Once I open a browser (no matter it's IE or Firefox), advertisements keep popping up in a separate windows. I also find some suspecious DLL loaded into the Startup script. I run "msconfig", open the Startup tab, and disable those suspicious items. They are enabled again after reboot. I use the Registrar Registry Manager to find the DLLs and tried to delete them. They come back after reboot.
Suspicious items:
monelare.dll
pasagami.dll
dilifori.dll
saharajimu
Here is the HJT log:
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 9:21:11 PM, on 2/27/2009
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16762)
Boot mode: Normal
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Symantec AntiVirus\DefWatch.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Common Files\LightScribe\LSSrvc.exe
C:\Program Files\Common Files\Motive\McciCMService.exe
C:\Program Files\Symantec AntiVirus\SavRoam.exe
C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Symantec AntiVirus\Rtvscan.exe
C:\WINDOWS\system32\Tablet.exe
C:\Program Files\Hewlett-Packard\Shared\hpqwmiex.exe
C:\Program Files\Canon\CAL\CALMAIN.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\system32\spool\drivers\w32x86\3\WrtMon.exe
C:\PROGRA~1\SYMANT~1\VPTray.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\Program Files\Analog Devices\SoundMAX\SMax4PNP.exe
C:\Program Files\Analog Devices\SoundMAX\Smax4.exe
C:\WINDOWS\system32\spool\drivers\w32x86\3\WrtProc.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\ScanSoft\OmniPageSE4.0\OpwareSE4.exe
C:\WINDOWS\system32\kmw_run.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe
C:\Program Files\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe
C:\Program Files\Hp\HP Software Update\HPWuSchd2.exe
C:\WINDOWS\system32\hkcmd.exe
C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_S0HIC1.EXE
C:\Program Files\HPQ\Quick Launch Buttons\EabServr.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\Program Files\Apoint2K\Apoint.exe
C:\WINDOWS\AGRSMMSG.exe
C:\WINDOWS\system32\rundll32.exe
C:\Program Files\Creative\MediaSource\Detector\CTDetect.exe
C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_S0HIC1.EXE
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\Apoint2K\Apntex.exe
C:\WINDOWS\system32\conime.exe
C:\Documents and Settings\Dad\Local Settings\Application Data\Google\Update\GoogleUpdate.exe
C:\Program Files\Common Files\Microsoft Shared\Works Shared\WkCalRem.exe
C:\Program Files\Hewlett-Packard\Shared\HpqToaster.exe
C:\Program Files\OpenOffice.org 2.4\program\soffice.exe
C:\Program Files\OpenOffice.org 2.4\program\soffice.BIN
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll (file missing)
O2 - BHO: Yahoo! IE Services Button - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll
O2 - BHO: EWPBrowseObject Class - {68F9551E-0411-48E4-9AAF-4BC42A6A46BE} - C:\Program Files\Canon\Easy-WebPrint\EWPBrowseLoader.dll
O2 - BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar3.dll
O2 - BHO: {9cec3fdb-b203-731a-daa4-59225d4a94ba} - {ab49a4d5-2295-4aad-a137-302bbdf3cec9} - C:\WINDOWS\system32\szbhny.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\3.1.807.1746\swg.dll
O2 - BHO: Windows Live Toolbar Helper - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
O2 - BHO: (no name) - {c51aa117-8dc6-48f3-934a-0c3a2a1c37de} - C:\WINDOWS\system32\bekoduya.dll (file missing)
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O2 - BHO: (no name) - {fe17851f-d6b3-4782-bd07-0694a8090459} - C:\WINDOWS\system32\wuyojogi.dll
O2 - BHO: (no name) - {FFFFFEF0-5B30-21D4-945D-000000000000} - C:\PROGRA~1\STARDO~1\SDIEInt.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar3.dll
O3 - Toolbar: Easy-WebPrint - {327C2873-E90D-4c37-AA9D-10AC9BABA46C} - C:\Program Files\Canon\Easy-WebPrint\Toolband.dll
O3 - Toolbar: Windows Live Toolbar - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
O4 - HKLM\..\Run: [MSConfig] C:\WINDOWS\PCHealth\HelpCtr\Binaries\MSConfig.exe /auto
O4 - HKLM\..\Run: [WrtMon.exe] C:\WINDOWS\system32\spool\drivers\w32x86\3\WrtMon.exe
O4 - HKLM\..\Run: [WatchDog] C:\Program Files\InterVideo\DVD Check\DVDCheck.exe
O4 - HKLM\..\Run: [vptray] C:\PROGRA~1\SYMANT~1\VPTray.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKLM\..\Run: [SSBkgdUpdate] "C:\Program Files\Common Files\Scansoft Shared\SSBkgdUpdate\SSBkgdupdate.exe" -Embedding -boot
O4 - HKLM\..\Run: [SoundMAXPnP] C:\Program Files\Analog Devices\SoundMAX\SMax4PNP.exe
O4 - HKLM\..\Run: [SoundMAX] "C:\Program Files\Analog Devices\SoundMAX\Smax4.exe" /tray
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [OpwareSE4] "C:\Program Files\ScanSoft\OmniPageSE4.0\OpwareSE4.exe"
O4 - HKLM\..\Run: [LSBWatcher] c:\hp\drivers\hplsbwatcher\lsburnwatcher.exe
O4 - HKLM\..\Run: [kmw_run.exe] kmw_run.exe
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [ISUSScheduler] "C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" -start
O4 - HKLM\..\Run: [ISUSPM Startup] C:\PROGRA~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe -startup
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [hpWirelessAssistant] C:\Program Files\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\Hp\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [EPSON Stylus C82 Series] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_S0HIC1.EXE /P23 "EPSON Stylus C82 Series" /O6 "USB001" /M "Stylus C82"
O4 - HKLM\..\Run: [eabconfg.cpl] C:\Program Files\HPQ\Quick Launch Buttons\EabServr.exe /Start
O4 - HKLM\..\Run: [Cpqset] C:\Program Files\HPQ\Default Settings\cpqset.exe
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [Apoint] C:\Program Files\Apoint2K\Apoint.exe
O4 - HKLM\..\Run: [AGRSMMSG] AGRSMMSG.exe
O4 - HKLM\..\Run: [CPM02a6aee7] Rundll32.exe "c:\windows\system32\monelare.dll",a
O4 - HKLM\..\Run: [saharajimu] Rundll32.exe "C:\WINDOWS\system32\pasagami.dll",s
O4 - HKLM\..\Run: [01959d7b] rundll32.exe "C:\WINDOWS\system32\dilifori.dll",b
O4 - HKCU\..\Run: [Creative Detector] C:\Program Files\Creative\MediaSource\Detector\CTDetect.exe /R
O4 - HKCU\..\Run: [EPSON Stylus C82 Series] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_S0HIC1.EXE /P23 "EPSON Stylus C82 Series" /M "Stylus C82" /EF "HKCU"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [Google Update] "C:\Documents and Settings\Dad\Local Settings\Application Data\Google\Update\GoogleUpdate.exe" /c
O4 - HKCU\..\Run: [DAEMON Tools Lite] "C:\Program Files\DAEMON Tools Lite\daemon.exe" -autorun
O4 - HKUS\S-1-5-18\..\Run: [saharajimu] Rundll32.exe "C:\WINDOWS\system32\pasagami.dll",s (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [saharajimu] Rundll32.exe "C:\WINDOWS\system32\pasagami.dll",s (User 'Default user')
O4 - Startup: ERUNT AutoBackup.lnk = C:\Program Files\ERUNT\AUTOBACK.EXE
O4 - Startup: OpenOffice.org 2.4.lnk = C:\Program Files\OpenOffice.org 2.4\program\quickstart.exe
O4 - Startup: wkcalrem.LNK = C:\Program Files\Common Files\Microsoft Shared\Works Shared\WkCalRem.exe
O4 - Global Startup: DVD Check.lnk = C:\Program Files\InterVideo\DVD Check\DVDCheck.exe
O8 - Extra context menu item: &Google Search - res://c:\program files\google\GoogleToolbar1.dll/cmsearch.html
O8 - Extra context menu item: &Translate English Word - res://c:\program files\google\GoogleToolbar1.dll/cmwordtrans.html
O8 - Extra context menu item: &Windows Live Search - res://C:\Program Files\Windows Live Toolbar\msntb.dll/search.htm
O8 - Extra context menu item: Backward Links - res://c:\program files\google\GoogleToolbar1.dll/cmbacklinks.html
O8 - Extra context menu item: Cached Snapshot of Page - res://c:\program files\google\GoogleToolbar1.dll/cmcache.html
O8 - Extra context menu item: Download with Star Downloader - C:\Program Files\Star Downloader\sdie.htm
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~4\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: Similar Pages - res://c:\program files\google\GoogleToolbar1.dll/cmsimilar.html
O8 - Extra context menu item: Translate Page into English - res://c:\program files\google\GoogleToolbar1.dll/cmtrans.html
O9 - Extra button: Yahoo! Services - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~4\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: FreshDownload - {F2C3214F-043E-4F1D-B727-3DEB78AA0974} - C:\Program Files\FreshDevices\FreshDownload\fd.exe (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O14 - IERESET.INF: START_PAGE_URL=http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=EN_US&c=Q405&bd=pavilion&pf=laptop
O15 - Trusted Zone: http://free.aol.com
O15 - ESC Trusted Zone: http://*.update.microsoft.com
O16 - DPF: {0006F063-0000-0000-C000-000000000046} (Microsoft Office Outlook View Control) - http://activex.microsoft.com/activex/controls/office/outlctlx.CAB
O16 - DPF: {00D9C306-6B11-492A-9AFC-C53CE30849CF} (Siebel SmartScript) - file:///C:/Siebel/7.8/Client/PUBLIC/enu/19213/applets/SiebelAx_Smartscript.cab
O16 - DPF: {05D44720-58E3-49E6-BDF6-D00330E511D3} (StagingUI Object) - http://zone.msn.com/binFrameWork/v10/StagingUI.cab53083.cab
O16 - DPF: {06314967-EECF-11D2-9D64-0000949887BE} (Siebel ERM eBriefings Offline Content Synchronization Control) - file:///C:/Siebel/7.8/dclient/PUBLIC/enu/19213/applets/SiebelAx_ERM_ContentSync.cab
O16 - DPF: {0D68687A-A2A3-46EB-9ED9-956C83875A6C} (Siebel Marketing HTML Editor) - file:///C:/Siebel/7.8/dclient/PUBLIC/enu/19213/applets/SiebelAx_Marketing_HTML_Editor.cab
O16 - DPF: {10093E98-C073-4C75-8D0E-FB5CD3A71D33} (ZoneUpwords Object) - http://messenger.zone.msn.com/binary/Upwords.cab31267.cab
O16 - DPF: {14B87622-7E19-4EA8-93B3-97215F77A6BC} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab31267.cab
O16 - DPF: {169ADD4B-EE8B-4B27-B332-2941A82DA7E2} (Siebel Microsite Layout Designer) - file:///C:/Siebel/7.8/dclient/PUBLIC/enu/19213/applets/SiebelAx_Microsite_Layout.cab
O16 - DPF: {16C7BBB7-738A-47D7-956E-52DD9A166A9A} (Siebel Event Calendar) - file:///C:/Siebel/7.8/Client/PUBLIC/enu/19213/applets/SiebelAx_Marketing_Calendar.cab
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=48835
O16 - DPF: {1D922C61-16AB-4179-8302-6B8A688C88D0} (CSSAxContainerCtrl Class) - file:///C:/Siebel/7.8/dclient/PUBLIC/enu/19213/applets/SiebelAx_Container_Control.cab
O16 - DPF: {20A60F0D-9AFA-4515-A0FD-83BD84642501} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab56986.cab
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - C:\Program Files\Yahoo!\Common\yinsthelper.dll
O16 - DPF: {30C1F757-58DC-45A1-9135-D4AB30932E62} (Siebel iHelp) - http://home-laptop1/20405/applets/SiebelAx_iHelp.cab
O16 - DPF: {321FB770-1FBE-4BFE-BDC1-6F622D4FA499} - https://setup.bellsouth.net/wizlet/PWReset/static/controls/WebflowActiveXInstaller_6-1-2.cab
O16 - DPF: {353F130D-72DB-4F14-B750-625F90D75D1B} (Siebel Test Automation) - file:///C:/Siebel/7.8/dclient/PUBLIC/enu/19213/applets/SiebelAx_Test_Automation.cab
O16 - DPF: {3BB54395-5982-4788-8AF4-B5388FFDD0D8} (ZoneBuddy Class) - http://zone.msn.com/BinFrameWork/v10/ZBuddy.cab53083.cab
O16 - DPF: {3DA5D23B-EFE1-4181-ADB7-7D457567AACA} - http://zone.msn.com/bingame/pacz/default/pandaonline.cab
O16 - DPF: {3E8C4740-70C5-439E-AE2F-16234083E248} (Siebel High Interactivity Framework) - file:///C:/Siebel/7.8/Client/PUBLIC/enu/19213/applets/SiebelAx_HI_Client.cab
O16 - DPF: {3FE16C08-D6A7-4133-84FC-D5BFB4F7D886} (WebGameLoader Class) - http://www.shockwave.com/content/ricochetlostworlds/ReflexiveWebGameLoader.cab
O16 - DPF: {48CE1C1F-092D-461C-A385-A0C3D19FE052} (Siebel iHelp) - file:///C:/Siebel/7.8/dclient/PUBLIC/enu/19213/applets/SiebelAx_iHelp.cab
O16 - DPF: {4B9F2C37-C0CF-42BC-BB2D-DCFA8B25CABF} (PopCapLoaderCtrl Class) - http://zone.msn.com/bingame/rock/default/popcaploader1.cab
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://kwokwingkwong.spaces.live.com//PhotoUpload/MsnPUpld.cab
O16 - DPF: {5736C456-EA94-4AAC-BB08-917ABDD035B3} (ZonePAChat Object) - http://zone.msn.com/binframework/v10/ZPAChat.cab53083.cab
O16 - DPF: {5D6F45B3-9043-443D-A792-115447494D24} (UnoCtrl Class) - http://messenger.zone.msn.com/EN-US/a-UNO1/GAME_UNO1.cab
O16 - DPF: {5FCAD8CF-85C1-4FD9-BD04-995CBEBA5BEB} (Siebel Hospitality Gantt Chart) - file:///C:/Siebel/7.8/dclient/PUBLIC/enu/19213/applets/SiebelAx_Hospitality_Gantt.cab
O16 - DPF: {61CE1CA1-6577-49B6-AE2C-43007A942429} (WebcastLogOut.Webcast) - https://webcast.accenture.com/v2/WebcastLog/WebcastInfo.CAB
O16 - DPF: {64D01C7F-810D-446E-A07E-16C764235644} (AtlAtomadersCtlAttrib Class) - http://zone.msn.com/bingame/amad/default/atomaders.cab
