鐵之狂傲

標題: kqsr.exe [列印本頁]
作者: 虛空幻想    時間: 08-2-13 19:51
標題: kqsr.exe
線上掃毒後此檔案上的病毒被清除後也跟著改名

導致我的硬碟沒辦法直接從"我的電腦"開啟

有人知道解決辦法嗎？

或著可以丟這個檔案給我

感恩QQ
作者: 藤乃紫音    時間: 08-2-13 19:51
找到c:windows/explorer.exe
把他上傳到
http://www.virustotal.com/zh-tw/
掃瞄完後把網址貼上來

下載Icesword後進入到安全模式(重開機一直按F8就行)
http://gin77729.myweb.hinet.net/IceSword.rar

進入安全模式後執行Icesowrd，點選左邊的File，找到以下檔案後在檔案上按右鍵選擇"force delete"
C:\WINDOWS\system32\kavo.exe
C:\WINDOWS\system32\wsctf.exe
C:\temp\jatmlano.sys
C:\WINDOWS\system32\CCRFG.SYS
C:\WINDOWS\system32\cologsver.exe
C:\WINDOWS\system32\CmdLineExt03.dll
C:\WINDOWS\system32\b4fm.dll
C:\autorun.inf
D:\autorun.inf
E:\autorun.inf
C:\kqsr.exe
D:\kqsr.exe
E:\kqsr.exe

開啟SREng，點選"啟動專案"的"註冊表"找到下面所列出來的東西點選後按刪除，在選擇"是"刪除
    <kava><C:\WINDOWS\system32\kavo.exe>  [N/A]
    <wsctf.exe><wsctf.exe>  [N/A]
    <EXPLORER.EXE><EXPLORER.EXE>  []
    <Userinit><C:\WINDOWS\system32\cologsver.exe>  []

開啟SREng，點選"啟動專案"的"服務"(右邊分頁的最後一個)選擇右邊的"驅動程式"，找到下面東西後點選"刪除服務"後選擇"設置"，然後按"否"刪除該驅動程式，注意，要按"否"才會刪除。
[CCRFG / CCRFG]
[dump_wmimmc / dump_wmimmc]
[jatmlano / jatmlano]

開啟SREng，點選"啟動專案"的"註冊表"找到下面那行
    <Userinit><userinit.exe,EXPLORER.EXE>  [(Verified)Microsoft Windows Publisher]
找到後點選按編輯，然後將這段刪除
userinit.exe,EXPLORER.EXE
接著將下面的內容複製貼上(逗號也要複製)
  1. C:\WINDOWS\system32\userinit.exe,
複製代碼
接著，點選"系統修復"裡面的"windows shell/IE"然後勾選下面的全選，按下修復

再看看電腦有沒有問題
作者: 迷糊小書僮    時間: 08-2-13 20:00
中獎真快0.0
這隻印象前天才出來的@@

http://www.avpclub.ddns.info/discuz/thread-6565-1-1.html

照這個跑一份SREng出來後壓縮上傳
作者: 虛空幻想    時間: 08-2-13 21:17
這是病毒？

之前好像也看過說...

嘗試ING
作者: 虛空幻想    時間: 08-2-13 21:32
沒解決..我丟實際狀況上來好了



囧...
作者: 藤乃紫音    時間: 08-2-13 22:32
先跑份SREng上來= =

上面有連結

不然把線上掃瞄掃出來的東西貼上來

[ 本文最後由 藤乃紫音 於 08-2-13 10:33 PM 編輯 ]
作者: 虛空幻想    時間: 08-2-13 22:50
  1. 2008-02-13,21:18:04

  3. System Repair Engineer 2.5.16.900
  4. Smallfrogs (http://www.KZTechs.com)

  6. Windows XP Professional Service Pack 2 (Build 2600) - 管理許可權用戶 - 完整功能

  8. 以下內容被選中：
  9.     所有的啟動項目（包括註冊表、開機檔案夾、服務等）
  10.     流覽器載入項
  11.     正在運行的進程（包括進程模組資訊）
  12.     文件關聯
  13.     Winsock 提供者
  14.     Autorun.inf
  15.     HOSTS 文件
  16.     進程特權掃描


