12   1  /  2  页   跳转

大侠们快来帮忙!!!

大侠们快来帮忙!!!

我的浏览器被恶意网站加载了工具条SeachToolbar,本想从查看→工具栏中勾选清除,谁知工具栏里的选项均被改为灰显了,而且每次电脑启动时,多运行了两个可疑EXE程序,用优化大师仍无法删除,怎么办呀。
最后编辑2005-07-21 19:49:50
分享到:
gototop
 

【回复“牛牛100”的帖子】建议你下载并使用HijackThis1.99.1
HijackThis下载地址请参考:
【必读】本版说明及常用小软件下载
http://forum.ikaka.com/topic.asp?board=67&artid=5188931

HijackThis的使用方法-----请参考--瑞星HijackThis专题
http://it.rising.com.cn/newSite/Channels/anti_virus/Antivirus_Faq/TopicExplorerPagePackage/hijackthis.htm
gototop
 

你说的工具栏里不是清除,只是不调用而已
WINDOWS的安装项目里有没有卸载的?
或者用一般的IE修复就可以了
瑞星的就行啊
就用瑞星推荐的HijackThis
gototop
 

开始→运行→输入  regedit→确定

展开注册表
HKEY_LOCAL_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer下
删除键值 NoToolbarCustomiz

再参考飞跃斑竹的意见
gototop
 

谢谢大侠,我不知怎么弄的,现在SeachToolbar没了,但查看→工具栏里的选项里还有,并且是灰显,“我的电脑”里查看→工具栏也是灰显,这该怎么办呢,用你们推荐的小软件,我又不会自己修复,还要把LOG贴出来,麻烦得很,有没有直接的方法呢?
gototop
 

我知道SeachToolbar并没有真正卸掉,下面是我控制面板→添加/删除程序里的截图,各位大侠帮我看看,这里可以卸除么,哪一个是的,我不知道。。。

附件附件:

下载次数:0
文件类型:image/pjpeg
文件大小:
上传时间:2005-7-21 10:57:31
描述:



gototop
 

【回复“牛牛100”的帖子】
请用HijackThis扫描个日志贴上来

运行HijackThis,先点[扫描]或[Scan]按钮,扫描完成后,[扫描]或[Scan]按钮会变为[保存Log]或[Save Log]按钮,点击它,LOG将会在记事本中显示,再从记事本里复制/粘贴到贴子里。

如果LOG比较长,一贴发不完,你可以分成几个部分发在回贴里。
gototop
 

HijackThis@Qoo的扫描日志  V1.97.7
Scan saved at 13:30:01, on 05-7-21
Platform: Windows 98 SE (Win9x 4.10.2222A)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\SYSTEM\KERNEL32.DLL
C:\WINDOWS\SYSTEM\MSGSRV32.EXE
C:\WINDOWS\SYSTEM\MPREXE.EXE
C:\PROGRAM FILES\RISING\RAV\RAVMOND.EXE
C:\PROGRAM FILES\RISING\RAV\CCENTER.EXE
C:\WINDOWS\SYSTEM\mmtask.tsk
C:\WINDOWS\EXPLORER.EXE
C:\WINDOWS\SYSTEM\SYSTRAY.EXE
C:\PROGRAM FILES\RISING\RAV\RAVTIMER.EXE
C:\PROGRAM FILES\RISING\RAV\RAVMON.EXE
C:\PROGRAM FILES\SKYNET\FIREWALL\PFW.EXE
C:\WINDOWS\SYSTEM\INTERNAT.EXE
C:\WINDOWS\SYSTEM\WMIEXE.EXE
C:\PROGRAM FILES\EFFICIENT NETWORKS\ENTERNET 300\APP\ENTERNET.EXE
C:\PROGRAM FILES\INTERNET EXPLORER\IEXPLORE.EXE
C:\WINDOWS\SYSTEM\DDHELP.EXE
C:\WINDOWS\SYSTEM\PSTORES.EXE
C:\WINDOWS\SAMPLES\HIJACKTHIS.EXE

