廣告廣告
  加入我的最愛 設為首頁 風格修改
首頁 首尾
 手機版   訂閱   地圖  簡體 
您是第 9630 個閱讀者
 
發表文章 發表投票 回覆文章
  可列印版   加為IE收藏   收藏主題   上一主題 | 下一主題   
ex90353
數位造型
個人文章 個人相簿 個人日記 個人地圖
路人甲
級別: 路人甲 該用戶目前不上站
推文 x0 鮮花 x0
分享: 轉寄此文章 Facebook Plurk Twitter 複製連結到剪貼簿 轉換為繁體 轉換為簡體 載入圖片
推文 x0
[病毒蠕蟲] 請問 Packed.Win32.NSAnti.r 的毒怎麼解呢 謝謝
請問 Packed.Win32.NSAnti.r 的毒怎麼解呢 謝謝   SREngLOG如下:



複製程式

2007-07-03,17:52:27

System Repair Engineer 2.4.12.806
Smallfrogs ([url]http://www.KZTechs.com[/url])

Windows XP Professional Service Pack 2 (Build 2600) - Administrative User - Completed Functions Allowed

Follow item(s) have been choosed:
    All Boot Items (Including Registry, Startup Folders, Services and so on)
    Browser Add-ons
    Runing Processes (Including process model information)
    File Associations
    Winsock Provider
    Autorun.Inf
    HOSTS File


Boot Items
Registry
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
    <ctfmon.exe><C:\WINDOWS\system32\ctfmon.exe>  [(Verified)Microsoft Windows Publisher]
    <RK Launcher><C:\Program Files\RK Launcher\RKLauncher.exe>  [RaduKing]
    <Alt+Q Hotkey Tool><C:\WINDOWS\Alt+Q Hotkey.exe>  []
    <Yahoo! Pager><"C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe" -quiet>  [(Verified)Yahoo! Inc.]
[HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows]
    <load><>  [N/A]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
    <IMJPMIG8.1><"C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32>  [(Verified)Microsoft Windows Publisher]
    <CJIMETIPSYNC><C:\Program Files\Common Files\Microsoft Shared\IME\IMTC65\CHANGJIE\CINTLCFG.EXE /CJIMETIPSync>  [(Verified)Microsoft Corporation]
    <PHIMETIPSYNC><C:\Program Files\Common Files\Microsoft Shared\IME\IMTC65\PHONETIC\TINTLCFG.EXE /PHIMETIPSync>  [(Verified)Microsoft Corporation]
    <NeroFilterCheck><C:\WINDOWS\system32\NeroCheck.exe>  [Ahead Software Gmbh]
    <SoundMan><SOUNDMAN.EXE>  [(Verified)Microsoft Windows Publisher]
    <NvCplDaemon><RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup>  [(Verified)Microsoft Windows Hardware Compatibility Publisher]
    <nwiz><nwiz.exe /install>  []
    <NvMediaCenter><RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit>  [NVIDIA Corporation]
    <System Files Updater><C:\WINDOWS\FlyakiteOSX\Tools\System Files Updater.exe /S>  []
    <TkBellExe><"C:\Program Files\Common Files\Real\Update_OB\realsched.exe"  -osboot>  [RealNetworks, Inc.]
    <QuickTime Task><"C:\Program Files\QuickTime\qttask.exe" -atboottime>  [Apple Computer, Inc.]
    <ClubBox><"C:\Program Files\NextLink\GOGOBOX\gogobox.exe" -l>  [NextLink, Co. LTD.]
    <SunJavaUpdateSched><"C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe">  [(Verified)"Sun Microsystems, Inc."]
    <AVP><"C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 7.0\avp.exe">  [(Verified)Kaspersky Lab]
    <IMDreyePlugin><"C:\Program Files\Inventec\Dreye\DreyeMT\DreyeIMplugin.exe" /h>  []
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
    <shell><Explorer.exe>  [(Verified)]
    <Userinit><c:\windows\system32\userinit.exe,c:\windows\installer\services.exe,>  [N/A]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Windows]
    <AppInit_DLLs><C:\PROGRA~1\KASPER~1\KASPER~1.0\adialhk.dll>  [(Verified)Kaspersky Lab]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
    <UIHost><logonui.exe>  [(Verified)]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
    <WPDShServiceObj><C:\WINDOWS\system32\WPDShServiceObj.dll>  [(Verified)Microsoft Windows Component Publisher]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\klogon]
    <WinlogonNotify: klogon><C:\WINDOWS\system32\klogon.dll>  [(Verified)Kaspersky Lab]

