虽然对这些界于流氓和病毒之间扮演无间道并且乐此不疲的滥人们有所闻,但是当我自己的机器真的被 http://www.k662.com/home.htm 彻底劫持了我算是大开了眼界.
    我虽说不是一个真正的菜鸟,但是当我用尽浑身解数还是没有把这个祖宗请出我的COMPUTER的时候,我彻底绝望了.虽然非常不愿意祭出格式化这个板斧并且也知道这并不是电脑人真正应该做的,但愤怒的火焰还是烧光了一切.本以为就此跟这个梦魇说拜拜的时候,三天后,我彻底崩溃了.幽灵一样的它又回来了,请大虾们就命啊.

HijackThis_815汉化版扫描日志 V1.99.1
保存于      23:23:30, 日期 2006-9-25
操作系统：  Windows XP SP2 (WinNT 5.01.2600)
浏览器：    Unable to get Internet Explorer version!

当前运行的进程：         
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\KAV2007\KWatch.EXE
C:\WINDOWS\Explorer.exe
C:\KAV2007\KPfwSvc.EXE
C:\KAV2007\KAVStart.exe
C:\WINDOWS\system32\ctfmon.exe
C:\KAV2007\KPFW32.EXE
C:\KAV2007\KMailMon.EXE
D:\Program Files\Maxthon\Maxthon.exe
C:\WINDOWS\system32\conime.exe
C:\WINDOWS\system32\wuauclt.exe
C:\DOCUME~1\huayan\LOCALS~1\Temp\Rar$EX00.234\winspeed.exe
D:\Program Files\HijackThis1991汉化版\HijackThis1991zww.exe

F2 - REG:system.ini: Shell=Explorer.exe ntio.exe
F2 - REG:system.ini: UserInit=C:\WINDOWS\system32\Userinit.exe
O4 - 启动项HKLM\\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O4 - 启动项HKLM\\Run: [Start] Start.exe
O4 - HKCU\..\Run: [Start] Start.exe
O14 - IERESET.INF: SEARCH_PAGE_URL=
O14 - IERESET.INF: START_PAGE_URL=
O16 - DPF: {8D9E0B29-563C-4226-86C1-5FF2AE77E1D2} (AxSubmitControl Class) - https://mybank.icbc.com.cn/icbc/perbank/AxSafeControls.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{07EBDB3B-A8BE-48A0-A4C4-4EEAD191EEA5}: NameServer = 202.99.166.4 202.99.160.68
O17 - HKLM\System\CS1\Services\Tcpip\..\{07EBDB3B-A8BE-48A0-A4C4-4EEAD191EEA5}: NameServer = 202.99.166.4 202.99.160.68
O17 - HKLM\System\CS2\Services\Tcpip\..\{07EBDB3B-A8BE-48A0-A4C4-4EEAD191EEA5}: NameServer = 202.99.166.4 202.99.160.68
O23 - NT 服务: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - NT 服务: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - NT 服务: Kingsoft Personal Firewall Service (KPfwSvc) - Kingsoft Corporation - C:\KAV2007\KPfwSvc.EXE
O23 - NT 服务: Kingsoft Antivirus KWatch Service (KWatchSvc) - Kingsoft Corporation - C:\KAV2007\KWatch.EXE



我该用那种方法 才能彻底杜绝这个恶棍?

