菜鸟求助：IE自动弹出广告窗口 - 瑞星卡卡安全论坛bbs.ikaka.com

瑞星卡卡安全论坛技术交流区 反病毒/反流氓软件论坛菜鸟求助：IE自动弹出广告窗口

	瑞星“1+2”全新解决方案巡展在广州画上圆满句号		叶院长揭秘：瑞星如何运用AI技术革新网络安全		俄乌冲突加剧网络攻击风险白俄罗斯政府遭APT攻击		瑞星ESM防病毒系统助力矿业大学筑牢网络安全防线
	实力拉满瑞星第五十次通过VB100测评		携手老友，拥抱新精彩 —— 新论坛新活动，感谢你的陪伴		护航司法，瑞星助力山西省高院构建安全防线		人工智能在网络安全领域的风险和机遇

1

1 / 1 页

跳转页

菜鸟求助：IE自动弹出广告窗口

尖头叉子初生襁褓狮帖子:3 注册: 2006-11-11 来自:	发表于： 2006-11-12 23:04 \| 只看楼主短消息资料字号：小中大 1楼菜鸟求助：IE自动弹出广告窗口菜鸟求助：IE自动弹出广告窗口（弹出HTTP:\\），本人另建了一个用户，但IE还是自动弹出广告窗口！为此特别的烦恼，求助各位高手，谢谢。日记如下： Logfile of HijackThis v1.99.1 Scan saved at 22:50:32, on 2006-11-12 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\Ati2evxx.exe C:\WINDOWS\system32\svchost.exe D:\Program Files\Rising\Rav\CCenter.exe C:\WINDOWS\System32\svchost.exe D:\Program Files\Rising\Rav\Ravmond.exe d:\program files\rising\rfw\rfwsrv.exe C:\WINDOWS\system32\spoolsv.exe C:\Program Files\Antiy Labs\Alive\AliveCenter.exe D:\Program Files\Rising\Rav\RavStub.exe C:\WINDOWS\system32\drivers\CDAC11BA.EXE C:\WINDOWS\system32\DRIVERS\CDANTSRV.EXE C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE C:\WINDOWS\system32\Ati2evxx.exe C:\WINDOWS\Explorer.EXE d:\program files\rising\rfw\RfwMain.exe C:\Program Files\DU Meter\DUMeter.exe C:\WINDOWS\VM_STI.EXE D:\Program Files\Rising\Rav\RavTask.exe D:\Program Files\DAEMON Tools\daemon.exe C:\WINDOWS\system32\ctfmon.exe D:\Program Files\Rising\Rav\Ravmon.exe C:\WINDOWS\system32\svchost.exe D:\Program Files\TTPlayer\TTPlayer.exe C:\Program Files\Internet Explorer\iexplore.exe C:\WINDOWS\system32\NOTEPAD.EXE F:\ha_hijackthis_1991\HijackThis.exe O3 - Toolbar: 卡卡上网安全助手 - {DB9ECD4F-FB8F-4311-B3CE-90B976C2707C} - C:\WINDOWS\system32\KakaTool.dll O4 - HKLM\..\Run: [DU Meter] C:\Program Files\DU Meter\DUMeter.exe O4 - HKLM\..\Run: [BigDogPath] C:\WINDOWS\VM_STI.EXE USB PC Camera 301P O4 - HKLM\..\Run: [RavTask] "D:\Program Files\Rising\Rav\RavTask.exe" -system O4 - HKLM\..\Run: [RfwMain] "D:\Program Files\Rising\Rfw\rfwmain.exe" -Startup O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k O4 - HKLM\..\Run: [DAEMON Tools] "d:\Program Files\DAEMON Tools\daemon.exe" -lang 1033 O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\CTFMON.EXE O4 - HKCU\..\Run: [bgswitch] C:\WINDOWS\system32\bgswitch.exe O4 - Global Startup: AutoCAD 启动加速器.lnk = C:\Program Files\Common Files\Autodesk Shared\acstart16.exe O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Restrictions present O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions present O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm (file missing) O9 - Extra 'Tools' menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm (file missing) O9 - Extra button: QQ - {c95fe080-8f5d-11d2-a20b-00aa003c157b} - D:\Program Files\Tencent\qq\QQ.EXE O9 - Extra 'Tools' menuitem: 腾讯QQ - {c95fe080-8f5d-11d2-a20b-00aa003c157b} - D:\Program Files\Tencent\qq\QQ.EXE O9 - Extra button: 访问瑞星网站 - {FF2DE7A6-ECB1-4CBC-9C0E-D92A9E66E444} - http://www.rising.com.cn (file missing) O9 - Extra button: 访问卡卡社区 - {FF2DE7A6-ECB1-4CBC-9C0E-D92A9E66E445} - http://www.ikaka.com (file missing) O10 - Unknown file in Winsock LSP: c:\windows\system32\aelupsvc32.dll O10 - Unknown file in Winsock LSP: c:\windows\system32\aelupsvc32.dll O16 - DPF: {C661F36D-DF85-4EF4-83C7-E107B83D04B1} (WebActivater Control) - http://dl_dir.qq.com/3dshow/3DShowVM.cab O16 - DPF: {F281A59C-7B65-11D3-8617-0010830243BD} (AcPreview 控件) - file://D:\Program Files\AutoCAD 2002\AcPreview.ocx O17 - HKLM\System\CCS\Services\Tcpip\..\{23789EE3-1B92-4281-825D-E106D423A666}: NameServer = 202.103.224.68 O17 - HKLM\System\CS1\Services\Tcpip\..\{23789EE3-1B92-4281-825D-E106D423A666}: NameServer = 202.103.224.68 O17 - HKLM\System\CS2\Services\Tcpip\..