[CODE]
2007-06-20,14:49:07
System Repair Engineer 2.4.12.806
Smallfrogs (http://www.KZTechs.com)
Windows XP Professional Service Pack 1 (Build 2600) - 管理权限用户 - 完整功能
以下内容被选中：
所有的启动项目（包括注册表、启动文件夹、服务等）
浏览器加载项
正在运行的进程（包括进程模块信息）
文件关联
Winsock 提供者
Autorun.inf
HOSTS 文件
启动项目
注册表
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
<ctfmon.exe><C:\WINDOWS\System32\ctfmon.exe> [(Verified)Microsoft Windows XP Publisher]
<r2evild30s><C:\DOCUME~1\lkx\LOCALS~1\Temp\iexplorer.exe> []
<t2gemesm1dbz><C:\DOCUME~1\lkx\LOCALS~1\Temp\c0nime.exe> [N/A]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
<RavTask><"c:\Program Files\Rising\Rav\RavTask.exe" -system> [Beijing Rising Technology Co., Ltd.]
<TkBellExe><"C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot> [RealNetworks, Inc.]
<regtangtang><C:\WINDOWS\System32\aa.exe> [N/A]
<Microsoft Autorun4><C:\WINDOWS\System32\dllhost32.exe> []
<AVPSrv><C:\WINDOWS\AVPSrv.exe> []
<wosa><C:\DOCUME~1\lkx\LOCALS~1\Temp\woso.exe> [N/A]
<rxsa><C:\DOCUME~1\lkx\LOCALS~1\Temp\rxso.exe> [N/A]
<qjsa><C:\DOCUME~1\lkx\LOCALS~1\Temp\qjso.exe> [N/A]
<tlsa><C:\DOCUME~1\lkx\LOCALS~1\Temp\tlso.exe> [N/A]
<dasa><C:\DOCUME~1\lkx\LOCALS~1\Temp\daso.exe> [N/A]
<wlsa><C:\DOCUME~1\lkx\LOCALS~1\Temp\wlso.exe> [N/A]
<wgsa><C:\DOCUME~1\lkx\LOCALS~1\Temp\wgso.exe> [N/A]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunOnce]
<RavStub><"c:\Program Files\Rising\Rav\ravstub.exe" /RUNONCE> [Beijing Rising Technology Co., Ltd.]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
<shell><Explorer.exe> [(Verified)Microsoft Windows XP Publisher]
<Userinit><C:\WINDOWS\System32\Userinit.exe> [(Verified)Microsoft Windows XP Publisher]
<UIHost><logonui.exe> [(Verified)Microsoft Windows XP Publisher]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
<{32CD708B-60A7-4C00-9377-D73EAA495F0F}><C:\WINDOWS\system32\RavExt.dll> [Beijing Rising Technology Co., Ltd.]
<?{0CD68AC9-FF63-3E61-626B-B663E62F6236}><> [N/A]
<?{0EA66AD2-CF26-2E23-532B-B292E22F3266}><> [N/A]
<{0EA66AD2-CF26-2E23-532B-B292E22F3266}><C:\Program Files\Common Files\Microsoft Shared\MSINFO\NewTemp.dll> [N/A]
<{0EA12C16-CDEF-6AC1-236E-CD3FE82F5213}><C:\Program Files\Internet Explorer\msvcrt.dll> [N/A]
<{754FB7D8-B8FE-4810-B363-A788CD060F1F}><C:\Program Files\Internet Explorer\PLUGINS\System64.Sys> [N/A]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
<ATIPTA><; "C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe"> [ATI Technologies, Inc.]
<dasa><; C:\DOCUME~1\lkx\LOCALS~1\Temp\daso.exe> [N/A]
<fysa><; C:\DOCUME~1\lkx\LOCALS~1\Temp\fyso.exe> [N/A]
<IMJPMIG8.1><; "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32> [(Verified)Microsoft Windows XP Publisher]
<jtsa><; C:\DOCUME~1\lkx\LOCALS~1\Temp\jtso.exe> [N/A]
<KernelFaultCheck><; %systemroot%\system32\dumprep 0 -k> [N/A]
<PHIME2002A><; C:\WINDOWS\System32\IME\TINTLGNT\TINTSETP.EXE /IMEName> [(Verified)Microsoft Windows XP Publisher]
<PHIME2002ASync><; C:\WINDOWS\System32\IME\TINTLGNT\TINTSETP.EXE /SYNC> [(Verified)Microsoft Windows XP Publisher]
<qjsa><; C:\DOCUME~1\lkx\LOCALS~1\Temp\qjso.exe> [N/A]
<runeip><; C:\Program Files\Rising\AntiSpyware\runiep.exe> [Beijing Rising Technology Co., Ltd.]
