|
| [求助]系统核心服务程序6和僵尸傀儡？ |
| 作者 那什么 查看 2262 发表时间 2006/11/15 11:28 【论坛浏览】 |
|
内容[/COLOR]问一个没水准的问题。我遭遇了（系统核心服务程序。6）这么一个木马，删了游出来，只要重启就会再出现。我地电脑知识有限不知如何是好。很多地方不懂，还请各位高手指教。尽可能说的详细一些。先谢过了！！！！！！！pmbsxutkn pmbsxutkn pmbsxutkn 此外，我的机器里莫名其妙的出现了一个叫僵尸傀儡的客户端，好像不是微软的产品。我不知道要如何卸载啊，好像也不是病毒，删不掉啊！帮我啊，大家！！！！！pmbsxutkn pmbsxutkn pmbsxutkn 回复:[求助]pmbsxutkn 救救我啊，谁。 |
| 序号 | 评论者 | 共有评论 18 【论坛浏览】 【发表评论】 | 评论时间 |
| 1 | 爱丽舍 | 回复:[求助] 用hijackthis和SREng分别扫日志帖上来看看 http://www.20lz.com/Show.asp?ID=870&BoardID=11&TB=1&page=1 有工具下载 |
2006/11/15 16:12 |
| 2 | 再来一次 | 回复:[求助]系统核心服务程序6和僵尸傀儡？ 为什么（那什么）这个号上不来了？ |
2006/11/17 07:19 |
| 3 | 再来一次 | 回复:[求助]系统核心服务程序6和僵尸傀儡？ 2006-11-16,23:51:13 拜托 System Repair Engineer 2.2.6.605 Smallfrogs (http://www.KZTechs.com) Windows XP Professional Service Pack 2 (Build 2600) - 管理权限用户 - 完整功能 以下内容被选中： 所有的启动项目（包括注册表、启动文件夹、服务等） 浏览器加载项 正在运行的进程（包括进程模块信息） 文件关联 Winsock 提供者 Autorun.inf HOSTS 文件 启动项目 注册表 [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run] <ctfmon.exe><C:\WINDOWS\system32\ctfmon.exe> [(Verified)Microsoft Corporation] [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run] <h><c:\windows\system32\explorer.fap /mode=hide /play=1> [N/A] <{E181C279-05DC-2052-1126-040410110056}><"C:\Program Files\Common Files\{E181C279-05DC-2052-1126-040410110056}\Update.exe" mc-110-12-0001046> [N/A] <wl><C:\WINDOWS\system32\svvosts.exe> [N/A] [HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows] <load><> [N/A] <run><> [N/A] [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run] <NVMixerTray><; "C:\Program Files\NVIDIA Corporation\NvMixer\NVMixerTray.exe"> [NVIDIA Corporation] <Super Rabbit SafeEdit><C:\Program Files\超级兔子魔法设置\SRFC.EXE /Load> [Super Rabbit Soft] <d><c:\windows\current.fap /mode=hide /play=1> [N/A] <Tray><C:\WINDOWS\command\rundll32.exe> [N/A] <WinDDoSServer.exe><C:\WINDOWS\system32\6.exe> [N/A] <KAVPersonal50><"C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus Personal\kav.exe" /minimize> [Kaspersky Lab] <IpWins><C:\Program Files\ipwins\ipwins.exe> [N/A] [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run] <1><C:\WINDOWS\syste32.exe> [N/A] <CheckFaultKernel><C:\WINDOWS\system32\mswdm.exe> [N/A] [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon] <shell><explorer.exe> [(Verified)Microsoft Corporation] <Userinit><C:\WINDOWS\system32\userinit.exe,> [(Verified)Microsoft Corporation] [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Windows] <AppInit_DLLs><> [N/A] [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon] <UIHost><logonui.exe> [(Verified)Microsoft Corporation] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad] <WPDShServiceObj><C:\WINDOWS\system32\WPDShServiceObj.dll> [(Verified)Microsoft Corporation] <SysRun><C:\WINDOWS\system32\svshost.dll> [N/A] ================================== 启动文件夹 [绿鹰PC万能精灵] <C:\Documents and Settings\All Users\「开始」菜单\程序\启动\绿鹰PC万能精灵.lnk --> C:\PROGRA~1\绿鹰PC~1\adam.exe [绿鹰网络]><N> ================================== 服务 [1F2ACEEF / 1F2ACEEF] <C:\WINDOWS\system32\1F2ACEEF.EXE -service><Microsoft Corporation> [DC825610 / DC825610] <C:\WINDOWS\system32\DC825610.EXE -service><Microsoft Corporation> [Human Interface Device Access / HidServ] <C:\WINDOWS\System32\svchost.exe -k netsvcs-->%SystemRoot%\System32\hidserv.dll><N/A> [HID Input Service WIN32 / HID_Input_Service_WIN32] <C:\WINDOWS\system32\msiexecu.exe><N/A> [kavsvc / kavsvc] <"C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus Personal\kavsvc.exe"><Kaspersky Lab> [RpcService / RpcService] <C:\WINDOWS\SYSTEM32\EXPLORE.EXE><N/A> ================================== 驱动程序 [ati2mtag / ati2mtag] <system32\DRIVERS\ati2mtag.sys><ATI Technologies Inc.> [Crystal SoundFusion(tm) Driver / cwcspud] <system32\drivers\cwcspud.sys><Crystal Semiconductor Corp.> [Crystal SoundFusion(tm) WDM Driver / cwcwdm] <system32\drivers\cwcwdm.sys><Crystal Semiconductor Corp.> [Sundance ST201 based Adapter NT Driver / DLH5X] <system32\DRIVERS\DLH5XND5.sys><D-Link Corporation> [GPKiller / GPKiller] <\SystemRoot\system32\drivers\gpkiller.sys><Yahoo!> [ids00026 / ids00026] <\??\C:\Documents and Settings\All Users\Application Data\Kaspersky Anti-Virus Personal\5.0\bases\ids00026.sys><N/A> [ids00118 / ids00118] <\??\C:\Documents and Settings\All Users\Application Data\Kaspersky Anti-Virus Personal\5.0\bases\ids00118.sys><N/A> [ids0014f / ids0014f] <\??\C:\Documents and Settings\All Users\Application Data\Kaspersky Anti-Virus Personal\5.0\bases\ids0014f.sys><Kaspersky Lab> [IC Plus IP100 10/100 Fast Ethernet Adapter NT Driver / ip100xp] <system32\DRIVERS\ipfnd51.sys><IC Plus Corp.> [Klick / Klick] <\SystemRoot\System32\drivers\klick.sys><Kaspersky Lab> [Klif / Klif] <System32\drivers\klif.sys><Kaspersky Labs> [Klin / Klin] <\SystemRoot\System32\drivers\klin.sys><Kaspersky Lab> [Klmc / Klmc] <System32\drivers\klmc.sys><Kaspersky Lab> [klstm / klstm] <\??\C:\Documents and Settings\All Users\Application Data\Kaspersky Anti-Virus Personal\5.0\bases\klstm.sys><Kaspersky Lab> [LT Modem Driver / ltmodem5] <system32\DRIVERS\ltmdmnt.sys><LT> [Netgroup Packet Filter / NPF] <system32\drivers\npf.sys><  olitecnico di Torino>[npkcrypt / npkcrypt] <\??\C:\WINDOWS\system32\qqedit\npkcrypt.sys><INCA Internet Co., Ltd.> [NSC Infrared Device Driver / NSCIRDA] <system32\DRIVERS\nscirda.sys><National Semiconductor Corporation> [Service for NVIDIA(R) nForce(TM) Audio Enumerator / nvax] <system32\drivers\nvax.sys><NVIDIA Corporation> [Service for NVIDIA(R) nForce(TM) Audio / nvnforce] <system32\drivers\nvapu.sys><NVIDIA Corporation> [NVIDIA nForce AGP Bus Filter / nv_agp] <\SystemRoot\system32\DRIVERS\nv_agp.sys><NVIDIA Corporation> [Padus ASPI Shell / pfc] <system32\drivers\pfc.sys>< adus, Inc.>[Direct Parallel Link Driver / Ptilink] <system32\DRIVERS\ptilink.sys>< arallel Technologies, Inc.