[CODE]
2007-08-14,15:35:12
System Repair Engineer 2.4.12.806
Smallfrogs (http://www.KZTechs.com)
Windows XP Professional Service Pack 2 (Build 2600) - 管理权限用户 - 完整功能
以下内容被选中：
所有的启动项目（包括注册表、启动文件夹、服务等）
浏览器加载项
正在运行的进程（包括进程模块信息）
文件关联
Winsock 提供者
Autorun.inf
HOSTS 文件
启动项目
注册表
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
<ctfmon.exe><C:\WINDOWS\system32\ctfmon.exe> [(Verified)Microsoft Windows Publisher]
<KpopMon><D:\KAV6\KPopMon.EXE> []
[HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows]
<load><> [N/A]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
<IMJPMIG8.1><"C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32> [(Verified)Microsoft Windows Publisher]
<PHIME2002ASync><C:\WINDOWS\System32\IME\TINTLGNT\TINTSETP.EXE /SYNC> [(Verified)Microsoft Windows Publisher]
<PHIME2002A><C:\WINDOWS\System32\IME\TINTLGNT\TINTSETP.EXE /IMEName> [(Verified)Microsoft Windows Publisher]
<Smapp><C:\Program Files\Analog Devices\SoundMAX\Smtray.exe> [Analog Devices, Inc.]
<KAVRun><D:\KAV6\KAVRun.EXE> [kingsoft]
<Kulansyn><D:\KAV6\Kulansyn.EXE> [Kingsoft Corp.]
<runeip><"D:\Program Files\Rising\AntiSpyware\runiep.exe" /startup> [Beijing Rising Technology Co., Ltd.]
<asgfdjs2><C:\WINDOWS\system32\vbsdaas2.exe> []
<mppds><C:\WINDOWS\mppds.exe> []
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run]
<MSDEG32><LYLoader.exe> []
<MSDWG32><LYLoadbr.exe> [N/A]
<MSDCG32 ><LYLeador.exe> [N/A]
<MSDOG32><LYLoador.exe> [N/A]
<MSDSG32><LYLoadar.exe> [N/A]
<MSDMG32><LYLoadmr.exe> []
<MSDHG32><LYLoadhr.exe> [N/A]
<MSDQG32><LYLoadqr.exe> [N/A]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
<shell><Explorer.exe> [(Verified)Microsoft Windows Publisher]
<Userinit><C:\WINDOWS\system32\userinit.exe,> [(Verified)Microsoft Windows Publisher]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Windows]
<AppInit_DLLs><WMDLL.dll> []
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
<UIHost><logonui.exe> [(Verified)Microsoft Windows Publisher]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
<{AC2DC2EF-5165-40A3-8CDF-41DCA1B0901A}><C:\WINDOWS\system32\shlhook.dll> [Beijing Rising Technology Co., Ltd.]
<{5731EA1D-6AAF-4DE9-BDDA-7B390A75B286}><C:\WINDOWS\system32\xk1s0.dll> []
<{DC7596CB-D6CC-DCA3-DE52-DEEA63F6C61D}><C:\Program Files\Internet Explorer\rksldk.dll> [Microsoft Corporation]
<{ACADABAF-0000-0010-8000-10AA006D2EA4}><C:\WINDOWS\system32\system.dat> []
<{A2b4AdAc-0000-0010-8000-00AA006D2EA5}><C:\WINDOWS\system32\wpsys32.dat> []
<{A771A1EC-975E-4798-AF5E-A3F552D45C41}><C:\WINDOWS\system32\WMDLL.dll> []
<{A771A1EC-975E-4718-AF5E-A3F552D45C41}><C:\WINDOWS\system32\WLDLL.dll> []
<{A771A1EC-975E-4788-AF5E-A3F552D45C41}><C:\WINDOWS\system32\ZXDLL.dll> []
<?{E03C23BD-35B7-49C2-BBCA-6D8CEC2507E3}><hook wl> [N/A]
<?{A3C95A74-638D-4C6B-A856-4B27664A7F47}><hook wg> [N/A]
