CPU占用率长期80％以上，开机硬盘就不规律的狂转，典型的病毒特征，可瑞星，毒霸，木马克星，SOP，诺顿，超级兔子几乎都用完了，*.EXE*.DLL文件删了N多，安全模式字大，看着真养眼，可不能总看阿，我的是IBM X31，机子不错就是硬盘才20G，一懒没分区，里面有N多重要文件，要不然早格了，真是苦阿，求求版主大哥了帮忙看看这个日志，是怎么回事？真是IE被捆绑了？

[csrss.exe]
CommandLine = C:\WINDOWS\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,3072,512 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ProfileControl=Off MaxRequestThreads=16

[winlogon.exe]
CommandLine = winlogon.exe

[services.exe]
CommandLine = C:\WINDOWS\system32\services.exe

[lsass.exe]
CommandLine = C:\WINDOWS\system32\lsass.exe

[ibmpmsvc.exe]
CommandLine = C:\WINDOWS\System32\ibmpmsvc.exe

[ati2evxx.exe]
CommandLine = C:\WINDOWS\System32\Ati2evxx.exe

[svchost.exe]
CommandLine = C:\WINDOWS\system32\svchost -k DcomLaunch

[svchost.exe]
CommandLine = C:\WINDOWS\system32\svchost -k rpcss

[svchost.exe]
CommandLine = C:\WINDOWS\System32\svchost.exe -k netsvcs

[S24EvMon.exe]
CommandLine = C:\WINDOWS\System32\S24EvMon.exe

[svchost.exe]
CommandLine = C:\WINDOWS\System32\svchost.exe -k NetworkService

[svchost.exe]
CommandLine = C:\WINDOWS\System32\svchost.exe -k LocalService

[explorer.exe]
CommandLine = C:\WINDOWS\Explorer.EXE

[ccSetMgr.exe]
CommandLine = "C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe"

[ccEvtMgr.exe]
CommandLine = "C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe"

[spoolsv.exe]
CommandLine = C:\WINDOWS\system32\spoolsv.exe

[tp4serv.exe]
CommandLine = "C:\WINDOWS\system32\tp4serv.exe"

[TPHKMGR.exe]
CommandLine = "C:\PROGRA~1\ThinkPad\PkgMgr\HOTKEY\TPHKMGR.exe"

[EzEjMnAp.Exe]
CommandLine = "C:\PROGRA~1\ThinkPad\UTILIT~1\EzEjMnAp.Exe"

[AGRSMMSG.exe]
CommandLine = "C:\WINDOWS\AGRSMMSG.exe"

[rundll32.exe]
CommandLine = "C:\WINDOWS\system32\RunDll32.exe" C:\PROGRA~1\ThinkPad\UTILIT~1\pwrmonit.dll,StartPwrMonitor

[VPTray.exe]
CommandLine = "C:\PROGRA~1\SYMANT~1\VPTray.exe"

[TPONSCR.exe]
CommandLine = "C:\Program Files\ThinkPad\PkgMgr\HOTKEY\TPONSCR.exe"

[TpScrex.exe]
CommandLine = "C:\Program Files\ThinkPad\PkgMgr\HOTKEY_1\TpScrex.exe"

[iparmor.exe]
CommandLine = "C:\Temp\iparmor\iparmor.exe" mini

[ctfmon.exe]
CommandLine = "C:\WINDOWS\system32\ctfmon.exe"

[JJSvr4.exe]
CommandLine = "C:\Program Files\jj4\jjsvr4.exe"

[cisvc.exe]
CommandLine = C:\WINDOWS\system32\cisvc.exe

[cvpnd.exe]
CommandLine = "C:\Program Files\Cisco Systems\VPN Client\cvpnd.exe"

[DefWatch.exe]
CommandLine = "C:\Program Files\Symantec AntiVirus\DefWatch.exe"

[ntmulti.exe]
CommandLine = "C:\Program Files\lotus\notes\ntmulti.exe"

[QCONSVC.EXE]
CommandLine = System32\QCONSVC.EXE

[RegSrvc.exe]
CommandLine = C:\WINDOWS\System32\RegSrvc.exe

Logfile of Kaka v2. 0. 0. 9 Scan Module v2. 0. 0. 1
Scan saved at 22:06:54, on 2006-09-11
Platform: Microsoft Windows XP Professional Service Pack 2 (Build 2600)
MSIE: Internet Explorer v6.00 SP2; (6.00.2900.2180 (xpsp_sp2_rtm.040803-2158))


Running processes:
[smss.exe]
CommandLine =


[svchost.exe]
CommandLine = C:\WINDOWS\System32\svchost.exe -k imgsvc

[Rtvscan.exe]
CommandLine = "C:\Program Files\Symantec AntiVirus\Rtvscan.exe"