>[S3SavageMX / S3SavageMX] <system32\DRIVERS\s3savmxm.sys><S3 Graphics, Inc.> [Secdrv / Secdrv] <system32\DRIVERS\secdrv.sys><Macrovision Corporation, Macrovision Europe Limited, and Macrovision Japan and Asia K.K.> [TSP / TSP] <\??\C:\WINDOWS\system32\drivers\klif.sys><Kaspersky Labs> [IBM PS/2 TrackPoint Filter Driver / TwoTrack] <system32\DRIVERS\TwoTrack.sys><IBM Corporation> ================================== 浏览器加载项 [QQ] {c95fe080-8f5d-11d2-a20b-00aa003c157b} <D:\所有QQ\QQ文件\QQ.EXE, TENCENT> [QQIEFloatBarCfgCmd Class] {DEDEB80D-FA35-45d9-9460-4983E5A8AFE6} <D:\所有QQ\qq文件\QQIEHelper.dll, N/A> [FlashGet Bar] {E0E899AB-F487-11D5-8D29-0050BA6940E3} <C:\PROGRA~1\FlashGet\fgiebar.dll, Amaze Soft> [WUWebControl Class] {6414512B-B978-451D-A0D8-FCFDF33E833C} <C:\WINDOWS\system32\wuweb.dll, Microsoft Corporation> [MUWebControl Class] {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} <C:\WINDOWS\system32\muweb.dll, Microsoft Corporation> [PhotoUploadCtrl Control] {A96C48EA-AA88-4BBD-B58C-7B41146A6EAC} <D:\所有QQ\qq文件\QZone\PHOTOU~1.OCX, tencent> [KSHScan Control] {ACFE8232-03C5-4AEC-AF5E-42B806724096} <C:\WINDOWS\system32\kingsoft\ONLINE~1\KSHScan.ocx, kingsoft> [CPasswordEditCtrl Object] {E787FD25-8D7C-4693-AE67-9406BC6E22DF} <C:\WINDOWS\system32\qqedit\qqedit.dll, 腾讯科技（深圳）有限公司> [KLeakScan Control] {1FFFA3E9-A615-41FA-972D-7DB61F23AE90} <C:\WINDOWS\system32\kingsoft\ONLINE~1\KLKScan.ocx, kingsoft> [Windows Media Player] {22D6F312-B0F6-11D0-94AB-0080C74C7E95} <C:\WINDOWS\system32\wmpdxm.dll, Microsoft Corporation> [HTML Document] {25336920-03F9-11CF-8FD0-00AA00686F13} <%SystemRoot%\system32\mshtml.dll, N/A> [IeCatch5 Class] {2F364306-AA45-47B5-9F9D-39A8B94E7EF7} <C:\PROGRA~1\FlashGet\jccatch.dll, N/A> [QQBrowserHelperObject Class] {54EBD53A-9BC1-480B-966A-843A333CA162} <D:\所有QQ\qq文件\QQIEHelper.dll, N/A> [Windows Media Player] {6BF52A52-394A-11D3-B153-00C04F79FAA6} <C:\WINDOWS\system32\wmp.dll, Microsoft Corporation> [Microsoft Web 浏览器] {8856F961-340A-11D0-A96B-00C04FD705A2} <C:\WINDOWS\system32\shdocvw.dll, Microsoft Corporation> [KSHScan Control] {ACFE8232-03C5-4AEC-AF5E-42B806724096} <C:\WINDOWS\system32\kingsoft\ONLINE~1\KSHScan.ocx, kingsoft> [conimehlp Class] {B10343BD-1DC6-442F-9BA2-D44C708CEE83} <C:\WINDOWS\system32\mskey32.dll, N/A> [SearchAssistantOC] {B45FF030-4447-11D2-85DE-00C04FA35C89} <%SystemRoot%\system32\shdocvw.dll, N/A> [RDS.DataSpace] {BD96C556-65A3-11D0-983A-00C04FC29E36} <C:\Program Files\Common Files\System\msadc\msadco.dll, Microsoft Corporation> [Kingsoft DUBA OnlineScan] {C8BD9ACB-F7EC-48E6-BB2F-DAADC6789E9A} <C:\WINDOWS\system32\kingsoft\ONLINE~1\kavclean.ocx, kingsoft> [VIDEO__X_MS_WMV Moniker Class] {CD3AFA94-B84F-48F0-9393-7EDC34128127} <C:\WINDOWS\system32\wmp.dll, Microsoft Corporation> [Shockwave Flash Object] {D27CDB6E-AE6D-11CF-96B8-444553540000} <C:\WINDOWS\system32\Macromed\Flash\Flash8a.ocx, Macromedia, Inc.