jkiller295
T.E.T.Я.I.S
Mã:
Mẫu báo cáo tình trạng máy tính hiện tại.
Thực hiện bởi chương trình: Perfect Antivirus 2009.
Thời gian: 11:30:37 AM - 10/5/2010
- Thông tin máy tính:
+ Hệ điều hành: Microsoft Windows XP Professional 5.1.2600
+ Tên người sử dụng: Administrator
+ Tên máy tính: MINH-F17E7CBEA3
+ Dung lượng bộ nhớ RAM: 503.488 MB
===============================================================================
[1] - Các chương trình đang chạy trong bộ nhớ:
C:\WINDOWS\System32\smss.exe : 480
C:\WINDOWS\system32\winlogon.exe : 560
C:\WINDOWS\system32\services.exe : 604
C:\WINDOWS\system32\lsass.exe : 616
C:\WINDOWS\system32\svchost.exe : 764
C:\WINDOWS\System32\svchost.exe : 888
C:\WINDOWS\system32\svchost.exe : 928
C:\WINDOWS\Explorer.EXE : 1268
C:\WINDOWS\system32\spoolsv.exe : 1372
C:\Program Files\Internet Download Manager\IDMan.exe : 2028
C:\WINDOWS\system32\ctfmon.exe : 2036
C:\Documents and Settings\Administrator.MINH-F17E7CBEA3\Local Settings\Application Data\Google\Update\1.2.183.29\GoogleCrashHandler.exe : 200
C:\Program Files\Internet Download Manager\IEMonitor.exe : 1808
C:\WINDOWS\system32\wscntfy.exe : 1860
C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe : 2288
C:\Documents and Settings\Administrator.MINH-F17E7CBEA3\My Documents\Downloads\Programs\BHome3063.exe : 3760
C:\WINDOWS\system32\svchost.exe : 3460
C:\Program Files\Internet Explorer\IEXPLORE.EXE : 2612
C:\Program Files\Internet Explorer\IEXPLORE.EXE : 2336
C:\Documents and Settings\Administrator.MINH-F17E7CBEA3\My Documents\Downloads\Compressed\_PSR\_PSR.exe : 3012
C:\WINDOWS\system32\notepad.exe : 2368
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
[2] - Các chương trình được nạp lúc khởi động:
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
[+] IDMan = C:\Program Files\Internet Download Manager\IDMan.exe /onboot
[+] ctfmon.exe = C:\WINDOWS\system32\ctfmon.exe
[+] Google Update = "C:\Documents and Settings\Administrator.MINH-F17E7CBEA3\Local Settings\Application Data\Google\Update\GoogleUpdate.exe" /c
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\RunOnce]
[+] FlashPlayerUpdate = C:\WINDOWS\system32\Macromed\Flash\FlashUtil10h_ActiveX.exe -update activex
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
[+] SafeSys = C:\Program Files\Common Files\SafeSys.exe
[+] BkavFw = C:\Program Files\Bkav2006\Bkav2006.exe TASKBAR
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce]
[+] AvgUninstallURL = cmd.exe /c start http://www.avg.com/ww.special-uninstallation-feedback-app?lic=OUxTRlJFRS1WUFVaNy1HMkNNWC1SWFBXQS1QM05aSC05RDIwQy0zN1RT"&"inst=NzctNDYyNTQ3NjAy"&"prod=55"&"ver=10.0.1119
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnceEx]
[C:\Documents and Settings\All Users\Start Menu\Programs\Startup]
[+] desktop.ini
[+] McAfee Security Scan Plus.lnk
[C:\Documents and Settings\Administrator\Start Menu\Programs\Startup]
[+] desktop.ini
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
[3] - Giá trị của các Key quan trọng trong khóa Winlogon:
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
[+] AutoRestartShell = 0001
[+] DefaultDomainName = MINH-F17E7CBEA3
[+] DefaultUserName = Administrator
[+] LegalNoticeCaption =
[+] LegalNoticeText =
[+] PowerdownAfterShutdown = 0
[+] ReportBootOk = 1
