1   1  /  1  页   跳转

无故弹出网页.怎样解决呀?

无故弹出网页.怎样解决呀?

我的电脑开机时会自动弹出某一网站,关了后.就会每隔一段时间弹出一个网,我用了好几去掉插件的程序,也没有搞定,怎么办?


扫描结果:
Logfile of HijackThis v1.99.1
Scan saved at 10:29:53, on 2006-9-19
Platform: Windows 2000 SP4 (WinNT 5.00.2195)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
E:\WINNT\System32\smss.exe
E:\WINNT\system32\winlogon.exe
E:\WINNT\system32\services.exe
E:\WINNT\system32\lsass.exe
E:\WINNT\system32\Ati2evxx.exe
e:\program files\rising\rfw\rfwsrv.exe
E:\WINNT\system32\svchost.exe
E:\Program Files\Rising\Rav\CCenter.exe
E:\Program Files\Rising\Rav\Ravmond.exe
E:\WINNT\system32\spoolsv.exe
E:\WINNT\system32\svchost.exe
E:\WINNT\system32\regsvc.exe
E:\WINNT\system32\MSTask.exe
E:\WINNT\System32\WBEM\WinMgmt.exe
E:\WINNT\system32\svchost.exe
E:\Program Files\Rising\Rav\RavStub.exe
E:\WINNT\Explorer.EXE
E:\Program Files\Rising\Rav\RavTask.exe
E:\Program Files\Rising\Rav\Ravmon.exe
H:\CCIR\bin\ibguard.exe
E:\WINNT\system32\internat.exe
H:\CCIR\bin\ibserver.exe
E:\Program Files\Rising\Rav\RsAgent.exe
E:\Tencent\qq\QQ.exe
E:\Tencent\qq\TIMPlatform.exe
E:\Tencent\qq\QQ.exe
E:\PROGRA~1\Yahoo!\Assistant\yassistse.exe
E:\Program Files\Internet Explorer\iexplore.exe
E:\Program Files\Internet Explorer\IEXPLORE.EXE
E:\Documents and Settings\Administrator\桌面\新建文件夹\ha_hijackthis_1991\HijackThis.exe

R3 - Default URLSearchHook is missing
O2 - BHO: ThunderIEHelper Class - {0005A87D-D626-4B3A-84F9-1D9571695F55} - E:\WINNT\system32\xunleibho_v3.dll
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - E:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll (file missing)
O2 - BHO: QQIEHelper - {54EBD53A-9BC1-480B-966A-843A333CA162} - E:\Tencent\qq\QQIEHelper.dll
O3 - Toolbar: @msdxmLC.dll,-1@2052,电台(&R) - {8E718888-423F-11D2-876E-00A0C9082467} - E:\WINNT\system32\msdxm.ocx
O3 - Toolbar: 5460 Toolbar - {6AE02E1C-8859-4F57-9097-5A55A56A4CAF} - E:\WINNT\Downloaded Program Files\5460.dll (file missing)
O3 - Toolbar: 卡卡上网安全助手 - {DB9ECD4F-FB8F-4311-B3CE-90B976C2707C} - E:\WINNT\system32\kakatool.dll
O4 - HKLM\..\Run: [RavTask] "E:\Program Files\Rising\Rav\RavTask.exe" -system
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [InterBaseGuardian] H:\CCIR\bin\ibguard.exe -a
O4 - HKLM\..\Run: [RfwMain] "E:\Program Files\Rising\Rfw\rfwmain.exe" -Startup
O4 - HKLM\..\Run: [yassistse] "E:\PROGRA~1\Yahoo!\Assistant\yassistse.exe"
O4 - HKLM\..\RunOnce: [Super Rabbit Winspeed] "E:\Documents and Settings\Administrator\桌面\新建文件夹\winspeed778beta\winspeed.exe" /autokill:105
O4 - HKCU\..\Run: [internat.exe] internat.exe
O4 - HKCU\..\Run: [Docserv] H:\CCIR\docserv.exe -a
O4 - Startup: 腾讯qq.lnk = E:\Tencent\qq\QQ.exe
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O8 - Extra context menu item: &使用迅雷下载 - E:\Program Files\Sandai Technologies Inc\Thunder\geturl.htm
O8 - Extra context menu item: &使用迅雷下载全部链接 - E:\Program Files\Sandai Technologies Inc\Thunder\getAllurl.htm
O8 - Extra context menu item: 上传到QQ网络硬盘 - E:\Tencent\qq\AddToNetDisk.htm
O8 - Extra context menu item: 添加到QQ自定义面板 - E:\Tencent\qq\AddPanel.htm
O8 - Extra context menu item: 添加到QQ表情 - E:\Tencent\qq\AddEmotion.htm
O8 - Extra context menu item: 用QQ彩信发送该图片 - E:\Tencent\qq\SendMMS.htm
O9 - Extra button: QQ - {c95fe080-8f5d-11d2-a20b-00aa003c157b} - E:\Tencent\qq\QQ.EXE
O9 - Extra 'Tools' menuitem: 腾讯QQ - {c95fe080-8f5d-11d2-a20b-00aa003c157b} - E:\Tencent\qq\QQ.EXE
O9 - Extra button: (no name) - {DEDEB80D-FA35-45d9-9460-4983E5A8AFE6} - E:\Tencent\qq\QQIEHelper.dll
O9 - Extra 'Tools' menuitem: QQ炫彩工具条设置 - {DEDEB80D-FA35-45d9-9460-4983E5A8AFE6} - E:\Tencent\qq\QQIEHelper.dll
O14 - IERESET.INF: SEARCH_PAGE_URL=
O14 - IERESET.INF: START_PAGE_URL=
O16 - DPF: _{78AF2F24-A9C3-11D3-BF8C-0060B0FCC122} - file://E:\Program Files\AutoCAD 2002\AcDcToday.ocx
O16 - DPF: _{F281A59C-7B65-11D3-8617-0010830243BD} - file://E:\Program Files\AutoCAD 2002\AcPreview.ocx
O16 - DPF: {6AE02E1C-8859-4F57-9097-5A55A56A4CAF} (5460 Toolbar) - http://images.5460.net/toolbar/webinstall/5460.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{81F8EC11-3A86-40EF-B502-007F2F9FF225}: NameServer = 61.147.37.1,61.177.7.1
O23 - Service: ATI Smart - Unknown owner - E:\WINNT\system32\ati2sgag.exe
O23 - Service: C-DillaSrv - C-Dilla Ltd - E:\WINNT\system32\DRIVERS\CDANTSRV.EXE
O23 - Service: Logical Disk Manager Administrative Service (dmadmin) - VERITAS Software Corp. - E:\WINNT\System32\dmadmin.exe
O23 - Service: Rising Proxy  Service (RfwProxySrv) - Beijing Rising Technology Co., Ltd. - e:\program files\rising\rfw\rfwproxy.exe
O23 - Service: Rising Personal Firewall Service (RfwService) - Beijing Rising Technology Co., Ltd. - e:\program files\rising\rfw\rfwsrv.exe
O23 - Service: Rising Process Communication Center (RsCCenter) - Beijing Rising Technology Co., Ltd. - E:\Program Files\Rising\Rav\CCenter.exe
O23 - Service: RsRavMon Service (RsRavMon) - Beijing Rising Technology Co., Ltd. - E:\Program Files\Rising\Rav\Ravmond.exe

