鐵之狂傲

標題: kqsr.exe [列印本頁]

作者: 虛空幻想    時間: 08-2-13 19:51
標題: kqsr.exe
線上掃毒後此檔案上的病毒被清除後也跟著改名

導致我的硬碟沒辦法直接從"我的電腦"開啟

有人知道解決辦法嗎?

或著可以丟這個檔案給我

感恩QQ
作者: 藤乃紫音    時間: 08-2-13 19:51
找到c:windows/explorer.exe
把他上傳到
http://www.virustotal.com/zh-tw/
掃瞄完後把網址貼上來

下載Icesword後進入到安全模式(重開機一直按F8就行)
http://gin77729.myweb.hinet.net/IceSword.rar

進入安全模式後執行Icesowrd,點選左邊的File,找到以下檔案後在檔案上按右鍵選擇"force delete"
C:\WINDOWS\system32\kavo.exe
C:\WINDOWS\system32\wsctf.exe
C:\temp\jatmlano.sys
C:\WINDOWS\system32\CCRFG.SYS
C:\WINDOWS\system32\cologsver.exe
C:\WINDOWS\system32\CmdLineExt03.dll
C:\WINDOWS\system32\b4fm.dll
C:\autorun.inf
D:\autorun.inf
E:\autorun.inf
C:\kqsr.exe
D:\kqsr.exe
E:\kqsr.exe

開啟SREng,點選"啟動專案"的"註冊表"找到下面所列出來的東西點選後按刪除,在選擇"是"刪除
    <kava><C:\WINDOWS\system32\kavo.exe>  [N/A]
    <wsctf.exe><wsctf.exe>  [N/A]
    <EXPLORER.EXE><EXPLORER.EXE>  []
    <Userinit><C:\WINDOWS\system32\cologsver.exe>  []

開啟SREng,點選"啟動專案"的"服務"(右邊分頁的最後一個)選擇右邊的"驅動程式",找到下面東西後點選"刪除服務"後選擇"設置",然後按"否"刪除該驅動程式,注意,要按"否"才會刪除。
[CCRFG / CCRFG]
[dump_wmimmc / dump_wmimmc]
[jatmlano / jatmlano]

開啟SREng,點選"啟動專案"的"註冊表"找到下面那行
    <Userinit><userinit.exe,EXPLORER.EXE>  [(Verified)Microsoft Windows Publisher]
找到後點選按編輯,然後將這段刪除
userinit.exe,EXPLORER.EXE
接著將下面的內容複製貼上(逗號也要複製)
  1. C:\WINDOWS\system32\userinit.exe,
複製代碼
接著,點選"系統修復"裡面的"windows shell/IE"然後勾選下面的全選,按下修復

再看看電腦有沒有問題
作者: 迷糊小書僮    時間: 08-2-13 20:00
中獎真快0.0
這隻印象前天才出來的@@

http://www.avpclub.ddns.info/discuz/thread-6565-1-1.html

照這個跑一份SREng出來後壓縮上傳
作者: 虛空幻想    時間: 08-2-13 21:17
這是病毒?

之前好像也看過說...

嘗試ING
作者: 虛空幻想    時間: 08-2-13 21:32
沒解決..我丟實際狀況上來好了



囧...
作者: 藤乃紫音    時間: 08-2-13 22:32
先跑份SREng上來= =

上面有連結

不然把線上掃瞄掃出來的東西貼上來

[ 本文最後由 藤乃紫音 於 08-2-13 10:33 PM 編輯 ]
作者: 虛空幻想    時間: 08-2-13 22:50
  1. 2008-02-13,21:18:04

  2. System Repair Engineer 2.5.16.900
  3. Smallfrogs (http://www.KZTechs.com)

  4. Windows XP Professional Service Pack 2 (Build 2600) - 管理許可權用戶 - 完整功能

  5. 以下內容被選中:
  6.     所有的啟動項目(包括註冊表、開機檔案夾、服務等)
  7.     流覽器載入項
  8.     正在運行的進程(包括進程模組資訊)
  9.     文件關聯
  10.     Winsock 提供者
  11.     Autorun.inf
  12.     HOSTS 文件
  13.     進程特權掃描


