瑞星卡卡安全论坛技术交流区反病毒/反流氓软件论坛 【求助】浏览器劫持“后遗症”。望魔法学徒及其他斑竹来帮帮忙!俺先谢了!

12   2  /  2  页   跳转

【求助】浏览器劫持“后遗症”。望魔法学徒及其他斑竹来帮帮忙!俺先谢了!

俺要晕了,这几天想尽各种办法还是不见好转。。魔法兄,您说俺是不是只能重装系统才能好?崩溃ing。。。- -#
gototop
 

请用System Repair Engineer扫个log贴上来

下载地址见置顶贴
[必读]本版说明及常用小软件下载
http://forum.ikaka.com/topic.asp?board=67&artid=5188931
gototop
 

恩,谢谢魔法兄的帮助,我已经扫描出来了:
2005-11-29,00:55:47

System Repair Engineer 1.1.0.269
    Windows XP Professional Service Pack 1 - 管理权限用户 - 完整功能

以下内容被选中:
    所有的启动项目(包括注册表、启动文件夹、服务等)
    浏览器加载项
    正在运行的进程(包括进程模块信息)
    文件关联


启动项目
注册表
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
  <ctfmon.exe><C:\WINDOWS\System32\ctfmon.exe>
[HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows]
  <load><>
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
  <NvCplDaemon><RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup>
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
  <assistse><"C:\PROGRA~1\3721\assistse.exe">
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
  <helper.dll><C:\WINDOWS\system32\rundll32.exe C:\PROGRA~1\3721\helper.dll,Rundll32>
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
  <RavTimer><rem C:\PROGRA~1\RISING\RAV\RAVTIMER.EXE>
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
  <RavMon><rem C:\PROGRA~1\RISING\RAV\RAVMON.EXE -SYSTEM>
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
  <TkBellExe><rem "C:\Program Files\Common Files\Real\Update_OB\realsched.exe"  -osboot>
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
  <BaiduX><; D:\BaiduX\BaiduX.exe -min>
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
  <shell><Explorer.exe>
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
  <Userinit><C:\WINDOWS\system32\userinit.exe,>
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Windows]
  <AppInit_DLLs><>

==================================
启动文件夹
服务
[Distributed File System Services / Distfsv]
  <C:\WINDOWS\System32\Distfsv.exe -service><N/A>
[DuDu Accelerator / DuDuProsvc]
  <D:\终级上网提速\DuDuProsvc.exe><DuDu>
[NVIDIA Display Driver Service / NVSvc]
  <C:\WINDOWS\System32\nvsvc32.exe><NVIDIA Corporation>
[P4P Service / P4P Service]
  <D:\P4P\p2psvr.exe><N/A>
[Rising Personal Firewall Service / RfwService]
  <d:\rising\rising\rfw防火墙\rfwsrv.exe><Beijing Rising Technology Corporation Limited>
[Rising Process Communication Center / RsCCenter]
  <C:\PROGRAM FILES\RISING\RAV\CCENTER.EXE><rising>
[RsRavMon Service / RsRavMon]
  <C:\PROGRAM FILES\RISING\RAV\Ravmond.exe><Beijing Rising Technology Co., Ltd.>
[SmartLinkService / SLService]
  <slserv.exe>< >

