瑞星卡卡安全论坛

电脑开机自动弹出网页http://toolsbar.kuaiso.com/~并且大楷过1-2分钟后会弹出另外一个网页http://www.cn2k.net/
怎么办

【回复“我姓张”的帖子】
http://forum.ikaka.com/topic.asp?board=67&artid=5188931
下载HIJACKTHIS
导出全部日志

【回复“不言放弃”的帖子】
下面是日志~看看~谢谢
Logfile of HijackThis v1.99.1
Scan saved at 14:34:42, on 2006-10-12
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
D:\2006\Rising\Rav\CCenter.exe
C:\WINDOWS\System32\svchost.exe
D:\2006\Rising\Rav\Ravmond.exe
d:\2006\rising\rfw\rfwsrv.exe
C:\WINDOWS\system32\spoolsv.exe
D:\2006\Rising\Rav\RavStub.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
d:\2006\rising\rfw\RfwMain.exe
C:\Program Files\Analog Devices\SoundMAX\SMTray.exe
D:\2006\Rising\Rav\RavTask.exe
D:\2006\Rising\Rav\Ravmon.exe
C:\WINDOWS\system32\wdfmgr32.exe
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
F:\ha_hijackthis_1991\HijackThis.exe

O2 - BHO: XBTP03129 - {71E000D6-C63D-4d95-85A0-76DF890982A3} - C:\PROGRA~1\SEARCH~1\SEARCH~1.DLL
O3 - Toolbar: (no name) - {E0E899AB-F487-11D5-8D29-0050BA6940E3} - (no file)
O3 - Toolbar: 卡卡上网安全助手 - {DB9ECD4F-FB8F-4311-B3CE-90B976C2707C} - C:\WINDOWS\system32\KakaTool.dll
O3 - Toolbar: SearchCar - {BD328E49-38AB-42CB-8EEA-73AA4CD2A6FD} - C:\Program Files\SearchCar\SearchCar.dll
O4 - HKLM\..\Run: [Smapp] C:\Program Files\Analog Devices\SoundMAX\SMTray.exe
O4 - HKLM\..\Run: [RavTask] "D:\2006\Rising\Rav\RavTask.exe" -system
O4 - HKLM\..\Run: [RfwMain] "D:\2006\Rising\Rfw\rfwmain.exe" -Startup
O4 - HKLM\..\Run: [wdfmgr32] C:\WINDOWS\system32\wdfmgr32.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O8 - Extra context menu item: 上传到QQ网络硬盘 - E:\QQ\AddToNetDisk.htm
O8 - Extra context menu item: 导出到 Microsoft Office Excel(&X) - res://c:\PROGRA~1\MICROS~3\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: 添加到QQ自定义面板 - E:\QQ\AddPanel.htm
O8 - Extra context menu item: 添加到QQ表情 - E:\QQ\AddEmotion.htm
O8 - Extra context menu item: 用QQ彩信发送该图片 - E:\QQ\SendMMS.htm
O10 - Unknown file in Winsock LSP: c:\windows\system32\srvdll.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\srvdll.dll
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: Rising Proxy  Service (RfwProxySrv) - Beijing Rising Technology Co., Ltd. - d:\2006\rising\rfw\rfwproxy.exe
O23 - Service: Rising Personal Firewall Service (RfwService) - Beijing Rising Technology Co., Ltd. - d:\2006\rising\rfw\rfwsrv.exe
O23 - Service: Rising Process Communication Center (RsCCenter) - Beijing Rising Technology Co., Ltd. - D:\2006\Rising\Rav\CCenter.exe
O23 - Service: RsRavMon Service (RsRavMon) - Beijing Rising Technology Co., Ltd. - D:\2006\Rising\Rav\Ravmond.exe
O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe

【回复“我姓张”的帖子】
结束C:\WINDOWS\system32\wdfmgr32.exe进程

修复
O3 - Toolbar: (no name) - {E0E899AB-F487-11D5-8D29-0050BA6940E3} - (no file)
O3 - Toolbar: SearchCar - {BD328E49-38AB-42CB-8EEA-73AA4CD2A6FD} - C:\Program Files\SearchCar\SearchCar.dll
O4 - HKLM\..\Run: [wdfmgr32] C:\WINDOWS\system32\wdfmgr32.exe

卸载
C:\Program Files\SearchCar\

http://cexx.org/lspfix.htm
下载LSPFix.exe
修复010项中的c:\windows\system32\srvdll.dll
修复方法参考图片
注意这次应该选中srvdll.dll
若用LSPFix.exe修复后还是不能上网
建议用WinsockFix修复注册表
WinsockFix下载：
http://www.winsockfix.nl/
(注意：此操作应该在断网或安全模式下进行)

删除
C:\Program Files\SearchCar\
C:\WINDOWS\system32\wdfmgr32.exe


附件: 36405220061012150314.jpg