h80053
|
發表於 2009-12-10 03:38 PM |
謝謝大大的指教!!
因為網頁又開始跑出來了~
我弟不知道又灌了什麼東西進去@@
馬上來用看看
掃了三十多分鐘後又發現不少毒@@
efix 5.3 20091126.30 - 2009-12-10 15:44:05.39 - ntfs
Microsoft Windows XP Service Pack 3 - MMX
執行位置: C:\Documents and Settings\MMX\桌面\新資料夾 (2)\EF2009112630.exe
AV: AntiVir Desktop (Avira GmbH) True - Enabled
提示：
未安裝安全性更新 KB971029
================================================================================
使用者帳戶列表:
Administrator
ASPNET
Guest
HelpAssistant
MMX -- Current
SUPPORT_388945a0
================================================================================
EF刪除的檔案列表:
c:\windows\ahnrpta.exe
================================================================================
EF刪除的驅動服務列表:
....\service\AVPsys
EF修改的登錄值列表:
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
"{BB4C402F-882A-4526-8C08-51278EA437C1}"=-
================================================================================
EF刪除的檔案備份位置列表:
C:\WINDOWS\AhnRpta.exe => C:\ef_backup\backup\C\WINDOWS\AhnRpta.exe.vir
================================================================================
各磁碟根目錄含有隱藏屬性的資料夾和檔案 :
2006-08-24 00:57:20 . 2009-05-02 19:20:46 -rhs--- 223 C:\boot.ini
2006-08-24 00:56:51 . 2006-03-02 20:00:00 -rhs--- 213830 C:\bootfont.bin
2006-08-24 00:56:55 . 2006-03-02 20:00:00 -rhs--- 47564 C:\NTDETECT.COM
2006-08-24 00:56:55 . 2009-05-18 21:11:07 -rhs--- 257728 C:\ntldr
2009-07-23 09:24:54 . 2009-08-23 14:45:29 --hs--- 251904 C:\radial.cdb
2009-06-25 08:00:49 . 2009-11-25 19:32:48 --h---- <DIR> C:\Config.Msi
2009-10-30 21:46:16 . 2009-11-01 13:04:46 -rhs--- 127235 D:\clxam6r6.exe
2009-05-16 17:31:11 . 2009-05-16 17:31:11 --hs--- <DIR> D:\vod_cache_data
********** Created 2009-11 -- 2009-12 Files: **********
2009-12-10 14:59:34 . 2009-12-10 15:03:35 ------- <DIR> C:\WINDOWS\LastGood
2009-11-28 18:43:00 . 2009-11-28 18:53:22 ------- <DIR> C:\Program Files\Windows Live Safety Center
2009-11-25 19:33:00 . 2009-05-11 09:12:24 a------ 28520 C:\WINDOWS\system32\drivers\ssmdrv.sys
2009-11-25 19:33:00 . 2009-03-30 09:33:07 a------ 96104 C:\WINDOWS\system32\drivers\avipbb.sys
2009-11-25 19:33:00 . 2009-02-13 11:29:11 a------ 22360 C:\WINDOWS\system32\drivers\avgntmgr.sys
2009-11-25 19:33:00 . 2009-02-13 11:17:49 a------ 45416 C:\WINDOWS\system32\drivers\avgntdd.sys
2009-11-25 18:19:55 . 2009-11-25 19:16:38 ------- <DIR> C:\WINDOWS\system32\NtmsData
2009-11-23 20:56:08 . 2009-11-23 20:56:08 ------- <DIR> C:\新資料夾
2009-11-23 19:59:15 . 2007-03-20 16:44:06 a------ 94480 C:\WINDOWS\system32\drivers\tmcomm.sys
2009-11-23 19:36:30 . 2006-06-20 20:36:00 a------ 692224 C:\WINDOWS\system32\kixforms.dll
2009-11-22 18:00:58 . 2009-12-08 19:34:00 a------ 56816 C:\WINDOWS\system32\drivers\avgntflt.sys
2009-11-16 23:28:00 . 2009-11-16 23:28:00 ------- <DIR> C:\Documents and Settings\MMX\My Documents\CyberLink
2009-11-16 23:26:51 . 2009-11-16 23:26:52 ------- <DIR> C:\Documents and Settings\MMX\Application Data\CyberLink
2009-11-16 23:25:47 . 2009-11-16 23:25:47 ------- <DIR> C:\Documents and Settings\MMX\Application Data\Ulead Systems
2009-11-16 23:18:09 . 2009-11-16 23:20:58 ------- <DIR> C:\Program Files\CyberLink
2009-11-16 23:13:30 . 2009-11-16 23:13:30 ------- <DIR> C:\Documents and Settings\MMX\Application Data\InstallShield
2009-11-16 23:12:54 . 2008-04-01 21:40:42 a------ 209040 C:\WINDOWS\system32\IVIresizeW7.dll
2009-11-16 23:12:54 . 2008-04-01 21:40:40 a------ 196752 C:\WINDOWS\system32\IVIresizeP6.dll
2009-11-16 23:12:54 . 2008-04-01 21:40:40 a------ 192656 C:\WINDOWS\system32\IVIresizePX.dll
2009-11-16 23:12:54 . 2008-04-01 21:40:38 a------ 196752 C:\WINDOWS\system32\IVIresizeM6.dll
2009-11-16 23:12:54 . 2008-04-01 21:40:36 a------ 204944 C:\WINDOWS\system32\IVIresizeA6.dll
2009-11-16 23:12:54 . 2008-04-01 21:40:34 a------ 24720 C:\WINDOWS\system32\IVIresize.dll
2009-11-16 23:12:30 . 2009-11-16 23:12:30 ------- <DIR> C:\Program Files\Windows Media Components
2009-11-16 23:11:28 . 2009-11-16 23:12:29 ------- <DIR> C:\Program Files\Common Files\Ulead Systems
2009-11-16 23:11:27 . 2009-11-16 23:11:27 ------- <DIR> C:\Program Files\Corel
2009-11-10 06:42:44 . 2009-11-10 06:42:44 ------- <DIR> C:\Documents and Settings\MMX\My Documents\瑪奇
.
