能力挑战:www.tubao.com(www.tubao.net) bbs.ikaka.com

斑茅 - 2005-12-30 17:00:00

我的浏览器被此网站劫持近一个月了.现在仍没找到解决办法.先前发贴到此处求助,无奈斑竹也无法解决.请有能力的高手,到此网站试试它的厉害(请做好系统备份).期待有人能解决它.

玉面修罗 - 2005-12-30 18:55:00

这个强悍?如果现在用的自己的机器肯定要试下...

花落花又开 - 2005-12-30 19:03:00

这个网站本身没问题。

是被劫持转到这个网站

闪电风暴 - 2005-12-30 19:07:00

监控结果:
System Safety Monitor:未发现更改项
IceSword:未发现有异常进程.
HJ日志:无改变

如果有来生 - 2005-12-30 19:41:00

下载这个软件，SREng，发log上来
http://www.kztechs.com/sreng/download.html
智能扫描扫描保存

斑茅 - 2005-12-31 14:07:00

扫描结果太长，只好分几页发。
2005-12-31,13:58:49

System Repair Engineer 2.0.12.350 (2.0 RC 1)
Windows 2000 Professional Service Pack 4 - 管理权限用户 - 完整功能

以下内容被选中：
所有的启动项目（包括注册表、启动文件夹、服务等）
浏览器加载项
正在运行的进程（包括进程模块信息）
文件关联

启动项目
注册表
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
<Internat.exe><internat.exe>
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
<MsnMsgr><"C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background>
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
<Super Rabbit IEPro><C:\Program Files\Super Rabbit\MagicSet\SRIECLI.EXE /LOAD>
[HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows]
<load><>
[HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows]
<run><>
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
<Synchronization Manager><mobsync.exe /logon>
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
<vptray><C:\Program Files\NavNT\vptray.exe>
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
<Super Rabbit SRRestore><C:\Program Files\Super Rabbit\MagicSet\srrest.exe /autosave>
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
<McAfeeUpdaterUI><"C:\Program Files\Network Associates\Common Framework\UpdaterUI.exe" /StartedFromRunKey>
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
<shell><Explorer.exe>
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
<Userinit><C:\WINNT\system32\userinit.exe,>
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Windows]
<AppInit_DLLs><>

==================================
启动文件夹
[Microsoft Office]
<C:\Documents and Settings\All Users\「开始」菜单\程序\启动\Microsoft Office.lnk><N>

==================================

斑茅 - 2005-12-31 14:08:00

服务
[DefWatch / DefWatch]
<C:\Program Files\NavNT\defwatch.exe><Symantec Corporation>
[Logical Disk Manager Administrative Service / dmadmin]
<C:\WINNT\System32\dmadmin.exe /com><VERITAS Software Corp.>
[McAfee Framework Service / McAfeeFramework]
<C:\Program Files\Network Associates\Common Framework\FrameworkService.exe /ServiceStart><Network Associates, Inc.>
[Norton AntiVirus 客户端 / Norton AntiVirus Server]
<C:\Program Files\NavNT\rtvscan.exe><Symantec Corporation>
[OracleOraHome81ClientCache / OracleOraHome81ClientCache]
<c:\Oracle\Ora81\BIN\ONRSD.EXE><N/A>
[Windows Management NetWork Service Extensions / Windows Management NetWork Service Extensions]
<NetManager.exe -exe_start><N/A>

==================================
浏览器加载项
[超级兔子上网精灵]
{FEDF637B-F631-4583-A210-33CC828D42DB} <C:\PROGRA~1\SUPERR~1\MagicSet\HAOKAN~1.DLL, 超级兔子>
[@shdoclc.dll,-866]
{c95fe080-8f5d-11d2-a20b-00aa003c157a} <, N/A>
[QQ]
{c95fe080-8f5d-11d2-a20b-00aa003c157b} <C:\Program Files\Tencent\QQ\QQ.EXE, N/A>
[电台(&R)]
{8E718888-423F-11D2-876E-00A0C9082467} <C:\WINNT\System32\msdxm.ocx, Microsoft Corporation>
[FlashGet Bar]
{E0E899AB-F487-11D5-8D29-0050BA6940E3} <C:\PROGRA~1\FlashGet\fgiebar.dll, Amaze Soft>
[超级兔子上网精灵]
{FEDF637B-F631-4583-A210-33CC828D42DB} <C:\PROGRA~1\SUPERR~1\MagicSet\HAOKAN~1.DLL, 超级兔子>
[Shockwave Flash Object]
{D27CDB6E-AE6D-11CF-96B8-444553540000} <C:\WINNT\system32\macromed\flash\Flash.ocx, Macromedia, Inc.>
[上传到QQ网络硬盘]
<C:\Program Files\Tencent\QQ\AddToNetDisk.htm, N/A>
[使用网际快车下载]
<C:\Program Files\FlashGet\jc_link.htm, N/A>
[使用网际快车下载全部链接]
<C:\Program Files\FlashGet\jc_all.htm, N/A>
[添加到QQ自定义面板]
<C:\Program Files\Tencent\QQ\AddPanel.htm, N/A>
[添加到QQ表情]
<C:\Program Files\Tencent\QQ\AddEmotion.htm, N/A>
[用QQ彩信发送该图片]
<C:\Program Files\Tencent\QQ\SendMMS.htm, N/A>

