ComboFix 08-08-16.01 - hoyin 2008-08-17 13:21:04.1 - NTFSx86 Microsoft Windows XP Professional 5.1.2600.2.950.1.1028.18.241 [GMT 8:00] 執行位置: C:\Documents and Settings\hoyin\桌面\ComboFix.exe * 已建立新的還原點 [color=red][b]WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !![/b][/color] . (((((((((((((((((((((((((((((((((((((( 其他遭刪除的檔案 )))))))))))))))))))))))))))))))))))))))))))))))))) . C:\Documents and Settings\Administrator\Application Data\Microsoft\SystemCertificates\My C:\Documents and Settings\All Users\「開始」功能表\UUSEE~1.LNK C:\Documents and Settings\All Users\桌面\UUSEE~1.LNK C:\Documents and Settings\hoyin\Application Data\FunWebProducts C:\Documents and Settings\hoyin\Application Data\Microsoft\Internet Explorer\Quick Launch\UUSee 厙釐萇弝.lnk C:\Documents and Settings\hoyin\Application Data\Microsoft\SystemCertificates\My C:\Documents and Settings\hoyin\Cookies\hoyin@badongo[2].txt C:\Documents and Settings\hoyin\Cookies\hoyin@lstat.youku[2].txt C:\Documents and Settings\hoyin\Cookies\hoyin@www.viruscn[1].txt C:\Documents and Settings\hoyin\Cookies\hoyin@yahoo[2].txt C:\Documents and Settings\hoyin\Local Settings\Application Data\baidu C:\Documents and Settings\LocalService\Application Data\Microsoft\SystemCertificates\My C:\Documents and Settings\NetworkService\Application Data\Microsoft\SystemCertificates\My C:\Documents and Settings\queenie\Application Data\Microsoft\SystemCertificates\My C:\Documents and Settings\queenie\Cookies\queenie@badongo[1].txt C:\Documents and Settings\queenie\Local Settings\Application Data\baidu C:\Program Files\Common Files\{38870~1 C:\Program Files\Common Files\{A8870~1 C:\Program Files\Common Files\{A8870~2 C:\Program Files\Common Files\fnts~1 C:\Program Files\cowabanga C:\Program Files\cowabanga\License.txt C:\Program Files\FunWebProducts C:\Program Files\FunWebProducts\PopSwatr\History\allowed C:\Program Files\FunWebProducts\PopSwatr\History\notallow C:\Program Files\FunWebProducts\Shared\Cache\AvatarSmallBtn.html C:\Program Files\FunWebProducts\Shared\Cache\CursorManiaBtn.html C:\Program Files\FunWebProducts\Shared\Cache\FunBuddyIconBtn.html C:\Program Files\FunWebProducts\Shared\Cache\MyFunCardsIMBtn.html C:\Program Files\FunWebProducts\Shared\Cache\SmileyCentralBtn.html C:\Program Files\MyWebSearch C:\Program Files\MyWebSearch\bar\1.bin\F3BKGERR.JPG C:\Program Files\MyWebSearch\bar\1.bin\F3BROVLY.DLL C:\Program Files\MyWebSearch\bar\1.bin\F3CJPEG.DLL C:\Program Files\MyWebSearch\bar\1.bin\F3HISTSW.DLL C:\Program Files\MyWebSearch\bar\1.bin\F3HTTPCT.DLL C:\Program Files\MyWebSearch\bar\1.bin\F3IMSTUB.DLL C:\Program Files\MyWebSearch\bar\1.bin\F3POPSWT.DLL C:\Program Files\MyWebSearch\bar\1.bin\F3PSSAVR.SCR C:\Program Files\MyWebSearch\bar\1.bin\F3RESTUB.DLL C:\Program Files\MyWebSearch\bar\1.bin\F3SCHMON.EXE C:\Program Files\MyWebSearch\bar\1.bin\F3SCRCTR.DLL C:\Program Files\MyWebSearch\bar\1.bin\F3SPACER.WMV C:\Program Files\MyWebSearch\bar\1.bin\F3WALLPP.DAT C:\Program Files\MyWebSearch\bar\1.bin\F3WPHOOK.DLL C:\Program Files\MyWebSearch\bar\1.bin\M3FFXTBR.JAR C:\Program Files\MyWebSearch\bar\1.bin\M3FFXTBR.MANIFEST C:\Program Files\MyWebSearch\bar\1.bin\M3HTML.DLL C:\Program Files\MyWebSearch\bar\1.bin\M3IDLE.DLL C:\Program Files\MyWebSearch\bar\1.bin\M3IMPIPE.EXE C:\Program Files\MyWebSearch\bar\1.bin\M3MSG.DLL