瑞星卡卡安全论坛技术交流区反病毒/反流氓软件论坛 我的灰鸽子查杀经过,请各位老大帮忙分析一下

12   1  /  2  页   跳转

我的灰鸽子查杀经过,请各位老大帮忙分析一下

我的灰鸽子查杀经过,请各位老大帮忙分析一下

我的机器装的是zonealarm的防火墙和norton的杀毒,一不小心运行了网上不知名的程序(运行前还用norton查了,哎),之后防火墙频繁提示我一些程序(winlogo.exe winlogon.exe sysexp.exe)要访问internet(有时候也要访问127.0.0.0.0或0.0.0.0)我在网上查询了一下要访问的ip,好么,是福建的,而且一开机就自己跳出来连接internet,我第一感觉是中木马了,立刻上网找到一个新版的木马克星,结果一运行看见一堆灰鸽子的提示可又杀不了(没注册),在网上又开始搜索灰鸽子,找到了瑞星的专杀工具,用了一下,竟说一切ok。又看到一篇手工查杀的文章,于是按照文章方法去做:
--进入安全模式,搜索到/windows下确有G_server_hook.dll文件,也找到另两个:G_server.exe 和 G_server.dll(高兴);
--进入注册表,在system\currentcontrolset\services下怎么也找不到对应的服务(我search的G_server),一气之下直接删除了上面的3个文件后重起;
--果然,重起后现象依旧,咋我的注册表中就找不到呢???在网上继续搜索,找到瑞星的论坛,发现老大们(救星),看了几篇文章后,依然对注册表中就找不到的事情不能释然--转换思路--下了HijackThis,可好象在023下没什么Unknown的,看上去没什么不对的(嘿嘿,纯业余)
又下了Autoruns,在启动项里觉得有些不对劲,其中logo,syslogo,winexp都和防火墙提示的相符,且logo和syslogo项前面的图标是两个ie,后面的image path是program files\microsoft office\winlogo(这个我search了整个c盘都没有找到)试着取消了logo,syslogo,winexp的启动选项,还有一个mic(图标是一个记事本,主要是我觉得它的time有问题,和另几个都比较新),使着重起到正常模式,没有弹出上网连接,防火墙也不再提示程序访问internet了,一切表面上好像又回到了正轨。可是,我所遇到的灰鸽子木马的机制是怎样的呢?删除了3个文件(还是先删的),取消了几个启动项就彻底解决了问题了吗???会不会在网络的某一端依然还有一只无形的黑手在操控着我的机器。。。。。。寒,老大一定要帮我分析一下呀,多谢了!!!
最后编辑2006-01-20 16:49:43
分享到:
gototop
 

HijackThis的结果:

当前运行的进程:         
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\HPQ\Quick Launch Buttons\EabServr.exe
C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\WINDOWS\System32\ctfmon.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\Norton AntiVirus\navapsvc.exe
C:\WINDOWS\System32\nvsvc32.exe
C:\WINDOWS\system32\ZoneLabs\vsmon.exe
C:\Program Files\Norton AntiVirus\SAVScan.exe
C:\WINDOWS\System32\wuauclt.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\BitComet\BitComet.exe
C:\Documents and Settings\zhssy\桌面\Autoruns\autoruns.exe
C:\WINDOWS\system32\notepad.exe
C:\Documents and Settings\zhssy\桌面\4842302005817230232\HijackThis1991zww.exe

