求救，怎么解决这个恶意网站的问题 bbs.ikaka.com

gwgw - 2005-11-21 20:11:00

麻烦给看下
2005-11-20,13:22:06

System Repair Engineer 1.1.0.269
Windows XP Professional Service Pack 1 - 管理权限用户 - 完整功能

以下内容被选中：
所有的启动项目（包括注册表、启动文件夹、服务等）
浏览器加载项
正在运行的进程（包括进程模块信息）
文件关联

启动项目
注册表
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
<ctfmon.exe><C:\WINDOWS\System32\ctfmon.exe>
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
<iDuba Personal FireWall><C:\KAV6\KAVPFW.EXE>
[HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows]
<load><>
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
<IMJPMIG8.1><"C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32>
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
<PHIME2002ASync><C:\WINDOWS\System32\IME\TINTLGNT\TINTSETP.EXE /SYNC>
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
<PHIME2002A><C:\WINDOWS\System32\IME\TINTLGNT\TINTSETP.EXE /IMEName>
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
<SoundMan><SOUNDMAN.EXE>
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
<ATIPTA><C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe>
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
<TkBellExe><"C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot>
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
<KAVRun><c:\KAV6\KAVRun.EXE>
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
<Kulansyn><c:\KAV6\Kulansyn.EXE>
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
<KpopMon><c:\KAV6\KpopMon.EXE>
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
<iDuba Personal FireWall><C:\KAV6\KAVPFW.EXE>
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
<UserFaultCheck><%systemroot%\system32\dumprep 0 -u>
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
<shell><Explorer.exe>
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
<Userinit><C:\WINDOWS\system32\userinit.exe,>
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Windows]
<AppInit_DLLs><>

gwgw - 2005-11-21 20:11:00

启动文件夹
[腾讯QQ]
<C:\Documents and Settings\hy\「开始」菜单\程序\启动\腾讯QQ.lnk><N>

==================================
服务
[Ati HotKey Poller / Ati HotKey Poller]
<C:\WINDOWS\System32\Ati2evxx.exe><N/A>
[ATI Smart / ATI Smart]
<C:\WINDOWS\system32\ati2sgag.exe><N/A>
[Kingsoft AntiVirus Service / KAVSvc]
<c:\KAV6\KAVSvc.EXE><kingsoft Antivirus>
[File Replication Services / NtFrs32]
<C:\WINDOWS\System32\NtFrs32.exe -service><N/A>
[StdService / StdService]
<C:\WINDOWS\System32\rundll32.exe C:\WINDOWS\system32\STDSVER.DLL,Service><N/A>

==================================
浏览器加载项
[KAVIEHelper Class]
<C:\Program Files\Kos\KOSIEBar.dll>
[MemoryManager Class]
<C:\WINDOWS\DOWNLO~1\cytdcli.dll>
[QQBrowserHelperObject Class]
<D:\Program Files\Tencent\QQ\QQIEHelper.dll>
[MMSAssist BHO]
<C:\PROGRA~1\MMSASS~1\MMSASS~1.DLL>
[std software]
<C:\WINDOWS\SYSTEM32\stdup.dll>
[百度搜霸]
<C:\WINDOWS\DOWNLO~1\BaiDuBar.dll>
[豪杰超级解霸V8]
<C:\Herosoft\HeroV8\STHSDVD.EXE>
[MMSAssistMenu]
<C:\PROGRA~1\MMSASS~1\MMSASS~1.DLL>
[金山卓越]
<url:http://www.joyo.com>
[@shdoclc.dll,-866]
<>
[QQ]
<D:\Program Files\Tencent\QQ\QQ.EXE>
[QQIEFloatBarCfgCmd Class]
<D:\Program Files\Tencent\QQ\QQIEHelper.dll>
[金山毒霸网站]
<url:http://www.duba.net>
[在线查毒]
<c:\KAV6\kavie.HTM>
[AxInputControl Class]
<C:\WINDOWS\DOWNLO~1\INPUTC~1.DLL>
[Shockwave Flash Object]
<C:\WINDOWS\System32\macromed\flash\Flash.ocx>
[Cytd Encipherment Memory]
<C:\WINDOWS\DOWNLO~1\cytdcli.dll>
[ >> 彩信发送 <<]
<res://C:\PROGRA~1\MMSASS~1\MMSASS~1.DLL/mms.htm>
[添加到QQ自定义面板]
<D:\Program Files\Tencent\QQ\AddPanel.htm>
[添加到QQ表情]
<D:\Program Files\Tencent\QQ\AddEmotion.htm>
[用QQ彩信发送该图片]
<D:\Program Files\Tencent\QQ\SendMMS.htm>
[百度Flash搜索]
<res://C:\WINDOWS\DOWNLO~1\BaiDuBar.dll/FLASHSEARCH.HTM>
[百度mp3搜索]
<res://C:\WINDOWS\DOWNLO~1\BaiDuBar.dll/BAIDUMP3.HTM>
[百度信息快递搜索]
<res://C:\WINDOWS\DOWNLO~1\BaiDuBar.dll/BAIDUIE.HTM>
[百度图片搜索]
<res://C:\WINDOWS\DOWNLO~1\BaiDuBar.dll/BAIDUIMG.HTM>
[百度搜索]
<res://C:\WINDOWS\DOWNLO~1\BaiDuBar.dll/BAIDUSEARCH.HTM>
[百度新闻搜索]
<res://C:\WINDOWS\DOWNLO~1\BaiDuBar.dll/BAIDUNEWS.HTM>
[豪杰超级解霸V8实时播放]
<C:\Herosoft\HeroV8\MPURLGET.HTM>