  14. 啟動專案
  15. 註冊表
  16. [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
  17.     <ctfmon.exe><C:\WINDOWS\system32\ctfmon.exe>  [(Verified)Microsoft Windows Publisher]
  18.     <MsnMsgr><"C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background>  [(Verified)Microsoft Corporation]
  19.     <Steam><"D:\Program Files\Steam\Steam.exe" -silent>  [(Verified)Valve]
  20.     <Yahoo! Pager><"D:\Program Files\Yahoo!\Messenger\YahooMessenger.exe" -quiet>  [(Verified)Yahoo! Inc.]
  21.     <kava><C:\WINDOWS\system32\kavo.exe>  [N/A]
  22.     <wsctf.exe><wsctf.exe>  [N/A]
  23.     <EXPLORER.EXE><EXPLORER.EXE>  []
  24. [HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows]
  25.     <load><>  [N/A]
  26. [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
  27.     <IMJPMIG8.1><"C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32>  [(Verified)Microsoft Windows Publisher]
  28.     <SoundMAXPnP><C:\Program Files\Analog Devices\Core\smax4pnp.exe>  [Analog Devices, Inc.]
  29.     <SoundMAX><"C:\Program Files\Analog Devices\SoundMAX\Smax4.exe" /tray>  [Analog Devices, Inc.]
  30.     <NvCplDaemon><RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup>  [(Verified)Microsoft Windows Hardware Compatibility Publisher]
  31.     <nwiz><nwiz.exe /install>  []
  32.     <LClock><C:\Program Files\LClock\LClock.exe>  [N/A]
  33.     <TkBellExe><"C:\Program Files\Common Files\Real\Update_OB\realsched.exe"  -osboot>  [(Verified)"RealNetworks, Inc."]
  34.     <PHIMETIPSYNC><C:\Program Files\Common Files\Microsoft Shared\IME\IMTC65\Phonetic\TINTLCFG.EXE /PHIMETIPSync>  [(Verified)Microsoft Corporation]
  35.     <QuickTime Task><"C:\Program Files\QuickTime\qttask.exe" -atboottime>  [Apple Computer, Inc.]
  36.     <WinampAgent><D:\Program Files\Winamp\winampa.exe>  []
  37.     <Flashget><D:\Program Files\FlashGet\FlashGet.exe /min>  [FlashGet.com]
  38.     <Thunder><"D:\Program Files\Thunder Network\Thunder\Thunder.exe" /s>  [Thunder Networking Technologies,LTD]
  39.     <Userinit><C:\WINDOWS\system32\cologsver.exe>  []
  40.     <RemoteControl><"D:\Program Files\CyberLink\PowerDVD\PDVDServ.exe">  [(Verified)CyberLink]
  41.     <LanguageShortcut><"D:\Program Files\CyberLink\PowerDVD\Language\Language.exe">  [(Verified)CyberLink]
  42.     <NvMediaCenter><RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit>  [(Verified)Microsoft Windows Hardware Compatibility Publisher]
  43. [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
  44.     <shell><Explorer.exe>  []
  45.     <Userinit><userinit.exe,EXPLORER.EXE>  [(Verified)Microsoft Windows Publisher]
  46.     <UIHost><LogonUI.exe>  [(Verified)Microsoft Windows Publisher]
  47. [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
  48.     <WPDShServiceObj><C:\WINDOWS\system32\WPDShServiceObj.dll>  [(Verified)Microsoft Windows Publisher]
  49. [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\>{26923b43-4d38-484f-9b9e-de460746276c}]
  50.     <Internet Explorer><%systemroot%\system32\shmgrate.exe OCInstallUserConfigIE>  [N/A]
  51. [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\>{881dd1c5-3dcf-431b-b061-f3f88e8be88a}]
  52.     <Outlook Express><%systemroot%\system32\shmgrate.exe OCInstallUserConfigOE>  [N/A]
  53. [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{2C7339CF-2B09-4501-B3F3-F3508C9228ED}]
  54.     <Themes Setup><%SystemRoot%\system32\regsvr32.exe /s /n /i:/UserInstall %SystemRoot%\system32\themeui.dll>  [N/A]
  55. [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{44BBA840-CC51-11CF-AAFA-00AA00B6015C}]
  56.     <Microsoft Outlook Express 6><"%ProgramFiles%\Outlook Express\setup50.exe" /APP:OE /CALLER:WINNT /user /install>  [N/A]
  57. [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{44BBA842-CC51-11CF-AAFA-00AA00B6015B}]
  58.     <NetMeeting 3.01><rundll32.exe advpack.dll,LaunchINFSection C:\WINDOWS\INF\msnetmtg.inf,NetMtg.Install.PerUser.NT>  [(Verified)Microsoft Windows Publisher]
  59. [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{6BF52A52-394A-11d3-B153-00C04F79FAA6}]
  60.     <Microsoft Windows Media Player><rundll32.exe advpack.dll,LaunchINFSection C:\WINDOWS\INF\wmp11.inf,PerUserStub>  [(Verified)Microsoft Windows Publisher]
  61. [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{7790769C-0471-11d2-AF11-00C04FA35D02}]
  62.     <Address Book 6><"%ProgramFiles%\Outlook Express\setup50.exe" /APP:WAB /CALLER:WINNT /user /install>  [N/A]
  63. [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{89B4C1CD-B018-4511-B0A1-5476DBF70820}]
  64.     <N/A><C:\WINDOWS\system32\Rundll32.exe C:\WINDOWS\system32\mscories.dll,Install>  [Microsoft Corporation]

  65. ==================================
  66. 開機檔案夾
  67. [Microsoft Office]
  68.   <C:\Documents and Settings\All Users\「開始」功能表\程式集\啟動\Microsoft Office.lnk --> D:\PROGRA~1\MICROS~1\Office10\OSA.EXE [Microsoft Corporation]><N>

  69. ==================================
  70. 服務
  71. [Adobe LM Service / Adobe LM Service][Stopped/Manual Start]
  72.   <"C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe"><Adobe Systems>
  73. [C-DillaCdaC11BA / C-DillaCdaC11BA][Running/Auto Start]
  74.   <C:\WINDOWS\system32\drivers\CDAC11BA.EXE><C-Dilla Ltd>
  75. [Firebird Guardian - DefaultInstance / FirebirdGuardianDefaultInstance][Running/Auto Start]
  76.   <d:\Program Files\SysAidServer\firebird\bin\fbguard.exe -s><The Firebird Project>
  77. [Firebird Server - DefaultInstance / FirebirdServerDefaultInstance][Running/Manual Start]
  78.   <d:\Program Files\SysAidServer\firebird\bin\fbserver.exe -s><The Firebird Project>
  79. [Human Interface Device Access / HidServ][Stopped/Disabled]
  80.   <C:\WINDOWS\System32\svchost.exe -k netsvcs-->%SystemRoot%\System32\hidserv.dll><N/A>
  81. [InstallDriver Table Manager / IDriverT][Stopped/Manual Start]
  82.   <"C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe"><Macrovision Corporation>
  83. [npkcmsvc / npkcmsvc][Running/Auto Start]
  84.   <C:\WINDOWS\system32\npkcmsvc.exe><INCA Internet Co., Ltd.>
  85. [NVIDIA Display Driver Service / NVSvc][Running/Auto Start]
  86.   <C:\WINDOWS\system32\nvsvc32.exe><NVIDIA Corporation>
  87. [Cyberlink RichVideo Service(CRVS) / RichVideo][Running/Auto Start]
  88.   <"C:\Program Files\Cyberlink\Shared files\RichVideo.exe"><>
  89. [Remote Packet Capture Protocol v.0 (experimental) / rpcapd][Stopped/Manual Start]
  90.   <"C:\Program Files\WinPcap\rpcapd.exe" -d -f "C:\Program Files\WinPcap\rpcapd.ini"><CACE Technologies>
  91. [StarWind iSCSI Service / StarWindService][Running/Auto Start]
  92.   <D:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe><Rocket Division Software>

