瑞星卡卡安全论坛

HijackThis@Qoo的扫描日志  V1.97.7
Scan saved at 11:08:27, on 2006-1-18
Platform: Windows XP  (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 (6.00.2600.0000)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
d:\瑞星\防火墙\rising\rfw\rfwsrv.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\System32\rundll32.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\CAP3RSK.EXE
C:\WINDOWS\Explorer.EXE
d:\瑞星\防火墙\rising\rfw\RfwMain.exe
C:\Program Files\Java\j2re1.4.2_03\bin\jusched.exe
C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_S4I3W1.EXE
D:\瑞星\Rav\RavTask.exe
C:\WINDOWS\System32\ctfmon.exe
D:\瑞星\Rav\Ravmon.exe
D:\迅雷下载\Thunder.exe
C:\WINDOWS\System32\DllHost.exe
D:\瑞星\Rav\RsAgent.exe
C:\WINDOWS\msagent\AgentSvr.exe
C:\Program Files\Microsoft Office\Office10\WINWORD.EXE
D:\进程扫描\hijackthis1.97_qoo\HijackThis.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\WINDOWS\System32\rundll32.exe

R3 - URLSearchHook: QQ Search Hook - {DB8B2393-7A6C-4C76-88CE-6B1F6FF6FFE9} - C:\Program Files\TENCENT\AddrPlus\IEHelp.dll
O2 - BHO: (no name) - {0005A87D-D626-4B3A-84F9-1D9571695F55} - C:\WINDOWS\System32\xunleibho_v8.dll
O2 - BHO: (no name) - {0C7C23EF-A848-485B-873C-0ED954731014} - C:\Program Files\TENCENT\AddrPlus\IEHelp.dll
O2 - BHO: std software - {6A512BF7-EC78-4e8d-9841-6C02E8FA9838} - C:\WINDOWS\SYSTEM32\stdup.dll
O2 - BHO: AssistII - {BB936323-19FA-4521-BA29-ECA6A121BC78} - C:\PROGRA~1\3721\Assist\asbar.dll
O3 - Toolbar: ????? - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O3 - Toolbar: ????? - {BB936323-19FA-4521-BA29-ECA6A121BC78} - C:\PROGRA~1\3721\Assist\asbar.dll
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\j2re1.4.2_03\bin\jusched.exe
O4 - HKLM\..\Run: [Thunder] "D:\
O4 - HKLM\..\Run: [EPSON ME 1] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_S4I3W1.EXE /P10 "EPSON ME 1" /O5 "LPT1:" /M "ME 1"
O4 - HKLM\..\Run: [RavTask] "D:\
O4 - HKLM\..\Run: [AddrPlus3] C:\PROGRA~1\TENCENT\AddrPlus\Runner.exe C:\PROGRA~1\TENCENT\AddrPlus\QAHook.dll Rundll32
O4 - HKLM\..\Run: [KsgUpdateRun] C:\Program Files\Common Files\kingsoft\KSG\client.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\System32\ctfmon.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - Startup: cqsel.ini
O4 - Startup: NTUSER.DAT
O4 - Startup: ntuser.dat.LOG
O4 - Startup: ntuser.ini
O4 - Startup: regproduct.ini
O4 - Startup: 桌肻campaign.CDX
O4 - Startup: 桌肻campaign.dbf
O4 - Startup: 桌肻campaign.FPT
O4 - Startup: 桌肻donors.CDX
O4 - Startup: 桌肻donors.dbf
O4 - Startup: 桌肻donors.FPT
O4 - Startup: 桌肻pledges.CDX
O4 - Startup: 桌肻pledges.dbf
O4 - Global Startup: ntuser.pol
O8 - Extra context menu item: &使用迅雷下载 - D:\
O8 - Extra context menu item: &使用迅雷下载全部链接 - D:\
O8 - Extra context menu item: 上传到QQ网络硬盘 - D:\cxs qq\myqq05\qq\AddToNetDisk.htm
O8 - Extra context menu item: 添加到QQ自定义面板 - D:\cxs qq\myqq05\qq\AddPanel.htm
O8 - Extra context menu item: 添加到QQ表情 - D:\cxs qq\myqq05\qq\AddEmotion.htm
O8 - Extra context menu item: 用QQ彩信发送该图片 - D:\cxs qq\myqq05\qq\SendMMS.htm
O9 - Extra button: Related (HKLM)
O9 - Extra 'Tools' menuitem: Show &Related Links (HKLM)
O11 - Options group: [TBH]  QQ
O17 - HKLM\System\CCS\Services\Tcpip\..\{9B902AD7-A994-4C22-9E2E-59138EF57CAD}: NameServer = 202.96.209.133,202.96.209.5

