瑞星卡卡安全论坛

我的电脑前几天总是蹦出n个广告网站，几乎是一分钟一次，各种广告，用瑞星杀了104个毒```
但是情况没有什么好转，依旧会有网站蹦出来，用木马杀客，兔子都无济于事。。。而且我还在屏幕右下脚发现两个类似于windows的警告黄色小图标，如图：









似乎说我的电脑中了间谍软件，要我下反间谍软件，如果我点击那2个图标，就会弹出一个网站，外国的，好象是卖杀毒软件的。。所以我怀疑这2个图标本来就是广告伪装的````````````
求达人帮助我怎么才能消掉这个东西```我可怜的电脑已经不堪一击了````而且由于没有光区`重装系统显得尤为困难```谢谢！！！如果方便的话，请加我的QQ:25313847
跪谢！！！~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~！！！

啊~~~~不知道为什么图片出现不了`````````````````郁闷```
图片地址：http://pic16.album.tom.com/album_pic/2006/05/14/c288ef9d70dde4ccdfaa9d857bf16b67?%75%4e%69%45%6a%73%4a%71%67%74
http://pic16.album.tom.com/album_pic/2006/05/14/a766bcff4cf028ac6db2778d7cb35f0c?%75%4e%69%45%6a%73%4a%75%68%7d

请下载 System Repair Engineer，使用“智能扫描”，按下“扫描”按钮进行扫描，扫描完成后按下“保存报告”按钮保存报告日志文件（SREng.LOG），把保存的报告日志文件内容复制-粘贴上来
http://forum.ikaka.com/topic.asp?board=67&artid=5188931
www.27814939.ys168.com
日志一次报不完，分次粘完，不要修改。

Running processes:
C:\WINNT\System32\smss.exe
C:\WINNT\system32\winlogon.exe
C:\WINNT\system32\services.exe
C:\WINNT\system32\lsass.exe
C:\WINNT\system32\svchost.exe
C:\Program Files\Rising\Rav\CCenter.exe
C:\Program Files\Rising\Rav\Ravmond.exe
C:\WINNT\system32\spoolsv.exe
C:\WINNT\atigraphics.exe
C:\WINNT\System32\svchost.exe
C:\WINNT\system32\nvsvc32.exe
C:\WINNT\system32\MSTask.exe
C:\WINNT\system32\stisvc.exe
C:\WINNT\System32\WBEM\WinMgmt.exe
C:\WINNT\system32\svchost.exe
C:\Program Files\Rising\Rav\RavStub.exe
C:\WINNT\Explorer.EXE
D:\长宽认证自动登陆器V8.0.exe
C:\Program Files\Rising\Rav\RavTask.exe
C:\WINNT\system32\Internat.exe
C:\WINNT\wupdmgr.exe
C:\WINNT\osaupd.exe
C:\PROGRA~1\Yahoo!\ASSIST~1\ylive.exe
D:\hanhua\HijackThis.exe
C:\WINNT\system32\NOTEPAD.EXE