> [FlashGet Bar] {E0E899AB-F487-11D5-8D29-0050BA6940E3} <C:\PROGRA~1\FlashGet\fgiebar.dll, Amaze Soft> [CPasswordEditCtrl Object] {E787FD25-8D7C-4693-AE67-9406BC6E22DF} <C:\WINDOWS\system32\qqedit\qqedit.dll, 腾讯科技（深圳）有限公司> [上传到QQ网络硬盘] <D:\所有QQ\qq文件\AddToNetDisk.htm, N/A> [使用网际快车下载] <C:\Program Files\FlashGet\jc_link.htm, N/A> [使用网际快车下载全部链接] <C:\Program Files\FlashGet\jc_all.htm, N/A> [添加到QQ自定义面板] <D:\所有QQ\qq文件\AddPanel.htm, N/A> [添加到QQ表情] <D:\所有QQ\qq文件\AddEmotion.htm, N/A> [用QQ彩信发送该图片] <D:\所有QQ\qq文件\SendMMS.htm, N/A> ================================== 正在运行的进程 [PID: 468][\SystemRoot\System32\smss.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)] [PID: 516][\??\C:\WINDOWS\system32\csrss.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)] [PID: 540][\??\C:\WINDOWS\system32\winlogon.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)] [PID: 584][C:\WINDOWS\system32\services.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)] [PID: 596][C:\WINDOWS\system32\lsass.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)] [PID: 744][C:\WINDOWS\system32\svchost.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)] [PID: 804][C:\WINDOWS\system32\svchost.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)] [PID: 840][C:\WINDOWS\System32\svchost.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)] [PID: 888][C:\WINDOWS\system32\svchost.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)] [PID: 1060][C:\WINDOWS\system32\svchost.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)] [PID: 1508][C:\WINDOWS\Explorer.EXE] [Microsoft Corporation, 6.00.2900.2180 (xpsp_sp2_rtm.040803-2158)] [C:\Program Files\WinRAR\rarext.dll] [N/A, N/A] [C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus Personal\shellex.dll] [Kaspersky Lab, 5.0.227.1] [C:\WINDOWS\system32\msdmo.dll] [N/A, N/A] [C:\WINDOWS\system32\VSFilter.dll] [Gabest, 1, 0, 1, 3] [C:\WINDOWS\system32\PmpSplitter.ax] [cooleyes, 1, 0, 0, 3] [C:\WINDOWS\system32\RoQSplitter.ax] [Gabest, 1, 0, 0, 0] [C:\WINDOWS\system32\MpegSplitter.ax] [Gabest, 1, 0, 0, 3] [C:\WINDOWS\system32\RadGtSplitter.ax] [Gabest, 1, 0, 0, 0] [C:\WINDOWS\system32\NutSplitter.ax] [Gabest, 1, 0, 0, 0] [C:\WINDOWS\system32\OggSplitter.ax] [Gabest, 1, 0, 0, 0] [C:\WINDOWS\system32\RealMediaSplitter.ax] [Gabest, 1, 0, 1, 1] [C:\WINDOWS\system32\DSMSplitter.ax] [Gabest, 1, 0, 0, 5] [C:\Program Files\Platinum Stream\ffdshow\ffdshow.ax] [N/A, 1.0.2.2605] [C:\WINDOWS\system32\TTL2DecodeFilter.dll] [N/A, N/A] [C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus Personal\avpscrch.dll] [Kaspersky Lab, 1.0.227.342] [C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus Personal\concl.dll] [Kaspersky Lab, 1.0.227.3] [C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus Personal\FSSync.dll] [Kaspersky Lab, 5.0.227.0] [C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus Personal\ipc.dll] [Kaspersky Lab, 5.0.227.0] [PID: 1672][C:\WINDOWS\system32\ctfmon.