********** Modified 2009-10 -- 2009-12 files: **********
2009-12-10 14:59:34 . 2009-12-10 15:03:35 ------- <DIR> C:\WINDOWS\LastGood
2009-11-28 18:43:00 . 2009-11-28 18:53:22 ------- <DIR> C:\Program Files\Windows Live Safety Center
2009-11-25 18:19:55 . 2009-11-25 19:16:38 ------- <DIR> C:\WINDOWS\system32\NtmsData
2009-11-23 20:56:08 . 2009-11-23 20:56:08 ------- <DIR> C:\新資料夾
2009-11-22 18:00:58 . 2009-12-08 19:34:00 a------ 56816 C:\WINDOWS\system32\drivers\avgntflt.sys
2009-11-16 23:28:00 . 2009-11-16 23:28:00 ------- <DIR> C:\Documents and Settings\MMX\My Documents\CyberLink
2009-11-16 23:26:51 . 2009-11-16 23:26:52 ------- <DIR> C:\Documents and Settings\MMX\Application Data\CyberLink
2009-11-16 23:25:47 . 2009-11-16 23:25:47 ------- <DIR> C:\Documents and Settings\MMX\Application Data\Ulead Systems
2009-11-16 23:18:09 . 2009-11-16 23:20:58 ------- <DIR> C:\Program Files\CyberLink
2009-11-16 23:13:30 . 2009-11-16 23:13:30 ------- <DIR> C:\Documents and Settings\MMX\Application Data\InstallShield
2009-11-16 23:12:30 . 2009-11-16 23:12:30 ------- <DIR> C:\Program Files\Windows Media Components
2009-11-16 23:11:28 . 2009-11-16 23:12:29 ------- <DIR> C:\Program Files\Common Files\Ulead Systems
2009-11-16 23:11:27 . 2009-11-16 23:11:27 ------- <DIR> C:\Program Files\Corel
2009-11-10 06:42:44 . 2009-11-10 06:42:44 ------- <DIR> C:\Documents and Settings\MMX\My Documents\瑪奇
2009-11-07 11:06:24 . 2009-11-07 11:06:24 ------- <DIR> C:\WINDOWS\pss
2009-11-02 06:16:13 . 2009-11-08 22:32:58 ------- <DIR> C:\Documents and Settings\MMX\Application Data\HpUpdate
2009-11-02 06:16:12 . 2009-11-02 06:16:12 ------- <DIR> C:\WINDOWS\Hewlett-Packard
2009-10-25 23:54:43 . 2009-10-25 23:54:43 ------- <DIR> C:\Program Files\Free Offers from Freeze.com
2009-10-25 23:54:40 . 2009-10-25 23:54:40 ------- <DIR> C:\Program Files\Common Files\Winferno
2009-10-25 23:54:01 . 2009-10-26 00:02:02 ------- <DIR> C:\Program Files\Winferno
2009-10-25 22:59:22 . 2009-10-25 22:59:22 ------- <DIR> C:\Documents and Settings\MMX\Application Data\Titanium Gears
2009-10-25 22:59:14 . 2009-10-25 23:59:13 ------- <DIR> C:\Program Files\Playalot Games
2009-10-25 22:53:03 . 2009-10-26 00:03:34 ------- <DIR> C:\Program Files\My.Freeze.com Toolbar
2009-10-25 22:51:14 . 2009-10-25 22:51:14 ------- <DIR> C:\Program Files\coolbirdsettings
2009-10-25 22:07:15 . 2009-11-28 22:04:36 ------- <DIR> C:\Documents and Settings\MMX\Application Data\coolbirdsettings
2009-10-25 22:07:14 . 2009-10-25 22:51:12 ------- <DIR> C:\Program Files\TorrentSpeeder
2009-10-25 16:38:21 . 2009-11-25 19:32:59 ------- <DIR> C:\Program Files\Avira
2009-10-25 14:24:11 . 2009-10-25 14:24:11 ------- <DIR> C:\WINDOWS\system32\Kaspersky Lab
2009-10-16 20:03:15 . 2009-10-16 21:53:50 ------- <DIR> C:\Program Files\Common Files\Blizzard Entertainment
2009-10-13 23:26:16 . 2009-10-13 23:26:16 ------- <DIR> C:\Program Files\Windows Live SkyDrive
2009-10-13 23:14:21 . 2009-10-13 23:14:21 ------- <DIR> C:\WINDOWS\SxsCaPendDel
2009-10-13 23:10:05 . 2009-10-13 23:10:05 ------- <DIR> C:\WINDOWS\system32\appmgmt
2009-10-12 15:19:17 . 2009-10-12 15:19:17 ------- <DIR> C:\Documents and Settings\MMX\WINDOWS
2009-06-25 08:01:02 . 2009-11-02 06:16:18 ------- <DIR> C:\Program Files\HP
2009-06-25 08:00:49 . 2009-11-25 19:32:48 --h---- <DIR> C:\Config.Msi
2009-05-19 03:06:21 . 2009-12-10 15:43:07 ------- <DIR> C:\WINDOWS\Prefetch
2009-05-18 21:11:16 . 2009-10-25 13:51:45 ------- <DIR> C:\WINDOWS\network diagnostic
2009-05-09 00:04:46 . 2009-12-10 14:58:43 ------- <DIR> C:\Documents and Settings\MMX\Tracing
2009-05-08 23:50:47 . 2009-10-13 23:26:27 ------- <DIR> C:\Program Files\Windows Live
2009-05-03 18:18:35 . 2009-11-19 17:07:05 ---s--- <DIR> C:\Documents and Settings\MMX\My Documents\mabinogi
2009-05-03 09:18:25 . 2009-12-10 09:14:56 ------- <DIR> C:\Program Files\eMule
2009-05-03 02:44:09 . 2009-12-10 15:43:56 ------- <DIR> C:\WINDOWS\Temp
2009-05-03 02:44:09 . 2009-12-10 15:43:45 ------- <DIR> C:\WINDOWS
2009-05-03 02:44:09 . 2009-12-10 15:43:08 ------- <DIR> C:\WINDOWS\system32
2009-05-03 02:44:09 . 2009-12-10 15:20:08 --h---- <DIR> C:\WINDOWS\inf
2009-05-03 02:44:09 . 2009-12-10 14:59:43 -rhs--- <DIR> C:\WINDOWS\system32\dllcache