==================================
Startup Folders
[Adobe Reader Speed Launch]
  <C:\Documents and Settings\All Users\「開始」功能表\程式集\啟動\Adobe Reader Speed Launch.lnk --> C:\PROGRA~1\Adobe\READER~1.0\Reader\READER~1.EXE [Adobe Systems Incorporated]><N>
[Adobe Reader Synchronizer]
  <C:\Documents and Settings\All Users\「開始」功能表\程式集\啟動\Adobe Reader Synchronizer.lnk --> C:\PROGRA~1\Adobe\READER~1.0\Reader\ADOBEC~1.EXE []><N>
[AutoCAD 啟動加速器]
  <C:\Documents and Settings\All Users\「開始」功能表\程式集\啟動\AutoCAD 啟動加速器.lnk --> C:\PROGRA~1\COMMON~1\AUTODE~1\ACSTAR~1.EXE [Autodesk, Inc]><N>
[Monitor Apache Servers]
  <C:\Documents and Settings\All Users\「開始」功能表\程式集\啟動\Monitor Apache Servers.lnk --> C:\PROGRA~1\APACHE~1\Apache2.2\bin\APACHE~1.EXE [Apache Software Foundation]><N>
[Rainlendar]
  <C:\Documents and Settings\Administrator\「開始」功能表\程式集\啟動\Rainlendar.lnk --> C:\PROGRA~1\RAINLE~1\RAINLE~1.EXE [Rainy]><N>

==================================
Services
[Apache2 / Apache2][Stopped/Auto Start]
  <"C:\Program Files\Apache Software Foundation\Apache2.2\bin\httpd.exe" -k runservice><Apache Software Foundation>
[ASP.NET State Service / aspnet_state][Stopped/Manual Start]
  <C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\aspnet_state.exe><Microsoft Corporation>
[Autodesk Licensing Service / Autodesk Licensing Service][Stopped/Manual Start]
  <"C:\Program Files\Common Files\Autodesk Shared\Service\AdskScSrv.exe"><Autodesk, Inc.>
[Kaspersky Internet Security 7.0 / AVP][Running/Auto Start]
  <"C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 7.0\avp.exe" -r><Kaspersky Lab>
[Human Interface Device Access / HidServ][Stopped/Disabled]
  <C:\WINDOWS\System32\svchost.exe -k netsvcs-->%SystemRoot%\System32\hidserv.dll><N/A>
[MySQL / MySQL][Running/Auto Start]
  <"C:\Program Files\MySQL\MySQL Server 4.1\bin\mysqld-nt" --defaults-file="C:\Program Files\MySQL\MySQL Server 4.1\my.ini" MySQL><N/A>
[NVIDIA Display Driver Service / NVSvc][Running/Auto Start]
  <C:\WINDOWS\system32\nvsvc32.exe><NVIDIA Corporation>
[StarWind iSCSI Service / StarWindService][Running/Auto Start]
  <C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe><Rocket Division Software>
[Windows Driver Foundation - User-mode Driver Framework / WudfSvc][Stopped/Manual Start]
  <C:\WINDOWS\system32\svchost.exe -k WudfServiceGroup-->%SystemRoot%\System32\WUDFSvc.dll><Microsoft Corporation>

