请看看我的HIJACK有问题吗？ bbs.ikaka.com

canghai74 - 2005-11-13 22:31:00

我才扫描的，是不是与弹出广告有关，请详细指点
O2 - BHO: Shockwave Flash BrowserHelpObject - {1002C84D-A326-2D3C-13F3-2C2474392A91} - C:\WINDOWS\system32\FlashHlp.dll
O2 - BHO: QQIEHelper - {54EBD53A-9BC1-480B-966A-843A333CA162} - C:\Program Files\Tencent\QQ\QQIEHelper.dll
O2 - BHO: IeCatch2 Class - {A5366673-E8CA-11D3-9CD9-0090271D075B} - C:\PROGRA~1\FLASHGET\jccatch.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
O2 - BHO: NTIECatcher Class - {C56CB6B0-0D96-11D6-8C65-B2868B609932} - C:\Program Files\Xi\NetTransport 2\NTIEHelper.dll
O3 - IE工具栏增项: FlashGet Bar - {E0E899AB-F487-11D5-8D29-0050BA6940E3} - C:\PROGRA~1\FLASHGET\fgiebar.dll
O3 - IE工具栏增项: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O3 - IE工具栏增项: 卡卡上网安全助手 - {DB9ECD4F-FB8F-4311-B3CE-90B976C2707C} - C:\WINDOWS\system32\KakaTool.dll
O4 - 启动项HKLM\\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
O4 - 启动项HKLM\\Run: [PHIME2002ASync] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC
O4 - 启动项HKLM\\Run: [PHIME2002A] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName
O4 - 启动项HKLM\\Run: [NvCplDaemon] RUNDLL32.EXE NvQTwk,NvCplDaemon initialize
O4 - 启动项HKLM\\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O8 - IE右键菜单中的新增项目: Google 搜索(&G) - res://C:\Program Files\Google\GoogleToolbar1.dll/cmsearch.html
O8 - IE右键菜单中的新增项目: 上传到QQ网络硬盘 - C:\Program Files\Tencent\QQ\AddToNetDisk.htm
O8 - IE右键菜单中的新增项目: 使用影音传送带下载 - C:\Program Files\Xi\NetTransport 2\NTAddLink.html
O8 - IE右键菜单中的新增项目: 使用影音传送带下载全部链接 - C:\Program Files\Xi\NetTransport 2\NTAddList.html
O8 - IE右键菜单中的新增项目: 使用网际快车下载 - C:\Program Files\FlashGet\jc_link.htm
O8 - IE右键菜单中的新增项目: 使用网际快车下载全部链接 - C:\Program Files\FlashGet\jc_all.htm
O9 - 浏览器额外的按钮: QQ - {c95fe080-8f5d-11d2-a20b-00aa003c157b} - C:\Program Files\Tencent\QQ\QQ.EXE
O9 - 浏览器额外的“工具”菜单项: 腾讯QQ - {c95fe080-8f5d-11d2-a20b-00aa003c157b} - C:\Program Files\Tencent\QQ\QQ.EXE
O9 - 浏览器额外的按钮: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\PROGRA~1\FLASHGET\flashget.exe
O9 - 浏览器额外的“工具”菜单项: &FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\PROGRA~1\FLASHGET\flashget.exe
O9 - 浏览器额外的按钮: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683}? - C:\Program Files\Messenger\msmsgs.exe
O9 - 浏览器额外的“工具”菜单项: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683}? - C:\Program Files\Messenger\msmsgs.exe
O17 - HKLM\System\CCS\Services\Tcpip\..\{C49A10C9-706C-4191-8400-D053DC9213A4}: NameServer = 202.98.96.68 61.139.2.69
O23 - NT 服务: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe

canghai74 - 2005-11-13 22:33:00

HijackThis_815汉化版扫描日志 V1.99.1
保存于 22:23:58, 日期 2005-11-13
操作系统： Windows XP SP2 (WinNT 5.01.2600)
浏览器： Internet Explorer v6.00 SP2 (6.00.2900.2180)

