论坛: 病毒专区 标题: 可能是新的木马,帮忙参考一下 复制本贴地址

作者: sznmy [sznmy]    论坛用户

登录

我的电脑最近出现了一些异常现象: 主页经常不定期被设定为:lender-search.com,hot-searchs.com 并且进入GOOGLE搜索引擎后,一些被搜索的连接(不是每一个)上会被自动加上lender-search.com的前缀.很不爽. 并且不是每次重新启动,进入IE都会被改变主页. 我做了常规安全检查. 注册表内RUN无异常. 搜索到一个和lender-search相关的键值,删除. HOST文件发现两个网址对应的地址,删除 其他没有发现相关的问题... 问题依然存在.. 我的防火墙没有发现什么问题,好奇怪啊. 下面是hijackthis的扫描记录: Logfile of HijackThis v1.97.6 Scan saved at 13:36:50, on 2004-06-05 Platform: Windows XP SP1 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\System32\ibmpmsvc.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\System32\Ati2evxx.exe C:\Program Files\Symantec_Client_Security\Symantec AntiVirus\DefWatch.exe C:\Program Files\Symantec_Client_Security\Symantec AntiVirus\Rtvscan.exe C:\WINDOWS\System32\QCONSVC.EXE C:\WINDOWS\system32\ZoneLabs\vsmon.exe C:\WINDOWS\Explorer.EXE C:\Program Files\ThinkPad\ConnectUtilities\QCTRAY.EXE C:\PROGRA~1\ThinkPad\PkgMgr\HOTKEY\TPHKMGR.exe C:\WINDOWS\AGRSMMSG.exe C:\PROGRA~1\SYMANT~1\SYMANT~1\vptray.exe C:\WINDOWS\System32\ctfmon.exe C:\Program Files\ThinkPad\PkgMgr\HOTKEY\TPONSCR.exe C:\Program Files\ThinkPad\PkgMgr\HOTKEY_1\TpScrex.exe C:\Program Files\Zone Labs\ZoneAlarm\zapro.exe C:\Program Files\MYIE2\MyIE.exe C:\WINDOWS\System32\csimesrv.exe C:\Program Files\Xi\Net Transport\NetTransport.EXE C:\WINDOWS\System32\conime.exe D:\downloads\网络和安全工具\HijackThis.exe R3 - URLSearchHook: O1 - Hosts file is located at: C:\WINDOWS\nsdb\hosts O2 - BHO: (no name) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx O2 - BHO: O2 - BHO: (no name) - {C56CB6B0-0D96-11D6-8C65-B2868B609932} - C:\Program Files\Xi\Net Transport\NTIEHelper.dll O3 - Toolbar: ????? - {F60C7D81-8471-4D40-AAFE-56D318F34C2D} - C:\WINDOWS\downlo~1\DDTONG~1.DLL O3 - Toolbar: ????? - {1B0E7716-898E-48cc-9690-4E338E8DE1D3} - C:\PROGRA~1\3721\assist\assist.dll O3 - Toolbar: ????? - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx O4 - HKLM\..\Run: [ATIModeChange] Ati2mdxx.exe O4 - HKLM\..\Run: [QCTRAY] C:\Program Files\ThinkPad\ConnectUtilities\QCTRAY.EXE O4 - HKLM\..\Run: [TP4EX] tp4ex.exe O4 - HKLM\..\Run: [TPHOTKEY] C:\PROGRA~1\ThinkPad\PkgMgr\HOTKEY\TPHKMGR.exe O4 - HKLM\..\Run: [AGRSMMSG] AGRSMMSG.exe O4 - HKLM\..\Run: [vptray] C:\PROGRA~1\SYMANT~1\SYMANT~1\vptray.exe O4 - HKLM\..\Run: [AsShell] "C:\Program Files\3721\assist\AsShell.exe" O4 - HKLM\..\Run: [MSPY2002] C:\WINDOWS\System32\IME\PINTLGNT\ImScInst.exe /SYNC O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\System32\ctfmon.exe O4 - Startup: .cms_properties O4 - Startup: NTUSER.DAT O4 - Startup: ntuser.dat.LOG O4 - Startup: ntuser.ini O4 - Startup: plugin131_01.trace O4 - Startup: sqlerror.log O4 - Global Startup: NTUSER.DAT O4 - Global Startup: NTUSER.DAT.LOG O8 - Extra context menu item: Download all by Net Transport - C:\PROGRA~1\Xi\NETTRA~1\NTAddList.html O8 - Extra context menu item: Download by Net Transport - C:\PROGRA~1\Xi\NETTRA~1\NTAddLink.html O9 - Extra button: Related (HKLM) O9 - Extra 'Tools' menuitem: Show &Related Links (HKLM) O16 - DPF: {0CA54D3F-CEAE-48AF-9A2B-31909CB9515D} (Edit Class) - https://www.sz1.cmbchina.com/download/CMBEdit.cab O16 - DPF: {15DDE989-CD45-4561-BF99-D22C0D5C2B74} (IDDTInitObj Class) - http://image2.sina.com.cn/home/source/ddt.cab O16 - DPF: {18D5D878-49B1-4FDE-9DD2-236AD1F54BA8} (JSKDRIVER Class) - http://77.24.16.4:7001/applet/jsdriver.cab O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab O16 - DPF: {DA984A6D-508E-11D6-AA49-0050FF3C628D} (Ravonline) - http://download.rising.com.cn/ravkill/rsonline.cab O17 - HKLM\System\CCS\Services\Tcpip\..\{50DEA0C4-8BB4-48EA-AAA9-EE2EDAAD8173}: NameServer = 220.192.8.58 220.192.32.103 我怀疑是 那位朋友帮忙诊断一下.谢谢.

回复: saskatoon [saskatoon]   论坛用户

登录

回复: sznmy [sznmy]   论坛用户

登录

20CN网络安全小组版权所有
Copyright © 2000-2010 20CN Security Group. All Rights Reserved.
论坛程序编写：NetDemon

粤ICP备05087286号