[TpKmpSvc.exe]
CommandLine = C:\WINDOWS\system32\TpKmpSVC.exe

[wdfmgr.exe]
CommandLine = C:\WINDOWS\system32\wdfmgr.exe

[alg.exe]
CommandLine = C:\WINDOWS\System32\alg.exe

[vpngui.exe]
CommandLine = "C:\Program Files\Cisco Systems\VPN Client\vpngui.exe"

[nlnotes.exe]
CommandLine = NLNOTES.EXE

[ntaskldr.exe]
CommandLine = "C:\Program Files\lotus\notes\ntaskldr.EXE" C:\Program Files\lotus\notes\ntaskldr.EXE

[XDICT.EXE]
CommandLine = "C:\Program Files\Kingsoft\PowerWord 2005\XDICT.EXE"

[tsrv.exe]
CommandLine = C:\WINDOWS\tsrv.exe s

[iexplore.exe]
CommandLine = "C:\Program Files\Internet Explorer\iexplore.exe" -nohome

[slbrwiad.exe]
CommandLine = C:\WINDOWS\system32\slbrwiad.exe C:\WINDOWS\system32\wuapx9tt.dll

[wuapx9tt.exe]
CommandLine = C:\WINDOWS\system32\wuapx9tt.exe

[iexplore.exe]
CommandLine = "C:\Program Files\Internet Explorer\iexplore.exe"

[KkScan.exe]
CommandLine = "C:\Program Files\Rising\KakaToolBar\KkScan.exe"

[iexplore.exe]
CommandLine = "C:\Program Files\Internet Explorer\iexplore.exe"

[cidaemon.exe]
CommandLine = "cidaemon.exe" DownLevelDaemon "c:\system volume information\catalog.wci" 196672l 1180l