gwgw - 2005-11-21 20:11:00

正在运行的进程
[PID: 560][\SystemRoot\System32\smss.exe] <Microsoft Corporation><5.1.2600.1106 (xpsp1.020828-1920)>
[PID: 636][\??\C:\WINDOWS\system32\csrss.exe] <Microsoft Corporation><5.1.2600.0 (xpclient.010817-1148)>
[PID: 660][\??\C:\WINDOWS\system32\winlogon.exe] <Microsoft Corporation><5.1.2600.1106 (xpsp1.020828-1920)>
[C:\WINDOWS\system32\Ati2evxx.dll] <N/A><N/A>
[C:\WINDOWS\System32\nsdff.dll] <N/A><N/A>
[PID: 704][C:\WINDOWS\system32\services.exe] <Microsoft Corporation><5.1.2600.0 (xpclient.010817-1148)>
[PID: 716][C:\WINDOWS\system32\lsass.exe] <Microsoft Corporation><5.1.2600.1106 (xpsp1.020828-1920)>
[PID: 868][C:\WINDOWS\System32\Ati2evxx.exe] <N/A><N/A>
[PID: 892][C:\WINDOWS\system32\svchost.exe] <Microsoft Corporation><5.1.2600.0 (xpclient.010817-1148)>
[PID: 996][C:\WINDOWS\System32\svchost.exe] <Microsoft Corporation><5.1.2600.0 (xpclient.010817-1148)>
[PID: 1140][C:\WINDOWS\System32\svchost.exe] <Microsoft Corporation><5.1.2600.0 (xpclient.010817-1148)>
[PID: 1152][C:\WINDOWS\System32\svchost.exe] <Microsoft Corporation><5.1.2600.0 (xpclient.010817-1148)>
[PID: 1432][C:\WINDOWS\system32\Ati2evxx.exe] <N/A><N/A>
[c:\KAV6\KMailFun.dll] <Kingsoft Co., Ltd><2005, 4, 28, 227>
[PID: 1484][C:\WINDOWS\Explorer.EXE] <Microsoft Corporation><6.00.2800.1106 (xpsp1.020828-1920)>
[C:\WINDOWS\System32\suflsd.dll] <N/A><N/A>
[c:\KAV6\KMailFun.dll] <Kingsoft Co., Ltd><2005, 4, 28, 227>
[C:\WINDOWS\SYSTEM32\stdup.dll] <AOL Corp.><3, 2, 1, 3>
[C:\WINDOWS\DOWNLO~1\BaiDuBar.dll] <N/A><2, 0, 0, 0>
[PID: 1536][C:\WINDOWS\system32\spoolsv.exe] <Microsoft Corporation><5.1.2600.0 (XPClient.010817-1148)>
[C:\WINDOWS\System32\spool\PRTPROCS\W32X86\vprproc.dll] <Windows (R) 2000 DDK provider><5.00.2195.1620>
[PID: 1660][C:\WINDOWS\System32\alg.exe] <Microsoft Corporation><5.1.2600.1106 (xpsp1.020828-1920)>
[PID: 1744][c:\KAV6\KAVSvc.EXE] <kingsoft Antivirus><2003, 11, 12, 70>
[c:\KAV6\SvcComm.dll] <kingsoft Antivirus><2004, 7, 28, 1>
[c:\KAV6\SvcTimer.DLL] <Kingsoft><2004.4.29.79>
[c:\KAV6\KavComm.dll] <Kingsoft Corporation><2003, 11, 12, 66>
[c:\KAV6\RpcBrge.DLL] <kingsoft><2003, 11, 12, 64>
[c:\KAV6\KWatchFn2.dll] <kingsoft Corporation><2004, 8, 24, 25>
[c:\KAV6\KAEPlat.DLL] <Kingsoft Corp.><2004, 8, 18, 48>
[c:\KAV6\KAEMem.DAT] <Kingsoft><2004, 8, 18, 10>
[c:\KAV6\KAVUtils.dll] <Kingsoft Corp><2004, 2, 12, 69>
[c:\KAV6\KAVDlg.DLL] <><2004.7.20.81>
[c:\KAV6\KAVLogFn.dll] <N/A><2003, 11, 26, 16>
[PID: 1976][C:\WINDOWS\SOUNDMAN.EXE] <Realtek Semiconductor Corp.><5.1.0.27>
[c:\KAV6\KMailFun.dll] <Kingsoft Co., Ltd><2005, 4, 28, 227>
[PID: 2024][C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe] <ATI Technologies, Inc.><6.14.10.5090>
[C:\Program Files\ATI Technologies\ATI Control Panel\atipdsxx.dll] <ATI Technologies, Inc.><6.14.10.5090>
[C:\PROGRAM FILES\ATI TECHNOLOGIES\ATI CONTROL PANEL\ATRPUIXX.CHS] <ATI Technologies, Inc.><6.14.10.5090>
[C:\Program Files\ATI Technologies\ATI Control Panel\atipdxxx.dll] <ATI Technologies, Inc.><6.14.10.5090>
[c:\KAV6\KMailFun.dll] <Kingsoft Co., Ltd><2005, 4, 28, 227>
[PID: 2040][C:\Program Files\Common Files\Real\Update_OB\realsched.exe] <RealNetworks, Inc.><0.1.0.3018>
[c:\KAV6\KMailFun.dll] <Kingsoft Co., Ltd><2005, 4, 28, 227>
[PID: 120][C:\WINDOWS\System32\rundll32.exe] <Microsoft Corporation><5.1.2600.0 (xpclient.010817-1148)>
[C:\WINDOWS\system32\STDSVER.DLL] <AOL Corp.><3, 2, 1, 3>
[PID: 224][c:\KAV6\KWatchUI.EXE] <><2004.1.6.119>
[c:\KAV6\kavcomm.dll] <Kingsoft Corporation><2003, 11, 12, 66>
[c:\KAV6\kavdlg.dll] <><2004.7.20.81>
[c:\KAV6\KAVMLM.DLL] <Kingsoft Corporation><2003.11.12.10>
[c:\KAV6\RpcBrge.DLL] <kingsoft><2003, 11, 12, 64>
[c:\KAV6\KMailFun.dll] <Kingsoft Co., Ltd><2005, 4, 28, 227>
[PID: 232][C:\KAV6\KpopMon.EXE] <N/A><2004, 2, 2, 31>
[C:\KAV6\KAVMLM.DLL] <Kingsoft Corporation><2003.11.12.10>
[c:\KAV6\KMailFun.dll] <Kingsoft Co., Ltd><2005, 4, 28, 227>
[PID: 368][C:\KAV6\KAVPFW.EXE] <Kingsoft Corporation><2004, 8, 16, 295>
[C:\KAV6\KAVMLM.DLL] <Kingsoft Corporation><2003.11.12.10>
[C:\KAV6\PFWScanC.dll] <KingSoft><2002, 4, 12, 3>
[C:\KAV6\KAMsgBox.dll] <><2002.9.27.30>
[C:\KAV6\NetShare.dll] <Kingsoft Antivirus><2004, 2, 20, 67>
[C:\KAV6\KAEPlat.DLL] <Kingsoft Corp.><2004, 8, 18, 48>
[C:\KAV6\KAEMem.DAT] <Kingsoft><2004, 8, 18, 10>
[C:\KAV6\KAEQSCAN.DLL] <Kingsoft Corp><2004, 3, 26, 69>
[c:\KAV6\KMailFun.dll] <Kingsoft Co., Ltd><2005, 4, 28, 227>
[C:\KAV6\KAVLogFn.dll] <N/A><2003, 11, 26, 16>
[PID: 376][C:\WINDOWS\System32\ctfmon.exe] <Microsoft Corporation><5.1.2600.1106 (xpsp1.020828-1920)>
[c:\KAV6\KMailFun.dll] <Kingsoft Co., Ltd><2005, 4, 28, 227>
[PID: 1128][c:\KAV6\MailMon.EXE] <Kingsoft Co., Ltd><2004, 2, 6, 245>
[c:\KAV6\KMFilter.DLL] <N/A><2004, 3, 1, 37>
[c:\KAV6\parse822.dll] <Quiksoft Corporation><2, 0, 0, 9>
[c:\KAV6\KAVLogFn.dll] <N/A><2003, 11, 26, 16>
[c:\KAV6\KAVMLM.DLL] <Kingsoft Corporation><2003.11.12.10>
[c:\KAV6\KAMsgBox.DLL] <><2002.9.27.30>
[c:\KAV6\KAVComm.dll] <Kingsoft Corporation><2003, 11, 12, 66>
[c:\KAV6\RpcBrge.DLL] <kingsoft><2003, 11, 12, 64>
[c:\KAV6\KAVIPC.DLL] <Kingsoft Corp.><2002, 3, 29, 8>
[c:\KAV6\KAVDlg.DLL] <><2004.7.20.81>
[c:\KAV6\KAECall.DLL] <Kingsoft Corporation><2003, 11, 14, 66>
[c:\KAV6\KAEScan.DLL] <Kingsoft Corp.><2003, 5, 24, 36>
[c:\KAV6\KAEPlat.DLL] <Kingsoft Corp.><2004, 8, 18, 48>
[c:\KAV6\KAEMem.DAT] <Kingsoft><2004, 8, 18, 10>
[c:\KAV6\KMailFun.dll] <Kingsoft Co., Ltd><2005, 4, 28, 227>
[PID: 1908][c:\KAV6\KAVPlus.EXE] <N/A><2004, 3, 3, 71>
[c:\KAV6\KMailFun.dll] <Kingsoft Co., Ltd><2005, 4, 28, 227>
[PID: 1396][D:\Program Files\IEscan.exe] <N/A><N/A>
[C:\DOCUME~1\hy\LOCALS~1\Temp\E_80003\krnln.fnr] <N/A><1, 0, 0, 1>
[c:\KAV6\KMailFun.dll] <Kingsoft Co., Ltd><2005, 4, 28, 227>
[C:\DOCUME~1\hy\LOCALS~1\Temp\E_80003\iext.fnr] <N/A><1, 0, 0, 1>
[C:\DOCUME~1\hy\LOCALS~1\Temp\E_80003\iext2.fne] <N/A><1, 0, 0, 1>
[PID: 2584][C:\WINDOWS\System32\rundll32.exe] <Microsoft Corporation><5.1.2600.0 (xpclient.010817-1148)>
[C:\WINDOWS\SYSTEM32\stdup.dll] <AOL Corp.><3, 2, 1, 3>
[c:\KAV6\KMailFun.dll] <Kingsoft Co., Ltd><2005, 4, 28, 227>
[PID: 2020][C:\Program Files\Internet Explorer\iexplore.exe] <Microsoft Corporation><6.00.2800.1106 (xpsp1.020828-1920)>
[c:\KAV6\KMailFun.dll] <Kingsoft Co., Ltd><2005, 4, 28, 227>
[C:\Program Files\Kos\KOSIEBar.dll] <金山软件股份有限公司><2005, 11, 1, 59>
[C:\WINDOWS\DOWNLO~1\cytdcli.dll] <北京创原天地科技有限公司><1, 0, 0, 9>
[D:\Program Files\Tencent\QQ\QQIEHelper.dll] <深圳市腾讯计算机系统有限公司><1, 1, 0, 5>
[C:\PROGRA~1\MMSASS~1\MMSASS~1.DLL] <N/A><1, 1, 0, 1>
[C:\WINDOWS\SYSTEM32\stdup.dll] <AOL Corp.><3, 2, 1, 3>
[C:\WINDOWS\DOWNLO~1\BaiDuBar.dll] <N/A><2, 0, 0, 0>
[c:\KAV6\KAVEXT.DLL] <Kingsoft Corp.><2002, 5, 24, 6>
[C:\Program Files\Kos\KOSScript.dll] <金山软件股份有限公司><2005, 7, 21, 3>
[C:\Program Files\Kos\KAEPlat.DLL] <Kingsoft Corp.><2004, 11, 26, 53>
[C:\Program Files\Kos\KAEMem.DAT] <Kingsoft><2004, 11, 9, 11>
[PID: 3856][D:\SREng.exe] <Smallfrogs Studio><1.1.0.269>
[c:\KAV6\KMailFun.dll] <Kingsoft Co., Ltd><2005, 4, 28, 227>

