[病毒:求助]Winword一打开,会Paste一个怪图片？

enry98

为何每次一打开Winword,然后按Paste，会出现如下一个怪图片？



谢谢.........

[ Last edited by enry98 on 20-4-2004 at 08:46 PM ]

Joseph_sky

enry98 于 20-4-2004 08:45 PM  说 :
为何每次一打开Winword,然后按Paste，会出现如下一个怪图片？



谢谢.........

[ Last edited by enry98 on 20-4-2004 at 08:46 PM ]

你copy 其它东西然后paste也是这样吗?
有没有用antivirus scan一下

enry98

copy 其他东西后就不会.......

不过每次一开winword ，头一次paste，那个图片就会出现........

antivirus scan 了，没发现什么...........

湖俊

这个真的是奇怪的现象
你可以把你的start-up program给我们看一下吗？

在start> run>
键入
msconfig

在start-up那一面的东西。。

Joseph_sky

用这个软件

这个软件是清洗clipboard里面的资料。下载后，按一下就可以。


如果还是一样，就可能中了spyware,下載 hijack 并存入新的文件夾（HijackThis）。 關閉所有程式，執行 HijackThis，然后作掃描，存檔 Log (Save Log)。然后把log post 上来。

enry98

Logfile of HijackThis v1.97.7
Scan saved at 17:27:46 PM, on 21/04/2004
Platform: Windows XP SP1 (WinNT 5.01.2600)

Running processes:
C:\Windows\System32\smss.exe
C:\Windows\system32\winlogon.exe
C:\Windows\system32\services.exe
C:\Windows\system32\lsass.exe
C:\Windows\system32\svchost.exe
C:\Windows\System32\svchost.exe
C:\Windows\system32\spoolsv.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\Windows\System32\Ati2evxx.exe
C:\Program Files\Compaq\Compaq Management Agents\cpqalert.exe
C:\Windows\System32\inetsrv\inetinfo.exe
C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
C:\Program Files\Norton AntiVirus\AdvTools\NPROTECT.EXE
C:\Windows\System32\snmp.exe
C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
C:\Windows\System32\svchost.exe
C:\Program Files\VMware\VMware Workstation\vmware-authd.exe
C:\Windows\System32\vmnat.exe
C:\Windows\System32\CAP3RSK.EXE
C:\Program Files\Compaq\Compaq Management Agents\Dmi\Win32\bin\Win32sl.exe
C:\Windows\System32\vmnetdhcp.exe
C:\Windows\Explorer.EXE
C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Program Files\Compaq\EAB\EabServr.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\Windows\System32\atiptaxx.exe
C:\Program Files\ATI Technologies\ATI HydraVision\HydraDM.exe
C:\Program Files\ATI Technologies\ATI HydraVision\HydraMD.exe
C:\Program Files\ICQLite\ICQLite.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\Motherboard Monitor 5\MBM5.EXE
C:\Windows\System32\ctfmon.exe
C:\Program Files\D-Link\D-Link DSL-200I USB ADSL Modem\dslmon.exe
C:\Program Files\Microsoft Office\OFFICE11\ONENOTEM.EXE
C:\PROGRA~1\Compaq\COMPAQ~1\cpqdmi.exe
C:\WINDOWS\SYSTEM32\SPOOL\DRIVERS\W32X86\3\CAP3SWK.EXE
C:\Windows\System32\conime.exe
C:\Documents and Settings\Office User\Desktop\SpyWare\HijackThis.exe

F2 - REG:system.ini: UserInit=C:\WINDOWS\system32\userinit.exe,
O2 - BHO: (no name) - {30EBA2E2-58B2-4980-9C41-F12F5F1422C5} - C:\PROGRA~1\COLLEG~1\TEACHI~1\tphandle.dll
O2 - BHO: (no name) - {A5366673-E8CA-11D3-9CD9-0090271D075B} - C:\Program Files\FlashGet\jccatch.dll
O2 - BHO: (no name) - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O4 - HKLM\..\Run: [SynTPLpr] C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [eabconfg.cpl] C:\Program Files\Compaq\EAB\EabServr.exe /Start
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [ccRegVfy] "C:\Program Files\Common Files\Symantec Shared\ccRegVfy.exe"
O4 - HKLM\..\Run: [ATIModeChange] Ati2mdxx.exe
O4 - HKLM\..\Run: [AtiPTA] atiptaxx.exe
O4 - HKLM\..\Run: [HydraVisionDesktopManager] C:\Program Files\ATI Technologies\ATI HydraVision\HydraDM.exe
O4 - HKLM\..\Run: [HydraVisionViewport] C:\Program Files\ATI Technologies\ATI HydraVision\HydraMD.exe
O4 - HKLM\..\Run: [ICQ Lite] C:\Program Files\ICQLite\ICQLite.exe -minimize
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [IMSCMIG40W] C:\PROGRA~1\COMMON~1\MICROS~1\IME\IMSC40W\IMSCMIG.EXE /SetPreload /Log
O4 - HKLM\..\Run: [MBM 5] "C:\Program Files\Motherboard Monitor 5\MBM5.EXE"
O4 - HKLM\..\Run: [MSConfig] C:\WINDOWS\PCHealth\HelpCtr\Binaries\MSConfig.exe /auto
O4 - HKCU\..\Run: [ctfmon.exe] C:\Windows\System32\ctfmon.exe
O4 - HKCU\..\RunOnce: [ICQ Lite] C:\Program Files\ICQLite\ICQLite.exe -trayboot
O4 - Global Startup: DSLMON.lnk = ?
O4 - Global Startup: Microsoft Office OneNote 2003 Quick Launch.lnk = C:\Program Files\Microsoft Office\OFFICE11\ONENOTEM.EXE

enry98

顺便问下 为何每次我用HijackThis scan时，会有以下error ??

An unexpected error has occurred at procedure: modMain_ProcessRuleReg(sRule=>54L|HYIbm#bVRm^YYRaePeSic^H`d'do;:ebVUShF>X+ct¨²de&^¨ªt5ih¨¢QYWt{)
Error #5 - Invalid procedure call or argument

Please email me at merijn@spywareinfo.com, reporting the following:
* What you were doing when the error occurred
* How you can reproduce the error.............

谢谢

friends

請看最后一個貼子：
http://chinese.cari.com.my/myfor ... =115282&fpage=1