遇到电脑不定期地弹广告窗口的问题

短命女 2024-04-07 13:43 124阅读 0赞

**endurer**　原创

2006-09-22　第**1**版

有位网友的电脑不定期地弹出广告窗口。

到 [http://endurer.ys168.com][http_endurer.ys168.com] 下载 HijackThis 扫描log。  
在 log 中发现如下可疑项目：

/---------  
Logfile of HijackThis v1.99.1  
Scan saved at 9:08:50, on 2006-9-22  
Platform: Windows XP SP2 (WinNT 5.01.2600)  
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:  
C:/Program Files/SystemInspect/SVCHAST.exe  
c:/windows/system32/inetsrv/csrss.exe  
C:/WINDOWS/system32/softbox.exe  
C:/WINDOWS/TEMP/setup.exe  
C:/WINDOWS/system32/windowoutnew.exe  
C:/WINDOWS/svchost.exe  
C:/DOCUME~1/ADMINI~1/LOCALS~1/Temp/windowoutnew.exe

R3 - URLSearchHook: SearchCar - \{6D53ADB7-6AD5-4A59-BFE4-7B57D2F4AA89\} - C:/Program Files/SearchCar/SearchCar.dll (file missing)

F2 - REG:system.ini: UserInit=C:/WINDOWS/system32/Userinit.exe  
O1 - Hosts: 125．91．1．20 localhost  
O1 - Hosts: 125．91．1．20 www．7939．com  
O1 - Hosts: 125．91．1．20 www．hao123．com  
O1 - Hosts: 125．91．1．20 www．9991．com  
O1 - Hosts: 125．91．1．20 www．5566．net  
O1 - Hosts: 125．91．1．20 www．gjj．cc  
O1 - Hosts: 125．91．1．20 www．265．com  
O1 - Hosts: 125．91．1．20 www．v111．com  
O1 - Hosts: 125．91．1．20 www．7322．com

O2 - BHO: MonitorURL Class - \{08A312BB-5409-49FC-9347-54BB7D069AC6\} - C:/PROGRA~1/DESKAD~1/deskipn.dll

O2 - BHO: MyIEHelper Class - \{16B770A0-0E87-4278-B748-2460D64A8386\} - C:/Documents and Settings/All Users/Application Data/Microsoft/IEHelper/IEHelper\_5107.dll

O2 - BHO: (no name) - \{3D898C55-74CC-4B7C-B5F1-45913F368388\} - C:/WINDOWS/system32/SecurityC1.dll

O2 - BHO: Spoolsv Class - \{9C363D55-07D7-433d-A13E-D9C105202F6F\} - C:/WINDOWS/system32/drivers/spoolsv.dll

O2 - BHO: XBTP03129 - \{B07D1F6B-6B8C-4904-8EE8-5E5A2B4624B3\} - C:/PROGRA~1/SEARCH~1/SEARCH~1.DLL (file missing)

O2 - BHO: Macromedia. Flash8 Object - \{C61A70F3-505E-4B90-916F-627A8706B4BC\} - c:/WINDOWS/system32/FlashPlayer8OCX.dll

O2 - BHO: OsbornTech Popup Blocker - \{C68AE9C0-0909-4DDC-B661-C1AFB9F5AE53\} - C:/WINDOWS/system32/ms.dll

O2 - BHO: Webacc - \{CAC068F3-A608-406B-8581-458788A67694\} - C:/WINDOWS/system32/svchost.dll

O2 - BHO: Microsoft Solo Browser Helper Object - \{E3DB85B5-C559-4894-B474-42E89FAA1EFD\} - C:/WINDOWS/system32/winmsd.dll (file missing)

O3 - Toolbar: SearchCar - \{6D53ADB7-6AD5-4A59-BFE4-7B57D2F4AA89\} - C:/Program Files/SearchCar/SearchCar.dll (file missing)

O3 - Toolbar: 系统标准按钮(&E) - \{6B2455FD-3669-4555-8DF8-69FD5BC846F8\} - C:/WINDOWS/system32/SystemToolbar.dll (file missing)

O4 - HKLM/../Run: \[softbox\] C:/WINDOWS/system32/softbox.exe  
O4 - HKLM/../Run: \[System\] C:/WINDOWS/TEMP/setup.exe  
O4 - HKLM/../Run: \[WindowOutNew\] C:/WINDOWS/system32/windowoutnew.exe  
O4 - HKLM/../Run: \[svc\] C:/WINDOWS/svchost.exe

O4 - HKLM/../Run: \[Desktop\] C:/WINDOWS/system32/rundll32.exe "C:/Program Files/DeskAdTop/Run.dll" ,Rundll