2009-05-03 02:44:09 . 2009-12-10 14:59:38 ------- <DIR> C:\WINDOWS\Help
2009-05-03 02:44:09 . 2009-12-10 06:21:08 ------- <DIR> C:\WINDOWS\system32\drivers
2009-05-03 02:44:09 . 2009-11-28 22:05:26 ------- <DIR> C:\WINDOWS\system32\drivers\etc
2009-05-03 02:44:09 . 2009-11-25 19:32:47 ------- <DIR> C:\WINDOWS\WinSxS
2009-05-03 02:44:09 . 2009-11-25 18:51:23 ------- <DIR> C:\WINDOWS\repair
2009-05-03 02:44:09 . 2009-11-25 18:13:05 a------ 90112 C:\WINDOWS\DUMP50df.tmp
2009-05-03 02:44:09 . 2009-11-16 23:19:44 -r-s--- <DIR> C:\WINDOWS\Fonts
2009-05-03 02:44:09 . 2009-11-01 20:23:30 a------ 90112 C:\WINDOWS\DUMP4f1a.tmp
2009-05-03 02:44:09 . 2009-10-13 22:37:37 ------- <DIR> C:\WINDOWS\system
2009-05-02 19:20:56 . 2009-12-10 15:42:50 ---s--- <DIR> C:\Documents and Settings\MMX\Cookies
2009-05-02 19:20:56 . 2009-12-10 15:41:46 -rh---- <DIR> C:\Documents and Settings\MMX\Recent
2009-05-02 19:20:56 . 2009-12-09 23:42:08 ------- <DIR> C:\Documents and Settings\MMX\桌面
2009-05-02 19:20:56 . 2009-12-08 17:31:36 a-h---- 6291456 C:\Documents and Settings\MMX\NTUSER.DAT
2009-05-02 19:20:56 . 2009-11-22 20:44:22 -r----- <DIR> C:\Documents and Settings\MMX\My Documents
2009-05-02 19:20:56 . 2009-11-21 17:43:44 --h---- <DIR> C:\Documents and Settings\MMX\NetHood
2009-05-02 19:20:56 . 2009-11-16 23:26:52 -rh---- <DIR> C:\Documents and Settings\MMX\Application Data
2009-05-02 19:20:56 . 2009-11-07 22:37:01 -r----- <DIR> C:\Documents and Settings\MMX\Favorites
2009-05-02 19:20:56 . 2009-10-25 13:33:31 -r----- <DIR> C:\Documents and Settings\MMX\My Documents\My Pictures
2009-05-02 19:20:56 . 2009-10-20 12:49:57 -r----- <DIR> C:\Documents and Settings\MMX\「開始」功能表
2009-05-02 19:00:35 . 2009-11-16 23:24:25 --h---- <DIR> C:\Program Files\InstallShield Installation Information
2009-05-02 18:56:42 . 2009-10-14 00:32:22 ------- <DIR> C:\WINDOWS\Microsoft.NET
2009-05-02 18:56:42 . 2009-10-13 23:13:39 -r-s--- <DIR> C:\WINDOWS\assembly
2009-05-02 18:55:40 . 2009-12-08 17:32:16 a--s--- 2048 C:\WINDOWS\bootstat.dat
2009-05-02 18:54:29 . 2009-12-10 15:19:18 --h---- <DIR> C:\WINDOWS\$hf_mig$
2009-05-02 18:53:32 . 2009-11-28 18:43:01 ---s--- <DIR> C:\WINDOWS\Downloaded Program Files
2009-05-02 18:53:11 . 2009-10-26 00:02:01 ---s--- <DIR> C:\WINDOWS\Tasks
2009-05-02 18:53:06 . 2009-11-23 19:58:31 ------- <DIR> C:\Program Files\Internet Explorer
2009-05-02 18:52:35 . 2009-11-25 18:51:17 ------- <DIR> C:\WINDOWS\Registration
2009-05-02 18:48:44 . 2009-11-25 19:32:48 --hs--- <DIR> C:\WINDOWS\Installer
2009-05-02 18:48:42 . 2009-11-28 18:43:00 -r----- <DIR> C:\Program Files
2009-05-02 18:48:42 . 2009-11-16 23:11:28 ------- <DIR> C:\Program Files\Common Files
2009-05-02 18:48:42 . 2009-10-13 23:26:21 ------- <DIR> C:\Program Files\Common Files\Microsoft Shared
2009-05-02 18:47:47 . 2009-12-10 15:20:02 ------- <DIR> C:\WINDOWS\system32\CatRoot2
2009-05-02 18:47:31 . 2009-11-18 08:30:22 a------ 160344 C:\WINDOWS\system32\FNTCACHE.DAT
2006-08-24 00:54:07 . 2009-11-23 20:33:43 --hs--- <DIR> C:\System Volume Information
.
================================================================================
執行中的程序:
[PID: 968] C:\WINDOWS\system32\Ati2evxx.exe [<Verified> ATI Technologies Inc.]
[PID: 1480] C:\WINDOWS\system32\spoolsv.exe [<Verified> Microsoft Corporation]
[PID: 1504] C:\WINDOWS\system32\Ati2evxx.exe [<Verified> ATI Technologies Inc.]
[PID: 1696] C:\Program Files\Avira\AntiVir Desktop\sched.exe [ Avira GmbH]
[PID: 256] C:\WINDOWS\RTHDCPL.EXE [<Verified> Realtek Semiconductor Corp.]
[PID: 276] C:\Program Files\EmvSmartCardReader\SmartMON.exe [ N/A]
[PID: 288] C:\Program Files\EmvSmartCardReader\BePCSC.exe [ N/A]
[PID: 304] C:\Program Files\GridService\peer.exe [ FS2YOU]
[PID: 340] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe [<Verified> Hewlett-Packard]
[PID: 484] C:\Program Files\Avira\AntiVir Desktop\avgnt.exe [ Avira GmbH]
[PID: 504] C:\WINDOWS\system32\ctfmon.exe [<Verified> Microsoft Corporation]
[PID: 740] C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.EXE [ ATI Technologies Inc.]
[PID: 1284] C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\ccc.exe [ ATI Technologies Inc.]
