u88连锁加盟店网自动安装，删了重开机又出现，请各位大虾帮帮忙！ bbs.ikaka.com

0van0 - 2005-11-26 11:46:00

Logfile of HijackThis v1.99.1
Scan saved at 11:45:34, on 2005-11-26
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\zsxz\UrlService.exe
C:\Program Files\P4P\p2psvr.exe
C:\PROGRAM FILES\RISING\RAV\CCENTER.EXE
C:\Program Files\zsxz\IEUrldrive.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\PROGRA~1\RISING\RAV\RAVTIMER.EXE
C:\Program Files\Ringz Studio\Storm Downloader\StormDownloader.exe
C:\WINDOWS\system32\conime.exe
C:\PROGRAM FILES\RISING\RAV\Ravmond.exe
C:\PROGRAM FILES\RISING\RAV\RavStub.exe
c:\program files\rising\rav\RAVMON.EXE
C:\WINDOWS\system32\regsvr32.exe
C:\Program Files\ChinaNet\VnetClient.exe
C:\WINDOWS\explorer.exe
F:\HijackThis.exe

R3 - Default URLSearchHook is missing
O2 - BHO: ThunderIEHelper Class - {0005A87D-D626-4B3A-84F9-1D9571695F55} - C:\WINDOWS\system32\xunleibho_v4.dll
O2 - BHO: yPhtb - {33BBE430-0E42-4f12-B075-8D21ACB10DCB} - C:\Program Files\Yahoo!\Assistant\Assist\yphtb.dll
O2 - BHO: (no name) - {35980F6E-A137-4E50-953D-813BB8556899} - (no file)
O2 - BHO: QQBrowserHelperObject Class - {54EBD53A-9BC1-480B-966A-843A333CA162} - C:\Program Files\Tencent\QQ\QQIEHelper.dll
O2 - BHO: YDragSearch - {62EED7C6-9F02-42f9-B634-98E2899E147B} - C:\PROGRA~1\Yahoo!\ASSIST~1\Assist\YDRAGS~1.DLL
O2 - BHO: std software - {6A512BF7-EC78-4e8d-9841-6C02E8FA9838} - C:\WINDOWS\SYSTEM32\stdup.dll (file missing)
O2 - BHO: EyeOnIE Class - {6E28339B-7A2A-47B6-AEB2-46BA53782379} - C:\PROGRA~1\PCDOWN~1\BhoPlugin.dll
O2 - BHO: CBHelper Object - {8A4280AD-9B37-4922-A51D-73F3C3A32AF7} - C:\WINDOWS\system32\msibm\cfsbho.dll
O2 - BHO: IeCatch2 Class - {A5366673-E8CA-11D3-9CD9-0090271D075B} - C:\PROGRA~1\flashget\jccatch.dll
O2 - BHO: (no name) - {A9930D97-9CF0-42A0-A10D-4F28836579D5} - C:\PROGRA~1\KuGoo2\KUGOO3~1.OCX
O2 - BHO: T2BHO Class - {B1D147E7-873E-4909-8127-695D9BB78728} - C:\WINDOWS\Downloaded Program Files\barhelp22.0.dll (file missing)
O2 - BHO: CAP Class - {B8CCDD47-38E4-4CD2-B7FA-3B4B690F74BD} - C:\WINDOWS\system32\dtap.dll
O3 - Toolbar: 卡卡上网安全助手 - {DB9ECD4F-FB8F-4311-B3CE-90B976C2707C} - C:\WINDOWS\system32\kakatool.dll
O4 - HKLM\..\Run: [DTService] rundll32.exe C:\DOCUME~1\Admin\LOCALS~1\Temp\RarSFX0\DTSERV~1.DLL,Load
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [RavTimer] C:\PROGRA~1\RISING\RAV\RAVTIMER.EXE
O4 - HKLM\..\Run: [RavMon] C:\PROGRA~1\RISING\RAV\RAVMON.EXE -SYSTEM
O4 - HKLM\..\Run: [MINI_BFYY] C:\Program Files\Ringz Studio\Storm Downloader\StormDownloader.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [升级程序] C:\Program Files\Internet Explorer\2052\aupdate.exe
O9 - Extra button: (no name) - {3FFD59AA-280D-4AB3-B420-0CFF2B332316} - C:\WINDOWS\system32\shdocvw.dll
O9 - Extra button: (no name) - {9239E4EC-C9A6-11D2-A844-00C04F68D538} - (no file)
O16 - DPF: {1ADC22CE-11CF-4BE4-B7EF-0B4E23E60A46} - http://www.dplab.com.cn/xp/install/album/setup.cab
O16 - DPF: {2BFAA61B-5C83-4865-8281-D8BDBF863061} (PGEdit Class) - https://www.gnetpg.com/PG_ATL.cab
O16 - DPF: {3D8F74EE-8692-4F8F-B8D2-7522E732519E} (WebActivater Control) - http://game.qq.com/QQGame2.cab
O16 - DPF: {488A4255-3236-44B3-8F27-FA1AECAA8844} (CEditCtrl Object) - https://img.alipay.com/download/aliedit.cab
O16 - DPF: {73E4740C-08EB-4133-896B-8D0A7C9EE3CD} (AxInputControl Class) - https://mybank.icbc.com.cn/icbc/perbank/AxSafeControls.cab
O16 - DPF: {9A578C98-3C2F-4630-890B-FC04196EF420} - http://jump.cnnic.cn/stat/stat?sid=0008&debug=false&pid=c_95p&url=http://client.jogo.cn/download/cnnic/cdn.cab
O16 - DPF: {DE3496D2-AFB9-47EB-A8C2-C3B330222513} (PhotoUpload Control) - http://www.photo.163.com/PhotoUpload.cab
O16 - DPF: {E4E2F180-CB8B-4DE9-ACBB-DA745D3BA153} (Rising Web Scan Object) - http://download.rising.com.cn/register/pcver/autoupgradepad/Ver2005/OL2005.cab
O16 - DPF: {EF6205C1-3F17-4829-BCB5-1336ED89E356} (KvScanOnline Control) - http://club.jiangmin.com/kvscan/KvDown.cab
O16 - DPF: {F138084D-84D7-48CD-BEA8-04772457516E} (VqqSpeedDlProxy Class) - http://218.85.138.27/vqqsdl1009.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{D4A6CF05-E8A2-4ACE-AEA2-D345CEDC9882}: NameServer = 202.96.128.86 61.144.56.101
O23 - Service: Event Client - Unknown owner - C:\Program Files\zsxz\UrlService.exe
O23 - Service: P4P Service - Sohu.com Inc. - C:\Program Files\P4P\p2psvr.exe
O23 - Service: Rising Process Communication Center (RsCCenter) - rising - C:\PROGRAM FILES\RISING\RAV\CCENTER.EXE
O23 - Service: RsRavMon Service (RsRavMon) - Beijing Rising Technology Co., Ltd. - C:\PROGRAM FILES\RISING\RAV\Ravmond.exe

