引用 | 編輯
x3333x
2007-11-07 19:28 |
2樓
▲ ▼ |
複製程式
2007-11-07,19:26:56 System Repair Engineer 2.5.16.900 Smallfrogs ([url]http://www.KZTechs.com[/url]) Windows XP Professional Service Pack 2 (Build 2600) - 管理許可權用戶 - 完整功能 以下內容被選中: 所有的啟動項目(包括註冊表、開機檔案夾、服務等) 流覽器載入項 正在運行的進程(包括進程模組資訊) 文件關聯 Winsock 提供者 Autorun.inf HOSTS 文件 進程特權掃描 啟動專案 註冊表 [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run] <ctfmon.exe><C:\WINDOWS\system32\ctfmon.exe> [(Verified)Microsoft Windows Publisher] <updateMgr><C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe AcRdB7_0_9> [N/A] <MsnMsgr><"C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background> [N/A] <YSearchProtection><C:\Program Files\Yahoo!\Search Protection\SearchProtection.exe> [(Verified)Yahoo! Inc.] <kava><C:\WINDOWS\system32\kavo.exe> [] [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run] <NvCplDaemon><RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup> [(Verified)Microsoft Windows Publisher] <tasa><C:\DOCUME~1\pa-hoo\LOCALS~1\Temp\taso.exe> [N/A] <!AVG Anti-Spyware><"C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized> [(Verified)GRISOFT LTD] <YSearchProtection><"C:\Program Files\Yahoo!\Search Protection\SearchProtection.exe"> [(Verified)Yahoo! Inc.] [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon] <shell><Explorer.exe> [(Verified)Microsoft Windows Component Publisher] <Userinit><C:\WINDOWS\system32\userinit.exe,> [(Verified)Microsoft Windows Component Publisher] [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Windows] <AppInit_DLLs><> [N/A] [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon] <UIHost><logonui.exe> [(Verified)Microsoft Windows Publisher] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks] <{57B86673-276A-48B2-BAE7-C6DBB3020EB8}><C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\shellexecutehook.dll> [(Verified)GRISOFT LTD] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\<{12d0ed0d-0ee0-4f90-8827-78cefb8f4988}] <IE7 Uninstall Stub><C:\WINDOWS\system32\ieudinit.exe> [(Verified)Microsoft Windows Component Publisher] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\>{881dd1c5-3dcf-431b-b061-f3f88e8be88a}] <Outlook Express><%systemroot%\system32\shmgrate.exe OCInstallUserConfigOE> [N/A] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{2C7339CF-2B09-4501-B3F3-F3508C9228ED}] <Themes Setup><%SystemRoot%\system32\regsvr32.exe /s /n /i:/UserInstall %SystemRoot%\system32\themeui.dll> [N/A] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{44BBA840-CC51-11CF-AAFA-00AA00B6015C}] <Microsoft Outlook Express 6><"%ProgramFiles%\Outlook Express\setup50.exe" /APP:OE /CALLER:WINNT /user /install> [N/A] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{44BBA842-CC51-11CF-AAFA-00AA00B6015B}] <NetMeeting 