我无邪我把你说的那个扫描完了 bbs.ikaka.com

8瞧 - 2006-9-2 9:15:00

求助啊
我用最新的瑞星也杀不出来这俩网站就是一直的往外弹用超级兔子也不好使
HijackThis_815汉化版扫描日志 V1.99.1
保存于 8:41:11, 日期 06-9-2
操作系统： Windows 98 SE (Win9x 4.10.2222A)
浏览器： Internet Explorer v6.00 SP1 (6.00.2800.1106)

当前运行的进程：
C:\WINDOWS\SYSTEM\KERNEL32.DLL
C:\WINDOWS\SYSTEM\MSGSRV32.EXE
C:\WINDOWS\SYSTEM\MPREXE.EXE
C:\PROGRAM FILES\RISING\RAV\CCENTER.EXE
C:\PROGRAM FILES\RISING\RAV\RAVMOND.EXE
C:\PROGRAM FILES\RISING\RAV\RAVMON.EXE
C:\WINDOWS\SYSTEM\mmtask.tsk
C:\WINDOWS\EXPLORER.EXE
C:\WINDOWS\SYSTEM\RPCSS.EXE
C:\WINDOWS\SYSTEM\INTERNAT.EXE
C:\WINDOWS\TASKMON.EXE
C:\WINDOWS\SYSTEM\SYSTRAY.EXE
C:\WINDOWS\RUNDLL32.EXE
C:\PROGRAM FILES\COMMON FILES\REAL\UPDATE_OB\REALSCHED.EXE
C:\PROGRAM FILES\RISING\RAV\RAVTASK.EXE
C:\WINDOWS\SYSTEM\DDHELP.EXE
C:\WINDOWS\SYSTEM\WMIEXE.EXE
C:\PROGRAM FILES\EFFICIENT NETWORKS\ENTERNET 300\APP\ENTERNET.EXE
C:\PROGRAM FILES\INTERNET EXPLORER\IEXPLORE.EXE
C:\PROGRAM FILES\INTERNET EXPLORER\IEXPLORE.EXE
C:\PROGRAM FILES\RISING\RFW\RFWMAIN.EXE
C:\PROGRAM FILES\TENCENT\QQ\QQ.EXE
C:\PROGRAM FILES\RISING\RFW\RFWSRV.EXE
C:\PROGRAM FILES\TENCENT\QQ\TIMPLATFORM.EXE
C:\WINDOWS\SYSTEM\PSTORES.EXE
C:\PROGRAM FILES\TENCENT\QQ\QQLIVEUPDATE.EXE
D:\TOOLS\HIJACKTHIS1991ZWW.EXE