==================================

gwgw - 2005-11-21 20:13:00

麻烦告诉我应该具体怎么操作！例如怎么删除，怎么恢复方面的！这方面我很菜！我目前发现的，它能连接www.sun12.com,av.9xi.com，www.77mt.com,av.9v9v.cn等等

飞跃迷离 - 2005-11-21 20:37:00

重新启动到安全模式（进入安全模式的方法:重新启动电脑, 开机自动检测完后, 按[F8]键(可以一直按到启动菜单出来为止), 选择安全模式(Safe Mode)进入Windows。）

开始→控制面板→性能和维护→管理工具→服务→查找StdService、File Replication Services→右击→属性→启动类型→禁止→应用→停止→确定。

删除这些浏览器加载项
[MemoryManager Class]
<C:\WINDOWS\DOWNLO~1\cytdcli.dll>
MMSAssist BHO]
<C:\PROGRA~1\MMSASS~1\MMSASS~1.DLL>
[std software]
<C:\WINDOWS\SYSTEM32\stdup.dll>
[MMSAssistMenu]
<C:\PROGRA~1\MMSASS~1\MMSASS~1.DLL>
[Cytd Encipherment Memory]
<C:\WINDOWS\DOWNLO~1\cytdcli.dll>
[ >> 彩信发送 <<]
<res://C:\PROGRA~1\MMSASS~1\MMSASS~1.DLL/mms.htm>

然后打开我的电脑→再点工具→打开文件夹选项→查看→把隐藏受保护的系统文件（推荐）和隐藏已知文件类型的扩展名的勾去掉→再显示所有文件→找到以下文件并删除：(如果有的话)
C:\WINDOWS\System32\NtFrs32.exe
C:\WINDOWS\system32\STDSVER.DLL
C:\WINDOWS\DOWNLO~1\cytdcli.dll
C:\WINDOWS\SYSTEM32\stdup.dll
删除文件夹C:\PROGRA~1\MMSASS~1

gwgw - 2005-11-21 20:40:00

好的！我明天回家看看！有问题我再来询问！：）今天在单位回不去！

gwgw - 2005-11-22 8:29:00

我还有疑问！我找了您让删除的文件！但是C:\WINDOWS\DOWNLO~1\cytdcli.dll
删除文件夹C:\PROGRA~1\MMSASS~1
好像没有！另外StdService、File Replication Services让我点属性！我就找到了StdService，至于File Replication Services没看到！是不是他们就是一起的？还有我找了几个文件，创建时间和我中毒时间差不多！您看看这些是不是系统自带的文件！可否删除
wpa.dbl
stfd.t
suflsd.dll
nsdff.dll
stdd
stdup.dll
stdsver.dll
std
ntfrs32

gwgw - 2005-11-22 9:08:00

还有斑竹给我的方法里面没提到修复这个问题？应该怎么修复？就果断的删除就可以吗？

花落花又开 - 2005-11-22 12:42:00

【回复“gwgw”的帖子】
直接在注册表中找到这些值删除即可.

再清空一下IE缓存.

gwgw - 2005-11-22 13:31:00

我对这方面比较菜！麻烦斑竹给举例说明一下操作！还有我上面列举的都可以删除吗？那么怎么恢复呢？我回头扫描一个hj得日志！到时候再请斑竹给看看

gwgw - 2005-11-22 13:36:00

等待回复：）这方面很菜！所以啰嗦了点！：）

青青的弯刀 - 2005-11-22 14:11:00

重装系统试试看!

