.
2009-06-15 23:30 . 2009-06-15 23:30 16384 ----a-w- d:\winnt\system32\Perflib_Perfdata_244.dat
2009-06-13 14:59 . 2009-06-13 14:59 -------- d-----w- d:\documents and settings\Jiang Luo\Application Data\Malwarebytes
2009-06-13 14:57 . 2009-05-26 17:20 40160 ----a-w- d:\winnt\system32\drivers\mbamswissarmy.sys
2009-06-13 14:57 . 2009-06-13 14:57 -------- d-----w- d:\documents and settings\All Users\Application Data\Malwarebytes
2009-06-13 14:57 . 2009-05-26 17:19 18456 ----a-w- d:\winnt\system32\drivers\mbam.sys
2009-06-13 14:57 . 2009-06-13 14:57 -------- d-----w- d:\program files\Malwarebytes' Anti-Malware
2009-06-10 22:47 . 2005-07-13 04:22 138000 ----a-w- d:\winnt\system32\dllcache\faxui.dll
2009-06-09 21:33 . 2009-06-09 21:33 152576 ----a-w- d:\documents and settings\Jiang Luo\Application Data\Sun\Java\jre1.6.0_14\lzma.dll
2009-05-30 21:07 . 2009-05-30 21:07 -------- d-----w- d:\temp\mp3
.
(((((((((((((((((((((((((((((((((((((((( 在三个月内被修改的档案 ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-06-15 23:29 . 2008-08-03 00:30 78880 --sha-w- d:\winnt\system32\drivers\fidbox2.dat
2009-06-15 23:29 . 2008-08-03 00:30 67796 --sha-w- d:\winnt\system32\drivers\fidbox.idx
2009-06-15 23:29 . 2008-08-03 00:30 4519456 --sha-w- d:\winnt\system32\drivers\fidbox.dat
2009-06-15 23:29 . 2008-08-03 00:30 11600 --sha-w- d:\winnt\system32\drivers\fidbox2.idx
2009-06-15 22:57 . 2009-01-28 01:34 776 ----a-w- d:\winnt\system32\secustat.dat
2009-06-15 22:48 . 2009-01-28 01:34 3821 ----a-w- d:\winnt\system32\secushr.dat
2009-06-14 22:58 . 2009-04-25 12:10 664 ----a-w- d:\winnt\system32\d3d9caps.dat
2009-05-22 12:09 . 2008-08-03 00:30 105395 ----a-w- d:\winnt\system32\drivers\klin.dat
2009-05-22 12:09 . 2008-08-03 00:30 94643 ----a-w- d:\winnt\system32\drivers\klick.dat
2009-05-21 15:33 . 2009-01-05 00:04 410984 ----a-w- d:\winnt\system32\deploytk.dll
2009-05-09 19:38 . 2009-05-09 19:38 -------- d-----w- d:\program files\PPStream
2009-05-07 06:41 . 1980-01-01 04:00 263440 ----a-w- d:\winnt\system32\LOCALSPL.DLL
2009-05-05 19:54 . 2009-05-05 19:54 -------- d-----w- d:\documents and settings\All Users\Application Data\CCTV
2009-04-28 23:44 . 2009-04-28 23:44 4512 ----a-w- d:\winnt\unins001.dat
2009-04-28 23:44 . 2009-04-28 23:44 685322 ----a-w- d:\winnt\unins001.exe
2009-04-27 11:31 . 2008-11-05 11:25 31048 ----a-w- d:\documents and settings\Jiang Luo\Application Data\QQ\59B848686BA6270269CE15953350482D\SafeBase\selfupdate.exe
2009-04-26 08:56 . 2009-01-28 01:43 42984 ----a-w- d:\documents and settings\Jiang Luo\Application Data\CCTV\tv\cctvupdateinstall.dll
2009-04-24 09:54 . 1980-01-01 04:00 95504 ----a-w- d:\winnt\system32\WIN32SPL.DLL
2009-04-22 13:38 . 2009-04-22 13:38 437008 ----a-w- d:\winnt\system32\rpcrt4.dll
2009-04-21 19:15 . 2009-04-21 19:15 576512 ----a-w- d:\winnt\system32\WININET.DLL
2009-04-17 05:04 . 1980-01-01 04:00 1645072 ----a-w- d:\winnt\system32\WIN32K.SYS
2009-04-02 11:29 . 2009-04-02 11:29 152576 ----a-w- d:\documents and settings\Jiang Luo\Application Data\Sun\Java\jre1.6.0_13\lzma.dll
2009-03-18 11:35 . 2009-03-18 11:35 152576 ----a-w- d:\documents and settings\Jiang Luo\Application Data\Sun\Java\jre1.6.0_12\lzma.dll
2008-08-02 23:31 . 2008-08-02 23:31 21952 ---h--w- d:\program files\folder.htt
2008-09-19 20:55 . 2008-09-19 20:55 548864 ----a-w- d:\program files\mozilla firefox\plugins\msvcp80.dll
2008-09-19 20:55 . 2008-09-19 20:55 626688 ----a-w- d:\program files\mozilla firefox\plugins\msvcr80.dll
2008-09-19 20:55 . 2008-09-19 20:55 479232 ----a-w- d:\program files\mozilla firefox\plugins\msvcm80.dll
2009-02-24 19:34 . 2009-02-24 19:34 1044480 ----a-w- d:\program files\mozilla firefox\plugins\libdivx.dll
2009-02-24 19:34 . 2009-02-24 19:34 200704 ----a-w- d:\program files\mozilla firefox\plugins\ssldivx.dll
.
((((((((((((((((((((((((((((((((((((( 重要登入点 ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*注意* 空白与合法缺省登录将不会被显示
REGEDIT4
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"PPS Accelerator"="d:\program files\PPStream\ppsap.exe" [2008-12-11 210296]
"internat.exe"="internat.exe" - d:\winnt\system32\internat.exe [1999-12-07 20752]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"tsnp2std"="d:\winnt\tsnp2std.exe" [2006-01-06 110592]
"snp2std"="d:\winnt\vsnp2std.exe" [2006-01-06 344064]
"IMSCMIG40W"="d:\progra~1\COMMON~1\MICROS~1\IME\IMSC40W\IMSCMIG.EXE" [2003-12-05 24576]
"OODefragTray"="d:\winnt\system32\oodtray.exe" [2008-11-03 2540800]
"TkBellExe"="d:\program files\Common Files\Real\Update_OB\realsched.exe" [2008-08-04 185896]
"QuickTime Task"="d:\program files\QuickTime\qttask.exe" [2007-04-27 282624]
"SunJavaUpdateSched"="d:\program files\Java\jre6\bin\jusched.exe" [2009-05-21 148888]
"TrackPointSrv"="tp4serv.exe" - d:\winnt\system32\tp4serv.exe [2002-12-03 87552]
"Synchronization Manager"="mobsync.exe" - d:\winnt\system32\mobsync.exe [2003-06-19 111376]
"TP4EX"="tp4ex.exe" - d:\winnt\system32\TP4EX.exe [2002-09-04 53248]
"WinFaxAppPortStarter"="wfxsnt40.exe" - d:\winnt\system32\WFXSNT40.EXE [2000-09-29 43008]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"internat.exe"="internat.exe" - d:\winnt\system32\internat.exe [1999-12-07 20752]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce]
"^SetupICWDesktop"="d:\program files\Internet Explorer\Connection Wizard\icwconn1.exe" [2003-06-19 186640]
[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
"{A213B520-C6C2-11d0-AF9D-008029E1027E}"= "d:\program files\WinFax\WfxSeh32.Dll" [1998-07-27 38400]
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager]
BootExecute REG_MULTI_SZ autocheck autochk *\
0OODBS
[HKLM\~\startupfolder\D:^Documents and Settings^Jiang Luo^Start Menu^Programs^Startup^腾讯QQ.lnk]
path=d:\documents and settings\Jiang Luo\Start Menu\Programs\Startup\腾讯QQ.lnk
backup=d:\winnt\pss\腾讯QQ.lnkStartup
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
"wfxsvc"=2 (0x2)
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\KasperskyAntiVirus]
"DisableMonitoring"=dword:00000001
R1 nbmkmd;nbmkmd;d:\winnt\system32\drivers\Nbmkmd.sys [8/02/08 8:06 PM 4512]
R2 DMIProxy;DMIProxy;d:\winnt\system32\drivers\Dmiproxy.sys [8/02/08 8:06 PM 36680]
R3 neo20xx;neo20xx;d:\winnt\system32\drivers\neo20xx.sys [8/02/08 7:19 PM 39888]
R3 solo;ESS Solo Audio Driver (WDM);d:\winnt\system32\drivers\solo.sys [4/11/07 12:04 PM 73281]
R3 Tp4Track;IBM PS/2 TrackPoint Driver;d:\winnt\system32\drivers\tp4track.sys [4/11/07 12:04 PM 14064]
--- Other Services/Drivers In Memory ---
*NewlyCreated* - IPNAT
*NewlyCreated* - RASAUTO
*NewlyCreated* - SHAREDACCESS
.
.
------- 而外的扫描 -------
.
uStart Page = about:blank
IE: Append to existing PDF - d:\program files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
IE: Convert link target to Adobe PDF - d:\program files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
IE: Convert link target to existing PDF - d:\program files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
IE: Convert selected links to Adobe PDF - d:\program files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
IE: Convert selected links to existing PDF - d:\program files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
IE: Convert selection to Adobe PDF - d:\program files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
IE: Convert selection to existing PDF - d:\program files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
IE: Convert to Adobe PDF - d:\program files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
IE: E&xport to Microsoft Excel - d:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
IE: 使用快车(Flas&hGet)下载 - d:\program files\FlashGet Network\Flashget\GetUrl.htm
IE: 使用快车(Flash&Get)下载全部链接 - d:\program files\FlashGet Network\Flashget\GetAllUrl.htm
IE: 使用快车(FlashGet)下载该网页FLV - d:\program files\FlashGet Network\Flashget\FlvDetector.htm
IE: 添加到QQ表情 - d:\program files\Tencent\QQ\AddEmotion.htm
IE: {{c95fe080-8f5d-11d2-a20b-00aa003c157a} - %SystemRoot%\web\related.htm
LSP: %SystemRoot%\system32\msafd.dll
DPF: {43E839C5-E10F-443A-BC1F-F09CFD2ABC77} -
hxxp://www.uusee.com/player/updateC.cabDPF: {AC414988-E5BB-4C2C-873B-EA53D2F3D23A} -
hxxp://t.live.cctv.com/ieocx/CCTVUpdateInstall.dllDPF: {F3E92562-1B4D-4BFA-B2D4-E9BCABE3B6A3} -
hxxps://ebanks.spdb.com.cn/per/gb/js/iesign.ocxDPF: {F3E92562-1B4D-4BFA-B2D4-E9BCABE3B7A3} -
hxxps://ebanks.spdb.com.cn/per/gb/js/spdbsign.ocxFF - ProfilePath -
.
.
------- 文件类型 -------
.
chm.file="hh.exe" %1
txtfile=d:\winnt\notepad.exe %1
.
**************************************************************************