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)] [PID: 1680][C:\Program Files\超级兔子魔法设置\SRFC.EXE] [Super Rabbit Soft, 2.20] [PID: 1712][C:\Program Files\ipwins\ipwins.exe] [N/A, N/A] [C:\Program Files\ipwins\Services.dll] [N/A, N/A] [C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus Personal\avpscrch.dll] [Kaspersky Lab, 1.0.227.342] [C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus Personal\concl.dll] [Kaspersky Lab, 1.0.227.3] [C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus Personal\FSSync.dll] [Kaspersky Lab, 5.0.227.0] [C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus Personal\ipc.dll] [Kaspersky Lab, 5.0.227.0] [C:\WINDOWS\system32\Macromed\Flash\Flash8a.ocx] [Macromedia, Inc., 8,0,24,0] [PID: 1728][C:\Program Files\Common Files\{E181C279-05DC-2052-1126-040410110056}\Update.exe] [N/A, N/A] [C:\Program Files\Common Files\{E181C279-05DC-2052-1126-040410110056}\System.dll] [N/A, N/A] [PID: 1756][C:\Program Files\绿鹰PC万能精灵\adam.exe] [绿鹰网络, ] [PID: 692][C:\WINDOWS\system32\svchost.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)] [PID: 176][C:\Program Files\Maxthon\Maxthon.exe] [Maxthon International Ltd., 1, 5, 6, 42] [C:\Program Files\Maxthon\maxzlib.dll] [ , 1, 0, 0, 2] [C:\Program Files\Maxthon\Services\RealTime\real_time.dll] [, 1, 0, 0, 1] [C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus Personal\avpscrch.dll] [Kaspersky Lab, 1.0.227.342] [C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus Personal\concl.dll] [Kaspersky Lab, 1.0.227.3] [C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus Personal\FSSync.dll] [Kaspersky Lab, 5.0.227.0] [C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus Personal\ipc.dll] [Kaspersky Lab, 5.0.227.0] [C:\WINDOWS\system32\SOGOUPY.IME] [Sohu.com Inc., 1, 0, 2, 2] [PID: 1292][C:\Program Files\SogouInput\Updater.exe] [N/A, N/A] [PID: 972][C:\Program Files\WinRAR\WinRAR.exe] [N/A, N/A] [PID: 664][D:\Temp\Rar$EX65.272\SREng.exe] [Smallfrogs Studio, 2.2.6.605] ================================== 文件关联 .TXT Error. [Notepad.exe %1] .EXE OK. ["%1" %*] .COM OK. ["%1" %*] .PIF OK. ["%1" %*] .REG OK. [regedit.exe "%1"] .BAT OK. ["%1" %*] .SCR OK. ["%1" /S] .CHM OK. ["C:\WINDOWS\hh.exe" %1] .HLP OK. [%SystemRoot%\system32\winhlp32.exe %1] .INI OK. [%SystemRoot%\system32\NOTEPAD.EXE %1] .INF OK. [%SystemRoot%\system32\NOTEPAD.EXE %1] .VBS OK. [%SystemRoot%\System32\WScript.exe "%1" %*] .JS OK. [%SystemRoot%\System32\WScript.exe "%1" %*] .LNK OK. [{00021401-0000-0000-C000-000000000046}] ================================== Winsock 提供者 N/A ================================== Autorun.inf N/A ================================== HOSTS 文件 127.0.0.1 localhost 127.0.0.1 www.yhhe.net 127.0.0.1 yhhe.net 127.0.0.1 www.1he.net 127.0.0.1 1he.net 127.0.0.1 www.yhhe.com 127.0.0.1 yhhe.com ================================== |