最后编辑2006-09-20 07:51:11
分享到:
gototop
 

清理IE临时文件夹,在控制面板,internet选项里,然后清理IE,无效就用Hijackthis扫个日志上来
不要用雅虎,本身就是流氓软件
gototop
 

好象是最近一个新的流氓软件  会自动关闭杀毒
主要特征是 弹出巨多广告 感染U盘
双击U盘后 自动关闭杀毒
用WIN优化大师 看启动项 发现有很多插件的EXE程序一起运行
有一个红底的黑龙标记 叫TROJAN PROGRAM C:\WINDOWS\WINLOGON.EXE
打开该文件夹 选 工具 文件夹选项 查看  取消 隐藏受保护的操作系统文件前的 钩子  显示所有文件和文件夹
可以看见 被隐藏的 EXEROUTE.EXE EXPLORER.COM FINDER.COM SMSS.EXE WINLOGON.EXE 5个
但是删除后无效。。。还是会再生
gototop
 

还有就是
大写的
C:WINDOWS/SOUNDMAN。EXE
gototop
 

在进程中有一个alexa.exe,杀掉后还会再出现,在WINNT/SYSTEM32里有一AT.EXE文件,删掉后马上会再出来一个.

也不知这个病毒的进程是藏在哪里的
gototop
 

修复
O14 - IERESET.INF: SEARCH_PAGE_URL=
O14 - IERESET.INF: START_PAGE_URL=
用超级兔子清理流氓软件和IE,

你说的在WINNT/SYSTEM32里有一AT.EXE文件是不是这个?显卡增强工具
E:\WINNT\system32\Ati2evxx.exe
gototop
 

AT不是那个.
用兔子清了,没用.

我详细说下症状:开机会打开7yin.com这个网站,等几十分钟打开另外一个,就是每隔几十分钟就会打开一个网站,总共四个网站,轮流打开.
在开机时进程中有一个IEXPLORE.EXE进程,但在下面任务栏中看不到,进程中还有 alexa.exe杀掉后会重新出现.
gototop
 

IEXPLORE.EXE正常进程
进入安全模式
中止alexa.exe
显示所有文件
删除E:\WINNT\system32\AlxTB1.dll
alexa.exe
开始,运行regedit
找到相关注册表项目删除
修复
O2 - BHO: ThunderIEHelper Class - {0005A87D-D626-4B3A-84F9-1D9571695F55} - E:\WINNT\system32\xunleibho_v3.dll
gototop
 

昨晚发现在进程中有一popwin.exe 进程,经搜索资料后认为是灰鸽子变种,在电脑中查找POPWIN,发现与之有关的三个文件,popwin.dll,popwinexe,还有一个忘了,呵呵.然后按楼上说法做了一遍后,重启,开机不再出现那个网站了
gototop
 
1   1  /  1  页   跳转
页面顶部
Powered by Discuz!NT