C:\Program Files\MyWebSearch\bar\1.bin\M3NTSTBR.JAR C:\Program Files\MyWebSearch\bar\1.bin\M3NTSTBR.MANIFEST C:\Program Files\MyWebSearch\bar\1.bin\M3OUTLCN.DLL C:\Program Files\MyWebSearch\bar\1.bin\M3PLUGIN.DLL C:\Program Files\MyWebSearch\bar\1.bin\M3SKIN.DLL C:\Program Files\MyWebSearch\bar\1.bin\M3SKPLAY.EXE C:\Program Files\MyWebSearch\bar\1.bin\M3SLSRCH.EXE C:\Program Files\MyWebSearch\bar\1.bin\M3SRCHMN.EXE C:\Program Files\MyWebSearch\bar\1.bin\MWSOEMON.EXE C:\Program Files\MyWebSearch\bar\1.bin\NPMYWEBS.DLL C:\Program Files\MyWebSearch\bar\Avatar\COMMON.F3S C:\Program Files\MyWebSearch\bar\Cache\[u]0[/u]096BC12 C:\Program Files\MyWebSearch\bar\Cache\[u]0[/u]096BE35.bin C:\Program Files\MyWebSearch\bar\Cache\[u]0[/u]096C0F4.bin C:\Program Files\MyWebSearch\bar\Cache\[u]0[/u]0983238.bin C:\Program Files\MyWebSearch\bar\Cache\[u]0[/u]0983564.bin C:\Program Files\MyWebSearch\bar\Cache\[u]0[/u]098391D.bin C:\Program Files\MyWebSearch\bar\Cache\[u]0[/u]0983C2B.bin C:\Program Files\MyWebSearch\bar\Cache\[u]0[/u]0983ECA.bin C:\Program Files\MyWebSearch\bar\Cache\[u]0[/u]0B19C14.bin C:\Program Files\MyWebSearch\bar\Cache\[u]0[/u]0B19E37.bin C:\Program Files\MyWebSearch\bar\Cache\[u]0[/u]0B1A059.bin C:\Program Files\MyWebSearch\bar\Cache\[u]0[/u]0FA9049 C:\Program Files\MyWebSearch\bar\Cache\files.ini C:\Program Files\MyWebSearch\bar\Game\CHECKERS.F3S C:\Program Files\MyWebSearch\bar\Game\CHESS.F3S C:\Program Files\MyWebSearch\bar\Game\REVERSI.F3S C:\Program Files\MyWebSearch\bar\History\search2 C:\Program Files\MyWebSearch\bar\icons\CM.ICO C:\Program Files\MyWebSearch\bar\icons\MFC.ICO C:\Program Files\MyWebSearch\bar\icons\PSS.ICO C:\Program Files\MyWebSearch\bar\icons\SMILEY.ICO C:\Program Files\MyWebSearch\bar\icons\WB.ICO C:\Program Files\MyWebSearch\bar\icons\ZWINKY.ICO C:\Program Files\MyWebSearch\bar\Message\COMMON.F3S C:\Program Files\MyWebSearch\bar\Notifier\COMMON.F3S C:\Program Files\MyWebSearch\bar\Notifier\DOG.F3S C:\Program Files\MyWebSearch\bar\Notifier\FISH.F3S C:\Program Files\MyWebSearch\bar\Notifier\KUNGFU.F3S C:\Program Files\MyWebSearch\bar\Notifier\LIFEGARD.F3S C:\Program Files\MyWebSearch\bar\Notifier\MAID.F3S C:\Program Files\MyWebSearch\bar\Notifier\MAILBOX.F3S C:\Program Files\MyWebSearch\bar\Notifier\OPERA.F3S C:\Program Files\MyWebSearch\bar\Notifier\ROBOT.F3S C:\Program Files\MyWebSearch\bar\Notifier\SEDUCT.F3S C:\Program Files\MyWebSearch\bar\Notifier\SURFER.F3S C:\Program Files\MyWebSearch\bar\Settings\prevcfg2.htm C:\Program Files\MyWebSearch\bar\Settings\s_pid.dat C:\Program Files\MyWebSearch\bar\Settings\setting2.htm C:\Program Files\MyWebSearch\bar\Settings\settings.dat C:\Program Files\uusee C:\Program Files\uusee\ARMP.ocx C:\Program Files\uusee\ARMPD.dll C:\Program Files\uusee\check_cmd.exe C:\Program Files\uusee\flvplayer.swf C:\Program Files\uusee\in_psp.dll C:\Program Files\uusee\MultiVMR9.dll C:\Program Files\uusee\out_mmshttp.dll C:\Program Files\uusee\rmsp011.ax C:\Program Files\uusee\skins\UUPlayer\About.bmp C:\Program Files\uusee\skins\UUPlayer\Control_Button_pause_1.bmp C:\Program Files\uusee\skins\UUPlayer\Control_Button_pause_2.bmp C:\Program Files\uusee\skins\UUPlayer\Control_Button_pause_3.bmp C:\Program Files\uusee\skins\UUPlayer\Control_Button_pause_4.bmp C:\Program