这是HijackThis_815扫描结果
ijackThis_815汉化版扫描日志 V1.99.1
保存于      10:34:02, 日期 2005-11-5
操作系统：  Windows XP SP1 (WinNT 5.01.2600)
浏览器：    Internet Explorer v6.00 SP1 (6.00.2800.1106)

当前运行的进程：         
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\PROGRAM FILES\RISING\RAV\Ravmond.exe
C:\Program Files\rising\Rfw\rfwsrv.exe
C:\PROGRAM FILES\RISING\RAV\RavStub.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\System32\ctfmon.exe
C:\WINDOWS\system32\spoolsv.exe
C:\PROGRA~1\RISING\RAV\RAVTIMER.EXE
C:\Program Files\rising\Rfw\RfwMain.exe
C:\WINDOWS\System32\nvsvc32.exe
C:\PROGRAM FILES\RISING\RAV\CCENTER.EXE
C:\WINDOWS\System32\svchost.exe
D:\新建文件夹\新建文件夹\qq\QQ.exe
D:\新建文件夹\新建文件夹\qq\TIMPlatform.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
D:\HijackThis1991汉化版\HijackThis1991zww.exe

R3 - URLSearchHook: 雅虎助手 - {406F94F0-504F-4a40-8DFD-58B0666ABEBD} - C:\PROGRA~1\Yahoo!\ASSIST~1\assist\yasbar.dll
O2 - BHO: yPhtb - {33BBE430-0E42-4f12-B075-8D21ACB10DCB} - C:\PROGRA~1\Yahoo!\ASSIST~1\assist\yphtb.dll
O2 - BHO: Anti Fish - {38928D50-8A48-44C2-945F-D2F23F771410} - C:\PROGRA~1\Yahoo!\ASSIST~1\Assist\yAngling.dll
O2 - BHO: 雅虎助手 - {406F94F0-504F-4a40-8DFD-58B0666ABEBD} - C:\PROGRA~1\Yahoo!\ASSIST~1\assist\yasbar.dll
O3 - IE工具栏增项: 电台(&R) - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O3 - IE工具栏增项: 雅虎助手 - {406F94F0-504F-4a40-8DFD-58B0666ABEBD} - C:\PROGRA~1\Yahoo!\ASSIST~1\assist\yasbar.dll
O4 - 启动项HKLM\\Run: [RavTimer] C:\PROGRA~1\RISING\RAV\RAVTIMER.EXE
O4 - 启动项HKLM\\Run: [UserFaultCheck] %systemroot%\system32\dumprep 0 -u
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\System32\ctfmon.exe
O8 - IE右键菜单中的新增项目: 添加到QQ自定义面板 - D:\新建文件夹\新建文件夹\qq\AddPanel.htm
O8 - IE右键菜单中的新增项目: 添加到QQ表情 - D:\新建文件夹\新建文件夹\qq\AddEmotion.htm
O8 - IE右键菜单中的新增项目: 用QQ彩信发送该图片 - D:\新建文件夹\新建文件夹\qq\SendMMS.htm
O9 - 浏览器额外的按钮: Yahoo 1G电邮 - {507F9113-CD77-4866-BA92-0E86DA3D0B97} - http://cn.mail.yahoo.com/promo/rd1 (file missing)
O9 - 浏览器额外的按钮: 上网助手 - {5D73EE86-05F1-49ed-B850-E423120EC338} - http://assistant.3721.com/index.htm?fb=Cns (file missing)
O10 - 未知的文件在 Winsock LSP: c:\windows\system32\cdnns.dll
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1129038294595
O16 - DPF: {8D9E0B29-563C-4226-86C1-5FF2AE77E1D2} (AxSubmitControl Class) - https://mybank.icbc.com.cn/icbc/perbank/AxSafeControls.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{DFAF9447-B2E3-41A8-8444-48AE5D3B12B5}: NameServer = 202.102.152.3
O23 - NT 服务: Distributed File System Services (Distfsv) - Unknown owner - C:\WINDOWS\System32\Distfsv.exe
O23 - NT 服务: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
O23 - NT 服务: Rising Personal Firewall Service (RfwService) - Beijing Rising Technology Corporation Limited - C:\Program Files\rising\Rfw\rfwsrv.exe
O23 - NT 服务: Rising Process Communication Center (RsCCenter) - rising - C:\PROGRAM FILES\RISING\RAV\CCENTER.EXE
O23 - NT 服务: RsRavMon Service (RsRavMon) - Beijing Rising Technology Co., Ltd. - C:\PROGRAM FILES\RISING\RAV\Ravmond.exe