3.01><rundll32.exe advpack.dll,LaunchINFSection C:\WINDOWS\INF\msnetmtg.inf,NetMtg.Install.PerUser.NT> [(Verified)Microsoft Windows Publisher] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{6BF52A52-394A-11d3-B153-00C04F79FAA6}] <Microsoft Windows Media Player><rundll32.exe advpack.dll,LaunchINFSection C:\WINDOWS\INF\wmp.inf,PerUserStub> [(Verified)Microsoft Windows Publisher] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{7790769C-0471-11d2-AF11-00C04FA35D02}] <Address Book 6><"%ProgramFiles%\Outlook Express\setup50.exe" /APP:WAB /CALLER:WINNT /user /install> [N/A] ================================== 開機檔案夾 [Adobe Reader Speed Launch] <C:\Documents and Settings\All Users\「開始」功能表\程式集\啟動\Adobe Reader Speed Launch.lnk --> C:\PROGRA~1\Adobe\ACROBA~2.0\Reader\READER~1.EXE [Adobe Systems Incorporated]><N> [ADSL] <C:\Documents and Settings\pa-hoo\「開始」功能表\程式集\啟動\ADSL.lnk --> [N/A]><N> ================================== 服務 [AVG Anti-Spyware Guard / AVG Anti-Spyware Guard][Running/Auto Start] <C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe><GRISOFT s.r.o.> [Human Interface Device Access / HidServ][Stopped/Disabled] <C:\WINDOWS\System32\svchost.exe -k netsvcs-->%SystemRoot%\System32\hidserv.dll><N/A> [NVIDIA Display Driver Service / NVSvc][Running/Auto Start] <C:\WINDOWS\system32\nvsvc32.exe><NVIDIA Corporation> [Trend Micro Personal Firewall / PccPfw][Running/Auto Start] <C:\Program Files\Trend Micro\PC-cillin 2004\PccPfw.exe><Trend Micro Incorporated.> [Trend NT Realtime Service / Tmntsrv][Running/Auto Start] <"C:\Program Files\Trend Micro\PC-cillin 2004\Tmntsrv.exe"><Trend Micro Incorporated.> [Trend Micro Proxy Service / tmproxy][Running/Auto Start] <C:\Program Files\Trend Micro\PC-cillin 2004\tmproxy.exe><Trend Micro Incorporated.> ================================== 驅動程式 [AMD Processor Driver / AmdK8][Running/System Start] <system32\DRIVERS\AmdK8.sys><Advanced Micro Devices> [AVG Anti-Spyware Driver / AVG Anti-Spyware Driver][Running/System Start] <\??\C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.sys><N/A> [AVG Anti-Spyware Clean Driver / AvgAsCln][Running/System Start] <System32\DRIVERS\AvgAsCln.sys><GRISOFT, s.r.o.> [Microsoft UAA 匯流排驅動程式 (適用於 High Definition Audio) / HDAudBus][Running/Manual Start] <system32\DRIVERS\HDAudBus.sys><Windows (R) Server 2003 DDK provider> [Service for Realtek HD Audio (WDM) / IntcAzAudAddService][Running/Manual Start] <system32\drivers\RtkHDAud.sys><Realtek Semiconductor Corp.> [nv / nv][Running/Manual Start] <system32\DRIVERS\nv4_mini.sys><NVIDIA Corporation> [nvata / nvata][Running/Boot Start] <\SystemRoot\system32\DRIVERS\nvata.sys><NVIDIA Corporation> [NVIDIA nForce Networking Controller Driver / NVENETFD][Running/Manual Start] <system32\DRIVERS\NVENETFD.sys><NVIDIA Corporation> [NVIDIA Network Bus Enumerator / nvnetbus][Running/Manual Start] <system32\DRIVERS\nvnetbus.sys><NVIDIA Corporation> [直接平行連接埠連結驅動程式 / Ptilink][Running/Manual Start] <system32\DRIVERS\ptilink.sys><Parallel Technologies, Inc.