IE被劫持了!死活找不到原因..高手来看.. bbs.ikaka.com

瓢虫仔 - 2006-7-16 20:56:00

http://www.maybook.net/ad/gg.html

用ie看网页时候，不论什么网站，都会随机弹出这个网页。
原来用Windows Defender好像搜索出来是一个叫bs3.dll的在利用 Ad-aware 移除一個名為“BookedSpace”的廣告軟件後，就發現電腦於每次啟動時都會出現找不到“ bs3.dll”及“bsxx5.dll”的訊息

但是我删除后。根本没有效果，现在照旧弹出这个网页。我快疯了。。。
真是见鬼了！！！！帮忙啊！！！谢谢了！！！

天使之剑 - 2006-7-16 20:58:00

【回复“瓢虫仔”的帖子】

请您先下载HijackThis1.99.1（它是免费的）：

http://www.spywareinfo.com/~merijn/files/hijackthis.zip
将它解压到一个非临时性的文件夹（比如C:\Program Files\HijackThis\HijackThis.exe）。然后双击HijackThis.exe图标，选择Do a system scan and save a logfile，将产生的文本文件中的日志贴上来。如果一个帖子贴不下，可以将剩余的部分另开一帖。

瓢虫仔 - 2006-7-16 21:18:00

Logfile of HijackThis v1.99.1
Scan saved at 21:06:05, on 2006-7-16
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Windows Defender\MsMpEng.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\System32\hkcmd.exe
C:\PROGRA~1\SKYNET\FIREWALL\pfw.exe
C:\Program Files\Windows Defender\MSASCui.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\MSN Messenger\MsnMsgr.Exe
C:\Program Files\Messenger\msmsgs.exe
C:\WINDOWS\system32\wscntfy.exe
C:\Program Files\Internet Explorer\iexplore.exe
D:\Ad-aware 6\Ad-watch.exe
E:\Tencent\qq\QQ.exe
E:\Tencent\qq\TIMPlatform.exe
D:\Winamp\winamp.exe
C:\WINDOWS\regedit.exe
C:\DOCUME~1\Dicky\LOCALS~1\Temp\Rar$EX00.319\HijackThis.exe

O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\System32\IME\TINTLGNT\TINTSETP.EXE /SYNC
O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\System32\IME\TINTLGNT\TINTSETP.EXE /IMEName
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\System32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\System32\hkcmd.exe
O4 - HKLM\..\Run: [SKYNET Personal FireWall] C:\PROGRA~1\SKYNET\FIREWALL\pfw.exe
O4 - HKLM\..\Run: [KAVPersonal50] "C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus Personal\kav.exe" /minimize
O4 - HKLM\..\Run: [IMSCMig] C:\PROGRA~1\COMMON~1\MICROS~1\IME\IMSC40A\IMSCMIG.EXE /Preload
O4 - HKLM\..\Run: [Windows Defender] "C:\Program Files\Windows Defender\MSASCui.exe" -hide
O4 - HKLM\..\Run: [Ad-watch] "D:\Ad-aware 6\Ad-watch.exe"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - Startup: adsl.lnk = ?
O8 - Extra context menu item: 使用网际快车下载 - d:\FlashGet\jc_link.htm
O8 - Extra context menu item: 使用网际快车下载全部链接 - d:\FlashGet\jc_all.htm
O8 - Extra context menu item: 导出到 Microsoft Office Excel(&X) - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: 用比特精灵下载(&B) - d:\BitSpirit\bsurl.htm
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O17 - HKLM\System\CCS\Services\Tcpip\..\{A482A68D-6EE9-4354-A7C2-15E1ED113C5C}: NameServer = 61.128.99.133 218.30.19.40
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
O23 - Service: kavsvc - Kaspersky Lab - C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus Personal\kavsvc.exe