  93. ==================================
  94. 驅動程式
  95. [ADI UAA Function Driver for High Definition Audio Service / ADIHdAudAddService][Running/Manual Start]
  96.   <system32\drivers\ADIHdAud.sys><Analog Devices, Inc.>
  97. [AE Audio Service / AEAudio][Running/Manual Start]
  98.   <system32\drivers\AEAudio.sys><Andrea Electronics Corporation>
  99. [AMD Processor Driver / AmdK8][Running/System Start]
  100.   <system32\DRIVERS\AmdK8.sys><Advanced Micro Devices>
  101. [CCRFG / CCRFG][Stopped/Manual Start]
  102.   <\??\C:\WINDOWS\system32\CCRFG.SYS><N/A>
  103. [dump_wmimmc / dump_wmimmc][Stopped/Manual Start]
  104.   <2 - 系統找不到指定的檔案。
  105. ><N/A>
  106. [Microsoft UAA Bus Driver for High Definition Audio / HDAudBus][Running/Manual Start]
  107.   <system32\DRIVERS\HDAudBus.sys><Windows (R) Server 2003 DDK provider>
  108. [jatmlano / jatmlano][Stopped/Manual Start]
  109.   <\??\C:\temp\jatmlano.sys><N/A>
  110. [ATK0110 ACPI UTILITY / MTsensor][Running/Manual Start]
  111.   <system32\DRIVERS\ASACPI.sys><>
  112. [NetGroup Packet Filter Driver / NPF][Stopped/Manual Start]
  113.   <system32\drivers\npf.sys><CACE Technologies>
  114. [npkcrypt / npkcrypt][Stopped/Manual Start]
  115.   <\??\C:\WINDOWS\system32\npkcrypt.sys><INCA Internet Co., Ltd.>
  116. [NPPTNT2 / NPPTNT2][Running/Manual Start]
  117.   <\??\C:\WINDOWS\system32\npptNT2.sys><INCA Internet Co., Ltd.>
  118. [nv / nv][Running/Manual Start]
  119.   <system32\DRIVERS\nv4_mini.sys><NVIDIA Corporation>
  120. [NVIDIA nForce Networking Controller Driver / NVENETFD][Running/Manual Start]
  121.   <system32\DRIVERS\NVENETFD.sys><NVIDIA Corporation>
  122. [NVIDIA Network Bus Enumerator / nvnetbus][Running/Manual Start]
  123.   <system32\DRIVERS\nvnetbus.sys><NVIDIA Corporation>
  124. [直接平行連接埠連結驅動程式 / Ptilink][Running/Manual Start]
  125.   <system32\DRIVERS\ptilink.sys><Parallel Technologies, Inc.>
  126. [PxHelp20 / PxHelp20][Running/Boot Start]
  127.   <\SystemRoot\System32\Drivers\PxHelp20.sys><Sonic Solutions>
  128. [Secdrv / Secdrv][Running/Auto Start]
  129.   <system32\DRIVERS\secdrv.sys><Macrovision Corporation, Macrovision Europe Limited, and Macrovision Japan and Asia K.K.>
  130. [SenFilt Service / SenFiltService][Running/Manual Start]
  131.   <system32\drivers\Senfilt.sys><Sensaura>
  132. [StarForce Protection Environment Driver (version 1.x.a) / sfdrv01a][Running/Boot Start]
  133.   <\SystemRoot\System32\drivers\sfdrv01a.sys><Protection Technology (StarForce)>
  134. [StarForce Protection Helper Driver (version 2.x) / sfhlp02][Running/Boot Start]
  135.   <\SystemRoot\System32\drivers\sfhlp02.sys><Protection Technology (StarForce)>
  136. [StarForce Protection Synchronization Driver (version 4.x) / sfsync04][Running/Boot Start]
  137.   <\SystemRoot\System32\drivers\sfsync04.sys><Protection Technology (StarForce)>
  138. [sptd / sptd][Running/Boot Start]
  139.   <\SystemRoot\System32\Drivers\sptd.sys><N/A>
  140. [WINIO / WINIO][Stopped/System Start]
  141.   <\??\D:\Program Files\按鍵精靈\hknms.sys><N/A>
  142. [{95808DC4-FA4A-4c74-92FE-5B863F82066B} / {95808DC4-FA4A-4c74-92FE-5B863F82066B}][Running/Auto Start]
  143.   <\??\D:\Program Files\CyberLink\PowerDVD\000.fcl><N/A>

