瑞星卡卡安全论坛

首页 » 技术交流区 » 反病毒/反流氓软件论坛 » SOS 被www.71791.com劫持
KloochFRK - 2006-4-5 12:44:00
昨天突然发生的状况
首先以为是自己不小心点击了什么广告
才导致自动弹出这种黄色网站
后来发现是被劫持了
用超级魔法兔子貌似不管用
请求牛人帮忙解决

实在没道理，这几天因为作项目，上的都是东北三省的政府网站找资料，而且除了军事网站，我从来不上杂七杂八的网站，也不和人视频什么的
2116bromgamed2m - 2006-4-5 13:13:00
下载HijackThisV1.99.1把生成的日志文件的内容发上来

http://forum.ikaka.com/topic.asp?board=67&artid=5188931
KloochFRK - 2006-4-5 13:42:00
Logfile of HijackThis v1.99.1
Scan saved at 13:44:07, on 2006-4-5
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Rising\Rav\CCenter.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Rising\Rav\Ravmond.exe
c:\program files\rising\rfw\rfwsrv.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Rising\Rav\RavStub.exe
C:\WINDOWS\Explorer.EXE
C:\MATLAB6p5p1\webserver\bin\win32\matlabserver.exe
c:\program files\rising\rfw\RfwMain.exe
C:\Program Files\Rising\Rav\RavTask.exe
C:\Program Files\Rising\Rav\Ravmon.exe
C:\WINDOWS\System32\ctfmon.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Microsoft Office\Office\WINWORD.EXE
C:\WINDOWS\System32\conime.exe
C:\Program Files\Internet Explorer\iexplore.exe
D:\hijackthis 1.99.0\HijackThis.exe

R3 - Default URLSearchHook is missing
O3 - Toolbar: 电台(&R) - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O3 - Toolbar: (no name) - {47833539-D0C5-4125-9FA8-0819E2EAAC93}? - (no file)
O3 - Toolbar: 卡卡上网安全助手 - {DB9ECD4F-FB8F-4311-B3CE-90B976C2707C} - C:\WINDOWS\System32\KakaTool.dll
O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\System32\IME\TINTLGNT\TINTSETP.EXE /SYNC
O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\System32\IME\TINTLGNT\TINTSETP.EXE /IMEName
O4 - HKLM\..\Run: [RfwMain] "C:\Program Files\Rising\Rfw\rfwmain.exe" -Startup
O4 - HKLM\..\Run: [MS-4011 Memory Patch] C:\Documents and Settings\beaverchuen\桌面\RavSasser.exe -Patch
O4 - HKLM\..\Run: [RavTask] "C:\Program Files\Rising\Rav\RavTask.exe" -system
O4 - HKLM\..\Run: [MSService] svchest.exe
O4 - HKLM\..\RunServices: [SystemRunOn] C:\WINDOWS\system32\sysconfig.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\System32\ctfmon.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O8 - Extra context menu item: 上传到QQ网络硬盘 - C:\Program Files\Tencent\QQ2005\AddToNetDisk.htm
O8 - Extra context menu item: 添加到QQ自定义面板 - C:\Program Files\Tencent\QQ2005\AddPanel.htm
O8 - Extra context menu item: 添加到QQ表情 - C:\Program Files\Tencent\QQ2005\AddEmotion.htm
O8 - Extra context menu item: 用QQ彩信发送该图片 - C:\Program Files\Tencent\QQ2005\SendMMS.htm
O9 - Extra button: 相关站点 - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
O9 - Extra 'Tools' menuitem: 相关站点 - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
O17 - HKLM\System\CCS\Services\Tcpip\..\{DF3EEDFE-54F8-43A1-A481-33899FA77CE7}: NameServer = 192.168.43.1,0.0.0.0
O18 - Protocol: dic - {C21F5C32-F57A-4A0D-8E0A-B672691C52D0} - C:\PROGRA~1\Kingsoft\POWERW~1\XDictExB.dll
O23 - Service: COM+ System Application (COMSysApp) - Unknown owner - C:\WINDOWS\System32\dllhost.exe (file missing)
O23 - Service: MATLAB Server (matlabserver) - Unknown owner - C:\MATLAB6p5p1\webserver\bin\win32\matlabserver.exe
O23 - Service: Remote Internet Service (Msisvr) - Unknown owner - C:\WINDOWS\System32\INTasks.exe
O23 - Service: Rising Proxy  Service (RfwProxySrv) - Beijing Rising Technology Co., Ltd. - c:\program files\rising\rfw\rfwproxy.exe
O23 - Service: Rising Personal Firewall Service (RfwService) - Beijing Rising Technology Co., Ltd. - c:\program files\rising\rfw\rfwsrv.exe
O23 - Service: Rising Process Communication Center (RsCCenter) - Beijing Rising Technology Co., Ltd. - C:\Program Files\Rising\Rav\CCenter.exe
O23 - Service: RsRavMon Service (RsRavMon) - Beijing Rising Technology Co., Ltd. - C:\Program Files\Rising\Rav\Ravmond.exe
O23 - Service: MS Software Shadow Copy Provider (SwPrv) - Unknown owner - C:\WINDOWS\System32\dllhost.exe (file missing)
O23 - Service: Windows Workstation (W32 Wmi Service) - Unknown owner - C:\WINDOWS\dl1host.exe (file missing)
KloochFRK - 2006-4-5 13:45:00
谢谢一楼
D:\hijackthis 1.99.0\HijackThis.exe
文件夹名字去错了，版本号就是V 1.99.1
KloochFRK - 2006-4-5 15:07:00
在线等
KloochFRK - 2006-4-5 17:42:00
faint
自动弹出的频率越来越快
IP202.107.234.110
浙江嘉兴的
想砍人
2116bromgamed2m - 2006-4-5 18:07:00
给你的修复建议为：
以安全模式启动计算机
关闭系统还原功能
-------------
修复：
O4 - HKLM\..\Run: [MSService] svchest.exe
O4 - HKLM\..\RunServices: [SystemRunOn] C:\WINDOWS\system32\sysconfig.exe
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O23 - Service: Remote Internet Service (Msisvr) - Unknown owner - C:\WINDOWS\System32\INTasks.exe