  19. 啟動專案
  20. 註冊表
  21. [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
  22.     <ctfmon.exe><C:\WINDOWS\system32\ctfmon.exe>  [(Verified)Microsoft Windows Publisher]
  23.     <MsnMsgr><"C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background>  [(Verified)Microsoft Corporation]
  24.     <Steam><"D:\Program Files\Steam\Steam.exe" -silent>  [(Verified)Valve]
  25.     <Yahoo! Pager><"D:\Program Files\Yahoo!\Messenger\YahooMessenger.exe" -quiet>  [(Verified)Yahoo! Inc.]
  26.     <kava><C:\WINDOWS\system32\kavo.exe>  [N/A]
  27.     <wsctf.exe><wsctf.exe>  [N/A]
  28.     <EXPLORER.EXE><EXPLORER.EXE>  []
  29. [HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows]
  30.     <load><>  [N/A]
  31. [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
  32.     <IMJPMIG8.1><"C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32>  [(Verified)Microsoft Windows Publisher]
  33.     <SoundMAXPnP><C:\Program Files\Analog Devices\Core\smax4pnp.exe>  [Analog Devices, Inc.]
  34.     <SoundMAX><"C:\Program Files\Analog Devices\SoundMAX\Smax4.exe" /tray>  [Analog Devices, Inc.]
  35.     <NvCplDaemon><RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup>  [(Verified)Microsoft Windows Hardware Compatibility Publisher]
  36.     <nwiz><nwiz.exe /install>  []
  37.     <LClock><C:\Program Files\LClock\LClock.exe>  [N/A]
  38.     <TkBellExe><"C:\Program Files\Common Files\Real\Update_OB\realsched.exe"  -osboot>  [(Verified)"RealNetworks, Inc."]
  39.     <PHIMETIPSYNC><C:\Program Files\Common Files\Microsoft Shared\IME\IMTC65\Phonetic\TINTLCFG.EXE /PHIMETIPSync>  [(Verified)Microsoft Corporation]
  40.     <QuickTime Task><"C:\Program Files\QuickTime\qttask.exe" -atboottime>  [Apple Computer, Inc.]
  41.     <WinampAgent><D:\Program Files\Winamp\winampa.exe>  []
  42.     <Flashget><D:\Program Files\FlashGet\FlashGet.exe /min>  [FlashGet.com]
  43.     <Thunder><"D:\Program Files\Thunder Network\Thunder\Thunder.exe" /s>  [Thunder Networking Technologies,LTD]
  44.     <Userinit><C:\WINDOWS\system32\cologsver.exe>  []
  45.     <RemoteControl><"D:\Program Files\CyberLink\PowerDVD\PDVDServ.exe">  [(Verified)CyberLink]
  46.     <LanguageShortcut><"D:\Program Files\CyberLink\PowerDVD\Language\Language.exe">  [(Verified)CyberLink]
  47.     <NvMediaCenter><RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit>  [(Verified)Microsoft Windows Hardware Compatibility Publisher]
  48. [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
  49.     <shell><Explorer.exe>  []
  50.     <Userinit><userinit.exe,EXPLORER.EXE>  [(Verified)Microsoft Windows Publisher]
  51.     <UIHost><LogonUI.exe>  [(Verified)Microsoft Windows Publisher]
  52. [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
  53.     <WPDShServiceObj><C:\WINDOWS\system32\WPDShServiceObj.dll>  [(Verified)Microsoft Windows Publisher]
  54. [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\>{26923b43-4d38-484f-9b9e-de460746276c}]
  55.     <Internet Explorer><%systemroot%\system32\shmgrate.exe OCInstallUserConfigIE>  [N/A]
  56. [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\>{881dd1c5-3dcf-431b-b061-f3f88e8be88a}]
  57.     <Outlook Express><%systemroot%\system32\shmgrate.exe OCInstallUserConfigOE>  [N/A]
  58. [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{2C7339CF-2B09-4501-B3F3-F3508C9228ED}]
  59.     <Themes Setup><%SystemRoot%\system32\regsvr32.exe /s /n /i:/UserInstall %SystemRoot%\system32\themeui.dll>  [N/A]
  60. [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{44BBA840-CC51-11CF-AAFA-00AA00B6015C}]
  61.     <Microsoft Outlook Express 6><"%ProgramFiles%\Outlook Express\setup50.exe" /APP:OE /CALLER:WINNT /user /install>  [N/A]
  62. [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{44BBA842-CC51-11CF-AAFA-00AA00B6015B}]
  63.     <NetMeeting 3.01><rundll32.exe advpack.dll,LaunchINFSection C:\WINDOWS\INF\msnetmtg.inf,NetMtg.Install.PerUser.NT>  [(Verified)Microsoft Windows Publisher]
  64. [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{6BF52A52-394A-11d3-B153-00C04F79FAA6}]
  65.     <Microsoft Windows Media Player><rundll32.exe advpack.dll,LaunchINFSection C:\WINDOWS\INF\wmp11.inf,PerUserStub>  [(Verified)Microsoft Windows Publisher]
  66. [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{7790769C-0471-11d2-AF11-00C04FA35D02}]
  67.     <Address Book 6><"%ProgramFiles%\Outlook Express\setup50.exe" /APP:WAB /CALLER:WINNT /user /install>  [N/A]
  68. [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{89B4C1CD-B018-4511-B0A1-5476DBF70820}]
  69.     <N/A><C:\WINDOWS\system32\Rundll32.exe C:\WINDOWS\system32\mscories.dll,Install>  [Microsoft Corporation]

  71. ==================================
  72. 開機檔案夾
  73. [Microsoft Office]
  74.   <C:\Documents and Settings\All Users\「開始」功能表\程式集\啟動\Microsoft Office.lnk --> D:\PROGRA~1\MICROS~1\Office10\OSA.EXE [Microsoft Corporation]><N>

  76. ==================================
  77. 服務
  78. [Adobe LM Service / Adobe LM Service][Stopped/Manual Start]
  79.   <"C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe"><Adobe Systems>
  80. [C-DillaCdaC11BA / C-DillaCdaC11BA][Running/Auto Start]
  81.   <C:\WINDOWS\system32\drivers\CDAC11BA.EXE><C-Dilla Ltd>
  82. [Firebird Guardian - DefaultInstance / FirebirdGuardianDefaultInstance][Running/Auto Start]
  83.   <d:\Program Files\SysAidServer\firebird\bin\fbguard.exe -s><The Firebird Project>
  84. [Firebird Server - DefaultInstance / FirebirdServerDefaultInstance][Running/Manual Start]
  85.   <d:\Program Files\SysAidServer\firebird\bin\fbserver.exe -s><The Firebird Project>
  86. [Human Interface Device Access / HidServ][Stopped/Disabled]
  87.   <C:\WINDOWS\System32\svchost.exe -k netsvcs-->%SystemRoot%\System32\hidserv.dll><N/A>
  88. [InstallDriver Table Manager / IDriverT][Stopped/Manual Start]
  89.   <"C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe"><Macrovision Corporation>
  90. [npkcmsvc / npkcmsvc][Running/Auto Start]
  91.   <C:\WINDOWS\system32\npkcmsvc.exe><INCA Internet Co., Ltd.>
  92. [NVIDIA Display Driver Service / NVSvc][Running/Auto Start]
  93.   <C:\WINDOWS\system32\nvsvc32.exe><NVIDIA Corporation>
  94. [Cyberlink RichVideo Service(CRVS) / RichVideo][Running/Auto Start]
  95.   <"C:\Program Files\Cyberlink\Shared files\RichVideo.exe"><>
  96. [Remote Packet Capture Protocol v.0 (experimental) / rpcapd][Stopped/Manual Start]
  97.   <"C:\Program Files\WinPcap\rpcapd.exe" -d -f "C:\Program Files\WinPcap\rpcapd.ini"><CACE Technologies>
  98. [StarWind iSCSI Service / StarWindService][Running/Auto Start]
  99.   <D:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe><Rocket Division Software>