[PID: 2104] C:\Program Files\CyberLink\Shared files\RichVideo.exe [<Verified> ]
[PID: 2216] C:\WINDOWS\system32\scardsvr.exe [<Verified> Microsoft Corporation]
[PID: 2268] C:\Program Files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe [<Verified> Microsoft Corporation]
[PID: 2328] C:\Program Files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe [<Verified> Ulead Systems, Inc.]
[PID: 2364] C:\Program Files\Viewpoint\Common\ViewpointService.exe [<Verified> Viewpoint Corporation]
[PID: 4044] C:\WINDOWS\System32\alg.exe [<Verified> Microsoft Corporation]
[PID: 3956] C:\Program Files\Avira\AntiVir Desktop\avguard.exe [ Avira GmbH]
[PID: 2836] C:\Program Files\eMule\emule.exe [ hxxp://www.emule-project.net]
[PID: 2624] C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe [<Verified> Yahoo! Inc.]
[PID: 4000] C:\WINDOWS\system32\wbem\wmiprvse.exe [<Verified> Microsoft Corporation]
[PID: 2848] C:\Program Files\Windows Live\Messenger\msnmsgr.exe [<Verified> Microsoft Corporation]
[PID: 2920] C:\Program Files\Windows Live\Contacts\wlcomm.exe [<Verified> Microsoft Corporation]
[PID: 1008] C:\Program Files\HP\Smart Web Printing\hpswp_clipbook.exe [<Verified> Hewlett-Packard Co.]
[PID: 3152] C:\WINDOWS\system32\conime.exe [<Verified> Microsoft Corporation]
[PID: 3416] C:\WINDOWS\system32\wbem\wmiprvse.exe [<Verified> Microsoft Corporation]
[PID: 2548] C:\WINDOWS\system32\wuauclt.exe [<Verified> Microsoft Corporation]
系統執行程序中沒有檔案資訊的動態連結檔:
'spoolsv.exe'(1480)
=> C:\WINDOWS\System32\spool\PRTPROCS\W32X86\hpzpp4xa.dll 61.063.264.22
'ccc.exe'(1284)
=> C:\WINDOWS\assembly\GAC_MSIL\atixclib\1.0.0.0__90ba9c70f846762e\atixclib.dll 1.0.0.0
=> C:\WINDOWS\assembly\GAC\AxInterop.WBOCXLib\1.0.0.0__90ba9c70f846762e\AxInterop.WBOCXLib.dll 1.0.0.0
=> C:\WINDOWS\assembly\GAC\Interop.WBOCXLib\1.0.0.0__90ba9c70f846762e\Interop.WBOCXLib.dll 1.0.0.0
'msnmsgr.exe'(2848)
=> C:\WINDOWS\system32\msdmo.dll
================================================================================
HOSTS:
98.126.17.171 www.qqluna.com
98.126.17.171 www.mhluna.com
98.126.17.171 www.101wg.cn
98.126.17.171 www.poc88.cn
98.126.17.171 www.lqran.com
98.126.17.171 myyong.com
98.126.17.171 www.sexran.net
98.126.17.171 www.yyran.com
98.126.17.171 www.99yong.com
98.126.17.171 www.vipyong.com
98.126.17.171 www.ranyong.com
98.126.17.171 www.babyran.com
98.126.17.171 www.zumuran.com
98.126.17.171 www.mxran.com
98.126.17.171 cityyong.com
98.126.17.171 www.ddran.cn
98.126.17.171 www.gmyong.com
98.126.17.171 www.codeyong.com
98.126.17.171 www.95yong.com
98.126.17.171 ran.878x.net
98.126.17.171 www.xxran.com
登錄值列表 *** 注意 : 部分正常值不會顯示 ***
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [Microsoft Corporation]
"<沒有名稱>"="" [File Not Found.]
"StartCCC"="C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [N/A]
"Messenger (Yahoo!)"="C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe" [Yahoo! Inc.]
"msnmsgr"="C:\Program Files\Windows Live\Messenger\msnmsgr.exe" [Microsoft Corporation]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"IMJPMIG8.1"="C:\WINDOWS\ime\IMJP8_1\imjpmig.exe" [Microsoft Corporation]
"PHIME2002ASync"="C:\WINDOWS\system32\IME\TINTLGNT\tintsetp.exe" [Microsoft Corporation]
"PHIME2002A"="C:\WINDOWS\system32\IME\TINTLGNT\tintsetp.exe" [Microsoft Corporation]
"RTHDCPL"="C:\WINDOWS\RTHDCPL.exe" [Realtek Semiconductor Corp.]
"Alcmtr"="C:\WINDOWS\Alcmtr.exe" [Realtek Semiconductor Corp.]
"SmartMon"="C:\Program Files\EmvSmartCardReader\SmartMON.exe" [N/A]
"BePCSC"="C:\Program Files\EmvSmartCardReader\BePCSC.exe" [N/A]
"Grid Service"="C:\Program Files\GridService\peer.exe" [FS2YOU]
"way math bike enc"="C:\Documents and Settings\All Users\Application Data\cast dale way math\axis mfcd.exe" [Upgraded Pofitors]
"KernelFaultCheck"="C:\WINDOWS\system32\dumprep 0 -k" [X]
"HP Software Update"="C:\Program Files\HP\HP Software Update\hpwuschd2.exe" [Hewlett-Packard]
"<沒有名稱>"="" [File Not Found.]
"UVS12 Preload"="C:\Program Files\Corel\Corel VideoStudio 12\uvPL.exe" [Corel TW Corp.]
"UpdatePDRShortCut"="C:\Program Files\CyberLink\PowerDirector\MUITransfer\MUIStartMenu.exe" [CyberLink Corp.]
