F3C74E3FA248.dll 中 "Possible_Infostl"

MyChat 數位男女
手機版
地圖
簡體
您是第 19903 個閱讀者
可列印版加為IE收藏收藏主題上一主題 | 下一主題
x3333x
級別: 初露鋒芒
x73
x765
▼
[問題討論] F3C74E3FA248.dll 中 "Possible_Infostl"
圖 1.
這三天幾天解了n次，都解不掉！
請諸位大大提供解決方法，謝謝。

x0 [樓主] From：臺灣 \| Posted：2007-11-07 16:00 \|
彗星風采
級別: 小人物
x24
▲ ▼
請參考置頂文章貼SREng報表上來判讀..

x0 [1 樓] From：臺灣中華電信HINET \| Posted：2007-11-07 18:22 \|
x3333x
級別: 初露鋒芒
x73
x765
▲ ▼
複製程式

2007-11-07,19:26:56

System Repair Engineer 2.5.16.900
Smallfrogs ([url]http://www.KZTechs.com[/url])

Windows XP Professional Service Pack 2 (Build 2600) - 管理許可權用戶 - 完整功能

以下內容被選中：
    所有的啟動項目（包括註冊表、開機檔案夾、服務等）
    流覽器載入項
    正在運行的進程（包括進程模組資訊）
    文件關聯
    Winsock 提供者
    Autorun.inf
    HOSTS 文件
    進程特權掃描


啟動專案
註冊表
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
    <ctfmon.exe><C:\WINDOWS\system32\ctfmon.exe>  [(Verified)Microsoft Windows Publisher]
    <updateMgr><C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe AcRdB7_0_9>  [N/A]
    <MsnMsgr><"C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background>  [N/A]
    <YSearchProtection><C:\Program Files\Yahoo!\Search Protection\SearchProtection.exe>  [(Verified)Yahoo! Inc.]
    <kava><C:\WINDOWS\system32\kavo.exe>  []
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
    <NvCplDaemon><RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup>  [(Verified)Microsoft Windows Publisher]
    <tasa><C:\DOCUME~1\pa-hoo\LOCALS~1\Temp\taso.exe>  [N/A]
    <!AVG Anti-Spyware><"C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized>  [(Verified)GRISOFT LTD]
    <YSearchProtection><"C:\Program Files\Yahoo!\Search Protection\SearchProtection.exe">  [(Verified)Yahoo! Inc.]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
    <shell><Explorer.exe>  [(Verified)Microsoft Windows Component Publisher]
    <Userinit><C:\WINDOWS\system32\userinit.exe,>  [(Verified)Microsoft Windows Component Publisher]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Windows]
    <AppInit_DLLs><>  [N/A]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
    <UIHost><logonui.exe>  [(Verified)Microsoft Windows Publisher]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
    <{57B86673-276A-48B2-BAE7-C6DBB3020EB8}><C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\shellexecutehook.dll>  [(Verified)GRISOFT LTD]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\<{12d0ed0d-0ee0-4f90-8827-78cefb8f4988}]
    <IE7 Uninstall Stub><C:\WINDOWS\system32\ieudinit.exe>  [(Verified)Microsoft Windows Component Publisher]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\>{881dd1c5-3dcf-431b-b061-f3f88e8be88a}]
    <Outlook Express><%systemroot%\system32\shmgrate.exe OCInstallUserConfigOE>  [N/A]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{2C7339CF-2B09-4501-B3F3-F3508C9228ED}]
    <Themes Setup><%SystemRoot%\system32\regsvr32.exe /s /n /i:/UserInstall %SystemRoot%\system32\themeui.dll>  [N/A]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{44BBA840-CC51-11CF-AAFA-00AA00B6015C}]
    <Microsoft Outlook Express 6><"%ProgramFiles%\Outlook Express\setup50.exe" /APP:OE /CALLER:WINNT /user /install>  [N/A]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{44BBA842-CC51-11CF-AAFA-00AA00B6015B}]
    <NetMeeting 3.01><rundll32.exe advpack.dll,LaunchINFSection C:\WINDOWS\INF\msnetmtg.inf,NetMtg.Install.PerUser.NT>  [(Verified)Microsoft Windows Publisher]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{6BF52A52-394A-11d3-B153-00C04F79FAA6}]
    <Microsoft Windows Media Player><rundll32.exe advpack.dll,LaunchINFSection C:\WINDOWS\INF\wmp.inf,PerUserStub>  [(Verified)Microsoft Windows Publisher]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{7790769C-0471-11d2-AF11-00C04FA35D02}]
    <Address Book 6><"%ProgramFiles%\Outlook Express\setup50.exe" /APP:WAB /CALLER:WINNT /user /install>  [N/A]