  101. ==================================
  102. 驅動程式
  103. [ADI UAA Function Driver for High Definition Audio Service / ADIHdAudAddService][Running/Manual Start]
  104.   <system32\drivers\ADIHdAud.sys><Analog Devices, Inc.>
  105. [AE Audio Service / AEAudio][Running/Manual Start]
  106.   <system32\drivers\AEAudio.sys><Andrea Electronics Corporation>
  107. [AMD Processor Driver / AmdK8][Running/System Start]
  108.   <system32\DRIVERS\AmdK8.sys><Advanced Micro Devices>
  109. [CCRFG / CCRFG][Stopped/Manual Start]
  110.   <\??\C:\WINDOWS\system32\CCRFG.SYS><N/A>
  111. [dump_wmimmc / dump_wmimmc][Stopped/Manual Start]
  112.   <2 - 系統找不到指定的檔案。
  113. ><N/A>
  114. [Microsoft UAA Bus Driver for High Definition Audio / HDAudBus][Running/Manual Start]
  115.   <system32\DRIVERS\HDAudBus.sys><Windows (R) Server 2003 DDK provider>
  116. [jatmlano / jatmlano][Stopped/Manual Start]
  117.   <\??\C:\temp\jatmlano.sys><N/A>
  118. [ATK0110 ACPI UTILITY / MTsensor][Running/Manual Start]
  119.   <system32\DRIVERS\ASACPI.sys><>
  120. [NetGroup Packet Filter Driver / NPF][Stopped/Manual Start]
  121.   <system32\drivers\npf.sys><CACE Technologies>
  122. [npkcrypt / npkcrypt][Stopped/Manual Start]
  123.   <\??\C:\WINDOWS\system32\npkcrypt.sys><INCA Internet Co., Ltd.>
  124. [NPPTNT2 / NPPTNT2][Running/Manual Start]
  125.   <\??\C:\WINDOWS\system32\npptNT2.sys><INCA Internet Co., Ltd.>
  126. [nv / nv][Running/Manual Start]
  127.   <system32\DRIVERS\nv4_mini.sys><NVIDIA Corporation>
  128. [NVIDIA nForce Networking Controller Driver / NVENETFD][Running/Manual Start]
  129.   <system32\DRIVERS\NVENETFD.sys><NVIDIA Corporation>
  130. [NVIDIA Network Bus Enumerator / nvnetbus][Running/Manual Start]
  131.   <system32\DRIVERS\nvnetbus.sys><NVIDIA Corporation>
  132. [直接平行連接埠連結驅動程式 / Ptilink][Running/Manual Start]
  133.   <system32\DRIVERS\ptilink.sys><Parallel Technologies, Inc.>
  134. [PxHelp20 / PxHelp20][Running/Boot Start]
  135.   <\SystemRoot\System32\Drivers\PxHelp20.sys><Sonic Solutions>
  136. [Secdrv / Secdrv][Running/Auto Start]
  137.   <system32\DRIVERS\secdrv.sys><Macrovision Corporation, Macrovision Europe Limited, and Macrovision Japan and Asia K.K.>
  138. [SenFilt Service / SenFiltService][Running/Manual Start]
  139.   <system32\drivers\Senfilt.sys><Sensaura>
  140. [StarForce Protection Environment Driver (version 1.x.a) / sfdrv01a][Running/Boot Start]
  141.   <\SystemRoot\System32\drivers\sfdrv01a.sys><Protection Technology (StarForce)>
  142. [StarForce Protection Helper Driver (version 2.x) / sfhlp02][Running/Boot Start]
  143.   <\SystemRoot\System32\drivers\sfhlp02.sys><Protection Technology (StarForce)>
  144. [StarForce Protection Synchronization Driver (version 4.x) / sfsync04][Running/Boot Start]
  145.   <\SystemRoot\System32\drivers\sfsync04.sys><Protection Technology (StarForce)>
  146. [sptd / sptd][Running/Boot Start]
  147.   <\SystemRoot\System32\Drivers\sptd.sys><N/A>
  148. [WINIO / WINIO][Stopped/System Start]
  149.   <\??\D:\Program Files\按鍵精靈\hknms.sys><N/A>
  150. [{95808DC4-FA4A-4c74-92FE-5B863F82066B} / {95808DC4-FA4A-4c74-92FE-5B863F82066B}][Running/Auto Start]
  151.   <\??\D:\Program Files\CyberLink\PowerDVD\000.fcl><N/A>