O2 - BHO: ThunderIEHelper Class - {0005A87D-D626-4B3A-84F9-1D9571695F55} - C:\WINDOWS\System32\xunleibho_v4.dll
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: TeachingHandler - {31EBA2E2-58B2-4980-9C41-F12F5F1422C5} - C:\Program Files\Common Files\Collegesoft\Share Components\TPHANDLE.dll
O2 - BHO: IeCatch2 Class - {A5366673-E8CA-11D3-9CD9-0090271D075B} - C:\Program Files\FlashGet-v1.71\jccatch.dll
O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O2 - BHO: Infofo 工具栏 - {D74EC18E-3DDD-4174-B1B1-949FE3B8366D} - C:\Program Files\Infofo Bar\infofobar.dll
O3 - IE工具栏增项: 电台(&R) - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O3 - IE工具栏增项: CyberArticle Express - {769A6A36-ED24-4376-BC7C-80225BF35698} - C:\Program Files\CyberArticle\CAExp.dll
O3 - IE工具栏增项: Infofo 工具栏 - {D74EC18E-3DDD-4174-B1B1-949FE3B8366D} - C:\Program Files\Infofo Bar\infofobar.dll
O3 - IE工具栏增项: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O4 - 启动项HKLM\\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
O4 - 启动项HKLM\\Run: [PHIME2002ASync] C:\WINDOWS\System32\IME\TINTLGNT\TINTSETP.EXE /SYNC
O4 - 启动项HKLM\\Run: [PHIME2002A] C:\WINDOWS\System32\IME\TINTLGNT\TINTSETP.EXE /IMEName
O4 - 启动项HKLM\\Run: [Cpqset] C:\Program Files\HPQ\Default Settings\cpqset.exe
O4 - 启动项HKLM\\Run: [eabconfg.cpl] C:\Program Files\HPQ\Quick Launch Buttons\EabServr.exe /Start
O4 - 启动项HKLM\\Run: [SynTPLpr] C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
O4 - 启动项HKLM\\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - 启动项HKLM\\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
O4 - 启动项HKLM\\Run: [nwiz] nwiz.exe /installquiet
O4 - 启动项HKLM\\Run: [StormCodec_Helper] "C:\Program Files\Ringz Studio\Storm Codec\StormSet.exe" /S /opti
O4 - 启动项HKLM\\Run: [Zone Labs Client] C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
O4 - 启动项HKLM\\Run: [WangWang] "D:\QQ\淘宝旺旺\WangWang.EXE"
O4 - 启动项HKLM\\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - 启动项HKLM\\Run: [Symantec NetDriver Monitor] C:\PROGRA~1\SYMNET~1\SNDMon.exe /Consumer
O4 - 启动项HKLM\\Run: [SSC_UserPrompt] C:\Program Files\Common Files\Symantec Shared\Security Center\UsrPrmpt.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\System32\ctfmon.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - Startup: PowerReg Scheduler V3.exe
O4 - Startup: PowerReg Scheduler.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O8 - IE右键菜单中的新增项目: 上传到QQ网络硬盘 - D:\sy\qq\AddToNetDisk.htm
O8 - IE右键菜单中的新增项目: 使用网际快车下载 - C:\Program Files\FlashGet-v1.71\jc_link.htm
O8 - IE右键菜单中的新增项目: 使用网际快车下载全部链接 - C:\Program Files\FlashGet-v1.71\jc_all.htm
O8 - IE右键菜单中的新增项目: 保存: 完整网页... - C:\Program Files\CyberArticle\script\Save.htm
O8 - IE右键菜单中的新增项目: 保存: 更多保存内容... - C:\Program Files\CyberArticle\script\SaveAuto.htm
O8 - IE右键菜单中的新增项目: 导出到 Microsoft Office Excel(&X) - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O8 - IE右键菜单中的新增项目: 添加到QQ自定义面板 - D:\sy\qq\AddPanel.htm
O8 - IE右键菜单中的新增项目: 添加到QQ表情 - D:\sy\qq\AddEmotion.htm
O8 - IE右键菜单中的新增项目: 用QQ彩信发送该图片 - D:\sy\qq\SendMMS.htm
O9 - 浏览器额外的按钮: Infofo 工具栏 - {8507326C-B5C1-4559-BB91-0919E753836F} - C:\Program Files\Infofo Bar\infofobar.dll
O9 - 浏览器额外的“工具”菜单项: Infofo 工具栏 - {8507326C-B5C1-4559-BB91-0919E753836F} - C:\Program Files\Infofo Bar\infofobar.dll
O9 - 浏览器额外的按钮: 卓越 - {8DE0FCD4-5EB5-11D3-AD25-00002100131B} - C:\PROGRA~1\Kingsoft\XDict\IEPlugin.dll
O9 - 浏览器额外的按钮: 金山词霸 - {C8CE29C5-7589-11D3-B81B-0080C8DC5DC8} - C:\PROGRA~1\Kingsoft\XDict\IEPlugin.dll
O9 - 浏览器额外的按钮: QQ - {c95fe080-8f5d-11d2-a20b-00aa003c157b} - D:\QQ\QQ.EXE (file missing)
O9 - 浏览器额外的“工具”菜单项: 腾讯QQ - {c95fe080-8f5d-11d2-a20b-00aa003c157b} - D:\QQ\QQ.EXE (file missing)
O9 - 浏览器额外的按钮: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\Program Files\FlashGet-v1.71\flashget.exe
O9 - 浏览器额外的“工具”菜单项: &FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\Program Files\FlashGet-v1.71\flashget.exe
O16 - DPF: {F138084D-84D7-48CD-BEA8-04772457516E} (VqqSpeedDlProxy Class) - http://218.85.138.27/vqqsdl1009.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{A9559812-CA5C-456A-A85A-5FB326E39B2D}: NameServer = 202.99.96.68 202.99.64.69
O23 - NT 服务: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - NT 服务: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
O23 - NT 服务: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - NT 服务: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - NT 服务: Norton AntiVirus Auto Protect Service (navapsvc) - Symantec Corporation - C:\Program Files\Norton AntiVirus\navapsvc.exe
O23 - NT 服务: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
O23 - NT 服务: SAVScan - Symantec Corporation - C:\Program Files\Norton AntiVirus\SAVScan.exe
O23 - NT 服务: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\COMMON~1\SYMANT~1\SCRIPT~1\SBServ.exe
O23 - NT 服务: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - NT 服务: SymWMI Service (SymWSC) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exe
O23 - NT 服务: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe
gototop
 