魔法学徒 - 2005-11-22 14:16:00

stfd.t
suflsd.dll
nsdff.dll
stdd
stdup.dll
stdsver.dll
std
ntfrs32

删除

gwgw - 2005-11-22 14:34:00

就是说我的wpa.dbl不能删除对吧！还有我不会用注册表，就是手动找到能删除吗？这么做管用吗？因为这几天我多少时间在家里，还不清楚怎么做能不能解决问题！我先这么操作看看！如果在弹出不同网站，我继续来问！还有我应该修复什么？

魔法学徒 - 2005-11-22 14:48:00

如果不熟悉注册表，请用hj扫一个log贴上来

gwgw - 2005-11-22 15:26:00

好的！等我下班我回家用hj扫描一个上来！我目前先手动在windows里面找到那几个文件删除！当然前面操作和飞跃说的那样去做！然后我在用hj扫描一个上来！您在给看看！看看那些地方还需要删除或者修改的！谢谢

gwgw - 2005-11-22 18:21:00

我按照斑竹的做法去做了！把该删的都删掉了！我分别用sreng和hj都扫描了一下！把结果发上来！有点长！请斑竹帮忙再看看恶意程序是不是清除掉了！是不是不再弹出不同网站了？以下是sreng报告：2005-11-22,18:14:34

System Repair Engineer 1.1.0.269
Windows XP Professional Service Pack 1 - 管理权限用户 - 完整功能

以下内容被选中：
所有的启动项目（包括注册表、启动文件夹、服务等）
浏览器加载项
正在运行的进程（包括进程模块信息）
文件关联

启动项目
注册表
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
<ctfmon.exe><C:\WINDOWS\System32\ctfmon.exe>
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
<iDuba Personal FireWall><C:\KAV6\KAVPFW.EXE>
[HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows]
<load><>
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
<IMJPMIG8.1><"C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32>
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
<PHIME2002ASync><C:\WINDOWS\System32\IME\TINTLGNT\TINTSETP.EXE /SYNC>
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
<PHIME2002A><C:\WINDOWS\System32\IME\TINTLGNT\TINTSETP.EXE /IMEName>
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
<SoundMan><SOUNDMAN.EXE>
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
<ATIPTA><C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe>
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
<TkBellExe><"C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot>
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
<KAVRun><c:\KAV6\KAVRun.EXE>
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
<Kulansyn><c:\KAV6\Kulansyn.EXE>
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
<KpopMon><c:\KAV6\KpopMon.EXE>
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
<iDuba Personal FireWall><C:\KAV6\KAVPFW.EXE>
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
<UserFaultCheck><%systemroot%\system32\dumprep 0 -u>
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
<shell><Explorer.exe>
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
<Userinit><C:\WINDOWS\system32\userinit.exe,>
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Windows]
<AppInit_DLLs><>

==================================
启动文件夹
[腾讯QQ]
<C:\Documents and Settings\hy\「开始」菜单\程序\启动\腾讯QQ.lnk><N>

==================================
服务
[Ati HotKey Poller / Ati HotKey Poller]
<C:\WINDOWS\System32\Ati2evxx.exe><N/A>
[ATI Smart / ATI Smart]
<C:\WINDOWS\system32\ati2sgag.exe><N/A>
[Kingsoft AntiVirus Service / KAVSvc]
<c:\KAV6\KAVSvc.EXE><kingsoft Antivirus>

==================================

gwgw - 2005-11-22 18:22:00

浏览器加载项
[KAVIEHelper Class]
<C:\Program Files\Kos\KOSIEBar.dll>
[QQBrowserHelperObject Class]
<D:\Program Files\Tencent\QQ\QQIEHelper.dll>
[百度搜霸]
<C:\WINDOWS\DOWNLO~1\BaiDuBar.dll>
[豪杰超级解霸V8]
<C:\Herosoft\HeroV8\STHSDVD.EXE>
[金山卓越]
<url:http://www.joyo.com>
[@shdoclc.dll,-866]
<>
[QQ]
<D:\Program Files\Tencent\QQ\QQ.EXE>
[QQIEFloatBarCfgCmd Class]
<D:\Program Files\Tencent\QQ\QQIEHelper.dll>
[金山毒霸网站]
<url:http://www.duba.net>
[在线查毒]
<c:\KAV6\kavie.HTM>
[AxInputControl Class]
<C:\WINDOWS\DOWNLO~1\INPUTC~1.DLL>
[Shockwave Flash Object]
<C:\WINDOWS\System32\macromed\flash\Flash.ocx>
[添加到QQ自定义面板]
<D:\Program Files\Tencent\QQ\AddPanel.htm>
[添加到QQ表情]
<D:\Program Files\Tencent\QQ\AddEmotion.htm>
[用QQ彩信发送该图片]
<D:\Program Files\Tencent\QQ\SendMMS.htm>
[百度Flash搜索]
<res://C:\WINDOWS\DOWNLO~1\BaiDuBar.dll/FLASHSEARCH.HTM>
[百度mp3搜索]
<res://C:\WINDOWS\DOWNLO~1\BaiDuBar.dll/BAIDUMP3.HTM>
[百度信息快递搜索]
<res://C:\WINDOWS\DOWNLO~1\BaiDuBar.dll/BAIDUIE.HTM>
[百度图片搜索]
<res://C:\WINDOWS\DOWNLO~1\BaiDuBar.dll/BAIDUIMG.HTM>
[百度搜索]
<res://C:\WINDOWS\DOWNLO~1\BaiDuBar.dll/BAIDUSEARCH.HTM>
[百度新闻搜索]
<res://C:\WINDOWS\DOWNLO~1\BaiDuBar.dll/BAIDUNEWS.HTM>
[豪杰超级解霸V8实时播放]
<C:\Herosoft\HeroV8\MPURLGET.HTM>

==================================
正在运行的进程
[PID: 560][\SystemRoot\System32\smss.exe] <Microsoft Corporation><5.1.2600.1106 (xpsp1.020828-1920)>
[PID: 628][\??\C:\WINDOWS\system32\csrss.exe] <Microsoft Corporation><5.1.2600.0 (xpclient.010817-1148)>
[PID: 660][\??\C:\WINDOWS\system32\winlogon.exe] <Microsoft Corporation><5.1.2600.1106 (xpsp1.020828-1920)>
[C:\WINDOWS\system32\Ati2evxx.dll] <N/A><N/A>
[PID: 704][C:\WINDOWS\system32\services.exe] <Microsoft Corporation><5.1.2600.0 (xpclient.010817-1148)>
[PID: 716][C:\WINDOWS\system32\lsass.exe] <Microsoft Corporation><5.1.2600.1106 (xpsp1.020828-1920)>
[PID: 868][C:\WINDOWS\System32\Ati2evxx.exe] <N/A><N/A>
[PID: 892][C:\WINDOWS\system32\svchost.exe] <Microsoft Corporation><5.1.2600.0 (xpclient.010817-1148)>
[PID: 996][C:\WINDOWS\System32\svchost.exe] <Microsoft Corporation><5.1.2600.0 (xpclient.010817-1148)>
[PID: 1104][C:\WINDOWS\System32\svchost.exe] <Microsoft Corporation><5.1.2600.0 (xpclient.010817-1148)>
[PID: 1176][C:\WINDOWS\System32\svchost.exe] <Microsoft Corporation><5.1.2600.0 (xpclient.010817-1148)>
[PID: 1428][C:\WINDOWS\system32\Ati2evxx.exe] <N/A><N/A>
[c:\KAV6\KMailFun.dll] <Kingsoft Co., Ltd><2005, 4, 28, 227>
[PID: 1480][C:\WINDOWS\Explorer.EXE] <Microsoft Corporation><6.00.2800.1106 (xpsp1.020828-1920)>
[c:\KAV6\KMailFun.dll] <Kingsoft Co., Ltd><2005, 4, 28, 227>
[c:\KAV6\KAVEXT.DLL] <Kingsoft Corp.><2002, 5, 24, 6>
[C:\Herosoft\HeroV8\VCvtShell.dll] <herosoft><1, 0, 0, 1>
[C:\Program Files\WinRAR\rarext.dll] <N/A><N/A>
[C:\WINDOWS\DOWNLO~1\BaiDuBar.dll] <N/A><2, 0, 0, 0>
[PID: 1508][C:\WINDOWS\system32\spoolsv.exe] <Microsoft Corporation><5.1.2600.0 (XPClient.010817-1148)>
[C:\WINDOWS\System32\spool\PRTPROCS\W32X86\vprproc.dll] <Windows (R) 2000 DDK provider><5.00.2195.1620>
[PID: 1652][C:\WINDOWS\System32\alg.exe] <Microsoft Corporation><5.1.2600.1106 (xpsp1.020828-1920)>
[PID: 1724][c:\KAV6\KAVSvc.EXE] <kingsoft Antivirus><2003, 11, 12, 70>
[c:\KAV6\SvcComm.dll] <kingsoft Antivirus><2004, 7, 28, 1>
[c:\KAV6\SvcTimer.DLL] <Kingsoft><2004.4.29.79>
[c:\KAV6\KavComm.dll] <Kingsoft Corporation><2003, 11, 12, 66>
[c:\KAV6\RpcBrge.DLL] <kingsoft><2003, 11, 12, 64>
[c:\KAV6\KWatchFn2.dll] <kingsoft Corporation><2004, 8, 24, 25>
[c:\KAV6\KAEPlat.DLL] <Kingsoft Corp.><2004, 8, 18, 48>
[c:\KAV6\KAEMem.DAT] <Kingsoft><2004, 8, 18, 10>
[c:\KAV6\KAVUtils.dll] <Kingsoft Corp><2004, 2, 12, 69>
[c:\KAV6\KAVDlg.DLL] <><2004.7.20.81>
[c:\KAV6\KAVLogFn.dll] <N/A><2003, 11, 26, 16>
[PID: 236][C:\WINDOWS\SOUNDMAN.EXE] <Realtek Semiconductor Corp.><5.1.0.27>
[c:\KAV6\KMailFun.dll] <Kingsoft Co., Ltd><2005, 4, 28, 227>
[PID: 252][C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe] <ATI Technologies, Inc.><6.14.10.5090>
[C:\Program Files\ATI Technologies\ATI Control

