瑞星卡卡安全论坛技术交流区反病毒/反流氓软件论坛 【求助】浏览器被劫持了,域名劫持,求助啊

1   1  /  1  页   跳转

【求助】浏览器被劫持了,域名劫持,求助啊

【求助】浏览器被劫持了,域名劫持,求助啊

输入很多网址后,打开的都是这个页面。
比如输入 www.jyka.cn ,打开的就是图中这个页面;
如果输入其他网址如 www.XXXXXXX.cn,除了左上角的jyka.cn变为XXXXX.cn其他部分和图里一模一样。
郁闷啊,打开很多网站的时候都是这样啊。
用360safe、卡卡,都查不出有什么恶意软件,Hosts文件早就被我删除了的。
大虾帮忙啊。

附件附件:

下载次数:320
文件类型:image/pjpeg
文件大小:
上传时间:2007-4-16 12:42:52
描述:



最后编辑2007-05-06 09:18:47
分享到:
gototop
 

点页面上右边的搜索,打开的是cn.yahoo.com/搜索页面
gototop
 

下载 System Repair Engineer,
下载地址:http://www.kztechs.com/sreng/download.html

1 解压缩sreng2.zip;
2 运行SREng.exe;
3 智能扫描—>扫描—>保存报告;
4 把日志中的报告完整拷贝贴上来,不要修改,一次发不了分多次发。
gototop
 

[CODE]

2007-04-16,19:00:51

System Repair Engineer 2.4.12.806
Smallfrogs (http://www.KZTechs.com)

Windows 2000 Professional Service Pack 4 (Build 2195) - 管理权限用户 - 完整功能

以下内容被选中:
    所有的启动项目(包括注册表、启动文件夹、服务等)
    浏览器加载项
    正在运行的进程(包括进程模块信息)
    文件关联
    Winsock 提供者
    Autorun.inf
    HOSTS 文件


启动项目
注册表
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
    <Internat.exe><Internat.exe>  [(Verified)Microsoft Windows 2000 Publisher]
[HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows]
    <load><>  [N/A]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
    <Synchronization Manager><mobsync.exe /logon>  [(Verified)Microsoft Windows 2000 Publisher]
    <IgfxTray><C:\WINNT\system32\igfxtray.exe>  [(Verified)Microsoft Windows 2000 Publisher]
    <HotKeysCmds><C:\WINNT\system32\hkcmd.exe>  [(Verified)Microsoft Windows Hardware Compatibility Publisher]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
    <shell><Explorer.exe>  [(Verified)Microsoft Windows 2000 Publisher]
    <Userinit><C:\WINNT\system32\userinit.exe,>  [(Verified)Microsoft Windows 2000 Publisher]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Windows]
    <AppInit_DLLs><>  [N/A]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\>{22d6f312-b0f6-11d0-94ab-0080c74c7e95}]
    <Microsoft Windows Media Player><C:\WINNT\system32\setup\wmpocm.exe /ShowWMP>  [(Verified)Microsoft Windows 2000 Publisher]

==================================
启动文件夹
N/A

==================================
服务
[Logical Disk Manager Administrative Service / dmadmin][Stopped/Manual Start]
  <C:\WINNT\System32\dmadmin.exe /com><VERITAS Software Corp.>
[MPSVC Service / MPSVCService][Running/Auto Start]
  <C:\Program Files\Micropoint\MPSVC.exe><Micropoint Corporation>
[Portable Media Serial Number Service / WmdmPmSN][Stopped/Manual Start]
  <C:\WINNT\System32\svchost.exe -k netsvcs-->C:\WINNT\system32\mspmsnsv.dll><Microsoft Corporation>