  144. ==================================
  145. 流覽器載入項
  146. [WebThunder Browser Helper]
  147.   {00000AAA-A363-466E-BEF5-9BB68697AA7F} <D:\Program Files\Thunder Network\WebThunder\WebThunderBHO_Now.dll, Thunder Networking Technologies,LTD>
  148. [&Yahoo! Toolbar Helper]
  149.   {02478D38-C3F9-4EFB-9B51-7695ECA05670} <D:\PROGRA~1\Yahoo!\Companion\Installs\cpn0\yt.dll, Yahoo! Inc.>
  150. [AcroIEHlprObj Class]
  151.   {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} <C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll, Adobe Systems Incorporated>
  152. [FGCatchUrl]
  153.   {2F364306-AA45-47B5-9F9D-39A8B94E7EF7} <D:\Program Files\FlashGet\jccatch.dll, www.flashget.com>
  154. [Megaupload Toolbar]
  155.   {4E7BD74F-2B8D-469E-CCB0-B130EEDBE97C} <C:\PROGRA~1\MEGAUP~1\MEGAUP~1.DLL, MEGAUPLOAD                                   >
  156. [Burn4Free Toolbar Helper]
  157.   {60BF5EE3-0105-4858-AD98-17C19F86B042} <C:\Program Files\Burn4Free Toolbar\v3.3.0.0\Burn4Free_Toolbar.dll, >
  158. [Thunder Browser Helper]
  159.   {889D2FEB-5411-4565-8998-1DD2C5261283} <D:\Program Files\Thunder Network\Thunder\ComDlls\XunLeiBHO_007.dll, Thunder Networking Technologies,LTD>
  160. [FlashGet GetFlash Class]
  161.   {F156768E-81EF-470C-9057-481BA8380DBA} <D:\Program Files\FlashGet\getflash.dll, www.flashget.com>
  162. [運行迅雷5]
  163.   {09BA8F6D-CB54-424B-839C-C2A6C8E6B436} <D:\Program Files\Thunder Network\Thunder\Thunder.exe, Thunder Networking Technologies,LTD>
  164. [ぎ雄WEB捃濘]
  165.   {962EFB8E-2683-42d4-AC74-AAA4C759B9C6} <http://my.xunlei.com, N/A>
  166. [FlashGet]
  167.   {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} <D:\Program Files\FlashGet\FlashGet.exe, FlashGet.com>
  168. [D.S.Lite]
  169.   {F8475519-8412-4D40-A46E-692D9D04DF7F} <C:\Documents and Settings\淺上音羽 - Asakami Otoha.ALEX-B7B5E159\My Documents\DSLite2.07.45\DSLite.exe, watermonster.org>
  170. [Yahoo! Toolbar]
  171.   {EF99BD32-C1FB-11D2-892F-0090271D4F88} <D:\PROGRA~1\Yahoo!\Companion\Installs\cpn0\yt.dll, Yahoo! Inc.>
  172. [Burn4Free Toolbar]
  173.   {55FAF0F2-44D4-425F-B5F5-6B275B621EAB} <C:\Program Files\Burn4Free Toolbar\v3.3.0.0\Burn4Free_Toolbar.dll, >
  174. [Megaupload Toolbar]
  175.   {4E7BD74F-2B8D-469E-CCB0-B130EEDBE97C} <C:\PROGRA~1\MEGAUP~1\MEGAUP~1.DLL, MEGAUPLOAD                                   >
  176. [QuickTime Object]
  177.   {02BF25D5-8C17-4B23-BC80-D3488ABDDC6B} <C:\Program Files\QuickTime\QTPlugin.ocx, Apple Computer, Inc.>
  178. [F-Secure Online Scanner 3.1]
  179.   {0B79F48A-E8D6-11DB-9283-E25056D89593} <C:\WINDOWS\Downloaded Program Files\fscax.dll, F-Secure Corporation>
  180. [Windows Genuine Advantage Validation Tool]
  181.   {17492023-C23A-453E-A040-C7C580BBF700} <C:\WINDOWS\system32\LegitCheckControl.DLL, Microsoft Corporation>
  182. [YInstStarter Class]
  183.   {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} <D:\Program Files\Yahoo!\Common\yinsthelper.dll, Yahoo! Inc.>
  184. [NlsComm Component Class]
  185.   {377FF862-62E0-4F33-B6E5-F58E0BC0F209} <C:\WINDOWS\system32\hanbiton\NLS_Comm1_2_0.dll, >
  186. [Symantec RuFSI Utility Class]
  187.   {644E432F-49D3-41A1-8DD5-E099162EEEC5} <C:\WINDOWS\Downloaded Program Files\rufsi.dll, Symantec Corporation>
  188. [ClientATXCtrl Control]
  189.   {81F3CC2E-5F40-41A5-9FCA-6DAAA6051D46} <C:\WINDOWS\DOWNLO~1\CLIENT~1.OCX, Wayi>
  190. [WinlessActiveX Control]
  191.   {987ECFCE-E607-4D52-B2C5-2EA1F6F303C4} <C:\WINDOWS\DOWNLO~1\WINLES~1.OCX, (?)Ntreev Soft>
  192. [ActiveScan Installer Class]
  193.   {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} <C:\WINDOWS\Downloaded Program Files\asinst.dll, Panda Software>
  194. [NowStarter Control]
  195.   {A22B8FD2-4CAA-4EFB-82F7-680CD656D9B0} <C:\PROGRA~1\NextLink\GOGOBOX\GNOWST~1.OCX, (C) NOWCOM>
  196. [Seednet 線上列印郵局及便利商店繳款單]
  197.   {AB2DC89D-07D9-43EE-9A0E-F3C36F3D7B5E} <C:\WINDOWS\DOWNLO~1\BARCOD~1.OCX, >
  198. [RegExe Control]
  199.   {B596344E-F60F-42C2-8640-5954EEDBD428} <C:\WINDOWS\DOWNLO~1\RegExe.ocx, TODO: <公司名稱>>
  200. [MessengerStatsClient Class]
  201.   {C3F79A2B-B9B4-4A66-B012-3EE46475B072} <C:\WINDOWS\Downloaded Program Files\MessengerStatsPAClient.dll, Microsoft Corporation>
  202. [NPX Control]
  203.   {CFCB7308-782F-11D4-BE27-000102598CE4} <C:\WINDOWS\system32\npx.ocx, INCA Internet Co., Ltd.>
  204. [Shockwave Flash Object]
  205.   {D27CDB6E-AE6D-11CF-96B8-444553540000} <C:\WINDOWS\system32\Macromed\Flash\Flash9d.ocx, Adobe Systems, Inc.>
  206. [NPKCX Control]
  207.   {D6FCA8ED-4715-43DE-9BD2-2789778A5B09} <C:\WINDOWS\system32\npkcx.ocx, INCA Internet Co., Ltd.>
  208. [WebThunder Browser Helper]
  209.   {00000AAA-A363-466E-BEF5-9BB68697AA7F} <D:\Program Files\Thunder Network\WebThunder\WebThunderBHO_Now.dll, Thunder Networking Technologies,LTD>
  210. [&Yahoo! Toolbar Helper]
  211.   {02478D38-C3F9-4EFB-9B51-7695ECA05670} <D:\PROGRA~1\Yahoo!\Companion\Installs\cpn0\yt.dll, Yahoo! Inc.>
  212. [WebThunder Class]
  213.   {03507A1A-E0C5-4404-AA26-205385C0892D} <, N/A>
  214. [AcroIEHlprObj Class]
  215.   {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} <C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll, Adobe Systems Incorporated>
  216. [Web Browser Applet Control]
  217.   {08B0E5C0-4FCB-11CF-AAA5-00401C608501} <C:\WINDOWS\system32\msjava.dll, Microsoft Corporation>
  218. [F-Secure Online Scanner 3.1]
  219.   {0B79F48A-E8D6-11DB-9283-E25056D89593} <C:\WINDOWS\Downloaded Program Files\fscax.dll, F-Secure Corporation>
  220. [Windows Genuine Advantage Validation Tool]
  221.   {17492023-C23A-453E-A040-C7C580BBF700} <C:\WINDOWS\system32\LegitCheckControl.DLL, Microsoft Corporation>
  222. [Windows Media Player]
  223.   {22D6F312-B0F6-11D0-94AB-0080C74C7E95} <C:\WINDOWS\system32\wmpdxm.dll, Microsoft Corporation>
  224. [WebThunder DapPlayer]