<?{074616A6-5ADC-4A3F-B252-E1D605228B5C}><hook wm> [N/A]
<?{6826A3DB-EA8E-4E67-880D-53D04C7C0BD8}><hook qj> [N/A]
<?{EDFF29C1-5A70-4460-AC1D-16DCB4B672F0}><hook rx> [N/A]
<?{08E909A4-B236-48DD-8BCC-90A604B93E68}><hook tl> [N/A]
<?{D8CC4845-441C-44F8-9053-28F2EF67655B}><hook da> [N/A]
<?{68F7767A-090C-4BBF-A015-720ACC6706E2}><hook wd> [N/A]
<?{781FBCC1-99C7-4AE0-95F7-66EA49E86DD7}><hook zx> [N/A]
<?{4E3FBFA4-F1CC-4B66-B333-B9F0FF4B4748}><hook my> [N/A]
<?{ABD0935D-B35A-47BD-BA9A-81678DDE74DD}><hook qh> [N/A]
<?{BD9B003B-0BE6-4528-A9D9-B8DBACAC6B9B}><hook fy> [N/A]
<?{71046DD5-E136-4C4B-A6B5-91C30CB15291}><hook jt> [N/A]
<?{E952B8F8-D91A-4EDD-851C-EE1A0F944469}><hook zt> [N/A]
<?{3422FB0F-95EB-458A-8B56-39552017A4EF}><hook mh> [N/A]
<{EDFF29C1-5A70-4460-AC1D-16DCB4B672F0}><C:\WINDOWS\system32\rxdoor0.dll> []
<{68F7767A-090C-4BBF-A015-720ACC6706E2}><C:\WINDOWS\system32\wddoor1.dll> []
<{781FBCC1-99C7-4AE0-95F7-66EA49E86DD7}><C:\WINDOWS\system32\zxdoor1.dll> []
<{D8CC4845-441C-44F8-9053-28F2EF67655B}><C:\WINDOWS\system32\dadoor1.dll> []
<{E03C23BD-35B7-49C2-BBCA-6D8CEC2507E3}><C:\WINDOWS\system32\wldoor1.dll> []
<{A3C95A74-638D-4C6B-A856-4B27664A7F47}><C:\WINDOWS\system32\wgdoor1.dll> []
<{3422FB0F-95EB-458A-8B56-39552017A4EF}><C:\WINDOWS\system32\mhdoor1.dll> []
<{4E3FBFA4-F1CC-4B66-B333-B9F0FF4B4748}><C:\WINDOWS\system32\mydoor1.dll> []
<{71046DD5-E136-4C4B-A6B5-91C30CB15291}><C:\WINDOWS\system32\jtdoor1.dll> []
<{074616A6-5ADC-4A3F-B252-E1D605228B5C}><C:\WINDOWS\system32\wmdoor1.dll> []
<{ABD0935D-B35A-47BD-BA9A-81678DDE74DD}><C:\WINDOWS\system32\qhdoor1.dll> []
<{E952B8F8-D91A-4EDD-851C-EE1A0F944469}><C:\WINDOWS\system32\ztdoor1.dll> []
<{6826A3DB-EA8E-4E67-880D-53D04C7C0BD8}><C:\WINDOWS\system32\qjdoor0.dll> []
<{08E909A4-B236-48DD-8BCC-90A604B93E68}><C:\WINDOWS\system32\tldoor1.dll> []
<{BD9B003B-0BE6-4528-A9D9-B8DBACAC6B9B}><C:\WINDOWS\system32\fydoor1.dll> []
[HKEY_CURRENT_USER\Control Panel\Desktop]
<SCRNSAVE.EXE><D:\KAV6\KaScrScn.scr> []
==================================
启动文件夹
[Adobe Gamma Loader]
<C:\Documents and Settings\All Users\「开始」菜单\程序\启动\Adobe Gamma Loader.lnk --> C:\PROGRA~1\COMMON~1\Adobe\CALIBR~1\ADOBEG~1.EXE [Adobe Systems, Inc.]><N>
[Microsoft Office]
<C:\Documents and Settings\All Users\「开始」菜单\程序\启动\Microsoft Office.lnk --> D:\PROGRA~1\MICROS~1\Office10\OSA.EXE [Microsoft Corporation]><N>
[TabUserW.exe]
<C:\Documents and Settings\All Users\「开始」菜单\程序\启动\TabUserW.exe.lnk --> C:\WINDOWS\system32\WTablet\TabUserW.exe [Wacom Technology, Corp.]><N>
==================================
服务
[Autodesk Licensing Service / Autodesk Licensing Service][Running/Auto Start]
<"C:\Program Files\Common Files\Autodesk Shared\Service\AdskScSrv.exe"><Autodesk>
[Human Interface Device Access / HidServ][Stopped/Disabled]
