求助 - 中了大陸廣告病毒 有何辦法..謝謝大大們了

[lonly888]

你們好...我想問問...我電腦昨天上網的時候 無意中去到惡意網站..然後便開始..
大量過分跳出許多大陸廣告網址...我利用我個人的防毒軟體(NOD32)掃瞄..根本就
掃不出什麼來..於是又用了 (Yahoo反間諜軟體)也好像無補於事...望大大們給點見義
及情報..用什麼方法可以完完全全殺查這些惡意廣告網站的樓源呢??我是一天不查殺..
就一天不舒服..在短短的十幾分鐘可以跳出十幾個廣告網址...根本在擾亂我的上網心情..
嗚嗚~~ 救命..

[不飛]

老實話說，
這是沒有辦法根治的!
您可以用 SpyRemover 這套軟體試試看，
但是終結的解決方案就是重新安裝。

[leowang]

如果一些抓惡意的程式都無法清除的話
那只好Backup吧 重新安裝系統囉

[plunderer]

用 hijackthis 掃描
http://www.trendsecure.com/portal/en...ackThis_v2.exe

把 log 貼上來

[lonly888]

大大指的 Log 是不是指掃瞄完後的 『筆記本』呢??..
我掃瞄完後就發現自動跳出筆記本來了..裡面全部都是..
關於Windows內部的一些東東...

[不飛]

作者: lonly888

大大指的 Log 是不是指掃瞄完後的 『筆記本』呢??..
我掃瞄完後就發現自動跳出筆記本來了..裡面全部都是..
關於Windows內部的一些東東...

那就請您就把記事本內的文字通通貼上來，

這樣大家才能幫您研判!

[lonly888]

好的..那就請大大們幫幫忙囉...

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\Program Files\Eset\nod32krn.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\svchost.exe
C:\PROGRA~1\COMMON~1\ATion\onligaui.exe
C:\Program Files\Eset\nod32kui.exe
C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe
C:\WINDOWS\RTHDCPL.EXE
C:\WINDOWS\system32\RUNDLL32.EXE
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\VM303_STI.EXE
C:\WINDOWS\system32\Rundll32.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\SURECOM\SURECOM 802.11g WLAN USB Adapter\Installer\WINXP\EP9001-g-3A.exe
C:\WINDOWS\BricoPacks\Vista Inspirat\ObjectDock\ObjectDock.exe
C:\WINDOWS\BricoPacks\Vista Inspirat\YzToolbar\YzToolBar.exe
D:\Program Files\Tencent\QQ\QQ.exe
C:\Program Files\PC Connectivity Solution\ServiceLayer.exe
C:\WINDOWS\System32\svchost.exe
D:\Program Files\Tencent\QQ\TIMPlatform.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Documents and Settings\自宅\桌面\HiJackThis_v2.exe