这个是autoruns的:

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run

+ ccAppCommon Client User SessionSymantec Corporationc:\program files\common files\symantec shared\ccapp.exe

+ Cpqsetc:\program files\hpq\default settings\cpqset.exe

+ eabconfg.cplQuick Launch ButtonsHewlett-Packard c:\program files\hpq\quick launch buttons\eabservr.exe

+ LOGOCEXPLORER Microsoft 基础类应用程序c:\program files\microsoft office\winlogom.exe

+ MICCFTMON Microsoft 基础类应用程序c:\program files\system32\cftmon.exe

+ NvCplDaemonNVIDIA Display Properties ExtensionNVIDIA Corporationc:\windows\system32\nvcpl.dll

+ nwizNVIDIA nView Wizard, Version 44.82 NVIDIA Corporationc:\windows\system32\nwiz.exe

+ SSC_UserPromptNorton Security Center HelperSymantec Corporationc:\program files\common files\symantec shared\security center\usrprmpt.exe

+ StormCodec_Helperc:\program files\ringz studio\storm codec\stormset.exe

+ Symantec NetDriver MonitorSymantec Security Drivers Install MonitorSymantec Corporationc:\program files\symnetdrv\sndmon.exe

+ SynTPEnhSynaptics TouchPad EnhancementsSynaptics, Inc.c:\program files\synaptics\syntp\syntpenh.exe

+ SynTPLprTouchPad Driver Helper ApplicationSynaptics, Inc.c:\program files\synaptics\syntp\syntplpr.exe

+ SYSLOGOCEXPLORER Microsoft 基础类应用程序c:\program files\microsoft office\winlogo.exe

+ WINEXPSYSEXP Microsoft 基础类应用程序c:\program files\microsoft office\sysexp.exe

+ Zone Labs ClientZone Labs ClientZone Labs, LLCc:\program files\zone labs\zonealarm\zlclient.exe

C:\Documents and Settings\All Users\「开始」菜单\程序\启动

+ Adobe Reader Speed Launch.lnkAdobe Acrobat SpeedLauncherAdobe Systems Incorporatedc:\program files\adobe\acrobat 7.0\reader\reader_sl.exe

C:\Documents and Settings\zhssy\「开始」菜单\程序\启动

+ PowerReg Scheduler V3.exePowerReg SchedulerLeader Technologiesc:\documents and settings\zhssy\「开始」菜单\程序\启动\powerreg scheduler v3.exe

+ PowerReg Scheduler.exePRegScheduler MFC Applicationc:\documents and settings\zhssy\「开始」菜单\程序\启动\powerreg scheduler.exe

HKLM\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved

+ Desktop ExplorerNVIDIA Desktop Explorer, Version 44.82 NVIDIA Corporationc:\windows\system32\nvshell.dll

+ Desktop Explorer MenuNVIDIA Desktop Explorer, Version 44.82 NVIDIA Corporationc:\windows\system32\nvshell.dll