> [Secdrv / Secdrv][Stopped/Manual Start] <system32\DRIVERS\secdrv.sys><N/A> [Tmfilter / Tmfilter][Running/Auto Start] <system32\drivers\TmXPFlt.sys><Trend Micro Inc.> [Tmpreflt / Tmpreflt][Running/Auto Start] <system32\drivers\Tmpreflt.sys><Trend Micro Inc.> [Trend Micro TDI Driver / tmtdi][Running/System Start] <\SystemRoot\System32\Drivers\tmtdi.sys><Trend Micro Inc.> [Common Firewall Driver / tm_cfw][Running/Auto Start] <\SystemRoot\System32\Drivers\tm_cfw.sys><Trend Micro Inc.> [Vsapint / Vsapint][Running/Auto Start] <system32\drivers\Vsapint.sys><Trend Micro Inc.> [wedcfvbghj / wedcfvbghj][Running/Manual Start] <2 - 系統找不到指定的檔案。 ><N/A> ================================== 流覽器載入項 [&Yahoo! Toolbar Helper] {02478D38-C3F9-4efb-9B51-7695ECA05670} <C:\Program Files\Yahoo!\Companion\Installs\cpn0\yt.dll, Yahoo! Inc.> [Adobe PDF Reader Link Helper] {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} <C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll, Adobe Systems Incorporated> [參考資料(&R)] {92780B25-18CC-41C8-B9BE-3C9C571A8263} <C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL, Microsoft Corporation> [Yahoo!奇摩捷徑列] {EF99BD32-C1FB-11D2-892F-0090271D4F88} <C:\Program Files\Yahoo!\Companion\Installs\cpn0\yt.dll, Yahoo! Inc.> [RALOG Class] {0FD3D8F2-9174-42BD-BC7A-AD1CAE413536} <C:\WINDOWS\Downloaded Program Files\RALATL.dll, > [Windows Genuine Advantage Validation Tool] {17492023-C23A-453E-A040-C7C580BBF700} <C:\WINDOWS\system32\LegitCheckControl.DLL, Microsoft Corporation> [WUWebControl Class] {6414512B-B978-451D-A0D8-FCFDF33E833C} <C:\WINDOWS\system32\wuweb.dll, Microsoft Corporation> [FSXMLATL Class] {95B7355A-15B6-43B5-8CA9-1A33ADE5B32D} <C:\WINDOWS\Downloaded Program Files\FSXMLCAPIATL.dll, > [EnvDetect Class] {9D10CDAC-AD9D-478A-BA49-4924481B20A6} <C:\WINDOWS\Downloaded Program Files\EnvDetectATL.dll, > [a-squared Scanner] {BB21F850-63F4-4EC9-BF9D-565BD30C9AE9} <C:\WINDOWS\DOWNLO~1\asquared.ocx, Emsi Software GmbH> [Shockwave Flash Object] {D27CDB6E-AE6D-11CF-96B8-444553540000} <C:\WINDOWS\system32\Macromed\Flash\Flash9b.ocx, Adobe Systems, Inc.> [Persits Software XEncrypt] {F9463571-87CB-4A90-A1AC-2284B7F5AF4E} <C:\WINDOWS\Downloaded Program Files\aspencrypt.dll, Persits Software, Inc.> [&Yahoo! Toolbar Helper] {02478D38-C3F9-4EFB-9B51-7695ECA05670} <C:\Program Files\Yahoo!\Companion\Installs\cpn0\yt.dll, Yahoo! Inc.