小弟谢谢大家了

版本太低,日志不全.

请下载并使用HijackThis1.99.1,把HijackThis
                  1.99.1生成的log日志文件的内容贴上来，方便大家分析。

                  有关操作方法可参考：
                  【推荐】反浏览器劫持的一些常用操作
                  http://forum.ikaka.com/topic.asp?board=67&artid=6490491

我马上就换新版本。谢谢

新的日志。谢谢
Logfile of HijackThis v1.99.1
Scan saved at 17:00:18, on 2006-1-18
Platform: Windows XP  (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2600.0000)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
d:\瑞星\防火墙\rising\rfw\rfwsrv.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\System32\rundll32.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\CAP3RSK.EXE
C:\WINDOWS\Explorer.EXE
D:\瑞星\Rav\RavTask.exe
C:\WINDOWS\System32\ctfmon.exe
D:\瑞星\Rav\Ravmon.exe
D:\迅雷下载\Thunder.exe
d:\瑞星\防火墙\rising\rfw\RfwMain.exe
C:\WINDOWS\System32\DllHost.exe
D:\cxs qq\myqq05\qq\QQ.exe
D:\cxs qq\myqq05\qq\TIMPlatform.exe
C:\WINDOWS\System32\rundll32.exe
D:\瑞星\Rav\RsAgent.exe
C:\WINDOWS\msagent\AgentSvr.exe
C:\Program Files\Internet Explorer\iexplore.exe
D:\cxs qq\myqq05\TT\TTraveler.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
D:\进程扫描\HijackThis.exe

