就是说我的wpa.dbl不能删除对吧！还有我不会用注册表，就是手动找到能删除吗？这么做管用吗？因为这几天我多少时间在家里，还不清楚怎么做能不能解决问题！我先这么操作看看！如果在弹出不同网站，我继续来问！还有我应该修复什么？

好的！等我下班我回家用hj扫描一个上来！我目前先手动在windows里面找到那几个文件删除！当然前面操作和飞跃说的那样去做！然后我在用hj扫描一个上来！您在给看看！看看那些地方还需要删除或者修改的！谢谢

我按照斑竹的做法去做了！把该删的都删掉了！我分别用sreng和hj都扫描了一下！把结果发上来！有点长！请斑竹帮忙再看看恶意程序是不是清除掉了！是不是不再弹出不同网站了？以下是sreng报告：2005-11-22,18:14:34

System Repair Engineer 1.1.0.269
    Windows XP Professional Service Pack 1 - 管理权限用户 - 完整功能

以下内容被选中：
    所有的启动项目（包括注册表、启动文件夹、服务等）
    浏览器加载项
    正在运行的进程（包括进程模块信息）
    文件关联


启动项目
注册表
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
  <ctfmon.exe><C:\WINDOWS\System32\ctfmon.exe>
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
  <iDuba Personal FireWall><C:\KAV6\KAVPFW.EXE>
[HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows]
  <load><>
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
  <IMJPMIG8.1><"C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32>
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
  <PHIME2002ASync><C:\WINDOWS\System32\IME\TINTLGNT\TINTSETP.EXE /SYNC>
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
  <PHIME2002A><C:\WINDOWS\System32\IME\TINTLGNT\TINTSETP.EXE /IMEName>
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
  <SoundMan><SOUNDMAN.EXE>
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
  <ATIPTA><C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe>
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
  <TkBellExe><"C:\Program Files\Common Files\Real\Update_OB\realsched.exe"  -osboot>
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
  <KAVRun><c:\KAV6\KAVRun.EXE>
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
  <Kulansyn><c:\KAV6\Kulansyn.EXE>
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
  <KpopMon><c:\KAV6\KpopMon.EXE>
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
  <iDuba Personal FireWall><C:\KAV6\KAVPFW.EXE>
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
  <UserFaultCheck><%systemroot%\system32\dumprep 0 -u>
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
  <shell><Explorer.exe>
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
  <Userinit><C:\WINDOWS\system32\userinit.exe,>
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Windows]
  <AppInit_DLLs><>

==================================
启动文件夹
[腾讯QQ]
  <C:\Documents and Settings\hy\「开始」菜单\程序\启动\腾讯QQ.lnk><N>

==================================
服务
[Ati HotKey Poller / Ati HotKey Poller]
  <C:\WINDOWS\System32\Ati2evxx.exe><N/A>
[ATI Smart / ATI Smart]
  <C:\WINDOWS\system32\ati2sgag.exe><N/A>
[Kingsoft AntiVirus Service / KAVSvc]
  <c:\KAV6\KAVSvc.EXE><kingsoft Antivirus>

==================================

浏览器加载项
[KAVIEHelper Class]
  <C:\Program Files\Kos\KOSIEBar.dll>
[QQBrowserHelperObject Class]
  <D:\Program Files\Tencent\QQ\QQIEHelper.dll>
[百度搜霸]
  <C:\WINDOWS\DOWNLO~1\BaiDuBar.dll>
[豪杰超级解霸V8]
  <C:\Herosoft\HeroV8\STHSDVD.EXE>
[金山卓越]
  <url:http://www.joyo.com>
[@shdoclc.dll,-866]
  <>
[QQ]
  <D:\Program Files\Tencent\QQ\QQ.EXE>
[QQIEFloatBarCfgCmd Class]
  <D:\Program Files\Tencent\QQ\QQIEHelper.dll>
[金山毒霸网站]
  <url:http://www.duba.net>
[在线查毒]
  <c:\KAV6\kavie.HTM>
[AxInputControl Class]
  <C:\WINDOWS\DOWNLO~1\INPUTC~1.DLL>
[Shockwave Flash Object]
  <C:\WINDOWS\System32\macromed\flash\Flash.ocx>
[添加到QQ自定义面板]
  <D:\Program Files\Tencent\QQ\AddPanel.htm>
[添加到QQ表情]
  <D:\Program Files\Tencent\QQ\AddEmotion.htm>
[用QQ彩信发送该图片]
  <D:\Program Files\Tencent\QQ\SendMMS.htm>
[百度Flash搜索]
  <res://C:\WINDOWS\DOWNLO~1\BaiDuBar.dll/FLASHSEARCH.HTM>
[百度mp3搜索]
  <res://C:\WINDOWS\DOWNLO~1\BaiDuBar.dll/BAIDUMP3.HTM>
[百度信息快递搜索]
  <res://C:\WINDOWS\DOWNLO~1\BaiDuBar.dll/BAIDUIE.HTM>
[百度图片搜索]
  <res://C:\WINDOWS\DOWNLO~1\BaiDuBar.dll/BAIDUIMG.HTM>
[百度搜索]
  <res://C:\WINDOWS\DOWNLO~1\BaiDuBar.dll/BAIDUSEARCH.HTM>
[百度新闻搜索]
  <res://C:\WINDOWS\DOWNLO~1\BaiDuBar.dll/BAIDUNEWS.HTM>
[豪杰超级解霸V8实时播放]
  <C:\Herosoft\HeroV8\MPURLGET.HTM>