当前运行的进程：
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\Program Files\WinRAR\WinRAR.exe
C:\DOCUME~1\TANGJU~1\LOCALS~1\Temp\Rar$EX47.462\HijackThis1991zww.exe

O2 - BHO: Shockwave Flash BrowserHelpObject - {1002C84D-A326-2D3C-13F3-2C2474392A91} - C:\WINDOWS\system32\FlashHlp.dll
O2 - BHO: QQIEHelper - {54EBD53A-9BC1-480B-966A-843A333CA162} - C:\Program Files\Tencent\QQ\QQIEHelper.dll
O2 - BHO: IeCatch2 Class - {A5366673-E8CA-11D3-9CD9-0090271D075B} - C:\PROGRA~1\FLASHGET\jccatch.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
O2 - BHO: NTIECatcher Class - {C56CB6B0-0D96-11D6-8C65-B2868B609932} - C:\Program Files\Xi\NetTransport 2\NTIEHelper.dll
O3 - IE工具栏增项: FlashGet Bar - {E0E899AB-F487-11D5-8D29-0050BA6940E3} - C:\PROGRA~1\FLASHGET\fgiebar.dll
O3 - IE工具栏增项: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O3 - IE工具栏增项: 卡卡上网安全助手 - {DB9ECD4F-FB8F-4311-B3CE-90B976C2707C} - C:\WINDOWS\system32\KakaTool.dll
O4 - 启动项HKLM\\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
O4 - 启动项HKLM\\Run: [PHIME2002ASync] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC
O4 - 启动项HKLM\\Run: [PHIME2002A] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName
O4 - 启动项HKLM\\Run: [NvCplDaemon] RUNDLL32.EXE NvQTwk,NvCplDaemon initialize
O4 - 启动项HKLM\\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O8 - IE右键菜单中的新增项目: Google 搜索(&G) - res://C:\Program Files\Google\GoogleToolbar1.dll/cmsearch.html
O8 - IE右键菜单中的新增项目: 上传到QQ网络硬盘 - C:\Program Files\Tencent\QQ\AddToNetDisk.htm
O8 - IE右键菜单中的新增项目: 使用影音传送带下载 - C:\Program Files\Xi\NetTransport 2\NTAddLink.html
O8 - IE右键菜单中的新增项目: 使用影音传送带下载全部链接 - C:\Program Files\Xi\NetTransport 2\NTAddList.html
O8 - IE右键菜单中的新增项目: 使用网际快车下载 - C:\Program Files\FlashGet\jc_link.htm
O8 - IE右键菜单中的新增项目: 使用网际快车下载全部链接 - C:\Program Files\FlashGet\jc_all.htm
O9 - 浏览器额外的按钮: QQ - {c95fe080-8f5d-11d2-a20b-00aa003c157b} - C:\Program Files\Tencent\QQ\QQ.EXE
O9 - 浏览器额外的“工具”菜单项: 腾讯QQ - {c95fe080-8f5d-11d2-a20b-00aa003c157b} - C:\Program Files\Tencent\QQ\QQ.EXE
O9 - 浏览器额外的按钮: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\PROGRA~1\FLASHGET\flashget.exe
O9 - 浏览器额外的“工具”菜单项: &FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\PROGRA~1\FLASHGET\flashget.exe
O9 - 浏览器额外的按钮: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683}? - C:\Program Files\Messenger\msmsgs.exe
O9 - 浏览器额外的“工具”菜单项: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683}? - C:\Program Files\Messenger\msmsgs.exe
O17 - HKLM\System\CCS\Services\Tcpip\..\{C49A10C9-706C-4191-8400-D053DC9213A4}: NameServer = 202.98.96.68 61.139.2.69
O23 - NT 服务: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe

详细的

建能 - 2005-11-13 22:40:00

正常

canghai74 - 2005-11-13 22:48:00

搞错没有？那我的机子总弹广告啊，很频繁啊，你看，又弹出一个（金山WPS）

canghai74 - 2005-11-13 23:01:00

老大，我现在只登陆了本论坛，只要刷新网页，总要弹出如免费彩铃下载，金山WPS，免费美女电影，智联招聘等小广告啊，能没问题吗

canghai74 - 2005-11-13 23:04:00

再帮我看看
HijackThis_815汉化版扫描日志 V1.99.1
保存于 23:02:02, 日期 2005-11-13
操作系统： Windows XP SP2 (WinNT 5.01.2600)
浏览器： Internet Explorer v6.00 SP2 (6.00.2900.2180)

当前运行的进程：
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\Program Files\WinRAR\WinRAR.exe
C:\DOCUME~1\TANGJU~1\LOCALS~1\Temp\Rar$EX47.462\HijackThis1991zww.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\DOCUME~1\TANGJU~1\LOCALS~1\Temp\Rar$EX27.5612\HijackThis1991zww.exe

R3 - 默认的URLSearchHook丢失。用HijackThis修复
O2 - BHO: Shockwave Flash BrowserHelpObject - {1002C84D-A326-2D3C-13F3-2C2474392A91} - C:\WINDOWS\system32\FlashHlp.dll
O2 - BHO: QQIEHelper - {54EBD53A-9BC1-480B-966A-843A333CA162} - C:\Program Files\Tencent\QQ\QQIEHelper.dll
O2 - BHO: IeCatch2 Class - {A5366673-E8CA-11D3-9CD9-0090271D075B} - C:\PROGRA~1\FLASHGET\jccatch.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
O2 - BHO: NTIECatcher Class - {C56CB6B0-0D96-11D6-8C65-B2868B609932} - C:\Program Files\Xi\NetTransport 2\NTIEHelper.dll
O3 - IE工具栏增项: FlashGet Bar - {E0E899AB-F487-11D5-8D29-0050BA6940E3} - C:\PROGRA~1\FLASHGET\fgiebar.dll
O3 - IE工具栏增项: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O3 - IE工具栏增项: 卡卡上网安全助手 - {DB9ECD4F-FB8F-4311-B3CE-90B976C2707C} - C:\WINDOWS\system32\KakaTool.dll
O4 - 启动项HKLM\\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
O4 - 启动项HKLM\\Run: [PHIME2002ASync] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC
O4 - 启动项HKLM\\Run: [PHIME2002A] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName
O4 - 启动项HKLM\\Run: [NvCplDaemon] RUNDLL32.EXE NvQTwk,NvCplDaemon initialize
O4 - 启动项HKLM\\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O8 - IE右键菜单中的新增项目: Google 搜索(&G) - res://C:\Program Files\Google\GoogleToolbar1.dll/cmsearch.html
O8 - IE右键菜单中的新增项目: 上传到QQ网络硬盘 - C:\Program Files\Tencent\QQ\AddToNetDisk.htm
O8 - IE右键菜单中的新增项目: 使用影音传送带下载 - C:\Program Files\Xi\NetTransport 2\NTAddLink.html
O8 - IE右键菜单中的新增项目: 使用影音传送带下载全部链接 - C:\Program Files\Xi\NetTransport 2\NTAddList.html
O8 - IE右键菜单中的新增项目: 使用网际快车下载 - C:\Program Files\FlashGet\jc_link.htm
O8 - IE右键菜单中的新增项目: 使用网际快车下载全部链接 - C:\Program Files\FlashGet\jc_all.htm
O9 - 浏览器额外的按钮: QQ - {c95fe080-8f5d-11d2-a20b-00aa003c157b} - C:\Program Files\Tencent\QQ\QQ.EXE
O9 - 浏览器额外的“工具”菜单项: 腾讯QQ - {c95fe080-8f5d-11d2-a20b-00aa003c157b} - C:\Program Files\Tencent\QQ\QQ.EXE
O9 - 浏览器额外的按钮: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\PROGRA~1\FLASHGET\flashget.exe
O9 - 浏览器额外的“工具”菜单项: &FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\PROGRA~1\FLASHGET\flashget.exe
O9 - 浏览器额外的按钮: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683}? - C:\Program Files\Messenger\msmsgs.exe
O9 - 浏览器额外的“工具”菜单项: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683}? - C:\Program Files\Messenger\msmsgs.exe
O17 - HKLM\System\CCS\Services\Tcpip\..\{C49A10C9-706C-4191-8400-D053DC9213A4}: NameServer = 202.98.96.68 61.139.2.69
O23 - NT 服务: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe

魔法学徒 - 2005-11-13 23:10:00

开始→运行→输入 regedit→确定

展开注册表
看一下
HKEY_CLASSES_ROOT\CLSID\{B48F6409-4740-475B-A474-651F54CCE460}下InprocServer32
里的内容是不是"C:\Program Files\Common Files\Microsoft Shared\MSInfo\MsInfo.dll"?

如果是,删除掉
HKEY_CLASSES_ROOT\CLSID\{B48F6409-4740-475B-A474-651F54CCE460}
和HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks
下边的{B48F6409-4740-475B-A474-651F54CCE460},
重新启动后可删除病毒文件
C:\Program Files\Common Files\Microsoft Shared\MSInfo\MsInfo.dll.

有System32\Temp2.inf,也一起删除.

canghai74 - 2005-11-13 23:14:00

好，谢谢了，我试试先

canghai74 - 2005-11-13 23:27:00

注册表里没有{B48F6409-4740-475B-A474-651F54CCE460}项啊？只有HKEY_CLASSES_ROOT\CLSID\{B401C5EB-8457-427F-84EA-A4D2363364B0}，HKEY_CLASSES_ROOT\CLSID\{B41DB860-8EE4-11D2-9906-E49FADC173CA}，HKEY_CLASSES_ROOT\CLSID\{B43C4EEC-8C32-4791-9102-508ADA5EE8E7}，HKEY_CLASSES_ROOT\CLSID\{B45AFEC0-2AE6-11D1-859E-00C04FC9E292}，HKEY_CLASSES_ROOT\CLSID\{B45FF030-4447-11D2-85DE-00C04FA35C89}，HKEY_CLASSES_ROOT\CLSID\{B490264C-8D8F-40FD-B1BE-CD69AD779EC1}，HKEY_CLASSES_ROOT\CLSID\{B4B3AECB-DFD6-11d1-9DAA-00805F85CFE3}，HKEY_CLASSES_ROOT\CLSID\{B4C8DF59-D16F-4042-80B7-3557A254B7C5}，HKEY_CLASSES_ROOT\CLSID\{B4CA2970-DD2B-11D0-9DFA-00AA00AF3494}，HKEY_CLASSES_ROOT\CLSID\{B4CA2971-DD2B-11D0-9DFA-00AA00AF3494}，HKEY_CLASSES_ROOT\CLSID\{B4DC8DD9-2CC1-4081-9B2B-20D7030234EF}。后面的是B5开头

魔法学徒 - 2005-11-13 23:30:00

显示隐藏文件

双击我的电脑--工具---文件夹选项--查看选项卡--单击选取"显示隐藏文件或文件夹"--清除"隐藏受保护的操作系统文件（推荐）"复选框。在提示您确定更改时，单击“是”--单击“确定”。

然后找到如下文件并删除（如果有的话）。
C:\Program Files\Common Files\Microsoft Shared\MSInfo\MsInfo.dll

canghai74 - 2005-11-13 23:43:00

此文件下未发现MsInfo.dll，只有msinfo32,IEFILES5(安装信息），IEINFO5.OCX(ACTIVEX控件）

魔法学徒 - 2005-11-13 23:52:00

用记事本打开hosts文件看看.