==================================
Drivers
[Service for Realtek AC97 Audio (WDM) / ALCXWDM][Running/Manual Start]
  <system32\drivers\ALCXWDM.SYS><Realtek Semiconductor Corp.>
[kl1 / kl1][Running/Boot Start]
  <\SystemRoot\system32\drivers\kl1.sys><Kaspersky Lab>
[klif / klif][Running/System Start]
  <\??\C:\WINDOWS\system32\drivers\klif.sys><Kaspersky Lab>
[Kaspersky Anti-Virus NDIS Filter / klim5][Running/Manual Start]
  <system32\DRIVERS\klim5.sys><Kaspersky Lab>
[NOWMEMDF / NOWMEMDF][Running/Manual Start]
  <\??\C:\WINDOWS\system32\NOWMEMDF.sys><(c)NOWCOM>
[npkcrypt / npkcrypt][Stopped/Manual Start]
  <\??\C:\Program Files\Gamania\天堂(Lineage 2.50C)\npkcrypt.sys><N/A>
[nv / nv][Running/Manual Start]
  <system32\DRIVERS\nv4_mini.sys><NVIDIA Corporation>
[直接平行連接埠連結驅動程式 / Ptilink][Running/Manual Start]
  <system32\DRIVERS\ptilink.sys><Parallel Technologies, Inc.>
[Secdrv / Secdrv][Running/Auto Start]
  <system32\DRIVERS\secdrv.sys><Macrovision Corporation, Macrovision Europe Limited, and Macrovision Japan and Asia K.K.>
[SiS PCI Fast Ethernet Adapter Driver / SISNIC][Running/Manual Start]
  <system32\DRIVERS\sisnic.sys><SiS Corporation>
[sptd / sptd][Running/Boot Start]
  <\SystemRoot\System32\Drivers\sptd.sys><N/A>
[Windows Driver Foundation - User-mode Driver Framework Platform Driver / WudfPf][Stopped/Manual Start]
  <system32\DRIVERS\WudfPf.sys><Microsoft Corporation>
[Windows Driver Foundation - User-mode Driver Framework Reflector / WudfRd][Stopped/Manual Start]
  <system32\DRIVERS\wudfrd.sys><Microsoft Corporation>