  153. ==================================
  154. 流覽器載入項
  155. [WebThunder Browser Helper]
  156.   {00000AAA-A363-466E-BEF5-9BB68697AA7F} <D:\Program Files\Thunder Network\WebThunder\WebThunderBHO_Now.dll, Thunder Networking Technologies,LTD>
  157. [&Yahoo! Toolbar Helper]
  158.   {02478D38-C3F9-4EFB-9B51-7695ECA05670} <D:\PROGRA~1\Yahoo!\Companion\Installs\cpn0\yt.dll, Yahoo! Inc.>
  159. [AcroIEHlprObj Class]
  160.   {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} <C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll, Adobe Systems Incorporated>
  161. [FGCatchUrl]
  162.   {2F364306-AA45-47B5-9F9D-39A8B94E7EF7} <D:\Program Files\FlashGet\jccatch.dll, www.flashget.com>
  163. [Megaupload Toolbar]
  164.   {4E7BD74F-2B8D-469E-CCB0-B130EEDBE97C} <C:\PROGRA~1\MEGAUP~1\MEGAUP~1.DLL, MEGAUPLOAD                                   >
  165. [Burn4Free Toolbar Helper]
  166.   {60BF5EE3-0105-4858-AD98-17C19F86B042} <C:\Program Files\Burn4Free Toolbar\v3.3.0.0\Burn4Free_Toolbar.dll, >
  167. [Thunder Browser Helper]
  168.   {889D2FEB-5411-4565-8998-1DD2C5261283} <D:\Program Files\Thunder Network\Thunder\ComDlls\XunLeiBHO_007.dll, Thunder Networking Technologies,LTD>
  169. [FlashGet GetFlash Class]
  170.   {F156768E-81EF-470C-9057-481BA8380DBA} <D:\Program Files\FlashGet\getflash.dll, www.flashget.com>
  171. [運行迅雷5]
  172.   {09BA8F6D-CB54-424B-839C-C2A6C8E6B436} <D:\Program Files\Thunder Network\Thunder\Thunder.exe, Thunder Networking Technologies,LTD>
  173. [ぎ雄WEB捃濘]
  174.   {962EFB8E-2683-42d4-AC74-AAA4C759B9C6} <http://my.xunlei.com, N/A>
  175. [FlashGet]
  176.   {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} <D:\Program Files\FlashGet\FlashGet.exe, FlashGet.com>
  177. [D.S.Lite]
  178.   {F8475519-8412-4D40-A46E-692D9D04DF7F} <C:\Documents and Settings\淺上音羽 - Asakami Otoha.ALEX-B7B5E159\My Documents\DSLite2.07.45\DSLite.exe, watermonster.org>
  179. [Yahoo! Toolbar]
  180.   {EF99BD32-C1FB-11D2-892F-0090271D4F88} <D:\PROGRA~1\Yahoo!\Companion\Installs\cpn0\yt.dll, Yahoo! Inc.>
  181. [Burn4Free Toolbar]
  182.   {55FAF0F2-44D4-425F-B5F5-6B275B621EAB} <C:\Program Files\Burn4Free Toolbar\v3.3.0.0\Burn4Free_Toolbar.dll, >
  183. [Megaupload Toolbar]
  184.   {4E7BD74F-2B8D-469E-CCB0-B130EEDBE97C} <C:\PROGRA~1\MEGAUP~1\MEGAUP~1.DLL, MEGAUPLOAD                                   >
  185. [QuickTime Object]
  186.   {02BF25D5-8C17-4B23-BC80-D3488ABDDC6B} <C:\Program Files\QuickTime\QTPlugin.ocx, Apple Computer, Inc.>
  187. [F-Secure Online Scanner 3.1]
  188.   {0B79F48A-E8D6-11DB-9283-E25056D89593} <C:\WINDOWS\Downloaded Program Files\fscax.dll, F-Secure Corporation>
  189. [Windows Genuine Advantage Validation Tool]
  190.   {17492023-C23A-453E-A040-C7C580BBF700} <C:\WINDOWS\system32\LegitCheckControl.DLL, Microsoft Corporation>
  191. [YInstStarter Class]
  192.   {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} <D:\Program Files\Yahoo!\Common\yinsthelper.dll, Yahoo! Inc.>
  193. [NlsComm Component Class]
  194.   {377FF862-62E0-4F33-B6E5-F58E0BC0F209} <C:\WINDOWS\system32\hanbiton\NLS_Comm1_2_0.dll, >
  195. [Symantec RuFSI Utility Class]
  196.   {644E432F-49D3-41A1-8DD5-E099162EEEC5} <C:\WINDOWS\Downloaded Program Files\rufsi.dll, Symantec Corporation>
  197. [ClientATXCtrl Control]
  198.   {81F3CC2E-5F40-41A5-9FCA-6DAAA6051D46} <C:\WINDOWS\DOWNLO~1\CLIENT~1.OCX, Wayi>
  199. [WinlessActiveX Control]
  200.   {987ECFCE-E607-4D52-B2C5-2EA1F6F303C4} <C:\WINDOWS\DOWNLO~1\WINLES~1.OCX, (?)Ntreev Soft>
  201. [ActiveScan Installer Class]
  202.   {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} <C:\WINDOWS\Downloaded Program Files\asinst.dll, Panda Software>
  203. [NowStarter Control]
  204.   {A22B8FD2-4CAA-4EFB-82F7-680CD656D9B0} <C:\PROGRA~1\NextLink\GOGOBOX\GNOWST~1.OCX, (C) NOWCOM>
  205. [Seednet 線上列印郵局及便利商店繳款單]
  206.   {AB2DC89D-07D9-43EE-9A0E-F3C36F3D7B5E} <C:\WINDOWS\DOWNLO~1\BARCOD~1.OCX, >
  207. [RegExe Control]
  208.   {B596344E-F60F-42C2-8640-5954EEDBD428} <C:\WINDOWS\DOWNLO~1\RegExe.ocx, TODO: <公司名稱>>
  209. [MessengerStatsClient Class]
  210.   {C3F79A2B-B9B4-4A66-B012-3EE46475B072} <C:\WINDOWS\Downloaded Program Files\MessengerStatsPAClient.dll, Microsoft Corporation>
  211. [NPX Control]
  212.   {CFCB7308-782F-11D4-BE27-000102598CE4} <C:\WINDOWS\system32\npx.ocx, INCA Internet Co., Ltd.>
  213. [Shockwave Flash Object]
  214.   {D27CDB6E-AE6D-11CF-96B8-444553540000} <C:\WINDOWS\system32\Macromed\Flash\Flash9d.ocx, Adobe Systems, Inc.>
  215. [NPKCX Control]
  216.   {D6FCA8ED-4715-43DE-9BD2-2789778A5B09} <C:\WINDOWS\system32\npkcx.ocx, INCA Internet Co., Ltd.>
  217. [WebThunder Browser Helper]
  218.   {00000AAA-A363-466E-BEF5-9BB68697AA7F} <D:\Program Files\Thunder Network\WebThunder\WebThunderBHO_Now.dll, Thunder Networking Technologies,LTD>
  219. [&Yahoo! Toolbar Helper]
  220.   {02478D38-C3F9-4EFB-9B51-7695ECA05670} <D:\PROGRA~1\Yahoo!\Companion\Installs\cpn0\yt.dll, Yahoo! Inc.>
  221. [WebThunder Class]
  222.   {03507A1A-E0C5-4404-AA26-205385C0892D} <, N/A>
  223. [AcroIEHlprObj Class]
  224.   {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} <C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll, Adobe Systems Incorporated>
  225. [Web Browser Applet Control]
  226.   {08B0E5C0-4FCB-11CF-AAA5-00401C608501} <C:\WINDOWS\system32\msjava.dll, Microsoft Corporation>
  227. [F-Secure Online Scanner 3.1]
  228.   {0B79F48A-E8D6-11DB-9283-E25056D89593} <C:\WINDOWS\Downloaded Program Files\fscax.dll, F-Secure Corporation>
  229. [Windows Genuine Advantage Validation Tool]
  230.   {17492023-C23A-453E-A040-C7C580BBF700} <C:\WINDOWS\system32\LegitCheckControl.DLL, Microsoft Corporation>
  231. [Windows Media Player]
  232.   {22D6F312-B0F6-11D0-94AB-0080C74C7E95} <C:\WINDOWS\system32\wmpdxm.dll, Microsoft Corporation>
  233. [WebThunder DapPlayer]