==================================
開機檔案夾
[Adobe Reader Speed Launch]
  <C:\Documents and Settings\All Users\「開始」功能表\程式集\啟動\Adobe Reader Speed Launch.lnk --> C:\PROGRA~1\Adobe\ACROBA~2.0\Reader\READER~1.EXE [Adobe Systems Incorporated]><N>
[ADSL]
  <C:\Documents and Settings\pa-hoo\「開始」功能表\程式集\啟動\ADSL.lnk -->  [N/A]><N>

==================================
服務
[AVG Anti-Spyware Guard / AVG Anti-Spyware Guard][Running/Auto Start]
  <C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe><GRISOFT s.r.o.>
[Human Interface Device Access / HidServ][Stopped/Disabled]
  <C:\WINDOWS\System32\svchost.exe -k netsvcs-->%SystemRoot%\System32\hidserv.dll><N/A>
[NVIDIA Display Driver Service / NVSvc][Running/Auto Start]
  <C:\WINDOWS\system32\nvsvc32.exe><NVIDIA Corporation>
[Trend Micro Personal Firewall / PccPfw][Running/Auto Start]
  <C:\Program Files\Trend Micro\PC-cillin 2004\PccPfw.exe><Trend Micro Incorporated.>
[Trend NT Realtime Service / Tmntsrv][Running/Auto Start]
  <"C:\Program Files\Trend Micro\PC-cillin 2004\Tmntsrv.exe"><Trend Micro Incorporated.>
[Trend Micro Proxy Service / tmproxy][Running/Auto Start]
  <C:\Program Files\Trend Micro\PC-cillin 2004\tmproxy.exe><Trend Micro Incorporated.>

==================================
驅動程式
[AMD Processor Driver / AmdK8][Running/System Start]
  <system32\DRIVERS\AmdK8.sys><Advanced Micro Devices>
[AVG Anti-Spyware Driver / AVG Anti-Spyware Driver][Running/System Start]
  <\??\C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.sys><N/A>
[AVG Anti-Spyware Clean Driver / AvgAsCln][Running/System Start]
  <System32\DRIVERS\AvgAsCln.sys><GRISOFT, s.r.o.>
[Microsoft UAA 匯流排驅動程式 (適用於 High Definition Audio) / HDAudBus][Running/Manual Start]
  <system32\DRIVERS\HDAudBus.sys><Windows (R) Server 2003 DDK provider>
[Service for Realtek HD Audio (WDM) / IntcAzAudAddService][Running/Manual Start]
  <system32\drivers\RtkHDAud.sys><Realtek Semiconductor Corp.>
[nv / nv][Running/Manual Start]
  <system32\DRIVERS\nv4_mini.sys><NVIDIA Corporation>
[nvata / nvata][Running/Boot Start]
  <\SystemRoot\system32\DRIVERS\nvata.sys><NVIDIA Corporation>
[NVIDIA nForce Networking Controller Driver / NVENETFD][Running/Manual Start]
  <system32\DRIVERS\NVENETFD.sys><NVIDIA Corporation>
[NVIDIA Network Bus Enumerator / nvnetbus][Running/Manual Start]
  <system32\DRIVERS\nvnetbus.sys><NVIDIA Corporation>
[直接平行連接埠連結驅動程式 / Ptilink][Running/Manual Start]
  <system32\DRIVERS\ptilink.sys><Parallel Technologies, Inc.>
[Secdrv / Secdrv][Stopped/Manual Start]
  <system32\DRIVERS\secdrv.sys><N/A>
[Tmfilter / Tmfilter][Running/Auto Start]
  <system32\drivers\TmXPFlt.sys><Trend Micro Inc.>
[Tmpreflt / Tmpreflt][Running/Auto Start]
  <system32\drivers\Tmpreflt.sys><Trend Micro Inc.>
[Trend Micro TDI Driver / tmtdi][Running/System Start]
  <\SystemRoot\System32\Drivers\tmtdi.sys><Trend Micro Inc.>
[Common Firewall Driver / tm_cfw][Running/Auto Start]
  <\SystemRoot\System32\Drivers\tm_cfw.sys><Trend Micro Inc.>
[Vsapint / Vsapint][Running/Auto Start]
  <system32\drivers\Vsapint.sys><Trend Micro Inc.>
[wedcfvbghj / wedcfvbghj][Running/Manual Start]
  <2 - 系統找不到指定的檔案。
><N/A>