> [Adobe PDF Reader Link Helper] {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} <C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll, Adobe Systems Incorporated> [RALOG Class] {0FD3D8F2-9174-42BD-BC7A-AD1CAE413536} <C:\WINDOWS\Downloaded Program Files\RALATL.dll, > [CEnroll Class] {127698E4-E730-4E5C-A2B1-21490A70C8A1} <C:\WINDOWS\system32\xenroll.dll, Microsoft Corporation> [Windows Genuine Advantage Validation Tool] {17492023-C23A-453E-A040-C7C580BBF700} <C:\WINDOWS\system32\LegitCheckControl.DLL, Microsoft Corporation> [InformationCardSigninHelper Class] {19916E01-B44E-4E31-94A4-4696DF46157B} <C:\WINDOWS\system32\icardie.dll, Microsoft Corporation> [Windows Media Player] {22D6F312-B0F6-11D0-94AB-0080C74C7E95} <C:\WINDOWS\system32\wmpdxm.dll, Microsoft Corporation> [HTML Document] {25336920-03F9-11CF-8FD0-00AA00686F13} <C:\WINDOWS\system32\mshtml.dll, Microsoft Corporation> [XML DOM Document] {2933BF90-7B36-11D2-B20E-00C04F983E60} <%SystemRoot%\system32\msxml3.dll, N/A> [DHTML Edit Control Safe for Scripting for IE5] {2D360201-FFF5-11D1-8D03-00A0C959BC0A} <C:\Program Files\Common Files\Microsoft Shared\Triedit\dhtmled.ocx, Microsoft Corporation> [HtmlDlgSafeHelper Class] {3050F819-98B5-11CF-BB82-00AA00BDCE0B} <C:\WINDOWS\system32\mshtmled.dll, Microsoft Corporation> [YInstStarter Class] {30528230-99F7-4BB4-88D8-FA1D4F56A2AB} <C:\WINDOWS\cache\yinsthelper.dll, Yahoo! Inc.> [Tabular Data Control] {333C7BC4-460F-11D0-BC04-0080C7055A83} <C:\WINDOWS\system32\tdc.ocx, Microsoft Corporation> [IETag Factory] {38481807-CA0E-42D2-BF39-B33AF135CC4D} <C:\PROGRA~1\COMMON~1\MICROS~1\SMARTT~1\IETAG.DLL, Microsoft Corporation> [XML Document] {48123BC4-99D9-11D1-A6B3-00C04FD91555} <%SystemRoot%\system32\msxml3.dll, N/A> [Shell Name Space] {55136805-B2DE-11D1-B9F2-00A0C98BC547} <C:\WINDOWS\system32\ieframe.dll, Microsoft Corporation> [KENCAPI Class] {5F4D222D-5EEE-40A8-8810-5642B4E4F441} <C:\Program Files\Formosoft\TCB_FSCAPIATL\FSCAPIATL.dll, Formosoft> [WUWebControl Class] {6414512B-B978-451D-A0D8-FCFDF33E833C} <C:\WINDOWS\system32\wuweb.dll, Microsoft Corporation> [Windows Media Player] {6BF52A52-394A-11D3-B153-00C04F79FAA6} <C:\WINDOWS\system32\wmp.dll, Microsoft Corporation> [Microsoft Web Browser] {8856F961-340A-11D0-A96B-00C04FD705A2} <C:\WINDOWS\system32\ieframe.dll, Microsoft Corporation> [XML DOM Document 5.0] {88D969E5-F192-11D4-A65F-0040963251E5} <C:\Program Files\Common Files\Microsoft Shared\OFFICE11\MSXML5.DLL, Microsoft Corporation> [FSXMLATL Class] {95B7355A-15B6-43B5-8CA9-1A33ADE5B32D} <C:\WINDOWS\Downloaded Program Files\FSXMLCAPIATL.dll, > [EnvDetect Class] {9D10CDAC-AD9D-478A-BA49-4924481B20A6} <C:\WINDOWS\Downloaded Program Files\EnvDetectATL.dll, > [SharePoint OpenDocuments Class] {9F9C4924-C3F3-4459-A396-9E9E0D8B83D1} <C:\PROGRA~1\MICROS~2\OFFICE11\OWSSUPP.DLL, Microsoft Corporation> [Microsoft Scriptlet