斑茅 - 2005-12-31 14:09:00

==================================
正在运行的进程
[PID: 140][\SystemRoot\System32\smss.exe] <Microsoft Corporation><5.00.2195.6601>
[PID: 164][\??\C:\WINNT\system32\csrss.exe] <Microsoft Corporation><5.00.2195.6601>
[PID: 160][\??\C:\WINNT\system32\winlogon.exe] <Microsoft Corporation><5.00.2195.6997>
[C:\WINNT\System32\NavLogon.dll] <N/A><N/A>
[PID: 212][C:\WINNT\system32\services.exe] <Microsoft Corporation><5.00.2195.7035>
[C:\WINNT\system32\dmserver.dll] <VERITAS Software Corp.><2195.6605.297.3>
[PID: 224][C:\WINNT\system32\lsass.exe] <Microsoft Corporation><5.00.2195.7011>
[PID: 392][C:\WINNT\system32\svchost.exe] <Microsoft Corporation><5.00.2134.1>
[PID: 420][C:\WINNT\system32\spoolsv.exe] <Microsoft Corporation><5.00.2195.7059>
[PID: 468][C:\Program Files\NavNT\defwatch.exe] <Symantec Corporation><7, 50, 0, 1>
[PID: 484][C:\WINNT\System32\svchost.exe] <Microsoft Corporation><5.00.2134.1>
[PID: 508][C:\Program Files\Network Associates\Common Framework\FrameworkService.exe] <Network Associates, Inc.><3.5.0.412>
[C:\Program Files\Network Associates\Common Framework\nailog.dll] <Network Associates, Inc.><3.5.0.474>
[C:\Program Files\Network Associates\Common Framework\naXML.dll] <Network Associates, Inc.><3.5.0.474>
[C:\Program Files\Network Associates\Common Framework\naCmnLib.dll] <Network Associates, Inc.><3.5.0.474>
[C:\Program Files\Network Associates\Common Framework\applib.dll] <Network Associates, Inc.><3.5.0.412>
[C:\Program Files\Network Associates\Common Framework\0409\AgentRes.dll] <Network Associates, Inc.><3.5.0.412>
[C:\Program Files\Network Associates\Common Framework\Logging.dll] <Network Associates, Inc.><3.5.0.412>
[C:\Program Files\Network Associates\Common Framework\InternetManager.dll] <Network Associates, Inc.><3.5.0.412>
[C:\Program Files\Network Associates\Common Framework\naInet.dll] <Network Associates, Inc.><3.5.0.474>
[C:\Program Files\Network Associates\Common Framework\UserSpace.dll] <Network Associates, Inc.><3.5.0.412>
[C:\Program Files\Network Associates\Common Framework\SecureFrameworkFactory.dll] <Network Associates, Inc.><3.5.0.412>
[C:\Program Files\Network Associates\Common Framework\Management.dll] <Network Associates, Inc.><3.5.0.412>
[C:\Program Files\Network Associates\Common Framework\cmalib.dll] <Network Associates, Inc.><3.5.0.412>
[C:\Program Files\Network Associates\Common Framework\naPolicyManager.dll] <Network Associates, Inc.><3.5.0.412>
[C:\Program Files\Network Associates\Common Framework\ScriptSubSys.dll] <Network Associates, Inc.><3.5.0.412>
[C:\Program Files\Network Associates\Common Framework\UpdateSubSys.dll] <Network Associates, Inc.><3.5.0.412>
[C:\Program Files\Network Associates\Common Framework\Scheduler.dll] <Network Associates, Inc.><3.5.0.412>
[C:\Program Files\Network Associates\Common Framework\Agent.dll] <Network Associates, Inc.><3.5.0.412>
[C:\Program Files\Network Associates\Common Framework\naSPIPE.dll] <Network Associates, Inc.><3.5.0.412>
[C:\Program Files\Network Associates\Common Framework\ListenServer.dll] <Network Associates, Inc.><3.5.0.412>
[C:\Program Files\Network Associates\Common Framework\TCSubSys.dll] <Network Associates, Inc.><3.5.0.412>
[PID: 572][C:\PROGRA~1\NETWOR~1\COMMON~1\naPrdMgr.exe] <Network Associates, Inc.><3.5.0.412>
[C:\PROGRA~1\NETWOR~1\COMMON~1\nailog.dll] <Network Associates, Inc.><3.5.0.474>
[C:\PROGRA~1\NETWOR~1\COMMON~1\naCmnLib.dll] <Network Associates, Inc.><3.5.0.474>
[C:\PROGRA~1\NETWOR~1\COMMON~1\naXML.dll] <Network Associates, Inc.><3.5.0.474>
[C:\PROGRA~1\NETWOR~1\COMMON~1\0409\AgentRes.dll] <Network Associates, Inc.><3.5.0.412>
[C:\Program Files\Network Associates\Common Framework\AgentPlugin.dll] <Network Associates, Inc.><3.5.0.412>
[C:\Program Files\Network Associates\Common Framework\NAGSHR32.DLL] <Network Associates, Inc.><3.5.0.474>
[C:\Program Files\Network Associates\Common Framework\PCRPlug.dll] <Network Associates, Inc.><3.5.0.412>
[PID: 680][C:\Program Files\NavNT\rtvscan.exe] <Symantec Corporation><7.50.00.846>
