1   1  /  1  页   跳转

高手,请进

高手,请进

我想删掉“天下搜”,“中文上网”,“虎翼DIY吧”等垃圾怎么办?
Logfile of HijackThis v1.99.1
Scan saved at 9:39:03, on 2005-9-9
Platform: Windows 2003  (WinNT 5.02.3790)
MSIE: Internet Explorer v6.00 (6.00.3790.0000)

Running processes:
D:\WINDOWS\System32\smss.exe
D:\WINDOWS\system32\winlogon.exe
D:\WINDOWS\system32\services.exe
D:\WINDOWS\system32\lsass.exe
D:\WINDOWS\system32\svchost.exe
D:\WINDOWS\System32\svchost.exe
F:\RISING\RAV\Ravmond.exe
D:\WINDOWS\System32\svchost.exe
f:\rising\rfw\rfwsrv.exe
F:\RISING\RAV\RavStub.exe
D:\WINDOWS\system32\spoolsv.exe
D:\WINDOWS\System32\svchost.exe
D:\WINDOWS\system32\nvsvc32.exe
F:\RISING\RAV\CCENTER.EXE
D:\WINDOWS\system32\Dfssvc.exe
D:\WINDOWS\Explorer.EXE
D:\WINDOWS\system32\RunDll32.exe
F:\RISING\RAV\RAVTIMER.EXE
F:\RISING\RAV\RAVMON.EXE
F:\rising\Rfw\rfwmain.exe
D:\Program Files\Common Files\Real\Update_OB\realsched.exe
D:\Program Files\CNNIC\Cdn\cdnup.exe
D:\WINDOWS\system32\CTFMON.EXE
F:\Tencent\QQ\QQ.exe
f:\Tencent\QQ\TIMPlatform.exe
D:\WINDOWS\System32\svchost.exe
F:\Tencent\QQ\QQ.exe
F:\Tencent\TT\TTraveler.exe
F:\Tencent\QQ\QQ.exe
G:\下载\hijackthis\HijackThis.exe