==================================
浏览器加载项
[AntiFish Class]
  <C:\Program Files\3721\Assist\Angling.dll>
[IeCatch2 Class]
  <C:\PROGRA~1\FLASHGET\jccatch.dll>
[上网助手]
  <C:\Program Files\3721\Assist\asbar.dll>
[手机短信]
  <http://sms.3721.com/ie/index.htm>
[Yahoo 1G电邮]
  <http://cn.mail.yahoo.com/promo/rd1>
[寻宝乐趣多]
  <http://hot.3721.com/rd/shop_btn.htm>
[上网助手]
  <http://assistant.3721.com/index.htm?fb=Cns>
[情景聊天]
  <http://cn.rd.yahoo.com/home/messenger/bjk/clientbtn/?http://cn.messenger.yahoo.com/>
[]
  <http://assistant.3721.com/security1.htm?fb=Cns>
[]
  <http://assistant.3721.com/clean1.htm?fb=Cns>
[电台(&R)]
  <C:\WINDOWS\System32\msdxm.ocx>
[上网助手]
  <C:\Program Files\3721\Assist\asbar.dll>
[WUWebControl Class]
  <C:\WINDOWS\System32\wuweb.dll>
[LoaderCore Class]
  <C:\WINDOWS\Downloaded Program Files\DLLoader.dll>
[!搜一搜]
  <res://C:\WINDOWS\DOWNLO~1\CnsMinEx.dll/1003>
[使用网际快车下载]
  <C:\Program Files\FlashGet\jc_link.htm>
[使用网际快车下载全部链接]
  <C:\Program Files\FlashGet\jc_all.htm>
[添加到QQ自定义面板]
  <E:\Program Files\QQ\AddPanel.htm>
[添加到QQ表情]
  <E:\Program Files\QQ\AddEmotion.htm>
[用QQ彩信发送该图片]
  <E:\Program Files\QQ\SendMMS.htm>

==================================
正在运行的进程
[PID: 452][\SystemRoot\System32\smss.exe]  <Microsoft Corporation><5.1.2600.1106 (xpsp1.020828-1920)>
[PID: 508][\??\C:\WINDOWS\system32\csrss.exe]  <Microsoft Corporation><5.1.2600.0 (xpclient.010817-1148)>
[PID: 532][\??\C:\WINDOWS\system32\winlogon.exe]  <Microsoft Corporation><5.1.2600.1106 (xpsp1.020828-1920)>
[PID: 576][C:\WINDOWS\system32\services.exe]  <Microsoft Corporation><5.1.2600.0 (xpclient.010817-1148)>
[PID: 588][C:\WINDOWS\system32\lsass.exe]  <Microsoft Corporation><5.1.2600.1106 (xpsp1.020828-1920)>
[PID: 760][C:\WINDOWS\system32\svchost.exe]  <Microsoft Corporation><5.1.2600.0 (xpclient.010817-1148)>
[PID: 852][C:\WINDOWS\System32\svchost.exe]  <Microsoft Corporation><5.1.2600.0 (xpclient.010817-1148)>
[PID: 884][C:\WINDOWS\System32\svchost.exe]  <Microsoft Corporation><5.1.2600.0 (xpclient.010817-1148)>
[PID: 980][C:\WINDOWS\system32\spoolsv.exe]  <Microsoft Corporation><5.1.2600.0 (XPClient.010817-1148)>
    [C:\WINDOWS\system32\OLFMNT40.DLL]  <Microsoft Corporation><9.0.98.0105>
    [C:\WINDOWS\System32\spool\PRTPROCS\W32X86\olfpnt40.dll]  <Microsoft Corporation><9.0.98.0105>
    [C:\WINDOWS\System32\spool\PRTPROCS\W32X86\vprproc.dll]  <Windows (R) 2000 DDK provider><5.00.2195.1620>
[PID: 1060][D:\终级上网提速\DuDuProsvc.exe]  <DuDu><1, 2, 0, 12>
[PID: 1084][C:\WINDOWS\System32\nvsvc32.exe]  <NVIDIA Corporation><6.14.10.5672>
[PID: 1112][C:\PROGRAM FILES\RISING\RAV\CCENTER.EXE]  <rising><17, 0, 0, 1>
[PID: 1124][C:\PROGRAM FILES\RISING\RAV\Ravmond.exe]  <Beijing Rising Technology Co., Ltd.><17, 0, 1, 57>
    [C:\PROGRAM FILES\RISING\RAV\guidll.dll]  <rising><17, 0, 0, 13>
    [C:\PROGRAM FILES\RISING\RAV\RsCommX.dll]  <rising><17, 0, 0, 3>
    [C:\PROGRAM FILES\RISING\RAV\RSAPPMGR.DLL]  <Rising Corp.><17, 0, 0, 7>
    [C:\PROGRAM FILES\RISING\RAV\CfgDll.dll]  <rising><17, 0, 0, 60>
    [C:\Program Files\Rising\Rav\Scanner.dll]  <Rising><17, 0, 0, 43>
    [C:\PROGRAM FILES\RISING\RAV\RSCOMMON.DLL]  <Beijing Rising Technology Co., Ltd.><17, 0, 0, 17>
    [C:\Program Files\Rising\Rav\libload.dll]  <Rising><17, 0, 0, 14>
    [C:\Program Files\Rising\Rav\VirusLib.dll]  <Rising><17, 0, 0, 26>
    [C:\PROGRAM FILES\RISING\RAV\MailMon.dll]  < ><17, 0, 0, 9>
    [C:\Program Files\Rising\Rav\engine.dll]  <rising><17, 0, 0, 39>
    [C:\Program Files\Rising\Rav\UnExe.dll]  <Rising><17, 0, 0, 25>
    [C:\Program Files\Rising\Rav\SpamEng.dll]  <N/A><17, 0, 0, 7>
    [C:\Program Files\Rising\Rav\ScanEx.dll]  <Rising><17, 0, 0, 33>
    [C:\PROGRAM FILES\RISING\RAV\MemMon.dll]  <北京瑞星><17, 8, 0, 0>
    [C:\Program Files\Rising\Rav\PostTrt.dll]  <Rising><17, 0, 0, 21>
    [C:\Program Files\Rising\Rav\NvFile.dll]  <瑞星><17, 0, 0, 13>
    [C:\PROGRAM FILES\RISING\RAV\expscan.dll]  <N/A><17, 0, 0, 6>
    [C:\PROGRAM FILES\RISING\RAV\mPorts.dll]  <Beijing Rising Technology Corporation Limited><3, 0, 0, 3>
    [C:\PROGRAM FILES\RISING\RAV\regmon.dll]  < ><17, 0, 0, 12>
    [C:\PROGRAM FILES\RISING\RAV\HookWeb.dll]  <rising><17, 0, 0, 4>
gototop
 