"avgnt"="C:\Program Files\Avira\AntiVir Desktop\avgnt.exe" [Avira GmbH]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [Microsoft Corporation]
[HKEY_USERS\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [Microsoft Corporation]
[HKEY_USERS\S-1-5-19\Software\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [Microsoft Corporation]
[HKEY_USERS\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [Microsoft Corporation]
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\shellserviceobjectdelayload]
"WPDShServiceObj"="{AAA288BA-9A4C-45B0-95D7-94D524869DB5}" - 2006-10-18 21:47 133632 C:\WINDOWS\system32\WPDShServiceObj.dll
[HKEY_LOCAL_MACHINE\~\Explorer\Browser Helper Objects\{02478D38-C3F9-4efb-9B51-7695ECA05670}]
2008-07-28 18:47 882416 C:\PROGRA~1\Yahoo!\Companion\Installs\cpn\yt.dll
[HKEY_LOCAL_MACHINE\~\Explorer\Browser Helper Objects\{0347C33E-8762-4905-BF09-768834316C61}]
2007-03-02 16:52 1298024 C:\Program Files\HP\Smart Web Printing\hpswp_printenhancer.dll
[HKEY_LOCAL_MACHINE\~\Explorer\Browser Helper Objects\{053F9267-DC04-4294-A72C-58F732D338C0}]
2007-03-02 16:52 177768 C:\Program Files\HP\Smart Web Printing\hpswp_framework.dll
[HKEY_LOCAL_MACHINE\~\Explorer\Browser Helper Objects\{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}]
[HKEY_LOCAL_MACHINE\~\Explorer\Browser Helper Objects\{22FC6CE8-7D47-479F-B74A-BFBB04ADB9AF}]
2008-04-01 08:39 73728 C:\Program Files\Winferno\PC Confidential\PCCBHO.dll
[HKEY_LOCAL_MACHINE\~\Explorer\Browser Helper Objects\{5C255C8A-E604-49b4-9D64-90988571CECB}]
[HKEY_LOCAL_MACHINE\~\Explorer\Browser Helper Objects\{6EBF7485-159F-4bff-A14F-B9E3AAC4465B}]
2009-05-19 11:36 137600 C:\Program Files\Microsoft\Search Enhancement Pack\Search Helper\SEPsearchhelperie.dll
[HKEY_LOCAL_MACHINE\~\Explorer\Browser Helper Objects\{FCBCCB87-9224-4B8D-B117-F56D924BEB18}]
2008-11-26 19:42 1916024 C:\Program Files\My.Freeze.com Toolbar\freeze_int2.dll
[HKEY_LOCAL_MACHINE\~\Explorer\Browser Helper Objects\{FDAD4DA1-61A2-4FD8-9C17-86F7AC245081}]
2008-07-28 18:47 160496 C:\PROGRA~1\Yahoo!\Companion\Installs\cpn\YTSingleInstance.dll
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\ccc-core-static]
msiexec /fums {A75BF1D0-C7C3-CB55-EE17-3225387FD154} /qb
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer]
HonorAutoRunSetting=0x1
c:\documents and settings\all users\「開始」功能表\程式集\啟動\
Adobe Reader Speed Launch.lnk - C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe [ 2004-12-14 04:44:06 29696 ]
Microsoft Office.lnk - C:\Program Files\Microsoft Office\Office10\OSA.EXE [ 2001-02-13 01:01:04 83360 ]
Rename operations pending:
001; C:\DOCUME~1\MMX\LOCALS~1\Temp\7dda43f45eed.tmp ;DELETE;
002; C:\DOCUME~1\MMX\LOCALS~1\Temp\94344f0efc01.tmp ;DELETE;
003; C:\DOCUME~1\MMX\LOCALS~1\Temp\377c599f8ea8.tmp ;DELETE;
004; C:\DOCUME~1\MMX\LOCALS~1\Temp\d75b5cdbab85.tmp ;DELETE;
005; C:\DOCUME~1\MMX\LOCALS~1\Temp\c652771aa24f.tmp ;DELETE;
006; C:\DOCUME~1\MMX\LOCALS~1\Temp\071078895fa2.tmp ;DELETE;
007; C:\DOCUME~1\MMX\LOCALS~1\Temp\f86e7abdac98.tmp ;DELETE;
008; C:\DOCUME~1\MMX\LOCALS~1\Temp\669c80533954.tmp ;DELETE;
009; C:\WINDOWS\system32\drivers\EagleNt.sys ;DELETE;
010; C:\DOCUME~1\MMX\LOCALS~1\Temp\54c25c742f85.tmp ;DELETE;
011; C:\DOCUME~1\MMX\LOCALS~1\Temp\5cce76030df2.tmp ;DELETE;
012; C:\DOCUME~1\MMX\LOCALS~1\Temp\f31c7ac3b164.tmp ;DELETE;
013; C:\DOCUME~1\MMX\LOCALS~1\Temp\89c47018e6e7.tmp ;DELETE;
014; C:\DOCUME~1\MMX\LOCALS~1\Temp\a1c88f79ef7a.tmp ;DELETE;
015; C:\DOCUME~1\MMX\LOCALS~1\Temp\3e5590ab50c3.tmp ;DELETE;
016; C:\DOCUME~1\MMX\LOCALS~1\Temp\825a92efca72.tmp ;DELETE;
017; C:\DOCUME~1\MMX\LOCALS~1\Temp\1b3696272de6.tmp ;DELETE;
018; C:\WINDOWS\system32\drivers\EagleNt.sys ;DELETE;
019; C:\WINDOWS\system32\wuapi.dll.wusetup.163670078.bak ;DELETE;
020; C:\WINDOWS\system32\wuauclt.exe.wusetup.163670125.bak ;DELETE;
021; C:\WINDOWS\system32\wuaueng.dll.wusetup.163670359.bak ;DELETE;
"C:\WINDOWS\system32\drivers\cdaudio.sys" not found.
"C:\WINDOWS\system32\ipfltdrv.sys" not found.
================================================================================
服務 \ 驅動 列表:
顯示方式 : 啟動狀態 服務名稱;顯示名稱;檔案名稱
R2 AntiVirSchedulerService;Avira AntiVir Scheduler;C:\Program Files\Avira\AntiVir Desktop\sched.exe [Avira GmbH]
P12 MediaSerial;Portable Media Number;C:\WINDOWS\system32\RjmktvC.dll [File Not Found.]
S3 napagent;Network Access Protection Agent;C:\WINDOWS\System32\qagentrt.dll [Microsoft Corporation]
S3 npggsvc;nProtect GameGuard Service;C:\WINDOWS\system32\GameMon.des -service [File Not Found.]
S2 rcmdsvc;Remote Command Service;C:\WINDOWS\system32\xtzlno.exe [File Not Found.]
R2 SeaPort;SeaPort;C:\Program Files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe [Microsoft Corporation]
S2 VServer_2008;V_Server;C:\Program Files\Common Files\Microsoft Shared\MSInfo\R_Server.exe [File Not Found.]
