TWed2k - 軟體求助討論區 - 電腦一直跳出奇怪網站已放問題圖片上去

h80053
銀驢友〔中級〕

．積分： 720
．精華： 1
．文章： 2053
．收花： 5801 支
．送花： 8430 支
．比例： 1.45
．在線： 2473 小時
．瀏覽： 17320 頁
．註冊： 7228 天
．失蹤： 126 天
．台中

#1 : 2009-11-22 09:05 AM 全部回覆	送花 (0) 送出中...

因為現在我去當兵的關係所以再家用電腦時間不多，這一次剛回到家電腦就出了狀況。
三不五時就跳出類似有問題的網站，之後電腦就問題不段常常連不上線、網路有延遲的現象。
雖然我這樣說很模糊，但不知道板上有人有沒有遇過相關問題可以指教一下呢??
謝謝

我所說的類似奇怪網站

新增移除內無奇怪的軟體??(我分辨不出來)

之後開了小紅傘掃毒發現不少毒= =
可是還是會出現滑鼠移動等等狀況
我過一會貼圖上來，還請各位大大指教一下謝謝。

[h80053 在 2009-11-27 05:51 PM 作了最後編輯]

相關關鍵字: 跳出奇怪網站

[如果你喜歡本文章，就按本文章之鮮花～送花給作者吧，你的支持就是別人的動力來源]

本文連接

快速回覆

h80053
銀驢友〔中級〕

．積分： 720
．精華： 1
．文章： 2053
．收花： 5801 支
．送花： 8430 支
．比例： 1.45
．在線： 2473 小時
．瀏覽： 17320 頁
．註冊： 7228 天
．失蹤： 126 天
．台中

#2 : 2009-11-22 01:53 PM 全部回覆	送花 (0) 送出中...

小任兄好阿!好久不見了
我上去看好像沒有怪怪的東西(其實我分別不出來~)
也沒有怪怪的字體
不知道大大可以在說詳細一些嗎?

我這個也不是首頁被綁架有點類似他會自己跳視窗出來
有時候游標也會自己跑來跑去的....

[如果你喜歡本文章，就按本文章之鮮花～送花給作者吧，你的支持就是別人的動力來源]

本文連接

快速回覆

h80053
銀驢友〔中級〕

．積分： 720
．精華： 1
．文章： 2053
．收花： 5801 支
．送花： 8430 支
．比例： 1.45
．在線： 2473 小時
．瀏覽： 17320 頁
．註冊： 7228 天
．失蹤： 126 天
．台中

#3 : 2009-11-27 05:52 PM 全部回覆	送花 (0) 送出中...

引用:

dennischerry寫到:

找個掃木馬的程式掃一掃,
會幫您把那些惡意廣告和木馬清一清.

請問大大有推薦的掃木馬程式嗎???
謝謝!!

[h80053 在 2009-11-27 05:53 PM 作了最後編輯]

[如果你喜歡本文章，就按本文章之鮮花～送花給作者吧，你的支持就是別人的動力來源]

本文連接

快速回覆

h80053
銀驢友〔中級〕

．積分： 720
．精華： 1
．文章： 2053
．收花： 5801 支
．送花： 8430 支
．比例： 1.45
．在線： 2473 小時
．瀏覽： 17320 頁
．註冊： 7228 天
．失蹤： 126 天
．台中

#4 : 2009-11-27 07:28 PM 全部回覆	送花 (0) 送出中...

目前使用率有一些高但我想是開遊戲(瑪奇)的關係
照大大所說的進去裡面看沒有發現到檔案
我重放了一張(已經盡量放到最大放法可能有些問題)

舊問題沒解決新問題又增加如下圖開C槽時會套出此視窗

還請大大指教謝謝

[h80053 在 2009-11-27 07:33 PM 作了最後編輯]

[如果你喜歡本文章，就按本文章之鮮花～送花給作者吧，你的支持就是別人的動力來源]

本文連接

快速回覆

h80053
銀驢友〔中級〕

．積分： 720
．精華： 1
．文章： 2053
．收花： 5801 支
．送花： 8430 支
．比例： 1.45
．在線： 2473 小時
．瀏覽： 17320 頁
．註冊： 7228 天
．失蹤： 126 天
．台中

#5 : 2009-11-27 10:39 PM 全部回覆	送花 (0) 送出中...

請問軟體掃到的東西都可以刪除嗎???
我的軟體是正版的也都有在更新!!
RAYSORCE 我不記得我有安裝過這個
因為電腦是跟我弟在用沒有掌握他都安裝些什麼不知道是不是配合遊戲安裝到的
PC MAN 我是拿來看BBS用基本上都是放著有要看才開
請問大大還有在裡面看到什麼奇怪的東西嗎?? 因為確實安裝的東西很雜亂

在此也謝謝大大

我剛剛看了一下但沒有看出一個所以然@@
但是圈了幾個我覺得奇怪的東西還請大大看看

[h80053 在 2009-11-27 10:49 PM 作了最後編輯]

[如果你喜歡本文章，就按本文章之鮮花～送花給作者吧，你的支持就是別人的動力來源]

本文連接

快速回覆

h80053
銀驢友〔中級〕

．積分： 720
．精華： 1
．文章： 2053
．收花： 5801 支
．送花： 8430 支
．比例： 1.45
．在線： 2473 小時
．瀏覽： 17320 頁
．註冊： 7228 天
．失蹤： 126 天
．台中

#6 : 2009-11-28 05:19 AM 全部回覆	送花 (0) 送出中...

謝謝大大我馬上來試試看!!
測試好將結果PO上來看是否會有網頁跳出

[h80053 在 2009-11-28 05:28 AM 作了最後編輯]

[如果你喜歡本文章，就按本文章之鮮花～送花給作者吧，你的支持就是別人的動力來源]

本文連接

快速回覆

h80053
銀驢友〔中級〕

．積分： 720
．精華： 1
．文章： 2053
．收花： 5801 支
．送花： 8430 支
．比例： 1.45
．在線： 2473 小時
．瀏覽： 17320 頁
．註冊： 7228 天
．失蹤： 126 天
．台中

#7 : 2009-11-28 05:20 PM 全部回覆	送花 (0) 送出中...

謝謝小任大大的寶貴意見!!我晚點再去試試看。
之前我電腦有問題也都是重灌但是這樣我網路還要再設定不然會IOW IP
所以之前重灌一次就懶了，希望這一次能順利解決

我已經更新過了將他給刪除了!!
可是還是跑出奇怪網頁@@
要嘗試安裝01上頭說的方式安裝到一半網頁都會跳出來@@

[h80053 在 2009-11-28 06:44 PM 作了最後編輯]

[如果你喜歡本文章，就按本文章之鮮花～送花給作者吧，你的支持就是別人的動力來源]

本文連接

快速回覆

h80053
銀驢友〔中級〕

．積分： 720
．精華： 1
．文章： 2053
．收花： 5801 支
．送花： 8430 支
．比例： 1.45
．在線： 2473 小時
．瀏覽： 17320 頁
．註冊： 7228 天
．失蹤： 126 天
．台中

#8 : 2009-11-28 09:21 PM 全部回覆	送花 (0) 送出中...