+ Display Panning CPL ExtensionFile not found: deskpan.dll

+ HyperTerminal Icon ExtHyperTerminal Applet LibraryHilgraeve, Inc.c:\windows\system32\hticons.dll

+ Shell Extensions for RealOne PlayerRealPlayer Shell ExtensionsRealNetworks, Inc.c:\program files\real\realplayer\rpshell.dll

+ WinRAR shell extensionc:\program files\winrar\rarext.dll

HKLM\Software\Classes\Folder\Shellex\ColumnHandlers

+ PDF Shell ExtensionPDF Shell ExtensionAdobe Systems, Inc.c:\program files\adobe\acrobat 7.0\activex\pdfshell.dll

HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects

+ AcroIEHlprObj ClassAdobe Acrobat IE Helper Version 7.0 for ActiveXAdobe Systems Incorporatedc:\program files\adobe\acrobat 7.0\activex\acroiehelper.dll

+ CNavExtBho ClassNorton AntiVirusNAVShellExt ModuleSymantec Corporationc:\program files\norton antivirus\navshext.dll

+ IeCatch2 Classjccatch ModuleAmaze Softc:\program files\flashget-v1.71\jccatch.dll

+ IEHandle ClassIEHandler for ScenicPlayer江苏科建教育软件有限责任公司c:\program files\common files\collegesoft\share components\tphandle.dll

+ Infofo 工具栏珊瑚虫 Infofo 工具栏珊瑚虫工作室 泰格工作室c:\program files\infofo bar\infofobar.dll

+ ThunderIEHelper Classxunleibho Modulec:\windows\system32\xunleibho_v4.dll

HKLM\Software\Microsoft\Internet Explorer\Toolbar

+ Norton AntiVirusNorton AntiVirusNAVShellExt ModuleSymantec Corporationc:\program files\norton antivirus\navshext.dll

HKLM\Software\Microsoft\Internet Explorer\Extensions

+ &FlashGetFlashGetAmaze Softc:\program files\flashget-v1.71\flashget.exe

+ 腾讯QQFile not found: D:\QQ\QQ.EXE

Task Scheduler

+ Symantec NetDetect.jobSymantec NetDetectSymantec Corporationc:\program files\symantec\liveupdate\ndetect.exe

HKLM\System\CurrentControlSet\Services

+ ccEvtMgrSymantec 事件管理器Symantec Corporationc:\program files\common files\symantec shared\ccevtmgr.exe

+ ccSetMgrSymantec 设置管理器Symantec Corporationc:\program files\common files\symantec shared\ccsetmgr.exe

+ navapsvc处理 Norton AntiVirus 自动防护事件。Symantec Corporationc:\program files\norton antivirus\navapsvc.exe

+ NVSvcNVIDIA Driver Helper Service, Version 44.82NVIDIA Corporationc:\windows\system32\nvsvc32.exe

+ SBServiceScriptBlocking registrationSymantec Corporationc:\program files\common files\symantec shared\script blocking\sbserv.exe

+ SymWSCSymantec WMI ServiceSymantec Corporationc:\program files\common files\symantec shared\security center\symwsc.exe

+ vsmon监视 Internet 通讯并为禁止的访问生成警报。Zone Labs, LLCc:\windows\system32\zonelabs\vsmon.exe

HKLM\System\CurrentControlSet\Services

+ BCM43XXBroadcom Corporation NDIS 5.0 wireless driverBroadcom Corporationc:\windows\system32\drivers\bcmwl5.sys

+ CAMCAUDConexant WDM AC97 Audio DriverConexant Systems Inc.c:\windows\system32\drivers\camcaud.sys

+ CAMCHALAConexant AmcHal DriverConexant Systems Inc.c:\windows\system32\drivers\camchal.sys

+ d347busPnP BIOS Extension c:\windows\system32\drivers\d347bus.sys

+ d347prtSCSI miniport c:\windows\system32\drivers\d347prt.sys

+ eabfiltrQLB PS/2 Keyboard filter driverHewlett-Packard Companyc:\windows\system32\drivers\eabfiltr.sys

+ eabusbQLB USB Keyboard filter driverHewlett-Packard Companyc:\windows\system32\drivers\eabusb.sys

+ EMCRENE PCI Memory Card Reader DriverENE Technology Inc.c:\windows\system32\drivers\emcr7sk.sys

