瑞星卡卡安全论坛技术交流区反病毒/反流氓软件论坛 求助:今天用卡巴扫描发现中了特洛伊木马无法清除,请高手指点,谢谢!

1   1  /  1  页   跳转页

求助:今天用卡巴扫描发现中了特洛伊木马无法清除,请高手指点,谢谢!

收藏
郭建磊
头像
初生襁褓狮
  • 帖子:28
  • 注册: 2005-10-06
  • 来自:
发表于： 2006-06-07 21:29 | 只看楼主 短消息 资料
字号： 小 中 大 1楼

求助:今天用卡巴扫描发现中了特洛伊木马无法清除,请高手指点,谢谢!

HijackThis_zww汉化版扫描日志 V1.99.1
保存于      21:15:04, 日期 2006-6-7
操作系统：  Windows XP SP2 (WinNT 5.01.2600)
浏览器：    Internet Explorer v6.00 SP2 (6.00.2900.2180)

当前运行的进程：         
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\appcheck.exe
C:\WINDOWS\system32\checkapp.exe
C:\Program Files\3000soft\Red Spider\RSagent.exe
C:\WINDOWS\system32\inetsrv\inetinfo.exe
C:\Program Files\3000soft\Red Spider\EPOINTER.EXE
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\Program Files\VMware\VMware Workstation\vmware-authd.exe
C:\Program Files\Common Files\VMware\VMware Virtual Image Editing\vmount2.exe
C:\WINDOWS\system32\vmnat.exe
C:\WINDOWS\system32\vmnetdhcp.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Tencent\QQ\QQ.exe
C:\Program Files\Tencent\QQ\TIMPlatform.exe
E:\guoguo1\2535952005811174944\HijackThis1991zww.exe
R3 - URLSearchHook: (no name) - <default> - (no file)
R3 - URLSearchHook: (no name) - {9D19E2ED-1777-40DB-A4CF-472123947078} - C:\WINDOWS\system32\Tbfyr.dll (file missing)
R3 - URLSearchHook: (no name) - {B0C28F8B-5DAE-45E3-975E-E1AFACA9F2C2} - C:\WINDOWS\system32\Jbir.dll (file missing)
R3 - URLSearchHook: (no name) - {AEF09650-4E3A-4FD5-919C-ED91F7BF44E1} - C:\WINDOWS\system32\Cghn.dll (file missing)
R3 - URLSearchHook: (no name) - {2AEAD5E4-C915-4359-A172-25127A2DCF19} - C:\WINDOWS\system32\Dssf.dll (file missing)
R3 - URLSearchHook: (no name) - {621ED108-3374-4DE1-9971-B57BA9F82147} - C:\WINDOWS\system32\Yeai.dll
R3 - URLSearchHook: (no name) - {FF9E4EF4-2D57-4B4E-9529-E1CE22EC478F} - C:\WINDOWS\system32\Iiyxu.dll
R3 - URLSearchHook: Tencent SearchHook - {DB8B2393-7A6C-4C76-88CE-6B1F6FF6FFE9} - C:\Program Files\TENCENT\Adplus\SSAddr.dll
R3 - URLSearchHook: (no name) - {213313D1-C5FA-43C3-86F2-D243775D4C63} - C:\WINDOWS\system32\Slhz.dll
R3 - URLSearchHook: (no name) - {C0BDE6B8-844D-452A-9B1F-FB2388E934AB} - C:\WINDOWS\system32\Ckogo.dll
R3 - URLSearchHook: (no name) - {FA6AB07F-B57B-4714-8143-7FBAFE46A0FC} - C:\WINDOWS\system32\Ynmkpj.dll
R3 - URLSearchHook: (no name) - {E1F3B3A8-0FDD-42D7-96E0-5B1505DCAFA2} - C:\WINDOWS\system32\Qxwxb.dll
R3 - URLSearchHook: (no name) - {93421621-F52A-4AF0-B53B-074E25C47BB7} - C:\WINDOWS\system32\Rzfid.dll
R3 - URLSearchHook: (no name) - {01D9A09B-82A0-4B96-BA90-0E4C47BB7155} - C:\WINDOWS\system32\Pzzvwb.dll
R3 - URLSearchHook: (no name) - {2D5B44F5-C6DF-4858-AE0A-5935C4E91B63} - C:\WINDOWS\system32\Fvviq.dll
F2 - REG:system.ini: UserInit=userinit.exe,
