Help from spyware infection

＊誠意出售域名TVBFUN.COM 罕有優質易記電郵直接聯絡快者得 - admin＊

禁止訪問

帖子: 232
精華: 0
威望: 0
魅力: 0
讚好: 0

1^#

打印

字體大小: tT

發表於 2006-1-13 12:56 AM | 只看該作者

Help from spyware infection

after infection
always have pop ups
desktop background cannot be changed

i tried
yahoo taskbar
microsoft antispyware
norton
use them scan and remove

but still have prob

also computer is really slow....
please hlpe me

收藏分享讚好

回復引用

訂閱 TOP

hello1997

註冊會員

Rank: 2 Rank: 2

帖子: 591
精華: 0
威望: 53
魅力: 50
讚好: 0

2^#

發表於 2006-1-13 06:54 AM | 只看該作者

did u try microsoft spyware removal tools?
http://www.download.com/Microsof ... 86.html?tag=lst-0-1

or

Adaware
http://www.download.com/Ad-Aware ... 02.html?tag=lst-0-1

They should work!!! Good luck!!!

回復引用

註冊會員

Rank: 2 Rank: 2

帖子: 3961
精華: 8
威望: 113
魅力: 0
讚好: 0
性別: 男

3^#

發表於 2006-1-13 11:25 AM | 只看該作者

有冇試過 Hijackthis，呢度有POST過

desktop background cannot be changed
——呢個可以入註冊表搞，記得都有POST過。

http://filehost.to/files/2005-11-30_02/102358_faeuste_ballen.gif
http://filehost.to/files/2005-11-30_02/102807_vtffani.gif
http://www3.filehost.to/files/2006-02-22_01/055823_00000001.gif

回復引用

lywv6

新手上路

Rank: 1

帖子: 31
精華: 0
威望: 0
魅力: 0
讚好: 0

4^#

發表於 2006-1-14 03:33 PM | 只看該作者

Originally posted by hello1997 at 2006-1-13 06:54 AM:
did u try microsoft spyware removal...

used both
they detected some spywawre and removed
but still have pop-ups

回復引用

註冊會員

Rank: 2 Rank: 2

帖子: 3961
精華: 8
威望: 113
魅力: 0
讚好: 0
性別: 男

5^#

發表於 2006-1-14 04:46 PM | 只看該作者

呢啲軟件清唔曬，入註冊表手工清除之。

入之前可用HIJACKTHIS掃一次，作一個分析，揾出位置。

[ Last edited by gergermen on 2006-1-14 at 04:47 PM ]

http://filehost.to/files/2005-11-30_02/102358_faeuste_ballen.gif
http://filehost.to/files/2005-11-30_02/102807_vtffani.gif
http://www3.filehost.to/files/2006-02-22_01/055823_00000001.gif

回復引用

禁止訪問

帖子: 232
精華: 0
威望: 0
魅力: 0
讚好: 0

6^#

發表於 2006-1-14 08:23 PM | 只看該作者

i downloaded hijackthis
scanned.... but dunno how to find which one is problematic and clear

回復引用

註冊會員

Rank: 2 Rank: 2

帖子: 3961
精華: 8
威望: 113
魅力: 0
讚好: 0
性別: 男

7^#

發表於 2006-1-14 10:46 PM | 只看該作者

post 個掃描結果上嚟（爲免太長，用TXT格式上傳上嚟）。

http://filehost.to/files/2005-11-30_02/102358_faeuste_ballen.gif
http://filehost.to/files/2005-11-30_02/102807_vtffani.gif
http://www3.filehost.to/files/2006-02-22_01/055823_00000001.gif

回復引用

禁止訪問

帖子: 232
精華: 0
威望: 0
魅力: 0
讚好: 0

8^#

發表於 2006-1-15 08:49 AM | 只看該作者

attached
pls rename it to .log instead of .rar to view

thanks

hijackthis.rar (7.7 KB)

回復引用

註冊會員

Rank: 2 Rank: 2

帖子: 3961
精華: 8
威望: 113
魅力: 0
讚好: 0
性別: 男

9^#

發表於 2006-1-15 10:51 AM | 只看該作者

O4 - HKLM\..\Run: [TFNF5] TFNF5. exe
O4 - HKLM\..\Run: [SxgTkBar] SxgTkBar. exe
O4 - HKLM\..\Run: [000StTHK] 000StTHK. exe
O4 - HKLM\..\Run: [Tpwrtray] TPWRTRAY. EXE
O4 - HKLM\..\Run: [TFncKy] TFncKy. exe /Type 01
O4 - HKCU\..\Run: [Shell] "C:\Program Files\Common Files\Microsoft Shared\Web Folders\ibm00001. exe"
——呢幾個本人覺得有啲疑問，先將呢幾項導出後再DEL，睇下有問題，若有，再導入返。

desktop background cannot be changed
—— 入註冊表，start——run,type regedit
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer]
"NoActiveDesktop" , "NoActiveDesktopChanges"

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\ActiveDesktop]
"NoChangingWallPaper"=dword:00000000
"NoHTMLWallPaper"=dword:00000000
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"DisableRegistryTools"=dword:00000000
"NoDispBackgroundPage"=dword:00000000
——值係唔係 1，若係改為 0

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main]
"Default_Search_URL", "Search Page"
——睇下係唔係你自己SET嘅LINK，若唔係，就改返佢。

http://filehost.to/files/2005-11-30_02/102358_faeuste_ballen.gif
http://filehost.to/files/2005-11-30_02/102807_vtffani.gif
http://www3.filehost.to/files/2006-02-22_01/055823_00000001.gif

回復引用

禁止訪問

帖子: 232
精華: 0
威望: 0
魅力: 0
讚好: 0

10^#

發表於 2006-1-15 11:05 AM | 只看該作者

thanks but i have some problem

導出後再DEL，睇下有問題，若有，再導入返
how to do this?
i scanned, and cliked those item and click fix checked, it said i will permanantly remove those item..so i clicked no....

—— 入註冊表，start——run,type regedit
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer]
"NoActiveDesktop" , --- i can find this, value is 0
"NoActiveDesktopChanges" ---- cannot find this

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"DisableRegistryTools"=dword:00000000 - cannot find
"NoDispBackgroundPage"=dword:00000000 -cannot find

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main]
"Default_Search_URL", "Search Page"
-- it seems the link are from micorsoft since they start with www.microsoft.com
but i didn't set them

回復引用