[C:\Program Files\Rising\Rav\ScanMac.dll]  <rising><17, 0, 0, 17>
    [C:\Program Files\Rising\Rav\ScanSct.dll]  <rising><17, 0, 0, 29>
    [C:\Program Files\Rising\Rav\ScanExec.dll]  <N/A><17, 0, 0, 21>
    [C:\Program Files\Rising\Rav\Unpacker.dll]  <rising><17, 0, 0, 19>
    [C:\Program Files\Rising\Rav\ExtOLE.dll]  <rising><17, 0, 0, 20>
[PID: 1196][C:\PROGRAM FILES\RISING\RAV\RavStub.exe]  <Beijing Rising Technology Co., Ltd.><17, 0, 0, 27>
    [C:\PROGRAM FILES\RISING\RAV\RsCommX.dll]  <rising><17, 0, 0, 3>
    [C:\PROGRAM FILES\RISING\RAV\RSCOMMON.DLL]  <Beijing Rising Technology Co., Ltd.><17, 0, 0, 17>
[PID: 1368][C:\WINDOWS\Explorer.EXE]  <Microsoft Corporation><6.00.2800.1106 (xpsp1.020828-1920)>
    [C:\WINDOWS\DOWNLO~1\CnsHook.dll]  <北京三七二一科技有限公司><1, 0, 2, 4>
    [C:\WINDOWS\DOWNLO~1\CnsMin.dll]  <北京三七二一科技有限公司><1, 5, 2, 0>
    [C:\PROGRA~1\3721\helper.dll]  <N/A><1, 0, 8, 1014>
    [C:\PROGRA~1\3721\alrex.dll]  <N/A><1, 0, 0, 1>
    [C:\PROGRA~1\3721\AutoLive.dll]  <N/A><1, 1, 4, 1026>
    [C:\PROGRA~1\3721\alLiveEx.dll]  < ><1, 0, 2, 1005>
    [C:\PROGRA~1\3721\Assist\asnoad.dll]  <N/A><1, 0, 0, 9>
    [C:\PROGRA~1\FLASHGET\jccatch.dll]  <Amaze Soft><1, 1, 4, 0>
    [C:\PROGRA~1\3721\Assist\repair.dll]  <北京三七二一科技有限公司><1, 0, 4, 1001>
    [C:\PROGRA~1\3721\Assist\asfsks.dll]  <3721.com><2, 1, 1, 87>
    [C:\PROGRA~1\3721\Assist\optimum.dll]  <N/A><N/A>
    [c:\progra~1\3721\assist\adfilter.dll]  < ><1, 0, 1, 6>
    [C:\PROGRA~1\3721\Assist\assecblk.dll]  <3721><1, 0, 0, 9>
    [C:\PROGRA~1\3721\Assist\XPStyle.dll]  <N/A><N/A>
    [C:\Program Files\WinRAR\rarext.dll]  <N/A><N/A>
    [C:\WINDOWS\System32\RAVEXT.DLL]  <Beijing Rising Technology Co., Ltd.><17, 0, 0, 8>
[PID: 1512][C:\WINDOWS\System32\Rundll32.exe]  <Microsoft Corporation><5.1.2600.0 (xpclient.010817-1148)>
    [C:\WINDOWS\DOWNLO~1\CnsMin.dll]  <北京三七二一科技有限公司><1, 5, 2, 0>
    [C:\WINDOWS\DOWNLO~1\CnsMinIO.dll]  <北京三七二一科技有限公司><1, 0, 3, 4>
    [C:\WINDOWS\DOWNLO~1\cnsio.dll]  <北京三七二一科技有限公司><1, 0, 2, 5>
    [C:\WINDOWS\DOWNLO~1\CnsMinEx.dll]  <国风因特软件(北京)有限公司><1, 0, 2, 4>