O2 - BHO: IE - {D157330A-9EF3-49F8-9A67-4141AC41ADD4} - (no file)
O2 - BHO: (no name) - {B3ECCAC9-C7FA-462C-894B-8E9930A70E14} - C:\PROGRA~1\KUGOO\IEHELP~1.DLL (file missing)
O2 - BHO: (no name) - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
O2 - BHO: (no name) - {9394EDE7-C8B5-483E-8773-474BF36AF6E4} - C:\PROGRAM FILES\MSN APPS\ST\01.02.3000.1002\EN-XU\STMAIN.DLL (file missing)
O2 - BHO: (no name) - {F236CC5A-F6E4-4011-9EED-C52FDF51CE3D} - C:\WINDOWS\SYSTEM\SBHOPLIN.DLL
O2 - BHO: (no name) - {0005A87D-D626-4B3A-84F9-1D9571695F55} - C:\WINDOWS\SYSTEM\XUNLEIBHO_V5.DLL
O2 - BHO: (no name) - {04DCC17E-35E1-417A-ABCF-41623FA2ACE7} - C:\DOWNLOADS\SOFTWARE\BZMJ157808\GARDEN\GBHO.DLL
O2 - BHO: (no name) - {08BEC6AA-49FC-4379-3587-4B21E286C19E} - C:\WINDOWS\SYSTEM\LCZZB.DLL (file missing)
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O3 - Toolbar: ????? - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\SYSTEM\MSDXM.OCX
O3 - Toolbar: SearchToolbar - {08BEC6AA-49FC-4379-3587-4B21E286C19E} - C:\WINDOWS\SYSTEM\LCZZB.DLL (file missing)
O4 - HKLM\..\Run: [SystemTray] SysTray.Exe
O4 - HKLM\..\Run: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
O4 - HKLM\..\Run: [HCLEAN32.EXE] C:\WINDOWS\SYSTEM\HCLEAN32.EXE
O4 - HKLM\..\Run: [RavTimer] C:\PROGRA~1\RISING\RAV\RAVTIMER.EXE
O4 - HKLM\..\Run: [Rav] C:\WINDOWS\Rav.exe
O4 - HKLM\..\Run: [RavMon] C:\PROGRA~1\RISING\RAV\RAVMON.EXE -SYSTEM
O4 - HKLM\..\Run: [SKYNET Personal FireWall] C:\PROGRAM FILES\SKYNET\FIREWALL\PFW.EXE
O4 - HKLM\..\Run: [internat.exe] internat.exe
O4 - HKLM\..\RunServices: [RsCcenter] C:\PROGRA~1\RISING\RAV\CCENTER.EXE
O4 - HKLM\..\RunServices: [RavMond] C:\PROGRA~1\RISING\RAV\RAVMOND.EXE
O4 - HKLM\..\RunServices: [ccenter] C:\Program Files\rising\Rav\CCenter.exe
O4 - Startup: MS-DOS 方式.pif
O4 - Startup: Windows 资源管理器.lnk
O4 - Startup: Outlook Express.lnk
O4 - Startup: MSN Messenger 6.2.lnk
O4 - Startup: Internet Explorer.lnk
O4 - Startup: Windows Media Player.lnk
O4 - Startup: Microsoft Word.lnk
O4 - Startup: Microsoft Excel.lnk
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O8 - Extra context menu item: &使用霏凡专用版迅雷下载 - C:\Program Files\Thunder Network\geturl.htm
O8 - Extra context menu item: &使用霏凡专用版迅雷下载全部链接 - C:\Program Files\Thunder Network\getAllurl.htm
O8 - Extra context menu item: &使用迅雷下载 - C:\PROGRAM FILES\THUNDER NETWORK\geturl.htm
O8 - Extra context menu item: &使用迅雷下载全部链接 - C:\PROGRAM FILES\THUNDER NETWORK\getAllurl.htm
O8 - Extra context menu item: 添加到QQ自定义面板 - C:\PROGRAM FILES\TENCENT\QQ\AddPanel.htm
O8 - Extra context menu item: 添加到QQ表情 - C:\PROGRAM FILES\TENCENT\QQ\AddEmotion.htm
O8 - Extra context menu item: 用QQ彩信发送该图片 - C:\PROGRAM FILES\TENCENT\QQ\SendMMS.htm
O16 - DPF: {AD7FAFB0-16D6-40C3-AF27-585D6E6453FD} - http://dload.ipbill.com/del/loader.cab
O16 - DPF: {33564D57-0000-0010-8000-00AA00389B71} - http://download.microsoft.com/download/F/6/E/F6E491A6-77E1-4E20-9F5F-94901338C922/wmv9VCM.CAB
O16 - DPF: {02BF25D5-8C17-4B23-BC80-D3488ABDDC6B} - http://www.apple.com/qtactivex/qtplugin.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab
O16 - DPF: {59CCB4A0-727D-11CF-AC36-00AA00A47DD2} (Timer Object) - http://www.xintv.com/download/ietimer.cab
O16 - DPF: {488A4255-3236-44B3-8F27-FA1AECAA8844} (CEditCtrl Object) - https://img.alipay.com/download/aliedit.cab
O16 - DPF: {991481A7-4669-4E15-8C24-100404E1F5CB} (Blueskyvoice Control) - http://www.bluesky.cn/download/blueskyvoice_60.cab
O16 - DPF: {2EA6D939-4445-43F1-A12B-8CB3DDA8B855} (BlueskyVideo Control) - http://www.bluesky.cn/download/v2_60.cab
O17 - HKLM\System\CCS\Services\VxD\MSTCP: NameServer = 69.50.184.86,85.255.112.9