天使之剑 - 2005-11-26 12:01:00

【回复“0van0”的帖子】

重新启动至安全模式，关闭所有不必要的窗口，使用HijackThis扫描后修复（在需要修复的项目前面打对勾，然后按“Fix checked”或“修复”，修复前会询问您是否需要备份，请选择“Yes”或“是”）：
R3 - Default URLSearchHook is missing
O2 - BHO: (no name) - {35980F6E-A137-4E50-953D-813BB8556899} - (no file)
O2 - BHO: std software - {6A512BF7-EC78-4e8d-9841-6C02E8FA9838} - C:\WINDOWS\SYSTEM32\stdup.dll (file missing)

使用下面的两个多引擎扫描器扫描下列文件：
C:\Program Files\zsxz\UrlService.exe
C:\PROGRA~1\PCDOWN~1\BhoPlugin.dll
C:\WINDOWS\system32\dtap.dll
C:\WINDOWS\system32\msibm\cfsbho.dll
多引擎扫描之Virustotal：

http://www.virustotal.com/
多引擎扫描之Jotti：

http://virusscan.jotti.org/

请务必将报告贴全。
以上建议仅供参考，如果您认识其中的一些设置抑或是您的手动设置，就不必执行。

0van0 - 2005-11-26 13:18:00

File: UrlService.exe
Status: INFECTED/MALWARE
MD5 d95bbcd826e2e734e187b31437baf3ec
Packers detected: -
Scanner results
AntiVir Found nothing
ArcaVir Found nothing
Avast Found nothing
AVG Antivirus Found nothing
BitDefender Found nothing
ClamAV Found nothing
Dr.Web Found Adware.Msearch
F-Prot Antivirus Found nothing
Fortinet Found nothing
Kaspersky Anti-Virus Found nothing
NOD32 Found nothing
Norman Virus Control Found nothing
UNA Found nothing
VBA32 Found nothing

0van0 - 2005-11-26 13:19:00

This is a report processed by VirusTotal on 11/26/2005 at 06:16:31 (CET) after scanning the file "BhoPlugin.dll" file.
Antivirus Version Update Result
AntiVir 6.32.0.6 11.25.2005 no virus found
Avast 4.6.695.0 11.26.2005 no virus found
AVG 718 11.25.2005 no virus found
Avira 6.32.0.6 11.25.2005 no virus found
BitDefender 7.2 11.26.2005 no virus found
CAT-QuickHeal 8.00 11.25.2005 no virus found
ClamAV devel-20051108 11.25.2005 no virus found
DrWeb 4.33 11.25.2005 no virus found
eTrust-Iris 7.1.194.0 11.24.2005 no virus found
eTrust-Vet 11.9.1.0 11.25.2005 no virus found
Fortinet 2.48.0.0 11.25.2005 no virus found
F-Prot 3.16c 11.24.2005 no virus found
Ikarus 0.2.59.0 11.26.2005 no virus found
Kaspersky 4.0.2.24 11.26.2005 no virus found
McAfee 4637 11.25.2005 no virus found
NOD32v2 1.1305 11.25.2005 no virus found
Norman 5.70.10 11.25.2005 no virus found
Panda 8.02.00 11.25.2005 no virus found
Sophos 3.99.0 11.26.2005 no virus found
Symantec 8.0 11.26.2005 no virus found
TheHacker 5.9.1.044 11.24.2005 no virus found
VBA32 3.10.5 11.26.2005 no virus found