O4 - HKCU/../Run: \[svc\] C:/WINDOWS/svchost.exe

O4 - Global Startup: IE-Bar.lnk = C:/Program Files/Common Files/IE-Bar/iebar.exe

O6 - HKCU/Software/Policies/Microsoft/Internet Explorer/Control Panel present

O9 - Extra button: 名品折扣 - \{59BC54A2-56B3-44a0-93E5-432D58746E26\} - [http://adtaobao.allyes.com/main/adfclick?db=adtaobao&bid=138,140,18&cid=816,8,1&sid=5042&show=ignore&url=http://www.taobao.com/vertical/mall/pro.php?allyesPara=816][http_adtaobao.allyes.com_main_adfclick_db_adtaobao_bid_138_140_18_cid_816_8_1_sid_5042_show_ignore_url_http_www.taobao.com_vertical_mall_pro.php_allyesPara_816] (file missing)

O10 - Unknown file in Winsock LSP: c:/windows/system32/msplus.dll  
O10 - Unknown file in Winsock LSP: c:/windows/system32/msplus.dll

O23 - Service: SVCHAST (SystemInspect) - Unknown owner - C:/Program Files/SystemInspect/SVCHAST.exe  
\---------/

卸载：IE-Bar，SearchCar，中文上网，桌面媒体

停止并禁用服务：SVCHAST (SystemInspect)

到 [http://endurer.ys168.com][http_endurer.ys168.com] 下载 并 运行 procview，终止下列进程：  
/---------  
C:/Program Files/SystemInspect/SVCHAST.exe  
c:/windows/system32/inetsrv/csrss.exe  
C:/WINDOWS/system32/softbox.exe  
C:/WINDOWS/TEMP/setup.exe  
C:/WINDOWS/system32/windowoutnew.exe  
C:/WINDOWS/svchost.exe  
C:/DOCUME~1/ADMINI~1/LOCALS~1/Temp/windowoutnew.exe  
\---------／

用WinRAR寻找如下文件：  
/---------  
C:/Program Files/SystemInspect/SVCHAST.exe  
C:/Documents and Settings/user/1018.exe（Kaspersky 报为 **Trojan-Downloader.Win32.Agent.aww**）  
C:/Documents and Settings/user/dmshell.dll（Kaspersky 报为 **not-a-virus:AdWare.Win32.Dm.d**）  
C:/Documents and Settings/user/Skymmstp234.exe（Kaspersky 报为 **not-a-virus:AdWare.Win32.ADMoke.n**）  
C:/WINDOWS/svchost.exe  
C:/WINDOWS/system32/softbox.exe  
C:/WINDOWS/system32/windowoutnew.exe（Kaspersky 报为 **Trojan-Downloader.Win32.VB.akp**）  
C:/WINDOWS/system32/FlashPlayer8OCX.dll  
C:/WINDOWS/system32/ms.dll  
C:/WINDOWS/system32/SecurityC1.dll  
C:/WINDOWS/system32/svchost.dll  
C:/WINDOWS/system32/drivers/spoolsv.dll  
c:/windows/system32/inetsrv/csrss.exe（Kaspersky 报为 **Backdoor.Win32.Delf.auu**）  
C:/WINDOWS/TEMP/setup.exe（Kaspersky 报为 **Trojan-Downloader.Win32.Small.duh**）  
C:/WINDOWS/TEMP/Setup4.exe.rar（Kaspersky 报为 **not-avirus：AdWare.Win32.BHO.ag**）  
C:/WINDOWS/TEMP/setup175.exe  
\---------/  
打包备份后删除。

关闭所有浏览器和文件夹窗口，用HijackThis扫描并修复上面所列项目。

到 [http://endurer.ys168.com][http_endurer.ys168.com] 下载 并 运行 lspfix.exe，选定“I Know What I'm Doing”，然后把左面窗口里的 msplus.dll 文件移到右面窗口里，然后选“Finish”。

清空IE临时文件夹

清空 c:/Documents and Settings/user/Local Settings/temp（其中 user 为用户名）

清空 c:/windows/temp

[http_endurer.ys168.com]: http://endurer.ys168.com
[http_adtaobao.allyes.com_main_adfclick_db_adtaobao_bid_138_140_18_cid_816_8_1_sid_5042_show_ignore_url_http_www.taobao.com_vertical_mall_pro.php_allyesPara_816]: http://adtaobao.allyes.com/main/adfclick?db=adtaobao&bid=138,140,18&cid=816,8,1&sid=5042&show=ignore&url=http://www.taobao.com/vertical/mall/pro.php?allyesPara=816