==================================
驱动程序
[aeaudio / aeaudio][Running/Manual Start]
  <system32\drivers\aeaudio.sys><Andrea Electronics Corporation>
[dmboot / dmboot][Stopped/Disabled]
  <System32\drivers\dmboot.sys><VERITAS Software Corp.>
[Logical Disk Manager Driver / dmio][Running/Boot Start]
  <\SystemRoot\System32\drivers\dmio.sys><VERITAS Software Corp.>
[dmload / dmload][Running/Boot Start]
  <\SystemRoot\System32\drivers\dmload.sys><VERITAS Software Corp.>
[Intel(R) PRO Adapter Driver / E100B][Running/Manual Start]
  <system32\DRIVERS\e100bnt5.sys><Intel Corporation>
[ialm / ialm][Running/Manual Start]
  <system32\DRIVERS\ialmnt5.sys><Intel Corporation>
[mp110001 / mp110001][Running/Auto Start]
  <system32\drivers\mp110001.sys><MicroPoint Corporation>
[mp110002 / mp110002][Running/Auto Start]
  <system32\drivers\mp110002.sys><Micropoint Corporation>
[mp110003 / mp110003][Running/Boot Start]
  <\SystemRoot\system32\drivers\mp110003.sys><Micropoint Corporation>
[mp110004 / mp110004][Running/Auto Start]
  <system32\drivers\mp110004.sys><Micropoint Corporation>
[mp110005 / mp110005][Running/Manual Start]
  <system32\drivers\mp110005.sys><Micropoint Corporation>
[mp110006 / mp110006][Running/System Start]
  <system32\drivers\mp110006.sys><Micropoint Corporation>
[mp110007 / mp110007][Running/System Start]
  <system32\drivers\mp110007.sys><Micropoint Corporation>
[mp110008 / mp110008][Running/Auto Start]
  <system32\drivers\mp110008.sys><Micropoint Corporation>
[mp110009 / mp110009][Running/System Start]
  <system32\drivers\mp110009.sys><Micropoint Corporation>
[mp110010 / mp110010][Running/Boot Start]
  <\SystemRoot\system32\drivers\mp110010.sys><Micropoint Corporation>
[mp110011 / mp110011][Running/System Start]
  <system32\drivers\mp110011.sys><Micropoint Corporation>
[mp110012 / mp110012][Stopped/Manual Start]
  <system32\drivers\mp110012.sys><Micropoint Corporation>
[mp110013 / mp110013][Running/Boot Start]
  <\SystemRoot\system32\drivers\mp110013.sys><Micropoint Corporation>
[Direct Parallel Link Driver / Ptilink][Running/Manual Start]
  <system32\DRIVERS\ptilink.sys><Parallel Technologies, Inc.>
[smwdm / smwdm][Running/Manual Start]
  <system32\drivers\smwdm.sys><Analog Devices, Inc.>
[World Standard Teletext Codec / WSTCODEC][Stopped/Manual Start]
  <system32\DRIVERS\WSTCODEC.SYS><Microsoft Corporation>
[Intel(R) Graphics Platform (SoftBIOS) Driver / {6080A529-897E-4629-A488-ABA0C29B635E}][Running/Manual Start]
  <system32\drivers\ialmsbw.sys><Intel Corporation>
[Intel(R) Graphics Chipset (KCH) Driver / {D31A0762-0CEB-444e-ACFF-B049A1F6FE91}][Running/Manual Start]
  <system32\drivers\ialmkchw.sys><Intel Corporation>

==================================
gototop
 

浏览器加载项
[WebThunder Browser Helper]
  {00000AAA-A363-466E-BEF5-9BB68697AA7F} <d:\Program Files\Thunder Network\WebThunder\WebThunderBHO_016.dll, Thunder Networking Technologies,LTD>
[启动Web迅雷]
  {962EFB8E-2683-42d4-AC74-AAA4C759B9C6} <http://my.xunlei.com, N/A>
[@shdoclc.dll,-866]
  {c95fe080-8f5d-11d2-a20b-00aa003c157a} <, N/A>
[@msdxmLC.dll,-1@2052,电台(&R)]
  {8E718888-423F-11D2-876E-00A0C9082467} <C:\WINNT\system32\msdxm.ocx, Microsoft Corporation>
[Shockwave Flash Object]
  {D27CDB6E-AE6D-11CF-96B8-444553540000} <C:\WINNT\system32\Macromed\Flash\Flash9c.ocx, Adobe Systems, Inc.>
[使用Web迅雷下载]
  <d:\Program Files\Thunder Network\WebThunder\GetUrl.htm, N/A>
[使用Web迅雷下载全部链接]
  <d:\Program Files\Thunder Network\WebThunder\GetAllUrl.htm, N/A>