O16 - DPF: {73EF83D1-DA75-4F58-8DB6-1CD6D8F9C8A1} (Siebel Calendar) - file:///C:/Siebel/7.8/Client/PUBLIC/enu/19213/applets/SiebelAx_Calendar.cab
O16 - DPF: {756E01C3-2CF9-4364-8724-B8C850CB0D50} (UInboxDynBtn Class) - file:///C:/Siebel/7.8/dclient/PUBLIC/enu/19213/applets/SiebelAx_UInbox.cab
O16 - DPF: {77E32299-629F-43C6-AB77-6A1E6D7663F6} (Groove Control) - http://download.shockwave.com/pub/otoy/OTOYAX.cab
O16 - DPF: {7D731A83-6C80-4EA4-9646-5E06A0513274} (Sandlot Loader Control) - http://www.shockwave.com/content/ballistik/sis/slgwebinstall.cab
O16 - DPF: {7E980B9B-8AE5-466A-B6D6-DA8CF814E78A} (MJLauncherCtrl Class) - http://zone.msn.com/bingame/luxr/default/mjolauncher.cab
O16 - DPF: {7FC1B346-83E6-4774-8D20-1A6B09B0E737} (Windows Live Photo Upload Control) - http://kwokwingkwong.spaces.live.com/PhotoUpload/MsnPUpld.cab
O16 - DPF: {8463A31A-7FB5-4D38-B269-57F4FEFDBB09} (SDData.clsData) - https://mylearning.accenture.com/codebase/SDData.cab
O16 - DPF: {8C244272-1DC1-4CE7-9C6C-FABCA09EB543} (Siebel Desktop Integration) - file:///C:/Siebel/7.8/dclient/PUBLIC/enu/19213/applets/SiebelAx_Desktop_Integration.cab
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsClient.cab31267.cab
O16 - DPF: {9522B3FB-7A2B-4646-8AF6-36E7F593073C} - http://a19.g.akamai.net/7/19/7125/4058/ftp.coupons.com/r3302/Coke/Coupons.cab
O16 - DPF: {96A3E5AB-C228-4D1D-B31F-712BA35EE470} (Siebel Gantt Chart) - file:///C:/Siebel/7.8/Client/PUBLIC/enu/19213/applets/SiebelAx_Gantt_Chart.cab
O16 - DPF: {9BFC2253-B9D9-477E-9488-CA450232620D} (BinAg1 Class) - http://pbells.broadjump.com/wizlet/StandardInstall/static/controls/WebflowActiveXCab.CAB
O16 - DPF: {A07F0AC9-D8AD-449A-BE90-668F5263B261} (Siebel High Interactivity Framework) - http://home-laptop1/20405/applets/SiebelAx_HI_Client.cab
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/MsnMessengerSetupDownloader.cab
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (MSN Games - Installer) - http://messenger.zone.msn.com/binary/ZIntro.cab56649.cab
O16 - DPF: {BD393C14-72AD-4790-A095-76522973D6B8} (CBreakshotControl Class) - http://messenger.zone.msn.com/binary/Bankshot.cab31267.cab
O16 - DPF: {BF17C411-9ADA-4C73-B12C-BD814BDE187F} (ScheduleServices.CtlScheduleServices) - https://mylearning.accenture.com/accenture/core/common/ScheduleServices/ScheduleServices.cab
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
O16 - DPF: {C5FEEC93-506D-4B41-A38B-3A59BF5B41AB} (Siebel Callcenter Communications Toolbar) - file:///C:/Siebel/7.8/Client/PUBLIC/enu/19213/applets/SiebelAx_CTI_Toolbar.cab
O16 - DPF: {C657D5D2-D725-4F0E-91A9-EA74647DCF84} (Siebel Marketing Allocation) - file:///C:/Siebel/7.8/Client/PUBLIC/enu/19213/applets/SiebelAx_Marketing_Allocation.cab
O16 - DPF: {CAC181B0-4D70-402D-B571-C596A47D0CE0} (CBankshotZoneCtrl Class) - http://zone.msn.com/bingame/zpagames/zpa_pool.cab42858.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
O16 - DPF: {D3B8B8A0-4FA3-44EB-86C7-5BEA866CEA57} (SDAICC.clsAICC) - https://mylearning.accenture.com/codebase/SDAICC.cab
O16 - DPF: {D54160C3-DB7B-4534-9B65-190EE4A9C7F7} (SproutLauncherCtrl Class) - http://zone.msn.com/bingame/feed/default/SproutLauncher.cab
O16 - DPF: {D6CC2526-859B-40C0-8515-1A47946478B6} (Siebel Email Support for Microsoft Outlook and Lotus Notes) - file:///C:/Siebel/7.8/Client/PUBLIC/enu/19213/applets/SiebelAx_OutBound_mail.cab
O16 - DPF: {D77EF652-9A6B-40C8-A4B9-1C0697C6CF41} (TikGames Online Control) - http://zone.msn.com/bingame/pacz/default/pandaonline.cab
O16 - DPF: {DA2AA6CF-5C7A-4B71-BC3B-C771BB369937} (StadiumProxy Class) - http://zone.msn.com/binframework/v10/StProxy.cab53852.cab
O16 - DPF: {DA758BB1-5F89-4465-975F-8D7179A4BCF3} (WheelofFortune Object) - http://messenger.zone.msn.com/binary/WoF.cab31267.cab
O16 - DPF: {DC75FEF6-165D-4D25-A518-C8C4BDA7BAA6} (CPlayFirstDinerDashControl Object) - http://zone.msn.com/bingame/dash/default/DinerDash.1.0.0.89.cab
O16 - DPF: {DF780F87-FF2B-4DF8-92D0-73DB16A1543A} (PopCapLoader Object) - http://zone.msn.com/bingame/popcaploader_v10.cab
O16 - DPF: {E06E2E99-0AA1-11D4-ABA6-0060082AA75C} (GpcContainer Class) - https://attwm.webex.com/client/v_mywebex-pso-attwm/webex/ieatgpc.cab
O16 - DPF: {E5D419D6-A846-4514-9FAD-97E826C84822} (HeartbeatCtl Class) - http://fdl.msn.com/zone/datafiles/heartbeat.cab
O16 - DPF: {EFB7D763-97A3-11CF-AE19-00608CEADE00} (CIC Ink Control) - file:///C:/Siebel/7.8/dclient/PUBLIC/enu/19213/applets/iTools.cab
O16 - DPF: {F6BF0D00-0B2A-4A75-BF7B-F385591623AF} (Solitaire Showdown Class) - http://messenger.zone.msn.com/binary/SolitaireShowdown.cab31267.cab
O16 - DPF: {FE507B78-691A-4DAA-BE3D-793C86592506} (SDWAPI.clsWAPI) - https://mylearning.accenture.com/codebase/SDWAPI.cab
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O20 - AppInit_DLLs: c:\windows\system32\monelare.dll,C:\WINDOWS\system32\vafefudo.dll
O21 - SSODL: SSODL - {EC43E3FD-5C60-46a6-97D7-E0B85DBDD6C4} - c:\windows\system32\monelare.dll
O22 - SharedTaskScheduler: STS - {EC43E3FD-5C60-46a6-97D7-E0B85DBDD6C4} - c:\windows\system32\monelare.dll
O23 - Service: Lavasoft Ad-Aware Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
O23 - Service: Apache - Unknown owner - C:\IBM\ISA\httpd\Apache\Apache.exe (file missing)
O23 - Service: Canon Camera Access Library 8 (CCALib8) - Canon Inc. - C:\Program Files\Canon\CAL\CALMAIN.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\system32\CTsvcCDA.EXE
O23 - Service: Cisco Trust Agent (ctad) - Cisco Systems, Inc. - C:\Program Files\Cisco Systems\CiscoTrustAgent\ctad.exe
O23 - Service: Cisco Trust Agent Event Logging Service (ctalogd) - Cisco Systems, Inc. - C:\Program Files\Cisco Systems\CiscoTrustAgent\ctalogd.exe
O23 - Service: Cisco Systems, Inc. VPN Service (CVPND) - Cisco Systems, Inc. - C:\Program Files\Cisco Systems\VPN Client\cvpnd.exe
O23 - Service: Symantec AntiVirus Definition Watcher (DefWatch) - Symantec Corporation - C:\Program Files\Symantec AntiVirus\DefWatch.exe
O23 - Service: Contivity VPN Service (ExtranetAccess) - Nortel Networks NA, Inc. - C:\Program Files\Nortel Networks\Extranet_serv.exe
O23 - Service: getPlus(R) Helper - NOS Microsystems Ltd. - C:\Program Files\NOS\bin\getPlus_HelperSvc.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: HP WMI Interface (hpqwmi) - Hewlett-Packard Development Company, L.P. - C:\Program Files\HPQ\SHARED\HPQWMI.exe
O23 - Service: hpqwmiex - Hewlett-Packard Development Company, L.P. - C:\Program Files\Hewlett-Packard\Shared\hpqwmiex.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: iPodService - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe
O23 - Service: McciCMService - Motive Communications, Inc. - C:\Program Files\Common Files\Motive\McciCMService.exe
O23 - Service: MySQL - Unknown owner - C:\Program.exe (file missing)
O23 - Service: SAVRoam (SavRoam) - symantec - C:\Program Files\Symantec AntiVirus\SavRoam.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
O23 - Service: Symantec AntiVirus - Symantec Corporation - C:\Program Files\Symantec AntiVirus\Rtvscan.exe
O23 - Service: TabletService - Wacom Technology, Corp. - C:\WINDOWS\system32\Tablet.exe
O23 - Service: Apache Tomcat (Tomcat5) - Apache Software Foundation - C:\Program Files\Apache Software Foundation\Tomcat 5.5\bin\tomcat5.exe
--
End of file - 24517 bytes
Thanks for your help!
Here is the content of ComboFix.txt:
ComboFix 09-02-27.02 - Dad 2009-02-28 14:11:17.1 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.3.936.86.1033.18.1014.434 [GMT -5:00]
执行位置: c:\documents and settings\Dad\Desktop\ComboFix.exe
AV: Symantec AntiVirus Corporate Edition *On-access scanning disabled* (Updated)
* 成功创造新还原点
.
((((((((((((((((((((((((((((((((((((((( 被删除的档案 )))))))))))))))))))))))))))))))))))))))))))))))))
.
c:\program files\\setup.exe
c:\windows\Downloaded Program Files\DinerDash.1.0.0.89
c:\windows\Downloaded Program Files\DinerDash.1.0.0.89\assets\accessories\cup.png
c:\windows\Downloaded Program Files\DinerDash.1.0.0.89\assets\accessories\customer_cup.png
c:\windows\Downloaded Program Files\DinerDash.1.0.0.89\assets\accessories\heart.png
c:\windows\Downloaded Program Files\DinerDash.1.0.0.89\assets\accessories\menu_down.png
c:\windows\Downloaded Program Files\DinerDash.1.0.0.89\assets\accessories\menu_up.png
c:\windows\Downloaded Program Files\DinerDash.1.0.0.89\assets\accessories\plates.png
c:\windows\Downloaded Program Files\DinerDash.1.0.0.89\assets\accessories\ticket.png
c:\windows\Downloaded Program Files\DinerDash.1.0.0.89\assets\accessories\tray.png
c:\windows\Downloaded Program Files\DinerDash.1.0.0.89\assets\audio\music\mainmenumusic.ogg
c:\windows\Downloaded Program Files\DinerDash.1.0.0.89\assets\audio\sfx\sfx_bring_check_1_snd.ogg
c:\windows\Downloaded Program Files\DinerDash.1.0.0.89\assets\audio\sfx\sfx_deliver_food_1_snd.ogg
c:\windows\Downloaded Program Files\DinerDash.1.0.0.89\assets\audio\sfx\sfx_deliver_order_1_snd.ogg
c:\windows\Downloaded Program Files\DinerDash.1.0.0.89\assets\audio\sfx\sfx_diner.ogg
c:\windows\Downloaded Program Files\DinerDash.1.0.0.89\assets\audio\sfx\sfx_dish_dropoff_1_snd.ogg
c:\windows\Downloaded Program Files\DinerDash.1.0.0.89\assets\audio\sfx\sfx_food_ready_1_snd.ogg
c:\windows\Downloaded Program Files\DinerDash.1.0.0.89\assets\audio\sfx\sfx_gain_heart_1.ogg
c:\windows\Downloaded Program Files\DinerDash.1.0.0.89\assets\audio\sfx\sfx_get_drinks_1_snd.ogg
c:\windows\Downloaded Program Files\DinerDash.1.0.0.89\assets\audio\sfx\sfx_party_arrive_1_snd.ogg
c:\windows\Downloaded Program Files\DinerDash.1.0.0.89\assets\audio\sfx\sfx_pencil_write_2.ogg
c:\windows\Downloaded Program Files\DinerDash.1.0.0.89\assets\audio\sfx\sfx_pickup_food_1_snd.ogg
c:\windows\Downloaded Program Files\DinerDash.1.0.0.89\assets\audio\sfx\sfx_rollover_1.ogg
c:\windows\Downloaded Program Files\DinerDash.1.0.0.89\assets\audio\sfx\sfx_seat_people_snd.ogg
c:\windows\Downloaded Program Files\DinerDash.1.0.0.89\assets\backgrounds\choosedifficulty.png
c:\windows\Downloaded Program Files\DinerDash.1.0.0.89\assets\backgrounds\credits.jpg
c:\windows\Downloaded Program Files\DinerDash.1.0.0.89\assets\backgrounds\flo_lose.png
c:\windows\Downloaded Program Files\DinerDash.1.0.0.89\assets\backgrounds\flo_win.png
c:\windows\Downloaded Program Files\DinerDash.1.0.0.89\assets\backgrounds\help1.jpg
c:\windows\Downloaded Program Files\DinerDash.1.0.0.89\assets\backgrounds\help2.jpg
c:\windows\Downloaded Program Files\DinerDash.1.0.0.89\assets\backgrounds\highscores.jpg
c:\windows\Downloaded Program Files\DinerDash.1.0.0.89\assets\backgrounds\levelintro.jpg
c:\windows\Downloaded Program Files\DinerDash.1.0.0.89\assets\backgrounds\levelintro_mask.png
c:\windows\Downloaded Program Files\DinerDash.1.0.0.89\assets\backgrounds\levelover.jpg
c:\windows\Downloaded Program Files\DinerDash.1.0.0.89\assets\backgrounds\levelover_mask.png
c:\windows\Downloaded Program Files\DinerDash.1.0.0.89\assets\backgrounds\mainmenu.jpg
c:\windows\Downloaded Program Files\DinerDash.1.0.0.89\assets\backgrounds\popup.jpg
c:\windows\Downloaded Program Files\DinerDash.1.0.0.89\assets\backgrounds\popup_mask.png
c:\windows\Downloaded Program Files\DinerDash.1.0.0.89\assets\backgrounds\upgradegrid.png
c:\windows\Downloaded Program Files\DinerDash.1.0.0.89\assets\backgrounds\upgradetitle.png
c:\windows\Downloaded Program Files\DinerDash.1.0.0.89\assets\backgrounds\upsell.jpg
c:\windows\Downloaded Program Files\DinerDash.1.0.0.89\assets\buttons\arrowleft_blue.png
c:\windows\Downloaded Program Files\DinerDash.1.0.0.89\assets\buttons\arrowleft_yellow.png
c:\windows\Downloaded Program Files\DinerDash.1.0.0.89\assets\buttons\arrowright_blue.png
c:\windows\Downloaded Program Files\DinerDash.1.0.0.89\assets\buttons\arrowright_yellow.png
c:\windows\Downloaded Program Files\DinerDash.1.0.0.89\assets\buttons\back_blue.png
c:\windows\Downloaded Program Files\DinerDash.1.0.0.89\assets\buttons\back_yellow.png
c:\windows\Downloaded Program Files\DinerDash.1.0.0.89\assets\buttons\backchalk.png
c:\windows\Downloaded Program Files\DinerDash.1.0.0.89\assets\buttons\backchalkup.png
c:\windows\Downloaded Program Files\DinerDash.1.0.0.89\assets\buttons\backtomenu_blue.png
c:\windows\Downloaded Program Files\DinerDash.1.0.0.89\assets\buttons\backtomenu_yellow.png
c:\windows\Downloaded Program Files\DinerDash.1.0.0.89\assets\buttons\cancel.png
c:\windows\Downloaded Program Files\DinerDash.1.0.0.89\assets\buttons\cancelup.png