    [C:\PROGRA~1\3721\helper.dll]  <N/A><1, 0, 8, 1014>
[PID: 1568][C:\PROGRA~1\3721\assistse.exe]  <yahoo><1, 0, 1, 1001>
    [C:\WINDOWS\DOWNLO~1\CnsMin.dll]  <北京三七二一科技有限公司><1, 5, 2, 0>
    [C:\PROGRA~1\3721\shell\Assecblk.dll]  <3721><1, 0, 0, 9>
    [C:\PROGRA~1\3721\shell\MenuInfo.dll]  <yahoo><1, 0, 0, 2>
    [C:\PROGRA~1\3721\shell\IEAngel.dll]  <yahoo><1, 0, 0, 3>
    [C:\PROGRA~1\3721\shell\AsMenu.dll]  <3721><1, 0, 1, 1006>
    [C:\PROGRA~1\3721\Assist\assist.dll]  <N/A><2, 0, 3, 3>
    [C:\PROGRA~1\3721\helper.dll]  <N/A><1, 0, 8, 1014>
[PID: 1584][C:\WINDOWS\system32\rundll32.exe]  <Microsoft Corporation><5.1.2600.0 (xpclient.010817-1148)>
    [C:\PROGRA~1\3721\helper.dll]  <N/A><1, 0, 8, 1014>
    [C:\WINDOWS\DOWNLO~1\CnsMin.dll]  <北京三七二一科技有限公司><1, 5, 2, 0>
    [C:\PROGRA~1\3721\AutoLive.dll]  <N/A><1, 1, 4, 1026>
    [C:\PROGRA~1\3721\alLiveEx.dll]  < ><1, 0, 2, 1005>
    [C:\Program Files\3721\Notifier.dll]  <N/A><1, 0, 0, 5>
[PID: 1592][C:\WINDOWS\System32\ctfmon.exe]  <Microsoft Corporation><5.1.2600.1106 (xpsp1.020828-1920)>
    [C:\PROGRA~1\3721\helper.dll]  <N/A><1, 0, 8, 1014>
    [C:\WINDOWS\DOWNLO~1\CnsMin.dll]  <北京三七二一科技有限公司><1, 5, 2, 0>
[PID: 1776][C:\Program Files\Common Files\Real\Update_OB\realsched.exe]  <RealNetworks, Inc.><0.1.0.3208>
    [C:\PROGRA~1\3721\helper.dll]  <N/A><1, 0, 8, 1014>
    [C:\WINDOWS\DOWNLO~1\CnsMin.dll]  <北京三七二一科技有限公司><1, 5, 2, 0>
[PID: 424][C:\WINDOWS\System32\svchost.exe]  <Microsoft Corporation><5.1.2600.0 (xpclient.010817-1148)>
[PID: 1576][C:\Program Files\rising\Rav\RavMon.exe]  <Beijing Rising Technology Co., Ltd.><17, 0, 1, 37>
    [C:\Program Files\rising\Rav\RsGuiLib.dll]  <Beijing Rising Technology Co., Ltd.><17, 0, 0, 40>
    [C:\Program Files\rising\Rav\RSAPPMGR.DLL]  <Rising Corp.><17, 0, 0, 7>
    [C:\Program Files\rising\Rav\CfgDll.dll]  <rising><17, 0, 0, 60>
    [C:\Program Files\rising\Rav\RsCommX.dll]  <rising><17, 0, 0, 3>
    [C:\Program Files\rising\Rav\PngDll.dll]  <Rising><17, 0, 0, 2>
    [C:\Program Files\rising\Rav\RSCOMMON.DLL]  <Beijing Rising Technology Co., Ltd.><17, 0, 0, 17>
    [C:\PROGRA~1\3721\helper.dll]  <N/A><1, 0, 8, 1014>
