瑞星卡卡安全论坛技术交流区反病毒/反流氓软件论坛 打开IE浏览器被自动转向其他网站~~但不固定是某一个~~请斑竹帮下忙~~

1   1  /  1  页   跳转

打开IE浏览器被自动转向其他网站~~但不固定是某一个~~请斑竹帮下忙~~

打开IE浏览器被自动转向其他网站~~但不固定是某一个~~请斑竹帮下忙~~

打开IE浏览器被自动转向其他网站~~但不固定是某一个~~每次关闭再打开会改变~~ 起始页仍然是空白~但打开之后就自动转向其他网站~~~
请斑竹帮忙看看~~不胜感激!!!!
以下是我的扫描日志!
Logfile of HijackThis v1.99.1
Scan saved at 12:00:27, on 2007-1-29
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\System32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\spoolsv.exe
D:\Program Files\KAV6\Kavpfw.EXE
C:\Program Files\Common Files\PCSuite\DataLayer\DataLayer.exe
C:\WINDOWS\VM_STI.EXE
D:\Program Files\KAV6\KWatchUI.EXE
C:\PROGRA~1\COMMON~1\PCSuite\Services\SERVIC~1.EXE
D:\Program Files\DAEMON Tools\daemon.exe
C:\WINDOWS\System32\ctfmon.exe
C:\WINDOWS\system32\crypserv.exe
D:\Program Files\KAV6\KAVSvc.EXE
D:\Program Files\KAV6\MailMon.EXE
C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
C:\WINDOWS\System32\svchost.exe
D:\Program Files\KAV6\KAVPlus.EXE
C:\Program Files\Internet Explorer\IEXPLORE.EXE
D:\Program Files\KAV6\KAV32.EXE
C:\WINDOWS\explorer.exe
C:\WINDOWS\System32\conime.exe
D:\扫描\HijackThis.exe