c:\windows\Downloaded Program Files\DinerDash.1.0.0.89\assets\buttons\career.png
c:\windows\Downloaded Program Files\DinerDash.1.0.0.89\assets\buttons\career_over.png
c:\windows\Downloaded Program Files\DinerDash.1.0.0.89\assets\buttons\close.png
c:\windows\Downloaded Program Files\DinerDash.1.0.0.89\assets\buttons\closeup.png
c:\windows\Downloaded Program Files\DinerDash.1.0.0.89\assets\buttons\continue.png
c:\windows\Downloaded Program Files\DinerDash.1.0.0.89\assets\buttons\continueover.png
c:\windows\Downloaded Program Files\DinerDash.1.0.0.89\assets\buttons\credits_blue.png
c:\windows\Downloaded Program Files\DinerDash.1.0.0.89\assets\buttons\credits_yellow.png
c:\windows\Downloaded Program Files\DinerDash.1.0.0.89\assets\buttons\download_blue.png
c:\windows\Downloaded Program Files\DinerDash.1.0.0.89\assets\buttons\download_yellow.png
c:\windows\Downloaded Program Files\DinerDash.1.0.0.89\assets\buttons\easy.png
c:\windows\Downloaded Program Files\DinerDash.1.0.0.89\assets\buttons\easy_over.png
c:\windows\Downloaded Program Files\DinerDash.1.0.0.89\assets\buttons\endlessshift.png
c:\windows\Downloaded Program Files\DinerDash.1.0.0.89\assets\buttons\endlessshift_over.png
c:\windows\Downloaded Program Files\DinerDash.1.0.0.89\assets\buttons\hard.png
c:\windows\Downloaded Program Files\DinerDash.1.0.0.89\assets\buttons\hard_over.png
c:\windows\Downloaded Program Files\DinerDash.1.0.0.89\assets\buttons\help.png
c:\windows\Downloaded Program Files\DinerDash.1.0.0.89\assets\buttons\help_over.png
c:\windows\Downloaded Program Files\DinerDash.1.0.0.89\assets\buttons\highscores.png
c:\windows\Downloaded Program Files\DinerDash.1.0.0.89\assets\buttons\highscores_over.png
c:\windows\Downloaded Program Files\DinerDash.1.0.0.89\assets\buttons\instructions_blue.png
c:\windows\Downloaded Program Files\DinerDash.1.0.0.89\assets\buttons\instructions_yellow.png
c:\windows\Downloaded Program Files\DinerDash.1.0.0.89\assets\buttons\letsplay.png
c:\windows\Downloaded Program Files\DinerDash.1.0.0.89\assets\buttons\letsplayover.png
c:\windows\Downloaded Program Files\DinerDash.1.0.0.89\assets\buttons\medium.png
c:\windows\Downloaded Program Files\DinerDash.1.0.0.89\assets\buttons\medium_over.png
c:\windows\Downloaded Program Files\DinerDash.1.0.0.89\assets\buttons\moreinfo.png
c:\windows\Downloaded Program Files\DinerDash.1.0.0.89\assets\buttons\moreinfoup.png
c:\windows\Downloaded Program Files\DinerDash.1.0.0.89\assets\buttons\off.png
c:\windows\Downloaded Program Files\DinerDash.1.0.0.89\assets\buttons\off_on.png
c:\windows\Downloaded Program Files\DinerDash.1.0.0.89\assets\buttons\on.png
c:\windows\Downloaded Program Files\DinerDash.1.0.0.89\assets\buttons\on_on.png
c:\windows\Downloaded Program Files\DinerDash.1.0.0.89\assets\buttons\pause.png
c:\windows\Downloaded Program Files\DinerDash.1.0.0.89\assets\buttons\pauseover.png
c:\windows\Downloaded Program Files\DinerDash.1.0.0.89\assets\buttons\quit.png
c:\windows\Downloaded Program Files\DinerDash.1.0.0.89\assets\buttons\quitgame.png
c:\windows\Downloaded Program Files\DinerDash.1.0.0.89\assets\buttons\quitgameover.png
c:\windows\Downloaded Program Files\DinerDash.1.0.0.89\assets\buttons\quitover.png
c:\windows\Downloaded Program Files\DinerDash.1.0.0.89\assets\buttons\resumegame.png
c:\windows\Downloaded Program Files\DinerDash.1.0.0.89\assets\buttons\resumegameover.png
c:\windows\Downloaded Program Files\DinerDash.1.0.0.89\assets\buttons\submit.png
c:\windows\Downloaded Program Files\DinerDash.1.0.0.89\assets\buttons\submitup.png
c:\windows\Downloaded Program Files\DinerDash.1.0.0.89\assets\buttons\tryagain.png
c:\windows\Downloaded Program Files\DinerDash.1.0.0.89\assets\buttons\tryagainover.png
c:\windows\Downloaded Program Files\DinerDash.1.0.0.89\assets\buttons\upgrade_over.png
c:\windows\Downloaded Program Files\DinerDash.1.0.0.89\assets\buttons\upgrade_up.png
c:\windows\Downloaded Program Files\DinerDash.1.0.0.89\assets\buttons\viewglobal.png
c:\windows\Downloaded Program Files\DinerDash.1.0.0.89\assets\buttons\viewglobalup.png
c:\windows\Downloaded Program Files\DinerDash.1.0.0.89\assets\buttons\viewhighscore.png
c:\windows\Downloaded Program Files\DinerDash.1.0.0.89\assets\buttons\viewhighscoreon.png
c:\windows\Downloaded Program Files\DinerDash.1.0.0.89\assets\buttons\viewlocal.png
c:\windows\Downloaded Program Files\DinerDash.1.0.0.89\assets\buttons\viewlocalup.png
c:\windows\Downloaded Program Files\DinerDash.1.0.0.89\assets\comics\webcomic.jpg
c:\windows\Downloaded Program Files\DinerDash.1.0.0.89\assets\config\career.xml
c:\windows\Downloaded Program Files\DinerDash.1.0.0.89\assets\config\customer.xml
c:\windows\Downloaded Program Files\DinerDash.1.0.0.89\assets\config\endless.xml
c:\windows\Downloaded Program Files\DinerDash.1.0.0.89\assets\config\global.xml
c:\windows\Downloaded Program Files\DinerDash.1.0.0.89\assets\config\powerups.xml
c:\windows\Downloaded Program Files\DinerDash.1.0.0.89\assets\cook\cook.png
c:\windows\Downloaded Program Files\DinerDash.1.0.0.89\assets\cook\cook.xml
c:\windows\Downloaded Program Files\DinerDash.1.0.0.89\assets\cook\stove.png
c:\windows\Downloaded Program Files\DinerDash.1.0.0.89\assets\cursor\arrow.png
c:\windows\Downloaded Program Files\DinerDash.1.0.0.89\assets\cursor\click.png
c:\windows\Downloaded Program Files\DinerDash.1.0.0.89\assets\cursor\click2.png
c:\windows\Downloaded Program Files\DinerDash.1.0.0.89\assets\cursor\grab.png
c:\windows\Downloaded Program Files\DinerDash.1.0.0.89\assets\cursor\open.png
c:\windows\Downloaded Program Files\DinerDash.1.0.0.89\assets\customers\old_male\anim.xml
c:\windows\Downloaded Program Files\DinerDash.1.0.0.89\assets\customers\old_male\blue\anim.png
c:\windows\Downloaded Program Files\DinerDash.1.0.0.89\assets\customers\old_male\blue\anim.xml
c:\windows\Downloaded Program Files\DinerDash.1.0.0.89\assets\customers\old_male\blue\sit_legs.png
c:\windows\Downloaded Program Files\DinerDash.1.0.0.89\assets\customers\old_male\green\anim.png
c:\windows\Downloaded Program Files\DinerDash.1.0.0.89\assets\customers\old_male\green\anim.xml
c:\windows\Downloaded Program Files\DinerDash.1.0.0.89\assets\customers\old_male\green\sit_legs.png
c:\windows\Downloaded Program Files\DinerDash.1.0.0.89\assets\customers\old_male\purple\anim.png
c:\windows\Downloaded Program Files\DinerDash.1.0.0.89\assets\customers\old_male\purple\anim.xml
c:\windows\Downloaded Program Files\DinerDash.1.0.0.89\assets\customers\old_male\purple\sit_legs.png
c:\windows\Downloaded Program Files\DinerDash.1.0.0.89\assets\customers\old_male\red\anim.png
c:\windows\Downloaded Program Files\DinerDash.1.0.0.89\assets\customers\old_male\red\anim.xml
c:\windows\Downloaded Program Files\DinerDash.1.0.0.89\assets\customers\old_male\red\sit_legs.png
c:\windows\Downloaded Program Files\DinerDash.1.0.0.89\assets\customers\old_male\yellow\anim.png
c:\windows\Downloaded Program Files\DinerDash.1.0.0.89\assets\customers\old_male\yellow\anim.xml
c:\windows\Downloaded Program Files\DinerDash.1.0.0.89\assets\customers\old_male\yellow\sit_legs.png
c:\windows\Downloaded Program Files\DinerDash.1.0.0.89\assets\customers\young_female\anim.xml
c:\windows\Downloaded Program Files\DinerDash.1.0.0.89\assets\customers\young_female\blue\anim.png
c:\windows\Downloaded Program Files\DinerDash.1.0.0.89\assets\customers\young_female\blue\anim.xml
c:\windows\Downloaded Program Files\DinerDash.1.0.0.89\assets\customers\young_female\blue\sit_legs.png
c:\windows\Downloaded Program Files\DinerDash.1.0.0.89\assets\customers\young_female\green\anim.png
c:\windows\Downloaded Program Files\DinerDash.1.0.0.89\assets\customers\young_female\green\anim.xml
c:\windows\Downloaded Program Files\DinerDash.1.0.0.89\assets\customers\young_female\green\sit_legs.png
c:\windows\Downloaded Program Files\DinerDash.1.0.0.89\assets\customers\young_female\purple\anim.png
c:\windows\Downloaded Program Files\DinerDash.1.0.0.89\assets\customers\young_female\purple\anim.xml
c:\windows\Downloaded Program Files\DinerDash.1.0.0.89\assets\customers\young_female\purple\sit_legs.png
c:\windows\Downloaded Program Files\DinerDash.1.0.0.89\assets\customers\young_female\red\anim.png
c:\windows\Downloaded Program Files\DinerDash.1.0.0.89\assets\customers\young_female\red\anim.xml
c:\windows\Downloaded Program Files\DinerDash.1.0.0.89\assets\customers\young_female\red\sit_legs.png
c:\windows\Downloaded Program Files\DinerDash.1.0.0.89\assets\customers\young_female\yellow\anim.png
c:\windows\Downloaded Program Files\DinerDash.1.0.0.89\assets\customers\young_female\yellow\anim.xml
c:\windows\Downloaded Program Files\DinerDash.1.0.0.89\assets\customers\young_female\yellow\sit_legs.png
c:\windows\Downloaded Program Files\DinerDash.1.0.0.89\assets\flo\idle.png
c:\windows\Downloaded Program Files\DinerDash.1.0.0.89\assets\flo\idle.xml
c:\windows\Downloaded Program Files\DinerDash.1.0.0.89\assets\flo\lower.png
c:\windows\Downloaded Program Files\DinerDash.1.0.0.89\assets\flo\lower.xml
c:\windows\Downloaded Program Files\DinerDash.1.0.0.89\assets\flo\upper.png
c:\windows\Downloaded Program Files\DinerDash.1.0.0.89\assets\flo\upper.xml
c:\windows\Downloaded Program Files\DinerDash.1.0.0.89\assets\fonts\arial.mvec
c:\windows\Downloaded Program Files\DinerDash.1.0.0.89\assets\fonts\komikaaxis.mvec
c:\windows\Downloaded Program Files\DinerDash.1.0.0.89\assets\furniture\chair.png
c:\windows\Downloaded Program Files\DinerDash.1.0.0.89\assets\furniture\chair.xml
c:\windows\Downloaded Program Files\DinerDash.1.0.0.89\assets\furniture\dirt2top.png
c:\windows\Downloaded Program Files\DinerDash.1.0.0.89\assets\furniture\dirt4top.png
c:\windows\Downloaded Program Files\DinerDash.1.0.0.89\assets\furniture\dishcart.png
c:\windows\Downloaded Program Files\DinerDash.1.0.0.89\assets\furniture\dishcart.xml
c:\windows\Downloaded Program Files\DinerDash.1.0.0.89\assets\furniture\drinkstation_off.png
c:\windows\Downloaded Program Files\DinerDash.1.0.0.89\assets\furniture\drinkstation_on1.png
c:\windows\Downloaded Program Files\DinerDash.1.0.0.89\assets\furniture\drinkstation_on2.png
c:\windows\Downloaded Program Files\DinerDash.1.0.0.89\assets\furniture\ticketstation.png
c:\windows\Downloaded Program Files\DinerDash.1.0.0.89\assets\furniture\ticketstation.xml
c:\windows\Downloaded Program Files\DinerDash.1.0.0.89\assets\hiscore\arrowdown.png
c:\windows\Downloaded Program Files\DinerDash.1.0.0.89\assets\hiscore\arrowdownon.png
c:\windows\Downloaded Program Files\DinerDash.1.0.0.89\assets\hiscore\arrowleft.png
c:\windows\Downloaded Program Files\DinerDash.1.0.0.89\assets\hiscore\arrowlefton.png
c:\windows\Downloaded Program Files\DinerDash.1.0.0.89\assets\hiscore\arrowright.png
c:\windows\Downloaded Program Files\DinerDash.1.0.0.89\assets\hiscore\arrowrighton.png
c:\windows\Downloaded Program Files\DinerDash.1.0.0.89\assets\hiscore\arrowup.png
c:\windows\Downloaded Program Files\DinerDash.1.0.0.89\assets\hiscore\arrowupon.png
c:\windows\Downloaded Program Files\DinerDash.1.0.0.89\assets\hiscore\p1icon.png
c:\windows\Downloaded Program Files\DinerDash.1.0.0.89\assets\hiscore\textedit.png
c:\windows\Downloaded Program Files\DinerDash.1.0.0.89\assets\hiscore\title.png
c:\windows\Downloaded Program Files\DinerDash.1.0.0.89\assets\layouts\endless_1_1.txt
c:\windows\Downloaded Program Files\DinerDash.1.0.0.89\assets\layouts\endless_1_1_a.txt
c:\windows\Downloaded Program Files\DinerDash.1.0.0.89\assets\layouts\endless_1_1_b.txt
c:\windows\Downloaded Program Files\DinerDash.1.0.0.89\assets\layouts\endless_1_1_c.txt
c:\windows\Downloaded Program Files\DinerDash.1.0.0.89\assets\layouts\endless_1_2.txt
c:\windows\Downloaded Program Files\DinerDash.1.0.0.89\assets\layouts\endless_1_2_a.txt
c:\windows\Downloaded Program Files\DinerDash.1.0.0.89\assets\layouts\endless_1_2_b.txt
c:\windows\Downloaded Program Files\DinerDash.1.0.0.89\assets\layouts\endless_1_2_c.txt
c:\windows\Downloaded Program Files\DinerDash.1.0.0.89\assets\layouts\endless_1_2_d.txt
c:\windows\Downloaded Program Files\DinerDash.1.0.0.89\assets\layouts\endless_1_3.txt
c:\windows\Downloaded Program Files\DinerDash.1.0.0.89\assets\layouts\endless_1_3_a.txt
c:\windows\Downloaded Program Files\DinerDash.1.0.0.89\assets\layouts\endless_1_3_b.txt
c:\windows\Downloaded Program Files\DinerDash.1.0.0.89\assets\layouts\endless_1_3_c.txt
c:\windows\Downloaded Program Files\DinerDash.1.0.0.89\assets\layouts\endless_1_3_d.txt