0van0 - 2005-11-26 13:20:00

This is a report processed by VirusTotal on 11/26/2005 at 06:22:12 (CET) after scanning the file "UrlService.exe" file.
Antivirus Version Update Result
AntiVir 6.32.0.6 11.25.2005 no virus found
Avast 4.6.695.0 11.26.2005 no virus found
AVG 718 11.25.2005 no virus found
Avira 6.32.0.6 11.25.2005 no virus found
BitDefender 7.2 11.26.2005 no virus found
CAT-QuickHeal 8.00 11.25.2005 no virus found
ClamAV devel-20051108 11.25.2005 no virus found
DrWeb 4.33 11.25.2005 no virus found
eTrust-Iris 7.1.194.0 11.24.2005 no virus found
eTrust-Vet 11.9.1.0 11.25.2005 no virus found
Fortinet 2.48.0.0 11.25.2005 no virus found
F-Prot 3.16c 11.24.2005 no virus found
Ikarus 0.2.59.0 11.26.2005 no virus found
Kaspersky 4.0.2.24 11.26.2005 no virus found
McAfee 4637 11.25.2005 no virus found
NOD32v2 1.1305 11.25.2005 no virus found
Norman 5.70.10 11.25.2005 no virus found
Panda 8.02.00 11.25.2005 no virus found
Sophos 3.99.0 11.26.2005 no virus found
Symantec 8.0 11.26.2005 no virus found
TheHacker 5.9.1.044 11.24.2005 no virus found
VBA32 3.10.5 11.26.2005 no virus found

0van0 - 2005-11-26 13:21:00

File: BhoPlugin.dll
Status: OK
MD5 0149bb1f64fcd6fe0ab72cef0ce3c1fb
Packers detected: -
Scanner results
AntiVir Found nothing
ArcaVir Found nothing
Avast Found nothing
AVG Antivirus Found nothing
BitDefender Found nothing
ClamAV Found nothing
Dr.Web Found nothing
F-Prot Antivirus Found nothing
Fortinet Found nothing
Kaspersky Anti-Virus Found nothing
NOD32 Found nothing
Norman Virus Control Found nothing
UNA Found nothing
VBA32 Found nothing

0van0 - 2005-11-26 13:25:00

This is a report processed by VirusTotal on 11/26/2005 at 06:24:34 (CET) after scanning the file "dtap.dll" file.
Antivirus Version Update Result
AntiVir 6.32.0.6 11.25.2005 no virus found
Avast 4.6.695.0 11.26.2005 no virus found
AVG 718 11.25.2005 no virus found
Avira 6.32.0.6 11.25.2005 no virus found
BitDefender 7.2 11.26.2005 no virus found
CAT-QuickHeal 8.00 11.25.2005 no virus found
ClamAV devel-20051108 11.25.2005 no virus found
DrWeb 4.33 11.25.2005 no virus found
eTrust-Iris 7.1.194.0 11.24.2005 no virus found
eTrust-Vet 11.9.1.0 11.25.2005 no virus found
Fortinet 2.48.0.0 11.25.2005 no virus found
F-Prot 3.16c 11.24.2005 no virus found
Ikarus 0.2.59.0 11.26.2005 no virus found
Kaspersky 4.0.2.24 11.26.2005 no virus found
McAfee 4637 11.25.2005 no virus found
NOD32v2 1.1305 11.25.2005 no virus found
Norman 5.70.10 11.25.2005 no virus found
Panda 8.02.00 11.25.2005 no virus found
Sophos 3.99.0 11.26.2005 no virus found
Symantec 8.0 11.26.2005 no virus found
TheHacker 5.9.1.044 11.24.2005 no virus found
VBA32 3.10.5 11.26.2005 no virus found

------------------------------

File: dtap.dll
Status: OK
MD5 383519b577916cbc787df409e81771f2
Packers detected: -
Scanner results
AntiVir Found nothing
ArcaVir Found nothing
Avast Found nothing
AVG Antivirus Found nothing
BitDefender Found nothing
ClamAV Found nothing
Dr.Web Found nothing
F-Prot Antivirus Found nothing
Fortinet Found nothing
Kaspersky Anti-Virus Found nothing
NOD32 Found nothing
Norman Virus Control Found nothing
UNA Found nothing
VBA32 Found nothing

sanadayukimura - 2005-11-26 13:26:00

【回复“0van0”的帖子】

楼主做得很好，能将后面两个文件的报告也贴上来吗？还有下面这个文件也麻烦扫描下：
C:\Program Files\Internet Explorer\2052\aupdate.exe
谢谢配合。