天使之剑 - 2006-7-16 21:30:00

【回复“瓢虫仔”的帖子】
建议下载并使用ewido：

http://www.ewido.net/en/download/

图1、下载ewido
安装时，请注意以下几点问题：
1、安装时，为了方便您阅读相关细则，请注意调整安装时的语言选项（德语和英语）；

图2、语言选项
2、当安装进行到Additional Options时，请按图3所示的要求操作。

图3、安装进行到Additional Options的注意事项
安装完毕后，开始进行扫描工作：
1、打开ewido，点击主界面上的“更新”按钮，进行更新工作；
2、更新完毕后，点击主界面上的“扫描器”按钮，然后点击“Scan Settings”，按照图4所示的要求操作（可以跳过该操作而使用默认设置），设定完成后，按“确定”；

图4、Scan Settings
3、开始扫描；

图5、进行扫描
4、当ewido发现威胁存在时会发出警报，请选择处理方式，然后按“确定”；
5、ewido会根据用户的选择处理这些威胁，当清理失败时（一般该文件在临时文件夹中），ewido会询问您是否删除整个文件夹，请选择“否”；
6、当扫描完成后，请点击“保存记录”按钮以保存日志，将产生的文本文件中的日志贴上来。

瓢虫仔 - 2006-7-17 12:34:00

对不起....我搜索了...
什么都没有搜索出来!问题依然存在!

瓢虫仔 - 2006-7-17 13:33:00

2006-07-17,13:23:14

System Repair Engineer 2.0.21.505 (2.0 RC 2)
Smallfrogs (http://www.KZTechs.com)

Windows XP Professional Service Pack 2 (Build 2600)
- 管理权限用户 - 完整功能

以下内容被选中：
所有的启动项目（包括注册表、启动文件夹、服务等）
浏览器加载项
正在运行的进程（包括进程模块信息）
文件关联

启动项目
注册表
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
<ctfmon.exe><C:\WINDOWS\system32\ctfmon.exe> [Microsoft Corporation]
<MsnMsgr><"C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background> [Microsoft Corporation]
<MSMSGS><"C:\Program Files\Messenger\msmsgs.exe" /background> [Microsoft Corporation]
[HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows]
<load><> []
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
<IMJPMIG8.1><"C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32> [Microsoft Corporation]
<PHIME2002ASync><C:\WINDOWS\System32\IME\TINTLGNT\TINTSETP.EXE /SYNC> [Microsoft Corporation]
<PHIME2002A><C:\WINDOWS\System32\IME\TINTLGNT\TINTSETP.EXE /IMEName> [Microsoft Corporation]
<IgfxTray><C:\WINDOWS\System32\igfxtray.exe> [Intel Corporation]
<HotKeysCmds><C:\WINDOWS\System32\hkcmd.exe> [Intel Corporation]
<SKYNET Personal FireWall><C:\PROGRA~1\SKYNET\FIREWALL\pfw.exe> [sky.net.cn]
<KAVPersonal50><"C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus Personal\kav.exe" /minimize> [Kaspersky Lab]
<IMSCMig><C:\PROGRA~1\COMMON~1\MICROS~1\IME\IMSC40A\IMSCMIG.EXE /Preload> [Microsoft Corporation]
<Windows Defender><"C:\Program Files\Windows Defender\MSASCui.exe" -hide> [Microsoft Corporation]
<REGSHAVE><C:\Program Files\REGSHAVE\REGSHAVE.EXE /AUTORUN> [FUJI PHOTO FILM CO., LTD.]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
<shell><Explorer.exe> [Microsoft Corporation]
<Userinit><C:\WINDOWS\system32\userinit.exe,> [Microsoft Corporation]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Windows]
<AppInit_DLLs><> []
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
<UIHost><logonui.exe> [Microsoft Corporation]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
<{57B86673-276A-48B2-BAE7-C6DBB3020EB8}><d:\ewido anti-spyware 4.0\shellexecutehook.dll> [Anti-Malware Development a.s.]