目前開始順利掃毒中但是要掃完還有一段時間
明天我會把結果跟東西PO出來跟大大們討論!!
小任你說的常駐檔案是專指IE的嗎??
其實很多常駐程式我自己也不是很清楚所以在這邊在問詳細一些
我之前有看過確實會跳出一個IE出來但是按掉刪除後後還是會在出現
可能是源頭太深了@@

[如果你喜歡本文章，就按本文章之鮮花～送花給作者吧，你的支持就是別人的動力來源]

本文連接

快速回覆

h80053
銀驢友〔中級〕

．積分： 720
．精華： 1
．文章： 2053
．收花： 5801 支
．送花： 8430 支
．比例： 1.45
．在線： 2473 小時
．瀏覽： 17320 頁
．註冊： 7228 天
．失蹤： 126 天
．台中

#9 : 2009-11-28 10:38 PM 全部回覆	送花 (3) 送出中...

謝謝大大目前掃出來有殺掉不少程式
接著就是在嘗試看看大大說的方法來去抓源頭了
之後有什麼變化我會在發表出來謝謝

裡面可以關的程式只有一個跟大大的相輔
其他的好像跟大大不一樣所以貼上來
至於掃過後網頁還沒跳出來過

[h80053 在 2009-11-29 08:43 AM 作了最後編輯]

[如果你喜歡本文章，就按本文章之鮮花～送花給作者吧，你的支持就是別人的動力來源]

本文連接

快速回覆

h80053
銀驢友〔中級〕

．積分： 720
．精華： 1
．文章： 2053
．收花： 5801 支
．送花： 8430 支
．比例： 1.45
．在線： 2473 小時
．瀏覽： 17320 頁
．註冊： 7228 天
．失蹤： 126 天
．台中

#10 : 2009-11-30 08:37 AM 全部回覆	送花 (0) 送出中...

掃毒過後的報告檔

好像沒檢查到什麼東西@@
至於大大所提出的那一個檔案我倒是沒注意到
我等等觀看看會有什麼反應

Avira AntiVir Personal
Report file date: 2009年11月30日  07:52

Scanning for 1400843 virus strains and unwanted programs.

Licensee       : Avira AntiVir Personal - FREE Antivirus
Serial number : 0000149996-ADJIE-0000001
Platform       : Windows XP
Windows version : (Service Pack 3)  [5.1.2600]
Boot mode    : Normally booted
Username       : SYSTEM
Computer name : YOUR-1480315507

Version information:
BUILD.DAT    : 9.0.0.415    21609 Bytes 2009/11/8 10:00:00
AVSCAN.EXE    : 9.0.3.10    466689 Bytes  2009/10/13 03:26:33
AVSCAN.DLL    : 9.0.3.0    40705 Bytes 2009/2/27 02:58:24
LUKE.DLL       : 9.0.3.2    209665 Bytes 2009/2/20 03:35:49
LUKERES.DLL    : 9.0.2.0    12033 Bytes 2009/2/27 02:58:52
VBASE000.VDF : 7.10.0.0 19875328 Bytes 2009/11/6 23:35:52
VBASE001.VDF : 7.10.1.0 1372672 Bytes  2009/11/19 11:36:33
VBASE002.VDF : 7.10.1.1    2048 Bytes  2009/11/19 11:36:33
VBASE003.VDF : 7.10.1.2    2048 Bytes  2009/11/19 11:36:33
VBASE004.VDF : 7.10.1.3    2048 Bytes  2009/11/19 11:36:33
VBASE005.VDF : 7.10.1.4    2048 Bytes  2009/11/19 11:36:34
VBASE006.VDF : 7.10.1.5    2048 Bytes  2009/11/19 11:36:34
VBASE007.VDF : 7.10.1.6    2048 Bytes  2009/11/19 11:36:34
VBASE008.VDF : 7.10.1.7    2048 Bytes  2009/11/19 11:36:34
VBASE009.VDF : 7.10.1.8    2048 Bytes  2009/11/19 11:36:34
VBASE010.VDF : 7.10.1.9    2048 Bytes  2009/11/19 11:36:34
VBASE011.VDF : 7.10.1.10    2048 Bytes  2009/11/19 11:36:35
VBASE012.VDF : 7.10.1.11    2048 Bytes  2009/11/19 11:36:35
VBASE013.VDF : 7.10.1.79 209920 Bytes  2009/11/25 11:36:37
VBASE014.VDF : 7.10.1.80    2048 Bytes  2009/11/25 11:36:37
VBASE015.VDF : 7.10.1.81    2048 Bytes  2009/11/25 11:36:37
VBASE016.VDF : 7.10.1.82    2048 Bytes  2009/11/25 11:36:37
VBASE017.VDF : 7.10.1.83    2048 Bytes  2009/11/25 11:36:37
VBASE018.VDF : 7.10.1.84    2048 Bytes  2009/11/25 11:36:37
VBASE019.VDF : 7.10.1.85    2048 Bytes  2009/11/25 11:36:38
VBASE020.VDF : 7.10.1.86    2048 Bytes  2009/11/25 11:36:38
VBASE021.VDF : 7.10.1.87    2048 Bytes  2009/11/25 11:36:38
VBASE022.VDF : 7.10.1.88    2048 Bytes  2009/11/25 11:36:38
VBASE023.VDF : 7.10.1.89    2048 Bytes  2009/11/25 11:36:38
VBASE024.VDF : 7.10.1.90    2048 Bytes  2009/11/25 11:36:38
VBASE025.VDF : 7.10.1.91    2048 Bytes  2009/11/25 11:36:39
VBASE026.VDF : 7.10.1.92    2048 Bytes  2009/11/25 11:36:39
VBASE027.VDF : 7.10.1.93    2048 Bytes  2009/11/25 11:36:39
VBASE028.VDF : 7.10.1.94    2048 Bytes  2009/11/25 11:36:39
VBASE029.VDF : 7.10.1.95    2048 Bytes  2009/11/25 11:36:39
VBASE030.VDF : 7.10.1.96    2048 Bytes  2009/11/25 11:36:39
VBASE031.VDF : 7.10.1.117 112128 Bytes  2009/11/27 11:33:38
Engineversion : 8.2.1.78
AEVDF.DLL    : 8.1.1.2    106867 Bytes 2009/11/7 23:38:52
AESCRIPT.DLL : 8.1.2.45    586108 Bytes  2009/11/25 11:36:52
AESCN.DLL    : 8.1.2.5    127346 Bytes 2009/11/7 23:38:46
AESBX.DLL    : 8.1.1.1    246132 Bytes 2009/11/7 23:38:44
AERDL.DLL    : 8.1.3.2    479604 Bytes 2009/11/7 23:38:42
AEPACK.DLL    : 8.2.0.3    422261 Bytes 2009/11/7 23:38:40
AEOFFICE.DLL : 8.1.0.38    196987 Bytes 2009/11/7 23:38:38
AEHEUR.DLL    : 8.1.0.180 2093432 Bytes  2009/11/25 11:36:50
AEHELP.DLL    : 8.1.7.5    237942 Bytes  2009/11/25 11:36:42
AEGEN.DLL    : 8.1.1.78    364917 Bytes  2009/11/25 11:36:41
AEEMU.DLL    : 8.1.1.0    393587 Bytes 2009/11/7 23:38:26
AECORE.DLL    : 8.1.8.2    184694 Bytes 2009/11/7 23:38:24
AEBB.DLL       : 8.1.0.3    53618 Bytes 2009/11/7 23:38:20
AVWINLL.DLL    : 9.0.0.3    18177 Bytes  2008/12/12 00:47:59
AVPREF.DLL    : 9.0.3.0    44289 Bytes 2009/8/26 07:14:02
AVREP.DLL    : 8.0.0.3    155905 Bytes 2009/1/20 06:34:28
AVREG.DLL    : 9.0.0.0    36609 Bytes 2008/12/5 02:32:09
AVARKT.DLL    : 9.0.0.3    292609 Bytes 2009/3/24 07:05:41
AVEVTLOG.DLL : 9.0.0.7    167169 Bytes 2009/1/30 02:37:08
SQLITE3.DLL    : 3.6.1.0    326401 Bytes 2009/1/28 07:03:49
SMTPLIB.DLL    : 9.2.0.25    28417 Bytes 2009/2/2 00:21:33
NETNT.DLL    : 9.0.0.0    11521 Bytes 2008/12/5 02:32:10
RCIMAGE.DLL    : 9.0.0.25 2438913 Bytes 2009/5/15 07:39:58
RCTEXT.DLL    : 9.0.73.0    86785 Bytes  2009/10/13 04:25:47

