gergermen

最好先唔好上網住，暫時關閉系統還原（若有開嘅話），開機時按“F5”，將隱含文件全部先顯示出嚟，等清完毒，再隱藏返。
1、先試下用殺毒軟件睇下可唔可以清除
殺毒軟件全機掃一次

2、上面方法唔得，再人手刪除佢
按 kingwong 講用HIJACKTHIS修復下面呢個同上面我講嗰兩個（竟然冇留意到呢項=.=)
O4 - HKLM\..\Run: [MS Messenger] C:\WINDOWS\msm. exe

跟住手工刪除下面呢啲（記得睇下HOST使唔使改）
DEL（呢幾個要徹底刪除，如果刪唔到，試下用上面講先regsvr32 /u 文件名，再刪）
C:\windows\system32\SSock32.dll
C:\WINDOWS\msm. exe
Regsock32. exe & ssocks5.dll: 一係 C:\windows\system32\，or 一係 C:\windows\
——開始——查找(或只有桌面冇打開窗口時按“F3”），輸入ssock32.*,msn.*,ssocks5.*,regsock32.*，位置選C：或所有分區（all driver)/我的電腦
del（入註冊表）
[quote]HKEY_CLASSES_ROOT\CLSID\{1E1B2879-88FF-11D2-8D96-000000000004}
　　HKEY_CLASSES_ROOT\HTMLEdit.SSocks32
　　HKEY_CLASSES_ROOT\HTMLEdit.SSocks32.1
　　HKEY_LOCAL_MACHINE\Software\CLASSES\CLSID\{1E1B2879-88FF-11D2-8D96-D7ACAC95951A}
　　HKEY_LOCAL_MACHINE\Software\CLASSES\HTMLEdit.SSocks32
　　HKEY_LOCAL_MACHINE\Software\CLASSES\HTMLEdit.SSocks32.1
　　HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{000000000004}

HKEY_CLASSES_ROOT\CLSID\{1E1B2879-88FF-11D2-8D96-D7ACAC95951A}
HKEY_CLASSES_ROOT\HTMLEdit.SSocks5
HKEY_CLASSES_ROOT\HTMLEdit.SSocks5.1
HKEY_LOCAL_MACHINE\Software\CLASSES\CLSID\{1E1B2879-88FF-11D2-8D96-D7ACAC95951A}
HKEY_LOCAL_MACHINE\Software\CLASSES\HTMLEdit.SSocks5
HKEY_LOCAL_MACHINE\Software\CLASSES\HTMLEdit.SSocks5.1
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\explorer\
Browser Helper Objects\{1E1B2879-88FF-11D2-8D96-D7ACAC95951A}[/quote]

lywv5

暫時關閉系統還原（若有開嘅話），開機時按“F5”
but still cannot enter safe mode
i use win XP

when i reboot ,, it first show toshiba , then window XP ( loading screen). then log in screen
when shall i press F5

147ak477

entered saft mode
disable 系統還原
set show hidden files

hijackthis remove O 17 and O4

scan norton ( nothing  wrong detected! , even the file last time)

search but cannot find all the files:
C:\windows\system32\SSock32.dll
C:\WINDOWS\msm. exe
Regsock32. exe & ssocks5.dll

also all the things in the registry inside the quote cannot be find

147ak477

still have pop up
after i connect to internet
microsoft anti-spyware detected the contextplus.com wants to modify the windows host file and i click block it


an add pop up in IE, but cannot load

then my toolbar style suddenly changed , from blue XP style to classic grey style and warning windoe ( cannot find power(sth else in the name) .dll ) and rebooted!

gergermen

sorry~~~~is press F8
As your computer restarts but before Windows launches, press F8
first show toshiba ,press F8
select safe made with network,but you no need to use network

ckyckk

Originally posted by gergermen at 2006-1-18 12:25 AM:
sorry~~~~is press F8
As your computer restarts but before Windows launches, press F8
first show toshiba ,press F8
select safe made with network,but you no need to use network

你好少可咁夜喎

147ak477

seems to fix , using another method from another forum
but thanks anyway
especially gergermen!!!

gergermen

what method~~~~

can you tell me?

lywv5

download a program called l2mfix, and clean up using the programme
(but i do not know what it does, i just enter the command to make it fix :-))