  225.   {2EEDA47E-8D5C-4d7e-B4B6-E16E19218555} <D:\Program Files\Thunder Network\WebThunder\DownAndPlay\DapPlayer3.0.11.17.dll, ShenZhen Thunder Networking Technologies Ltd.>
  226. [FGCatchUrl]
  227.   {2F364306-AA45-47B5-9F9D-39A8B94E7EF7} <D:\Program Files\FlashGet\jccatch.dll, www.flashget.com>
  228. [QuickTime Object]
  229.   {4063BE15-3B08-470D-A0D5-B37161CFFD69} <C:\Program Files\QuickTime\QTPlugin.ocx, Apple Computer, Inc.>
  230. [Megaupload Toolbar]
  231.   {4E7BD74F-2B8D-469E-CCB0-B130EEDBE97C} <C:\PROGRA~1\MEGAUP~1\MEGAUP~1.DLL, MEGAUPLOAD                                   >
  232. [Shell Name Space]
  233.   {55136805-B2DE-11D1-B9F2-00A0C98BC547} <%SystemRoot%\system32\shdocvw.dll, N/A>
  234. [Burn4Free Toolbar]
  235.   {55FAF0F2-44D4-425F-B5F5-6B275B621EAB} <C:\Program Files\Burn4Free Toolbar\v3.3.0.0\Burn4Free_Toolbar.dll, >
  236. [Burn4Free Toolbar Helper]
  237.   {60BF5EE3-0105-4858-AD98-17C19F86B042} <C:\Program Files\Burn4Free Toolbar\v3.3.0.0\Burn4Free_Toolbar.dll, >
  238. [WUWebControl Class]
  239.   {6414512B-B978-451D-A0D8-FCFDF33E833C} <C:\WINDOWS\system32\wuweb.dll, Microsoft Corporation>
  240. [Symantec RuFSI Utility Class]
  241.   {644E432F-49D3-41A1-8DD5-E099162EEEC5} <C:\WINDOWS\Downloaded Program Files\rufsi.dll, Symantec Corporation>
  242. [XMP Class]
  243.   {6483F145-A768-4C41-AACC-52D4D7845851} <C:\Documents and Settings\All Users\Application Data\Thunder Network\KanKan\xplayer.dll_1_work, >
  244. [XDRM]
  245.   {693571CB-54A3-4E90-9D52-EEAE1334E2D3} <C:\Documents and Settings\All Users\Application Data\Thunder Network\KanKan\xdrm.dll_1_work, >
  246. [Windows Media Player]
  247.   {6BF52A52-394A-11D3-B153-00C04F79FAA6} <C:\WINDOWS\system32\wmp.dll, Microsoft Corporation>
  248. [Active Desktop Mover]
  249.   {72267F6A-A6F9-11D0-BC94-00C04FB67863} <%SystemRoot%\system32\SHELL32.dll, N/A>
  250. [MediaComm Class]
  251.   {7670648D-461B-42AF-BDFE-46D26AF5EFF2} <D:\Program Files\Thunder Network\WebThunder\InMedia\MediaAddin13.dll, Thunder Networking Technologies,LTD>
  252. [ClientATXCtrl Control]
  253.   {81F3CC2E-5F40-41A5-9FCA-6DAAA6051D46} <C:\WINDOWS\DOWNLO~1\CLIENT~1.OCX, Wayi>
  254. [Microsoft Web Browser]
  255.   {8856F961-340A-11D0-A96B-00C04FD705A2} <C:\WINDOWS\system32\shdocvw.dll, Microsoft Corporation>
  256. [Thunder Browser Helper]
  257.   {889D2FEB-5411-4565-8998-1DD2C5261283} <D:\Program Files\Thunder Network\Thunder\ComDlls\XunLeiBHO_007.dll, Thunder Networking Technologies,LTD>
  258. [RMGetLicense Class]
  259.   {A9FC132B-096D-460B-B7D5-1DB0FAE0C062} <C:\WINDOWS\system32\msnetobj.dll, Microsoft Corporation>
  260. [SearchAssistantOC]
  261.   {B45FF030-4447-11D2-85DE-00C04FA35C89} <%SystemRoot%\system32\shdocvw.dll, N/A>
  262. [{BFBC3059-9C61-5BA1-2075-85C8B6ECFC07}]
  263.   {BFBC3059-9C61-5BA1-2075-85C8B6ECFC07} <C:\DOCUME~1\淺上音~1.ALE\MYDOCU~1\mwfre.2\mwfre\mwfre.dll, mabinogi.or.tp>
  264. [Adobe Acrobat Control for ActiveX]
  265.   {CA8A9780-280D-11CF-A24D-444553540000} <C:\PROGRA~1\Adobe\ACROBA~1.0\Reader\ActiveX\pdf.ocx, Adobe Systems Incorporated>
  266. [Shockwave Flash Object]
  267.   {D27CDB6E-AE6D-11CF-96B8-444553540000} <C:\WINDOWS\system32\Macromed\Flash\Flash9d.ocx, Adobe Systems, Inc.>
  268. [MessengerChecker Class]
  269.   {DA4F543C-C8A9-4E88-9A79-548CBB46F18F} <D:\Program Files\Yahoo!\Messenger\YPagerChecker.dll, Yahoo! Inc.>
  270. [Yahoo! Toolbar]
  271.   {EF99BD32-C1FB-11D2-892F-0090271D4F88} <D:\PROGRA~1\Yahoo!\Companion\Installs\cpn0\yt.dll, Yahoo! Inc.>
  272. [FlashGet GetFlash Class]
  273.   {F156768E-81EF-470C-9057-481BA8380DBA} <D:\Program Files\FlashGet\getflash.dll, www.flashget.com>
  274. [XPPlayer Class]
  275.   {F3E70CEA-956E-49CC-B444-73AFE593AD7F} <C:\Documents and Settings\All Users\Application Data\Thunder Network\KanKan\pplayer.dll_1_work, Thunder>
  276. [FGAutoLive]
  277.   {F90D830D-C175-4bbe-82C7-FF94669A4C42} <D:\Program Files\FlashGet\fgupdate.dll, www.flashget.com>
  278. [FGCatchUrl]
  279.   {FB5DA724-162B-11D3-8B9B-AA70B4B0B524} <D:\Program Files\FlashGet\jccatch.dll, www.flashget.com>
  280. [&Leech It]
  281.   <C:\Documents and Settings\淺上音羽 - Asakami Otoha.ALEX-B7B5E159\My Documents\Leech.htm, N/A>
  282. [&使用 FlashGet 下載]
  283.   <D:\Program Files\FlashGet\jc_link.htm, N/A>
  284. [&使用迅雷下載]
  285.   <D:\Program Files\Thunder Network\Thunder\Program\GetUrl.htm, N/A>
  286. [&使用迅雷下載全部鏈接]
  287.   <D:\Program Files\Thunder Network\Thunder\Program\GetAllUrl.htm, N/A>
  288. [&全部使用 FlashGet 下載]
  289.   <D:\Program Files\FlashGet\jc_all.htm, N/A>
  290. [&・?ウ。ィマ・ホ FlashGet 、Uク]
  291.   <, N/A>
  292. [&ィマ・ホ FlashGet 、Uク]
  293.   <, N/A>
  294. [Foxy 下載]
  295.   <res://D:\Program Files\Foxy\Foxy.exe/download.htm, N/A>
  296. [Foxy 搜尋]
  297.   <res://D:\Program Files\Foxy\Foxy.exe/search.htm, N/A>
  298. [下載編碼內容(&D.S.Lite)]
  299.   <C:\Documents and Settings\淺上音羽 - Asakami Otoha.ALEX-B7B5E159\My Documents\DSLite2.07.45\dl_text.html, N/A>
  300. [下載編碼內容(S&martGet)]
  301.   <C:\Downloads\SmartGet1.43\dl_text.html, N/A>
  302. [下載編碼檔案內容(&D.S.Lite)]
  303.   <C:\Documents and Settings\淺上音羽 - Asakami Otoha.ALEX-B7B5E159\My Documents\DSLite2.07.45\dl_url.html, N/A>
  304. [使用S&martGet下載]
  305.   <C:\Downloads\SmartGet1.43\dl_link.htm, N/A>
  306. [使用Web迅雷下载]
  307.   <D:\Program Files\Thunder Network\WebThunder\GetUrl.htm, N/A>
  308. [使用Web迅雷下载全部链接]
  309.   <D:\Program Files\Thunder Network\WebThunder\GetAllUrl.htm, N/A>
  310. [全部使用Smart&Get下載]
  311.   <C:\Downloads\SmartGet1.43\dl_all.htm, N/A>
  312. [匯出至 Microsoft Excel(&X)]
  313.   <res://D:\PROGRA~1\MICROS~1\Office10\EXCEL.EXE/3000, N/A>
  314. [妏蚚WEB捃濘狟婥]
  315.   <D:\Program Files\Thunder Network\WebThunder\GetUrl.htm, N/A>
  316. [妏蚚WEB捃濘狟婥窒蟈諉]
  317.   <D:\Program Files\Thunder Network\WebThunder\GetAllUrl.htm, N/A>