S2 winloginsav;Rising Scan Service2009;C:\WINDOWS\system32\RlmitjC.dl [File Not Found.]
U? AVPsys;AVPsys;[X]
S3 city;city;C:\WINDOWS\system32\drivers\city.ahc [N/A]
S3 EMVSCARD;EMVSCARD;C:\WINDOWS\system32\Drivers\EMVSCARD.sys [File Not Found.]
S3 SecRomDrv;Secure CDROM Property;C:\WINDOWS\system32\DRIVERS\cdrom.sys [Microsoft Corporation]
S3 Yong_tw;Yong_tw;C:\WINDOWS\system32\drivers\Yong_tw.ahc [N/A]
================================================================================
工作排程資料夾內的資料:
IE 首頁設定:
Internet Explorer Version: 6.0.2900.5512
HKLM - Search Page = hxxp://tw.rd.yahoo.com/customize/ie/defaults/sp/msgr9/*hxxp://tw.search.yahoo.com
HKCU - Start Page = hxxp://tw.yahoo.com/
HKCU - Search Page = hxxp://tw.rd.yahoo.com/customize/ie/defaults/sp/msgr9/*hxxp://tw.search.yahoo.com
HKCU - Extra menu item: 匯出至 Microsoft Excel(&X) - res://C:\PROGRA~1\MI1933~1\Office10\EXCEL.EXE/3000
HKLM - Extensions: {53F6FCCD-9E22-4d71-86EA-6E43136192AB} - C:\Program Files\Winferno\PC Confidential\PCConfidential.exe
HKLM - Extensions: {925DAB62-F9AC-4221-806A-057BFB1014AA} - C:\Program Files\Winferno\PC Confidential\PCConfidential.exe
HKLM - Extensions: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe
HKLM - Extensions: {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
HKLM - Extensions: {58ECB495-38F0-49cb-A538-10282ABF65E7} - {E763472E-A716-4CD9-89BD-DBDA6122F741} - C:\Program Files\HP\Smart Web Printing\hpswp_extensions.dll
HKLM - Extensions: {700259D7-1666-479a-93B1-3250410481E8} - {A93C41D8-01F8-4F8B-B14C-DE20B117E636} - C:\Program Files\HP\Smart Web Printing\hpswp_extensions.dll
================================================================================
Win32/Conficker worm has not been found active in the memory.
Do you want to perform scanning and cleaning anyway? (y/n)
Nothing was found.
Checking for Win32/Conficker.AA files:
Nothing was found.
================================================================================
A: -Removable Disk- No Assess
C: -Local Disk- Size: 32218386432 FreeSpace: 12433031168 NTFS
D: -Local Disk- Size: 214334345216 FreeSpace: 11102408704 NTFS
E: -Compact Disc- No Assess
掃描結束時間: 2009-12-10 15:44:41.74 小紅傘開著好像毒也是一直來XD
[h80053 在 2009-12-10 04:36 PM 作了最後編輯]
| |
dk2004
|
發表於 2009-12-9 11:40 PM |
|
|
h80053
|
發表於 2009-11-30 08:37 AM |
掃毒過後的報告檔
好像沒檢查到什麼東西@@
至於大大所提出的那一個檔案我倒是沒注意到
我等等觀看看會有什麼反應
Avira AntiVir Personal
Report file date: 2009年11月30日 07:52
Scanning for 1400843 virus strains and unwanted programs.
Licensee : Avira AntiVir Personal - FREE Antivirus
Serial number : 0000149996-ADJIE-0000001
Platform : Windows XP
Windows version : (Service Pack 3) [5.1.2600]
Boot mode : Normally booted
Username : SYSTEM
Computer name : YOUR-1480315507
Version information:
BUILD.DAT : 9.0.0.415 21609 Bytes 2009/11/8 10:00:00
AVSCAN.EXE : 9.0.3.10 466689 Bytes 2009/10/13 03:26:33
AVSCAN.DLL : 9.0.3.0 40705 Bytes 2009/2/27 02:58:24
LUKE.DLL : 9.0.3.2 209665 Bytes 2009/2/20 03:35:49
LUKERES.DLL : 9.0.2.0 12033 Bytes 2009/2/27 02:58:52
VBASE000.VDF : 7.10.0.0 19875328 Bytes 2009/11/6 23:35:52
VBASE001.VDF : 7.10.1.0 1372672 Bytes 2009/11/19 11:36:33
VBASE002.VDF : 7.10.1.1 2048 Bytes 2009/11/19 11:36:33
VBASE003.VDF : 7.10.1.2 2048 Bytes 2009/11/19 11:36:33
VBASE004.VDF : 7.10.1.3 2048 Bytes 2009/11/19 11:36:33
VBASE005.VDF : 7.10.1.4 2048 Bytes 2009/11/19 11:36:34
VBASE006.VDF : 7.10.1.5 2048 Bytes 2009/11/19 11:36:34
VBASE007.VDF : 7.10.1.6 2048 Bytes 2009/11/19 11:36:34
VBASE008.VDF : 7.10.1.7 2048 Bytes 2009/11/19 11:36:34
VBASE009.VDF : 7.10.1.8 2048 Bytes 2009/11/19 11:36:34
VBASE010.VDF : 7.10.1.9 2048 Bytes 2009/11/19 11:36:34
VBASE011.VDF : 7.10.1.10 2048 Bytes 2009/11/19 11:36:35
VBASE012.VDF : 7.10.1.11 2048 Bytes 2009/11/19 11:36:35
VBASE013.VDF : 7.10.1.79 209920 Bytes 2009/11/25 11:36:37
VBASE014.VDF : 7.10.1.80 2048 Bytes 2009/11/25 11:36:37
VBASE015.VDF : 7.10.1.81 2048 Bytes 2009/11/25 11:36:37
VBASE016.VDF : 7.10.1.82 2048 Bytes 2009/11/25 11:36:37
VBASE017.VDF : 7.10.1.83 2048 Bytes 2009/11/25 11:36:37
VBASE018.VDF : 7.10.1.84 2048 Bytes 2009/11/25 11:36:37
VBASE019.VDF : 7.10.1.85 2048 Bytes 2009/11/25 11:36:38
VBASE020.VDF : 7.10.1.86 2048 Bytes 2009/11/25 11:36:38
VBASE021.VDF : 7.10.1.87 2048 Bytes 2009/11/25 11:36:38
VBASE022.VDF : 7.10.1.88 2048 Bytes 2009/11/25 11:36:38
VBASE023.VDF : 7.10.1.89 2048 Bytes 2009/11/25 11:36:38
VBASE024.VDF : 7.10.1.90 2048 Bytes 2009/11/25 11:36:38
VBASE025.VDF : 7.10.1.91 2048 Bytes 2009/11/25 11:36:39
VBASE026.VDF : 7.10.1.92 2048 Bytes 2009/11/25 11:36:39
VBASE027.VDF : 7.10.1.93 2048 Bytes 2009/11/25 11:36:39
VBASE028.VDF : 7.10.1.94 2048 Bytes 2009/11/25 11:36:39