Component] {AE24FDAE-03C6-11D1-8B76-0080C744F389} <C:\WINDOWS\system32\mshtml.dll, Microsoft Corporation> [a-squared Scanner] {BB21F850-63F4-4EC9-BF9D-565BD30C9AE9} <C:\WINDOWS\DOWNLO~1\asquared.ocx, Emsi Software GmbH> [RDS.DataSpace] {BD96C556-65A3-11D0-983A-00C04FC29E36} <C:\Program Files\Common Files\System\msadc\msadco.dll, Microsoft Corporation> [SharePoint Spreadsheet Launcher] {BDEADE9E-C265-11D0-BCED-00A0C90AB50F} <C:\PROGRA~1\MICROS~2\OFFICE11\OWSCLT.DLL, Microsoft Corporation> [SharePoint Stssync Handler] {BDEADEF4-C265-11D0-BCED-00A0C90AB50F} <C:\PROGRA~1\MICROS~2\OFFICE11\OWSSUPP.DLL, Microsoft Corporation> [AUDIO__MID Moniker Class] {CD3AFA74-B84F-48F0-9393-7EDC34128127} <C:\WINDOWS\system32\wmp.dll, Microsoft Corporation> [AUDIO__MP3 Moniker Class] {CD3AFA76-B84F-48F0-9393-7EDC34128127} <C:\WINDOWS\system32\wmp.dll, Microsoft Corporation> [AUDIO__WAV Moniker Class] {CD3AFA7B-B84F-48F0-9393-7EDC34128127} <C:\WINDOWS\system32\wmp.dll, Microsoft Corporation> [AUDIO__X_MS_WMA Moniker Class] {CD3AFA84-B84F-48F0-9393-7EDC34128127} <C:\WINDOWS\system32\wmp.dll, Microsoft Corporation> [VIDEO__MPEG Moniker Class] {CD3AFA89-B84F-48F0-9393-7EDC34128127} <C:\WINDOWS\system32\wmp.dll, Microsoft Corporation> [VIDEO__X_MS_ASF Moniker Class] {CD3AFA8F-B84F-48F0-9393-7EDC34128127} <C:\WINDOWS\system32\wmp.dll, Microsoft Corporation> [VIDEO__X_MS_WMV Moniker Class] {CD3AFA94-B84F-48F0-9393-7EDC34128127} <C:\WINDOWS\system32\wmp.dll, Microsoft Corporation> [Shockwave Flash Object] {D27CDB6E-AE6D-11CF-96B8-444553540000} <C:\WINDOWS\system32\Macromed\Flash\Flash9b.ocx, Adobe Systems, Inc.> [XML HTTP Request] {ED8C108E-4349-11D2-91A4-00C04F7969E8} <%SystemRoot%\system32\msxml3.dll, N/A> [Yahoo!奇摩捷徑列] {EF99BD32-C1FB-11D2-892F-0090271D4F88} <C:\Program Files\Yahoo!\Companion\Installs\cpn0\yt.dll, Yahoo! Inc.> [XML DOM Document 3.0] {F5078F32-C551-11D3-89B9-0000F81FE221} <%SystemRoot%\system32\msxml3.dll, N/A> [XML HTTP 3.0] {F5078F35-C551-11D3-89B9-0000F81FE221} <%SystemRoot%\system32\msxml3.dll, N/A> [XML DOM Document] {F6D90F11-9C73-11D3-B32E-00C04F990BB4} <%SystemRoot%\system32\msxml3.dll, N/A> [XML HTTP] {F6D90F16-9C73-11D3-B32E-00C04F990BB4} <%SystemRoot%\system32\msxml3.dll, N/A> [Persits Software XEncrypt] {F9463571-87CB-4A90-A1AC-2284B7F5AF4E} <C:\WINDOWS\Downloaded Program Files\aspencrypt.dll, Persits Software, Inc.> [匯出至 Microsoft Office Excel(&X)] <res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000, N/A> ================================== 正在運行的進程 [PID: 616 / SYSTEM][\SystemRoot\System32\smss.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)] [PID: 680 / SYSTEM][\??\C:\WINDOWS\system32\csrss.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)] [PID: 704 / SYSTEM][\??\C:\WINDOWS\system32\winlogon.