soso313.cn、dao234.com等劫持浏览器,tlntsvi_1547.exe、ydzyh.exe、scvhost.exe等做怪
一位网友的电脑中了病毒，用超级巡警查杀后，每次开机进入Windows桌面后都会弹出对话框，提示找不到文件tlntsvi_1547.exe，并且桌面上有两个IE图标和360浏览器图标无法删除，IE、360、遨游浏览器均被劫持，开始菜单和快速启动项上多出了几个网址快捷方式，IE右键快捷菜单也多出了几个项目。请偶帮忙检修。
重启电脑到带网络连接的安全模式下，用 pe_xscan 扫描 log 并分析，发现如下可疑项：
e_xscan 09-06-21 by Purple Endurer 2010-3-24 12:23:9 Windows XP Service Pack 3(5.1.2600) MSIE:6.0.2900.5512 管理员用户组 带网络连接的安全模式 F2 - HKCU/../PolShell=C:/WINDOWS/Explorer.exe C:/WINDOWS/system32/tlntsvi_1547.exe O2 - BHO CFunPlayer Object - {4D7D1A10-B9AA-4a06-AEAE-E5EE912A59FC} = C:/WINDOWS/system32/e2c2.dll O2 - BHO CFunPlayer Object - {66DF3805-4078-4095-BA13-09DBC92F3E87} = C:/WINDOWS/system32/393r.dll | 2010-2-6 17:51:22 | IE Media Object | 1.0.0.1 | IE Media Object | Beijing Angels Technology ltd. All rights reserved. | 1.0.0.1 | Beijing Angels Technology ltd.| ? | BHO.dll | b.dll O2 - BHO BHO Class - {AFA9FF66-862A-4b0c-8D6B-3FB026ECEB0A} = C:/WINDOWS/system32/n9elo8.dll | 2010-2-14 16:50:54 | Flacdker Product | 1, 0, 2, 8 | Transactin_Module | Copyright 2006 | 1, 0, 2, 8 | RealNetworks Corporation | | Browser Services | Browser Services O4 - HKCU/../run: [健康155网] 点击弹出网页广告.可以永久关闭弹出窗口 O4 - HKCU/../run: [se情网站] 点击弹出网页广告,可以关闭弹出网页窗口 O4 - HKLM/../run: [UUSEE] C:/Program Files/Common Files/uusee/UUSeeMediaCenter.exe O4 - HKLM/../run: [Default Action] C:/windows/system32/LABEL.lnk O4 - HKLM/../run: [StlockIE] E:/Program Files/NBA LIVE 2008/Webserver.exe O4 - HKLM/../run: [xydzyh] C:/WINDOWS/system32/xydzyh.exe O4 - HKLM/../run: [360Soft] C:/WINDOWS/system32/scvhost.exe ms.job O9 - IE工具栏扩展按钮HKLM：百度一下，你就知道! - {0036A2BA-F043-481D-81B1-BF9761EDB7DE} -hxxp://www．sw777．cn O9 - IE工具菜单扩展项HKLM：百度一下，你就知道! - {0036A2BA-F043-481D-81B1-BF9761EDB7DE} -hxxp://www．sw777．cn O9 - IE工具栏扩展按钮HKLM：好站金牌网址! - {078EE8AC-3825-41EB-BADB-A8A4F21A6A56} -hxxp://www．72227．cn O9 - IE工具菜单扩展项HKLM：好站金牌网址! - {078EE8AC-3825-41EB-BADB-A8A4F21A6A56} -hxxp://www．72227．cn O23 - 服务: 6to4 (ComputerBrow) - C:/WINDOWS/System32/svchost.exe -k netsvcs | 2007-6-1 0:0:0 -> C:/WINDOWS/system32/6to4ex.dll(自动) O23 - 服务: AsyncMac (RAS Asynchronous Media Driver) - system32/DRIVERS/asyncmac.sys (手动) O23 - 服务: BrowserMedia (BrowserMedia) - C:/WINDOWS/system32/32u4.exe(自动) O23 - 服务: IE_WinServerName (Windows CreaterIE) - C:/WINDOWS/MSDDOS.exe(自动) O23 - 服务: MediaIECom (MediaIECom) - C:/WINDOWS/system32/733d.exe | 2010-2-6 17:51:24(自动) O23 - 服务: OSEvent (OSEvent) - C:/WINDOWS/system32/s.exe | 2010-1-20 13:31:22 | Microsoft(R) Windows(R) Operating System | 3.1.2600.2160 | COM Surrogate | Microsoft Corporation | 3.1.2600.2160 (xpsp_sp2_rtm.040803-2158) | Microsoft Corporation| ? | COM| ?(自动) O23 - 服务: Sanseex (Remote Access Connection Manage) - C:/WINDOWS/system32/Servicx.exe(自动) O23 - 服务: W32Time (Windows Time) - C:/WINDOWS/System32/svchost.exe -k netsvcs | 2007-6-1 0:0:0 -> c:/windows/system32/senol/qqbupreais.dll(自动) O29 - HKCU-Search Bar =hxxp://www．soso313．cn/?ars