VBASE029.VDF : 7.10.1.95 2048 Bytes 2009/11/25 11:36:39
VBASE030.VDF : 7.10.1.96 2048 Bytes 2009/11/25 11:36:39
VBASE031.VDF : 7.10.1.117 112128 Bytes 2009/11/27 11:33:38
Engineversion : 8.2.1.78
AEVDF.DLL : 8.1.1.2 106867 Bytes 2009/11/7 23:38:52
AESCRIPT.DLL : 8.1.2.45 586108 Bytes 2009/11/25 11:36:52
AESCN.DLL : 8.1.2.5 127346 Bytes 2009/11/7 23:38:46
AESBX.DLL : 8.1.1.1 246132 Bytes 2009/11/7 23:38:44
AERDL.DLL : 8.1.3.2 479604 Bytes 2009/11/7 23:38:42
AEPACK.DLL : 8.2.0.3 422261 Bytes 2009/11/7 23:38:40
AEOFFICE.DLL : 8.1.0.38 196987 Bytes 2009/11/7 23:38:38
AEHEUR.DLL : 8.1.0.180 2093432 Bytes 2009/11/25 11:36:50
AEHELP.DLL : 8.1.7.5 237942 Bytes 2009/11/25 11:36:42
AEGEN.DLL : 8.1.1.78 364917 Bytes 2009/11/25 11:36:41
AEEMU.DLL : 8.1.1.0 393587 Bytes 2009/11/7 23:38:26
AECORE.DLL : 8.1.8.2 184694 Bytes 2009/11/7 23:38:24
AEBB.DLL : 8.1.0.3 53618 Bytes 2009/11/7 23:38:20
AVWINLL.DLL : 9.0.0.3 18177 Bytes 2008/12/12 00:47:59
AVPREF.DLL : 9.0.3.0 44289 Bytes 2009/8/26 07:14:02
AVREP.DLL : 8.0.0.3 155905 Bytes 2009/1/20 06:34:28
AVREG.DLL : 9.0.0.0 36609 Bytes 2008/12/5 02:32:09
AVARKT.DLL : 9.0.0.3 292609 Bytes 2009/3/24 07:05:41
AVEVTLOG.DLL : 9.0.0.7 167169 Bytes 2009/1/30 02:37:08
SQLITE3.DLL : 3.6.1.0 326401 Bytes 2009/1/28 07:03:49
SMTPLIB.DLL : 9.2.0.25 28417 Bytes 2009/2/2 00:21:33
NETNT.DLL : 9.0.0.0 11521 Bytes 2008/12/5 02:32:10
RCIMAGE.DLL : 9.0.0.25 2438913 Bytes 2009/5/15 07:39:58
RCTEXT.DLL : 9.0.73.0 86785 Bytes 2009/10/13 04:25:47
Configuration settings for the scan:
Jobname.............................: Complete system scan
Configuration file..................: c:\program files\avira\antivir desktop\sysscan.avp
Logging.............................: low
Primary action......................: repair
Secondary action....................: delete
Scan master boot sector.............: on
Scan boot sector....................: on
Boot sectors........................: C:, D:,
Process scan........................: on
Scan registry.......................: on
Search for rootkits.................: on
Integrity checking of system files..: off
Scan all files......................: All files
Scan archives.......................: on
Recursion depth.....................: 20
Smart extensions....................: on
Macro heuristic.....................: on
File heuristic......................: medium
Start of the scan: 2009年11月30日 07:52
Starting search for hidden objects.
'47537' objects were checked, '0' hidden objects were found.
The scan of running processes will be started
Scan process 'avscan.exe' - '1' Module(s) have been scanned
Scan process 'avcenter.exe' - '1' Module(s) have been scanned
Scan process 'spoolsv.exe' - '1' Module(s) have been scanned
Scan process 'wmplayer.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'hpswp_clipbook.exe' - '1' Module(s) have been scanned
Scan process 'iexplore.exe' - '1' Module(s) have been scanned
Scan process 'emule.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'wscntfy.exe' - '1' Module(s) have been scanned
Scan process 'alg.exe' - '1' Module(s) have been scanned
Scan process 'ViewpointService.exe' - '1' Module(s) have been scanned
Scan process 'ULCDRSvr.exe' - '1' Module(s) have been scanned
Scan process 'SeaPort.exe' - '1' Module(s) have been scanned
Scan process 'scardsvr.exe' - '1' Module(s) have been scanned
Scan process 'RichVideo.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'avguard.exe' - '1' Module(s) have been scanned
Scan process 'CCC.exe' - '1' Module(s) have been scanned
Scan process 'MOM.exe' - '1' Module(s) have been scanned
Scan process 'ctfmon.exe' - '1' Module(s) have been scanned
Scan process 'avgnt.exe' - '1' Module(s) have been scanned
Scan process 'hpwuschd2.exe' - '1' Module(s) have been scanned
Scan process 'peer.exe' - '1' Module(s) have been scanned
Scan process 'BePCSC.exe' - '1' Module(s) have been scanned
Scan process 'SmartMON.exe' - '1' Module(s) have been scanned
Scan process 'RTHDCPL.exe' - '1' Module(s) have been scanned
Scan process 'explorer.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'sched.exe' - '1' Module(s) have been scanned
Scan process 'ati2evxx.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'ati2evxx.exe' - '1' Module(s) have been scanned
Scan process 'lsass.exe' - '1' Module(s) have been scanned
Scan process 'services.exe' - '1' Module(s) have been scanned
Scan process 'winlogon.exe' - '1' Module(s) have been scanned
Scan process 'csrss.exe' - '1' Module(s) have been scanned
Scan process 'smss.exe' - '1' Module(s) have been scanned
42 processes with 42 modules were scanned
Starting master boot sector scan:
Master boot sector HD0
[INFO] No virus was found!
