尖头叉子 - 2006-11-12 23:04:00
菜鸟求助：IE自动弹出广告窗口（弹出HTTP:\\），本人另建了一个用户，但IE还是自动弹出广告窗口！为此特别的烦恼，求助各位高手，谢谢。
日记如下：
Logfile of HijackThis v1.99.1
Scan saved at 22:50:32, on 2006-11-12
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
D:\Program Files\Rising\Rav\CCenter.exe
C:\WINDOWS\System32\svchost.exe
D:\Program Files\Rising\Rav\Ravmond.exe
d:\program files\rising\rfw\rfwsrv.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Antiy Labs\Alive\AliveCenter.exe
D:\Program Files\Rising\Rav\RavStub.exe
C:\WINDOWS\system32\drivers\CDAC11BA.EXE
C:\WINDOWS\system32\DRIVERS\CDANTSRV.EXE
C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
d:\program files\rising\rfw\RfwMain.exe
C:\Program Files\DU Meter\DUMeter.exe
C:\WINDOWS\VM_STI.EXE
D:\Program Files\Rising\Rav\RavTask.exe
D:\Program Files\DAEMON Tools\daemon.exe
C:\WINDOWS\system32\ctfmon.exe
D:\Program Files\Rising\Rav\Ravmon.exe
C:\WINDOWS\system32\svchost.exe
D:\Program Files\TTPlayer\TTPlayer.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\WINDOWS\system32\NOTEPAD.EXE
F:\ha_hijackthis_1991\HijackThis.exe
O3 - Toolbar: 卡卡上网安全助手 - {DB9ECD4F-FB8F-4311-B3CE-90B976C2707C} - C:\WINDOWS\system32\KakaTool.dll
O4 - HKLM\..\Run: [DU Meter] C:\Program Files\DU Meter\DUMeter.exe
O4 - HKLM\..\Run: [BigDogPath] C:\WINDOWS\VM_STI.EXE USB PC Camera 301P
O4 - HKLM\..\Run: [RavTask] "D:\Program Files\Rising\Rav\RavTask.exe" -system
O4 - HKLM\..\Run: [RfwMain] "D:\Program Files\Rising\Rfw\rfwmain.exe" -Startup
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O4 - HKLM\..\Run: [DAEMON Tools] "d:\Program Files\DAEMON Tools\daemon.exe" -lang 1033
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\CTFMON.EXE
O4 - HKCU\..\Run: [bgswitch] C:\WINDOWS\system32\bgswitch.exe
O4 - Global Startup: AutoCAD 启动加速器.lnk = C:\Program Files\Common Files\Autodesk Shared\acstart16.exe
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm (file missing)
O9 - Extra 'Tools' menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm (file missing)
O9 - Extra button: QQ - {c95fe080-8f5d-11d2-a20b-00aa003c157b} - D:\Program Files\Tencent\qq\QQ.EXE
O9 - Extra 'Tools' menuitem: 腾讯QQ - {c95fe080-8f5d-11d2-a20b-00aa003c157b} - D:\Program Files\Tencent\qq\QQ.EXE
O9 - Extra button: 访问瑞星网站 - {FF2DE7A6-ECB1-4CBC-9C0E-D92A9E66E444} - http://www.rising.com.cn (file missing)
O9 - Extra button: 访问卡卡社区 - {FF2DE7A6-ECB1-4CBC-9C0E-D92A9E66E445} - http://www.ikaka.com (file missing)
O10 - Unknown file in Winsock LSP: c:\windows\system32\aelupsvc32.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\aelupsvc32.dll
O16 - DPF: {C661F36D-DF85-4EF4-83C7-E107B83D04B1} (WebActivater Control) - http://dl_dir.qq.com/3dshow/3DShowVM.cab
O16 - DPF: {F281A59C-7B65-11D3-8617-0010830243BD} (AcPreview 控件) - file://D:\Program Files\AutoCAD 2002\AcPreview.ocx
O17 - HKLM\System\CCS\Services\Tcpip\..\{23789EE3-1B92-4281-825D-E106D423A666}: NameServer = 202.103.224.68
O17 - HKLM\System\CS1\Services\Tcpip\..\{23789EE3-1B92-4281-825D-E106D423A666}: NameServer = 202.103.224.68