2006/11/17 07:46 |
| 4 | 再来一次 | 回复:[求助]系统核心服务程序6和僵尸傀儡？ Logfile of HijackThis v1.99.1 第二次，跪谢了！！！1 Scan saved at 23:34:23, on 2006-11-16 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\Explorer.EXE C:\WINDOWS\system32\ctfmon.exe C:\Program Files\超级兔子魔法设置\SRFC.EXE C:\Program Files\ipwins\ipwins.exe C:\Program Files\Common Files\{E181C279-05DC-2052-1126-040410110056}\Update.exe C:\Program Files\绿鹰PC万能精灵\adam.exe C:\WINDOWS\system32\svchost.exe C:\Program Files\Maxthon\Maxthon.exe C:\Program Files\SogouInput\Updater.exe C:\Program Files\WinRAR\WinRAR.exe D:\Temp\Rar$EX00.422\HijackThis.exe R3 - URLSearchHook: (no name) - {6D53ADB7-6AD5-4A59-BFE4-7B57D2F4AA89} - (no file) O3 - Toolbar: FlashGet Bar - {E0E899AB-F487-11D5-8D29-0050BA6940E3} - C:\PROGRA~1\FlashGet\fgiebar.dll O4 - HKLM\..\Run: [NVMixerTray] ; "C:\Program Files\NVIDIA Corporation\NvMixer\NVMixerTray.exe" O4 - HKLM\..\Run: [Super Rabbit SafeEdit] C:\Program Files\超级兔子魔法设置\SRFC.EXE /Load O4 - HKLM\..\Run: [d] c:\windows\current.fap /mode=hide /play=1 O4 - HKLM\..\Run: [Tray] C:\WINDOWS\command\rundll32.exe O4 - HKLM\..\Run: [WinDDoSServer.exe] C:\WINDOWS\system32\6.exe O4 - HKLM\..\Run: [KAVPersonal50] "C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus Personal\kav.exe" /minimize O4 - HKLM\..\Run: [IpWins] C:\Program Files\ipwins\ipwins.exe O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe O4 - Global Startup: 绿鹰PC万能精灵.lnk = ? O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present O8 - Extra context menu item: 上传到QQ网络硬盘 - D:\所有QQ\qq文件\AddToNetDisk.htm O8 - Extra context menu item: 使用网际快车下载 - C:\Program Files\FlashGet\jc_link.htm O8 - Extra context menu item: 使用网际快车下载全部链接 - C:\Program Files\FlashGet\jc_all.htm O8 - Extra context menu item: 添加到QQ自定义面板 - D:\所有QQ\qq文件\AddPanel.htm O8 - Extra context menu item: 添加到QQ表情 - D:\所有QQ\qq文件\AddEmotion.htm O8 - Extra context menu item: 用QQ彩信发送该图片 - D:\所有QQ\qq文件\SendMMS.htm O9 - Extra button: QQ - {c95fe080-8f5d-11d2-a20b-00aa003c157b} - D:\所有QQ\QQ文件\QQ.EXE O9 - Extra 'Tools' menuitem: 腾讯QQ - {c95fe080-8f5d-11d2-a20b-00aa003c157b} - D:\所有QQ\QQ文件\QQ.EXE O9 - Extra button: (no name) - {DEDEB80D-FA35-45d9-9460-4983E5A8AFE6} - D:\所有QQ\qq文件\QQIEHelper.dll (file missing) O9 - Extra 'Tools' menuitem: QQ炫彩工具条设置 - {DEDEB80D-FA35-45d9-9460-4983E5A8AFE6} - D:\所有QQ\qq文件\QQIEHelper.dll (file missing) O16 - DPF: {52DF16E3-6C4F-4B22-8BAF-09263E463B48} - http://www.duba.net/cab/KOSInit.cab O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1160464711377 O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1159684221818 O16 - DPF: {A96C48EA-AA88-4BBD-B58C-7B41146A6EAC} (PhotoUploadCtrl Control) - http://qz-photo.qq.com/qzone3/QzoneMediaTools.cab O16 - DPF: {ACFE8232-03C5-4AEC-AF5E-42B806724096} (KSHScan Control) - http://safe.qq.com/scan/KAllScan.CAB O16 - DPF: {E787FD25-8D7C-4693-AE67-9406BC6E22DF} (CPasswordEditCtrl Object) - https://password.qq.com/download/qqedit.cab O17 - HKLM\System\CCS\Services\Tcpip\..