==================================
正在运行的进程
[PID: 156][\SystemRoot\System32\smss.exe]  [Microsoft Corporation, 5.00.2195.6601]
[PID: 180][\??\C:\WINNT\system32\csrss.exe]  [Microsoft Corporation, 5.00.2195.6601]
[PID: 176][\??\C:\WINNT\system32\winlogon.exe]  [Microsoft Corporation, 5.00.2195.6714]
    [C:\Program Files\Micropoint\mp110031.dll]  [Micropoint Corporation, 1.2.10033]
    [C:\WINNT\system32\wdmaud.drv]  [Microsoft Corporation, 5.00.2195.6673]
    [C:\WINNT\system32\msacm32.drv]  [Microsoft Corporation, 5.00.2134.1]
[PID: 228][C:\WINNT\system32\services.exe]  [Microsoft Corporation, 5.00.2195.6700]
    [C:\Program Files\Micropoint\mp110031.dll]  [Micropoint Corporation, 1.2.10033]
    [C:\WINNT\system32\dmserver.dll]  [VERITAS Software Corp., 2195.6605.297.3]
[PID: 240][C:\WINNT\system32\lsass.exe]  [Microsoft Corporation, 5.00.2195.6695]
    [C:\Program Files\Micropoint\mp110031.dll]  [Micropoint Corporation, 1.2.10033]
[PID: 988][C:\WINNT\Explorer.EXE]  [Microsoft Corporation, 5.00.3700.6690]
    [C:\WINNT\AppPatch\AcLayers.DLL]  [Microsoft Corporation, 5.00.2195.6717]
    [C:\Program Files\Micropoint\mp110031.dll]  [Micropoint Corporation, 1.2.10033]
    [C:\WINNT\system32\wdmaud.drv]  [Microsoft Corporation, 5.00.2195.6673]
    [C:\WINNT\system32\msacm32.drv]  [Microsoft Corporation, 5.00.2134.1]
    [d:\Program Files\Thunder Network\WebThunder\WebThunderBHO_016.dll]  [Thunder Networking Technologies,LTD, 6, 0, 0, 5]
    [C:\WINNT\system32\MSVCP60.dll]  [Microsoft Corporation, 6.00.8972.0]
    [C:\WINNT\system32\msadp32.acm]  [Microsoft Corporation, 5.00.2134.1]
    [C:\Program Files\WinRAR\rarext.dll]  [N/A, ]
[PID: 1080][C:\WINNT\system32\igfxtray.exe]  [Intel Corporation, 3.0.0.2249]
    [C:\WINNT\system32\hccutils.DLL]  [Intel Corporation, 3.0.0.2249]
    [C:\Program Files\Micropoint\mp110031.dll]  [Micropoint Corporation, 1.2.10033]
    [C:\WINNT\system32\igfxdev.dll]  [Intel Corporation, 3.0.0.2249]
    [C:\WINNT\system32\igfxsrvc.dll]  [Intel Corporation, 3.0.0.2249]
    [C:\WINNT\system32\igfxres.dll]  [Intel Corporation, 3.0.0.2249]
    [C:\WINNT\system32\igfxress.dll]  [Intel Corporation, 3.0.0.2249]
[PID: 1076][C:\WINNT\system32\hkcmd.exe]  [Intel Corporation, 3.0.0.2249]
    [C:\WINNT\system32\hccutils.DLL]  [Intel Corporation, 3.0.0.2249]
    [C:\Program Files\Micropoint\mp110031.dll]  [Micropoint Corporation, 1.2.10033]
    [C:\WINNT\system32\igfxdev.dll]  [Intel Corporation, 3.0.0.2249]
    [C:\WINNT\system32\igfxsrvc.dll]  [Intel Corporation, 3.0.0.2249]
    [C:\WINNT\system32\igfxhk.dll]  [Intel Corporation, 3.0.0.2249]
    [C:\WINNT\system32\igfxres.dll]  [Intel Corporation, 3.0.0.2249]
[PID: 916][C:\WINNT\system32\Internat.exe]  [Microsoft Corporation, 5.00.2920.0000]
    [C:\Program Files\Micropoint\mp110031.dll]  [Micropoint Corporation, 1.2.10033]
[PID: 1188][C:\Program Files\Internet Explorer\iexplore.exe]  [Microsoft Corporation, 6.00.2800.1106]
    [C:\Program Files\Micropoint\mp110031.dll]  [Micropoint Corporation, 1.2.10033]
    [d:\Program Files\Thunder Network\WebThunder\WebThunderBHO_016.dll]  [Thunder Networking Technologies,LTD, 6, 0, 0, 5]
    [C:\WINNT\system32\MSVCP60.dll]  [Microsoft Corporation, 6.00.8972.0]
    [C:\WINNT\system32\wdmaud.drv]  [Microsoft Corporation, 5.00.2195.6673]
    [C:\WINNT\system32\msacm32.drv]  [Microsoft Corporation, 5.00.2134.1]
    [C:\WINNT\system32\msadp32.acm]  [Microsoft Corporation, 5.00.2134.1]
    [C:\WINNT\system32\Macromed\Flash\Flash9c.ocx]  [Adobe Systems, Inc., 9,0,45,0]
[PID: 1428][F:\TDDownload\软件\sreng2\SREng.EXE]  [Smallfrogs Studio, 2.4.12.806]
    [C:\Program Files\Micropoint\mp110031.dll]  [Micropoint Corporation, 1.2.10033]