O2 - BHO: ThunderIEHelper - {0005A87D-D626-4B3A-84F9-1D9571695F55} - C:\WINDOWS\system32\xunleibho_v14.dll
O2 - BHO: (no name) - {01D9A09B-82A0-4B96-BA90-0E4C47BB7155} - C:\WINDOWS\system32\Pzzvwb.dll
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Acrobat\ActiveX\AcroIEHelper.ocx
O2 - BHO: Tencent Browser Helper - {0C7C23EF-A848-485B-873C-0ED954731014} - C:\Program Files\TENCENT\Adplus\SSAddr.dll
O2 - BHO: (no name) - {213313D1-C5FA-43C3-86F2-D243775D4C63} - C:\WINDOWS\system32\Slhz.dll
O2 - BHO: (no name) - {2AEAD5E4-C915-4359-A172-25127A2DCF19} - C:\WINDOWS\system32\Dssf.dll (file missing)
O2 - BHO: (no name) - {2D5B44F5-C6DF-4858-AE0A-5935C4E91B63} - C:\WINDOWS\system32\Fvviq.dll
O2 - BHO: TeachingHandler - {31EBA2E2-58B2-4980-9C41-F12F5F1422C5} - C:\WINDOWS\system32\TPHANDLE.dll
O2 - BHO: QQIEHelper - {54EBD53A-9BC1-480B-966A-843A333CA162} - C:\Program Files\Tencent\QQ\QQIEHelper.dll
O2 - BHO: (no name) - {621ED108-3374-4DE1-9971-B57BA9F82147} - C:\WINDOWS\system32\Yeai.dll
O2 - BHO: BandIE Class - {77FEF28E-EB96-44FF-B511-3185DEA48697} - C:\PROGRA~1\baidu\bar\baidubar.dll
O2 - BHO: ThunderBHO - {889D2FEB-5411-4565-8998-1DD2C5261283} - C:\Program Files\Thunder Network\Thunder\ComDlls\XunLeiBHO_001.dll
O2 - BHO: (no name) - {93421621-F52A-4AF0-B53B-074E25C47BB7} - C:\WINDOWS\system32\Rzfid.dll
O2 - BHO: Accoona Search Assistant - {944864A5-3916-46E2-96A9-A2E84F3F1208} - C:\Program Files\Accoona\ASearchAssist.dll (file missing)
O2 - BHO: (no name) - {9D19E2ED-1777-40DB-A4CF-472123947078} - C:\WINDOWS\system32\Tbfyr.dll (file missing)
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll
O2 - BHO: (no name) - {AEF09650-4E3A-4FD5-919C-ED91F7BF44E1} - C:\WINDOWS\system32\Cghn.dll (file missing)
O2 - BHO: (no name) - {B0C28F8B-5DAE-45E3-975E-E1AFACA9F2C2} - C:\WINDOWS\system32\Jbir.dll (file missing)
O2 - BHO: MacroMediapd - {B8CCDD47-38E4-4CD2-B7FA-3B4B690F74BD} - C:\WINDOWS\system32\microapmddt.dll (file missing)
O2 - BHO: (no name) - {C0BDE6B8-844D-452A-9B1F-FB2388E934AB} - C:\WINDOWS\system32\Ckogo.dll
O2 - BHO: (no name) - {E1F3B3A8-0FDD-42D7-96E0-5B1505DCAFA2} - C:\WINDOWS\system32\Qxwxb.dll
O2 - BHO: (no name) - {FA6AB07F-B57B-4714-8143-7FBAFE46A0FC} - C:\WINDOWS\system32\Ynmkpj.dll
O2 - BHO: (no name) - {FF9E4EF4-2D57-4B4E-9529-E1CE22EC478F} - C:\WINDOWS\system32\Iiyxu.dll
O3 - IE工具栏增项: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll
O3 - IE工具栏增项: 百度超级搜霸 - {B580CF65-E151-49C3-B73F-70B13FCA8E86} - C:\PROGRA~1\baidu\bar\baidubar.dll
O4 - 启动项HKLM\\Run: [HNETPOLCY] rundll32.exe C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\RarSFX1\HNETPO~1.DLL,Start
O4 - 启动项HKLM\\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - 启动项HKLM\\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe"  -osboot
O4 - 启动项HKLM\\Run: [stup.exe] C:\PROGRA~1\TENCENT\Adplus\stup.exe
