2006-07-08,00:44:44

System Repair Engineer 2.0.21.505 (2.0 RC 2)
Smallfrogs (http://www.KZTechs.com)

Windows XP Home Edition Service Pack 1 (Build 2600)
- 管理权限用户 - 完整功能

以下内容被选中：
所有的启动项目（包括注册表、启动文件夹、服务等）
浏览器加载项
正在运行的进程（包括进程模块信息）
文件关联


启动项目


注册表

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
(ctfmon.exe)(C:\WINDOWS\System32\ctfmon.exe) [Microsoft Corporation]
[HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows]
(load)() []
(run)() []
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
(PHIME2002ASync)(C:\WINDOWS\System32\IME\TINTLGNT\TINTSETP.EXE /SYNC) [Microsoft Corporation]
(PHIME2002A)(C:\WINDOWS\System32\IME\TINTLGNT\TINTSETP.EXE /IMEName) [Microsoft Corporation]
(IMSCMIG40W)(C:\PROGRA~1\COMMON~1\MICROS~1\IME\IMSC40W\IMSCMIG.EXE /SetPreload /Log) [Microsoft Corporation]
(KernelFaultCheck)(%systemroot%\system32\dumprep 0 -k) []
(NvCplDaemon)(RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup) [NVIDIA Corporation]
(RavTask)("C:\Program Files\rising\Rav\RavTask.exe" -system) [Beijing Rising Technology Co., Ltd.]
(SoundMan)(SOUNDMAN.EXE) [Realtek Semiconductor Corp.]
(XFILTER)("D:\Program Files\Filseclab\xfilter\xfilter.exe" -a) [费尔安全实验室]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
(shell)(Explorer.exe) [Microsoft Corporation]
(Userinit)(C:\WINDOWS\system32\userinit.exe,) [Microsoft Corporation]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Windows]
(AppInit_DLLs)() []
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
(UIHost)(logonui.exe) [Microsoft Corporation]

动文件夹

[费尔消息服务]
(C:\Documents and Settings\All Users\「开始」菜单\程序\启动\费尔消息服务.lnk)(N)



--------------------------------------------------------------------------------



服务

[NVIDIA Display Driver Service / NVSvc]
(C:\WINDOWS\System32\nvsvc32.exe)(NVIDIA Corporation)
[Rising Process Communication Center / RsCCenter]
("C:\Program Files\rising\Rav\CCenter.exe")(Beijing Rising Technology Co., Ltd.)
[RsRavMon Service / RsRavMon]
("C:\Program Files\rising\Rav\Ravmond.exe")(Beijing Rising Technology Co., Ltd.)