<C:\WINDOWS\System32\svchost.exe -k netsvcs-->%SystemRoot%\System32\hidserv.dll><N/A>
[InstallDriver Table Manager / IDriverT][Stopped/Manual Start]
<"C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe"><Macrovision Corporation>
[Kingsoft AntiVirus Service / KAVSvc][Running/Auto Start]
<D:\KAV6\KAVSvc.EXE><kingsoft Antivirus>
[RaySat_3dsmax8 Server / mi-raysat_3dsmax8][Running/Auto Start]
<"D:\Program Files\Autodesk\3dsMax8\mentalray\satellite\raysat_3dsmax8server.exe"><N/A>
[Remote Packet Capture Protocol v.0 (experimental) / rpcapd][Stopped/Manual Start]
<"C:\Program Files\WinPcap\rpcapd.exe" -d -f "C:\Program Files\WinPcap\rpcapd.ini"><N/A>
[SoundMAX Agent Service / SoundMAX Agent Service (default)][Running/Auto Start]
<C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe><Analog Devices, Inc.>
[TabletService / TabletService][Running/Auto Start]
<C:\WINDOWS\system32\Tablet.exe><Wacom Technology, Corp.>
[WebPrint / WebPrint][Stopped/Auto Start]
<c:\windows\system32\webprint.exe><Microsoft Corporation>
==================================
驱动程序
[aeaudio / aeaudio][Running/Manual Start]
<system32\drivers\aeaudio.sys><Andrea Electronics Corporation>
[jv2i2y4qv0 / jv2i2y4qv0][Running/Auto Start]
<\??\C:\WINDOWS\system32\drivers\jv2i2y4qv0.sys><N/A>
[KWatch / KWatch][Running/Manual Start]
<\??\C:\WINDOWS\system32\drivers\KWatch.Sys><Kingsoft Corporation>
[KWatch2 / KWatch2][Stopped/Manual Start]
<\??\C:\WINDOWS\system32\drivers\KWatch2.sys><Kingsoft Antivirus>
[NetGroup Packet Filter Driver / NPF][Stopped/Manual Start]
<system32\drivers\npf.sys><CACE Technologies>
[nv / nv][Running/Manual Start]
<System32\DRIVERS\nv4_mini.sys><NVIDIA Corporation>
[p2pfilter / p2pfilter][Stopped/Manual Start]
<\??\D:\Program Files\NetSoft\P2POver\p2pfilter.sys><N/A>
[Pen Class / PenClass][Running/Boot Start]
<\SystemRoot\system32\Drivers\PenClass.sys><Wacom Technology Corporation>
[Padus ASPI Shell / pfc][Running/Manual Start]
<system32\drivers\pfc.sys><Padus, Inc.>
[Direct Parallel Link Driver / Ptilink][Running/Manual Start]
<System32\DRIVERS\ptilink.sys><Parallel Technologies, Inc.>
[q4h / q4hj][Running/Boot Start]
<\SystemRoot\System32\DRIVERS\q4hj.sys><N/A>
[RsAntiSpyware / RsAntiSpyware][Running/Boot Start]
<\SystemRoot\system32\drivers\RsBoot.sys><Beijing Rising Technology Co., Ltd.>
[Realtek RTL8139(A/B/C)-based PCI Fast Ethernet Adapter NT Driver / rtl8139][Running/Manual Start]
<System32\DRIVERS\RTL8139.SYS><Realtek Semiconductor Corporation>
[Secdrv / Secdrv][Stopped/Manual Start]
<System32\DRIVERS\secdrv.sys><N/A>
[smwdm / smwdm][Running/Manual Start]
<system32\drivers\smwdm.sys><Analog Devices, Inc.>
[acpidisk / acpidisk][Running/Auto Start]
<\??\C:\WINDOWS\system32\drivers\acpidisk.sys><N/A>
==================================