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page=C:\WINDOWS\System32\blank.htm
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page=%SystemRoot%\system32\blank.htm
R3 - URLSearchHook: (no name) - {406F94F0-504F-4a40-8DFD-58B0666ABEBD} - (no file)
O1 - Hosts: 127.0.0.1      localhost
O1 - Hosts: 127.0.0.1 download.microsoft.com
O1 - Hosts: 127.0.0.1 go.microsoft.com
O1 - Hosts: 127.0.0.1 msdn.microsoft.com
O1 - Hosts: 127.0.0.1 office.microsoft.com
O1 - Hosts: 127.0.0.1 windowsupdate.microsoft.com
O1 - Hosts: 127.0.0.1 http://www.microsoft.com/downloads/Search.aspx?displaylang=en
O1 - Hosts: 127.0.0.1 avp.ru
O1 - Hosts: 127.0.0.1 www.avp.ru
O1 - Hosts: 127.0.0.1 http://avp.ru
O1 - Hosts: 127.0.0.1 http://www.avp.ru
O1 - Hosts: 127.0.0.1 kaspersky.ru
O1 - Hosts: 127.0.0.1 www.kaspersky.ru
O1 - Hosts: 127.0.0.1 http://kaspersky.ru
O1 - Hosts: 127.0.0.1 kaspersky.com
O1 - Hosts: 127.0.0.1 www.kaspersky.com
O1 - Hosts: 127.0.0.1 http://kaspersky.com
O1 - Hosts: 127.0.0.1 kaspersky-labs.com
O1 - Hosts: 127.0.0.1 www.kaspersky-labs.com
O1 - Hosts: 127.0.0.1 http://kaspersky-labs.com
O1 - Hosts: 127.0.0.1 avp.ru/download/
O1 - Hosts: 127.0.0.1 www.avp.ru/download/
O1 - Hosts: 127.0.0.1 http://www.avp.ru/download/
O1 - Hosts: 127.0.0.1 http://www.kaspersky.ru/updates/
O1 - Hosts: 127.0.0.1 http://www.kaspersky-labs.com/updates/
O1 - Hosts: 127.0.0.1 http://kaspersky.ru/updates/
O1 - Hosts: 127.0.0.1 http://kaspersky-labs.com/updates/
O1 - Hosts: 127.0.0.1 downloads1.kaspersky-labs.com
O1 - Hosts: 127.0.0.1 downloads2.kaspersky-labs.com
O1 - Hosts: 127.0.0.1 downloads3.kaspersky-labs.com
O1 - Hosts: 127.0.0.1 downloads4.kaspersky-labs.com
O1 - Hosts: 127.0.0.1 downloads5.kaspersky-labs.com
O1 - Hosts: 127.0.0.1 http://downloads1.kaspersky-labs.com
O1 - Hosts: 127.0.0.1 http://downloads2.kaspersky-labs.com
O1 - Hosts: 127.0.0.1 http://downloads3.kaspersky-labs.com
O1 - Hosts: 127.0.0.1 http://downloads4.kaspersky-labs.com
O1 - Hosts: 127.0.0.1 http://downloads5.kaspersky-labs.com
O1 - Hosts: 127.0.0.1 downloads1.kaspersky-labs.com/products/
O1 - Hosts: 127.0.0.1 downloads2.kaspersky-labs.com/products/
O1 - Hosts: 127.0.0.1 downloads3.kaspersky-labs.com/products/
O1 - Hosts: 127.0.0.1 downloads4.kaspersky-labs.com/products/
O1 - Hosts: 127.0.0.1 downloads5.kaspersky-labs.com/products/
O1 - Hosts: 127.0.0.1 http://downloads1.kaspersky-labs.com/products/
O1 - Hosts: 127.0.0.1 http://downloads2.kaspersky-labs.com/products/
O1 - Hosts: 127.0.0.1 http://downloads3.kaspersky-labs.com/products/
O1 - Hosts: 127.0.0.1 http://downloads4.kaspersky-labs.com/products/
O1 - Hosts: 127.0.0.1 http://downloads5.kaspersky-labs.com/products/
O1 - Hosts: 127.0.0.1 downloads1.kaspersky-labs.com/updates/
O1 - Hosts: 127.0.0.1 downloads2.kaspersky-labs.com/updates/
O1 - Hosts: 127.0.0.1 downloads3.kaspersky-labs.com/updates/
O1 - Hosts: 127.0.0.1 downloads4.kaspersky-labs.com/updates/
O1 - Hosts: 127.0.0.1 downloads5.kaspersky-labs.com/updates/
O1 - Hosts: 127.0.0.1 http://downloads1.kaspersky-labs.com/updates/
O1 - Hosts: 127.0.0.1 http://downloads2.kaspersky-labs.com/updates/
O1 - Hosts: 127.0.0.1 http://downloads3.kaspersky-labs.com/updates/
O1 - Hosts: 127.0.0.1 http://downloads4.kaspersky-labs.com/updates/
O1 - Hosts: 127.0.0.1 http://downloads5.kaspersky-labs.com/updates/
O1 - Hosts: 127.0.0.1 ftp://downloads1.kaspersky-labs.com
O1 - Hosts: 127.0.0.1 ftp://downloads2.kaspersky-labs.com