==================================
正在运行的进程
[PID: 560][\SystemRoot\System32\smss.exe]  <Microsoft Corporation><5.1.2600.1106 (xpsp1.020828-1920)>
[PID: 628][\??\C:\WINDOWS\system32\csrss.exe]  <Microsoft Corporation><5.1.2600.0 (xpclient.010817-1148)>
[PID: 660][\??\C:\WINDOWS\system32\winlogon.exe]  <Microsoft Corporation><5.1.2600.1106 (xpsp1.020828-1920)>
    [C:\WINDOWS\system32\Ati2evxx.dll]  <N/A><N/A>
[PID: 704][C:\WINDOWS\system32\services.exe]  <Microsoft Corporation><5.1.2600.0 (xpclient.010817-1148)>
[PID: 716][C:\WINDOWS\system32\lsass.exe]  <Microsoft Corporation><5.1.2600.1106 (xpsp1.020828-1920)>
[PID: 868][C:\WINDOWS\System32\Ati2evxx.exe]  <N/A><N/A>
[PID: 892][C:\WINDOWS\system32\svchost.exe]  <Microsoft Corporation><5.1.2600.0 (xpclient.010817-1148)>
[PID: 996][C:\WINDOWS\System32\svchost.exe]  <Microsoft Corporation><5.1.2600.0 (xpclient.010817-1148)>
[PID: 1104][C:\WINDOWS\System32\svchost.exe]  <Microsoft Corporation><5.1.2600.0 (xpclient.010817-1148)>
[PID: 1176][C:\WINDOWS\System32\svchost.exe]  <Microsoft Corporation><5.1.2600.0 (xpclient.010817-1148)>
[PID: 1428][C:\WINDOWS\system32\Ati2evxx.exe]  <N/A><N/A>
    [c:\KAV6\KMailFun.dll]  <Kingsoft Co., Ltd><2005, 4, 28, 227>
[PID: 1480][C:\WINDOWS\Explorer.EXE]  <Microsoft Corporation><6.00.2800.1106 (xpsp1.020828-1920)>
    [c:\KAV6\KMailFun.dll]  <Kingsoft Co., Ltd><2005, 4, 28, 227>
    [c:\KAV6\KAVEXT.DLL]  <Kingsoft Corp.><2002, 5, 24, 6>
    [C:\Herosoft\HeroV8\VCvtShell.dll]  <herosoft><1, 0, 0, 1>
    [C:\Program Files\WinRAR\rarext.dll]  <N/A><N/A>
    [C:\WINDOWS\DOWNLO~1\BaiDuBar.dll]  <N/A><2, 0, 0, 0>
[PID: 1508][C:\WINDOWS\system32\spoolsv.exe]  <Microsoft Corporation><5.1.2600.0 (XPClient.010817-1148)>
    [C:\WINDOWS\System32\spool\PRTPROCS\W32X86\vprproc.dll]  <Windows (R) 2000 DDK provider><5.00.2195.1620>
[PID: 1652][C:\WINDOWS\System32\alg.exe]  <Microsoft Corporation><5.1.2600.1106 (xpsp1.020828-1920)>
[PID: 1724][c:\KAV6\KAVSvc.EXE]  <kingsoft Antivirus><2003, 11, 12, 70>
    [c:\KAV6\SvcComm.dll]  <kingsoft Antivirus><2004, 7, 28, 1>
    [c:\KAV6\SvcTimer.DLL]  <Kingsoft><2004.4.29.79>
    [c:\KAV6\KavComm.dll]  <Kingsoft Corporation><2003, 11, 12, 66>
    [c:\KAV6\RpcBrge.DLL]  <kingsoft><2003, 11, 12, 64>
    [c:\KAV6\KWatchFn2.dll]  <kingsoft Corporation><2004, 8, 24, 25>
    [c:\KAV6\KAEPlat.DLL]  <Kingsoft Corp.><2004, 8, 18, 48>
    [c:\KAV6\KAEMem.DAT]  <Kingsoft><2004, 8, 18, 10>
    [c:\KAV6\KAVUtils.dll]  <Kingsoft Corp><2004, 2, 12, 69>
    [c:\KAV6\KAVDlg.DLL]  <><2004.7.20.81>
    [c:\KAV6\KAVLogFn.dll]  <N/A><2003, 11, 26, 16>
[PID: 236][C:\WINDOWS\SOUNDMAN.EXE]  <Realtek Semiconductor Corp.><5.1.0.27>
    [c:\KAV6\KMailFun.dll]  <Kingsoft Co., Ltd><2005, 4, 28, 227>
[PID: 252][C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe]  <ATI Technologies, Inc.><6.14.10.5090>
    [C:\Program Files\ATI Technologies\ATI Control