==================================
流覽器載入項
[&Yahoo! Toolbar Helper]
  {02478D38-C3F9-4efb-9B51-7695ECA05670} <C:\Program Files\Yahoo!\Companion\Installs\cpn0\yt.dll, Yahoo! Inc.>
[Adobe PDF Reader Link Helper]
  {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} <C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll, Adobe Systems Incorporated>
[參考資料(&R)]
  {92780B25-18CC-41C8-B9BE-3C9C571A8263} <C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL, Microsoft Corporation>
[Yahoo!奇摩捷徑列]
  {EF99BD32-C1FB-11D2-892F-0090271D4F88} <C:\Program Files\Yahoo!\Companion\Installs\cpn0\yt.dll, Yahoo! Inc.>
[RALOG Class]
  {0FD3D8F2-9174-42BD-BC7A-AD1CAE413536} <C:\WINDOWS\Downloaded Program Files\RALATL.dll, >
[Windows Genuine Advantage Validation Tool]
  {17492023-C23A-453E-A040-C7C580BBF700} <C:\WINDOWS\system32\LegitCheckControl.DLL, Microsoft Corporation>
[WUWebControl Class]
  {6414512B-B978-451D-A0D8-FCFDF33E833C} <C:\WINDOWS\system32\wuweb.dll, Microsoft Corporation>
[FSXMLATL Class]
  {95B7355A-15B6-43B5-8CA9-1A33ADE5B32D} <C:\WINDOWS\Downloaded Program Files\FSXMLCAPIATL.dll, >
[EnvDetect Class]
  {9D10CDAC-AD9D-478A-BA49-4924481B20A6} <C:\WINDOWS\Downloaded Program Files\EnvDetectATL.dll, >
[a-squared Scanner]
  {BB21F850-63F4-4EC9-BF9D-565BD30C9AE9} <C:\WINDOWS\DOWNLO~1\asquared.ocx, Emsi Software GmbH>
[Shockwave Flash Object]
  {D27CDB6E-AE6D-11CF-96B8-444553540000} <C:\WINDOWS\system32\Macromed\Flash\Flash9b.ocx, Adobe Systems, Inc.>
[Persits Software XEncrypt]
  {F9463571-87CB-4A90-A1AC-2284B7F5AF4E} <C:\WINDOWS\Downloaded Program Files\aspencrypt.dll, Persits Software, Inc.>
[&Yahoo! Toolbar Helper]
  {02478D38-C3F9-4EFB-9B51-7695ECA05670} <C:\Program Files\Yahoo!\Companion\Installs\cpn0\yt.dll, Yahoo! Inc.>
[Adobe PDF Reader Link Helper]
  {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} <C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll, Adobe Systems Incorporated>
[RALOG Class]
  {0FD3D8F2-9174-42BD-BC7A-AD1CAE413536} <C:\WINDOWS\Downloaded Program Files\RALATL.dll, >
[CEnroll Class]
  {127698E4-E730-4E5C-A2B1-21490A70C8A1} <C:\WINDOWS\system32\xenroll.dll, Microsoft Corporation>
[Windows Genuine Advantage Validation Tool]
  {17492023-C23A-453E-A040-C7C580BBF700} <C:\WINDOWS\system32\LegitCheckControl.DLL, Microsoft Corporation>
[InformationCardSigninHelper Class]
  {19916E01-B44E-4E31-94A4-4696DF46157B} <C:\WINDOWS\system32\icardie.dll, Microsoft Corporation>
