被www.12388.hk劫持！求助！ - 瑞星卡卡安全论坛bbs.ikaka.com

瑞星卡卡安全论坛技术交流区 反病毒/反流氓软件论坛被www.12388.hk劫持！求助！

	瑞星“1+2”全新解决方案巡展在广州画上圆满句号		叶院长揭秘：瑞星如何运用AI技术革新网络安全		俄乌冲突加剧网络攻击风险白俄罗斯政府遭APT攻击		瑞星ESM防病毒系统助力矿业大学筑牢网络安全防线
	实力拉满瑞星第五十次通过VB100测评		携手老友，拥抱新精彩 —— 新论坛新活动，感谢你的陪伴		护航司法，瑞星助力山西省高院构建安全防线		人工智能在网络安全领域的风险和机遇

1

1 / 1 页

跳转页

被www.12388.hk劫持！求助！

bykie 初生襁褓狮帖子:3 注册: 2005-07-21 来自:	发表于： 2005-07-21 23:02 \| 只看楼主短消息资料字号：小中大 1楼被www.12388.hk劫持！求助！ Logfile of HijackThis v1.99.1 Scan saved at 22:55:57, on 2005-7-21 Platform: Windows XP SP1 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\csrss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\System32\wdfmgr.exe C:\Program Files\MSN Apps\Updater\01.02.3000.1001\zh-cn\msnappau.exe C:\WINDOWS\Explorer.EXE c:\program files\internet explorer\iexplore.exe C:\WINDOWS\SOUNDMAN.EXE C:\WINDOWS\System32\igfxtray.exe C:\WINDOWS\System32\hkcmd.exe C:\WINDOWS\System32\RunDll32.exe C:\Program Files\Conexant\AccessRunner ADSL\CnxDslTb.exe D:\msnshell.exe C:\PROGRA~1\YDT\YDTMain.exe C:\Program Files\Internet Explorer\syssmss.exe C:\WINDOWS\System32\conime.exe D:\KWatchUI.EXE D:\MailMon.EXE C:\Program Files\MSN Messenger\msnmsgr.exe D:\Common\Bin\WinCinemaMgr.exe D:\KAVPlus.EXE C:\Documents and Settings\Owner\桌面\HijackThis.exe R3 - URLSearchHook: Tencent Url Search Hook - {DB8B2393-7A6C-4C76-88CE-6B1F6FF6FFE9} - C:\WINDOWS\Downloaded Program Files\TBHMain.dll R3 - URLSearchHook: 上网助手 - {BB936323-19FA-4521-BA29-ECA6A121BC78} - C:\PROGRA~1\3721\Assist\asbar.dll F2 - REG:system.ini: Shell= O2 - BHO: ThunderIEHelper Class - {0005A87D-D626-4B3A-84F9-1D9571695F55} - C:\WINDOWS\System32\xunleibho_v6.dll O2 - BHO: Tencent Browser Helper - {0C7C23EF-A848-485B-873C-0ED954731014} - C:\WINDOWS\Downloaded Program Files\TBHMain.dll O2 - BHO: Anti Fish - {38928D50-8A48-44C2-945F-D2F23F771410} - C:\Program Files\3721\Assist\Angling.dll O2 - BHO: QQIEHelper - {54EBD53A-9BC1-480B-966A-843A333CA162} - C:\Program Files\Tencent\qq\QQIEHelper.dll O2 - BHO: PCTools Site Guard - {5C8B2A36-3DB1-42A4-A3CB-D426709BBFEB} - C:\PROGRA~1\SPYWAR~1\tools\iesdsg.dll O2 - BHO: ST - {9394EDE7-C8B5-483E-8773-474BF36AF6E4} - C:\Program Files\MSN Apps\ST\01.03.0000.1005\en-xu\stmain.dll O2 - BHO: IeCatch2 Class - {A5366673-E8CA-11D3-9CD9-0090271D075B} - D:\PROGRA~1\FLASHGET\jccatch.dll O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll O2 - BHO: PCTools Browser Monitor - {B56A7D7D-6927-48C8-A975-17DF180C71AC} - C:\PROGRA~1\SPYWAR~1\tools\iesdpb.dll O2 - BHO: AssistII - {BB936323-19FA-4521-BA29-ECA6A121BC78} - C:\PROGRA~1\3721\Assist\asbar.dll O2 - BHO: MSNToolBandBHO - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Apps\MSN Toolbar\01.02.4000.1001\zh-cn\msntb.dll O2 - BHO: IEHlprObj Class - {EE7C3CF0-4B15-11D1-ABED-709549C10000} - C:\PROGRA~1\INTERN~1\HMAPI.dll