【問題】木馬?

牛鈴 · July 2, 2006

期待的暑假來臨後把電腦裝好

結果突然爆出一堆假程式真木馬的玩意

現在電腦超級不順

經過兩天的奮鬥後終於把大半都清掉了

但是似乎還是有漏網之魚

在瀏覽網頁的時候時常會跳出以下這些網頁

hxxp://reg.yeskee.com/html/member/registerPre.html

hxxp://www.96333.com/login/loginMain.jsps?internal=1

還蠻困擾的~''~

望好心的老爺夫人幫我解答

感激不盡!

o石頭o布丁 · July 3, 2006

可以試試 Firefox 瀏覽器

http://moztw.org/

牛鈴 · July 4, 2006

要換我老早就換了ˊˋ

就是習慣跟惰性阿...|||

不過我用Ad-Aware掃過之後似乎沒再出現了

不過我之前好像刪了一個atom.exe

有誰知道那是什麼嗎?

independent · July 4, 2006

Spy Sweeper比較好用耶... 我發現有很多AD-aware掃不出來

petercpg · July 4, 2006

http://www.merijn.org/files/hijackthis.zip

抓這個下來然後執行這程式

打開之後按Do a system scan and save a logfile

掃完之後把跳出來的記事本視窗裡面的東西貼出來看看

牛鈴 · July 4, 2006

http://www.merijn.org/files/hijackthis.zip
抓這個下來然後執行這程式
打開之後按Do a system scan and save a logfile
掃完之後把跳出來的記事本視窗裡面的東西貼出來看看

Logfile of HijackThis v1.99.1

Scan saved at 下午 05:01:45, on 2006/7/4

Platform: Windows XP SP2 (WinNT 5.01.2600)

MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\system32\spoolsv.exe

C:\Program Files\Stardock\Object Desktop\WindowBlinds\wbload.exe

C:\WINDOWS\Explorer.EXE

C:\WINDOWS\system32\RUNDLL32.EXE

C:\WINDOWS\system32\nvsvc32.exe

D:\桌面\HijackThis.exe

F2 - REG:system.ini: UserInit=C:\WINDOWS\system32\userinit.exe,C:\WINDOWS\system32\inituser.exe

O2 - BHO: (no name) - {16A770A0-0E87-4278-B748-2460D64A8386} - (no file)

O2 - BHO: (no name) - {2D99E8F4-56B7-457B-9A92-61B5D247D263} - (no file)

O2 - BHO: Yahoo Ie-Bar - {4FCE0A2B-6D48-4B22-AD7A-1ACACABC0B38} - C:\WINDOWS\twuenk_16.dll

O2 - BHO: (no name) - {5C761D09-377E-4EAC-ADA1-C9CDE39B5674} - (no file)

O2 - BHO: YDragSearch - {62EED7C6-9F02-42f9-B634-98E2899E147B} - C:\PROGRA~1\Yahoo!\ASSIST~1\Assist\YDRAGS~1.DLL

O2 - BHO: MSHlper Class - {721E6521-4CAD-4A8D-A7F1-4E230B31EF19} - C:\WINDOWS\system32\MSHLP.DLL

O2 - BHO: NewWeb Controller - {9ACEEE30-143F-471A-AA45-72B061FE7D60} - (no file)

O2 - BHO: NewWeb Controller - {9ACEEE31-1440-471B-AA46-72B061FE7D61} - C:\WINDOWS\system32\WinSC.dll

O2 - BHO: (no name) - {A2B7A0F0-B697-4A71-8D91-43443F57D7BB} - (no file)

O2 - BHO: IeCatch2 Class - {A5366673-E8CA-11D3-9CD9-0090271D075B} - C:\PROGRA~1\FLASHGET\jccatch.dll

O2 - BHO: (no name) - {E16009DB-6D16-4E39-94AD-D33A24310DD2} - (no file)

O2 - BHO: IEHlprObj Class - {F5B3ECED-9BF3-4f7e-882B-A6E75343C499} - C:\Progra~1\NetMeeting\netinit.dll

O2 - BHO: internet explorer helper - {F7911E65-B01C-4A58-AEC7-53085ECA70A5} - C:\WINDOWS\system32\mshlink.dll

O3 - Toolbar: FlashGet Bar - {E0E899AB-F487-11D5-8D29-0050BA6940E3} - C:\PROGRA~1\FLASHGET\fgiebar.dll

O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup

O4 - HKLM\..\Run: [nwiz] nwiz.exe /install

O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit

O4 - HKLM\..\Run: [rx] c:\windows\system32\rundll32.exe

O4 - HKLM\..\Run: [systemMgr] C:\WINDOWS\system32\Ir32_f.exe

O4 - HKLM\..\Run: [PHIMETIPSYNC] C:\Program Files\Common Files\Microsoft Shared\IME\IMTC65\Phonetic\TINTLCFG.EXE /PHIMETIPSync

O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime

O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Restrictions present

O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present

O8 - Extra context menu item: mxie 檔案搜索 - C:\Program Files\mxie\Config\protocol.htm

O8 - Extra context menu item: 使用 FlashGet 下載 - C:\Program Files\FlashGet\jc_link.htm

O8 - Extra context menu item: 全部使用 FlashGet 下載 - C:\Program Files\FlashGet\jc_all.htm

O9 - Extra button: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\PROGRA~1\FLASHGET\flashget.exe

O9 - Extra 'Tools' menuitem: &FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\PROGRA~1\FLASHGET\flashget.exe

O9 - Extra button: Yahoo! Messenger - {E5D12C4E-7B4F-11D3-B5C9-0050045C3C96} - C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe

O9 - Extra 'Tools' menuitem: Yahoo! Messenger - {E5D12C4E-7B4F-11D3-B5C9-0050045C3C96} - C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe

O16 - DPF: {072039AB-2117-4ED5-A85F-9B9EB903E021} - http://www.clubbox.co.kr/neo.fld/NowStarter.cab

O16 - DPF: {5082D9B5-5538-4C50-BDB1-C5F44BFB98CC} (HgRunPub Class) - http://www.hangame.co.jp/publish/HgRunPub.cab

O16 - DPF: {E0BE586C-7C66-4909-94D6-D18BBBDD6373} (ファイルバンクランチャー) - http://www.filebank.co.jp/setup/win/fbx2.cab

O17 - HKLM\System\CCS\Services\Tcpip\..\{A6EDF9B7-C76F-47A4-A6B6-553EB7369BA2}: NameServer = 168.95.192.1 168.95.1.1

O20 - Winlogon Notify: WB - C:\PROGRA~1\STARDOCK\OBJECT~1\WINDOW~1\fastload.dll

O23 - Service: kavsvc - Kaspersky Lab - C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus Personal\kavsvc.exe

O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe

O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Conexant - (no file)

=====

眼睛花了

Denny · July 4, 2006

那是在看現在正執行什麼程式嗎^o)

petercpg · July 4, 2006

F2 - REGystem.ini: UserInit=C:\WINDOWS\system32\userinit.exe,C:\WINDOWS\system32\inituser.exe