gergermen

Originally posted by 147ak477 at 2006-1-15 23:40:
(1)
by TEMP, you mean c:\ TEMP
or C:\Documents and Settings\Administrator\Local Settings\Temp?

scan log please change to .log

[ Last edited by 147ak477 on 2006-1-15 at 11:42 PM ]

all~~~記住連隱含嗰啲一並DEL

where is log?

147ak477

sorry forgot to attach

147ak477

all contents in c:\ TEMP deleted
and
C:\Documents and Settings\Administrator\Local Settings\Temp
some files cannot be deleted , other including hidded files are deleted
see attached

gergermen

睇過曬，問題係呢兩個，用HIJACKTHIS修復後，最後手工入去呢兩個位置（記住個路徑同啲數字），再CHECK一次，DEL lv0u09d9e.dll（唔係刪咗後入Recycled嗰種，係不可恢復)，順手改返HOST
O17 - HKLM\System\CCS\Services\Tcpip\..\{9B69C40C-4719-4BCA-85F7-49A8AFC67880}: NameServer = 205.252.144.28 218.102.23.77
O20 - Winlogon Notify: MCD - C:\WINDOWS\system32\lv0u09d9e.dll

用殺毒軟件（更新咗個病毒庫先）再全機完整掃一次（用NORTON可能未必查，可以試下其他），懷疑造成呢個問題嘅代碼嵌入咗啲程序度。

ckyckk

Originally posted by gergermen at 2006-1-16 12:32 AM:
睇過曬，問題係呢兩個，用HIJACKTHIS...

非常厲害的電腦博士-隱貓,小弟完全唔明,喵~~喵~~~

147ak477

O17 --deleted and doesn't  appear anymore

but
O20 - Winlogon Notify: MCD - C:\WINDOWS\system32\lv0u09d9e.dll
after use hijackthis to fix , still appear, when i manually click delete it
it said other program/user using it , cannot delete

i use norton to scan sometime before and there 's also a .dll ( scanned as a threat) that cannot be deleted.

gergermen

咁你入SAFE MODE度再睇搞一次
HIJACKTHIS掃一次，手工CHECK一次
NORTON掃一次
開始——執行，REGSVR32 /U lv0u09d9e.dll ，再一次相同命令REGSVR32 /U <norton 掃到有問題又DEL唔到個DLL>
再手工刪一次。

[ Last edited by gergermen on 2006-1-16 at 10:29 AM ]

kingwong

用HIJACKTHIS修復以下items：

O4 - HKLM\..\Run: [MS Messenger] C:\WINDOWS\msm. exe

Delete the following files：
ssocks5.dll
%systemdir%\SSocks32.dll
Regsock32. exe
MSM. EXE

[ Last edited by kingwong on 2006-1-16 at 06:06 PM ]

147ak477

Originally posted by kingwong at 2006-1-16 06:03 PM:
用HIJACKTHIS修復以下items：

O4 -...

where can i find these:
ssocks5.dll
%systemdir%\SSocks32.dll
Regsock32. exe
MSM. EXE

147ak477

Originally posted by gergermen at 2006-1-16 10:09 AM:
咁你入SAFE MODE度再睇搞一次
HIJACK...

how to enter safe mode?