瑞星卡卡安全论坛

不知道什么时候开始,主页被改成http://www.17777.com/这个可恶的网站.
用尽办法都改不回来,瑞星的注册表修复没过几分钟有变成了http://www.17777.com/
改注册表的　
　[HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main]
　　"default_page_url"="http://www.microsoft.com/windows/ie_intl/cn/start/"
改成空白页之后又变回　http://www.17777.com/
打开msconfig看了，没什么可疑的启动项.　用最新版本的瑞星查杀过了，也没发现病毒.
我该怎么办呀!!!!如果真的没办法修复的话,我想只有重装系统这条路了...
没想到瑞星也帮不了我


附件: 36814820058931352.jpg

用瑞星的注册表工具一试

HijackThis下载地址请参考：
【必读】本版说明及常用小软件下载
http://forum.ikaka.com/topic.asp?board=67&artid=5188931

【推荐】反浏览器劫持的一些常用操作
http://forum.ikaka.com/topic.asp?board=67&artid=6490491
扫描好后,把日志贴上来

呵呵。我也同样。我被另一个可恶的网站弄的。。直接清除。也清除不掉。。用上网助手那个IE修复。启动到安全模式。然后用上网助手恢复就可以了吧。/试试看吧

扫描结果如下:

Logfile of HijackThis v1.99.1
Scan saved at 19:26:03, on 2005-8-9
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
e:\program files\rising\rfw\rfwsrv.exe
C:\WINDOWS\Explorer.EXE
E:\电子蚊香 Ⅱ\fixwww.exe
C:\WINDOWS\system32\spoolsv.exe
E:\Program Files\rising\Rfw\rfwmain.exe
E:\Customizer XP\RAMIdle.exe
C:\WINDOWS\System32\ctfmon.exe
C:\WINDOWS\System32\DRIVERS\CDANTSRV.EXE
C:\WINDOWS\System32\nvsvc32.exe
E:\PROGRAM FILES\RISING\RAV\CCENTER.EXE
E:\PROGRAM FILES\RISING\RAV\Ravmond.exe
E:\PROGRAM FILES\RISING\RAV\RavStub.exe
G:\Program Files\Tencent\QQ.exe
E:\Program Files\Tencent2\TIMPlatform.exe
C:\Program Files\MyIE2\MyIE.exe
C:\Documents and Settings\ivan\桌面\cc\1903632005219183744\HijackThis.exe