==================================
Browser Add-ons
[Adobe PDF Reader Link Helper]
  {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} <C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll, Adobe Systems Incorporated>
[BitComet Helper]
  {39F7E362-828A-4B5A-BCAF-5B79BFDFEA60} <C:\Program Files\BitComet\tools\BitCometBHO_1.1.6.14.dll, BitComet>
[Megaupload Toolbar]
  {4E7BD74F-2B8D-469E-CCB0-B130EEDBE97C} <C:\PROGRA~1\MEGAUP~1\MEGAUP~1.DLL, MegaUpload>
[SSVHelper Class]
  {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} <C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll, Sun Microsystems, Inc.>
[Java Plug-in 1.6.0_01]
  {08B0E5C0-4FCB-11CF-AAA5-00401C608501} <C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll, Sun Microsystems, Inc.>
[網頁防護統計]
  {1F460357-8A94-4D71-9CA3-AA4ACF32ED8E} <C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 7.0\SCIEPlgn.dll, Kaspersky Lab>
[參考資料(&R)]
  {92780B25-18CC-41C8-B9BE-3C9C571A8263} <C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL, Microsoft Corporation>
[@shdoclc.dll,-866]
  {c95fe080-8f5d-11d2-a20b-00aa003c157a} <, N/A>
[D.S.Lite]
  {F8475519-8412-4D40-A46E-692D9D04DF7F} <D:\酷必佑\Data-area\DSLite2\DSLite.exe, watermonster.org>
[Messenger]
  {FB5F1910-F110-11d2-BB9E-00C04F795683} <C:\Program Files\Messenger\msmsgs.exe, Microsoft Corporation>
[Megaupload Toolbar]
  {4E7BD74F-2B8D-469E-CCB0-B130EEDBE97C} <C:\PROGRA~1\MEGAUP~1\MEGAUP~1.DLL, MegaUpload>
[Dr.eye WebPage Translation]
  {92B255FE-94E2-4BCA-958D-3926CE38913F} <C:\Program Files\Inventec\Dreye\DreyeMT\DreyeIEBar.dll, >
[Java Plug-in 1.6.0_01]
  {8AD9C840-044E-11D1-B3E9-00805F499D93} <C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll, Sun Microsystems, Inc.>
[NowStarter Control]
  {A22B8FD2-4CAA-4EFB-82F7-680CD656D9B0} <C:\PROGRA~1\NextLink\GOGOBOX\GNOWST~1.OCX, (C) NOWCOM>
[Java Plug-in 1.6.0_01]
  {CAFEEFAC-0016-0000-0001-ABCDEFFEDCBA} <C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll, Sun Microsystems, Inc.>
[Java Plug-in 1.6.0_01]
  {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} <C:\Program Files\Java\jre1.6.0_01\bin\npjpi160_01.dll, Sun Microsystems, Inc.>
[Shockwave Flash Object]
  {D27CDB6E-AE6D-11CF-96B8-444553540000} <C:\WINDOWS\system32\Macromed\Flash\Flash9c.ocx, Adobe Systems, Inc.>
[Adobe PDF Reader Link Helper]
  {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} <C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll, Adobe Systems Incorporated>
[BitComet Helper]
  {39F7E362-828A-4B5A-BCAF-5B79BFDFEA60} <C:\Program Files\BitComet\tools\BitCometBHO_1.1.6.14.dll, BitComet>
[Megaupload Toolbar]
  {4E7BD74F-2B8D-469E-CCB0-B130EEDBE97C} <C:\PROGRA~1\MEGAUP~1\MEGAUP~1.DLL, MegaUpload>
[SSVHelper Class]
  {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} <C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll, Sun Microsystems, Inc.>
[Shockwave Flash Object]
  {D27CDB6E-AE6D-11CF-96B8-444553540000} <C:\WINDOWS\system32\Macromed\Flash\Flash9c.ocx, Adobe Systems, Inc.>
[&使用BitComet下載本頁視訊]
  <res://C:\Program Files\BitComet\BitComet.exe/AddVideo.htm, N/A>
[Mail to a Friend...]
  <[url]http://client.alexa.com/holiday/script/actions/mailto.htm[/url], N/A>
[下載編碼內容(&D.S.Lite)]
  <D:\酷必佑\Data-area\DSLite2\dl_text.html, N/A>
[下載編碼內容(S&martGet)]
  <D:\酷必佑\Data-area\software land\SmartGet1.2\dl_text.html, N/A>
[下載編碼檔案內容(&D.S.Lite)]
  <D:\酷必佑\Data-area\DSLite2\dl_url.html, N/A>
[使用 S&martGet 下載]
  <D:\酷必佑\Data-area\software land\SmartGet1.2\dl_link.htm, N/A>
[使用BitComet下載全部連結]
  <res://C:\Program Files\BitComet\BitComet.exe/AddAllLink.htm, N/A>
[使用BitComet下載連結(&B)]
  <res://C:\Program Files\BitComet\BitComet.exe/AddLink.htm, N/A>
[加入到反廣告橫幅]
  <C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 7.0\ie_banner_deny.htm, N/A>
[匯出至 Microsoft Office Excel(&X)]
  <res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000, N/A>