O17 - HKLM\System\CS2\Services\Tcpip\..\{23789EE3-1B92-4281-825D-E106D423A666}: NameServer = 202.103.224.68
O20 - Winlogon Notify: WBSrv - D:\WINDOW~1\wbsrv.dll (file missing)
O23 - Service: Antiy live update (Alive Auto-Update Service) - Unknown owner - C:\Program Files\Antiy Labs\Alive\AliveCenter.exe
O23 - Service: Ati HotKey Poller - Unknown owner - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: Autodesk Licensing Service - Autodesk - C:\Program Files\Common Files\Autodesk Shared\Service\AdskScSrv.exe
O23 - Service: C-DillaCdaC11BA - Macrovision - C:\WINDOWS\system32\drivers\CDAC11BA.EXE
O23 - Service: C-DillaSrv - C-Dilla Ltd - C:\WINDOWS\system32\DRIVERS\CDANTSRV.EXE
O23 - Service: Macromedia Licensing Service - Unknown owner - C:\Program Files\Common Files\Macromedia Shared\Service\Macromedia Licensing.exe
O23 - Service: Rising Proxy Service (RfwProxySrv) - Beijing Rising Technology Co., Ltd. - d:\program files\rising\rfw\rfwproxy.exe
O23 - Service: Rising Personal Firewall Service (RfwService) - Beijing Rising Technology Co., Ltd. - d:\program files\rising\rfw\rfwsrv.exe
O23 - Service: Rising Process Communication Center (RsCCenter) - Beijing Rising Technology Co., Ltd. - D:\Program Files\Rising\Rav\CCenter.exe
O23 - Service: Rising RealTime Monitor (RsRavMon) - Beijing Rising Technology Co., Ltd. - D:\Program Files\Rising\Rav\Ravmond.exe
进程如下：
Process list saved on 22:52:47, on 2006-11-12
Platform: Windows XP SP2 (WinNT 5.01.2600)
[pid] [full path to filename] [file version] [company name]
700 C:\WINDOWS\System32\smss.exe 5.1.2600.2180 Microsoft Corporation
1268 C:\WINDOWS\system32\winlogon.exe 5.1.2600.2180 Microsoft Corporation
1412 C:\WINDOWS\system32\services.exe 5.1.2600.2180 Microsoft Corporation
1432 C:\WINDOWS\system32\lsass.exe 5.1.2600.2180 Microsoft Corporation
1648 C:\WINDOWS\system32\Ati2evxx.exe 6.14.10.4103
1660 C:\WINDOWS\system32\svchost.exe 5.1.2600.2180 Microsoft Corporation
1840 D:\Program Files\Rising\Rav\CCenter.exe 18.0.0.3 Beijing Rising Technology Co., Ltd.
1884 C:\WINDOWS\System32\svchost.exe 5.1.2600.2180 Microsoft Corporation
240 D:\Program Files\Rising\Rav\Ravmond.exe 18.0.1.47 Beijing Rising Technology Co., Ltd.
456 d:\program files\rising\rfw\rfwsrv.exe 4.0.0.33 Beijing Rising Technology Co., Ltd.
652 C:\WINDOWS\system32\spoolsv.exe 5.1.2600.2696 Microsoft Corporation
808 C:\Program Files\Antiy Labs\Alive\AliveCenter.exe 1.0.0.1
864 D:\Program Files\Rising\Rav\RavStub.exe 18.0.0.16 Beijing Rising Technology Co., Ltd.
1212 C:\WINDOWS\system32\drivers\CDAC11BA.EXE 4.20.20.0 Macrovision
1308 C:\WINDOWS\system32\DRIVERS\CDANTSRV.EXE 3.24.10.0 C-Dilla Ltd
1332 C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe 2.0.-14809.42 Microsoft Corporation
732 C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE 7.0.9466.0 Microsoft Corporation
1484 C:\WINDOWS\system32\Ati2evxx.exe 6.14.10.4103
1632 C:\WINDOWS\Explorer.EXE 6.0.2900.2649 Microsoft Corporation
1500 d:\program files\rising\rfw\RfwMain.exe 4.0.0.52 Beijing Rising Technology Co., Ltd.