    [C:\WINDOWS\DOWNLO~1\CnsMin.dll]  <北京三七二一科技有限公司><1, 5, 2, 0>
[PID: 204][C:\Program Files\Internet Explorer\iexplore.exe]  <Microsoft Corporation><6.00.2800.1106 (xpsp1.020828-1920)>
    [C:\PROGRA~1\3721\helper.dll]  <N/A><1, 0, 8, 1014>
    [C:\PROGRA~1\3721\scrblock.dll]  <3721><1, 0, 1, 1000>
    [C:\PROGRA~1\3721\alrex.dll]  <N/A><1, 0, 0, 1>
    [C:\WINDOWS\DOWNLO~1\CnsMin.dll]  <北京三七二一科技有限公司><1, 5, 2, 0>
    [C:\WINDOWS\DOWNLO~1\CnsHint.dll]  <3721><1, 0, 0, 4>
    [C:\PROGRA~1\3721\AutoLive.dll]  <N/A><1, 1, 4, 1026>
    [C:\PROGRA~1\3721\alLiveEx.dll]  < ><1, 0, 2, 1005>
    [C:\WINDOWS\DOWNLO~1\cnsplus.dll]  <3721><1, 0, 0, 2>
    [C:\Program Files\3721\Assist\Angling.dll]  <Yahoo Inc.><1, 0, 0, 1008>
    [C:\PROGRA~1\FLASHGET\jccatch.dll]  <Amaze Soft><1, 1, 4, 0>
    [C:\Program Files\3721\Assist\asbar.dll]  <3721><1, 0, 1, 1021>
    [C:\WINDOWS\DOWNLO~1\CnsMinIO.dll]  <北京三七二一科技有限公司><1, 0, 3, 4>
    [C:\WINDOWS\DOWNLO~1\cnsio.dll]  <北京三七二一科技有限公司><1, 0, 2, 5>
    [C:\WINDOWS\System32\macromed\flash\Flash.ocx]  <Macromedia, Inc.><7,0,19,0>
    [C:\WINDOWS\DOWNLO~1\CnsHook.dll]  <北京三七二一科技有限公司><1, 0, 2, 4>
[PID: 1332][C:\Program Files\FlashGet\flashget.exe]  <Amaze Soft><1, 3, 0, 0>
    [C:\PROGRA~1\3721\helper.dll]  <N/A><1, 0, 8, 1014>
    [C:\WINDOWS\DOWNLO~1\CnsMin.dll]  <北京三七二一科技有限公司><1, 5, 2, 0>
[PID: 1760][c:\program files\rising\rav\RavTimer.exe]  <Beijing Rising Technology Co., Ltd.><17, 0, 0, 39>
    [c:\program files\rising\rav\RSCOMMON.DLL]  <Beijing Rising Technology Co., Ltd.><17, 0, 0, 17>
    [c:\program files\rising\rav\RSAPPMGR.DLL]  <Rising Corp.><17, 0, 0, 7>
    [c:\program files\rising\rav\CfgDll.dll]  <rising><17, 0, 0, 60>
    [c:\program files\rising\rav\RsCommX.dll]  <rising><17, 0, 0, 3>
    [C:\PROGRA~1\3721\helper.dll]  <N/A><1, 0, 8, 1014>
    [C:\WINDOWS\DOWNLO~1\CnsMin.dll]  <北京三七二一科技有限公司><1, 5, 2, 0>
[PID: 2756][D:\System Repair Engineer\SREng.exe]  <Smallfrogs Studio><1.1.0.269>
    [C:\PROGRA~1\3721\helper.dll]  <N/A><1, 0, 8, 1014>
    [C:\WINDOWS\DOWNLO~1\CnsMin.dll]  <北京三七二一科技有限公司><1, 5, 2, 0>