[C:\Program Files\NavNT\Dec2.dll] <Symantec Corporation><2.16.0.45>
[C:\Program Files\NavNT\Dec2ARJ.dll] <Symantec Corporation><2.16.0.45>
[C:\Program Files\NavNT\Dec2ID.dll] <Symantec Corporation><2.16.0.45>
[C:\Program Files\NavNT\Dec2LHA.dll] <Symantec Corporation><2.16.0.45>
[C:\Program Files\NavNT\SymLHA.dll] <Symantec Corporation><2.16.0.45>
[C:\Program Files\NavNT\Dec2LZ.dll] <Symantec Corporation><2.16.0.45>
[C:\Program Files\NavNT\Dec2MIME.dll] <Symantec Corporation><2.16.0.45>
[C:\Program Files\NavNT\Dec2Zip.dll] <Symantec Corporation><2.16.0.45>
[C:\Program Files\NavNT\Dec2AMG.dll] <Symantec Corporation><2.16.0.45>
[C:\Program Files\NavNT\SYMAMG32.DLL] <Symantec Corporation with portions by FUJITSU DEVICES INC.><2.16.0.45>
[C:\Program Files\NavNT\Dec2UUE.dll] <Symantec Corporation><2.16.0.45>
[C:\Program Files\NavNT\Dec2SS.dll] <Symantec Corporation><2.16.0.45>
[C:\Program Files\NavNT\Dec2RTF.dll] <Symantec Corporation><2.16.0.45>
[C:\WINNT\system32\CBA.DLL] <Intel Corporation><6.0.201.0940 E>
[C:\WINNT\system32\MsgSys.dll] <Intel Corporation><6.0.201.0940 E>
[C:\WINNT\system32\NTS.dll] <Intel Corporation><6.0.201.0940 E>
[C:\WINNT\system32\PDS.DLL] <Intel Corporation><6.0.201.0940 E>
[C:\Program Files\NavNT\NAVLU.dll] <Symantec Corporation><7.50.00.846>
[C:\Program Files\NavNT\NAVNTUTL.DLL] <Symantec/Peter Norton Group><1, 0, 0, 1>
[C:\Program Files\NavNT\i2ldvp3.dll] <Symantec Corporation><7.50.00.846>
[C:\Program Files\NavNT\NAVAPI32.DLL] <Symantec Corp.><4.1.0.6>
[C:\PROGRA~1\COMMON~1\SYMANT~1\VIRUSD~1\20051223.006\NAVEX32a.DLL] <Symantec Corporation><20051.3.1.11>
[C:\PROGRA~1\COMMON~1\SYMANT~1\VIRUSD~1\20051223.006\NAVENG32.DLL] <Symantec Corporation><20051.3.1.11>
[C:\Program Files\NavNT\NAVAP32.DLL] <Symantec Corporation><5.3.1.39>
[C:\Program Files\NavNT\NotesExt.dll] <Symantec Corporation><7.50.00.846>
[C:\Program Files\NavNT\vpmsece.dll] <Symantec Corporation><7.50.00.846>
[C:\WINNT\system32\amslib.dll] <Intel Corporation><6.0.201.0940 E>
[C:\WINNT\system32\loc32vc0.dll] <Intel><3, 0, 0, 2>
[PID: 716][C:\WINNT\system32\regsvc.exe] <Microsoft Corporation><5.00.2195.6701>
[PID: 736][C:\WINNT\system32\MSTask.exe] <Microsoft Corporation><4.71.2195.6972>
[PID: 800][C:\WINNT\System32\WBEM\WinMgmt.exe] <Microsoft Corporation><1.50.1085.0100>
[PID: 820][C:\WINNT\system32\svchost.exe] <Microsoft Corporation><5.00.2134.1>
[PID: 824][C:\WINNT\system32\MsgSys.EXE] <Intel Corporation><6.0.201.0940 E>
[C:\WINNT\system32\NTS.dll] <Intel Corporation><6.0.201.0940 E>
[C:\WINNT\system32\CBA.DLL] <Intel Corporation><6.0.201.0940 E>
[C:\WINNT\system32\MsgSys.dll] <Intel Corporation><6.0.201.0940 E>
[C:\WINNT\system32\PDS.DLL] <Intel Corporation><6.0.201.0940 E>
[PID: 1100][C:\WINNT\Explorer.EXE] <Microsoft Corporation><5.00.3700.6690>
[PID: 1224][C:\Program Files\NavNT\vptray.exe] <Symantec Corporation><7.50.00.846>
[C:\Program Files\NavNT\Cliproxy.dll] <Symantec Corporation><7.50.00.846>
[C:\Program Files\NavNT\NAVNTUTL.DLL] <Symantec/Peter Norton Group><1, 0, 0, 1>
[C:\Program Files\NavNT\Cliscan.dll] <Symantec Corporation><7.50.00.846>
[PID: 1244][C:\Program Files\Network Associates\Common Framework\UpdaterUI.exe] <Network Associates, Inc.><3.5.0.412>
[C:\Program Files\Network Associates\Common Framework\nailog.dll] <Network Associates, Inc.><3.5.0.474>
[C:\Program Files\Network Associates\Common Framework\naCmnLib.dll] <Network Associates, Inc.><3.5.0.474>
[C:\Program Files\Network Associates\Common Framework\naXML.dll] <Network Associates, Inc.><3.5.0.474>
[C:\Program Files\Network Associates\Common Framework\0409\UpdRes.dll] <Network Associates, Inc.><3.5.0.412>
[C:\Program Files\Network Associates\Common Framework\0409\AgentRes.dll] <Network Associates, Inc.><3.5.0.412>
[C:\Program Files\Network Associates\Common Framework\SecureFrameworkFactory.dll] <Network Associates, Inc.><3.5.0.412>
[PID: 1252][C:\WINNT\system32\internat.exe] <Microsoft Corporation><5.00.2920.0000>
[PID: 1412][E:\zhuomian\sreng2\SREng.exe] <Smallfrogs Studio><2.0.12.350>