关闭所有浏览窗口以及一些不必要的程序
运行Hijackthis，扫描结束后在下列选项前打上勾，然后选"修复
F2 - REG:system.ini: Shell=Explorer.exe ntio.exe
O4 - 启动项HKLM\\Run: [Start] Start.exe
O4 - HKCU\..\Run: [Start] Start.exe
双击我的电脑，工具，文件夹选项，查看，单击选取"显示隐藏文件或文件夹"清除"隐藏受保护的操作系统文件（推荐）"复选框。在提示确定更改时，单击“是”，清除“隐藏已知文件类型的扩展名
删除
C:\WINDOWS\system32\ntio.exe
C:\WINDOWS\system32\Start.exe
一定要删除这两个东东
如果找不到，可以看一下这个帖子
给菜鸟的东东—KillBox的使用技巧
http://forum.ikaka.com/topic.asp?board=28&artid=8160799
完后重启。
请下载 System Repair Engineer，使用“智能扫描”，按下“扫描”按钮进行扫描，扫描完成后按下“保存报告”按钮保存报告日志文件（SREng.LOG），把保存的报告日志文件内容复制-粘贴上来
下载网址
http://www.kztechs.com/sreng/sreng2.zip
http://forum.ikaka.com/topic.asp?board=67&artid=5188931
日志一次粘不完，分次粘完，请不要修改。

万分感谢 我现在就开工

惊了 显示不了隐藏文件.....好多东西搞不定了...难道又要重装...

在 安全模式下面 进行修复操作 没有效果.怀疑流氓软件绑架 Explorer 用管理器结束Explorer进程.执行修复步骤,删除可疑文件.部分修复成功,但是遗憾的是不能显示隐藏文件的问题还是不能得到修正,贴出来修复后的SREngLOG,请教高手.

2006-09-26,09:19:57

System Repair Engineer 2.0.21.505 (2.0 RC 2)
Smallfrogs (http://www.KZTechs.com)

Windows XP Professional Service Pack 2 (Build 2600)
- 管理权限用户 - 完整功能

以下内容被选中：
    所有的启动项目（包括注册表、启动文件夹、服务等）
    浏览器加载项
    正在运行的进程（包括进程模块信息）
    文件关联


启动项目
注册表
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
    <ctfmon.exe><C:\WINDOWS\system32\ctfmon.exe>  [Microsoft Corporation]
    <KavPFW><"C:\KAV2007\KPFW32.EXE">  [Kingsoft Corporation]
[HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows]
    <load><>  []
    <run><>  []
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
    <shell><Explorer.exe>  [Microsoft Corporation]
    <Userinit><C:\WINDOWS\system32\Userinit.exe>  [Microsoft Corporation]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Windows]
    <AppInit_DLLs><>  []
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
    <UIHost><logonui.exe>  [Microsoft Corporation]
[HKEY_CURRENT_USER\Control Panel\Desktop]
    <SCRNSAVE.EXE><C:\KAV2007\KaScrScn.SCR>  [Kingsoft Corporation]

==================================
启动文件夹
服务
[Ati HotKey Poller / Ati HotKey Poller]
  <C:\WINDOWS\system32\Ati2evxx.exe><ATI Technologies Inc.>
[ATI Smart / ATI Smart]
  <C:\WINDOWS\system32\ati2sgag.exe><>
[Kingsoft Personal Firewall Service / KPfwSvc]
  <"C:\KAV2007\KPfwSvc.EXE"><Kingsoft Corporation>
[Kingsoft Antivirus KWatch Service / KWatchSvc]
  <C:\KAV2007\KWatch.EXE><Kingsoft Corporation>