0van0 - 2005-11-26 13:27:00

This is a report processed by VirusTotal on 11/26/2005 at 06:26:21 (CET) after scanning the file "cfsbho.dll" file.
Antivirus Version Update Result
AntiVir 6.32.0.6 11.25.2005 no virus found
Avast 4.6.695.0 11.26.2005 no virus found
AVG 718 11.25.2005 no virus found
Avira 6.32.0.6 11.25.2005 no virus found
BitDefender 7.2 11.26.2005 no virus found
CAT-QuickHeal 8.00 11.25.2005 no virus found
ClamAV devel-20051108 11.25.2005 no virus found
DrWeb 4.33 11.25.2005 no virus found
eTrust-Iris 7.1.194.0 11.24.2005 no virus found
eTrust-Vet 11.9.1.0 11.25.2005 no virus found
Fortinet 2.48.0.0 11.25.2005 no virus found
F-Prot 3.16c 11.24.2005 no virus found
Ikarus 0.2.59.0 11.26.2005 no virus found
Kaspersky 4.0.2.24 11.26.2005 no virus found
McAfee 4637 11.25.2005 no virus found
NOD32v2 1.1305 11.25.2005 no virus found
Norman 5.70.10 11.25.2005 no virus found
Panda 8.02.00 11.25.2005 no virus found
Sophos 3.99.0 11.26.2005 no virus found
Symantec 8.0 11.26.2005 no virus found
TheHacker 5.9.1.044 11.24.2005 no virus found
VBA32 3.10.5 11.26.2005 no virus found

------------------------------------------------------

File: cfsbho.dll
Status: OK
MD5 f967f2d1ae78ae5b5008dc6de13682b7
Packers detected: -
Scanner results
AntiVir Found nothing
ArcaVir Found nothing
Avast Found nothing
AVG Antivirus Found nothing
BitDefender Found nothing
ClamAV Found nothing
Dr.Web Found nothing
F-Prot Antivirus Found nothing
Fortinet Found nothing
Kaspersky Anti-Virus Found nothing
NOD32 Found nothing
Norman Virus Control Found nothing
UNA Found nothing
VBA32 Found nothing

天使之剑 - 2005-11-26 13:33:00

【回复“0van0”的帖子】

重新启动至安全模式，关闭所有不必要的窗口，使用HijackThis扫描后修复（在需要修复的项目前面打对勾，然后按“Fix checked”或“修复”，修复前会询问您是否需要备份，请选择“Yes”或“是”）：
O23 - Service: Event Client - Unknown owner - C:\Program Files\zsxz\UrlService.exe
显示隐藏文件和系统文件，删除（如果存在的话）：
C:\Program Files\zsxz文件夹
待修复完成，如果问题依旧，请继续跟帖说明情况。

使用下面的两个多引擎扫描器扫描下列文件：
C:\Program Files\Internet Explorer\2052\aupdate.exe
多引擎扫描之Virustotal：

http://www.virustotal.com/
多引擎扫描之Jotti：

http://virusscan.jotti.org/

请务必将报告贴全。
以上建议仅供参考，如果您认识其中的一些设置抑或是您的手动设置，就不必执行。

0van0 - 2005-11-26 13:45:00

顺便问句：我的电脑在安全模式中鼠标不能用，正常吗？

天使之剑 - 2005-11-26 13:51:00

【回复“0van0”的帖子】

不太正常哦……
请先尝试修复工作，鼠标的问题先搁置一下好吗？可以先在普通模式下进行修复工作。

0van0 - 2005-11-26 14:28:00

This is a report processed by VirusTotal on 11/26/2005 at 07:24:24 (CET) after scanning the file "aupdate.exe" file.
Antivirus Version Update Result
AntiVir 6.32.0.6 11.25.2005 no virus found
Avast 4.6.695.0 11.26.2005 no virus found
AVG 718 11.25.2005 no virus found
Avira 6.32.0.6 11.25.2005 no virus found
BitDefender 7.2 11.26.2005 no virus found
CAT-QuickHeal 8.00 11.25.2005 no virus found
ClamAV devel-20051108 11.25.2005 no virus found
DrWeb 4.33 11.25.2005 no virus found
eTrust-Iris 7.1.194.0 11.24.2005 no virus found
eTrust-Vet 11.9.1.0 11.25.2005 no virus found
Fortinet 2.48.0.0 11.25.2005 no virus found
F-Prot 3.16c 11.24.2005 no virus found
Ikarus 0.2.59.0 11.26.2005 no virus found
Kaspersky 4.0.2.24 11.26.2005 no virus found
McAfee 4637 11.25.2005 no virus found
NOD32v2 1.1305 11.25.2005 no virus found
Norman 5.70.10 11.25.2005 no virus found
Panda 8.02.00 11.25.2005 no virus found
Sophos 3.99.0 11.26.2005 no virus found
Symantec 8.0 11.26.2005 no virus found
TheHacker 5.9.1.044 11.24.2005 no virus found
VBA32 3.10.5 11.26.2005 no virus found

-------------------------------------------

File: aupdate.exe
Status: OK (Note: this file has been scanned before. Therefore, this file's scan results will not be stored in the database)
MD5 78e50dea3bf2b9632a627aad20e5bcca
Packers detected: -
Scanner results
AntiVir Found nothing
ArcaVir Found nothing
Avast Found nothing
AVG Antivirus Found nothing
BitDefender Found nothing
ClamAV Found nothing
Dr.Web Found nothing
F-Prot Antivirus Found nothing
Fortinet Found nothing
Kaspersky Anti-Virus Found nothing
NOD32 Found nothing
Norman Virus Control Found nothing
UNA Found nothing
VBA32 Found nothing