Configuration settings for the scan:
Jobname.............................: Complete system scan
Configuration file..................: c:\program files\avira\antivir desktop\sysscan.avp
Logging.............................: low
Primary action......................: repair
Secondary action....................: delete
Scan master boot sector.............: on
Scan boot sector....................: on
Boot sectors........................: C:, D:,
Process scan........................: on
Scan registry.......................: on
Search for rootkits.................: on
Integrity checking of system files..: off
Scan all files......................: All files
Scan archives.......................: on
Recursion depth.....................: 20
Smart extensions....................: on
Macro heuristic.....................: on
File heuristic......................: medium

Start of the scan: 2009年11月30日  07:52

Starting search for hidden objects.
'47537' objects were checked, '0' hidden objects were found.

The scan of running processes will be started
Scan process 'avscan.exe' - '1' Module(s) have been scanned
Scan process 'avcenter.exe' - '1' Module(s) have been scanned
Scan process 'spoolsv.exe' - '1' Module(s) have been scanned
Scan process 'wmplayer.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'hpswp_clipbook.exe' - '1' Module(s) have been scanned
Scan process 'iexplore.exe' - '1' Module(s) have been scanned
Scan process 'emule.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'wscntfy.exe' - '1' Module(s) have been scanned
Scan process 'alg.exe' - '1' Module(s) have been scanned
Scan process 'ViewpointService.exe' - '1' Module(s) have been scanned
Scan process 'ULCDRSvr.exe' - '1' Module(s) have been scanned
Scan process 'SeaPort.exe' - '1' Module(s) have been scanned
Scan process 'scardsvr.exe' - '1' Module(s) have been scanned
Scan process 'RichVideo.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'avguard.exe' - '1' Module(s) have been scanned
Scan process 'CCC.exe' - '1' Module(s) have been scanned
Scan process 'MOM.exe' - '1' Module(s) have been scanned
Scan process 'ctfmon.exe' - '1' Module(s) have been scanned
Scan process 'avgnt.exe' - '1' Module(s) have been scanned
Scan process 'hpwuschd2.exe' - '1' Module(s) have been scanned
Scan process 'peer.exe' - '1' Module(s) have been scanned
Scan process 'BePCSC.exe' - '1' Module(s) have been scanned
Scan process 'SmartMON.exe' - '1' Module(s) have been scanned
Scan process 'RTHDCPL.exe' - '1' Module(s) have been scanned
Scan process 'explorer.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'sched.exe' - '1' Module(s) have been scanned
Scan process 'ati2evxx.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'ati2evxx.exe' - '1' Module(s) have been scanned
Scan process 'lsass.exe' - '1' Module(s) have been scanned
Scan process 'services.exe' - '1' Module(s) have been scanned
Scan process 'winlogon.exe' - '1' Module(s) have been scanned
Scan process 'csrss.exe' - '1' Module(s) have been scanned
Scan process 'smss.exe' - '1' Module(s) have been scanned
42 processes with 42 modules were scanned

Starting master boot sector scan:
Master boot sector HD0
[INFO]    No virus was found!

Start scanning boot sectors:
Boot sector 'C:\'
[INFO]    No virus was found!
Boot sector 'D:\'
[INFO]    No virus was found!

Starting to scan executable files (registry).
The registry was scanned ( '65' files ).

Starting the file scan:

Begin scan in 'C:\'
C:\pagefile.sys
[WARNING] The file could not be opened!
[NOTE]    This file is a Windows system file.
[NOTE]    This file cannot be opened for scanning.
C:\WINDOWS\SoftwareDistribution\Download\26937c38397cdf6fe89dcfb204cc0f11\BIT151.tmp
  [0] Archive type: CAB (Microsoft)
--> hpoh710a.cab
   [1] Archive type: CAB (Microsoft)
   --> hpbcfgre.dll
      [WARNING] No further files can be extracted from this archive. The archive will be closed
--> hpoh710a.cat
   [WARNING] No further files can be extracted from this archive. The archive will be closed
Begin scan in 'D:\'

End of the scan: 2009年11月30日  08:34
Used time: 42:03 Minute(s)

The scan has been done completely.

8525 Scanned directories
241189 Files were scanned
   0 Viruses and/or unwanted programs were found
   0 Files were classified as suspicious
   0 files were deleted
   0 Viruses and unwanted programs were repaired
   0 Files were moved to quarantine
   0 Files were renamed
   1 Files cannot be scanned
241188 Files not concerned
7553 Archives were scanned
   3 Warnings
   1 Notes
  47537 Objects were scanned with rootkit scan
   0 Hidden objects were found

[h80053 在  2009-11-30 08:41 AM 作了最後編輯]

[如果你喜歡本文章，就按本文章之鮮花～送花給作者吧，你的支持就是別人的動力來源]

本文連接

快速回覆

h80053
銀驢友〔中級〕

．積分： 720
．精華： 1
．文章： 2053
．收花： 5801 支
．送花： 8430 支
．比例： 1.45
．在線： 2473 小時
．瀏覽： 17320 頁
．註冊： 7228 天
．失蹤： 126 天
．台中

#11 : 2009-12-10 03:38 PM 全部回覆	送花 (0) 送出中...