R3 - URLSearchHook: 虎翼DIY吧! - {0A00D11E-B1E7-44b5-AD88-C9190876AAC4} - D:\WINDOWS\system32\diybar2\diybar2.dll
O2 - BHO: CNNIC_IDN - {35980F6E-A137-4E50-953D-813BB8556899} - D:\PROGRA~1\CNNIC\Cdn\cdniehlp.dll (file missing)
O2 - BHO: Link Filter - {4022F902-ABC7-4C79-924F-BB26F1D355A2} - D:\WINDOWS\system32\diybar2\diybar2.dll
O2 - BHO: QQBrowserHelperObject Class - {54EBD53A-9BC1-480B-966A-843A333CA162} - f:\Tencent\QQ\QQIEHelper.dll
O2 - BHO: IeCatch2 Class - {A5366673-E8CA-11D3-9CD9-0090271D075B} - F:\FLASHGET\jccatch.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - d:\program files\google\googletoolbar.dll
O2 - BHO: DownloadBHO T2BHO - {B1D147E7-873E-4909-8127-695D9BB78728} - D:\WINDOWS\Downloaded Program Files\CONFLICT.1\barhelp22.0.dll
O2 - BHO: InsIII - {DDDE2452-AF9E-4577-AE6C-465DBCB54D49} - D:\WINDOWS\system32\brinsthd.dll
O3 - Toolbar: FlashGet Bar - {E0E899AB-F487-11D5-8D29-0050BA6940E3} - F:\FLASHGET\fgiebar.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - d:\program files\google\googletoolbar.dll
O3 - Toolbar: 虎翼DIY吧! - {0A00D11E-B1E7-44b5-AD88-C9190876AAC4} - D:\WINDOWS\system32\diybar2\diybar2.dll
O3 - Toolbar: @msdxmLC.dll,-1@2052,电台(&R) - {8E718888-423F-11D2-876E-00A0C9082467} - D:\WINDOWS\system32\msdxm.ocx
O4 - HKLM\..\Run: [IMJPMIG8.1] "D:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
O4 - HKLM\..\Run: [PHIME2002ASync] D:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC
O4 - HKLM\..\Run: [PHIME2002A] D:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName
O4 - HKLM\..\Run: [Cmaudio] RunDll32 cmicnfg.cpl,CMICtrlWnd
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE NvQTwk,NvCplDaemon initialize
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [IMSCMig] D:\PROGRA~1\COMMON~1\MICROS~1\IME\IMSC40A\IMSCMIG.EXE /Preload
O4 - HKLM\..\Run: [RavTimer] F:\RISING\RAV\RAVTIMER.EXE
O4 - HKLM\..\Run: [RavMon] F:\RISING\RAV\RAVMON.EXE -SYSTEM
O4 - HKLM\..\Run: [MSPY2002] D:\WINDOWS\system32\IME\PINTLGNT\ImScInst.exe /SYNC
O4 - HKLM\..\Run: [RfwMain] "f:\rising\Rfw\rfwmain.exe" -Startup
O4 - HKLM\..\Run: [TkBellExe] "D:\Program Files\Common Files\Real\Update_OB\realsched.exe"  -osboot
O4 - HKLM\..\Run: [CdnCtr] D:\Program Files\CNNIC\Cdn\cdnup.exe
O4 - HKCU\..\Run: [ctfmon.exe] D:\WINDOWS\system32\ctfmon.exe
O4 - Startup: 腾讯QQ.lnk = F:\Tencent\QQ\QQ.exe
O8 - Extra context menu item: &Google Search - res://D:\Program Files\Google\googletoolbar.dll/cmsearch.html
O8 - Extra context menu item: 使用网际快车下载 - F:\FlashGet\jc_link.htm
O8 - Extra context menu item: 使用网际快车下载全部链接 - F:\FlashGet\jc_all.htm
O8 - Extra context menu item: 反向链接 - res://D:\Program Files\Google\googletoolbar.dll/cmbacklinks.html
O8 - Extra context menu item: 导出到 Microsoft Office Excel(&X) - res://F:\MICROS~1\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: 导出当前页到超星阅览器(&A) - F:\SSREADER36\ss_all.htm
O8 - Extra context menu item: 导出选中部分到超星阅览器(&S) - F:\SSREADER36\ss_select.htm
O8 - Extra context menu item: 添加到QQ自定义面板 - F:\Tencent\QQ\AddPanel.htm
O8 - Extra context menu item: 添加到QQ表情 - F:\Tencent\QQ\AddEmotion.htm
O8 - Extra context menu item: 用QQ彩信发送该图片 - F:\Tencent\QQ\SendMMS.htm
O8 - Extra context menu item: 类似网页 - res://D:\Program Files\Google\googletoolbar.dll/cmsimilar.html
O8 - Extra context menu item: 缓存的网页快照 - res://D:\Program Files\Google\googletoolbar.dll/cmcache.html
O9 - Extra button: (no name) - {3F686D91-4AFA-4ed1-B43F-F1DB46ED480C} - D:\WINDOWS\system32\shdocvw.dll
O9 - Extra 'Tools' menuitem: Link Filter - {3F686D91-4AFA-4ed1-B43F-F1DB46ED480C} - D:\WINDOWS\system32\shdocvw.dll
O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - D:\WINDOWS\web\related.htm
O9 - Extra 'Tools' menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - D:\WINDOWS\web\related.htm
O9 - Extra button: QQ - {c95fe080-8f5d-11d2-a20b-00aa003c157b} - f:\Tencent\QQ\QQ.EXE
O9 - Extra 'Tools' menuitem: 腾讯QQ - {c95fe080-8f5d-11d2-a20b-00aa003c157b} - f:\Tencent\QQ\QQ.EXE
O9 - Extra button: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - F:\FLASHGET\flashget.exe
O9 - Extra 'Tools' menuitem: &FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - F:\FLASHGET\flashget.exe
O9 - Extra button: (no name) - {DEDEB80D-FA35-45d9-9460-4983E5A8AFE6} - f:\Tencent\QQ\QQIEHelper.dll
O9 - Extra 'Tools' menuitem: QQ炫彩工具条设置 - {DEDEB80D-FA35-45d9-9460-4983E5A8AFE6} - f:\Tencent\QQ\QQIEHelper.dll
O11 - Options group: [CDNCLIENT]  中文上网
O16 - DPF: {28E0FA88-ABA8-4937-A247-3031F1A11165} (Installer Class) - http://pi.51.net/download/diybar2.cab
O16 - DPF: {488A4255-3236-44B3-8F27-FA1AECAA8844} (CEditCtrl Object) - https://img.alipay.com/download/aliedit.cab
O16 - DPF: {56336BCB-3D8A-11D6-A00B-0050DA18DE71} (RdxIE Class) - http://software-dl.real.com/02379a10a3c8aa336405/netzip/RdxIE601_cn.cab
O16 - DPF: {56A7DC70-E102-4408-A34A-AE06FEF01586} (天下搜索) - http://iebar.t2t2.com/iebar.cab
O16 - DPF: {98A62E3F-A8C5-4EF0-8A00-C70CF9D18A89} (LoaderCore Class) - http://tb.sogou.com/DLLoader.cab
O16 - DPF: {9A578C98-3C2F-4630-890B-FC04196EF420} (CNNIC_IDN) - http://client.jogo.cn/download/cnnic/cdn.cab
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/MsnMessengerSetupDownloader.cab
O16 - DPF: {F138084D-84D7-48CD-BEA8-04772457516E} (VqqSpeedDlProxy Class) - http://218.85.138.27/vqqsdl1009.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{CA808A17-6DC7-47E8-A9E9-29F79C60F9A8}: NameServer = 220.168.208.3,220.168.208.6
O18 - Protocol: dynascript - {3050F3B2-98B5-11CF-BB82-00AA00BDCE0B} - D:\WINDOWS\system32\mshtml.dll
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "D:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)
O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - D:\WINDOWS\system32\nvsvc32.exe
O23 - Service: Rising Personal Firewall Service (RfwService) - Beijing Rising Technology Corporation Limited - f:\rising\rfw\rfwsrv.exe
O23 - Service: Rising Process Communication Center (RsCCenter) - rising - F:\RISING\RAV\CCENTER.EXE
O23 - Service: RsRavMon Service (RsRavMon) - Beijing Rising Technology Co., Ltd. - F:\RISING\RAV\Ravmond.exe
最后编辑2005-09-10 00:36:57
分享到:
gototop
 

想删除就删除啊~~
gototop
 

建议在安全模式下修复
R3 - URLSearchHook: 虎翼DIY吧! - {0A00D11E-B1E7-44b5-AD88-C9190876AAC4} - D:\WINDOWS\system32\diybar2\diybar2.dll
如果楼主知道是安全的~可以不修复~~
其他项我不确定有问题~还是请版主帮忙吧
gototop
 

【回复“吴沁”的帖子】
关于中文上网您可以先卸载然后修复下面的项目:
从“开始菜单”>>“程序”>>“中文上网官方版软件”>>“卸载中文上网官方版软件”卸载。
或者
从“控制面板”>>“添加/删除程序”,找到“中文上网官方版软件”,卸载。


重新启动到安全模式(进入安全模式的方法:重新启动电脑, 开机自动检测完后, 按[F8]键(可以一直按到启动菜单出来为止), 选择安全模式(Safe Mode)进入Windows。)

请关闭所有IE界面,重新使用HijackThis扫描一次,选中下面建议修复的项目,让HijackThis修复,修复前请允许HijackThis保留备份。(如果楼主知道是安全的可以不必勾选)
R3 - URLSearchHook: 虎翼DIY吧! - {0A00D11E-B1E7-44b5-AD88-C9190876AAC4} - D:\WINDOWS\system32\diybar2\diybar2.dll
O2 - BHO: CNNIC_IDN - {35980F6E-A137-4E50-953D-813BB8556899} - D:\PROGRA~1\CNNIC\Cdn\cdniehlp.dll (file missing)
O2 - BHO: Link Filter - {4022F902-ABC7-4C79-924F-BB26F1D355A2} - D:\WINDOWS\system32\diybar2\diybar2.dll
O2 - BHO: DownloadBHO T2BHO - {B1D147E7-873E-4909-8127-695D9BB78728} - D:\WINDOWS\Downloaded Program Files\CONFLICT.1\barhelp22.0.dll
O2 - BHO: InsIII - {DDDE2452-AF9E-4577-AE6C-465DBCB54D49} - D:\WINDOWS\system32\brinsthd.dll
O3 - Toolbar: 虎翼DIY吧! - {0A00D11E-B1E7-44b5-AD88-C9190876AAC4} - D:\WINDOWS\system32\diybar2\diybar2.dll
O4 - HKLM\..\Run: [CdnCtr] D:\Program Files\CNNIC\Cdn\cdnup.exe
O11 - Options group: [CDNCLIENT] 中文上网
O16 - DPF: {28E0FA88-ABA8-4937-A247-3031F1A11165} (Installer Class) - http://pi.51.net/download/diybar2.cab
O16 - DPF: {56A7DC70-E102-4408-A34A-AE06FEF01586} (天下搜索) - http://iebar.t2t2.com/iebar.cab

然后打开我的电脑→再点工具→打开文件夹选项→查看→把隐藏受保护的系统文件(推荐)和隐藏已知文件类型的扩展名的勾去掉→再显示所有文件→找到以下文件并删除:
D:\WINDOWS\Downloaded Program Files\CONFLICT.1\barhelp22.0.dll
D:\WINDOWS\system32\brinsthd.dll
删除文件夹:D:\WINDOWS\system32\diybar2
删除文件夹:D:\PROGRA~1\CNNIC

gototop
 

【回复“飞跃迷离”的帖子】
能不能帮我找到它们在注册表中的注册项,我好清理注册表。
gototop
 

【回复“吴沁”的帖子】
HijackThis的修复工作其实就是清理注册表项。
gototop
 

哦,谢啦
gototop
 

问一个很傻的问题,是先修复还是先删除
gototop
 

先修复再删除
gototop
 
1   1  /  1  页   跳转
页面顶部
Powered by Discuz!NT