[Windows Media Player]
  {22D6F312-B0F6-11D0-94AB-0080C74C7E95} <C:\WINDOWS\system32\wmpdxm.dll, Microsoft Corporation>
[HTML Document]
  {25336920-03F9-11CF-8FD0-00AA00686F13} <C:\WINDOWS\system32\mshtml.dll, Microsoft Corporation>
[XML DOM Document]
  {2933BF90-7B36-11D2-B20E-00C04F983E60} <%SystemRoot%\system32\msxml3.dll, N/A>
[DHTML Edit Control Safe for Scripting for IE5]
  {2D360201-FFF5-11D1-8D03-00A0C959BC0A} <C:\Program Files\Common Files\Microsoft Shared\Triedit\dhtmled.ocx, Microsoft Corporation>
[HtmlDlgSafeHelper Class]
  {3050F819-98B5-11CF-BB82-00AA00BDCE0B} <C:\WINDOWS\system32\mshtmled.dll, Microsoft Corporation>
[YInstStarter Class]
  {30528230-99F7-4BB4-88D8-FA1D4F56A2AB} <C:\WINDOWS\cache\yinsthelper.dll, Yahoo! Inc.>
[Tabular Data Control]
  {333C7BC4-460F-11D0-BC04-0080C7055A83} <C:\WINDOWS\system32\tdc.ocx, Microsoft Corporation>
[IETag Factory]
  {38481807-CA0E-42D2-BF39-B33AF135CC4D} <C:\PROGRA~1\COMMON~1\MICROS~1\SMARTT~1\IETAG.DLL, Microsoft Corporation>
[XML Document]
  {48123BC4-99D9-11D1-A6B3-00C04FD91555} <%SystemRoot%\system32\msxml3.dll, N/A>
[Shell Name Space]
  {55136805-B2DE-11D1-B9F2-00A0C98BC547} <C:\WINDOWS\system32\ieframe.dll, Microsoft Corporation>
[KENCAPI Class]
  {5F4D222D-5EEE-40A8-8810-5642B4E4F441} <C:\Program Files\Formosoft\TCB_FSCAPIATL\FSCAPIATL.dll, Formosoft>
[WUWebControl Class]
  {6414512B-B978-451D-A0D8-FCFDF33E833C} <C:\WINDOWS\system32\wuweb.dll, Microsoft Corporation>
[Windows Media Player]
  {6BF52A52-394A-11D3-B153-00C04F79FAA6} <C:\WINDOWS\system32\wmp.dll, Microsoft Corporation>
[Microsoft Web Browser]
  {8856F961-340A-11D0-A96B-00C04FD705A2} <C:\WINDOWS\system32\ieframe.dll, Microsoft Corporation>
[XML DOM Document 5.0]
  {88D969E5-F192-11D4-A65F-0040963251E5} <C:\Program Files\Common Files\Microsoft Shared\OFFICE11\MSXML5.DLL, Microsoft Corporation>
[FSXMLATL Class]
  {95B7355A-15B6-43B5-8CA9-1A33ADE5B32D} <C:\WINDOWS\Downloaded Program Files\FSXMLCAPIATL.dll, >
[EnvDetect Class]
  {9D10CDAC-AD9D-478A-BA49-4924481B20A6} <C:\WINDOWS\Downloaded Program Files\EnvDetectATL.dll, >
[SharePoint OpenDocuments Class]
  {9F9C4924-C3F3-4459-A396-9E9E0D8B83D1} <C:\PROGRA~1\MICROS~2\OFFICE11\OWSSUPP.DLL, Microsoft Corporation>
[Microsoft Scriptlet Component]
  {AE24FDAE-03C6-11D1-8B76-0080C744F389} <C:\WINDOWS\system32\mshtml.dll, Microsoft Corporation>