\{23789EE3-1B92-4281-825D-E106D423A666}: NameServer = 202.103.224.68 O20 - Winlogon Notify: WBSrv - D:\WINDOW~1\wbsrv.dll (file missing) O23 - Service: Antiy live update (Alive Auto-Update Service) - Unknown owner - C:\Program Files\Antiy Labs\Alive\AliveCenter.exe O23 - Service: Ati HotKey Poller - Unknown owner - C:\WINDOWS\system32\Ati2evxx.exe O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe O23 - Service: Autodesk Licensing Service - Autodesk - C:\Program Files\Common Files\Autodesk Shared\Service\AdskScSrv.exe O23 - Service: C-DillaCdaC11BA - Macrovision - C:\WINDOWS\system32\drivers\CDAC11BA.EXE O23 - Service: C-DillaSrv - C-Dilla Ltd - C:\WINDOWS\system32\DRIVERS\CDANTSRV.EXE O23 - Service: Macromedia Licensing Service - Unknown owner - C:\Program Files\Common Files\Macromedia Shared\Service\Macromedia Licensing.exe O23 - Service: Rising Proxy Service (RfwProxySrv) - Beijing Rising Technology Co., Ltd. - d:\program files\rising\rfw\rfwproxy.exe O23 - Service: Rising Personal Firewall Service (RfwService) - Beijing Rising Technology Co., Ltd. - d:\program files\rising\rfw\rfwsrv.exe O23 - Service: Rising Process Communication Center (RsCCenter) - Beijing Rising Technology Co., Ltd. - D:\Program Files\Rising\Rav\CCenter.exe O23 - Service: Rising RealTime Monitor (RsRavMon) - Beijing Rising Technology Co., Ltd. - D:\Program Files\Rising\Rav\Ravmond.exe 进程如下： Process list saved on 22:52:47, on 2006-11-12 Platform: Windows XP SP2 (WinNT 5.01.2600) [pid] [full path to filename] [file version] [company name] 700 C:\WINDOWS\System32\smss.exe 5.1.2600.2180 Microsoft Corporation 1268 C:\WINDOWS\system32\winlogon.exe 5.1.2600.2180 Microsoft Corporation 1412 C:\WINDOWS\system32\services.exe 5.1.2600.2180 Microsoft Corporation 1432 C:\WINDOWS\system32\lsass.exe 5.1.2600.2180 Microsoft Corporation 1648 C:\WINDOWS\system32\Ati2evxx.exe 6.14.10.4103 1660 C:\WINDOWS\system32\svchost.exe 5.1.2600.2180 Microsoft Corporation 1840 D:\Program Files\Rising\Rav\CCenter.exe 18.0.0.3 Beijing Rising Technology Co., Ltd. 1884 C:\WINDOWS\System32\svchost.exe 5.1.2600.2180 Microsoft Corporation 240 D:\Program Files\Rising\Rav\Ravmond.exe 18.0.1.47 Beijing Rising Technology Co., Ltd. 456 d:\program files\rising\rfw\rfwsrv.exe 4.0.0.33 Beijing Rising Technology Co., Ltd. 652 C:\WINDOWS\system32\spoolsv.exe 5.1.2600.2696 Microsoft Corporation 808 C:\Program Files\Antiy Labs\Alive\AliveCenter.exe 1.0.0.1 864 D:\Program Files\Rising\Rav\RavStub.exe 18.0.0.16 Beijing Rising Technology Co., Ltd. 1212 C:\WINDOWS\system32\drivers\CDAC11BA.EXE 4.20.20.0 Macrovision 1308 C:\WINDOWS\system32\DRIVERS\CDANTSRV.EXE 3.24.10.0 C-Dilla Ltd 1332 C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe 2.0.-14809.42 Microsoft Corporation 732 C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE 7.0.9466.0 Microsoft Corporation 1484 C:\WINDOWS\system32\Ati2evxx.exe 6.14.10.4103 1632 C:\WINDOWS\Explorer.EXE 6.0.2900.2649 Microsoft Corporation 1500 d:\program files\rising\rfw\RfwMain.exe 4.0.0.52 Beijing Rising Technology Co., Ltd. 2728 C:\Program Files\DU Meter\DUMeter.exe 3.0.7.192 Hagel Technologies 2744 C:\WINDOWS\VM_STI.EXE 4.2.610.4 VM. 2752 D:\Program Files\Rising\Rav\RavTask.exe 18.0.0.22 Beijing Rising Technology Co., Ltd. 2784 D:\Program Files\DAEMON Tools\daemon.exe 4.0.0.0 DT Soft Ltd. 2792 C:\WINDOWS\system32\ctfmon.exe 5.1.2600.2180 Microsoft Corporation 2908 D:\Program Files\Rising\Rav\Ravmon.exe 18.0.1.39 Beijing Rising Technology Co., Ltd. 3364 C:\WINDOWS\system32\svchost.exe 5.1.2600.2180 Microsoft Corporation 604 D:\Program Files\TTPlayer\TTPlayer.exe 4.6.8.0 Alen Soft 2440 C:\Program Files\Internet Explorer\iexplore.exe 6.0.2900.2180 Microsoft Corporation 4084 C:\WINDOWS\system32\NOTEPAD.EXE 5.1.2600.2180 Microsoft Corporation 516 C:\WINDOWS\system32\NOTEPAD.EXE 5.1.2600.2180 Microsoft Corporation 340 F:\ha_hijackthis_1991\HijackThis.exe 1.99.0.1 Soeperman Enterprises Ltd. 2006-11-13 08:14:33.043000000
尖头叉子初生襁褓狮帖子:3 注册: 2006-11-11 来自:	分享到：