Panel\atipdsxx.dll]  <ATI Technologies, Inc.><6.14.10.5090>
    [C:\PROGRAM FILES\ATI TECHNOLOGIES\ATI CONTROL PANEL\ATRPUIXX.CHS]  <ATI Technologies, Inc.><6.14.10.5090>
    [C:\Program Files\ATI Technologies\ATI Control Panel\atipdxxx.dll]  <ATI Technologies, Inc.><6.14.10.5090>
    [c:\KAV6\KMailFun.dll]  <Kingsoft Co., Ltd><2005, 4, 28, 227>
[PID: 264][C:\Program Files\Common Files\Real\Update_OB\realsched.exe]  <RealNetworks, Inc.><0.1.0.3018>
    [c:\KAV6\KMailFun.dll]  <Kingsoft Co., Ltd><2005, 4, 28, 227>
[PID: 332][C:\KAV6\KpopMon.EXE]  <N/A><2004, 2, 2, 31>
    [C:\KAV6\KAVMLM.DLL]  <Kingsoft Corporation><2003.11.12.10>
    [c:\KAV6\KMailFun.dll]  <Kingsoft Co., Ltd><2005, 4, 28, 227>
[PID: 340][c:\KAV6\KWatchUI.EXE]  <><2004.1.6.119>
    [c:\KAV6\kavcomm.dll]  <Kingsoft Corporation><2003, 11, 12, 66>
    [c:\KAV6\kavdlg.dll]  <><2004.7.20.81>
    [c:\KAV6\KAVMLM.DLL]  <Kingsoft Corporation><2003.11.12.10>
    [c:\KAV6\RpcBrge.DLL]  <kingsoft><2003, 11, 12, 64>
    [c:\KAV6\KMailFun.dll]  <Kingsoft Co., Ltd><2005, 4, 28, 227>
[PID: 364][C:\KAV6\KAVPFW.EXE]  <Kingsoft Corporation><2004, 8, 16, 295>
    [C:\KAV6\KAVMLM.DLL]  <Kingsoft Corporation><2003.11.12.10>
    [C:\KAV6\PFWScanC.dll]  <KingSoft><2002, 4, 12, 3>
    [C:\KAV6\KAMsgBox.dll]  <><2002.9.27.30>
    [C:\KAV6\NetShare.dll]  <Kingsoft Antivirus><2004, 2, 20, 67>
    [C:\KAV6\KAEPlat.DLL]  <Kingsoft Corp.><2004, 8, 18, 48>
    [C:\KAV6\KAEMem.DAT]  <Kingsoft><2004, 8, 18, 10>
    [C:\KAV6\KAEQSCAN.DLL]  <Kingsoft Corp><2004, 3, 26, 69>
    [c:\KAV6\KMailFun.dll]  <Kingsoft Co., Ltd><2005, 4, 28, 227>
    [C:\KAV6\KAVLogFn.dll]  <N/A><2003, 11, 26, 16>
[PID: 376][C:\WINDOWS\System32\ctfmon.exe]  <Microsoft Corporation><5.1.2600.1106 (xpsp1.020828-1920)>
    [c:\KAV6\KMailFun.dll]  <Kingsoft Co., Ltd><2005, 4, 28, 227>
[PID: 1252][c:\KAV6\MailMon.EXE]  <Kingsoft Co., Ltd><2004, 2, 6, 245>
    [c:\KAV6\KMFilter.DLL]  <N/A><2004, 3, 1, 37>
    [c:\KAV6\parse822.dll]  <Quiksoft Corporation><2, 0, 0, 9>
    [c:\KAV6\KAVLogFn.dll]  <N/A><2003, 11, 26, 16>
    [c:\KAV6\KAVMLM.DLL]  <Kingsoft Corporation><2003.11.12.10>
    [c:\KAV6\KAMsgBox.DLL]  <><2002.9.27.30>
    [c:\KAV6\KAVComm.dll]  <Kingsoft Corporation><2003, 11, 12, 66>
    [c:\KAV6\RpcBrge.DLL]  <kingsoft><2003, 11, 12, 64>
    [c:\KAV6\KAVIPC.DLL]  <Kingsoft Corp.><2002, 3, 29, 8>
    [c:\KAV6\KAVDlg.DLL]  <><2004.7.20.81>
    [c:\KAV6\KAECall.DLL]  <Kingsoft Corporation><2003, 11, 14, 66>
    [c:\KAV6\KAEScan.DLL]  <Kingsoft Corp.><2003, 5, 24, 36>
    [c:\KAV6\KAEPlat.DLL]  <Kingsoft Corp.><2004, 8, 18, 48>
    [c:\KAV6\KAEMem.DAT]  <Kingsoft><2004, 8, 18, 10>
    [c:\KAV6\KMailFun.dll]  <Kingsoft Co., Ltd><2005, 4, 28, 227>
[PID: 1128][c:\KAV6\KAVPlus.EXE]  <N/A><2004, 3, 3, 71>
    [c:\KAV6\KMailFun.dll]  <Kingsoft Co., Ltd><2005, 4, 28, 227>
[PID: 404][C:\WINDOWS\NOTEPAD.EXE]  <Microsoft Corporation><5.1.2600.0 (xpclient.010817-1148)>
    [c:\KAV6\KMailFun.dll]  <Kingsoft Co., Ltd><2005, 4, 28, 227>
[PID: 444][D:\Program Files\IEscan.exe]  <N/A><N/A>
    [C:\DOCUME~1\hy\LOCALS~1\Temp\E_80003\krnln.fnr]  <N/A><1, 0, 0, 1>
    [c:\KAV6\KMailFun.dll]  <Kingsoft Co., Ltd><2005, 4, 28, 227>
    [C:\DOCUME~1\hy\LOCALS~1\Temp\E_80003\iext.fnr]  <N/A><1, 0, 0, 1>
    [C:\DOCUME~1\hy\LOCALS~1\Temp\E_80003\iext2.fne]  <N/A><1, 0, 0, 1>
[PID: 1716][D:\SREng.exe]  <Smallfrogs Studio><1.1.0.269>
    [c:\KAV6\KMailFun.dll]  <Kingsoft Co., Ltd><2005, 4, 28, 227>

