［求助于］ － VX2和SearchClick

Silentforce

我中了以上两样， 用过Ad-aware + VX2 remover ，Trojan Registry Remover， AVG等等， 还是删除不掉。谁可以帮忙吗？

我的system restore已经关了，试过在Safe Mode里面用过以上的来扫描，外加上用HiJackThis, 还是弄不掉。。


我的Hijackthis ：

Logfile of HijackThis v1.99.1
Scan saved at 8:09:39 PM, on 9/17/2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
C:\WINDOWS\addxl32.exe
C:\WINDOWS\addsa32.exe
C:\Program Files\MSN Messenger\msnmsgr.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\DOCUME~1\Ong\LOCALS~1\Temp\Rar$EX00.016\HijackThis.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\WinRAR\WinRAR.exe
C:\DOCUME~1\Ong\LOCALS~1\Temp\Rar$EX00.093\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\WINDOWS\system32\jbfjx.dll/sp.html#17702
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINDOWS\system32\jbfjx.dll/sp.html#17702
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = res://C:\WINDOWS\system32\jbfjx.dll/sp.html#17702
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\WINDOWS\system32\jbfjx.dll/sp.html#17702
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINDOWS\system32\jbfjx.dll/sp.html#17702
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = res://C:\WINDOWS\system32\jbfjx.dll/sp.html#17702
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = res://C:\WINDOWS\system32\jbfjx.dll/sp.html#17702
R3 - Default URLSearchHook is missing
O2 - BHO: IeCatch2 Class - {A5366673-E8CA-11D3-9CD9-0090271D075B} - C:\PROGRA~1\FlashGet\jccatch.dll
O2 - BHO: Class - {A6D5714A-23DD-8A3B-9821-97AB83B91146} - C:\WINDOWS\mssm32.dll
O3 - Toolbar: FlashGet Bar - {E0E899AB-F487-11D5-8D29-0050BA6940E3} - C:\PROGRA~1\FlashGet\fgiebar.dll
O4 - HKLM\..\Run: [addsa32.exe] C:\WINDOWS\addsa32.exe
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O8 - Extra context menu item: Download All by FlashGet - C:\PROGRA~1\FlashGet\jc_all.htm
O8 - Extra context menu item: Download using FlashGet - C:\PROGRA~1\FlashGet\jc_link.htm
O9 - Extra button: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\PROGRA~1\FlashGet\flashget.exe
O9 - Extra 'Tools' menuitem: &FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\PROGRA~1\FlashGet\flashget.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/wind ... e.cab?1126774663694
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/MsnMessengerSetupDownloader.cab
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)
O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxsrvc.dll
O23 - Service: Network Security Service (NSS) ( 11Fßä#·ºÄÖ`I) - Unknown owner - C:\WINDOWS\addxl32.exe"  /s (file missing)
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe




在safe mode时已经 把这些
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\WINDOWS\system32\jbfjx.dll/sp.html#17702
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINDOWS\system32\jbfjx.dll/sp.html#17702
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = res://C:\WINDOWS\system32\jbfjx.dll/sp.html#17702
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\WINDOWS\system32\jbfjx.dll/sp.html#17702
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINDOWS\system32\jbfjx.dll/sp.html#17702
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = res://C:\WINDOWS\system32\jbfjx.dll/sp.html#17702
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = res://C:\WINDOWS\system32\jbfjx.dll/sp.html#17702
R3 - Default URLSearchHook is missing


Fix Checked了， 但重新开机后又出现了。。

MrNiceGuy

原帖由 Silentforce 于 17-9-2005 08:03 PM 发表
我中了以上两样， 用过Ad-aware + VX2 remover ，Trojan Registry Remover， AVG等等， 还是删除不掉。谁可以帮忙吗？

我的system restore已经关了，试过在Safe Mode里面用过以上的来扫描，外加上用HiJackThis ...

SearchClick的清除方法看这里
http://www.uninstall-i-lookup.com/removeSearchClick.html


VX2的清除方法--->
下载AD-AWARE，这里按--->
http://www.lavasoftusa.com/support/download/

然后下载VX2 CLEANER。这里按--->
http://www.lavasoftusa.com/software/addons/vx2cleaner.shtml

用AD-AWARE和VX2 CLEANER扫一扫。

Silentforce

我试过用Ad-aware + VX2 remover扫， 它说我的已经清除了， 但过后Scan的时候又有。

关于SearchClick, 要到哪里找
{FD9BC004-8331-4457-B830-4759FF704C22}
{69739905-5C5C-4D84-B42B-5757C302DC09}
的registry key? HKEY_LOCAL_MACHINE 还是其他的？

MrNiceGuy

原帖由 Silentforce 于 18-9-2005 08:22 AM 发表
我试过用Ad-aware + VX2 remover扫， 它说我的已经清除了， 但过后Scan的时候又有。

关于SearchClick, 要到哪里找
{FD9BC004-8331-4457-B830-4759FF704C22}
{69739905-5C5C-4D84-B42B-5757C302DC09}
的re ...

用什么SCAN说你还有VX2？
用REGISTRY的SEARCH来找哪个KEY