Files\uusee\skins\UUPlayer\Control_Button_Recording_1.bmp C:\Program Files\uusee\skins\UUPlayer\Control_Button_Recording_2.bmp C:\Program Files\uusee\skins\UUPlayer\Control_Button_Recording_3.bmp C:\Program Files\uusee\skins\UUPlayer\Ctrl_CheckBox_1.bmp C:\Program Files\uusee\skins\UUPlayer\Ctrl_CheckBox_2.bmp C:\Program Files\uusee\skins\UUPlayer\Ctrl_CheckBox_3.bmp C:\Program Files\uusee\skins\UUPlayer\Ctrl_CheckBox_4.bmp C:\Program Files\uusee\skins\UUPlayer\Ctrl_CheckBox_C1.bmp C:\Program Files\uusee\skins\UUPlayer\Ctrl_CheckBox_C2.bmp C:\Program Files\uusee\skins\UUPlayer\Ctrl_CheckBox_C3.bmp C:\Program Files\uusee\skins\UUPlayer\Ctrl_CheckBox_C4.bmp C:\Program Files\uusee\skins\UUPlayer\Ctrl_ComboBox_1.bmp C:\Program Files\uusee\skins\UUPlayer\Ctrl_ComboBox_2.bmp C:\Program Files\uusee\skins\UUPlayer\Ctrl_ComboBox_3.bmp C:\Program Files\uusee\skins\UUPlayer\Ctrl_ComboBox_4.bmp C:\Program Files\uusee\skins\UUPlayer\Ctrl_Edit_1.bmp C:\Program Files\uusee\skins\UUPlayer\Ctrl_Edit_4.bmp C:\Program Files\uusee\skins\UUPlayer\Ctrl_PushButton_1.bmp C:\Program Files\uusee\skins\UUPlayer\Ctrl_PushButton_2.bmp C:\Program Files\uusee\skins\UUPlayer\Ctrl_PushButton_3.bmp C:\Program Files\uusee\skins\UUPlayer\Ctrl_PushButton_4.bmp C:\Program Files\uusee\skins\UUPlayer\Ctrl_RadioButton_1.bmp C:\Program Files\uusee\skins\UUPlayer\Ctrl_RadioButton_2.bmp C:\Program Files\uusee\skins\UUPlayer\Ctrl_RadioButton_3.bmp C:\Program Files\uusee\skins\UUPlayer\Ctrl_RadioButton_4.bmp C:\Program Files\uusee\skins\UUPlayer\Ctrl_RadioButton_C1.bmp C:\Program Files\uusee\skins\UUPlayer\Ctrl_RadioButton_C2.bmp C:\Program Files\uusee\skins\UUPlayer\Ctrl_RadioButton_C3.bmp C:\Program Files\uusee\skins\UUPlayer\Ctrl_RadioButton_C4.bmp C:\Program Files\uusee\skins\UUPlayer\Dlg_Back.bmp C:\Program Files\uusee\skins\UUPlayer\Dlg_Detect.bmp C:\Program Files\uusee\skins\UUPlayer\Dlg_Frame_1.bmp C:\Program Files\uusee\skins\UUPlayer\Dlg_Frame_2.bmp C:\Program Files\uusee\skins\UUPlayer\Dlg_Frame_3.bmp C:\Program Files\uusee\skins\UUPlayer\Dlg_Record_Task_1.bmp C:\Program Files\uusee\skins\UUPlayer\Icon_Information.bmp C:\Program Files\uusee\skins\UUPlayer\Icon_Question.bmp C:\Program Files\uusee\skins\UUPlayer\Icon_Stop.bmp C:\Program Files\uusee\skins\UUPlayer\ListHeader_1.bmp C:\Program Files\uusee\skins\UUPlayer\ListHeader_2.bmp C:\Program Files\uusee\skins\UUPlayer\ListHeader_3.bmp C:\Program Files\uusee\skins\UUPlayer\ListHeader_ArrowD.bmp C:\Program Files\uusee\skins\UUPlayer\ListHeader_ArrowU.bmp C:\Program Files\uusee\skins\UUPlayer\ListHeader_SP.bmp C:\Program Files\uusee\skins\UUPlayer\Play_Window_Rec_icon.bmp C:\Program Files\uusee\skins\UUPlayer\Progressbar_Block_1.bmp C:\Program Files\uusee\skins\UUPlayer\Progressbar_Block_2.bmp C:\Program Files\uusee\skins\UUPlayer\Progressbar_Block_3.bmp C:\Program Files\uusee\skins\UUPlayer\Progressbar_Block_4.bmp C:\Program Files\uusee\skins\UUPlayer\Resource.h C:\Program Files\uusee\skins\UUPlayer\Setting_Group_1_1.bmp C:\Program Files\uusee\skins\UUPlayer\Setting_Group_1_2.bmp C:\Program Files\uusee\skins\UUPlayer\Setting_Group_1_3.bmp C:\Program Files\uusee\skins\UUPlayer\Setting_Group_2_1.bmp C:\Program Files\uusee\skins\UUPlayer\Setting_Group_2_2.bmp C:\Program Files\uusee\skins\UUPlayer\Setting_Group_2_3.bmp