www.66169.com 这个网站不从没有上过，只是在昨天登陆某个网站后，每次重启后主页都变成www.66169.com ，用白猫清理工，重启后已然无法改变主页地址。请专家帮助解决。

【回复“marcokoko”的帖子】
您好,请用hijackthis1.99.1版把日志扫描贴上来.

引用:

【花落花又开的贴子】【回复“marcokoko”的帖子】 您好,请用hijackthis1.99.1版把日志扫描贴上来. ...........................

你好，这是我的日志文件
－－－－－－－－－－－－－－－－－－－－－－－－－－－－－－－－－－－－－－－－
HijackThis_zww汉化版扫描日志 V1.99.1
保存于      14:37:00, 日期 2005-8-3
操作系统：  Windows XP SP1 (WinNT 5.01.2600)
浏览器：    Internet Explorer v6.00 SP1 (6.00.2800.1106)

当前运行的进程：         
D:\WINDOWS\System32\smss.exe
D:\WINDOWS\system32\winlogon.exe
D:\WINDOWS\system32\services.exe
D:\WINDOWS\system32\lsass.exe
D:\WINDOWS\system32\svchost.exe
D:\WINDOWS\System32\svchost.exe
D:\PROGRAM FILES\RISING\RAV\Ravmond.exe
D:\WINDOWS\system32\spoolsv.exe
D:\WINDOWS\Explorer.EXE
D:\Program Files\Common Files\Real\Update_OB\realsched.exe
D:\PROGRA~1\RISING\RAV\RAVTIMER.EXE
D:\WINDOWS\System32\ctfmon.exe
D:\PROGRAM FILES\RISING\RAV\CCENTER.EXE
E:\Program Files\浩方对战平台\GameClient.exe
C:\TT\TTraveler.exe
D:\Program Files\WinRAR\WinRAR.exe
D:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\Rar$EX00.892\HijackThis1991zww.exe