--------------------------------------------------------------------------------



浏览器加载项

[DragSearch BHO]
{62EED7C6-9F02-42f9-B634-98E2899E147B} (, N/A)
[超级兔子上网精灵]
{7369D35A-5B70-4A5B-B789-B25FE09B4AF3} (D:\Program Files\Super Rabbit\MagicSet\haokanbar.dll, Xiang Feng Technology)
[Yahoo 1G电邮]
{507F9113-CD77-4866-BA92-0E86DA3D0B97} (http://cn.zs.yahoo.com/cnsbutton.htm?source=cns&btn=yahoomail, N/A)
[雅虎助手]
{5D73EE86-05F1-49ed-B850-E423120EC338} (http://cn.zs.yahoo.com/cnsbutton.htm?source=cns&btn=yassist, N/A)
[@shdoclc.dll,-866]
{c95fe080-8f5d-11d2-a20b-00aa003c157a} (, N/A)
[QQ]
{c95fe080-8f5d-11d2-a20b-00aa003c157b} (d:\Program Files\Tencent\QQ\QQ.EXE, TENCENT)
[FlashGet]
{D6E814A0-E0C5-11d4-8D29-0050BA6940E3} (C:\PROGRA~1\FLASHGET\flashget.exe, Amaze Soft)
[Yahoo! Messenger]
{E5D12C4E-7B4F-11D3-B5C9-0050045C3C96} (, N/A)
[电台(&R)]
{8E718888-423F-11D2-876E-00A0C9082467} (C:\WINDOWS\System32\msdxm.ocx, Microsoft Corporation)
[FlashGet Bar]
{E0E899AB-F487-11D5-8D29-0050BA6940E3} (C:\PROGRA~1\FLASHGET\fgiebar.dll, Amaze Soft)
[金山快译(&K)]
{6C3797D2-3FEF-4cd4-B654-D3AE55B4128C} (, N/A)
[超级兔子上网精灵]
{43869BB3-22FD-4F15-9B46-238106BA2F4E} (D:\Program Files\Super Rabbit\MagicSet\haokanbar.dll, Xiang Feng Technology)
[YInstStarter Class]
{30528230-99F7-4BB4-88D8-FA1D4F56A2AB} (C:\WINDOWS\Downloaded Program Files\yinsthelper.dll, Yahoo! Inc.)
[WebActivater Control]
{3D8F74EE-8692-4F8F-B8D2-7522E732519E} (C:\WINDOWS\System32\WEBACT~1.OCX, QQ)
[updatePanelX Control]
{43E839C5-E10F-443A-BC1F-F09CFD2ABC77} (C:\WINDOWS\system32\uusee\internet\updateC.ocx, uusee)
[Kingsoft DUBA OnlineScan]
{C8BD9ACB-F7EC-48E6-BB2F-DAADC6789E9A} (C:\WINDOWS\System32\kingsoft\ONLINE~1\kavclean.ocx, kingsoft)
[Shockwave Flash Object]
{D27CDB6E-AE6D-11CF-96B8-444553540000} (C:\WINDOWS\System32\Macromed\Flash\Flash8.ocx, Macromedia, Inc.)
[Rising Web Scan Object]
{E4E2F180-CB8B-4DE9-ACBB-DA745D3BA153} (C:\WINDOWS\Downloaded Program Files\OL2005.dll, Beijing Rising Tech. Co., Ltd.)
[VqqSpeedDlProxy Class]
{F138084D-84D7-48CD-BEA8-04772457516E} (C:\WINDOWS\vqqsdl.dll, Tencent)
[上传到QQ网络硬盘]
(D:\Program Files\Tencent\qq\AddToNetDisk.htm, N/A)
[使用网际快车下载]
(C:\Program Files\FlashGet\jc_link.htm, N/A)
[使用网际快车下载全部链接]
(C:\Program Files\FlashGet\jc_all.htm, N/A)
[添加到QQ自定义面板]
(D:\Program Files\Tencent\qq\AddPanel.htm, N/A)
[添加到QQ表情]
(D:\Program Files\Tencent\qq\AddEmotion.htm, N/A)
[用QQ彩信发送该图片]
(D:\Program Files\Tencent\qq\SendMMS.htm, N/A)