2728 C:\Program Files\DU Meter\DUMeter.exe 3.0.7.192 Hagel Technologies
2744 C:\WINDOWS\VM_STI.EXE 4.2.610.4 VM.
2752 D:\Program Files\Rising\Rav\RavTask.exe 18.0.0.22 Beijing Rising Technology Co., Ltd.
2784 D:\Program Files\DAEMON Tools\daemon.exe 4.0.0.0 DT Soft Ltd.
2792 C:\WINDOWS\system32\ctfmon.exe 5.1.2600.2180 Microsoft Corporation
2908 D:\Program Files\Rising\Rav\Ravmon.exe 18.0.1.39 Beijing Rising Technology Co., Ltd.
3364 C:\WINDOWS\system32\svchost.exe 5.1.2600.2180 Microsoft Corporation
604 D:\Program Files\TTPlayer\TTPlayer.exe 4.6.8.0 Alen Soft
2440 C:\Program Files\Internet Explorer\iexplore.exe 6.0.2900.2180 Microsoft Corporation
4084 C:\WINDOWS\system32\NOTEPAD.EXE 5.1.2600.2180 Microsoft Corporation
516 C:\WINDOWS\system32\NOTEPAD.EXE 5.1.2600.2180 Microsoft Corporation
340 F:\ha_hijackthis_1991\HijackThis.exe 1.99.0.1 Soeperman Enterprises Ltd.
尖头叉子 - 2006-11-13 0:53:00
请高手们看一下吧，帮帮忙，看看到底是哪一个进程在做怪，谢谢了
尖头叉子 - 2006-11-13 0:57:00
启动列表日记：
StartupList report, 2006-11-13, 上午 12:45:56
StartupList version: 1.52.2
Started from : F:\ha_hijackthis_1991\HijackThis.EXE
Detected: Windows XP SP2 (WinNT 5.01.2600)
Detected: Internet Explorer v6.00 SP2 (6.00.2900.2180)
* Using default options
==================================================
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
D:\Program Files\Rising\Rav\CCenter.exe
C:\WINDOWS\System32\svchost.exe
D:\Program Files\Rising\Rav\Ravmond.exe
d:\program files\rising\rfw\rfwsrv.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\drivers\CDAC11BA.EXE
C:\WINDOWS\system32\DRIVERS\CDANTSRV.EXE
C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
D:\Program Files\Rising\Rav\RavStub.exe
d:\program files\rising\rfw\RfwMain.exe
C:\Program Files\DU Meter\DUMeter.exe
C:\WINDOWS\VM_STI.EXE
D:\Program Files\Rising\Rav\RavTask.exe
D:\Program Files\Rising\Rav\Ravmon.exe
D:\Program Files\DAEMON Tools\daemon.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Internet Explorer\IEXPLORE.exe
C:\WINDOWS\system32\conime.exe
D:\Program Files\Spybot - Search & Destroy\SpybotSD.exe
F:\ha_hijackthis_1991\HijackThis.exe
--------------------------------------------------
Listing of startup folders:
Shell folders Common Startup:
[C:\Documents and Settings\All Users\「开始」菜单\程序\启动]
AutoCAD 启动加速器.lnk = C:\Program Files\Common Files\Autodesk Shared\acstart16.exe
--------------------------------------------------
Checking Windows NT UserInit:
[HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
UserInit = C:\WINDOWS\SYSTEM32\Userinit.exe,
--------------------------------------------------
Autorun entries from Registry:
HKLM\Software\Microsoft\Windows\CurrentVersion\Run
DU Meter = C:\Program Files\DU Meter\DUMeter.exe
BigDogPath = C:\WINDOWS\VM_STI.EXE USB PC Camera 301P
RavTask = "D:\Program Files\Rising\Rav\RavTask.exe" -system
RfwMain = "D:\Program Files\Rising\Rfw\rfwmain.exe" -Startup
KernelFaultCheck = %systemroot%\system32\dumprep 0 -k
DAEMON Tools = "d:\Program Files\DAEMON Tools\daemon.exe" -lang 1033
--------------------------------------------------
Autorun entries from Registry:
HKCU\Software\Microsoft\Windows\CurrentVersion\Run
ctfmon.exe = C:\WINDOWS\system32\ctfmon.exe
bgswitch = C:\WINDOWS\system32\bgswitch.exe
Super Rabbit Desktop Search = D:\超级兔子魔法设置\SRSearch.exe
--------------------------------------------------