c:\windows\Downloaded Program Files\DinerDash.1.0.0.89\assets\layouts\fifth_level_diner.txt
c:\windows\Downloaded Program Files\DinerDash.1.0.0.89\assets\layouts\first_level_diner.txt
c:\windows\Downloaded Program Files\DinerDash.1.0.0.89\assets\layouts\fourth_level_diner.txt
c:\windows\Downloaded Program Files\DinerDash.1.0.0.89\assets\layouts\second_level_diner.txt
c:\windows\Downloaded Program Files\DinerDash.1.0.0.89\assets\playfirst_logo.png
c:\windows\Downloaded Program Files\DinerDash.1.0.0.89\assets\restaurants\diner\background.jpg
c:\windows\Downloaded Program Files\DinerDash.1.0.0.89\assets\restaurants\diner\food\food1.png
c:\windows\Downloaded Program Files\DinerDash.1.0.0.89\assets\restaurants\diner\food\food1.xml
c:\windows\Downloaded Program Files\DinerDash.1.0.0.89\assets\restaurants\diner\food\food2.png
c:\windows\Downloaded Program Files\DinerDash.1.0.0.89\assets\restaurants\diner\food\food2.xml
c:\windows\Downloaded Program Files\DinerDash.1.0.0.89\assets\restaurants\diner\food\food3.png
c:\windows\Downloaded Program Files\DinerDash.1.0.0.89\assets\restaurants\diner\food\food3.xml
c:\windows\Downloaded Program Files\DinerDash.1.0.0.89\assets\restaurants\diner\frames\upgrade_0001.png
c:\windows\Downloaded Program Files\DinerDash.1.0.0.89\assets\restaurants\diner\tables\2top.png
c:\windows\Downloaded Program Files\DinerDash.1.0.0.89\assets\restaurants\diner\tables\2top.xml
c:\windows\Downloaded Program Files\DinerDash.1.0.0.89\assets\restaurants\diner\tables\4top.png
c:\windows\Downloaded Program Files\DinerDash.1.0.0.89\assets\restaurants\diner\tables\4top.xml
c:\windows\Downloaded Program Files\DinerDash.1.0.0.89\assets\restaurants\diner\upgrades.xml
c:\windows\Downloaded Program Files\DinerDash.1.0.0.89\assets\restaurants\tableshadow.png
c:\windows\Downloaded Program Files\DinerDash.1.0.0.89\assets\scripts\choosedifficulty.lua
c:\windows\Downloaded Program Files\DinerDash.1.0.0.89\assets\scripts\chooseplayer.lua
c:\windows\Downloaded Program Files\DinerDash.1.0.0.89\assets\scripts\chooserestaurant.lua
c:\windows\Downloaded Program Files\DinerDash.1.0.0.89\assets\scripts\credits.lua
c:\windows\Downloaded Program Files\DinerDash.1.0.0.89\assets\scripts\game.lua
c:\windows\Downloaded Program Files\DinerDash.1.0.0.89\assets\scripts\gothighscore.lua
c:\windows\Downloaded Program Files\DinerDash.1.0.0.89\assets\scripts\help.lua
c:\windows\Downloaded Program Files\DinerDash.1.0.0.89\assets\scripts\help2.lua
c:\windows\Downloaded Program Files\DinerDash.1.0.0.89\assets\scripts\hiscore.lua
c:\windows\Downloaded Program Files\DinerDash.1.0.0.89\assets\scripts\hiscoreinfo.lua
c:\windows\Downloaded Program Files\DinerDash.1.0.0.89\assets\scripts\hiscoresubmit.lua
c:\windows\Downloaded Program Files\DinerDash.1.0.0.89\assets\scripts\levelintro.lua
c:\windows\Downloaded Program Files\DinerDash.1.0.0.89\assets\scripts\levelover.lua
c:\windows\Downloaded Program Files\DinerDash.1.0.0.89\assets\scripts\loading.lua
c:\windows\Downloaded Program Files\DinerDash.1.0.0.89\assets\scripts\mainloop.lua
c:\windows\Downloaded Program Files\DinerDash.1.0.0.89\assets\scripts\mainmenu.lua
c:\windows\Downloaded Program Files\DinerDash.1.0.0.89\assets\scripts\ok.lua
c:\windows\Downloaded Program Files\DinerDash.1.0.0.89\assets\scripts\pause.lua
c:\windows\Downloaded Program Files\DinerDash.1.0.0.89\assets\scripts\style.lua
c:\windows\Downloaded Program Files\DinerDash.1.0.0.89\assets\scripts\tutorialintro.lua
c:\windows\Downloaded Program Files\DinerDash.1.0.0.89\assets\scripts\upgrade.lua
c:\windows\Downloaded Program Files\DinerDash.1.0.0.89\assets\scripts\upsell.lua
c:\windows\Downloaded Program Files\DinerDash.1.0.0.89\assets\scripts\webcomic.lua
c:\windows\Downloaded Program Files\DinerDash.1.0.0.89\assets\scripts\yesno.lua
c:\windows\Downloaded Program Files\DinerDash.1.0.0.89\assets\splash\aol_logo.png
c:\windows\Downloaded Program Files\DinerDash.1.0.0.89\assets\splash\gamelabsplash.jpg
c:\windows\Downloaded Program Files\DinerDash.1.0.0.89\assets\splash\playfirst_logo.jpg
c:\windows\Downloaded Program Files\DinerDash.1.0.0.89\assets\strings.xml
c:\windows\Downloaded Program Files\DinerDash.1.0.0.89\assets\ui\angersmoke.png
c:\windows\Downloaded Program Files\DinerDash.1.0.0.89\assets\ui\angersmoke.xml
c:\windows\Downloaded Program Files\DinerDash.1.0.0.89\assets\ui\chairflags.png
c:\windows\Downloaded Program Files\DinerDash.1.0.0.89\assets\ui\chairflags.xml
c:\windows\Downloaded Program Files\DinerDash.1.0.0.89\assets\ui\check.png
c:\windows\Downloaded Program Files\DinerDash.1.0.0.89\assets\ui\checkmark.png
c:\windows\Downloaded Program Files\DinerDash.1.0.0.89\assets\ui\clock.png
c:\windows\Downloaded Program Files\DinerDash.1.0.0.89\assets\ui\closed.png
c:\windows\Downloaded Program Files\DinerDash.1.0.0.89\assets\ui\closingtime.png
c:\windows\Downloaded Program Files\DinerDash.1.0.0.89\assets\ui\coinflip.png
c:\windows\Downloaded Program Files\DinerDash.1.0.0.89\assets\ui\coinflip.xml
c:\windows\Downloaded Program Files\DinerDash.1.0.0.89\assets\ui\dollar.png
c:\windows\Downloaded Program Files\DinerDash.1.0.0.89\assets\ui\doodles\coffee.png
c:\windows\Downloaded Program Files\DinerDash.1.0.0.89\assets\ui\doodles\tables.png
c:\windows\Downloaded Program Files\DinerDash.1.0.0.89\assets\ui\doodles\wallpaper.png
c:\windows\Downloaded Program Files\DinerDash.1.0.0.89\assets\ui\expert.png
c:\windows\Downloaded Program Files\DinerDash.1.0.0.89\assets\ui\expertscore.png
c:\windows\Downloaded Program Files\DinerDash.1.0.0.89\assets\ui\foodpoof.png
c:\windows\Downloaded Program Files\DinerDash.1.0.0.89\assets\ui\foodpoof.xml
c:\windows\Downloaded Program Files\DinerDash.1.0.0.89\assets\ui\fork_timer.png
c:\windows\Downloaded Program Files\DinerDash.1.0.0.89\assets\ui\goalcompleted.png
c:\windows\Downloaded Program Files\DinerDash.1.0.0.89\assets\ui\heartgrow.png
c:\windows\Downloaded Program Files\DinerDash.1.0.0.89\assets\ui\heartgrow.xml
c:\windows\Downloaded Program Files\DinerDash.1.0.0.89\assets\ui\jar.png
c:\windows\Downloaded Program Files\DinerDash.1.0.0.89\assets\ui\jar.xml
c:\windows\Downloaded Program Files\DinerDash.1.0.0.89\assets\ui\level.png
c:\windows\Downloaded Program Files\DinerDash.1.0.0.89\assets\ui\level_career.png
c:\windows\Downloaded Program Files\DinerDash.1.0.0.89\assets\ui\score.png
c:\windows\Downloaded Program Files\DinerDash.1.0.0.89\assets\ui\sound.png
c:\windows\Downloaded Program Files\DinerDash.1.0.0.89\assets\ui\staroff.png
c:\windows\Downloaded Program Files\DinerDash.1.0.0.89\assets\ui\staron.png
c:\windows\Downloaded Program Files\DinerDash.1.0.0.89\assets\ui\tablenumber.png
c:\windows\Downloaded Program Files\DinerDash.1.0.0.89\assets\ui\tablenumberup.png
c:\windows\Downloaded Program Files\DinerDash.1.0.0.89\assets\ui\traynumber.png
c:\windows\Downloaded Program Files\DinerDash.1.0.0.89\assets\ui\tutorial_character.png
c:\windows\Downloaded Program Files\DinerDash.1.0.0.89\assets\ui\tutorialarrow.png
c:\windows\Downloaded Program Files\DinerDash.1.0.0.89\assets\ui\tutorialbox.png
c:\windows\Downloaded Program Files\DinerDash.1.0.0.89\assets\ui\upgradeanim.png
c:\windows\Downloaded Program Files\DinerDash.1.0.0.89\assets\ui\upgradeanim.xml
c:\windows\Downloaded Program Files\DinerDash.1.0.0.89\assets\ui\upgrades\drinks.png
c:\windows\Downloaded Program Files\DinerDash.1.0.0.89\assets\ui\upgrades\maitred.png
c:\windows\Downloaded Program Files\DinerDash.1.0.0.89\assets\ui\upgrades\oven.png
c:\windows\Downloaded Program Files\DinerDash.1.0.0.89\assets\ui\upgrades\select.png
c:\windows\Downloaded Program Files\DinerDash.1.0.0.89\assets\ui\upgrades\shoes.png
c:\windows\Downloaded Program Files\DinerDash.1.0.0.89\assets\ui\upgrades\stereo.png
c:\windows\Downloaded Program Files\DinerDash.1.0.0.89\assets\ui\upgrades\table.png
c:\windows\Downloaded Program Files\DinerDash.1.0.0.89\dinerdash.exe
c:\windows\IE4 Error Log.txt
c:\windows\struct~.ini
c:\windows\system32\bodizeya.dll
c:\windows\system32\fetokuze.dll
c:\windows\system32\jogopamo.dll
c:\windows\system32\owjbka.dll
c:\windows\system32\pasagami.dll
c:\windows\system32\pxobkb.dll
c:\windows\system32\sisazibo.dll
c:\windows\system32\szbhny.dll
c:\windows\system32\vafefudo.dll
c:\windows\system32\vtvdcd.dll
c:\windows\system32\wuyojogi.dll
c:\windows\system32\xdlhki.dll
c:\windows\system32\yinazeku.dll
c:\windows\system32\zavidegu.dll
.
((((((((((((((((((((((((( 2009-01-28 至 2009-02-28 的新的档案 )))))))))))))))))))))))))))))))
.
2009-02-28 13:59 . 2009-02-28 13:59 <DIR> d-------- C:\32788R22FWJFW
2009-02-28 09:38 . 2009-02-28 14:23 1,665,518 ---hs---- c:\windows\system32\uruzegid.ini
2009-02-27 21:38 . 2009-02-27 21:59 1,665,505 ---hs---- c:\windows\system32\idebimav.ini
2009-02-27 21:19 . 2009-02-27 21:19 <DIR> d-------- c:\program files\Trend Micro
2009-02-27 21:11 . 2009-02-27 21:11 <DIR> d-------- c:\program files\ERUNT
2009-02-27 01:20 . 2009-02-27 01:20 2,713 ---hs---- c:\windows\system32\zanaruma.exe
2009-02-25 20:15 . 2009-02-27 21:24 1,665,518 ---hs---- c:\windows\system32\irofilid.ini
2009-02-24 23:37 . 2009-02-24 23:38 1,608,251 ---hs---- c:\windows\system32\ehuhewap.ini
2009-02-24 11:27 . 2009-02-24 23:38 1,608,251 ---hs---- c:\windows\system32\imudenas.ini
2009-02-16 22:25 . 2009-02-16 22:25 98,304 --a------ c:\windows\system32\CmdLineExt.dll
2009-02-16 21:57 . 2009-02-16 21:57 <DIR> d-------- c:\program files\Sierra
2009-02-15 21:40 . 2009-02-15 21:40 <DIR> d-------- c:\program files\NCSoft
2009-02-15 21:29 . 2009-02-15 21:29 <DIR> d-------- c:\documents and settings\Dad\Application Data\InstallShield
2009-02-15 21:26 . 2009-02-15 21:29 <DIR> d-------- c:\documents and settings\Dad\Application Data\GetRightToGo
.
(((((((((((((((((((((((((((((((((((((((( 在三个月内被修改的档案 ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-02-28 18:35 --------- d-----w c:\program files\Symantec AntiVirus
2009-02-28 14:37 84,992 --sha-w c:\windows\system32\wujeluhe.dll
2009-02-28 14:37 79,872 --sha-w c:\windows\system32\digezuru.dll
2009-02-28 13:55 --------- d-----w c:\documents and settings\Dad\Application Data\OpenOffice.org2
2009-02-28 02:37 84,992 --sha-w c:\windows\system32\dipakule.dll
2009-02-28 02:37 79,872 ------w c:\windows\system32\vamibedi.dll
2009-02-26 01:15 84,992 --sha-w c:\windows\system32\monelare.dll
2009-02-26 01:15 79,872 ------w c:\windows\system32\dilifori.dll
2009-02-25 04:37 84,992 --sha-w c:\windows\system32\jimekaju.dll
2009-02-25 04:37 79,872 --sha-w c:\windows\system32\pawehuhe.dll
2009-02-24 21:03 --------- d-----w c:\documents and settings\May\Application Data\OpenOffice.org2
2009-02-17 03:17 --------- d-----w c:\program files\GameSpy Arcade
2009-02-17 02:57 --------- d--h--w c:\program files\InstallShield Installation Information
2009-02-07 16:55 --------- d-----w c:\documents and settings\Dad\Application Data\Skype
2009-01-23 00:31 --------- d-----w c:\program files\Common Files\LightScribe
2009-01-15 17:42 1,798 ----a-w c:\documents and settings\May\Application Data\wklnhst.dat
2009-01-15 16:36 --------- d-----w c:\documents and settings\All Users\Application Data\LightScribe
2009-01-15 02:29 --------- d-----w c:\documents and settings\Dad\Application Data\Move Networks
2009-01-10 22:27 --------- d-----w c:\documents and settings\Dad\Application Data\ZoomBrowser EX
2009-01-08 02:04 --------- d-----w c:\documents and settings\All Users\Application Data\ZoomBrowser
2009-01-06 01:18 --------- d-----w c:\program files\Registrar Registry Manager
2009-01-04 20:31 2,713 --sh--w c:\windows\system32\boponase.exe
2009-01-04 05:31 2,713 --sh--w c:\windows\system32\nukizota.exe
2008-12-13 06:40 3,593,216 ----a-w c:\windows\system32\dllcache\mshtml.dll
2008-05-24 18:46 4,492 ----a-w c:\documents and settings\Dad\Application Data\wklnhst.dat
2006-12-14 21:47 45,056 ----a-w c:\program files\Common Files\Period20.dll
2006-12-14 21:47 24,576 ----a-w c:\program files\Common Files\Artes32X.dll
2006-12-14 21:47 24,576 ----a-w c:\program files\Common Files\ACTripsLog.dll
2006-01-29 18:51 13,340,672 ----a-w c:\program files\Setup.msi
2006-01-29 18:49 247 ----a-w c:\program files\Setup.Ini
2007-03-21 13:53 28,672 ----a-w c:\program files\mozilla firefox\plugins\atgpcdec.dll
2007-03-21 13:53 98,304 ----a-w c:\program files\mozilla firefox\plugins\atgpcext.dll
2008-09-05 02:45 32,768 --sha-w c:\windows\system32\config\systemprofile\Local Settings\History\History.IE5\MSHist012008090420080905\index.dat
.