正在运行的进程

[PID: 440][\SystemRoot\System32\smss.exe] (Microsoft Corporation)(5.1.2600.1106 (xpsp1.020828-1920))
[PID: 500][\??\C:\WINDOWS\system32\csrss.exe] (Microsoft Corporation)(5.1.2600.0 (xpclient.010817-1148))
[PID: 524][\??\C:\WINDOWS\system32\winlogon.exe] (Microsoft Corporation)(5.1.2600.1106 (xpsp1.020828-1920))
[PID: 568][C:\WINDOWS\system32\services.exe] (Microsoft Corporation)(5.1.2600.0 (xpclient.010817-1148))
[PID: 580][C:\WINDOWS\system32\lsass.exe] (Microsoft Corporation)(5.1.2600.1106 (xpsp1.020828-1920))
[C:\WINDOWS\system32\qlpxdrv.dll] (qeeloo.com)(1, 0, 0, 1)
[d:\Program Files\Filseclab\xfilter\XFILTER.DLL] (Filseclab Corporation)(3, 0, 0, 3644)
[PID: 756][C:\WINDOWS\system32\svchost.exe] (Microsoft Corporation)(5.1.2600.0 (xpclient.010817-1148))
[C:\WINDOWS\system32\qlpxdrv.dll] (qeeloo.com)(1, 0, 0, 1)
[d:\Program Files\Filseclab\xfilter\XFILTER.DLL] (Filseclab Corporation)(3, 0, 0, 3644)
[PID: 804][C:\Program Files\rising\Rav\CCenter.exe] (Beijing Rising Technology Co., Ltd.)(18, 0, 0, 3)
[PID: 820][C:\WINDOWS\System32\svchost.exe] (Microsoft Corporation)(5.1.2600.0 (xpclient.010817-1148))
[C:\WINDOWS\System32\qlpxdrv.dll] (qeeloo.com)(1, 0, 0, 1)
[d:\Program Files\Filseclab\xfilter\XFILTER.DLL] (Filseclab Corporation)(3, 0, 0, 3644)
[PID: 916][C:\WINDOWS\System32\svchost.exe] (Microsoft Corporation)(5.1.2600.0 (xpclient.010817-1148))
[C:\WINDOWS\System32\qlpxdrv.dll] (qeeloo.com)(1, 0, 0, 1)
[d:\Program Files\Filseclab\xfilter\XFILTER.DLL] (Filseclab Corporation)(3, 0, 0, 3644)
[PID: 944][C:\WINDOWS\System32\svchost.exe] (Microsoft Corporation)(5.1.2600.0 (xpclient.010817-1148))
[PID: 960][C:\Program Files\rising\Rav\Ravmond.exe] (Beijing Rising Technology Co., Ltd.)(18, 0, 1, 26)
[C:\Program Files\rising\Rav\BWList.dll] (Beijing Rising Technology Co., Ltd.)(18, 0, 0, 19)
[C:\Program Files\rising\Rav\RsCommX.dll] (rising)(18, 0, 0, 1)
[C:\Program Files\rising\Rav\RSAPPMGR.DLL] (Beijing Rising Technology Co., Ltd.)(18, 0, 0, 2)
[C:\Program Files\rising\Rav\CfgDll.dll] (Beijing Rising Technology Co., Ltd.)(18, 0, 0, 10)
[C:\Program Files\rising\Rav\RSCOMMON.DLL] (Beijing Rising Technology Co., Ltd.)(18, 0, 0, 4)
[C:\Program Files\rising\Rav\RsLog.dll] (Beijing Rising Technology Co., Ltd.)(18, 0, 0, 20)
[C:\Program Files\rising\Rav\HOOKSYS.dll] (Rising)(18, 1, 0, 9)
[C:\Program Files\rising\Rav\Scanner.dll] (Beijing Rising Technology Co., Ltd.)(18, 0, 0, 30)
[C:\Program Files\rising\Rav\libload.dll] (Beijing Rising Technology Co., Ltd.)(18, 0, 0, 10)
[C:\Program Files\rising\Rav\VirusLib.dll] (Beijing Rising Technology Co., Ltd.)(18, 0, 0, 10)
[C:\Program Files\rising\Rav\regmon.dll] (Beijing Rising Technology Co., Ltd.)(18, 0, 0, 6)
[C:\Program Files\rising\Rav\HookWeb.dll] (rising)(18, 0, 0, 1)
[C:\Program Files\rising\Rav\MemMon.dll] (Beijing Rising Technology Co., Ltd.)(18, 0, 0, 9)
[C:\Program Files\rising\Rav\expscan.dll] (Beijing Rising Technology Co., Ltd.)(18, 0, 0, 4)
[C:\Program Files\rising\Rav\mPorts.dll] (Beijing Rising Technology Co., Ltd.)(4, 0, 0, 3)
