运行QQ提示找不到SVHUVS.DLL？一些安全网站打不开？修复～

运行QQ提示找不到SVHUVS.DLL？一些安全网站打不开？修复～

 

endurer 原创
2008-10-19 第1版

 

前天，一位同事说他的电脑，在运行QQ时提示找不到文件SVHUVS.DLL，另外有网站打不开，进安全模式会蓝屏。请偶帮忙检修。

 



 

同事的电脑中装有瑞星和360卫士。先Google一下SVHUVS.DLL是什么东东，不料Google网站打不开。换sogou，可以正常打开，搜索得知SVHUVS.DLL是个恶意文件。

想下载金山清理专家可以修复安全模式(偶都在卡卡论坛提了几次了，可瑞星卡卡安全助手还是没有加入这个功能)，不料打开金山毒霸的网站没打开，电脑却蓝屏了。

重启电脑，下载 pe_xscan 扫描 log并分析，发现如下可疑项：

pe_xscan 08-08-01 by Purple Endurer
2008-10-17 12:3:21
Windows XP Service Pack 2(5.1.2600)
MSIE:7.0.5730.13
管理员用户组
正常模式

O1 - Hosts: 219．235．3．16    search．114．vnet．cn
O1 - Hosts: 219．235．3．16    keyword．vnet．cn
O1 - Hosts: 219．235．3．16    auto．search．msn．com
O1 - Hosts: 219．235．3．16    search．msn．com
O1 - Hosts: 219．235．3．16    cnweb．search．live．com
O1 - Hosts: 219．235．3．16    www．k369．com
O1 - Hosts: 219．235．3．16    www．5566．net
O1 - Hosts: 219．235．3．16    360．cn
O1 - Hosts: 219．235．3．16    360．qihoo．com
O1 - Hosts: 219．235．3．16    360safe．qihoo．com
O1 - Hosts: 219．235．3．16    forum．ikaka．com
O1 - Hosts: 219．235．3．16    www．ikaka．com
O1 - Hosts: 202．165．102．243 update．ikaka．com
O1 - Hosts: 219．235．3．16    forum．jiangmin．com
O1 - Hosts: 202．165．102．243 update．jiangmin．com
O1 - Hosts: 219．235．3．16    tieba．baidu．com
O1 - Hosts: 219．235．3．16    post．baidu．com
O1 - Hosts: 219．235．3．16    zhidao．baidu．com
O1 - Hosts: 219．235．3．16    www．baidu．com
O1 - Hosts: 202．165．102．243 update．rising．com．cn
O1 - Hosts: 219．235．3．16    online．rising．com．cn
O1 - Hosts: 202．165．102．243 center．rising．com．cn
O1 - Hosts: 219．235．3．16    up．duba．net
O1 - Hosts: 219．235．3．16    vi．duba．net
O1 - Hosts: 219．235．3．16    shadu．baidu．com
O1 - Hosts: 219．235．3．16    du．baidu．com
O1 - Hosts: 219．235．3．16    security．symantec．com
O1 - Hosts: 219．235．3．16    shadu．duba．net
O1 - Hosts: 219．235．3．16    bbs．duba．net
O1 - Hosts: 219．235．3．16    online．jiangmin．com
O1 - Hosts: 219．235．3．16    cn．mcafee．com
O1 - Hosts: 219．235．3．16    www．ahn．com．cn
O1 - Hosts: 219．235．3．16    www．kaspersky．com．cn
O1 - Hosts: 219．235．3．16    www．pcav．cn
O1 - Hosts: 219．235．3．16    www．luosoft．com
O1 - Hosts: 219．235．3．16    www．im286．com
O1 - Hosts: 219．235．3．16    an．baidu．com
O1 - Hosts: 219．235．3．16    ma．baidu．com
O1 - Hosts: 219．235．3．16    bbs．htmlman．net
O1 - Hosts: 202．165．102．243 download．rising．com．cn
O1 - Hosts: 202．165．102．243 rsup08．rising．com．cn
O1 - Hosts: 219．235．3．16    10000．286er．com
O1 - Hosts: 219．235．3．16    im286．net
O1 - Hosts: 219．235．3．16    ju．qihoo．com
O1 - Hosts: 219．235．3．16    bbs．chinaz．com
O1 - Hosts: 219．235．3．16    www．qihoo．com
