我朋友的一台机子被www.163wz.net劫持了，一打开IE就弹出这个网站，打开其它很多网站有的上不了，有的自动转到www.163wz.net上面来。我装了NOD32并升到最新查杀无效、这王八网站一打开就会弹出个www.163wz.net/163.asp来。被NOD32拦截说是木马。然后再进www.avl.com.cn这个网站就进不了。后来发现hosts文件被改成系统、隐藏、只读属性。删掉后可以上www.avl.com.cn了，但重启之后又回复原状。还是上不了。
、、、、我那朋友是个猪头MM，她只要上这个网站看片子，其它一概不理、、、各们大侠救救我吧，我被她緾得很头痛，都不用上班了

请用最新版Hijackthis1.99.1扫描一个log贴上来。

hijackThis下载地址见置顶贴
[必读]本版说明及常用小软件下载
http://forum.ikaka.com/topic.asp?board=67&artid=5188931

hijackthis使用方法请参考——瑞星HijackThis专题
http://it.rising.com.cn/newSite/Channels/anti_virus/Antivirus_Faq/TopicExplorerPagePackage/hijackthis.htm

运行HijackThis，先点[扫描系统并保存日志]或[Do a system scan and save a logfile]按钮，扫描完成后，LOG将会在自动弹出的记事本中显示，再从记事本里复制/粘贴到贴子里。如果LOG比较长，一贴发不完，你可以分成几个部分发在回贴里。

Logfile of HijackThis v1.99.1
Scan saved at 18:08:50, on 2005/08/12
Platform: Windows 2000 SP4 (WinNT 5.00.2195)
MSIE: Internet Explorer v6.00 (6.00.2600.0000)

Running processes:
C:\WINNT\System32\smss.exe
C:\WINNT\system32\winlogon.exe
C:\WINNT\system32\services.exe
C:\WINNT\system32\lsass.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\system32\spoolsv.exe
C:\Program Files\Symantec\pcAnywhere\awhost32.exe
C:\WINNT\System32\svchost.exe
C:\Program Files\Eset\nod32krn.exe
C:\WINNT\system32\regsvc.exe
C:\WINNT\system32\MSTask.exe
C:\WINNT\System32\WBEM\WinMgmt.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\Explorer.EXE
C:\WINNT\system32\conime.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\Eset\nod32kui.exe
C:\WINNT\system32\internat.exe
D:\Phone\Skype.exe
C:\Program Files\Microsoft Office\Office\EXCEL.EXE
D:\穝戈Ж\и瓜\Tencent\QQ\hongmei.exe
D:\穝戈Ж\и瓜\Tencent\QQ\TIMPlatform.exe
D:\穝戈Ж\и瓜\Tencent\QQ\hongmei.exe
C:\Program Files\Outlook Express\msimn.exe
C:\Program Files\Internet Explorer\iexplore.exe
D:\pc224\иゅン\繟柳瓜\winlinez.exe
D:\pc224\иゅン\繟柳瓜\winlinez.exe
\192.168.21.45\tools\Mysoft\hijackthis EN\HijackThis.exe