O4 - 启动项HKLM\\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O4 - 启动项HKLM\\Run: [KAVPersonal50] "C:\Documents and Settings\Administrator\桌面\新建文件夹\卡巴斯基KEY大全\Kaspersky Anti-Virus Personal\kav.exe" /minimize
O4 - 启动项HKLM\\Run: [KillTrojanMaster] C:\Program Files\木马专杀大师\木马专杀大师.exe
O4 - 启动项HKLM\\RunOnce: [Rfw] "C:\Program Files\rising\Rfw\Update\Setup.exe" /UPDATE /ONCE
O4 - HKCU\..\Run: [HNETPOLCY] rundll32.exe C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\RarSFX1\HNETPO~1.DLL,Start
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O8 - IE右键菜单中的新增项目: &Google Search - res://c:\program files\google\GoogleToolbar2.dll/cmsearch.html
O8 - IE右键菜单中的新增项目: &Translate English Word - res://c:\program files\google\GoogleToolbar2.dll/cmwordtrans.html
O8 - IE右键菜单中的新增项目: &使用迅雷下载 - C:\Program Files\Thunder Network\Thunder\Program\GetUrl.htm
O8 - IE右键菜单中的新增项目: &使用迅雷下载全部链接 - C:\Program Files\Thunder Network\Thunder\Program\GetAllUrl.htm
O8 - IE右键菜单中的新增项目: Backward Links - res://c:\program files\google\GoogleToolbar2.dll/cmbacklinks.html
O8 - IE右键菜单中的新增项目: Cached Snapshot of Page - res://c:\program files\google\GoogleToolbar2.dll/cmcache.html
O8 - IE右键菜单中的新增项目: Similar Pages - res://c:\program files\google\GoogleToolbar2.dll/cmsimilar.html
O8 - IE右键菜单中的新增项目: Translate Page into English - res://c:\program files\google\GoogleToolbar2.dll/cmtrans.html
O8 - IE右键菜单中的新增项目: 上传到QQ网络硬盘 - C:\Program Files\Tencent\QQ\AddToNetDisk.htm
O8 - IE右键菜单中的新增项目: 使用网际快车下载 - C:\PROGRA~1\FLASHGET\jc_link.htm
O8 - IE右键菜单中的新增项目: 使用网际快车下载全部链接 - C:\PROGRA~1\FLASHGET\jc_all.htm
O8 - IE右键菜单中的新增项目: 导出到 Microsoft Office Excel(&X) - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O8 - IE右键菜单中的新增项目: 添加到QQ自定义面板 - C:\Program Files\Tencent\QQ\AddPanel.htm
O8 - IE右键菜单中的新增项目: 添加到QQ表情 - C:\Program Files\Tencent\QQ\AddEmotion.htm
O8 - IE右键菜单中的新增项目: 用QQ彩信发送该图片 - C:\Program Files\Tencent\QQ\SendMMS.htm
O8 - IE右键菜单中的新增项目: 用比特精灵下载(&B) - C:\Program Files\BitSpirit\bsurl.htm
O9 - 浏览器额外的按钮: 信息检索 - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - 浏览器额外的按钮: QQ - {c95fe080-8f5d-11d2-a20b-00aa003c157b} - C:\Program Files\Tencent\QQ\QQ.EXE
O9 - 浏览器额外的“工具”菜单项: 腾讯QQ - {c95fe080-8f5d-11d2-a20b-00aa003c157b} - C:\Program Files\Tencent\QQ\QQ.EXE
O9 - 浏览器额外的按钮: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\PROGRA~1\FLASHGET\flashget.exe (file missing)
O9 - 浏览器额外的“工具”菜单项: &FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\PROGRA~1\FLASHGET\flashget.exe (file missing)
O9 - 浏览器额外的按钮: (no name) - {DEDEB80D-FA35-45d9-9460-4983E5A8AFE6} - C:\Program Files\Tencent\QQ\QQIEHelper.dll
O9 - 浏览器额外的“工具”菜单项: QQ炫彩工具条设置 - {DEDEB80D-FA35-45d9-9460-4983E5A8AFE6} - C:\Program Files\Tencent\QQ\QQIEHelper.dll
最后编辑2006-06-07 21:37:50
分享到：
gototop
 