[a-squared Scanner]
  {BB21F850-63F4-4EC9-BF9D-565BD30C9AE9} <C:\WINDOWS\DOWNLO~1\asquared.ocx, Emsi Software GmbH>
[RDS.DataSpace]
  {BD96C556-65A3-11D0-983A-00C04FC29E36} <C:\Program Files\Common Files\System\msadc\msadco.dll, Microsoft Corporation>
[SharePoint Spreadsheet Launcher]
  {BDEADE9E-C265-11D0-BCED-00A0C90AB50F} <C:\PROGRA~1\MICROS~2\OFFICE11\OWSCLT.DLL, Microsoft Corporation>
[SharePoint Stssync Handler]
  {BDEADEF4-C265-11D0-BCED-00A0C90AB50F} <C:\PROGRA~1\MICROS~2\OFFICE11\OWSSUPP.DLL, Microsoft Corporation>
[AUDIO__MID Moniker Class]
  {CD3AFA74-B84F-48F0-9393-7EDC34128127} <C:\WINDOWS\system32\wmp.dll, Microsoft Corporation>
[AUDIO__MP3 Moniker Class]
  {CD3AFA76-B84F-48F0-9393-7EDC34128127} <C:\WINDOWS\system32\wmp.dll, Microsoft Corporation>
[AUDIO__WAV Moniker Class]
  {CD3AFA7B-B84F-48F0-9393-7EDC34128127} <C:\WINDOWS\system32\wmp.dll, Microsoft Corporation>
[AUDIO__X_MS_WMA Moniker Class]
  {CD3AFA84-B84F-48F0-9393-7EDC34128127} <C:\WINDOWS\system32\wmp.dll, Microsoft Corporation>
[VIDEO__MPEG Moniker Class]
  {CD3AFA89-B84F-48F0-9393-7EDC34128127} <C:\WINDOWS\system32\wmp.dll, Microsoft Corporation>
[VIDEO__X_MS_ASF Moniker Class]
  {CD3AFA8F-B84F-48F0-9393-7EDC34128127} <C:\WINDOWS\system32\wmp.dll, Microsoft Corporation>
[VIDEO__X_MS_WMV Moniker Class]
  {CD3AFA94-B84F-48F0-9393-7EDC34128127} <C:\WINDOWS\system32\wmp.dll, Microsoft Corporation>
[Shockwave Flash Object]
  {D27CDB6E-AE6D-11CF-96B8-444553540000} <C:\WINDOWS\system32\Macromed\Flash\Flash9b.ocx, Adobe Systems, Inc.>
[XML HTTP Request]
  {ED8C108E-4349-11D2-91A4-00C04F7969E8} <%SystemRoot%\system32\msxml3.dll, N/A>
[Yahoo!奇摩捷徑列]
  {EF99BD32-C1FB-11D2-892F-0090271D4F88} <C:\Program Files\Yahoo!\Companion\Installs\cpn0\yt.dll, Yahoo! Inc.>
[XML DOM Document 3.0]
  {F5078F32-C551-11D3-89B9-0000F81FE221} <%SystemRoot%\system32\msxml3.dll, N/A>
[XML HTTP 3.0]
  {F5078F35-C551-11D3-89B9-0000F81FE221} <%SystemRoot%\system32\msxml3.dll, N/A>
[XML DOM Document]
  {F6D90F11-9C73-11D3-B32E-00C04F990BB4} <%SystemRoot%\system32\msxml3.dll, N/A>
[XML HTTP]
  {F6D90F16-9C73-11D3-B32E-00C04F990BB4} <%SystemRoot%\system32\msxml3.dll, N/A>
[Persits Software XEncrypt]
  {F9463571-87CB-4A90-A1AC-2284B7F5AF4E} <C:\WINDOWS\Downloaded Program Files\aspencrypt.dll, Persits Software, Inc.>
[匯出至 Microsoft Office Excel(&X)]
  <res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000, N/A>

