瑞星卡卡安全论坛技术交流区反病毒/反流氓软件论坛 我的机器总是自动弹出网页,可是瑞星杀不出毒来啊,这是怎么了?

1   1  /  1  页   跳转

我的机器总是自动弹出网页,可是瑞星杀不出毒来啊,这是怎么了?

我的机器总是自动弹出网页,可是瑞星杀不出毒来啊,这是怎么了?

我的机器,只要一上网就会不断的弹出一些网页,基本全是广告类的。用瑞星卡卡助手加入黑名单也不管用。加入网页屏蔽也不管用。
比如http://www.kuaiso.net/lovevip.asp?channelid=502&user_id=28085&Parent_Id=edmchina,
http://tl.linktone.com/wzlm/longindex.html?user_id=010010136#,
http://img.zhangxiu.com/2/202.html?f=2960,
http://211.100.23.57/MiniWeb/index.aspx?pid=0089&from=1等。
请问,这是怎么回事呢?
总是出弹出网页很烦人的,影响工作,瑞星杀没毒,瑞星的ie修复也没用,有人能帮我处理一下吗?
谢谢了!
最后编辑2006-02-11 11:48:26
分享到:
gototop
 

http://forum.ikaka.com/topic.asp?board=28&artid=6979213
下载HIJACKTHIS
导出日志
gototop
 

HijackThis_zww汉化版扫描日志 V1.99.1
保存于      10:24:01, 日期 2006-2-11
操作系统:  Windows 2000 SP4 (WinNT 5.00.2195)
浏览器:    Internet Explorer v6.00 SP1 (6.00.2800.1106)

当前运行的进程:         
C:\WINNT\System32\smss.exe
C:\WINNT\system32\winlogon.exe
C:\WINNT\system32\services.exe
C:\WINNT\system32\lsass.exe
C:\WINNT\system32\svchost.exe
C:\Program Files\Rising\Rav\CCenter.exe
C:\Program Files\Rising\Rav\Ravmond.exe
C:\WINNT\system32\spoolsv.exe
C:\WINNT\system32\drivers\CDAC11BA.EXE
C:\WINNT\system32\svchost.exe
C:\WINNT\system32\regsvc.exe
C:\WINNT\system32\MSTask.exe
C:\WINNT\system32\stisvc.exe
C:\Program Files\Common Files\COMM\Network.exe
C:\WINNT\System32\WBEM\WinMgmt.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\Explorer.EXE
C:\WINNT\system32\RUNDLL32.exe
C:\Program Files\Rising\Rav\RavTask.exe
C:\Program Files\Rising\Rav\Ravmon.exe
C:\Program Files\MSN Messenger\msnmsgr.exe
C:\WINNT\system32\ctfmon.exe
D:\lizk\qq\TIMPlatform.exe
D:\lizk\qq\QQ.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Documents and Settings\Administrator\桌面\2535952005811174944\HijackThis1991zww.exe

R3 - 默认的URLSearchHook丢失。用HijackThis修复
O2 - BHO: wmpdrm - {0E674588-66B7-4E19-9D0E-2053B800F69F} - C:\WINNT\system32\wmpdrm.dll
O2 - BHO: (no name) - {16A770A0-0E87-4278-B748-2460D64A8386}? - (no file)
O2 - BHO: BHelper - {8A4280AD-9B37-4922-A51D-73F3C3A32AF7} -

C:\WINNT\system32\msibm\cfsbho.dll
O2 - BHO: MacroMediapd - {B8CCDD47-38E4-4CD2-B7FA-3B4B690F74BD} -

C:\WINNT\system32\microapmddt.dll
O3 - IE工具栏增项: @msdxmLC.dll,-1@2052,电台(&R) - {8E718888-423F-11D2-876E-00A0C9082467} -

C:\WINNT\system32\msdxm.ocx
O3 - IE工具栏增项: 卡卡上网安全助手 - {DB9ECD4F-FB8F-4311-B3CE-90B976C2707C} -

C:\WINNT\system32\kakatool.dll
O4 - 启动项HKLM\\Run: [Synchronization Manager] mobsync.exe /logon
O4 - 启动项HKLM\\Run: [IMSCMig] C:\PROGRA~1\COMMON~1\MICROS~1\IME\IMSC40A\IMSCMIG.EXE

/Preload
O4 - 启动项HKLM\\Run: [mscfs] RUNDLL32 C:\WINNT\system32\msibm\cfsys.dll,cfs
O4 - 启动项HKLM\\Run: [spoolsv] C:\WINNT\system32\spoolsv\spoolsv.exe -printer
O4 - 启动项HKLM\\Run: [RavTask] "C:\Program Files\Rising\Rav\RavTask.exe" -system
O4 - HKCU\..\Run: [Yahoo! Pager] "D:\lizk\Messenger\ypager.exe" -quiet
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background
O4 - HKCU\..\Run: [internat.exe] internat.exe
O8 - IE右键菜单中的新增项目: 添加到QQ表情 - D:\lizk\qq\AddEmotion.htm
O9 - 浏览器额外的按钮: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} -