O1 - Hosts: 202．165．102．243 dnl-cn1．kaspersky-labs．com
O1 - Hosts: 202．165．102．243 dnl-cn2．kaspersky-labs．com
O1 - Hosts: 202．165．102．243 dnl-cn3．kaspersky-labs．com
O1 - Hosts: 202．165．102．243 dnl-cn4．kaspersky-labs．com
O1 - Hosts: 202．165．102．243 dnl-cn5．kaspersky-labs．com
O1 - Hosts: 202．165．102．243 dnl-cn6．kaspersky-labs．com
O1 - Hosts: 202．165．102．243 dnl-cn7．kaspersky-labs．com
O1 - Hosts: 202．165．102．243 dnl-cn8．kaspersky-labs．com
O1 - Hosts: 202．165．102．243 dnl-cn9．kaspersky-labs．com
O1 - Hosts: 202．165．102．243 dnl-cn10．kaspersky-labs．com
O1 - Hosts: 202．165．102．243 dnl-cn11．kaspersky-labs．com
O1 - Hosts: 202．165．102．243 dnl-cn12．kaspersky-labs．com
O1 - Hosts: 202．165．102．243 dnl-cn13．kaspersky-labs．com
O1 - Hosts: 202．165．102．243 dnl-cn14．kaspersky-labs．com
O1 - Hosts: 202．165．102．243 dnl-cn15．kaspersky-labs．com
O1 - Hosts: 202．165．102．243    dnl-eu1．kaspersky-labs．com
O1 - Hosts: 202．165．102．243    dnl-eu2．kaspersky-labs．com
O1 - Hosts: 202．165．102．243    dnl-eu3．kaspersky-labs．com
O1 - Hosts: 202．165．102．243    dnl-eu4．kaspersky-labs．com
O1 - Hosts: 202．165．102．243    dnl-eu5．kaspersky-labs．com
O1 - Hosts: 202．165．102．243    dnl-eu6．kaspersky-labs．com
O1 - Hosts: 202．165．102．243    dnl-eu7．kaspersky-labs．com
O1 - Hosts: 202．165．102．243    dnl-eu8．kaspersky-labs．com
O1 - Hosts: 202．165．102．243    dnl-eu9．kaspersky-labs．com
O1 - Hosts: 202．165．102．243    dnl-eu10．kaspersky-labs．com
O1 - Hosts: 202．165．102．243    dnl-eu11．kaspersky-labs．com
O1 - Hosts: 202．165．102．243    dnl-eu12．kaspersky-labs．com
O1 - Hosts: 202．165．102．243    dnl-eu13．kaspersky-labs．com
O1 - Hosts: 202．165．102．243    dnl-eu14．kaspersky-labs．com
O1 - Hosts: 202．165．102．243    dnl-eu15．kaspersky-labs．com
O1 - Hosts: 202．165．102．243    dnl-us1．kaspersky-labs．com
O1 - Hosts: 202．165．102．243    dnl-us2．kaspersky-labs．com
O1 - Hosts: 202．165．102．243    dnl-us3．kaspersky-labs．com
O1 - Hosts: 202．165．102．243    dnl-us4．kaspersky-labs．com
O1 - Hosts: 202．165．102．243    dnl-us5．kaspersky-labs．com
O1 - Hosts: 202．165．102．243    dnl-us6．kaspersky-labs．com
O1 - Hosts: 202．165．102．243    dnl-us7．kaspersky-labs．com
O1 - Hosts: 202．165．102．243    dnl-us8．kaspersky-labs．com
O1 - Hosts: 202．165．102．243    dnl-us9．kaspersky-labs．com
O1 - Hosts: 202．165．102．243    dnl-us10．kaspersky-labs．com
O1 - Hosts: 202．165．102．243    dnl-us11．kaspersky-labs．com
O1 - Hosts: 202．165．102．243    dnl-us12．kaspersky-labs．com
O1 - Hosts: 202．165．102．243    dnl-us13．kaspersky-labs．com
O1 - Hosts: 202．165．102．243    dnl-us14．kaspersky-labs．com
O1 - Hosts: 202．165．102．243    dnl-us15．kaspersky-labs．com