R3 - URLSearchHook: 雅虎助手 - {406F94F0-504F-4a40-8DFD-58B0666ABEBD} - C:\PROGRA~1\Yahoo!\ASSIST~1\assist\yasbar.dll
O2 - BHO: (no name) - {A5366673-E8CA-11D3-9CD9-0090271D075B} - (no file)
O3 - Toolbar: @msdxmLC.dll,-1@2052,电台(&R) - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINNT\System32\msdxm.ocx
O3 - Toolbar: FlashGet Bar - {E0E899AB-F487-11D5-8D29-0050BA6940E3} - D:\PROGRA~1\FLASHGET\fgiebar.dll
O3 - Toolbar: 雅虎助手 - {406F94F0-504F-4a40-8DFD-58B0666ABEBD} - C:\PROGRA~1\Yahoo!\ASSIST~1\assist\yasbar.dll
O3 - Toolbar: 超级兔子上网精灵 - {FEDF637B-F631-4583-A210-33CC828D42DB} - D:\PROGRA~1\SUPERR~1\MagicSet\HAOKAN~1.DLL
O4 - HKLM\..\Run: [nwiz] ; nwiz.exe /install
O4 - HKLM\..\Run: [Synchronization Manager] mobsync.exe /logon
O4 - HKLM\..\Run: [YLive.exe] ; C:\PROGRA~1\Yahoo!\ASSIST~1\YLive.exe
O4 - HKLM\..\Run: [yassistse] ; "C:\PROGRA~1\Yahoo!\Assistant\yassistse.exe"
O4 - HKLM\..\Run: [GzGwBn] "D:\长宽认证自动登陆器V8.0.exe"
O4 - HKLM\..\Run: [stup.exe] C:\PROGRA~1\TENCENT\Adplus\stup.exe
O4 - HKLM\..\Run: [RavTask] "C:\Program Files\Rising\Rav\RavTask.exe" -system
O4 - HKCU\..\Run: [Internat.exe] Internat.exe
O4 - Startup: 腾讯QQ.lnk = D:\Program Files\Tencent\qq\QQ.exe
O4 - Global Startup: MSCOMM32.EXE
O4 - Global Startup: wupdmgr.exe
O8 - Extra context menu item: 上传到QQ网络硬盘 - D:\Program Files\Tencent\qq\AddToNetDisk.htm
O8 - Extra context menu item: 使用网际快车下载 - D:\Program Files\FlashGet\jc_link.htm
O8 - Extra context menu item: 使用网际快车下载全部链接 - D:\Program Files\FlashGet\jc_all.htm
O8 - Extra context menu item: 添加到QQ自定义面板 - D:\Program Files\Tencent\qq\AddPanel.htm
O8 - Extra context menu item: 添加到QQ表情 - D:\Program Files\Tencent\qq\AddEmotion.htm
O8 - Extra context menu item: 用QQ彩信发送该图片 - D:\Program Files\Tencent\qq\SendMMS.htm
O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINNT\web\related.htm
O9 - Extra 'Tools' menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINNT\web\related.htm
O11 - Options group: [TBH]  搜搜地址栏搜索
O14 - IERESET.INF: SEARCH_PAGE_URL=
O14 - IERESET.INF: START_PAGE_URL=
O16 - DPF: {11111111-1111-1111-1111-222222222222} - ms-its:mhtml:file://d:\foo.mht!http://spc.biz/exp/chm//x.chm::/open.exe
O16 - DPF: {A96C48EA-AA88-4BBD-B58C-7B41146A6EAC} (Qzone Media Tools) - http://imgcache.qq.com/qzone/photo/QzoneMediaTools.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{16BCA105-301F-4F3A-BBB6-48973736CBAD}: NameServer = 85.255.115.30,85.255.112.150
O17 - HKLM\System\CCS\Services\Tcpip\..\{4E8469CF-5A5E-4A81-8A3B-DCD56B3CF9BD}: NameServer = 85.255.115.30,85.255.112.150
O17 - HKLM\System\CCS\Services\Tcpip\..\{6572CCF7-648E-43AE-9BE5-C06B860423C1}: NameServer = 85.255.115.30,85.255.112.150
O17 - HKLM\System\CCS\Services\Tcpip\..\{C6B6EA51-3DE2-4619-80E0-720009FB3FDE}: NameServer = 85.255.115.30,85.255.112.150
O17 - HKLM\System\CCS\Services\Tcpip\..\{F86835D2-D110-4F4D-B4E4-E3BDB9CB4801}: NameServer = 85.255.115.30,85.255.112.150
O18 - Protocol: mbox - {7DEE9D05-FA0A-4416-A6F3-6537D0EAB6A6} - (no file)
O20 - Winlogon Notify: gdwxp3 - C:\WINNT\SYSTEM32\gdwxp3.dll
O23 - Service: ATIintergrated - Unknown owner - C:\WINNT\atigraphics.exe
O23 - Service: Logical Disk Manager Administrative Service (dmadmin) - VERITAS Software Corp. - C:\WINNT\System32\dmadmin.exe
O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINNT\system32\nvsvc32.exe
O23 - Service: Rising Process Communication Center (RsCCenter) - Beijing Rising Technology Co., Ltd. - C:\Program Files\Rising\Rav\CCenter.exe
O23 - Service: RsRavMon Service (RsRavMon) - Beijing Rising Technology Co., Ltd. - C:\Program Files\Rising\Rav\Ravmond.exe