C:\WINNT\web\related.htm
O9 - 浏览器额外的“工具”菜单项: Show &Related Links -

{c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINNT\web\related.htm
O16 - DPF: {106E49CF-797A-11D2-81A2-00E02C015623} (AlternaTIFF ActiveX) -

http://www.alternatiff.com/install/00/alttiff.cab
O16 - DPF: {28E0FA88-ABA8-4937-A247-3031F1A11165} - http://dl.51.net/download/diybar2.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) -

http://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1125631

694281
O16 - DPF: {98A62E3F-A8C5-4EF0-8A00-C70CF9D18A89} (LoaderCore Class) -

http://tb.sogou.com/DLLoader.cab
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) -

http://messenger.msn.com/download/msnmessengersetupdownloader.cab
O16 - DPF: {C7D7CC85-4485-41AC-BBFB-39BD95481DAE} (PatTifAcTiveX Control) -

http://211.157.104.85:8080/cnipr/PatTifAcTiveX.ocx
O17 - HKLM\System\CCS\Services\Tcpip\..\{BEA0D65F-9FA8-40A3-8E14-DDE5E15B7708}: NameServer =

192.168.0.1
O17 - HKLM\System\CCS\Services\Tcpip\..\{DC1ADEDD-537B-4580-A95A-F7D8BFD8ED18}: NameServer =

192.168.0.254
O23 - NT 服务: ATI Smart - Unknown owner - C:\WINNT\system32\ati2sgag.exe
O23 - NT 服务: Autodesk Licensing Service - Autodesk, Inc. - C:\Program Files\Common

Files\Autodesk Shared\Service\AdskScSrv.exe
O23 - NT 服务: C-DillaCdaC11BA - Macrovision - C:\WINNT\system32\drivers\CDAC11BA.EXE
O23 - NT 服务: Logical Disk Manager Administrative Service (dmadmin) - VERITAS Software

Corp. - C:\WINNT\System32\dmadmin.exe
O23 - NT 服务: Rising Process Communication Center (RsCCenter) - Beijing Rising Technology

Co., Ltd. - C:\Program Files\Rising\Rav\CCenter.exe
O23 - NT 服务: RsRavMon Service (RsRavMon) - Beijing Rising Technology Co., Ltd. -

C:\Program Files\Rising\Rav\Ravmond.exe
O23 - NT 服务: Network System (Universal Disk Manager) - COMENET TECHNOLOGY - C:\Program

Files\Common Files\COMM\Network.exe

gototop
 

结束C:\Program Files\Common Files\COMM\Network.exe进程

修复
R3 - 默认的URLSearchHook丢失。用HijackThis修复
O2 - BHO: wmpdrm - {0E674588-66B7-4E19-9D0E-2053B800F69F} - C:\WINNT\system32\wmpdrm.dll
O2 - BHO: (no name) - {16A770A0-0E87-4278-B748-2460D64A8386}? - (no file)
O2 - BHO: BHelper - {8A4280AD-9B37-4922-A51D-73F3C3A32AF7} - C:\WINNT\system32\msibm\cfsbho.dll
O2 - BHO: MacroMediapd - {B8CCDD47-38E4-4CD2-B7FA-3B4B690F74BD} - C:\WINNT\system32\microapmddt.dll
O4 - 启动项HKLM\\Run: [mscfs] RUNDLL32 C:\WINNT\system32\msibm\cfsys.dll,cfs
O4 - 启动项HKLM\\Run: [spoolsv] C:\WINNT\system32\spoolsv\spoolsv.exe -printer
O23 - NT 服务: Network System (Universal Disk Manager) - COMENET TECHNOLOGY - C:\Program Files\Common Files\COMM\Network.exe

双击C:\WINNT\system32\msibm下的uninstall程序
卸载清除C:\WINNT\system32\msibm文件夹

删除
C:\WINNT\system32\wmpdrm.dll
C:\WINNT\system32\microapmddt.dll
C:\WINNT\system32\msibm
C:\WINNT\system32\spoolsv\spoolsv.exe
C:\Program Files\Common Files\COMM
C:\WINNT\system32\spoolsv
gototop
 

不让结束C:\Program Files\Common Files\COMM\Network.exe进程。用任务管理器和HijackThis都不让删除啊,拒绝访问,怎么能删除?
gototop
 

问题解决了,谢谢
gototop
 
1   1  /  1  页   跳转
页面顶部
Powered by Discuz!NT