O1 - Hosts: 202．165．102．243    dnl-ru1．kaspersky-labs．com
O1 - Hosts: 202．165．102．243    dnl-ru2．kaspersky-labs．com
O1 - Hosts: 202．165．102．243    dnl-ru3．kaspersky-labs．com
O1 - Hosts: 202．165．102．243    dnl-ru4．kaspersky-labs．com
O1 - Hosts: 202．165．102．243    dnl-ru5．kaspersky-labs．com
O1 - Hosts: 202．165．102．243    dnl-ru6．kaspersky-labs．com
O1 - Hosts: 202．165．102．243    dnl-ru7．kaspersky-labs．com
O1 - Hosts: 202．165．102．243    dnl-ru8．kaspersky-labs．com
O1 - Hosts: 202．165．102．243    dnl-ru9．kaspersky-labs．com
O1 - Hosts: 202．165．102．243    dnl-ru10．kaspersky-labs．com
O1 - Hosts: 202．165．102．243    dnl-ru11．kaspersky-labs．com
O1 - Hosts: 202．165．102．243    dnl-ru12．kaspersky-labs．com
O1 - Hosts: 202．165．102．243    dnl-ru13．kaspersky-labs．com
O1 - Hosts: 202．165．102．243    dnl-ru14．kaspersky-labs．com
O1 - Hosts: 202．165．102．243    dnl-ru15．kaspersky-labs．com
O1 - Hosts: 202．165．102．243    dnl-jp1．kaspersky-labs．com
O1 - Hosts: 202．165．102．243    dnl-jp2．kaspersky-labs．com
O1 - Hosts: 202．165．102．243    dnl-jp3．kaspersky-labs．com
O1 - Hosts: 202．165．102．243    dnl-jp4．kaspersky-labs．com
O1 - Hosts: 202．165．102．243    dnl-jp5．kaspersky-labs．com
O1 - Hosts: 202．165．102．243    dnl-jp6．kaspersky-labs．com
O1 - Hosts: 202．165．102．243    dnl-jp7．kaspersky-labs．com
O1 - Hosts: 202．165．102．243    dnl-jp8．kaspersky-labs．com
O1 - Hosts: 202．165．102．243    dnl-jp9．kaspersky-labs．com
O1 - Hosts: 202．165．102．243    dnl-jp10．kaspersky-labs．com
O1 - Hosts: 202．165．102．243    dnl-jp11．kaspersky-labs．com
O1 - Hosts: 202．165．102．243    dnl-jp12．kaspersky-labs．com
O1 - Hosts: 202．165．102．243    dnl-jp13．kaspersky-labs．com
O1 - Hosts: 202．165．102．243    dnl-jp14．kaspersky-labs．com
O1 - Hosts: 202．165．102．243    dnl-jp15．kaspersky-labs．com
O1 - Hosts: 202．165．102．243    dnl-kr1．kaspersky-labs．com
O1 - Hosts: 202．165．102．243    dnl-kr2．kaspersky-labs．com
O1 - Hosts: 202．165．102．243    dnl-kr3．kaspersky-labs．com
O1 - Hosts: 202．165．102．243    dnl-kr4．kaspersky-labs．com
O1 - Hosts: 202．165．102．243    dnl-kr5．kaspersky-labs．com
O1 - Hosts: 202．165．102．243    dnl-kr6．kaspersky-labs．com
O1 - Hosts: 202．165．102．243    dnl-kr7．kaspersky-labs．com
O1 - Hosts: 202．165．102．243    dnl-kr8．kaspersky-labs．com
O1 - Hosts: 202．165．102．243    dnl-kr9．kaspersky-labs．com
O1 - Hosts: 202．165．102．243    dnl-kr10．kaspersky-labs．com
O1 - Hosts: 202．165．102．243    dnl-kr11．kaspersky-labs．com
O1 - Hosts: 202．165．102．243    dnl-kr12．kaspersky-labs．com
O1 - Hosts: 202．165．102．243    dnl-kr13．kaspersky-labs．com