  234.   {2EEDA47E-8D5C-4d7e-B4B6-E16E19218555} <D:\Program Files\Thunder Network\WebThunder\DownAndPlay\DapPlayer3.0.11.17.dll, ShenZhen Thunder Networking Technologies Ltd.>
  235. [FGCatchUrl]
  236.   {2F364306-AA45-47B5-9F9D-39A8B94E7EF7} <D:\Program Files\FlashGet\jccatch.dll, www.flashget.com>
  237. [QuickTime Object]
  238.   {4063BE15-3B08-470D-A0D5-B37161CFFD69} <C:\Program Files\QuickTime\QTPlugin.ocx, Apple Computer, Inc.>
  239. [Megaupload Toolbar]
  240.   {4E7BD74F-2B8D-469E-CCB0-B130EEDBE97C} <C:\PROGRA~1\MEGAUP~1\MEGAUP~1.DLL, MEGAUPLOAD                                   >
  241. [Shell Name Space]
  242.   {55136805-B2DE-11D1-B9F2-00A0C98BC547} <%SystemRoot%\system32\shdocvw.dll, N/A>
  243. [Burn4Free Toolbar]
  244.   {55FAF0F2-44D4-425F-B5F5-6B275B621EAB} <C:\Program Files\Burn4Free Toolbar\v3.3.0.0\Burn4Free_Toolbar.dll, >
  245. [Burn4Free Toolbar Helper]
  246.   {60BF5EE3-0105-4858-AD98-17C19F86B042} <C:\Program Files\Burn4Free Toolbar\v3.3.0.0\Burn4Free_Toolbar.dll, >
  247. [WUWebControl Class]
  248.   {6414512B-B978-451D-A0D8-FCFDF33E833C} <C:\WINDOWS\system32\wuweb.dll, Microsoft Corporation>
  249. [Symantec RuFSI Utility Class]
  250.   {644E432F-49D3-41A1-8DD5-E099162EEEC5} <C:\WINDOWS\Downloaded Program Files\rufsi.dll, Symantec Corporation>
  251. [XMP Class]
  252.   {6483F145-A768-4C41-AACC-52D4D7845851} <C:\Documents and Settings\All Users\Application Data\Thunder Network\KanKan\xplayer.dll_1_work, >
  253. [XDRM]
  254.   {693571CB-54A3-4E90-9D52-EEAE1334E2D3} <C:\Documents and Settings\All Users\Application Data\Thunder Network\KanKan\xdrm.dll_1_work, >
  255. [Windows Media Player]
  256.   {6BF52A52-394A-11D3-B153-00C04F79FAA6} <C:\WINDOWS\system32\wmp.dll, Microsoft Corporation>
  257. [Active Desktop Mover]
  258.   {72267F6A-A6F9-11D0-BC94-00C04FB67863} <%SystemRoot%\system32\SHELL32.dll, N/A>
  259. [MediaComm Class]
  260.   {7670648D-461B-42AF-BDFE-46D26AF5EFF2} <D:\Program Files\Thunder Network\WebThunder\InMedia\MediaAddin13.dll, Thunder Networking Technologies,LTD>
  261. [ClientATXCtrl Control]
  262.   {81F3CC2E-5F40-41A5-9FCA-6DAAA6051D46} <C:\WINDOWS\DOWNLO~1\CLIENT~1.OCX, Wayi>
  263. [Microsoft Web Browser]
  264.   {8856F961-340A-11D0-A96B-00C04FD705A2} <C:\WINDOWS\system32\shdocvw.dll, Microsoft Corporation>
  265. [Thunder Browser Helper]
  266.   {889D2FEB-5411-4565-8998-1DD2C5261283} <D:\Program Files\Thunder Network\Thunder\ComDlls\XunLeiBHO_007.dll, Thunder Networking Technologies,LTD>
  267. [RMGetLicense Class]
  268.   {A9FC132B-096D-460B-B7D5-1DB0FAE0C062} <C:\WINDOWS\system32\msnetobj.dll, Microsoft Corporation>
  269. [SearchAssistantOC]
  270.   {B45FF030-4447-11D2-85DE-00C04FA35C89} <%SystemRoot%\system32\shdocvw.dll, N/A>
  271. [{BFBC3059-9C61-5BA1-2075-85C8B6ECFC07}]
  272.   {BFBC3059-9C61-5BA1-2075-85C8B6ECFC07} <C:\DOCUME~1\淺上音~1.ALE\MYDOCU~1\mwfre.2\mwfre\mwfre.dll, mabinogi.or.tp>
  273. [Adobe Acrobat Control for ActiveX]
  274.   {CA8A9780-280D-11CF-A24D-444553540000} <C:\PROGRA~1\Adobe\ACROBA~1.0\Reader\ActiveX\pdf.ocx, Adobe Systems Incorporated>
  275. [Shockwave Flash Object]
  276.   {D27CDB6E-AE6D-11CF-96B8-444553540000} <C:\WINDOWS\system32\Macromed\Flash\Flash9d.ocx, Adobe Systems, Inc.>
  277. [MessengerChecker Class]
  278.   {DA4F543C-C8A9-4E88-9A79-548CBB46F18F} <D:\Program Files\Yahoo!\Messenger\YPagerChecker.dll, Yahoo! Inc.>
  279. [Yahoo! Toolbar]
  280.   {EF99BD32-C1FB-11D2-892F-0090271D4F88} <D:\PROGRA~1\Yahoo!\Companion\Installs\cpn0\yt.dll, Yahoo! Inc.>
  281. [FlashGet GetFlash Class]
  282.   {F156768E-81EF-470C-9057-481BA8380DBA} <D:\Program Files\FlashGet\getflash.dll, www.flashget.com>
  283. [XPPlayer Class]
  284.   {F3E70CEA-956E-49CC-B444-73AFE593AD7F} <C:\Documents and Settings\All Users\Application Data\Thunder Network\KanKan\pplayer.dll_1_work, Thunder>
  285. [FGAutoLive]
  286.   {F90D830D-C175-4bbe-82C7-FF94669A4C42} <D:\Program Files\FlashGet\fgupdate.dll, www.flashget.com>
  287. [FGCatchUrl]
  288.   {FB5DA724-162B-11D3-8B9B-AA70B4B0B524} <D:\Program Files\FlashGet\jccatch.dll, www.flashget.com>
  289. [&Leech It]
  290.   <C:\Documents and Settings\淺上音羽 - Asakami Otoha.ALEX-B7B5E159\My Documents\Leech.htm, N/A>
  291. [&使用 FlashGet 下載]
  292.   <D:\Program Files\FlashGet\jc_link.htm, N/A>
  293. [&使用迅雷下載]
  294.   <D:\Program Files\Thunder Network\Thunder\Program\GetUrl.htm, N/A>
  295. [&使用迅雷下載全部鏈接]
  296.   <D:\Program Files\Thunder Network\Thunder\Program\GetAllUrl.htm, N/A>
  297. [&全部使用 FlashGet 下載]
  298.   <D:\Program Files\FlashGet\jc_all.htm, N/A>
  299. [&･?ｳ｡ｨﾏ･ﾎ FlashGet ､Uｸ]
  300.   <, N/A>
  301. [&ｨﾏ･ﾎ FlashGet ､Uｸ]
  302.   <, N/A>
  303. [Foxy 下載]
  304.   <res://D:\Program Files\Foxy\Foxy.exe/download.htm, N/A>
  305. [Foxy 搜尋]
  306.   <res://D:\Program Files\Foxy\Foxy.exe/search.htm, N/A>
  307. [下載編碼內容(&D.S.Lite)]
  308.   <C:\Documents and Settings\淺上音羽 - Asakami Otoha.ALEX-B7B5E159\My Documents\DSLite2.07.45\dl_text.html, N/A>
  309. [下載編碼內容(S&martGet)]
  310.   <C:\Downloads\SmartGet1.43\dl_text.html, N/A>
  311. [下載編碼檔案內容(&D.S.Lite)]
  312.   <C:\Documents and Settings\淺上音羽 - Asakami Otoha.ALEX-B7B5E159\My Documents\DSLite2.07.45\dl_url.html, N/A>
  313. [使用S&martGet下載]
  314.   <C:\Downloads\SmartGet1.43\dl_link.htm, N/A>
  315. [使用Web迅雷下载]
  316.   <D:\Program Files\Thunder Network\WebThunder\GetUrl.htm, N/A>
  317. [使用Web迅雷下载全部链接]
  318.   <D:\Program Files\Thunder Network\WebThunder\GetAllUrl.htm, N/A>
  319. [全部使用Smart&Get下載]
  320.   <C:\Downloads\SmartGet1.43\dl_all.htm, N/A>
  321. [匯出至 Microsoft Excel(&X)]
  322.   <res://D:\PROGRA~1\MICROS~1\Office10\EXCEL.EXE/3000, N/A>
  323. [妏蚚WEB捃濘狟婥]
  324.   <D:\Program Files\Thunder Network\WebThunder\GetUrl.htm, N/A>
  325. [妏蚚WEB捃濘狟婥窒蟈諉]
  326.   <D:\Program Files\Thunder Network\WebThunder\GetAllUrl.htm, N/A>

