[间谍：求助] Home Adrress 被Hijack 了

aka_naruto

IE被http://0websearch.com/ 给HIJACK 了。请问应该怎么清除呢？
我也用了hijackthis做了扫描可是不知道应该删除哪一个file。
所以在此贴了logfile， 请各位大大帮我看看一下。
Logfile of HijackThis v1.98.2
Scan saved at 4:49:54 PM, on 8/9/2004
Platform: Windows XP  (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 (6.00.2600.0000)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\inetdata\services.exe
C:\WINDOWS\System32\gowegazg.exe
C:\WINDOWS\System32\P2P Networking\P2P Networking2.exe
C:\WINDOWS\system32\rundll32.exe
C:\WINDOWS\System32\ctfmon.exe
C:\Program Files\MSN Messenger\msnmsgr.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\Real\RealOne Player\realplay.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\unzipped\hijackthis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://0websearch.com/
R3 - URLSearchHook: (no name) - {707E6F76-9FFB-4920-A976-EA101271BC25} - C:\Program Files\TV Media\TvmBho.dll
F3 - REG:win.ini: run=C:\WINDOWS\inetdata\services.exe
O2 - BHO: twaintecObj Class - {000020DD-C72E-4113-AF77-DD56626C6C42} - C:\WINDOWS\twaintec.dll
O2 - BHO: (no name) - {5321E378-FFAD-4999-8C62-03CA8155F0B3} - (no file)
O2 - BHO: IE - {D157330A-9EF3-49F8-9A67-4141AC41ADD4} - C:\WINDOWS\DOWNLO~1\CONFLICT.13\CnsHook.dll
O4 - HKLM\..\Run: [ncgovudw] C:\WINDOWS\System32\gowegazg.exe
O4 - HKLM\..\Run: [xp_system] C:\WINDOWS\inetdata\services.exe
O4 - HKLM\..\Run: [P2P Networking2] C:\WINDOWS\System32\P2P Networking\P2P Networking2.exe /AUTOSTART
O4 - HKLM\..\Run: [helper.dll] C:\WINDOWS\system32\rundll32.exe C:\PROGRA~1\3721\helper.dll,Rundll32
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\RunOnce: [TV Media] C:\Program Files\TV Media\Tvm.exe
O4 - HKCU\..\Run: [xp_system] C:\WINDOWS\inetdata\services.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\System32\ctfmon.exe
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background
O4 - HKCU\..\RunOnce: [TV Media] C:\Program Files\TV Media\Tvm.exe
O9 - Extra button: Short Message - {00000000-0000-0001-0001-596BAEDD1289} - http://sms.3721.com/ie/index.htm (file missing)
O9 - Extra button: Instant Messenger - {0F7DE07D-BD74-4991-9D5F-ECBB8391875D} - http://cn.rd.yahoo.com/home/messenger/bjk/clientbtn/?[url]http://cn.messenger.yahoo.com/[/url] (file missing)
O9 - Extra button: 3721 Assistant - {5D73EE86-05F1-49ed-B850-E423120EC338} - http://assistant.3721.com/index.htm?fb=Cns (file missing)
O9 - Extra button: (no name) - {ECF2E268-F28C-48d2-9AB7-8F69C11CCB71} - http://assistant.3721.com/security1.htm?fb=Cns (file missing)
O9 - Extra 'Tools' menuitem: Repair Browser - {ECF2E268-F28C-48d2-9AB7-8F69C11CCB71} - http://assistant.3721.com/security1.htm?fb=Cns (file missing)
O9 - Extra button: (no name) - {FD00D911-7529-4084-9946-A29F1BDF4FE5} - http://assistant.3721.com/clean1.htm?fb=Cns (file missing)
O9 - Extra 'Tools' menuitem: Clean Internet access record - {FD00D911-7529-4084-9946-A29F1BDF4FE5} - http://assistant.3721.com/clean1.htm?fb=Cns (file missing)
O11 - Options group: [!CNS]  Chinese keywords
O17 - HKLM\System\CCS\Services\Tcpip\..\{60B2B15E-1730-43EC-A001-5ABFF9803671}: NameServer = 203.120.90.40 203.120.90.60

[ Last edited by aka_naruto on 9-8-2004 at 08:01 PM ]

aka_naruto

那位大大可否帮我看看阿？等着救命阿。。。

试看BOOT进SAFE MODE,关掉IE,然后用CWShredder.exe来扫描除毒

在这里下栽: http://www.softpedia.com/public/scripts/downloadhero/10-17-150/

aka_naruto

Can teach me step by step. I still dun quite understand of ur way to clear the virus.