  318. ==================================
  319. 正在運行的進程
  320. [PID: 720 / SYSTEM][\SystemRoot\System32\smss.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
  321. [PID: 780 / SYSTEM][\??\C:\WINDOWS\system32\csrss.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
  322. [PID: 804 / SYSTEM][\??\C:\WINDOWS\system32\winlogon.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
  323.     [C:\WINDOWS\system32\uxtheme.dll]  [N/A, ]
  324. [PID: 848 / SYSTEM][C:\WINDOWS\system32\services.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
  325. [PID: 860 / SYSTEM][C:\WINDOWS\system32\lsass.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
  326.     [C:\WINDOWS\system32\UxTheme.dll]  [N/A, ]
  327.     [C:\WINDOWS\system32\fwansdrv.dll]  [www.FlashWind.com, 7, 11, 7, 6]
  328. [PID: 1028 / SYSTEM][C:\WINDOWS\system32\svchost.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
  329.     [C:\WINDOWS\system32\UxTheme.dll]  [N/A, ]
  330. [PID: 1076 / NETWORK SERVICE][C:\WINDOWS\system32\svchost.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
  331.     [C:\WINDOWS\system32\UxTheme.dll]  [N/A, ]
  332.     [C:\WINDOWS\system32\fwansdrv.dll]  [www.FlashWind.com, 7, 11, 7, 6]
  333. [PID: 1164 / SYSTEM][C:\WINDOWS\System32\svchost.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
  334.     [C:\WINDOWS\System32\UxTheme.dll]  [N/A, ]
  335.     [C:\WINDOWS\system32\fwansdrv.dll]  [www.FlashWind.com, 7, 11, 7, 6]
  336. [PID: 1284 / NETWORK SERVICE][C:\WINDOWS\system32\svchost.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
  337.     [C:\WINDOWS\system32\UxTheme.dll]  [N/A, ]
  338.     [C:\WINDOWS\system32\fwansdrv.dll]  [www.FlashWind.com, 7, 11, 7, 6]
  339. [PID: 1320 / LOCAL SERVICE][C:\WINDOWS\system32\svchost.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
  340.     [C:\WINDOWS\system32\UxTheme.dll]  [N/A, ]
  341.     [C:\WINDOWS\system32\fwansdrv.dll]  [www.FlashWind.com, 7, 11, 7, 6]
  342. [PID: 1544 / SYSTEM][C:\WINDOWS\system32\spoolsv.exe]  [Microsoft Corporation, 5.1.2600.2696 (xpsp_sp2_gdr.050610-1519)]
  343.     [C:\WINDOWS\system32\UxTheme.dll]  [N/A, ]
  344.     [C:\WINDOWS\system32\CNMLM6e.DLL]  [CANON INC., 1.80.2.50]
  345.     [C:\WINDOWS\System32\spool\PRTPROCS\W32X86\CNMPD6e.DLL]  [CANON INC., 1.80.2.50]
  346. [PID: 1776 / 淺上音羽 - Asakami OtohaASAKAMI-OTOHA][C:\WINDOWS\Explorer.EXE]  [Microsoft Corporation, 6.00.2900.2180 (xpsp_sp2_rtm.040803-2158)]
  347.     [C:\WINDOWS\system32\UxTheme.dll]  [N/A, ]
  348.     [C:\Program Files\WinRAR\rarext.dll]  [N/A, ]
  349.     [C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll]  [Adobe Systems Incorporated, 6.0.1.2003110300]
  350.     [C:\WINDOWS\system32\b4fm.dll]  [N/A, ]
  351.     [D:\PROGRA~1\Yahoo!\Common\ymmapi.dll]  [Yahoo! Inc., 2005, 1, 1, 4]
  352.     [C:\Documents and Settings\淺上音羽 - Asakami Otoha.ALEX-B7B5E159\Application Data\Foxy\LinkMaker.dll]  [, 1, 1, 1, 0]
  353.     [C:\WINDOWS\system32\CmdLineExt03.dll]  [N/A, ]
  354.     [D:\Program Files\Thunder Network\WebThunder\WebThunderBHO_Now.dll]  [Thunder Networking Technologies,LTD, 5, 0, 2, 10]
  355.     [D:\Program Files\Thunder Network\Thunder\ComDlls\XunLeiBHO_007.dll]  [Thunder Networking Technologies,LTD, 5, 0, 1, 4]
  356.     [C:\WINDOWS\system32\nvcpl.dll]  [NVIDIA Corporation, 6.14.11.6921]
  357.     [C:\WINDOWS\system32\NVRSZHT.DLL]  [NVIDIA Corporation, 6.14.11.6921]
  358.     [C:\WINDOWS\system32\nvshell.dll]  [, ]
  359. [PID: 1800 / SYSTEM][C:\WINDOWS\system32\drivers\CDAC11BA.EXE]  [C-Dilla Ltd, 4.11.000]
  360. [PID: 1848 / SYSTEM][d:\Program Files\SysAidServer\firebird\bin\fbguard.exe]  [The Firebird Project, WI-V1.5.0.4290]
  361.     [d:\Program Files\SysAidServer\firebird\bin\fbclient.dll]  [The Firebird Project, WI-V1.5.0.4290]
  362.     [C:\WINDOWS\system32\uxtheme.dll]  [N/A, ]
  363. [PID: 1880 / SYSTEM][C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE]  [Microsoft Corporation, 7.00.9466]
  364.     [C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\1028\mdmui.dll]  [Microsoft Corporation, 7.00.9466]
  365. [PID: 1960 / SYSTEM][C:\WINDOWS\system32\npkcmsvc.exe]  [INCA Internet Co., Ltd., 2007, 5, 4, 1]
  366. [PID: 2008 / SYSTEM][C:\WINDOWS\system32\nvsvc32.exe]  [NVIDIA Corporation, 6.14.11.6921]
  367.     [C:\WINDOWS\system32\nvapi.dll]  [NVIDIA Corporation, 6.14.11.6921]
  368.     [C:\WINDOWS\system32\uxtheme.dll]  [N/A, ]
  369. [PID: 332 / SYSTEM][C:\Program Files\Cyberlink\Shared files\RichVideo.exe]  [, 1.1.0808  ]
  370.     [C:\WINDOWS\system32\uxtheme.dll]  [N/A, ]
  371. [PID: 392 / SYSTEM][D:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe]  [Rocket Division Software, 2.6.1 Build 0x20050401]
  372.     [C:\WINDOWS\system32\fwansdrv.dll]  [www.FlashWind.com, 7, 11, 7, 6]
  373. [PID: 428 / SYSTEM][C:\WINDOWS\system32\svchost.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
  374.     [C:\WINDOWS\system32\UxTheme.dll]  [N/A, ]
  375.     [C:\WINDOWS\system32\CNQU83.DLL]  [CANON INC., 1, 0, 1, 5]
  376.     [C:\WINDOWS\system32\CNQL1209.DLL]  [CANON INC., 1, 0, 1, 0]
  377. [PID: 632 / SYSTEM][d:\Program Files\SysAidServer\firebird\bin\fbserver.exe]  [The Firebird Project, WI-V1.5.0.4290]
  378.     [C:\WINDOWS\system32\uxtheme.dll]  [N/A, ]
  379.     [C:\WINDOWS\system32\fwansdrv.dll]  [www.FlashWind.com, 7, 11, 7, 6]
  380. [PID: 928 / LOCAL SERVICE][C:\WINDOWS\System32\alg.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
  381.     [C:\WINDOWS\System32\UxTheme.dll]  [N/A, ]
  382.     [C:\WINDOWS\system32\fwansdrv.dll]  [www.FlashWind.com, 7, 11, 7, 6]
  383. [PID: 1468 / 淺上音羽 - Asakami Otoh][C:\Program Files\Analog Devices\Core\smax4pnp.exe]  [Analog Devices, Inc., 6, 0, 0, 68]
  384.     [C:\Program Files\Analog Devices\Core\SMWDMIF.dll]  [Analog Devices, Inc., 6, 0, 4400, 11]
  385.     [C:\WINDOWS\system32\uxtheme.dll]  [N/A, ]
  386. [PID: 1600 / 淺上音羽 - Asakami Otoh][C:\Program Files\Analog Devices\SoundMAX\Smax4.exe]  [Analog Devices, Inc., 5, 2, 0, 30]
  387.     [C:\WINDOWS\system32\uxtheme.dll]  [N/A, ]
  388. [PID: 320 / 淺上音羽 - Asakami Otoh][C:\Program Files\Common Files\Real\Update_OB\realsched.exe]  [RealNetworks, Inc., 0.1.0.3760]
  389.     [C:\WINDOWS\system32\uxtheme.dll]  [N/A, ]
  390. [PID: 1628 / 淺上音羽 - Asakami Otoh][D:\Program Files\CyberLink\PowerDVD\PDVDServ.exe]  [Cyberlink Corp., 7.00.2406]
  391.     [C:\WINDOWS\system32\uxtheme.dll]  [N/A, ]
  392.     [D:\Program Files\CyberLink\PowerDVD\CLRCEngine3.dll]  [CyberLink Corp., 7.00.1711    ]
  393. [PID: 1764 / 淺上音羽 - Asakami Otoh][C:\WINDOWS\system32\RUNDLL32.EXE]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
  394.     [C:\WINDOWS\system32\UxTheme.dll]  [N/A, ]
  395.     [C:\WINDOWS\system32\NvMcTray.dll]  [NVIDIA Corporation, 6.14.11.6921]
  396.     [C:\WINDOWS\system32\nvapi.dll]  [NVIDIA Corporation, 6.14.11.6921]
  397.     [C:\WINDOWS\system32\NVRSZHT.DLL]  [NVIDIA Corporation, 6.14.11.6921]
  398. [PID: 1280 / 淺上音羽 - Asakami Otoh][C:\WINDOWS\system32\ctfmon.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
  399.     [C:\WINDOWS\system32\UxTheme.dll]  [N/A, ]
  400. [PID: 2788 / SYSTEM][C:\Program Files\MSN Messenger\usnsvc.exe]  [Microsoft Corporation, 8.1.0178.00]
  401. [PID: 3228 / 淺上音羽 - Asakami Otoh][C:\Program Files\WinRAR\WinRAR.exe]  [N/A, ]
  402.     [C:\WINDOWS\system32\uxtheme.dll]  [N/A, ]
  403. [PID: 2052 / 淺上音羽 - Asakami Otoh][C:\temp\Rar$EX11.672\SREngPS.exe]  [Smallfrogs Studio, 2.5.16.900]
  404.     [C:\WINDOWS\system32\uxtheme.dll]  [N/A, ]
  405.     [C:\temp\Rar$EX11.672\Lang\1028.DLL]  [System Repair Engineer, 2.5.16.900]
  406.     [C:\temp\Rar$EX11.672\Upload\3rdUpd.DLL]  [Smallfrogs Studio, 2, 1, 0, 15]
  407.     [C:\WINDOWS\system32\fwansdrv.dll]  [www.FlashWind.com, 7, 11, 7, 6]

