在C：\WINNT下的MSNSMGER.EXE怎样删除呢。浏览器主页被改为www.ddzhz.com
用Hijackthis在安全模式下扫描的日志如下：
HijackThis@Qoo的扫描日志 V1.97.7
Scan saved at 13:29:11, on 2006-02-16
Platform: Windows 2000 SP4 (WinNT 5.00.2195)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)
Running processes:
C:\WINNT\System32\smss.exe
C:\WINNT\system32\winlogon.exe
C:\WINNT\system32\services.exe
C:\WINNT\system32\lsass.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\system32\netddesrv.exe
C:\WINNT\System32\WBEM\WinMgmt.exe
C:\WINNT\Explorer.EXE
C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\Rar$EX00.359\hijackthis.exe
R3 - Default URLSearchHook is missing
O1 - Hosts: 70.84.177.195 onlineaccounts2.abbeynational.co.uk
O1 - Hosts: 70.84.177.195 www3.aibgbonline.co.uk
O1 - Hosts: 70.84.177.195 www.bank.alliance-leicester.co.uk
O1 - Hosts: 70.84.177.195 login.iblogin.com
O1 - Hosts: 70.84.177.195 ww2.bankofscotlandhalifax-online.co.uk
O1 - Hosts: 70.84.177.195 inet.barclays.co.uk
O1 - Hosts: 70.84.177.195 iibank.barclays.co.uk
O1 - Hosts: 70.84.177.195 iibank.cahoot.com
O1 - Hosts: 70.84.177.195 www3.coventrybuildingsociety.co.uk
O1 - Hosts: 70.84.177.195 ww.hsbc.co.uk
O1 - Hosts: 70.84.177.195 login.ebank.offshore.hsbc.co.je
O1 - Hosts: 70.84.177.195 ww3.online-offshore.lloydstsb.com
O1 - Hosts: 70.84.177.195 ww3.online-business.lloydstsb.co.uk
O1 - Hosts: 70.84.177.195 ww3.online.lloydstsb.co.uk
O1 - Hosts: 70.84.177.195 ww3.online.lloydstsb.co.uk
O1 - Hosts: 70.84.177.195 ww3.online-business.lloydstsb.co.uk
O1 - Hosts: 70.84.177.195 ob2.nationet.com
O1 - Hosts: 70.84.177.195 ww3.onlinebanking.natwestoffshore.com
O1 - Hosts: 70.84.177.195 ww1.nwolb.com
O1 - Hosts: 70.84.177.195 ww1.onlinebanking.iombank.com
O1 - Hosts: 70.84.177.195 ww1.www.rbsdigital.com
O1 - Hosts: 70.84.177.195 welcome.smile.co.uk
O1 - Hosts: 70.84.177.195 login.365online.com
O1 - Hosts: 70.84.177.195 wvw.citizensbankonline.com
O1 - Hosts: 70.84.177.195 esecure.regionsnet.com
O1 - Hosts: 70.84.177.195 rollb.associatedbank.com
O1 - Hosts: 70.84.177.195 upb.unionplanters.com
O1 - Hosts: 70.84.177.195 www.onlinebanking.huntington.com
O1 - Hosts: 70.84.177.195 inet.southtrustonlinebanking.com
O1 - Hosts: 70.84.177.195 logon.personal.wamu.com
O1 - Hosts: 70.84.177.195 login.compassweb.com
O1 - Hosts: 70.84.177.195 logon.firstmeritib.com
O1 - Hosts: 70.84.177.195 login.ccfcuonline.org
O1 - Hosts: 70.84.177.195 ww3.etimebanker.bankofthewest.com
O1 - Hosts: 70.84.177.195 ww2.onlinebanking.lasallebank.com
O1 - Hosts: 70.84.177.195 wvw.totallyfreebanking.com
O1 - Hosts: 70.84.177.195 www.online.wellsfargo.com
O1 - Hosts: 70.84.177.195 www.onlinebanking.bankofoklahoma.com
O1 - Hosts: 70.84.177.195 accounts4.keybank.com