发的文件是 卡吧斯及扫描结果 
具体症状。。。就我目前发现的来说  就是开机后不定时自己蹦网页  www.kk12.com就是其中一个
我用瑞星  查不出来  3721清理过一次  后来又出来了
实在没办法了啊  请高手指教

Scan Statistics
Total number of scanned objects 32622
Number of viruses found 4
Number of infected objects 58
Number of suspicious objects 0
Duration of the scan process 1425 sec

Infected Object Name Virus Name
C:\System Volume Information\_restore{D7CF3D9E-189B-4FD5-AB28-4C52C51EE0EE}\RP28\A0108786.dll  Infected: Trojan-Downloader.Win32.Agent.yo 

C:\System Volume Information\_restore{D7CF3D9E-189B-4FD5-AB28-4C52C51EE0EE}\RP28\A0108787.dll  Infected: Trojan-Downloader.Win32.Agent.yo 

C:\System Volume Information\_restore{D7CF3D9E-189B-4FD5-AB28-4C52C51EE0EE}\RP28\A0109786.dll  Infected: Trojan-Downloader.Win32.Agent.yo 

C:\System Volume Information\_restore{D7CF3D9E-189B-4FD5-AB28-4C52C51EE0EE}\RP28\A0109787.dll  Infected: Trojan-Downloader.Win32.Agent.yo 

C:\System Volume Information\_restore{D7CF3D9E-189B-4FD5-AB28-4C52C51EE0EE}\RP28\A0109799.dll  Infected: Trojan-Downloader.Win32.Agent.yo 

C:\System Volume Information\_restore{D7CF3D9E-189B-4FD5-AB28-4C52C51EE0EE}\RP28\A0109800.dll  Infected: Trojan-Downloader.Win32.Agent.yo 

C:\System Volume Information\_restore{D7CF3D9E-189B-4FD5-AB28-4C52C51EE0EE}\RP28\A0110117.dll  Infected: Trojan-Downloader.Win32.Agent.yo 

C:\System Volume Information\_restore{D7CF3D9E-189B-4FD5-AB28-4C52C51EE0EE}\RP28\A0109812.dll  Infected: Trojan-Downloader.Win32.Agent.yo 

C:\System Volume Information\_restore{D7CF3D9E-189B-4FD5-AB28-4C52C51EE0EE}\RP28\A0109813.dll  Infected: Trojan-Downloader.Win32.Agent.yo 

C:\System Volume Information\_restore{D7CF3D9E-189B-4FD5-AB28-4C52C51EE0EE}\RP28\A0110118.dll  Infected: Trojan-Downloader.Win32.Agent.yo 

C:\System Volume Information\_restore{D7CF3D9E-189B-4FD5-AB28-4C52C51EE0EE}\RP28\A0109862.dll  Infected: Trojan-Downloader.Win32.Agent.yo 

C:\System Volume Information\_restore{D7CF3D9E-189B-4FD5-AB28-4C52C51EE0EE}\RP28\A0109863.dll  Infected: Trojan-Downloader.Win32.Agent.yo 

C:\System Volume Information\_restore{D7CF3D9E-189B-4FD5-AB28-4C52C51EE0EE}\RP28\A0109879.dll  Infected: Trojan-Downloader.Win32.Agent.yo 

C:\System Volume Information\_restore{D7CF3D9E-189B-4FD5-AB28-4C52C51EE0EE}\RP28\A0109880.dll  Infected: Trojan-Downloader.Win32.Agent.yo 

C:\System Volume Information\_restore{D7CF3D9E-189B-4FD5-AB28-4C52C51EE0EE}\RP28\A0109892.dll  Infected: Trojan-Downloader.Win32.Agent.yo 

C:\System Volume Information\_restore{D7CF3D9E-189B-4FD5-AB28-4C52C51EE0EE}\RP28\A0109893.dll  Infected: Trojan-Downloader.Win32.Agent.yo 

C:\System Volume Information\_restore{D7CF3D9E-189B-4FD5-AB28-4C52C51EE0EE}\RP28\A0110041.dll  Infected: Trojan-Downloader.Win32.Agent.yo 

C:\System Volume Information\_restore{D7CF3D9E-189B-4FD5-AB28-4C52C51EE0EE}\RP28\A0110042.dll  Infected: Trojan-Downloader.Win32.Agent.yo 

C:\System Volume Information\_restore{D7CF3D9E-189B-4FD5-AB28-4C52C51EE0EE}\RP28\A0110057.dll  Infected: Trojan-Downloader.Win32.Agent.yo 