謝謝大大的指教!!
因為網頁又開始跑出來了~
我弟不知道又灌了什麼東西進去@@
馬上來用看看

掃了三十多分鐘後又發現不少毒@@

CODE:

[Copy to clipboard]

efix 5.3 20091126.30 -  2009-12-10 15:44:05.39  -  ntfs
Microsoft Windows XP  Service Pack 3 - MMX
執行位置: C:\Documents and Settings\MMX\桌面\新資料夾 (2)\EF2009112630.exe
AV: AntiVir Desktop (Avira GmbH) True - Enabled

提示：

未安裝安全性更新 KB971029

================================================================================
使用者帳戶列表:
Administrator
ASPNET
Guest
HelpAssistant
MMX -- Current
SUPPORT_388945a0

================================================================================
EF刪除的檔案列表:

c:\windows\ahnrpta.exe

================================================================================
EF刪除的驅動服務列表:

....\service\AVPsys

EF修改的登錄值列表:

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
"{BB4C402F-882A-4526-8C08-51278EA437C1}"=-

================================================================================
EF刪除的檔案備份位置列表:

C:\WINDOWS\AhnRpta.exe => C:\ef_backup\backup\C\WINDOWS\AhnRpta.exe.vir

================================================================================
各磁碟根目錄含有隱藏屬性的資料夾和檔案 :

2006-08-24 00:57:20 . 2009-05-02 19:20:46 -rhs--- 223  C:\boot.ini
2006-08-24 00:56:51 . 2006-03-02 20:00:00 -rhs--- 213830  C:\bootfont.bin
2006-08-24 00:56:55 . 2006-03-02 20:00:00 -rhs--- 47564  C:\NTDETECT.COM
2006-08-24 00:56:55 . 2009-05-18 21:11:07 -rhs--- 257728  C:\ntldr
2009-07-23 09:24:54 . 2009-08-23 14:45:29 --hs--- 251904  C:\radial.cdb
2009-06-25 08:00:49 . 2009-11-25 19:32:48 --h---- <DIR>  C:\Config.Msi
2009-10-30 21:46:16 . 2009-11-01 13:04:46 -rhs--- 127235  D:\clxam6r6.exe
2009-05-16 17:31:11 . 2009-05-16 17:31:11 --hs--- <DIR>  D:\vod_cache_data

********** Created 2009-11 -- 2009-12 Files: **********

2009-12-10 14:59:34 . 2009-12-10 15:03:35  -------  <DIR>  C:\WINDOWS\LastGood
2009-11-28 18:43:00 . 2009-11-28 18:53:22  -------  <DIR>  C:\Program Files\Windows Live Safety Center
2009-11-25 19:33:00 . 2009-05-11 09:12:24  a------  28520  C:\WINDOWS\system32\drivers\ssmdrv.sys
2009-11-25 19:33:00 . 2009-03-30 09:33:07  a------  96104  C:\WINDOWS\system32\drivers\avipbb.sys
2009-11-25 19:33:00 . 2009-02-13 11:29:11  a------  22360  C:\WINDOWS\system32\drivers\avgntmgr.sys
2009-11-25 19:33:00 . 2009-02-13 11:17:49  a------  45416  C:\WINDOWS\system32\drivers\avgntdd.sys
2009-11-25 18:19:55 . 2009-11-25 19:16:38  -------  <DIR>  C:\WINDOWS\system32\NtmsData
2009-11-23 20:56:08 . 2009-11-23 20:56:08  -------  <DIR>  C:\新資料夾
2009-11-23 19:59:15 . 2007-03-20 16:44:06  a------  94480  C:\WINDOWS\system32\drivers\tmcomm.sys
2009-11-23 19:36:30 . 2006-06-20 20:36:00  a------  692224  C:\WINDOWS\system32\kixforms.dll
2009-11-22 18:00:58 . 2009-12-08 19:34:00  a------  56816  C:\WINDOWS\system32\drivers\avgntflt.sys
2009-11-16 23:28:00 . 2009-11-16 23:28:00  -------  <DIR>  C:\Documents and Settings\MMX\My Documents\CyberLink
2009-11-16 23:26:51 . 2009-11-16 23:26:52  -------  <DIR>  C:\Documents and Settings\MMX\Application Data\CyberLink
2009-11-16 23:25:47 . 2009-11-16 23:25:47  -------  <DIR>  C:\Documents and Settings\MMX\Application Data\Ulead Systems
2009-11-16 23:18:09 . 2009-11-16 23:20:58  -------  <DIR>  C:\Program Files\CyberLink
2009-11-16 23:13:30 . 2009-11-16 23:13:30  -------  <DIR>  C:\Documents and Settings\MMX\Application Data\InstallShield
2009-11-16 23:12:54 . 2008-04-01 21:40:42  a------  209040  C:\WINDOWS\system32\IVIresizeW7.dll
2009-11-16 23:12:54 . 2008-04-01 21:40:40  a------  196752  C:\WINDOWS\system32\IVIresizeP6.dll
2009-11-16 23:12:54 . 2008-04-01 21:40:40  a------  192656  C:\WINDOWS\system32\IVIresizePX.dll
2009-11-16 23:12:54 . 2008-04-01 21:40:38  a------  196752  C:\WINDOWS\system32\IVIresizeM6.dll
2009-11-16 23:12:54 . 2008-04-01 21:40:36  a------  204944  C:\WINDOWS\system32\IVIresizeA6.dll
2009-11-16 23:12:54 . 2008-04-01 21:40:34  a------  24720  C:\WINDOWS\system32\IVIresize.dll
2009-11-16 23:12:30 . 2009-11-16 23:12:30  -------  <DIR>  C:\Program Files\Windows Media Components
2009-11-16 23:11:28 . 2009-11-16 23:12:29  -------  <DIR>  C:\Program Files\Common Files\Ulead Systems
2009-11-16 23:11:27 . 2009-11-16 23:11:27  -------  <DIR>  C:\Program Files\Corel
2009-11-10 06:42:44 . 2009-11-10 06:42:44  -------  <DIR>  C:\Documents and Settings\MMX\My Documents\瑪奇
.
********** Modified 2009-10 -- 2009-12 files: **********

