被劫持时扫描情况：
2006-03-02,01:14:45
System Repair Engineer 2.0.12.350 (2.0 RC 1)
Windows 98 Second Edition
以下内容被选中：
所有的启动项目（包括注册表、启动文件夹、服务等）
浏览器加载项
正在运行的进程（包括进程模块信息）
文件关联
启动项目
注册表
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
<ScanRegistry><C:\WINDOWS\scanregw.exe /autorun>
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
<TaskMonitor><C:\WINDOWS\taskmon.exe>
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
<SystemTray><SysTray.Exe>
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
<IrMon><IrMon.exe>
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
<LoadPowerProfile><Rundll32.exe powrprof.dll,LoadCurrentPwrScheme>
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
<TkBellExe><"C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot>
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
<SysExplr><C:\HEROSOFT\HERO2001\SYSEXPLR.EXE>
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunServices]
<LoadPowerProfile><Rundll32.exe powrprof.dll,LoadCurrentPwrScheme>
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunServices]
<SchedulingAgent><C:\WINDOWS\SYSTEM\mstask.exe>
==================================
启动文件夹
服务
==================================
浏览器加载项
[@shdoclc.dll,-866]
{c95fe080-8f5d-11d2-a20b-00aa003c157a} <, N/A>
[Shockwave Flash
Object]
{D27CDB6E-AE6D-11CF-96B8-444553540000} <C:\WINDOWS\SYSTEM\MACROMED\FLASH\FLASH.OCX, Macromedia, Inc.>
[Download All Links with IDM]
<D:\软体\IDMAN_4[1].03\IDMAN_4.03\IEGetAll.htm, N/A>
[Download with IDM]
<D:\软体\IDMAN_4[1].03\IDMAN_4.03\IEExt.htm, N/A>
[使用影音传送带下载]
<C:\Program Files\Xi\NetTransport 2\NTAddLink.html, N/A>
[使用影音传送带下载全部链接]
<C:\Program Files\Xi\NetTransport 2\NTAddList.html, N/A>
==================================
正在运行的进程
[PID: 4294869269][C:\WINDOWS\SYSTEM\MPREXE.EXE] <Microsoft Corporation><4.10.1998>
[PID: 4294839993][C:\WINDOWS\SYSTEM\MSTASK.EXE] <Microsoft Corporation><4.71.1959.1>
[C:\WINDOWS\SYSTEM\NETBIOS.DLL] <N/A><N/A>
[PID: 4294855641][C:\WINDOWS\EXPLORER.EXE] <Microsoft Corporation><4.72.3110.1>
[PID: 4294807033][C:\WINDOWS\TASKMON.EXE] <Microsoft Corporation><4.10.1998>
[PID: 4294804525][C:\WINDOWS\SYSTEM\SYSTRAY.EXE] <Microsoft Corporation><4.10.2222>
[PID: 4294830777][C:\PROGRAM FILES\COMMON FILES\REAL\UPDATE_OB\REALSCHED.EXE] <RealNetworks, Inc.><0.1.0.1622>
[PID: 4294825553][C:\HEROSOFT\HERO2001\SYSEXPLR.EXE] <N/A><N/A>
[C:\HEROSOFT\HERO2001\AVCDROM.DLL] <N/A><N/A>
[C:\WINDOWS\SYSTEM\WNASPI32.DLL] <Adaptec><1, 0, 0, 0>
[C:\WINDOWS\SYSTEM\NETBIOS.DLL] <N/A><N/A>
[PID: 4294831533][C:\WINDOWS\SYSTEM\WMIEXE.EXE] <Microsoft Corporation><5.00.1755.1>
[PID: 4294741037][C:\WINDOWS\SYSTEM\RNAAPP.EXE] <Microsoft Corporation><4.10.2222>
[C:\WINDOWS\SYSTEM\NETBIOS.DLL] <N/A><N/A>
[PID: 4294742457][C:\WINDOWS\SYSTEM\TAPISRV.EXE] <Microsoft Corporation><4.10.2222>
[C:\PROGRAM FILES\FFDSHOW\FFDSHOW.AX] <N/A><N/A>
[C:\WINDOWS\SYSTEM\MACROMED\FLASH\FLASH.OCX] <Macromedia, Inc.><7,0,19,0>
[C:\WINDOWS\SYSTEM\NETBIOS.DLL] <N/A><N/A>
[C:\PROGRAM FILES\COMMON FILES\MICROSOFT SHARED\WEB 文件夹\MSONSEXT.DLL] <N/A><N/A>
[PID: 4294725461][C:\PROGRAM FILES\INTERNET EXPLORER\IEXPLORE.EXE] <Microsoft Corporation><5.00.2614.3500>
[C:\WINDOWS\SYSTEM\ATIMCRAB.DLL] <ATI Technologies Inc.><4.11.2033>
[C:\WINDOWS\SYSTEM\ATIVPEAB.DLL] <ATI Technologies Inc.><4.11.9125>
[C:\WINDOWS\SYSTEM\ATI3DRAB.DLL] <ATI Technologies Inc. ><4.11.6024>
[C:\WINDOWS\SYSTEM\ATID32AB.DLL] <ATI Technologies Inc.><4.11.6023>
[PID: 4294690777][C:\WINDOWS\SYSTEM\DDHELP.EXE] <Microsoft Corporation><4.08.01.0881>
[PID: 4294646197][C:\WINDOWS\NOTEPAD.EXE] <Microsoft Corporation><4.10.1998>
[C:\WINDOWS\SYSTEM\NETBIOS.DLL] <N/A><N/A>
[PID: 4294552333][D:\软体\SYSTEM REPAIR ENGINEER\SRENG.EXE] <Smallfrogs Studio><2.0.12.350>
==================================
文件关联
.TXT OK. [C:\WINDOWS\NOTEPAD.EXE %1]
.EXE OK. ["%1" %*]
.COM OK. ["%1" %*]
.PIF OK. ["%1" %*]
.REG OK. [regedit.exe "%1"]
.BAT OK. ["%1" %*]
.SCR OK. ["%1" /S]
.CHM OK. ["C:\WINDOWS\hh.exe" %1]
.HLP OK. [C:\WINDOWS\winhlp32.exe %1]
.INI OK. [C:\WINDOWS\NOTEPAD.EXE %1]
.INF OK. [C:\WINDOWS\NOTEPAD.EXE %1]
.VBS Error. [超级解霸2001XP]
.JS OK. [C:\WINDOWS\WScript.exe "%1" %*]
.LNK OK. [{00021401-0000-0000-C000-000000000046}]
==================================
Winsock 提供者
==================================