O3 - IE工具栏增项: 电台(&R) - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\SYSTEM\MSDXM.OCX
O4 - 启动项HKLM\\Run: [internat.exe] internat.exe
O4 - 启动项HKLM\\Run: [ScanRegistry] C:\WINDOWS\scanregw.exe /autorun
O4 - 启动项HKLM\\Run: [TaskMonitor] C:\WINDOWS\taskmon.exe
O4 - 启动项HKLM\\Run: [SystemTray] SysTray.Exe
O4 - 启动项HKLM\\Run: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
O4 - 启动项HKLM\\Run: [Cmaudio] RunDll32 cmicnfg.cpl,CMICtrlWnd
O4 - 启动项HKLM\\Run: [NvCplDaemon] RUNDLL32.EXE NvQTwk,NvCplDaemon initialize
O4 - 启动项HKLM\\Run: [nwiz] nwiz.exe /install
O4 - 启动项HKLM\\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - 启动项HKLM\\Run: [RavTask] "C:\Program Files\Rising\Rav\RavTask.exe" -system
O4 - 启动项HKLM\\RunServices: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
O4 - 启动项HKLM\\RunServices: [RsCcenter] "C:\Program Files\Rising\Rav\CCenter.exe"
O4 - 启动项HKLM\\RunServices: [RavMond] "C:\Program Files\Rising\Rav\RavMond.exe"
O4 - 启动项HKLM\\RunServices: [RavMon] "C:\Program Files\Rising\Rav\RavMon.exe" -system
O8 - IE右键菜单中的新增项目: 使用影音传送带下载 - C:\Program Files\Xi\NetTransport 2\NTAddLink.html
O8 - IE右键菜单中的新增项目: 使用影音传送带下载全部链接 - C:\Program Files\Xi\NetTransport 2\NTAddList.html
O8 - IE右键菜单中的新增项目: 添加到QQ自定义面板 - C:\PROGRAM FILES\TENCENT\QQ\AddPanel.htm
O8 - IE右键菜单中的新增项目: 添加到QQ表情 - C:\PROGRAM FILES\TENCENT\QQ\AddEmotion.htm
O8 - IE右键菜单中的新增项目: 用QQ彩信发送该图片 - C:\PROGRAM FILES\TENCENT\QQ\SendMMS.htm
O8 - IE右键菜单中的新增项目: 上传到QQ网络硬盘 - C:\PROGRAM FILES\TENCENT\QQ\AddToNetDisk.htm
O9 - 浏览器额外的按钮: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
O9 - 浏览器额外的“工具”菜单项: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
O9 - 浏览器额外的按钮: QQ - {c95fe080-8f5d-11d2-a20b-00aa003c157b} - c:\PROGRAM FILES\TENCENT\QQ\QQ.EXE
O9 - 浏览器额外的“工具”菜单项: 腾讯QQ - {c95fe080-8f5d-11d2-a20b-00aa003c157b} - c:\PROGRAM FILES\TENCENT\QQ\QQ.EXE
O16 - DPF: {9BDBC41E-C335-4263-83C0-ECE78EE28A33} (SysMonOCX Control) - http://www.ahn.com.cn/aspservice/plugin/myfirewall20.cab
O18 - 列举现有的协议: http - {79EAC9E2-BAF9-11CE-8C82-00AA004BA90B} - C:\WINDOWS\SYSTEM\urlmon.dll
O18 - 列举现有的协议: ftp - {79EAC9E3-BAF9-11CE-8C82-00AA004BA90B} - C:\WINDOWS\SYSTEM\urlmon.dll
O18 - 列举现有的协议: gopher - {79EAC9E4-BAF9-11CE-8C82-00AA004BA90B} - C:\WINDOWS\SYSTEM\urlmon.dll
O18 - 列举现有的协议: https - {79EAC9E5-BAF9-11CE-8C82-00AA004BA90B} - C:\WINDOWS\SYSTEM\urlmon.dll
O18 - 列举现有的协议: mk - {79EAC9E6-BAF9-11CE-8C82-00AA004BA90B} - C:\WINDOWS\SYSTEM\urlmon.dll
O18 - 列举现有的协议: file - {79EAC9E7-BAF9-11CE-8C82-00AA004BA90B} - C:\WINDOWS\SYSTEM\urlmon.dll
O18 - 列举现有的协议: local - {79EAC9E7-BAF9-11CE-8C82-00AA004BA90B} - C:\WINDOWS\SYSTEM\urlmon.dll
O18 - 列举现有的协议: cdl - {3DD53D40-7B8B-11D0-B013-00AA0059CE02} - C:\WINDOWS\SYSTEM\urlmon.dll
O18 - 列举现有的协议: javascript - {3050F3B2-98B5-11CF-BB82-00AA00BDCE0B} - C:\WINDOWS\SYSTEM\MSHTML.DLL
O18 - 列举现有的协议: vbscript - {3050F3B2-98B5-11CF-BB82-00AA00BDCE0B} - C:\WINDOWS\SYSTEM\MSHTML.DLL
O18 - 列举现有的协议: about - {3050F406-98B5-11CF-BB82-00AA00BDCE0B} - C:\WINDOWS\SYSTEM\MSHTML.DLL
O18 - 列举现有的协议: res - {3050F3BC-98B5-11CF-BB82-00AA00BDCE0B} - C:\WINDOWS\SYSTEM\MSHTML.DLL
O18 - 列举现有的协议: mailto - {3050F3DA-98B5-11CF-BB82-00AA00BDCE0B} - C:\WINDOWS\SYSTEM\MSHTML.DLL
O18 - 列举现有的协议: sysimage - {76E67A63-06E9-11D2-A840-006008059382} - C:\WINDOWS\SYSTEM\MSHTML.DLL
O18 - 列举现有的协议: its - {9D148291-B9C8-11D0-A4CC-0000F80149F6} - C:\WINDOWS\SYSTEM\ITSS.DLL
O18 - 列举现有的协议: ms-its - {9D148291-B9C8-11D0-A4CC-0000F80149F6} - C:\WINDOWS\SYSTEM\ITSS.DLL
O18 - 列举现有的协议: mhtml - {05300401-BCBC-11D0-85E3-00C04FD85AB4} - C:\WINDOWS\SYSTEM\INETCOMM.DLL
O18 - 列举现有的协议: msdaipp - (no CLSID) - (no file)
O18 - 列举现有的协议: vnd.ms.radio - {3DA2AA3B-3D96-11D2-9BD2-204C4F4F5020} - C:\WINDOWS\SYSTEM\MSDXM.OCX