<rxsa><; C:\DOCUME~1\lkx\LOCALS~1\Temp\rxso.exe> [N/A]
<TkBellExe><; "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot> [RealNetworks, Inc.]
<tlsa><; C:\DOCUME~1\lkx\LOCALS~1\Temp\tlso.exe> [N/A]
<wdsa><; C:\DOCUME~1\lkx\LOCALS~1\Temp\wdso.exe> [N/A]
<wgsa><; C:\DOCUME~1\lkx\LOCALS~1\Temp\wgso.exe> [N/A]
<wlsa><; C:\DOCUME~1\lkx\LOCALS~1\Temp\wlso.exe> [N/A]
<wmsa><; C:\DOCUME~1\lkx\LOCALS~1\Temp\wmso.exe> [N/A]
<wosa><; C:\DOCUME~1\lkx\LOCALS~1\Temp\woso.exe> [N/A]
<ztsa><; C:\DOCUME~1\lkx\LOCALS~1\Temp\ztso.exe> [N/A]
==================================
启动文件夹
N/A
==================================
服务
[Ati HotKey Poller / Ati HotKey Poller][Running/Auto Start]
<C:\WINDOWS\System32\Ati2evxx.exe><ATI Technologies Inc.>
[ATI Smart / ATI Smart][Stopped/Auto Start]
<C:\WINDOWS\system32\ati2sgag.exe><>
[Human Interface Device Access / HidServ][Stopped/Disabled]
<C:\WINDOWS\System32\svchost.exe -k netsvcs-->%SystemRoot%\System32\hidserv.dll><N/A>
[Win32 Debug Service / MSDebugsvc][Stopped/Auto Start]
<C:\WINDOWS\System32\rundll32.exe msdebug.dll,input><Microsoft Corporation>
[Remote Debug Service / RemoteDbg][Stopped/Auto Start]
<C:\WINDOWS\System32\rundll32.exe RemoteDbg.dll,input><Microsoft Corporation>
[Remote Packet Capture Protocol v.0 (experimental) / rpcapd][Stopped/Manual Start]
<"C:\Program Files\WinPcap\rpcapd.exe" -d -f "C:\Program Files\WinPcap\rpcapd.ini"><N/A>
[Rising Process Communication Center / RsCCenter][Running/Auto Start]
<"c:\Program Files\Rising\Rav\CCenter.exe"><Beijing Rising Technology Co., Ltd.>
[Rising RealTime Monitor / RsRavMon][Running/Auto Start]
<"c:\Program Files\Rising\Rav\Ravmond.exe"><Beijing Rising Technology Co., Ltd.>
[SoundMAX Agent Service / SoundMAX Agent Service (default)][Running/Auto Start]
<C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe><Analog Devices, Inc.>
[Windows DHCP Service / WinDHCPsvc][Stopped/Auto Start]
<C:\WINDOWS\System32\rundll32.exe windhcp.ocx,input><Microsoft Corporation>
==================================
驱动程序
[ADProt / ADProt][Stopped/System Start]
<system32\drivers\ADProt.sys><腾讯科技（深圳）有限公司>
[aeaudio / aeaudio][Running/Manual Start]
<system32\drivers\aeaudio.sys><Andrea Electronics Corporation>
[ati2mtag / ati2mtag][Running/Manual Start]
<System32\DRIVERS\ati2mtag.sys><ATI Technologies Inc.>
[Rising TDI Base Driver / BaseTDI][Running/Auto Start]
<System32\DRIVERS\BaseTDI.SYS><Beijing Rising Technology Co., Ltd.>
[boot002 / boot002][Stopped/Boot Start]
<\SystemRoot\system32\drivers\boot002.sys><>
[d347bus / d347bus][Running/Boot Start]
<\SystemRoot\System32\DRIVERS\d347bus.sys><>
[d347prt / d347prt][Running/Boot Start]