C:\System Volume Information\_restore{D7CF3D9E-189B-4FD5-AB28-4C52C51EE0EE}\RP28\A0110058.dll  Infected: Trojan-Downloader.Win32.Agent.yo 

C:\System Volume Information\_restore{D7CF3D9E-189B-4FD5-AB28-4C52C51EE0EE}\RP28\A0110069.dll  Infected: Trojan-Downloader.Win32.Agent.yo 

C:\System Volume Information\_restore{D7CF3D9E-189B-4FD5-AB28-4C52C51EE0EE}\RP28\A0110070.dll  Infected: Trojan-Downloader.Win32.Agent.yo 

C:\System Volume Information\_restore{D7CF3D9E-189B-4FD5-AB28-4C52C51EE0EE}\RP28\A0110089.dll  Infected: Trojan-Downloader.Win32.Agent.yo 

C:\System Volume Information\_restore{D7CF3D9E-189B-4FD5-AB28-4C52C51EE0EE}\RP28\A0110090.dll  Infected: Trojan-Downloader.Win32.Agent.yo 

C:\System Volume Information\_restore{D7CF3D9E-189B-4FD5-AB28-4C52C51EE0EE}\RP28\A0110138.dll  Infected: Trojan-Downloader.Win32.Agent.yo 

C:\System Volume Information\_restore{D7CF3D9E-189B-4FD5-AB28-4C52C51EE0EE}\RP28\A0110139.dll  Infected: Trojan-Downloader.Win32.Agent.yo 

C:\System Volume Information\_restore{D7CF3D9E-189B-4FD5-AB28-4C52C51EE0EE}\RP28\A0110156.dll  Infected: Trojan-Downloader.Win32.Agent.yo 

C:\System Volume Information\_restore{D7CF3D9E-189B-4FD5-AB28-4C52C51EE0EE}\RP28\A0110157.dll  Infected: Trojan-Downloader.Win32.Agent.yo 

C:\System Volume Information\_restore{D7CF3D9E-189B-4FD5-AB28-4C52C51EE0EE}\RP28\A0110172.dll  Infected: Trojan-Downloader.Win32.Agent.yo 

C:\System Volume Information\_restore{D7CF3D9E-189B-4FD5-AB28-4C52C51EE0EE}\RP28\A0110173.dll  Infected: Trojan-Downloader.Win32.Agent.yo 

C:\System Volume Information\_restore{D7CF3D9E-189B-4FD5-AB28-4C52C51EE0EE}\RP28\A0111174.dll  Infected: Trojan-Downloader.Win32.Agent.yo 

C:\System Volume Information\_restore{D7CF3D9E-189B-4FD5-AB28-4C52C51EE0EE}\RP28\A0111175.dll  Infected: Trojan-Downloader.Win32.Agent.yo 

C:\System Volume Information\_restore{D7CF3D9E-189B-4FD5-AB28-4C52C51EE0EE}\RP29\A0111182.dll  Infected: Trojan-Downloader.Win32.Agent.yo 

C:\System Volume Information\_restore{D7CF3D9E-189B-4FD5-AB28-4C52C51EE0EE}\RP29\A0111251.dll  Infected: Trojan-Downloader.Win32.Agent.yo 

C:\System Volume Information\_restore{D7CF3D9E-189B-4FD5-AB28-4C52C51EE0EE}\RP29\A0111252.dll  Infected: Trojan-Downloader.Win32.Agent.yo 

C:\System Volume Information\_restore{D7CF3D9E-189B-4FD5-AB28-4C52C51EE0EE}\RP29\A0111270.dll  Infected: Trojan-Downloader.Win32.Agent.yo 

C:\System Volume Information\_restore{D7CF3D9E-189B-4FD5-AB28-4C52C51EE0EE}\RP29\A0111271.dll  Infected: Trojan-Downloader.Win32.Agent.yo 

C:\System Volume Information\_restore{D7CF3D9E-189B-4FD5-AB28-4C52C51EE0EE}\RP29\A0111283.dll  Infected: Trojan-Downloader.Win32.Agent.yo 

C:\System Volume Information\_restore{D7CF3D9E-189B-4FD5-AB28-4C52C51EE0EE}\RP29\A0111284.dll  Infected: Trojan-Downloader.Win32.Agent.yo 

D:\System Volume Information\_restore{D7CF3D9E-189B-4FD5-AB28-4C52C51EE0EE}\RP15\A0085753.exe/stream/data1552/data.rar/Install/Setup.exe  Infected: not-a-virus:AdWare.Win32.Inot.a 