O1 - Hosts: 127.0.0.1 ftp://downloads3.kaspersky-labs.com
O1 - Hosts: 127.0.0.1 ftp://downloads4.kaspersky-labs.com
O1 - Hosts: 127.0.0.1 ftp://downloads5.kaspersky-labs.com
O1 - Hosts: 127.0.0.1 ftp://downloads1.kaspersky-labs.com/products/
O1 - Hosts: 127.0.0.1 ftp://downloads2.kaspersky-labs.com/products/
O1 - Hosts: 127.0.0.1 ftp://downloads3.kaspersky-labs.com/products/
O1 - Hosts: 127.0.0.1 ftp://downloads4.kaspersky-labs.com/products/
O1 - Hosts: 127.0.0.1 ftp://downloads5.kaspersky-labs.com/products/
O1 - Hosts: 127.0.0.1 ftp://downloads1.kaspersky-labs.com/updates/
O1 - Hosts: 127.0.0.1 ftp://downloads2.kaspersky-labs.com/updates/
O1 - Hosts: 127.0.0.1 ftp://downloads3.kaspersky-labs.com/updates/
O1 - Hosts: 127.0.0.1 ftp://downloads4.kaspersky-labs.com/updates/
O1 - Hosts: 127.0.0.1 ftp://downloads5.kaspersky-labs.com/updates/
O1 - Hosts: 127.0.0.1 http://updates.kaspersky-labs.com/updates/
O1 - Hosts: 127.0.0.1 http://updates1.kaspersky-labs.com/updates/
O1 - Hosts: 127.0.0.1 http://updates2.kaspersky-labs.com/updates/
O1 - Hosts: 127.0.0.1 http://updates3.kaspersky-labs.com/updates/
O1 - Hosts: 127.0.0.1 http://updates4.kaspersky-labs.com/updates/
O1 - Hosts: 127.0.0.1 ftp://updates.kaspersky-labs.com/updates/
O1 - Hosts: 127.0.0.1 ftp://updates1.kaspersky-labs.com/updates/
O1 - Hosts: 127.0.0.1 ftp://updates2.kaspersky-labs.com/updates/
O1 - Hosts: 127.0.0.1 ftp://updates3.kaspersky-labs.com/updates/
O1 - Hosts: 127.0.0.1 ftp://updates4.kaspersky-labs.com/updates/
O1 - Hosts: 127.0.0.1 viruslist.com
O1 - Hosts: 127.0.0.1 www.viruslist.com
O1 - Hosts: 127.0.0.1 http://viruslist.com
O1 - Hosts: 127.0.0.1 viruslist.ru
O1 - Hosts: 127.0.0.1 www.viruslist.ru
O1 - Hosts: 127.0.0.1 http://viruslist.ru
O1 - Hosts: 127.0.0.1 ftp://ftp.kasperskylab.ru/updates/
O1 - Hosts: 127.0.0.1 symantec.com
O1 - Hosts: 127.0.0.1 www.symantec.com
O1 - Hosts: 127.0.0.1 http://symantec.com
O1 - Hosts: 127.0.0.1 customer.symantec.com
O1 - Hosts: 127.0.0.1 http://customer.symantec.com
O1 - Hosts: 127.0.0.1 liveupdate.symantec.com
O1 - Hosts: 127.0.0.1 http://liveupdate.symantec.com
O1 - Hosts: 127.0.0.1 liveupdate.symantecliveupdate.com
O1 - Hosts: 127.0.0.1 http://liveupdate.symantecliveupdate.com
O1 - Hosts: 127.0.0.1 securityresponse.symantec.com
O1 - Hosts: 127.0.0.1 http://securityresponse.symantec.com
O1 - Hosts: 127.0.0.1 service1.symantec.com
O1 - Hosts: 127.0.0.1 http://service1.symantec.com
O1 - Hosts: 127.0.0.1 symantec.com/updates
O1 - Hosts: 127.0.0.1 http://symantec.com/updates
O1 - Hosts: 127.0.0.1 updates.symantec.com
O1 - Hosts: 127.0.0.1 http://updates.symantec.com
O1 - Hosts: 127.0.0.1 eset.com/
O1 - Hosts: 127.0.0.1 www.eset.com/
O1 - Hosts: 127.0.0.1 http://www.eset.com/
O1 - Hosts: 127.0.0.1 eset.com/products/index.php
O1 - Hosts: 127.0.0.1 www.eset.com/products/index.php
O1 - Hosts: 127.0.0.1 http://www.eset.com/products/index.php
O1 - Hosts: 127.0.0.1 eset.com/download/index.php
O1 - Hosts: 127.0.0.1 www.eset.com/download/index.php
O1 - Hosts: 127.0.0.1 http://www.eset.com/download/index.php
O1 - Hosts: 127.0.0.1 eset.com/joomla/
O1 - Hosts: 127.0.0.1 www.eset.com/joomla/
O1 - Hosts: 127.0.0.1 http://www.eset.com/joomla/
O1 - Hosts: 127.0.0.1 u3.eset.com/
O1 - Hosts: 127.0.0.1 http://u3.eset.com/
O1 - Hosts: 127.0.0.1 u4.eset.com/
O1 - Hosts: 127.0.0.1 http://u4.eset.com/
O1 - Hosts: 127.0.0.1 www.symantec.com/updates

