瑞星卡卡安全论坛技术交流区反病毒/反流氓软件论坛 有帅哥帮我看下我这菜鸟的hijackthis扫描日志么 中毒了

1   1  /  1  页   跳转

有帅哥帮我看下我这菜鸟的hijackthis扫描日志么 中毒了

有帅哥帮我看下我这菜鸟的hijackthis扫描日志么 中毒了

有人帮下忙教我下怎么删除这该死的dddzzz.com的毒么      菜鸟中毒了  汗呢

Logfile of HijackThis v1.99.1
Scan saved at 8:16:52, on 2006-7-19
Platform: Windows ME (Win9x 4.90.3000)
MSIE: Internet Explorer v5.50 (5.50.4134.0100)

Running processes:
C:\WINDOWS\SYSTEM\KERNEL32.DLL
C:\WINDOWS\SYSTEM\MSGSRV32.EXE
C:\WINDOWS\SYSTEM\SPOOL32.EXE
C:\WINDOWS\SYSTEM\MPREXE.EXE
C:\WINDOWS\SYSTEM\mmtask.tsk
C:\WINDOWS\EXPLORER.EXE
C:\WINDOWS\SYSTEM\INTERNAT.EXE
C:\WINDOWS\TASKMON.EXE
C:\WINDOWS\SYSTEM\SYSTRAY.EXE
C:\PROGRAM FILES\CNNIC\CDN\CDNUP.EXE
C:\WINDOWS\SYSTEM\WMIEXE.EXE
C:\WINDOWS\SYSTEM\NTDHCP.EXE
C:\PROGRAM FILES\INTERNET EXPLORER\IEXPLORE.EXE
C:\WINDOWS\SYSTEM\DDHELP.EXE
D:\防护墙\HIJACKTHIS\HIJACKTHIS.EXE

O2 - BHO: WMHlprObj Class - {F5824EFB-728A-4726-A5A5-85A68B20EDC3} - C:\PROGRAM FILES\CNNIC\CDN\WMHLPR.DLL
O2 - BHO: BandIE Class - {77FEF28E-EB96-44FF-B511-3185DEA48697} - C:\PROGRAM FILES\BAIDU\BAR\BAIDUBAR.DLL
O2 - BHO: CdnForIE Class - {5C3853CF-C7E0-4946-B3FA-1ABDB6F48108} - C:\PROGRA~1\CNNIC\CDN\CDNFORIE.DLL
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll
O2 - BHO: Acrobat IE Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE083} - C:\WINDOWS\system\ctldlg32.dll
O3 - Toolbar: @msdxmLC.dll,-1@2052,电台(&R) - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\SYSTEM\MSDXM.OCX
O3 - Toolbar: 百度超级搜霸 - {B580CF65-E151-49C3-B73F-70B13FCA8E86} - C:\PROGRAM FILES\BAIDU\BAR\BAIDUBAR.DLL
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll
O4 - HKLM\..\Run: [internat.exe] internat.exe
O4 - HKLM\..\Run: [ScanRegistry] C:\WINDOWS\scanregw.exe /autorun
O4 - HKLM\..\Run: [TaskMonitor] C:\WINDOWS\taskmon.exe
O4 - HKLM\..\Run: [PCHealth] C:\WINDOWS\PCHealth\Support\PCHSchd.exe -s
O4 - HKLM\..\Run: [SystemTray] SysTray.Exe
O4 - HKLM\..\Run: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
O4 - HKLM\..\Run: [CdnCtr] C:\Program Files\CNNIC\Cdn\cdnup.exe
O4 - HKLM\..\Run: [Update] C:\Program Files\Common Files\UPDAT\Update.exe
O4 - HKLM\..\Run: [] regedit -s C:\$NtUninstallQ5926809$\sp4custom.dll
O4 - HKLM\..\Run: [3721] C:\$NtUninstallQ5926809$\3721.bat
O4 - HKLM\..\Run: [cnyisou_com] http://www.dddzzz.com
O4 - HKLM\..\Run: [NTdhcp] C:\WINDOWS\SYSTEM\NTdhcp.exe
O4 - HKLM\..\Run: [Kernel32] C:\WINDOWS\SYSTEM\Kernel.dll
O4 - HKLM\..\RunOnce: [regsvr32 /s C:\PROGRA~1\baidu\bar\BaiduBar.dll] regsvr32 /s C:\PROGRA~1\baidu\bar\BaiduBar.dll
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O8 - Extra context menu item: 访问通用网址 - C:\Program Files\CNNIC\Cdn\cnnic.htm
O8 - Extra context menu item: 百度--网页搜索 - RES://C:\PROGRA~1\BAIDU\BAR\baidubar.dll/BAIDUSEARCH.HTM
O8 - Extra context menu item: 百度--MP3搜索 - RES://C:\PROGRA~1\BAIDU\BAR\baidubar.dll/BAIDUMP3.HTM
O8 - Extra context menu item: 百度--歌词搜索 - RES://C:\PROGRA~1\BAIDU\BAR\baidubar.dll/BAIDULYRIC.HTM
O8 - Extra context menu item: 百度--图片搜索 - RES://C:\PROGRA~1\BAIDU\BAR\baidubar.dll/BAIDUIMG.HTM
O8 - Extra context menu item: 百度--新闻搜索 - RES://C:\PROGRA~1\BAIDU\BAR\baidubar.dll/BAIDUNEWS.HTM
O8 - Extra context menu item: 百度--贴吧搜索 - RES://C:\PROGRA~1\BAIDU\BAR\baidubar.dll/BAIDUPOST.HTM
O8 - Extra context menu item: 百度--词典搜索 - RES://C:\PROGRA~1\BAIDU\BAR\baidubar.dll/BAIDU_DIC.HTM
O8 - Extra context menu item: Google 搜索(&G) - res://C:\PROGRAM FILES\GOOGLE\GOOGLETOOLBAR2.DLL/cmsearch.html
O8 - Extra context menu item: 翻译英文字词(&T) - res://C:\PROGRAM FILES\GOOGLE\GOOGLETOOLBAR2.DLL/cmwordtrans.html
O8 - Extra context menu item: 缓存的网页快照 - res://C:\PROGRAM FILES\GOOGLE\GOOGLETOOLBAR2.DLL/cmcache.html
O8 - Extra context menu item: 类似网页 - res://C:\PROGRAM FILES\GOOGLE\GOOGLETOOLBAR2.DLL/cmsimilar.html
O8 - Extra context menu item: 反向链接 - res://C:\PROGRAM FILES\GOOGLE\GOOGLETOOLBAR2.DLL/cmbacklinks.html
O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
O9 - Extra 'Tools' menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\PROGRA~1\MESSEN~1\MSMSGS.EXE
O9 - Extra 'Tools' menuitem: MSN Messenger Service - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\PROGRA~1\MESSEN~1\MSMSGS.EXE
O9 - Extra button: 中文上网 - {5C3853CF-C7E0-4946-B3FA-1ABDB6F48108} - C:\PROGRA~1\CNNIC\CDN\CDNFORIE.DLL
O9 - Extra 'Tools' menuitem: 中文上网 - {5C3853CF-C7E0-4946-B3FA-1ABDB6F48108} - C:\PROGRA~1\CNNIC\CDN\CDNFORIE.DLL
O10 - Unknown file in Winsock LSP: c:\windows\system\cdnns.dll
O11 - Options group: [CDNCLIENT]  中文上网
O13 - WWW Prefix: http://www.sex19.net?
O13 - Home Prefix: http://www.sex19.net?
O17 - HKLM\System\CCS\Services\VxD\MSTCP: Domain = aa
O17 - HKLM\System\CCS\Services\VxD\MSTCP: NameServer = 10.72.255.226,10.72.255.131