O1 - Hosts: 210.74.232.207 www.zhao114.com
O1 - Hosts: 210.74.232.207 zhao114.com
O1 - Hosts: 210.74.232.207 www.zhao114.com
O1 - Hosts: 210.74.232.207 zhao114.com
O1 - Hosts: 210.74.232.207 www.cnww.net
O1 - Hosts: 210.74.232.207 cnww.net
O1 - Hosts: 210.74.232.207 www.zhao123.com
O1 - Hosts: 210.74.232.207 zhao123.com
O1 - Hosts: 210.74.232.207 www.4399.com
O1 - Hosts: 210.74.232.207 4399.com
O1 - Hosts: 210.74.232.207 www.chinagames.net
O1 - Hosts: 210.74.232.207 chinagames.net
O1 - Hosts: 210.74.232.207 www.tiexue.net
O1 - Hosts: 210.74.232.207 tiexue.net
O1 - Hosts: 210.74.232.207 www.qq163.com
O1 - Hosts: 210.74.232.207 qq163.com
O1 - Hosts: 210.74.232.207 www.tt67.com
O1 - Hosts: 210.74.232.207 tt67.com
O1 - Hosts: 210.74.232.207 www.chinamp3.com
O1 - Hosts: 210.74.232.207 chinamp3.com
O1 - Hosts: 210.74.232.207 www.pg168.com
O1 - Hosts: 210.74.232.207 pg168.com
O1 - Hosts: 210.74.232.207 www.yymp3.com
O1 - Hosts: 210.74.232.207 yymp3.com
O1 - Hosts: 210.74.232.207 www.yy138.com
O1 - Hosts: 210.74.232.207 yy138.com
O1 - Hosts: 210.74.232.207 www.dj99.com
O1 - Hosts: 210.74.232.207 dj99.com
O1 - Hosts: 210.74.232.207 www.sogua.com
O1 - Hosts: 210.74.232.207 sogua.com
O1 - Hosts: 210.74.232.207 www.snsn.net
O1 - Hosts: 210.74.232.207 snsn.net
O1 - Hosts: 210.74.232.207 www.flash8.net
O1 - Hosts: 210.74.232.207 flash8.net
O1 - Hosts: 210.74.232.207 www.mop.com
O1 - Hosts: 210.74.232.207 mop.com
O1 - Hosts: 210.74.232.207 www.tianyaclub.com
O1 - Hosts: 210.74.232.207 tianyaclub.com
O1 - Hosts: 210.74.232.207 www.xici.net
O1 - Hosts: 210.74.232.207 xici.net
O1 - Hosts: 210.74.232.207 www.ucanlove.com
O1 - Hosts: 210.74.232.207 ucanlove.com
O1 - Hosts: 210.74.232.207 www.cmfu.com
O1 - Hosts: 210.74.232.207 cmfu.com
O1 - Hosts: 210.74.232.207 www.21red.net
O1 - Hosts: 210.74.232.207 21red.net
O1 - Hosts: 210.74.232.207 www.pconline.com.cn
O1 - Hosts: 210.74.232.207 pconline.com.cn
O1 - Hosts: 210.74.232.207 www.donews.com
O1 - Hosts: 210.74.232.207 donews.com
O1 - Hosts: 210.74.232.207 www.pcauto.com.cn
O1 - Hosts: 210.74.232.207 pcauto.com.cn
O1 - Hosts: 210.74.232.207 www.265.com
O1 - Hosts: 210.74.232.207 265.com
O1 - Hosts: 210.74.232.207 www.wo99.com
O1 - Hosts: 210.74.232.207 wo99.com
O1 - Hosts: 210.74.232.207 www.familydoctor.com.cn
O1 - Hosts: 210.74.232.207 familydoctor.com.cn
O1 - Hosts: 210.74.232.207 www.flashempire.com
O1 - Hosts: 210.74.232.207 flashempire.com
O1 - Hosts: 210.74.232.207 www.showgood.tv
O1 - Hosts: 210.74.232.207 showgood.tv
O1 - Hosts: 210.74.232.207 www.flashfan.net
O1 - Hosts: 210.74.232.207 flashfan.net
O1 - Hosts: 210.74.232.207 www.long21.net
O1 - Hosts: 210.74.232.207 long21.net
O1 - Hosts: 210.74.232.207 www.sowww.com
O1 - Hosts: 210.74.232.207 sowww.com
O1 - Hosts: 210.74.232.207 www.flashhome.net
O1 - Hosts: 210.74.232.207 flashhome.net
O1 - Hosts: 210.74.232.207 www.cnflash.net
O1 - Hosts: 210.74.232.207 cnflash.net
O1 - Hosts: 210.74.232.207 www.flashsky.com
O1 - Hosts: 210.74.232.207 flashsky.com
O1 - Hosts: 210.74.232.207 www.hunansky.com
O1 - Hosts: 210.74.232.207 hunansky.com
O1 - Hosts: 210.74.232.207 www.52flash.net
O1 - Hosts: 210.74.232.207 52flash.net
O1 - Hosts: 210.74.232.207 www.flashh.com
O1 - Hosts: 210.74.232.207 flashh.com
O1 - Hosts: 210.74.232.207 www.flashsun.com
O1 - Hosts: 210.74.232.207 flashsun.com
O1 - Hosts: 210.74.232.207 www.7k7k.com
O1 - Hosts: 210.74.232.207 7k7k.com
O1 - Hosts: 210.74.232.207 www.xuanxuan.com
O1 - Hosts: 210.74.232.207 xuanxuan.com
O1 - Hosts: 210.74.232.207 www.flash88.net
O1 - Hosts: 210.74.232.207 flash88.net
O1 - Hosts: 210.74.232.207 www.91flash.com
O1 - Hosts: 210.74.232.207 91flash.com
O1 - Hosts: 210.74.232.207 www.doingflash.com
O1 - Hosts: 210.74.232.207 doingflash.com
O1 - Hosts: 210.74.232.207 www.5see.com
O1 - Hosts: 210.74.232.207 5see.com
O1 - Hosts: 210.74.232.207 www.skyhits.com
O1 - Hosts: 210.74.232.207 skyhits.com
O1 - Hosts: 210.74.232.207 www.ting78.com
O1 - Hosts: 210.74.232.207 ting78.com
O1 - Hosts: 210.74.232.207 www.91.com
O1 - Hosts: 210.74.232.207 91.com
O1 - Hosts: 210.74.232.207 www.flashchina.net
O3 - IE工具栏增项: 电台(&R) - {8E718888-423F-11D2-876E-00A0C9082467} - D:\WINDOWS\System32\msdxm.ocx
O3 - IE工具栏增项: 卡卡安全助手 - {DB9ECD4F-FB8F-4311-B3CE-90B976C2707C} - D:\WINDOWS\System32\KakaTool.dll
O4 - 启动项HKLM\\Run: [ExFilter] Rundll32.exe "D:\PROGRA~1\CNNIC\Cdn\cdnspie.dll,ExecFilter solo"
O4 - 启动项HKLM\\Run: [MsWind] D:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\Rar$EX01.359\MsWind.exe
O4 - 启动项HKLM\\Run: [TkBellExe] "D:\Program Files\Common Files\Real\Update_OB\realsched.exe"  -osboot
O4 - 启动项HKLM\\Run: [RavTimer] D:\PROGRA~1\RISING\RAV\RAVTIMER.EXE
O4 - 启动项HKLM\\Run: [RavMon] D:\PROGRA~1\RISING\RAV\RAVMON.EXE -SYSTEM
O4 - HKCU\..\Run: [ctfmon.exe] D:\WINDOWS\System32\ctfmon.exe
O4 - HKCU\..\Run: [MsWind] D:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\Rar$EX01.359\MsWind.exe
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O8 - IE右键菜单中的新增项目: &使用迅雷下载 - D:\Program Files\Sandai Technologies Inc\Thunder\geturl.htm
O8 - IE右键菜单中的新增项目: &使用迅雷下载全部链接 - D:\Program Files\Sandai Technologies Inc\Thunder\getAllurl.htm
O9 - 浏览器额外的按钮: 浩方对战平台 - {0A155D3C-68E2-4215-A47A-E800A446447A} - E:\Program Files\浩方对战平台\GameClient.exe
O9 - 浏览器额外的按钮: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - D:\WINDOWS\web\related.htm
O9 - 浏览器额外的“工具”菜单项: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - D:\WINDOWS\web\related.htm
O11 - Options group: [!ANetSpeeder]  NetSpeeder
O17 - HKLM\System\CCS\Services\Tcpip\..\{F4BFCBD7-2199-4567-A021-2133A533F647}: NameServer = 202.99.166.4 202.99.160.68
O20 - Winlogon Notify: igfxcui - D:\WINDOWS\SYSTEM32\igfxsrvc.dll
O23 - NT 服务: Rising Process Communication Center (RsCCenter) - rising - D:\PROGRAM FILES\RISING\RAV\CCENTER.EXE
O23 - NT 服务: RsRavMon Service (RsRavMon) - Beijing Rising Technology Co., Ltd. - D:\PROGRAM FILES\RISING\RAV\Ravmond.exe

