endurer 原创
2006-09-08 第1版
有位网友的电脑，使用IE浏览网页时老是弹出hxxp://www.duduw.com 的广告窗口。
使用HijackThis（可以到 hxxp://endurer.ys168.com 下载）扫描log，发现可疑项：
/-----------
Logfile of HijackThis v1.99.1
Scan saved at 20:20:12, on 2006-9-8
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
O2 - BHO: shdocvwhlp Class - {BE442802-3911-46E0-B227-076B15A4EAD3} - C:/WINDOWS/system32/mssnmp16.dll
O9 - Extra button: 精彩游戏 - {D1EDDE84-E67E-4ccd-B28E-73AD3B71A7C9} - http://bars.duole8.com/ (file missing)
O9 - Extra 'Tools' menuitem: 精彩游戏 - {D1EDDE84-E67E-4ccd-B28E-73AD3B71A7C9} - http://bars.duole8.com/ (file missing)
O21 - SSODL: SysTime - {724C75F1-B757-408D-A50A-4CF99DA35D73} - C:/PROGRA~1/WinKld/WinKld.dll
-----------/
用 WinRAR找到文件：
/-----------
C:/WINDOWS/system32/mssnmp16.dll
-----------/
打包备份后删除。
卸载：Windows日历（Winkalendar）
关闭所有浏览器和文件夹窗口，用HijackThis扫描并修复上面所列项目。
清空IE临时文件夹
清空 c:/Documents and Settings/user/Local Settings/temp（其中 user 为用户名）
STATUS: FINISHED
Complete scanning result of "mssnmp16.dll", received in VirusTotal at 09.08.2006, 14:57:10 (CET).
Antivirus | Version | Update | Result |
AntiVir | 7.1.1.16 | 09.08.2006 | TR/Spy.Agent.JP |
Authentium | 4.93.8 | 09.08.2006 | no virus found |
Avast | 4.7.844.0 | 09.08.2006 | no virus found |
AVG | 386 | 09.08.2006 | no virus found |
BitDefender | 7.2 | 09.08.2006 | no virus found |
CAT-QuickHeal | 8.00 | 09.07.2006 | no virus found |
ClamAV | devel-20060426 | 09.08.2006 | no virus found |
DrWeb | 4.33 | 09.08.2006 | no virus found |
eTrust-InoculateIT | 23.72.119 | 09.08.2006 | no virus found |
eTrust-Vet | 30.3.3068 | 09.08.2006 | no virus found |
Ewido | 4.0 | 09.05.2006 | no virus found |
Fortinet | 2.77.0.0 | 09.07.2006 | no virus found |
F-Prot | 3.16f | 09.08.2006 | no virus found |
F-Prot4 | 4.2.1.29 | 09.07.2006 | no virus found |
Ikarus | 0.2.65.0 | 09.08.2006 | no virus found |
Kaspersky | 4.0.2.24 | 09.08.2006 | no virus found |
McAfee | 4847 | 09.07.2006 | no virus found |
Microsoft | 1.1560 | 09.08.2006 | no virus found |
NOD32v2 | 1.1745 | 09.08.2006 | no virus found |
Norman | 5.90.23 | 09.08.2006 | no virus found |
Panda | 9.0.0.4 | 09.07.2006 | no virus found |
Sophos | 4.09.0 | 09.08.2006 | no virus found |
Symantec | 8.0 | 09.08.2006 | no virus found |
TheHacker | 5.9.8.208 | 09.08.2006 | no virus found |
UNA | 1.83 | 09.07.2006 | no virus found |
VBA32 | 3.11.1 | 09.07.2006 | no virus found |
VirusBuster | 4.3.7:9 | 09.08.2006 | no virus found |
Aditional Information |
File size: 233472 bytes |
MD5: 7efdae2d9d17d52d855cf6560a21b906 |
SHA1: 831369c5aa26360b9ace5ec8eea51d77c97968d4 |