<\SystemRoot\System32\Drivers\d347prt.sys><>
[EagleNT / EagleNT][Stopped/Manual Start]
<\??\C:\WINDOWS\System32\drivers\EagleNT.sys><N/A>
[ExpScaner / ExpScaner][Running/Auto Start]
<\??\c:\Program Files\Rising\Rav\ExpScan.sys><>
[HOOKAPI / HOOKAPI][Stopped/Manual Start]
<\??\C:\PROGRAM FILES\RISING\RAV\HookApi.Sys><瑞星软件有限公司>
[HookCont / HookCont][Running/Auto Start]
<\??\c:\Program Files\Rising\Rav\HOOKCONT.sys><Rising>
[HookReg / HookReg][Running/Auto Start]
<\??\c:\Program Files\Rising\Rav\HookReg.sys><>
[HookSys / HookSys][Running/Auto Start]
<\??\c:\Program Files\Rising\Rav\HookSys.sys><Rising>
[iqudxia / iqudxia][Running/Boot Start]
<\SystemRoot\system32\drivers\iqudxia.sys><>
[kdrdli / kdrdli][Running/Boot Start]
<\SystemRoot\\SystemRoot\System32\drivers\kdrdli.sys><N/A>
[kmsinput / kmsinput][Stopped/Manual Start]
<\??\C:\WINDOWS\System32\drivers\kmsinput.sys><N/A>
[MEMSCAN / MEMSCAN][Running/Auto Start]
<\??\c:\Program Files\Rising\Rav\MEMSCAN.sys><瑞星软件有限公司>
[NetGroup Packet Filter Driver / NPF][Stopped/Manual Start]
<system32\drivers\npf.sys><NetGroup - Politecnico di Torino>
[npkcrypt / npkcrypt][Running/Auto Start]
<\??\d:\Program Files\Tencent\QQ\npkcrypt.sys><INCA Internet Co., Ltd.>
[NPPTNT2 / NPPTNT2][Stopped/Manual Start]
<\??\C:\WINDOWS\System32\npptNT2.sys><INCA Internet Co., Ltd.>
[oagwmh8 / oagwmh80][Stopped/Boot Start]
<\SystemRoot\System32\DRIVERS\oagwmh80.sys><N/A>
[odak / odakj][Stopped/Boot Start]
<\SystemRoot\System32\DRIVERS\odakj.sys><N/A>
[oklfemfm / oklfemfm][Running/Boot Start]
<\SystemRoot\System32\DRIVERS\oklfemfm.sys><Yahoo! China Corporation>
[Direct Parallel Link Driver / Ptilink][Running/Manual Start]
<System32\DRIVERS\ptilink.sys><Parallel Technologies, Inc.>
[RsAntiSpyware / RsAntiSpyware][Running/Boot Start]
<\SystemRoot\System32\drivers\RsBoot.sys><Beijing Rising>
[RsNTGDI / RsNTGDI][Running/Boot Start]
<\SystemRoot\System32\Drivers\RsNTGdi.sys><Beijing Rising Technology Co., Ltd.>
[RSPPSYS / RSPPSYS][Running/Auto Start]
<\??\c:\Program Files\Rising\Rav\RSPPSYS.sys><Rising>
[Realtek RTL8139(A/B/C)-based PCI Fast Ethernet Adapter NT Driver / rtl8139][Running/Manual Start]
<System32\DRIVERS\RTL8139.SYS><Realtek Semiconductor Corporation>
[Secdrv / Secdrv][Running/Auto Start]
<System32\DRIVERS\secdrv.sys><Macrovision Corporation, Macrovision Europe Limited, and Macrovision Japan and Asia K.K.>
[smwdm / smwdm][Running/Manual Start]
<system32\drivers\smwdm.sys><Analog Devices, Inc.>
[Player Recovery Device Control Driver / StMp3Rec][Stopped/Manual Start]
<System32\Drivers\StMp3Rec.sys><Generic>
==================================