0van0 - 2005-11-26 14:32:00

已完成以下操作：
重新启动至安全模式，关闭所有不必要的窗口，使用HijackThis扫描后修复（在需要修复的项目前面打对勾，然后按“Fix checked”或“修复”，修复前会询问您是否需要备份，请选择“Yes”或“是”）：
O23 - Service: Event Client - Unknown owner - C:\Program Files\zsxz\UrlService.exe
显示隐藏文件和系统文件，删除（如果存在的话）：
C:\Program Files\zsxz文件夹

--------------------------------------
但重开机，还是会弹出网页，给卡卡助手拦住了，说是不良网页，就没显示网页地址

天使之剑 - 2005-11-26 14:35:00

【回复“0van0”的帖子】

请贴出新扫描的HijackThis日志，谢谢。

0van0 - 2005-11-26 14:45:00

Logfile of HijackThis v1.99.1
Scan saved at 14:44:28, on 2005-11-26
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\PROGRAM FILES\RISING\RAV\Ravmond.exe
C:\PROGRAM FILES\RISING\RAV\RavStub.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\PROGRA~1\RISING\RAV\RAVTIMER.EXE
C:\PROGRA~1\RISING\RAV\RAVMON.EXE
C:\Program Files\Ringz Studio\Storm Downloader\StormDownloader.exe
C:\Program Files\P4P\p2psvr.exe
C:\PROGRAM FILES\RISING\RAV\CCENTER.EXE
C:\WINDOWS\system32\svchost.exe
C:\Program Files\ChinaNet\VnetClient.exe
C:\Program Files\BitComet\BitComet.exe
F:\HijackThis\HijackThis.exe

O2 - BHO: ThunderIEHelper Class - {0005A87D-D626-4B3A-84F9-1D9571695F55} - C:\WINDOWS\system32\xunleibho_v4.dll
O2 - BHO: yPhtb - {33BBE430-0E42-4f12-B075-8D21ACB10DCB} - C:\Program Files\Yahoo!\Assistant\Assist\yphtb.dll (file missing)
O2 - BHO: QQBrowserHelperObject Class - {54EBD53A-9BC1-480B-966A-843A333CA162} - C:\Program Files\Tencent\QQ\QQIEHelper.dll
O2 - BHO: YDragSearch - {62EED7C6-9F02-42f9-B634-98E2899E147B} - C:\PROGRA~1\Yahoo!\ASSIST~1\Assist\YDRAGS~1.DLL (file missing)
O2 - BHO: EyeOnIE Class - {6E28339B-7A2A-47B6-AEB2-46BA53782379} - C:\PROGRA~1\PCDOWN~1\BhoPlugin.dll
O2 - BHO: CBHelper Object - {8A4280AD-9B37-4922-A51D-73F3C3A32AF7} - C:\WINDOWS\system32\msibm\cfsbho.dll
O2 - BHO: IeCatch2 Class - {A5366673-E8CA-11D3-9CD9-0090271D075B} - C:\PROGRA~1\flashget\jccatch.dll
O2 - BHO: (no name) - {A9930D97-9CF0-42A0-A10D-4F28836579D5} - C:\PROGRA~1\KuGoo2\KUGOO3~1.OCX
O2 - BHO: T2BHO Class - {B1D147E7-873E-4909-8127-695D9BB78728} - C:\WINDOWS\Downloaded Program Files\barhelp22.0.dll (file missing)
O2 - BHO: CAP Class - {B8CCDD47-38E4-4CD2-B7FA-3B4B690F74BD} - C:\WINDOWS\system32\dtap.dll
O3 - Toolbar: 卡卡上网安全助手 - {DB9ECD4F-FB8F-4311-B3CE-90B976C2707C} - C:\WINDOWS\system32\kakatool.dll
O4 - HKLM\..\Run: [DTService] rundll32.exe C:\DOCUME~1\Admin\LOCALS~1\Temp\RarSFX0\DTSERV~1.DLL,Load
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [RavTimer] C:\PROGRA~1\RISING\RAV\RAVTIMER.EXE
O4 - HKLM\..\Run: [RavMon] C:\PROGRA~1\RISING\RAV\RAVMON.EXE -SYSTEM
O4 - HKLM\..\Run: [MINI_BFYY] C:\Program Files\Ringz Studio\Storm Downloader\StormDownloader.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [升级程序] C:\Program Files\Internet Explorer\2052\aupdate.exe
O8 - Extra context menu item: &使用暴风下载器下载 - C:\Program Files\Ringz Studio\Storm Downloader\geturl.htm
O9 - Extra button: (no name) - {3FFD59AA-280D-4AB3-B420-0CFF2B332316} - C:\WINDOWS\system32\shdocvw.dll
O9 - Extra button: (no name) - {9239E4EC-C9A6-11D2-A844-00C04F68D538} - (no file)
O16 - DPF: {1ADC22CE-11CF-4BE4-B7EF-0B4E23E60A46} - http://www.dplab.com.cn/xp/install/album/setup.cab
O16 - DPF: {2BFAA61B-5C83-4865-8281-D8BDBF863061} (PGEdit Class) - https://www.gnetpg.com/PG_ATL.cab
O16 - DPF: {3D8F74EE-8692-4F8F-B8D2-7522E732519E} (WebActivater Control) - http://game.qq.com/QQGame2.cab
O16 - DPF: {488A4255-3236-44B3-8F27-FA1AECAA8844} (CEditCtrl Object) - https://img.alipay.com/download/aliedit.cab
O16 - DPF: {73E4740C-08EB-4133-896B-8D0A7C9EE3CD} (AxInputControl Class) - https://mybank.icbc.com.cn/icbc/perbank/AxSafeControls.cab
O16 - DPF: {9A578C98-3C2F-4630-890B-FC04196EF420} - http://jump.cnnic.cn/stat/stat?sid=0008&debug=false&pid=c_95p&url=http://client.jogo.cn/download/cnnic/cdn.cab
O16 - DPF: {DE3496D2-AFB9-47EB-A8C2-C3B330222513} (PhotoUpload Control) - http://www.photo.163.com/PhotoUpload.cab
O16 - DPF: {E4E2F180-CB8B-4DE9-ACBB-DA745D3BA153} (Rising Web Scan Object) - http://download.rising.com.cn/register/pcver/autoupgradepad/Ver2005/OL2005.cab
O16 - DPF: {EF6205C1-3F17-4829-BCB5-1336ED89E356} (KvScanOnline Control) - http://club.jiangmin.com/kvscan/KvDown.cab
O16 - DPF: {F138084D-84D7-48CD-BEA8-04772457516E} (VqqSpeedDlProxy Class) - http://218.85.138.27/vqqsdl1009.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{D4A6CF05-E8A2-4ACE-AEA2-D345CEDC9882}: NameServer = 202.96.128.86 61.144.56.101
O23 - Service: P4P Service - Sohu.com Inc. - C:\Program Files\P4P\p2psvr.exe
O23 - Service: Rising Process Communication Center (RsCCenter) - rising - C:\PROGRAM FILES\RISING\RAV\CCENTER.EXE
O23 - Service: RsRavMon Service (RsRavMon) - Beijing Rising Technology Co., Ltd. - C:\PROGRAM FILES\RISING\RAV\Ravmond.exe