【回复“marcokoko”的帖子】
修复所有01项,
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present

清空hosts文件:

在win 98里是: C:\Windows\hosts
在win 2000/xp是: C:\Windows\system32\drivers\etc\hosts

HOSTS文件里保存有WINDOWS系统记录的IP地址与域名的对应关系。

有些网页恶意代码会修改这个文件迫使我们访问恶意网页/网站。

删除127.0.0.1 localhost以外的其他所有多余内容

引用:

【花落花又开的贴子】【回复“marcokoko”的帖子】 修复所有01项, O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present 清空hosts文件: 在win 98里是: C:\Windows\hosts 在win 2000/xp是: C:\Windows\system32\drivers\etc\hosts HOSTS文件里保存有WINDOWS系统记录的IP地址与域名的对应关系。 有些网页恶意代码会修改这个文件迫使我们访问恶意网页/网站。 删除127.0.0.1 localhost以外的其他所有多余内容 ...........................

再打扰您一下，我在SYSTEM32/drives 中，找不到这个文件\etc\hosts

【回复“marcokoko”的帖子】
忽略.

请问您的问题解决了吗?

一看hosts里面就有问题
清空
推荐安装winpatrol
能够监控 自启动 hosts ie插件 等等

解决了，感谢您的热心帮助

我的情况和他一样，不过杀毒软件每在我打开任何一窗口的时候都报告有木马程序……
C:\Windows\system32\drivers\etc\hosts我也删了，没起作用……

以下是我扫描到的日志

HijackThis_815汉化版扫描日志 V1.99.1
保存于      15:42:30, 日期 2006-11-10
操作系统：  Windows XP SP2 (WinNT 5.01.2600)
浏览器：    Internet Explorer v6.00 SP2 (6.00.2900.2180)

当前运行的进程：         
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\RUNDLL32.EXE
E:\Kaspersky Lab\Kaspersky Internet Security 6.0\avp.exe
C:\PROGRA~1\Yahoo!\ASSIST~1\YLive.exe
C:\PROGRA~1\Yahoo!\Assistant\yassistse.exe
E:\Kaspersky Lab\Kaspersky Internet Security 6.0\avp.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Internet Explorer\iexplore.exe
E:\WinRAR\WinRAR.exe
C:\WINDOWS\TEMP\Rar$EX00.625\HijackThis1991zww.exe