O1 - Hosts: 70.84.177.195 logon.bankone.com
O1 - Hosts: 70.84.177.195 www.secure.tdbanknorth.com
O1 - Hosts: 70.84.177.195 www.secure.mvnt4.com
O1 - Hosts: 70.84.177.195 ww.mynfbonline.com
O1 - Hosts: 70.84.177.195 login.forumcuonline.com
O1 - Hosts: 70.84.177.195 www.eds.usersonlnet.com
O1 - Hosts: 70.84.177.195 www.onlineid.bankofamerica.com
O1 - Hosts: 70.84.177.195 wvw.e-gold.com
O1 - Hosts: 70.84.177.195 pcbs.peoples.com
O1 - Hosts: 70.84.177.195 www.global1.onlinebank.com
O1 - Hosts: 70.84.177.195 ww2.mybranch.lafcu.com
O1 - Hosts: 70.84.177.195 login.webbanking.comerica.com
O1 - Hosts: 70.84.177.195 web.banking.firsttennessee.com
O1 - Hosts: 70.84.177.195 logon.members1st.org
O1 - Hosts: 70.84.177.195 www.cib.ibanking-services.com
O1 - Hosts: 70.84.177.195 www.miwebbusbank.ebanking-services.com
O1 - Hosts: 70.84.177.195 wvw.paypal.com
O1 - Hosts: 70.84.177.195 www.signin.ebay.com
O1 - Hosts: 70.84.177.195 wvw.etrade.com
O1 - Hosts: 70.84.177.195 ww4.fleethomelink.fleet.com
O1 - Hosts: 70.84.177.195 ww3.connect.skyfi.com
O1 - Hosts: 70.84.177.195 www6.usbank.com
O1 - Hosts: 70.84.177.195 www.bvi.bancodevalencia.es
O1 - Hosts: 70.84.177.195 extrant.banesto.es
O1 - Hosts: 70.84.177.195 banesnt.banesto.es
O1 - Hosts: 70.84.177.195 activia.caixagalicia.es
O1 - Hosts: 70.84.177.195 www.bancae.caixapenedes.com
O1 - Hosts: 70.84.177.195 login.caixasabadell.net
O1 - Hosts: 70.84.177.195 oii.cajamadrid.es
O1 - Hosts: 70.84.177.195 login.cajamar.es
O1 - Hosts: 70.84.177.195 login.ccm.es
O1 - Hosts: 70.84.177.195 ww.unicaja.es
O1 - Hosts: 70.84.177.195 www5.bancopopular.es
O1 - Hosts: 70.84.177.195 ww3.bbvanet.com
O1 - Hosts: 70.84.177.195 ww.bayernlb.de
O1 - Hosts: 70.84.177.195 ww2.berliner-volksbank.de
O1 - Hosts: 70.84.177.195 ww7.homebanking-berlin.de
O1 - Hosts: 70.84.177.195 portal09.commerzbanking.de
O1 - Hosts: 70.84.177.195 www.meine.deutsche-bank.de
O1 - Hosts: 70.84.177.195 ww2.dresdner-privat.de
O1 - Hosts: 70.84.177.195 ww.e-banking.helaba.de
O1 - Hosts: 70.84.177.195 ww.hsh-nordbank.de
O1 - Hosts: 70.84.177.195 www.my.hypovereinsbank.de
O1 - Hosts: 70.84.177.195 ww3.homebanking-berlin.de
O1 - Hosts: 70.84.177.195 ww3.homebanking-berlin.de
O1 - Hosts: 70.84.177.195 www.banking.lbbw.de
O1 - Hosts: 70.84.177.195 lrp.sparkasse-banking.de
O1 - Hosts: 70.84.177.195 ww3.homebanking-niedersachsen.de
O1 - Hosts: 70.84.177.195 www.onlinebanking.norisbank.de
O1 - Hosts: 70.84.177.195 www.banking.postbank.de
O1 - Hosts: 70.84.177.195 wvw.internetbanking.gad.de
O1 - Hosts: 70.84.177.195 ww1.portal.izb.de
O1 - Hosts: 70.84.177.195 wvw.kunden-service.lbs.de
O1 - Hosts: 70.84.177.195 ibanking.seb.de
O1 - Hosts: 70.84.177.195 bw7.sparkasse-banking.de