C:\Program Files\uusee\skins\UUPlayer\Setting_Group_3_1.bmp C:\Program Files\uusee\skins\UUPlayer\Setting_Group_3_2.bmp C:\Program Files\uusee\skins\UUPlayer\Setting_Group_3_3.bmp C:\Program Files\uusee\skins\UUPlayer\Sidebar_Button_1_1.bmp C:\Program Files\uusee\skins\UUPlayer\Sidebar_Button_1_2.bmp C:\Program Files\uusee\skins\UUPlayer\Sidebar_Button_1_3.bmp C:\Program Files\uusee\skins\UUPlayer\Sidebar_Group_1.bmp C:\Program Files\uusee\skins\UUPlayer\Sidebar_Group_2.bmp C:\Program Files\uusee\skins\UUPlayer\Sidebar_Group_3.bmp C:\Program Files\uusee\skins\UUPlayer\Sidebar_Group_x1.bmp C:\Program Files\uusee\skins\UUPlayer\Sidebar_Group_x2.bmp C:\Program Files\uusee\skins\UUPlayer\Sidebar_Group_x3.bmp C:\Program Files\uusee\skins\UUPlayer\Titlebar_button_Res_1.bmp C:\Program Files\uusee\skins\UUPlayer\Titlebar_button_Res_2.bmp C:\Program Files\uusee\skins\UUPlayer\Titlebar_button_Res_3.bmp C:\Program Files\uusee\skins\UUPlayer\Toolbar_Button_Compact_1.bmp C:\Program Files\uusee\skins\UUPlayer\Toolbar_Button_Compact_2.bmp C:\Program Files\uusee\skins\UUPlayer\Toolbar_Button_Compact_3.bmp C:\Program Files\uusee\skins\UUPlayer\Toolbar_Button_FullScreen_1.bmp C:\Program Files\uusee\skins\UUPlayer\Toolbar_Button_FullScreen_2.bmp C:\Program Files\uusee\skins\UUPlayer\Toolbar_Button_FullScreen_3.bmp C:\Program Files\uusee\skins\UUPlayer\Toolbar_Button_TopMost_1.bmp C:\Program Files\uusee\skins\UUPlayer\Toolbar_Button_TopMost_2.bmp C:\Program Files\uusee\skins\UUPlayer\Toolbar_Button_TopMost_3.bmp C:\Program Files\uusee\skins\UUPlayer\TopTab_Browse.bmp C:\Program Files\uusee\skins\UUPlayer\TopTab_Browse1.bmp C:\Program Files\uusee\skins\UUPlayer\TopTab_Play.bmp C:\Program Files\uusee\skins\UUPlayer\TopTab_Play1.bmp C:\Program Files\uusee\skins\UUPlayer\TopTab_Record.bmp C:\Program Files\uusee\skins\UUPlayer\TopTab_Record1.bmp C:\Program Files\uusee\skins\UUPlayer\Tree_Arrow.bmp C:\Program Files\uusee\skins\UUPlayer\Tree_Collapse.bmp C:\Program Files\uusee\skins\UUPlayer\Tree_Expand.bmp C:\Program Files\uusee\skins\UUPlayer\Tree_Header.bmp C:\Program Files\uusee\skins\UUPlayer\Tree_ScrollBar_D.bmp C:\Program Files\uusee\skins\UUPlayer\Tree_ScrollBar_H.bmp C:\Program Files\uusee\skins\UUPlayer\Tree_ScrollBar_N.bmp C:\Program Files\uusee\skins\UUPlayer\Tree_ScrollBar_S.bmp C:\Program Files\uusee\skins\UUPlayer\Tree_ScrollBarThumb_D.bmp C:\Program Files\uusee\skins\UUPlayer\Tree_ScrollBarThumb_H.bmp C:\Program Files\uusee\skins\UUPlayer\Tree_ScrollBarThumb_N.bmp C:\Program Files\uusee\skins\UUPlayer\Tree_ScrollBarThumb_S.bmp C:\Program Files\uusee\skins\UUPlayer\Tree_SortIconDown.bmp C:\Program Files\uusee\skins\UUPlayer\Tree_SortIconUp.bmp C:\Program Files\uusee\skins\UUPlayer\UUSEE.ui C:\Program Files\uusee\skins\UUPlayer\Volume_Bar_Block_1.bmp C:\Program Files\uusee\skins\UUPlayer\Volume_Bar_Block_2.bmp C:\Program Files\uusee\skins\UUPlayer\Volume_Bar_Block_3.bmp C:\Program Files\uusee\skins\UUPlayer\Volume_Button_2_1.bmp C:\Program Files\uusee\skins\UUPlayer\Volume_Button_2_2.bmp C:\Program Files\uusee\skins\UUPlayer\Volume_Button_2_3.bmp C:\Program Files\uusee\skins\UUPlayer\Wnd_Browser_1.bmp C:\Program Files\uusee\skins\UUPlayer\Wnd_Browser_2.bmp C:\Program Files\uusee\skins\UUPlayer\Wnd_Browser_3.bmp C:\Program Files\uusee\skins\UUPlayer\Wnd_ChannelInfo.bmp