==================================
正在運行的進程
[PID: 616 / SYSTEM][\SystemRoot\System32\smss.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 680 / SYSTEM][\??\C:\WINDOWS\system32\csrss.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 704 / SYSTEM][\??\C:\WINDOWS\system32\winlogon.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 748 / SYSTEM][C:\WINDOWS\system32\services.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 760 / SYSTEM][C:\WINDOWS\system32\lsass.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 940 / SYSTEM][C:\WINDOWS\system32\svchost.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 988 / NETWORK SERVICE][C:\WINDOWS\system32\svchost.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 1080 / SYSTEM][C:\WINDOWS\System32\svchost.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 1128 / NETWORK SERVICE][C:\WINDOWS\system32\svchost.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 1232 / LOCAL SERVICE][C:\WINDOWS\system32\svchost.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 1440 / pa-hoo][C:\WINDOWS\Explorer.EXE]  [Microsoft Corporation, 6.00.2900.3156 (xpsp_sp2_gdr.070613-1234)]
    [C:\WINDOWS\HELP\F3C74E3FA248.dll]  [N/A, ]
    [C:\WINDOWS\system32\kavo1.dll]  [N/A, ]
    [C:\Program Files\Adobe\Acrobat 7.0\ActiveX\PDFShell.dll]  [Adobe Systems, Inc., 7.0.0.0]
    [C:\WINDOWS\system32\nvcpl.dll]  [NVIDIA Corporation, 6.14.10.9148]
    [C:\WINDOWS\system32\NVRSZHT.DLL]  [NVIDIA Corporation, 6.14.10.9148]
    [C:\WINDOWS\system32\nvapi.dll]  [N/A, ]
    [C:\WINDOWS\system32\nvshell.dll]  [, ]
    [C:\Program Files\Trend Micro\PC-cillin 2004\Tmdshell.dll]  [Trend Micro Incorporated., 11.0.0.1264]
    [C:\PROGRA~1\WINZIP\WZSHLSTB.DLL]  [WinZip Computing, Inc., 4.1 (32-bit)]
    [C:\Program Files\WinRAR\rarext.dll]  [N/A, ]
    [C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\context.dll]  [GRISOFT s.r.o., 7, 5, 1, 36]
[PID: 1468 / SYSTEM][C:\WINDOWS\system32\spoolsv.exe]  [Microsoft Corporation, 5.1.2600.2696 (xpsp_sp2_gdr.050610-1519)]
    [C:\WINDOWS\system32\mdimon.dll]  [Microsoft Corporation, 11.3.1897.0]
    [C:\WINDOWS\System32\spool\PRTPROCS\W32X86\mdippr.dll]  [Microsoft Corporation, 11.3.1897.0]
[PID: 1724 / pa-hoo][C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe]  [GRISOFT s.r.o., 7, 5, 1, 43]
    [C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\engine.dll]  [GRISOFT s.r.o., 4, 2, 0, 19]
    [C:\WINDOWS\system32\kavo1.dll]  [N/A, ]
    [C:\WINDOWS\HELP\F3C74E3FA248.dll]  [N/A, ]
[PID: 1732 / pa-hoo][C:\Program Files\Yahoo!\Search Protection\SearchProtection.exe]  [Yahoo! Inc., 2007, 6, 8, 1]
    [C:\Program Files\Yahoo!\Search Protection\fdload.dll]  [Yahoo! Inc., 2007, 7, 30, 1]
[PID: 1740 / pa-hoo][C:\WINDOWS\system32\ctfmon.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
    [C:\WINDOWS\HELP\F3C74E3FA248.dll]  [N/A, ]
[PID: 1920 / SYSTEM][C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe]  [GRISOFT s.r.o., 7, 5, 1, 22]
    [C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\engine.dll]  [GRISOFT s.r.o., 4, 2, 0, 19]
[PID: 1988 / SYSTEM][C:\WINDOWS\system32\nvsvc32.exe]  [NVIDIA Corporation, 6.14.10.9148]
    [C:\WINDOWS\system32\nvapi.dll]  [N/A, ]
[PID: 2028 / SYSTEM][C:\Program Files\Trend Micro\PC-cillin 2004\Tmntsrv.exe]  [Trend Micro Incorporated., 11.0.0.1264]
    [C:\Program Files\Trend Micro\PC-cillin 2004\tmdbg.dll]  [N/A, ]
    [C:\Program Files\Trend Micro\PC-cillin 2004\pewnt2.dll]  [Trend Micro Incorporated., 11.0.0.1264]
[PID: 344 / SYSTEM][C:\Program Files\Trend Micro\PC-cillin 2004\tmproxy.exe]  [Trend Micro Incorporated., 11.0.0.1264]
    [C:\PROGRA~1\TRENDM~1\PC-CIL~1\tmdbg.dll]  [N/A, ]
    [C:\PROGRA~1\TRENDM~1\PC-CIL~1\TmpxHelp.dll]  [Trend Micro Incorporated., 11.0.0.1264]