O1 - Hosts: 70.84.177.195 ww2.homebanking-sparkasse.de
O1 - Hosts: 70.84.177.195 ww2.vr-networld-ebanking.de
O1 - Hosts: 70.84.177.195 ww.bics.fr
O1 - Hosts: 70.84.177.195 www.co.caixabank.fr
O1 - Hosts: 70.84.177.195 ww.creditmutuel.fr
O1 - Hosts: 70.84.177.195 internetbank.intesabci.it
O1 - Hosts: 70.84.177.195 ww.extensive.bancalombarda.it
O2 - BHO: (no name) - {08A312BB-5409-49FC-9347-54BB7D069AC6} - C:\PROGRA~1\DESKAD~1\deskipn.dll
O2 - BHO: SohuDAIEHelper - {0CA51D02-7739-43EA-8D9A-1E8AD4327B03} - C:\Program Files\P4P\sodaie.dll (file missing)
O2 - BHO: (no name) - {2A0176FE-008B-4706-90F5-BBA532A49731} - C:\Program Files\SearchNet\SNHpr.dll
O2 - BHO: (no name) - {33BBE430-0E42-4f12-B075-8D21ACB10DCB} - C:\PROGRA~1\Yahoo!\ASSIST~1\assist\yphtb.dll (file missing)
O2 - BHO: (no name) - {62EED7C6-9F02-42f9-B634-98E2899E147B} - C:\PROGRA~1\Yahoo!\ASSIST~1\assist\YDRAGS~1.DLL (file missing)
O2 - BHO: (no name) - {6E28339B-7A2A-47B6-AEB2-46BA53782379} - C:\WINNT\system32\dllcache\java.dll (file missing)
O2 - BHO: Accoona Search Assistant - {944864A5-3916-46E2-96A9-A2E84F3F1208} - C:\Program Files\Accoona\ASearchAssist.dll
O2 - BHO: (no name) - {A5366673-E8CA-11D3-9CD9-0090271D075B} - (no file)
O2 - BHO: (no name) - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll
O2 - BHO: (no name) - {B1D147E7-873E-4909-8127-695D9BB78728} - C:\WINNT\Downloaded Program Files\CONFLICT.1\barsmall24.dll
O3 - Toolbar: ????? - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINNT\System32\msdxm.ocx
O3 - Toolbar: FlashGet Bar - {E0E899AB-F487-11D5-8D29-0050BA6940E3} - C:\PROGRA~1\FlashGet\fgiebar.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll
O4 - HKLM\..\Run: [IMSCMig] C:\PROGRA~1\COMMON~1\MICROS~1\IME\IMSC40A\IMSCMIG.EXE /Preload
O4 - HKLM\..\Run: [MoveSearch] C:\Program Files\HuaCi\huaci\zsearch.exe
O4 - HKLM\..\Run: [helper.dll] C:\WINNT\system32\rundll32.exe C:\PROGRA~1\3721\helper.dll,Rundll32
O4 - HKLM\..\Run: [SearchNet_Up] "C:\Program Files\SearchNet\ServeUp.exe"
O4 - HKLM\..\Run: [MediaGateway] C:\Program Files\MediaGateway\MediaGateway.exe
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINNT\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [ATI AS Filter] msnse.exe
O4 - HKLM\..\Run: [3721] C:\WINNT\MSMNSGER.EXE
O4 - HKLM\..\Run: [Update] C:\Program Files\Common Files\UPDATE\Update.exe
O4 - HKLM\..\RunServices: [ATI AS Filter] msnse.exe
O4 - HKCU\..\Run: [ATI AS Filter] msnse.exe
O4 - HKCU\..\RunServices: [ATI AS Filter] msnse.exe
O4 - Startup: 100_Video.asd
O4 - Startup: 128_CD_Transparency_Audio.asd
O4 - Startup: 16_AM_Radio.asd
O4 - Startup: 1Mb_Video.asd
O4 - Startup: 250_Video.asd
O4 - Startup: 28.8_56_100_MBR_VIDEO.asd