C:\Program Files\uusee\skins\UUPlayer\Wnd_ChannelInfo_5.bmp C:\Program Files\uusee\skins\UUPlayer\Wnd_Control_1.bmp C:\Program Files\uusee\skins\UUPlayer\Wnd_Control_2.bmp C:\Program Files\uusee\skins\UUPlayer\Wnd_Control_3.bmp C:\Program Files\uusee\skins\UUPlayer\Wnd_Control_4.bmp C:\Program Files\uusee\skins\UUPlayer\Wnd_Main_1.bmp C:\Program Files\uusee\skins\UUPlayer\Wnd_Main_2.bmp C:\Program Files\uusee\skins\UUPlayer\Wnd_Main_3.bmp C:\Program Files\uusee\skins\UUPlayer\Wnd_Main_5.bmp C:\Program Files\uusee\skins\UUPlayer\Wnd_Play_1.bmp C:\Program Files\uusee\skins\UUPlayer\Wnd_Record_1.bmp C:\Program Files\uusee\skins\UUPlayer\Wnd_Record_2.bmp C:\Program Files\uusee\skins\UUPlayer\Wnd_Record_3.bmp C:\Program Files\uusee\skins\UUPlayer\Wnd_Record_4.bmp C:\Program Files\uusee\skins\UUPlayer\Wnd_Setting_1.bmp C:\Program Files\uusee\skins\UUPlayer\Wnd_Setting_2.bmp C:\Program Files\uusee\skins\UUPlayer\Wnd_Setting_3.bmp C:\Program Files\uusee\skins\UUPlayer\Wnd_Side_1.bmp C:\Program Files\uusee\skins\UUPlayer\Wnd_Side_2.bmp C:\Program Files\uusee\skins\UUPlayer\Wnd_Side_3.bmp C:\Program Files\uusee\skins\UUPlayer\Wnd_Toolbar_1.bmp C:\Program Files\uusee\skins\UUPlayer\Wnd_Toolbar_2.bmp C:\Program Files\uusee\skins\UUPlayer\Wnd_Toolbar_3.bmp C:\Program Files\uusee\skins\UUPlayer\Wnd_Toolbar_4.bmp C:\Program Files\uusee\skins\UUPlayer\Wnd_Top_1.bmp C:\Program Files\uusee\skins\UUPlayer\Wnd_Top_2.bmp C:\Program Files\uusee\skins\UUPlayer\Wnd_Top_3.bmp C:\Program Files\uusee\u264Dec.ax C:\Program Files\uusee\UFDeMux.ax C:\Program Files\uusee\uninst.exe C:\Program Files\uusee\updateC2.inf C:\Program Files\uusee\updateC2.ocx C:\Program Files\uusee\UUPlayer.dll C:\Program Files\uusee\UUPlayer.ocx C:\Program Files\uusee\UUPlayer_update.ini C:\Program Files\uusee\UUSee.url C:\Program Files\uusee\uusee_video.dll C:\Program Files\uusee\UUSEEAudioDec.ax C:\Program Files\uusee\UUSeePlayer.exe C:\Program Files\uusee\UUUpgrade.exe C:\Program Files\uusee\UUUpgrade.ini C:\Program Files\uusee\UUUpgrade.ocx C:\Program Files\uusee\vermini.ini C:\Program Files\uusee\vermini_x.ini C:\Program Files\uusee\vermini_x1.ini C:\Program Files\uusee\What's new.txt C:\WINDOWS\mcroso~1 C:\WINDOWS\sosuo.col C:\WINDOWS\system32\f3PSSavr.scr C:\WINDOWS\system32\iexp_log.txt C:\WINDOWS\system32\mdm.exe C:\WINDOWS\system32\wnsintisv32.exe C:\WINDOWS\system32\xunleibho_v8.dll . ((((((((((((((((((((((((((((((((((((((( Drivers/Services ))))))))))))))))))))))))))))))))))))))))))))))))) . -------\Legacy_BDGUARD -------\Legacy_CLIENT_IP-IPX (((((((((((((((((((((((((((( 2008-07-17 - 2008-08-17 之間建立的檔案 ))))))))))))))))))))))))))))))))) . 2008-08-09 20:40 . 2008-08-09 20:40 d-------- C:\WINDOWS\ServicePackFiles 2008-08-09 20:38 . 2004-07-17 11:40 19,528 --a------ C:\WINDOWS\[u]0[/u]00001_.tmp 2008-08-09 16:57 . 2008-08-09 17:22 96,976 --a------ C:\WINDOWS\system32\drivers\klin.dat 2008-08-09 16:57 . 2008-08-09 17:22 87,855 --a------ C:\WINDOWS\system32\drivers\klick.dat 2008-08-09 16:56 . 2008-08-09 16:56 d-------- C:\Program Files\Kaspersky Lab 2008-08-09 16:56 . 2008-08-17 12:41 d-------- C:\Documents and Settings\All Users\Application Data\Kaspersky Lab 2008-08-09 16:56 . 2008-08-17 13:42 3,050,016 --ahs---- C:\WINDOWS\system32\drivers\fidbox.dat 2008-08-09 16:56 . 