gwgw - 2005-11-22 18:24:00

Panel\atipdsxx.dll] <ATI Technologies, Inc.><6.14.10.5090>
[C:\PROGRAM FILES\ATI TECHNOLOGIES\ATI CONTROL PANEL\ATRPUIXX.CHS] <ATI Technologies, Inc.><6.14.10.5090>
[C:\Program Files\ATI Technologies\ATI Control Panel\atipdxxx.dll] <ATI Technologies, Inc.><6.14.10.5090>
[c:\KAV6\KMailFun.dll] <Kingsoft Co., Ltd><2005, 4, 28, 227>
[PID: 264][C:\Program Files\Common Files\Real\Update_OB\realsched.exe] <RealNetworks, Inc.><0.1.0.3018>
[c:\KAV6\KMailFun.dll] <Kingsoft Co., Ltd><2005, 4, 28, 227>
[PID: 332][C:\KAV6\KpopMon.EXE] <N/A><2004, 2, 2, 31>
[C:\KAV6\KAVMLM.DLL] <Kingsoft Corporation><2003.11.12.10>
[c:\KAV6\KMailFun.dll] <Kingsoft Co., Ltd><2005, 4, 28, 227>
[PID: 340][c:\KAV6\KWatchUI.EXE] <><2004.1.6.119>
[c:\KAV6\kavcomm.dll] <Kingsoft Corporation><2003, 11, 12, 66>
[c:\KAV6\kavdlg.dll] <><2004.7.20.81>
[c:\KAV6\KAVMLM.DLL] <Kingsoft Corporation><2003.11.12.10>
[c:\KAV6\RpcBrge.DLL] <kingsoft><2003, 11, 12, 64>
[c:\KAV6\KMailFun.dll] <Kingsoft Co., Ltd><2005, 4, 28, 227>
[PID: 364][C:\KAV6\KAVPFW.EXE] <Kingsoft Corporation><2004, 8, 16, 295>
[C:\KAV6\KAVMLM.DLL] <Kingsoft Corporation><2003.11.12.10>
[C:\KAV6\PFWScanC.dll] <KingSoft><2002, 4, 12, 3>
[C:\KAV6\KAMsgBox.dll] <><2002.9.27.30>
[C:\KAV6\NetShare.dll] <Kingsoft Antivirus><2004, 2, 20, 67>
[C:\KAV6\KAEPlat.DLL] <Kingsoft Corp.><2004, 8, 18, 48>
[C:\KAV6\KAEMem.DAT] <Kingsoft><2004, 8, 18, 10>
[C:\KAV6\KAEQSCAN.DLL] <Kingsoft Corp><2004, 3, 26, 69>
[c:\KAV6\KMailFun.dll] <Kingsoft Co., Ltd><2005, 4, 28, 227>
[C:\KAV6\KAVLogFn.dll] <N/A><2003, 11, 26, 16>
[PID: 376][C:\WINDOWS\System32\ctfmon.exe] <Microsoft Corporation><5.1.2600.1106 (xpsp1.020828-1920)>
[c:\KAV6\KMailFun.dll] <Kingsoft Co., Ltd><2005, 4, 28, 227>
[PID: 1252][c:\KAV6\MailMon.EXE] <Kingsoft Co., Ltd><2004, 2, 6, 245>
[c:\KAV6\KMFilter.DLL] <N/A><2004, 3, 1, 37>
[c:\KAV6\parse822.dll] <Quiksoft Corporation><2, 0, 0, 9>
[c:\KAV6\KAVLogFn.dll] <N/A><2003, 11, 26, 16>
[c:\KAV6\KAVMLM.DLL] <Kingsoft Corporation><2003.11.12.10>
[c:\KAV6\KAMsgBox.DLL] <><2002.9.27.30>
[c:\KAV6\KAVComm.dll] <Kingsoft Corporation><2003, 11, 12, 66>
[c:\KAV6\RpcBrge.DLL] <kingsoft><2003, 11, 12, 64>
[c:\KAV6\KAVIPC.DLL] <Kingsoft Corp.><2002, 3, 29, 8>
[c:\KAV6\KAVDlg.DLL] <><2004.7.20.81>
[c:\KAV6\KAECall.DLL] <Kingsoft Corporation><2003, 11, 14, 66>
[c:\KAV6\KAEScan.DLL] <Kingsoft Corp.><2003, 5, 24, 36>
[c:\KAV6\KAEPlat.DLL] <Kingsoft Corp.><2004, 8, 18, 48>
[c:\KAV6\KAEMem.DAT] <Kingsoft><2004, 8, 18, 10>
[c:\KAV6\KMailFun.dll] <Kingsoft Co., Ltd><2005, 4, 28, 227>
[PID: 1128][c:\KAV6\KAVPlus.EXE] <N/A><2004, 3, 3, 71>
[c:\KAV6\KMailFun.dll] <Kingsoft Co., Ltd><2005, 4, 28, 227>
[PID: 404][C:\WINDOWS\NOTEPAD.EXE] <Microsoft Corporation><5.1.2600.0 (xpclient.010817-1148)>
[c:\KAV6\KMailFun.dll] <Kingsoft Co., Ltd><2005, 4, 28, 227>
[PID: 444][D:\Program Files\IEscan.exe] <N/A><N/A>
[C:\DOCUME~1\hy\LOCALS~1\Temp\E_80003\krnln.fnr] <N/A><1, 0, 0, 1>
[c:\KAV6\KMailFun.dll] <Kingsoft Co., Ltd><2005, 4, 28, 227>
[C:\DOCUME~1\hy\LOCALS~1\Temp\E_80003\iext.fnr] <N/A><1, 0, 0, 1>
[C:\DOCUME~1\hy\LOCALS~1\Temp\E_80003\iext2.fne] <N/A><1, 0, 0, 1>
[PID: 1716][D:\SREng.exe] <Smallfrogs Studio><1.1.0.269>
[c:\KAV6\KMailFun.dll] <Kingsoft Co., Ltd><2005, 4, 28, 227>