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)] [PID: 748 / SYSTEM][C:\WINDOWS\system32\services.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)] [PID: 760 / SYSTEM][C:\WINDOWS\system32\lsass.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)] [PID: 940 / SYSTEM][C:\WINDOWS\system32\svchost.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)] [PID: 988 / NETWORK SERVICE][C:\WINDOWS\system32\svchost.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)] [PID: 1080 / SYSTEM][C:\WINDOWS\System32\svchost.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)] [PID: 1128 / NETWORK SERVICE][C:\WINDOWS\system32\svchost.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)] [PID: 1232 / LOCAL SERVICE][C:\WINDOWS\system32\svchost.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)] [PID: 1440 / pa-hoo][C:\WINDOWS\Explorer.EXE] [Microsoft Corporation, 6.00.2900.3156 (xpsp_sp2_gdr.070613-1234)] [C:\WINDOWS\HELP\F3C74E3FA248.dll] [N/A, ] [C:\WINDOWS\system32\kavo1.dll] [N/A, ] [C:\Program Files\Adobe\Acrobat 7.0\ActiveX\PDFShell.dll] [Adobe Systems, Inc., 7.0.0.0] [C:\WINDOWS\system32\nvcpl.dll] [NVIDIA Corporation, 6.14.10.9148] [C:\WINDOWS\system32\NVRSZHT.DLL] [NVIDIA Corporation, 6.14.10.9148] [C:\WINDOWS\system32\nvapi.dll] [N/A, ] [C:\WINDOWS\system32\nvshell.dll] [, ] [C:\Program Files\Trend Micro\PC-cillin 2004\Tmdshell.dll] [Trend Micro Incorporated., 11.0.0.1264] [C:\PROGRA~1\WINZIP\WZSHLSTB.DLL] [WinZip Computing, Inc., 4.1 (32-bit)] [C:\Program Files\WinRAR\rarext.dll] [N/A, ] [C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\context.dll] [GRISOFT s.r.o., 7, 5, 1, 36] [PID: 1468 / SYSTEM][C:\WINDOWS\system32\spoolsv.exe] [Microsoft Corporation, 5.1.2600.2696 (xpsp_sp2_gdr.050610-1519)] [C:\WINDOWS\system32\mdimon.dll] [Microsoft Corporation, 11.3.1897.0] [C:\WINDOWS\System32\spool\PRTPROCS\W32X86\mdippr.dll] [Microsoft Corporation, 11.3.1897.0] [PID: 1724 / pa-hoo][C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe] [GRISOFT s.r.o., 7, 5, 1, 43] [C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\engine.dll] [GRISOFT s.r.o., 4, 2, 0, 19] [C:\WINDOWS\system32\kavo1.dll] [N/A, ] [C:\WINDOWS\HELP\F3C74E3FA248.dll] [N/A, ] [PID: 1732 / pa-hoo][C:\Program Files\Yahoo!\Search Protection\SearchProtection.exe] [Yahoo! Inc., 2007, 6, 8, 1] [C:\Program Files\Yahoo!\Search Protection\fdload.dll] [Yahoo! Inc., 2007, 7, 30, 1] [PID: 1740 / pa-hoo][C:\WINDOWS\system32\ctfmon.