尖头叉子初生襁褓狮帖子:3 注册: 2006-11-11 来自:	发表于： 2006-11-13 00:53 \| 只看楼主短消息资料字号：小中大 2楼请高手们看一下吧，帮帮忙，看看到底是哪一个进程在做怪，谢谢了
尖头叉子初生襁褓狮帖子:3 注册: 2006-11-11 来自:

尖头叉子初生襁褓狮帖子:3 注册: 2006-11-11 来自:	发表于： 2006-11-13 00:57 \| 只看楼主短消息资料字号：小中大 3楼启动列表日记： StartupList report, 2006-11-13, 上午 12:45:56 StartupList version: 1.52.2 Started from : F:\ha_hijackthis_1991\HijackThis.EXE Detected: Windows XP SP2 (WinNT 5.01.2600) Detected: Internet Explorer v6.00 SP2 (6.00.2900.2180) * Using default options ================================================== Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\Ati2evxx.exe C:\WINDOWS\system32\svchost.exe D:\Program Files\Rising\Rav\CCenter.exe C:\WINDOWS\System32\svchost.exe D:\Program Files\Rising\Rav\Ravmond.exe d:\program files\rising\rfw\rfwsrv.exe C:\WINDOWS\system32\Ati2evxx.exe C:\WINDOWS\Explorer.EXE C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\system32\drivers\CDAC11BA.EXE C:\WINDOWS\system32\DRIVERS\CDANTSRV.EXE C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE D:\Program Files\Rising\Rav\RavStub.exe d:\program files\rising\rfw\RfwMain.exe C:\Program Files\DU Meter\DUMeter.exe C:\WINDOWS\VM_STI.EXE D:\Program Files\Rising\Rav\RavTask.exe D:\Program Files\Rising\Rav\Ravmon.exe D:\Program Files\DAEMON Tools\daemon.exe C:\WINDOWS\system32\ctfmon.exe C:\Program Files\Internet Explorer\IEXPLORE.exe C:\WINDOWS\system32\conime.exe D:\Program Files\Spybot - Search & Destroy\SpybotSD.exe F:\ha_hijackthis_1991\HijackThis.exe -------------------------------------------------- Listing of startup folders: Shell folders Common Startup: [C:\Documents and Settings\All Users\「开始」菜单\程序\启动] AutoCAD 启动加速器.lnk = C:\Program Files\Common Files\Autodesk Shared\acstart16.exe -------------------------------------------------- Checking Windows NT UserInit: [HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon] UserInit = C:\WINDOWS\SYSTEM32\Userinit.exe, -------------------------------------------------- Autorun entries from Registry: HKLM\Software\Microsoft\Windows\CurrentVersion\Run DU Meter = C:\Program Files\DU Meter\DUMeter.exe BigDogPath = C:\WINDOWS\VM_STI.EXE USB PC Camera 301P RavTask = "D:\Program Files\Rising\Rav\RavTask.exe" -system RfwMain = "D:\Program Files\Rising\Rfw\rfwmain.exe" -Startup KernelFaultCheck = %systemroot%\system32\dumprep 0 -k DAEMON Tools = "d:\Program Files\DAEMON Tools\daemon.exe" -lang 1033 -------------------------------------------------- Autorun entries from Registry: HKCU\Software\Microsoft\Windows\CurrentVersion\Run ctfmon.exe = C:\WINDOWS\system32\ctfmon.exe bgswitch = C:\WINDOWS\system32\bgswitch.exe Super Rabbit Desktop Search = D:\超级兔子魔法设置\SRSearch.exe -------------------------------------------------- Autorun entries in Registry subkeys of: HKLM\Software\Microsoft\Windows\CurrentVersion\Run [OptionalComponents] No values found [RsAutorunsDisabled] VVSN = C:\Program Files\VVSN\VVSN.exe -------------------------------------------------- Shell & screensaver key from C:\WINDOWS\SYSTEM.INI: Shell=INI section not found SCRNSAVE.EXE=INI section not found drivers=INI section not found Shell & screensaver key from Registry: Shell=Explorer.exe SCRNSAVE.EXE=C:\WINDOWS\System32\logon.scr drivers=Registry value not found Policies Shell key: HKCU\..