O2 - BHO: 卡卡上网安全助手 - {AFF6E516-CBE5-4F8A-9C2F-38A68013E766} - C:\WINDOWS\system32\kakatool.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll (file missing)
O3 - Toolbar: 卡卡上网安全助手 - {DB9ECD4F-FB8F-4311-B3CE-90B976C2707C} - C:\WINDOWS\system32\kakatool.dll
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [pyjj] C:\Program Files\jj4\jjsvr4.exe
O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\System32\IME\TINTLGNT\TINTSETP.EXE /SYNC
O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\System32\IME\TINTLGNT\TINTSETP.EXE /IMEName
O4 - HKLM\..\Run: [TrackPointSrv] tp4serv.exe
O4 - HKLM\..\Run: [ATIModeChange] Ati2mdxx.exe
O4 - HKLM\..\Run: [BluetoothAuthenticationAgent] rundll32.exe irprops.cpl,,BluetoothAuthenticationAgent
O4 - HKLM\..\Run: [TPHOTKEY] C:\PROGRA~1\ThinkPad\PkgMgr\HOTKEY\TPHKMGR.exe
O4 - HKLM\..\Run: [BMMLREF] C:\Program Files\ThinkPad\Utilities\BMMLREF.EXE
O4 - HKLM\..\Run: [TP4EX] tp4ex.exe
O4 - HKLM\..\Run: [EZEJMNAP] C:\PROGRA~1\ThinkPad\UTILIT~1\EzEjMnAp.Exe
O4 - HKLM\..\Run: [AGRSMMSG] AGRSMMSG.exe
O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [BMMGAG] RunDll32 C:\PROGRA~1\ThinkPad\UTILIT~1\pwrmonit.dll,StartPwrMonitor
O4 - HKLM\..\Run: [IMEKRMIG6.1] C:\WINDOWS\ime\imkr6_1\IMEKRMIG.EXE
O4 - HKLM\..\Run: [vptray] C:\PROGRA~1\SYMANT~1\VPTray.exe
O4 - HKLM\..\Run: [S3TRAY2] S3Tray2.exe
O4 - HKLM\..\Run: [iparmor] C:\Temp\iparmor\iparmor.exe mini
O4 - Startup: desktop.ini =
O4 - Global Startup: Cisco Systems VPN Client.lnk = C:\Program Files\Cisco Systems\VPN Client\vpngui.exe
O4 - Global Startup: desktop.ini =
O9 - Extra Button: (no name) - {D6E814A0-E0C5-11d4-8D29-0050BA6940E4}? - C:\WINDOWS\system32\shdocvw.dll
O14 - IERESET.INF: START_PAGE_URL=http://www.microsoft.com/isapi/redir.dll?prd=ie&pver=6&ar=msnhome
O15 - Trusted Zone: 
O16 - DPF: {3BFFE033-BF43-11D5-A271-00A024A51325} (iNotes6 Class) - http://61.222.107.211/iNotes6W.cab
O16 - DPF: {52DF16E3-6C4F-4B22-8BAF-09263E463B48} - http://zs.kingsoft.com/KOSInit.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1124347276515
O16 - DPF: {E4E2F180-CB8B-4DE9-ACBB-DA745D3BA153} (Rising Web Scan Object) - http://download.rising.com.cn/register/pcver/autoupgradepad/pcver2006new/OL2006.cab
O17 - HKLM\System\CCS\Services\Tcpip\Parameters:  SearchList = westwd.com,westwd.com,westwd.com,westwd.com,kspcb.nanyapcb.com.tw,fpg.com.tw
O17 - HKLM\System\CCS\Services\Tcpip\..\{873CCEC2-E7C3-4E35-9D7A-197012A73EC7}: NameServer = 61.177.7.1,10.214.3.10
O17 - HKLM\System\CCS\Services\Tcpip\..\{DF7EFFBC-AAA2-4E5F-A029-EECE6CECDEBF}: Domain = westwd.com
O17 - HKLM\System\CCS\Services\Tcpip\..\{DF7EFFBC-AAA2-4E5F-A029-EECE6CECDEBF}: NameServer = 10.10.10.8
O18 - Protocol: about - {3050F406-98B5-11CF-BB82-00AA00BDCE0B} - C:\WINDOWS\System32\mshtml.dll
O18 - Protocol: cdl - {3dd53d40-7b8b-11D0-b013-00aa0059ce02} - C:\WINDOWS\system32\urlmon.dll
O18 - Protocol: dvd - {12D51199-0DB5-46FE-A120-47A3D7D937CC} - C:\WINDOWS\system32\msvidctl.dll
O18 - Protocol: file - {79eac9e7-baf9-11ce-8c82-00aa004ba90b} - C:\WINDOWS\system32\urlmon.dll
O18 - Protocol: ftp - {79eac9e3-baf9-11ce-8c82-00aa004ba90b} - C:\WINDOWS\system32\urlmon.dll
O18 - Protocol: gopher - {79eac9e4-baf9-11ce-8c82-00aa004ba90b} - C:\WINDOWS\system32\urlmon.dll
O18 - Protocol: http - {79eac9e2-baf9-11ce-8c82-00aa004ba90b} - C:\WINDOWS\system32\urlmon.dll
O18 - Protocol: https - {79eac9e5-baf9-11ce-8c82-00aa004ba90b} - C:\WINDOWS\system32\urlmon.dll
