引用:
作者: overyuki
還有的~~拜託了
|
你的問題嚴重多了....
綁架, 木馬, 廣告齊飛......
F2 - REG:system.ini: UserInit=C:\WINDOWS\system32\userinit.exe,C:\WINDOWS\Installer\services.exe,
O2 - BHO: NaviHelperObj Class - {3E422F49-1566-40D3-B43D-077EF739AC32} - C:\WINDOWS\system32\NaviHelper.dll (file missing)
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll (file missing)
O2 - BHO: BHOHelper Class - {67A90DD6-128D-43AB-B97C-565D2DD42A28} - C:\Program Files\safe360\atloader.dll (file missing)
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: (no name) - {A5366673-E8CA-11D3-9CD9-0090271D075B} - (no file)
O4 - HKLM\..\Run: [CdnCtr] C:\Program Files\CNNIC\Cdn\cdnup.exe
O4 - HKLM\..\Run: [mppds] C:\WINDOWS\mppds.exe
O4 - HKLM\..\Run: [kernelmh] C:\WINDOWS\Kernelmh.exe
O4 - HKLM\..\Run: [mnsa] C:\DOCUME~1\RAY~1.COL\LOCALS~1\Temp\mnso.exe
O4 - HKLM\..\Run: [wosa] C:\DOCUME~1\tat\LOCALS~1\Temp\woso.exe
O4 - HKLM\..\Run: [mhsa] C:\DOCUME~1\RAY~1.COL\LOCALS~1\Temp\mhso.exe
O4 - HKCU\..\Run: [fx93027u6g4m8] C:\WINDOWS\iexpl0re.exe
O4 - HKCU\..\Run: [2ulhg401] C:\WINDOWS\Servera.exe
O4 - HKCU\..\Run: [df1ms8] C:\WINDOWS\iexp1ora.exe
O4 - HKCU\..\Run: [0r2bx2sg9fh] C:\WINDOWS\winlog0a.exe
O4 - HKCU\..\Run: [exxzr2ev3qu0t4] C:\WINDOWS\iexpl0ra.exe
O4 - HKCU\..\Run: [zr3b] C:\WINDOWS\rundl13a.exe
O4 - HKLM\..\Policies\Explorer\Run: [IceSword] C:\WINDOWS\system32\ipocnfig.exe
O9 - Extra button: (no name) - {0062C9BD-B349-40DE-91A0-755F37ACD559} - (no file)
O9 - Extra button: Holdfast Battle Net - {0A155D3C-68E2-4215-A47A-E800A446447A} - C:\Program Files\CGA Gameing Platform\GameClient.exe (file missing)
O9 - Extra button: QQ - {c95fe080-8f5d-11d2-a20b-00aa003c157b} - C:\Program Files\Tencent\QQ\QQ.EXE (file missing)
O9 - Extra 'Tools' menuitem: 騰訊QQ - {c95fe080-8f5d-11d2-a20b-00aa003c157b} - C:\Program Files\Tencent\QQ\QQ.EXE (file missing)
O16 - DPF: i.Game CChessImpress4003 -
http://202.43.223.156/client/CChessd...essImpress.cab
O16 - DPF: i.Game MJImpressYHK -
http://202.43.223.148/client/MJc/com...ImpressYHK.cab
O16 - DPF: {05BCE06B-A300-4C4E-A42F-4C04BCCDE63B} (TRLuncherROC Control) -
http://weblogin.talesrunner.com.hk/TRLuncherROC.cab
O16 - DPF: {30528230-99F7-4BB4-88D8-FA1D4F56A2AB} (YInstStarter Class) -
http://us.dl1.yimg.com/download.yaho...st20040510.cab
勾選並修復上述項目, 重新開機, 按 F8 以安全模式登入 windows, 刪除下列檔案:
C:\WINDOWS\Installer\services.exe
C:\Program Files\CNNIC\Cdn\cdnup.exe(最好卸載或刪除整個 CNNIC目錄)
C:\WINDOWS\mppds.exe
C:\WINDOWS\Kernelmh.exe
C:\WINDOWS\iexpl0re.exe
C:\WINDOWS\Servera.exe
C:\WINDOWS\iexp1ora.exe
C:\WINDOWS\iexpl0ra.exe
C:\WINDOWS\rundl13a.exe
並清空 C:\Documents and Settings\用戶名\Local Settings\Temp 內所有暫存檔
盡量少執行莫名奇妙的軟體
上不明網站若有提示需安裝 ActiveX 控制元件, 不要隨便"允許" 啊
還有, 已裝了 KAV, 那個safe360就不需要了, 卸載吧