天使之剑 - 2005-11-26 14:49:00

【回复“0van0”的帖子】

清空IE临时文件。关闭所有不必要的窗口，使用HijackThis扫描后修复（在需要修复的项目前面打对勾，然后按“Fix checked”或“修复”，修复前会询问您是否需要备份，请选择“Yes”或“是”）：
O2 - BHO: T2BHO Class - {B1D147E7-873E-4909-8127-695D9BB78728} - C:\WINDOWS\Downloaded Program Files\barhelp22.0.dll (file missing)
O9 - Extra button: (no name) - {3FFD59AA-280D-4AB3-B420-0CFF2B332316} - C:\WINDOWS\system32\shdocvw.dll
O9 - Extra button: (no name) - {9239E4EC-C9A6-11D2-A844-00C04F68D538} - (no file)
O16 - DPF: {9A578C98-3C2F-4630-890B-FC04196EF420} - http://jump.cnnic.cn/stat/stat?sid=0008&debug=false&pid=c_95p&url=http://client.jogo.cn/download/cnnic/cdn.cab
O16 - DPF: {F138084D-84D7-48CD-BEA8-04772457516E} (VqqSpeedDlProxy Class) - http://218.85.138.27/vqqsdl1009.cab
显示隐藏文件和系统文件，删除（如果存在的话）：
C:\WINDOWS\system32\shdocvw.dll
待修复完成，如果问题依旧，请继续跟帖说明情况。
以上建议仅供参考，如果您认识其中的一些设置抑或是您的手动设置，就不必执行。

0van0 - 2005-11-26 15:17:00

已全部窗口关闭，C:\WINDOWS\system32\shdocvw.dll
存在，但删除不了，说拒绝访问。
在安全模式删也一样

“u88连锁加盟店”也还在右键菜单
如果启动项有勾：aupdate，开机还是会弹出http://www.u88.cn/shortcut/u88shortcut.htm

非典患者 - 2006-8-21 16:14:00

Logfile of HijackThis v1.99.1
Scan saved at 14:26:10, on 2006-8-21
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\drivers\CDAC11BA.EXE
C:\Program Files\SAV\DefWatch.exe
C:\WINDOWS\system32\CBA\pds.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\SAV\Rtvscan.exe
C:\WINDOWS\system32\Rundll32.exe
C:\WINDOWS\system32\wdfmgr.exe
C:\WINDOWS\System32\alg.exe
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\System32\svchost.exe
E:\QQ\QQ.exe
C:\Program Files\Tencent\QQ\TMDlls\TIMPlatform.exe
C:\Program Files\Maxthon\Maxthon.exe
C:\Documents and Settings\dsd\桌面\hijackthis\HijackThis.exe
C:\Program Files\Kingsoft\FastAIT 2005\FastAIT.exe

