发表于： 2011-04-14 11:04 | 显示全部 短消息 资料
字号： 小 中 大 1楼

www.pbamy.com被攻击救助

请教高手，如何去除这些流氓？

Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 23:25:08, on 2011/3/19
Platform: Windows 7  (WinNT 6.00.3504)
MSIE: Internet Explorer v8.00 (8.00.7600.16722)
Boot mode: Normal
Running processes:
C:\Windows\system32\taskhost.exe
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Program Files\360Safebox\safeboxtray.exe
C:\Windows\System32\D4Svr_ICBC.exe
C:\Program Files\360\360Safe\safemon\360tray.exe
C:\Users\Administrator.PC-20100818ZXXO\AppData\Roaming\360se\bin\360se.exe
C:\Users\Administrator.PC-20100818ZXXO\AppData\Roaming\360se\extensions\ExtWebmail\360seNotify.exe
C:\Users\Administrator.PC-20100818ZXXO\AppData\Roaming\360se\bin\Extensions\SafeCentral\urlproc.exe
C:\Users\Administrator.PC-20100818ZXXO\AppData\Roaming\360se\bin\360se.exe
C:\Program Files\Kingsoft\WPS Office Personal\office6\et.exe
C:\Users\Administrator.PC-20100818ZXXO\AppData\Roaming\360se\bin\360se.exe
C:\Program Files\Kingsoft\WPS Office Personal\office6\wps.exe
C:\Users\Administrator.PC-20100818ZXXO\AppData\Roaming\360se\bin\360se.exe
C:\Users\Administrator.PC-20100818ZXXO\AppData\Roaming\360se\bin\360se.exe
C:\Program Files\Tencent\QQ\Bin\QQ.exe
C:\Program Files\Tencent\QQ\Bin\TXPlatform.exe
C:\Program Files\Tencent\QQ\Bin\QQ.exe
C:\Users\Administrator.PC-20100818ZXXO\AppData\Roaming\360se\bin\360se.exe
C:\Users\Administrator.PC-20100818ZXXO\AppData\Roaming\360se\bin\360se.exe
C:\Users\Administrator.PC-20100818ZXXO\AppData\Roaming\360se\bin\360se.exe
C:\Windows\notepad.exe
C:\Program Files\SogouInput\5.1.1.4954\SogouCloud.exe
C:\Users\Administrator.PC-20100818ZXXO\AppData\Roaming\360se\bin\360se.exe
C:\Windows\system32\SearchFilterHost.exe
C:\Program Files\Trend Micro\HiJackThis\HiJackThis.exe
O2 - BHO: MediaMonitor.XlMediaMonitorBhoObject - {0EA37B17-6B8B-4085-8257-F3A4AA69C27A} - C:\Program Files\Thunder Network\Thunder\BHO\MediaMonitor1.0.0.11.dll
O2 - BHO: XunleiBHO - {889D2FEB-5411-4565-8998-1DD2C5261283} - C:\Program Files\Thunder Network\Thunder\BHO\XunleiBHO7.1.6.2194.dll
O2 - BHO: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Microsoft Web Test Recorder 10.0 Helper - {DDA57003-0068-4ed2-9D32-4D1EC707D94D} - C:\Program Files\Microsoft Visual Studio 10.0\Common7\IDE\PrivateAssemblies\Microsoft.VisualStudio.QualityTools.RecorderBarBHO100.dll
O4 - HKLM\..\Run: [D4Svr_ICBC.exe] C:\Windows\system32\D4Svr_ICBC.exe
O4 - HKLM\..\Run: [360Safetray] "C:\Program Files\360\360Safe\safemon\360Tray.exe" /start
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-19\..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-20\..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (User 'NETWORK SERVICE')
O4 - Global Startup: 51彩虹.lnk = C:\Program Files\CaiHong\caihong.exe
O8 - Extra context menu item: pba上传到淘江湖相册 - C:\Program Files\AliWangWang\AddToAlbum.htm
O8 - Extra context menu item: 使用迅雷下载BB霜 - C:\Program Files\Thunder Network\Thunder\BHO\geturl.htm
O8 - Extra context menu item: 使用迅雷下载全部链接 - C:\Program Files\Thunder Network\Thunder\BHO\GetAllUrl.htm

用户系统信息：Mozilla/5.0 (Windows; Windows NT 5.2) AppleWebKit/534.23 (KHTML, like Gecko) Chrome/11.0.686.3 Safari/534.23