+ HSF_DPHSF_DP driverConexant Systems, Inc.c:\windows\system32\drivers\hsf_dp.sys

+ HSFHWICHHSFHWICH WDM driverConexant Systems, Inc.c:\windows\system32\drivers\hsfhwich.sys

+ mdmxsdkDiagnostic Interface DRIVERConexantc:\windows\system32\drivers\mdmxsdk.sys

+ NAVENGAV EngineSymantec Corporationc:\program files\common files\symantec shared\virusdefs\20060117.007\naveng.sys

+ NAVEX15AV EngineSymantec Corporationc:\program files\common files\symantec shared\virusdefs\20060117.007\navex15.sys

+ npkcryptnProtect KeyCrypt DriverINCA Internet Co., Ltd.d:\sy\qq\npkcrypt.sys

+ npkycrypFile not found: D:\sy\qq\npkycryp.sys

+ NSCIRDANSC Fast Infrared Driver.National Semiconductor Corporationc:\windows\system32\drivers\nscirda.sys

+ nvNVIDIA Compatible Windows 2000 Miniport Driver, Version 44.82 NVIDIA Corporationc:\windows\system32\drivers\nv4_mini.sys

+ PtilinkDirect Parallel Link DriverParallel Technologies, Inc.c:\windows\system32\drivers\ptilink.sys

+ rtl8139Realtek RTL8139/810x Family NDIS 5.1 DrvRealtek Semiconductor Corporation      c:\windows\system32\drivers\r8139n51.sys

+ SAVRTAutoProtectSymantec Corporationc:\program files\norton antivirus\savrt.sys

+ SAVRTPELSAVRTPELSymantec Corporationc:\program files\norton antivirus\savrtpel.sys

+ SecdrvSafeDisc driverMacrovision Corporation, Macrovision Europe Limited, and Macrovision Japan and Asia K.K.c:\windows\system32\drivers\secdrv.sys

+ StreamDispatcherConexant Stream DispatcherConexant Systems, Inc.c:\windows\system32\drivers\strmdisp.sys

+ SymEventSymantec Event LibrarySymantec Corporationc:\program files\symantec\symevent.sys

+ SYMREDRVRedirector Filter DriverSymantec Corporationc:\windows\system32\drivers\symredrv.sys

+ SYMTDINetwork Dispatch DriverSymantec Corporationc:\windows\system32\drivers\symtdi.sys

+ SynTPSynaptics Touchpad DriverSynaptics, Inc.c:\windows\system32\drivers\syntp.sys

+ vsdatantTrueVector Device DriverZone Labs, LLCc:\windows\system32\vsdatant.sys

+ winachsfWinACHSF driverConexant Systems, Inc.c:\windows\system32\drivers\hsf_cnxt.sys

+ XBBO99File not found: C:\WINDOWS\TEMP\u4.sys

gototop
 

再次表示感谢先!!!
gototop
 

可能灰鸽子2005版的
安全模式下删除G_server.exe(可能会找不到这个文件)。建议用Icesword开启禁止线程创建后,在用Icesword进入Windows目录删除G_server.exe以及其他的Dll。
最后一步要看你的了 你的日志没有灰鸽子NT服务,你点我的电脑右健,按管理,然后察看服务,找一下NT服务里对G_server.exe 有引用的就对它禁止
gototop
 

如果有什么不懂点我上面的QQ详细说吧
gototop
 

第一段我说了3个文件已经找到并删除,问题是我只是禁止了一些启动项,并无找到相关的服务,这正常吗?
gototop
 

这个不正常,灰鸽子是注册表,服务,启动项3重启动,你要是不删了表面正常,实际还在运行。我也用过灰鸽子,你下载一个灰鸽子清除器就行了。
gototop
 

可是我找不到服务,你说的清除器是哪个?
另,
O16 - DPF: {F138084D-84D7-48CD-BEA8-04772457516E} (VqqSpeedDlProxy Class) - http://218.85.138.27/vqqsdl1009.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{A9559812-CA5C-456A-A85A-5FB326E39B2D}: NameServer = 202.99.96.68 202.99.64.69
正常吗?谢了
gototop
 

灰鸽子全版清除器阿
gototop
 
12   1  /  2  页   跳转
页面顶部
Powered by Discuz!NT