停止并禁用服务：Remote Internet Service (Msisvr)

设置系统显示所有文件和文件夹,不隐藏已知文件类型扩展名


删除：

C:\WINDOWS\system32\sysconfig.exe


C:\WINDOWS\System32\INTasks.exe

svchest.exe（用开始菜单的搜索功能查找）

-----------------------
卡卡有点问题
才上线
mainky - 2006-4-5 19:04:00
请问安全模式是怎样的?谢谢,我是菜鸟~~
KloochFRK - 2006-4-5 20:48:00
谢谢2116bromgamed2m
我这就试试
KloochFRK - 2006-4-5 21:53:00
貌似没用
想哭
我这赶活
它老蹦出来捣乱
能不能在帮忙想想是怎么回事
不甚感激
魔法学徒 - 2006-4-6 8:38:00
没用就再贴个log出来看看，光诉苦是没用的
KloochFRK - 2006-4-6 9:09:00
Logfile of HijackThis v1.99.1
Scan saved at 9:10:47, on 2006-4-6
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Rising\Rav\CCenter.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Rising\Rav\Ravmond.exe
c:\program files\rising\rfw\rfwsrv.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Rising\Rav\RavStub.exe
C:\MATLAB6p5p1\webserver\bin\win32\matlabserver.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Rising\Rfw\rfwmain.exe
C:\Program Files\Rising\Rav\RavTask.exe
C:\Program Files\Rising\Rav\Ravmon.exe
C:\WINDOWS\System32\ctfmon.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Tencent\QQ2005\QQ.exe
C:\Program Files\Tencent\QQ2005\TIMPlatform.exe
C:\WINDOWS\System32\conime.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
D:\hijackthis 1.99.0\HijackThis.exe

