瑞星卡卡安全论坛技术交流区反病毒/反流氓软件论坛 开机后不停的出现瑞星注册列表,请各位帮帮我!

1   1  /  1  页   跳转

开机后不停的出现瑞星注册列表,请各位帮帮我!

开机后不停的出现瑞星注册列表,请各位帮帮我!

不知道怎么搞的,前段时间出现这样的情况,打开IE浏览器,就自动出现:www.7939.com.cn的网站.而且也不能进行更改.估计是流氓网站,后来用了黄山修复不管用,又用的超级兔子,清理后就没问题了,但是每次开机都要重新用免子修理一遍,不然就又会自出现www.7b.com的网站.而且现在每次开机都会不停的出现瑞星注册列表,并且变换的速度很快,根本点不了任何键.上一会网还会出现系统自动关机的倒计时对话框.出现的瑞星注册列表如下显示:
注册表:HKEY_CURRENT_USER\SOFTWARE\MICROSOFT\
发现:修改START PAGE值为HTTP://7B.COM.CN
进程名称:C:\WINDOWS\EXPLORER.EXE
同意修改          拒绝修改

我又下载了hijackthis进行扫描,扫描后的结果如下,请各位高手教教我该怎么做,谢谢各位了!
最后编辑2006-09-07 22:58:16
分享到:
gototop
 

Logfile of HijackThis v1.99.1
Scan saved at 15:59:29, on 2006-9-7
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
D:\Program Files\Rising\Rav\CCenter.exe
C:\WINDOWS\System32\svchost.exe
D:\Program Files\Rising\Rav\Ravmond.exe
d:\program files\rising\rfw\rfwsrv.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\SoftUpdate.exe
D:\Program Files\Rising\Rav\RavStub.exe
d:\program files\rising\rfw\RfwMain.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
F:\Program Files\淘宝网\淘宝旺旺\WangWang.EXE
C:\Program Files\VIA\RAID\raid_tool.exe
C:\WINDOWS\RTHDCPL.EXE
C:\WINDOWS\VM305_STI.EXE
D:\Program Files\Rising\Rav\RavTask.exe
D:\Program Files\Rising\Rav\Ravmon.exe
C:\WINDOWS\system32\ctfmon.exe
F:\Program Files\Super Rabbit\MagicSet\SRIECLI.EXE
D:\Program Files\Rising\Rav\RsAgent.exe
C:\WINDOWS\msagent\AgentSvr.exe
D:\Program Files\Rising\Rav\Rav.exe
d:\program files\rising\rfw\RfwCfg.exe
C:\Program Files\Internet Explorer\iexplore.exe
F:\HijackThis.exe

