[求助] 电脑中Trojan.StartPage !!

pHi[L]iP · 发表于 20-1-2005 10:22 PM

有什么方法救？？？
帮帮忙~~

austinlim · 发表于 20-1-2005 10:24 PM

请下载HijackThis 英文版
http://www.merijn.org/files/hijackthis.zip 然后解压到一个新的文件夹然后scan了把log传上来
或者下载HijackThis 1.99.0 汉化版
http://www.newhua.com/soft/37094.htm 然后解压到一个新的文件夹然后扫描了把日志传上来

pHi[L]iP · 发表于 20-1-2005 10:37 PM

我下载了~
不过不知道如何用？？
scan了...

austinlim · 发表于 20-1-2005 10:41 PM

save保存了文件名字应该是 hijackthis.log 什么的用notepad打开然后copy全部的内容粘贴在发表帖子里发表上来

Edwen · 发表于 21-1-2005 01:55 AM

用Trojan Guarder Gold Version 比较容易

pHi[L]iP · 发表于 21-1-2005 01:28 PM

Logfile of HijackThis v1.99.0
Scan saved at 13:31:19, on 21/01/2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\Microsoft AntiSpyware\gcasServ.exe
C:\Program Files\Trend Micro\Internet Security\pccguide.exe
C:\Program Files\Trend Micro\Internet Security\PCClient.exe
C:\Program Files\Trend Micro\Internet Security\TMOAgent.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
C:\Program Files\MSN Messenger\MsnMsgr.Exe
C:\Program Files\Kingsoft\XDict\XDICT.EXE
C:\Program Files\Microsoft AntiSpyware\gcasDtServ.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
C:\Program Files\Trend Micro\Internet Security\Tmntsrv.exe
C:\Program Files\Trend Micro\Internet Security\tmproxy.exe
C:\Program Files\Trend Micro\Internet Security\PccPfw.exe
C:\Program Files\NJStar Communicator\NJCOM32.EXE
C:\Program Files\NJStar Communicator\NJSIME.EXE
C:\Program Files\Windows Media Player\wmplayer.exe
C:\Program Files\Internet Explorer\iexplore.exe
D:\philip\pc\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://red.clientapps.yahoo.com/customize/ycomp/defaults/sb/*http://www.yahoo.com/search/ie.html
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://chinese.cari.com.my/myforum/index.php?sid=UzEKAh
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://red.clientapps.yahoo.com/customize/ycomp/defaults/su/*http://www.yahoo.com
O2 - BHO: Yahoo! Companion BHO - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\ycomp5_5_7_0.dll
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: NTIECatcher Class - {C56CB6B0-0D96-11D6-8C65-B2868B609932} - C:\Program Files\Xi\NetTransport 2\NTIEHelper.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\ycomp5_5_7_0.dll
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [gcasServ] "C:\Program Files\Microsoft AntiSpyware\gcasServ.exe"
O4 - HKLM\..\Run: [pccguide.exe] "C:\Program Files\Trend Micro\Internet Security\pccguide.exe"
O4 - HKLM\..\Run: [PCClient.exe] "C:\Program Files\Trend Micro\Internet Security\PCClient.exe"
O4 - HKLM\..\Run: [TM Outbreak Agent] "C:\Program Files\Trend Micro\Internet Security\TMOAgent.exe" /run
O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
O4 - HKLM\..\Run: [MSPY2002] C:\WINDOWS\system32\IME\PINTLGNT\ImScInst.exe /SYNC
O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC
O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [AVG7_EMC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [Skype] "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized
O4 - Global Startup: PowerWord 2002.lnk = C:\Program Files\Kingsoft\XDict\XDICT.EXE
O8 - Extra context menu item: Download all by Net Transport - C:\Program Files\Xi\NetTransport 2\NTAddList.html
O8 - Extra context menu item: Download by Net Transport - C:\Program Files\Xi\NetTransport 2\NTAddLink.html
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~3\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: Joyo - {8DE0FCD4-5EB5-11D3-AD25-00002100131B} - C:\PROGRA~1\Kingsoft\XDict\IEPlugin.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\OFFICE11\REFIEBAR.DLL
O9 - Extra button: PowerWord - {C8CE29C5-7589-11D3-B81B-0080C8DC5DC8} - C:\PROGRA~1\Kingsoft\XDict\IEPlugin.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O17 - HKLM\System\CCS\Services\Tcpip\..\{F3E8C9B3-011D-4C56-9563-ACCC7D52AF2C}: NameServer = 202.188.1.133,202.188.1.5
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: AVG7 Alert Manager Server - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
O23 - Service: AVG7 Update Service - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
O23 - Service: Trend Micro Personal Firewall - Trend Micro Incorporated. - C:\Program Files\Trend Micro\Internet Security\PccPfw.exe
O23 - Service: Trend NT Realtime Service - Trend Micro Incorporated. - C:\Program Files\Trend Micro\Internet Security\Tmntsrv.exe
O23 - Service: Trend Micro Proxy Service - Trend Micro Incorporated. - C:\Program Files\Trend Micro\Internet Security\tmproxy.exe