2009-12-10 14:59:34 . 2009-12-10 15:03:35  -------  <DIR>  C:\WINDOWS\LastGood
2009-11-28 18:43:00 . 2009-11-28 18:53:22  -------  <DIR>  C:\Program Files\Windows Live Safety Center
2009-11-25 18:19:55 . 2009-11-25 19:16:38  -------  <DIR>  C:\WINDOWS\system32\NtmsData
2009-11-23 20:56:08 . 2009-11-23 20:56:08  -------  <DIR>  C:\新資料夾
2009-11-22 18:00:58 . 2009-12-08 19:34:00  a------  56816  C:\WINDOWS\system32\drivers\avgntflt.sys
2009-11-16 23:28:00 . 2009-11-16 23:28:00  -------  <DIR>  C:\Documents and Settings\MMX\My Documents\CyberLink
2009-11-16 23:26:51 . 2009-11-16 23:26:52  -------  <DIR>  C:\Documents and Settings\MMX\Application Data\CyberLink
2009-11-16 23:25:47 . 2009-11-16 23:25:47  -------  <DIR>  C:\Documents and Settings\MMX\Application Data\Ulead Systems
2009-11-16 23:18:09 . 2009-11-16 23:20:58  -------  <DIR>  C:\Program Files\CyberLink
2009-11-16 23:13:30 . 2009-11-16 23:13:30  -------  <DIR>  C:\Documents and Settings\MMX\Application Data\InstallShield
2009-11-16 23:12:30 . 2009-11-16 23:12:30  -------  <DIR>  C:\Program Files\Windows Media Components
2009-11-16 23:11:28 . 2009-11-16 23:12:29  -------  <DIR>  C:\Program Files\Common Files\Ulead Systems
2009-11-16 23:11:27 . 2009-11-16 23:11:27  -------  <DIR>  C:\Program Files\Corel
2009-11-10 06:42:44 . 2009-11-10 06:42:44  -------  <DIR>  C:\Documents and Settings\MMX\My Documents\瑪奇
2009-11-07 11:06:24 . 2009-11-07 11:06:24  -------  <DIR>  C:\WINDOWS\pss
2009-11-02 06:16:13 . 2009-11-08 22:32:58  -------  <DIR>  C:\Documents and Settings\MMX\Application Data\HpUpdate
2009-11-02 06:16:12 . 2009-11-02 06:16:12  -------  <DIR>  C:\WINDOWS\Hewlett-Packard
2009-10-25 23:54:43 . 2009-10-25 23:54:43  -------  <DIR>  C:\Program Files\Free Offers from Freeze.com
2009-10-25 23:54:40 . 2009-10-25 23:54:40  -------  <DIR>  C:\Program Files\Common Files\Winferno
2009-10-25 23:54:01 . 2009-10-26 00:02:02  -------  <DIR>  C:\Program Files\Winferno
2009-10-25 22:59:22 . 2009-10-25 22:59:22  -------  <DIR>  C:\Documents and Settings\MMX\Application Data\Titanium Gears
2009-10-25 22:59:14 . 2009-10-25 23:59:13  -------  <DIR>  C:\Program Files\Playalot Games
2009-10-25 22:53:03 . 2009-10-26 00:03:34  -------  <DIR>  C:\Program Files\My.Freeze.com Toolbar
2009-10-25 22:51:14 . 2009-10-25 22:51:14  -------  <DIR>  C:\Program Files\coolbirdsettings
2009-10-25 22:07:15 . 2009-11-28 22:04:36  -------  <DIR>  C:\Documents and Settings\MMX\Application Data\coolbirdsettings
2009-10-25 22:07:14 . 2009-10-25 22:51:12  -------  <DIR>  C:\Program Files\TorrentSpeeder
2009-10-25 16:38:21 . 2009-11-25 19:32:59  -------  <DIR>  C:\Program Files\Avira
2009-10-25 14:24:11 . 2009-10-25 14:24:11  -------  <DIR>  C:\WINDOWS\system32\Kaspersky Lab
2009-10-16 20:03:15 . 2009-10-16 21:53:50  -------  <DIR>  C:\Program Files\Common Files\Blizzard Entertainment
2009-10-13 23:26:16 . 2009-10-13 23:26:16  -------  <DIR>  C:\Program Files\Windows Live SkyDrive
2009-10-13 23:14:21 . 2009-10-13 23:14:21  -------  <DIR>  C:\WINDOWS\SxsCaPendDel
2009-10-13 23:10:05 . 2009-10-13 23:10:05  -------  <DIR>  C:\WINDOWS\system32\appmgmt
2009-10-12 15:19:17 . 2009-10-12 15:19:17  -------  <DIR>  C:\Documents and Settings\MMX\WINDOWS
2009-06-25 08:01:02 . 2009-11-02 06:16:18  -------  <DIR>  C:\Program Files\HP
2009-06-25 08:00:49 . 2009-11-25 19:32:48  --h----  <DIR>  C:\Config.Msi
2009-05-19 03:06:21 . 2009-12-10 15:43:07  -------  <DIR>  C:\WINDOWS\Prefetch
2009-05-18 21:11:16 . 2009-10-25 13:51:45  -------  <DIR>  C:\WINDOWS\network diagnostic
2009-05-09 00:04:46 . 2009-12-10 14:58:43  -------  <DIR>  C:\Documents and Settings\MMX\Tracing
2009-05-08 23:50:47 . 2009-10-13 23:26:27  -------  <DIR>  C:\Program Files\Windows Live
2009-05-03 18:18:35 . 2009-11-19 17:07:05  ---s---  <DIR>  C:\Documents and Settings\MMX\My Documents\mabinogi
2009-05-03 09:18:25 . 2009-12-10 09:14:56  -------  <DIR>  C:\Program Files\eMule
2009-05-03 02:44:09 . 2009-12-10 15:43:56  -------  <DIR>  C:\WINDOWS\Temp
2009-05-03 02:44:09 . 2009-12-10 15:43:45  -------  <DIR>  C:\WINDOWS
2009-05-03 02:44:09 . 2009-12-10 15:43:08  -------  <DIR>  C:\WINDOWS\system32
2009-05-03 02:44:09 . 2009-12-10 15:20:08  --h----  <DIR>  C:\WINDOWS\inf
2009-05-03 02:44:09 . 2009-12-10 14:59:43  -rhs---  <DIR>  C:\WINDOWS\system32\dllcache
2009-05-03 02:44:09 . 2009-12-10 14:59:38  -------  <DIR>  C:\WINDOWS\Help
2009-05-03 02:44:09 . 2009-12-10 06:21:08  -------  <DIR>  C:\WINDOWS\system32\drivers
2009-05-03 02:44:09 . 2009-11-28 22:05:26  -------  <DIR>  C:\WINDOWS\system32\drivers\etc
2009-05-03 02:44:09 . 2009-11-25 19:32:47  -------  <DIR>  C:\WINDOWS\WinSxS
2009-05-03 02:44:09 . 2009-11-25 18:51:23  -------  <DIR>  C:\WINDOWS\repair
2009-05-03 02:44:09 . 2009-11-25 18:13:05  a------  90112  C:\WINDOWS\DUMP50df.tmp
2009-05-03 02:44:09 . 2009-11-16 23:19:44  -r-s---  <DIR>  C:\WINDOWS\Fonts
2009-05-03 02:44:09 . 2009-11-01 20:23:30  a------  90112  C:\WINDOWS\DUMP4f1a.tmp
2009-05-03 02:44:09 . 2009-10-13 22:37:37  -------  <DIR>  C:\WINDOWS\system
2009-05-02 19:20:56 . 2009-12-10 15:42:50  ---s---  <DIR>  C:\Documents and Settings\MMX\Cookies
2009-05-02 19:20:56 . 2009-12-10 15:41:46  -rh----  <DIR>  C:\Documents and Settings\MMX\Recent
2009-05-02 19:20:56 . 2009-12-09 23:42:08  -------  <DIR>  C:\Documents and Settings\MMX\桌面
2009-05-02 19:20:56 . 2009-12-08 17:31:36  a-h----  6291456  C:\Documents and Settings\MMX\NTUSER.DAT
2009-05-02 19:20:56 . 2009-11-22 20:44:22  -r-----  <DIR>  C:\Documents and Settings\MMX\My Documents
2009-05-02 19:20:56 . 2009-11-21 17:43:44  --h----  <DIR>  C:\Documents and Settings\MMX\NetHood
2009-05-02 19:20:56 . 2009-11-16 23:26:52  -rh----  <DIR>  C:\Documents and Settings\MMX\Application Data
2009-05-02 19:20:56 . 2009-11-07 22:37:01  -r-----  <DIR>  C:\Documents and Settings\MMX\Favorites
2009-05-02 19:20:56 . 2009-10-25 13:33:31  -r-----  <DIR>  C:\Documents and Settings\MMX\My Documents\My Pictures
2009-05-02 19:20:56 . 2009-10-20 12:49:57  -r-----  <DIR>  C:\Documents and Settings\MMX\「開始」功能表
2009-05-02 19:00:35 . 2009-11-16 23:24:25  --h----  <DIR>  C:\Program Files\InstallShield Installation Information
2009-05-02 18:56:42 . 2009-10-14 00:32:22  -------  <DIR>  C:\WINDOWS\Microsoft.NET
2009-05-02 18:56:42 . 2009-10-13 23:13:39  -r-s---  <DIR>  C:\WINDOWS\assembly
2009-05-02 18:55:40 . 2009-12-08 17:32:16  a--s---  2048  C:\WINDOWS\bootstat.dat
2009-05-02 18:54:29 . 2009-12-10 15:19:18  --h----  <DIR>  C:\WINDOWS\$hf_mig$
2009-05-02 18:53:32 . 2009-11-28 18:43:01  ---s---  <DIR>  C:\WINDOWS\Downloaded Program Files
2009-05-02 18:53:11 . 2009-10-26 00:02:01  ---s---  <DIR>  C:\WINDOWS\Tasks
2009-05-02 18:53:06 . 2009-11-23 19:58:31  -------  <DIR>  C:\Program Files\Internet Explorer
2009-05-02 18:52:35 . 2009-11-25 18:51:17  -------  <DIR>  C:\WINDOWS\Registration
2009-05-02 18:48:44 . 2009-11-25 19:32:48  --hs---  <DIR>  C:\WINDOWS\Installer
2009-05-02 18:48:42 . 2009-11-28 18:43:00  -r-----  <DIR>  C:\Program Files
2009-05-02 18:48:42 . 2009-11-16 23:11:28  -------  <DIR>  C:\Program Files\Common Files
2009-05-02 18:48:42 . 2009-10-13 23:26:21  -------  <DIR>  C:\Program Files\Common Files\Microsoft Shared
2009-05-02 18:47:47 . 2009-12-10 15:20:02  -------  <DIR>  C:\WINDOWS\system32\CatRoot2
2009-05-02 18:47:31 . 2009-11-18 08:30:22  a------  160344  C:\WINDOWS\system32\FNTCACHE.DAT
2006-08-24 00:54:07 . 2009-11-23 20:33:43  --hs---  <DIR>  C:\System Volume Information
.
================================================================================
執行中的程序:

[PID: 968]  C:\WINDOWS\system32\Ati2evxx.exe  [<Verified> ATI Technologies Inc.]
[PID: 1480]  C:\WINDOWS\system32\spoolsv.exe  [<Verified> Microsoft Corporation]
[PID: 1504]  C:\WINDOWS\system32\Ati2evxx.exe  [<Verified> ATI Technologies Inc.]
[PID: 1696]  C:\Program Files\Avira\AntiVir Desktop\sched.exe  [ Avira GmbH]
[PID: 256]  C:\WINDOWS\RTHDCPL.EXE  [<Verified> Realtek Semiconductor Corp.]
[PID: 276]  C:\Program Files\EmvSmartCardReader\SmartMON.exe  [ N/A]
[PID: 288]  C:\Program Files\EmvSmartCardReader\BePCSC.exe  [ N/A]
[PID: 304]  C:\Program Files\GridService\peer.exe  [ FS2YOU]
[PID: 340]  C:\Program Files\HP\HP Software Update\HPWuSchd2.exe  [<Verified> Hewlett-Packard]
[PID: 484]  C:\Program Files\Avira\AntiVir Desktop\avgnt.exe  [ Avira GmbH]
[PID: 504]  C:\WINDOWS\system32\ctfmon.exe  [<Verified> Microsoft Corporation]
[PID: 740]  C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.EXE  [ ATI Technologies Inc.]
[PID: 1284]  C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\ccc.exe  [ ATI Technologies Inc.]
[PID: 2104]  C:\Program Files\CyberLink\Shared files\RichVideo.exe  [<Verified> ]
[PID: 2216]  C:\WINDOWS\system32\scardsvr.exe  [<Verified> Microsoft Corporation]
[PID: 2268]  C:\Program Files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe  [<Verified> Microsoft Corporation]
[PID: 2328]  C:\Program Files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe  [<Verified> Ulead Systems, Inc.]
[PID: 2364]  C:\Program Files\Viewpoint\Common\ViewpointService.exe  [<Verified> Viewpoint Corporation]
[PID: 4044]  C:\WINDOWS\System32\alg.exe  [<Verified> Microsoft Corporation]
[PID: 3956]  C:\Program Files\Avira\AntiVir Desktop\avguard.exe  [ Avira GmbH]
[PID: 2836]  C:\Program Files\eMule\emule.exe  [ hxxp://www.emule-project.net]
[PID: 2624]  C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe  [<Verified> Yahoo! Inc.]
[PID: 4000]  C:\WINDOWS\system32\wbem\wmiprvse.exe  [<Verified> Microsoft Corporation]
[PID: 2848]  C:\Program Files\Windows Live\Messenger\msnmsgr.exe  [<Verified> Microsoft Corporation]
[PID: 2920]  C:\Program Files\Windows Live\Contacts\wlcomm.exe  [<Verified> Microsoft Corporation]
[PID: 1008]  C:\Program Files\HP\Smart Web Printing\hpswp_clipbook.exe  [<Verified> Hewlett-Packard Co.]
[PID: 3152]  C:\WINDOWS\system32\conime.exe  [<Verified> Microsoft Corporation]
[PID: 3416]  C:\WINDOWS\system32\wbem\wmiprvse.exe  [<Verified> Microsoft Corporation]
[PID: 2548]  C:\WINDOWS\system32\wuauclt.exe  [<Verified> Microsoft Corporation]

系統執行程序中沒有檔案資訊的動態連結檔:

'spoolsv.exe'(1480)
=> C:\WINDOWS\System32\spool\PRTPROCS\W32X86\hpzpp4xa.dll  61.063.264.22

'ccc.exe'(1284)
=> C:\WINDOWS\assembly\GAC_MSIL\atixclib\1.0.0.0__90ba9c70f846762e\atixclib.dll  1.0.0.0
=> C:\WINDOWS\assembly\GAC\AxInterop.WBOCXLib\1.0.0.0__90ba9c70f846762e\AxInterop.WBOCXLib.dll  1.0.0.0
=> C:\WINDOWS\assembly\GAC\Interop.WBOCXLib\1.0.0.0__90ba9c70f846762e\Interop.WBOCXLib.dll  1.0.0.0

'msnmsgr.exe'(2848)
=> C:\WINDOWS\system32\msdmo.dll

================================================================================
HOSTS:
98.126.17.171 www.qqluna.com
98.126.17.171 www.mhluna.com
98.126.17.171 www.101wg.cn
98.126.17.171 www.poc88.cn
98.126.17.171 www.lqran.com
98.126.17.171 myyong.com
98.126.17.171 www.sexran.net
98.126.17.171 www.yyran.com
98.126.17.171 www.99yong.com
98.126.17.171 www.vipyong.com
98.126.17.171 www.ranyong.com
98.126.17.171 www.babyran.com
98.126.17.171 www.zumuran.com
98.126.17.171 www.mxran.com
98.126.17.171 cityyong.com
98.126.17.171 www.ddran.cn
98.126.17.171 www.gmyong.com
98.126.17.171 www.codeyong.com
98.126.17.171 www.95yong.com
98.126.17.171 ran.878x.net
98.126.17.171 www.xxran.com

登錄值列表 *** 注意 : 部分正常值不會顯示 ***

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe"  [Microsoft Corporation]
"<沒有名稱>"=""  [File Not Found.]
"StartCCC"="C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe"  [N/A]
"Messenger (Yahoo!)"="C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe"  [Yahoo! Inc.]
"msnmsgr"="C:\Program Files\Windows Live\Messenger\msnmsgr.exe"  [Microsoft Corporation]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"IMJPMIG8.1"="C:\WINDOWS\ime\IMJP8_1\imjpmig.exe"  [Microsoft Corporation]
"PHIME2002ASync"="C:\WINDOWS\system32\IME\TINTLGNT\tintsetp.exe"  [Microsoft Corporation]
"PHIME2002A"="C:\WINDOWS\system32\IME\TINTLGNT\tintsetp.exe"  [Microsoft Corporation]
"RTHDCPL"="C:\WINDOWS\RTHDCPL.exe"  [Realtek Semiconductor Corp.]
"Alcmtr"="C:\WINDOWS\Alcmtr.exe"  [Realtek Semiconductor Corp.]
"SmartMon"="C:\Program Files\EmvSmartCardReader\SmartMON.exe"  [N/A]
"BePCSC"="C:\Program Files\EmvSmartCardReader\BePCSC.exe"  [N/A]
"Grid Service"="C:\Program Files\GridService\peer.exe"  [FS2YOU]
"way math bike enc"="C:\Documents and Settings\All Users\Application Data\cast dale way math\axis mfcd.exe"  [Upgraded Pofitors]
"KernelFaultCheck"="C:\WINDOWS\system32\dumprep 0 -k"  [X]
"HP Software Update"="C:\Program Files\HP\HP Software Update\hpwuschd2.exe"  [Hewlett-Packard]
"<沒有名稱>"=""  [File Not Found.]
"UVS12 Preload"="C:\Program Files\Corel\Corel VideoStudio 12\uvPL.exe"  [Corel TW Corp.]
"UpdatePDRShortCut"="C:\Program Files\CyberLink\PowerDirector\MUITransfer\MUIStartMenu.exe"  [CyberLink Corp.]
"avgnt"="C:\Program Files\Avira\AntiVir Desktop\avgnt.exe"  [Avira GmbH]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe"  [Microsoft Corporation]

[HKEY_USERS\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe"  [Microsoft Corporation]

[HKEY_USERS\S-1-5-19\Software\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe"  [Microsoft Corporation]

[HKEY_USERS\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe"  [Microsoft Corporation]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\shellserviceobjectdelayload]
"WPDShServiceObj"="{AAA288BA-9A4C-45B0-95D7-94D524869DB5}" - 2006-10-18 21:47 133632 C:\WINDOWS\system32\WPDShServiceObj.dll

[HKEY_LOCAL_MACHINE\~\Explorer\Browser Helper Objects\{02478D38-C3F9-4efb-9B51-7695ECA05670}]
2008-07-28 18:47 882416 C:\PROGRA~1\Yahoo!\Companion\Installs\cpn\yt.dll

[HKEY_LOCAL_MACHINE\~\Explorer\Browser Helper Objects\{0347C33E-8762-4905-BF09-768834316C61}]
2007-03-02 16:52 1298024 C:\Program Files\HP\Smart Web Printing\hpswp_printenhancer.dll

[HKEY_LOCAL_MACHINE\~\Explorer\Browser Helper Objects\{053F9267-DC04-4294-A72C-58F732D338C0}]
2007-03-02 16:52 177768 C:\Program Files\HP\Smart Web Printing\hpswp_framework.dll

[HKEY_LOCAL_MACHINE\~\Explorer\Browser Helper Objects\{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}]

[HKEY_LOCAL_MACHINE\~\Explorer\Browser Helper Objects\{22FC6CE8-7D47-479F-B74A-BFBB04ADB9AF}]
2008-04-01 08:39 73728 C:\Program Files\Winferno\PC Confidential\PCCBHO.dll

[HKEY_LOCAL_MACHINE\~\Explorer\Browser Helper Objects\{5C255C8A-E604-49b4-9D64-90988571CECB}]

[HKEY_LOCAL_MACHINE\~\Explorer\Browser Helper Objects\{6EBF7485-159F-4bff-A14F-B9E3AAC4465B}]
2009-05-19 11:36 137600 C:\Program Files\Microsoft\Search Enhancement Pack\Search Helper\SEPsearchhelperie.dll

[HKEY_LOCAL_MACHINE\~\Explorer\Browser Helper Objects\{FCBCCB87-9224-4B8D-B117-F56D924BEB18}]
2008-11-26 19:42 1916024 C:\Program Files\My.Freeze.com Toolbar\freeze_int2.dll

[HKEY_LOCAL_MACHINE\~\Explorer\Browser Helper Objects\{FDAD4DA1-61A2-4FD8-9C17-86F7AC245081}]
2008-07-28 18:47 160496 C:\PROGRA~1\Yahoo!\Companion\Installs\cpn\YTSingleInstance.dll

[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\ccc-core-static]
msiexec /fums {A75BF1D0-C7C3-CB55-EE17-3225387FD154} /qb