==================================
文件关联
.TXT Error. [NOTEPAD.EXE %1]
.EXE OK. ["%1" %*]
.COM OK. ["%1" %*]
.PIF OK. ["%1" %*]
.REG OK. [regedit.exe "%1"]
.BAT OK. ["%1" %*]
.SCR OK. ["%1" /S]
.CHM OK. ["C:\WINDOWS\hh.exe" %1]
.HLP OK. [C:\WINDOWS\System32\winhlp32.exe %1]
.INI Error. [notepad.exe %1]
.INF OK. [C:\WINDOWS\System32\NOTEPAD.EXE %1]

==================================

gwgw - 2005-11-22 18:24:00

这是hj的扫描：HijackThis_815汉化版扫描日志 V1.99.1
保存于 18:15:14, 日期 2005-11-22
操作系统： Windows XP SP1 (WinNT 5.01.2600)
浏览器： Internet Explorer v6.00 SP1 (6.00.2800.1106)

当前运行的进程：
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\System32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
c:\KAV6\KAVSvc.EXE
C:\WINDOWS\SOUNDMAN.EXE
C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\KAV6\KpopMon.EXE
c:\KAV6\KWatchUI.EXE
C:\KAV6\KAVPFW.EXE
C:\WINDOWS\System32\ctfmon.exe
c:\KAV6\MailMon.EXE
c:\KAV6\KAVPlus.EXE
C:\WINDOWS\NOTEPAD.EXE
D:\Program Files\IEscan.exe
D:\4842302005817230232\HijackThis1991zww.exe

R3 - 默认的URLSearchHook丢失。用HijackThis修复
O1 - Hosts: .
O1 - Hosts: .
O1 - Hosts: .
O1 - Hosts: .
O1 - Hosts: .
O1 - Hosts: .
O1 - Hosts: .
O1 - Hosts: .
O1 - Hosts: .
O1 - Hosts: .
O1 - Hosts: .
O1 - Hosts: .
O1 - Hosts: .
O1 - Hosts: .
O1 - Hosts: .
O1 - Hosts: .
O1 - Hosts: .
O1 - Hosts: .
O1 - Hosts: .
O1 - Hosts: .
O2 - BHO: KOSIE HelperInternet Explorer Web Content Guard - {1B2F92A1-CDAF-4511-9382-91E3F5CE0880} - C:\Program Files\Kos\KOSIEBar.dll
O2 - BHO: QQIEHelper - {54EBD53A-9BC1-480B-966A-843A333CA162} - D:\Program Files\Tencent\QQ\QQIEHelper.dll
O2 - BHO: 百度搜霸 - {B580CF65-E151-49C3-B73F-70B13FCA8E86} - C:\WINDOWS\DOWNLO~1\BaiDuBar.dll
O4 - 启动项HKLM\\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
O4 - 启动项HKLM\\Run: [PHIME2002ASync] C:\WINDOWS\System32\IME\TINTLGNT\TINTSETP.EXE /SYNC
O4 - 启动项HKLM\\Run: [PHIME2002A] C:\WINDOWS\System32\IME\TINTLGNT\TINTSETP.EXE /IMEName
O4 - 启动项HKLM\\Run: [SoundMan] SOUNDMAN.EXE
O4 - 启动项HKLM\\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - 启动项HKLM\\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - 启动项HKLM\\Run: [KAVRun] c:\KAV6\KAVRun.EXE
O4 - 启动项HKLM\\Run: [Kulansyn] c:\KAV6\Kulansyn.EXE
O4 - 启动项HKLM\\Run: [KpopMon] c:\KAV6\KpopMon.EXE
O4 - 启动项HKLM\\Run: [iDuba Personal FireWall] C:\KAV6\KAVPFW.EXE
O4 - 启动项HKLM\\Run: [UserFaultCheck] %systemroot%\system32\dumprep 0 -u
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\System32\ctfmon.exe
O4 - HKCU\..\Run: [iDuba Personal FireWall] C:\KAV6\KAVPFW.EXE
O4 - Startup: 腾讯QQ.lnk = D:\Program Files\Tencent\QQ\QQ.exe
O8 - IE右键菜单中的新增项目: 添加到QQ自定义面板 - D:\Program Files\Tencent\QQ\AddPanel.htm
O8 - IE右键菜单中的新增项目: 添加到QQ表情 - D:\Program Files\Tencent\QQ\AddEmotion.htm
O8 - IE右键菜单中的新增项目: 用QQ彩信发送该图片 - D:\Program Files\Tencent\QQ\SendMMS.htm
O8 - IE右键菜单中的新增项目: 百度Flash搜索 - res://C:\WINDOWS\DOWNLO~1\BaiDuBar.dll/FLASHSEARCH.HTM
O8 - IE右键菜单中的新增项目: 百度mp3搜索 - res://C:\WINDOWS\DOWNLO~1\BaiDuBar.dll/BAIDUMP3.HTM
O8 - IE右键菜单中的新增项目: 百度信息快递搜索 - res://C:\WINDOWS\DOWNLO~1\BaiDuBar.dll/BAIDUIE.HTM
O8 - IE右键菜单中的新增项目: 百度图片搜索 - res://C:\WINDOWS\DOWNLO~1\BaiDuBar.dll/BAIDUIMG.HTM
O8 - IE右键菜单中的新增项目: 百度搜索 - res://C:\WINDOWS\DOWNLO~1\BaiDuBar.dll/BAIDUSEARCH.HTM
O8 - IE右键菜单中的新增项目: 百度新闻搜索 - res://C:\WINDOWS\DOWNLO~1\BaiDuBar.dll/BAIDUNEWS.HTM
O8 - IE右键菜单中的新增项目: 豪杰超级解霸V8实时播放 - C:\Herosoft\HeroV8\MPURLGET.HTM
O9 - 浏览器额外的按钮: 豪杰超级解霸V8 - {367E0A21-8601-4986-9C9A-153BF5ACA118} - C:\Herosoft\HeroV8\STHSDVD.EXE
O9 - 浏览器额外的“工具”菜单项: 豪杰超级解霸V8 - {367E0A21-8601-4986-9C9A-153BF5ACA118} - C:\Herosoft\HeroV8\STHSDVD.EXE
O9 - 浏览器额外的按钮: 金山卓越 - {8DE0FCD4-5EB5-11D3-AD25-00002100131B} - url:http://www.joyo.com (file missing)
O9 - 浏览器额外的按钮: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
O9 - 浏览器额外的“工具”菜单项: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
O9 - 浏览器额外的按钮: QQ - {c95fe080-8f5d-11d2-a20b-00aa003c157b} - D:\Program Files\Tencent\QQ\QQ.EXE
O9 - 浏览器额外的“工具”菜单项: 腾讯QQ - {c95fe080-8f5d-11d2-a20b-00aa003c157b} - D:\Program Files\Tencent\QQ\QQ.EXE
O9 - 浏览器额外的按钮: (no name) - {DEDEB80D-FA35-45d9-9460-4983E5A8AFE6} - D:\Program Files\Tencent\QQ\QQIEHelper.dll
O9 - 浏览器额外的“工具”菜单项: QQ炫彩工具条设置 - {DEDEB80D-FA35-45d9-9460-4983E5A8AFE6} - D:\Program Files\Tencent\QQ\QQIEHelper.dll
O9 - 浏览器额外的按钮: 金山毒霸网站 - {e1fc9760-7b95-49cd-80b9-8c9e41017b93} - url:http://www.duba.net (file missing)
O9 - 浏览器额外的按钮: 在线查毒 - {f58d36c3-40be-4418-a786-d8fbe3eb3554} - c:\KAV6\kavie.HTM
O15 - “受信任的站点”中添加项: www.cctv.com
O15 - “受信任的站点”中添加项: doswang.liveabc.com.cn
O15 - “受信任的站点”中添加项: www.microstar.com.cn
O15 - “受信任的站点”中添加项: www.hbsdt.com
O15 - “受信任的站点”中添加项: mediastack.vod.inhe.net
O15 - “受信任的站点”中添加项: www.vod.inhe.net
O15 - “受信任的站点”中添加项: bbs.jcrx.com
O15 - “受信任的站点”中添加项: chat.jcrx.com
O15 - “受信任的站点”中添加项: www.jcrx.com
O15 - “受信任的站点”中添加项: www.kpworld.com
O15 - “受信任的站点”中添加项: messenger.microsoft.com
O15 - “受信任的站点”中添加项: office.microsoft.com
O15 - “受信任的站点”中添加项: support.microsoft.com
O15 - “受信任的站点”中添加项: v4.windowsupdate.microsoft.com
O15 - “受信任的站点”中添加项: v5.windowsupdate.microsoft.com
O15 - “受信任的站点”中添加项: www.microsoft.com
O15 - “受信任的站点”中添加项: *.microsoft.com
O15 - “受信任的站点”中添加项: www.inhe.net.cn
O15 - “受信任的站点”中添加项: www.openhe.net
O15 - “受信任的站点”中添加项: breezy.vicp.net
O15 - “受信任的站点”中添加项: *.windowsmedia.com
O16 - DPF: {73E4740C-08EB-4133-896B-8D0A7C9EE3CD} (AxInputControl Class) - https://mybank.icbc.com.cn/icbc/perbank/AxSafeControls.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - file://C:\Herosoft\HeroV8\DVDSkin\defskin\HTML\swflash.cab
O23 - NT 服务: Ati HotKey Poller - Unknown owner - C:\WINDOWS\System32\Ati2evxx.exe
O23 - NT 服务: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - NT 服务: Kingsoft AntiVirus Service (KAVSvc) - kingsoft Antivirus - c:\KAV6\KAVSvc.EXE