==================================
Running Processes
[PID: 820][\SystemRoot\System32\smss.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 880][\??\C:\WINDOWS\system32\csrss.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 2052][c:\windows\installer\services.exe]  [N/A, ]
    [C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 7.0\miscr3.dll]  [Kaspersky Lab, 7.0.0.119]
    [C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\gj5oni7.dll]  [N/A, ]
    [C:\WINDOWS\system32\msdll.dll]  [N/A, ]
    [C:\Program Files\Inventec\Dreye\DreyeMT\DreyeIMhook.dll]  [, 1, 0, 0, 1]
    [C:\Program Files\Inventec\Dreye\DreyeMT\DreyeMT.dll]  [N/A, ]
[PID: 2112][C:\WINDOWS\system32\wscntfy.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
    [C:\WINDOWS\system32\msdll.dll]  [N/A, ]
    [C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 7.0\miscr3.dll]  [Kaspersky Lab, 7.0.0.119]
    [C:\Program Files\Inventec\Dreye\DreyeMT\DreyeIMhook.dll]  [, 1, 0, 0, 1]
    [C:\Program Files\Inventec\Dreye\DreyeMT\DreyeMT.dll]  [N/A, ]
[PID: 2328][C:\WINDOWS\Explorer.EXE]  [Microsoft Corporation, 6.00.2900.2180 (xpsp_sp2_rtm.040803-2158)]
    [C:\WINDOWS\system32\AcSignIcon.dll]  [Autodesk, 16.1.63.0]
    [C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 7.0\miscr3.dll]  [Kaspersky Lab, 7.0.0.119]
    [C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 7.0\scrchpg.dll]  [Kaspersky Lab, 7.0.0.119]
    [C:\WINDOWS\system32\msdll.dll]  [N/A, ]
    [C:\Program Files\Common Files\Autodesk Shared\AcSignCore16.dll]  [Autodesk, 16.1.63.0]
    [C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 7.0\adialhk.dll]  [Kaspersky Lab, 7.0.0.119]
    [C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 7.0\dnsq.dll]  [Kaspersky Lab, 7.0.0.119]
    [C:\Program Files\Inventec\Dreye\DreyeMT\DreyeIMhook.dll]  [, 1, 0, 0, 1]
    [C:\Program Files\Inventec\Dreye\DreyeMT\DreyeMT.dll]  [N/A, ]
    [C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\PDFShell.dll]  [Adobe Systems, Inc., 8.0.0.0]
    [C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\PDFShell.CHT]  [Adobe Systems, Inc., 8.0.0.0]
    [C:\WINDOWS\system32\nvcpl.dll]  [NVIDIA Corporation, 6.14.10.9371]
    [C:\WINDOWS\system32\NVRSZHT.DLL]  [NVIDIA Corporation, 6.14.10.9371]
    [C:\WINDOWS\system32\nvapi.dll]  [N/A, ]
    [C:\WINDOWS\system32\nvshell.dll]  [, ]
[PID: 2960][C:\WINDOWS\SOUNDMAN.EXE]  [Realtek Semiconductor Corp., 5, 1, 0, 58]
    [C:\WINDOWS\system32\msdll.dll]  [N/A, ]
    [C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 7.0\miscr3.dll]  [Kaspersky Lab, 7.0.0.119]
    [C:\Program Files\Inventec\Dreye\DreyeMT\DreyeIMhook.dll]  [, 1, 0, 0, 1]
    [C:\Program Files\Inventec\Dreye\DreyeMT\DreyeMT.dll]  [N/A, ]
[PID: 2988][C:\WINDOWS\system32\RUNDLL32.EXE]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
    [C:\WINDOWS\system32\NvMcTray.dll]  [NVIDIA Corporation, 6.14.10.9371]
    [C:\WINDOWS\system32\nvapi.dll]  [N/A, ]
    [C:\WINDOWS\system32\NVRSZHT.DLL]  [NVIDIA Corporation, 6.14.10.9371]
    [C:\WINDOWS\system32\msdll.dll]  [N/A, ]
    [C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 7.0\miscr3.dll]  [Kaspersky Lab, 7.0.0.119]
    [C:\Program Files\Inventec\Dreye\DreyeMT\DreyeIMhook.dll]  [, 1, 0, 0, 1]
    [C:\Program Files\Inventec\Dreye\DreyeMT\DreyeMT.dll]  [N/A, ]
[PID: 3008][C:\Program Files\Common Files\Real\Update_OB\realsched.exe]  [RealNetworks, Inc., 0.1.0.3427]
