[spycat77]

(續前一篇)
O4 - HKLM\..\Run: [OfficeScan WinNT 監控程式] "C:\OfficeScan NT\pccntmon.exe" -HideWindow
O4 - HKLM\..\Run: [gcasServ] "C:\Program Files\Microsoft AntiSpyware\gcasServ.exe"
O4 - HKLM\..\Run: [sp] rundll32 C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\se.dll,DllInstall
O4 - HKLM\..\Run: [Synchronization Manager] mobsync.exe /logon
O4 - HKCU\..\Run: [ctfmon.exe] ctfmon.exe
O4 - Startup: .plugin141.trace
O4 - Startup: NTUSER.DAT
O4 - Startup: ntuser.dat.LOG
O4 - Startup: ntuser.ini
O4 - Startup: PCC.log
O4 - Startup: ~
O4 - Global Startup: ntuser.pol
O8 - Extra context menu item: 匯出至 Microsoft Excel(&X) - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O16 - DPF: {00134F72-5284-44F7-95A8-52A619F70751} (ObjWinNTCheck Class) - http://ca.AAAAA.com.tw/officescan/Cl...l/WinNTChk.cab
O16 - DPF: {030518B8-76E5-4FCD-888C-19D376E3AD18} (tmb_web_activex.frminq) - https://ias.AAAAA.com.tw:8082/txhist...eb_activex.CAB
O16 - DPF: {08D75BB0-D2B5-11D1-88FC-0080C859833B} (OfficeScan Corp Edition Web-Deployment SetupIniCtrl Class) - http://ca.AAAAA.com.tw/officescan/cl...l/setupini.cab
O16 - DPF: {08D75BC1-D2B5-11D1-88FC-0080C859833B} (OfficeScan Corp Edition Web-Deployment SetupCtrl Class) - http://ca.AAAAA.com.tw/officescan/cl...tall/setup.cab
O16 - DPF: {1E4C83BC-D65C-4C6F-9B5A-E2B34CE8630D} (PwcInstall.PwcPage1) - http://140.118.43.38/emb2/PwcInstall.CAB
O16 - DPF: {5EFE8CB1-D095-11D1-88FC-0080C859833B} (OfficeScan Corp Edition Web-Deployment ObjRemoveCtrl Class) - http://ca.AAAAA.com.tw/officescan/cl...RemoveCtrl.cab
O16 - DPF: {62789780-B744-11D0-986B-00609731A21D} (Autodesk MapGuide ActiveX Control) - http://www.gismap.com.tw/auto_download/mgaxctrl.cab
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} (Java Runtime Environment 1.4.2) - http://172.16.8.11/tcb/j2re-1_4_2_03-windows-i586-p.exe
O16 - DPF: {9F1C11AA-197B-4942-BA54-47A8489BB47F} (Update Class) - http://v4.windowsupdate.microsoft.co...486.6994791667
O16 - DPF: {C7BD467B-0B38-442F-840F-3F048E7F6005} (RootKeyDistributor Class) - http://grca.nat.gov.tw/pse/CHTPKI_PSE.cab
O16 - DPF: {CE684CA4-935B-11D3-A163-00004C815B0E} (ftpocx.webftp) - http://www.AAAAA.com.tw/ftpocx.CAB
O16 - DPF: {D19781C5-2051-44F8-8445-DDC82933C191} (VacPro.internazionale_ver11) - http://advnt01.com/dialer/internazionale_ver11.CAB
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload.macromedia.com/pub...sh/swflash.cab
O16 - DPF: {DF780F87-FF2B-4DF8-92D0-73DB16A1543A} (PopCapLoader Object) - http://www.shockwave.com/content/zum...ploader_v5.cab
O16 - DPF: {F210AAE2-E2F3-4EE9-8317-9934A492BBF0} (tmb_web_activex.frminq) - https://ias.AAAAA.com.tw:8080/tmb_web_activex.CAB
O16 - DPF: {F6EF5E31-2AE5-4511-B99A-2CF2D266F106} (tmb_web_activex.frminq) - https://ias.AAAAA.com.tw:8080/tmb_web_activex.CAB
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: Domain = AAAAA.com.tw
O17 - HKLM\System\CCS\Services\Tcpip\..\{8CA52B0B-CD43-4647-9C8D-9BEF353DDA7E}: NameServer = 172.16.70.2,172.16.70.1,172.16.70.12
O17 - HKLM\System\CS1\Services\Tcpip\Parameters: Domain = AAAAA.com.tw
O17 - HKLM\System\CS2\Services\Tcpip\Parameters: Domain = AAAAA.com.tw