\Policies: Shell=Registry value not found HKLM\..\Policies: Shell=Registry value not found -------------------------------------------------- Enumerating Browser Helper Objects: (no name) - D:\PROGRA~1\SPYBOT~1\SDHelper.dll - {53707962-6F74-2D53-2644-206D7942484F} -------------------------------------------------- Enumerating Download Program Files: [WebActivater Control] InProcServer32 = C:\WINDOWS\system32\3DShowVM.ocx CODEBASE = http://dl_dir.qq.com/3dshow/3DShowVM.cab [Shockwave Flash Object] InProcServer32 = C:\WINDOWS\System32\macromed\flash\Flash9.ocx CODEBASE = http://fpdownload.macromedia.com/pub/shockwave/cabs/flash/swflash.cab [AcPreview 控件] InProcServer32 = C:\WINDOWS\DOWNLO~1\ACPREV~1.OCX CODEBASE = file://D:\Program Files\AutoCAD 2002\AcPreview.ocx -------------------------------------------------- Enumerating Winsock LSP files: Protocol #1: C:\WINDOWS\system32\aelupsvc32.dll Protocol #21: C:\WINDOWS\system32\aelupsvc32.dll -------------------------------------------------- Enumerating Windows NT logon/logoff scripts: No scripts set to run Windows NT checkdisk command: BootExecute = autocheck autochk * Windows NT 'Wininit.ini': PendingFileRenameOperations: D:\Config.Msi\35bb4.rbf\|\|\|s -------------------------------------------------- Enumerating ShellServiceObjectDelayLoad items: PostBootReminder: C:\WINDOWS\system32\SHELL32.dll CDBurn: C:\WINDOWS\system32\SHELL32.dll WebCheck: C:\WINDOWS\system32\webcheck.dll SysTray: C:\WINDOWS\system32\stobject.dll -------------------------------------------------- End of report, 5,658 bytes Report generated in 0.047 seconds Command line options: /verbose - to add additional info on each section /complete - to include empty sections and unsuspicious data /full - to include several rarely-important sections /force9x - to include Win9x-only startups even if running on WinNT /forcent - to include WinNT-only startups even if running on Win9x /forceall - to include all Win9x and WinNT startups, regardless of platform /history - to list version history only
尖头叉子初生襁褓狮帖子:3 注册: 2006-11-11 来自:

红夜鬼1 横据古稀狮帖子:8602 注册: 2006-10-18 来自:	发表于： 2006-11-13 08:14 \| 短消息资料字号：小中大 4楼运行Hijackthis，把下面的选中打上钩，修复 O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Restrictions present O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions present O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm (file missing) O9 - Extra 'Tools' menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm (file missing) O10 - Unknown file in Winsock LSP: c:\windows\system32\aelupsvc32.dll O10 - Unknown file in Winsock LSP: c:\windows\system32\aelupsvc32.dll O20 - Winlogon Notify: WBSrv - D:\WINDOW~1\wbsrv.dll (file missing) 请下载LSPFix和WinsockXPFix这两个软件，小软件下载 http://free5.ys168.com/?ufwihgu168 　　重新启动电脑, 进入安全模式。运行LSPFix.exe，删除： aelupsvc32.dll 如果无法上网，请运行WinsockXPFix，让它修复一下。使用360安全卫士清除插件 .360下载地址: http://www.xdowns.com/soft/8/9/2006/Soft_31554.html 使用后删除360安全卫士
红夜鬼1 横据古稀狮帖子:8602 注册: 2006-10-18 来自:

<<上一主题|下一主题>>

1

1 / 1 页

跳转页

页面顶部

Powered by Discuz!NT