gototop
 

【回复“牛牛100”的帖子】
请关闭所有IE界面,重新使用HijackThis扫描一次,选中下面建议修复的项目,让HijackThis修复,修复前请允许HijackThis保留备份。(如果楼主知道是安全的可以不必勾选)
O2 - BHO: IE - {D157330A-9EF3-49F8-9A67-4141AC41ADD4} - (no file)
O2 - BHO: (no name) - {08BEC6AA-49FC-4379-3587-4B21E286C19E} - C:\WINDOWS\SYSTEM\LCZZB.DLL (file missing)
O3 - Toolbar: SearchToolbar - {08BEC6AA-49FC-4379-3587-4B21E286C19E} - C:\WINDOWS\SYSTEM\LCZZB.DLL (file missing)
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O16 - DPF: {AD7FAFB0-16D6-40C3-AF27-585D6E6453FD} - http://dload.ipbill.com/del/loader.cab
O16 - DPF: {02BF25D5-8C17-4B23-BC80-D3488ABDDC6B} - http://www.apple.com/qtactivex/qtplugin.cab
O16 - DPF: {488A4255-3236-44B3-8F27-FA1AECAA8844} (CEditCtrl Object) - https://img.alipay.com/download/aliedit.cab
然后打开我的电脑。。再点工具。。打开文件夹选项。。。查看。。。把隐藏受保护的系统文件(推荐)和隐藏已知文件类型的扩展名的勾去掉。再显示所有文件。 用WINDOWS的查找功能进行查找并删除:
C:\WINDOWS\SYSTEM\LCZZB.DLL
gototop
 

Logfile of HijackThis v1.99.1
Scan saved at 15:13:46, on 05-7-21
Platform: Windows 98 SE (Win9x 4.10.2222A)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\SYSTEM\KERNEL32.DLL
C:\WINDOWS\SYSTEM\MSGSRV32.EXE
C:\WINDOWS\SYSTEM\MPREXE.EXE
C:\PROGRAM FILES\RISING\RAV\CCENTER.EXE
C:\PROGRAM FILES\RISING\RAV\RAVMOND.EXE
C:\WINDOWS\SYSTEM\mmtask.tsk
C:\WINDOWS\EXPLORER.EXE
C:\WINDOWS\SYSTEM\SYSTRAY.EXE
C:\PROGRAM FILES\RISING\RAV\RAVTIMER.EXE
C:\PROGRAM FILES\RISING\RAV\RAVMON.EXE
C:\PROGRAM FILES\SKYNET\FIREWALL\PFW.EXE
C:\WINDOWS\SYSTEM\INTERNAT.EXE
C:\WINDOWS\SYSTEM\WMIEXE.EXE
C:\PROGRAM FILES\EFFICIENT NETWORKS\ENTERNET 300\APP\ENTERNET.EXE
C:\WINDOWS\SYSTEM\DDHELP.EXE
C:\WINDOWS\SYSTEM\PSTORES.EXE
C:\WINDOWS\SAMPLES\1.99.1HIJACKTHIS\HIJACKTHIS.EXE