==================================
文件关联
.TXT  Error. [NOTEPAD.EXE %1]
.EXE  OK. ["%1" %*]
.COM  OK. ["%1" %*]
.PIF  OK. ["%1" %*]
.REG  OK. [regedit.exe "%1"]
.BAT  OK. ["%1" %*]
.SCR  OK. ["%1" /S]
.CHM  OK. ["C:\WINDOWS\hh.exe" %1]
.HLP  OK. [C:\WINDOWS\System32\winhlp32.exe %1]
.INI  Error. [notepad.exe %1]
.INF  OK. [C:\WINDOWS\System32\NOTEPAD.EXE %1]

==================================

这是hj的扫描：HijackThis_815汉化版扫描日志 V1.99.1
保存于      18:15:14, 日期 2005-11-22
操作系统：  Windows XP SP1 (WinNT 5.01.2600)
浏览器：    Internet Explorer v6.00 SP1 (6.00.2800.1106)

当前运行的进程：         
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\System32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
c:\KAV6\KAVSvc.EXE
C:\WINDOWS\SOUNDMAN.EXE
C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\KAV6\KpopMon.EXE
c:\KAV6\KWatchUI.EXE
C:\KAV6\KAVPFW.EXE
C:\WINDOWS\System32\ctfmon.exe
c:\KAV6\MailMon.EXE
c:\KAV6\KAVPlus.EXE
C:\WINDOWS\NOTEPAD.EXE
D:\Program Files\IEscan.exe
D:\4842302005817230232\HijackThis1991zww.exe