D:\System Volume Information\_restore{D7CF3D9E-189B-4FD5-AB28-4C52C51EE0EE}\RP15\A0085753.exe/stream/data1552/data.rar/Install/UIInfo.exe  Infected: Trojan-Downloader.Win32.Small.asu 

D:\System Volume Information\_restore{D7CF3D9E-189B-4FD5-AB28-4C52C51EE0EE}\RP15\A0085753.exe/stream/data1552/data.rar/Install/UpdaterMgr.exe  Infected: Trojan-Downloader.Win32.Small.asu 

D:\System Volume Information\_restore{D7CF3D9E-189B-4FD5-AB28-4C52C51EE0EE}\RP15\A0085753.exe/stream/data1552/data.rar  Infected: Trojan-Downloader.Win32.Small.asu 

D:\System Volume Information\_restore{D7CF3D9E-189B-4FD5-AB28-4C52C51EE0EE}\RP15\A0085753.exe/stream/data1552  Infected: Trojan-Downloader.Win32.Small.asu 

D:\System Volume Information\_restore{D7CF3D9E-189B-4FD5-AB28-4C52C51EE0EE}\RP15\A0085753.exe/stream  Infected: Trojan-Downloader.Win32.Small.asu 

D:\System Volume Information\_restore{D7CF3D9E-189B-4FD5-AB28-4C52C51EE0EE}\RP15\A0085753.exe  Infected: Trojan-Downloader.Win32.Small.asu 

D:\System Volume Information\_restore{D7CF3D9E-189B-4FD5-AB28-4C52C51EE0EE}\RP26\A0099723.exe/stream/data1552/data.rar/Install/Setup.exe  Infected: not-a-virus:AdWare.Win32.Inot.a 

D:\System Volume Information\_restore{D7CF3D9E-189B-4FD5-AB28-4C52C51EE0EE}\RP26\A0099723.exe/stream/data1552/data.rar/Install/UIInfo.exe  Infected: Trojan-Downloader.Win32.Small.asu 

D:\System Volume Information\_restore{D7CF3D9E-189B-4FD5-AB28-4C52C51EE0EE}\RP26\A0099723.exe/stream/data1552/data.rar/Install/UpdaterMgr.exe  Infected: Trojan-Downloader.Win32.Small.asu 

D:\System Volume Information\_restore{D7CF3D9E-189B-4FD5-AB28-4C52C51EE0EE}\RP26\A0099723.exe/stream/data1552/data.rar  Infected: Trojan-Downloader.Win32.Small.asu 

D:\System Volume Information\_restore{D7CF3D9E-189B-4FD5-AB28-4C52C51EE0EE}\RP26\A0099723.exe/stream/data1552  Infected: Trojan-Downloader.Win32.Small.asu 

D:\System Volume Information\_restore{D7CF3D9E-189B-4FD5-AB28-4C52C51EE0EE}\RP26\A0099723.exe/stream  Infected: Trojan-Downloader.Win32.Small.asu 

D:\System Volume Information\_restore{D7CF3D9E-189B-4FD5-AB28-4C52C51EE0EE}\RP26\A0099723.exe  Infected: Trojan-Downloader.Win32.Small.asu 

D:\HB_Hijackthis1991zww8152.exe/HijackThis1991ºº»¯°æ\Xautorun.exe/pk.exe  Infected: not-a-virus:RiskTool.Win32.PsKill.c 

D:\HB_Hijackthis1991zww8152.exe/HijackThis1991ºº»¯°æ\Xautorun.exe  Infected: not-a-virus:RiskTool.Win32.PsKill.c 

D:\HB_Hijackthis1991zww8152.exe  Infected: not-a-virus:RiskTool.Win32.PsKill.c 

D:\HijackThis1991汉化版\Xautorun.exe/pk.exe  Infected: not-a-virus:RiskTool.Win32.PsKill.c 

D:\HijackThis1991汉化版\Xautorun.exe  Infected: not-a-virus:RiskTool.Win32.PsKill.c 

Scan process completed.