  328. ==================================
  329. 正在運行的進程
  330. [PID: 720 / SYSTEM][\SystemRoot\System32\smss.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
  331. [PID: 780 / SYSTEM][\??\C:\WINDOWS\system32\csrss.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
  332. [PID: 804 / SYSTEM][\??\C:\WINDOWS\system32\winlogon.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
  333.     [C:\WINDOWS\system32\uxtheme.dll]  [N/A, ]
  334. [PID: 848 / SYSTEM][C:\WINDOWS\system32\services.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
  335. [PID: 860 / SYSTEM][C:\WINDOWS\system32\lsass.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
  336.     [C:\WINDOWS\system32\UxTheme.dll]  [N/A, ]
  337.     [C:\WINDOWS\system32\fwansdrv.dll]  [www.FlashWind.com, 7, 11, 7, 6]
  338. [PID: 1028 / SYSTEM][C:\WINDOWS\system32\svchost.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
  339.     [C:\WINDOWS\system32\UxTheme.dll]  [N/A, ]
  340. [PID: 1076 / NETWORK SERVICE][C:\WINDOWS\system32\svchost.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
  341.     [C:\WINDOWS\system32\UxTheme.dll]  [N/A, ]
  342.     [C:\WINDOWS\system32\fwansdrv.dll]  [www.FlashWind.com, 7, 11, 7, 6]
  343. [PID: 1164 / SYSTEM][C:\WINDOWS\System32\svchost.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
  344.     [C:\WINDOWS\System32\UxTheme.dll]  [N/A, ]
  345.     [C:\WINDOWS\system32\fwansdrv.dll]  [www.FlashWind.com, 7, 11, 7, 6]
  346. [PID: 1284 / NETWORK SERVICE][C:\WINDOWS\system32\svchost.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
  347.     [C:\WINDOWS\system32\UxTheme.dll]  [N/A, ]
  348.     [C:\WINDOWS\system32\fwansdrv.dll]  [www.FlashWind.com, 7, 11, 7, 6]
  349. [PID: 1320 / LOCAL SERVICE][C:\WINDOWS\system32\svchost.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
  350.     [C:\WINDOWS\system32\UxTheme.dll]  [N/A, ]
  351.     [C:\WINDOWS\system32\fwansdrv.dll]  [www.FlashWind.com, 7, 11, 7, 6]
  352. [PID: 1544 / SYSTEM][C:\WINDOWS\system32\spoolsv.exe]  [Microsoft Corporation, 5.1.2600.2696 (xpsp_sp2_gdr.050610-1519)]
  353.     [C:\WINDOWS\system32\UxTheme.dll]  [N/A, ]
  354.     [C:\WINDOWS\system32\CNMLM6e.DLL]  [CANON INC., 1.80.2.50]
  355.     [C:\WINDOWS\System32\spool\PRTPROCS\W32X86\CNMPD6e.DLL]  [CANON INC., 1.80.2.50]
  356. [PID: 1776 / 淺上音羽 - Asakami OtohaASAKAMI-OTOHA][C:\WINDOWS\Explorer.EXE]  [Microsoft Corporation, 6.00.2900.2180 (xpsp_sp2_rtm.040803-2158)]
  357.     [C:\WINDOWS\system32\UxTheme.dll]  [N/A, ]
  358.     [C:\Program Files\WinRAR\rarext.dll]  [N/A, ]
  359.     [C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll]  [Adobe Systems Incorporated, 6.0.1.2003110300]
  360.     [C:\WINDOWS\system32\b4fm.dll]  [N/A, ]
  361.     [D:\PROGRA~1\Yahoo!\Common\ymmapi.dll]  [Yahoo! Inc., 2005, 1, 1, 4]
  362.     [C:\Documents and Settings\淺上音羽 - Asakami Otoha.ALEX-B7B5E159\Application Data\Foxy\LinkMaker.dll]  [, 1, 1, 1, 0]
  363.     [C:\WINDOWS\system32\CmdLineExt03.dll]  [N/A, ]
  364.     [D:\Program Files\Thunder Network\WebThunder\WebThunderBHO_Now.dll]  [Thunder Networking Technologies,LTD, 5, 0, 2, 10]
  365.     [D:\Program Files\Thunder Network\Thunder\ComDlls\XunLeiBHO_007.dll]  [Thunder Networking Technologies,LTD, 5, 0, 1, 4]
  366.     [C:\WINDOWS\system32\nvcpl.dll]  [NVIDIA Corporation, 6.14.11.6921]
  367.     [C:\WINDOWS\system32\NVRSZHT.DLL]  [NVIDIA Corporation, 6.14.11.6921]
  368.     [C:\WINDOWS\system32\nvshell.dll]  [, ]
  369. [PID: 1800 / SYSTEM][C:\WINDOWS\system32\drivers\CDAC11BA.EXE]  [C-Dilla Ltd, 4.11.000]
  370. [PID: 1848 / SYSTEM][d:\Program Files\SysAidServer\firebird\bin\fbguard.exe]  [The Firebird Project, WI-V1.5.0.4290]
  371.     [d:\Program Files\SysAidServer\firebird\bin\fbclient.dll]  [The Firebird Project, WI-V1.5.0.4290]
  372.     [C:\WINDOWS\system32\uxtheme.dll]  [N/A, ]
  373. [PID: 1880 / SYSTEM][C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE]  [Microsoft Corporation, 7.00.9466]
  374.     [C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\1028\mdmui.dll]  [Microsoft Corporation, 7.00.9466]
  375. [PID: 1960 / SYSTEM][C:\WINDOWS\system32\npkcmsvc.exe]  [INCA Internet Co., Ltd., 2007, 5, 4, 1]
  376. [PID: 2008 / SYSTEM][C:\WINDOWS\system32\nvsvc32.exe]  [NVIDIA Corporation, 6.14.11.6921]
  377.     [C:\WINDOWS\system32\nvapi.dll]  [NVIDIA Corporation, 6.14.11.6921]
  378.     [C:\WINDOWS\system32\uxtheme.dll]  [N/A, ]
  379. [PID: 332 / SYSTEM][C:\Program Files\Cyberlink\Shared files\RichVideo.exe]  [, 1.1.0808  ]
  380.     [C:\WINDOWS\system32\uxtheme.dll]  [N/A, ]
  381. [PID: 392 / SYSTEM][D:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe]  [Rocket Division Software, 2.6.1 Build 0x20050401]
  382.     [C:\WINDOWS\system32\fwansdrv.dll]  [www.FlashWind.com, 7, 11, 7, 6]
  383. [PID: 428 / SYSTEM][C:\WINDOWS\system32\svchost.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
  384.     [C:\WINDOWS\system32\UxTheme.dll]  [N/A, ]
  385.     [C:\WINDOWS\system32\CNQU83.DLL]  [CANON INC., 1, 0, 1, 5]
  386.     [C:\WINDOWS\system32\CNQL1209.DLL]  [CANON INC., 1, 0, 1, 0]
  387. [PID: 632 / SYSTEM][d:\Program Files\SysAidServer\firebird\bin\fbserver.exe]  [The Firebird Project, WI-V1.5.0.4290]
  388.     [C:\WINDOWS\system32\uxtheme.dll]  [N/A, ]
  389.     [C:\WINDOWS\system32\fwansdrv.dll]  [www.FlashWind.com, 7, 11, 7, 6]
  390. [PID: 928 / LOCAL SERVICE][C:\WINDOWS\System32\alg.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
  391.     [C:\WINDOWS\System32\UxTheme.dll]  [N/A, ]
  392.     [C:\WINDOWS\system32\fwansdrv.dll]  [www.FlashWind.com, 7, 11, 7, 6]
  393. [PID: 1468 / 淺上音羽 - Asakami Otoh][C:\Program Files\Analog Devices\Core\smax4pnp.exe]  [Analog Devices, Inc., 6, 0, 0, 68]
  394.     [C:\Program Files\Analog Devices\Core\SMWDMIF.dll]  [Analog Devices, Inc., 6, 0, 4400, 11]
  395.     [C:\WINDOWS\system32\uxtheme.dll]  [N/A, ]
  396. [PID: 1600 / 淺上音羽 - Asakami Otoh][C:\Program Files\Analog Devices\SoundMAX\Smax4.exe]  [Analog Devices, Inc., 5, 2, 0, 30]
  397.     [C:\WINDOWS\system32\uxtheme.dll]  [N/A, ]
  398. [PID: 320 / 淺上音羽 - Asakami Otoh][C:\Program Files\Common Files\Real\Update_OB\realsched.exe]  [RealNetworks, Inc., 0.1.0.3760]
  399.     [C:\WINDOWS\system32\uxtheme.dll]  [N/A, ]
  400. [PID: 1628 / 淺上音羽 - Asakami Otoh][D:\Program Files\CyberLink\PowerDVD\PDVDServ.exe]  [Cyberlink Corp., 7.00.2406]
  401.     [C:\WINDOWS\system32\uxtheme.dll]  [N/A, ]
  402.     [D:\Program Files\CyberLink\PowerDVD\CLRCEngine3.dll]  [CyberLink Corp., 7.00.1711    ]
  403. [PID: 1764 / 淺上音羽 - Asakami Otoh][C:\WINDOWS\system32\RUNDLL32.EXE]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
  404.     [C:\WINDOWS\system32\UxTheme.dll]  [N/A, ]
  405.     [C:\WINDOWS\system32\NvMcTray.dll]  [NVIDIA Corporation, 6.14.11.6921]
  406.     [C:\WINDOWS\system32\nvapi.dll]  [NVIDIA Corporation, 6.14.11.6921]
  407.     [C:\WINDOWS\system32\NVRSZHT.DLL]  [NVIDIA Corporation, 6.14.11.6921]
  408. [PID: 1280 / 淺上音羽 - Asakami Otoh][C:\WINDOWS\system32\ctfmon.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
  409.     [C:\WINDOWS\system32\UxTheme.dll]  [N/A, ]
  410. [PID: 2788 / SYSTEM][C:\Program Files\MSN Messenger\usnsvc.exe]  [Microsoft Corporation, 8.1.0178.00]
  411. [PID: 3228 / 淺上音羽 - Asakami Otoh][C:\Program Files\WinRAR\WinRAR.exe]  [N/A, ]
  412.     [C:\WINDOWS\system32\uxtheme.dll]  [N/A, ]
  413. [PID: 2052 / 淺上音羽 - Asakami Otoh][C:\temp\Rar$EX11.672\SREngPS.exe]  [Smallfrogs Studio, 2.5.16.900]
  414.     [C:\WINDOWS\system32\uxtheme.dll]  [N/A, ]
  415.     [C:\temp\Rar$EX11.672\Lang\1028.DLL]  [System Repair Engineer, 2.5.16.900]
  416.     [C:\temp\Rar$EX11.672\Upload\3rdUpd.DLL]  [Smallfrogs Studio, 2, 1, 0, 15]
  417.     [C:\WINDOWS\system32\fwansdrv.dll]  [www.FlashWind.com, 7, 11, 7, 6]