gwgw - 2005-11-22 18:26:00

麻烦给看看还有问题吗？我以前的症状在第一页里说明了！还有我sreng里文件关联有2处错误！是不是要恢复一下？文件关联
.TXT Error. [NOTEPAD.EXE %1]
.EXE OK. ["%1" %*]
.COM OK. ["%1" %*]
.PIF OK. ["%1" %*]
.REG OK. [regedit.exe "%1"]
.BAT OK. ["%1" %*]
.SCR OK. ["%1" /S]
.CHM OK. ["C:\WINDOWS\hh.exe" %1]
.HLP OK. [C:\WINDOWS\System32\winhlp32.exe %1]
.INI Error. [notepad.exe %1]
.INF OK. [C:\WINDOWS\System32\NOTEPAD.EXE %1]

飞跃迷离 - 2005-11-22 19:04:00

请关闭所有IE界面，重新使用HijackThis扫描一次，选中下面建议修复的项目，让HijackThis修复，修复前请允许HijackThis保留备份。（如果楼主知道是安全的可以不必勾选）
R3 - 默认的URLSearchHook丢失。用HijackThis修复
所有01项
所有15项（如果是您设置的就不必修复）

然后用SREng修复文件关联

gwgw - 2005-11-22 19:35:00

我以前没设置什么！是不是就是把所有的01 15 项修复，文件关联也修复就可以了吗？那么我之前的那个问题就算解决了吗/我被弹出不同网站弄怕了

飞跃迷离 - 2005-11-22 19:37:00

请先按22楼的建议修复吧。

gwgw - 2005-11-22 19:45:00

修复了这是修复后的HijackThis_815汉化版扫描日志 V1.99.1
保存于 19:39:41, 日期 2005-11-22
操作系统： Windows XP SP1 (WinNT 5.01.2600)
浏览器： Internet Explorer v6.00 SP1 (6.00.2800.1106)

当前运行的进程：
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\System32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
c:\KAV6\KAVSvc.EXE
C:\WINDOWS\SOUNDMAN.EXE
C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
c:\KAV6\KWatchUI.EXE
C:\KAV6\KpopMon.EXE
C:\KAV6\KAVPFW.EXE
C:\WINDOWS\System32\ctfmon.exe
c:\KAV6\MailMon.EXE
c:\KAV6\KAVPlus.EXE
D:\Program Files\IEscan.exe
D:\4842302005817230232\HijackThis1991zww.exe

