系统已经重装过很多次了还是删不掉｀｀｀急！！！！HijackThis_815汉化版扫描日志 V1.99.1
保存于 15:08:35, 日期 1980-1-28
操作系统： Windows XP SP2 (WinNT 5.01.2600)
浏览器： Internet Explorer v6.00 SP2 (6.00.2900.2180)
当前运行的进程：
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\svchosts.exe
C:\WINDOWS\Explorer.EXE
D:\Program Files\DefWatch.exe
C:\WINDOWS\system32\rundll32.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\rundll32.exe
D:\PROGRA~1\vptray.exe
c:\windows\system32\wbem\lsass.exe
C:\WINDOWS\system32\ctfmon.exe
C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\win32.exe
C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\1015.exe
C:\WINDOWS\system32\SysExp.exe
C:\WINDOWS\system32\conime.exe
C:\WINDOWS\system32\regsvr32.exe
C:\WINDOWS\system32\3DD94364.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\system32\SysExp.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\WINDOWS\system32\SysExp.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\WINDOWS\SYSTEM32\RUNDLL32.EXE
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Internet Explorer\iexplore.exe
D:\软件下载\WinRAR.exe
C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\Rar$EX13.328\HijackThis1991zww.exe
C:\Program Files\Internet Explorer\iexplore.exe
R3 - URLSearchHook: 雅虎助手 - {406F94F0-504F-4a40-8DFD-58B0666ABEBD} - C:\PROGRA~1\Yahoo!\ASSIST~1\Assist\yasbar.dll
F2 - REG:system.ini: UserInit=C:\WINDOWS\system32\userinit.exe,c:\WINDOWS\1015.exe
O2 - BHO: IEMonitor Class - {08A312BB-5409-49FC-9347-54BB7D069AC6} - C:\WINDOWS\system32\IESHEL~1.DLL
O2 - BHO: 雅虎助手 - {406F94F0-504F-4a40-8DFD-58B0666ABEBD} - C:\PROGRA~1\Yahoo!\ASSIST~1\Assist\yasbar.dll
O2 - BHO: Vision - {6671A431-5C3D-463d-A7CF-5587F9B7E191} - C:\PROGRA~1\vision\vision.dll
O2 - BHO: 实用搜索 - {6CFD436C-7AAD-4e50-992F-C0C87A94CAD2} - C:\Program Files\superutilbar\superutilbar.dll
O2 - BHO: KRXEMSX - {97F2BC8E-8CA2-4724-A6E2-2E020A7684EF} - C:\WINDOWS\system32\WDIPWCINVAHN.DLL
O2 - BHO: hcms - {ACAAE0BD-942B-4412-B45C-1B926A326C79} - C:\PROGRA~1\COMMON~1\qlvy\upsc.dll
O2 - BHO: XTTBPos00 - {BBBE1C1A-89F7-4AF6-ABD1-1A1DE1C6962A} - C:\PROGRA~1\SOFATO~1\sofa.dll
O2 - BHO: Bar888 - {C1B4DEC2-2623-438e-9CA2-C9043AB28508} - C:\PROGRA~1\COMMON~1\{3831C~1\Bar888.dll
O2 - BHO: IEHlprObj Class - {DE7C3CF0-4B15-11D1-ABED-709549C10000} - C:\WINDOWS\POPNTS.DLL
O2 - BHO: (no name) - {EB16D2B9-8AA5-4CD7-A9F2-72A4D3078327} - C:\WINDOWS\system32\ygtyuentfkrdf.dll
O3 - IE工具栏增项: 雅虎助手 - {406F94F0-504F-4a40-8DFD-58B0666ABEBD} - C:\PROGRA~1\Yahoo!\ASSIST~1\Assist\yasbar.dll
O3 - IE工具栏增项: 实用搜索工具条2.0 - {03465FF5-00AE-411a-9C34-960ED566EC03} - C:\Program Files\superutilbar\superutilbar.dll
O3 - IE工具栏增项: Bar888 - {C1B4DEC2-2623-438e-9CA2-C9043AB28508} - C:\PROGRA~1\COMMON~1\{3831C~1\Bar888.dll
O3 - IE工具栏增项: sofa - {B7D3E479-CC68-42B5-A338-B5A0E057163B} - C:\Program Files\SofaToolbar\sofa.dll
O4 - 启动项HKLM\\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
O4 - 启动项HKLM\\Run: [PHIME2002ASync] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC
O4 - 启动项HKLM\\Run: [PHIME2002A] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName
O4 - 启动项HKLM\\Run: [vptray] D:\PROGRA~1\vptray.exe
O4 - 启动项HKLM\\Run: [IEBarUp] RunDll32 "C:\WINDOWS\system32\IeBar1.dll",Run