我还没有修改``因为我看不懂哪里出了问题````555555555555！！！

ALT+CTRL+DELETE调出任务管理器,终止wupdmgr.exe，osaupd.exe，atigraphics.exe的进程，如果无法终止，请到www.27814939.ys168.com下载诺顿进程管理器终止wupdmgr.exe，osaupd.exe，atigraphics.exe的进程（注意，一共三个进程。
开始→运行→输入services.msc，打开“服务”→查找 ATIintergrated →双击→启动类型→禁止→停止→应用→确定。禁止ATIintergrated 这个服务
关闭所有浏览窗口以及一些不必要的程序
运行Hijackthis，扫描结束后在下列选项前打上勾，然后选"修复""
O4 - Global Startup: wupdmgr.exe
O4 - Global Startup: MSCOMM32.EXE（如果你也不知道，建议修复
O20 - Winlogon Notify: gdwxp3 - C:\WINNT\SYSTEM32\gdwxp3.dll（如果你也不知道，建议修复。
O23 - Service: ATIintergrated - Unknown owner - C:\WINNT\atigraphics.exe
双击我的电脑--工具---文件夹选项--查看--单击选取"显示隐藏文件或文件夹"清除"隐藏受保护的操作系统文件（推荐）"复选框。在提示您确定更改时，单击“是”
(请按上述步骤操作，不要略过)
然后找到如下文件并删除
C:\WINNT\wupdmgr.exe
C:\WINNT\osaupd.exe
C:\WINNT\SYSTEM32\gdwxp3.dll
C:\WINNT\atigraphics.exe
修复后，请重启。
请下载 System Repair Engineer，使用“智能扫描”，按下“扫描”按钮进行扫描，扫描完成后按下“保存报告”按钮保存报告日志文件（SREng.LOG），把保存的报告日志文件内容复制-粘贴上来
http://forum.ikaka.com/topic.asp?board=67&artid=5188931
www.27814939.ys168.com
日志一次粘不完，分次粘完，不要修改

你好！~wupdmgr.exe，osaupd.exe的进程我终止不了`，atigraphics.exe我没有找到`下了诺顿的那个也是终止后还是没有消失，无法终止`
你说的开始→运行→输入services.msc，我在运行里面也无法打开，请告诉我是怎么回事啊！谢谢！！

请下载 System Repair Engineer，使用“智能扫描”，按下“扫描”按钮进行扫描，扫描完成后按下“保存报告”按钮保存报告日志文件（SREng.LOG），把保存的报告日志文件内容复制-粘贴上来
http://forum.ikaka.com/topic.asp?board=67&artid=5188931
www.27814939.ys168.com
日志一次粘不完，分次粘完，不要修改

启动项目
注册表
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
  <Internat.exe><Internat.exe>
[HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows]
  <load><>
[HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows]
  <run><>
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
  <nwiz><; nwiz.exe /install>
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
  <Synchronization Manager><mobsync.exe /logon>
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
  <YLive.exe><; C:\PROGRA~1\Yahoo!\ASSIST~1\YLive.exe>
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
  <yassistse><; "C:\PROGRA~1\Yahoo!\Assistant\yassistse.exe">
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
  <GzGwBn><"D:\长宽认证自动登陆器V8.0.exe">
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
  <stup.exe><C:\PROGRA~1\TENCENT\Adplus\stup.exe>
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
  <RavTask><"C:\Program Files\Rising\Rav\RavTask.exe" -system>
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
  <shell><explorer.exe>
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
  <Userinit><C:\WINNT\system32\userinit.exe,>
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Windows]
  <AppInit_DLLs><>

==================================
启动文件夹
[wupdmgr]
  <C:\Documents and Settings\All Users\「开始」菜单\程序\启动\wupdmgr.exe><N>
[腾讯QQ]
  <C:\Documents and Settings\42284\「开始」菜单\程序\启动\腾讯QQ.lnk><H>

==================================
服务
[Logical Disk Manager Administrative Service / dmadmin]
  <C:\WINNT\System32\dmadmin.exe /com><VERITAS Software Corp.>
[NVIDIA Driver Helper Service / NVSvc]
  <C:\WINNT\system32\nvsvc32.exe><NVIDIA Corporation>
[Rising Process Communication Center / RsCCenter]
  <"C:\Program Files\Rising\Rav\CCenter.exe"><Beijing Rising Technology Co., Ltd.>
[RsRavMon Service / RsRavMon]
  <"C:\Program Files\Rising\Rav\Ravmond.exe"><Beijing Rising Technology Co., Ltd.>