((((((((((((((((((((((((((((((((((((( 重要登入点 ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*注意* 空白与合法缺省登录将不会被显示
REGEDIT4
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Creative Detector"="c:\program files\Creative\MediaSource\Detector\CTDetect.exe" [2003-10-02 98304]
"EPSON Stylus C82 Series"="c:\windows\System32\spool\DRIVERS\W32X86\3\E_S0HIC1.EXE" [2003-10-15 99840]
"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2008-04-13 15360]
"swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2007-06-28 68856]
"MSMSGS"="c:\program files\Messenger\msmsgs.exe" [2008-04-13 1695232]
"Google Update"="c:\documents and settings\Dad\Local Settings\Application Data\Google\Update\GoogleUpdate.exe" [2008-09-03 133104]
"DAEMON Tools Lite"="c:\program files\DAEMON Tools Lite\daemon.exe" [2008-01-17 486856]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"MSConfig"="c:\windows\PCHealth\HelpCtr\Binaries\MSConfig.exe" [2008-04-13 169984]
"WrtMon.exe"="c:\windows\system32\spool\drivers\w32x86\3\WrtMon.exe" [2006-09-20 20480]
"WatchDog"="c:\program files\InterVideo\DVD Check\DVDCheck.exe" [2005-07-04 184320]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2008-11-10 136600]
"SSBkgdUpdate"="c:\program files\Common Files\Scansoft Shared\SSBkgdUpdate\SSBkgdupdate.exe" [2006-09-28 185896]
"SoundMAXPnP"="c:\program files\Analog Devices\SoundMAX\SMax4PNP.exe" [2004-10-14 1388544]
"QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2006-04-29 155648]
"OpwareSE4"="c:\program files\ScanSoft\OmniPageSE4.0\OpwareSE4.exe" [2006-10-11 75304]
"LSBWatcher"="c:\hp\drivers\hplsbwatcher\lsburnwatcher.exe" [2004-10-14 253952]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2006-02-23 278528]
"ISUSScheduler"="c:\program files\Common Files\InstallShield\UpdateService\issch.exe" [2005-02-16 81920]
"ISUSPM Startup"="c:\progra~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe" [2004-07-27 221184]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2005-02-08 155648]
"hpWirelessAssistant"="c:\program files\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe" [2007-10-03 480560]
"HP Software Update"="c:\program files\Hp\HP Software Update\HPWuSchd2.exe" [2007-05-08 54840]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2005-02-08 126976]
"EPSON Stylus C82 Series"="c:\windows\System32\spool\DRIVERS\W32X86\3\E_S0HIC1.EXE" [2003-10-15 99840]
"eabconfg.cpl"="c:\program files\HPQ\Quick Launch Buttons\EabServr.exe" [2006-04-18 405504]
"Cpqset"="c:\program files\HPQ\Default Settings\cpqset.exe" [2005-03-29 233534]
"ccApp"="c:\program files\Common Files\Symantec Shared\ccApp.exe" [2005-12-21 48800]
"Apoint"="c:\program files\Apoint2K\Apoint.exe" [2005-02-08 159744]
"01959d7b"="c:\windows\system32\digezuru.dll" [2009-02-28 79872]
"CPM02a6aee7"="c:\windows\system32\wujeluhe.dll" [2009-02-28 84992]
"kmw_run.exe"="kmw_run.exe" [2005-09-01 c:\windows\system32\kmw_run.exe]
"AGRSMMSG"="AGRSMMSG.exe" [2005-04-13 c:\windows\AGRSMMSG.exe]
c:\documents and settings\Hanan\Start Menu\Programs\Startup\
OpenOffice.org 2.4.lnk - c:\program files\OpenOffice.org 2.4\program\quickstart.exe [2008-01-21 393216]
c:\documents and settings\May\Start Menu\Programs\Startup\
OpenOffice.org 2.4.lnk - c:\program files\OpenOffice.org 2.4\program\quickstart.exe [2008-01-21 393216]
WKCALREM.LNK - c:\program files\Common Files\Microsoft Shared\Works Shared\WkCalRem.exe [2004-06-23 15360]
c:\documents and settings\Dad\Start Menu\Programs\Startup\
ERUNT AutoBackup.lnk - c:\program files\ERUNT\AUTOBACK.EXE [2005-10-20 38912]
OpenOffice.org 2.4.lnk - c:\program files\OpenOffice.org 2.4\program\quickstart.exe [2008-01-21 393216]
wkcalrem.LNK - c:\program files\Common Files\Microsoft Shared\Works Shared\WkCalRem.exe [2004-06-23 15360]
c:\documents and settings\All Users\Start Menu\Programs\Startup\
DVD Check.lnk - c:\program files\InterVideo\DVD Check\DVDCheck.exe [2007-01-10 184320]
[hkey_local_machine\software\microsoft\windows\currentversion\explorer\SharedTaskScheduler]
"{EC43E3FD-5C60-46a6-97D7-E0B85DBDD6C4}"= "c:\windows\system32\wujeluhe.dll" [2009-02-28 84992]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
"SSODL"= {EC43E3FD-5C60-46a6-97D7-E0B85DBDD6C4} - c:\windows\system32\wujeluhe.dll [2009-02-28 84992]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"AppInit_DLLs"=c:\windows\system32\wujeluhe.dll
"LoadAppInit_DLLs"=1 (0x1)
[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"UpdatesDisableNotify"=dword:00000001
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"c:\\Program Files\\Messenger\\msmsgs.exe"=
"c:\\Program Files\\SmartFTP Client 2.0\\SmartFTP.exe"=
"c:\\WINDOWS\\system32\\javaw.exe"=
"c:\\WINDOWS\\system32\\ftp.exe"=
"c:\\Program Files\\Java\\jdk1.5.0_06\\bin\\java.exe"=
"c:\\WINDOWS\\system32\\spool\\drivers\\w32x86\\3\\SAGENT4.EXE"=
"c:\\WINDOWS\\system32\\sessmgr.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\Java\\jdk1.6.0\\bin\\java.exe"=
"c:\\Program Files\\Yahoo!\\Messenger\\YahooMessenger.exe"=
"c:\\Program Files\\BitTyrant\\Azureus.exe"=
"c:\\Program Files\\iTunes\\iTunes.exe"=
"c:\\Program Files\\Yahoo!\\Messenger\\YServer.exe"=
"c:\\WINDOWS\\system32\\dpvsetup.exe"=
"c:\\Program Files\\GameSpy Arcade\\Aphex.exe"=
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\MSN Messenger\\msnmsgr.exe"=
"c:\\Program Files\\MSN Messenger\\livecall.exe"=
"c:\\eclipse\\eclipse.exe"=
"c:\\Documents and Settings\\Dad\\Application Data\\Macromedia\\Flash Player\\www.macromedia.com\\bin\\octoshape\\octoshape.exe"=
"c:\\Program Files\\Mozilla Firefox\\firefox.exe"=
"c:\\Program Files\\Skype\\Phone\\Skype.exe"=
"c:\\Program Files\\Sierra\\FEARCombat\\FEARMP.exe"=
"c:\\Program Files\\Java\\jre6\\bin\\java.exe"=
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"21862:UDP"= 21862:UDP:Verizon CTA Port
"12667:TCP"= 12667:TCP:*:Disabled:AzureusTCP
"12667:UDP"= 12667:UDP:*:Disabled:AzureusUDP
"1597:UDP"= 1597:UDP:Windows Media Format SDK (wmplayer.exe)
"1596:UDP"= 1596:UDP:Windows Media Format SDK (wmplayer.exe)
R2 SavRoam;SAVRoam;c:\program files\Symantec AntiVirus\SavRoam.exe [2006-05-26 169200]
R3 Eacfilt;Eacfilt Miniport;c:\windows\system32\drivers\eacfilt.sys [2007-04-11 24521]
R3 EraserUtilRebootDrv;EraserUtilRebootDrv;c:\program files\Common Files\Symantec Shared\eengine\EraserUtilRebootDrv.sys [2008-09-09 99376]
S3 ctad;Cisco Trust Agent;c:\program files\Cisco Systems\CiscoTrustAgent\ctad.exe [2004-10-22 553035]
S3 ctalogd;Cisco Trust Agent Event Logging Service;c:\program files\Cisco Systems\CiscoTrustAgent\ctalogd.exe [2004-10-22 90112]
S3 ExtranetAccess;Contivity VPN Service;c:\program files\Nortel Networks\Extranet_serv.exe [2005-11-04 811008]
S3 getPlus(R) Helper;getPlus(R) Helper;c:\program files\NOS\bin\getPlus_HelperSvc.exe [2008-10-18 33752]
S3 IPSECEXT;Nortel Extranet Access Protocol;c:\windows\system32\drivers\ipsecw2k.sys [2005-11-04 155184]
S3 Tomcat5;Apache Tomcat;c:\program files\Apache Software Foundation\Tomcat 5.5\bin\tomcat5.exe [2006-04-14 102400]
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{f50e5e8c-9469-11da-a61a-444553544200}]
\Shell\AutoRun\command - setupSNK.exe
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{10880D85-AAD9-4558-ABDC-2AB1552D831F}]
"c:\program files\Common Files\LightScribe\LSRunOnce.exe"
.
‘计划任务’ 文件夹 里的内容
2009-02-28 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-3306096642-3123241714-1870812128-1013.job
- c:\documents and settings\Dad\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [2008-09-03 22:47]
2009-02-28 c:\windows\Tasks\查看 Windows Live Toolbar 的更新資訊.job
- c:\program files\Windows Live Toolbar\MSNTBUP.EXE [2007-10-19 11:20]
.
- - - - ORPHANS REMOVED - - - -
BHO-{ab49a4d5-2295-4aad-a137-302bbdf3cec9} - c:\windows\system32\szbhny.dll
BHO-{c51aa117-8dc6-48f3-934a-0c3a2a1c37de} - c:\windows\system32\bekoduya.dll
BHO-{fe17851f-d6b3-4782-bd07-0694a8090459} - c:\windows\system32\wuyojogi.dll
HKLM-Run-MSWheel - (no file)
HKU-Default-Run-saharajimu - c:\windows\system32\pasagami.dll
MSConfigStartUp-SpybotSD TeaTimer - c:\program files\Spybot - Search & Destroy\TeaTimer.exe
.
------- 而外的扫描 -------
.
uStart Page = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=EN_US&c=Q405&bd=pavilion&pf=laptop
mSearch Bar = hxxp://us.rd.yahoo.com/customize/ie/defaults/sb/msgr8/*http://www.yahoo.com/ext/search/search.html
uInternet Connection Wizard,ShellNext = hxxp://192.168.1.1/start.htm
IE: &Google Search - c:\program files\google\GoogleToolbar1.dll/cmsearch.html
IE: &Translate English Word - c:\program files\google\GoogleToolbar1.dll/cmwordtrans.html
IE: &Windows Live Search - c:\program files\Windows Live Toolbar\msntb.dll/search.htm
IE: Backward Links - c:\program files\google\GoogleToolbar1.dll/cmbacklinks.html
IE: Cached Snapshot of Page - c:\program files\google\GoogleToolbar1.dll/cmcache.html
IE: Download with Star Downloader - c:\program files\Star Downloader\sdie.htm
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~4\OFFICE11\EXCEL.EXE/3000
IE: Similar Pages - c:\program files\google\GoogleToolbar1.dll/cmsimilar.html
IE: Translate Page into English - c:\program files\google\GoogleToolbar1.dll/cmtrans.html
IE: {{F2C3214F-043E-4F1D-B727-3DEB78AA0974} - c:\program files\FreshDevices\FreshDownload\fd.exe
Trusted Zone: aol.com\free
DPF: {00D9C306-6B11-492A-9AFC-C53CE30849CF} - file:///C:/Siebel/7.8/Client/PUBLIC/enu/19213/applets/SiebelAx_Smartscript.cab
DPF: {06314967-EECF-11D2-9D64-0000949887BE} - file:///C:/Siebel/7.8/dclient/PUBLIC/enu/19213/applets/SiebelAx_ERM_ContentSync.cab
DPF: {0D68687A-A2A3-46EB-9ED9-956C83875A6C} - file:///C:/Siebel/7.8/dclient/PUBLIC/enu/19213/applets/SiebelAx_Marketing_HTML_Editor.cab
DPF: {169ADD4B-EE8B-4B27-B332-2941A82DA7E2} - file:///C:/Siebel/7.8/dclient/PUBLIC/enu/19213/applets/SiebelAx_Microsite_Layout.cab
DPF: {16C7BBB7-738A-47D7-956E-52DD9A166A9A} - file:///C:/Siebel/7.8/Client/PUBLIC/enu/19213/applets/SiebelAx_Marketing_Calendar.cab
DPF: {1D922C61-16AB-4179-8302-6B8A688C88D0} - file:///C:/Siebel/7.8/dclient/PUBLIC/enu/19213/applets/SiebelAx_Container_Control.cab
DPF: {30C1F757-58DC-45A1-9135-D4AB30932E62} - hxxp://home-laptop1/20405/applets/SiebelAx_iHelp.cab
DPF: {353F130D-72DB-4F14-B750-625F90D75D1B} - file:///C:/Siebel/7.8/dclient/PUBLIC/enu/19213/applets/SiebelAx_Test_Automation.cab
DPF: {3E8C4740-70C5-439E-AE2F-16234083E248} - file:///C:/Siebel/7.8/Client/PUBLIC/enu/19213/applets/SiebelAx_HI_Client.cab
DPF: {48CE1C1F-092D-461C-A385-A0C3D19FE052} - file:///C:/Siebel/7.8/dclient/PUBLIC/enu/19213/applets/SiebelAx_iHelp.cab
DPF: {5FCAD8CF-85C1-4FD9-BD04-995CBEBA5BEB} - file:///C:/Siebel/7.8/dclient/PUBLIC/enu/19213/applets/SiebelAx_Hospitality_Gantt.cab
DPF: {61CE1CA1-6577-49B6-AE2C-43007A942429} - hxxps://webcast.accenture.com/v2/WebcastLog/WebcastInfo.CAB
DPF: {73EF83D1-DA75-4F58-8DB6-1CD6D8F9C8A1} - file:///C:/Siebel/7.8/Client/PUBLIC/enu/19213/applets/SiebelAx_Calendar.cab
DPF: {756E01C3-2CF9-4364-8724-B8C850CB0D50} - file:///C:/Siebel/7.8/dclient/PUBLIC/enu/19213/applets/SiebelAx_UInbox.cab
DPF: {7D731A83-6C80-4EA4-9646-5E06A0513274} - hxxp://www.shockwave.com/content/ballistik/sis/slgwebinstall.cab
DPF: {8C244272-1DC1-4CE7-9C6C-FABCA09EB543} - file:///C:/Siebel/7.8/dclient/PUBLIC/enu/19213/applets/SiebelAx_Desktop_Integration.cab
DPF: {96A3E5AB-C228-4D1D-B31F-712BA35EE470} - file:///C:/Siebel/7.8/Client/PUBLIC/enu/19213/applets/SiebelAx_Gantt_Chart.cab
DPF: {A07F0AC9-D8AD-449A-BE90-668F5263B261} - hxxp://home-laptop1/20405/applets/SiebelAx_HI_Client.cab
DPF: {BF17C411-9ADA-4C73-B12C-BD814BDE187F} - hxxps://mylearning.accenture.com/accenture/core/common/ScheduleServices/ScheduleServices.cab
DPF: {C5FEEC93-506D-4B41-A38B-3A59BF5B41AB} - file:///C:/Siebel/7.8/Client/PUBLIC/enu/19213/applets/SiebelAx_CTI_Toolbar.cab
DPF: {C657D5D2-D725-4F0E-91A9-EA74647DCF84} - file:///C:/Siebel/7.8/Client/PUBLIC/enu/19213/applets/SiebelAx_Marketing_Allocation.cab
DPF: {D6CC2526-859B-40C0-8515-1A47946478B6} - file:///C:/Siebel/7.8/Client/PUBLIC/enu/19213/applets/SiebelAx_OutBound_mail.cab
DPF: {EFB7D763-97A3-11CF-AE19-00608CEADE00} - file:///C:/Siebel/7.8/dclient/PUBLIC/enu/19213/applets/iTools.cab
FF - ProfilePath - c:\documents and settings\Dad\Application Data\Mozilla\Firefox\Profiles\ir4t8dpt.default\
FF - prefs.js: browser.search.selectedEngine - Google
FF - prefs.js: browser.startup.homepage - hxxp://www.google.com/
FF - component: c:\documents and settings\Dad\Application Data\Mozilla\Firefox\Profiles\ir4t8dpt.default\extensions\{a7c6cf7f-112c-4500-a7ea-39801a327e5f}\platform\WINNT_x86-msvc\components\ipc.dll
FF - component: c:\documents and settings\Dad\Application Data\Mozilla\Firefox\Profiles\ir4t8dpt.default\extensions\speedtest@gotomyhelp.com\components\NetDiag.dll
FF - plugin: c:\documents and settings\Dad\Application Data\Mozilla\Firefox\Profiles\ir4t8dpt.default\extensions\moveplayer@movenetworks.com\platform\WINNT_x86-msvc\plugins\npmnqmp071101000055.dll
FF - plugin: c:\documents and settings\Dad\Local Settings\Application Data\Google\Update\1.2.141.5\npGoogleOneClick7.dll
FF - plugin: c:\progra~1\Yahoo!\Common\npyaxmpb.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\npatgpc.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\npqtplugin8.dll
FF - plugin: c:\program files\QuickTime\Plugins\npqtplugin8.dll
.
**************************************************************************
catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-02-28 14:21:09
Windows 5.1.2600 Service Pack 3 NTFS
扫描被隐藏的进程 。。。
扫描被隐藏的启动组 。。。
HKLM\Software\Microsoft\Windows\CurrentVersion\Run
Cpqset = c:\program files\HPQ\Default Settings\cpqset.exe???????2?4?1?7??`??? ??B?????????????hLC? ?????
扫描被隐藏的文件 。。。
扫描完成
被隐藏的档案: 0
**************************************************************************
[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\MySQL]
"ImagePath"="\"c:\program files\MySQL\MySQL Server 5.0\bin\mysqld-nt\" --defaults-file=\"c:\program files\MySQL\MySQL Server 5.0\my.ini\" MySQL"
.
------------------------ 其他运行进程 ------------------------
.
c:\program files\Common Files\Symantec Shared\ccEvtMgr.exe
c:\program files\Common Files\Symantec Shared\ccSetMgr.exe
c:\program files\Common Files\Symantec Shared\SNDSrvc.exe
c:\program files\Lavasoft\Ad-Aware\aawservice.exe
c:\program files\Symantec AntiVirus\DefWatch.exe
c:\program files\Java\jre6\bin\jqs.exe
c:\program files\Common Files\LightScribe\LSSrvc.exe
c:\program files\Common Files\Motive\McciCMService.exe
c:\program files\Analog Devices\SoundMAX\SMAgent.exe
c:\windows\system32\Tablet.exe
c:\windows\system32\wdfmgr.exe
c:\program files\Hewlett-Packard\Shared\hpqWmiEx.exe
c:\windows\system32\conime.exe
c:\program files\Canon\CAL\CALMAIN.exe
c:\windows\system32\wscntfy.exe
c:\windows\system32\spool\drivers\w32x86\3\WrtProc.exe
c:\program files\iPod\bin\iPodService.exe
c:\windows\system32\rundll32.exe
c:\program files\Apoint2K\ApntEx.exe
c:\program files\Hewlett-Packard\Shared\HpqToaster.exe
c:\program files\OpenOffice.org 2.4\program\soffice.exe
c:\program files\OpenOffice.org 2.4\program\soffice.bin
c:\program files\Internet Explorer\iexplore.exe
.
**************************************************************************
.