O3 - Toolbar: 电台(&R) - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx O3 - Toolbar: MSN - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Apps\MSN Toolbar\01.02.4000.1001\zh-cn\msntb.dll O3 - Toolbar: 上网助手 - {BB936323-19FA-4521-BA29-ECA6A121BC78} - C:\PROGRA~1\3721\Assist\asbar.dll O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32 O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\System32\IME\TINTLGNT\TINTSETP.EXE /SYNC O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\System32\IME\TINTLGNT\TINTSETP.EXE /IMEName O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\System32\igfxtray.exe O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\System32\hkcmd.exe O4 - HKLM\..\Run: [Cmaudio] RunDll32 cmicnfg.cpl,CMICtrlWnd O4 - HKLM\..\Run: [CnxDslTaskBar] C:\Program Files\Conexant\AccessRunner ADSL\CnxDslTb.exe O4 - HKLM\..\Run: [Expatch] rem C:\WINDOWS\System32\system32win.exe O4 - HKLM\..\Run: [MSNShell] D:\msnshell.exe autorun O4 - HKLM\..\Run: [Internat] rem C:\WINDOWS\Downloaded Program Files\#.exe O4 - HKLM\..\Run: [msnappau] "C:\Program Files\MSN Apps\Updater\01.02.3000.1001\zh-cn\msnappau.exe" O4 - HKLM\..\Run: [NTdhcp] rem C:\WINDOWS\System32\NTdhcp.exe O4 - HKLM\..\Run: [YDTMain.exe] C:\PROGRA~1\YDT\YDTMain.exe O4 - HKLM\..\Run: [WinsSystem] C:\Program Files\Internet Explorer\syssmss.exe O4 - HKLM\..\Run: [RealPlayer] C:\WINDOWS\Bridge.exe O4 - HKLM\..\Run: [dl_accel] rem C:\Program Files\3721\Dlaccel\YDownloader.exe O4 - HKLM\..\Run: [3721] C:\$NtUninstallQ5926809$\3721.bat O4 - HKLM\..\Run: [cnyisou_com] rem http://www.dddzzz.com O4 - HKLM\..\Run: [internat.exe] internat.exe O4 - HKLM\..\Run: [KAVRUN] D:\KAVRUN.EXE O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background O4 - Startup: 腾讯QQ.lnk = C:\Program Files\Tencent\qq\QQ.exe O4 - Global Startup: InterVideo WinCinema Manager.lnk = D:\Common\Bin\WinCinemaMgr.exe O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Restrictions present O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present O8 - Extra context menu item: &Google Search - res://C:\Program Files\Google\GoogleToolbar1.dll/cmsearch.html O8 - Extra context menu item: &使用下载加速专家下载 - C:\Program Files\3721\Dlaccel\geturl.htm O8 - Extra context menu item: 使用网际快车下载 - D:\Program Files\FlashGet\jc_link.htm O8 - Extra context menu item: 使用网际快车下载全部链接 - D:\Program Files\FlashGet\jc_all.htm O8 - Extra context menu item: 反向链接 - res://C:\Program Files\Google\GoogleToolbar1.dll/cmbacklinks.html O8 - Extra context menu item: 添加QQ网络收藏夹 - C:\Program Files\Tencent\TT\NAF.htm O8 - Extra context menu item: 添加到QQ自定义面板 - C:\Program Files\Tencent\qq\AddPanel.htm O8 - Extra context menu item: 添加到QQ表情 - C:\Program Files\Tencent\qq\AddEmotion.htm O8 - Extra context menu