R3 - URLSearchHook: (no name) - {BB936323-19FA-4521-BA29-ECA6A121BC78} - (no file)
O2 - BHO: dddmont Class - {00018593-C6BD-46F7-9349-DBA1AA674C90} - C:\Program Files\DuDu\Speed\dddiemon.dll
O2 - BHO: xBarHelper.MoveCatchPic - {0CF098A0-CBAC-4EFB-8451-3AFC201C7222} - C:\Program Files\xBar\xBarHelper.dll
O2 - BHO: YDragSearch - {62EED7C6-9F02-42f9-B634-98E2899E147B} - C:\PROGRA~1\Yahoo!\ASSIST~1\Assist\YDRAGS~1.DLL (file missing)
O2 - BHO: IeCatch2 Class - {A5366673-E8CA-11D3-9CD9-0090271D075B} - C:\PROGRA~1\FLASHGET\jccatch.dll
O2 - BHO: (no name) - {A9930D97-9CF0-42A0-A10D-4F28836579D5} - C:\PROGRA~1\KuGoo3\KUGOO3~1.OCX
O2 - BHO: IEHlprObj Class - {C5E5DB7E-46B1-47E6-8447-2E517F269925} - C:\Program Files\Xplus\GETIE.dll (file missing)
O2 - BHO: IE - {D157330A-9EF3-49F8-9A67-4141AC41ADD4} - C:\WINDOWS\DOWNLO~1\CnsHook.dll
O2 - BHO: (no name) - {E16BB625-16F1-4338-AA38-098F6873AC24} - (no file)
O3 - Toolbar: FlashGet Bar - {E0E899AB-F487-11D5-8D29-0050BA6940E3} - C:\PROGRA~1\FLASHGET\fgiebar.dll
O3 - Toolbar: 金山快译(&K) - {6C3797D2-3FEF-4cd4-B654-D3AE55B4128C} - C:\Program Files\Kingsoft\FastAIT 2005\IEBand.dll
O3 - Toolbar: &u88连锁加盟网 - {3FFD59AA-280D-4AB3-B420-0CFF2B332316} - C:\Program Files\Internet Explorer\2052\WebBand.dll
O4 - HKLM\..\Run: [CnsMin] Rundll32.exe C:\WINDOWS\DOWNLO~1\CnsMin.dll,Rundll32
O4 - HKLM\..\RunServices: [services] C:\WINDOWS\services.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [KavPFW] "C:\KAV2005\KAVPFW.exe"
O4 - HKCU\..\RunServices: [services] C:\WINDOWS\services.exe
O8 - Extra context menu item: &使用DuDu下载 - res://C:\Program Files\DuDu\Speed\dddmext.dll/202
O8 - Extra context menu item: &使用DuDu下载全部链接 - res://C:\Program Files\DuDu\Speed\dddmext.dll/203
O8 - Extra context menu item: &使用DuDu下载选择链接 - res://C:\Program Files\DuDu\Speed\dddmext.dll/204
O8 - Extra context menu item: Google 搜索(&G) - res://c:\program files\google\GoogleToolbar1.dll/cmsearch.html
O8 - Extra context menu item: U88连锁加盟网 - c:\Program Files\Internet Explorer\2052\contextmenu.htm
O8 - Extra context menu item: 使用KuGoo3下载(&K) - C:\Program Files\KuGoo3\KuGoo3DownX.htm
O8 - Extra context menu item: 使用网际快车下载 - C:\Program Files\FlashGet\jc_link.htm
O8 - Extra context menu item: 使用网际快车下载全部链接 - C:\Program Files\FlashGet\jc_all.htm
O8 - Extra context menu item: 反向链接 - res://c:\program files\google\GoogleToolbar1.dll/cmbacklinks.html
O8 - Extra context menu item: 发送到手机 - C:\Program Files\xBar\xBar.htm
O8 - Extra context menu item: 类似网页 - res://c:\program files\google\GoogleToolbar1.dll/cmsimilar.html
O8 - Extra context menu item: 缓存的网页快照 - res://c:\program files\google\GoogleToolbar1.dll/cmcache.html
O8 - Extra context menu item: 翻译英文字词(&T) - res://c:\program files\google\GoogleToolbar1.dll/cmwordtrans.html
O9 - Extra button: 免费精彩视频超流畅在线观看 - {022C4009-5283-4365-97BF-144054B40E2E} - http://itv.mop.com (file missing)
O9 - Extra 'Tools' menuitem: 播霸电视 - {022C4009-5283-4365-97BF-144054B40E2E} - http://itv.mop.com (file missing)
O9 - Extra button: (no name) - {3FFD59AA-280D-4AB3-B420-0CFF2B332316} - C:\WINDOWS\system32\shdocvw.dll
O9 - Extra button: Yahoo 1G电邮 - {507F9113-CD77-4866-BA92-0E86DA3D0B97} - http://cn.zs.yahoo.com/cnsbutton.htm?source=cns&btn=yahoomail (file missing)
O9 - Extra button: 寻宝乐趣多 - {59BC54A2-56B3-44a0-93E5-432D58746E26} - http://cn.zs.yahoo.com/cnsbutton.htm?source=cns&btn=taobao (file missing)
O9 - Extra button: 雅虎助手 - {5D73EE86-05F1-49ed-B850-E423120EC338} - http://cn.zs.yahoo.com/cnsbutton.htm?source=cns&btn=yassist (file missing)
