1   1  /  1  页   跳转

毛病一大堆啊...

毛病一大堆啊...

经常乱蹦网页,莫名其妙被安装上去的软件也一大堆,我想把IE恢复到最初的样子啊!
最后编辑2006-06-30 00:21:53
分享到:
gototop
 

ogfile of HijackThis v1.99.1
Scan saved at 14:42:05, on 2006-6-28
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\Internet Explorer\test.exe
C:\WINDOWS\system32\conime.exe
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\system32\atievxx.exe
C:\WINDOWS\system32\wdfmgr.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\System32\alg.exe
C:\WINDOWS\system32\IEXPLORER.EXE
d:\KAV2006\KWatch.EXE
d:\KAV2006\KavStart.exe
d:\KAV2006\KPfwSvc.EXE
d:\KAV2006\KMailMon.EXE
d:\KAV2006\KPFW32.EXE
C:\PROGRA~1\Yahoo!\ASSIST~1\YLive.exe
C:\WINDOWS\system32\Rundll32.exe
C:\Program Files\CNNIC\Cdn\cdnup.exe
C:\Program Files\winmon.exe
C:\WINDOWS\System32\VIPTray.exe
C:\WINDOWS\system32\rundll32.exe
C:\PROGRA~1\Yahoo!\Assistant\yassistse.exe
C:\Program Files\Tencent\TT\TTraveler.exe
D:\HijackThis.exe

O2 - BHO: BrowserHelper Class - {2D99E8F4-56B7-457B-9A92-61B5D247D263} - C:\WINDOWS\system32\WinDefendor.dll
O2 - BHO: YDragSearch - {62EED7C6-9F02-42f9-B634-98E2899E147B} - C:\PROGRA~1\Yahoo!\ASSIST~1\Assist\YDRAGS~1.DLL
O2 - BHO: IeCatch2 Class - {A5366673-E8CA-11D3-9CD9-0090271D075B} - C:\PROGRA~1\FLASHGET\jccatch.dll
O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC
O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName
O4 - HKLM\..\Run: [rundll31] C:\WINDOWS\system32\IEXPLORER.EXE
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [LocalSystem] C:\WINDOWS\system\svchost.exe
O8 - Extra context menu item: 使用网际快车下载 - C:\Program Files\FlashGet\jc_link.htm
O17 - HKLM\System\CCS\Services\Tcpip\..\{876B61BD-825D-4D09-A0F1-265B2190525F}: NameServer = 219.150.32.132 219.146.0.130
O23 - Service: Gray_Pigeon_Server1.2 (GrayPigeonServer1.2) - Unknown owner - C:\WINDOWS\G_Server1.23.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: Kingsoft Personal Firewall Service (KPfwSvc) - Kingsoft Corporation - d:\KAV2006\KPfwSvc.EXE
O23 - Service: Kingsoft Antivirus KWatch Service (KWatchSvc) - Kingsoft Corporation - d:\KAV2006\KWatch.EXE
O23 - Service: Removable Storage (NtmsSvc) - Unknown owner - C:\WINDOWS\winte.exe
O23 - Service: Pigeon_Server2.0 (PigeonServer2.0) - Unknown owner - C:\WINDOWS\winfucker.exe
O23 - Service: Rising Firewell Service - Unknown owner - C:\WINDOWS\svchost.exe (file missing)
O23 - Service: System Event Log Service (SystemLog) - www.huigezi.net - C:\WINDOWS\system32\shellext\services.exe
O23 - Service: VIPTray - Unknown owner - C:\WINDOWS\System32\VIPTray.exe

gototop
 

为什么没人帮你?好几种版本的灰鸽子病毒吧?
gototop
 

好多病毒。你的杀毒、防火墙软件咧?
gototop
 

开始→运行→输入services.msc,打开“服务”→查找 Removable Storage,Pigeon_Server2.0,Rising Firewell Service,System Event Log Service, VIPTray →双击→启动类型→禁止→停止→应用→确定。禁止Removable Storage,Pigeon_Server2.0,Rising Firewell Service,System Event Log Service, VIPTray这5个服务 (每一个逗号隔开的就是一个病毒的服务,请逐一禁用)
重启
ALT+CTRL+DELETE调出任务管理器,终止所有winmon.exe,test.exe的进程
关闭所有浏览窗口以及一些不必要的程序
运行Hijackthis,扫描结束后在下列选项前打上勾,然后选"修复"
2 - BHO: BrowserHelper Class - {2D99E8F4-56B7-457B-9A92-61B5D247D263} - C:\WINDOWS\system32\WinDefendor.dll
O4 - HKCU\..\Run: [LocalSystem] C:\WINDOWS\system\svchost.exe
双击我的电脑,工具,文件夹选项,查看,单击选取"显示隐藏文件或文件夹"清除"隐藏受保护的操作系统文件(推荐)"复选框。在提示确定更改时,单击“是”,清除“隐藏已知文件类型的扩展名
删除
C:\WINDOWS\System32\VIPTray.exe
C:\WINDOWS\system32\WinDefendor.dll
C:\WINDOWS\system\svchost.exe
C:\Program Files\winmon.exe
C:\Program Files\Internet Explorer\test.exe
C:\WINDOWS\winte.exe
C:\WINDOWS\svchost.exe
C:\WINDOWS\system32\shellext\services.exe
C:\WINDOWS\System32\VIPTray.exe
C:\WINDOWS\winfucker.exe
以上程序,不要搜索,直接手工找到删除。
修复后,请重启。
请下载 System Repair Engineer,使用“智能扫描”,按下“扫描”按钮进行扫描,扫描完成后按下“保存报告”按钮保存报告日志文件(SREng.LOG),把保存的报告日志文件内容复制-粘贴上来
下载网址
http://www.kztechs.com/sreng/sreng2.zip
http://forum.ikaka.com/topic.asp?board=67&artid=5188931
日志一次粘不完,分次粘完,请不要修改。
gototop
 
1   1  /  1  页   跳转
页面顶部
Powered by Discuz!NT