O2 - BHO: MEobjectSDT - {D4D5C535-BA95-4327-870D-A33826FDD17A} - C:\WINDOWS\System32\bdian32.dll
O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\System32\IME\TINTLGNT\TINTSETP.EXE /SYNC
O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\System32\IME\TINTLGNT\TINTSETP.EXE /IMEName
O4 - HKLM\..\Run: [No Ant!!] E:\电子蚊香 Ⅱ\fixwww.exe
O4 - HKLM\..\Run: [RivaTunerStartupDaemon] "E:\mydrive\RivaTuner20RC12\RivaTuner20RC12\RivaTuner.exe" /S
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [RfwMain] "e:\Program Files\rising\Rfw\rfwmain.exe" -Startup
O4 - HKLM\..\Run: [RAM Idle] E:\Customizer XP\RAMIdle.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\System32\ctfmon.exe
O8 - Extra context menu item: 添加到QQ自定义面板 - G:\Program Files\Tencent\AddPanel.htm
O8 - Extra context menu item: 添加到QQ表情 - G:\Program Files\Tencent\AddEmotion.htm
O8 - Extra context menu item: 用QQ彩信发送该图片 - G:\Program Files\Tencent\SendMMS.htm
O9 - Extra button: 浩方对战平台 - {0A155D3C-68E2-4215-A47A-E800A446447A} - E:\Program Files\浩方对战平台\GameClient.exe
O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
O9 - Extra 'Tools' menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
O9 - Extra button: QQ - {c95fe080-8f5d-11d2-a20b-00aa003c157b} - G:\Program Files\Tencent\QQ.EXE
O9 - Extra 'Tools' menuitem: 腾讯QQ - {c95fe080-8f5d-11d2-a20b-00aa003c157b} - G:\Program Files\Tencent\QQ.EXE
O14 - IERESET.INF: START_PAGE_URL=about:blank
O16 - DPF: {1F831FA1-42FC-11D4-95A6-0080AD30DCE1} (InstaFred) - file://G:\Program Files\AutoCAD 2002\InstFred.ocx
O16 - DPF: {3D8F74EE-8692-4F8F-B8D2-7522E732519E} (WebActivater Control) - http://game.qq.com/QQGame2.cab
O16 - DPF: {78AF2F24-A9C3-11D3-BF8C-0060B0FCC122} (AcDcToday 控件) - file://G:\Program Files\AutoCAD 2002\AcDcToday.ocx
O16 - DPF: {AE563722-B4F5-11D4-A415-00108302FDFD} (NOXLATE-BANR) - file://G:\Program Files\AutoCAD 2002\InstBanr.ocx
O16 - DPF: {C7420698-3CCE-4823-8795-1C098F2D3A4B} (WebFtp Class) - http://10000.gd.cn/AT/WebPerformance.dll
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://www.mydrivers.com/swflash.cab
O16 - DPF: {F281A59C-7B65-11D3-8617-0010830243BD} (AcPreview 控件) - file://G:\Program Files\AutoCAD 2002\AcPreview.ocx
O17 - HKLM\System\CCS\Services\Tcpip\..\{49CCF22B-E6FB-4F14-BD09-196856AB3CE3}: NameServer = 202.96.128.143,202.96.128.68
O17 - HKLM\System\CCS\Services\Tcpip\..\{71B9933A-7D4C-4D11-9288-AF22FD4DD7A2}: NameServer = 61.144.56.100,192.168.0.1
O17 - HKLM\System\CS1\Services\Tcpip\..\{49CCF22B-E6FB-4F14-BD09-196856AB3CE3}: NameServer = 202.96.128.143,202.96.128.68
O17 - HKLM\System\CS2\Services\Tcpip\..\{49CCF22B-E6FB-4F14-BD09-196856AB3CE3}: NameServer = 202.96.128.143,202.96.128.68
O18 - Protocol: about - {3050F406-98B5-11CF-BB82-00AA00BDCE0B} - C:\WINDOWS\System32\mshtml.dll
O18 - Protocol: cdl - {3DD53D40-7B8B-11D0-B013-00AA0059CE02} - C:\WINDOWS\system32\urlmon.dll
O18 - Protocol: dvd - {12D51199-0DB5-46FE-A120-47A3D7D937CC} - C:\WINDOWS\System32\msvidctl.dll
O18 - Protocol: file - {79EAC9E7-BAF9-11CE-8C82-00AA004BA90B} - C:\WINDOWS\system32\urlmon.dll
O18 - Protocol: ftp - {79EAC9E3-BAF9-11CE-8C82-00AA004BA90B} - C:\WINDOWS\system32\urlmon.dll
O18 - Protocol: gopher - {79EAC9E4-BAF9-11CE-8C82-00AA004BA90B} - C:\WINDOWS\system32\urlmon.dll
O18 - Protocol: http - {79EAC9E2-BAF9-11CE-8C82-00AA004BA90B} - C:\WINDOWS\system32\urlmon.dll
O18 - Protocol: https - {79EAC9E5-BAF9-11CE-8C82-00AA004BA90B} - C:\WINDOWS\system32\urlmon.dll
O18 - Protocol: its - {9D148291-B9C8-11D0-A4CC-0000F80149F6} - C:\WINDOWS\System32\itss.dll
O18 - Protocol: javascript - {3050F3B2-98B5-11CF-BB82-00AA00BDCE0B} - C:\WINDOWS\System32\mshtml.dll
O18 - Protocol: local - {79EAC9E7-BAF9-11CE-8C82-00AA004BA90B} - C:\WINDOWS\system32\urlmon.dll
O18 - Protocol: mailto - {3050F3DA-98B5-11CF-BB82-00AA00BDCE0B} - C:\WINDOWS\System32\mshtml.dll
O18 - Protocol: mhtml - {05300401-BCBC-11D0-85E3-00C04FD85AB4} - C:\WINDOWS\System32\inetcomm.dll
O18 - Protocol: mk - {79EAC9E6-BAF9-11CE-8C82-00AA004BA90B} - C:\WINDOWS\system32\urlmon.dll
O18 - Protocol: ms-its - {9D148291-B9C8-11D0-A4CC-0000F80149F6} - C:\WINDOWS\System32\itss.dll
O18 - Protocol: res - {3050F3BC-98B5-11CF-BB82-00AA00BDCE0B} - C:\WINDOWS\System32\mshtml.dll
O18 - Protocol: sysimage - {76E67A63-06E9-11D2-A840-006008059382} - C:\WINDOWS\System32\mshtml.dll
O18 - Protocol: tv - {CBD30858-AF45-11D2-B6D6-00C04FBBDE6E} - C:\WINDOWS\System32\msvidctl.dll
O18 - Protocol: vbscript - {3050F3B2-98B5-11CF-BB82-00AA00BDCE0B} - C:\WINDOWS\System32\mshtml.dll
O18 - Protocol: vnd.ms.radio - {3DA2AA3B-3D96-11D2-9BD2-204C4F4F5020} - C:\WINDOWS\System32\msdxm.ocx
O18 - Protocol: wia - {13F3EA8B-91D7-4F0A-AD76-D2853AC8BECE} - C:\WINDOWS\System32\wiascr.dll
O23 - Service: C-DillaSrv - C-Dilla Ltd - C:\WINDOWS\System32\DRIVERS\CDANTSRV.EXE
O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
O23 - Service: Rising Personal Firewall Service (RfwService) - Beijing Rising Technology Corporation Limited - e:\program files\rising\rfw\rfwsrv.exe
O23 - Service: Rising Process Communication Center (RsCCenter) - rising - E:\PROGRAM FILES\RISING\RAV\CCENTER.EXE
O23 - Service: RsRavMon Service (RsRavMon) - Beijing Rising Technology Co., Ltd. - E:\PROGRAM FILES\RISING\RAV\Ravmond.exe
O23 - Service: SDAgent Service (SDAgentService) - smartdove - C:\Program Files\Common Files\SDAgent\smartda.exe


哪位大侠帮忙看一下哪里有问题~

O2 - BHO: MEobjectSDT - {D4D5C535-BA95-4327-870D-A33826FDD17A} - C:\WINDOWS\System32\bdian32.dll
O16 - DPF: {C7420698-3CCE-4823-8795-1C098F2D3A4B} (WebFtp Class) - http://10000.gd.cn/AT/WebPerformance.dll

请问CrossVirus
O2 - BHO: MEobjectSDT - {D4D5C535-BA95-4327-870D-A33826FDD17A} - C:\WINDOWS\System32\bdian32.dll
这行是什么意思?

刚刚解决的
安全模式下或者结束explorer.exe进程后
删除c:\windows\system32\usign.dll
恢复注册表，即可

【回复“最爱婵”的帖子】修复：O2 - BHO: MEobjectSDT - {D4D5C535-BA95-4327-870D-A33826FDD17A} - C:\WINDOWS\System32\bdian32.dll

删除：C:\WINDOWS\System32\bdian32.dll