【求助】Ad-aware 和 Spybot 都沒辦法砍掉的惡意廣告

[DavW]

小弟用了這兩個程式(都有跟新)，都砍不掉這個網站Casinopalazzo
所植入的程式...
我用HijackThis，但完全看不懂哪些應該刪掉...

這個程式每隔十幾分鐘就會跳出2個瀏覽器連到他們的網站http://www.casinopalazzo.com/index.php?sourceid=102989
並且在桌面上建立一個名為sex的網路捷徑

我想盡快除去這個麻煩
希望各位先進能給我一點建議...
謝謝！

[cheerx]

1.試試看這一套 http://internet.cybermesa.com/~moosoft/cleaner41.exe
更新完他的最新更新 再做一次全機掃瞄試試看

2.做完先不要上網 先去WINDOWS UPDATE更新WINDOWS的全部更新(如果是盜版WIN XP黑名單序號就幫不上忙了)

3.同時建議防毒軟體裝上MCAFEE最新版或是KASPERSKY最新版,並且更新病毒碼.

最後,祝好運,再不行就備份資料,準備重灌OS.

[DavW]

剛剛試過了，雖然還是沒辦法移除

不過還是非常感謝你提供的解決方法

感激不盡！

[cheerx]

別客氣 很遺憾沒幫上你的忙,上面那一套cleanner可以裝起來,平常跑他的監控程式,如果有東西來改你的reg檔,他都會警告你,之後就比較不會有這種問題.

[jerry11]

把HijackThis掃瞄的結果，抓圖給大家看一下，也許有高手知道怎麼解？

[jerry11]

http://computercops.biz/postt71347.html
看看上面的教學吧!我用google查"HijackThis、Casinopalazzo"，這2個keyword，一下子就找到解決方式了。
若還須更多資料，自己用google再去查查。

[DavW]