O4 - Startup: 28.8_FM_Radio_Mono.asd
O4 - Startup: 28.8_FM_Radio_Stereo.asd
O4 - Startup: 28.8_Video_Audio_Emphasis.asd
O4 - Startup: 28.8_Video_For_Web_Server.asd
O4 - Startup: 28.8_Video_Voice.asd
O4 - Startup: 3Mb_Video.asd
O4 - Startup: 512_Video.asd
O4 - Startup: 56_Dialup_High_Quality_Stereo.asd
O4 - Startup: 56_Dialup_Modem_Video.asd
O4 - Startup: 56_dialup_Video_For_Web_Server.asd
O4 - Startup: 6.5_Voice_Audio.asd
O4 - Startup: 64_High_Fidelity_Stereo_Audio.asd
O4 - Startup: 96_CD_Quality_Audio.asd
O4 - Startup: crack.jar
O4 - Startup: Dialup_Modems_ISDN_MBR_Video.asd
O4 - Startup: FrameMapViewImage.asp
O4 - Startup: Intranet_HighSpeed_Lan_MBR_Video.asd
O4 - Startup: Noname1.html
O4 - Startup: Noname1.txt
O4 - Startup: Noname2.txt
O4 - Startup: nspmcvt.exe
O4 - Startup: NTUSER.DAT
O4 - Startup: ntuser.dat.LOG
O4 - Startup: ntuser.ini
O4 - Startup: sqlnet.log
O4 - Startup: tempfile.diff
O4 - Global Startup: ntuser.pol
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O8 - Extra context menu item: Google 搜索(&G) - res://C:\Program Files\Google\GoogleToolbar2.dll/cmsearch.html
O8 - Extra context menu item: 使用网际快车下载 - C:\Program Files\FlashGet\jc_link.htm
O8 - Extra context menu item: 使用网际快车下载全部链接 - C:\Program Files\FlashGet\jc_all.htm
O8 - Extra context menu item: 反向链接 - res://C:\Program Files\Google\GoogleToolbar2.dll/cmbacklinks.html
O8 - Extra context menu item: 添加到QQ自定义面板 - C:\Program Files\Tencent\QQ\AddPanel.htm
O8 - Extra context menu item: 添加到QQ表情 - C:\Program Files\Tencent\QQ\AddEmotion.htm
O8 - Extra context menu item: 添加到广告杀手 - E:\
O8 - Extra context menu item: 用QQ彩信发送该图片 - C:\Program Files\Tencent\QQ\SendMMS.htm
O8 - Extra context menu item: 用比特精灵下载(&B) - E:\BitSpirit\bsurl.htm
O8 - Extra context menu item: 类似网页 - res://C:\Program Files\Google\GoogleToolbar2.dll/cmsimilar.html
O8 - Extra context menu item: 缓存的网页快照 - res://C:\Program Files\Google\GoogleToolbar2.dll/cmcache.html
O8 - Extra context menu item: 翻译英文字词(&T) - res://C:\Program Files\Google\GoogleToolbar2.dll/cmwordtrans.html
O9 - Extra button: FlashGet (HKLM)
O9 - Extra 'Tools' menuitem: &FlashGet (HKLM)
O11 - Options group: [!MySearch]
O16 - DPF: {56A7DC70-E102-4408-A34A-AE06FEF01586} (
O16 - DPF: {8FCDF9D9-A28B-480F-8C3D-581F119A8AB8} (MediaGatewayX) - http://static.zangocash.com/cab/Zango/ie/bridge-c18.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash
Object) - http://fpdownload.macromedia.com/pub/shockwave/cabs/flash/swflash.cab
O16 - DPF: {EF6205C1-3F17-4829-BCB5-1336ED89E356} - http://online.jiangmin.com/KvDown.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{37B0DCE1-0787-4016-AF5E-291394AE0A27}: NameServer = 202.106.196.115
