<<新主題 | 舊主題>>
娛樂滿紛 26FUN » 電腦區 » Help from spyware infection
返回列表 回復 發帖

Help from spyware infection

after infection
always have pop ups
desktop background cannot be changed


i tried
yahoo taskbar
microsoft antispyware
norton
use them scan and remove

but still have prob

also computer is really slow....
please hlpe me
did u try microsoft spyware removal tools?
http://www.download.com/Microsof ... 86.html?tag=lst-0-1

or

Adaware
http://www.download.com/Ad-Aware ... 02.html?tag=lst-0-1

They should work!!! Good luck!!!
有冇試過 Hijackthis,呢度有POST過

desktop background cannot be changed
——呢個可以入註冊表搞,記得都有POST過。
http://filehost.to/files/2005-11-30_02/102358_faeuste_ballen.gif
http://filehost.to/files/2005-11-30_02/102807_vtffani.gif
http://www3.filehost.to/files/2006-02-22_01/055823_00000001.gif
Originally posted by hello1997 at 2006-1-13 06:54 AM:
did u try microsoft spyware removal...
used both
they detected some spywawre and removed
but still have pop-ups
呢啲軟件清唔曬,入註冊表手工清除之。

入之前可用HIJACKTHIS掃一次,作一個分析,揾出位置。

[ Last edited by gergermen on 2006-1-14 at 04:47 PM ]
http://filehost.to/files/2005-11-30_02/102358_faeuste_ballen.gif
http://filehost.to/files/2005-11-30_02/102807_vtffani.gif
http://www3.filehost.to/files/2006-02-22_01/055823_00000001.gif
i downloaded hijackthis
scanned.... but dunno how to find which one is problematic and clear
post 個掃描結果上嚟(爲免太長,用TXT格式上傳上嚟)。
http://filehost.to/files/2005-11-30_02/102358_faeuste_ballen.gif
http://filehost.to/files/2005-11-30_02/102807_vtffani.gif
http://www3.filehost.to/files/2006-02-22_01/055823_00000001.gif
attached
pls rename it to  .log instead of .rar to view

thanks

hijackthis.rar (7.7 KB)

O4 - HKLM\..\Run: [TFNF5] TFNF5. exe
O4 - HKLM\..\Run: [SxgTkBar] SxgTkBar. exe
O4 - HKLM\..\Run: [000StTHK] 000StTHK. exe
O4 - HKLM\..\Run: [Tpwrtray] TPWRTRAY. EXE
O4 - HKLM\..\Run: [TFncKy] TFncKy. exe /Type 01
O4 - HKCU\..\Run: [Shell] "C:\Program Files\Common Files\Microsoft Shared\Web Folders\ibm00001. exe"
——呢幾個本人覺得有啲疑問,先將呢幾項導出後再DEL,睇下有問題,若有,再導入返。

desktop background cannot be changed
—— 入註冊表,start——run,type regedit
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer]
"NoActiveDesktop" , "NoActiveDesktopChanges"

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\ActiveDesktop]
"NoChangingWallPaper"=dword:00000000
"NoHTMLWallPaper"=dword:00000000
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"DisableRegistryTools"=dword:00000000
"NoDispBackgroundPage"=dword:00000000
——值係唔係 1,若係改為 0

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main]
"Default_Search_URL", "Search Page"
——睇下係唔係你自己SET嘅LINK,若唔係,就改返佢。
http://filehost.to/files/2005-11-30_02/102358_faeuste_ballen.gif
http://filehost.to/files/2005-11-30_02/102807_vtffani.gif
http://www3.filehost.to/files/2006-02-22_01/055823_00000001.gif
thanks but i have some problem

導出後再DEL,睇下有問題,若有,再導入返
how to do this?
i scanned, and cliked those item and click fix checked, it said i will permanantly remove those item..so i clicked no....



—— 入註冊表,start——run,type regedit
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer]
"NoActiveDesktop" ,  --- i can find this, value is 0
"NoActiveDesktopChanges" ---- cannot find this


[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"DisableRegistryTools"=dword:00000000           - cannot find
"NoDispBackgroundPage"=dword:00000000    -cannot find




[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main]
"Default_Search_URL", "Search Page"
-- it seems the link are from micorsoft since they start with www.microsoft.com
but i didn't set them
返回列表 回復 發帖
<<新主題 | 舊主題>>
娛樂滿紛 26FUN » 電腦區 » Help from spyware infection

重要聲明:26fun.com為一個討論區服務網站。本網站是以即時上載留言的方式運作,26fun.com對所有留言的真實性、完整性及立場等,不負任何法律責任。而一切留言之言論只代表留言者個人意見,並非本網站之立場,用戶不應信賴內容,並應自行判斷內容之真實性。於有關情形下,用戶應尋求專業意見(如涉及醫療、法律或投資等問題)。 由於本討論區受到「即時上載留言」運作方式所規限,故不能完全監察所有留言,若讀者發現有留言出現問題,請聯絡我們。26fun.com有權刪除任何留言及拒絕任何人士上載留言,同時亦有不刪除留言的權利。切勿撰寫粗言穢語、誹謗、渲染色情暴力或人身攻擊的言論,敬請自律。本網站保留一切法律權利。