郭建磊
头像
初生襁褓狮
  • 帖子:28
  • 注册: 2005-10-06
  • 来自:
发表于： 2006-06-07 21:29 | 只看楼主 短消息 资料
字号： 小 中 大 2楼

O9 - 浏览器额外的按钮: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - 浏览器额外的“工具”菜单项: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O11 - Options group: [TBH]  搜搜地址栏搜索
O15 - “受信任的站点”中添加项: http://*.localhost
O16 - DPF: {3D8F74EE-8692-4F8F-B8D2-7522E732519E} (WebActivater Control) - http://game.qq.com/QQGame2.cab
O16 - DPF: {6A9735F1-72AA-49E9-9981-A13C3FD8641B} (WuYou.WySystem) - http://localhost/webexam/Activex/WySystem.cab
O16 - DPF: {E4E2F180-CB8B-4DE9-ACBB-DA745D3BA153} (Rising Web Scan Object) - http://download.rising.com.cn/register/pcver/autoupgradepad/pcver2006new/OL2006.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{622ECC27-3738-48A6-BFC0-76EFECEE1525}: NameServer = 202.99.160.68,211.90.8.129
O17 - HKLM\System\CCS\Services\Tcpip\..\{714468A4-A6C7-459C-A079-ABB4AFF6C9B3}: NameServer = 202.99.160.68
O18 - 列举现有的协议: about - {3050F406-98B5-11CF-BB82-00AA00BDCE0B} - C:\WINDOWS\system32\mshtml.dll
O18 - 列举现有的协议: cdl - {3DD53D40-7B8B-11D0-B013-00AA0059CE02} - C:\WINDOWS\system32\urlmon.dll
O18 - 列举现有的协议: dvd - {12D51199-0DB5-46FE-A120-47A3D7D937CC} - C:\WINDOWS\system32\msvidctl.dll
O18 - 列举现有的协议: file - {79EAC9E7-BAF9-11CE-8C82-00AA004BA90B} - C:\WINDOWS\system32\urlmon.dll
O18 - 列举现有的协议: ftp - {79EAC9E3-BAF9-11CE-8C82-00AA004BA90B} - C:\WINDOWS\system32\urlmon.dll
O18 - 列举现有的协议: gopher - {79EAC9E4-BAF9-11CE-8C82-00AA004BA90B} - C:\WINDOWS\system32\urlmon.dll
O18 - 列举现有的协议: http - {79EAC9E2-BAF9-11CE-8C82-00AA004BA90B} - C:\WINDOWS\system32\urlmon.dll
O18 - 列举现有的协议: https - {79EAC9E5-BAF9-11CE-8C82-00AA004BA90B} - C:\WINDOWS\system32\urlmon.dll
O18 - 列举现有的协议: ipp - (no CLSID) - (no file)
O18 - 列举现有的协议: its - {9D148291-B9C8-11D0-A4CC-0000F80149F6} - C:\WINDOWS\system32\itss.dll
O18 - 列举现有的协议: javascript - {3050F3B2-98B5-11CF-BB82-00AA00BDCE0B} - C:\WINDOWS\system32\mshtml.dll
O18 - 列举现有的协议: local - {79EAC9E7-BAF9-11CE-8C82-00AA004BA90B} - C:\WINDOWS\system32\urlmon.dll
O18 - 列举现有的协议: mailto - {3050F3DA-98B5-11CF-BB82-00AA00BDCE0B} - C:\WINDOWS\system32\mshtml.dll
O18 - 列举现有的协议: mhtml - {05300401-BCBC-11D0-85E3-00C04FD85AB4} - C:\WINDOWS\system32\inetcomm.dll
O18 - 列举现有的协议: mk - {79EAC9E6-BAF9-11CE-8C82-00AA004BA90B} - C:\WINDOWS\system32\urlmon.dll
O18 - 列举现有的协议: ms-its - {9D148291-B9C8-11D0-A4CC-0000F80149F6} - C:\WINDOWS\system32\itss.dll
O18 - 列举现有的协议: ms-itss - {0A9007C0-4076-11D3-8789-0000F8105754} - C:\Program Files\Common Files\Microsoft Shared\Information Retrieval\MSITSS.DLL
O18 - 列举现有的协议: msdaipp - (no CLSID) - (no file)
O18 - 列举现有的协议: mso-offdap - {3D9F03FA-7A94-11D3-BE81-0050048385D1} - C:\PROGRA~1\COMMON~1\MICROS~1\WEBCOM~1\10\OWC10.DLL
O18 - 列举现有的协议: mso-offdap11 - {32505114-5902-49B2-880A-1F7738E5A384} - C:\PROGRA~1\COMMON~1\MICROS~1\WEBCOM~1\11\OWC11.DLL
gototop
 