最后编辑2006-07-19 09:12:10.373000000
分享到:
gototop
 

【回复“poter321”的帖子】
结束C:\WINDOWS\SYSTEM\NTDHCP.EXE进程

修复
O2 - BHO: Acrobat IE Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE083} - C:\WINDOWS\system\ctldlg32.dll
O4 - HKLM\..\Run: [Update] C:\Program Files\Common Files\UPDAT\Update.exe
O4 - HKLM\..\Run: [] regedit -s C:\$NtUninstallQ5926809$\sp4custom.dll
O4 - HKLM\..\Run: [3721] C:\$NtUninstallQ5926809$\3721.bat
O4 - HKLM\..\Run: [cnyisou_com] http://www.dddzzz.com
O4 - HKLM\..\Run: [NTdhcp] C:\WINDOWS\SYSTEM\NTdhcp.exe
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O13 - WWW Prefix: http://www.sex19.net?
O13 - Home Prefix: http://www.sex19.net?

删除
C:\WINDOWS\system\ctldlg32.dll
C:\Program Files\Common Files\UPDAT\
C:\$NtUninstallQ5926809$\
C:\WINDOWS\SYSTEM\NTdhcp.exe

另外
C:\WINDOWS\SYSTEM\NTdhcp.exe是QQ大盗
会屏蔽杀软实时监控
但从楼主的日志来看
楼主没有安装专业杀软吗?
gototop
 

顺便给个QQ大盗的处理连接:http://forum.ikaka.com/topic.asp?board=28&artid=7152812
gototop
 

谢拉 大哥
我也是刚拿到这台电脑,不知道怎么会这么烂的
gototop
 

再问下以上操作都是在安全模式下进行的么
gototop
 

引用:
【poter321的贴子】再问下以上操作都是在安全模式下进行的么
...........................


正常模式也可以 最好在安全模式
gototop
 

等一下!~
问个问题……
O10 - Unknown file in Winsock LSP: c:\windows\system\cdnns.dll
这个程序你们有虾米看法?
gototop
 

引用:
【ヤ苁佌變壞的贴子】等一下!~
问个问题……
O10 - Unknown file in Winsock LSP: c:\windows\system\cdnns.dll
这个程序你们有虾米看法?
...........................


中文上网的..卸掉中文上网这个也没了..
gototop
 

引用:
【mopery的贴子】

中文上网的..卸掉中文上网这个也没了..
...........................

路径看着难受!~~~~
gototop
 
1   1  /  1  页   跳转
页面顶部
Powered by Discuz!NT