ceheng - 2006-9-2 10:20:00

我的也是这样，总要弹出www.duduw.com网和cj.xiao123.com，总也清除不了，好烦。
哪位帮帮忙才好，先谢谢啦！

V手术刀V - 2006-9-2 10:25:00

没有高手回答啊！我XP系统也如此了！怎么办？跪求高手帮忙！

8瞧 - 2006-9-2 12:37:00

刚才看了一会发现好多人都中这俩个网页了啊
大家帮帮忙啊

我无邪 - 2006-9-2 13:25:00

以上两们各自立帖子
请下载 System Repair Engineer，使用“智能扫描”，按下“扫描”按钮进行扫描，扫描完成后按下“保存报告”按钮保存报告日志文件（SREng.LOG），把保存的报告日志文件内容复制-粘贴上来
下载网址
http://www.kztechs.com/sreng/sreng2.zip
http://forum.ikaka.com/topic.asp?board=67&artid=5188931
日志一次粘不完，分次粘完，请不要修改。

8瞧 - 2006-9-2 20:21:00

2006-09-02,19:45:55

System Repair Engineer 2.0.21.505 (2.0 RC 2)
Smallfrogs (http://www.KZTechs.com)

Windows 98 SE -

以下内容被选中：
所有的启动项目（包括注册表、启动文件夹、服务等）
浏览器加载项
正在运行的进程（包括进程模块信息）
文件关联

启动项目
注册表
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
<internat.exe><internat.exe> [Microsoft Corporation]
<ScanRegistry><C:\WINDOWS\scanregw.exe /autorun> [Microsoft Corporation]
<TaskMonitor><C:\WINDOWS\taskmon.exe> [Microsoft Corporation]
<SystemTray><SysTray.Exe> [Microsoft Corporation]
<LoadPowerProfile><Rundll32.exe powrprof.dll,LoadCurrentPwrScheme> [Microsoft Corporation]
<Cmaudio><RunDll32 cmicnfg.cpl,CMICtrlWnd> [C-Media Corporation]
<NvCplDaemon><RUNDLL32.EXE NvQTwk,NvCplDaemon initialize> []
<nwiz><nwiz.exe /install> [NVIDIA Corporation]
<TkBellExe><"C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot> [RealNetworks, Inc.]
<RfwMain><"C:\Program Files\Rising\Rfw\rfwmain.exe" -Startup> [Beijing Rising Technology Co., Ltd.]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunServices]
<LoadPowerProfile><Rundll32.exe powrprof.dll,LoadCurrentPwrScheme> [Microsoft Corporation]
<RfwService><"C:\PROGRAM FILES\RISING\RFW\RFWSRV.EXE" -service> [Beijing Rising Technology Co., Ltd.]

==================================
启动文件夹
服务

==================================
浏览器加载项
[NTIECatcher Class]
{C56CB6B0-0D96-11D6-8C65-B2868B609932} <C:\PROGRAM FILES\XI\NETTRANSPORT 2\NTIEHELPER.DLL, Xi>
[@shdoclc.dll,-866]
{c95fe080-8f5d-11d2-a20b-00aa003c157a} <, N/A>
[Shockwave Flash Object]
{D27CDB6E-AE6D-11CF-96B8-444553540000} <C:\WINDOWS\SYSTEM\MACROMED\FLASH\FLASH.OCX, Macromedia, Inc.>
[使用影音传送带下载]
<C:\Program Files\Xi\NetTransport 2\NTAddLink.html, N/A>
[使用影音传送带下载全部链接]
<C:\Program Files\Xi\NetTransport 2\NTAddList.html, N/A>

