Bt不停弹出网业到死机，救命

terryye520

一打开Bt不停弹出IE网业到死机，弹出网业竟是电信的首页，Bt0.60与0.86版一样情况...
沙巴与杀客均无发现....
360与瑞星卡卡修复IE都没有效果，怎么办？？？
沙巴显示：可疑操作：
试图使用命令参数运行浏览器：“G:\Program files\Internet\iexpore.exe"-embedding.

Logfile of HijackThis v1.99.1
Scan saved at 3:44:38, on 2007-4-13
Platform: Windows 2000 SP4 (WinNT 5.00.2195)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)
Running processes:
G:\WINNT\System32\smss.exe
G:\WINNT\system32\winlogon.exe
G:\WINNT\system32\services.exe
G:\WINNT\system32\lsass.exe
G:\WINNT\system32\svchost.exe
G:\WINNT\system32\spoolsv.exe
G:\WINNT\System32\svchost.exe
G:\WINNT\runservice.exe
G:\WINNT\System32\nvsvc32.exe
G:\WINNT\system32\regsvc.exe
G:\WINNT\system32\MSTask.exe
G:\WINNT\System32\WBEM\WinMgmt.exe
G:\WINNT\system32\svchost.exe
G:\WINNT\Explorer.EXE
G:\WINNT\SOUNDMAN.EXE
G:\WINNT\system32\internat.exe
C:\木马杀客\mmsk.exe
G:\WINNT\system32\NOTEPAD.EXE
H:\BitComet\BitComet.exe
C:\HIJITHIS\HijackThis.exe
R3 - Default URLSearchHook is missing
O2 - BHO: WebThunder Browser Helper - {00000AAA-A363-466E-BEF5-9BB68697AA7F} - H:\WebThunder\WebThunderBHO_016.dll
O2 - BHO: BitComet ClickCapture - {39F7E362-828A-4B5A-BCAF-5B79BFDFEA60} - H:\BitComet\tools\BitCometBHO_1.1.3.28.dll
O2 - BHO: Helper Class - {6E28339B-7A2A-47B6-AEB2-197004272379} - G:\WINNT\vcbar\vchelper.dll (file missing)
O2 - BHO: NavigatMon Class - {B69F34DD-F0F9-42DC-9EDD-957187DA688D} - C:\360safe\safemon\safemon.dll
O3 - Toolbar: @msdxmLC.dll,-1@2052,电台(&R) - {8E718888-423F-11D2-876E-00A0C9082467} - G:\WINNT\System32\msdxm.ocx
O3 - Toolbar: 卡卡上网安全助手 - {DB9ECD4F-FB8F-4311-B3CE-90B976C2707C} - G:\WINNT\system32\kakatool.dll
O4 - HKLM\..\Run: [Synchronization Manager] mobsync.exe /logon
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE G:\WINNT\System32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE G:\WINNT\System32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [TkBellExe] "realsched.exe" -osboot
O4 - HKLM\..\Run: [kav] "C:\Kaspersky Anti-Virus 6.0\avp.exe"
O4 - HKLM\..\Run: [360Safetray] C:\360safe\safemon\360Tray.exe /start
O4 - HKLM\..\Run: [runeip] C:\kakaToolBar\runiep.exe
O4 - HKCU\..\Run: [internat.exe] internat.exe
O4 - Global Startup: Adobe Gamma Loader.lnk = G:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O8 - Extra context menu item: &使用BitComet下载 - res://H:\BitComet\BitComet.exe/AddLink.htm
O8 - Extra context menu item: &使用BitComet下载全部链接 - res://H:\BitComet\BitComet.exe/AddAllLink.htm
O8 - Extra context menu item: &使用BitComet下载本页视频 - res://H:\BitComet\BitComet.exe/AddVideo.htm
O8 - Extra context menu item: 使用Web迅雷下载 - H:\WebThunder\GetUrl.htm
O8 - Extra context menu item: 使用Web迅雷下载全部链接 - H:\WebThunder\GetAllUrl.htm
O9 - Extra button: Web反病毒保护 - {1F460357-8A94-4D71-9CA3-AA4ACF32ED8E} - C:\Kaspersky Anti-Virus 6.0\scieplugin.dll
O9 - Extra button: 启动Web迅雷 - {962EFB8E-2683-42d4-AC74-AAA4C759B9C6} - http://my.xunlei.com (file missing)
O9 - Extra 'Tools' menuitem: 启动Web迅雷 - {962EFB8E-2683-42d4-AC74-AAA4C759B9C6} - http://my.xunlei.com (file missing)
O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - G:\WINNT\web\related.htm
O9 - Extra 'Tools' menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - G:\WINNT\web\related.htm
O16 - DPF: {E4E2F180-CB8B-4DE9-ACBB-DA745D3BA153} (Rising Web Scan Object) - http://download.rising.com.cn/register/pcver/autoupgradepad/pcver2006new/OL2006.cab
O20 - Winlogon Notify: klogon - G:\WINNT\system32\klogon.dll
O23 - Service: 卡巴斯基反病毒6.0 (AVP) - Unknown owner - C:\Kaspersky Anti-Virus 6.0\avp.exe" -r (file missing)
O23 - Service: Logical Disk Manager Administrative Service (dmadmin) - VERITAS Software Corp. - G:\WINNT\System32\dmadmin.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - G:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: LicCtrl Service (LicCtrlService) - Unknown owner - G:\WINNT\runservice.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - G:\WINNT\System32\nvsvc32.exe

janfire

如果是BT用命令参数运行IE，而照楼主说的，卡巴又提示了，那么可以在主动防御里设置一下不让它弹出网页。
具体方法见
http://my.kafan.cn/viewthread.php?tid=14052
即对“使用命令参数运行浏览器”的行为，一律采取阻止的办法。

[ 本帖最后由 janfire 于 2007-4-13 08:25 编辑 ]