已感染: 木马程序 Trojan-Clicker.HTML.Agent.a C:\Documents and Settings\LiZhisheng\Local Settings\Temporary Internet Files\Content.IE5\D08BH5SL\popup[1].php
卡巴删一次又出来一次，文件夹被删光了，还是有！请大家帮帮忙，谢谢了！
hijackthis扫描结果：
启动项报告： 2006-7-14, 上午 23:24:17
启动项扫描器版本： 1.52.2
开始于： E:\Program Files\HijackThis1991汉化版\HijackThis1991zww.EXE
系统检测： Windows XP SP1 (WinNT 5.01.2600)
系统检测： Internet Explorer v6.00 SP1 (6.00.2800.1106)
* 使用默认选项
==================================================
当前运行的进程：
C:\WINDOWS\XP\System32\smss.exe
C:\WINDOWS\XP\system32\winlogon.exe
C:\WINDOWS\XP\system32\services.exe
C:\WINDOWS\XP\system32\lsass.exe
C:\WINDOWS\XP\System32\Ati2evxx.exe
C:\WINDOWS\XP\system32\svchost.exe
C:\WINDOWS\XP\System32\svchost.exe
C:\WINDOWS\XP\system32\spoolsv.exe
D:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 6.0\avp.exe
E:\Program Files\ewido anti-spyware 4.0\guard.exe
C:\WINDOWS\XP\system32\Ati2evxx.exe
C:\WINDOWS\XP\Explorer.EXE
D:\Program Files\SkyNet\FireWall\PFW.exe
C:\Program Files\CNNIC\Cdn\cdnup.exe
D:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 6.0\avp.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\WINDOWS\XP\System32\ctfmon.exe
E:\Program Files\SnowFox\DesktopSprite2\DesktopSprite.exe
C:\WINDOWS\XP\System32\conime.exe
C:\WINDOWS\XP\System32\ctfmon.exe
E:\Program Files\TTPlayer\TTPlayer.exe
D:\Program Files\Maxthon\Maxthon.exe
E:\Program Files\HijackThis1991汉化版\HijackThis1991zww.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
--------------------------------------------------
Checking Windows NT UserInit:
[HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
UserInit = C:\WINDOWS\XP\system32\userinit.exe,
--------------------------------------------------
注册表中的启动项:
HKLM\Software\Microsoft\Windows\CurrentVersion\Run
SKYNET Personal FireWall = D:\Program Files\SkyNet\FireWall\PFW.exe
CdnCtr = C:\Program Files\CNNIC\Cdn\cdnup.exe
kav = "D:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 6.0\avp.exe"
--------------------------------------------------
注册表中的启动项:
HKCU\Software\Microsoft\Windows\CurrentVersion\Run
ctfmon.exe = C:\WINDOWS\XP\System32\ctfmon.exe
DesktopSprite = E:\Program Files\SnowFox\DesktopSprite2\DesktopSprite.exe
--------------------------------------------------
Load/Run keys from C:\WINDOWS\XP\WIN.INI:
load=* 未找到INI相关项目值 *
run=* 未找到INI相关项目值 *
Load/Run keys from Registry:
HKLM\..\Windows NT\CurrentVersion\WinLogon: load=* 未找到相关注册表键值 *
HKLM\..\Windows NT\CurrentVersion\WinLogon: run=* 未找到相关注册表键值 *
HKLM\..\Windows\CurrentVersion\WinLogon: load=* 未找到相关注册表键值 *
HKLM\..\Windows\CurrentVersion\WinLogon: run=* 未找到相关注册表键值 *
HKCU\..\Windows NT\CurrentVersion\WinLogon: load=* 未找到相关注册表键值 *
HKCU\..\Windows NT\CurrentVersion\WinLogon: run=* 未找到相关注册表键值 *
HKCU\..\Windows\CurrentVersion\WinLogon: load=* 未找到相关注册表键值 *
HKCU\..\Windows\CurrentVersion\WinLogon: run=* 未找到相关注册表键值 *
HKCU\..\Windows NT\CurrentVersion\Windows: load=
HKCU\..\Windows NT\CurrentVersion\Windows: run=* 未找到相关注册表键值 *
HKLM\..\Windows NT\CurrentVersion\Windows: load=* 未找到相关注册表键值 *
HKLM\..\Windows NT\CurrentVersion\Windows: run=* 未找到相关注册表键值 *
