解决弹出www.duduw.com广告的问题

￡神魔★判官ぃ 2024-04-20 11:17 66阅读 0赞

**endurer**　原创  
  
2006-09-08 第**1**版

有位网友的电脑，使用IE浏览网页时老是弹出hxxp://www.duduw.com 的广告窗口。

使用HijackThis（可以到 hxxp://endurer.ys168.com 下载）扫描log，发现可疑项：

/-----------  
Logfile of HijackThis v1.99.1  
Scan saved at 20:20:12, on 2006-9-8  
Platform: Windows XP SP2 (WinNT 5.01.2600)  
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

O2 - BHO: shdocvwhlp Class - \{BE442802-3911-46E0-B227-076B15A4EAD3\} - C:/WINDOWS/system32/mssnmp16.dll

O9 - Extra button: 精彩游戏 - \{D1EDDE84-E67E-4ccd-B28E-73AD3B71A7C9\} - [http://bars.duole8.com/][http_bars.duole8.com] (file missing)

O9 - Extra 'Tools' menuitem: 精彩游戏 - \{D1EDDE84-E67E-4ccd-B28E-73AD3B71A7C9\} - [http://bars.duole8.com/][http_bars.duole8.com] (file missing)

O21 - SSODL: SysTime - \{724C75F1-B757-408D-A50A-4CF99DA35D73\} - C:/PROGRA~1/WinKld/WinKld.dll  
\-----------/

用 WinRAR找到文件：  
/-----------  
C:/WINDOWS/system32/mssnmp16.dll  
\-----------/

打包备份后删除。

卸载：Windows日历（Winkalendar）

关闭所有浏览器和文件夹窗口，用HijackThis扫描并修复上面所列项目。

清空IE临时文件夹

清空 c:/Documents and Settings/user/Local Settings/temp（其中 user 为用户名）

STATUS: FINISHED

Complete scanning result of "mssnmp16.dll", received in VirusTotal at 09.08.2006, 14:57:10 (CET).