[+] Shell = Explorer.exe
[+] ShutdownWithoutLogon = 0
[+] System =
[+] Userinit = C:\WINDOWS\system32\userinit.exe,
[+] VmApplet = rundll32 shell32,Control_RunDLL "sysdm.cpl"
[+] SfcQuota = FFFFFFFF
[+] allocatecdroms = 0
[+] allocatedasd = 0
[+] allocatefloppies = 0
[+] cachedlogonscount = 10
[+] forceunlocklogon = 0000
[+] passwordexpirywarning = 000E
[+] scremoveoption = 0
[+] AllowMultipleTSSessions = 0001
[+] UIHost = logonui.exe
[+] LogonType = 0001
[+] Background = 0 0 0
[+] DebugServerCommand = no
[+] SFCDisable = 0000
[+] WinStationsDisabled = 0
[+] HibernationPreviouslyEnabled = 0001
[+] ShowLogonOptions = 0000
[+] AltDefaultUserName = Administrator
[+] AltDefaultDomainName = MINH-F17E7CBEA3
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
[4] - Nội dung tập tin Hosts:
-------------------------------------------------------------------
# Copyright (c) 1993-1999 Microsoft Corp.
#
# This is a sample HOSTS file used by Microsoft TCP/IP for Windows.
#
# This file contains the mappings of IP addresses to host names. Each
# entry should be kept on an individual line. The IP address should
# be placed in the first column followed by the corresponding host name.
# The IP address and the host name should be separated by at least one
# space.
#
# Additionally, comments (such as these) may be inserted on individual
# lines or following the machine name denoted by a '#' symbol.
#
# For example:
#
# 102.54.94.97 rhino.acme.com # source server
# 38.25.63.10 x.acme.com # x client host
127.0.0.1 localhost
222.255.28.123 update.nprotect.com
222.255.28.123 update.nprotect.net
222.255.28.123 guard.gunbound.net
222.255.28.123 update.gameguard.net
222.255.28.123 update.gameguard.com
222.255.28.123 gameguard.co.kr-------------------------------------------------------------------
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
[5] - Các thông số cài đặt của Internet Explorer:
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main]
[+] NoUpdateCheck = 0001
[+] NoJITSetup = 0001
[+] Disable Script Debugger = yes
[+] Show_ChannelBand = No
[+] Anchor Underline = yes
[+] Cache_Update_Frequency = Once_Per_Session
[+] Display Inline Images = yes
[+] Do404Search = 01 00 00 00
[+] Local Page = C:\WINDOWS\system32\blank.htm
[+] Save_Session_History_On_Exit = no
[+] Show_FullURL = no
[+] Show_StatusBar = yes
[+] Show_ToolBar = yes
[+] Show_URLinStatusBar = yes
[+] Show_URLToolBar = yes
[+] Start Page = http://www.zing.vn/zing/?utm_source=hp&utm_medium=boom
[+] Use_DlgBox_Colors = yes
[+] Search Page = http://vn.rd.yahoo.com/customize/ycomp/defaults/sp/*http://vn.yahoo.com
[+] FullScreen = no
[+] NotifyDownloadComplete = yes
[+] Window_Placement = 2C 00 00 00 00 00 00 00 01 00 00 00 FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF 00 00 00 00 00 00 00 00 73 04 00 00 3E 03 00 00
[+] Use Custom Search URL = 0001
[+] AutoSearch = 0000
[+] Error Dlg Displayed On Every Error = no
[+] ShowedCheckBrowser = Yes
[+] Check_Associations = Yes
[+] FormSuggest PW Ask = no
[+] Use FormSuggest = no
[+] XMLHTTP = 0001
[+] UseClearType = yes
[+] Enable Browser Extensions = yes
[+] Play_Background_Sounds = yes
[+] Play_Animations = yes
[+] CompatibilityFlags = 0000
[+] IE8RunOnceLastShown = 0001