austinlim · 发表于 21-1-2005 02:49 PM

请问你的杀毒软件杀不了吗
Trojan.StartPage 在哪个文件夹那个文件感染了

pHi[L]iP · 发表于 21-1-2005 03:06 PM

austinlim 于 21-1-2005 02:49 PM 说 :
请问你的杀毒软件杀不了吗
Trojan.StartPage 在哪个文件夹那个文件感染了

现在应该没有了~
昨天我用最笨的方法...

我format电脑....(本来就想format了)
就顺便....

现在我想知道要怎样杀那个木马...

pHi[L]iP · 发表于 21-1-2005 03:11 PM

pHi[L]iP 于 21-1-2005 01:28 PM 说 :
Logfile of HijackThis v1.99.0
Scan saved at 13:31:19, on 21/01/2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOW ...

是不是我scan了这些~
然后把有毒的打勾。。
然后fix他就可以了？？
要怎样知道那个是病毒？？？

austinlim · 发表于 21-1-2005 03:23 PM

是的一般上打勾去毒就可以的了。
上网搜索那些可疑的文件名称，有不少资料的。
但是网上的资料有真有假有误有错要多找些对证

austinlim · 发表于 21-1-2005 03:26 PM

如果找不到资料，只好像神农氏那样自己亲知去尝可疑的毒啦哈哈

pHi[L]iP · 发表于 21-1-2005 03:28 PM

austinlim 于 21-1-2005 03:26 PM 说 :
如果找不到资料，只好像神农氏那样自己亲知去尝可疑的毒啦哈哈

昨天我在format前把他都打勾了..
过后在list里面的东西都开不到....
哈哈~~

对了..
还要谢谢你帮了我不少忙

pHi[L]iP · 发表于 21-1-2005 03:29 PM

Edwen 于 21-1-2005 01:55 AM 说 :
用Trojan Guarder Gold Version 比较容易

这个要去那里下载？？
也是抓毒的吗？？？

austinlim · 发表于 21-1-2005 03:39 PM

scan 了出来所有的资料只是资料而已，大多数都是正常的不是有问题的，只有某些可能是有问题的而已。
你删了全部，电脑会晕的：D

这个需要注册的
你发短消息问问Edwen吧

Edwen · 发表于 21-1-2005 04:35 PM

pHi[L]iP 于 21-1-2005 03:29 PM 说 :
这个要去那里下载？？
也是抓毒的吗？？？

这个不只是抓毒，他也是防毒，防木马，它再window后面操作的，很像Antivirus software.
最新的6.59 我没用,我用6.50

http://www.your-soft.com/

[ Last edited by Edwen on 14-2-2005 at 11:45 AM ]

pHi[L]iP · 发表于 21-1-2005 07:03 PM

Edwen 于 21-1-2005 04:35 PM 说 :

这个不只是抓毒，他也是防毒，防木马，它再window后面操作的，很像Antivirus software.
Click For more detail
最新的6.54 我没用,我用6.50

ok~
知道了~
谢谢你~

院长 · 发表于 14-2-2005 10:32 AM

Edwen 于 21-1-2005 01:55 说 :
用Trojan Guarder Gold Version 比较容易

那请问那里可以download啊
请问有网址吗

显示全部楼层 · 发表于 14-2-2005 10:25 PM

院长于 14-2-2005 10:32 说 :

那请问那里可以download啊
请问有网址吗

http://www.download.com/Trojan-G ... 00.html?tag=lst-0-1

[ Last edited by 逍遙子_vincent on 14-2-2005 at 10:28 PM ]