==================================
启动文件夹
[adsl]
<C:\Documents and Settings\Dicky\「开始」菜单\程序\启动\adsl.lnk><N>

==================================
服务
[Adobe LM Service / Adobe LM Service]
<"C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe"><Adobe Systems>
[ewido anti-spyware 4.0 guard / ewido anti-spyware 4.0 guard]
<d:\ewido anti-spyware 4.0\guard.exe><Anti-Malware Development a.s.>
[kavsvc / kavsvc]
<"C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus Personal\kavsvc.exe"><Kaspersky Lab>

==================================
浏览器加载项
[Messenger]
{FB5F1910-F110-11d2-BB9E-00C04F795683} <C:\Program Files\Messenger\msmsgs.exe, Microsoft Corporation>
[Windows Genuine Advantage Validation Tool]
{17492023-C23A-453E-A040-C7C580BBF700} <C:\WINDOWS\System32\LegitCheckControl.DLL, Microsoft Corporation>
[Shockwave Flash Object]
{D27CDB6E-AE6D-11CF-96B8-444553540000} <C:\WINDOWS\System32\Macromed\Flash\Flash8b.ocx, Macromedia, Inc.>
[Windows Genuine Advantage Validation Tool]
{17492023-C23A-453E-A040-C7C580BBF700} <C:\WINDOWS\System32\LegitCheckControl.DLL, Microsoft Corporation>
[XML DOM Document]
{2933BF90-7B36-11D2-B20E-00C04F983E60} <%SystemRoot%\System32\msxml3.dll, N/A>
[DHTML Edit Control Safe for Scripting for IE5]
{2D360201-FFF5-11D1-8D03-00A0C959BC0A} <C:\Program Files\Common Files\Microsoft Shared\Triedit\dhtmled.ocx, Microsoft Corporation>
[XML Document]
{48123BC4-99D9-11D1-A6B3-00C04FD91555} <%SystemRoot%\System32\msxml3.dll, N/A>
[Microsoft Web Browser]
{8856F961-340A-11D0-A96B-00C04FD705A2} <C:\WINDOWS\system32\ieframe.dll, Microsoft Corporation>
[AUDIO__MP3 Moniker Class]
{CD3AFA76-B84F-48F0-9393-7EDC34128127} <C:\WINDOWS\system32\wmp.dll, Microsoft Corporation>
[RealPlayer G2 Control]
{CFCDAA03-8BE4-11CF-B84B-0020AFBBCCFA} <C:\WINDOWS\System32\rmoc3260.dll, RealNetworks, Inc.>
[Shockwave Flash Object]
{D27CDB6E-AE6D-11CF-96B8-444553540000} <C:\WINDOWS\System32\Macromed\Flash\Flash8b.ocx, Macromedia, Inc.>
[XML HTTP]
{F6D90F16-9C73-11D3-B32E-00C04F990BB4} <%SystemRoot%\System32\msxml3.dll, N/A>
[Write a Review...]
<F1910-F110-11D2-BB9E-00C04F795683}, N/A>
[使用网际快车下载]
<d:\FlashGet\jc_link.htm, N/A>
[使用网际快车下载全部链接]
<d:\FlashGet\jc_all.htm, N/A>
[导出到 Microsoft Office Excel(&X)]
<res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000, N/A>
[用比特精灵下载(&B)]
<d:\BitSpirit\bsurl.htm, N/A>