R3 - Default URLSearchHook is missing
O3 - Toolbar: 电台(&R) - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O3 - Toolbar: (no name) - {47833539-D0C5-4125-9FA8-0819E2EAAC93}? - (no file)
O3 - Toolbar: 卡卡上网安全助手 - {DB9ECD4F-FB8F-4311-B3CE-90B976C2707C} - C:\WINDOWS\System32\KakaTool.dll
O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\System32\IME\TINTLGNT\TINTSETP.EXE /SYNC
O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\System32\IME\TINTLGNT\TINTSETP.EXE /IMEName
O4 - HKLM\..\Run: [RfwMain] "C:\Program Files\Rising\Rfw\rfwmain.exe" -Startup
O4 - HKLM\..\Run: [MS-4011 Memory Patch] C:\Documents and Settings\beaverchuen\桌面\RavSasser.exe -Patch
O4 - HKLM\..\Run: [RavTask] "C:\Program Files\Rising\Rav\RavTask.exe" -system
O4 - HKLM\..\Run: [MSService] svchest.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\System32\ctfmon.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O8 - Extra context menu item: 上传到QQ网络硬盘 - C:\Program Files\Tencent\QQ2005\AddToNetDisk.htm
O8 - Extra context menu item: 添加到QQ自定义面板 - C:\Program Files\Tencent\QQ2005\AddPanel.htm
O8 - Extra context menu item: 添加到QQ表情 - C:\Program Files\Tencent\QQ2005\AddEmotion.htm
O8 - Extra context menu item: 用QQ彩信发送该图片 - C:\Program Files\Tencent\QQ2005\SendMMS.htm
O9 - Extra button: 相关站点 - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
O9 - Extra 'Tools' menuitem: 相关站点 - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
O17 - HKLM\System\CCS\Services\Tcpip\..\{DF3EEDFE-54F8-43A1-A481-33899FA77CE7}: NameServer = 192.168.43.1,0.0.0.0
O18 - Protocol: dic - {C21F5C32-F57A-4A0D-8E0A-B672691C52D0} - C:\PROGRA~1\Kingsoft\POWERW~1\XDictExB.dll
O23 - Service: COM+ System Application (COMSysApp) - Unknown owner - C:\WINDOWS\System32\dllhost.exe (file missing)
O23 - Service: MATLAB Server (matlabserver) - Unknown owner - C:\MATLAB6p5p1\webserver\bin\win32\matlabserver.exe
O23 - Service: Remote Internet Service (Msisvr) - Unknown owner - C:\WINDOWS\System32\INTasks.exe
O23 - Service: Rising Proxy  Service (RfwProxySrv) - Beijing Rising Technology Co., Ltd. - c:\program files\rising\rfw\rfwproxy.exe
O23 - Service: Rising Personal Firewall Service (RfwService) - Beijing Rising Technology Co., Ltd. - c:\program files\rising\rfw\rfwsrv.exe
O23 - Service: Rising Process Communication Center (RsCCenter) - Beijing Rising Technology Co., Ltd. - C:\Program Files\Rising\Rav\CCenter.exe
O23 - Service: RsRavMon Service (RsRavMon) - Beijing Rising Technology Co., Ltd. - C:\Program Files\Rising\Rav\Ravmond.exe
O23 - Service: MS Software Shadow Copy Provider (SwPrv) - Unknown owner - C:\WINDOWS\System32\dllhost.exe (file missing)
O23 - Service: Windows Workstation (W32 Wmi Service) - Unknown owner - C:\WINDOWS\dl1host.exe (file missing)

魔法学徒 - 2006-4-6 9:15:00
O4 - HKLM\..\Run: [MSService] svchest.exe
O23 - Service: Remote Internet Service (Msisvr) - Unknown owner - C:\WINDOWS\System32\INTasks.exe

2116bromgamed2m 朋友建议你修复的这两项还在啊
KloochFRK - 2006-4-6 9:40:00
我也知道
不过确实点击了修复
KloochFRK - 2006-4-6 9:47:00
只存在一种可能
我一起点选的然后fix checked
不会需要三个修复一个个的点选吧
KloochFRK - 2006-4-6 12:59:00
刚才又费了半天功夫重新按步骤弄了一遍
以下是弄完后的新log