Start scanning boot sectors:
Boot sector 'C:\'
[INFO] No virus was found!
Boot sector 'D:\'
[INFO] No virus was found!
Starting to scan executable files (registry).
The registry was scanned ( '65' files ).
Starting the file scan:
Begin scan in 'C:\'
C:\pagefile.sys
[WARNING] The file could not be opened!
[NOTE] This file is a Windows system file.
[NOTE] This file cannot be opened for scanning.
C:\WINDOWS\SoftwareDistribution\Download\26937c38397cdf6fe89dcfb204cc0f11\BIT151.tmp
[0] Archive type: CAB (Microsoft)
--> hpoh710a.cab
[1] Archive type: CAB (Microsoft)
--> hpbcfgre.dll
[WARNING] No further files can be extracted from this archive. The archive will be closed
--> hpoh710a.cat
[WARNING] No further files can be extracted from this archive. The archive will be closed
Begin scan in 'D:\'
End of the scan: 2009年11月30日 08:34
Used time: 42:03 Minute(s)
The scan has been done completely.
8525 Scanned directories
241189 Files were scanned
0 Viruses and/or unwanted programs were found
0 Files were classified as suspicious
0 files were deleted
0 Viruses and unwanted programs were repaired
0 Files were moved to quarantine
0 Files were renamed
1 Files cannot be scanned
241188 Files not concerned
7553 Archives were scanned
3 Warnings
1 Notes
47537 Objects were scanned with rootkit scan
0 Hidden objects were found
[h80053 在 2009-11-30 08:41 AM 作了最後編輯]
| |
平凡小任
|
發表於 2009-11-30 12:22 AM |
其實應該是都可以關掉的
不過如果你目前沒問題網頁沒跳出應該是OK了
我裡面看比較可疑的是My.freeze.com toolbar這個
我覺得怪怪的
反正暫時穩住就OK了
送花給你鼓勵一下
[平凡小任 在 2009-11-30 08:58 AM 作了最後編輯]
| |
h80053
|
發表於 2009-11-28 10:38 PM |
謝謝大大 目前掃出來有殺掉不少程式
接著就是在嘗試看看大大說的方法來去抓源頭了
之後有什麼變化我會在發表出來 謝謝
裡面可以關的程式只有一個跟大大的相輔
其他的好像跟大大不一樣所以貼上來
至於掃過後網頁還沒跳出來過
[h80053 在 2009-11-29 08:43 AM 作了最後編輯]
| |
平凡小任
|
發表於 2009-11-28 09:28 PM |
所謂的IE砍光光應該是可以做到這樣的程度
[img=http://img410.imageshack.us/img410/781/11333.th.jpg]
你看應該一個IE也沒有
建議你先用firefox上網
然後觀察IE會跳出來的視窗
注意程序是由哪裡發動的
從這裡去下手吧
另外IE的話
工具→管理附加元件
這些其實都可以關掉
怕有的原件偽裝成綁架網站
所以這些先都關掉看看
不然還有一招
去找魔法兔子來用
他裡面有一個設定可以讓你回復IE到初始設定
真的無法自己排除再考慮看看吧
我記得版上有人提供該軟體可以搜尋看看
[平凡小任 在 2009-11-28 09:37 PM 作了最後編輯]
| |
h80053
|
發表於 2009-11-28 09:21 PM |
目前開始順利掃毒中 但是要掃完還有一段時間
明天我會把結果跟東西PO出來跟大大們討論!!
小任你說的常駐檔案是專指IE的嗎??
其實很多常駐程式我自己也不是很清楚所以在這邊在問詳細一些
我之前有看過 確實會跳出一個IE出來 但是按掉刪除後後還是會在出現
可能是源頭太深了@@
| |
iaban
|
發表於 2009-11-28 07:51 PM |
你這個啊 常駐裡面看不到的... 即使看得到異常檔案也都是因為主要木馬在背景偷偷下載了執行檔..
你肯定是木馬 dll sys等等檔案被當驅動程式載入了，或是某些網路必備dll sys檔案被置換成有木馬的!
然後你只要一連網路他就先去下載.exe檔或是直接連線到某網頁去...
我不知道小紅傘掃不掃的到，但是你可以用小紅掃然後完整掃描 C:\windows
然後貼出log檔來給大家討論....
不想安裝其他防毒的話就裝一些線上病毒掃描來分析(但是清除病毒要自己手動)
像是panda , norton , Kaspersky等等都有線上掃描可以用...
| |
平凡小任
|
發表於 2009-11-28 06:52 PM |
喔
onecare他好像是救急用的
你看看你有沒有正常的電腦
把硬碟拆下來給那台掃→最好是外接模式
這樣下去試看看吧
至於跳網頁的情形
你可以先把所有IE都關掉
程序也都砍掉
然後注意觀察跳頁面出來時是哪個程式或小程序發動的
這樣下去判斷
另外win.ini看看有沒有奇怪常駐開機的也取消掉
先這樣子重開看看
這個要自己抓老實說難度有比較高
只能默默給你祝福了
另外你可以去找firefox的免安裝版
然後IE程序都關閉
用firefox上網線上掃毒
我有看到你好像有灌那個線上掃毒網
可以這樣子下去試看看
因為你IE可能被綁架了所以IE不能動用
除非你拿給別台掃毒
不然很可能也會掃不乾淨
[平凡小任 在 2009-11-28 06:53 PM 作了最後編輯]
| |
h80053
|
發表於 2009-11-28 05:20 PM |
謝謝小任大大的寶貴意見!!我晚點再去試試看。
之前我電腦有問題也都是重灌但是這樣我網路還要再設定不然會IOW IP
所以之前重灌一次就懶了，希望這一次能順利解決
我已經更新過了將他給刪除了!!
可是還是跑出奇怪網頁@@
要嘗試安裝01上頭說的方式 安裝到一半網頁都會跳出來@@
[h80053 在 2009-11-28 06:44 PM 作了最後編輯]
| |
| 本主題回覆較多，請 點擊這裡 檢閱。 |