R3 - URLSearchHook: Tencent SearchHook - {DB8B2393-7A6C-4C76-88CE-6B1F6FF6FFE9} - C:\Program Files\TENCENT\SSPlus\SAddr.dll
F3 - REG:win.ini: run=C:\PROGRA~1\COMMON~1\ATion\onligaui.exe
O1 - Hosts: 222.76.219.22 bbs.he007.net
O1 - Hosts: 222.76.219.22 www.he007.net
O1 - Hosts: 222.76.219.22 www.he007.com
O1 - Hosts: 222.76.219.22 www.yoyo-do.com
O1 - Hosts: 222.76.219.22 www.33wg.com
O1 - Hosts: 222.76.219.22 www.he521.com
O1 - Hosts: 222.76.219.22 www.he007.cn
O1 - Hosts: 222.76.219.22 bbs.he007.cn
O1 - Hosts: 222.76.219.22 www.zsbot.com
O1 - Hosts: 222.76.219.22 98.to
O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: Tencent Browser Helper - {0C7C23EF-A848-485B-873C-0ED954731014} - C:\Program Files\TENCENT\SSPlus\SAddr.dll
O2 - BHO: flashget urlcatch - {2F364306-AA45-47B5-9F9D-39A8B94E7EF7} - D:\Program Files\FlashGet\jccatch.dll
O2 - BHO: MEGAUPLOADTOOLBAR - {4E7BD74F-2B8D-469E-CCB0-B130EEDBE97C} - C:\PROGRA~1\MEGAUP~1\MEGAUP~1.DLL
O2 - BHO: QQIEHelper - {54EBD53A-9BC1-480B-966A-843A333CA162} - D:\Program Files\Tencent\QQ\QQIEHelper.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: ThunderBHO - {889D2FEB-5411-4565-8998-1DD2C5261283} - D:\FD\迅雷\ComDlls\XunLeiBHO_002.dll (file missing)
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Windows Live Toolbar Helper - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
O2 - BHO: FlashGet GetFlash Class - {F156768E-81EF-470C-9057-481BA8380DBA} - D:\Program Files\FlashGet\getflash.dll
O3 - Toolbar: Dr.eye WebPage Translation - {92B255FE-94E2-4BCA-958D-3926CE38913F} - C:\Program Files\Inventec\Dreye\DreyeMT\DreyeIEBar.dll
O3 - Toolbar: Windows Live Toolbar - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O3 - Toolbar: MEGAUPLOADTOOLBAR - {4E7BD74F-2B8D-469E-CCB0-B130EEDBE97C} - C:\PROGRA~1\MEGAUP~1\MEGAUP~1.DLL
O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
O4 - HKLM\..\Run: [nod32kui] "C:\Program Files\Eset\nod32kui.exe" /WAITSERVICE
O4 - HKLM\..\Run: [RemoteControl] "C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe"
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [SkyTel] SkyTel.EXE
O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [CJIMETIPSYNC] C:\Program Files\Common Files\Microsoft Shared\IME\IMTC65\CHANGJIE\CINTLCFG.EXE /CJIMETIPSync
O4 - HKLM\..\Run: [PHIMETIPSYNC] C:\Program Files\Common Files\Microsoft Shared\IME\IMTC65\PHONETIC\TINTLCFG.EXE /PHIMETIPSync
O4 - HKLM\..\Run: [BigDog303] C:\WINDOWS\VM303_STI.EXE VIMICRO USB PC Camera (ZC0301PLH)
O4 - HKLM\..\Run: [stup.exe] Rundll32.exe C:\PROGRA~1\TENCENT\SSPlus\SPlus.dll,Rundll32 R
O4 - HKLM\..\Run: [Flashget] D:\Program Files\FlashGet\FlashGet.exe /min
O4 - HKLM\..\Run: [PCSuiteTrayApplication] C:\Program Files\Nokia\Nokia PC Suite 6\LaunchApplication.exe -startup
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [foxy] "D:\Program Files\Foxy\Foxy.exe" -tray
O4 - HKUS\S-1-5-19\..\Run: [ctfmon.exe] C:\WINDOWS\system32\CTFMON.EXE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [ctfmon.exe] C:\WINDOWS\system32\CTFMON.EXE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [ctfmon.exe] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [ctfmon.exe] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O8 - Extra context menu item: &NeoTrace It! - E:\PROGRA~1\NEOTRA~1\NTXcontext.htm
O8 - Extra context menu item: &Windows Live Search - res://C:\Program Files\Windows Live Toolbar\msntb.dll/search.htm
O8 - Extra context menu item: &使用 FlashGet 下載 - D:\Program Files\FlashGet\jc_link.htm
O8 - Extra context menu item: &使用迅雷下載 - D:\FD\迅雷\Program\GetUrl.htm
O8 - Extra context menu item: &使用迅雷下載全部鏈接 - D:\FD\迅雷\Program\GetAllUrl.htm
O8 - Extra context menu item: &全部使用 FlashGet 下載 - D:\Program Files\FlashGet\jc_all.htm