  419. ==================================
  420. 文件關聯
  421. .TXT  OK. [%SystemRoot%\system32\NOTEPAD.EXE %1]
  422. .EXE  OK. ["%1" %*]
  423. .COM  OK. ["%1" %*]
  424. .PIF  OK. ["%1" %*]
  425. .REG  OK. [regedit.exe "%1"]
  426. .BAT  OK. ["%1" %*]
  427. .SCR  OK. ["%1" /S]
  428. .CHM  OK. ["C:\WINDOWS\hh.exe" %1]
  429. .HLP  OK. [%SystemRoot%\System32\winhlp32.exe %1]
  430. .INI  OK. [%SystemRoot%\System32\NOTEPAD.EXE %1]
  431. .INF  OK. [%SystemRoot%\System32\NOTEPAD.EXE %1]
  432. .VBS  OK. [%SystemRoot%\System32\WScript.exe "%1" %*]
  433. .JS   OK. [%SystemRoot%\System32\WScript.exe "%1" %*]
  434. .LNK  OK. [{00021401-0000-0000-C000-000000000046}]

  436. ==================================
  437. Winsock 提供者
  438. FlashWind-Chain
  439.     C:\WINDOWS\system32\fwansdrv.dll(www.FlashWind.com, FlashWind Assistant DLL)
  440. FlashWind-Chain
  441.     C:\WINDOWS\system32\fwansdrv.dll(www.FlashWind.com, FlashWind Assistant DLL)
  442. FlashWind-Chain
  443.     C:\WINDOWS\system32\fwansdrv.dll(www.FlashWind.com, FlashWind Assistant DLL)
  444. FlashWind-Chain
  445.     C:\WINDOWS\system32\fwansdrv.dll(www.FlashWind.com, FlashWind Assistant DLL)
  446. FlashWind-Filter
  447.     C:\WINDOWS\system32\fwansdrv.dll(www.FlashWind.com, FlashWind Assistant DLL)
  448. FlashWind-Filter
  449.     C:\WINDOWS\system32\fwansdrv.dll(www.FlashWind.com, FlashWind Assistant DLL)
  450. FlashWind-Filter
  451.     C:\WINDOWS\system32\fwansdrv.dll(www.FlashWind.com, FlashWind Assistant DLL)
  452. FlashWind-Filter
  453.     C:\WINDOWS\system32\fwansdrv.dll(www.FlashWind.com, FlashWind Assistant DLL)

