瑞星卡卡安全论坛

首页 » 技术交流区 » 反病毒/反流氓软件论坛 » 各位救命啊，我的IE被http://wn.265.com/绑架了！！！！！
yinqi190 - 2005-8-4 19:41:00
各位救命啊，我的IE被http://wn.265.com/绑架了
原来用这网站做首页，自己也能改回默认，可今天开卡巴就报警说“检测到危险脚本”现在自己也改不了默认了，用瑞星的注册表修复也不好使，只能求助各位大侠了，看看我的hijackthis扫描日志
＝＝＝＝＝＝＝＝＝＝＝＝＝＝＝＝＝＝＝＝＝＝＝＝＝＝＝＝＝＝＝＝＝＝＝＝
HijackThis@Qoo的扫描日志  V1.97.7
Scan saved at 19:41:12, on 2005-8-4
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
F:\Program Files\Rfw\rfwsrv.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\conime.exe
F:\Program Files\Rfw\RfwMain.exe
F:\PROGRA~1\瑞星2005\RAV\RAVTIMER.EXE
C:\WINDOWS\system32\ctfmon.exe
F:\PROGRAM FILES\瑞星2005\RAV\CCENTER.EXE
F:\PROGRAM FILES\瑞星2005\RAV\Ravmond.exe
F:\PROGRAM FILES\瑞星2005\RAV\RavStub.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\WINDOWS\system32\taskmgr.exe
C:\WINDOWS\explorer.exe
C:\Documents and Settings\yinqi\桌面\hijackthis1.97_qoo\HijackThis.exe

O2 - BHO: (no name) - {0005A87D-D626-4B3A-84F9-1D9571695F55} - C:\WINDOWS\system32\xunleibho_v4.dll
O2 - BHO: (no name) - {E5A1691B-D188-4419-AD02-90002030B8EE} - D:\PROGRA~1\FlashFXP\IEFlash.dll
O3 - Toolbar: ????? - {DB9ECD4F-FB8F-4311-B3CE-90B976C2707C} - C:\WINDOWS\system32\kakatool.dll
O4 - HKLM\..\Run: [RavMon] F:\PROGRA~1\
O4 - HKLM\..\Run: [RfwMain] "F:\Program Files\Rfw\rfwmain.exe" -Startup
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - Startup: NTUSER.DAT
O4 - Startup: NTUSER.DAT.LOG
O4 - Startup: ntuser.ini
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O8 - Extra context menu item: &使用迅雷下载 - F:\Program Files\
O8 - Extra context menu item: &使用迅雷下载全部链接 - F:\Program Files\
O8 - Extra context menu item: 使用WellGet下载(&W) - D:\Program Files\WellGet\nxcatch.htm
O8 - Extra context menu item: 使用WellGet下载全部链接(&D) - D:\Program Files\WellGet\nxall.htm
O14 - IERESET.INF: SEARCH_PAGE_URL=
O14 - IERESET.INF: START_PAGE_URL=
O17 - HKLM\System\CCS\Services\Tcpip\..\{F675E666-56F6-4BE9-AD11-5FCE39895598}: NameServer = 202.97.224.69 202.97.227.138
飞跃迷离 - 2005-8-4 19:45:00
【回复“yinqi190”的帖子】
请修复：
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O14 - IERESET.INF: SEARCH_PAGE_URL=
O14 - IERESET.INF: START_PAGE_URL=

建议您用最新版的HijackThis1.99.1 扫描个日志上来
HijackThis下载地址请参考：
【必读】本版说明及常用小软件下载
http://forum.ikaka.com/topic.asp?board=67&artid=5188931


yinqi190 - 2005-8-4 19:48:00
Logfile of HijackThis v1.99.1
Scan saved at 19:47:24, on 2005-8-4
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
F:\Program Files\Rfw\rfwsrv.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\conime.exe
F:\Program Files\Rfw\RfwMain.exe
F:\PROGRA~1\瑞星2005\RAV\RAVTIMER.EXE
C:\WINDOWS\system32\ctfmon.exe
F:\PROGRAM FILES\瑞星2005\RAV\CCENTER.EXE
F:\PROGRAM FILES\瑞星2005\RAV\Ravmond.exe
F:\PROGRAM FILES\瑞星2005\RAV\RavStub.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\WINDOWS\system32\taskmgr.exe
C:\WINDOWS\explorer.exe
C:\Documents and Settings\yinqi\桌面\hijackthis1.97_qoo\HijackThis.exe
C:\WINDOWS\NOTEPAD.EXE
C:\Documents and Settings\yinqi\桌面\248783200522382732\HijackThis.exe