item: 用QQ彩信发送该图片 - C:\Program Files\Tencent\qq\SendMMS.htm O8 - Extra context menu item: 类似网页 - res://C:\Program Files\Google\GoogleToolbar1.dll/cmsimilar.html O8 - Extra context menu item: 缓存的网页快照 - res://C:\Program Files\Google\GoogleToolbar1.dll/cmcache.html O9 - Extra button: 手机短信 - {00000000-0000-0001-0001-596BAEDD1289} - http://sms.3721.com/ie/index.htm?pid=U_3721_assist (file missing) O9 - Extra button: Spyware Doctor - {2D663D1A-8670-49D9-A1A5-4C56B4E14E84} - C:\PROGRA~1\SPYWAR~1\tools\iesdpb.dll O9 - Extra button: Yahoo 1G电邮 - {507F9113-CD77-4866-BA92-0E86DA3D0B97} - http://cn.mail.yahoo.com/promo/rd1 (file missing) O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm O9 - Extra 'Tools' menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm O9 - Extra button: QQ - {c95fe080-8f5d-11d2-a20b-00aa003c157b} - C:\Program Files\Tencent\qq\QQ.EXE O9 - Extra 'Tools' menuitem: 腾讯QQ - {c95fe080-8f5d-11d2-a20b-00aa003c157b} - C:\Program Files\Tencent\qq\QQ.EXE O9 - Extra button: (no name) - {DEDEB80D-FA35-45d9-9460-4983E5A8AFE6} - C:\Program Files\Tencent\qq\QQIEHelper.dll O9 - Extra 'Tools' menuitem: QQ炫彩工具条设置 - {DEDEB80D-FA35-45d9-9460-4983E5A8AFE6} - C:\Program Files\Tencent\qq\QQIEHelper.dll O9 - Extra button: 情景聊天 - {E5D12C4E-7B4F-11D3-B5C9-0050045C3C96} - http://cn.rd.yahoo.com/home/messenger/bjk/clientbtn/?http://cn.messenger.yahoo.com/ (file missing) O11 - Options group: [TBH] QQ地址栏搜索 O14 - IERESET.INF: START_PAGE_URL=http://www.foundertech.com O16 - DPF: {0CA54D3F-CEAE-48AF-9A2B-31909CB9515D} (Edit Class) - https://www.sz1.cmbchina.com/download/CMBEdit.cab O16 - DPF: {2354A44B-3CEB-4829-9940-545B03103538} (PowerPlr Control) - http://bbsky.wuhan.net.cn/htyy/plugin/PowerPlr.ocx O16 - DPF: {3D8F74EE-8692-4F8F-B8D2-7522E732519E} (WebActivater Control) - http://game.qq.com/QQGame2.cab O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://spaces.msn.com//PhotoUpload/MsnPUpld.cab O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/MsnMessengerSetupDownloader.cab O16 - DPF: {DF780F87-FF2B-4DF8-92D0-73DB16A1543A} (PopCapLoader Object) - http://zone.msn.com/bingame/zuma/default/popcaploader_v5.cab O16 - DPF: {E4E2F180-CB8B-4DE9-ACBB-DA745D3BA153} (Rising Web Scan Object) - http://download.rising.com.cn/register/pcver/autoupgradepad/Ver2005/OL2005.cab O17 - HKLM\System\CCS\Services\Tcpip\..\{DBBCFC65-2CBD-4796-A56A-8F1F3FBFA858}: NameServer = 202.103.24.68 O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxsrvc.dll O23 - Service: Remote Packet Capture Protocol v.0 (experimental) (rpcapd) - Unknown owner - %ProgramFiles%\WinPcap\rpcapd.exe" -d -f "%ProgramFiles%\WinPcap\rpcapd.ini (file missing) O23 - Service: Win_Fix - Unknown owner - C:\WINDOWS\(数值未设置).exe 2005-07-22 12:59:28
bykie 初生襁褓狮帖子:3 注册: 2005-07-21 来自:	分享到：

