疑似Rootkit

穿越星空

　　我刚刚用了RootkitRevealer做了检查，发现两个可以的注册表键值：
HKEY_LOCAL_MACHINE\SECURITY\Policy\Secrets\SAC
HKEY_LOCAL_MACHINE\SECURITY\Policy\Secrets\SAI
　　描述都为：Key name contains embedded 'nulls'
　　请教这个可以吗？网上搜索好像还没人能回答。请指教，谢谢。

伊の星

If you see a Rootkit Revealer report that shows:
HKEY_LOCAL_MACHINE\SECURITY\Policy\Secrets\SAC
HKEY_LOCAL_MACHINE\SECURITY\Policy\Secrets\SAI
as keys with embedded nulls, they are probably not a problem (although a rootkit that used those keys would be a real problem, because Regdelnulls doesn't touch it).  After a few more checks, I think that it was a false alarm, But I was beginning to think that I had an unknown rootkit, especially when I had crash problems with Sysinternals' Autoruns when I referred listed items to Process Explorer.

oddtime

的确，是楼主多心了。

穿越星空

　　多谢指点，不过从该文来看，虽说该文作者认为可能是错误，但是在他结合Autoruns和Process Explorer后，也怀疑这个可能是潜在的Rootkit。

伊の星

呵呵,那你呢?
AUTORUNS有可疑的项目么?
其他检查工具有使用过么?

穿越星空

　　AutoRuns中不见有此项；
　　IceSword中可见这两项，但提示打开错误；
　　Wsyscheck中，赋予“完全控制”权限后，也可见这两项，但点击没有反应。