一位网友的电脑最近打开IE总是显示hxxp://www.pp8000.cn，把IE首页设为空白也没用，而且卡卡安全助手还报IE为可疑后门程序。
请偶帮忙检修。
到 http://purpleendurer.ys168.com 下载 FileInfo 检测 iexplore.exe，通过了MS数字签名，应该没问题。
使用 pe_xscan 扫描 log 并分析，发现如下可疑项：
pe_xscan 09-01-08 by Purple Endurer 2009-2-11 21:27:45 Windows XP Service Pack 3(5.1.2600) MSIE:6.0.2900.5512 管理员用户组 正常模式 [System Process] *0 C:/windows/donben.dll|2009-2-11 17:44:52|Microsoft(R) Windows(R) Operating System|1, 0, 2, 1|Microsoft WinEvent Support|Copyright ? 2002|1, 0, 2, 1|Microsoft Corporation||wthelp|wthelp.dll C:/windows/system32/Rundll32.exe *2828|Microsoft(R) Windows(R) Operating System|5.1.2600.5512|Run a DLL as an App|(C) Microsoft Corporation. All rights reserved.|5.1.2600.5512 (xpsp.080413-2105)|Microsoft Corporation|?|rundll|RUNDLL.EXE C:/WINDOWS/DOWNLO~1/fonst.dll|2009-2-10 15:9:36|Microsoft Net Library|5, 0, 2, 0|Copyright 2003|Microsoft Net Library|5, 0, 2, 0|Microsoft(R) Windows(R) Operating System|Microsoft Corporation|benhelp|benhelp.DLL C:/windows/donben.dll|2009-2-10 15:9:40|Microsoft(R) Windows(R) Operating System|1, 0, 0, 1|Microsoft Communicate Improve Service Provider|版权所有 (C) 1999|1, 0, 0, 1|Microsoft Corporation||wtlpro|wtlpro.DLL O2 - BHO BandIE Class - {77FEF28E-EB96-44FF-B511-3185DEA48697} =C:/PROGRA~1/baidu/bar/baidubar.dll|2008-12-23 10:51:58 O2 - BHO benobj Class - {AB54800B-F901-43AA-AB71-38A4CE758A5A} =C:/WINDOWS/DOWNLO~1/fonst.dll|2009-2-10 15:9:36 O3 - IE工具栏: - {B580CF65-E151-49C3-B73F-70B13FCA8E86} =C:/PROGRA~1/baidu/bar/baidubar.dll|2008-12-23 10:51:58 O4 - HKLM/../Run: [VPro] C:/windows/system32/Rundll32.exe "C:/WINDOWS/DOWNLO~1/fonst.dll",WaitWindows O6 - HKCU/Software/Policies/Microsoft/Internet Explorer/restrictions 存在 IE或Internet选项可能受到限制 O6 - HKCU/Software/Policies/Microsoft/Internet Explorer/Control Panel 存在 IE或Internet选项可能受到限制 O9 - IE工具栏扩展按钮HKLM： - {09BA8F6D-CB54-424B-839C-C2A6C8E6B436} - O9 - IE工具菜单扩展项HKLM： - {09BA8F6D-CB54-424B-839C-C2A6C8E6B436} - O10 - LSP: ML_IP =C:/windows/system32/msben.dll|2009-2-10 15:9:40|Microsoft(R) Windows(R) Operating System|1, 0, 0, 1|Microsoft Communicate Improve Service Provider|版权所有 (C) 1999|1, 0, 0, 1|Microsoft Corporation||wtlpro|wtlpro.DLL O10 - LSP: ML_UDP_CHAIN =C:/windows/system32/msben.dll|2009-2-10 15:9:40|Microsoft(R) Windows(R) Operating System|1, 0, 0, 1|Microsoft Communicate Improve Service Provider|版权所有 (C) 1999|1, 0, 0, 1|Microsoft Corporation||wtlpro|wtlpro.DLL O29 - HKLM-Start Page =hxxp://wwv.1188.com/ O29 - HKLM-Default_Page_URL =hxx://wwv.1188.com/ O30 - IeOpenHomePage = "C:/Program Files/Internet Explorer/iexplore.exe" hxxp://www.pp8000.cn
开始-》设备-》控制面板-》Internet选项，打开加截项管理，把O2、O3、O9全部禁用了。再打开IE，卡卡不再报告了。
卸载Baidu，启动卡卡安全助手清理……