花落花又开社区嘉宾帖子:6782 注册: 2005-04-16 来自:	发表于： 2005-07-21 23:10 \| 短消息资料字号：小中大 2楼修复: R3 - URLSearchHook: Tencent Url Search Hook - {DB8B2393-7A6C-4C76-88CE-6B1F6FF6FFE9} - C:\WINDOWS\Downloaded Program Files\TBHMain.dll F2 - REG:system.ini: Shell O2 - BHO: Tencent Browser Helper - {0C7C23EF-A848-485B-873C-0ED954731014} - C:\WINDOWS\Downloaded Program Files\TBHMain.dll O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\System32\igfxtray.exe O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\System32\hkcmd.exe O4 - HKLM\..\Run: [Expatch] rem C:\WINDOWS\System32\system32win.exe O4 - HKLM\..\Run: [MSNShell] D:\msnshell.exe autorun O4 - HKLM\..\Run: [Internat] rem C:\WINDOWS\Downloaded Program Files\#.exe O4 - HKLM\..\Run: [NTdhcp] rem C:\WINDOWS\System32\NTdhcp.exe O4 - HKLM\..\Run: [RealPlayer] C:\WINDOWS\Bridge.exe O4 - HKLM\..\Run: [dl_accel] rem C:\Program Files\3721\Dlaccel\YDownloader.exe O4 - HKLM\..\Run: [3721] C:\$NtUninstallQ5926809$\3721.bat O4 - HKLM\..\Run: [cnyisou_com] rem http://www.dddzzz.com O4 - HKLM\..\Run: [RealPlayer] C:\WINDOWS\Bridge.exe O4 - HKLM\..\Run: [3721] C:\$NtUninstallQ5926809$\3721.bat O4 - HKLM\..\Run: [cnyisou_com] rem http://www.dddzzz.com O14 - IERESET.INF: START_PAGE_URL=http://www.foundertech.com O16 - DPF: {0CA54D3F-CEAE-48AF-9A2B-31909CB9515D} (Edit Class) - https://www.sz1.cmbchina.com/download/CMBEdit.cab O16 - DPF: {2354A44B-3CEB-4829-9940-545B03103538} (PowerPlr Control) - http://bbsky.wuhan.net.cn/htyy/plugin/PowerPlr.ocxO23 - Service: Remote Packet Capture Protocol v.0 (experimental) (rpcapd) - Unknown owner - %ProgramFiles%\WinPcap\rpcapd.exe" -d -f "%ProgramFiles%\WinPcap\rpcapd.ini (file missing) O23 - Service: Win_Fix - Unknown owner - C:\WINDOWS\(数值未设置).exe 删除文件: C:\WINDOWS\Downloaded Program Files\TBHMain.dll C:\WINDOWS\Downloaded Program Files\TBHMain.dll C:\WINDOWS\System32\system32win.exe D:\msnshell.exe autorun C:\WINDOWS\Downloaded Program Files\#.exe C:\WINDOWS\System32\NTdhcp.exe C:\WINDOWS\Bridge.exe C:\Program Files\3721\Dlaccel\YDownloader.exe C:\$NtUninstallQ5926809$\3721.bat C:\$NtUninstallQ5926809$\3721.bat C:\WINDOWS\(数值未设置).exe
花落花又开社区嘉宾帖子:6782 注册: 2005-04-16 来自:

花落花又开社区嘉宾帖子:6782 注册: 2005-04-16 来自:	发表于： 2005-07-21 23:10 \| 短消息资料字号：小中大 3楼眼睛看花了...楼主真给我的眼睛好好的上了一课...
花落花又开社区嘉宾帖子:6782 注册: 2005-04-16 来自:

魔法学徒卡卡技术团队帖子:11465 注册: 2004-10-03 来自:	发表于： 2005-07-21 23:11 \| 短消息资料字号：小中大 4楼重新启动电脑, 开机检测完后, 按[F8]键(可以一直按到启动菜单出来为止), 选择安全模式进入Windows 终止下列进程 C:\Program Files\Internet Explorer\syssmss.exe 运行Hijackthis，扫描结束后在下列选项前打上勾，然后选修复“Fix Checked”： F2 - REG:system.ini: Shell= O2 - BHO: IEHlprObj Class - {EE7C3CF0-4B15-11D1-ABED-709549C10000} - C:\PROGRA~1\INTERN~1\HMAPI.dll O4 - HKLM\..\Run: [Expatch] rem C:\WINDOWS\System32\system32win.exe O4 - HKLM\..\Run: [Internat] rem C:\WINDOWS\Downloaded Program Files\#.exe O4 - HKLM\..\Run: [NTdhcp] rem C:\WINDOWS\System32\NTdhcp.exe O4 - HKLM\..\Run: [WinsSystem] C:\Program Files\Internet Explorer\syssmss.exe O4 - HKLM\..\Run: [RealPlayer] C:\WINDOWS\Bridge.exe O4 - HKLM\..\Run: [3721] C:\$NtUninstallQ5926809$\3721.bat O4 - HKLM\..\Run: [cnyisou_com] rem http://www.dddzzz.com O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Restrictions present O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present O23 - Service: Remote Packet Capture Protocol v.0 (experimental) (rpcapd) - Unknown owner - %ProgramFiles%\WinPcap\rpcapd.exe" -d -f "%ProgramFiles%\WinPcap\rpcapd.ini (file missing) O23 - Service: Win_Fix - Unknown owner - C:\WINDOWS\(数值未设置).exe 显示隐藏文件双击我的电脑--工具---文件夹选项--查看选项卡--单击选取"显示隐藏文件或文件夹"--清除"隐藏受保护的操作系统文件（推荐）"复选框。在提示您确定更改时，单击“是”--单击“确定”。然后找到如下文件并删除（如果有的话）。 C:\Program Files\Internet Explorer\syssmss.exe C:\PROGRA~1\INTERN~1\HMAPI.dll C:\WINDOWS\System32\system32win.exe C:\WINDOWS\Downloaded Program Files\#.exe C:\WINDOWS\System32\NTdhcp.exe C:\WINDOWS\Bridge.exe C:\$NtUninstallQ5926809$\整个目录 C:\WINDOWS\(数值未设置).exe 如果文件无法删除，请到 [必读]反浏览器劫持论坛说明及常用小软件下载 http://forum.ikaka.com/topic.asp?board=67&artid=5188931 下载KillBox来删除。使用方法可参考：介绍 KillBox@Qoo 的使用 http://forum.ikaka.com/topic.asp?board=28&artid=5454397
魔法学徒卡卡技术团队帖子:11465 注册: 2004-10-03 来自:

bykie 初生襁褓狮帖子:3 注册: 2005-07-21 来自:	发表于： 2005-07-21 23:23 \| 只看楼主短消息资料字号：小中大 5楼预先谢一下，我去试试吧
bykie 初生襁褓狮帖子:3 注册: 2005-07-21 来自:

bykie 初生襁褓狮帖子:3 注册: 2005-07-21 来自:	发表于： 2005-07-21 23:27 \| 只看楼主短消息资料字号：小中大 6楼呃可不可以问一下那个C:\Program Files\Internet Explorer\syssmss.exe是个什么鬼进程啊？？？居然是最近才创建的……
bykie 初生襁褓狮帖子:3 注册: 2005-07-21 来自:

WilliamKang 初生襁褓狮帖子:146 注册: 2005-07-22 来自:	发表于： 2005-07-22 08:07 \| 短消息资料字号：小中大 7楼出示各种 --脚本错误--如何办？？请教帮主！！
WilliamKang 初生襁褓狮帖子:146 注册: 2005-07-22 来自:

魔法学徒卡卡技术团队帖子:11465 注册: 2004-10-03 来自:	发表于： 2005-07-22 08:16 \| 短消息资料字号：小中大 8楼【回复“WilliamKang”的帖子】打开ie--工具--internet选项--高级--浏览--选中“禁止脚本调试”
魔法学徒卡卡技术团队帖子:11465 注册: 2004-10-03 来自:

建能横据古稀狮帖子:5755 注册: 2005-04-01 来自:	发表于： 2005-07-22 08:45 \| 短消息资料字号：小中大 9楼 O23 - Service: Win_Fix - Unknown owner - C:\WINDOWS\(数值未设置).exe 楼主这一项要特别注意，你进入注册表定位到HKEY_LOCAL_MACHINE\ SYSTEM\ CURRENT CONTROLSET\ SERVICES \ 病毒服务名称 {因为在正常情况下，键值名称为默认时，它的数据项是数值未设置，你双击键值名称为默认时，弹出的数值设置的对话匡是空百，而你的这个病毒在双击键值名称为默认时，弹出的数值设置的对话匡是{数值未设置).exe ，把这项删除既可。你不注意的话很难查出这个病毒。
建能横据古稀狮帖子:5755 注册: 2005-04-01 来自:

建能横据古稀狮帖子:5755 注册: 2005-04-01 来自:	发表于： 2005-07-22 12:59 \| 短消息资料字号：小中大 10楼 O23 - Service: Win_Fix - Unknown owner - C:\WINDOWS\(数值未设置).exe 你不注意的话很难查出这个病毒。顶。
建能横据古稀狮帖子:5755 注册: 2005-04-01 来自:

<<上一主题|下一主题>>

1

1 / 1 页

跳转页

页面顶部

Powered by Discuz!NT