==================================
浏览器加载项
[@shdoclc.dll,-866]
  {c95fe080-8f5d-11d2-a20b-00aa003c157a} <, N/A>
[@msdxmLC.dll,-1@2052,电台(&R)]
  {8E718888-423F-11D2-876E-00A0C9082467} <C:\WINNT\System32\msdxm.ocx, Microsoft Corporation>
[FlashGet Bar]
  {E0E899AB-F487-11D5-8D29-0050BA6940E3} <D:\PROGRA~1\FLASHGET\fgiebar.dll, Amaze Soft>
[雅虎助手]
  {406F94F0-504F-4a40-8DFD-58B0666ABEBD} <C:\PROGRA~1\Yahoo!\ASSIST~1\assist\yasbar.dll, Yahoo!>
[超级兔子上网精灵]
  {FEDF637B-F631-4583-A210-33CC828D42DB} <D:\PROGRA~1\SUPERR~1\MagicSet\HAOKAN~1.DLL, 超级兔子>
[Qzone Media Tools]
  {A96C48EA-AA88-4BBD-B58C-7B41146A6EAC} <D:\PROGRA~1\Tencent\qq\QZone\QZONEM~1.OCX, Tencent Technology (Shenzhen) Company Limited>
[Shockwave Flash Object]
  {D27CDB6E-AE6D-11CF-96B8-444553540000} <C:\WINNT\system32\Macromed\Flash\Flash8b.ocx, Macromedia, Inc.>
[上传到QQ网络硬盘]
  <D:\Program Files\Tencent\qq\AddToNetDisk.htm, N/A>
[使用网际快车下载]
  <D:\Program Files\FlashGet\jc_link.htm, N/A>
[使用网际快车下载全部链接]
  <D:\Program Files\FlashGet\jc_all.htm, N/A>
[添加到QQ自定义面板]
  <D:\Program Files\Tencent\qq\AddPanel.htm, N/A>
[添加到QQ表情]
  <D:\Program Files\Tencent\qq\AddEmotion.htm, N/A>
[用QQ彩信发送该图片]
  <D:\Program Files\Tencent\qq\SendMMS.htm, N/A>

正在运行的进程
[PID: 764][C:\WINNT\Explorer.EXE]  <Microsoft Corporation><5.00.3700.6690>
    [C:\Program Files\TENCENT\Adplus\Adplus1.dll]  <Tencent><4, 0, 1, 11>
    [C:\Program Files\TENCENT\Adplus\SSAddr1.dll]  <Tencent><4, 0, 1, 11>
    [C:\PROGRA~1\Yahoo!\ASSIST~1\Yhelper.dll]  <><2, 0, 0, 1013>
    [C:\PROGRA~1\Yahoo!\ASSIST~1\YAlive.dll]  <><2, 1, 4, 1044>
    [C:\PROGRA~1\Yahoo!\ASSIST~1\Yalliveex.dll]  < ><2, 0, 1, 1007>
    [C:\WINNT\system32\ALSNDMGR.CPL]  <Realtek Semiconductor Corp.><2.1.05>
    [C:\WINNT\system32\nvtuicpl.cpl]  <NVIDIA Corporation><6.13.10.3140>
    [C:\WINNT\system32\NVWRSZHC.DLL]  <NVIDIA Corporation><6.13.10.3140>
    [C:\WINNT\system32\RavExt.dll]  <Beijing Rising Technology Co., Ltd.><18, 0, 0, 13>
    [C:\PROGRA~1\Yahoo!\ASSIST~1\assist\ywiper.dll]  <N/A><1, 0, 1, 1014>
    [C:\Program Files\WinRAR\rarext.dll]  <N/A><N/A>
[PID: 1008][D:\长宽认证自动登陆器V8.0.exe]  <><0, 0, 7, 0>
    [C:\Program Files\TENCENT\Adplus\Adplus1.dll]  <Tencent><4, 0, 1, 11>
[PID: 1048][C:\Program Files\Rising\Rav\RavTask.exe]  <Beijing Rising Technology Co., Ltd.><18, 0, 0, 22>
    [C:\Program Files\Rising\Rav\RSCOMMON.DLL]  <Beijing Rising Technology Co., Ltd.><18, 0, 0, 4>
    [C:\Program Files\Rising\Rav\RSAPPMGR.DLL]  <Beijing Rising Technology Co., Ltd.><18, 0, 0, 2>
    [C:\Program Files\Rising\Rav\CfgDll.dll]  <Beijing Rising Technology Co., Ltd.><18, 0, 0, 10>
    [C:\Program Files\Rising\Rav\RsCommX.dll]  <rising><18, 0, 0, 1>
    [C:\Program Files\TENCENT\Adplus\Adplus1.dll]  <Tencent><4, 0, 1, 11>
[PID: 1068][C:\WINNT\system32\Internat.exe]  <Microsoft Corporation><5.00.2920.0000>
[PID: 1028][C:\Program Files\Rising\Rav\Ravmon.exe]  <Beijing Rising Technology Co., Ltd.><18, 0, 1, 17>
    [C:\Program Files\Rising\Rav\RsGuiLib.dll]  <Beijing Rising Technology Co., Ltd.><18, 0, 0, 24>
    [C:\Program Files\Rising\Rav\BWList.dll]  <Beijing Rising Technology Co., Ltd.><18, 0, 0, 16>
    [C:\Program Files\Rising\Rav\RSAPPMGR.DLL]  <Beijing Rising Technology Co., Ltd.><18, 0, 0, 2>
    [C:\Program Files\Rising\Rav\CfgDll.dll]  <Beijing Rising Technology Co., Ltd.><18, 0, 0, 10>
    [C:\Program Files\Rising\Rav\RSCOMMON.DLL]  <Beijing Rising Technology Co., Ltd.><18, 0, 0, 4>
    [C:\Program Files\Rising\Rav\RsCommX.dll]  <rising><18, 0, 0, 1>
    [C:\Program Files\Rising\Rav\PngDll.dll]  <Beijing Rising Technology Co., Ltd.><18, 0, 0, 5>
    [C:\Program Files\TENCENT\Adplus\Adplus1.dll]  <Tencent><4, 0, 1, 11>
[PID: 1156][C:\PROGRA~1\Yahoo!\ASSIST~1\ylive.exe]  < ><2, 0, 0, 1002>
    [C:\PROGRA~1\Yahoo!\ASSIST~1\Yhelper.dll]  <><2, 0, 0, 1013>
    [C:\Program Files\TENCENT\Adplus\Adplus1.dll]  <Tencent><4, 0, 1, 11>
    [C:\PROGRA~1\Yahoo!\ASSIST~1\YAlive.dll]  <><2, 1, 4, 1044>
    [C:\PROGRA~1\Yahoo!\ASSIST~1\Yalliveex.dll]  < ><2, 0, 1, 1007>
    [C:\PROGRA~1\Yahoo!\ASSIST~1\ynotifier.dll]  <><1, 0, 0, 5>
[PID: 820][C:\WINNT\wupdmgr.exe]  <><1, 0, 0, 1>
    [C:\PROGRA~1\Yahoo!\ASSIST~1\Yhelper.dll]  <><2, 0, 0, 1013>
    [C:\Program Files\TENCENT\Adplus\Adplus1.dll]  <Tencent><4, 0, 1, 11>
[PID: 808][C:\WINNT\osaupd.exe]  <><1, 0, 0, 1>
    [C:\PROGRA~1\Yahoo!\ASSIST~1\Yhelper.dll]  <><2, 0, 0, 1013>
    [C:\Program Files\TENCENT\Adplus\Adplus1.dll]  <Tencent><4, 0, 1, 11>
[PID: 576][C:\WINNT\system32\conime.exe]  <Microsoft Corporation><5.00.2195.6655>
    [C:\PROGRA~1\Yahoo!\ASSIST~1\Yhelper.dll]  <><2, 0, 0, 1013>
    [C:\Program Files\TENCENT\Adplus\Adplus1.dll]  <Tencent><4, 0, 1, 11>
[PID: 988][D:\sreng2\SREng.exe]  <Smallfrogs Studio><2.0.12.350>
    [C:\PROGRA~1\Yahoo!\ASSIST~1\Yhelper.dll]  <><2, 0, 0, 1013>
    [C:\Program Files\TENCENT\Adplus\Adplus1.dll]  <Tencent><4, 0, 1, 11>