O1 - Hosts: 210.74.232.207 www.zhao114.com
O1 - Hosts: 210.74.232.207 zhao114.com
O1 - Hosts: 210.74.232.207 www.zhao114.com
O1 - Hosts: 210.74.232.207 zhao114.com
O1 - Hosts: 210.74.232.207 www.cnww.net
O1 - Hosts: 210.74.232.207 cnww.net
O1 - Hosts: 210.74.232.207 www.zhao123.com
O1 - Hosts: 210.74.232.207 zhao123.com
O1 - Hosts: 210.74.232.207 www.4399.com
O1 - Hosts: 210.74.232.207 4399.com
O1 - Hosts: 210.74.232.207 www.chinagames.net
O1 - Hosts: 210.74.232.207 chinagames.net
O1 - Hosts: 210.74.232.207 www.tiexue.net
O1 - Hosts: 210.74.232.207 tiexue.net
O1 - Hosts: 210.74.232.207 www.qq163.com
O1 - Hosts: 210.74.232.207 qq163.com
O1 - Hosts: 210.74.232.207 www.tt67.com
O1 - Hosts: 210.74.232.207 tt67.com
O1 - Hosts: 210.74.232.207 www.chinamp3.com
O1 - Hosts: 210.74.232.207 chinamp3.com
O1 - Hosts: 210.74.232.207 www.pg168.com
O1 - Hosts: 210.74.232.207 pg168.com
O1 - Hosts: 210.74.232.207 www.yymp3.com
O1 - Hosts: 210.74.232.207 yymp3.com
O1 - Hosts: 210.74.232.207 www.yy138.com
O1 - Hosts: 210.74.232.207 yy138.com
O1 - Hosts: 210.74.232.207 www.dj99.com
O1 - Hosts: 210.74.232.207 dj99.com
O1 - Hosts: 210.74.232.207 www.sogua.com
O1 - Hosts: 210.74.232.207 sogua.com
O1 - Hosts: 210.74.232.207 www.snsn.net
O1 - Hosts: 210.74.232.207 snsn.net
O1 - Hosts: 210.74.232.207 www.flash8.net
O1 - Hosts: 210.74.232.207 flash8.net
O1 - Hosts: 210.74.232.207 www.mop.com
O1 - Hosts: 210.74.232.207 mop.com
O1 - Hosts: 210.74.232.207 www.tianyaclub.com
O1 - Hosts: 210.74.232.207 tianyaclub.com
O1 - Hosts: 210.74.232.207 www.xici.net
O1 - Hosts: 210.74.232.207 xici.net
O1 - Hosts: 210.74.232.207 www.ucanlove.com
O1 - Hosts: 210.74.232.207 ucanlove.com
O1 - Hosts: 210.74.232.207 www.cmfu.com
O1 - Hosts: 210.74.232.207 cmfu.com
O1 - Hosts: 210.74.232.207 www.21red.net
O1 - Hosts: 210.74.232.207 21red.net
O1 - Hosts: 210.74.232.207 www.pconline.com.cn
O1 - Hosts: 210.74.232.207 pconline.com.cn
O1 - Hosts: 210.74.232.207 www.donews.com
O1 - Hosts: 210.74.232.207 donews.com
O1 - Hosts: 210.74.232.207 www.pcauto.com.cn
O1 - Hosts: 210.74.232.207 pcauto.com.cn
O1 - Hosts: 210.74.232.207 www.265.com
O1 - Hosts: 210.74.232.207 265.com
O1 - Hosts: 210.74.232.207 www.wo99.com
O1 - Hosts: 210.74.232.207 wo99.com
O1 - Hosts: 210.74.232.207 www.familydoctor.com.cn
O1 - Hosts: 210.74.232.207 familydoctor.com.cn
O1 - Hosts: 210.74.232.207 www.flashempire.com
O1 - Hosts: 210.74.232.207 flashempire.com
O1 - Hosts: 210.74.232.207 www.showgood.tv
O1 - Hosts: 210.74.232.207 showgood.tv
O1 - Hosts: 210.74.232.207 www.flashfan.net
O1 - Hosts: 210.74.232.207 flashfan.net
O1 - Hosts: 210.74.232.207 www.long21.net
O1 - Hosts: 210.74.232.207 long21.net
O1 - Hosts: 210.74.232.207 www.sowww.com
O1 - Hosts: 210.74.232.207 sowww.com
O1 - Hosts: 210.74.232.207 www.flashhome.net
O1 - Hosts: 210.74.232.207 flashhome.net
O1 - Hosts: 210.74.232.207 www.cnflash.net
O1 - Hosts: 210.74.232.207 cnflash.net
O1 - Hosts: 210.74.232.207 www.flashsky.com
O1 - Hosts: 210.74.232.207 flashsky.com
O1 - Hosts: 210.74.232.207 www.hunansky.com
O1 - Hosts: 210.74.232.207 hunansky.com
O1 - Hosts: 210.74.232.207 www.52flash.net
O1 - Hosts: 210.74.232.207 52flash.net