O18 - Protocol: ipp - (no CLSID) - (no file)
O18 - Protocol: its - {9D148291-B9C8-11D0-A4CC-0000F80149F6} - C:\WINDOWS\System32\itss.dll
O18 - Protocol: javascript - {3050F3B2-98B5-11CF-BB82-00AA00BDCE0B} - C:\WINDOWS\System32\mshtml.dll
O18 - Protocol: local - {79eac9e7-baf9-11ce-8c82-00aa004ba90b} - C:\WINDOWS\system32\urlmon.dll
O18 - Protocol: mailto - {3050f3DA-98B5-11CF-BB82-00AA00BDCE0B} - C:\WINDOWS\System32\mshtml.dll
O18 - Protocol: mhtml - {05300401-BCBC-11d0-85E3-00C04FD85AB4} - C:\WINDOWS\System32\inetcomm.dll
O18 - Protocol: mk - {79eac9e6-baf9-11ce-8c82-00aa004ba90b} - C:\WINDOWS\system32\urlmon.dll
O18 - Protocol: ms-its - {9D148291-B9C8-11D0-A4CC-0000F80149F6} - C:\WINDOWS\System32\itss.dll
O18 - Protocol: msdaipp - (no CLSID) - (no file)
O18 - Protocol: res - {3050F3BC-98B5-11CF-BB82-00AA00BDCE0B} - C:\WINDOWS\System32\mshtml.dll
O18 - Protocol: sysimage - {76E67A63-06E9-11D2-A840-006008059382} - C:\WINDOWS\System32\mshtml.dll
O18 - Protocol: tv - {CBD30858-AF45-11D2-B6D6-00C04FBBDE6E} - C:\WINDOWS\system32\msvidctl.dll
O18 - Protocol: vbscript - {3050F3B2-98B5-11CF-BB82-00AA00BDCE0B} - C:\WINDOWS\System32\mshtml.dll
O18 - Protocol: wia - {13F3EA8B-91D7-4F0A-AD76-D2853AC8BECE} - C:\WINDOWS\System32\wiascr.dll
O20 - AppInit_DLLs:  msji449c14b7.dll daniwshb.dll msv1nv4_.dll
O20 - Winlogon Notify: acac
O20 - Winlogon Notify: NavLogon
O20 - Winlogon Notify: PCANotify
O20 - Winlogon Notify: WgaLogon
O20 - Winlogon Notify: wuapx9tt
O23 - Service: Ati HotKey Poller (Ati HotKey Poller) -  - C:\WINDOWS\system32\ati2evxx.exe
O23 - Service: pcAnywhere Host Service (awhost32) - Symantec Corporation - C:\Program Files\Symantec\pcAnywhere\awhost32.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - "C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe"
O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - "C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe"
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - "C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe"
O23 - Service: Cisco Systems, Inc. VPN Service (CVPND) - Cisco Systems, Inc. - "C:\Program Files\Cisco Systems\VPN Client\cvpnd.exe"
O23 - Service: Symantec AntiVirus Definition Watcher (DefWatch) - Symantec Corporation - "C:\Program Files\Symantec AntiVirus\DefWatch.exe"
O23 - Service: Human Interface Device Access (HidServ) -  - C:\WINDOWS\system32\svchost.exe -k netsvcs
O23 - Service: IBM PM Service (IBMPMSVC) -  - C:\WINDOWS\system32\ibmpmsvc.exe
O23 - Service: Multi-user Cleanup Service (Multi-user Cleanup Service) - IBM Corp - "C:\Program Files\lotus\notes\ntmulti.exe"
O23 - Service: Pml Driver HPZ12 (Pml Driver HPZ12) - HP - C:\WINDOWS\system32\spool\drivers\w32x86\3\hpzipm12.exe
O23 - Service: QCONSVC (QCONSVC) - IBM Corp. - C:\WINDOWS\system32\qconsvc.exe
O23 - Service: RegSrvc (RegSrvc) - Intel Corporation - C:\WINDOWS\system32\regsrvc.exe
O23 - Service: Spectrum24 Event Monitor (S24EventMonitor) - Intel Corporation  - C:\WINDOWS\system32\s24evmon.exe
O23 - Service: SAVRoam (SavRoam) - symantec - "C:\Program Files\Symantec AntiVirus\SavRoam.exe"
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - "C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe"
O23 - Service: Symantec AntiVirus (Symantec AntiVirus) - Symantec Corporation - "C:\Program Files\Symantec AntiVirus\Rtvscan.exe"
O23 - Service: IBM KCU Service (TpKmpSVC) -  - C:\WINDOWS\system32\tpkmpsvc.exe