Autorun entries in Registry subkeys of:
HKLM\Software\Microsoft\Windows\CurrentVersion\Run
[OptionalComponents]
*No values found*
[RsAutorunsDisabled]
VVSN = C:\Program Files\VVSN\VVSN.exe
--------------------------------------------------
Shell & screensaver key from C:\WINDOWS\SYSTEM.INI:
Shell=*INI section not found*
SCRNSAVE.EXE=*INI section not found*
drivers=*INI section not found*
Shell & screensaver key from Registry:
Shell=Explorer.exe
SCRNSAVE.EXE=C:\WINDOWS\System32\logon.scr
drivers=*Registry value not found*
Policies Shell key:
HKCU\..\Policies: Shell=*Registry value not found*
HKLM\..\Policies: Shell=*Registry value not found*
--------------------------------------------------
Enumerating Browser Helper Objects:
(no name) - D:\PROGRA~1\SPYBOT~1\SDHelper.dll - {53707962-6F74-2D53-2644-206D7942484F}
--------------------------------------------------
Enumerating Download Program Files:
[WebActivater Control]
InProcServer32 = C:\WINDOWS\system32\3DShowVM.ocx
CODEBASE = http://dl_dir.qq.com/3dshow/3DShowVM.cab
[Shockwave Flash Object]
InProcServer32 = C:\WINDOWS\System32\macromed\flash\Flash9.ocx
CODEBASE = http://fpdownload.macromedia.com/pub/shockwave/cabs/flash/swflash.cab
[AcPreview 控件]
InProcServer32 = C:\WINDOWS\DOWNLO~1\ACPREV~1.OCX
CODEBASE = file://D:\Program Files\AutoCAD 2002\AcPreview.ocx
--------------------------------------------------
Enumerating Winsock LSP files:
Protocol #1: C:\WINDOWS\system32\aelupsvc32.dll
Protocol #21: C:\WINDOWS\system32\aelupsvc32.dll
--------------------------------------------------
Enumerating Windows NT logon/logoff scripts:
*No scripts set to run*
Windows NT checkdisk command:
BootExecute = autocheck autochk *
Windows NT 'Wininit.ini':
PendingFileRenameOperations: D:\Config.Msi\35bb4.rbf|||s
--------------------------------------------------
Enumerating ShellServiceObjectDelayLoad items:
PostBootReminder: C:\WINDOWS\system32\SHELL32.dll
CDBurn: C:\WINDOWS\system32\SHELL32.dll
WebCheck: C:\WINDOWS\system32\webcheck.dll
SysTray: C:\WINDOWS\system32\stobject.dll
--------------------------------------------------
End of report, 5,658 bytes
Report generated in 0.047 seconds
Command line options:
/verbose - to add additional info on each section
/complete - to include empty sections and unsuspicious data
/full - to include several rarely-important sections
/force9x - to include Win9x-only startups even if running on WinNT
/forcent - to include WinNT-only startups even if running on Win9x
/forceall - to include all Win9x and WinNT startups, regardless of platform
/history - to list version history only
红夜鬼1 - 2006-11-13 8:14:00
运行Hijackthis，把下面的选中打上钩，修复
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm (file missing)
O9 - Extra 'Tools' menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm (file missing)
O10 - Unknown file in Winsock LSP: c:\windows\system32\aelupsvc32.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\aelupsvc32.dll
O20 - Winlogon Notify: WBSrv - D:\WINDOW~1\wbsrv.dll (file missing)
请下载LSPFix和WinsockXPFix这两个软件，
小软件下载
http://free5.ys168.com/?ufwihgu168
重新启动电脑, 进入安全模式。运行LSPFix.exe，删除：
aelupsvc32.dll
如果无法上网，请运行WinsockXPFix，
让它修复一下。
使用360安全卫士清除插件
.360下载地址:
http://www.xdowns.com/soft/8/9/2006/Soft_31554.html
使用后删除360安全卫士
© 2000 - 2026 Rising Corp. Ltd.