==================================
正在运行的进程
[PID: 632][\SystemRoot\System32\smss.exe] <Microsoft Corporation><5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)>
[PID: 696][\??\C:\WINDOWS\system32\csrss.exe] <Microsoft Corporation><5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)>
[PID: 720][\??\C:\WINDOWS\system32\winlogon.exe] <Microsoft Corporation><5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)>
[PID: 764][C:\WINDOWS\system32\services.exe] <Microsoft Corporation><5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)>
[PID: 776][C:\WINDOWS\system32\lsass.exe] <Microsoft Corporation><5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)>
[PID: 928][C:\WINDOWS\system32\svchost.exe] <Microsoft Corporation><5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)>
[PID: 996][C:\WINDOWS\system32\svchost.exe] <Microsoft Corporation><5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)>
[PID: 1156][C:\WINDOWS\System32\svchost.exe] <Microsoft Corporation><5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)>
[PID: 1348][C:\WINDOWS\System32\svchost.exe] <Microsoft Corporation><5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)>
[PID: 1516][C:\WINDOWS\System32\svchost.exe] <Microsoft Corporation><5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)>
[PID: 1540][C:\WINDOWS\Explorer.EXE] <Microsoft Corporation><6.00.2900.2180 (xpsp_sp2_rtm.040803-2158)>
[PID: 1704][C:\WINDOWS\system32\spoolsv.exe] <Microsoft Corporation><5.1.2600.2696 (xpsp_sp2_gdr.050610-1519)>
[PID: 1836][C:\WINDOWS\System32\hkcmd.exe] <Intel Corporation><3,0,0,1757>
[C:\WINDOWS\System32\hccutils.DLL] <Intel Corporation><3,0,0,1757>
[C:\WINDOWS\System32\igfxdev.dll] <Intel Corporation><3,0,0,1757>
[C:\WINDOWS\System32\igfxsrvc.dll] <Intel Corporation><3,0,0,1757>
[C:\WINDOWS\System32\igfxhk.dll] <Intel Corporation><3,0,0,1757>
[C:\WINDOWS\System32\igfxres.dll] <Intel Corporation><3,0,0,1757>
[PID: 1844][C:\PROGRA~1\SKYNET\FIREWALL\pfw.exe] <sky.net.cn><2.6.1.168>
[d:\ewido anti-spyware 4.0\shellexecutehook.dll] <Anti-Malware Development a.s.><4, 0, 0, 172>
[PID: 1928][C:\WINDOWS\system32\ctfmon.exe] <Microsoft Corporation><5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)>
[PID: 1968][C:\Program Files\MSN Messenger\MsnMsgr.Exe] <Microsoft Corporation><8.0.0792.00>