  455. ==================================
  456. Autorun.inf
  457. [C:\]
  458. ;02sDL91Cf22KwarmiAdas5L048A7wdKLLD7aowiS3l3qsfksaDr03AKdsk13w4iKkj2wqliDl1KakLn3s5okcwdf
  459. [AutoRun]
  460. ;iaiiqd3kJKaDAFS4wrpdlKsK4KwkJldLCk3O1l4jea73d8Daa0aajssLwkfaKLd0i4Ai439s1a9i7r320KoD4eDAk36DL5ddD74
  461. open=kqsr.exe
  462. ;2iwr0wSw10Kfjika0wwqsjr1mfo15dw2ssrJ8wk5lkS4AZ57LiIa4sLfe0DXskp
  463. shell\open\Command=kqsr.exe
  464. ;0KLDL2owiad3DaKKkLlsaolk3sa4433os2rl5dSrq8el43rL02OL975q1lkK8s1i3anJ22seAsilc
  465. shell\open\Default=1
  466. ;siKk3AfK1Hkw5KJoLwdaol723SqD1rwKL2s
  467. shell\explore\Command=kqsr.exe
  468. ;la1l12akKLqKjLis42D53l4keKIkq2Dea5sZiAj
  469. [D:\]
  470. ;02sDL91Cf22KwarmiAdas5L048A7wdKLLD7aowiS3l3qsfksaDr03AKdsk13w4iKkj2wqliDl1KakLn3s5okcwdf
  471. [AutoRun]
  472. ;iaiiqd3kJKaDAFS4wrpdlKsK4KwkJldLCk3O1l4jea73d8Daa0aajssLwkfaKLd0i4Ai439s1a9i7r320KoD4eDAk36DL5ddD74
  473. open=kqsr.exe
  474. ;2iwr0wSw10Kfjika0wwqsjr1mfo15dw2ssrJ8wk5lkS4AZ57LiIa4sLfe0DXskp
  475. shell\open\Command=kqsr.exe
  476. ;0KLDL2owiad3DaKKkLlsaolk3sa4433os2rl5dSrq8el43rL02OL975q1lkK8s1i3anJ22seAsilc
  477. shell\open\Default=1
  478. ;siKk3AfK1Hkw5KJoLwdaol723SqD1rwKL2s
  479. shell\explore\Command=kqsr.exe
  480. ;la1l12akKLqKjLis42D53l4keKIkq2Dea5sZiAj
  481. [E:\]
  482. ;02sDL91Cf22KwarmiAdas5L048A7wdKLLD7aowiS3l3qsfksaDr03AKdsk13w4iKkj2wqliDl1KakLn3s5okcwdf
  483. [AutoRun]
  484. ;iaiiqd3kJKaDAFS4wrpdlKsK4KwkJldLCk3O1l4jea73d8Daa0aajssLwkfaKLd0i4Ai439s1a9i7r320KoD4eDAk36DL5ddD74
  485. open=kqsr.exe
  486. ;2iwr0wSw10Kfjika0wwqsjr1mfo15dw2ssrJ8wk5lkS4AZ57LiIa4sLfe0DXskp
  487. shell\open\Command=kqsr.exe
  488. ;0KLDL2owiad3DaKKkLlsaolk3sa4433os2rl5dSrq8el43rL02OL975q1lkK8s1i3anJ22seAsilc
  489. shell\open\Default=1
  490. ;siKk3AfK1Hkw5KJoLwdaol723SqD1rwKL2s
  491. shell\explore\Command=kqsr.exe
  492. ;la1l12akKLqKjLis42D53l4keKIkq2Dea5sZiAj

  494. ==================================
  495. HOSTS 文件
  496. 127.0.0.1       localhost
  497. 127.0.0.1       bar.baidu.com                   #百度IE搜索
  498. 127.0.0.1       3721.com                        #3721
  499. 127.0.0.1       3721.net                        #3721
  500. 127.0.0.1       cnsmin.3721.com                 #3721
  501. 127.0.0.1       cnsmin.3721.net                 #3721
  502. 127.0.0.1       download.3721.com               #3721
  503. 127.0.0.1       download.3721.net               #3721
  504. 127.0.0.1       www.3721.com                    #3721
  505. 127.0.0.1       www.3721.net                    #3721
  506. 127.0.0.1       zwsw.3721.net                   #3721
  507. 127.0.0.1       ad4.sina.com.cn                 #sina
  508. 127.0.0.1       ad.cn.doubleclick.net           #sina

  510. ==================================
  511. 進程特權掃描
  512. 特殊特權被允許： SeLoadDriverPrivilege [PID = 1776, C:\WINDOWS\EXPLORER.EXE]
  513. 特殊特權被允許： SeLoadDriverPrivilege [PID = 1468, C:\PROGRAM FILES\ANALOG DEVICES\CORE\SMAX4PNP.EXE]
  514. 特殊特權被允許： SeLoadDriverPrivilege [PID = 1600, C:\PROGRAM FILES\ANALOG DEVICES\SOUNDMAX\SMAX4.EXE]
  515. 特殊特權被允許： SeLoadDriverPrivilege [PID = 3228, C:\PROGRAM FILES\WINRAR\WINRAR.EXE]

  517. ==================================
  518. API HOOK
  519. N/A

  521. ==================================
  522. 隱藏進程
  523. N/A

  525. ==================================
複製代碼




歡迎光臨 鐵之狂傲 (https://gamez.com.tw/)