8瞧 - 2006-9-2 20:21:00

==================================
正在运行的进程
[C:\PROGRAM FILES\RISING\RFW\INJECT.DLL] <N/A><N/A>
[PID: 4294927961][C:\WINDOWS\SYSTEM\MPREXE.EXE] <Microsoft Corporation><4.10.1998>
[C:\PROGRAM FILES\RISING\RFW\INJECT.DLL] <N/A><N/A>
[C:\PROGRAM FILES\RISING\RFW\PNGDLL.DLL] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 5>
[C:\PROGRAM FILES\RISING\RFW\RSCOMMON.DLL] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 4>
[PID: 4294852765][C:\PROGRAM FILES\RISING\RFW\RFWMAIN.EXE] <Beijing Rising Technology Co., Ltd.><4, 0, 0, 51>
[C:\PROGRAM FILES\RISING\RFW\RSGUILIB.DLL] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 23>
[C:\PROGRAM FILES\WINRAR\RAREXT.DLL] <N/A><N/A>
[C:\PROGRAM FILES\XI\NETTRANSPORT 2\NTIEHELPER.DLL] <Xi><1.60.11>
[C:\PROGRAM FILES\RISING\RFW\INJECT.DLL] <N/A><N/A>
[PID: 4294837501][C:\WINDOWS\EXPLORER.EXE] <Microsoft Corporation><4.72.3110.1>
[C:\PROGRAM FILES\RISING\RFW\INJECT.DLL] <N/A><N/A>
[C:\PROGRAM FILES\RISING\RFW\PROCLIB.DLL] <Beijing Rising Technology Co., Ltd.><4, 0, 0, 9>
[C:\PROGRAM FILES\RISING\RFW\RFWAPI.DLL] <Beijing Rising Technology Co., Ltd.><4, 0, 0, 5>
[C:\PROGRAM FILES\RISING\RFW\RFWDRV.DLL] <Beijing Rising Technology Co., Ltd.><4, 0, 0, 21>
[C:\PROGRAM FILES\RISING\RFW\RFWLOG.DLL] <Beijing Rising Technology Co., Ltd.><4, 0, 0, 6>
[C:\PROGRAM FILES\RISING\RFW\RFWRULE.DLL] <Beijing Rising Technology Co., Ltd.><4, 0, 0, 13>
[PID: 4294836537][C:\PROGRAM FILES\RISING\RFW\RFWSRV.EXE] <Beijing Rising Technology Co., Ltd.><4, 0, 0, 32>
[C:\PROGRAM FILES\RISING\RFW\INJECT.DLL] <N/A><N/A>
[PID: 4294816581][C:\WINDOWS\SYSTEM\INTERNAT.EXE] <Microsoft Corporation><4.10.2222>
[PID: 4294823445][C:\WINDOWS\TASKMON.EXE] <Microsoft Corporation><4.10.1998>
[C:\PROGRAM FILES\RISING\RFW\INJECT.DLL] <N/A><N/A>
[PID: 4294825197][C:\WINDOWS\SYSTEM\SYSTRAY.EXE] <Microsoft Corporation><4.10.2222>
[C:\PROGRAM FILES\RISING\RFW\INJECT.DLL] <N/A><N/A>
[C:\WINDOWS\SYSTEM\CMICNFG.CPL] <C-Media Corporation><1, 0, 0, 17>
[PID: 4294775821][C:\WINDOWS\RUNDLL32.EXE] <Microsoft Corporation><4.10.1998>
[C:\PROGRAM FILES\RISING\RFW\INJECT.DLL] <N/A><N/A>
[PID: 4294782993][C:\PROGRAM FILES\COMMON FILES\REAL\UPDATE_OB\REALSCHED.EXE] <RealNetworks, Inc.><0.1.0.1612>
[C:\WINDOWS\SYSTEM\NVDD32.DLL] <NVidia Corporation><4.13.01.2730>
[C:\WINDOWS\SYSTEM\NVARCH32.DLL] <NVidia Corporation><4.13.01.2730>
[C:\PROGRAM FILES\RISING\RFW\INJECT.DLL] <N/A><N/A>
[PID: 4294751445][C:\WINDOWS\SYSTEM\DDHELP.EXE] <Microsoft Corporation><4.09.00.0900>