\{89B74261-AE47-4967-9292-CDB8195C6F52}: NameServer = 202.109.14.5 202.96.209.5 O18 - Protocol: about - {3050F406-98B5-11CF-BB82-00AA00BDCE0B} - C:\WINDOWS\system32\mshtml.dll O18 - Protocol: cdl - {3DD53D40-7B8B-11D0-B013-00AA0059CE02} - C:\WINDOWS\system32\urlmon.dll O18 - Protocol: dvd - {12D51199-0DB5-46FE-A120-47A3D7D937CC} - C:\WINDOWS\system32\msvidctl.dll O18 - Protocol: file - {79EAC9E7-BAF9-11CE-8C82-00AA004BA90B} - C:\WINDOWS\system32\urlmon.dll O18 - Protocol: ftp - {79EAC9E3-BAF9-11CE-8C82-00AA004BA90B} - C:\WINDOWS\system32\urlmon.dll O18 - Protocol: gopher - {79EAC9E4-BAF9-11CE-8C82-00AA004BA90B} - C:\WINDOWS\system32\urlmon.dll O18 - Protocol: http - {79EAC9E2-BAF9-11CE-8C82-00AA004BA90B} - C:\WINDOWS\system32\urlmon.dll O18 - Protocol: https - {79EAC9E5-BAF9-11CE-8C82-00AA004BA90B} - C:\WINDOWS\system32\urlmon.dll O18 - Protocol: ipp - (no CLSID) - (no file) O18 - Protocol: its - {9D148291-B9C8-11D0-A4CC-0000F80149F6} - C:\WINDOWS\system32\itss.dll O18 - Protocol: javascript - {3050F3B2-98B5-11CF-BB82-00AA00BDCE0B} - C:\WINDOWS\system32\mshtml.dll O18 - Protocol: local - {79EAC9E7-BAF9-11CE-8C82-00AA004BA90B} - C:\WINDOWS\system32\urlmon.dll O18 - Protocol: mailto - {3050F3DA-98B5-11CF-BB82-00AA00BDCE0B} - C:\WINDOWS\system32\mshtml.dll O18 - Protocol: mhtml - {05300401-BCBC-11D0-85E3-00C04FD85AB4} - C:\WINDOWS\system32\inetcomm.dll O18 - Protocol: mk - {79EAC9E6-BAF9-11CE-8C82-00AA004BA90B} - C:\WINDOWS\system32\urlmon.dll O18 - Protocol: ms-its - {9D148291-B9C8-11D0-A4CC-0000F80149F6} - C:\WINDOWS\system32\itss.dll O18 - Protocol: msdaipp - (no CLSID) - (no file) O18 - Protocol: res - {3050F3BC-98B5-11CF-BB82-00AA00BDCE0B} - C:\WINDOWS\system32\mshtml.dll O18 - Protocol: sysimage - {76E67A63-06E9-11D2-A840-006008059382} - C:\WINDOWS\system32\mshtml.dll O18 - Protocol: tv - {CBD30858-AF45-11D2-B6D6-00C04FBBDE6E} - C:\WINDOWS\system32\msvidctl.dll O18 - Protocol: vbscript - {3050F3B2-98B5-11CF-BB82-00AA00BDCE0B} - C:\WINDOWS\system32\mshtml.dll O18 - Protocol: wia - {13F3EA8B-91D7-4F0A-AD76-D2853AC8BECE} - C:\WINDOWS\system32\wiascr.dll O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll O21 - SSODL: SysRun - {D7FFD784-5276-42D1-887B-00267870A4C7} - C:\WINDOWS\system32\svshost.dll (file missing) O23 - Service: HID Input Service WIN32 (HID_Input_Service_WIN32) - Unknown owner - C:\WINDOWS\system32\msiexecu.exe (file missing) O23 - Service: kavsvc - Kaspersky Lab - C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus Personal\kavsvc.exe O23 - Service: RpcService - Unknown owner - C:\WINDOWS\SYSTEM32\EXPLORE.EXE (file missing) |
2006/11/17 07:47 |
| 5 | 再来一次 | 回复:[求助]系统核心服务程序6和僵尸傀儡？ 其实就是那什么的问题。[em20][em20][em20][em20] |