==================================
文件关联
.TXT  OK. [%SystemRoot%\system32\NOTEPAD.EXE %1]
.EXE  OK. ["%1" %*]
.COM  OK. ["%1" %*]
.PIF  OK. ["%1" %*]
.REG  OK. [regedit.exe "%1"]
.BAT  OK. ["%1" %*]
.SCR  OK. ["%1" /S]
.CHM  OK. ["C:\WINNT\hh.exe" %1]
.HLP  OK. [%SystemRoot%\System32\winhlp32.exe %1]
.INI  OK. [%SystemRoot%\System32\NOTEPAD.EXE %1]
.INF  OK. [%SystemRoot%\System32\NOTEPAD.EXE %1]
.VBS  OK. [%SystemRoot%\System32\WScript.exe "%1" %*]
.JS  OK. [%SystemRoot%\System32\WScript.exe "%1" %*]
.LNK  OK. [{00021401-0000-0000-C000-000000000046}]

==================================
Winsock 提供者
N/A

==================================
Autorun.inf
N/A

==================================
HOSTS 文件
127.0.0.1      localhost

==================================
API HOOK
N/A

==================================
隐藏进程
N/A

==================================


[/CODE]
gototop
 

高手帮忙啊
gototop
 

重新启动电脑, 按[F8]键(狂按), 选择安全模式(Safe Mode)进入Windows。)

运行(双击)SRENG2,点“启动项目,服务,点“驱动程序”
勾选“隐藏微软服务”选中病毒服务
[mp110001 / mp110001][Running/Auto Start]

[mp110002 / mp110002][Running/Auto Start]

[mp110003 / mp110003][Running/Boot Start]

[mp110004 / mp110004][Running/Auto Start]

[mp110005 / mp110005][Running/Manual Start]

[mp110006 / mp110006][Running/System Start]

[mp110007 / mp110007][Running/System Start]

[mp110008 / mp110008][Running/Auto Start]

[mp110009 / mp110009][Running/System Start]

[mp110010 / mp110010][Running/Boot Start]

[mp110011 / mp110011][Running/System Start]

[mp110012 / mp110012][Stopped/Manual Start]

[mp110013 / mp110013][Running/Boot Start]

,选择“删除服务”
点“设置”选择“否”
运行SREng2,使用“系统修复”——浏览器——删除:
[@shdoclc.dll,-866]
{c95fe080-8f5d-11d2-a20b-00aa003c157a} <, N/A>


显示隐藏文件
删除:
system32\drivers\mp110001.sys
system32\drivers\mp110002.sys
SystemRoot\system32\drivers\mp110003.sys
system32\drivers\mp110004.sys
system32\drivers\mp110005.sys
system32\drivers\mp110006.sys
system32\drivers\mp110007.sys
system32\drivers\mp110008.sys
system32\drivers\mp110009.sys
system32\drivers\mp1100010.sys
system32\drivers\mp1100011.sys
system32\drivers\mp1100012.sys
SystemRoot\system32\drivers\mp110003.sys

gototop
 

这样就有用了吗?
gototop
 
1   1  /  1  页   跳转
页面顶部
Powered by Discuz!NT