    [C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 7.0\miscr3.dll]  [Kaspersky Lab, 7.0.0.119]
    [C:\WINDOWS\system32\msdll.dll]  [N/A, ]
    [C:\Program Files\Inventec\Dreye\DreyeMT\DreyeIMhook.dll]  [, 1, 0, 0, 1]
    [C:\Program Files\Inventec\Dreye\DreyeMT\DreyeMT.dll]  [N/A, ]
[PID: 3120][C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe]  [Sun Microsystems, Inc., 6.0.10.6]
    [C:\Program Files\Java\jre1.6.0_01\bin\MSVCR71.dll]  [Microsoft Corporation, 7.10.3052.4]
[PID: 3136][C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 7.0\avp.exe]  [Kaspersky Lab, 7.0.0.119]
    [C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 7.0\prremote.dll]  [Kaspersky Lab, 7.0.0.119]
    [C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 7.0\FSSync.dll]  [Kaspersky Lab, 7.0.5.119]
    [C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 7.0\AVPGS.PPL]  [Kaspersky Lab, 7.0.0.119]
    [C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 7.0\CLLDR.DLL]  [Kaspersky Lab, 7.0.0.119]
    [C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 7.0\prloader.dll]  [Kaspersky Lab, 7.0.0.119]
    [C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 7.0\prkernel.ppl]  [Kaspersky Lab, 7.0.0.119]
    [c:\program files\kaspersky lab\kaspersky internet security 7.0\pxstub.ppl]  [Kaspersky Lab, 7.0.0.119]
    [c:\program files\kaspersky lab\kaspersky internet security 7.0\params.ppl]  [Kaspersky Lab, 7.0.0.119]
    [c:\program files\kaspersky lab\kaspersky internet security 7.0\winreg.ppl]  [Kaspersky Lab, 7.0.0.119]
    [c:\program files\kaspersky lab\kaspersky internet security 7.0\mkavio.ppl]  [Kaspersky Lab, 7.0.0.119]
    [c:\program files\kaspersky lab\kaspersky internet security 7.0\tempfile.ppl]  [Kaspersky Lab, 7.0.0.119]
    [C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 7.0\miscr3.dll]  [Kaspersky Lab, 7.0.0.119]
    [c:\program files\kaspersky lab\kaspersky internet security 7.0\avpgui.ppl]  [Kaspersky Lab, 7.0.0.119]
    [c:\program files\kaspersky lab\kaspersky internet security 7.0\nfio.ppl]  [Kaspersky Lab, 7.0.0.119]
    [c:\program files\kaspersky lab\kaspersky internet security 7.0\fsdrvplg.ppl]  [Kaspersky Lab, 7.0.0.119]
    [c:\program files\kaspersky lab\kaspersky internet security 7.0\basegui.ppl]  [Kaspersky Lab, 7.0.0.119]
    [c:\program files\kaspersky lab\kaspersky internet security 7.0\thpimpl.ppl]  [Kaspersky Lab, 7.0.0.119]
    [c:\program files\kaspersky lab\kaspersky internet security 7.0\qb.ppl]  [Kaspersky Lab, 7.0.0.119]
[PID: 3156][C:\Program Files\Inventec\Dreye\DreyeMT\DreyeIMplugin.exe]  [, 1, 0, 0, 1]
    [C:\Program Files\Inventec\Dreye\DreyeMT\DreyeMT.dll]  [N/A, ]
    [C:\Program Files\Inventec\Dreye\DreyeMT\DreyeIMhook.dll]  [, 1, 0, 0, 1]
    [C:\WINDOWS\system32\msdll.dll]  [N/A, ]
    [C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 7.0\miscr3.dll]  [Kaspersky Lab, 7.0.0.119]
[PID: 3212][C:\WINDOWS\system32\ctfmon.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
    [C:\WINDOWS\system32\msdll.dll]  [N/A, ]
    [C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 7.0\miscr3.dll]  [Kaspersky Lab, 7.0.0.119]
    [C:\Program Files\Inventec\Dreye\DreyeMT\DreyeIMhook.dll]  [, 1, 0, 0, 1]
    [C:\Program Files\Inventec\Dreye\DreyeMT\DreyeMT.dll]  [N/A, ]
[PID: 3264][C:\WINDOWS\Alt+Q Hotkey.exe]  [N/A, ]
    [C:\Program Files\Inventec\Dreye\DreyeMT\DreyeIMhook.dll]  [, 1, 0, 0, 1]