1〕先下载CWShredder.exe
2〕在MY COMPUTER 按滑鼠左键 -> PROPERTIES -> SYSTEM RESTORE
3) 勾TURN OFF SYSTEM RESTORE -> OK
4) RESTART
5) 从新开机时，出现黑黑的CMOS画面后一直按键盘的F8（因为现在电脑速度太快）
6〕在OS MENU，选SAFE MODE, ENTER
7) 进入SAFE MODE后，记得别开Internet Explorer
8) 开启CWShredder，然后只是NEXT，NEXT，scan到后按CLEAR、DELETE就可以了
9) RESTART

记得把SYSTEM RESTORE弄回

friends

aka_naruto 于 9/8/2004 04:53 PM  说 :
IE被http://0websearch.com/ 给HIJACK 了。请问应该怎么清除呢？
我也用了hijackthis做了扫描可是不知道应该删除哪一个file。
所以在此贴了logfile， 请各位大大帮我看看一下。
Logfile of HijackT ...

執行 HijackThis，打勾以下的，按 CHECKED FIX :

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://0websearch.com/
R3 - URLSearchHook: (no name) - {707E6F76-9FFB-4920-A976-EA101271BC25} - C:\Program Files\TV Media\TvmBho.dll
F3 - REG:win.ini: run=C:\WINDOWS\inetdata\services.exe
O2 - BHO: twaintecObj Class - {000020DD-C72E-4113-AF77-DD56626C6C42} - C:\WINDOWS\twaintec.dll
O2 - BHO: (no name) - {5321E378-FFAD-4999-8C62-03CA8155F0B3} - (no file)
O2 - BHO: IE - {D157330A-9EF3-49F8-9A67-4141AC41ADD4} - C:\WINDOWS\DOWNLO~1\CONFLICT.13\CnsHook.dll

O4 - HKLM\..\Run: [ncgovudw] C:\WINDOWS\System32\gowegazg.exe
O4 - HKLM\..\Run: [xp_system] C:\WINDOWS\inetdata\services.exe

O4 - HKLM\..\Run: [helper.dll] C:\WINDOWS\system32\rundll32.exe C:\PROGRA~1\3721\helper.dll,Rundll32

O4 - HKLM\..\RunOnce: [TV Media] C:\Program Files\TV Media\Tvm.exe
O4 - HKCU\..\Run: [xp_system] C:\WINDOWS\inetdata\services.exe
O4 - HKCU\..\RunOnce: [TV Media] C:\Program Files\TV Media\Tvm.exe
O9 - Extra button: Short Message - {00000000-0000-0001-0001-596BAEDD1289} - http://sms.3721.com/ie/index.htm (file missing)
O9 - Extra button: 3721 Assistant - {5D73EE86-05F1-49ed-B850-E423120EC338} - http://assistant.3721.com/index.htm?fb=Cns (file missing)
O9 - Extra button: (no name) - {ECF2E268-F28C-48d2-9AB7-8F69C11CCB71} - http://assistant.3721.com/security1.htm?fb=Cns (file missing)
O9 - Extra 'Tools' menuitem: Repair Browser - {ECF2E268-F28C-48d2-9AB7-8F69C11CCB71} - http://assistant.3721.com/security1.htm?fb=Cns (file missing)
O9 - Extra button: (no name) - {FD00D911-7529-4084-9946-A29F1BDF4FE5} - http://assistant.3721.com/clean1.htm?fb=Cns (file missing)
O9 - Extra 'Tools' menuitem: Clean Internet access record - {FD00D911-7529-4084-9946-A29F1BDF4FE5} - http://assistant.3721.com/clean1.htm?fb=Cns (file missing)
O11 - Options group: [!CNS]  Chinese keywords

O17 - HKLM\System\CCS\Services\Tcpip\..\{60B2B15E-1730-43EC-A001-5ABFF9803671}: NameServer = 203.120.90.40 203.120.90.60

【注】017 這，若 IP 203.120.90.40 不是你設定的，將這 O17 項目刪除

重新啓動電腦后，將以下的刪除：

C:\WINDOWS\System32\gowegazg.exe
C:\WINDOWS\system32\rundll32.exe

再新啓動電腦，看看你的問題是否解決了！

skyjuice2004

下載這個檔案然後試試看.

http://skyjuice2004.spymac.net/cleaner.exe