O2 - BHO: (no name) - {B3ECCAC9-C7FA-462C-894B-8E9930A70E14} - C:\PROGRA~1\KUGOO\IEHELP~1.DLL (file missing)
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
O2 - BHO: ST - {9394EDE7-C8B5-483E-8773-474BF36AF6E4} - C:\PROGRAM FILES\MSN APPS\ST\01.02.3000.1002\EN-XU\STMAIN.DLL (file missing)
O2 - BHO: SFP Class - {F236CC5A-F6E4-4011-9EED-C52FDF51CE3D} - C:\WINDOWS\SYSTEM\SBHOPLIN.DLL
O2 - BHO: ThunderIEHelper Class - {0005A87D-D626-4B3A-84F9-1D9571695F55} - C:\WINDOWS\SYSTEM\XUNLEIBHO_V5.DLL
O2 - BHO: BHO Class - {04DCC17E-35E1-417A-ABCF-41623FA2ACE7} - C:\DOWNLOADS\SOFTWARE\BZMJ157808\GARDEN\GBHO.DLL
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O3 - Toolbar: 电台(&R) - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\SYSTEM\MSDXM.OCX
O4 - HKLM\..\Run: [SystemTray] SysTray.Exe
O4 - HKLM\..\Run: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
O4 - HKLM\..\Run: [HCLEAN32.EXE] C:\WINDOWS\SYSTEM\HCLEAN32.EXE
O4 - HKLM\..\Run: [RavTimer] C:\PROGRA~1\RISING\RAV\RAVTIMER.EXE
O4 - HKLM\..\Run: [Rav] C:\WINDOWS\Rav.exe
O4 - HKLM\..\Run: [RavMon] C:\PROGRA~1\RISING\RAV\RAVMON.EXE -SYSTEM
O4 - HKLM\..\Run: [SKYNET Personal FireWall] C:\PROGRAM FILES\SKYNET\FIREWALL\PFW.EXE
O4 - HKLM\..\Run: [internat.exe] internat.exe
O4 - HKLM\..\RunServices: [RsCcenter] C:\PROGRA~1\RISING\RAV\CCENTER.EXE
O4 - HKLM\..\RunServices: [RavMond] C:\PROGRA~1\RISING\RAV\RAVMOND.EXE
O4 - HKLM\..\RunServices: [ccenter] C:\Program Files\rising\Rav\CCenter.exe
O8 - Extra context menu item: &使用霏凡专用版迅雷下载 - C:\Program Files\Thunder Network\geturl.htm
O8 - Extra context menu item: &使用霏凡专用版迅雷下载全部链接 - C:\Program Files\Thunder Network\getAllurl.htm
O8 - Extra context menu item: &使用迅雷下载 - C:\PROGRAM FILES\THUNDER NETWORK\geturl.htm
O8 - Extra context menu item: &使用迅雷下载全部链接 - C:\PROGRAM FILES\THUNDER NETWORK\getAllurl.htm
O8 - Extra context menu item: 添加到QQ自定义面板 - C:\PROGRAM FILES\TENCENT\QQ\AddPanel.htm
O8 - Extra context menu item: 添加到QQ表情 - C:\PROGRAM FILES\TENCENT\QQ\AddEmotion.htm
O8 - Extra context menu item: 用QQ彩信发送该图片 - C:\PROGRAM FILES\TENCENT\QQ\SendMMS.htm
O16 - DPF: {59CCB4A0-727D-11CF-AC36-00AA00A47DD2} (Timer Object) - http://www.xintv.com/download/ietimer.cab
O16 - DPF: {991481A7-4669-4E15-8C24-100404E1F5CB} (Blueskyvoice Control) - http://www.bluesky.cn/download/blueskyvoice_60.cab
O16 - DPF: {2EA6D939-4445-43F1-A12B-8CB3DDA8B855} (BlueskyVideo Control) - http://www.bluesky.cn/download/v2_60.cab
O17 - HKLM\System\CCS\Services\VxD\MSTCP: NameServer = 69.50.184.86,85.255.112.9
gototop
 
12   1  /  2  页   跳转
页面顶部
Powered by Discuz!NT