O4 - 启动项HKLM\\Run: [System] C:\Program Files\Common Files\System\Updaterun.exe
O4 - 启动项HKLM\\Run: [cmdbc] C:\WINDOWS\cmdbc.exe
O4 - 启动项HKLM\\Run: [msccrt] C:\WINDOWS\msccrt.exe
O4 - 启动项HKLM\\Run: [Autoupdate] C:\WINDOWS\wuacult.exe
O4 - 启动项HKLM\\Run: [{4831CEFC-0384-2052-1021-040818030056}] "C:\Program Files\Common Files\{4831CEFC-0384-2052-1021-040818030056}\Update.exe" te-110-12-0000333
O4 - 启动项HKLM\\Run: [sysExp] C:\WINDOWS\system32\SysExp.exe
O4 - 启动项HKLM\\Run: [sdafdsafds] D;]XJOEPXT]ufnq]te266/fyf
O4 - 启动项HKLM\\Run: [dfsf] RUNDLL32.EXE C:\WINDOWS\system\Mvvp.dll,DImmcv
O4 - 启动项HKLM\\Run: [t] rundll32.exe C:\WINDOWS\weotbuhskhb.dll _start@16
O4 - 启动项HKLM\\Run: [Desktop] "C:\WINDOWS\system32\rundll32.exe" "C:\WINDOWS\system32\NTService32.dll",Run
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [bgswitch] C:\WINDOWS\system32\bgswitch.exe
O4 - HKCU\..\Run: [jv61dbux2kc6] C:\WINDOWS\iexpl0re.exe
O4 - HKCU\..\Run: [xzfvzkh6hxg6] C:\WINDOWS\system.exe
O4 - HKCU\..\Run: [updatereal] C:\WINDOWS\realupdate.exe other
O4 - HKCU\..\Run: [winsamps] C:\WINDOWS\winamps.exe
O4 - HKCU\..\Run: [Windows installer] C:\winstall.exe
O4 - HKCU\..\Run: [UUpdate] C:\Program Files\UUSee\UUpdate.exe
O4 - Global Startup: WinZip 快选.lnk = D:\Program Files\WinZip\WZQKPICK.EXE
O8 - IE右键菜单中的新增项目: >>彩信发送<< - res://C:\PROGRA~1\vision\vision.dll/mms.htm
O8 - IE右键菜单中的新增项目: 雅虎搜索 - res://C:\PROGRA~1\Yahoo!\ASSIST~1\Assist\yasbar.dll/246
O9 - 浏览器额外的按钮: 番茄花园 - {6096E38F-5AC1-4391-8EC4-75DFA92FB32F} - http://www.tomatolei.com (file missing)
O9 - 浏览器额外的“工具”菜单项: 番茄花园 - {6096E38F-5AC1-4391-8EC4-75DFA92FB32F} - http://www.tomatolei.com (file missing)
O9 - 浏览器额外的按钮: (no name) - {6671A433-5C3D-463d-A7CF-5587F9B7E191} - C:\PROGRA~1\vision\vision.dll
O9 - 浏览器额外的“工具”菜单项: 彩E精灵设置 - {6671A433-5C3D-463d-A7CF-5587F9B7E191} - C:\PROGRA~1\vision\vision.dll
O9 - 浏览器额外的按钮: sofa - {B7D3E479-CC68-42B5-A338-B5A0E057163B} - C:\Program Files\SofaToolbar\sofa.dll
O9 - 浏览器额外的“工具”菜单项: sofa - {B7D3E479-CC68-42B5-A338-B5A0E057163B} - C:\Program Files\SofaToolbar\sofa.dll
O9 - 浏览器额外的按钮: 易趣购物 - {BE9C13C3-9E46-4db1-BC05-BD8DA44599F2} - http://adfarm.mediaplex.com/ad/ck/4080-22910-9640-151?cn=song;icon;hp&mpro=http://www.ebay.com.cn (file missing)
O9 - 浏览器额外的“工具”菜单项: 易趣购物 - {BE9C13C3-9E46-4db1-BC05-BD8DA44599F2} - http://adfarm.mediaplex.com/ad/ck/4080-22910-9640-151?cn=song;icon;hp&mpro=http://www.ebay.com.cn (file missing)
O14 - IERESET.INF: START_PAGE_URL=http://www.tomatolei.com
O20 - Winlogon Notify: cryptimg - C:\WINDOWS\SYSTEM32\cryptimg.dll
O20 - Winlogon Notify: NavLogon - C:\WINDOWS\system32\NavLogon.dll
O20 - Winlogon Notify: rpcc - C:\WINDOWS\system32\rpcc.dll
O20 - Winlogon Notify: ScCardLogn - C:\WINDOWS\ScNotify.dll
O23 - NT 服务: SysAllowStop (AllowStop) - Unknown owner - C:\Windows\system32\GLRWE.EXE
O23 - NT 服务: COM+ Messages - Unknown owner - C:\WINDOWS\system32\svchosts.exe" -e te-110-12-0000333 (file missing)
O23 - NT 服务: DefWatch - Symantec Corporation - D:\Program Files\DefWatch.exe
O23 - NT 服务: Symantec AntiVirus Client (Norton AntiVirus Server) - Symantec Corporation - D:\Program Files\Rtvscan.exe
O23 - NT 服务: Windows User Mode Driver (UMWdfmgr) - Unknown owner - rundll32.exe (file missing)
