我用的是傲游浏览器,现在只要打开浏览器并打开一个网页垃圾网页http://211.100.33.108/dm_lp/3man.html就自动打开,请大家帮我分析,我的HijackThis日志如下,(另外不知道3721的垃圾怎么请求,请大家一起帮我看看)
HijackThis_815汉化版扫描日志 V1.99.1
保存于 9:22:58, 日期 2006-6-18
操作系统: Windows 2000 SP4 (WinNT 5.00.2195)
浏览器: Unable to get Internet Explorer version!
当前运行的进程:
C:\WINNT\System32\smss.exe
C:\WINNT\system32\csrss.exe
C:\WINNT\system32\winlogon.exe
C:\WINNT\system32\services.exe
C:\WINNT\system32\lsass.exe
C:\WINNT\system32\svchost.exe
C:\Program Files\rising\Rav\CCenter.exe
C:\Program Files\rising\Rav\Ravmond.exe
C:\WINNT\system32\spoolsv.exe
C:\WINNT\System32\svchost.exe
C:\WINNT\System32\svchost.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\WINNT\system32\regsvc.exe
C:\WINNT\system32\MSTask.exe
C:\WINNT\System32\VIPTray.exe
C:\WINNT\System32\WBEM\WinMgmt.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\system32\inetsrv\inetinfo.exe
C:\WINNT\Explorer.EXE
C:\Program Files\输入法\jj4\jjsvr4.exe
C:\WINNT\system32\Rundll32.exe
C:\Program Files\rising\Rav\RavTask.exe
C:\WINNT\system32\ctfmon.exe
C:\WINNT\system32\rundll32.exe
C:\Program Files\rising\Rav\Ravmon.exe
C:\Program Files\Maxthon\Max.exe
C:\Program Files\FlashGet\flashget.exe
C:\WINNT\system32\rundll32.exe
C:\Program Files\HijackThis\HijackThis.exe
O2 - BHO: Shockwave Flash
Object - {14A21378-5BB1-4BC4-95D5-5D3F51527F6F} - C:\WINNT\system32\swflash.ocx
O2 - BHO: BrowserHelper Class - {2D99E8F4-56B7-457B-9A92-61B5D247D263} - C:\WINNT\system32\WinDefendor.dll
O2 - BHO: NetXfer - {83B80A9C-D91A-4F22-8DCF-EA7204039F79} - C:\Program Files\Xi\NetXfer\NXIEHelper.dll
O2 - BHO: IeCatch2 Class - {A5366673-E8CA-11D3-9CD9-0090271D075B} - C:\Program Files\FlashGet\Jccatch.dll
O2 - BHO: IE - {D157330A-9EF3-49F8-9A67-4141AC41ADD4} - C:\WINNT\downlo~1\CnsHook.dll
O4 - 启动项HKLM\\Run: [Synchronization Manager] mobsync.exe /logon
O4 - 启动项HKLM\\Run: [SoundMan] rem SOUNDMAN.EXE
O4 - 启动项HKLM\\Run: [IMSCMig] rem C:\PROGRA~1\COMMON~1\MICROS~1\IME\IMSC40A\IMSCMIG.EXE /Preload
O4 - 启动项HKLM\\Run: [RavTask] "C:\Program Files\rising\Rav\RavTask.exe" -system
O4 - 启动项HKLM\\Run: [CnsMin] rem Rundll32.exe C:\WINNT\downlo~1\CnsMin.dll,Rundll32
O4 - 启动项HKLM\\Run: [StormCodec_Helper] "C:\Program Files\Ringz Studio\Storm Codec\StormSet.exe" /S /opti
O4 - HKCU\..\Run: [ctfmon.exe] ctfmon.exe
O4 - HKCU\..\Run: [pyjj] C:\Program Files\输入法\jj4\jjsvr4.exe
O4 - Global Startup: IE-BAR.lnk = C:\WINNT\system32\rundll32.exe
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O8 - IE右键菜单中的新增项目: 使用网络传送带下载 - C:\Program Files\Xi\NetXfer\NXAddLink.html
O8 - IE右键菜单中的新增项目: 使用网络传送带下载全部链接 - C:\Program Files\Xi\NetXfer\NXAddList.html
O8 - IE右键菜单中的新增项目: 使用网际快车下载 - C:\Program Files\FlashGet\jc_link.htm
O8 - IE右键菜单中的新增项目: 使用网际快车下载全部链接 - C:\Program Files\FlashGet\jc_all.htm
O8 - IE右键菜单中的新增项目: 用快车下载全部图片 - C:\Program Files\FlashGet\jc_allpic.htm
O11 - Options group: [!CNS] 网络实名
O16 - DPF: {5932517A-3326-4439-A708-1C98EDB5C549} (Downloader Class) -
file://C:\Documents and Settings\All Users\Application Data\Share Helper\Cast\GGS\d6a66bc18b\js\iMopDl.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1142309257842
O16 - DPF: {9C628796-B6F0-4ED5-8CDC-888AB2CF145F} (Ftpcontrol Control) - http://192.168.1.104/derup/page/ftpcontrol.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{A5BDF967-1B87-42C8-8178-693CBAD36373}: NameServer = 192.168.1.101,202.102.128.68
O18 - 列举现有的协议: dic - {C21F5C32-F57A-4A0D-8E0A-B672691C52D0} - (no file)
O23 - NT 服务: Logical Disk Manager Administrative Service (dmadmin) - VERITAS Software Corp. - C:\WINNT\System32\dmadmin.exe
O23 - NT 服务: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - NT 服务: Macromedia Licensing Service - Unknown owner - C:\Program Files\Common Files\Macromedia Shared\Service\Macromedia Licensing.exe
O23 - NT 服务: Rising Process Communication Center (RsCCenter) - Beijing Rising Technology Co., Ltd. - C:\Program Files\rising\Rav\CCenter.exe
O23 - NT 服务: RsRavMon Service (RsRavMon) - Beijing Rising Technology Co., Ltd. - C:\Program Files\rising\Rav\Ravmond.exe
O23 - NT 服务: VIPTray - Unknown owner - C:\WINNT\System32\VIPTray.exe