUM = C:\WINNT\SYSTEM32\DRIVERS\IRENUM.SYS isapnp = C:\WINNT\SYSTEM32\DRIVERS\ISAPNP.SYS Kbdclass = C:\WINNT\SYSTEM32\DRIVERS\KBDCLASS.SYS kmixer = C:\WINNT\SYSTEM32\DRIVERS\KMIXER.SYS KWatch3 = C:\WINNT\SYSTEM32\DRIVERS\KWATCH3.SYS MEMSCAN = C:\PROGRAM FILES\RISING\RAV\MEMSCAN.SYS Mouclass = C:\WINNT\SYSTEM32\DRIVERS\MOUCLASS.SYS mouhid = C:\WINNT\SYSTEM32\DRIVERS\MOUHID.SYS MPE = C:\WINNT\SYSTEM32\DRIVERS\MPE.SYS MSKSSRV = C:\WINNT\SYSTEM32\DRIVERS\MSKSSRV.SYS MSPCLOCK = C:\WINNT\SYSTEM32\DRIVERS\MSPCLOCK.SYS MSPQM = C:\WINNT\SYSTEM32\DRIVERS\MSPQM.SYS MSTEE = C:\WINNT\SYSTEM32\DRIVERS\MSTEE.SYS ms_mpu401 = C:\WINNT\SYSTEM32\DRIVERS\MSMPU401.SYS NABTSFEC = C:\WINNT\SYSTEM32\DRIVERS\NABTSFEC.SYS NAVAP = D:\SYMANT~1\NAVAP.SYS NAVAPEL = D:\SYMANTEC ANTIVIRUS\NAVAPEL.SYS NAVENG = C:\PROGRA~1\COMMON~1\SYMANT~1\VIRUSD~1\20060118.007\NAVENG.SYS NAVEX15 = C:\PROGRA~1\COMMON~1\SYMANT~1\VIRUSD~1\20060118.007\NAVEX15.SYS Nbf = C:\WINNT\SYSTEM32\DRIVERS\NBF.SYS NdisTapi = C:\WINNT\SYSTEM32\DRIVERS\NDISTAPI.SYS Ndisuio = C:\WINNT\SYSTEM32\DRIVERS\NDISUIO.SYS NdisWan = C:\WINNT\SYSTEM32\DRIVERS\NDISWAN.SYS NetBT = C:\WINNT\SYSTEM32\DRIVERS\NETBT.SYS NetDetect = C:\WINNT\SYSTEM32\DRIVERS\NETDTECT.SYS NPF = C:\WINNT\SYSTEM32\DRIVERS\NPF.SYS npkcrypt = F:\新建文件夹\路由器\CISCO路由器配置完全手册\QQ\NPKCRYPT.SYS NPPTNT2 = C:\WINNT\SYSTEM32\NPPTNT2.SYS nv4 = C:\WINNT\SYSTEM32\DRIVERS\NV4.SYS NwlnkFlt = C:\WINNT\SYSTEM32\DRIVERS\NWLNKFLT.SYS NwlnkFwd = C:\WINNT\SYSTEM32\DRIVERS\NWLNKFWD.SYS NwlnkIpx = C:\WINNT\SYSTEM32\DRIVERS\NWLNKIPX.SYS NwlnkNb = C:\WINNT\SYSTEM32\DRIVERS\NWLNKNB.SYS NwlnkSpx = C:\WINNT\SYSTEM32\DRIVERS\NWLNKSPX.SYS Parallel = C:\WINNT\SYSTEM32\DRIVERS\PARALLEL.SYS Parport = C:\WINNT\SYSTEM32\DRIVERS\PARPORT.SYS PCI = C:\WINNT\SYSTEM32\DRIVERS\PCI.SYS PCIIde = C:\WINNT\SYSTEM32\DRIVERS\PCIIDE.SYS PptpMiniport = C:\WINNT\SYSTEM32\DRIVERS\RASPPTP.SYS ptfsmekb = C:\PROGRAM FILES\PTFSMEKB.SYS Ptilink = C:\WINNT\SYSTEM32\DRIVERS\PTILINK.SYS RasAcd = C:\WINNT\SYSTEM32\DRIVERS\RASACD.SYS Rasl2tp = C:\WINNT\SYSTEM32\DRIVERS\RASL2TP.SYS Raspti = C:\WINNT\SYSTEM32\DRIVERS\RASPTI.SYS RCA = C:\WINNT\SYSTEM32\DRIVERS\RCA.SYS redbook = C:\WINNT\SYSTEM32\DRIVERS\REDBOOK.SYS RGGA = C:\WINNT\SYSTEM32\DRIVERS\RGGA.SYS RMSPPPOE = C:\WINNT\SYSTEM32\DRIVERS\RMSPPPOE.SYS rsbksbuy = C:\WINNT\SYSTEM32\DRIVERS\RSBKSBUY.SYS rtl8139 = C:\WINNT\SYSTEM32\DRIVERS\RTL8139.SYS serenum = C:\WINNT\SYSTEM32\DRIVERS\SERENUM.SYS Serial = C:\WINNT\SYSTEM32\DRIVERS\SERIAL.SYS SLIP = C:\WINNT\SYSTEM32\DRIVERS\SLIP.SYS spud = C:\WINNT\SYSTEM32\DRIVERS\SPUD.SYS streamip = C:\WINNT\SYSTEM32\DRIVERS\STREAMIP.SYS swenum = C:\WINNT\SYSTEM32\DRIVERS\SWENUM.SYS swmidi = C:\WINNT\SYSTEM32\DRIVERS\SWMIDI.SYS sysaudio = C:\WINNT\SYSTEM32\DRIVERS\SYSAUDIO.SYS Tcpip = C:\WINNT\SYSTEM32\DRIVERS\TCPIP.SYS TermDD = C:\WINNT\SYSTEM32\DRIVERS\TERMDD.SYS trid3d = C:\WINNT\SYSTEM32\DRIVERS\TRID3DM.SYS uhcd = C:\WINNT\SYSTEM32\DRIVERS\UHCD.SYS Update = C:\WINNT\SYSTEM32\DRIVERS\UPDATE.SYS usbehci = C:\WINNT\SYSTEM32\DRIVERS\USBEHCI.SYS usbhub = C:\WINNT\SYSTEM32\DRIVERS\USBHUB.SYS usbhub20 = C:\WINNT\SYSTEM32\DRIVERS\USBHUB20.SYS USBSTOR = C:\WINNT\SYSTEM32\DRIVERS\USBSTOR.SYS vcddev = C:\WINNT\SYSTEM32\DRIVERS\VCDVNIC.SYS VgaSave = C:\WINNT\SYSTEM32\DRIVERS\VGA.SYS viaagp = C:\WINNT\SYSTEM32\DRIVERS\VIAAGP.SYS Wanarp = C:\WINNT\SYSTEM32\DRIVERS\WANARP.SYS wdmaud = C:\WINNT\SYSTEM32\DRIVERS\WDMAUD.SYS Wg1n = C:\WINNT\SYSTEM32\DRIVERS\WG1N.SYS Wg2n = C:\WINNT\SYSTEM32\DRIVERS\WG2N.SYS wg4n = C:\WINNT\SYSTEM32\DRIVERS\WG4N.SYS wg5n = C:\WINNT\SYSTEM32\DRIVERS\WG5N.SYS wg6n = C:\WINNT\SYSTEM32\DRIVERS\WG6N.SYS wg8n = C:\WINNT\SYSTEM32\DRIVERS\WG8N.SYS wg9n = C:\WINNT\SYSTEM32\DRIVERS\WG9N.SYS WINIO = F:\新建文件夹\电影\JS\JS\WINIO.SYS Wsdrv = C:\WINNT\SYSTEM32\DRIVERS\WSDRV.SYS WSTCODEC = C:\WINNT\SYSTEM32\DRIVERS\WSTCODEC.SYS XPROTECTOR = C:\WINNT\SYSTEM32\DRIVERS\OREANS.SYS xyantivirus = C:\VRV\CLIENT\FILEMON.SYS
满天飞雪初生襁褓狮帖子:211 注册: 2006-06-17 来自:

baohe 大版主帖子:72578 注册: 2003-04-10 来自:	发表于： 2006-06-17 22:47 \| 短消息资料字号：小中大 4楼【回复“满天飞雪”的帖子】 HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run ToP = C:\WINNT\LSASS.EXE 很难杀的一个木马。如果你不熟悉手工杀毒，建议尝试“系统还原”。
baohe 大版主帖子:72578 注册: 2003-04-10 来自:

满天飞雪初生襁褓狮帖子:211 注册: 2006-06-17 来自:	发表于： 2006-06-17 22:48 \| 只看楼主短消息资料字号：小中大 5楼在线等，那为大侠能帮下忙，已经被这个病毒困绕几天了，人都快疯了。
满天飞雪初生襁褓狮帖子:211 注册: 2006-06-17 来自:

我无邪高贵耄耋狮帖子:20720 注册: 2004-06-10 来自:广西玉林	发表于： 2006-06-17 22:50 \| 短消息资料字号：小中大 6楼疯也无宜如果实在搞不定，可以考虑重装系统了。
我无邪高贵耄耋狮帖子:20720 注册: 2004-06-10 来自:广西玉林

满天飞雪初生襁褓狮帖子:211 注册: 2006-06-17 来自:	发表于： 2006-06-17 22:53 \| 只看楼主短消息资料字号：小中大 7楼瑞星的升级报告说已经添加了这个木马的病毒库，我就买了一个下载版，结果还是查不出来，瑞星这不明摆着骗人的吗。
满天飞雪初生襁褓狮帖子:211 注册: 2006-06-17 来自:

满天飞雪初生襁褓狮帖子:211 注册: 2006-06-17 来自:	发表于： 2006-06-17 22:54 \| 只看楼主短消息资料字号：小中大 8楼既然进程扫描认的出来，为什么杀毒软件就是杀不掉呢？哄人钱财啊
满天飞雪初生襁褓狮帖子:211 注册: 2006-06-17 来自:

<<上一主题|下一主题>>

1

1 / 1 页

跳转页

页面顶部

Powered by Discuz!NT