完成时间: 2009-02-28 14:30:50 - 电脑已重新启动
ComboFix-quarantined-files.txt 2009-02-28 19:30:21
Pre-Run: 50,113,323,008 bytes free
Post-Run: 50,546,216,960 bytes free
WindowsXP-KB310994-SP2-Pro-BootDisk-CHS.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Professional" /noexecute=optin /fastdetect
594 --- E O F --- 2008-12-19 04:26:47
ComboFix 09-02-27.02 - Dad 2009-03-02 19:09:32.2 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.3.936.86.1033.18.1014.452 [GMT -5:00]
执行位置: c:\documents and settings\Dad\Desktop\ComboFix.exe
Command switches used :: c:\documents and settings\Dad\Desktop\CFScript.txt
AV: Symantec AntiVirus Corporate Edition *On-access scanning disabled* (Updated)
* 成功创造新还原点
FILE ::
c:\windows\system32\boponase.exe
c:\windows\system32\digezuru.dll
c:\windows\system32\dilifori.dll
c:\windows\system32\dipakule.dll
c:\windows\system32\ehuhewap.ini
c:\windows\system32\idebimav.ini
c:\windows\system32\imudenas.ini
c:\windows\system32\irofilid.ini
c:\windows\system32\jimekaju.dll
c:\windows\system32\monelare.dll
c:\windows\system32\nukizota.exe
c:\windows\system32\pawehuhe.dll
c:\windows\system32\uruzegid.ini
c:\windows\system32\vamibedi.dll
c:\windows\system32\wujeluhe.dll
c:\windows\system32\zanaruma.exe
.
((((((((((((((((((((((((((((((((((((((( 被删除的档案 )))))))))))))))))))))))))))))))))))))))))))))))))
.
c:\windows\system32\boponase.exe
c:\windows\system32\digezuru.dll
c:\windows\system32\dilifori.dll
c:\windows\system32\dipakule.dll
c:\windows\system32\ehuhewap.ini
c:\windows\system32\idebimav.ini
c:\windows\system32\imudenas.ini
c:\windows\system32\irofilid.ini
c:\windows\system32\jimekaju.dll
c:\windows\system32\monelare.dll
c:\windows\system32\nukizota.exe
c:\windows\system32\pawehuhe.dll
c:\windows\system32\uruzegid.ini
c:\windows\system32\vamibedi.dll
c:\windows\system32\wujeluhe.dll
c:\windows\system32\zanaruma.exe
.
((((((((((((((((((((((((( 2009-02-03 至 2009-03-03 的新的档案 )))))))))))))))))))))))))))))))
.
2009-02-27 21:19 . 2009-02-27 21:19 <DIR> d-------- c:\program files\Trend Micro
2009-02-27 21:11 . 2009-02-27 21:11 <DIR> d-------- c:\program files\ERUNT
2009-02-16 22:25 . 2009-02-16 22:25 98,304 --a------ c:\windows\system32\CmdLineExt.dll
2009-02-16 21:57 . 2009-02-16 21:57 <DIR> d-------- c:\program files\Sierra
2009-02-15 21:40 . 2009-02-15 21:40 <DIR> d-------- c:\program files\NCSoft
2009-02-15 21:29 . 2009-02-15 21:29 <DIR> d-------- c:\documents and settings\Dad\Application Data\InstallShield
2009-02-15 21:26 . 2009-02-15 21:29 <DIR> d-------- c:\documents and settings\Dad\Application Data\GetRightToGo
.
(((((((((((((((((((((((((((((((((((((((( 在三个月内被修改的档案 ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-03-03 00:46 --------- d-----w c:\program files\Symantec AntiVirus
2009-03-03 00:38 --------- d-----w c:\documents and settings\Dad\Application Data\OpenOffice.org2
2009-03-01 21:29 --------- d-----w c:\program files\BitTyrant
2009-03-01 02:53 --------- d-----w c:\program files\Microsoft Silverlight
2009-02-24 21:03 --------- d-----w c:\documents and settings\May\Application Data\OpenOffice.org2
2009-02-17 03:17 --------- d-----w c:\program files\GameSpy Arcade
2009-02-17 02:57 --------- d--h--w c:\program files\InstallShield Installation Information
2009-02-07 16:55 --------- d-----w c:\documents and settings\Dad\Application Data\Skype
2009-01-23 00:31 --------- d-----w c:\program files\Common Files\LightScribe
2009-01-15 17:42 1,798 ----a-w c:\documents and settings\May\Application Data\wklnhst.dat
2009-01-15 16:36 --------- d-----w c:\documents and settings\All Users\Application Data\LightScribe
2009-01-15 02:29 --------- d-----w c:\documents and settings\Dad\Application Data\Move Networks
2009-01-10 22:27 --------- d-----w c:\documents and settings\Dad\Application Data\ZoomBrowser EX
2009-01-08 02:04 --------- d-----w c:\documents and settings\All Users\Application Data\ZoomBrowser
2009-01-06 01:18 --------- d-----w c:\program files\Registrar Registry Manager
2008-05-24 18:46 4,492 ----a-w c:\documents and settings\Dad\Application Data\wklnhst.dat
2006-12-14 21:47 45,056 ----a-w c:\program files\Common Files\Period20.dll
2006-12-14 21:47 24,576 ----a-w c:\program files\Common Files\Artes32X.dll
2006-12-14 21:47 24,576 ----a-w c:\program files\Common Files\ACTripsLog.dll
2006-01-29 18:51 13,340,672 ----a-w c:\program files\Setup.msi
2006-01-29 18:49 247 ----a-w c:\program files\Setup.Ini
2007-03-21 13:53 28,672 ----a-w c:\program files\mozilla firefox\plugins\atgpcdec.dll
2007-03-21 13:53 98,304 ----a-w c:\program files\mozilla firefox\plugins\atgpcext.dll
2008-09-05 02:45 32,768 --sha-w c:\windows\system32\config\systemprofile\Local Settings\History\History.IE5\MSHist012008090420080905\index.dat
.
((((((((((((((((((((((((((((( SnapShot@2009-02-28_14.28.40.56 )))))))))))))))))))))))))))))))))))))))))
.
+ 2005-10-20 17:02:28 163,328 ----a-w c:\windows\ERDNT\AutoBackup\2009-02-28\ERDNT.EXE
+ 2005-10-20 17:02:28 163,328 ----a-w c:\windows\ERDNT\AutoBackup\2009-03-02\ERDNT.EXE
+ 2009-03-03 00:38:07 5,562,368 ----a-w c:\windows\ERDNT\AutoBackup\2009-03-02\Users\00000001\NTUSER.DAT
+ 2009-03-03 00:38:07 217,088 ----a-w c:\windows\ERDNT\AutoBackup\2009-03-02\Users\00000002\UsrClass.dat
+ 2005-10-20 17:02:28 163,328 ----a-w c:\windows\ERDNT\AutoBackup\3-1-2009\ERDNT.EXE
+ 2009-03-01 21:21:32 5,545,984 ----a-w c:\windows\ERDNT\AutoBackup\3-1-2009\Users\00000001\NTUSER.DAT
+ 2009-03-01 21:21:32 217,088 ----a-w c:\windows\ERDNT\AutoBackup\3-1-2009\Users\00000002\UsrClass.dat
+ 2005-10-20 17:02:28 163,328 ----a-w c:\windows\ERDNT\AutoBackup\3-2-2009\ERDNT.EXE
+ 2009-03-02 23:54:57 5,554,176 ----a-w c:\windows\ERDNT\AutoBackup\3-2-2009\Users\00000001\NTUSER.DAT
+ 2009-03-02 23:54:58 217,088 ----a-w c:\windows\ERDNT\AutoBackup\3-2-2009\Users\00000002\UsrClass.dat
+ 2008-10-16 20:38:34 124,928 -c----w c:\windows\ie7updates\KB961260-IE7\advpack.dll
+ 2008-10-16 20:38:34 347,136 -c----w c:\windows\ie7updates\KB961260-IE7\dxtmsft.dll
+ 2008-10-16 20:38:34 214,528 -c----w c:\windows\ie7updates\KB961260-IE7\dxtrans.dll
+ 2008-10-16 20:38:35 133,120 -c----w c:\windows\ie7updates\KB961260-IE7\extmgr.dll
+ 2008-10-16 20:38:35 63,488 -c----w c:\windows\ie7updates\KB961260-IE7\icardie.dll
+ 2008-10-16 13:11:09 70,656 -c----w c:\windows\ie7updates\KB961260-IE7\ie4uinit.exe
+ 2008-10-16 20:38:35 153,088 -c----w c:\windows\ie7updates\KB961260-IE7\ieakeng.dll
+ 2008-10-16 20:38:35 230,400 -c----w c:\windows\ie7updates\KB961260-IE7\ieaksie.dll
+ 2008-10-15 07:04:53 161,792 -c----w c:\windows\ie7updates\KB961260-IE7\ieakui.dll
+ 2008-10-16 20:38:35 383,488 -c----w c:\windows\ie7updates\KB961260-IE7\ieapfltr.dll
+ 2008-10-16 20:38:35 384,512 -c----w c:\windows\ie7updates\KB961260-IE7\iedkcs32.dll
+ 2008-10-16 20:38:37 6,066,176 -c----w c:\windows\ie7updates\KB961260-IE7\ieframe.dll
+ 2008-10-16 20:38:37 44,544 -c----w c:\windows\ie7updates\KB961260-IE7\iernonce.dll
+ 2008-10-16 20:38:37 267,776 -c----w c:\windows\ie7updates\KB961260-IE7\iertutil.dll
+ 2008-10-16 13:11:09 13,824 -c----w c:\windows\ie7updates\KB961260-IE7\ieudinit.exe
+ 2008-10-15 07:06:26 633,632 -c----w c:\windows\ie7updates\KB961260-IE7\iexplore.exe
+ 2008-10-16 20:38:37 27,648 -c----w c:\windows\ie7updates\KB961260-IE7\jsproxy.dll
+ 2008-10-16 20:38:37 459,264 -c----w c:\windows\ie7updates\KB961260-IE7\msfeeds.dll
+ 2008-10-16 20:38:37 52,224 -c----w c:\windows\ie7updates\KB961260-IE7\msfeedsbs.dll
+ 2008-12-13 06:40:02 3,593,216 -c----w c:\windows\ie7updates\KB961260-IE7\mshtml.dll
+ 2008-10-16 20:38:38 477,696 -c----w c:\windows\ie7updates\KB961260-IE7\mshtmled.dll
+ 2008-10-16 20:38:38 193,024 -c----w c:\windows\ie7updates\KB961260-IE7\msrating.dll
+ 2008-10-16 20:38:39 671,232 -c----w c:\windows\ie7updates\KB961260-IE7\mstime.dll
+ 2008-10-16 20:38:39 102,912 -c----w c:\windows\ie7updates\KB961260-IE7\occache.dll
+ 2008-10-16 20:38:39 44,544 -c----w c:\windows\ie7updates\KB961260-IE7\pngfilt.dll
+ 2007-03-06 01:22:41 213,216 -c----w c:\windows\ie7updates\KB961260-IE7\spuninst\spuninst.exe
+ 2007-03-06 01:23:51 371,424 -c----w c:\windows\ie7updates\KB961260-IE7\spuninst\updspapi.dll
+ 2008-10-16 20:38:39 105,984 -c----w c:\windows\ie7updates\KB961260-IE7\url.dll
+ 2008-10-16 20:38:39 1,160,192 -c----w c:\windows\ie7updates\KB961260-IE7\urlmon.dll
+ 2008-10-16 20:38:39 233,472 -c----w c:\windows\ie7updates\KB961260-IE7\webcheck.dll
+ 2008-10-16 20:38:40 826,368 -c----w c:\windows\ie7updates\KB961260-IE7\wininet.dll
+ 2007-06-20 08:30:12 868,744 ----a-r c:\windows\Installer\$PatchCache$\Managed\9040151900063D11C8EF10054038389C\11.0.8173\AEC.DLL
+ 2007-06-20 09:34:06 135,576 ----a-r c:\windows\Installer\$PatchCache$\Managed\9040151900063D11C8EF10054038389C\11.0.8173\BRTVIEW.DLL
+ 2007-06-20 09:33:40 86,424 ----a-r c:\windows\Installer\$PatchCache$\Managed\9040151900063D11C8EF10054038389C\11.0.8173\DBSHARE.DLL
+ 2007-06-20 09:29:50 537,496 ----a-r c:\windows\Installer\$PatchCache$\Managed\9040151900063D11C8EF10054038389C\11.0.8173\IMCOMMON.DLL
+ 2007-06-20 09:34:14 147,864 ----a-r c:\windows\Installer\$PatchCache$\Managed\9040151900063D11C8EF10054038389C\11.0.8173\IMUTIL.DLL
+ 2007-06-20 08:29:44 484,760 ----a-r c:\windows\Installer\$PatchCache$\Managed\9040151900063D11C8EF10054038389C\11.0.8173\MODELENG.DLL
+ 2007-06-20 08:29:40 469,912 ----a-r c:\windows\Installer\$PatchCache$\Managed\9040151900063D11C8EF10054038389C\11.0.8173\ORGCHWIZ.DLL
+ 2007-06-20 09:29:08 335,256 ----a-r c:\windows\Installer\$PatchCache$\Managed\9040151900063D11C8EF10054038389C\11.0.8173\PDSBASE.DLL
+ 2007-06-20 09:30:34 2,715,992 ----a-r c:\windows\Installer\$PatchCache$\Managed\9040151900063D11C8EF10054038389C\11.0.8173\SG.DLL
+ 2007-06-20 09:34:36 186,264 ----a-r c:\windows\Installer\$PatchCache$\Managed\9040151900063D11C8EF10054038389C\11.0.8173\SQLSHARE.DLL
+ 2007-06-20 08:30:28 1,511,256 ----a-r c:\windows\Installer\$PatchCache$\Managed\9040151900063D11C8EF10054038389C\11.0.8173\UML.DLL
+ 2007-06-20 08:29:52 554,336 ----a-r c:\windows\Installer\$PatchCache$\Managed\9040151900063D11C8EF10054038389C\11.0.8173\UMLSYS.DLL
+ 2007-06-20 09:30:32 2,279,776 ----a-r c:\windows\Installer\$PatchCache$\Managed\9040151900063D11C8EF10054038389C\11.0.8173\VISFILT.DLL
- 2008-12-09 23:06:14 12,288 ----a-r c:\windows\Installer\{91120409-6000-11D3-8CFE-0150048383C9}\cagicon.exe
+ 2009-02-28 23:19:37 12,288 ----a-r c:\windows\Installer\{91120409-6000-11D3-8CFE-0150048383C9}\cagicon.exe
- 2008-12-09 23:06:14 135,168 ----a-r c:\windows\Installer\{91120409-6000-11D3-8CFE-0150048383C9}\misc.exe
+ 2009-02-28 23:19:36 135,168 ----a-r c:\windows\Installer\{91120409-6000-11D3-8CFE-0150048383C9}\misc.exe
- 2008-12-09 23:06:14 11,264 ----a-r c:\windows\Installer\{91120409-6000-11D3-8CFE-0150048383C9}\mspicons.exe
+ 2009-02-28 23:19:37 11,264 ----a-r c:\windows\Installer\{91120409-6000-11D3-8CFE-0150048383C9}\mspicons.exe
- 2008-12-09 23:06:14 27,136 ----a-r c:\windows\Installer\{91120409-6000-11D3-8CFE-0150048383C9}\oisicon.exe
+ 2009-02-28 23:19:38 27,136 ----a-r c:\windows\Installer\{91120409-6000-11D3-8CFE-0150048383C9}\oisicon.exe
- 2008-12-09 23:06:14 4,096 ----a-r c:\windows\Installer\{91120409-6000-11D3-8CFE-0150048383C9}\opwicon.exe
+ 2009-02-28 23:19:38 4,096 ----a-r c:\windows\Installer\{91120409-6000-11D3-8CFE-0150048383C9}\opwicon.exe
- 2008-12-09 23:06:14 794,624 ----a-r c:\windows\Installer\{91120409-6000-11D3-8CFE-0150048383C9}\outicon.exe