pHi[L]iP · 发表于 17-2-2005 02:21 PM

Logfile of HijackThis v1.99.0
Scan saved at 14:25:38, on 17/02/2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\Microsoft AntiSpyware\gcasServ.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
C:\Program Files\Microsoft AntiSpyware\gcasDtServ.exe
C:\Program Files\MSN Messenger\MsnMsgr.Exe
C:\Program Files\Kingsoft\XDict\XDICT.EXE
C:\Program Files\NJStar Communicator\NJCOM32.EXE
C:\Program Files\NJStar Communicator\NJSIME.EXE
C:\Program Files\Winamp\winamp.exe
C:\Program Files\Maxthon\Maxthon.exe
D:\philip\pc\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://red.clientapps.yahoo.com/customize/ycomp/defaults/sb/*http://www.yahoo.com/search/ie.html
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://chinese.cari.com.my/myforum/index.php?sid=UzEKAh
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://red.clientapps.yahoo.com/customize/ycomp/defaults/sb/*http://www.yahoo.com/search/ie.html
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://chinese.cari.com.my/myforum/index.php?sid=UzEKAh
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://red.clientapps.yahoo.com/customize/ycomp/defaults/su/*http://www.yahoo.com
R1 - HKLM\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://red.clientapps.yahoo.com/customize/ycomp/defaults/su/*http://www.yahoo.com
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: NTIECatcher Class - {C56CB6B0-0D96-11D6-8C65-B2868B609932} - C:\Program Files\Xi\NetTransport 2\NTIEHelper.dll
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [gcasServ] "C:\Program Files\Microsoft AntiSpyware\gcasServ.exe"
O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
O4 - HKLM\..\Run: [MSPY2002] C:\WINDOWS\system32\IME\PINTLGNT\ImScInst.exe /SYNC
O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC
O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [AVG7_EMC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: PowerWord 2002.lnk = C:\Program Files\Kingsoft\XDict\XDICT.EXE
O8 - Extra context menu item: Download all by Net Transport - C:\Program Files\Xi\NetTransport 2\NTAddList.html
O8 - Extra context menu item: Download by Net Transport - C:\Program Files\Xi\NetTransport 2\NTAddLink.html
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~3\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: Joyo - {8DE0FCD4-5EB5-11D3-AD25-00002100131B} - C:\PROGRA~1\Kingsoft\XDict\IEPlugin.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\OFFICE11\REFIEBAR.DLL
O9 - Extra button: PowerWord - {C8CE29C5-7589-11D3-B81B-0080C8DC5DC8} - C:\PROGRA~1\Kingsoft\XDict\IEPlugin.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O17 - HKLM\System\CCS\Services\Tcpip\..\{6489F913-C009-4623-B4B3-7D815B36A2AF}: NameServer = 202.188.1.5 202.188.0.133
O17 - HKLM\System\CCS\Services\Tcpip\..\{F3E8C9B3-011D-4C56-9563-ACCC7D52AF2C}: NameServer = 202.188.1.133,202.188.1.5
O17 - HKLM\System\CS1\Services\Tcpip\..\{6489F913-C009-4623-B4B3-7D815B36A2AF}: NameServer = 202.188.1.5 202.188.0.133
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: AVG7 Alert Manager Server - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
O23 - Service: AVG7 Update Service - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe

帮我看看~~
有没有中？
感觉我电脑又生病了..

冰冻之使者 · 发表于 17-2-2005 10:10 PM

我前天也中了，刚刚消除罢了。
首先Disable system restore，让电脑进入安全模式，然后用所有杀毒软件杀毒。（我用的是Spyware doctor 3.1, registry 4.0及Spybot search &destroy...都是在download.com下载的）然后上registry更改：
病毒修改的注册表：
（1）在注册表中添加下列启动项：
  [HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run]
  "olehelp" = c:\\program files\\common files\\svchost.exe
  这样，在Windows启动时，病毒就可以自动执行。（把它删除）
（2）病毒通过修改下列注册表键值，改变IE默认主页等信息：
[HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Internet Explorer\\Search]
  "SearchAssistant" = http://search-all.net/sp.html
（正常应该是： "SearchAssistant" =http://ie.search.msn.com/{SUB_RFC1766}/srchasst/srchasst.htm）
[HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Internet Explorer\\Main]
  "Start Page" = http://all-find.net/       （正常应该是：你自己选定的开始首页）
[HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Internet Explorer\\Main]
  "Search Page" = http://all-find.net/ （正常应该是：http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch）
[HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Internet Explorer\\Main]
  "Use Search Asst" = no          （正常应该是：没有该项，可以删除）
[HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Internet Explorer\\Main]
  "Search Bar" = http://search-all.net/sp.html       （正常应该是：没有该项，可以删除）
[HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Internet Explorer\\SearchUrl]
  "provider" = gogl                （正常应该是：""）
[HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Internet Explorer\\SearchUrl]
  "" = http://all-find.net/          （正常应该是：没有该项，可以删除）

  HKEY_CURRENT_USER\\Software\\Microsoft\\Internet Explorer\\Main
"HOMEOldSP" = "about:blank" (可以删除)
  HKEY_CURRENT_USER\\Software\\Microsoft\\Internet Explorer\\Main
"Search Bar" = "sp.html" (可以删除)
  HKEY_CURRENT_USER\\Software\\Microsoft\\Internet Explorer\\Main
"Use Search Asst" = "no" (可以删除)
  HKEY_CURRENT_USER\\Software\\Microsoft\\Internet Explorer\\Search
"SearchAssistant" = "sp.html" (可以删除)

过后在重新启动

		自动登录	找回密码
密码			注册

[求助] 电脑中Trojan.StartPage !!

所属分类: 电脑手机