O1 - Hosts: 210.74.232.207 www.flashh.com
O1 - Hosts: 210.74.232.207 flashh.com
O1 - Hosts: 210.74.232.207 www.flashsun.com
O1 - Hosts: 210.74.232.207 flashsun.com
O1 - Hosts: 210.74.232.207 www.7k7k.com
O1 - Hosts: 210.74.232.207 7k7k.com
O1 - Hosts: 210.74.232.207 www.xuanxuan.com
O1 - Hosts: 210.74.232.207 xuanxuan.com
O1 - Hosts: 210.74.232.207 www.flash88.net
O1 - Hosts: 210.74.232.207 flash88.net
O1 - Hosts: 210.74.232.207 www.91flash.com
O1 - Hosts: 210.74.232.207 91flash.com
O1 - Hosts: 210.74.232.207 www.doingflash.com
O1 - Hosts: 210.74.232.207 doingflash.com
O1 - Hosts: 210.74.232.207 www.5see.com
O1 - Hosts: 210.74.232.207 5see.com
O1 - Hosts: 210.74.232.207 www.skyhits.com
O1 - Hosts: 210.74.232.207 skyhits.com
O1 - Hosts: 210.74.232.207 www.ting78.com
O1 - Hosts: 210.74.232.207 ting78.com
O1 - Hosts: 210.74.232.207 www.91.com
O1 - Hosts: 210.74.232.207 91.com
O1 - Hosts: 210.74.232.207 www.flashchina.net
O3 - Toolbar: @msdxmLC.dll,-1@1028,Μ诀[&R] - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINNT\System32\msdxm.ocx
O4 - HKLM\..\Run: [Synchronization Manager] mobsync.exe /logon
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe"  -osboot
O4 - HKLM\..\Run: [nod32kui] "C:\Program Files\Eset\nod32kui.exe" /WAITSERVICE
O4 - HKCU\..\Run: [Internat.exe] internat.exe
O4 - HKCU\..\Run: [Skype] "D:\Phone\Skype.exe" /nosplash /minimized
O8 - Extra context menu item: 睰QQ﹚竡 - D:\穝戈Ж\и瓜\Tencent\QQ\AddPanel.htm
O8 - Extra context menu item: 睰QQ薄 - D:\穝戈Ж\и瓜\Tencent\QQ\AddEmotion.htm
O8 - Extra context menu item: ノQQ眒獺肚癳赣瓜 - D:\穝戈Ж\и瓜\Tencent\QQ\SendMMS.htm
O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINNT\web\related.htm
O9 - Extra 'Tools' menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINNT\web\related.htm
O9 - Extra button: ㎝獺戈癟いみ - {07020D85-05C6-4027-B5CB-F89F1CA2B352} - \\qxfs\tools\software\pictuer\index.url (file missing) (HKCU)
O14 - IERESET.INF: START_PAGE_URL=http://bbs.qxshoe.com
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: Domain = qxshoe.com
O17 - HKLM\System\CS1\Services\Tcpip\Parameters: Domain = qxshoe.com
O17 - HKLM\System\CS2\Services\Tcpip\Parameters: Domain = qxshoe.com
O20 - Winlogon Notify: PCANotify - C:\WINNT\SYSTEM32\PCANotify.dll
O23 - Service: pcAnywhere Host Service (awhost32) - Symantec Corporation - C:\Program Files\Symantec\pcAnywhere\awhost32.exe
O23 - Service: Logical Disk Manager Administrative Service (dmadmin) - VERITAS Software Corp. - C:\WINNT\System32\dmadmin.exe
O23 - Service: NOD32 Kernel Service (NOD32krn) - Eset  - C:\Program Files\Eset\nod32krn.exe

不好意思，她的系统是繁体版的，中间有些繁体字，现在看上就是乱码了。

【回复“goocai”的帖子】
【回复“goocai”的帖子】
请修复：
所有01项
O14 - IERESET.INF: START_PAGE_URL=http://bbs.qxshoe.com

014是她那个公司的网址，应该没所谓。01已经修复过几次，每次重新启动之后又有了

请用记事打开hosts这个文件
方法是：
开始--》运行...
你使用的是win 2000/xp，请输入(你也可以复制/粘贴过去)：notepad %SystemRoot%\system32\drivers\etc\hosts
点[确定]按钮。
保留包含127.0.0.1的行，把其它行全部删除。
保存修改后，重新启动计算机看看。

我已试过把HOSTS文件都整个删掉，重启之后还是一样，又回来了

【回复“goocai”的帖子】
楼主的日志里还有O1项吗？如果没有，那么该网页是随开机打开吗，如果是的话，请打开HijackThis的“Mixed Tools”，扫描所有的启动项目，然后贴上来。

呵呵，我做了个批处理，把HOSTS去属性后删掉的，然后叫她不行就先运行一下这个批处理，先顶一阵。有什么最新情况明天再向各位大侠禀报，明天再把新的LOG发上来