在win 2000/xp是: C:\Windows\system32\drivers\etc\hosts

HOSTS文件里保存有WINDOWS系统记录的IP地址与域名的对应关系。

有些网页恶意代码会修改这个文件迫使我们访问恶意网页/网站。

删除127.0.0.1 localhost以外的其他所有多余内容

canghai74 - 2005-11-13 23:59:00

前后都不要吗？只要127.0.0.1 localhost它一个吗？
# Copyright (c) 1993-1999 Microsoft Corp.
#
# This is a sample HOSTS file used by Microsoft TCP/IP for Windows.
#
# This file contains the mappings of IP addresses to host names. Each
# entry should be kept on an individual line. The IP address should
# be placed in the first column followed by the corresponding host name.
# The IP address and the host name should be separated by at least one
# space.
#
# Additionally, comments (such as these) may be inserted on individual
# lines or following the machine name denoted by a '#' symbol.
#
# For example:
#
# 102.54.94.97 rhino.acme.com # source server
# 38.25.63.10 x.acme.com # x client host

127.0.0.1 localhost
# copyright (c) 1993-1999 microsoft corp.
#
# this is a sample hosts file used by microsoft tcp/ip for windows.
#
# this file contains the mappings of ip addresses to host names. each
# entry should be kept on an individual line. the ip address should
# be placed in the first column followed by the corresponding host name.
# the ip address and the host name should be separated by at least one
# space.
#
# additionally, comments (such as these) may be inserted on individual
# lines or following the machine name denoted by a '#' symbol.
#
# for example:
#
# 102.54.94.97 rhino.acme.com # source server
# 38.25.63.10 x.acme.com # x client host
# 恶意,广告网站HOSTS收集----更新时间：2005年8月7日

127.0.0.1 localhost
127.0.0.1 www.139cn.com
127.0.0.1 www.7liao.com
127.0.0.1 chat.51liao.net
127.0.0.1 www.51liao.net
127.0.0.1 www.7liao.net
127.0.0.1 www.6see.com
127.0.0.1 bliao.com
127.0.0.1 www.bliao.com
127.0.0.1 www.hao222.net
127.0.0.1 www.hao222.com
127.0.0.1 www.v111.com
127.0.0.1 music.v111.com
127.0.0.1 www.qq165.com
127.0.0.1 www.xicu.com
127.0.0.1 www.haodx.com
127.0.0.1 www.haohz.com
127.0.0.1 www.265.com
127.0.0.1 www.dj99.com
127.0.0.1 www.dj99.net
127.0.0.1 265.com
127.0.0.1 www.yqdj.com
127.0.0.1 www.qq530.com
127.0.0.1 www.tt67.com
127.0.0.1 ad.t2t2.com
127.0.0.1 www.yexr.com
127.0.0.1 chat.9see.com
127.0.0.1 www.ok816.com
127.0.0.1 www.3399.net
127.0.0.1 www.ads8.com
127.0.0.1 www.5566.net
127.0.0.1 www.t2t2.com
127.0.0.1 popad.qq.com
127.0.0.1 v.jsdownload.com
127.0.0.1 www.linktoad.com
127.0.0.1 club.homeway.com.cn
127.0.0.1 sms1.ctn.com.cn
127.0.0.1 sms2.ctn.com.cn
127.0.0.1 sms3.ctn.com.cn
127.0.0.1 www.331122.com
127.0.0.1 mmpic.uni.cc
127.0.0.1 www.love34.com
127.0.0.1 www.free-movie.org
127.0.0.1 www.skyhits.com
127.0.0.1 www.rd18.com
127.0.0.1 tadsweb.tencent.com
127.0.0.1 www.vlike.com
127.0.0.1 www.chinasee.net
127.0.0.1 www.japansky.net
127.0.0.1 www.3721.com
127.0.0.1 cnsmin.3721.com
127.0.0.1 download.3721.com
127.0.0.1 union.3721.com

瑞星卡卡安全论坛