R3 - 默认的URLSearchHook丢失。用HijackThis修复
O1 - Hosts: .
O1 - Hosts: .
O1 - Hosts: .
O1 - Hosts: .
O1 - Hosts: .
O1 - Hosts: .
O1 - Hosts: .
O1 - Hosts: .
O1 - Hosts: .
O1 - Hosts: .
O1 - Hosts: .
O1 - Hosts: .
O1 - Hosts: .
O1 - Hosts: .
O1 - Hosts: .
O1 - Hosts: .
O1 - Hosts: .
O1 - Hosts: .
O1 - Hosts: .
O1 - Hosts: .
O2 - BHO: KOSIE HelperInternet Explorer Web Content Guard  - {1B2F92A1-CDAF-4511-9382-91E3F5CE0880} - C:\Program Files\Kos\KOSIEBar.dll
O2 - BHO: QQIEHelper - {54EBD53A-9BC1-480B-966A-843A333CA162} - D:\Program Files\Tencent\QQ\QQIEHelper.dll
O2 - BHO: 百度搜霸 - {B580CF65-E151-49C3-B73F-70B13FCA8E86} - C:\WINDOWS\DOWNLO~1\BaiDuBar.dll
O4 - 启动项HKLM\\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
O4 - 启动项HKLM\\Run: [PHIME2002ASync] C:\WINDOWS\System32\IME\TINTLGNT\TINTSETP.EXE /SYNC
O4 - 启动项HKLM\\Run: [PHIME2002A] C:\WINDOWS\System32\IME\TINTLGNT\TINTSETP.EXE /IMEName
O4 - 启动项HKLM\\Run: [SoundMan] SOUNDMAN.EXE
O4 - 启动项HKLM\\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - 启动项HKLM\\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe"  -osboot
O4 - 启动项HKLM\\Run: [KAVRun] c:\KAV6\KAVRun.EXE
O4 - 启动项HKLM\\Run: [Kulansyn] c:\KAV6\Kulansyn.EXE
O4 - 启动项HKLM\\Run: [KpopMon] c:\KAV6\KpopMon.EXE
O4 - 启动项HKLM\\Run: [iDuba Personal FireWall] C:\KAV6\KAVPFW.EXE
O4 - 启动项HKLM\\Run: [UserFaultCheck] %systemroot%\system32\dumprep 0 -u
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\System32\ctfmon.exe
O4 - HKCU\..\Run: [iDuba Personal FireWall] C:\KAV6\KAVPFW.EXE
O4 - Startup: 腾讯QQ.lnk = D:\Program Files\Tencent\QQ\QQ.exe
O8 - IE右键菜单中的新增项目: 添加到QQ自定义面板 - D:\Program Files\Tencent\QQ\AddPanel.htm
O8 - IE右键菜单中的新增项目: 添加到QQ表情 - D:\Program Files\Tencent\QQ\AddEmotion.htm
O8 - IE右键菜单中的新增项目: 用QQ彩信发送该图片 - D:\Program Files\Tencent\QQ\SendMMS.htm
O8 - IE右键菜单中的新增项目: 百度Flash搜索 - res://C:\WINDOWS\DOWNLO~1\BaiDuBar.dll/FLASHSEARCH.HTM
O8 - IE右键菜单中的新增项目: 百度mp3搜索 - res://C:\WINDOWS\DOWNLO~1\BaiDuBar.dll/BAIDUMP3.HTM
O8 - IE右键菜单中的新增项目: 百度信息快递搜索 - res://C:\WINDOWS\DOWNLO~1\BaiDuBar.dll/BAIDUIE.HTM
O8 - IE右键菜单中的新增项目: 百度图片搜索 - res://C:\WINDOWS\DOWNLO~1\BaiDuBar.dll/BAIDUIMG.HTM
O8 - IE右键菜单中的新增项目: 百度搜索 - res://C:\WINDOWS\DOWNLO~1\BaiDuBar.dll/BAIDUSEARCH.HTM
O8 - IE右键菜单中的新增项目: 百度新闻搜索 - res://C:\WINDOWS\DOWNLO~1\BaiDuBar.dll/BAIDUNEWS.HTM
O8 - IE右键菜单中的新增项目: 豪杰超级解霸V8实时播放 - C:\Herosoft\HeroV8\MPURLGET.HTM
O9 - 浏览器额外的按钮: 豪杰超级解霸V8 - {367E0A21-8601-4986-9C9A-153BF5ACA118} - C:\Herosoft\HeroV8\STHSDVD.EXE
O9 - 浏览器额外的“工具”菜单项: 豪杰超级解霸V8 - {367E0A21-8601-4986-9C9A-153BF5ACA118} - C:\Herosoft\HeroV8\STHSDVD.EXE
O9 - 浏览器额外的按钮: 金山卓越 - {8DE0FCD4-5EB5-11D3-AD25-00002100131B} - url:http://www.joyo.com (file missing)
O9 - 浏览器额外的按钮: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
O9 - 浏览器额外的“工具”菜单项: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
O9 - 浏览器额外的按钮: QQ - {c95fe080-8f5d-11d2-a20b-00aa003c157b} - D:\Program Files\Tencent\QQ\QQ.EXE
O9 - 浏览器额外的“工具”菜单项: 腾讯QQ - {c95fe080-8f5d-11d2-a20b-00aa003c157b} - D:\Program Files\Tencent\QQ\QQ.EXE
O9 - 浏览器额外的按钮: (no name) - {DEDEB80D-FA35-45d9-9460-4983E5A8AFE6} - D:\Program Files\Tencent\QQ\QQIEHelper.dll
O9 - 浏览器额外的“工具”菜单项: QQ炫彩工具条设置 - {DEDEB80D-FA35-45d9-9460-4983E5A8AFE6} - D:\Program Files\Tencent\QQ\QQIEHelper.dll
O9 - 浏览器额外的按钮: 金山毒霸网站 - {e1fc9760-7b95-49cd-80b9-8c9e41017b93} - url:http://www.duba.net (file missing)
O9 - 浏览器额外的按钮: 在线查毒 - {f58d36c3-40be-4418-a786-d8fbe3eb3554} - c:\KAV6\kavie.HTM
O15 - “受信任的站点”中添加项: www.cctv.com
O15 - “受信任的站点”中添加项: doswang.liveabc.com.cn
O15 - “受信任的站点”中添加项: www.microstar.com.cn
O15 - “受信任的站点”中添加项: www.hbsdt.com
O15 - “受信任的站点”中添加项: mediastack.vod.inhe.net
O15 - “受信任的站点”中添加项: www.vod.inhe.net
O15 - “受信任的站点”中添加项: bbs.jcrx.com
O15 - “受信任的站点”中添加项: chat.jcrx.com
O15 - “受信任的站点”中添加项: www.jcrx.com
O15 - “受信任的站点”中添加项: www.kpworld.com
O15 - “受信任的站点”中添加项: messenger.microsoft.com
O15 - “受信任的站点”中添加项: office.microsoft.com
O15 - “受信任的站点”中添加项: support.microsoft.com
O15 - “受信任的站点”中添加项: v4.windowsupdate.microsoft.com
O15 - “受信任的站点”中添加项: v5.windowsupdate.microsoft.com
O15 - “受信任的站点”中添加项: www.microsoft.com
O15 - “受信任的站点”中添加项: *.microsoft.com
O15 - “受信任的站点”中添加项: www.inhe.net.cn
O15 - “受信任的站点”中添加项: www.openhe.net
O15 - “受信任的站点”中添加项: breezy.vicp.net
O15 - “受信任的站点”中添加项: *.windowsmedia.com
O16 - DPF: {73E4740C-08EB-4133-896B-8D0A7C9EE3CD} (AxInputControl Class) - https://mybank.icbc.com.cn/icbc/perbank/AxSafeControls.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - file://C:\Herosoft\HeroV8\DVDSkin\defskin\HTML\swflash.cab
O23 - NT 服务: Ati HotKey Poller - Unknown owner - C:\WINDOWS\System32\Ati2evxx.exe
O23 - NT 服务: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - NT 服务: Kingsoft AntiVirus Service (KAVSvc) - kingsoft Antivirus - c:\KAV6\KAVSvc.EXE