    [C:\PROGRA~1\TRENDM~1\PC-CIL~1\TmpxCfg.dll]  [Trend Micro Incorporated., 11.0.0.1264]
    [C:\PROGRA~1\TRENDM~1\PC-CIL~1\tmtdi.dll]  [Trend Micro Incorporated., 11.0.0.1264]
    [C:\PROGRA~1\TRENDM~1\PC-CIL~1\TmsmHttp.dll]  [Trend Micro Incorporated., 11.0.0.1264]
    [C:\PROGRA~1\TRENDM~1\PC-CIL~1\TmpeVS.dll]  [Trend Micro Incorporated., 11.0.0.1264]
    [C:\PROGRA~1\TRENDM~1\PC-CIL~1\vsapi32.dll]  [Trend Micro Inc., 8.500-1002]
    [C:\PROGRA~1\TRENDM~1\PC-CIL~1\TmpeURLF.dll]  [, ]
    [C:\PROGRA~1\TRENDM~1\PC-CIL~1\TmphHttp.dll]  [Trend Micro Incorporated., 11.0.0.1264]
    [C:\PROGRA~1\TRENDM~1\PC-CIL~1\TmsmMail.dll]  [Trend Micro Incorporated., 11.0.0.1264]
    [C:\Program Files\Trend Micro\PC-cillin 2004\TmMsg.dll]  [Trend Micro Inc., 2.0]
    [C:\Program Files\Trend Micro\PC-cillin 2004\icuin18.dll]  [IBM Corporation and others, 1, 8, 1, 0]
    [C:\Program Files\Trend Micro\PC-cillin 2004\icuuc18.dll]  [IBM Corporation and others, 1, 8, 1, 0]
    [C:\PROGRA~1\TRENDM~1\PC-CIL~1\TmphPop3.dll]  [Trend Micro Incorporated., 11.0.0.1264]
    [C:\PROGRA~1\TRENDM~1\PC-CIL~1\TmphSMTP.dll]  [Trend Micro Incorporated., 11.0.0.1264]
[PID: 764 / SYSTEM][C:\Program Files\Trend Micro\PC-cillin 2004\PccPfw.exe]  [Trend Micro Incorporated., 11.0.0.1264]
    [C:\Program Files\Trend Micro\PC-cillin 2004\tmdbg.dll]  [N/A, ]
    [C:\Program Files\Trend Micro\PC-cillin 2004\tmCfwApi.dll]  [Trend Micro Inc., 1.2.0.1020]
[PID: 2396 / LOCAL SERVICE][C:\WINDOWS\System32\alg.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 184 / pa-hoo][C:\Program Files\Trend Micro\PC-cillin 2004\PCCGUIDE.EXE]  [Trend Micro Incorporated., 11.0.0.1264]
    [C:\Program Files\Trend Micro\PC-cillin 2004\tmdbg.dll]  [N/A, ]
    [C:\Program Files\Trend Micro\PC-cillin 2004\tmCfwApi.dll]  [Trend Micro Inc., 1.2.0.1020]
    [C:\Program Files\Trend Micro\PC-cillin 2004\TmProxy.dll]  [Trend Micro Incorporated., 11.0.0.1264]
    [C:\WINDOWS\system32\kavo1.dll]  [N/A, ]
    [C:\WINDOWS\HELP\F3C74E3FA248.dll]  [N/A, ]
[PID: 2380 / pa-hoo][C:\WINDOWS\system32\mspaint.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
    [C:\WINDOWS\system32\kavo1.dll]  [N/A, ]
    [C:\WINDOWS\HELP\F3C74E3FA248.dll]  [N/A, ]
[PID: 3796 / SYSTEM][C:\WINDOWS\system32\svchost.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 1932 / pa-hoo][C:\WINDOWS\system32\conime.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 1212 / pa-hoo][C:\Program Files\Internet Explorer\iexplore.exe]  [Microsoft Corporation, 7.00.6000.16544 (vista_gdr.070814-1500)]
    [C:\Program Files\Yahoo!\Companion\Installs\cpn0\yt.dll]  [Yahoo! Inc., 2007, 9, 5, 1]
    [C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll]  [Adobe Systems Incorporated, 7.0.9.2006121800]
    [C:\WINDOWS\system32\MSVCR71.dll]  [Microsoft Corporation, 7.10.3052.4]
    [C:\Program Files\Yahoo!\Companion\Installs\cpn0\YTBM.dll]  [Yahoo! Inc., 2007, 8, 21, 1]
    [C:\Program Files\Yahoo!\Companion\Installs\cpn0\pubmod.dll]  [Yahoo! Inc., 2007, 8, 22, 1]
    [C:\Program Files\Yahoo!\Companion\Installs\cpn0\YPUBC.dll]  [Yahoo! Inc., 2006, 12, 4, 1]
    [C:\WINDOWS\system32\Macromed\Flash\Flash9b.ocx]  [Adobe Systems, Inc., 9,0,28,0]
    [C:\WINDOWS\system32\kavo1.dll]  [N/A, ]
    [C:\WINDOWS\HELP\F3C74E3FA248.dll]  [N/A, ]
    [C:\WINDOWS\system32\icm32.dll]  [Microsoft Corporation, 5.1.2600.2709 (xpsp_sp2_gdr.050628-1518)]
[PID: 3640 / pa-hoo][D:\sreng2\SREngPS.EXE]  [Smallfrogs Studio, 2.5.16.900]
    [D:\sreng2\Lang\1028.DLL]  [System Repair Engineer, 2.5.16.900]
    [C:\WINDOWS\system32\kavo1.dll]  [N/A, ]
    [C:\WINDOWS\HELP\F3C74E3FA248.dll]  [N/A, ]
    [D:\sreng2\Upload\3rdUpd.DLL]  [Smallfrogs Studio, 2, 1, 0, 15]