+ 2009-02-28 23:19:38 794,624 ----a-r c:\windows\Installer\{91120409-6000-11D3-8CFE-0150048383C9}\outicon.exe
- 2008-12-09 23:06:14 249,856 ----a-r c:\windows\Installer\{91120409-6000-11D3-8CFE-0150048383C9}\pptico.exe
+ 2009-02-28 23:19:37 249,856 ----a-r c:\windows\Installer\{91120409-6000-11D3-8CFE-0150048383C9}\pptico.exe
- 2008-12-09 23:06:15 23,040 ----a-r c:\windows\Installer\{91120409-6000-11D3-8CFE-0150048383C9}\unbndico.exe
+ 2009-02-28 23:19:39 23,040 ----a-r c:\windows\Installer\{91120409-6000-11D3-8CFE-0150048383C9}\unbndico.exe
- 2008-12-09 23:06:14 286,720 ----a-r c:\windows\Installer\{91120409-6000-11D3-8CFE-0150048383C9}\wordicon.exe
+ 2009-02-28 23:19:36 286,720 ----a-r c:\windows\Installer\{91120409-6000-11D3-8CFE-0150048383C9}\wordicon.exe
- 2008-12-09 23:06:14 409,600 ----a-r c:\windows\Installer\{91120409-6000-11D3-8CFE-0150048383C9}\xlicons.exe
+ 2009-02-28 23:19:35 409,600 ----a-r c:\windows\Installer\{91120409-6000-11D3-8CFE-0150048383C9}\xlicons.exe
- 2008-11-13 03:47:50 12,288 ----a-r c:\windows\Installer\{91510409-6000-11D3-8CFE-0150048383C9}\cagicon.exe
+ 2009-02-28 23:20:25 12,288 ----a-r c:\windows\Installer\{91510409-6000-11D3-8CFE-0150048383C9}\cagicon.exe
- 2008-11-13 03:47:51 135,168 ----a-r c:\windows\Installer\{91510409-6000-11D3-8CFE-0150048383C9}\misc.exe
+ 2009-02-28 23:20:25 135,168 ----a-r c:\windows\Installer\{91510409-6000-11D3-8CFE-0150048383C9}\misc.exe
- 2008-11-13 03:47:51 4,096 ----a-r c:\windows\Installer\{91510409-6000-11D3-8CFE-0150048383C9}\opwicon.exe
+ 2009-02-28 23:20:26 4,096 ----a-r c:\windows\Installer\{91510409-6000-11D3-8CFE-0150048383C9}\opwicon.exe
- 2008-11-13 03:47:50 176,128 ----a-r c:\windows\Installer\{91510409-6000-11D3-8CFE-0150048383C9}\visicon.exe
+ 2009-02-28 23:20:25 176,128 ----a-r c:\windows\Installer\{91510409-6000-11D3-8CFE-0150048383C9}\visicon.exe
- 2008-10-16 20:38:34 124,928 ----a-w c:\windows\system32\advpack.dll
+ 2008-12-20 23:15:11 124,928 ----a-w c:\windows\system32\advpack.dll
- 2008-10-16 20:38:34 124,928 ------w c:\windows\system32\dllcache\advpack.dll
+ 2008-12-20 23:15:11 124,928 ------w c:\windows\system32\dllcache\advpack.dll
- 2008-10-16 20:38:34 347,136 ----a-w c:\windows\system32\dllcache\dxtmsft.dll
+ 2008-12-20 23:15:12 347,136 ----a-w c:\windows\system32\dllcache\dxtmsft.dll
- 2008-10-16 20:38:34 214,528 ----a-w c:\windows\system32\dllcache\dxtrans.dll
+ 2008-12-20 23:15:13 214,528 ----a-w c:\windows\system32\dllcache\dxtrans.dll
- 2008-10-16 20:38:35 133,120 ----a-w c:\windows\system32\dllcache\extmgr.dll
+ 2008-12-20 23:15:13 133,120 ----a-w c:\windows\system32\dllcache\extmgr.dll
- 2008-10-16 20:38:35 63,488 ------w c:\windows\system32\dllcache\icardie.dll
+ 2008-12-20 23:15:13 63,488 ------w c:\windows\system32\dllcache\icardie.dll
- 2008-10-16 13:11:09 70,656 ------w c:\windows\system32\dllcache\ie4uinit.exe
+ 2008-12-19 09:10:15 70,656 ------w c:\windows\system32\dllcache\ie4uinit.exe
- 2008-10-16 20:38:35 153,088 ------w c:\windows\system32\dllcache\ieakeng.dll
+ 2008-12-20 23:15:14 153,088 ------w c:\windows\system32\dllcache\ieakeng.dll
- 2008-10-16 20:38:35 230,400 ------w c:\windows\system32\dllcache\ieaksie.dll
+ 2008-12-20 23:15:14 230,400 ------w c:\windows\system32\dllcache\ieaksie.dll
- 2008-10-15 07:04:53 161,792 ------w c:\windows\system32\dllcache\ieakui.dll
+ 2008-12-19 05:23:56 161,792 ------w c:\windows\system32\dllcache\ieakui.dll
- 2008-10-16 20:38:35 383,488 ------w c:\windows\system32\dllcache\ieapfltr.dll
+ 2008-12-20 23:15:15 383,488 ------w c:\windows\system32\dllcache\ieapfltr.dll
- 2008-10-16 20:38:35 384,512 ------w c:\windows\system32\dllcache\iedkcs32.dll
+ 2008-12-20 23:15:16 384,512 ------w c:\windows\system32\dllcache\iedkcs32.dll
- 2008-10-16 20:38:37 6,066,176 ------w c:\windows\system32\dllcache\ieframe.dll
+ 2008-12-20 23:15:21 6,066,688 ------w c:\windows\system32\dllcache\ieframe.dll
- 2008-10-16 20:38:37 44,544 ------w c:\windows\system32\dllcache\iernonce.dll
+ 2008-12-20 23:15:21 44,544 ------w c:\windows\system32\dllcache\iernonce.dll
- 2008-10-16 20:38:37 267,776 ------w c:\windows\system32\dllcache\iertutil.dll
+ 2008-12-20 23:15:22 267,776 ------w c:\windows\system32\dllcache\iertutil.dll
- 2008-10-16 13:11:09 13,824 ------w c:\windows\system32\dllcache\ieudinit.exe
+ 2008-12-19 09:10:15 13,824 ------w c:\windows\system32\dllcache\ieudinit.exe
- 2008-10-15 07:06:26 633,632 ------w c:\windows\system32\dllcache\iexplore.exe
+ 2008-12-19 05:25:25 634,024 ------w c:\windows\system32\dllcache\iexplore.exe
- 2008-10-16 20:38:37 27,648 ----a-w c:\windows\system32\dllcache\jsproxy.dll
+ 2008-12-20 23:15:23 27,648 ----a-w c:\windows\system32\dllcache\jsproxy.dll
- 2008-10-16 20:38:37 459,264 ------w c:\windows\system32\dllcache\msfeeds.dll
+ 2008-12-20 23:15:23 459,264 ------w c:\windows\system32\dllcache\msfeeds.dll
- 2008-10-16 20:38:37 52,224 ------w c:\windows\system32\dllcache\msfeedsbs.dll
+ 2008-12-20 23:15:24 52,224 ------w c:\windows\system32\dllcache\msfeedsbs.dll
- 2008-12-13 06:40:02 3,593,216 ----a-w c:\windows\system32\dllcache\mshtml.dll
+ 2009-01-17 02:35:14 3,594,752 ----a-w c:\windows\system32\dllcache\mshtml.dll
- 2008-10-16 20:38:38 477,696 ----a-w c:\windows\system32\dllcache\mshtmled.dll
+ 2008-12-20 23:15:30 477,696 ----a-w c:\windows\system32\dllcache\mshtmled.dll
- 2008-10-16 20:38:38 193,024 ----a-w c:\windows\system32\dllcache\msrating.dll
+ 2008-12-20 23:15:31 193,024 ----a-w c:\windows\system32\dllcache\msrating.dll
- 2008-10-16 20:38:39 671,232 ----a-w c:\windows\system32\dllcache\mstime.dll
+ 2008-12-20 23:15:32 671,232 ----a-w c:\windows\system32\dllcache\mstime.dll
- 2008-10-16 20:38:39 102,912 ------w c:\windows\system32\dllcache\occache.dll
+ 2008-12-20 23:15:38 102,912 ------w c:\windows\system32\dllcache\occache.dll
- 2008-10-16 20:38:39 44,544 ----a-w c:\windows\system32\dllcache\pngfilt.dll
+ 2008-12-20 23:15:38 44,544 ----a-w c:\windows\system32\dllcache\pngfilt.dll
+ 2008-06-17 19:02:19 8,461,312 ------w c:\windows\system32\dllcache\shell32.dll
- 2008-09-08 10:41:42 333,824 ------w c:\windows\system32\dllcache\srv.sys
+ 2008-12-11 10:57:09 333,952 ------w c:\windows\system32\dllcache\srv.sys
- 2008-10-16 20:38:39 105,984 ------w c:\windows\system32\dllcache\url.dll
+ 2008-12-20 23:15:39 105,984 ------w c:\windows\system32\dllcache\url.dll
- 2008-10-16 20:38:39 1,160,192 ----a-w c:\windows\system32\dllcache\urlmon.dll
+ 2008-12-20 23:15:40 1,160,192 ----a-w c:\windows\system32\dllcache\urlmon.dll
- 2008-10-16 20:38:39 233,472 ------w c:\windows\system32\dllcache\webcheck.dll
+ 2008-12-20 23:15:40 233,472 ------w c:\windows\system32\dllcache\webcheck.dll
- 2008-10-16 20:38:40 826,368 ----a-w c:\windows\system32\dllcache\wininet.dll
+ 2008-12-20 23:15:41 826,368 ----a-w c:\windows\system32\dllcache\wininet.dll
- 2008-09-08 10:41:42 333,824 ----a-w c:\windows\system32\drivers\srv.sys
+ 2008-12-11 10:57:09 333,952 ----a-w c:\windows\system32\drivers\srv.sys
- 2008-10-16 20:38:34 347,136 ----a-w c:\windows\system32\dxtmsft.dll
+ 2008-12-20 23:15:12 347,136 ----a-w c:\windows\system32\dxtmsft.dll
- 2008-10-16 20:38:34 214,528 ----a-w c:\windows\system32\dxtrans.dll
+ 2008-12-20 23:15:13 214,528 ----a-w c:\windows\system32\dxtrans.dll
- 2008-10-16 20:38:35 133,120 ----a-w c:\windows\system32\extmgr.dll
+ 2008-12-20 23:15:13 133,120 ----a-w c:\windows\system32\extmgr.dll
- 2008-10-16 20:38:35 63,488 ----a-w c:\windows\system32\icardie.dll
+ 2008-12-20 23:15:13 63,488 ----a-w c:\windows\system32\icardie.dll
- 2008-10-16 13:11:09 70,656 ----a-w c:\windows\system32\ie4uinit.exe
+ 2008-12-19 09:10:15 70,656 ----a-w c:\windows\system32\ie4uinit.exe
- 2008-10-16 20:38:35 153,088 ----a-w c:\windows\system32\ieakeng.dll
+ 2008-12-20 23:15:14 153,088 ----a-w c:\windows\system32\ieakeng.dll
- 2008-10-16 20:38:35 230,400 ----a-w c:\windows\system32\ieaksie.dll
+ 2008-12-20 23:15:14 230,400 ----a-w c:\windows\system32\ieaksie.dll
- 2008-10-15 07:04:53 161,792 ----a-w c:\windows\system32\ieakui.dll
+ 2008-12-19 05:23:56 161,792 ----a-w c:\windows\system32\ieakui.dll
- 2008-10-16 20:38:35 383,488 ----a-w c:\windows\system32\ieapfltr.dll
+ 2008-12-20 23:15:15 383,488 ----a-w c:\windows\system32\ieapfltr.dll
- 2008-10-16 20:38:35 384,512 ----a-w c:\windows\system32\iedkcs32.dll
+ 2008-12-20 23:15:16 384,512 ----a-w c:\windows\system32\iedkcs32.dll
- 2008-10-16 20:38:37 6,066,176 ----a-w c:\windows\system32\ieframe.dll
+ 2008-12-20 23:15:21 6,066,688 ----a-w c:\windows\system32\ieframe.dll
- 2008-10-16 20:38:37 44,544 ----a-w c:\windows\system32\iernonce.dll
+ 2008-12-20 23:15:21 44,544 ----a-w c:\windows\system32\iernonce.dll
- 2008-10-16 20:38:37 267,776 ----a-w c:\windows\system32\iertutil.dll
+ 2008-12-20 23:15:22 267,776 ----a-w c:\windows\system32\iertutil.dll
- 2008-10-16 13:11:09 13,824 ----a-w c:\windows\system32\ieudinit.exe
+ 2008-12-19 09:10:15 13,824 ----a-w c:\windows\system32\ieudinit.exe
- 2008-10-16 20:38:37 27,648 ----a-w c:\windows\system32\jsproxy.dll
+ 2008-12-20 23:15:23 27,648 ----a-w c:\windows\system32\jsproxy.dll
+ 2009-02-12 01:56:18 21,244,872 ----a-w c:\windows\system32\MRT.exe
- 2008-10-16 20:38:37 459,264 ----a-w c:\windows\system32\msfeeds.dll
+ 2008-12-20 23:15:23 459,264 ----a-w c:\windows\system32\msfeeds.dll
- 2008-10-16 20:38:37 52,224 ----a-w c:\windows\system32\msfeedsbs.dll
+ 2008-12-20 23:15:24 52,224 ----a-w c:\windows\system32\msfeedsbs.dll
- 2008-12-13 06:40:02 3,593,216 ----a-w c:\windows\system32\mshtml.dll
+ 2009-01-17 02:35:14 3,594,752 ----a-w c:\windows\system32\mshtml.dll
- 2008-10-16 20:38:38 477,696 ----a-w c:\windows\system32\mshtmled.dll
+ 2008-12-20 23:15:30 477,696 ----a-w c:\windows\system32\mshtmled.dll
- 2008-10-16 20:38:38 193,024 ----a-w c:\windows\system32\msrating.dll
+ 2008-12-20 23:15:31 193,024 ----a-w c:\windows\system32\msrating.dll
- 2008-10-16 20:38:39 671,232 ----a-w c:\windows\system32\mstime.dll
+ 2008-12-20 23:15:32 671,232 ----a-w c:\windows\system32\mstime.dll
- 2008-10-16 20:38:39 102,912 ----a-w c:\windows\system32\occache.dll
+ 2008-12-20 23:15:38 102,912 ----a-w c:\windows\system32\occache.dll
- 2008-10-16 20:38:39 44,544 ----a-w c:\windows\system32\pngfilt.dll
+ 2008-12-20 23:15:38 44,544 ----a-w c:\windows\system32\pngfilt.dll
- 2008-04-14 00:12:05 8,461,312 ----a-w c:\windows\system32\shell32.dll
+ 2008-06-17 19:02:19 8,461,312 ----a-w c:\windows\system32\shell32.dll
- 2007-11-30 12:39:22 17,272 ------w c:\windows\system32\spmsg.dll
+ 2008-07-09 07:38:24 17,272 ------w c:\windows\system32\spmsg.dll
- 2009-02-28 19:20:37 12,361 ----a-w c:\windows\system32\Tablet.dat
+ 2009-03-03 00:15:44 12,361 ----a-w c:\windows\system32\Tablet.dat
- 2008-10-16 20:38:39 105,984 ----a-w c:\windows\system32\url.dll
+ 2008-12-20 23:15:39 105,984 ----a-w c:\windows\system32\url.dll
- 2008-10-16 20:38:39 1,160,192 ----a-w c:\windows\system32\urlmon.dll
+ 2008-12-20 23:15:40 1,160,192 ----a-w c:\windows\system32\urlmon.dll
- 2008-10-16 20:38:39 233,472 ----a-w c:\windows\system32\webcheck.dll
+ 2008-12-20 23:15:40 233,472 ----a-w c:\windows\system32\webcheck.dll
- 2008-10-16 20:38:40 826,368 ----a-w c:\windows\system32\wininet.dll
+ 2008-12-20 23:15:41 826,368 ----a-w c:\windows\system32\wininet.dll
+ 2009-03-03 00:15:37 16,384 ----atw c:\windows\Temp\Perflib_Perfdata_5bc.dat
.
-- 快照技术重新设置 --
.