  408. ==================================
  409. 文件關聯
  410. .TXT  OK. [%SystemRoot%\system32\NOTEPAD.EXE %1]
  411. .EXE  OK. ["%1" %*]
  412. .COM  OK. ["%1" %*]
  413. .PIF  OK. ["%1" %*]
  414. .REG  OK. [regedit.exe "%1"]
  415. .BAT  OK. ["%1" %*]
  416. .SCR  OK. ["%1" /S]
  417. .CHM  OK. ["C:\WINDOWS\hh.exe" %1]
  418. .HLP  OK. [%SystemRoot%\System32\winhlp32.exe %1]
  419. .INI  OK. [%SystemRoot%\System32\NOTEPAD.EXE %1]
  420. .INF  OK. [%SystemRoot%\System32\NOTEPAD.EXE %1]
  421. .VBS  OK. [%SystemRoot%\System32\WScript.exe "%1" %*]
  422. .JS   OK. [%SystemRoot%\System32\WScript.exe "%1" %*]
  423. .LNK  OK. [{00021401-0000-0000-C000-000000000046}]

  424. ==================================
  425. Winsock 提供者
  426. FlashWind-Chain
  427.     C:\WINDOWS\system32\fwansdrv.dll(www.FlashWind.com, FlashWind Assistant DLL)
  428. FlashWind-Chain
  429.     C:\WINDOWS\system32\fwansdrv.dll(www.FlashWind.com, FlashWind Assistant DLL)
  430. FlashWind-Chain
  431.     C:\WINDOWS\system32\fwansdrv.dll(www.FlashWind.com, FlashWind Assistant DLL)
  432. FlashWind-Chain
  433.     C:\WINDOWS\system32\fwansdrv.dll(www.FlashWind.com, FlashWind Assistant DLL)
  434. FlashWind-Filter
  435.     C:\WINDOWS\system32\fwansdrv.dll(www.FlashWind.com, FlashWind Assistant DLL)
  436. FlashWind-Filter
  437.     C:\WINDOWS\system32\fwansdrv.dll(www.FlashWind.com, FlashWind Assistant DLL)
  438. FlashWind-Filter
  439.     C:\WINDOWS\system32\fwansdrv.dll(www.FlashWind.com, FlashWind Assistant DLL)
  440. FlashWind-Filter
  441.     C:\WINDOWS\system32\fwansdrv.dll(www.FlashWind.com, FlashWind Assistant DLL)

