瑞星卡卡安全论坛技术交流区反病毒/反流氓软件论坛 求助!!!请帮忙看一下hijackthis,万分感谢!!!

1   1  /  1  页   跳转

求助!!!请帮忙看一下hijackthis,万分感谢!!!

求助!!!请帮忙看一下hijackthis,万分感谢!!!

最近上网经常出现探出窗口。打开属性地址显示为
res://C:\WINDOWS\system32\shdoclc.dll/dnserror.htm#http://ad.18dx.com/ad
res://C:\WINDOWS\system32\shdoclc.dll/dnserror.htm#http://click2.ad4all.
还有ebay的广告。附:hijackthis。该怎办,请详细点说明(小鸟),谢谢!!!


当前运行的进程:         
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Intel\Wireless\Bin\ZcfgSvc.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\hkcmd.exe
C:\soft\Norman\bin\ZANDA.EXE
C:\Program Files\Apoint2K\Apoint.exe
C:\Program Files\Fujitsu\BtnHnd\BtnHnd.exe
C:\Program Files\Intel\Wireless\Bin\OProtSvc.exe
C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe
C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
C:\Program Files\Intel\Wireless\Bin\EOUWiz.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\wdfmgr.exe
C:\WINDOWS\system32\igfxext.exe
C:\WINDOWS\AGRSMMSG.exe
C:\Program Files\Fujitsu\Fujitsu Hotkey Utility\IndicatorUty.exe
C:\Program Files\Fujitsu\Application Panel\QuickTouch.exe
C:\WINDOWS\system32\dla\tfswctrl.exe
C:\soft\Norman\bin\ZLH.EXE
C:\WINDOWS\system32\LVCOMSX.EXE
C:\Program Files\Logitech\Video\LogiTray.exe
C:\game\幻想游戏\hxgame4.2\hxgameupdate\hxgame-update.exe
C:\WINDOWS\system32\ctfmon.exe
C:\soft\Norman\Nvc\BIN\NIP.EXE
C:\Program Files\Apoint2K\HidFind.exe
C:\Program Files\Apoint2K\Apntex.exe
C:\Program Files\Logitech\Video\FxSvr2.exe
C:\WINDOWS\system32\conime.exe
C:\SOFT\NORMAN\Nvc\BIN\NVCSCHED.EXE
C:\SOFT\NORMAN\Nvc\BIN\nipsvc.exe
C:\soft\Norman\bin\NJEEVES.EXE
C:\WINDOWS\System32\alg.exe
C:\Program Files\Logitech\MouseWare\system\em_exec.exe
C:\soft\Norman\bin\niu.exe
C:\WINDOWS\system32\wscntfy.exe
C:\soft\临时文件夹\hijackthis1.99.1\hijackthis1[1][1].99.1\HijackThis1991zww.exe