郭建磊
头像
初生襁褓狮
  • 帖子:28
  • 注册: 2005-10-06
  • 来自:
发表于： 2006-06-07 21:31 | 只看楼主 短消息 资料
字号： 小 中 大 3楼

O18 - 列举现有的协议: res - {3050F3BC-98B5-11CF-BB82-00AA00BDCE0B} - C:\WINDOWS\system32\mshtml.dll
O18 - 列举现有的协议: sysimage - {76E67A63-06E9-11D2-A840-006008059382} - C:\WINDOWS\system32\mshtml.dll
O18 - 列举现有的协议: tv - {CBD30858-AF45-11D2-B6D6-00C04FBBDE6E} - C:\WINDOWS\system32\msvidctl.dll
O18 - 列举现有的协议: vbscript - {3050F3B2-98B5-11CF-BB82-00AA00BDCE0B} - C:\WINDOWS\system32\mshtml.dll
O18 - 列举现有的协议: wia - {13F3EA8B-91D7-4F0A-AD76-D2853AC8BECE} - C:\WINDOWS\system32\wiascr.dll
O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxsrvc.dll
O23 - NT 服务: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - NT 服务: Application Checker for Windows (appcheck) - Unknown owner - C:\WINDOWS\system32\appcheck.exe
O23 - NT 服务: Windows Application Checker (checkapp) - Unknown owner - C:\WINDOWS\system32\checkapp.exe
O23 - NT 服务: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - NT 服务: kavsvc - Kaspersky Lab - C:\Documents and Settings\Administrator\桌面\新建文件夹\卡巴斯基KEY大全\Kaspersky Anti-Virus Personal\kavsvc.exe
O23 - NT 服务: Macromedia Licensing Service - Unknown owner - C:\Program Files\Common Files\Macromedia Shared\Service\Macromedia Licensing.exe
O23 - NT 服务: Rising Proxy  Service (RfwProxySrv) - Beijing Rising Technology Co., Ltd. - c:\program files\rising\rfw\rfwproxy.exe
O23 - NT 服务: Rising Personal Firewall Service (RfwService) - Beijing Rising Technology Co., Ltd. - c:\program files\rising\rfw\rfwsrv.exe
O23 - NT 服务: VMware Authorization Service (VMAuthdService) - VMware, Inc. - C:\Program Files\VMware\VMware Workstation\vmware-authd.exe
O23 - NT 服务: VMware DHCP Service (VMnetDHCP) - VMware, Inc. - C:\WINDOWS\system32\vmnetdhcp.exe
O23 - NT 服务: VMware Virtual Mount Manager Extended (vmount2) - VMware, Inc. - C:\Program Files\Common Files\VMware\VMware Virtual Image Editing\vmount2.exe
O23 - NT 服务: VMware NAT Service - VMware, Inc. - C:\WINDOWS\system32\vmnat.exe
gototop
 