在线等啊  急

什么还原啊  我选择以前的日期还原 好多时候说还原不了

3楼的怎么修复啊  能弄好自动弹的网页吗

楼上的方法不管用啊    那网页还是自己不定时的自己开




还有其他方法吗  能杀掉的

O10 - 未知的文件在 Winsock LSP: c:\windows\system32\cdnns.dll（LSPFix工具在天天泡泡网络E盘有，http://forum.ikaka.com/topic.asp?board=28&artid=6979213）
修复不了啊

谢谢,我去试下


不过 我想 这些毕竟都是些很被动的做法  能不能彻底清除掉安装在我机子的东西呢?
我也对网络安全很赶兴趣  只不过是刚刚接触..很想跟您学习
我想彻底去掉他    可能是我在找电影时中的吧  当时想找 死神来了  于是到处搜索  好象有个网站说点击广告后就能看了...
谢谢你 等下回来告诉你结果

忘记了件事  用什么杀毒啊  我这里只装了瑞星  可是什么也查不出来 除非在那网页出来时才提示杀毒...我用喀吧司机在线杀 每次都查出来...图片在我1楼有 

还有 瑞星杀毒有时删除  有时忽略  有什么区别和危害? 如果我想把瑞星选择忽略的删除掉 可以么? 怎么操作 有无危险?
谢谢

ba 把那IP加入绿色小伞的黑名单  瑞星再次杀毒后还出现那往沾

HijackThis_815汉化版扫描日志 V1.99.1
保存于      5:25:45, 日期 2005-11-7
操作系统：  Windows XP SP1 (WinNT 5.01.2600)
浏览器：    Internet Explorer v6.00 SP1 (6.00.2800.1106)

当前运行的进程：         
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\PROGRAM FILES\RISING\RAV\Ravmond.exe
C:\Program Files\rising\Rfw\rfwsrv.exe
C:\PROGRAM FILES\RISING\RAV\RavStub.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\System32\ctfmon.exe
C:\WINDOWS\system32\spoolsv.exe
C:\PROGRA~1\RISING\RAV\RAVTIMER.EXE
C:\PROGRA~1\RISING\RAV\RAVMON.EXE
C:\Program Files\rising\Rfw\RfwMain.exe
C:\WINDOWS\System32\nvsvc32.exe
D:\新建文件夹\新建文件夹\qq\QQ.exe
D:\新建文件夹\新建文件夹\qq\TIMPlatform.exe
C:\PROGRAM FILES\RISING\RAV\CCENTER.EXE
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Internet Explorer\iexplore.exe
D:\HijackThis1991汉化版\HijackThis1991zww.exe

R3 - URLSearchHook: (no name) - {406F94F0-504F-4a40-8DFD-58B0666ABEBD} - (no file)
O2 - BHO: yPhtb - {33BBE430-0E42-4f12-B075-8D21ACB10DCB} - C:\PROGRA~1\Yahoo!\ASSIST~1\assist\yphtb.dll
O2 - BHO: Anti Fish - {38928D50-8A48-44C2-945F-D2F23F771410} - C:\PROGRA~1\Yahoo!\ASSIST~1\Assist\yAngling.dll
O3 - IE工具栏增项: 电台(&R) - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O3 - IE工具栏增项: (no name) - {406F94F0-504F-4a40-8DFD-58B0666ABEBD} - (no file)
O4 - 启动项HKLM\\Run: [RavTimer] C:\PROGRA~1\RISING\RAV\RAVTIMER.EXE
O4 - 启动项HKLM\\Run: [UserFaultCheck] %systemroot%\system32\dumprep 0 -u
O4 - 启动项HKLM\\Run: [RavMon] C:\PROGRA~1\RISING\RAV\RAVMON.EXE -SYSTEM
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\System32\ctfmon.exe
O8 - IE右键菜单中的新增项目: 添加到QQ自定义面板 - D:\新建文件夹\新建文件夹\qq\AddPanel.htm
O8 - IE右键菜单中的新增项目: 添加到QQ表情 - D:\新建文件夹\新建文件夹\qq\AddEmotion.htm
O8 - IE右键菜单中的新增项目: 用QQ彩信发送该图片 - D:\新建文件夹\新建文件夹\qq\SendMMS.htm
O10 - 未知的文件在 Winsock LSP: c:\windows\system32\cdnns.dll
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1129038294595
O17 - HKLM\System\CCS\Services\Tcpip\..\{DFAF9447-B2E3-41A8-8444-48AE5D3B12B5}: NameServer = 202.102.152.3
O23 - NT 服务: Distributed File System Services (Distfsv) - Unknown owner - C:\WINDOWS\System32\Distfsv.exe
O23 - NT 服务: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
O23 - NT 服务: Rising Personal Firewall Service (RfwService) - Beijing Rising Technology Corporation Limited - C:\Program Files\rising\Rfw\rfwsrv.exe
O23 - NT 服务: Rising Process Communication Center (RsCCenter) - rising - C:\PROGRAM FILES\RISING\RAV\CCENTER.EXE
O23 - NT 服务: RsRavMon Service (RsRavMon) - Beijing Rising Technology Co., Ltd. - C:\PROGRAM FILES\RISING\RAV\Ravmond.exe