O2 - BHO: KOSIE HelperInternet Explorer Web Content Guard - {1B2F92A1-CDAF-4511-9382-91E3F5CE0880} - C:\Program Files\Kos\KOSIEBar.dll
O2 - BHO: QQIEHelper - {54EBD53A-9BC1-480B-966A-843A333CA162} - D:\Program Files\Tencent\QQ\QQIEHelper.dll
O2 - BHO: 百度搜霸 - {B580CF65-E151-49C3-B73F-70B13FCA8E86} - C:\WINDOWS\DOWNLO~1\BaiDuBar.dll
O4 - 启动项HKLM\\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
O4 - 启动项HKLM\\Run: [PHIME2002ASync] C:\WINDOWS\System32\IME\TINTLGNT\TINTSETP.EXE /SYNC
O4 - 启动项HKLM\\Run: [PHIME2002A] C:\WINDOWS\System32\IME\TINTLGNT\TINTSETP.EXE /IMEName
O4 - 启动项HKLM\\Run: [SoundMan] SOUNDMAN.EXE
O4 - 启动项HKLM\\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - 启动项HKLM\\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - 启动项HKLM\\Run: [KAVRun] c:\KAV6\KAVRun.EXE
O4 - 启动项HKLM\\Run: [Kulansyn] c:\KAV6\Kulansyn.EXE
O4 - 启动项HKLM\\Run: [KpopMon] c:\KAV6\KpopMon.EXE
O4 - 启动项HKLM\\Run: [iDuba Personal FireWall] C:\KAV6\KAVPFW.EXE
O4 - 启动项HKLM\\Run: [UserFaultCheck] %systemroot%\system32\dumprep 0 -u
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\System32\ctfmon.exe
O4 - HKCU\..\Run: [iDuba Personal FireWall] C:\KAV6\KAVPFW.EXE
O4 - Startup: 腾讯QQ.lnk = D:\Program Files\Tencent\QQ\QQ.exe
O8 - IE右键菜单中的新增项目: 添加到QQ自定义面板 - D:\Program Files\Tencent\QQ\AddPanel.htm
O8 - IE右键菜单中的新增项目: 添加到QQ表情 - D:\Program Files\Tencent\QQ\AddEmotion.htm
O8 - IE右键菜单中的新增项目: 用QQ彩信发送该图片 - D:\Program Files\Tencent\QQ\SendMMS.htm
O8 - IE右键菜单中的新增项目: 百度Flash搜索 - res://C:\WINDOWS\DOWNLO~1\BaiDuBar.dll/FLASHSEARCH.HTM
O8 - IE右键菜单中的新增项目: 百度mp3搜索 - res://C:\WINDOWS\DOWNLO~1\BaiDuBar.dll/BAIDUMP3.HTM
O8 - IE右键菜单中的新增项目: 百度信息快递搜索 - res://C:\WINDOWS\DOWNLO~1\BaiDuBar.dll/BAIDUIE.HTM
O8 - IE右键菜单中的新增项目: 百度图片搜索 - res://C:\WINDOWS\DOWNLO~1\BaiDuBar.dll/BAIDUIMG.HTM
O8 - IE右键菜单中的新增项目: 百度搜索 - res://C:\WINDOWS\DOWNLO~1\BaiDuBar.dll/BAIDUSEARCH.HTM
O8 - IE右键菜单中的新增项目: 百度新闻搜索 - res://C:\WINDOWS\DOWNLO~1\BaiDuBar.dll/BAIDUNEWS.HTM
O8 - IE右键菜单中的新增项目: 豪杰超级解霸V8实时播放 - C:\Herosoft\HeroV8\MPURLGET.HTM
O9 - 浏览器额外的按钮: 豪杰超级解霸V8 - {367E0A21-8601-4986-9C9A-153BF5ACA118} - C:\Herosoft\HeroV8\STHSDVD.EXE
O9 - 浏览器额外的“工具”菜单项: 豪杰超级解霸V8 - {367E0A21-8601-4986-9C9A-153BF5ACA118} - C:\Herosoft\HeroV8\STHSDVD.EXE
O9 - 浏览器额外的按钮: 金山卓越 - {8DE0FCD4-5EB5-11D3-AD25-00002100131B} - url:http://www.joyo.com (file missing)
O9 - 浏览器额外的按钮: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
O9 - 浏览器额外的“工具”菜单项: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
O9 - 浏览器额外的按钮: QQ - {c95fe080-8f5d-11d2-a20b-00aa003c157b} - D:\Program Files\Tencent\QQ\QQ.EXE
O9 - 浏览器额外的“工具”菜单项: 腾讯QQ - {c95fe080-8f5d-11d2-a20b-00aa003c157b} - D:\Program Files\Tencent\QQ\QQ.EXE
O9 - 浏览器额外的按钮: (no name) - {DEDEB80D-FA35-45d9-9460-4983E5A8AFE6} - D:\Program Files\Tencent\QQ\QQIEHelper.dll
O9 - 浏览器额外的“工具”菜单项: QQ炫彩工具条设置 - {DEDEB80D-FA35-45d9-9460-4983E5A8AFE6} - D:\Program Files\Tencent\QQ\QQIEHelper.dll
O9 - 浏览器额外的按钮: 金山毒霸网站 - {e1fc9760-7b95-49cd-80b9-8c9e41017b93} - url:http://www.duba.net (file missing)
O9 - 浏览器额外的按钮: 在线查毒 - {f58d36c3-40be-4418-a786-d8fbe3eb3554} - c:\KAV6\kavie.HTM
O16 - DPF: {73E4740C-08EB-4133-896B-8D0A7C9EE3CD} (AxInputControl Class) - https://mybank.icbc.com.cn/icbc/perbank/AxSafeControls.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - file://C:\Herosoft\HeroV8\DVDSkin\defskin\HTML\swflash.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{D0C5B574-869E-46AB-B312-908853D5D9B3}: NameServer = 202.99.160.68 202.99.166.4
O18 - 列举现有的协议: about - {3050F406-98B5-11CF-BB82-00AA00BDCE0B} - C:\WINDOWS\System32\mshtml.dll
O18 - 列举现有的协议: cdl - {3DD53D40-7B8B-11D0-B013-00AA0059CE02} - C:\WINDOWS\system32\urlmon.dll
O18 - 列举现有的协议: dvd - {12D51199-0DB5-46FE-A120-47A3D7D937CC} - C:\WINDOWS\System32\msvidctl.dll
O18 - 列举现有的协议: file - {79EAC9E7-BAF9-11CE-8C82-00AA004BA90B} - C:\WINDOWS\system32\urlmon.dll
O18 - 列举现有的协议: ftp - {79EAC9E3-BAF9-11CE-8C82-00AA004BA90B} - C:\WINDOWS\system32\urlmon.dll
O18 - 列举现有的协议: gopher - {79EAC9E4-BAF9-11CE-8C82-00AA004BA90B} - C:\WINDOWS\system32\urlmon.dll
O18 - 列举现有的协议: http - {79EAC9E2-BAF9-11CE-8C82-00AA004BA90B} - C:\WINDOWS\system32\urlmon.dll
O18 - 列举现有的协议: https - {79EAC9E5-BAF9-11CE-8C82-00AA004BA90B} - C:\WINDOWS\system32\urlmon.dll
O18 - 列举现有的协议: ipp - (no CLSID) - (no file)
O18 - 列举现有的协议: its - {9D148291-B9C8-11D0-A4CC-0000F80149F6} - C:\WINDOWS\System32\itss.dll
O18 - 列举现有的协议: javascript - {3050F3B2-98B5-11CF-BB82-00AA00BDCE0B} - C:\WINDOWS\System32\mshtml.dll
O18 - 列举现有的协议: local - {79EAC9E7-BAF9-11CE-8C82-00AA004BA90B} - C:\WINDOWS\system32\urlmon.dll
O18 - 列举现有的协议: mailto - {3050F3DA-98B5-11CF-BB82-00AA00BDCE0B} - C:\WINDOWS\System32\mshtml.dll
O18 - 列举现有的协议: mhtml - {05300401-BCBC-11D0-85E3-00C04FD85AB4} - C:\WINDOWS\System32\inetcomm.dll
O18 - 列举现有的协议: mk - {79EAC9E6-BAF9-11CE-8C82-00AA004BA90B} - C:\WINDOWS\system32\urlmon.dll
O18 - 列举现有的协议: ms-its - {9D148291-B9C8-11D0-A4CC-0000F80149F6} - C:\WINDOWS\System32\itss.dll
O18 - 列举现有的协议: msdaipp - (no CLSID) - (no file)
O18 - 列举现有的协议: res - {3050F3BC-98B5-11CF-BB82-00AA00BDCE0B} - C:\WINDOWS\System32\mshtml.dll
O18 - 列举现有的协议: sysimage - {76E67A63-06E9-11D2-A840-006008059382} - C:\WINDOWS\System32\mshtml.dll
O18 - 列举现有的协议: tv - {CBD30858-AF45-11D2-B6D6-00C04FBBDE6E} - C:\WINDOWS\System32\msvidctl.dll
O18 - 列举现有的协议: vbscript - {3050F3B2-98B5-11CF-BB82-00AA00BDCE0B} - C:\WINDOWS\System32\mshtml.dll
O18 - 列举现有的协议: vnd.ms.radio - {3DA2AA3B-3D96-11D2-9BD2-204C4F4F5020} - C:\WINDOWS\System32\msdxm.ocx
O18 - 列举现有的协议: wia - {13F3EA8B-91D7-4F0A-AD76-D2853AC8BECE} - C:\WINDOWS\System32\wiascr.dll
O23 - NT 服务: Ati HotKey Poller - Unknown owner - C:\WINDOWS\System32\Ati2evxx.exe
O23 - NT 服务: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - NT 服务: Kingsoft AntiVirus Service (KAVSvc) - kingsoft Antivirus - c:\KAV6\KAVSvc.EXE

您再看看！还有就是修复后hj文件夹里多了backups文件夹！这是什么？是备份的吗？先感谢几位斑竹了！我在观察看看还弹不弹

瑞星卡卡安全论坛