一位网友的电脑，IE浏览器首页被强制设置为 www.6781.com，让偶帮忙检修。
到 http://endurer.ys168.com 下载 HijackThis 和 ProcView。
在用 HijackThis 扫描 log，生成启动项列表，用 ProcView 导出的系统进程列表，传回来。
在 HijackThis 扫描的 log发现如下可疑项：
/-------
Logfile of HijackThis v1.99.1
Scan saved at 17:58:56, on 2006-11-30
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Running processes:
G:/WINDOWS/SYSTEM32/RUNDLLFROMWIN2000.EXE
G:/Program Files/Common Files/System/Update.exe
F2 - REG:system.ini: UserInit=userinit.exe,
O2 - BHO: NewWeb Controller - {9ACEEE31-1440-471B-AA46-72B061FE7D61} - G:/WINDOWS/system32/SCIntruder.dll
O4 - HKLM/../Run: [System] G:/Program Files/Common Files/System/Update.exe
O4 - HKLM/../Run: [RavAV] G:/WINDOWS/RavMonE.exe
O6 - HKCU/Software/Policies/Microsoft/Internet Explorer/Restrictions present
O6 - HKCU/Software/Policies/Microsoft/Internet Explorer/Control Panel present
O6 - HKLM/Software/Policies/Microsoft/Internet Explorer/Restrictions present
-------/
在 ProcView 导出的系统进程列表中发现下列可疑项目：
/-------
Windows XP (5.1.2600 Service Pack 2)
2006-11-30 18:32:15进程列表
G:/WINDOWS/System32/svchost.exe
g:/windows/system32/vpgqhi34.dll
G:/WINDOWS/SYSTEM32/RUNDLLFROMWIN2000.EXE
G:/WINDOWS/SYSTEM32/RUNDLLFROMWIN2000.EXE
G:/WINDOWS/SYSTEM32/WBEM/IBHQTW19.DLL
G:/WINDOWS/RavMonE.exe
G:/WINDOWS/RavMonE.exe
-------/
在 HijackThis 生成的启动项列表中发现如下可疑服务：
/-------
StartupList report, 2006-11-30, 18:39:57
StartupList version: 1.52.2
Started from : G:/tools/HijackThis.EXE
Detected: Windows XP SP2 (WinNT 5.01.2600)
Detected: Internet Explorer v6.00 SP2 (6.00.2900.2180)
* Using default options
* Including empty and uninteresting sections
* Showing rarely important sections
==================================================
Enumerating Windows NT/2000/XP services
00: /SystemRoot/System32/drivers/8590312.sys (system)
108375: System32/drivers/108375.sys (system)
63090: System32/drivers/63090.sys (system)
a0: /SystemRoot/System32/drivers/108375.sys (system)
paraudio: /??/G:/WINDOWS/system32/drivers/paraudio.sys (autostart)
Network IPSEC Connections: G:/WINDOWS/SYSTEM32/RUNDLLFROMWIN2000.EXE G:/WINDOWS/SYSTEM32/WBEM/IBHQTW19.DLL,Export 1087 (autostart)
＜endurer注：Windows系统有个内置服务：IPSEC Services: %SystemRoot%/system32/lsass.exe (autostart)，不要弄混了＞
-------/
用 ProcView 把
/-------
G:/WINDOWS/SYSTEM32/RUNDLLFROMWIN2000.EXE
G:/WINDOWS/RavMonE.exe
-------/
把包传回来后终止它们。忘记把
/-------
g:/windows/system32/vpgqhi34.dll
G:/WINDOWS/SYSTEM32/WBEM/IBHQTW19.DLL
-------/
打包了，汗！
刚用WinRAR找到
/-------
G:/Documents and Settings/user/Local Settings/Temp/jh.exe
G:/Program Files/Common Files/System/Update.exe
G:/WINDOWS/RavMonE.exe
-------/
打包传回来，网友就下班了。