    [C:\Program Files\Inventec\Dreye\DreyeMT\DreyeMT.dll]  [N/A, ]
    [C:\WINDOWS\system32\msdll.dll]  [N/A, ]
    [C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 7.0\miscr3.dll]  [Kaspersky Lab, 7.0.0.119]
[PID: 3400][C:\Program Files\Adobe\Reader 8.0\Reader\reader_sl.exe]  [Adobe Systems Incorporated, 8.0.0.0]
    [C:\Program Files\Inventec\Dreye\DreyeMT\DreyeIMhook.dll]  [, 1, 0, 0, 1]
    [C:\Program Files\Inventec\Dreye\DreyeMT\DreyeMT.dll]  [N/A, ]
    [C:\WINDOWS\system32\msdll.dll]  [N/A, ]
    [C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 7.0\miscr3.dll]  [Kaspersky Lab, 7.0.0.119]
[PID: 3496][C:\Program Files\Apache Software Foundation\Apache2.2\bin\ApacheMonitor.exe]  [Apache Software Foundation, 2.2.4]
    [C:\Program Files\Inventec\Dreye\DreyeMT\DreyeIMhook.dll]  [, 1, 0, 0, 1]
    [C:\Program Files\Inventec\Dreye\DreyeMT\DreyeMT.dll]  [N/A, ]
    [C:\WINDOWS\system32\msdll.dll]  [N/A, ]
    [C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 7.0\miscr3.dll]  [Kaspersky Lab, 7.0.0.119]
[PID: 3516][C:\Program Files\Rainlendar\Rainlendar.exe]  [Rainy, 0, 22, 1, 0]
    [C:\Program Files\Rainlendar\Rainlendar.dll]  [N/A, ]
    [C:\Program Files\Inventec\Dreye\DreyeMT\DreyeIMhook.dll]  [, 1, 0, 0, 1]
    [C:\Program Files\Inventec\Dreye\DreyeMT\DreyeMT.dll]  [N/A, ]
    [C:\Program Files\Rainlendar\Plugins\iCalPlugin.dll]  [N/A, ]
    [C:\Program Files\Rainlendar\Plugins\IniFormatPlugin.dll]  [N/A, ]
    [C:\Program Files\Rainlendar\Plugins\OutlookPlugin.dll]  [N/A, ]
    [C:\Program Files\Rainlendar\Plugins\ServerPlugin.dll]  [N/A, ]
    [C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 7.0\miscr3.dll]  [Kaspersky Lab, 7.0.0.119]
    [C:\WINDOWS\system32\msdll.dll]  [N/A, ]
[PID: 1420][C:\Program Files\Yahoo!\Messenger\ymsgr_tray.exe]  [Yahoo! Inc., 8,1,0,0]
    [C:\Program Files\Yahoo!\Messenger\MSVCP71.dll]  [Microsoft Corporation, 7.10.3077.0]
    [C:\Program Files\Yahoo!\Messenger\MSVCR71.dll]  [Microsoft Corporation, 7.10.3052.4]
    [C:\Program Files\Inventec\Dreye\DreyeMT\DreyeIMhook.dll]  [, 1, 0, 0, 1]
    [C:\Program Files\Inventec\Dreye\DreyeMT\DreyeMT.dll]  [N/A, ]
    [C:\Program Files\Yahoo!\Shared\YbSkin2.dll]  [Yahoo! Inc., 2006, 10, 11, 1]
    [C:\Program Files\Yahoo!\Messenger\res_msgr.dll]  [Yahoo! Inc., 8,5,0,1]
[PID: 2580][C:\Program Files\NextLink\GOGOBOX\GFSCAgent.exe]  [NextLink Co., Ltd., 3, 1, 1, 24]
    [C:\WINDOWS\system32\MFC71U.DLL]  [Microsoft Corporation, 7.10.3077.0]
    [C:\WINDOWS\system32\MSVCR71.dll]  [Microsoft Corporation, 7.10.3052.4]
    [C:\Program Files\Inventec\Dreye\DreyeMT\DreyeIMhook.dll]  [, 1, 0, 0, 1]
    [C:\Program Files\Inventec\Dreye\DreyeMT\DreyeMT.dll]  [N/A, ]
    [C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 7.0\dnsq.dll]  [Kaspersky Lab, 7.0.0.119]
    [C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 7.0\miscr3.dll]  [Kaspersky Lab, 7.0.0.119]
[PID: 2188][D:\酷必佑\compare program\Sreng2 (測毒程序)\sreng2\SREng.EXE]  [Smallfrogs Studio, 2.4.12.806]
    [C:\Program Files\Inventec\Dreye\DreyeMT\DreyeIMhook.dll]  [, 1, 0, 0, 1]
    [C:\Program Files\Inventec\Dreye\DreyeMT\DreyeMT.dll]  [N/A, ]
    [C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 7.0\miscr3.dll]  [Kaspersky Lab, 7.0.0.119]
    [C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 7.0\adialhk.dll]  [Kaspersky Lab, 7.0.0.119]
    [C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 7.0\dnsq.dll]  [Kaspersky Lab, 7.0.0.119]