R3 - Default URLSearchHook is missing
F2 - REG:system.ini: UserInit=C:\WINDOWS\system32\userinit.exe
O2 - BHO: ThunderIEHelper Class - {0005A87D-D626-4B3A-84F9-1D9571695F55} - C:\WINDOWS\system32\xunleibho_v4.dll
O2 - BHO: FlashFXP Helper for Internet Explorer - {E5A1691B-D188-4419-AD02-90002030B8EE} - D:\PROGRA~1\FlashFXP\IEFlash.dll
O3 - Toolbar: 卡卡安全助手 - {DB9ECD4F-FB8F-4311-B3CE-90B976C2707C} - C:\WINDOWS\system32\kakatool.dll
O4 - HKLM\..\Run: [RavMon] F:\PROGRA~1\瑞星2005\RAV\RAVMON.EXE -SYSTEM
O4 - HKLM\..\Run: [RfwMain] "F:\Program Files\Rfw\rfwmain.exe" -Startup
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O8 - Extra context menu item: &使用迅雷下载 - F:\Program Files\迅雷\geturl.htm
O8 - Extra context menu item: &使用迅雷下载全部链接 - F:\Program Files\迅雷\getAllurl.htm
O8 - Extra context menu item: 使用WellGet下载(&W) - D:\Program Files\WellGet\nxcatch.htm
O8 - Extra context menu item: 使用WellGet下载全部链接(&D) - D:\Program Files\WellGet\nxall.htm
O9 - Extra button: 浩方对战平台 - {0A155D3C-68E2-4215-A47A-E800A446447A} - F:\Program Files\浩方对战平台\GameClient.exe
O9 - Extra button: 访问瑞星网站 - {FF2DE7A6-ECB1-4CBC-9C0E-D92A9E66E444} - 访问瑞星网站 (file missing)
O9 - Extra button: 访问卡卡社区 - {FF2DE7A6-ECB1-4CBC-9C0E-D92A9E66E445} - 访问卡卡社区 (file missing)
O14 - IERESET.INF: SEARCH_PAGE_URL=
O14 - IERESET.INF: START_PAGE_URL=
O17 - HKLM\System\CCS\Services\Tcpip\..\{F675E666-56F6-4BE9-AD11-5FCE39895598}: NameServer = 202.97.224.69 202.97.227.138
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: kavsvc - Kaspersky Lab - C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus Personal\kavsvc.exe
O23 - Service: Rising Personal Firewall Service (RfwService) - Beijing Rising Technology Corporation Limited - F:\Program Files\Rfw\rfwsrv.exe
O23 - Service: Rising Process Communication Center (RsCCenter) - rising - F:\PROGRAM FILES\瑞星2005\RAV\CCENTER.EXE
O23 - Service: RsRavMon Service (RsRavMon) - Beijing Rising Technology Co., Ltd. - F:\PROGRAM FILES\瑞星2005\RAV\Ravmond.exe
yinqi190 - 2005-8-4 19:50:00
飞跃迷离大哥在不？？？
飞跃迷离 - 2005-8-4 19:57:00
【回复“yinqi190”的帖子】
请关闭所有IE界面，重新使用HijackThis扫描一次，选中下面建议修复的项目，让HijackThis修复，修复前请允许HijackThis保留备份。（如果楼主知道是安全的可以不必勾选）
R3 - Default URLSearchHook is missing
F2 - REG:system.ini: UserInit=C:\WINDOWS\system32\userinit.exe
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O14 - IERESET.INF: SEARCH_PAGE_URL=
O14 - IERESET.INF: START_PAGE_URL=
yinqi190 - 2005-8-4 20:03:00
飞跃迷离大哥还是没好，打开还是http://wn.265.com/
==================================================
Logfile of HijackThis v1.99.1
Scan saved at 20:01:27, on 2005-8-4
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
F:\Program Files\Rfw\rfwsrv.exe
C:\WINDOWS\system32\spoolsv.exe
F:\PROGRAM FILES\瑞星2005\RAV\CCENTER.EXE
F:\PROGRAM FILES\瑞星2005\RAV\Ravmond.exe
F:\PROGRAM FILES\瑞星2005\RAV\RavStub.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\Explorer.EXE
F:\PROGRA~1\瑞星2005\RAV\RAVMON.EXE
F:\Program Files\Rfw\rfwmain.exe
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Documents and Settings\yinqi\桌面\248783200522382732\HijackThis.exe