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)] [C:\WINDOWS\HELP\F3C74E3FA248.dll] [N/A, ] [PID: 1920 / SYSTEM][C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe] [GRISOFT s.r.o., 7, 5, 1, 22] [C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\engine.dll] [GRISOFT s.r.o., 4, 2, 0, 19] [PID: 1988 / SYSTEM][C:\WINDOWS\system32\nvsvc32.exe] [NVIDIA Corporation, 6.14.10.9148] [C:\WINDOWS\system32\nvapi.dll] [N/A, ] [PID: 2028 / SYSTEM][C:\Program Files\Trend Micro\PC-cillin 2004\Tmntsrv.exe] [Trend Micro Incorporated., 11.0.0.1264] [C:\Program Files\Trend Micro\PC-cillin 2004\tmdbg.dll] [N/A, ] [C:\Program Files\Trend Micro\PC-cillin 2004\pewnt2.dll] [Trend Micro Incorporated., 11.0.0.1264] [PID: 344 / SYSTEM][C:\Program Files\Trend Micro\PC-cillin 2004\tmproxy.exe] [Trend Micro Incorporated., 11.0.0.1264] [C:\PROGRA~1\TRENDM~1\PC-CIL~1\tmdbg.dll] [N/A, ] [C:\PROGRA~1\TRENDM~1\PC-CIL~1\TmpxHelp.dll] [Trend Micro Incorporated., 11.0.0.1264] [C:\PROGRA~1\TRENDM~1\PC-CIL~1\TmpxCfg.dll] [Trend Micro Incorporated., 11.0.0.1264] [C:\PROGRA~1\TRENDM~1\PC-CIL~1\tmtdi.dll] [Trend Micro Incorporated., 11.0.0.1264] [C:\PROGRA~1\TRENDM~1\PC-CIL~1\TmsmHttp.dll] [Trend Micro Incorporated., 11.0.0.1264] [C:\PROGRA~1\TRENDM~1\PC-CIL~1\TmpeVS.dll] [Trend Micro Incorporated., 11.0.0.1264] [C:\PROGRA~1\TRENDM~1\PC-CIL~1\vsapi32.dll] [Trend Micro Inc., 8.500-1002] [C:\PROGRA~1\TRENDM~1\PC-CIL~1\TmpeURLF.dll] [, ] [C:\PROGRA~1\TRENDM~1\PC-CIL~1\TmphHttp.dll] [Trend Micro Incorporated., 11.0.0.1264] [C:\PROGRA~1\TRENDM~1\PC-CIL~1\TmsmMail.dll] [Trend Micro Incorporated., 11.0.0.1264] [C:\Program Files\Trend Micro\PC-cillin 2004\TmMsg.dll] [Trend Micro Inc., 2.0] [C:\Program Files\Trend Micro\PC-cillin 2004\icuin18.dll] [IBM Corporation and others, 1, 8, 1, 0] [C:\Program Files\Trend Micro\PC-cillin 2004\icuuc18.dll] [IBM Corporation and others, 1, 8, 1, 0] [C:\PROGRA~1\TRENDM~1\PC-CIL~1\TmphPop3.dll] [Trend Micro Incorporated., 11.0.0.1264] [C:\PROGRA~1\TRENDM~1\PC-CIL~1\TmphSMTP.dll] [Trend Micro Incorporated., 11.0.0.1264] [PID: 764 / SYSTEM][C:\Program Files\Trend Micro\PC-cillin 2004\PccPfw.exe] [Trend Micro Incorporated., 11.0.0.1264] [C:\Program Files\Trend Micro\PC-cillin 2004\tmdbg.dll] [N/A, ] [C:\Program Files\Trend Micro\PC-cillin 2004\tmCfwApi.dll] [Trend Micro Inc., 1.2.0.1020] [PID: 2396 / LOCAL SERVICE][C:\WINDOWS\System32\alg.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)] [PID: 184 / pa-hoo][C:\Program Files\Trend Micro\PC-cillin 2004\PCCGUIDE.EXE] [Trend Micro Incorporated., 11.0.0.1264] [C:\Program Files\Trend Micro\PC-cillin 2004\tmdbg.dll] [N/A, ] [C:\Program Files\Trend Micro\PC-cillin 2004\tmCfwApi.dll] [Trend Micro Inc., 1.2.0.1020] [C:\Program Files\Trend Micro\PC-cillin 2004\TmProxy.dll] [Trend Micro Incorporated., 11.0.0.1264] [C:\WINDOWS\system32\kavo1.dll] [N/A, ] [C:\WINDOWS\HELP\F3C74E3FA248.dll] [N/A, ] [PID: 2380 / pa-hoo][C:\WINDOWS\system32\mspaint.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)] [C:\WINDOWS\system32\kavo1.dll] [N/A, ] [C:\WINDOWS\HELP\F3C74E3FA248.dll] [N/A, ] [PID: 3796 / SYSTEM][C:\WINDOWS\system32\svchost.