斑茅 - 2005-12-31 14:10:00

==================================
文件关联
.TXT OK. [%SystemRoot%\system32\NOTEPAD.EXE %1]
.EXE OK. ["%1" %*]
.COM OK. ["%1" %*]
.PIF OK. ["%1" %*]
.REG OK. [regedit.exe "%1"]
.BAT OK. ["%1" %*]
.SCR OK. ["%1" /S]
.CHM OK. ["C:\WINNT\hh.exe" %1]
.HLP OK. [%SystemRoot%\System32\winhlp32.exe %1]
.INI OK. [%SystemRoot%\System32\NOTEPAD.EXE %1]
.INF OK. [%SystemRoot%\System32\NOTEPAD.EXE %1]
.VBS OK. [%SystemRoot%\System32\WScript.exe "%1" %*]
.JS OK. [%SystemRoot%\System32\WScript.exe "%1" %*]
.LNK OK. [{00021401-0000-0000-C000-000000000046}]

==================================
Winsock 提供者

==================================

斑茅 - 2005-12-31 14:17:00

发完了。这里还有一张重装系统前发作的时候的截图。现在禁用了脚本，禁用了服务。虽然不会再连到www.tubao.com上。但访问正常网页却还是经常受阻（网址后面被加上了404.html)如访问www.95588.com,地址栏里会显示www.95588.com/404.html.手动删不走404.html

附件: 57174320051231141756.jpg

瑞星卡卡安全论坛