O2 - BHO: ThunderIEHelper Class - {0005A87D-D626-4B3A-84F9-1D9571695F55} - C:\WINDOWS\system32\xunleibho_v4.dll
O2 - BHO: FlashFXP Helper for Internet Explorer - {E5A1691B-D188-4419-AD02-90002030B8EE} - D:\PROGRA~1\FlashFXP\IEFlash.dll
O3 - Toolbar: 卡卡安全助手 - {DB9ECD4F-FB8F-4311-B3CE-90B976C2707C} - C:\WINDOWS\system32\kakatool.dll
O4 - HKLM\..\Run: [RavMon] F:\PROGRA~1\瑞星2005\RAV\RAVMON.EXE -SYSTEM
O4 - HKLM\..\Run: [RfwMain] "F:\Program Files\Rfw\rfwmain.exe" -Startup
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O8 - Extra context menu item: &使用迅雷下载 - F:\Program Files\迅雷\geturl.htm
O8 - Extra context menu item: &使用迅雷下载全部链接 - F:\Program Files\迅雷\getAllurl.htm
O8 - Extra context menu item: 使用WellGet下载(&W) - D:\Program Files\WellGet\nxcatch.htm
O8 - Extra context menu item: 使用WellGet下载全部链接(&D) - D:\Program Files\WellGet\nxall.htm
O9 - Extra button: 浩方对战平台 - {0A155D3C-68E2-4215-A47A-E800A446447A} - F:\Program Files\浩方对战平台\GameClient.exe
O9 - Extra button: 访问瑞星网站 - {FF2DE7A6-ECB1-4CBC-9C0E-D92A9E66E444} - 访问瑞星网站 (file missing)
O9 - Extra button: 访问卡卡社区 - {FF2DE7A6-ECB1-4CBC-9C0E-D92A9E66E445} - 访问卡卡社区 (file missing)
O14 - IERESET.INF: SEARCH_PAGE_URL=
O14 - IERESET.INF: START_PAGE_URL=
O17 - HKLM\System\CCS\Services\Tcpip\..\{F675E666-56F6-4BE9-AD11-5FCE39895598}: NameServer = 202.97.224.69 202.97.227.138
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: kavsvc - Kaspersky Lab - C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus Personal\kavsvc.exe
O23 - Service: Rising Personal Firewall Service (RfwService) - Beijing Rising Technology Corporation Limited - F:\Program Files\Rfw\rfwsrv.exe
O23 - Service: Rising Process Communication Center (RsCCenter) - rising - F:\PROGRAM FILES\瑞星2005\RAV\CCENTER.EXE
O23 - Service: RsRavMon Service (RsRavMon) - Beijing Rising Technology Co., Ltd. - F:\PROGRAM FILES\瑞星2005\RAV\Ravmond.exe
飞跃迷离 - 2005-8-4 20:10:00
【回复“yinqi190”的帖子】
您是否安装了万能五笔输入法？

用记事本打开 C:\WINNT\system32\drivers\etc\hosts 文件
最后加入
202.232.140.12 auto.search.msn.com
这么一行(作用是把微软默认搜索解析到正确的地址)
最好再加一行 127.0.0.0 www.265.com

yinqi190 - 2005-8-4 20:11:00
O14 - IERESET.INF: SEARCH_PAGE_URL=
O14 - IERESET.INF: START_PAGE_URL=
这两个修复后扫描还是出现!
飞跃迷离 - 2005-8-4 20:20:00
【回复“yinqi190”的帖子】
这两项不是问题，如果想修复可以进安全模式下修复看看...
yinqi190 - 2005-8-4 20:26:00
大哥是这么加不？我没装万能五笔输入法
# Copyright (c) 1993-1999 Microsoft Corp.
#
# This is a sample HOSTS file used by Microsoft TCP/IP for Windows.
#
# This file contains the mappings of IP addresses to host names. Each
# entry should be kept on an individual line. The IP address should
# be placed in the first column followed by the corresponding host name.
# The IP address and the host name should be separated by at least one
# space.
#
# Additionally, comments (such as these) may be inserted on individual
# lines or following the machine name denoted by a '#' symbol.
#
# For example:
#
#      102.54.94.97    rhino.acme.com          # source server
#      38.25.63.10    x.acme.com              # x client host

127.0.0.1      localhost
202.232.140.12 auto.search.msn.com
127.0.0.0 www.265.com
飞跃迷离 - 2005-8-4 20:35:00
引用:
【yinqi190的贴子】大哥是这么加不？我没装万能五笔输入法
# Copyright (c) 1993-1999 Microsoft Corp.
#
# This is a sample HOSTS file used by Microsoft TCP/IP for Windows.
#
# This file contains the mappings of IP addresses to host names. Each
# entry should be kept on an individual line. The IP address should
# be placed in the first column followed by the corresponding host name.
# The IP address and the host name should be separated by at least one
# space.
#
# Additionally, comments (such as these) may be inserted on individual
# lines or following the machine name denoted by a ''#'' symbol.
#
# For example:
#
#      102.54.94.97    rhino.acme.com          # source server
#      38.25.63.10    x.acme.com              # x client host

127.0.0.1      localhost
202.232.140.12 auto.search.msn.com
127.0.0.0 www.265.com

...........................

127.0.0.1 www.265.com
不好意思，刚才打错了~~~
yinqi190 - 2005-8-4 22:08:00
谢谢飞跃迷离，我先用3721把这个流氓网站干掉了，然后用工具把3721这个大流氓软件干掉了。看来有时就得以毒攻毒啊，以暴制暴！
疾风之狼2006 - 2005-8-5 0:03:00
你怎么运行了两个杀毒软件啊。
把卡巴斯基停掉吧。。。。。。。
现在杀毒软件暂时不用到的。

呵呵，有时候，卡卡在功能上要学一下3721的。当然只是功能上。
那时候，3721没这么恶的时候，我还提了不少功能建议的。。
Brzzz-左岸 - 2005-8-5 10:26:00
一个漏洞型病毒
打好补丁吧！
1
查看完整版本: 各位救命啊，我的IE被http://wn.265.com/绑架了！！！！！
© 2000 - 2026 Rising Corp. Ltd.