瓢虫仔 - 2006-7-17 13:33:00

[C:\WINDOWS\system32\msdmo.dll] <N/A><N/A>
[PID: 2000][C:\Program Files\Messenger\msmsgs.exe] <Microsoft Corporation><4.7.3001>
[PID: 1588][C:\WINDOWS\System32\alg.exe] <Microsoft Corporation><5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)>
[PID: 876][C:\WINDOWS\system32\wscntfy.exe] <Microsoft Corporation><5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)>
[PID: 2636][C:\Program Files\Windows Defender\MSASCui.exe] <Microsoft Corporation><1.1.1347.0>
[PID: 2652][C:\Program Files\Windows Defender\MsMpEng.exe] <Microsoft Corporation><1.1.1347.0>
[PID: 3076][C:\Program Files\Internet Explorer\iexplore.exe] <Microsoft Corporation><7.00.5450.4 (winmain(wmbla).060623-0309)>
[C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus Personal\scrchpg.dll] <Kaspersky Lab><5.0.1.18>
[C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus Personal\scrch_ag.dll] <Kaspersky Lab><5.0.388.1>
[C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus Personal\FSSync.dll] <Kaspersky Lab><5.0.388.0>
[C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus Personal\pr_rmt.dll] <Kaspersky Lab><5.0.388.0>
[C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus Personal\ccclient.dll] <Kaspersky Lab><5.0.388.1>
[C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus Personal\klipc.dll] <Kaspersky Lab><5.0.388.0>
[C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus Personal\KLUtil.dll] <Kaspersky Lab><5.0.388.1>
[C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus Personal\rpt.dll] <Kaspersky Lab><5.0.388.2>
[C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus Personal\CCIFACE.dll] <Kaspersky Lab><5.0.388.1>
[C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus Personal\prloader.dll] <Kaspersky Lab><5.0.388.0>
[C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus Personal\prkernel.ppl] <Kaspersky Lab><5.0.388.0>
[c:\program files\kaspersky lab\kaspersky anti-virus personal\prstring.ppl] <Kaspersky Lab><5.0.388.0>
[c:\program files\kaspersky lab\kaspersky anti-virus personal\pr_srv.ppl] <Kaspersky Lab><5.0.388.0>
[c:\program files\kaspersky lab\kaspersky anti-virus personal\pr_clnt.ppl] <Kaspersky Lab><5.0.388.0>
[C:\WINDOWS\System32\Macromed\Flash\Flash8b.ocx] <Macromedia, Inc.><8,0,24,0>
[PID: 3536][E:\Tencent\qq\QQ.exe] <TENCENT><0, 0, 0, 0>
[E:\Tencent\qq\CoralAssist.DLL] <Coral Team><4.5.0 build 20060515>
[E:\Tencent\qq\CoralQQ.DLL] <Coral Team><4.5 Build 20060515>
[E:\Tencent\qq\ipsearcher.dll] <N/A><1.0.0.4>
[E:\Tencent\qq\QQBaseClassInDll.dll] <><1, 0, 0, 1>
[E:\Tencent\qq\QQHelperDll.dll] <><1, 0, 0, 1>
[E:\Tencent\qq\BasicCtrlDll.dll] <Tencent><5, 0, 200, 160>
[E:\Tencent\qq\QQAPI.dll] <><1, 0, 0, 1>
[E:\Tencent\qq\TIMProxy.dll] <tencent><0, 3, 2, 4>
[E:\Tencent\qq\LoginCtrl.dll] <><1, 0, 0, 1>
[E:\Tencent\qq\npkcntc.dll] <INCA Internet Co., Ltd.><2006, 3, 2, 1>
[E:\Tencent\qq\npkpdb.dll] <INCA Internet Co., Ltd.><2003, 10, 1, 1>
[E:\Tencent\qq\QQRes.dll] <tencent><1, 0, 0, 1>
[E:\Tencent\qq\QQMainFrame.dll] <N/A><N/A>
[E:\Tencent\qq\CQQApplication.dll] <N/A><N/A>
[E:\Tencent\qq\NewSkin.dll] <><1, 0, 0, 1>
[E:\Tencent\qq\HostingMgr.dll] <><1, 0, 0, 1>
[E:\Tencent\qq\CameraDll.dll] <><1, 0, 0, 1>
[E:\Tencent\qq\MailSummary.dll] <><1, 0, 0, 1>
[E:\Tencent\qq\QQSpace.dll] <><1, 0, 0, 1>
[C:\WINDOWS\system32\msdmo.dll] <N/A><N/A>
[E:\Tencent\qq\QQGroupMng.dll] <><1, 0, 0, 1>
[E:\Tencent\qq\GroupLive.dll] <N/A><N/A>
[E:\Tencent\qq\QQSettingCtrl.dll] <><1, 0, 0, 1>
[E:\Tencent\qq\QQSysMsgMng.dll] <N/A><N/A>
[E:\Tencent\qq\LongConnection.dll] <tencent><5, 0, 200, 160>
[E:\Tencent\qq\QQAvatar.dll] <N/A><N/A>
[E:\Tencent\qq\FlashAvatarDll.dll] <><1, 4, 0, 1>
[E:\Tencent\qq\UserDefinedHead.dll] <><1, 0, 0, 1>
[E:\Tencent\qq\QQPlugin.dll] <N/A><N/A>
[E:\Tencent\qq\QQConfigPlugin.dll] <><1, 0, 0, 1>
[E:\Tencent\qq\QRingMng.dll] <N/A><N/A>
[E:\Tencent\qq\PhoneAPI.dll] <><1, 0, 0, 1>
[E:\Tencent\qq\DialerAllinOne.dll] <tencent><1, 4, 0, 0>
[E:\Tencent\qq\QQPet.dll] <><1, 0, 0, 1>
[E:\Tencent\qq\QQAllInOne.dll] <N/A><N/A>
[E:\Tencent\qq\SCCore.dll] <N/A><N/A>
[E:\Tencent\qq\QQCustomFace.dll] <N/A><N/A>
[E:\Tencent\qq\BQQApplication.dll] <N/A><N/A>
[E:\Tencent\qq\PersonalDesktop.dll] <深圳市腾讯计算机系统公司QQ工作小组><1, 0, 0, 2>
[d:\ewido anti-spyware 4.0\shellexecutehook.dll] <Anti-Malware Development a.s.><4, 0, 0, 172>
[E:\Tencent\qq\CommercesMng.dll] <><1, 0, 0, 1>
[E:\Tencent\qq\QQAddr.dll] <深圳市腾讯计算机系统有限公司><5, 0, 101, 200>
[E:\Tencent\qq\QQSceneMng.dll] <N/A><N/A>
[E:\Tencent\qq\QQPhoneHelper.dll] <腾讯科技（深圳）有限公司><2, 0, 4, 40>
[E:\Tencent\qq\OEMApplication.dll] <><1, 0, 0, 1>
[C:\WINDOWS\System32\Macromed\Flash\Flash8b.ocx] <Macromedia, Inc.><8,0,24,0>
[E:\Tencent\qq\GroupConnection.dll] <Tencent><5, 0, 202, 170>
[PID: 232][E:\Tencent\qq\TIMPlatform.exe] <tencent><0, 3, 1, 8>
[E:\Tencent\qq\TIMProxy.dll] <tencent><0, 3, 2, 4>
[PID: 3900][C:\Program Files\WinRAR\WinRAR.exe] <N/A><N/A>
[PID: 1572][C:\DOCUME~1\Dicky\LOCALS~1\Temp\Rar$EX14.6654\SREng2\SREng.exe] <Smallfrogs Studio><2.0.21.505>
[C:\DOCUME~1\Dicky\LOCALS~1\Temp\Rar$EX14.6654\SREng2\Plugins\SREngPluginDemo.SRE] <Smallfrogs Studio><1, 1, 1, 0>