O9 - Extra button: (no name) - {9239E4EC-C9A6-11D2-A844-00C04F68D538} - (no file)
O9 - Extra button: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\PROGRA~1\FLASHGET\flashget.exe
O9 - Extra 'Tools' menuitem: &FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\PROGRA~1\FLASHGET\flashget.exe
O9 - Extra button: 情景聊天 - {E5D12C4E-7B4F-11D3-B5C9-0050045C3C96} - http://cn.zs.yahoo.com/cnsbutton.htm?source=cns&btn=yahoomsg (file missing)
O9 - Extra button: (no name) - {ECF2E268-F28C-48d2-9AB7-8F69C11CCB71} - http://cn.zs.yahoo.com/cnsbutton.htm?source=cns&btn=repair (file missing)
O9 - Extra 'Tools' menuitem: 修复浏览器 - {ECF2E268-F28C-48d2-9AB7-8F69C11CCB71} - http://cn.zs.yahoo.com/cnsbutton.htm?source=cns&btn=repair (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (file missing)
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (file missing)
O9 - Extra button: (no name) - {FD00D911-7529-4084-9946-A29F1BDF4FE5} - http://cn.zs.yahoo.com/cnsbutton.htm?source=cns&btn=clean (file missing)
O9 - Extra 'Tools' menuitem: 清理上网记录 - {FD00D911-7529-4084-9946-A29F1BDF4FE5} - http://cn.zs.yahoo.com/cnsbutton.htm?source=cns&btn=clean (file missing)
O11 - Options group: [!CNS] 网络实名
O14 - IERESET.INF: START_PAGE_URL=about:blank
O16 - DPF: {0CA54D3F-CEAE-48AF-9A2B-31909CB9515D} (Edit Class) - https://www.sz1.cmbchina.com/download/CMBEdit.cab
O16 - DPF: {20C2C286-BDE8-441B-B73D-AFA22D914DA5} (PowerList Control) - http://download.ppstream.com/bin/powerplayer.cab
O16 - DPF: {3D8F74EE-8692-4F8F-B8D2-7522E732519E} (WebActivater Control) - http://game.qq.com/QQGame2.cab
O16 - DPF: {87CCFDB0-C4BE-4BC2-A78C-9EAA7CF96667} (pcastup Class) - http://ps.itv.mop.com/dn/files/vodupdate_1.0.0.8_20051009.cab
O16 - DPF: {FEE1002D-90A5-4A5D-AABE-01803FFBCF7A} (pCastPanel Class) - http://ps.itv.mop.com/dn/files/pCastCtl_1.0.0.87_20060601.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{158E1278-713A-40F6-BC36-4831499BF792}: NameServer = 202.96.128.143,202.96.128.68
O17 - HKLM\System\CCS\Services\Tcpip\..\{1A29D1F0-9E0F-48D0-9F7A-47A2E5385742}: NameServer = 202.96.128.143,202.96.128.68
O17 - HKLM\System\CCS\Services\Tcpip\..\{4F28A2AD-C6EC-4260-8B43-3E6D6D1A418C}: NameServer = 192.168.1.1,202.96.128.86
O17 - HKLM\System\CCS\Services\Tcpip\..\{515D1D66-2EAF-4E46-B43F-A8A09E247855}: NameServer = 202.96.128.68,202.96.128.143
O17 - HKLM\System\CCS\Services\Tcpip\..\{C09F141D-96E6-4FFC-9128-E6B4C88D92A3}: NameServer = 202.96.128.143,202.96.128.68
O17 - HKLM\System\CS1\Services\Tcpip\..\{158E1278-713A-40F6-BC36-4831499BF792}: NameServer = 202.96.128.143,202.96.128.68
O17 - HKLM\System\CS2\Services\Tcpip\..\{158E1278-713A-40F6-BC36-4831499BF792}: NameServer = 202.96.128.143,202.96.128.68
O18 - Protocol: mbox - {7DEE9D05-FA0A-4416-A6F3-6537D0EAB6A6} - C:\WINDOWS\system32\mbprot.dll
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)
O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxsrvc.dll
O20 - Winlogon Notify: NavLogon - C:\WINDOWS\system32\NavLogon.dll
O23 - Service: C-DillaCdaC11BA - Macrovision - C:\WINDOWS\system32\drivers\CDAC11BA.EXE
O23 - Service: Symantec AntiVirus Definition Watcher (DefWatch) - Symantec Corporation - C:\Program Files\SAV\DefWatch.exe
O23 - Service: Intel PDS - Intel? Corporation - C:\WINDOWS\system32\CBA\pds.exe
O23 - Service: Symantec AntiVirus - Symantec Corporation - C:\Program Files\SAV\Rtvscan.exe

瑞星卡卡安全论坛