==================================
浏览器加载项
正在运行的进程
[PID: 380][\SystemRoot\System32\smss.exe]  <Microsoft Corporation><5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)>
[PID: 696][\??\C:\WINDOWS\system32\csrss.exe]  <Microsoft Corporation><5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)>
[PID: 804][\??\C:\WINDOWS\system32\winlogon.exe]  <Microsoft Corporation><5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)>
[PID: 912][C:\WINDOWS\system32\services.exe]  <Microsoft Corporation><5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)>
[PID: 924][C:\WINDOWS\system32\lsass.exe]  <Microsoft Corporation><5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)>
[PID: 1132][C:\WINDOWS\system32\Ati2evxx.exe]  <ATI Technologies Inc.><6.14.10.4129>
    [C:\WINDOWS\system32\Ati2edxx.dll]  <ATI Technologies, Inc.><6, 14, 10, 2500>
[PID: 1172][C:\WINDOWS\system32\svchost.exe]  <Microsoft Corporation><5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)>
[PID: 1264][C:\WINDOWS\system32\svchost.exe]  <Microsoft Corporation><5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)>
[PID: 1396][C:\WINDOWS\System32\svchost.exe]  <Microsoft Corporation><5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)>
[PID: 1456][C:\WINDOWS\system32\svchost.exe]  <Microsoft Corporation><5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)>
[PID: 1576][C:\WINDOWS\system32\svchost.exe]  <Microsoft Corporation><5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)>
[PID: 1796][C:\KAV2007\KWatch.EXE]  <Kingsoft Corporation><2005, 9, 27, 51>
    [C:\KAV2007\KAVIPC2.DLL]  <Kingsoft Corporation><2004, 12, 28, 20>
    [C:\KAV2007\KAEPlat.DLL]  <Kingsoft Corp.><2006, 5, 30, 59>
    [C:\KAV2007\KAEMem.DAT]  <Kingsoft><2006, 5, 17, 14>
    [C:\KAV2007\KAEUnpack.DAT]  <Kingsoft Corp.><2006, 7, 27, 59>
[PID: 1932][C:\WINDOWS\system32\spoolsv.exe]  <Microsoft Corporation><5.1.2600.2696 (xpsp_sp2_gdr.050610-1519)>
[PID: 268][C:\WINDOWS\Explorer.EXE]  <Microsoft Corporation><6.00.2900.2180 (xpsp_sp2_rtm.040803-2158)>
    [C:\KAV2007\KAVEXT.DLL]  <Kingsoft Corporation><2005, 8, 5, 16>
    [C:\Program Files\WinRAR\rarext.dll]  <N/A><N/A>
    [C:\KAV2007\KASocket.dll]  <Kingsoft Corporation><2005, 2, 22, 233>
    [C:\KAV2007\KMailOEBand.dll]  <Kingsoft Corporation><2006, 9, 7, 132>
[PID: 860][C:\KAV2007\KPfwSvc.EXE]  <Kingsoft Corporation><2005, 9, 5, 28>
[PID: 1024][C:\WINDOWS\System32\alg.exe]  <Microsoft Corporation><5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)>
[PID: 1592][C:\WINDOWS\system32\ctfmon.exe]  <Microsoft Corporation><5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)>
[PID: 972][D:\Program Files\Maxthon\Maxthon.exe]  <Maxthon International Ltd.><1, 5, 6, 39>
    [D:\Program Files\Maxthon\maxzlib.dll]  < ><1, 0, 0, 2>
    [D:\Program Files\Maxthon\Services\RealTime\real_time.dll]  <><1, 0, 0, 1>
    [C:\KAV2007\KASocket.dll]  <Kingsoft Corporation><2005, 2, 22, 233>