麻烦给看看还有问题吗？我以前的症状在第一页 里说明了！还有我sreng里文件关联有2处错误！是不是要恢复一下？文件关联
.TXT  Error. [NOTEPAD.EXE %1]
.EXE  OK. ["%1" %*]
.COM  OK. ["%1" %*]
.PIF  OK. ["%1" %*]
.REG  OK. [regedit.exe "%1"]
.BAT  OK. ["%1" %*]
.SCR  OK. ["%1" /S]
.CHM  OK. ["C:\WINDOWS\hh.exe" %1]
.HLP  OK. [C:\WINDOWS\System32\winhlp32.exe %1]
.INI  Error. [notepad.exe %1]
.INF  OK. [C:\WINDOWS\System32\NOTEPAD.EXE %1]

我以前没设置什么！是不是就是把所有的01 15 项修复，文件关联也修复就可以了吗？那么我之前的那个问题就算解决了吗/我被弹出不同网站弄怕了

修复了这是修复后的HijackThis_815汉化版扫描日志 V1.99.1
保存于      19:39:41, 日期 2005-11-22
操作系统：  Windows XP SP1 (WinNT 5.01.2600)
浏览器：    Internet Explorer v6.00 SP1 (6.00.2800.1106)

当前运行的进程：         
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\System32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
c:\KAV6\KAVSvc.EXE
C:\WINDOWS\SOUNDMAN.EXE
C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
c:\KAV6\KWatchUI.EXE
C:\KAV6\KpopMon.EXE
C:\KAV6\KAVPFW.EXE
C:\WINDOWS\System32\ctfmon.exe
c:\KAV6\MailMon.EXE
c:\KAV6\KAVPlus.EXE
D:\Program Files\IEscan.exe
D:\4842302005817230232\HijackThis1991zww.exe

