求助--总是弹出窗口"冒险岛影音娱乐" bbs.ikaka.com

自由飞 - 2005-10-27 12:24:00

日志文件如下,请看看
Logfile of HijackThis v1.99.1
Scan saved at :12:21, on 2005-10-27
Platform: Windows 2000 SP3 (WinNT 5.00.2195)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINNT\System32\smss.exe
C:\WINNT\system32\winlogon.exe
C:\WINNT\system32\services.exe
C:\WINNT\system32\lsass.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\system32\spoolsv.exe
C:\WINNT\System32\msdtc.exe
C:\CCProxy\CCProxy.exe
C:\WINNT\System32\svchost.exe
C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
C:\WINNT\System32\nvsvc32.exe
C:\WINNT\system32\regsvc.exe
C:\PROGRAM FILES\RISING\RAV\CCENTER.EXE
C:\WINNT\servers.exe
C:\WINNT\system32\MSTask.exe
C:\Program Files\Serv-U\ServUDaemon.exe
C:\WINNT\System32\WBEM\WinMgmt.exe
C:\WINNT\System32\inetsrv\inetinfo.exe
C:\WINNT\Explorer.EXE
C:\WINNT\SOUNDMAN.EXE
C:\WINNT\System32\internat.exe
C:\Program Files\Serv-U\ServUTray.exe
C:\WINNT\system32\Dfssvc.exe
C:\WINNT\System32\svchost.exe
C:\WINNT\System32\conime.exe
C:\Program Files\QQ2005 Beta2 精灵坊显IP版\QQ.EXE
C:\Program Files\Tencent\qq2005\TIMPlatform.exe
c:\program files\rising\rav\RAVTIMER.EXE
C:\WINNT\System32\CMD.exe
D:\superscan\radmin.exe
C:\PROGRAM FILES\RISING\RAV\Ravmond.exe
C:\PROGRAM FILES\RISING\RAV\RavStub.exe
c:\program files\rising\rav\RAVMON.EXE
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\Microsoft Office\Office\EXCEL.EXE
D:\superscan\mac扫描器\netgoves.exe
C:\Program Files\Maxthon\Maxthon.exe
D:\program1\taskinfo5注册版\TaskInfo.exe
C:\Program Files\JJOL\IME\JJSvr.EXE
F:\hijackthis\HijackThis.exe