R3 - URLSearchHook: QQ Search Hook - {DB8B2393-7A6C-4C76-88CE-6B1F6FF6FFE9} - C:\Program Files\TENCENT\AddrPlus\IEHelp.dll
O2 - BHO: ThunderIEHelper Class - {0005A87D-D626-4B3A-84F9-1D9571695F55} - C:\WINDOWS\System32\xunleibho_v8.dll
O2 - BHO: Tencent Browser Helper - {0C7C23EF-A848-485B-873C-0ED954731014} - C:\Program Files\TENCENT\AddrPlus\IEHelp.dll
O2 - BHO: std software - {6A512BF7-EC78-4e8d-9841-6C02E8FA9838} - C:\WINDOWS\SYSTEM32\stdup.dll
O2 - BHO: AssistII - {BB936323-19FA-4521-BA29-ECA6A121BC78} - C:\PROGRA~1\3721\Assist\asbar.dll
O3 - Toolbar: 电台(&R) - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O3 - Toolbar: 上网助手 - {BB936323-19FA-4521-BA29-ECA6A121BC78} - C:\PROGRA~1\3721\Assist\asbar.dll
O4 - HKLM\..\Run: [Thunder] "D:\迅雷下载\ThunderShell.exe" /s
O4 - HKLM\..\Run: [RavTask] "D:\瑞星\Rav\RavTask.exe" -system
O4 - HKLM\..\Run: [AddrPlus3] C:\PROGRA~1\TENCENT\AddrPlus\Runner.exe C:\PROGRA~1\TENCENT\AddrPlus\QAHook.dll Rundll32
O4 - HKLM\..\Run: [KsgUpdateRun] C:\Program Files\Common Files\kingsoft\KSG\client.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\System32\ctfmon.exe
O8 - Extra context menu item: &使用迅雷下载 - D:\迅雷下载\geturl.htm
O8 - Extra context menu item: &使用迅雷下载全部链接 - D:\迅雷下载\getallurl.htm
O8 - Extra context menu item: 上传到QQ网络硬盘 - D:\cxs qq\myqq05\qq\AddToNetDisk.htm
O8 - Extra context menu item: 添加到QQ自定义面板 - D:\cxs qq\myqq05\qq\AddPanel.htm
O8 - Extra context menu item: 添加到QQ表情 - D:\cxs qq\myqq05\qq\AddEmotion.htm
O8 - Extra context menu item: 用QQ彩信发送该图片 - D:\cxs qq\myqq05\qq\SendMMS.htm
O9 - Extra button: 手机短信 - {00000000-0000-0001-0001-596BAEDD1289} - http://sms.3721.com/ie/index.htm?pid=208676_1006 (file missing)
O9 - Extra button: 维宇RealLink - {0713E8D2-850A-101B-AFC0-4210122A8DA9} - D:\REALLINK\RealLink.exe
O9 - Extra 'Tools' menuitem: 维宇RealLink - {0713E8D2-850A-101B-AFC0-4210122A8DA9} - D:\REALLINK\RealLink.exe
O9 - Extra button: Yahoo 1G电邮 - {507F9113-CD77-4866-BA92-0E86DA3D0B97} - http://cn.mail.yahoo.com/promo/rd1 (file missing)
O9 - Extra button: 上网助手 - {5D73EE86-05F1-49ed-B850-E423120EC338} - http://assistant.3721.com/index.htm?fb=Cns (file missing)
O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
O9 - Extra 'Tools' menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
O9 - Extra button: 情景聊天 - {E5D12C4E-7B4F-11D3-B5C9-0050045C3C96} - http://cn.rd.yahoo.com/home/messenger/bjk/clientbtn/?http://cn.messenger.yahoo.com/ (file missing)
O11 - Options group: [TBH]  QQ地址栏搜索插件
O17 - HKLM\System\CCS\Services\Tcpip\..\{9B902AD7-A994-4C22-9E2E-59138EF57CAD}: NameServer = 202.96.209.133,202.96.209.5
O18 - Protocol: koboo - {7DEE9D05-FA0A-4416-A6F3-6537D0EAB6A6} - C:\WINDOWS\System32\mbprot.dll
O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxsrvc.dll
O23 - Service: Rising Personal Firewall Service (RfwService) - Beijing Rising Technology Co., Ltd. - d:\瑞星\防火墙\rising\rfw\rfwsrv.exe
O23 - Service: RsRavMon Service (RsRavMon) - Beijing Rising Technology Co., Ltd. - D:\瑞星\Rav\Ravmond.exe

O2 - BHO: std software - {6A512BF7-EC78-4e8d-9841-6C02E8FA9838} - C:\WINDOWS\SYSTEM32\stdup.dll

修复
关闭IE
删除C:\WINDOWS\SYSTEM32\stdup.dll

引用:

【BlackStone的贴子】O2 - BHO: std software - {6A512BF7-EC78-4e8d-9841-6C02E8FA9838} - C:\WINDOWS\SYSTEM32\stdup.dll 修复 关闭IE 删除C:\WINDOWS\SYSTEM32\stdup.dll ...........................

我修复了，那个文件也删掉了。可是开机还有。扫描日志那项还在。是怎么回事呀。应该怎么办。

http://forum.ikaka.com/topic.asp?board=67&artid=7423269  【讨论】关于stdup.dll反复出现、无法删除的解决办法

谢谢楼上的。我的问题解决了。