2008-08-17 13:42 573,472 --ahs---- C:\WINDOWS\system32\drivers\fidbox2.dat 2008-08-09 16:56 . 2008-08-17 13:42 27,004 --ahs---- C:\WINDOWS\system32\drivers\fidbox.idx 2008-08-09 16:56 . 2008-08-17 13:42 5,136 --ahs---- C:\WINDOWS\system32\drivers\fidbox2.idx 2008-08-09 16:51 . 2008-08-09 16:51 d-------- C:\Documents and Settings\All Users\Application Data\Kaspersky Lab Setup Files 2008-08-01 16:33 . 2008-08-07 19:39 d-------- C:\Program Files\wayi 2008-07-26 13:25 . 2008-07-26 14:55 d-------- C:\Program Files\Webshots 2008-07-26 13:25 . 2008-07-26 13:25 d-------- C:\Documents and Settings\hoyin\Application Data\Webshots 2008-07-19 18:55 . 2008-08-01 16:33 d-------- C:\Documents and Settings\hoyin\Application Data\BitTorrent 2008-07-19 18:54 . 2008-07-19 18:55 d-------- C:\Program Files\BitTorrent . (((((((((((((((((((((((((((((((((((( 近三個月內更動的檔案 ))))))))))))))))))))))))))))))))))))))))))))))) . 2008-08-17 05:41 --------- d-----w C:\Documents and Settings\hoyin\Application Data\DNA 2008-08-17 04:23 --------- d-----w C:\Program Files\Windows Media Connect 2 2008-08-16 10:19 --------- d-----w C:\Program Files\Ace Zip 2008-08-15 09:53 --------- d-----w C:\Program Files\Windows Live Safety Center 2008-08-07 11:39 --------- d--h--w C:\Program Files\InstallShield Installation Information 2008-07-19 04:29 --------- d-----w C:\Program Files\Java 2008-07-19 04:27 --------- d-----w C:\Program Files\Valve 2008-07-09 14:55 33,824 ----a-w C:\WINDOWS\system32\drivers\oreans32.sys 2008-07-07 20:30 253,952 ----a-w C:\WINDOWS\system32\es.dll 2008-07-06 14:36 724,992 ----a-w C:\WINDOWS\iun6002.exe 2008-07-01 13:39 2,576 ----a-w C:\WINDOWS\system32\PerfStringBackup.TMP 2008-06-25 11:15 --------- d-----w C:\Program Files\urgame 2008-06-24 16:22 74,240 ----a-w C:\WINDOWS\system32\mscms.dll 2008-06-24 09:17 206,088 ----a-w C:\WINDOWS\system32\klogon.dll 2008-06-24 09:16 24,774 ----a-w C:\WINDOWS\system32\drivers\klopp.dat 2008-06-23 16:15 826,368 ----a-w C:\WINDOWS\system32\wininet.dll 2008-06-21 08:43 --------- d-----w C:\Program Files\MSECache 2008-06-20 17:39 240,640 ----a-w C:\WINDOWS\system32\mswsock.dll 2008-06-20 10:45 360,320 ----a-w C:\WINDOWS\system32\drivers\tcpip.sys 2008-06-20 10:44 138,368 ----a-w C:\WINDOWS\system32\drivers\afd.sys 2008-06-20 09:52 225,920 ----a-w C:\WINDOWS\system32\drivers\tcpip6.sys 2008-03-09 11:45 2,660,962 ----a-w C:\Program Files\ttpsetup_cht.exe . ------- Sigcheck ------- 2006-04-20 20:18 360576 b2220c618b42a2212a59d91ebd6fc4b4 C:\WINDOWS\$hf_mig$\KB917953\SP2QFE\tcpip.sys 2007-10-31 00:53 360832 64798ecfa43d78c7178375fcdd16d8c8 C:\WINDOWS\$hf_mig$\KB941644\SP2QFE\tcpip.sys 2008-06-20 18:44 360960 744e57c99232201ae98c49168b918f48 C:\WINDOWS\$hf_mig$\KB951748\SP2QFE\tcpip.sys 2008-06-20 19:51 361600 9aefa14bd6b182d61e3119fa5f436d3d C:\WINDOWS\$hf_mig$\KB951748\SP3GDR\tcpip.sys 2008-06-20 19:59 361600 ad978a1b783b5719720cff204b666c8e C:\WINDOWS\$hf_mig$\KB951748\SP3QFE\tcpip.sys 2004-08-03 23:14 359040 9f4b36614a0fc234525ba224957de55c C:\WINDOWS\$NtUninstallKB917953$\tcpip.sys 2006-04-20 19:51 359808 b4e29943b4b04bd5e7381546848e6669 C:\WINDOWS\$NtUninstallKB941644$\tcpip.sys 2007-10-31 01:20 360064 ed06c31200714e734118f9a47f5df5ce C:\WINDOWS\$NtUninstallKB951748$\tcpip.sys 2004-08-03 23:14 359040 