2006/11/17 07:49 |
| 6 | 网络vs浪子 | 回复:[求助]系统核心服务程序6和僵尸傀儡？ 删除以下几个启动项： 启动项目 注册表 [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run] <h><c:\windows\system32\explorer.fap /mode=hide /play=1> [N/A] <{E181C279-05DC-2052-1126-040410110056}><"C:\Program Files\Common Files\{E181C279-05DC-2052-1126-040410110056}\Update.exe" mc-110-12-0001046> [N/A] <wl><C:\WINDOWS\system32\svvosts.exe> [N/A] [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run] <d><c:\windows\current.fap /mode=hide /play=1> [N/A] <Tray><C:\WINDOWS\command\rundll32.exe> [N/A] <WinDDoSServer.exe><C:\WINDOWS\system32\6.exe> [N/A] <IpWins><C:\Program Files\ipwins\ipwins.exe> [N/A] [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run] <1><C:\WINDOWS\syste32.exe> [N/A] <CheckFaultKernel><C:\WINDOWS\system32\mswdm.exe> [N/A] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad] <SysRun><C:\WINDOWS\system32\svshost.dll> [N/A] （此启动项如果无法删除请到安全模式下操作）[/COLOR] 删除以下服务： ================================== 服务 [RpcService / RpcService] <C:\WINDOWS\SYSTEM32\EXPLORE.EXE><N/A> 然后重启系统，删除以下文件： C:\WINDOWS\SYSTEM32\EXPLORE.EXE C:\WINDOWS\system32\svshost.dll C:\WINDOWS\system32\mswdm.exe C:\WINDOWS\syste32.exe C:\Program Files\ipwins\*.*（整个目录） C:\WINDOWS\system32\6.exe C:\WINDOWS\command\rundll32.exe c:\windows\current.fap C:\WINDOWS\system32\svvosts.exe C:\Program Files\Common Files\{E181C279-05DC-2052-1126-040410110056}\Update.exe c:\windows\system32\explorer.fap 还有以下文件和服务为未知（如果楼主清楚是什么就不用理睬，如不清楚请打包文件发送到 webmaster@20lz.com，并关闭该服务，该还不用删除）： [1F2ACEEF / 1F2ACEEF] <C:\WINDOWS\system32\1F2ACEEF.EXE -service><Microsoft Corporation> [DC825610 / DC825610] <C:\WINDOWS\system32\DC825610.EXE -service><Microsoft Corporation> [HID Input Service WIN32 / HID_Input_Service_WIN32] <C:\WINDOWS\system32\msiexecu.exe><N/A> 对应文件： C:\WINDOWS\system32\msiexecu.exe C:\WINDOWS\system32\DC825610.EXE C:\WINDOWS\system32\1F2ACEEF.EXE 最后建议楼主要常升级你的卡巴，并打开实时监控～常用你的超级兔子清理一下流氓软件～ |
2006/11/17 08:05 |
| 7 | 再来一次 | 回复:[求助]系统核心服务程序6和僵尸傀儡？ 不好意思，服务该怎么删？好像连冰剑也不能删啊。[em20]呵呵，我不太会啊！！ |
2006/11/18 07:24 |
| 8 | 网络vs浪子 | 回复:[求助]系统核心服务程序6和僵尸傀儡？ 请参考置顶～SRENG软件的操作方法，大同小意～ |
2006/11/18 07:50 |
| 9 | 再来一次 | 回复:[求助]系统核心服务程序6和僵尸傀儡？ 已经按照浪子大哥的方法做了，在重启删文件时，有部分未在指定地方找到，找到的已删除。还有，在删启动项时，不小心把Run里的所有项都删了。不知会否受到影响？ 另外，始终有一个SERVICES.EXE的进程在运行。杀毒时显示为（伪系统木马）藏在system32/Com文件夹里，用冰剑结束其进程后再删掉暂时可以去掉，但重启后有再度出现。[em9]究竟为什么，如何解决？ 还有，上网过程中老是出现IE浏览器中断，显示错误。我用的遨游浏览器也会突然断掉，还不时会强行跳出来一些外文网站和黄色网站。 以上，如果已经解决就不必再回了，没有解决的还请浪子大哥不吝赐教。十分感谢浪子大哥到现在给于的帮助，十分的及时。谢谢！！！！！！！！[em12][em12][em12][em12][em12] |
2006/11/18 11:53 |
| 10 | 再来一次 | 回复:[求助]系统核心服务程序6和僵尸傀儡？ 救救我吧！！！！！！！！[em12][em12][em12][em12][em12] |
2006/11/19 07:17 |
共有评论数 18 每页显示 10
|
|||
 |
紧急求救!!!!! |
| |
[图文] 反病毒木马辅助工具... |
 |
[求助] 无法进入系统 |
| |
[讨论] 为什么系统的时间老... |
| |
[求助]系统核心服务程序6和... |
| |
[求助] 开机后瑞星杀毒软件... |
| |
每次开机都弹出三个网页对... |
| |
[已解决] [求助]跪求如何清... |
| |
反病毒可能需要用到的方法... |
| |
[求助] 帮看下扫描 |
