瑞星卡卡安全论坛技术交流区反病毒/反流氓软件论坛 ie被劫持,不断弹出窗口,但是无法打开ie,只能用遨游

1   1  /  1  页   跳转

ie被劫持,不断弹出窗口,但是无法打开ie,只能用遨游

ie被劫持,不断弹出窗口,但是无法打开ie,只能用遨游

以下是HijackThis扫描信息,请高手帮忙!谢谢啦!

Logfile of HijackThis v1.99.1
Scan saved at 14:23:32, on 2006/10/06
Platform: Windows 2000 SP4 (WinNT 5.00.2195)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINNT\System32\smss.exe
C:\WINNT\system32\winlogon.exe
C:\WINNT\system32\services.exe
C:\WINNT\system32\lsass.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\system32\spoolsv.exe
C:\WINNT\System32\svchost.exe
C:\WINNT\System32\svchost.exe
C:\Program Files\Network Associates\Common Framework\FrameworkService.exe
C:\Program Files\Network Associates\VirusScan\Mcshield.exe
C:\Program Files\Network Associates\VirusScan\VsTskMgr.exe
C:\WINNT\System32\svchost.exe
C:\WINNT\system32\regsvc.exe
C:\WINNT\system32\MSTask.exe
C:\WINNT\system32\stisvc.exe
C:\Program Files\SystemInspect\SVCHAST.exe
C:\WINNT\System32\WBEM\WinMgmt.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\Explorer.EXE
c:\winnt\system32\wbem\winlogon.exe
C:\WINNT\System32\hkcmd.exe
C:\WINNT\System32\igfxpers.exe
C:\WINNT\SOUNDMAN.EXE
C:\Program Files\Network Associates\VirusScan\SHSTAT.EXE
C:\Program Files\Network Associates\Common Framework\UpdaterUI.exe
C:\Program Files\Common Files\Network Associates\TalkBack\TBMon.exe
C:\WINNT\system32\ucind.exe
C:\WINNT\system32\ctfmon.exe
C:\Program Files\ADSL拨号王\HNMainUI.exe
D:\Tencent\qq\QQ.exe
D:\Tencent\qq\TIMPlatform.exe
D:\Tencent\qq\QQ.exe
D:\Tencent\qq\QQ.exe
C:\WINNT\system32\rundll32.exe
C:\WINNT\system32\rundll32.exe
C:\WINNT\regedit.exe
D:\网络工具\MyIE2Final050824\MyIE.exe
C:\WINNT\system32\RMAServer.exe
D:\系统工具\ha_hijackthis_1991\HijackThis.exe