9f4b36614a0fc234525ba224957de55c C:\WINDOWS\ServicePackFiles\i386\tcpip.sys 2008-06-20 18:45 360320 2a5554fc5b1e04e131230e3ce035c3f9 C:\WINDOWS\system32\dllcache\tcpip.sys 2008-06-20 18:45 360320 073941d59ae065910064b728dee981ee C:\WINDOWS\system32\drivers\tcpip.sys . (((((((((((((((((((((((((((((((((((((((((( 重要登錄檔 ))))))))))))))))))))))))))))))))))))))))))))))))))))) . . REGEDIT4 *注意* 空白或合法的登錄值將不會顯示 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 00:47 15360] "NBJ"="C:\Program Files\Ahead\Nero BackItUp\NBJ.exe" [2004-07-26 19:14 1867776] "MsnMsgr"="C:\Program Files\MSN Messenger\MsnMsgr.Exe" [2007-01-19 12:55 5674352] "foxy"="C:\Program Files\Foxy\Foxy.exe" [2008-05-29 19:37 1160704] "BitTorrent DNA"="C:\Program Files\DNA\btdna.exe" [2008-06-09 18:06 289088] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "IMJPMIG8.1"="C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" [2004-08-03 22:32 208952] "SoundMAXPnP"="C:\Program Files\Analog Devices\Core\smax4pnp.exe" [2005-07-09 07:10 925696] "NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2005-12-14 14:51 7323648] "NvMediaCenter"="C:\WINDOWS\system32\NvMcTray.dll" [2005-12-14 14:51 86016] "NeroFilterCheck"="C:\WINDOWS\system32\NeroCheck.exe" [2001-07-09 11:50 155648] "TkBellExe"="C:\Program Files\Common Files\Real\Update_OB\realsched.exe" [2007-02-20 15:45 185896] "Sony Ericsson PC Suite"="C:\Program Files\Sony Ericsson\Mobile2\Application Launcher\Application Launcher.exe" [2005-10-26 17:17 159744] "CJIMETIPSYNC"="C:\Program Files\Common Files\Microsoft Shared\IME\IMTC65\CHANGJIE\CINTLCFG.EXE" [2007-03-22 19:17 66400] "PHIMETIPSYNC"="C:\Program Files\Common Files\Microsoft Shared\IME\IMTC65\PHONETIC\TINTLCFG.EXE" [2007-03-22 19:17 98656] "SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe" [2008-02-22 04:25 144784] "AVP"="C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2009\avp.exe" [2008-06-24 17:16 201992] "High Definition Audio Property Page Shortcut"="HDAShCut.exe" [2004-10-27 15:21 61952 C:\WINDOWS\system32\HdAShCut.exe] "nwiz"="nwiz.exe" [2005-12-14 14:51 1519616 C:\WINDOWS\system32\nwiz.exe] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] "ctfmon.exe"="C:\WINDOWS\system32\CTFMON.EXE" [2004-08-04 00:47 15360] C:\Documents and Settings\All Users\「開始」功能表\程式集\啟動\ Adobe Gamma Loader.lnk - C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [2007-06-10 00:24:53 113664] [HKEY_LOCAL_MACHINE\software\microsoft\security center] "AntiVirusDisableNotify"=dword:00000001 "UpdatesDisableNotify"=dword:00000001 "FirewallOverride"=dword:00000001 [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\KasperskyAntiVirus] "DisableMonitoring"=dword:00000001 [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile] "EnableFirewall"= 0 (0x0) [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "%windir%\\system32\\sessmgr.exe"= "D:\\aoc\\AOC10.exe"= "C:\\WINDOWS\\system32\\dplaysvr.exe"= "C:\\Program Files\\Foxy\\Foxy.exe"= "C:\\Program Files\\FlashGet\\flashget.exe"= "C:\\Program Files\\MSN Messenger\\msnmsgr.exe"= "C:\\Program Files\\MSN Messenger\\livecall.exe"= "C:\\Program Files\\TVAnts\\Tvants.exe"= "%windir%\\Network Diagnostic\\xpnetdiag.exe"= "C:\\Program Files\\DNA\\btdna.exe"= "C:\\Program Files\\BitTorrent\\bittorrent.exe"= "C:\\Documents and