我无邪
头像
高贵耄耋狮
  • 帖子:20720
  • 注册: 2004-06-10
  • 来自:广西玉林
发表于： 2006-06-07 21:37 | 短消息 资料
字号： 小 中 大 4楼

O23 - NT 服务: Windows Application Checker (checkapp) - Unknown owner - C:\WINDOWS\system32\checkapp.exe
O23 - NT 服务: Application Checker for Windows (appcheck) - Unknown owner - C:\WINDOWS\system32\appcheck.exe
这2项如果你也不知道，建议删除
开始→运行→输入services.msc，打开“服务”→查找 Windows Application Checker，Application Checker for Windows →双击→启动类型→禁止→停止→应用→确定。禁止Windows Application Checker，Application Checker for Windows 这个服务
重启
关闭所有浏览窗口以及一些不必要的程序
运行Hijackthis，扫描结束后在下列选项前打上勾，然后选"修复""（如果有的话）
R3 - URLSearchHook: (no name) - <default> - (no file)
R3 - URLSearchHook: (no name) - {9D19E2ED-1777-40DB-A4CF-472123947078} - C:\WINDOWS\system32\Tbfyr.dll (file missing)
R3 - URLSearchHook: (no name) - {B0C28F8B-5DAE-45E3-975E-E1AFACA9F2C2} - C:\WINDOWS\system32\Jbir.dll (file missing)
R3 - URLSearchHook: (no name) - {AEF09650-4E3A-4FD5-919C-ED91F7BF44E1} - C:\WINDOWS\system32\Cghn.dll (file missing)
R3 - URLSearchHook: (no name) - {2AEAD5E4-C915-4359-A172-25127A2DCF19} - C:\WINDOWS\system32\Dssf.dll (file missing)
R3 - URLSearchHook: (no name) - {621ED108-3374-4DE1-9971-B57BA9F82147} - C:\WINDOWS\system32\Yeai.dll
R3 - URLSearchHook: (no name) - {FF9E4EF4-2D57-4B4E-9529-E1CE22EC478F} - C:\WINDOWS\system32\Iiyxu.dll
R3 - URLSearchHook: Tencent SearchHook - {DB8B2393-7A6C-4C76-88CE-6B1F6FF6FFE9} - C:\Program Files\TENCENT\Adplus\SSAddr.dll
R3 - URLSearchHook: (no name) - {213313D1-C5FA-43C3-86F2-D243775D4C63} - C:\WINDOWS\system32\Slhz.dll
R3 - URLSearchHook: (no name) - {C0BDE6B8-844D-452A-9B1F-FB2388E934AB} - C:\WINDOWS\system32\Ckogo.dll
R3 - URLSearchHook: (no name) - {FA6AB07F-B57B-4714-8143-7FBAFE46A0FC} - C:\WINDOWS\system32\Ynmkpj.dll
R3 - URLSearchHook: (no name) - {E1F3B3A8-0FDD-42D7-96E0-5B1505DCAFA2} - C:\WINDOWS\system32\Qxwxb.dll
R3 - URLSearchHook: (no name) - {93421621-F52A-4AF0-B53B-074E25C47BB7} - C:\WINDOWS\system32\Rzfid.dll
R3 - URLSearchHook: (no name) - {01D9A09B-82A0-4B96-BA90-0E4C47BB7155} - C:\WINDOWS\system32\Pzzvwb.dll
R3 - URLSearchHook: (no name) - {2D5B44F5-C6DF-4858-AE0A-5935C4E91B63} - C:\WINDOWS\system32\Fvviq.dll
