瑞星卡卡安全论坛技术交流区反病毒/反流氓软件论坛 【求助】高手帮忙看看(让我抓到是谁干的,我割掉他的JJ)

1   1  /  1  页   跳转

【求助】高手帮忙看看(让我抓到是谁干的,我割掉他的JJ)

【求助】高手帮忙看看(让我抓到是谁干的,我割掉他的JJ)

下视频解码器的时候,发现自动安装了好几个小软件,如IE-BAR什么的,还自动弹出网页,估计是中毒了,请大家帮忙看一下!谢谢了!
Logfile of HijackThis v1.99.1
Scan saved at 17:52:23, on 2006-10-24
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\savedump.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\svchost.exe
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\EPSON\EBAPI\SAgent2.exe
F:\Program Files\kav2006\KPfwSvc.EXE
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\SYSTEM32\RUN32.EXE
C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
c:\windows\system32\wbem\services.exe
C:\WINDOWS\system32\wuauclt.exe
F:\Program Files\系统日志软件\HijackThis.exe

O2 - BHO: MyIEHelper Class - {16B770A0-0E87-4278-B748-2460D64A8386} - C:\Documents and Settings\All Users\Application Data\Microsoft\UserData\IEHelper_5124.dll
O2 - BHO: NaviHelperObj Class - {3E422F49-1566-40D3-B43D-077EF739AC32} - C:\WINDOWS\system32\NaviHelper.dll
O2 - BHO: QQIEHelper - {54EBD53A-9BC1-480B-966A-843A333CA162} - f:\Program Files\Tencent\QQ\QQIEHelper.dll
O2 - BHO: 信息检索 - {CE7C3CF0-98A8-474D-B2B5-1ED7E2E3B004} - C:\WINDOWS\system32\IEHelper.dll
O2 - BHO: (no name) - {F2E37336-BFDB-409B-8D0E-6F013C438B20} - (no file)
O4 - HKLM\..\Run: [MSConfig] C:\WINDOWS\PCHealth\HelpCtr\Binaries\MSConfig.exe /auto
O4 - HKLM\..\Run: [svc] C:\WINDOWS\svchost.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [svc] C:\WINDOWS\svchost.exe
O8 - Extra context menu item: !搜一搜(&S) - res://C:\Program Files\yisou\yisou.dll/232
O8 - Extra context menu item: 上传到QQ网络硬盘 - F:\Program Files\Tencent\QQ\AddToNetDisk.htm
O8 - Extra context menu item: 使用超级解霸播放 - C:\Program Files\Herosoft\Hero 9\MPURLGET.HTM
O8 - Extra context menu item: 添加到QQ自定义面板 - F:\Program Files\Tencent\QQ\AddPanel.htm
O8 - Extra context menu item: 添加到QQ表情 - F:\Program Files\Tencent\QQ\AddEmotion.htm
O8 - Extra context menu item: 用QQ彩信发送该图片 - F:\Program Files\Tencent\QQ\SendMMS.htm
O8 - Extra context menu item: 用比特精灵下载(&B) - F:\Program Files\BitSpirit\bsurl.htm
O9 - Extra button: 豪杰超级解霸9 - {367E0A21-8601-4986-9C9A-153BF5ACA118} - C:\Program Files\Herosoft\Hero 9\STHSDVD.EXE
O9 - Extra 'Tools' menuitem: 豪杰超级解霸9 - {367E0A21-8601-4986-9C9A-153BF5ACA118} - C:\Program Files\Herosoft\Hero 9\STHSDVD.EXE
O9 - Extra button: QQ - {c95fe080-8f5d-11d2-a20b-00aa003c157b} - f:\Program Files\Tencent\QQ\QQ.EXE
O9 - Extra 'Tools' menuitem: 腾讯QQ - {c95fe080-8f5d-11d2-a20b-00aa003c157b} - f:\Program Files\Tencent\QQ\QQ.EXE
O9 - Extra button: (no name) - {DEDEB80D-FA35-45d9-9460-4983E5A8AFE6} - f:\Program Files\Tencent\QQ\QQIEHelper.dll
O9 - Extra 'Tools' menuitem: QQ炫彩工具条设置 - {DEDEB80D-FA35-45d9-9460-4983E5A8AFE6} - f:\Program Files\Tencent\QQ\QQIEHelper.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O10 - Unknown file in Winsock LSP: c:\windows\system32\quartz32.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\quartz32.dll
O11 - Options group: [!CNS]  网络实名
O17 - HKLM\System\CCS\Services\Tcpip\..\{4CFE963C-61DE-4423-BB5D-70D09FF426E9}: NameServer = 202.102.192.68 202.102.199.68
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: COM+ System User (COMSysUser) - Unknown owner - C:\WINDOWS\sndvol.exe (file missing)
O23 - Service: EPSON Printer Status Agent2 (EPSONStatusAgent2) - SEIKO EPSON CORPORATION - C:\Program Files\Common Files\EPSON\EBAPI\SAgent2.exe
O23 - Service: Kingsoft Personal Firewall Service (KPfwSvc) - Kingsoft Corporation - F:\Program Files\kav2006\KPfwSvc.EXE
O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
最后编辑2006-10-24 19:00:28
分享到:
gototop
 

我顺便问下,为什么我的序列号明明是知道的,但为什么老是输入提示错误?
gototop
 

LS的老兄啊,我来求问,你却问我,我晕鸟!
gototop
 

不得了啦,弹出的窗口关闭都来不及!!!!!!!!
gototop
 

楼主先上http://forum.ikaka.com/topic.asp?board=28&artid=6979213下载
LSPFix与WinsockxpFix
重新启动电脑, 进入安全模式。运行LSPFix.exe,删除:
quartz32.dll,如果无法上网,请运行WinsockXPFix,
让它修复一下。
结束C:\WINDOWS\svchost.exe进程
修复
O4 - HKCU\..\Run: [svc] C:\WINDOWS\svchost.exe
O2 - BHO: (no name) - {F2E37336-BFDB-409B-8D0E-6F013C438B20} - (no file)
O23 - Service: COM+ System User (COMSysUser) - Unknown owner - C:\WINDOWS\sndvol.exe (file missing)
重启,在安全模式下删除C:\WINDOWS\svchost.exe
开始--运行——regedit——“编辑”——“查找”C:\WINDOWS\svchost.exe找到后删除注册表项。
gototop
 
1   1  /  1  页   跳转
页面顶部
Powered by Discuz!NT