Settings\\hoyin\\桌面\\GoalConnector 1.5.2\\GoalConnector\\GoalConnector.exe"= "C:\\Documents and Settings\\hoyin\\桌面\\GoalConnector 1.5.2\\GoalConnector\\Lib\\server.exe"= "C:\\Program Files\\KONAMI\\Winning Eleven 8I\\WE8.exe"= "C:\\Documents and Settings\\All Users\\Application Data\\Kaspersky Lab Setup Files\\Kaspersky Internet Security 8.0.0.358\\TradChinese\\setup.exe"= [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List] "7831:TCP"= 7831:TCP:Foxy (192.168.1.100:7831) 7831 TCP "7831:UDP"= 7831:UDP:Foxy (192.168.1.100:7831) 7831 UDP R0 klbg;Kaspersky Lab Boot Guard Driver;C:\WINDOWS\system32\drivers\klbg.sys [2008-01-29 18:29] R1 oreans32;oreans32;C:\WINDOWS\system32\drivers\oreans32.sys [2008-07-09 22:55] R3 IPvE;IPvE Adapter Driver;C:\WINDOWS\system32\DRIVERS\IPvE.sys [2008-06-17 01:16] R3 KLFLTDEV;Kaspersky Lab KLFltDev;C:\WINDOWS\system32\DRIVERS\klfltdev.sys [2008-03-13 19:02] R3 klim5;Kaspersky Anti-Virus NDIS Filter;C:\WINDOWS\system32\DRIVERS\klim5.sys [2008-03-25 20:07] S2 Windows_XP;Windows_XP;C:\Program Files\Common Files\Microsoft Shared\MSINFO\Backup.exe [] [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{bb4c8f2a-ecc9-11db-80a0-001731552f07}] \Shell\Auto\command - H:\Backup.exe \Shell\AutoRun\command - C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL Backup.exe . 排程工作資料夾的內容 2008-08-17 C:\WINDOWS\Tasks\查看 Windows Live Toolbar 的更新資訊.job - C:\Program Files\Windows Live Toolbar\MMSNTBUP.EXE [2007-10-19 11:20] . - - - - ORPHANS REMOVED - - - - WebBrowser-{89FDCC4B-8D91-49B0-81A6-18BCFF582735} - (no file) HKLM-Run-Thunder - C:\Program Files\Thunder Network\Thunder\ThunderShell.exe HKCU-Explorer_Run-{A8870664-0AFA-1028-0509-060512060376} - C:\Program Files\Common Files\{A8870664-0AFA-1028-0509-060512060376}\Update.exe HKU-Default-Explorer_Run-{A8870664-0AFA-1028-0509-060512060376} - C:\Program Files\Common Files\{A8870664-0AFA-1028-0509-060512060376}\Update.exe HKU-Default-Explorer_Run-{A8870664-0AF9-1028-0509-060512060376} - C:\Program Files\Common Files\{A8870664-0AF9-1028-0509-060512060376}\Update.exe . ------- Supplementary Scan ------- . FireFox -: Profile - C:\Documents and Settings\hoyin\Application Data\Mozilla\Firefox\Profiles\cz01e4mv.default\ FireFox -: prefs.js - SEARCH.DEFAULTURL - hxxp://www.google.com/search?lr=&ie=UTF-8&oe=UTF-8&q= ************************************************************************** catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2008-08-17 13:45:08 Windows 5.1.2600 Service Pack 2 NTFS 掃描隱藏的程序... 掃描隱藏的進程... 掃描隱藏的檔案... 掃描完成 隱藏檔案: 0 ************************************************************************** . ------------------------ Other Running Prrocesses ------------------------ . C:\WINDOWS\system32\conime.exe C:\WINDOWS\system32\nvsvc32.exe C:\WINDOWS\system32\rundll32.exe C:\Program Files\Common Files\Teleca Shared\CapabilityManager.exe C:\Program Files\Common Files\Teleca Shared\Generic.exe C:\Program Files\Sony Ericsson\Mobile2\Mobile Phone Monitor\epmworker.exe C:\WINDOWS\system32\verclsid.exe . ************************************************************************** . 完成時間: 2008-08-17 13:49:59 - machine was rebooted ComboFix-quarantined-files.txt 2008-08-17 05:49:50 Pre-Run: 18,498,297,856 位元組可用 Post-Run: 32,132,255,744 位元組可用 457 --- E O F --- 2008-08-14 08:51:37