O8 - Extra context menu item: Foxy 下載 - res://D:\Program Files\Foxy\Foxy.exe/download.htm
O8 - Extra context menu item: Foxy 刲 - res://D:\Program Files\Foxy\Foxy.exe/search.htm
O8 - Extra context menu item: Foxy 搜尋 - res://D:\Program Files\Foxy\Foxy.exe/search.htm
O8 - Extra context menu item: Foxy 狟徭 - res://D:\Program Files\Foxy\Foxy.exe/download.htm
O8 - Extra context menu item: Foxy 更 - res://D:\Program Files\Foxy\Foxy.exe/download.htm
O8 - Extra context menu item: 上傳到QQ網路硬碟 - D:\Program Files\Tencent\QQ\AddToNetDisk.htm
O8 - Extra context menu item: 使用 BitSpirit 下載(&B) - D:\Program Files\BitSpirit\bsurl.htm
O8 - Extra context menu item: 匯出至 Microsoft Office Excel(&X) - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: 在新的前景索引標籤中開啟 - res://C:\Program Files\Windows Live Toolbar\Components\zh-tw\msntabres.dll.mui/230?37fbe9b2a29c46b398063fca5b769c13
O8 - Extra context menu item: 在新的背景索引標籤中開啟 - res://C:\Program Files\Windows Live Toolbar\Components\zh-tw\msntabres.dll.mui/229?37fbe9b2a29c46b398063fca5b769c13
O8 - Extra context menu item: 新增到QQ自定義面板 - D:\Program Files\Tencent\QQ\AddPanel.htm
O8 - Extra context menu item: 新增到QQ表情 - D:\Program Files\Tencent\QQ\AddEmotion.htm
O8 - Extra context menu item: 添加到QQ自定義面板 - D:\Program Files\Tencent\QQ\AddPanel.htm
O8 - Extra context menu item: 添加到QQ表情 - D:\Program Files\Tencent\QQ\AddEmotion.htm
O8 - Extra context menu item: 用QQ MMS傳送該圖片 - D:\Program Files\Tencent\QQ\SendMMS.htm
O8 - Extra context menu item: 用QQ彩信發送該圖片 - D:\Program Files\Tencent\QQ\SendMMS.htm
O8 - Extra context menu item: 用中華神捕抓取全部圖片 - D:\Program Files\FLISoft\Capture Studio\CapAll.htm
O8 - Extra context menu item: 用中華神捕抓取圖片 - D:\Program Files\FLISoft\Capture Studio\CapOne.htm
O9 - Extra button: 啟動迅雷 - {0062C9BD-B349-40DE-91A0-755F37ACD559} - D:\FD\迅雷\Thunder.exe (file missing)
O9 - Extra 'Tools' menuitem: 啟動迅雷 - {0062C9BD-B349-40DE-91A0-755F37ACD559} - D:\FD\迅雷\Thunder.exe (file missing)
O9 - Extra button: 參考資料 - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: QQ - {c95fe080-8f5d-11d2-a20b-00aa003c157b} - D:\Program Files\Tencent\QQ\QQ.EXE
O9 - Extra 'Tools' menuitem: 騰訊QQ - {c95fe080-8f5d-11d2-a20b-00aa003c157b} - D:\Program Files\Tencent\QQ\QQ.EXE
O9 - Extra button: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - D:\Program Files\FlashGet\FlashGet.exe
O9 - Extra 'Tools' menuitem: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - D:\Program Files\FlashGet\FlashGet.exe
O9 - Extra button: (no name) - {DEDEB80D-FA35-45d9-9460-4983E5A8AFE6} - D:\Program Files\Tencent\QQ\QQIEHelper.dll
O9 - Extra 'Tools' menuitem: QQ嚃粗馱撿沭扢离 - {DEDEB80D-FA35-45d9-9460-4983E5A8AFE6} - D:\Program Files\Tencent\QQ\QQIEHelper.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra button: NeoTrace It! - {9885224C-1217-4c5f-83C2-00002E6CEF2B} - E:\PROGRA~1\NEOTRA~1\NTXtoolbar.htm (file missing) (HKCU)
O11 - Options group: [TBH] SOSO AddressBar Search
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {30528230-99F7-4BB4-88D8-FA1D4F56A2AB} (YInstStarter Class) - http://us.dl1.yimg.com/download.yaho...st20040510.cab
O16 - DPF: {C75BE5CC-7F80-458C-8B66-FAB86E3B13C3} (FotkiUploader Control) - http://images.fotki.com/activex/FotkiUploader.cab
O22 - SharedTaskScheduler: Browseui preloader - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - C:\WINDOWS\system32\browseui.dll
O22 - SharedTaskScheduler: Component Categories cache daemon - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\WINDOWS\system32\browseui.dll
O23 - Service: NOD32 Kernel Service (NOD32krn) - Eset - C:\Program Files\Eset\nod32krn.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: ServiceLayer - Nokia. - C:\Program Files\PC Connectivity Solution\ServiceLayer.exe