<table> 
 <thead> 
  <tr> 
   <td>Antivirus</td> 
   <td>Version</td> 
   <td align="center">Update</td> 
   <td>Result</td> 
  </tr> 
 </thead> 
 <tbody> 
  <tr> 
   <td>AntiVir</td> 
   <td>7.1.1.16</td> 
   <td align="center">09.08.2006</td> 
   <td>TR/Spy.Agent.JP</td> 
  </tr> 
  <tr> 
   <td>Authentium</td> 
   <td>4.93.8</td> 
   <td align="center">09.08.2006 </td> 
   <td>no virus found</td> 
  </tr> 
  <tr> 
   <td>Avast</td> 
   <td>4.7.844.0</td> 
   <td align="center">09.08.2006 </td> 
   <td>no virus found</td> 
  </tr> 
  <tr> 
   <td>AVG</td> 
   <td>386</td> 
   <td align="center">09.08.2006 </td> 
   <td>no virus found</td> 
  </tr> 
  <tr> 
   <td>BitDefender</td> 
   <td>7.2</td> 
   <td align="center">09.08.2006 </td> 
   <td>no virus found</td> 
  </tr> 
  <tr> 
   <td>CAT-QuickHeal</td> 
   <td>8.00</td> 
   <td align="center">09.07.2006 </td> 
   <td>no virus found</td> 
  </tr> 
  <tr> 
   <td>ClamAV</td> 
   <td>devel-20060426</td> 
   <td align="center">09.08.2006 </td> 
   <td>no virus found</td> 
  </tr> 
  <tr> 
   <td>DrWeb</td> 
   <td>4.33</td> 
   <td align="center">09.08.2006 </td> 
   <td>no virus found</td> 
  </tr> 
  <tr> 
   <td>eTrust-InoculateIT</td> 
   <td>23.72.119</td> 
   <td align="center">09.08.2006 </td> 
   <td>no virus found</td> 
  </tr> 
  <tr> 
   <td>eTrust-Vet</td> 
   <td>30.3.3068</td> 
   <td align="center">09.08.2006 </td> 
   <td>no virus found</td> 
  </tr> 
  <tr> 
   <td>Ewido</td> 
   <td>4.0</td> 
   <td align="center">09.05.2006 </td> 
   <td>no virus found</td> 
  </tr> 
  <tr> 
   <td>Fortinet</td> 
   <td>2.77.0.0</td> 
   <td align="center">09.07.2006 </td> 
   <td>no virus found</td> 
  </tr> 
  <tr> 
   <td>F-Prot</td> 
   <td>3.16f</td> 
   <td align="center">09.08.2006 </td> 
   <td>no virus found</td> 
  </tr> 
  <tr> 
   <td>F-Prot4</td> 
   <td>4.2.1.29</td> 
   <td align="center">09.07.2006 </td> 
   <td>no virus found</td> 
  </tr> 
  <tr> 
   <td>Ikarus</td> 
   <td>0.2.65.0</td> 
   <td align="center">09.08.2006 </td> 
   <td>no virus found</td> 
  </tr> 
  <tr> 
   <td>Kaspersky</td> 
   <td>4.0.2.24</td> 
   <td align="center">09.08.2006 </td> 
   <td>no virus found</td> 
  </tr> 
  <tr> 
   <td>McAfee</td> 
   <td>4847</td> 
   <td align="center">09.07.2006 </td> 
   <td>no virus found</td> 
  </tr> 
  <tr> 
   <td>Microsoft</td> 
   <td>1.1560</td> 
   <td align="center">09.08.2006 </td> 
   <td>no virus found</td> 
  </tr> 
  <tr> 
   <td>NOD32v2</td> 
   <td>1.1745</td> 
   <td align="center">09.08.2006 </td> 
   <td>no virus found</td> 
  </tr> 
  <tr> 
   <td>Norman</td> 
   <td>5.90.23</td> 
   <td align="center">09.08.2006 </td> 
   <td>no virus found</td> 
  </tr> 
  <tr> 
   <td>Panda</td> 
   <td>9.0.0.4</td> 
   <td align="center">09.07.2006 </td> 
   <td>no virus found</td> 
  </tr> 
  <tr> 
   <td>Sophos</td> 
   <td>4.09.0</td> 
   <td align="center">09.08.2006 </td> 
   <td>no virus found</td> 
  </tr> 
  <tr> 
   <td>Symantec</td> 
   <td>8.0</td> 
   <td align="center">09.08.2006 </td> 
   <td>no virus found</td> 
  </tr> 
  <tr> 
   <td>TheHacker</td> 
   <td>5.9.8.208</td> 
   <td align="center">09.08.2006 </td> 
   <td>no virus found</td> 
  </tr> 
  <tr> 
   <td>UNA</td> 
   <td>1.83</td> 
   <td align="center">09.07.2006 </td> 
   <td>no virus found</td> 
  </tr> 
  <tr> 
   <td>VBA32</td> 
   <td>3.11.1</td> 
   <td align="center">09.07.2006 </td> 
   <td>no virus found</td> 
  </tr> 
  <tr> 
   <td>VirusBuster</td> 
   <td>4.3.7:9</td> 
   <td align="center">09.08.2006 </td> 
   <td>no virus found</td> 
  </tr> 
 </tbody> 
</table>

<table> 
 <thead> 
  <tr> 
   <td><span style="TEXT-DECORATION: underline">Aditional Information</span></td> 
  </tr> 
 </thead> 
 <tbody> 
  <tr> 
   <td>File size: 233472 bytes</td> 
  </tr> 
  <tr> 
   <td>MD5: 7efdae2d9d17d52d855cf6560a21b906</td> 
  </tr> 
  <tr> 
   <td>SHA1: 831369c5aa26360b9ace5ec8eea51d77c97968d4</td> 
  </tr> 
 </tbody> 
</table>

[http_bars.duole8.com]: http://bars.duole8.com/