听说System Repair Engineer能智能扫描，结果我的XP是繁体的，全是乱码，郁闷，请问版主有解决的办法吗？

谢谢阿！

引用:

【从头爱你的贴子】 那hj呢`` (http://forum.ikaka.com/topic.asp?board=67&artid=7018885) HijackThis V1.99.1 完全汉化版（8月15日更新.） ………………

好咧，呵呵，谢谢，请看！

HijackThis_815汉化版扫描日志 V1.99.1
保存于      下午 10:38:02, 日期 2006/9/11
操作系统：  Windows XP SP2 (WinNT 5.01.2600)
浏览器：    Internet Explorer v6.00 SP2 (6.00.2900.2180)

当前运行的进程：         
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\System32\ibmpmsvc.exe
C:\WINDOWS\System32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\S24EvMon.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\tp4serv.exe
C:\PROGRA~1\ThinkPad\PkgMgr\HOTKEY\TPHKMGR.exe
C:\PROGRA~1\ThinkPad\UTILIT~1\EzEjMnAp.Exe
C:\WINDOWS\AGRSMMSG.exe
C:\WINDOWS\system32\RunDll32.exe
C:\PROGRA~1\SYMANT~1\VPTray.exe
C:\Program Files\ThinkPad\PkgMgr\HOTKEY\TPONSCR.exe
C:\Program Files\ThinkPad\PkgMgr\HOTKEY_1\TpScrex.exe
C:\Temp\iparmor\iparmor.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\jj4\jjsvr4.exe
C:\WINDOWS\system32\cisvc.exe
C:\Program Files\Cisco Systems\VPN Client\cvpnd.exe
C:\Program Files\Symantec AntiVirus\DefWatch.exe
C:\Program Files\lotus\notes\ntmulti.exe
C:\WINDOWS\System32\QCONSVC.EXE
C:\WINDOWS\System32\RegSrvc.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Symantec AntiVirus\Rtvscan.exe
C:\WINDOWS\system32\TpKmpSVC.exe
C:\Program Files\Cisco Systems\VPN Client\vpngui.exe
C:\Program Files\Kingsoft\PowerWord 2005\XDICT.EXE
C:\Program Files\Internet Explorer\iexplore.exe
C:\WINDOWS\system32\slbrwiad.exe
C:\WINDOWS\system32\wuapx9tt.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\WINDOWS\system32\cidaemon.exe
C:\Temp\hijackthis1[1].99.1汉化第二版(new).exe
C:\Program Files\333\HijackThis1991汉化版\HijackThis1991zww.exe