==================================
文件关联
.TXT  OK. [%SystemRoot%\system32\NOTEPAD.EXE %1]
.EXE  OK. ["%1" %*]
.COM  OK. ["%1" %*]
.PIF  OK. ["%1" %*]
.REG  OK. [regedit.exe "%1"]
.BAT  OK. ["%1" %*]
.SCR  OK. ["%1" /S]
.CHM  OK. ["C:\WINNT\hh.exe" %1]
.HLP  OK. [%SystemRoot%\System32\winhlp32.exe %1]
.INI  OK. [%SystemRoot%\System32\NOTEPAD.EXE %1]
.INF  OK. [%SystemRoot%\System32\NOTEPAD.EXE %1]
.VBS  OK. [%SystemRoot%\System32\WScript.exe "%1" %*]
.JS  OK. [%SystemRoot%\System32\WScript.exe "%1" %*]
.LNK  OK. [{00021401-0000-0000-C000-000000000046}]

麻烦你了 谢谢

人呢``？？5555555555~~~~~~~``

你这个不好解决,等等吧,我那个也是!

进程里依然有
[PID: 820][C:\WINNT\wupdmgr.exe] <><1, 0, 0, 1>
[PID: 808][C:\WINNT\osaupd.exe
建议，进入控制面版的添加删除程序中卸载搜搜地址栏搜索(QQ搜索小助手)卸载后。
重新启动电脑, 开机检测完后, 按[F8]键(可以一直按到启动菜单出来为止), 选择安全模式进入Windows
C:\WINNT\wupdmgr.exe
C:\WINNT\osaupd.exe