[+] IE8RunOnceLastShown_TIMESTAMP = EE 3F 45 EF D8 92 C1 01
[+] IE8RunOncePerInstallCompleted = 0001
[+] IE8RunOnceCompletionTime = 62 2F AE FF D8 92 C1 01
[+] IE8TourShown = 0001
[+] IE8TourShownTime = 62 2F AE FF D8 92 C1 01
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main]
[+] Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
[+] Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
[+] Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
[+] Enable_Disk_Cache = yes
[+] Cache_Percent_of_Disk = 0A 00 00 00
[+] Delete_Temp_Files_On_Exit = yes
[+] Local Page = C:\WINDOWS\system32\blank.htm
[+] Anchor_Visitation_Horizon = 01 00 00 00
[+] Use_Async_DNS = yes
[+] Placeholder_Width = 1A 00 00 00
[+] Placeholder_Height = 1A 00 00 00
[+] Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
[+] CompanyName = Microsoft Corporation
[+] Custom_Key = MICROSO
[+] Wizard_Version = 6.0.2600.0000
[+] FullScreen = no
[+] Default_Secondary_Page_URL =
[+] Extensions Off Page = about:NoAdd-ons
[+] Security Risk Page = about:SecurityRisk
[+] Check_Associations = yes
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Search]
[+] SearchAssistant = http://ie.search.msn.com/{SUB_RFC1766}/srchasst/srchasst.htm
[+] CustomizeSearch = http://ie.search.msn.com/{SUB_RFC1766}/srchasst/srchcust.htm
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
[6] - Khóa đăng ký của các tập tin thực thi:
[HKEY_CLASSES_ROOT\exefile\shell\open\command]
(Default) = "%1" %*
[HKEY_CLASSES_ROOT\comfile\shell\open\command]
(Default) = "%1" %*
[HKEY_CLASSES_ROOT\batfile\shell\open\command]
(Default) = "%1" %*
[HKEY_CLASSES_ROOT\piffile\shell\open\command]
(Default) = "%1" %*
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
[7] - Tình trạng Khóa/Mở các chức năng của Windows
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies]
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System]
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer]
[+] NoDriveTypeAutoRun = 00091
[HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\System]
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
[8] - Các tập tin Autorun.inf trong ổ đĩa:
[C:\] - Phát hiện Autorun!
-------------------------------------
[AutoRun]
Open=SafeSys.exe
Shell\Open=´ò¿ª(&O)
Shell\Open\Command=SafeSys.exe
Shell\Open\Default=1
Shell\Explore=×ÊÔ´¹ÜÀíÆ÷(&X)
Shell\Explore\Command=SafeSys.exe
-------------------------------------
[D:\] - Phát hiện Autorun!
-------------------------------------
[AutoRun]
Open=SafeSys.exe
Shell\Open=´ò¿ª(&O)
Shell\Open\Command=SafeSys.exe
Shell\Open\Default=1
Shell\Explore=×ÊÔ´¹ÜÀíÆ÷(&X)
Shell\Explore\Command=SafeSys.exe
-------------------------------------
[E:\] - Phát hiện Autorun!
-------------------------------------
[AutoRun]
Open=SafeSys.exe
Shell\Open=´ò¿ª(&O)
Shell\Open\Command=SafeSys.exe
Shell\Open\Default=1
Shell\Explore=×ÊÔ´¹ÜÀíÆ÷(&X)
Shell\Explore\Command=SafeSys.exe
-------------------------------------
==============================================================================
Hoàn tất báo cáo.
--------------------------------------- End --------------------------------------
Copyright © Perfect Antivirus 2009cài BHome3063.exe, ko phải là cũ. vẫn bị virus autorun. ko hiểu bkav phòng autorun virus như thế nào
( ứ report lên ứ diệt 
)