    [C:\KAV2007\KMailOEBand.dll]  <Kingsoft Corporation><2006, 9, 7, 132>
    [C:\KAV2007\KAScript.DLL]  <Kingsoft Corporation><2006, 2, 10, 60>
    [C:\KAV2007\KAEPlat.DLL]  <Kingsoft Corp.><2006, 5, 30, 59>
    [C:\KAV2007\KAEMem.DAT]  <Kingsoft><2006, 5, 17, 14>
    [C:\KAV2007\KAEUnpack.DAT]  <Kingsoft Corp.><2006, 7, 27, 59>
    [C:\WINDOWS\system32\Macromed\Flash\Flash9.ocx]  <Adobe Systems, Inc.><9,0,16,0>
[PID: 616][C:\KAV2007\KPFW32.EXE]  <Kingsoft Corporation><2006, 9, 7, 656>
    [C:\KAV2007\KAVIPC2.DLL]  <Kingsoft Corporation><2004, 12, 28, 20>
    [C:\KAV2007\KAConfig.DLL]  <Kingsoft Corporation><2006, 8, 23, 38>
    [C:\KAV2007\FiltList.dll]  <N/A><N/A>
    [C:\KAV2007\KAVPassp.DLL]  <Kingsoft Corporation><2006, 9, 7, 270>
    [C:\KAV2007\KAEPlat.DLL]  <Kingsoft Corp.><2006, 5, 30, 59>
    [C:\KAV2007\KAEMem.DAT]  <Kingsoft><2006, 5, 17, 14>
    [C:\KAV2007\KAEUnpack.DAT]  <Kingsoft Corp.><2006, 7, 27, 59>
    [C:\KAV2007\KASocket.dll]  <Kingsoft Corporation><2005, 2, 22, 233>
[PID: 224][C:\KAV2007\KMailMon.EXE]  <Kingsoft Corporation><2006, 9, 7, 918>
    [C:\KAV2007\KAntiSpm.dll]  <Kingsoft Corporation><2006, 8, 19, 104>
    [C:\KAV2007\KAVIPC2.DLL]  <Kingsoft Corporation><2004, 12, 28, 20>
    [C:\KAV2007\KAECall2.DLL]  <Kingsoft Corporation><2004, 12, 28, 7>
    [C:\KAV2007\KAEPlat.DLL]  <Kingsoft Corp.><2006, 5, 30, 59>
    [C:\KAV2007\KAEMem.DAT]  <Kingsoft><2006, 5, 17, 14>
    [C:\KAV2007\KAEUnpack.DAT]  <Kingsoft Corp.><2006, 7, 27, 59>
    [C:\KAV2007\KAConfig.DLL]  <Kingsoft Corporation><2006, 8, 23, 38>
    [C:\KAV2007\KASocket.dll]  <Kingsoft Corporation><2005, 2, 22, 233>
    [C:\KAV2007\KMailOEBand.dll]  <Kingsoft Corporation><2006, 9, 7, 132>
[PID: 1740][C:\WINDOWS\system32\wuauclt.exe]  <Microsoft Corporation><5.8.0.2469 built by: lab01_n(wmbla)>
    [C:\KAV2007\KMailOEBand.dll]  <Kingsoft Corporation><2006, 9, 7, 132>
    [C:\KAV2007\KASocket.dll]  <Kingsoft Corporation><2005, 2, 22, 233>
[PID: 680][D:\download\SREng2\SREng.exe]  <Smallfrogs Studio><2.0.21.505>
    [C:\KAV2007\KMailOEBand.dll]  <Kingsoft Corporation><2006, 9, 7, 132>
    [C:\KAV2007\KASocket.dll]  <Kingsoft Corporation><2005, 2, 22, 233>

==================================
文件关联
.TXT  OK. [%SystemRoot%\system32\NOTEPAD.EXE %1]
.EXE  OK. ["%1" %*]
.COM  OK. ["%1" %*]
.PIF  OK. ["%1" %*]
.REG  OK. [regedit.exe "%1"]
.BAT  OK. ["%1" %*]
.SCR  OK. ["%1" /S]
.CHM  Error. ["hh.exe" %1]
.HLP  Error. [winhlp32.exe %1]
.INI  OK. [%SystemRoot%\System32\NOTEPAD.EXE %1]
.INF  OK. [%SystemRoot%\System32\NOTEPAD.EXE %1]
.VBS  OK. [%SystemRoot%\System32\WScript.exe "%1" %*]
.JS  OK. [%SystemRoot%\System32\WScript.exe "%1" %*]
.LNK  OK. [{00021401-0000-0000-C000-000000000046}]

==================================

打开System Repair Engineer（也就是你的扫描日志软件SREng.exe），使用“系统修复，文件关联，勾选“全选”点“修复”使所有扩展名都恢复正常

日志看不出问题了
有异常你描述一下
显示不了文件，可以看一下这个帖子
http://forum.ikaka.com/topic.asp?board=3&artid=8130575