IE首頁被綁,用了好幾個軟體都除不了

[spycat77]

作者: tomas

安裝微軟這一套可以解決，並且在未來給予防護
http://download.microsoft.com/downlo...areInstall.exe
依照預設值一步一步安裝，安裝並SCAN完後，記得把清出來的東西按Remove後重新開機
開完機後，不要再開IE，請直接入控制台@網際網路選項\改回首頁、刪...

報告tomas大大,微軟這一套失敗,掃了二次,首頁還是被綁.

[spycat77]

以上各位大大的方法我都試過了,不過首頁依然被綁...只剩hijack this 我不敢刪.
我用hijack this把日志記錄下來,如果各位大大有興趣,再拜託指點一下該刪哪個.
其中公司名稱我用AAAAA來替代.
謝謝各位.
=======================
HijackThis@Qoo的掃描日志 V1.97.7
Scan saved at 下午 02:24:45, on 2005/6/1
Platform: Windows 2000 SP4 (WinNT 5.00.2195)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINNT\System32\smss.exe
C:\WINNT\system32\winlogon.exe
C:\WINNT\system32\services.exe
C:\WINNT\system32\lsass.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\system32\spoolsv.exe
C:\WINNT\System32\svchost.exe
C:\WINNT\system32\hidserv.exe
C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
C:\OfficeScan NT\ntrtscan.exe
C:\OfficeScan NT\OfcPfwSvc.exe
C:\WINNT\system32\regsvc.exe
C:\WINNT\system32\MSTask.exe
C:\WINNT\System32\snmp.exe
C:\OfficeScan NT\tmlisten.exe
C:\WINNT\System32\WBEM\WinMgmt.exe
C:\WINNT\System32\mspmspsv.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\Explorer.EXE
C:\WINNT\TEMP\GJ491B.EXE
C:\OfficeScan NT\pccntmon.exe
C:\Program Files\Microsoft AntiSpyware\gcasServ.exe
C:\WINNT\system32\rundll32.exe
C:\WINNT\system32\ctfmon.exe
C:\OfficeScan NT\Pop3Trap.exe
C:\Program Files\Microsoft AntiSpyware\gcasDtServ.exe
C:\Program Files\WinRAR\WinRAR.exe
C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\Rar$EX00.359\HijackThis.exe

O2 - BHO: (no name) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: (no name) - {9569B1C8-35C7-4AF6-BA51-90A78BC3A30E} - C:\WINNT\system32\kcip.dll
O3 - Toolbar: ????? - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINNT\System32\msdxm.ocx
(以下見下一篇)

[spycat77]

(續前一篇)
O4 - HKLM\..\Run: [OfficeScan WinNT 監控程式] "C:\OfficeScan NT\pccntmon.exe" -HideWindow
O4 - HKLM\..\Run: [gcasServ] "C:\Program Files\Microsoft AntiSpyware\gcasServ.exe"
O4 - HKLM\..\Run: [sp] rundll32 C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\se.dll,DllInstall
O4 - HKLM\..\Run: [Synchronization Manager] mobsync.exe /logon
O4 - HKCU\..\Run: [ctfmon.exe] ctfmon.exe
O4 - Startup: .plugin141.trace
O4 - Startup: NTUSER.DAT
O4 - Startup: ntuser.dat.LOG
O4 - Startup: ntuser.ini
O4 - Startup: PCC.log
O4 - Startup: ~
O4 - Global Startup: ntuser.pol
O8 - Extra context menu item: 匯出至 Microsoft Excel(&X) - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O16 - DPF: {00134F72-5284-44F7-95A8-52A619F70751} (ObjWinNTCheck Class) - http://ca.AAAAA.com.tw/officescan/Cl...l/WinNTChk.cab
O16 - DPF: {030518B8-76E5-4FCD-888C-19D376E3AD18} (tmb_web_activex.frminq) - https://ias.AAAAA.com.tw:8082/txhist...eb_activex.CAB
O16 - DPF: {08D75BB0-D2B5-11D1-88FC-0080C859833B} (OfficeScan Corp Edition Web-Deployment SetupIniCtrl Class) - http://ca.AAAAA.com.tw/officescan/cl...l/setupini.cab
O16 - DPF: {08D75BC1-D2B5-11D1-88FC-0080C859833B} (OfficeScan Corp Edition Web-Deployment SetupCtrl Class) - http://ca.AAAAA.com.tw/officescan/cl...tall/setup.cab
O16 - DPF: {1E4C83BC-D65C-4C6F-9B5A-E2B34CE8630D} (PwcInstall.PwcPage1) - http://140.118.43.38/emb2/PwcInstall.CAB
O16 - DPF: {5EFE8CB1-D095-11D1-88FC-0080C859833B} (OfficeScan Corp Edition Web-Deployment ObjRemoveCtrl Class) - http://ca.AAAAA.com.tw/officescan/cl...RemoveCtrl.cab
O16 - DPF: {62789780-B744-11D0-986B-00609731A21D} (Autodesk MapGuide ActiveX Control) - http://www.gismap.com.tw/auto_download/mgaxctrl.cab
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} (Java Runtime Environment 1.4.2) - http://172.16.8.11/tcb/j2re-1_4_2_03-windows-i586-p.exe
O16 - DPF: {9F1C11AA-197B-4942-BA54-47A8489BB47F} (Update Class) - http://v4.windowsupdate.microsoft.co...486.6994791667
O16 - DPF: {C7BD467B-0B38-442F-840F-3F048E7F6005} (RootKeyDistributor Class) - http://grca.nat.gov.tw/pse/CHTPKI_PSE.cab
O16 - DPF: {CE684CA4-935B-11D3-A163-00004C815B0E} (ftpocx.webftp) - http://www.AAAAA.com.tw/ftpocx.CAB
O16 - DPF: {D19781C5-2051-44F8-8445-DDC82933C191} (VacPro.internazionale_ver11) - http://advnt01.com/dialer/internazionale_ver11.CAB
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload.macromedia.com/pub...sh/swflash.cab
O16 - DPF: {DF780F87-FF2B-4DF8-92D0-73DB16A1543A} (PopCapLoader Object) - http://www.shockwave.com/content/zum...ploader_v5.cab
O16 - DPF: {F210AAE2-E2F3-4EE9-8317-9934A492BBF0} (tmb_web_activex.frminq) - https://ias.AAAAA.com.tw:8080/tmb_web_activex.CAB
O16 - DPF: {F6EF5E31-2AE5-4511-B99A-2CF2D266F106} (tmb_web_activex.frminq) - https://ias.AAAAA.com.tw:8080/tmb_web_activex.CAB
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: Domain = AAAAA.com.tw
O17 - HKLM\System\CCS\Services\Tcpip\..\{8CA52B0B-CD43-4647-9C8D-9BEF353DDA7E}: NameServer = 172.16.70.2,172.16.70.1,172.16.70.12
O17 - HKLM\System\CS1\Services\Tcpip\Parameters: Domain = AAAAA.com.tw
O17 - HKLM\System\CS2\Services\Tcpip\Parameters: Domain = AAAAA.com.tw