O2 - BHO: (no name) - {02DCA195-602B-4B1F-83FF-381B7E804BDB} - C:\WINNT\system32\HDBHO.dll
O2 - BHO: EyeOnBrowser Class - {1272F701-349D-4DB3-BBCD-10CBDCD049FE} - (no file)
O2 - BHO: IeCatch2 Class - {A5366673-E8CA-11D3-9CD9-0090271D075B} - C:\PROGRA~1\FLASHGET\jccatch.dll
O2 - BHO: MEobjectSDT - {D4D5C535-BA95-4327-870D-A33826FDD17A} - C:\WINNT\System32\obwbkya.dll
O3 - Toolbar: @msdxmLC.dll,-1@2052,电台(&R) - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINNT\System32\msdxm.ocx
O3 - Toolbar: FlashGet Bar - {E0E899AB-F487-11D5-8D29-0050BA6940E3} - C:\PROGRA~1\FLASHGET\fgiebar.dll
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINNT\System32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [RavTimer] C:\PROGRA~1\RISING\RAV\RAVTIMER.EXE
O4 - HKLM\..\Run: [RavMon] C:\PROGRA~1\RISING\RAV\RAVMON.EXE -SYSTEM
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKCU\..\Run: [internat.exe] internat.exe
O4 - HKCU\..\Run: [ServUTrayIcon] C:\Program Files\Serv-U\ServUTray.exe
O8 - Extra context menu item: 使用网际快车下载 - C:\Program Files\FlashGet\jc_link.htm
O8 - Extra context menu item: 使用网际快车下载全部链接 - C:\Program Files\FlashGet\jc_all.htm
O8 - Extra context menu item: 取星号密码 - C:\windows\iexinhao.htm
O8 - Extra context menu item: 添加到QQ自定义面板 - C:\Program Files\QQ2005 Beta2 精灵坊显IP版\AddPanel.htm
O8 - Extra context menu item: 添加到QQ表情 - C:\Program Files\QQ2005 Beta2 精灵坊显IP版\AddEmotion.htm
O8 - Extra context menu item: 用QQ彩信发送该图片 - C:\Program Files\QQ2005 Beta2 精灵坊显IP版\SendMMS.htm
O8 - Extra context menu item: 用比特精灵下载(&B) - C:\Program Files\BitSpirit\bsurl.htm
O12 - Plugin for .pdf: C:\Program Files\Internet Explorer\PLUGINS\nppdf32.dll
O15 - Trusted IP range: http://192.130.1.76
O15 - Trusted IP range: http://66.40.16.198
O15 - Trusted IP range: http://216.65.3.68
O15 - Trusted IP range: http://66.250.74.150
O16 - DPF: {53DA1E9F-03BB-46E7-86DE-FF84E0282158} (Jiangmin_AntiVirus.UserControl1) - http://110dj.com/sz/ocx.ocx
O16 - DPF: {B4FE8160-76DB-48C4-9803-68ED6278CA2C} (File Uploader ) - http://211.91.230.60/main/uploaderx.cab
O16 - DPF: {DD473D47-C45E-427D-87C5-D6DEFBF8AB42} (WacosPrinterCtrlX Control) - http://192.130.1.76/Share/ActiveX/WacosPrinterCtrl.inf
O17 - HKLM\System\CCS\Services\Tcpip\..\{8BC99720-3A8F-4CCD-BBA8-2B29C48997BD}: NameServer = 211.91.216.129
O18 - Protocol: ms-help - {314111C7-A502-11D2-BBCA-00C04F8EC294} - C:\Program Files\Common Files\Microsoft Shared\Help\hxds.dll
O18 - Filter: text/x-mrml - {C51721BE-858B-4A66-A8BF-D2882FF49820} - C:\Program Files\YAMAHA\MidRadio Player\midradio.ocx
O23 - Service: CCProxy - Unknown owner - C:\CCProxy\CCProxy.exe" -service (file missing)
O23 - Service: Logical Disk Manager Administrative Service (dmadmin) - VERITAS Software Corp. - C:\WINNT\System32\dmadmin.exe
O23 - Service: Macromedia Licensing Service - Unknown owner - C:\Program Files\Common Files\Macromedia Shared\Service\Macromedia Licensing.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINNT\System32\nvsvc32.exe
O23 - Service: Remote Packet Capture Protocol v.0 (experimental) (rpcapd) - Unknown owner - %ProgramFiles%\WinPcap\rpcapd.exe" -d -f "%ProgramFiles%\WinPcap\rpcapd.ini (file missing)
O23 - Service: Rising Process Communication Center (RsCCenter) - rising - C:\PROGRAM FILES\RISING\RAV\CCENTER.EXE
O23 - Service: RsRavMon Service (RsRavMon) - Beijing Rising Technology Co., Ltd. - C:\PROGRAM FILES\RISING\RAV\Ravmond.exe
O23 - Service: Remote Administrator Service (r_server) - Unknown owner - C:\WINNT\servers.exe" /service (file missing)
O23 - Service: Serv-U FTP 服务器 (Serv-U) - Cat Soft - C:\Program Files\Serv-U\ServUDaemon.exe

天使之剑 - 2005-10-27 12:30:00

【回复“自由飞”的帖子】

关闭所有不必要的窗口，使用HijackThis扫描后修复（在需要修复的项目前面打对勾，然后按“Fix checked”或“修复”，修复前会询问您是否需要备份，请选择“Yes”或“是”）：
O2 - BHO: (no name) - {02DCA195-602B-4B1F-83FF-381B7E804BDB} - C:\WINNT\system32\HDBHO.dll
O2 - BHO: EyeOnBrowser Class - {1272F701-349D-4DB3-BBCD-10CBDCD049FE} - (no file)
O2 - BHO: MEobjectSDT - {D4D5C535-BA95-4327-870D-A33826FDD17A} - C:\WINNT\System32\obwbkya.dll
O15 - Trusted IP range: http://192.130.1.76
O15 - Trusted IP range: http://66.40.16.198
O15 - Trusted IP range: http://216.65.3.68
O15 - Trusted IP range: http://66.250.74.150
O16 - DPF: {53DA1E9F-03BB-46E7-86DE-FF84E0282158} (Jiangmin_AntiVirus.UserControl1) - http://110dj.com/sz/ocx.ocx
O16 - DPF: {B4FE8160-76DB-48C4-9803-68ED6278CA2C} (File Uploader ) - http://211.91.230.60/main/uploaderx.cab
O16 - DPF: {DD473D47-C45E-427D-87C5-D6DEFBF8AB42} (WacosPrinterCtrlX Control) - http://192.130.1.76/Share/ActiveX/WacosPrinterCtrl.inf
O23 - Service: Remote Administrator Service (r_server) - Unknown owner - C:\WINNT\servers.exe" /service (file missing)
O23 - Service: CCProxy - Unknown owner - C:\CCProxy\CCProxy.exe" -service (file missing)
显示隐藏文件和系统文件，删除（如果存在的话）：
C:\WINNT\system32\HDBHO.dll
C:\WINNT\System32\obwbkya.dll
待修复完成，如果问题依旧，请附上新的在安全模式下扫描的HijackThis扫描日志。
以上建议仅供参考，如果您认识其中的一些设置抑或是您的手动设置，就不必执行。

瑞星卡卡安全论坛