O2 - BHO: ThunderIEHelper Class - {0005A87D-D626-4B3A-84F9-1D9571695F55} - C:\WINDOWS\system32\xunleibho_v4.dll
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\soft\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {3D898C55-74CC-4B7C-B5F1-45913F368388} - C:\WINDOWS\system32\mewin.dll
O2 - BHO: DriveLetterAccess - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\system32\dla\tfswshx.dll
O2 - BHO: (no name) - {A5366673-E8CA-11D3-9CD9-0090271D075B} - (no file)
O3 - IE工具栏增项: (no name) - {E0E899AB-F487-11D5-8D29-0050BA6940E3} - (no file)
O4 - 启动项HKLM\\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
O4 - 启动项HKLM\\Run: [PHIME2002ASync] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC
O4 - 启动项HKLM\\Run: [PHIME2002A] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName
O4 - 启动项HKLM\\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe
O4 - 启动项HKLM\\Run: [Apoint] C:\Program Files\Apoint2K\Apoint.exe
O4 - 启动项HKLM\\Run: [LoadBtnHnd] C:\Program Files\Fujitsu\BtnHnd\BtnHnd.exe
O4 - 启动项HKLM\\Run: [FJUPDNV_Chitose] C:\Program Files\Fujitsu\updnavi\updnavi.exe
O4 - 启动项HKLM\\Run: [IntelWireless] C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe /tf Intel PROSet/Wireless
O4 - 启动项HKLM\\Run: [EOUApp] C:\Program Files\Intel\Wireless\Bin\EOUWiz.exe
O4 - 启动项HKLM\\Run: [AGRSMMSG] AGRSMMSG.exe
O4 - 启动项HKLM\\Run: [IndicatorUtility] C:\Program Files\Fujitsu\Fujitsu Hotkey Utility\IndicatorUty.exe
O4 - 启动项HKLM\\Run: [LoadFujitsuQuickTouch] C:\Program Files\Fujitsu\Application Panel\QuickTouch.exe
O4 - 启动项HKLM\\Run: [dla] C:\WINDOWS\system32\dla\tfswctrl.exe
O4 - 启动项HKLM\\Run: [Norman ZANDA] C:\soft\Norman\bin\ZLH.EXE /LOAD /SPLASH
O4 - 启动项HKLM\\Run: [Logitech Utility] Logi_MwX.Exe
O4 - 启动项HKLM\\Run: [IMSCMig] C:\PROGRA~1\COMMON~1\MICROS~1\IME\IMSC40A\IMSCMIG.EXE /Preload
O4 - 启动项HKLM\\Run: [Timplatform] C:\Program Files\qmail\Timplatform.exe
O4 - 启动项HKLM\\Run: [LVCOMSX] C:\WINDOWS\system32\LVCOMSX.EXE
O4 - 启动项HKLM\\Run: [LogitechVideoRepair] C:\Program Files\Logitech\Video\ISStart.exe
O4 - 启动项HKLM\\Run: [LogitechVideoTray] C:\Program Files\Logitech\Video\LogiTray.exe
O4 - 启动项HKLM\\Run: [ISUSScheduler] "C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" -start
O4 - 启动项HKLM\\Run: [hxgame-update] C:\game\幻想游戏\hxgame4.2\hxgameupdate\hxgame-update.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [LogitechSoftwareUpdate] "C:\Program Files\Logitech\Video\ManifestEngine.exe" boot
O8 - IE右键菜单中的新增项目: 使用网际快车下载 - C:\soft\FlashGet\jc_link.htm
O8 - IE右键菜单中的新增项目: 使用网际快车下载全部链接 - C:\soft\FlashGet\jc_all.htm
O9 - 浏览器额外的按钮: 信息检索 - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\soft\MICROS~1\OFFICE11\REFIEBAR.DLL
O9 - 浏览器额外的按钮: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (file missing)
O9 - 浏览器额外的“工具”菜单项: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (file missing)
O12 - IE插件,支持文件类型.pdf: C:\Program Files\Internet Explorer\PLUGINS\nppdf32.dll
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1121994374333
O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxsrvc.dll
O20 - Winlogon Notify: IntelWireless - C:\Program Files\Intel\Wireless\Bin\LgNotify.dll
O23 - NT 服务: EvtEng - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
O23 - NT 服务: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - NT 服务: Norman API-hooking helper (NipSvc) - Unknown owner - C:\SOFT\NORMAN\Nvc\BIN\nipsvc.exe
O23 - NT 服务: Norman NJeeves - Unknown owner - C:\soft\Norman\bin\NJEEVES.EXE
O23 - NT 服务: Norman ZANDA - Unknown owner - C:\soft\Norman\bin\ZANDA.EXE
O23 - NT 服务: Norman Virus Control on-access component (nvcoas) - Norman ASA - C:\SOFT\NORMAN\Nvc\BIN\nvcoas.exe
O23 - NT 服务: Norman Virus Control Scheduler (NVCScheduler) - Norman Data Defense Systems - C:\SOFT\NORMAN\Nvc\BIN\NVCSCHED.EXE
O23 - NT 服务: OwnershipProtocol - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\OProtSvc.exe
O23 - NT 服务: RegSrvc - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
O23 - NT 服务: Spectrum24 Event Monitor (S24EventMonitor) - Intel Corporation  - C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
最后编辑2005-10-13 13:46:49
分享到:
gototop
 

【回复“寒消”的帖子】
修复:
O2 - BHO: (no name) - {3D898C55-74CC-4B7C-B5F1-45913F368388} - C:\WINDOWS\system32\mewin.dll
O2 - BHO: DriveLetterAccess - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\system32\dla\tfswshx.dll
删除:
C:\WINDOWS\system32\mewin.dll
gototop
 
1   1  /  1  页   跳转
页面顶部
Powered by Discuz!NT