gergermen

有冇試過 Hijackthis，呢度有POST過

desktop background cannot be changed
——呢個可以入註冊表搞，記得都有POST過。

gergermen

呢啲軟件清唔曬，入註冊表手工清除之。

入之前可用HIJACKTHIS掃一次，作一個分析，揾出位置。

[ Last edited by gergermen on 2006-1-14 at 04:47 PM ]

gergermen

post 個掃描結果上嚟（爲免太長，用TXT格式上傳上嚟）。

gergermen

O4 - HKLM\..\Run: [TFNF5] TFNF5. exe
O4 - HKLM\..\Run: [SxgTkBar] SxgTkBar. exe
O4 - HKLM\..\Run: [000StTHK] 000StTHK. exe
O4 - HKLM\..\Run: [Tpwrtray] TPWRTRAY. EXE
O4 - HKLM\..\Run: [TFncKy] TFncKy. exe /Type 01
O4 - HKCU\..\Run: [Shell] "C:\Program Files\Common Files\Microsoft Shared\Web Folders\ibm00001. exe"
——呢幾個本人覺得有啲疑問，先將呢幾項導出後再DEL，睇下有問題，若有，再導入返。

desktop background cannot be changed
—— 入註冊表，start——run,type regedit
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer]
"NoActiveDesktop" , "NoActiveDesktopChanges"

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\ActiveDesktop]
"NoChangingWallPaper"=dword:00000000
"NoHTMLWallPaper"=dword:00000000
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"DisableRegistryTools"=dword:00000000
"NoDispBackgroundPage"=dword:00000000
——值係唔係 1，若係改為 0

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main]
"Default_Search_URL", "Search Page"
——睇下係唔係你自己SET嘅LINK，若唔係，就改返佢。

gergermen

O4 - HKLM\..\Run: [TFNF5] TFNF5. exe
O4 - HKLM\..\Run: [SxgTkBar] SxgTkBar. exe
O4 - HKLM\..\Run: [000StTHK] 000StTHK. exe
O4 - HKLM\..\Run: [Tpwrtray] TPWRTRAY. EXE
O4 - HKLM\..\Run: [TFncKy] TFncKy. exe /Type 01
O4 - HKCU\..\Run: [Shell] "C:\Program Files\Common Files\Microsoft Shared\Web Folders\ibm00001. exe"
——i scanned, and cliked those item and click fix checked, it said i will permanantly remove those item..so i clicked no....,指上面呢幾個？呢幾個係咩SOFTWARE，你知唔知。
導出（EXPORT）/導入（IMPORT），喺註冊表編輯器嘅“REGISTRY（註冊表）”嗰度。


[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer]
"force active desktop on"  have  0X0000001 (1)
—— 改為0，睇下得唔得

PS：desktop background cannot be changed，具體係點？喺DESKTOP，RIGHT CLICK MOUSE，SELECT“PROPERTISE”，有冇“BACKGROUND”呢項？

gergermen

WHAT ABOUT THIS
HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurentVersion\\Policies\\Explores
“No Save Setting”若1 ，改為0

pop-up，maybe this one
O4 - HKCU\..\Run: [Shell] "C:\Program Files\Common Files\Microsoft Shared\Web Folders\ibm00001. exe"

#12嗰幾個software，知唔知係咩嚟。

[ Last edited by gergermen on 2006-1-15 at 12:13 PM ]

gergermen

REG:system.ini: Shell=explorer. exe                                                                                                    "C:\Program Files\Common Files\Microsoft Shared\Web Folders\ibm00001. exe"
HKCU\..\Run: [Shell] "C:\Program Files\Common Files\Microsoft Shared\Web Folders\ibm00001. exe"
——喺註冊表同呢個文件del曬佢。如果唔知，用HIJACKTHIS修復

HKLM\..\Run: [drsmartloadb] c:\\drsmartloadbfilter-031 —— 有冇掃過毒，呢個亦有可能，入註冊表，DEL咗呢項。

Winlogon Notify: Installer - C:\WINDOWS\system32\irl6l53s1.dll —— 呢個不少少懷疑？但唔肯定

gergermen

Originally posted by 147ak477 at 2006-1-15 15:26:
still have popo-ups

唔係啩~~~

CAP張圖睇下（下面幾張）

彈出嚟嘅係咩內容/ TASK MANAGER /  
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run-
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnceEx
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServices
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServicesOnce

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Runonce
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Start Menu\Programs\启动

OR
用HIJACKTHIS再掃一次

[ Last edited by gergermen on 2006-1-15 at 03:58 PM ]

gergermen

O17 - HKLM\System\CCS\Services\Tcpip\..\{9B69C40C-4719-4BCA-85F7-49A8AFC67880}: NameServer = 205.252.144.28 218.102.23.77

之前用HIJACKTHIS掃過嘅LOG中有呢個，一下冇留意，你清唔清楚呢個IP，也許就是POPUP嘅來源，佢將你個IP重定向呢個到，用HIJACKTHIS修復。

gergermen

Originally posted by 147ak477 at 2006-1-15 16:36:
after i fix the O-17
all the pop u...

而家應該冇事嘞？係唔係
你POST嘅LINK係連去呢度（賣廣告）
http://www.health-yshopping.com/normal/yyy102.html