==================================
文件關聯
.TXT  OK. [%SystemRoot%\system32\NOTEPAD.EXE %1]
.EXE  OK. ["%1" %*]
.COM  OK. ["%1" %*]
.PIF  OK. ["%1" %*]
.REG  OK. [regedit.exe "%1"]
.BAT  OK. ["%1" %*]
.SCR  OK. ["%1" /S]
.CHM  OK. ["C:\WINDOWS\hh.exe" %1]
.HLP  OK. [%SystemRoot%\system32\winhlp32.exe %1]
.INI  OK. [%SystemRoot%\system32\NOTEPAD.EXE %1]
.INF  OK. [%SystemRoot%\system32\NOTEPAD.EXE %1]
.VBS  OK. [%SystemRoot%\System32\WScript.exe "%1" %*]
.JS   OK. [%SystemRoot%\System32\WScript.exe "%1" %*]
.LNK  OK. [{00021401-0000-0000-C000-000000000046}]

==================================
Winsock 提供者
N/A

==================================
Autorun.inf
[C:\]
[AutoRun]
open=ntdelect.com
;shell\open=Open(&O)
shell\open\Command=ntdelect.com
shell\open\Default=1
;shell\explore=Manager(&X)
shell\explore\Command=ntdelect.com
[D:\]
[AutoRun]
open=ntdelect.com
;shell\open=Open(&O)
shell\open\Command=ntdelect.com
shell\open\Default=1
;shell\explore=Manager(&X)
shell\explore\Command=ntdelect.com

==================================
HOSTS 文件
127.0.0.1       localhost

==================================
進程特權掃描
特殊特權被允許： SeLoadDriverPrivilege [PID = 184, C:\PROGRAM FILES\TREND MICRO\PC-CILLIN 2004\PCCGUIDE.EXE]

==================================
API HOOK
N/A

==================================
隱藏進程
N/A

==================================

x0 [2 樓] From：臺灣 \| Posted：2007-11-07 19:28 \|
upside
反病毒反詐騙反虐犬
級別: 版主
版區: 硬體討論, 公益互助, PDA 討論, 手機討論區, 詐騙資訊, 網路&防毒
x372
x2016
▲ ▼
看到那個檔名就知道是 KAVO 這隻
請使用
http://bbs.mychat.to/read.php?tid=646527
爸爸你一路好走
x1 [3 樓] From：臺灣 \| Posted：2007-11-07 20:49 \|
lens690
級別: 初露鋒芒
x51
▲ ▼
3個步驟就可以解決了！

1.使用autoruns程式，將啟動中的「F3C74E3FA248.dll」刪除掉
2.使用Icesword程式，將處理序中的Explorer.exe停用。
3.使用Icesword程式，進入「File」，將 Windows\HELP\F3C74E3FA248.dll and F3C74E3FA248.exe 刪除。

趨勢會發現但砍不掉的問題有兩個：
1.因為正在執行中(綁在Explorer處理序中)
2.他是寫「Possible」，就是說這「可能是」病毒，但不代表一定是，所以砍不掉
確保電腦安全，勿點選不明檔案或網址
x1 [4 樓] From：臺灣中華電信HINET \| Posted：2007-11-07 21:07 \|
x3333x
級別: 初露鋒芒
x73
x765
▲
謝謝版主及大大們的解答！

x0 [5 樓] From：臺灣 \| Posted：2007-11-07 21:14 \|


MyChat 數位男女 » 防毒防駭討論
Powered by PHPWind v1.3.6 Copyright © 2003-04 PHPWind	Processed in 0.089120 second(s),query:16 Gzip disabled 本站由瀛睿律師事務所擔任常年法律顧問 \| 免責聲明 \| 本網站已依台灣網站內容分級規定處理 \| 連絡我們 \| 訪客留言