O2 - BHO: QQBrowserHelperObject Class - {54EBD53A-9BC1-480B-966A-843A333CA162} - C:\Program Files\Tencent\QQ\QQIEHelper.dll
O2 - BHO: (no name) - {832C0563-0820-4fef-83D8-418261DBC233} - (no file)
O2 - BHO: NewWeb Controller - {9ACEEE31-1440-471B-AA46-72B061FE7D61} - C:\WINDOWS\system32\WinSC.dll (file missing)
O2 - BHO: IeCatch2 Class - {A5366673-E8CA-11D3-9CD9-0090271D075B} - D:\PROGRA~1\FLASHGET\jccatch.dll
O2 - BHO: Subconscious Intruder - {E2218499-2FD4-4EED-A94A-7F0B9C6E300E} - C:\WINDOWS\system32\Inte32.dll (file missing)
O3 - Toolbar: 电台(&R) - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O3 - Toolbar: FlashGet Bar - {E0E899AB-F487-11D5-8D29-0050BA6940E3} - D:\PROGRA~1\FLASHGET\fgiebar.dll
O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
O4 - HKLM\..\Run: [KAVRun] D:\Program Files\KAV6\KAVRun.EXE
O4 - HKLM\..\Run: [iDuba Personal FireWall] D:\Program Files\KAV6\Kavpfw.EXE
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe"  -osboot
O4 - HKLM\..\Run: [DataLayer] C:\Program Files\Common Files\PCSuite\DataLayer\DataLayer.exe
O4 - HKLM\..\Run: [BigDogPath] C:\WINDOWS\VM_STI.EXE Webeye USB PC Camera
O4 - HKLM\..\Run: [DAEMON Tools] "D:\Program Files\DAEMON Tools\daemon.exe" -lang 1033
O4 - HKLM\..\Run: [Kulansyn] D:\Program Files\KAV6\Kulansyn.EXE
O4 - HKLM\..\Run: [adx.exe] C:\Program Files\real\adx.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\System32\ctfmon.exe
O4 - HKCU\..\Run: [iDuba Personal FireWall] D:\Program Files\KAV6\Kavpfw.EXE
O8 - Extra context menu item: 上传到QQ网络硬盘 - C:\Program Files\Tencent\QQ\AddToNetDisk.htm
O8 - Extra context menu item: 使用网际快车下载 - D:\Program Files\FlashGet\jc_link.htm
O8 - Extra context menu item: 使用网际快车下载全部链接 - D:\Program Files\FlashGet\jc_all.htm
O8 - Extra context menu item: 使用超级解霸播放 - D:\Program Files\豪杰解霸\MPURLGET.HTM
O8 - Extra context menu item: 添加到QQ自定义面板 - C:\Program Files\Tencent\QQ\AddPanel.htm
O8 - Extra context menu item: 添加到QQ表情 - C:\Program Files\Tencent\QQ\AddEmotion.htm
O8 - Extra context menu item: 用QQ彩信发送该图片 - C:\Program Files\Tencent\QQ\SendMMS.htm
O8 - Extra context menu item: 用比特精灵下载(&B) - D:\Program Files\BitSpirit\bsurl.htm
O9 - Extra button: 浩方对战平台 - {0A155D3C-68E2-4215-A47A-E800A446447A} - C:\WINDOWS\System32\shdocvw.dll
O9 - Extra button: (no name) - {367E0A21-8601-4986-9C9A-153BF5ACA118} - (no file)
O9 - Extra button: 金山卓越 - {8DE0FCD4-5EB5-11D3-AD25-00002100131B} - url:http://www.joyo.com (file missing)
O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
O9 - Extra 'Tools' menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
O9 - Extra button: QQ - {c95fe080-8f5d-11d2-a20b-00aa003c157b} - C:\Program Files\Tencent\QQ\QQ.EXE
O9 - Extra 'Tools' menuitem: 腾讯QQ - {c95fe080-8f5d-11d2-a20b-00aa003c157b} - C:\Program Files\Tencent\QQ\QQ.EXE
O9 - Extra button: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - D:\PROGRA~1\FLASHGET\flashget.exe
O9 - Extra 'Tools' menuitem: &FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - D:\PROGRA~1\FLASHGET\flashget.exe
O9 - Extra button: (no name) - {DEDEB80D-FA35-45d9-9460-4983E5A8AFE6} - C:\Program Files\Tencent\QQ\QQIEHelper.dll
O9 - Extra 'Tools' menuitem: QQ炫彩工具条设置 - {DEDEB80D-FA35-45d9-9460-4983E5A8AFE6} - C:\Program Files\Tencent\QQ\QQIEHelper.dll
O9 - Extra button: 金山毒霸网站 - {e1fc9760-7b95-49cd-80b9-8c9e41017b93} - url:http://www.duba.net (file missing)
O9 - Extra button: 在线查毒 - {f58d36c3-40be-4418-a786-d8fbe3eb3554} - D:\Program Files\KAV6\kavie.HTM
O17 - HKLM\System\CCS\Services\Tcpip\..\{920511B2-23D3-483F-9414-0AD41C9C0FF3}: NameServer = 61.139.2.69 202.98.96.68
O23 - Service: Adobe LM Service - Unknown owner - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\System32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: Crypkey License - Kenonic Controls Ltd. - C:\WINDOWS\SYSTEM32\crypserv.exe
O23 - Service: Kingsoft AntiVirus Service (KAVSvc) - kingsoft Antivirus - D:\Program Files\KAV6\KAVSvc.EXE
O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
O23 - Service: Network Management Center Task (W32Tasks) - Unknown owner - C:\WINDOWS\system32\taskman32.exe (file missing)


最后编辑2007-01-29 14:54:44
分享到:
gototop
 

顶~~~~斑竹请帮忙哈~~谢谢了!!
gototop
 

恩~~~~~和士辛朋友说的一样~~~~~问题已经解决~~~谢谢了哈!!!!

经过查看,此次劫持是修改了IE浏览器的快捷方式,在快捷方式的“属性”、“快捷方式”下的“目标”位置处修改如下:"C:\Program Files\Internet Explorer\IEXPLORE.EXE" http://www.d766.com/veer.php?entry=993&mac=000C767398A4

将快捷方式的只读属性取消,然后将http://www.d766.com/veer.php?entry=993&mac=000C767398A4删除保存即可。

这样启动时,就不会出现www.d766.com网站了。
((摘自~~士辛 所发帖子 原帖见上面,希望和我有同样问题的朋友们能看到))
gototop
 
1   1  /  1  页   跳转
页面顶部
Powered by Discuz!NT