==================================
文件关联
.TXT  Error. [NOTEPAD.EXE %1]
.EXE  OK. ["%1" %*]
.COM  OK. ["%1" %*]
.PIF  OK. ["%1" %*]
.REG  OK. [regedit.exe "%1"]
.BAT  OK. ["%1" %*]
.SCR  OK. ["%1" /S]
.CHM  OK. ["C:\WINDOWS\hh.exe" %1]
.HLP  OK. [C:\WINDOWS\System32\winhlp32.exe %1]
.INI  OK. [C:\WINDOWS\System32\NOTEPAD.EXE %1]
.INF  OK. [C:\WINDOWS\System32\NOTEPAD.EXE %1]

==================================
gototop
 

这个服务还在.
[Distributed File System Services / Distfsv]
<C:\WINDOWS\System32\Distfsv.exe -service><N/A>
请删除.
另,修复一下.TXT文件关联.
gototop
 

重新启动到安全模式(进入安全模式的方法:重新启动电脑, 开机自动检测完后, 按[F8]键(可以一直按到启动菜单出来为止), 选择安全模式(Safe Mode)进入Windows。)

开始→控制面板→性能和维护→管理工具→服务→查找Distributed File System Services→右击→属性→启动类型→禁止→应用→停止→确定。

然后打开我的电脑→再点工具→打开文件夹选项→查看→把隐藏受保护的系统文件(推荐)和隐藏已知文件类型的扩展名的勾去掉→再显示所有文件→找到以下文件并删除:(如果有的话)
C:\WINDOWS\System32\Distfsv.exe 
C:\WINDOWS\System32\Distfsv1.dll
C:\WINDOWS\System32\Distfsv2.dll

最后请修复TXT 文件的关联
gototop
 
12   2  /  2  页   跳转
页面顶部
Powered by Discuz!NT