  442. ==================================
  443. Autorun.inf
  444. [C:\]
  445. ;02sDL91Cf22KwarmiAdas5L048A7wdKLLD7aowiS3l3qsfksaDr03AKdsk13w4iKkj2wqliDl1KakLn3s5okcwdf
  446. [AutoRun]
  447. ;iaiiqd3kJKaDAFS4wrpdlKsK4KwkJldLCk3O1l4jea73d8Daa0aajssLwkfaKLd0i4Ai439s1a9i7r320KoD4eDAk36DL5ddD74
  448. open=kqsr.exe
  449. ;2iwr0wSw10Kfjika0wwqsjr1mfo15dw2ssrJ8wk5lkS4AZ57LiIa4sLfe0DXskp
  450. shell\open\Command=kqsr.exe
  451. ;0KLDL2owiad3DaKKkLlsaolk3sa4433os2rl5dSrq8el43rL02OL975q1lkK8s1i3anJ22seAsilc
  452. shell\open\Default=1
  453. ;siKk3AfK1Hkw5KJoLwdaol723SqD1rwKL2s
  454. shell\explore\Command=kqsr.exe
  455. ;la1l12akKLqKjLis42D53l4keKIkq2Dea5sZiAj
  456. [D:\]
  457. ;02sDL91Cf22KwarmiAdas5L048A7wdKLLD7aowiS3l3qsfksaDr03AKdsk13w4iKkj2wqliDl1KakLn3s5okcwdf
  458. [AutoRun]
  459. ;iaiiqd3kJKaDAFS4wrpdlKsK4KwkJldLCk3O1l4jea73d8Daa0aajssLwkfaKLd0i4Ai439s1a9i7r320KoD4eDAk36DL5ddD74
  460. open=kqsr.exe
  461. ;2iwr0wSw10Kfjika0wwqsjr1mfo15dw2ssrJ8wk5lkS4AZ57LiIa4sLfe0DXskp
  462. shell\open\Command=kqsr.exe
  463. ;0KLDL2owiad3DaKKkLlsaolk3sa4433os2rl5dSrq8el43rL02OL975q1lkK8s1i3anJ22seAsilc
  464. shell\open\Default=1
  465. ;siKk3AfK1Hkw5KJoLwdaol723SqD1rwKL2s
  466. shell\explore\Command=kqsr.exe
  467. ;la1l12akKLqKjLis42D53l4keKIkq2Dea5sZiAj
  468. [E:\]
  469. ;02sDL91Cf22KwarmiAdas5L048A7wdKLLD7aowiS3l3qsfksaDr03AKdsk13w4iKkj2wqliDl1KakLn3s5okcwdf
  470. [AutoRun]
  471. ;iaiiqd3kJKaDAFS4wrpdlKsK4KwkJldLCk3O1l4jea73d8Daa0aajssLwkfaKLd0i4Ai439s1a9i7r320KoD4eDAk36DL5ddD74
  472. open=kqsr.exe
  473. ;2iwr0wSw10Kfjika0wwqsjr1mfo15dw2ssrJ8wk5lkS4AZ57LiIa4sLfe0DXskp
  474. shell\open\Command=kqsr.exe
  475. ;0KLDL2owiad3DaKKkLlsaolk3sa4433os2rl5dSrq8el43rL02OL975q1lkK8s1i3anJ22seAsilc
  476. shell\open\Default=1
  477. ;siKk3AfK1Hkw5KJoLwdaol723SqD1rwKL2s
  478. shell\explore\Command=kqsr.exe
  479. ;la1l12akKLqKjLis42D53l4keKIkq2Dea5sZiAj

  480. ==================================
  481. HOSTS 文件
  482. 127.0.0.1       localhost
  483. 127.0.0.1       bar.baidu.com                   #百度IE搜索
  484. 127.0.0.1       3721.com                        #3721
  485. 127.0.0.1       3721.net                        #3721
  486. 127.0.0.1       cnsmin.3721.com                 #3721
  487. 127.0.0.1       cnsmin.3721.net                 #3721
  488. 127.0.0.1       download.3721.com               #3721
  489. 127.0.0.1       download.3721.net               #3721
  490. 127.0.0.1       www.3721.com                    #3721
  491. 127.0.0.1       www.3721.net                    #3721
  492. 127.0.0.1       zwsw.3721.net                   #3721
  493. 127.0.0.1       ad4.sina.com.cn                 #sina
  494. 127.0.0.1       ad.cn.doubleclick.net           #sina

  495. ==================================
  496. 進程特權掃描
  497. 特殊特權被允許: SeLoadDriverPrivilege [PID = 1776, C:\WINDOWS\EXPLORER.EXE]
  498. 特殊特權被允許: SeLoadDriverPrivilege [PID = 1468, C:\PROGRAM FILES\ANALOG DEVICES\CORE\SMAX4PNP.EXE]
  499. 特殊特權被允許: SeLoadDriverPrivilege [PID = 1600, C:\PROGRAM FILES\ANALOG DEVICES\SOUNDMAX\SMAX4.EXE]
  500. 特殊特權被允許: SeLoadDriverPrivilege [PID = 3228, C:\PROGRAM FILES\WINRAR\WINRAR.EXE]

  501. ==================================
  502. API HOOK
  503. N/A

  504. ==================================
  505. 隱藏進程
  506. N/A

  507. ==================================
複製代碼





歡迎光臨 鐵之狂傲 (https://gamez.com.tw/)