O2 - BHO: KOSIE HelperInternet Explorer Web Content Guard  - {1B2F92A1-CDAF-4511-9382-91E3F5CE0880} - C:\Program Files\Kos\KOSIEBar.dll
O2 - BHO: QQIEHelper - {54EBD53A-9BC1-480B-966A-843A333CA162} - D:\Program Files\Tencent\QQ\QQIEHelper.dll
O2 - BHO: 百度搜霸 - {B580CF65-E151-49C3-B73F-70B13FCA8E86} - C:\WINDOWS\DOWNLO~1\BaiDuBar.dll
O4 - 启动项HKLM\\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
O4 - 启动项HKLM\\Run: [PHIME2002ASync] C:\WINDOWS\System32\IME\TINTLGNT\TINTSETP.EXE /SYNC
O4 - 启动项HKLM\\Run: [PHIME2002A] C:\WINDOWS\System32\IME\TINTLGNT\TINTSETP.EXE /IMEName
O4 - 启动项HKLM\\Run: [SoundMan] SOUNDMAN.EXE
O4 - 启动项HKLM\\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - 启动项HKLM\\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe"  -osboot
O4 - 启动项HKLM\\Run: [KAVRun] c:\KAV6\KAVRun.EXE
O4 - 启动项HKLM\\Run: [Kulansyn] c:\KAV6\Kulansyn.EXE
O4 - 启动项HKLM\\Run: [KpopMon] c:\KAV6\KpopMon.EXE
O4 - 启动项HKLM\\Run: [iDuba Personal FireWall] C:\KAV6\KAVPFW.EXE
O4 - 启动项HKLM\\Run: [UserFaultCheck] %systemroot%\system32\dumprep 0 -u
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\System32\ctfmon.exe
O4 - HKCU\..\Run: [iDuba Personal FireWall] C:\KAV6\KAVPFW.EXE
O4 - Startup: 腾讯QQ.lnk = D:\Program Files\Tencent\QQ\QQ.exe
O8 - IE右键菜单中的新增项目: 添加到QQ自定义面板 - D:\Program Files\Tencent\QQ\AddPanel.htm
O8 - IE右键菜单中的新增项目: 添加到QQ表情 - D:\Program Files\Tencent\QQ\AddEmotion.htm
O8 - IE右键菜单中的新增项目: 用QQ彩信发送该图片 - D:\Program Files\Tencent\QQ\SendMMS.htm
O8 - IE右键菜单中的新增项目: 百度Flash搜索 - res://C:\WINDOWS\DOWNLO~1\BaiDuBar.dll/FLASHSEARCH.HTM
O8 - IE右键菜单中的新增项目: 百度mp3搜索 - res://C:\WINDOWS\DOWNLO~1\BaiDuBar.dll/BAIDUMP3.HTM
O8 - IE右键菜单中的新增项目: 百度信息快递搜索 - res://C:\WINDOWS\DOWNLO~1\BaiDuBar.dll/BAIDUIE.HTM
O8 - IE右键菜单中的新增项目: 百度图片搜索 - res://C:\WINDOWS\DOWNLO~1\BaiDuBar.dll/BAIDUIMG.HTM
O8 - IE右键菜单中的新增项目: 百度搜索 - res://C:\WINDOWS\DOWNLO~1\BaiDuBar.dll/BAIDUSEARCH.HTM
O8 - IE右键菜单中的新增项目: 百度新闻搜索 - res://C:\WINDOWS\DOWNLO~1\BaiDuBar.dll/BAIDUNEWS.HTM
O8 - IE右键菜单中的新增项目: 豪杰超级解霸V8实时播放 - C:\Herosoft\HeroV8\MPURLGET.HTM
O9 - 浏览器额外的按钮: 豪杰超级解霸V8 - {367E0A21-8601-4986-9C9A-153BF5ACA118} - C:\Herosoft\HeroV8\STHSDVD.EXE
O9 - 浏览器额外的“工具”菜单项: 豪杰超级解霸V8 - {367E0A21-8601-4986-9C9A-153BF5ACA118} - C:\Herosoft\HeroV8\STHSDVD.EXE
O9 - 浏览器额外的按钮: 金山卓越 - {8DE0FCD4-5EB5-11D3-AD25-00002100131B} - url:http://www.joyo.com (file missing)
O9 - 浏览器额外的按钮: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
O9 - 浏览器额外的“工具”菜单项: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
O9 - 浏览器额外的按钮: QQ - {c95fe080-8f5d-11d2-a20b-00aa003c157b} - D:\Program Files\Tencent\QQ\QQ.EXE
O9 - 浏览器额外的“工具”菜单项: 腾讯QQ - {c95fe080-8f5d-11d2-a20b-00aa003c157b} - D:\Program Files\Tencent\QQ\QQ.EXE
O9 - 浏览器额外的按钮: (no name) - {DEDEB80D-FA35-45d9-9460-4983E5A8AFE6} - D:\Program Files\Tencent\QQ\QQIEHelper.dll
O9 - 浏览器额外的“工具”菜单项: QQ炫彩工具条设置 - {DEDEB80D-FA35-45d9-9460-4983E5A8AFE6} - D:\Program Files\Tencent\QQ\QQIEHelper.dll