O2 - BHO: (no name) - {01D9A09B-82A0-4B96-BA90-0E4C47BB7155} - C:\WINDOWS\system32\Pzzvwb.dll
- BHO: (no name) - {213313D1-C5FA-43C3-86F2-D243775D4C63} - C:\WINDOWS\system32\Slhz.dll
O2 - BHO: (no name) - {2AEAD5E4-C915-4359-A172-25127A2DCF19} - C:\WINDOWS\system32\Dssf.dll (file missing)
O2 - BHO: (no name) - {2D5B44F5-C6DF-4858-AE0A-5935C4E91B63} - C:\WINDOWS\system32\Fvviq.dll
O2 - BHO: TeachingHandler - {31EBA2E2-58B2-4980-9C41-F12F5F1422C5} - C:\WINDOWS\system32\TPHANDLE
O2 - BHO: (no name) - {621ED108-3374-4DE1-9971-B57BA9F82147} - C:\WINDOWS\system32\Yeai.dll
O2 - BHO: (no name) - {93421621-F52A-4AF0-B53B-074E25C47BB7} - C:\WINDOWS\system32\Rzfid.dll
O2 - BHO: Accoona Search Assistant - {944864A5-3916-46E2-96A9-A2E84F3F1208} - C:\Program Files\Accoona\ASearchAssist.dll (file missing)
O2 - BHO: (no name) - {9D19E2ED-1777-40DB-A4CF-472123947078} - C:\WINDOWS\system32\Tbfyr.dll (file missing)
O2 - BHO: (no name) - {AEF09650-4E3A-4FD5-919C-ED91F7BF44E1} - C:\WINDOWS\system32\Cghn.dll (file missing)
O2 - BHO: (no name) - {B0C28F8B-5DAE-45E3-975E-E1AFACA9F2C2} - C:\WINDOWS\system32\Jbir.dll (file missing)
O2 - BHO: MacroMediapd - {B8CCDD47-38E4-4CD2-B7FA-3B4B690F74BD} - C:\WINDOWS\system32\microapmddt.dll (file missing)
O2 - BHO: (no name) - {C0BDE6B8-844D-452A-9B1F-FB2388E934AB} - C:\WINDOWS\system32\Ckogo.dll
O2 - BHO: (no name) - {E1F3B3A8-0FDD-42D7-96E0-5B1505DCAFA2} - C:\WINDOWS\system32\Qxwxb.dll
O2 - BHO: (no name) - {FA6AB07F-B57B-4714-8143-7FBAFE46A0FC} - C:\WINDOWS\system32\Ynmkpj.dll
O2 - BHO: (no name) - {FF9E4EF4-2D57-4B4E-9529-E1CE22EC478F} - C:\WINDOWS\system32\Iiyxu.dll
O4 - HKCU\..\Run: [HNETPOLCY] rundll32.exe C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\RarSFX1\HNETPO~1.DLL,Start
O23 - NT 服务: Windows Application Checker (checkapp) - Unknown owner - C:\WINDOWS\system32\checkapp.exe

O23 - NT 服务: Application Checker for Windows (appcheck) - Unknown owner - C:\WINDOWS\system32\appcheck.exe

双击我的电脑--工具---文件夹选项--查看--单击选取"显示隐藏文件或文件夹"清除"隐藏受保护的操作系统文件（推荐）"复选框。在提示您确定更改时，单击“是”
删除C:\WINDOWS\system32\appcheck.exe
C:\WINDOWS\system32\checkapp.exe
gototop
 
<<上一主题|下一主题>>
1   1  /  1  页   跳转页
页面顶部
Powered by Discuz!NT