.
*注意* 空白与合法缺省登录将不会被显示
REGEDIT4
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"PPS Accelerator"="d:\program files\PPStream\ppsap.exe" [2008-12-11 210296]
"internat.exe"="internat.exe" - d:\winnt\system32\internat.exe [1999-12-07 20752]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"tsnp2std"="d:\winnt\tsnp2std.exe" [2006-01-06 110592]
"snp2std"="d:\winnt\vsnp2std.exe" [2006-01-06 344064]
"IMSCMIG40W"="d:\progra~1\COMMON~1\MICROS~1\IME\IMSC40W\IMSCMIG.EXE" [2003-12-05 24576]
"OODefragTray"="d:\winnt\system32\oodtray.exe" [2008-11-03 2540800]
"TkBellExe"="d:\program files\Common Files\Real\Update_OB\realsched.exe" [2008-08-04 185896]
"QuickTime Task"="d:\program files\QuickTime\qttask.exe" [2007-04-27 282624]
"SunJavaUpdateSched"="d:\program files\Java\jre6\bin\jusched.exe" [2009-05-21 148888]
"TrackPointSrv"="tp4serv.exe" - d:\winnt\system32\tp4serv.exe [2002-12-03 87552]
"Synchronization Manager"="mobsync.exe" - d:\winnt\system32\mobsync.exe [2003-06-19 111376]
"TP4EX"="tp4ex.exe" - d:\winnt\system32\TP4EX.exe [2002-09-04 53248]
"WinFaxAppPortStarter"="wfxsnt40.exe" - d:\winnt\system32\WFXSNT40.EXE [2000-09-29 43008]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"internat.exe"="internat.exe" - d:\winnt\system32\internat.exe [1999-12-07 20752]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce]
"^SetupICWDesktop"="d:\program files\Internet Explorer\Connection Wizard\icwconn1.exe" [2003-06-19 186640]
[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
"{A213B520-C6C2-11d0-AF9D-008029E1027E}"= "d:\program files\WinFax\WfxSeh32.Dll" [1998-07-27 38400]
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager]
BootExecute REG_MULTI_SZ autocheck autochk *\
0OODBS
[HKLM\~\startupfolder\D:^Documents and Settings^Jiang Luo^Start Menu^Programs^Startup^腾讯QQ.lnk]
path=d:\documents and settings\Jiang Luo\Start Menu\Programs\Startup\腾讯QQ.lnk
backup=d:\winnt\pss\腾讯QQ.lnkStartup
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
"wfxsvc"=2 (0x2)
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\KasperskyAntiVirus]
"DisableMonitoring"=dword:00000001
R1 nbmkmd;nbmkmd;d:\winnt\system32\drivers\Nbmkmd.sys [8/02/08 8:06 PM 4512]
R2 DMIProxy;DMIProxy;d:\winnt\system32\drivers\Dmiproxy.sys [8/02/08 8:06 PM 36680]
R3 neo20xx;neo20xx;d:\winnt\system32\drivers\neo20xx.sys [8/02/08 7:19 PM 39888]
R3 solo;ESS Solo Audio Driver (WDM);d:\winnt\system32\drivers\solo.sys [4/11/07 12:04 PM 73281]
R3 Tp4Track;IBM PS/2 TrackPoint Driver;d:\winnt\system32\drivers\tp4track.sys [4/11/07 12:04 PM 14064]
--- Other Services/Drivers In Memory ---
*NewlyCreated* - IPNAT
*NewlyCreated* - RASAUTO
*NewlyCreated* - SHAREDACCESS
.
.
------- 而外的扫描 -------
.
uStart Page = about:blank
IE: Append to existing PDF - d:\program files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
IE: Convert link target to Adobe PDF - d:\program files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
IE: Convert link target to existing PDF - d:\program files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
IE: Convert selected links to Adobe PDF - d:\program files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
IE: Convert selected links to existing PDF - d:\program files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
IE: Convert selection to Adobe PDF - d:\program files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
IE: Convert selection to existing PDF - d:\program files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
IE: Convert to Adobe PDF - d:\program files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
IE: E&xport to Microsoft Excel - d:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
IE: 使用快车(Flas&hGet)下载 - d:\program files\FlashGet Network\Flashget\GetUrl.htm
IE: 使用快车(Flash&Get)下载全部链接 - d:\program files\FlashGet Network\Flashget\GetAllUrl.htm
IE: 使用快车(FlashGet)下载该网页FLV - d:\program files\FlashGet Network\Flashget\FlvDetector.htm
IE: 添加到QQ表情 - d:\program files\Tencent\QQ\AddEmotion.htm
IE: {{c95fe080-8f5d-11d2-a20b-00aa003c157a} - %SystemRoot%\web\related.htm
LSP: %SystemRoot%\system32\msafd.dll
DPF: {43E839C5-E10F-443A-BC1F-F09CFD2ABC77} -
hxxp://www.uusee.com/player/updateC.cabDPF: {AC414988-E5BB-4C2C-873B-EA53D2F3D23A} -
hxxp://t.live.cctv.com/ieocx/CCTVUpdateInstall.dllDPF: {F3E92562-1B4D-4BFA-B2D4-E9BCABE3B6A3} -
hxxps://ebanks.spdb.com.cn/per/gb/js/iesign.ocxDPF: {F3E92562-1B4D-4BFA-B2D4-E9BCABE3B7A3} -
hxxps://ebanks.spdb.com.cn/per/gb/js/spdbsign.ocxFF - ProfilePath -
.
.
------- 文件类型 -------
.
chm.file="hh.exe" %1
txtfile=d:\winnt\notepad.exe %1
.
**************************************************************************
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer,
http://www.gmer.netRootkit scan 2009-06-15 19:32
Windows 5.0.2195 Service Pack 4 FAT NTAPI
扫描被隐藏的进程 。。。
扫描被隐藏的启动组 。。。
扫描被隐藏的文件 。。。
扫描完成
被隐藏的档案: 0