R3 - URLSearchHook: (no name) - {406F94F0-504F-4a40-8DFD-58B0666ABEBD} - (no file)
O3 - IE工具栏增项: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll (file missing)
O3 - IE工具栏增项: 縐縐奻厙假?翑忒 - {DB9ECD4F-FB8F-4311-B3CE-90B976C2707C} - C:\WINDOWS\system32\kakatool.dll
O4 - 启动项HKLM\\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
O4 - 启动项HKLM\\Run: [PHIME2002ASync] C:\WINDOWS\System32\IME\TINTLGNT\TINTSETP.EXE /SYNC
O4 - 启动项HKLM\\Run: [PHIME2002A] C:\WINDOWS\System32\IME\TINTLGNT\TINTSETP.EXE /IMEName
O4 - 启动项HKLM\\Run: [TrackPointSrv] tp4serv.exe
O4 - 启动项HKLM\\Run: [ATIModeChange] Ati2mdxx.exe
O4 - 启动项HKLM\\Run: [BluetoothAuthenticationAgent] rundll32.exe irprops.cpl,,BluetoothAuthenticationAgent
O4 - 启动项HKLM\\Run: [TPHOTKEY] C:\PROGRA~1\ThinkPad\PkgMgr\HOTKEY\TPHKMGR.exe
O4 - 启动项HKLM\\Run: [BMMLREF] C:\Program Files\ThinkPad\Utilities\BMMLREF.EXE
O4 - 启动项HKLM\\Run: [TP4EX] tp4ex.exe
O4 - 启动项HKLM\\Run: [EZEJMNAP] C:\PROGRA~1\ThinkPad\UTILIT~1\EzEjMnAp.Exe
O4 - 启动项HKLM\\Run: [AGRSMMSG] AGRSMMSG.exe
O4 - 启动项HKLM\\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - 启动项HKLM\\Run: [BMMGAG] RunDll32 C:\PROGRA~1\ThinkPad\UTILIT~1\pwrmonit.dll,StartPwrMonitor
O4 - 启动项HKLM\\Run: [IMEKRMIG6.1] C:\WINDOWS\ime\imkr6_1\IMEKRMIG.EXE
O4 - 启动项HKLM\\Run: [vptray] C:\PROGRA~1\SYMANT~1\VPTray.exe
O4 - 启动项HKLM\\Run: [S3TRAY2] S3Tray2.exe
O4 - 启动项HKLM\\Run: [iparmor] C:\Temp\iparmor\iparmor.exe mini
O4 - 启动项HKLM\\Run: [pdfFactory Pro 分配器 v2] ; C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\fppdis2a.exe
O4 - 启动项HKLM\\Run: [yassistse] ; "C:\PROGRA~1\Yahoo!\Assistant\yassistse.exe"
O4 - 启动项HKLM\\Run: [YLive.exe] ; C:\PROGRA~1\Yahoo!\ASSIST~1\YLive.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [pyjj] C:\Program Files\jj4\jjsvr4.exe
O9 - 浏览器额外的按钮: (no name) - {D6E814A0-E0C5-11d4-8D29-0050BA6940E4}? - C:\WINDOWS\system32\shdocvw.dll
O16 - DPF: {3BFFE033-BF43-11D5-A271-00A024A51325} (iNotes6 Class) - http://61.222.107.211/iNotes6W.cab
O16 - DPF: {52DF16E3-6C4F-4B22-8BAF-09263E463B48} - http://zs.kingsoft.com/KOSInit.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1124347276515
O16 - DPF: {E4E2F180-CB8B-4DE9-ACBB-DA745D3BA153} (Rising Web Scan Object) - http://download.rising.com.cn/register/pcver/autoupgradepad/pcver2006new/OL2006.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{873CCEC2-E7C3-4E35-9D7A-197012A73EC7}: NameServer = 61.177.7.1,10.214.3.10
O17 - HKLM\System\CCS\Services\Tcpip\..\{DF7EFFBC-AAA2-4E5F-A029-EECE6CECDEBF}: Domain = westwd.com
O17 - HKLM\System\CCS\Services\Tcpip\..\{DF7EFFBC-AAA2-4E5F-A029-EECE6CECDEBF}: NameServer = 10.10.10.8
O17 - HKLM\System\CS1\Services\Tcpip\Parameters: SearchList = westwd.com,westwd.com,westwd.com,westwd.com,kspcb.nanyapcb.com.tw,fpg.com.tw
O17 - HKLM\System\CS2\Services\Tcpip\Parameters: SearchList = westwd.com,westwd.com,westwd.com,kspcb.nanyapcb.com.tw,fpg.com.tw
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: SearchList = westwd.com,westwd.com,westwd.com,westwd.com,kspcb.nanyapcb.com.tw,fpg.com.tw
O20 - AppInit_DLLs:  msji449c14b7.dll daniwshb.dll msv1nv4_.dll
O20 - Winlogon Notify: acac - C:\WINDOWS\system32\acac.dll
O20 - Winlogon Notify: NavLogon - C:\WINDOWS\system32\NavLogon.dll
O20 - Winlogon Notify: PCANotify - C:\WINDOWS\SYSTEM32\PCANotify.dll
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O20 - Winlogon Notify: wuapx9tt - C:\WINDOWS\system32\wuapx9tt.dll
O23 - NT 服务: Ati HotKey Poller - Unknown owner - C:\WINDOWS\System32\Ati2evxx.exe
O23 - NT 服务: pcAnywhere Host Service (awhost32) - Symantec Corporation - C:\Program Files\Symantec\pcAnywhere\awhost32.exe
O23 - NT 服务: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - NT 服务: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
O23 - NT 服务: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - NT 服务: Cisco Systems, Inc. VPN Service (CVPND) - Cisco Systems, Inc. - C:\Program Files\Cisco Systems\VPN Client\cvpnd.exe
O23 - NT 服务: Symantec AntiVirus Definition Watcher (DefWatch) - Symantec Corporation - C:\Program Files\Symantec AntiVirus\DefWatch.exe
O23 - NT 服务: IBM PM Service (IBMPMSVC) - Unknown owner - C:\WINDOWS\System32\ibmpmsvc.exe
O23 - NT 服务: Multi-user Cleanup Service - IBM Corp - C:\Program Files\lotus\notes\ntmulti.exe
O23 - NT 服务: Pml Driver HPZ12 - HP - C:\WINDOWS\SYSTEM32\SPOOL\DRIVERS\W32X86\3\HPZipm12.exe
O23 - NT 服务: QCONSVC - IBM Corp. - C:\WINDOWS\System32\QCONSVC.EXE
O23 - NT 服务: RegSrvc - Intel Corporation - C:\WINDOWS\System32\RegSrvc.exe
O23 - NT 服务: Spectrum24 Event Monitor (S24EventMonitor) - Intel Corporation  - C:\WINDOWS\System32\S24EvMon.exe
O23 - NT 服务: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - NT 服务: Symantec AntiVirus - Symantec Corporation - C:\Program Files\Symantec AntiVirus\Rtvscan.exe
O23 - NT 服务: IBM KCU Service (TpKmpSVC) - Unknown owner - C:\WINDOWS\system32\TpKmpSVC.exe

引用:

【baohe的贴子】【回复“西门吹胡子”的帖子】 C:\WINDOWS\tsrv.exe s C:\WINDOWS\system32\wuapx9tt.exe 找到这两个文件，打包，加密（解压密码用virus），发到：baohelin@yahoo.com.cn。帮你看看。 ………………

已发送，请查阅，谢谢！

引用:

【baohe的贴子】【回复“西门吹胡子”的帖子】 另外一个——C:\WINDOWS\system32\wuapx9tt.exe，在我的系统中无法运行。 卡巴斯基不报毒。 但我觉得它不是什么好东西。 ………………

大哥，这个玩意还有那个wuapx9tt。dll我再安全模式下删不掉，更改文件权限天杀的居然不让我更改，重启进入adminstrators居然又找不到着俩文件了，真晕，请继续指教。
那4个tsrv文件很容易就删除了。