O1 - Hosts: 202．165．102．243    dnl-kr14．kaspersky-labs．com
O1 - Hosts: 202．165．102．243    dnl-kr15．kaspersky-labs．com
O1 - Hosts: 202．165．102．243    dnl-cd1．kaspersky-labs．com
O1 - Hosts: 202．165．102．243    dnl-cd2．kaspersky-labs．com
O1 - Hosts: 202．165．102．243    dnl-cd3．kaspersky-labs．com
O1 - Hosts: 202．165．102．243    dnl-cd4．kaspersky-labs．com
O1 - Hosts: 202．165．102．243    dnl-cd5．kaspersky-labs．com
O1 - Hosts: 202．165．102．243    dnl-cd6．kaspersky-labs．com
O1 - Hosts: 202．165．102．243    dnl-cd7．kaspersky-labs．com
O1 - Hosts: 202．165．102．243    dnl-cd8．kaspersky-labs．com
O1 - Hosts: 202．165．102．243    dnl-cd9．kaspersky-labs．com
O1 - Hosts: 202．165．102．243    dnl-cd10．kaspersky-labs．com
O1 - Hosts: 202．165．102．243    dnl-cd11．kaspersky-labs．com
O1 - Hosts: 202．165．102．243    dnl-cd12．kaspersky-labs．com
O1 - Hosts: 202．165．102．243    dnl-cd13．kaspersky-labs．com
O1 - Hosts: 202．165．102．243    dnl-cd14．kaspersky-labs．com
O1 - Hosts: 202．165．102．243    dnl-cd15．kaspersky-labs．com
O1 - Hosts: 202．165．102．243    downloads1．kaspersky-labs．com
O1 - Hosts: 202．165．102．243    downloads2．kaspersky-labs．com
O1 - Hosts: 202．165．102．243    downloads3．kaspersky-labs．com
O1 - Hosts: 202．165．102．243    downloads4．kaspersky-labs．com
O1 - Hosts: 202．165．102．243    downloads5．kaspersky-labs．com
O1 - Hosts: 219．235．3．16       ishare．sina．com．cn
O1 - Hosts: 219．235．3．16       search．cn．yahoo．com
O1 - Hosts: 219．235．3．16       www．google．com
O1 - Hosts: 219．235．3．16       google．com
O1 - Hosts: 219．235．3．16       www．google．cn
O1 - Hosts: 219．235．3．16       www．yahoo．com．cn
O1 - Hosts: 219．235．3．16       cn．yahoo．com
O1 - Hosts: 219．235．3．16       search．tom．com
O1 - Hosts: 219．235．3．16       zhuansha．duba．net
O1 - Hosts: 219．235．3．16       buy．duba．net
O1 - Hosts: 219．235．3．16       client．download．duba．net
O1 - Hosts: 219．235．3．16       page．so．163．com
O1 - Hosts: 219．235．3．16       www．soso．com
O1 - Hosts: 219．235．3．16       sou．china．com
O1 - Hosts: 219．235．3．16       test．591jx．com
O1 - Hosts: 219．235．3．16       a．topxxxx．cn
O1 - Hosts: 219．235．3．16       picon．chinaren．com
O1 - Hosts: 219．235．3．16       www．5566．net

O21 - SSODL - qtfstqywi() - {ed5810ca-65d0-ba25-76e1-65d09842c225} = C:/WINDOWS/system32/loanoltrd.dll

 

原来恶意程序修改了hosts文件（HijackThis/pe_xscan log中的O1项）。

在其它电脑上下载了金山清理专家，用U盘拷过来，运行，先修复安全模式，然后检测恶意程序，检测出了2个，清理了；提示hosts被恶意修改，修复。检测到了HijackThis/pe_xscan log中的O21项可疑，却没法处理。

还是下载 HijackThis备用罢。

重启电脑到安全模式，这次没蓝屏，可以正常进入。运行HijackThis，修复O21项，却发现O1项并没有被金山清理专家修复，用HijackThis修复。

重启电脑测试，Google，瑞星等网站可以正常打开了~

重新下载安装QQ~