R3 - Default URLSearchHook is missing
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - D:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: (no name) - {A5366673-E8CA-11D3-9CD9-0090271D075B} - (no file)
O3 - Toolbar: FlashGet Bar - {E0E899AB-F487-11D5-8D29-0050BA6940E3} - D:\PROGRA~1\FLASHGET\fgiebar.dll
O3 - Toolbar: 收音機(&R) - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [pccguide.exe] "D:\Program Files\Trend Micro\PC-cillin 2004\pccguide.exe"
O4 - HKLM\..\Run: [PCClient.exe] "D:\Program Files\Trend Micro\PC-cillin 2004\PCClient.exe"
O4 - HKLM\..\Run: [TM Outbreak Agent] "D:\Program Files\Trend Micro\PC-cillin 2004\TMOAgent.exe" /run
O4 - HKLM\..\Run: [MSNShell] D:\Program Files\msnshell\MSNShell.exe autorun
O4 - HKLM\..\Run: [MessengerPlus3] "C:\Program Files\Messenger Plus! 3\MsgPlus.exe"
O4 - HKLM\..\Run: [QuickTime Task] "D:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\j2re1.4.2_05\bin\jusched.exe
O4 - HKLM\..\Run: [loadMect1] C:\Program Files\rundll32.exe
O4 - HKLM\..\Run: [PHIMETIPSYNC] C:\Program Files\Common Files\Microsoft Shared\IME\IMTC60\Phonetic\TINTLCFG.EXE /PHIMETIPSync
O4 - HKLM\..\Run: [DKTime] C:\WINDOWS\System32\dktime.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\System32\ctfmon.exe
O4 - HKCU\..\Run: [Yahoo! Pager] D:\Program Files\Yahoo!\Messenger\ypager.exe -quiet
O4 - HKCU\..\Run: [MessengerPlus3] "C:\Program Files\Messenger Plus! 3\MsgPlus.exe" /WinStart
O4 - HKCU\..\Run: [DKTime] C:\WINDOWS\System32\dktime.exe
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O8 - Extra context menu item: 下載編碼內容(&D.S.Lite) - C:\Documents and Settings\David\桌面\DSLite2.06\DSLite2\dl_text.html
O8 - Extra context menu item: 下載編碼檔案內容(&D.S.Lite) - C:\Documents and Settings\David\桌面\DSLite2.06\DSLite2\dl_url.html
O8 - Extra context menu item: 使用 FlashGet 下載 - D:\Program Files\FlashGet\jc_link.htm
O8 - Extra context menu item: 全部使用 FlashGet 下載 - D:\Program Files\FlashGet\jc_all.htm
O8 - Extra context menu item: 及時添加轉換用語 - res://C:\WINDOWS\System32\tcscconv.dll/wnaddindex
O8 - Extra context menu item: 更新用語轉碼檔案 - res://C:\WINDOWS\System32\tcscconv.dll/update
O8 - Extra context menu item: 龍之旅簡轉繁體(&T) - res://C:\WINDOWS\System32\tcscconv.dll/totrad
O8 - Extra context menu item: 龍之旅繁轉簡體(&S) - res://C:\WINDOWS\System32\tcscconv.dll/tosimp
O9 - Extra button: D.S.Lite - {F8475519-8412-4D40-A46E-692D9D04DF7F} - C:\Documents and Settings\David\桌面\DSLite2.06\DSLite2\DSLite.exe (file missing)
O9 - Extra 'Tools' menuitem: &D.S.Lite - {F8475519-8412-4D40-A46E-692D9D04DF7F} - C:\Documents and Settings\David\桌面\DSLite2.06\DSLite2\DSLite.exe (file missing)
O12 - Plugin for .pdf: C:\Program Files\Internet Explorer\PLUGINS\nppdf32.dll
O15 - Trusted Zone: *.searchmiracle.com
O15 - Trusted Zone: *.skoobidoo.com
O15 - Trusted Zone: *.windupdates.com
O16 - DPF: gcaee - http://www.pki.gov.tw/gcaee/gcaee.CAB
O16 - DPF: ppctlcab - http://69.44.122.156/scanner/ppctlcab.cab
O16 - DPF: {03F998B2-0E00-11D3-A498-00104B6EB52E} - https://components.viewpoint.com/MTS...p.html?1&false
O16 - DPF: {051299DE-2CFD-4EA8-A432-F0429B4E7A5D} (陓毞刲啪(&X)) - http://61.129.113.248:554/toolbar/XTTIEBar.CAB
O16 - DPF: {08F04139-8DFC-11D2-80E9-006008B066EE} (ConfigChkr Class) - https://pki.toptrade.com.tw/onsite/vscnfchk.cab
O16 - DPF: {12755229-656A-4508-BC94-2DA4D314B4C8} (CathayMyATM.ATMFunc) - https://www.mybank.com.tw/myatm/CAB/CathayMyATM.CAB
O16 - DPF: {2FC9A21E-2069-4E47-8235-36318989DB13} (PPSDKActiveXScanner.MainScreen) - http://69.44.122.156/scanner/axscanner.cab
O16 - DPF: {402EE96E-2CE8-482D-ADA5-CECEEA07E16D} (TurnTool Scene) - http://www.turntool.com/ViewerInstall.exe
O16 - DPF: {41F17733-B041-4099-A042-B518BB6A408C} - http://a1540.g.akamai.net/7/1540/52/...eInstaller.exe
O16 - DPF: {62789780-B744-11D0-986B-00609731A21D} (Autodesk MapGuide ActiveX Control) - http://bus.tpc.gov.tw/plug-in/mgaxctrl.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://v5.windowsupdate.microsoft.co...?1093843266696
O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} - http://security.symantec.com/sscv6/S.../bin/cabsa.cab
O16 - DPF: {6CB5E471-C305-11D3-99A8-000086395495} - http://toolbar.google.com/data/zh-TW.../GoogleNav.cab
O16 - DPF: {6F7864F9-DB33-11D3-8166-0060B0F885E6} (VSPTA Class) - https://pki.toptrade.com.tw/OnSite/VSApps/vspta3.cab
O16 - DPF: {706F3805-27D7-478D-80E5-E25D2BB030B3} (VacPro.internazionale_ver3) - http://www.advnt01.com/dialer/internazionale_ver3.CAB
O16 - DPF: {917623D1-D8E5-11D2-BE8B-00104B06BDE3} (CamImage Class) - http://211.79.170.21/plugin/1/AxisCamControl.cab
O16 - DPF: {BC207F7D-3E63-4ACA-99B5-FB5F8428200C} - http://bar.baidu.com/update/IESearch.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - https://download.macromedia.com/pub/...sh/swflash.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{4081894B-76E4-41AF-8BF6-B8187ED88C3B}: NameServer = 168.95.192.1 168.95.1.1
O20 - AppInit_DLLs: NVDESK32.DLL