[C:\PROGRAM FILES\COMMON FILES\REAL\PLUGINS\HTTP3260.DLL] <RealNetworks, Inc.><6.0.7.4089>
[C:\PROGRAM FILES\COMMON FILES\REAL\UPDATE_OB\SETU3270.DLL] <RealNetworks, Inc.><7.0.0.2302>
[C:\PROGRAM FILES\COMMON FILES\REAL\UPDATE_OB\RNQU3270.DLL] <RealNetworks, Inc.><7.0.0.1676>
[C:\PROGRAM FILES\RISING\RFW\INJECT.DLL] <N/A><N/A>
[C:\PROGRAM FILES\COMMON FILES\REAL\UPDATE_OB\RNAD3201.DLL] <RealNetworks, Inc.><0.1.0.1612>
[C:\PROGRAM FILES\COMMON FILES\REAL\RCAPLUGINS\UISY3201.DLL] <RealNetworks, Inc.><0.1.0.1748>
[C:\PROGRAM FILES\COMMON FILES\REAL\COMMON\OBJB3201.DLL] <RealNetworks, Inc.><0.1.0.3377>
[C:\PROGRAM FILES\COMMON FILES\REAL\UPDATE_OB\RNMS3270.DLL] <RealNetworks, Inc.><7.0.0.1443>
[PID: 4294773805][C:\PROGRAM FILES\COMMON FILES\REAL\UPDATE_OB\REALEVENT.EXE] <RealNetworks, Inc.><0.1.0.1612>
[C:\WINDOWS\SYSTEM\PNCRT.DLL] <Real Networks, Inc><6.0.0.0>
[C:\WINDOWS\SYSTEM\NETBIOS.DLL] <N/A><N/A>
[C:\PROGRAM FILES\RISING\RFW\INJECT.DLL] <N/A><N/A>
[PID: 4294736501][C:\WINDOWS\SYSTEM\WMIEXE.EXE] <Microsoft Corporation><5.00.1755.1>
[C:\WINDOWS\SYSTEM\NETBIOS.DLL] <N/A><N/A>
[C:\PROGRAM FILES\RISING\RFW\INJECT.DLL] <N/A><N/A>
[C:\PROGRAM FILES\EFFICIENT NETWORKS\ENTERNET 300\APP\RESENU.DLL] <Efficient Networks, Inc.><1, 6, 0, 7>
[PID: 4294796073][C:\PROGRAM FILES\EFFICIENT NETWORKS\ENTERNET 300\APP\ENTERNET.EXE] <N/A><N/A>
[C:\PROGRAM FILES\EFFICIENT NETWORKS\ENTERNET 300\APP\DSLAPI32.DLL] <Efficient Networks Inc.><1, 6, 0, 7>
[C:\PROGRAM FILES\EFFICIENT NETWORKS\ENTERNET 300\APP\PACKETLOG.DLL] <Efficient Networks, Inc.><1, 6, 0, 7>
[C:\PROGRAM FILES\EFFICIENT NETWORKS\ENTERNET 300\APP\RESMSGENU.DLL] <Efficient Networks, Inc.><1, 6, 0, 7>
[C:\WINDOWS\SYSTEM\MACROMED\FLASH\FLASH.OCX] <Macromedia, Inc.><7,0,19,0>
[C:\WINDOWS\SYSTEM\NETBIOS.DLL] <N/A><N/A>
[C:\PROGRAM FILES\XI\NETTRANSPORT 2\NTIEHELPER.DLL] <Xi><1.60.11>
[C:\PROGRAM FILES\RISING\RFW\INJECT.DLL] <N/A><N/A>
[PID: 4294681141][C:\PROGRAM FILES\INTERNET EXPLORER\IEXPLORE.EXE] <Microsoft Corporation><6.00.2800.1106>
[C:\PROGRAM FILES\RISING\RFW\INJECT.DLL] <N/A><N/A>
[PID: 4294617149][C:\WINDOWS\SYSTEM\MACROMED\FLASH\GETFLASH.EXE] <Macromedia, Inc.><7,0,19,0>
[C:\PROGRAM FILES\RISING\RFW\INJECT.DLL] <N/A><N/A>
[PID: 4294584057][C:\WINDOWS\SYSTEM\PSTORES.EXE] <Microsoft Corporation><5.00.1877.3>
[C:\PROGRAM FILES\RISING\RFW\INJECT.DLL] <N/A><N/A>
[PID: 4294599681][D:\DOWNLOAD\SRENG2\SRENG.EXE] <Smallfrogs Studio><2.0.21.505>

瑞星卡卡安全论坛