瑞星卡卡安全论坛技术交流区反病毒/反流氓软件论坛 大家看看“唯刊.VIKA”是不是流氓软件。

1   1  /  1  页   跳转

大家看看“唯刊.VIKA”是不是流氓软件。

大家看看“唯刊.VIKA”是不是流氓软件。

我在网上下载 Winamp 安装程序时,被捆绑了这个软件,发现这个软件卸载不了。如果直接删除,稍后就能立即出现。

C:\Program Files\VIKA\
C:\Program Files\HBClient\
这个2个文件夹删不掉,即使删了过几分钟也会出现。

下载:http://download.vika.cn/vikasetup.exe

Logfile of HijackThis v1.99.2
Scan saved at 22:30:03, on 2005-9-28
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\MSN Messenger\MsnMsgr.Exe
D:\Applications\NetTransport 2\NetTransport.exe
D:\Applications\Maxthon\Maxthon.exe
D:\APPLICATIONS\RISING\RAV\CCENTER.EXE
D:\APPLICATIONS\RISING\RAV\Ravmond.exe
D:\Applications\Rising\Rav\RavTimer.exe
D:\Applications\Rising\Rav\RavMon.exe
D:\Applications\Rising\Rav\RsAgent.exe
C:\WINDOWS\msagent\AgentSvr.exe
C:\DOCUME~1\PXF\LOCALS~1\Temp\HijackThis.exe
C:\WINDOWS\system32\Rundll32.exe
C:\WINDOWS\system32\Rundll32.exe

O2 - BHO: BrowserHAP Class - {AEF6F648-78D8-4456-BEE7-5ADE23D209FD} - C:\Program Files\HBClient\hapast.dll
O2 - BHO: NTIECatcher Class - {C56CB6B0-0D96-11D6-8C65-B2868B609932} - D:\Applications\NetTransport 2\NTIEHelper.dll
O4 - HKLM\..\Run: [Login] E:\Documents\login\login2.exe
O4 - HKLM\..\Run: [hbpassport] C:\PROGRA~1\HBCLIENT\hbast.exe
O4 - HKLM\..\Run: [RavTimer] D:\Applications\Rising\Rav\RavTimer.exe
O4 - HKLM\..\Run: [RavMon] D:\Applications\Rising\Rav\RavMon.exe -system
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O8 - Extra context menu item: 使用影音传送带下载 - D:\Applications\NetTransport 2\NTAddLink.html
O8 - Extra context menu item: 使用影音传送带下载全部链接 - D:\Applications\NetTransport 2\NTAddList.html
O8 - Extra context menu item: 导出到 Microsoft Office Excel(&X) - res://D:\APPLIC~1\MICROS~1\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: 信息检索 - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - D:\APPLIC~1\MICROS~1\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)
O23 - Service: Macromedia Licensing Service - Unknown owner - C:\Program Files\Common Files\Macromedia Shared\Service\Macromedia Licensing.exe
O23 - Service: Rising Process Communication Center (RsCCenter) - rising - D:\APPLICATIONS\RISING\RAV\CCENTER.EXE
O23 - Service: RsRavMon Service (RsRavMon) - rising - D:\APPLICATIONS\RISING\RAV\Ravmond.exe

最后编辑2005-10-14 19:34:49
分享到:
gototop
 

喂,高手帮我看看啊... 自顶
gototop
 

我靠,到底有没有高手啊~~~
gototop
 

不会吧,VIKA可是网络电子杂志的龙头,浏览和点击率都是天文数字,不可能用这方法吧
gototop
 

O23 - Service: Macromedia Licensing Service - Unknown owner - C:\Program Files\Common Files\Macromedia Shared\Service\Macromedia Licensing.exe
你重灰鸽子了!
gototop
 

安全模式下修复
O2 - BHO: BrowserHAP Class - {AEF6F648-78D8-4456-BEE7-5ADE23D209FD} - C:\Program Files\HBClient\hapast.dll
O4 - HKLM\..\Run: [hbpassport] C:\PROGRA~1\HBCLIENT\hbast.exe
然后删除
C:\Program Files\VIKA\
C:\Program Files\HBClient\
下所有内容.
gototop
 
1   1  /  1  页   跳转
页面顶部
Powered by Discuz!NT