O2 - BHO: Yahoo! Companion BHO - {02478D38-C3F9-4efb-9B51-7695ECA05670} - (no file)
O2 - BHO: (no name) - {68BE802C-B03B-4DCF-91CE-2841E0C8C2B9} - C:\WINDOWS\system32\rqrom.dll
O2 - BHO: BandIE Class - {77FEF28E-EB96-44FF-B511-3185DEA48697} - C:\PROGRA~1\baidu\bar\baidubar.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: (no name) - {CF46BFB3-2ACC-441b-B82B-36B9562C7FF1} - C:\WINDOWS\system32\cfbstylc.dll
O2 - BHO: (no name) - {D157330A-9EF3-49F8-9A67-4141AC41ADD4} - (no file)
O2 - BHO: (no name) - {F4002052-AB29-4B33-8C8D-0E99084564EC} - C:\WINDOWS\system32\gebabaa.dll
O3 - Toolbar: (no name) - {1B0E7716-898E-48cc-9690-4E338E8DE1D3} - (no file)
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file)
O3 - Toolbar: 啃僅閉撰刲啪 - {B580CF65-E151-49C3-B73F-70B13FCA8E86} - C:\PROGRA~1\baidu\bar\baidubar.dll
O4 - HKLM\..\Run: [SystemOptimizer] rundll32.exe "C:\WINDOWS\system32\qsxwtnfa.dll",forkonce
O9 - Extra button: 3721中文郵 - {5D73EE86-05F1-49ed-B850-E423120EC329} -
http://cmail.3721.com?fb=client (file missing)
O9 - Extra 'Tools' menuitem: 3721中文郵 - {5D73EE86-05F1-49ed-B850-E423120EC329} -
http://cmail.3721.com?fb=client (file missing)
O9 - Extra button: (no name) - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - (no file)
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O20 - Winlogon Notify: gebabaa - C:\WINDOWS\SYSTEM32\gebabaa.dll
O20 - Winlogon Notify: rqrom - C:\WINDOWS\system32\rqrom.dll
O21 - SSODL: prodigy1 - {D3E79DA8-0472-4F60-8C56-962BAC65041E} - newsystem25.dll (file missing)
O21 - SSODL: mjd - {B47B36FB-D01F-47DE-98AF-BB96CD197A8C} - w32_mjd.dll (file missing)
勾選並修復上述項目, 重新開機, 刪除下列檔案:
C:\WINDOWS\system32\rqrom.dll
C:\WINDOWS\system32\cfbstylc.dll
C:\WINDOWS\system32\gebabaa.dll
C:\WINDOWS\system32\qsxwtnfa.dll
C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
卸載百度工具列
P.S
1
O4 - HKLM\..\Run: [IMJPMIG8.1] ; "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
O4 - HKLM\..\Run: [IMEKRMIG6.1] C:\WINDOWS\ime\imkr6_1\IMEKRMIG.EXE
O4 - HKLM\..\Run: [MSPY2002] ; C:\WINDOWS\System32\IME\PINTLGNT\ImScInst.exe /SYNC
這三項分別是日文輸入法, 韓文輸入法, 拼音輸入法, 若用不到就勾選並修復
2
裝個防毒軟體吧
3
可否將樣本上傳並 PM 我下載連結?