O9 - 浏览器额外的按钮: 金山毒霸网站 - {e1fc9760-7b95-49cd-80b9-8c9e41017b93} - url:http://www.duba.net (file missing)
O9 - 浏览器额外的按钮: 在线查毒 - {f58d36c3-40be-4418-a786-d8fbe3eb3554} - c:\KAV6\kavie.HTM
O16 - DPF: {73E4740C-08EB-4133-896B-8D0A7C9EE3CD} (AxInputControl Class) - https://mybank.icbc.com.cn/icbc/perbank/AxSafeControls.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - file://C:\Herosoft\HeroV8\DVDSkin\defskin\HTML\swflash.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{D0C5B574-869E-46AB-B312-908853D5D9B3}: NameServer = 202.99.160.68 202.99.166.4
O18 - 列举现有的协议: about - {3050F406-98B5-11CF-BB82-00AA00BDCE0B} - C:\WINDOWS\System32\mshtml.dll
O18 - 列举现有的协议: cdl - {3DD53D40-7B8B-11D0-B013-00AA0059CE02} - C:\WINDOWS\system32\urlmon.dll
O18 - 列举现有的协议: dvd - {12D51199-0DB5-46FE-A120-47A3D7D937CC} - C:\WINDOWS\System32\msvidctl.dll
O18 - 列举现有的协议: file - {79EAC9E7-BAF9-11CE-8C82-00AA004BA90B} - C:\WINDOWS\system32\urlmon.dll
O18 - 列举现有的协议: ftp - {79EAC9E3-BAF9-11CE-8C82-00AA004BA90B} - C:\WINDOWS\system32\urlmon.dll
O18 - 列举现有的协议: gopher - {79EAC9E4-BAF9-11CE-8C82-00AA004BA90B} - C:\WINDOWS\system32\urlmon.dll
O18 - 列举现有的协议: http - {79EAC9E2-BAF9-11CE-8C82-00AA004BA90B} - C:\WINDOWS\system32\urlmon.dll
O18 - 列举现有的协议: https - {79EAC9E5-BAF9-11CE-8C82-00AA004BA90B} - C:\WINDOWS\system32\urlmon.dll
O18 - 列举现有的协议: ipp - (no CLSID) - (no file)
O18 - 列举现有的协议: its - {9D148291-B9C8-11D0-A4CC-0000F80149F6} - C:\WINDOWS\System32\itss.dll
O18 - 列举现有的协议: javascript - {3050F3B2-98B5-11CF-BB82-00AA00BDCE0B} - C:\WINDOWS\System32\mshtml.dll
O18 - 列举现有的协议: local - {79EAC9E7-BAF9-11CE-8C82-00AA004BA90B} - C:\WINDOWS\system32\urlmon.dll
O18 - 列举现有的协议: mailto - {3050F3DA-98B5-11CF-BB82-00AA00BDCE0B} - C:\WINDOWS\System32\mshtml.dll
O18 - 列举现有的协议: mhtml - {05300401-BCBC-11D0-85E3-00C04FD85AB4} - C:\WINDOWS\System32\inetcomm.dll
O18 - 列举现有的协议: mk - {79EAC9E6-BAF9-11CE-8C82-00AA004BA90B} - C:\WINDOWS\system32\urlmon.dll
O18 - 列举现有的协议: ms-its - {9D148291-B9C8-11D0-A4CC-0000F80149F6} - C:\WINDOWS\System32\itss.dll
O18 - 列举现有的协议: msdaipp - (no CLSID) - (no file)
O18 - 列举现有的协议: res - {3050F3BC-98B5-11CF-BB82-00AA00BDCE0B} - C:\WINDOWS\System32\mshtml.dll
O18 - 列举现有的协议: sysimage - {76E67A63-06E9-11D2-A840-006008059382} - C:\WINDOWS\System32\mshtml.dll
O18 - 列举现有的协议: tv - {CBD30858-AF45-11D2-B6D6-00C04FBBDE6E} - C:\WINDOWS\System32\msvidctl.dll
O18 - 列举现有的协议: vbscript - {3050F3B2-98B5-11CF-BB82-00AA00BDCE0B} - C:\WINDOWS\System32\mshtml.dll
O18 - 列举现有的协议: vnd.ms.radio - {3DA2AA3B-3D96-11D2-9BD2-204C4F4F5020} - C:\WINDOWS\System32\msdxm.ocx
O18 - 列举现有的协议: wia - {13F3EA8B-91D7-4F0A-AD76-D2853AC8BECE} - C:\WINDOWS\System32\wiascr.dll
O23 - NT 服务: Ati HotKey Poller - Unknown owner - C:\WINDOWS\System32\Ati2evxx.exe
O23 - NT 服务: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - NT 服务: Kingsoft AntiVirus Service (KAVSvc) - kingsoft Antivirus - c:\KAV6\KAVSvc.EXE

您再看看！还有就是修复后hj文件夹里多了backups文件夹！这是什么？是备份的吗？先感谢几位斑竹了！我在观察看看还弹不弹

谢谢！感谢这阵子的帮忙！我目前在观察！如有问题我发贴再问，再次感谢