((((((((((((((((((((((((((((((((((((( 重要登入点 ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*注意* 空白与合法缺省登录将不会被显示
REGEDIT4
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Creative Detector"="c:\program files\Creative\MediaSource\Detector\CTDetect.exe" [2003-10-02 98304]
"EPSON Stylus C82 Series"="c:\windows\System32\spool\DRIVERS\W32X86\3\E_S0HIC1.EXE" [2003-10-15 99840]
"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2008-04-13 15360]
"swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2007-06-28 68856]
"MSMSGS"="c:\program files\Messenger\msmsgs.exe" [2008-04-13 1695232]
"Google Update"="c:\documents and settings\Dad\Local Settings\Application Data\Google\Update\GoogleUpdate.exe" [2008-09-03 133104]
"DAEMON Tools Lite"="c:\program files\DAEMON Tools Lite\daemon.exe" [2008-01-17 486856]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"WrtMon.exe"="c:\windows\system32\spool\drivers\w32x86\3\WrtMon.exe" [2006-09-20 20480]
"WatchDog"="c:\program files\InterVideo\DVD Check\DVDCheck.exe" [2005-07-04 184320]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2008-11-10 136600]
"SSBkgdUpdate"="c:\program files\Common Files\Scansoft Shared\SSBkgdUpdate\SSBkgdupdate.exe" [2006-09-28 185896]
"SoundMAXPnP"="c:\program files\Analog Devices\SoundMAX\SMax4PNP.exe" [2004-10-14 1388544]
"QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2006-04-29 155648]
"OpwareSE4"="c:\program files\ScanSoft\OmniPageSE4.0\OpwareSE4.exe" [2006-10-11 75304]
"LSBWatcher"="c:\hp\drivers\hplsbwatcher\lsburnwatcher.exe" [2004-10-14 253952]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2006-02-23 278528]
"ISUSScheduler"="c:\program files\Common Files\InstallShield\UpdateService\issch.exe" [2005-02-16 81920]
"ISUSPM Startup"="c:\progra~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe" [2004-07-27 221184]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2005-02-08 155648]
"hpWirelessAssistant"="c:\program files\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe" [2007-10-03 480560]
"HP Software Update"="c:\program files\Hp\HP Software Update\HPWuSchd2.exe" [2007-05-08 54840]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2005-02-08 126976]
"EPSON Stylus C82 Series"="c:\windows\System32\spool\DRIVERS\W32X86\3\E_S0HIC1.EXE" [2003-10-15 99840]
"eabconfg.cpl"="c:\program files\HPQ\Quick Launch Buttons\EabServr.exe" [2006-04-18 405504]
"Cpqset"="c:\program files\HPQ\Default Settings\cpqset.exe" [2005-03-29 233534]
"ccApp"="c:\program files\Common Files\Symantec Shared\ccApp.exe" [2005-12-21 48800]
"Apoint"="c:\program files\Apoint2K\Apoint.exe" [2005-02-08 159744]
"vptray"="c:\progra~1\SYMANT~1\\vptray.exe" [2006-05-26 85744]
"kmw_run.exe"="kmw_run.exe" [2005-09-01 c:\windows\system32\kmw_run.exe]
"AGRSMMSG"="AGRSMMSG.exe" [2005-04-13 c:\windows\AGRSMMSG.exe]
c:\documents and settings\Hanan\Start Menu\Programs\Startup\
OpenOffice.org 2.4.lnk - c:\program files\OpenOffice.org 2.4\program\quickstart.exe [2008-01-21 393216]
c:\documents and settings\May\Start Menu\Programs\Startup\
OpenOffice.org 2.4.lnk - c:\program files\OpenOffice.org 2.4\program\quickstart.exe [2008-01-21 393216]
WKCALREM.LNK - c:\program files\Common Files\Microsoft Shared\Works Shared\WkCalRem.exe [2004-06-23 15360]
c:\documents and settings\Dad\Start Menu\Programs\Startup\
ERUNT AutoBackup.lnk - c:\program files\ERUNT\AUTOBACK.EXE [2005-10-20 38912]
OpenOffice.org 2.4.lnk - c:\program files\OpenOffice.org 2.4\program\quickstart.exe [2008-01-21 393216]
wkcalrem.LNK - c:\program files\Common Files\Microsoft Shared\Works Shared\WkCalRem.exe [2004-06-23 15360]
c:\documents and settings\All Users\Start Menu\Programs\Startup\
DVD Check.lnk - c:\program files\InterVideo\DVD Check\DVDCheck.exe [2007-01-10 184320]
[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"UpdatesDisableNotify"=dword:00000001
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"c:\\Program Files\\Messenger\\msmsgs.exe"=
"c:\\Program Files\\SmartFTP Client 2.0\\SmartFTP.exe"=
"c:\\WINDOWS\\system32\\javaw.exe"=
"c:\\WINDOWS\\system32\\ftp.exe"=
"c:\\Program Files\\Java\\jdk1.5.0_06\\bin\\java.exe"=
"c:\\WINDOWS\\system32\\spool\\drivers\\w32x86\\3\\SAGENT4.EXE"=
"c:\\WINDOWS\\system32\\sessmgr.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\Java\\jdk1.6.0\\bin\\java.exe"=
"c:\\Program Files\\Yahoo!\\Messenger\\YahooMessenger.exe"=
"c:\\Program Files\\iTunes\\iTunes.exe"=
"c:\\Program Files\\Yahoo!\\Messenger\\YServer.exe"=
"c:\\WINDOWS\\system32\\dpvsetup.exe"=
"c:\\Program Files\\GameSpy Arcade\\Aphex.exe"=
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\MSN Messenger\\msnmsgr.exe"=
"c:\\Program Files\\MSN Messenger\\livecall.exe"=
"c:\\eclipse\\eclipse.exe"=
"c:\\Documents and Settings\\Dad\\Application Data\\Macromedia\\Flash Player\\www.macromedia.com\\bin\\octoshape\\octoshape.exe"=
"c:\\Program Files\\Mozilla Firefox\\firefox.exe"=
"c:\\Program Files\\Skype\\Phone\\Skype.exe"=
"c:\\Program Files\\Sierra\\FEARCombat\\FEARMP.exe"=
"c:\\Program Files\\Java\\jre6\\bin\\java.exe"=
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"21862:UDP"= 21862:UDP:Verizon CTA Port
"1597:UDP"= 1597:UDP:Windows Media Format SDK (wmplayer.exe)
"1596:UDP"= 1596:UDP:Windows Media Format SDK (wmplayer.exe)
R2 SavRoam;SAVRoam;c:\program files\Symantec AntiVirus\SavRoam.exe [2006-05-26 169200]
R3 Eacfilt;Eacfilt Miniport;c:\windows\system32\drivers\eacfilt.sys [2007-04-11 24521]
R3 EraserUtilRebootDrv;EraserUtilRebootDrv;c:\program files\Common Files\Symantec Shared\eengine\EraserUtilRebootDrv.sys [2009-02-28 101936]
S3 ctad;Cisco Trust Agent;c:\program files\Cisco Systems\CiscoTrustAgent\ctad.exe [2004-10-22 553035]
S3 ctalogd;Cisco Trust Agent Event Logging Service;c:\program files\Cisco Systems\CiscoTrustAgent\ctalogd.exe [2004-10-22 90112]
S3 ExtranetAccess;Contivity VPN Service;c:\program files\Nortel Networks\Extranet_serv.exe [2005-11-04 811008]
S3 getPlus(R) Helper;getPlus(R) Helper;c:\program files\NOS\bin\getPlus_HelperSvc.exe [2008-10-18 33752]
S3 IPSECEXT;Nortel Extranet Access Protocol;c:\windows\system32\drivers\ipsecw2k.sys [2005-11-04 155184]
S3 Tomcat5;Apache Tomcat;c:\program files\Apache Software Foundation\Tomcat 5.5\bin\tomcat5.exe [2006-04-14 102400]
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{f50e5e8c-9469-11da-a61a-444553544200}]
\Shell\AutoRun\command - setupSNK.exe
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{10880D85-AAD9-4558-ABDC-2AB1552D831F}]
"c:\program files\Common Files\LightScribe\LSRunOnce.exe"
.
‘计划任务’ 文件夹 里的内容
2009-03-03 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-3306096642-3123241714-1870812128-1013.job
- c:\documents and settings\Dad\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [2008-09-03 22:47]
2009-03-03 c:\windows\Tasks\查看 Windows Live Toolbar 的更新資訊.job
- c:\program files\Windows Live Toolbar\MSNTBUP.EXE [2007-10-19 11:20]
.
.
------- 而外的扫描 -------
.
uStart Page = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=EN_US&c=Q405&bd=pavilion&pf=laptop
mSearch Bar = hxxp://us.rd.yahoo.com/customize/ie/defaults/sb/msgr8/*http://www.yahoo.com/ext/search/search.html
uInternet Connection Wizard,ShellNext = hxxp://192.168.1.1/start.htm
IE: &Google Search - c:\program files\google\GoogleToolbar1.dll/cmsearch.html
IE: &Translate English Word - c:\program files\google\GoogleToolbar1.dll/cmwordtrans.html
IE: &Windows Live Search - c:\program files\Windows Live Toolbar\msntb.dll/search.htm
IE: Backward Links - c:\program files\google\GoogleToolbar1.dll/cmbacklinks.html
IE: Cached Snapshot of Page - c:\program files\google\GoogleToolbar1.dll/cmcache.html
IE: Download with Star Downloader - c:\program files\Star Downloader\sdie.htm
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~4\OFFICE11\EXCEL.EXE/3000
IE: Similar Pages - c:\program files\google\GoogleToolbar1.dll/cmsimilar.html
IE: Translate Page into English - c:\program files\google\GoogleToolbar1.dll/cmtrans.html
IE: {{F2C3214F-043E-4F1D-B727-3DEB78AA0974} - c:\program files\FreshDevices\FreshDownload\fd.exe
Trusted Zone: aol.com\free
DPF: {00D9C306-6B11-492A-9AFC-C53CE30849CF} - file:///C:/Siebel/7.8/Client/PUBLIC/enu/19213/applets/SiebelAx_Smartscript.cab
DPF: {06314967-EECF-11D2-9D64-0000949887BE} - file:///C:/Siebel/7.8/dclient/PUBLIC/enu/19213/applets/SiebelAx_ERM_ContentSync.cab
DPF: {0D68687A-A2A3-46EB-9ED9-956C83875A6C} - file:///C:/Siebel/7.8/dclient/PUBLIC/enu/19213/applets/SiebelAx_Marketing_HTML_Editor.cab
DPF: {169ADD4B-EE8B-4B27-B332-2941A82DA7E2} - file:///C:/Siebel/7.8/dclient/PUBLIC/enu/19213/applets/SiebelAx_Microsite_Layout.cab
DPF: {16C7BBB7-738A-47D7-956E-52DD9A166A9A} - file:///C:/Siebel/7.8/Client/PUBLIC/enu/19213/applets/SiebelAx_Marketing_Calendar.cab
DPF: {1D922C61-16AB-4179-8302-6B8A688C88D0} - file:///C:/Siebel/7.8/dclient/PUBLIC/enu/19213/applets/SiebelAx_Container_Control.cab
DPF: {30C1F757-58DC-45A1-9135-D4AB30932E62} - hxxp://home-laptop1/20405/applets/SiebelAx_iHelp.cab
DPF: {353F130D-72DB-4F14-B750-625F90D75D1B} - file:///C:/Siebel/7.8/dclient/PUBLIC/enu/19213/applets/SiebelAx_Test_Automation.cab
DPF: {3E8C4740-70C5-439E-AE2F-16234083E248} - file:///C:/Siebel/7.8/Client/PUBLIC/enu/19213/applets/SiebelAx_HI_Client.cab
DPF: {48CE1C1F-092D-461C-A385-A0C3D19FE052} - file:///C:/Siebel/7.8/dclient/PUBLIC/enu/19213/applets/SiebelAx_iHelp.cab
DPF: {5FCAD8CF-85C1-4FD9-BD04-995CBEBA5BEB} - file:///C:/Siebel/7.8/dclient/PUBLIC/enu/19213/applets/SiebelAx_Hospitality_Gantt.cab
DPF: {61CE1CA1-6577-49B6-AE2C-43007A942429} - hxxps://webcast.accenture.com/v2/WebcastLog/WebcastInfo.CAB
DPF: {73EF83D1-DA75-4F58-8DB6-1CD6D8F9C8A1} - file:///C:/Siebel/7.8/Client/PUBLIC/enu/19213/applets/SiebelAx_Calendar.cab
DPF: {756E01C3-2CF9-4364-8724-B8C850CB0D50} - file:///C:/Siebel/7.8/dclient/PUBLIC/enu/19213/applets/SiebelAx_UInbox.cab
DPF: {7D731A83-6C80-4EA4-9646-5E06A0513274} - hxxp://www.shockwave.com/content/ballistik/sis/slgwebinstall.cab
DPF: {8C244272-1DC1-4CE7-9C6C-FABCA09EB543} - file:///C:/Siebel/7.8/dclient/PUBLIC/enu/19213/applets/SiebelAx_Desktop_Integration.cab
DPF: {96A3E5AB-C228-4D1D-B31F-712BA35EE470} - file:///C:/Siebel/7.8/Client/PUBLIC/enu/19213/applets/SiebelAx_Gantt_Chart.cab
DPF: {A07F0AC9-D8AD-449A-BE90-668F5263B261} - hxxp://home-laptop1/20405/applets/SiebelAx_HI_Client.cab
DPF: {BF17C411-9ADA-4C73-B12C-BD814BDE187F} - hxxps://mylearning.accenture.com/accenture/core/common/ScheduleServices/ScheduleServices.cab
DPF: {C5FEEC93-506D-4B41-A38B-3A59BF5B41AB} - file:///C:/Siebel/7.8/Client/PUBLIC/enu/19213/applets/SiebelAx_CTI_Toolbar.cab
DPF: {C657D5D2-D725-4F0E-91A9-EA74647DCF84} - file:///C:/Siebel/7.8/Client/PUBLIC/enu/19213/applets/SiebelAx_Marketing_Allocation.cab
DPF: {D6CC2526-859B-40C0-8515-1A47946478B6} - file:///C:/Siebel/7.8/Client/PUBLIC/enu/19213/applets/SiebelAx_OutBound_mail.cab
DPF: {EFB7D763-97A3-11CF-AE19-00608CEADE00} - file:///C:/Siebel/7.8/dclient/PUBLIC/enu/19213/applets/iTools.cab
FF - ProfilePath - c:\documents and settings\Dad\Application Data\Mozilla\Firefox\Profiles\ir4t8dpt.default\
FF - prefs.js: browser.search.selectedEngine - Google
FF - prefs.js: browser.startup.homepage - hxxp://www.google.com/
FF - component: c:\documents and settings\Dad\Application Data\Mozilla\Firefox\Profiles\ir4t8dpt.default\extensions\{a7c6cf7f-112c-4500-a7ea-39801a327e5f}\platform\WINNT_x86-msvc\components\ipc.dll
FF - component: c:\documents and settings\Dad\Application Data\Mozilla\Firefox\Profiles\ir4t8dpt.default\extensions\speedtest@gotomyhelp.com\components\NetDiag.dll
FF - plugin: c:\documents and settings\Dad\Application Data\Mozilla\Firefox\Profiles\ir4t8dpt.default\extensions\moveplayer@movenetworks.com\platform\WINNT_x86-msvc\plugins\npmnqmp071101000055.dll
FF - plugin: c:\documents and settings\Dad\Local Settings\Application Data\Google\Update\1.2.141.5\npGoogleOneClick7.dll
FF - plugin: c:\progra~1\Yahoo!\Common\npyaxmpb.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\npatgpc.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\npqtplugin8.dll
FF - plugin: c:\program files\QuickTime\Plugins\npqtplugin8.dll
.
**************************************************************************
catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-03-02 19:46:38
Windows 5.1.2600 Service Pack 3 NTFS
扫描被隐藏的进程 。。。
扫描被隐藏的启动组 。。。
HKLM\Software\Microsoft\Windows\CurrentVersion\Run
Cpqset = c:\program files\HPQ\Default Settings\cpqset.exe???????2?4?1?7??P??? ??B?????????????hLC? ?????
扫描被隐藏的文件 。。。
扫描完成
被隐藏的档案: 0
**************************************************************************
[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\MySQL]
"ImagePath"="\"c:\program files\MySQL\MySQL Server 5.0\bin\mysqld-nt\" --defaults-file=\"c:\program files\MySQL\MySQL Server 5.0\my.ini\" MySQL"
.
------------------------ 其他运行进程 ------------------------
.
c:\program files\Common Files\Symantec Shared\ccEvtMgr.exe
c:\program files\Common Files\Symantec Shared\ccSetMgr.exe
c:\program files\Common Files\Symantec Shared\SNDSrvc.exe
c:\program files\Lavasoft\Ad-Aware\aawservice.exe
c:\program files\Symantec AntiVirus\DefWatch.exe
c:\program files\Java\jre6\bin\jqs.exe
c:\program files\Common Files\LightScribe\LSSrvc.exe
c:\program files\Common Files\Motive\McciCMService.exe
c:\program files\Analog Devices\SoundMAX\SMAgent.exe
c:\windows\system32\Tablet.exe
c:\windows\system32\wdfmgr.exe
c:\program files\Hewlett-Packard\Shared\hpqWmiEx.exe
c:\program files\Canon\CAL\CALMAIN.exe
c:\windows\system32\conime.exe
c:\windows\system32\spool\drivers\w32x86\3\WrtProc.exe
c:\program files\iPod\bin\iPodService.exe
c:\program files\Hewlett-Packard\Shared\HpqToaster.exe
c:\program files\Apoint2K\ApntEx.exe
c:\program files\Symantec AntiVirus\VPTray.exe
c:\program files\Symantec AntiVirus\Rtvscan.exe
c:\windows\system32\wscntfy.exe
.
**************************************************************************
.
完成时间: 2009-03-02 19:50:55 - 电脑已重新启动
ComboFix-quarantined-files.txt 2009-03-03 00:50:32
ComboFix2.txt 2009-02-28 19:30:53
Pre-Run: 50,407,936,000 bytes free
Post-Run: 50,337,460,224 bytes free
492 --- E O F --- 2009-02-28 23:23:03