==================================
文件关联
.TXT OK. [%SystemRoot%\system32\NOTEPAD.EXE %1]
.EXE OK. ["%1" %*]
.COM OK. ["%1" %*]
.PIF OK. ["%1" %*]
.REG OK. [regedit.exe "%1"]
.BAT OK. ["%1" %*]
.SCR OK. ["%1" /S]
.CHM OK. ["C:\WINDOWS\hh.exe" %1]
.HLP OK. [%SystemRoot%\System32\winhlp32.exe %1]
.INI OK. [%SystemRoot%\System32\NOTEPAD.EXE %1]
.INF OK. [%SystemRoot%\System32\NOTEPAD.EXE %1]
.VBS OK. [%SystemRoot%\System32\WScript.exe "%1" %*]
.JS OK. [%SystemRoot%\System32\WScript.exe "%1" %*]
.LNK OK. [{00021401-0000-0000-C000-000000000046}]

==================================
Winsock 提供者

==================================

瓢虫仔 - 2006-7-17 20:21:00

这地方是没高手了..失望..

我无邪 - 2006-7-17 21:17:00

很遗憾，日志没看出问题
你这样试试，新建一个用户，并以这个用户登陆，看看还有这种异常吗。

yczjs - 2006-7-18 21:20:00

看一下这个贴：http://bbs.kingsoft.com/list.php?reurl=http://bbs.db.kingsoft.com/forumdisplay.php?fid=3145
楼主是那里人?

瓢虫仔 - 2006-7-20 13:45:00

鬼知道咋搞的...这论坛用FIREFOX还不能回帖....可笑...

nanfeiyan1 - 2006-7-22 10:52:00

我也发现同样的问题，

我是打开瑞星的主程序出来的，瑞星程序里的网页没出来，倒是蹦出来那个http://www.maybook.net/ad/gg.html 很气人，找不到来源。
请瑞星的工作人员尽快解决！！！
全国已经有好多地方都有类似现象发生，打开可以在百度搜 “gg.html”