瑞星卡卡安全论坛技术交流区反病毒/反流氓软件论坛 被流氓网站—“北斗搜索”(www.bydou.com)劫持了,靠之

1   1  /  1  页   跳转

被流氓网站—“北斗搜索”(www.bydou.com)劫持了,靠之

被流氓网站—“北斗搜索”(www.bydou.com)劫持了,靠之

时不时弹个窗口出来,太烦了,求高手们帮帮忙


---------------------------------------------------------------------
Logfile of HijackThis v1.99.1
Scan saved at 11:52:50, on 2007-1-11
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\SOUNDMAN.EXE
C:\WINDOWS\system32\RUNDLL32.EXE
E:\KV2005\KVMonXP.kxp
C:\WINDOWS\system32\ctfmon.exe
E:\KV2005\KVSrvXP.exe
E:\KV2005\kvwsc.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\Program Files\Microsoft Office\OFFICE11\2052\msohelp.exe
C:\WINDOWS\system32\conime.exe
E:\flashxp200中文版\FlashFXP.exe
C:\WINDOWS\system32\sevchost.exe
C:\WINDOWS\system32\vmiprwse.exe
E:\tt\TTraveler.exe
E:\ha_hijackthis_1991\HijackThis.exe

O2 - BHO: ThunderIEHelper - {0005A87D-D626-4B3A-84F9-1D9571695F55} - C:\WINDOWS\system32\xunleibho_v10.dll
O2 - BHO: QQIEHelper - {54EBD53A-9BC1-480B-966A-843A333CA162} - E:\qq\QQIEHelper.dll
O2 - BHO: BrowseHelper Class - {80BF4637-D65B-43F3-BB60-C5DD3D5FB7B9} - E:\KV2005\KvShell.dll
O3 - Toolbar: 江民杀毒工具栏 - {B5A34A93-D538-43A7-8371-864CB6148D12} - E:\KV2005\KvShell.dll
O4 - HKLM\..\Run: [IMSCMig] C:\PROGRA~1\COMMON~1\MICROS~1\IME\IMSC40A\IMSCMIG.EXE /Preload
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [StormCodec_Helper] "E:\Storm Codec\StormSet.exe" /S /opti
O4 - HKLM\..\Run: [KvMonXP] "E:\KV2005\KVMonXP.kxp" /auto
O4 - HKLM\..\Run: [Mysee Alert] "C:\Program Files\GAOV\Mysee Alert\Mysee Alert.exe" -notray
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - Startup: 腾讯QQ.lnk = E:\qq\QQ.exe
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O8 - Extra context menu item: &使用迅雷下载 - E:\Thunder\geturl.htm
O8 - Extra context menu item: &使用迅雷下载全部链接 - E:\Thunder\getallurl.htm
O8 - Extra context menu item: 上传到QQ网络硬盘 - E:\qq\AddToNetDisk.htm
O8 - Extra context menu item: 导出到 Microsoft Office Excel(&X) - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: 添加到QQ自定义面板 - E:\qq\AddPanel.htm
O8 - Extra context menu item: 添加到QQ表情 - E:\qq\AddEmotion.htm
O8 - Extra context menu item: 用QQ彩信发送该图片 - E:\qq\SendMMS.htm
O9 - Extra button: 浩方对战平台 - {0A155D3C-68E2-4215-A47A-E800A446447A} - E:\浩方对战平台\GameClient.exe (file missing)
O9 - Extra button: 信息检索 - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: QQ - {c95fe080-8f5d-11d2-a20b-00aa003c157b} - E:\qq\QQ.EXE
O9 - Extra 'Tools' menuitem: 腾讯QQ - {c95fe080-8f5d-11d2-a20b-00aa003c157b} - E:\qq\QQ.EXE
O9 - Extra button: (no name) - {DEDEB80D-FA35-45d9-9460-4983E5A8AFE6} - E:\qq\QQIEHelper.dll
O9 - Extra 'Tools' menuitem: QQ炫彩工具条设置 - {DEDEB80D-FA35-45d9-9460-4983E5A8AFE6} - E:\qq\QQIEHelper.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O10 - Unknown file in Winsock LSP: c:\windows\system32\kvwspxp_1.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\kvwspxp_1.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\kvwspxp_1.dll
O16 - DPF: {05C1004E-2596-48E5-8E26-39362985EEB9} (MMCPlayer Class) - http://p3p.sogou.com/MMCShell.cab
O16 - DPF: {39044F32-421E-4CE0-A595-EF66D42C363C} (PptvPlayer Class) - http://218.16.123.208:8080/nba/pptv.CAB
O16 - DPF: {53AF6E02-F18F-4228-AC13-3E79773FBE50} (CMCBooter Object) - http://download.mysee.com/plugin/booter.cab
O16 - DPF: {87CCFDB0-C4BE-4BC2-A78C-9EAA7CF96667} - http://ps.itv.mop.com/dn/files/vodupdate_1.0.0.10_20080809.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{C0867983-1861-4D3C-902B-AE860A1F7A5E}: NameServer = 61.139.2.69,218.246.195.5
O20 - Winlogon Notify: ceitmmc - C:\WINDOWS\SYSTEM32\ceitmmc.dll
O20 - Winlogon Notify: certrmgr - certrmgr.dll (file missing)
O20 - Winlogon Notify: cfggr32 - cfggr32.dll (file missing)
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: KVSrvXP - JiangMin New Tech Ltd. - E:\KV2005\KVSrvXP.exe
O23 - Service: KVWSC - Jiangmin Co.Ltd - E:\KV2005\kvwsc.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe

---------------------------------------------------------------------------------
最后编辑2007-01-19 11:07:08
分享到:
gototop
 

推荐使用360安全卫士清理一下流氓

.360下载地址:
http://www.360safe.com/
http://www.xdowns.com/soft/8/9/2006/Soft_31554.html
使用后删除360安全卫士
gototop
 

清理了,没用,360根本找不到什么北斗搜索

继续寻求帮助
gototop
 

========Content========
【回复“cokki”的帖子】

O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [StormCodec_Helper] "E:\Storm Codec\StormSet.exe" /S /opti
O4 - HKLM\..\Run: [Mysee Alert] "C:\Program Files\GAOV\Mysee Alert\Mysee Alert.exe" -notray
请确定以上起动软件是否LZ常用的,且必须随系统起动.否则请先禁掉.(确定没用就删掉起动项,并卸载干净整个程序)


O10 - Unknown file in Winsock LSP: c:\windows\system32\kvwspxp_1.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\kvwspxp_1.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\kvwspxp_1.dll
这三项请打开相应文件夹,看看是否江民的,否则请在安全模式下修复010项,并删除相应的文件.


O16 - DPF: {05C1004E-2596-48E5-8E26-39362985EEB9} (MMCPlayer Class) - http://p3p.sogou.com/MMCShell.cab
O16 - DPF: {39044F32-421E-4CE0-A595-EF66D42C363C} (PptvPlayer Class) - http://218.16.123.208:8080/nba/pptv.CAB
O16 - DPF: {53AF6E02-F18F-4228-AC13-3E79773FBE50} (CMCBooter Object) - http://download.mysee.com/plugin/booter.cab
O16 - DPF: {87CCFDB0-C4BE-4BC2-A78C-9EAA7CF96667} - http://ps.itv.mop.com/dn/files/vodupdate_1.0.0.10_20080809.cab
安全模式下修复以上016项.并删除相应文件.
gototop
 

【回复“cokki”的帖子】
017项的DNS地址是否LZ当地的网络运营商提供的.若是流氓所设,那它指哪,LZ就去哪?


O20 - Winlogon Notify: ceitmmc - C:\WINDOWS\SYSTEM32\ceitmmc.dll
O20 - Winlogon Notify: certrmgr - certrmgr.dll (file missing)
O20 - Winlogon Notify: cfggr32 - cfggr32.dll (file missing)
以上3项也须LZ进相应文件夹查看文件属性,看看是否显卡驱动,或杀软的驱动或其它熟知的文件,否则也是很有问题.须修复.

另:可下个SRENG2.3扫描看看.
URL:http://www.kztechs.com/

gototop
 

感谢各位热心帮忙,我试试
gototop
 

我现在什么都用了
就是干不掉
卡卡也不行!!!
急!!!!!!!!!
gototop
 

删除
C:\WINDOWS\system32\sevchost.exe
gototop
 
1   1  /  1  页   跳转
页面顶部
Powered by Discuz!NT