O2 - BHO: IEMonitor Class - {08A312BB-5409-49FC-9347-54BB7D069AC6} - C:\Program Files\DeskAdTop\deskipn.dll
O2 - BHO: netup - {0A44CDEC-87D0-4D4D-BF97-DE9AFB9B104A} - C:\WINNT\system32\netiup.dll
O2 - BHO: (no name) - {2A4956FD-BE98-4104-ABEB-97029B3175BB} - C:\WINNT\system32\sys32dev.dll (file missing)
O2 - BHO: IeCatch5 Class - {2F364306-AA45-47B5-9F9D-39A8B94E7EF7} - C:\PROGRA~1\FLASHGET\jccatch.dll
O2 - BHO: SYM - {36BF6929-DCBC-4CCD-A620-C5E3BBA77B95} - C:\WINNT\system32\usersrd.dll
O2 - BHO: RMAHelper Class - {B4657940-1439-4CF3-A910-C687E388D9D5} - C:\WINNT\system32\RMA\RMAHelper\svchost.dll
O2 - BHO: BHelper Class - {F2E37336-BFDB-409B-8D0E-6F013C438B20} - C:\WINNT\system32\23eo71f0.dll
O2 - BHO: (no name) - {FFFFFFFF-74CC-4B7C-B5F1-45913F368388} - C:\PROGRA~1\SYSTEM~1\SYSTEM~1.DLL
O3 - Toolbar: @msdxmLC.dll,-1@2052,电台(&R) - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINNT\System32\msdxm.ocx
O3 - Toolbar: FlashGet Bar - {E0E899AB-F487-11D5-8D29-0050BA6940E3} - C:\PROGRA~1\FLASHGET\fgiebar.dll
O4 - HKLM\..\Run: [Synchronization Manager] mobsync.exe /logon
O4 - HKLM\..\Run: [igfxtray] C:\WINNT\System32\igfxtray.exe
O4 - HKLM\..\Run: [igfxhkcmd] C:\WINNT\System32\hkcmd.exe
O4 - HKLM\..\Run: [igfxpers] C:\WINNT\System32\igfxpers.exe
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [StormCodec_Helper] "C:\Program Files\Ringz Studio\Storm Codec\StormSet.exe" /S /opti
O4 - HKLM\..\Run: [ShStatEXE] "C:\Program Files\Network Associates\VirusScan\SHSTAT.EXE" /STANDALONE
O4 - HKLM\..\Run: [McAfeeUpdaterUI] "C:\Program Files\Network Associates\Common Framework\UpdaterUI.exe" /StartedFromRunKey
O4 - HKLM\..\Run: [Network Associates Error Reporting Service] "C:\Program Files\Common Files\Network Associates\TalkBack\TBMon.exe"
O4 - HKLM\..\Run: [NMGameX_AutoRun] C:\WINNT\system32\Rundll32.exe NMGameX.dll,LiveProcess /aa
O4 - HKLM\..\Run: [IntelFile] C:\WINNT\system32\IntelFile.exe
O4 - HKLM\..\Run: [LoadEWXD] C:\WINNT\system32\ucind.exe
O4 - HKLM\..\Run: [RMA] C:\WINNT\system32\RMAServer.exe
O4 - HKCU\..\Run: [ctfmon.exe] ctfmon.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O4 - Global Startup: IE-Bar.lnk = C:\Program Files\Common Files\IE-Bar\iebar.exe
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O8 - Extra context menu item: &_找本网页音视频链接_ - C:\Program Files\Riptide\Plugin\Monitor.htm
O8 - Extra context menu item: 使用网际快车下载 - C:\Program Files\FlashGet\jc_link.htm
O8 - Extra context menu item: 使用网际快车下载全部链接 - C:\Program Files\FlashGet\jc_all.htm
O8 - Extra context menu item: 导出到 Microsoft Excel(&x) - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O9 - Extra button: 新浪UC - {2253922F-1B26-4C74-8B57-E3AEE748DBB8} - C:\Program Files\sina\UC\uc.exe
O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINNT\web\related.htm
O9 - Extra 'Tools' menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINNT\web\related.htm
O9 - Extra button: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\PROGRA~1\FLASHGET\flashget.exe
O9 - Extra 'Tools' menuitem: &FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\PROGRA~1\FLASHGET\flashget.exe
O9 - Extra button: 时尚精品,体验快感 - {6E5EECAF-8879-4a75-8A88-B44B6382A763} - http://adfarm.mediaplex.com/ad/ck/4080-22910-9640-344?cn=chaoyue;rgbutton_120x60;hp&mpro=http://www.ebay.com.cn (file missing) (HKCU)
O9 - Extra 'Tools' menuitem: 易趣时尚购物 - {6E5EECAF-8879-4a75-8A88-B44B6382A763} - http://adfarm.mediaplex.com/ad/ck/4080-22910-9640-344?cn=chaoyue;rgbutton_120x60;hp&mpro=http://www.ebay.com.cn (file missing) (HKCU)
O16 - DPF: {3D8F74EE-8692-4F8F-B8D2-7522E732519E} (WebActivater Control) - http://game.qq.com/QQGame2.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{44647DA7-3A23-46F6-B83F-5D5B56CD2A0A}: NameServer = 211.98.4.1 211.98.2.4
O20 - Winlogon Notify: igfxcui - C:\WINNT\SYSTEM32\igfxdev.dll
O21 - SSODL: DelayRun - {5A6F2F95-3191-433B-8533-EB0B596A7BAC} - C:\WINNT\system32\23ed71f0.dll
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Logical Disk Manager Administrative Service (dmadmin) - VERITAS Software Corp. - C:\WINNT\System32\dmadmin.exe
O23 - Service: McAfee Framework 服务 (McAfeeFramework) - Network Associates, Inc. - C:\Program Files\Network Associates\Common Framework\FrameworkService.exe
O23 - Service: Network Associates McShield (McShield) - Network Associates, Inc. - C:\Program Files\Network Associates\VirusScan\Mcshield.exe
O23 - Service: Network Associates Task Manager (McTaskManager) - Network Associates, Inc. - C:\Program Files\Network Associates\VirusScan\VsTskMgr.exe
O23 - Service: SVCHOST (SystemInspect) - Unknown owner - C:\Program Files\SystemInspect\SVCHAST.exe

最后编辑2006-10-06 20:13:51
分享到:
gototop
 

双击ie图标时,提示如下:

附件附件:

下载次数:345
文件类型:image/pjpeg
文件大小:
上传时间:2006-10-6 17:40:56
描述:



gototop
 

而且不定时弹出以下IE窗口:
http://ad.mokead.com/goopen.asp?timeid=5
http://cg.9e3.com/register3.html
http://www.9istyle.com/pop/imop.html
http://free.bbvod.net/index.html?vodadid=aid0001&vodcoopid=a0866058c582468aa48472f187df76f2
自己无法使用ie,TNND自己倒是能打开这些垃圾窗口,搞不懂!!!,请高手帮忙!谢谢
gototop
 

请下载 System Repair Engineer,使用“智能扫描”,按下“扫描”按钮进行扫描,扫描完成后按下“保存报告”按钮保存报告日志文件(SREng.LOG),把保存的报告日志文件内容复制-粘贴上来
下载网址
http://www.kztechs.com/sreng/sreng2.zip
http://forum.ikaka.com/topic.asp?board=67&artid=5188931
日志一次粘不完,分次粘完,请不要修改。
gototop
 
1   1  /  1  页   跳转
页面顶部
Powered by Discuz!NT