O2 - BHO: (no name) - {E730189A-9973-4121-B046-AD1C161EC3AF} - C:\WINDOWS\system32\37211.dll
O3 - Toolbar: BitCometBar - {3F1ABCDB-A875-46c1-8345-B72A4567E486} - F:\BT\BitComet\BitCometBar\BitCometBar0.2.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll (file missing)
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [RfwMain] "D:\Program Files\Rising\Rfw\rfwmain.exe" -Startup
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe"  -osboot
O4 - HKLM\..\Run: [WangWang] "F:\Program Files\淘宝网\淘宝旺旺\WangWang.EXE"
O4 - HKLM\..\Run: [Messenger.exe] C:\Program Files\Tencent\QQ\Messenger.exe
O4 - HKLM\..\Run: [RaidTool] C:\Program Files\VIA\RAID\raid_tool.exe
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE
O4 - HKLM\..\Run: [BigDog305] C:\WINDOWS\VM305_STI.EXE VIMICRO USB PC Camera (ZC0305)
O4 - HKLM\..\Run: [StormCodec_Helper] "F:\暴风影音\Storm Codec\StormSet.exe" /S /opti
O4 - HKLM\..\Run: [realplayer.exe] C:\Program Files\Tencent\QQ\Messenger.exe
O4 - HKLM\..\Run: [WebThunder] F:\WEB迅雷\WebThunder.exe
O4 - HKLM\..\Run: [RavTask] "D:\Program Files\Rising\Rav\RavTask.exe" -system
O4 - HKLM\..\Run: [Messager.exe] C:\Program Files\Tencent\QQ\Messenger.exe
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [RavScanBD] "D:\Program Files\Rising\Rav\ScanBD.exe" /INST
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [Messenger.exe] C:\Program Files\Tencent\QQ\Messenger.exe
O4 - HKCU\..\Run: [realplayer.exe] C:\Program Files\Tencent\QQ\Messenger.exe
O4 - HKCU\..\Run: [Messager.exe] C:\Program Files\Tencent\QQ\Messenger.exe
O4 - HKCU\..\Run: [Super Rabbit IEPro] F:\Program Files\Super Rabbit\MagicSet\SRIECLI.EXE /LOAD
O4 - Startup: 腾讯qq.lnk = F:\QQ\QQ.exe
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O8 - Extra context menu item: Google 搜索(&G) - res://C:\Program Files\Google\GoogleToolbar1.dll/cmsearch.html
O8 - Extra context menu item: 上传到QQ网络硬盘 - F:\QQ\AddToNetDisk.htm
O8 - Extra context menu item: 使用网际快车下载 - C:\Program Files\绿色软件\网际快车(FlashGet) v1.65 美化特别版\jc_link.htm
O8 - Extra context menu item: 使用网际快车下载全部链接 - C:\Program Files\绿色软件\网际快车(FlashGet) v1.65 美化特别版\jc_all.htm
O8 - Extra context menu item: 导出到 Microsoft Office Excel(&X) - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: 添加到QQ自定义面板 - F:\QQ\AddPanel.htm
O8 - Extra context menu item: 添加到QQ表情 - F:\QQ\AddEmotion.htm
O8 - Extra context menu item: 用QQ彩信发送该图片 - F:\QQ\SendMMS.htm
O9 - Extra button: 启动Web迅雷 - {962EFB8E-2683-42d4-AC74-AAA4C759B9C6} - http://my.xunlei.com (file missing)
O9 - Extra 'Tools' menuitem: 启动Web迅雷 - {962EFB8E-2683-42d4-AC74-AAA4C759B9C6} - http://my.xunlei.com (file missing)
O9 - Extra button: QQ - {c95fe080-8f5d-11d2-a20b-00aa003c157b} - F:\QQ\QQ.EXE
O9 - Extra 'Tools' menuitem: 腾讯QQ - {c95fe080-8f5d-11d2-a20b-00aa003c157b} - F:\QQ\QQ.EXE
O9 - Extra button: (no name) - {DEDEB80D-FA35-45d9-9460-4983E5A8AFE6} - F:\QQ\QQIEHelper.dll (file missing)
O9 - Extra 'Tools' menuitem: QQ炫彩工具条设置 - {DEDEB80D-FA35-45d9-9460-4983E5A8AFE6} - F:\QQ\QQIEHelper.dll (file missing)
O14 - IERESET.INF: SEARCH_PAGE_URL=
O14 - IERESET.INF: START_PAGE_URL=
O16 - DPF: {2354A44B-3CEB-4829-9940-545B03103538} (PowerPlr Control) - http://221.232.161.18/enshi/plugin/PowerPlr.ocx
O16 - DPF: {87CCFDB0-C4BE-4BC2-A78C-9EAA7CF96667} - http://ps.itv.mop.com/dn/files/vodupdate_1.0.0.10_20080809.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{CFA8E0D4-E9BC-4425-A452-3F22C02C800C}: NameServer = 202.103.44.150 202.103.24.68
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: Rising Proxy  Service (RfwProxySrv) - Beijing Rising Technology Co., Ltd. - d:\program files\rising\rfw\rfwproxy.exe
O23 - Service: Rising Personal Firewall Service (RfwService) - Beijing Rising Technology Co., Ltd. - d:\program files\rising\rfw\rfwsrv.exe
O23 - Service: Rising Process Communication Center (RsCCenter) - Beijing Rising Technology Co., Ltd. - D:\Program Files\Rising\Rav\CCenter.exe
O23 - Service: RsRavMon Service (RsRavMon) - Beijing Rising Technology Co., Ltd. - D:\Program Files\Rising\Rav\Ravmond.exe
O23 - Service: Update Service For Windows (SoftUpdate) - Unknown owner - C:\WINDOWS\SoftUpdate.exe

gototop
 

请各位高手帮帮我!!!
gototop
 

请各位高手帮帮我!!!



gototop
 

楼主申请两个用户名

这贴子好熟悉!今天好像回过贴
gototop
 

没有,我今天只发这一个帖子,可能是最近出现这样情况的太多了。
gototop
 

控制面板--管理工具--服务--查找--Update Service For Windows --启动类型--设置为已禁止--服务类型--设置为停止


运行Hijackthis,把下面的选中打上钩,修复
O2 - BHO: (no name) - {E730189A-9973-4121-B046-AD1C161EC3AF} - C:\WINDOWS\system32\37211.dll
O4 - HKCU\..\Run: [Messenger.exe] C:\Program Files\Tencent\QQ\Messenger.exe
O4 - HKCU\..\Run: [realplayer.exe] C:\Program Files\Tencent\QQ\Messenger.exe
O4 - HKCU\..\Run: [Messager.exe] C:\Program Files\Tencent\QQ\Messenger.exe
O4 - HKLM\..\Run: [realplayer.exe] C:\Program Files\Tencent\QQ\Messenger.exe
O4 - HKCU\..\Run: [Messager.exe] C:\Program Files\Tencent\QQ\Messenger.exe
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O23 - Service: Update Service For Windows (SoftUpdate) - Unknown owner - C:\WINDOWS\SoftUpdate.exe

删除:
C:\WINDOWS\SoftUpdate.exe
C:\Program Files\Tencent\QQ\Messenger.exe


修复后请重新扫描上来
gototop
 
1   1  /  1  页   跳转
页面顶部
Powered by Discuz!NT