Logfile of HijackThis v1.99.1
Scan saved at 12:50:04, on 2006-4-6
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Rising\Rav\CCenter.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Rising\Rav\Ravmond.exe
c:\program files\rising\rfw\rfwsrv.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Rising\Rav\RavStub.exe
C:\MATLAB6p5p1\webserver\bin\win32\matlabserver.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\WINDOWS\Explorer.EXE
c:\program files\rising\rfw\RfwMain.exe
C:\Program Files\Rising\Rav\RavTask.exe
C:\Program Files\Rising\Rav\Ravmon.exe
C:\WINDOWS\System32\ctfmon.exe
D:\hijackthis 1.99.0\HijackThis.exe

R3 - Default URLSearchHook is missing
O3 - Toolbar: 电台(&R) - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O3 - Toolbar: (no name) - {47833539-D0C5-4125-9FA8-0819E2EAAC93}? - (no file)
O3 - Toolbar: 卡卡上网安全助手 - {DB9ECD4F-FB8F-4311-B3CE-90B976C2707C} - C:\WINDOWS\System32\KakaTool.dll
O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\System32\IME\TINTLGNT\TINTSETP.EXE /SYNC
O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\System32\IME\TINTLGNT\TINTSETP.EXE /IMEName
O4 - HKLM\..\Run: [RfwMain] "C:\Program Files\Rising\Rfw\rfwmain.exe" -Startup
O4 - HKLM\..\Run: [MS-4011 Memory Patch] C:\Documents and Settings\beaverchuen\桌面\RavSasser.exe -Patch
O4 - HKLM\..\Run: [RavTask] "C:\Program Files\Rising\Rav\RavTask.exe" -system
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\System32\ctfmon.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O8 - Extra context menu item: 上传到QQ网络硬盘 - C:\Program Files\Tencent\QQ2005\AddToNetDisk.htm
O8 - Extra context menu item: 添加到QQ自定义面板 - C:\Program Files\Tencent\QQ2005\AddPanel.htm
O8 - Extra context menu item: 添加到QQ表情 - C:\Program Files\Tencent\QQ2005\AddEmotion.htm
O8 - Extra context menu item: 用QQ彩信发送该图片 - C:\Program Files\Tencent\QQ2005\SendMMS.htm
O9 - Extra button: 相关站点 - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
O9 - Extra 'Tools' menuitem: 相关站点 - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
O17 - HKLM\System\CCS\Services\Tcpip\..\{DF3EEDFE-54F8-43A1-A481-33899FA77CE7}: NameServer = 192.168.43.1,0.0.0.0
O18 - Protocol: dic - {C21F5C32-F57A-4A0D-8E0A-B672691C52D0} - C:\PROGRA~1\Kingsoft\POWERW~1\XDictExB.dll
O23 - Service: COM+ System Application (COMSysApp) - Unknown owner - C:\WINDOWS\System32\dllhost.exe (file missing)
O23 - Service: MATLAB Server (matlabserver) - Unknown owner - C:\MATLAB6p5p1\webserver\bin\win32\matlabserver.exe
O23 - Service: Rising Proxy  Service (RfwProxySrv) - Beijing Rising Technology Co., Ltd. - c:\program files\rising\rfw\rfwproxy.exe
O23 - Service: Rising Personal Firewall Service (RfwService) - Beijing Rising Technology Co., Ltd. - c:\program files\rising\rfw\rfwsrv.exe
O23 - Service: Rising Process Communication Center (RsCCenter) - Beijing Rising Technology Co., Ltd. - C:\Program Files\Rising\Rav\CCenter.exe
O23 - Service: RsRavMon Service (RsRavMon) - Beijing Rising Technology Co., Ltd. - C:\Program Files\Rising\Rav\Ravmond.exe
O23 - Service: MS Software Shadow Copy Provider (SwPrv) - Unknown owner - C:\WINDOWS\System32\dllhost.exe (file missing)
O23 - Service: Windows Workstation (W32 Wmi Service) - Unknown owner - C:\WINDOWS\dl1host.exe (file missing)

已经十五分钟了
那个鸟站没有蹦出来过
希望不再出问题
谢谢两位班主大仙了
如果有情况在通知你们
KloochFRK - 2006-4-6 14:56:00
向斑竹报告
一切正常
斑竹强仁啊
1
查看完整版本: SOS 被www.71791.com劫持
© 2000 - 2026 Rising Corp. Ltd.