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer]
HonorAutoRunSetting=0x1

c:\documents and settings\all users\「開始」功能表\程式集\啟動\
Adobe Reader Speed Launch.lnk - C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe  [ 2004-12-14 04:44:06  29696 ]
Microsoft Office.lnk - C:\Program Files\Microsoft Office\Office10\OSA.EXE  [ 2001-02-13 01:01:04  83360 ]

Rename operations pending:
001; C:\DOCUME~1\MMX\LOCALS~1\Temp\7dda43f45eed.tmp ;DELETE;
002; C:\DOCUME~1\MMX\LOCALS~1\Temp\94344f0efc01.tmp ;DELETE;
003; C:\DOCUME~1\MMX\LOCALS~1\Temp\377c599f8ea8.tmp ;DELETE;
004; C:\DOCUME~1\MMX\LOCALS~1\Temp\d75b5cdbab85.tmp ;DELETE;
005; C:\DOCUME~1\MMX\LOCALS~1\Temp\c652771aa24f.tmp ;DELETE;
006; C:\DOCUME~1\MMX\LOCALS~1\Temp\071078895fa2.tmp ;DELETE;
007; C:\DOCUME~1\MMX\LOCALS~1\Temp\f86e7abdac98.tmp ;DELETE;
008; C:\DOCUME~1\MMX\LOCALS~1\Temp\669c80533954.tmp ;DELETE;
009; C:\WINDOWS\system32\drivers\EagleNt.sys ;DELETE;
010; C:\DOCUME~1\MMX\LOCALS~1\Temp\54c25c742f85.tmp ;DELETE;
011; C:\DOCUME~1\MMX\LOCALS~1\Temp\5cce76030df2.tmp ;DELETE;
012; C:\DOCUME~1\MMX\LOCALS~1\Temp\f31c7ac3b164.tmp ;DELETE;
013; C:\DOCUME~1\MMX\LOCALS~1\Temp\89c47018e6e7.tmp ;DELETE;
014; C:\DOCUME~1\MMX\LOCALS~1\Temp\a1c88f79ef7a.tmp ;DELETE;
015; C:\DOCUME~1\MMX\LOCALS~1\Temp\3e5590ab50c3.tmp ;DELETE;
016; C:\DOCUME~1\MMX\LOCALS~1\Temp\825a92efca72.tmp ;DELETE;
017; C:\DOCUME~1\MMX\LOCALS~1\Temp\1b3696272de6.tmp ;DELETE;
018; C:\WINDOWS\system32\drivers\EagleNt.sys ;DELETE;
019; C:\WINDOWS\system32\wuapi.dll.wusetup.163670078.bak ;DELETE;
020; C:\WINDOWS\system32\wuauclt.exe.wusetup.163670125.bak ;DELETE;
021; C:\WINDOWS\system32\wuaueng.dll.wusetup.163670359.bak ;DELETE;

"C:\WINDOWS\system32\drivers\cdaudio.sys" not found.
"C:\WINDOWS\system32\ipfltdrv.sys" not found.
================================================================================

服務 \ 驅動列表:
顯示方式 :  啟動狀態  服務名稱;顯示名稱;檔案名稱

R2  AntiVirSchedulerService;Avira AntiVir Scheduler;C:\Program Files\Avira\AntiVir Desktop\sched.exe  [Avira GmbH]
P12  MediaSerial;Portable Media Number;C:\WINDOWS\system32\RjmktvC.dll  [File Not Found.]
S3  napagent;Network Access Protection Agent;C:\WINDOWS\System32\qagentrt.dll  [Microsoft Corporation]
S3  npggsvc;nProtect GameGuard Service;C:\WINDOWS\system32\GameMon.des -service  [File Not Found.]
S2  rcmdsvc;Remote Command Service;C:\WINDOWS\system32\xtzlno.exe  [File Not Found.]
R2  SeaPort;SeaPort;C:\Program Files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe  [Microsoft Corporation]
S2  VServer_2008;V_Server;C:\Program Files\Common Files\Microsoft Shared\MSInfo\R_Server.exe  [File Not Found.]
S2  winloginsav;Rising Scan Service2009;C:\WINDOWS\system32\RlmitjC.dl  [File Not Found.]
U?  AVPsys;AVPsys;[X]
S3  city;city;C:\WINDOWS\system32\drivers\city.ahc  [N/A]
S3  EMVSCARD;EMVSCARD;C:\WINDOWS\system32\Drivers\EMVSCARD.sys  [File Not Found.]
S3  SecRomDrv;Secure CDROM Property;C:\WINDOWS\system32\DRIVERS\cdrom.sys  [Microsoft Corporation]
S3  Yong_tw;Yong_tw;C:\WINDOWS\system32\drivers\Yong_tw.ahc  [N/A]

================================================================================
工作排程資料夾內的資料:

IE 首頁設定:

Internet Explorer Version: 6.0.2900.5512
HKLM - Search Page = hxxp://tw.rd.yahoo.com/customize/ie/defaults/sp/msgr9/*hxxp://tw.search.yahoo.com
HKCU - Start Page = hxxp://tw.yahoo.com/
HKCU - Search Page = hxxp://tw.rd.yahoo.com/customize/ie/defaults/sp/msgr9/*hxxp://tw.search.yahoo.com
HKCU - Extra menu item: 匯出至 Microsoft Excel(&X) - res://C:\PROGRA~1\MI1933~1\Office10\EXCEL.EXE/3000
HKLM - Extensions: {53F6FCCD-9E22-4d71-86EA-6E43136192AB} - C:\Program Files\Winferno\PC Confidential\PCConfidential.exe
HKLM - Extensions: {925DAB62-F9AC-4221-806A-057BFB1014AA} - C:\Program Files\Winferno\PC Confidential\PCConfidential.exe
HKLM - Extensions: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe
HKLM - Extensions: {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
HKLM - Extensions: {58ECB495-38F0-49cb-A538-10282ABF65E7} - {E763472E-A716-4CD9-89BD-DBDA6122F741} - C:\Program Files\HP\Smart Web Printing\hpswp_extensions.dll
HKLM - Extensions: {700259D7-1666-479a-93B1-3250410481E8} - {A93C41D8-01F8-4F8B-B14C-DE20B117E636} - C:\Program Files\HP\Smart Web Printing\hpswp_extensions.dll

================================================================================

Win32/Conficker worm has not been found active in the memory.
Do you want to perform scanning and cleaning anyway? (y/n)
Nothing was found.
Checking for Win32/Conficker.AA files:
Nothing was found.

================================================================================

A: -Removable Disk- No Assess
C: -Local Disk- Size: 32218386432  FreeSpace: 12433031168  NTFS
D: -Local Disk- Size: 214334345216  FreeSpace: 11102408704  NTFS
E: -Compact Disc- No Assess

掃描結束時間: 2009-12-10 15:44:41.74

小紅傘開著好像毒也是一直來XD

[h80053 在 2009-12-10 04:36 PM 作了最後編輯]

[如果你喜歡本文章，就按本文章之鮮花～送花給作者吧，你的支持就是別人的動力來源]

本文連接

快速回覆