==================================
File Associations
.TXT  OK. [%SystemRoot%\system32\NOTEPAD.EXE %1]
.EXE  OK. ["%1" %*]
.COM  OK. ["%1" %*]
.PIF  OK. ["%1" %*]
.REG  OK. [regedit.exe "%1"]
.BAT  OK. ["%1" %*]
.SCR  Error. [AutoCADScriptFile]
.CHM  OK. ["C:\WINDOWS\hh.exe" %1]
.HLP  OK. [%SystemRoot%\System32\winhlp32.exe %1]
.INI  OK. [%SystemRoot%\System32\NOTEPAD.EXE %1]
.INF  OK. [%SystemRoot%\System32\NOTEPAD.EXE %1]
.VBS  OK. [%SystemRoot%\System32\WScript.exe "%1" %*]
.JS   OK. [%SystemRoot%\System32\WScript.exe "%1" %*]
.LNK  OK. [{00021401-0000-0000-C000-000000000046}]

==================================
Winsock Provider
N/A

==================================
Autorun.Inf
N/A

==================================
HOSTS File
127.0.0.1       localhost

==================================
API HOOK
RVA Error:  LoadLibraryA (Dangerous Level: Generic,  Hooked by Module: Dest Addr: 0xF5A0EAF0)
RVA Error:  LoadLibraryExA (Dangerous Level: Generic,  Hooked by Module: Dest Addr: 0xF5A0ECD0)
RVA Error:  LoadLibraryExW (Dangerous Level: Generic,  Hooked by Module: Dest Addr: 0xF5A0EE30)
RVA Error:  LoadLibraryW (Dangerous Level: Generic,  Hooked by Module: Dest Addr: 0xF5A0EBE0)
RVA Error:  GetProcAddress (Dangerous Level: High,  Hooked by Module: Dest Addr: 0xF5A0EDE0)

==================================
Hidden Process
N/A

==================================





獻花 x0 回到頂端 [樓 主] From:局域網對方和您在同一內部網 | Posted:2007-07-03 17:57 |

首頁  發表文章 發表投票 回覆文章
Powered by PHPWind v1.3.6
Copyright © 2003-04 PHPWind
Processed in 0.064054 second(s),query:15 Gzip disabled
本站由 瀛睿律師事務所 擔任常年法律顧問 | 免責聲明 | 本網站已依台灣網站內容分級規定處理 | 連絡我們 | 訪客留言