HKLM\..\Windows NT\CurrentVersion\Windows: AppInit_DLLs=
--------------------------------------------------
外壳扩展和屏幕保护程序的键值 从 C:\WINDOWS\XP\SYSTEM.INI:
Shell=* 未找到INI相关项目值 *
SCRNSAVE.EXE=* 未找到INI相关项目值 *
drivers=* 未找到INI相关项目值 *
外壳扩展和屏幕保护程序的键值 从 注册表
Shell=Explorer.exe
SCRNSAVE.EXE=C:\WINDOWS\XP\System32\logon.scr
drivers=* 未找到相关注册表键值 *
Policies Shell key:
HKCU\..\Policies: Shell=* 未找到相关注册表键值 *
HKLM\..\Policies: Shell=* 未找到相关注册表键值 *
--------------------------------------------------
列举IE浏览器辅助对象(BHO模块):
(no name) - E:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}
(no name) - C:\PROGRA~1\CNNIC\Cdn\cdnforie.dll - {5C3853CF-C7E0-4946-B3FA-1ABDB6F48108}
(no name) - C:\PROGRA~1\baidu\bar\baidubar.dll - {77FEF28E-EB96-44FF-B511-3185DEA48697}
ThunderBHO - E:\Program Files\Thunder Network\Thunder\ComDlls\XunLeiBHO_001.dll - {889D2FEB-5411-4565-8998-1DD2C5261283}
(no name) - E:\Program Files\JetCar\jccatch.dll - {A5366673-E8CA-11D3-9CD9-0090271D075B}
--------------------------------------------------
列举下载的程序文件：
[MUWebControl Class]
InProcServer32 = C:\WINDOWS\XP\System32\muweb.dll
CODEBASE = http://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1150356144921
[ActiveScan Installer Class]
InProcServer32 = C:\WINDOWS\XP\Downloaded Program Files\asinst.dll
CODEBASE = http://acs.pandasoftware.com/activescan/as5free/asinst.cab
[Shockwave Flash
Object]
InProcServer32 = C:\WINDOWS\XP\System32\Macromed\Flash\Flash8.ocx
CODEBASE = http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab
[KvScanOnline Control]
InProcServer32 = C:\WINDOWS\XP\System32\KvDown.ocx
CODEBASE = http://online.jiangmin.com/KvDown.cab
--------------------------------------------------
列举 Winsock LSP 文件：
NameSpace #1: C:\WINDOWS\XP\System32\cdnns.dll (file MISSING)
--------------------------------------------------
Enumerating Windows NT logon/logoff scripts:
*No scripts set to run*
Windows NT checkdisk command:
BootExecute = autocheck autochk *
Windows NT 'Wininit.ini':
PendingFileRenameOperations: C:\Program Files\Internet Explorer\PLUGINS\system.bak => C:\Program Files\Internet Explorer\PLUGINS\system.sys|C:\Program Files\Internet Explorer\IEXPLORE.Tmp => C:\Program Files\Internet Explorer\IEXPLORE.Dat|C:\Program Files\Internet Explorer\IEXPLORE.Bak => C:\Program Files\Internet Explorer\IEXPLORE.Sys||.
--------------------------------------------------
列举 ShellService
ObjectDelayLoad 项目：
PostBootReminder: C:\WINDOWS\XP\system32\SHELL32.dll
CDBurn: C:\WINDOWS\XP\system32\SHELL32.dll
WebCheck: C:\WINDOWS\XP\System32\webcheck.dll
SysTray: C:\WINDOWS\XP\System32\st
object.dll
--------------------------------------------------
报告完毕，共 6,823 字节
报告生成用时：0.500秒
Command line options:
/verbose - to add additional info on each section
/complete - to include empty sections and unsuspicious data
/full - to include several rarely-important sections
/force9x - to include Win9x-only startups even if running on WinNT
/forcent - to include WinNT-only startups even if running on Win9x
/forceall - to include all Win9x and WinNT startups, regardless of platform
/history - to list version history only