O2 - BHO: (no name) - Script - (no file)
O2 - BHO: yPhtb - {33BBE430-0E42-4f12-B075-8D21ACB10DCB} - C:\Program Files\Yahoo!\Assistant\Assist\yphtb.dll
O2 - BHO: Anti Fish - {38928D50-8A48-44C2-945F-D2F23F771410} - C:\Program Files\Yahoo!\Assistant\Assist\yAngling.dll
O2 - BHO: (no name) - {3D898C55-74CC-4B7C-B5F1-45913F368389} - C:\WINDOWS\system32\Comn32.dll
O2 - BHO: YDragSearch - {62EED7C6-9F02-42f9-B634-98E2899E147B} - C:\PROGRA~1\Yahoo!\ASSIST~1\Assist\YDRAGS~1.DLL
O2 - BHO: AssistHelper - {FE3ECAE7-0A37-4506-8A7D-3CC9A04D2CA8} - C:\Program Files\Yahoo!\Assistant\Assist\yassist.dll
O3 - IE工具栏增项: 雅虎助手 - {406F94F0-504F-4A40-8DFD-58B0666ABEBD} - C:\Program Files\Yahoo!\Assistant\Assist\yasbar.dll
O4 - 启动项HKLM\\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - 启动项HKLM\\Run: [nwiz] nwiz.exe /install
O4 - 启动项HKLM\\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - 启动项HKLM\\Run: [BigDogPath] C:\WINDOWS\VM_STI.EXE VIMICRO USB PC Camera
O4 - 启动项HKLM\\Run: [kis] "E:\Kaspersky Lab\Kaspersky Internet Security 6.0\avp.exe"
O4 - 启动项HKLM\\Run: [MsWind] D:\白猫清理工\baimao\kenqqcrk\MsWind.exe
O4 - 启动项HKLM\\Run: [QiQi] rem C:\WINDOWS\system32\QiQi_.exe
O4 - 启动项HKLM\\Run: [YLive.exe] C:\PROGRA~1\Yahoo!\ASSIST~1\YLive.exe
O4 - 启动项HKLM\\Run: [yassistse] "C:\PROGRA~1\Yahoo!\Assistant\yassistse.exe"
O4 - 启动项HKLM\\Run: [QiQi.exe] C:\WINDOWS\system32\ol2272.exe
O4 - HKCU\..\Run: [MsWind] D:\白猫清理工\baimao\kenqqcrk\MsWind.exe
O4 - HKCU\..\Run: [QiQi] rem C:\WINDOWS\system32\QiQi_.exe
O4 - HKCU\..\Run: [QiQi.exe] C:\WINDOWS\system32\ol2272.exe
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O8 - IE右键菜单中的新增项目: 加入POCO网摘(&K) - http://my.poco.cn/fav/rightClick.php
O8 - IE右键菜单中的新增项目: 我的POCO网摘(&O) - http://my.poco.cn/fav/open_myfav.php
O8 - IE右键菜单中的新增项目: 添加到雅虎订阅(&Y) - res://C:\Program Files\Yahoo!\Assistant\Assist\yrss.dll/YRSSMENUEXT
O8 - IE右键菜单中的新增项目: 雅虎搜索 - res://C:\Program Files\Yahoo!\Assistant\Assist\yasbar.dll/203
O9 - 浏览器额外的按钮: 浩方对战平台 - {0A155D3C-68E2-4215-A47A-E800A446447A} - E:\浩方对战平台\GameClient.exe
O9 - 浏览器额外的按钮: Web反病毒保护 - {1F460357-8A94-4D71-9CA3-AA4ACF32ED8E} - E:\Kaspersky Lab\Kaspersky Internet Security 6.0\scieplugin.dll
O9 - 浏览器额外的按钮: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - 浏览器额外的“工具”菜单项: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O20 - AppInit_DLLs: E:\KASPER~1\KASPER~1.0\adialhk.dll
O20 - Winlogon Notify: klogon - C:\WINDOWS\system32\klogon.dll
O23 - NT 服务: 卡巴斯基互联网安全套装 6.0 (AVP) - Unknown owner - E:\Kaspersky Lab\Kaspersky Internet Security 6.0\avp.exe" -r (file missing)
O23 - NT 服务: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe