求助 - 整個系統的語言顯示好像都有被病毒或木馬入侵的跡象

[wulom]

不飛前輩您好

剛才到您提供的該連結裡下載了HiJackThis.exe檔案，不過掃描到一半，就會出現下列訊息：

就算我按第二個選項，只掃描不存檔，然後想手動下拉結果複制時，也會出現相同的訊息。

又重開機，再使用該軟體掃描一次，仍是一樣的結果。

這到底是我的電腦不相容，還是那個可能存在著病毒造成的呢？

===
另外剛才又發現三點文字顯示障礙的徵兆：

一：在奇摩搜尋框裡打的字，包括現在在史萊姆方框裡打的字，字體全部都變成不是新細明體了。就是變成像是大陸網站才會顯示的那種字體… 是細明體嗎？我也不是很能說個明白。可以確定的是，我並沒有去調過。

二：瀏覽日文的網站，全部也是變成亂碼，調各語系編碼之類的，也沒效。

三：字體大小顯示一直是在「適中」，可是某些字當滑鼠移過去時會突然變成「最大」的。可是再去看字體的大小依然是顯示「適中」。

[wulom]

剛才IE的瀏覽記錄裡再出現一個異狀：

現在時間到了星期一，瀏覽記錄都是以一星期、一天為分類的。在昨日(7/5 pm 23.59)之前，我電腦裡的瀏覽記錄顯示方式還可以整齊的按照不同星期、以及本周是星期幾瀏覽哪些網站整齊的顯示出來。結果現在一到了星期一，需要重開一個新的本周資料夾的時候，它的時間分類功能竟然就這麼消失了！

也就是說，現在按「記錄」出來的是一大排，所有我最近45天瀏覽過的網站列表(我的設定是45天)。而沒有時間分類的功能了。這一大排的顯示列表裡，從上星期六早上開始有異狀後的瀏覽記錄都未能收錄進去。

另外，除了現在90%以上的網站，其文字顯示全部變成大陸網站的顯示字體、以及我在網頁所有能輸入地方的空格輸入的中文全都變成了大陸網站的顯示字體以外(我用記事本輸入，就是正常的新細明體了)，我發現有至少60%的台灣網站，全都不能看了。所以現在還能在史萊姆正常發問看到正常顯示的字體，還真的是萬幸啊！！

貼出一個目前顯示紊亂的實例(中央氣象局網站)：

[plunderer]

應該是中了 "av 終結者" 病毒

1
把 HiJackThis.exe 改成 HJ.com 或 HJ.bat, 再執行試試, 若無問題, 把 log 貼上來

2,
若還是有問題, 先修復 IFEO 映像劫持:
http://mafia.myweb.hinet.net/file/FixIFEO.zip
點兩下 FixIFEO.reg 匯入登錄檔, 再執行 HiJackThis.exe

3
若還是不行, 找找 "av 終結者" 專殺工具吧,

[wulom]

作者: plunderer

應該是中了 "av 終結者" 病毒

1
把 HiJackThis.exe 改成 HJ.com 或 HJ.bat, 再執行試試, 若無問題, 把 log 貼上來

2,
若還是有問題, 先修復 IFEO 映像劫持:
http://mafia.myweb.hinet.net/file/FixIFEO.zip
點兩下 FixIFEO.reg 匯入登錄檔, 再執行 HiJackThis.exe

3
若還是不行, 找找 "av 終結者" 專殺工具吧,

這位熱心的前輩您好

我用了您說的前兩個步驟，改檔名或加入登錄檔的方式，一樣是無法產生log.就是會產生錯誤而必須關閉的訊息。

不過我用av終結者為關鍵字去搜尋，找了好一陣子，終於讓我發現一個綠色版的專殺av終結者的軟體。現在基本上大部份主要的問題都解決了，記錄的功能恢復正常，系統和網頁字體字形異常的部份也全部復元了。只是系統還原的部份依舊完全無法啟動，以及用Rogue Cleaner掃的那兩個毒，刪不掉的以及刪掉又回來的檔案依舊存在。

但至少現在顯示完全正常了，在此衷心感謝您的傾囊教授！

我也把找到的那個殺av終結者軟體的網址給post出來，給有需要的人參考。
http://download.csdn.net/source/525153 (需加入會員)

[plunderer]

"av 終結者" 專殺工具只是比較方便 使用, 但只能治標, 不能治本, 暫時讓系統正常而已, 所以才會有刪不掉的以及刪掉又回來的檔案依舊存在的情形

你的系統內應該還存在 autorun 病毒, 光靠防毒軟體及專殺工具是無法根治的
但我很好奇為何 HiJackThis 不能產生log

建議下載執行 System Repair Engineer
http://www.kztechs.com/sreng/download.html
"系統修復" => "高級修復" => "自動修復"
重新開機後, 再執行一次, 啟用智能掃描
http://www.kztechs.com/sreng/help2/
然後把 log 貼上來

[pedrowong]

下載 what's running, 將不正常執行程式殺掉及關閉不正常開機設定，或許可以解決。

http://www.whatsrunning.net/whatsrunning/download.aspx

[wulom]

作者: pedrowong

下載 what's running, 將不正常執行程式殺掉及關閉不正常開機設定，或許可以解決。

http://www.whatsrunning.net/whatsrunning/download.aspx

pedro兄您好

感謝您提供這套很實用方便的程式，我下載後執行觀看是否有不明的程式正在執行，但列表裡所有正在running的程序密密麻麻，一下子我也找不出到底是哪些程序有問題。或許是還有哪些地方有異常的我還沒發現吧。總之，這個程式讓我受益良多，我會再研究看看的！

作者: plunderer

"av 終結者" 專殺工具只是比較方便 使用, 但只能治標, 不能治本, 暫時讓系統正常而已, 所以才會有刪不掉的以及刪掉又回來的檔案依舊存在的情形

你的系統內應該還存在 autorun 病毒, 光靠防毒軟體及專殺工具是無法根治的
但我很好奇為何 HiJackThis 不能產生log

建議下載執行 System Repair Engineer
http://www.kztechs.com/sreng/download.html
"系統修復" => "高級修復" => "自動修復"
重新開機後, 再執行一次, 啟用智能掃描
http://www.kztechs.com/sreng/help2/
然後把 log 貼上來

plunderer前輩您好。一切就像您診斷的一樣，我的電腦仍有很大的和木馬或病毒相關的問題並沒有根治，最近發現還有一個異狀是，電腦開機到一半時，都會自動跳到藍底白英文字的系統出錯畫面，內容就是寫要確認磁碟檔案之類的，有三個步驟，每次到了第二個步驟，就完全卡住，不管放多久都不會動，連1%也沒有辦法執行。所以我只好都在第一步驟三秒內可按任意鍵跳過時跳過才能開機。

我下載了 System Repair Engineer ，並且執行完"自動修復"，重開機後，執行了智能掃描。使用這軟體時也出現了我電腦內異常的訊息，在"啟動專案"的"註冊表"裡，有兩排名字為"AppInit_DLLs"，在C:\WINDOWS\system32\RhdwE8NYdbqQ.dll裡，說被修改為非正常值，預設值為空，結果我修改成空白，雖修改成功，隨即又被自動改回原來錯誤的數值。以下為掃描的完整log，請您再撥冗幫我看看有哪裡需要做變更處理的，謝謝。 (註:因為全部有7萬多個字元，所以只好依序裁切成五篇送出。)

[code]

2009-07-07,06:10:36

System Repair Engineer 2.7.1.1261
Smallfrogs (http://www.KZTechs.com)

Windows XP Professional Service Pack 3 (Build 2600) - 管理許可權用戶 - 完整功能

以下內容被選中：
所有的啟動項目（包括註冊表、開機檔案夾、服務等）
流覽器載入項
正在運行的進程（包括進程模組資訊）
文件關聯
Winsock 提供者
Autorun.inf
HOSTS 文件
進程特權掃描
計畫任務
API HOOK
隱藏進程


啟動專案
註冊表
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
<ctfmon.exe><C:\WINDOWS\system32\ctfmon.exe> [(Verified)Microsoft Windows Component Publisher]
<PPS Accelerator><C:\Program Files\PPStream\ppsap.exe> [(Verified)SHANGHAI ZHONGYUAN NETWORKS LIMITED]
[HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows]
<load><; > [N/A]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
<IgfxTray><C:\WINDOWS\system32\igfxtray.exe> [(Verified)Microsoft Windows Hardware Compatibility Publisher]
<HotKeysCmds><C:\WINDOWS\system32\hkcmd.exe> [(Verified)Microsoft Windows Hardware Compatibility Publisher]
<NetRover><; C:\WINDOWS\NetRover.exe> [File is missing]
<IMJPMIG8.1><; "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32> [(Verified)Microsoft Windows Component Publisher]
<KernelFaultCheck><%systemroot%\system32\dumprep 0 -k> [File is missing]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
<shell><Explorer.exe> [(Verified)Microsoft Windows Component Publisher]
<Userinit><C:\WINDOWS\system32\userinit.exe,> [(Verified)Microsoft Windows Component Publisher]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Windows]
<AppInit_DLLs><C:\WINDOWS\system32\RhdwE8NYdbqQ.dll,C:\PROGRA~1\KASPER~1\KASPER~1.0\adialhk.dll> [File is missing]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
<UIHost><logonui.exe> [(Verified)Microsoft Windows Component Publisher]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
<{AEB6717E-7E19-11d0-97EE-00C04FD91972}><shell32.dll> [(Verified)Microsoft Windows Component Publisher]
<{03A80B1D-5C6A-42c2-9DFB-81B6005D8023}><C:\Program Files\Trend Micro\Tmas\sshook.dll> [File is missing]
<{750DBD56-AF03-47CB-BB28-BBF312B059F9}><C:\WINDOWS\fonts\xbpCfXnG6wUVF.fon> []
<{AC933D46-96A7-4670-9292-E7C4126C071E}><C:\WINDOWS\fonts\wQ7KbaNZKMe5G4qZ.fon> []
<{8708994F-1758-4C2C-9A3F-FA22D6CCCB41}><C:\WINDOWS\fonts\A97CRaCB.fon> []
<{11B10F7F-FB23-466D-BDC3-9591CF02EC17}><C:\WINDOWS\fonts\uXUsF2RrQy.fon> []
<{CD95107F-52A5-42A4-9914-18949993E798}><C:\WINDOWS\fonts\tY5UFS434YYd.fon> []
<{51F88A10-09E6-4763-948F-1C8861003255}><C:\WINDOWS\fonts\MqppW9KYn.fon> []
<{F1C149F4-380C-4F8A-B87E-7393732B27C1}><C:\WINDOWS\system32\GsfMwDWD3.dll> []
<{FCA4D3BE-C6C7-4F4D-9CBD-CB2666647ACA}><C:\WINDOWS\system32\EN7hzSreCat8.dll> []
<{E45C0FF6-B170-43B2-B897-6D02C43A2E18}><C:\WINDOWS\system32\ybM7kf9heVHDx.dll> []
<{71C4F360-FF1E-413E-B17A-0CA267A78E97}><C:\WINDOWS\system32\qB5BKZy7vR5m.dll> []
<{A0C86020-5935-4B87-B20E-0B656D450264}><C:\WINDOWS\system32\A0C86020.dll> []
<{39C1640B-E010-48CF-88A1-0D17A33AF9EA}><C:\WINDOWS\system32\dktXFYbT3G.dll> []
<{AB900155-F1F0-4165-9E73-67BC13BBCE89}><C:\WINDOWS\system32\xg4hAPNygs29.dll> []
<{76B9BA7A-81D0-4979-8598-8471F2AB5186}><C:\WINDOWS\system32\76B9BA7A.dll> []
<{36AC68E6-0C26-4D39-B98E-54B49DAB6BAA}><C:\WINDOWS\system32\dhDhwS7fFW.dll> []
<{76CBCF38-0583-44C7-A1AE-D463DFE625EC}><C:\WINDOWS\system32\skcfujQ5EDN.dll> []
<{56441985-D4E7-4D1F-BA3A-000C647FAA00}><C:\WINDOWS\system32\RhdwE8NYdbqQ.dll> []
<{122B901E-493F-4AD9-BC69-7DE8C3E52FCC}><C:\WINDOWS\system32\122B901E.dll> []
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]

[wulom]

<PostBootReminder><%SystemRoot%\system32\SHELL32.dll> [(Verified)Microsoft Windows Component Publisher]
<CDBurn><%SystemRoot%\system\SHELLEX.DLL> []
<WebCheck><%SystemRoot%\system32\webcheck.dll> [(Verified)Microsoft Windows Component Publisher]
<SysTray><C:\WINDOWS\system32\stobject.dll> [(Verified)Microsoft Windows Component Publisher]
<WPDShServiceObj><C:\WINDOWS\system32\WPDShServiceObj.dll> [(Verified)Microsoft Windows Component Publisher]
<UPnPMonitor><C:\WINDOWS\system32\upnpui.dll> [(Verified)Microsoft Windows Component Publisher]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\crypt32chain]
<WinlogonNotify: crypt32chain><crypt32.dll> [(Verified)Microsoft Windows Component Publisher]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\cryptnet]
<WinlogonNotify: cryptnet><cryptnet.dll> [(Verified)Microsoft Windows Component Publisher]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\cscdll]
<WinlogonNotify: cscdll><cscdll.dll> [(Verified)Microsoft Windows Component Publisher]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\dimsntfy]
<WinlogonNotify: dimsntfy><%SystemRoot%\System32\dimsntfy.dll> [(Verified)Microsoft Windows Component Publisher]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\klogon]
<WinlogonNotify: klogon><C:\WINDOWS\system32\klogon.dll> [Kaspersky Lab]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\ScCertProp]
<WinlogonNotify: ScCertProp><wlnotify.dll> [(Verified)Microsoft Windows Component Publisher]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\Schedule]
<WinlogonNotify: Schedule><wlnotify.dll> [(Verified)Microsoft Windows Component Publisher]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\sclgntfy]
<WinlogonNotify: sclgntfy><sclgntfy.dll> [(Verified)Microsoft Windows Component Publisher]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\SensLogn]
<WinlogonNotify: SensLogn><WlNotify.dll> [(Verified)Microsoft Windows Component Publisher]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\termsrv]
<WinlogonNotify: termsrv><wlnotify.dll> [(Verified)Microsoft Windows Component Publisher]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\wlballoon]
<WinlogonNotify: wlballoon><wlnotify.dll> [(Verified)Microsoft Windows Component Publisher]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
<{438755C2-A8BA-11D1-B96B-00A0C90312E1}><%SystemRoot%\System32\browseui.dll> [(Verified)Microsoft Windows Component Publisher]
<{8C7461EF-2B13-11d2-BE35-3078302C2030}><%SystemRoot%\System32\browseui.dll> [(Verified)Microsoft Windows Component Publisher]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\<{12d0ed0d-0ee0-4f90-8827-78cefb8f4988}]
<IE7 Uninstall Stub><C:\WINDOWS\system32\ieudinit.exe> [Microsoft Corporation]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\>{22d6f312-b0f6-11d0-94ab-0080c74c7e95}]
<Windows Media Player><C:\WINDOWS\inf\unregmp2.exe /ShowWMP> [(Verified)Microsoft Windows Component Publisher]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\>{26923b43-4d38-484f-9b9e-de460746276c}]
<Internet Explorer><%systemroot%\system32\shmgrate.exe OCInstallUserConfigIE> [File is missing]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\>{60B49E34-C7CC-11D0-8953-00A0C90347FF}MICROS]
<自訂瀏覽器><RunDLL32 IEDKCS32.DLL,BrandIE4 SIGNUP> [(Verified)Microsoft Windows Component Publisher]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\>{881dd1c5-3dcf-431b-b061-f3f88e8be88a}]
<Outlook Express><%systemroot%\system32\shmgrate.exe OCInstallUserConfigOE> [File is missing]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{2C7339CF-2B09-4501-B3F3-F3508C9228ED}]
<Themes Setup><%SystemRoot%\system32\regsvr32.exe /s /n /i:/UserInstall %SystemRoot%\system32\themeui.dll> [File is missing]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{44BBA840-CC51-11CF-AAFA-00AA00B6015C}]
<Microsoft Outlook Express 6><"%ProgramFiles%\Outlook Express\setup50.exe" /APP:OE /CALLER:WINNT /user /install> [File is missing]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{44BBA842-CC51-11CF-AAFA-00AA00B6015B}]
<NetMeeting 3.01><rundll32.exe advpack.dll,LaunchINFSection C:\WINDOWS\INF\msnetmtg.inf,NetMtg.Install.PerUser.NT> [(Verified)Microsoft Windows Component Publisher]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{5945c046-1e7d-11d1-bc44-00c04fd912be}]
<Windows Messenger 4.7><rundll32.exe advpack.dll,LaunchINFSection C:\WINDOWS\INF\msmsgs.inf,BLC.QuietInstall.PerUser> [(Verified)Microsoft Windows Component Publisher]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{6BF52A52-394A-11d3-B153-00C04F79FAA6}]
<Microsoft Windows Media Player><rundll32.exe advpack.dll,LaunchINFSection C:\WINDOWS\INF\wmp10.inf,PerUserStub> [(Verified)Microsoft Windows Component Publisher]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{7790769C-0471-11d2-AF11-00C04FA35D02}]
<Address Book 6><"%ProgramFiles%\Outlook Express\setup50.exe" /APP:WAB /CALLER:WINNT /user /install> [File is missing]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{89820200-ECBD-11cf-8B85-00AA005B4340}]
<Windows 桌面更新><regsvr32.exe /s /n /i:U shell32.dll> [(Verified)Microsoft Windows Component Publisher]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{89820200-ECBD-11cf-8B85-00AA005B4383}]
<Internet Explorer 6><%SystemRoot%\system32\ie4uinit.exe> [(Verified)Microsoft Windows Component Publisher]
[HKEY_CURRENT_USER\Control Panel\Desktop]
<SCRNSAVE.EXE><C:\WINDOWS\system32\ssflwbox.scr> [(Verified)Microsoft Windows Component Publisher]

==================================
開機檔案夾
[hpoddt01.exe]
<C:\Documents and Settings\All Users\「開始」功能表\程式集\啟動\hpoddt01.exe.lnk --> C:\PROGRA~1\HEWLET~1\DIGITA~1\bin\hpotdd01.exe [Hewlett-Packard]><N>
[AntiCrash 5.0]
<C:\Documents and Settings\Administrator\「開始」功能表\程式集\啟動\AntiCrash 5.0.lnk --> C:\PROGRA~1\JIBREE~1\ANTICR~1.0\ANTICR~1.EXE [Jibreel Incorporated.]><N>
[Hare]
<C:\Documents and Settings\Administrator\「開始」功能表\程式集\啟動\Hare.lnk --> C:\PROGRA~1\DACHSH~1\Hare\Hare.exe [N/A]><N>

==================================
服務
[MS Driver Management Service / 360svc][Running/Auto Start]
<C:\WINDOWS\sYSTEM32\SVCHOST.EXE -K NETSVCS-->C:\WINDOWS\system32\360svcSystem.dll><360安全中心>
[Kaspersky Internet Security 7.0 / AVP][Stopped/Manual Start]
<"C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 7.0\avp.exe" -r><Kaspersky Lab>
[C-DillaCdaC11BA / C-DillaCdaC11BA][Running/Auto Start]
<C:\WINDOWS\system32\drivers\CDAC11BA.EXE><Macrovision>
[InstallDriver Table Manager / IDriverT][Stopped/Manual Start]
<"C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe"><Macrovision Corporation>
[iPodService / iPodService][Stopped/Manual Start]
<C:\Program Files\iPod\bin\iPodService.exe><Apple Computer, Inc.>
[Java Quick Starter / JavaQuickStarterService][Running/Auto Start]
<"C:\Program Files\Java\jre6\bin\jqs.exe" -service -config "C:\Program Files\Java\jre6\lib\deploy\jqs\jqs.conf"><Sun Microsystems, Inc.>
[Kingsoft Basic Service / kaccore][Running/Auto Start]
<"C:\Program Files\Kingsoft\KAC\Service\kaccore.exe"><Kingsoft Corporation>
[Pml Driver HPZ12 / Pml Driver HPZ12][Stopped/Manual Start]
<C:\WINDOWS\system32\HPZipm12.exe><HP>

==================================
驅動程式
[a347bus / a347bus][Running/Boot Start]
<\SystemRoot\system32\DRIVERS\a347bus.sys><>
[a347scsi / a347scsi][Running/Boot Start]
<\SystemRoot\System32\Drivers\a347scsi.sys><>
[標準 IDE/ESDI 硬碟控制器 / atapi][Running/Boot Start]
<\SystemRoot\System32\DRIVERS\atapi.sys><N/A>
[CdaC15BA / CdaC15BA][Running/Auto Start]
<\??\C:\WINDOWS\system32\drivers\CdaC15BA.SYS><Macrovision Europe Ltd>
[d347bus / d347bus][Running/Boot Start]
<\SystemRoot\system32\DRIVERS\d347bus.sys><>
[d347prt / d347prt][Running/Boot Start]
<\SystemRoot\System32\Drivers\d347prt.sys><>
[Intel(R) PRO Network Connection Driver / E100B][Running/Manual Start]
<System32\DRIVERS\e100b325.sys><Intel Corporation>
[ENTECH / ENTECH][Stopped/Manual Start]
<\??\C:\WINDOWS\system32\DRIVERS\ENTECH.sys><EnTech Taiwan>
[EZUSB PC/SC Smart Card Reader / EZUSB][Stopped/Manual Start]
<system32\DRIVERS\ezusb.sys><Castles Technology Co.,Ltd>
[GEARAspiWDM / GEARAspiWDM][Running/Manual Start]
<System32\Drivers\GEARAspiWDM.sys><GEAR Software Inc.>
[IEEE-1284.4 Driver HPZid412 / HPZid412][Stopped/Manual Start]
<system32\DRIVERS\HPZid412.sys><HP>
[Print Class Driver for IEEE-1284.4 HPZipr12 / HPZipr12][Stopped/Manual Start]
<system32\DRIVERS\HPZipr12.sys><HP>
[USB to IEEE-1284.4 Translation Driver HPZius12 / HPZius12][Stopped/Manual Start]
<system32\DRIVERS\HPZius12.sys><HP>
[ialm / ialm][Running/Manual Start]
<System32\DRIVERS\ialmnt5.sys><Intel Corporation>
[Imx5123 / Imx5123][Stopped/Manual Start]
<system32\drivers\Imx5123.sys><Inmax Technology Corp.>
[KAVBootC / KAVBootC][Running/Boot Start]
<\SystemRoot\system32\Drivers\KAVBootC.sys><Kingsoft Corporation>
[kl1 / kl1][Running/Boot Start]
<\SystemRoot\system32\drivers\kl1.sys><Kaspersky Lab>
[Kaspersky Lab Boot Guard Driver / KLBG][Running/Boot Start]
<\SystemRoot\system32\DRIVERS\klbg.sys><Kaspersky Lab>
[Kaspersky Lab KLFltDev / KLFLTDEV][Running/Manual Start]
<system32\DRIVERS\klfltdev.sys><Kaspersky Lab>
[KLIF / KLIF][Running/System Start]
<\??\C:\WINDOWS\system32\drivers\klif.sys><Kaspersky Lab>
[Kaspersky Anti-Virus NDIS Filter / klim5][Running/Manual Start]
<system32\DRIVERS\klim5.sys><Kaspersky Lab>
[MintRoot / MintRoot][Stopped/Manual Start]
<\??\C:\Program Files\Common Files\System\MintRoot.sys><N/A>
[pavboot / pavboot][Running/Boot Start]
<\SystemRoot\system32\drivers\pavboot.sys><Panda Security, S.L.>
[直接平行連接埠連結驅動程式 / Ptilink][Running/Manual Start]
<System32\DRIVERS\ptilink.sys><Parallel Technologies, Inc.>
[Qualcomm Diagnostic Port 3197 / qcusbser][Stopped/Manual Start]
<system32\DRIVERS\qcusbser.sys><QUALCOMM Incorporated>
[Secdrv / Secdrv][Stopped/Manual Start]
<System32\DRIVERS\secdrv.sys><Macrovision Corporation, Macrovision Europe Limited, and Macrovision Japan and Asia K.K.>
[smwdm / smwdm][Running/Manual Start]
<system32\drivers\smwdm.sys><Analog Devices, Inc.>
[sptd / sptd][Running/Boot Start]
<\SystemRoot\System32\Drivers\sptd.sys><N/A>
[TCP/IP Protocol Driver / Tcpip][Running/System Start]
<System32\DRIVERS\tcpip.sys><Microsoft Corporation>
[tmcomm / tmcomm][Running/Auto Start]
<\??\C:\WINDOWS\system32\drivers\tmcomm.sys><Trend Micro Inc.>
[WheelMouse USB Lower Filter Driver / whfltr2k][Stopped/Manual Start]
<system32\DRIVERS\whfltr2k.sys><>
[X4HSX32 / X4HSX32][Running/Auto Start]
<\??\C:\Program Files\OTTOPLAYER\X4HSX32.Sys><Exent Technologies Ltd.>
[Intel(R) Graphics Platform (SoftBIOS) Driver / {6080A529-897E-4629-A488-ABA0C29B635E}][Stopped/Manual Start]
<system32\drivers\ialmsbw.sys><Intel Corporation>
[Intel(R) Graphics Chipset (KCH) Driver / {D31A0762-0CEB-444e-ACFF-B049A1F6FE91}][Stopped/Manual Start]
<system32\drivers\ialmkchw.sys><Intel Corporation>

==================================
流覽器載入項
[Octh Class]
{000123B4-9B42-4900-B3F7-F4B073EFC214} <C:\Program Files\Orbitdownloader\orbitcth.dll, (Signed) Orbitdownloader.com>
[&Yahoo! Toolbar Helper]
{02478D38-C3F9-4efb-9B51-7695ECA05670} <C:\PROGRA~1\Yahoo!\Companion\Installs\cpn0\yt.dll, (Signed) Yahoo! Inc.>
[Adobe PDF Reader Link Helper]
{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} <C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll, (Signed) Adobe Systems Incorporated>
[BitComet Helper]
{39F7E362-828A-4B5A-BCAF-5B79BFDFEA60} <C:\Program Files\BitComet\tools\BitCometBHO_1.1.11.30.dll, (Signed) BitComet>
[IETimber]
{489873CE-F3E1-44A3-8E89-04BE26BE4446} <C:\Program Files\Internet Explorer\IETimber\IETimber.dll, (Signed) 北京世?乾坤?件>
[]
{7E853D72-626A-48EC-A868-BA8D5E23E045} <, >
[]
{A5366673-E8CA-11D3-9CD9-0090271D075B} <, >
[FlashGetBHO]
{b070d3e3-fec0-47d9-8e8a-99d4eeb3d3b0} <C:\Documents and Settings\Administrator\Application Data\FlashGetBHO\FlashGetBHO31.dll, (Signed) FlashGet>
[Java(tm) Plug-In 2 SSV Helper]
{DBC80044-A445-435b-BC74-9C25C1C588A9} <C:\Program Files\Java\jre6\bin\jp2ssv.dll, Sun Microsystems, Inc.>
[JQSIEStartDetectorImpl Class]
{E7E6F031-17CE-4C07-BC86-EABFE594F69C} <C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll, Sun Microsystems, Inc.>
[]
{F01CB278-9AE5-427F-90CC-FBD913B44E8E} <, >
[?????@???p]
{1F460357-8A94-4D71-9CA3-AA4ACF32ED8E} <C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 7.0\SCIEPlgn.dll, (Signed) Kaspersky Lab>
[]
{4528BBE0-4E08-11D5-AD55-00010333D0AD} <C:\PROGRA~1\Yahoo!\common\yhexbmestw.dll, (Signed) >
[Real.com]
{CD67F990-D8E9-11d2-98FE-00C0F0318AFE} <C:\WINDOWS\System32\Shdocvw.dll, (Signed) Microsoft Corporation>
[BitComet]
{D18A0B52-D63C-4ed0-AFC6-C1E3DC1AF43A} <, >
[]
{e2e2dd38-d088-4134-82b7-f2ba38496583} <%windir%\Network Diagnostic\xpnetdiag.exe, (Signed) N/A>
[D.S.Lite]
{F8475519-8412-4D40-A46E-692D9D04DF7F} <D:\DSLite 2.07.45\DSLite.exe, watermonster.org>
[Messenger]
{FB5F1910-F110-11d2-BB9E-00C04F795683} <C:\Program Files\Messenger\msmsgs.exe, (Signed) Microsoft Corporation>
[&IE Doctor Bar]
{123249EB-F891-44C4-946F-450064F9080E} <C:\PROGRA~1\IEDOCT~1\IEDrBar.dll, N/A>
[Dr.eye WebPage Translation]
{92B255FE-94E2-4BCA-958D-3926CE38913F} <C:\PROGRA~1\Inventec\Dreye\DreyeMT\DREYEI~1.DLL, >
[Dr.eye 線上辭典]
{08B2E5B7-9E4D-4FB9-831D-F4E407A1CE7E} <C:\Program Files\Inventec\Dreye iDictionary\DrODWBar.dll, >
[Yahoo! Toolbar]
{EF99BD32-C1FB-11D2-892F-0090271D4F88} <C:\PROGRA~1\Yahoo!\Companion\Installs\cpn0\yt.dll, (Signed) Yahoo! Inc.>
[Grab Pro]
{C55BBCD6-41AD-48AD-9953-3609C48EACC7} <C:\Program Files\Orbitdownloader\GrabPro.dll, (Signed) >
[]
{02BF25D5-8C17-4B23-BC80-D3488ABDDC6B} <, >
[MMCPlayer Class]
{05C1004E-2596-48E5-8E26-39362985EEB9} <C:\WINDOWS\Downloaded Program Files\MMCShell.dll, Sohu.com Inc.>
[]
{072039AB-2117-4ED5-A85F-9B9EB903E021} <, >
[BMSpeedCheck Control]
{0AE0F5F9-8233-49A4-A3C8-004CE190787B} <C:\WINDOWS\DOWNLO~1\BMSPEE~1.OCX, ???>
[CathayMyATM.ATMFunc]
{12755229-656A-4508-BC94-2DA4D314B4C8} <C:\WINDOWS\system32\CathayMyATM.dll, Cathay United Bank>
[Shockwave ActiveX Control]
{166B1BCA-3F9C-11CF-8075-444553540000} <C:\WINDOWS\system32\Adobe\Director\SwDir.dll, (Signed) Adobe Systems, Inc.>