--
End of file - 10457 bytes

[plunderer]

R3 - URLSearchHook: Tencent SearchHook - {DB8B2393-7A6C-4C76-88CE-6B1F6FF6FFE9} - C:\Program Files\TENCENT\SSPlus\SAddr.dll

F3 - REG:win.ini: run=C:\PROGRA~1\COMMON~1\ATion\onligaui.exe

O1 - Hosts: 222.76.219.22 bbs.he007.net

O1 - Hosts: 222.76.219.22 www.he007.net

O1 - Hosts: 222.76.219.22 www.he007.com

O1 - Hosts: 222.76.219.22 www.yoyo-do.com

O1 - Hosts: 222.76.219.22 www.33wg.com

O1 - Hosts: 222.76.219.22 www.he521.com

O1 - Hosts: 222.76.219.22 www.he007.cn

O1 - Hosts: 222.76.219.22 bbs.he007.cn

O1 - Hosts: 222.76.219.22 www.zsbot.com

O1 - Hosts: 222.76.219.22 98.to

O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)

O2 - BHO: ThunderBHO - {889D2FEB-5411-4565-8998-1DD2C5261283} - D:\FD\迅雷\ComDlls\XunLeiBHO_002.dll (file missing)

O9 - Extra button: 啟動迅雷 - {0062C9BD-B349-40DE-91A0-755F37ACD559} - D:\FD\迅雷\Thunder.exe (file missing)

O9 - Extra 'Tools' menuitem: 啟動迅雷 - {0062C9BD-B349-40DE-91A0-755F37ACD559} - D:\FD\迅雷\Thunder.exe (file missing)

O9 - Extra button: NeoTrace It! - {9885224C-1217-4c5f-83C2-00002E6CEF2B} - E:\PROGRA~1\NEOTRA~1\NTXtoolbar.htm (file missing) (HKCU)

O16 - DPF: {30528230-99F7-4BB4-88D8-FA1D4F56A2AB} (YInstStarter Class) - http://us.dl1.yimg.com/download.yaho...st20040510.cab

勾選並修復上述項目, 重新開機後刪除下列檔案:
C:\Program Files\Common Files\ATion\onligaui.exe
我懷疑這個 ATion 是廣告來源, 若你不清楚那是什麼軟體, 最好卸載或刪除 ATion 整個目錄

[lonly888]

大大 可否教教我 按哪個鍵可以修復及刪除呢??那個軟體是英文版本 我不會看耶.. 謝謝了

[plunderer]

如圖, 在我上一篇回復所列出要修復項目左邊的小框格中打勾, 然後按下面的 "Fix Checked", 然後就會問你是否確定要修復, 按 "是", 就會自動修復了

[lonly888]

大大...謝謝指點了 剛剛修復了一下...會跳出一些框框來..
不知道是警告訊息還是完成訊息..我沒理會到..呵呵!!
我現在先重新開機 跟著大大的步驟來進行 看可否完成其他 病毒的移除..
先這樣子了 轉個頭 我在回覆下吧..^ ^

也謝謝大大了 ...

[lonly888]

謝謝大大了 東西移除了 ...^ ^

試用大陸的360安全衛士,不過好像只有間體...但效果不錯!