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)] [PID: 1932 / pa-hoo][C:\WINDOWS\system32\conime.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)] [PID: 1212 / pa-hoo][C:\Program Files\Internet Explorer\iexplore.exe] [Microsoft Corporation, 7.00.6000.16544 (vista_gdr.070814-1500)] [C:\Program Files\Yahoo!\Companion\Installs\cpn0\yt.dll] [Yahoo! Inc., 2007, 9, 5, 1] [C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll] [Adobe Systems Incorporated, 7.0.9.2006121800] [C:\WINDOWS\system32\MSVCR71.dll] [Microsoft Corporation, 7.10.3052.4] [C:\Program Files\Yahoo!\Companion\Installs\cpn0\YTBM.dll] [Yahoo! Inc., 2007, 8, 21, 1] [C:\Program Files\Yahoo!\Companion\Installs\cpn0\pubmod.dll] [Yahoo! Inc., 2007, 8, 22, 1] [C:\Program Files\Yahoo!\Companion\Installs\cpn0\YPUBC.dll] [Yahoo! Inc., 2006, 12, 4, 1] [C:\WINDOWS\system32\Macromed\Flash\Flash9b.ocx] [Adobe Systems, Inc., 9,0,28,0] [C:\WINDOWS\system32\kavo1.dll] [N/A, ] [C:\WINDOWS\HELP\F3C74E3FA248.dll] [N/A, ] [C:\WINDOWS\system32\icm32.dll] [Microsoft Corporation, 5.1.2600.2709 (xpsp_sp2_gdr.050628-1518)] [PID: 3640 / pa-hoo][D:\sreng2\SREngPS.EXE] [Smallfrogs Studio, 2.5.16.900] [D:\sreng2\Lang\1028.DLL] [System Repair Engineer, 2.5.16.900] [C:\WINDOWS\system32\kavo1.dll] [N/A, ] [C:\WINDOWS\HELP\F3C74E3FA248.dll] [N/A, ] [D:\sreng2\Upload\3rdUpd.DLL] [Smallfrogs Studio, 2, 1, 0, 15] ================================== 文件關聯 .TXT OK. [%SystemRoot%\system32\NOTEPAD.EXE %1] .EXE OK. ["%1" %*] .COM OK. ["%1" %*] .PIF OK. ["%1" %*] .REG OK. [regedit.exe "%1"] .BAT OK. ["%1" %*] .SCR OK. ["%1" /S] .CHM OK. ["C:\WINDOWS\hh.exe" %1] .HLP OK. [%SystemRoot%\system32\winhlp32.exe %1] .INI OK. [%SystemRoot%\system32\NOTEPAD.EXE %1] .INF OK. [%SystemRoot%\system32\NOTEPAD.EXE %1] .VBS OK. [%SystemRoot%\System32\WScript.exe "%1" %*] .JS OK. [%SystemRoot%\System32\WScript.exe "%1" %*] .LNK OK. [{00021401-0000-0000-C000-000000000046}] ================================== Winsock 提供者 N/A ================================== Autorun.inf [C:\] [AutoRun] open=ntdelect.com ;shell\open=Open(&O) shell\open\Command=ntdelect.com shell\open\Default=1 ;shell\explore=Manager(&X) shell\explore\Command=ntdelect.com [D:\] [AutoRun] open=ntdelect.com ;shell\open=Open(&O) shell\open\Command=ntdelect.com shell\open\Default=1 ;shell\explore=Manager(&X) shell\explore\Command=ntdelect.com ================================== HOSTS 文件 127.0.0.1 localhost ================================== 進程特權掃描 特殊特權被允許: SeLoadDriverPrivilege [PID = 184, C:\PROGRAM FILES\TREND MICRO\PC-CILLIN 2004\PCCGUIDE.EXE] ================================== API HOOK N/A ================================== 隱藏進程 N/A ================================== x0 |