[C:\Program Files\rising\Rav\MailMon.dll] (Beijing Rising Technology Co., Ltd.)(18, 0, 0, 5)
[C:\Program Files\rising\Rav\SpamEng.dll] (N/A)(18, 0, 0, 6)
[C:\Program Files\rising\Rav\engine.dll] (Beijing Rising Technology Co., Ltd.)(18, 0, 0, 30)
[C:\WINDOWS\System32\qlpxdrv.dll] (qeeloo.com)(1, 0, 0, 1)
[d:\Program Files\Filseclab\xfilter\XFILTER.DLL] (Filseclab Corporation)(3, 0, 0, 3644)
[C:\Program Files\rising\Rav\PostTrt.dll] (Beijing Rising Technology Co., Ltd.)(18, 0, 0, 9)
[C:\Program Files\rising\Rav\UnExe.dll] (Beijing Rising Technology Co., Ltd.)(18, 0, 0, 11)
[C:\Program Files\rising\Rav\ScanExec.dll] (Beijing Rising Technology Co., Ltd.)(18, 0, 0, 11)
[C:\Program Files\rising\Rav\ScanEx.dll] (Beijing Rising Technology Co., Ltd.)(18, 0, 0, 11)
[C:\Program Files\rising\Rav\NvFile.dll] (Beijing Rising Technology Co., Ltd.)(18, 0, 0, 7)
[C:\Program Files\rising\Rav\ScanMac.dll] (Beijing Rising Technology Co., Ltd.)(18, 0, 0, 8)
[C:\Program Files\rising\Rav\ScanSct.dll] (Beijing Rising Technology Co., Ltd.)(18, 0, 0, 17)
[C:\Program Files\rising\Rav\Unpacker.dll] (Beijing Rising Technology Co., Ltd.)(18, 0, 0, 3)
[PID: 1116][C:\WINDOWS\system32\spoolsv.exe] (Microsoft Corporation)(5.1.2600.0 (XPClient.010817-1148))
[PID: 1300][C:\WINDOWS\Explorer.EXE] (Microsoft Corporation)(6.00.2800.1106 (xpsp1.020828-1920))
[PID: 1396][C:\Program Files\rising\Rav\RavStub.exe] (Beijing Rising Technology Co., Ltd.)(18, 0, 0, 16)
[C:\Program Files\rising\Rav\RsCommX.dll] (rising)(18, 0, 0, 1)
[C:\Program Files\rising\Rav\RSCOMMON.DLL] (Beijing Rising Technology Co., Ltd.)(18, 0, 0, 4)
[PID: 1532][C:\WINDOWS\System32\alg.exe] (Microsoft Corporation)(5.1.2600.1106 (xpsp1.020828-1920))
[C:\WINDOWS\System32\qlpxdrv.dll] (qeeloo.com)(1, 0, 0, 1)
[d:\Program Files\Filseclab\xfilter\XFILTER.DLL] (Filseclab Corporation)(3, 0, 0, 3644)
[PID: 1584][C:\WINDOWS\System32\nvsvc32.exe] (NVIDIA Corporation)(6.14.10.5216)
[PID: 1608][C:\WINDOWS\System32\svchost.exe] (Microsoft Corporation)(5.1.2600.0 (xpclient.010817-1148))
[PID: 732][C:\Program Files\rising\Rav\RavTask.exe] (Beijing Rising Technology Co., Ltd.)(18, 0, 0, 22)
[C:\Program Files\rising\Rav\RSCOMMON.DLL] (Beijing Rising Technology Co., Ltd.)(18, 0, 0, 4)
[C:\Program Files\rising\Rav\RSAPPMGR.DLL] (Beijing Rising Technology Co., Ltd.)(18, 0, 0, 2)
[C:\Program Files\rising\Rav\CfgDll.dll] (Beijing Rising Technology Co., Ltd.)(18, 0, 0, 10)
[C:\Program Files\rising\Rav\RsCommX.dll] (rising)(18, 0, 0, 1)
[PID: 632][C:\WINDOWS\SOUNDMAN.EXE] (Realtek Semiconductor Corp.)(5.1.0.30)
[PID: 784][C:\Program Files\rising\Rav\Ravmon.exe] (Beijing Rising Technology Co., Ltd.)(18, 0, 1, 28)
[C:\Program Files\rising\Rav\RsGuiLib.dll] (Beijing Rising Technology Co., Ltd.)(18, 0, 0, 24)
[C:\Program Files\rising\Rav\BWList.dll] (Beijing Rising Technology Co., Ltd.)(18, 0, 0, 19)
[C:\Program Files\rising\Rav\RSAPPMGR.DLL] (Beijing Rising Technology Co., Ltd.)(18, 0, 0, 2)
[C:\Program Files\rising\Rav\CfgDll.dll] (Beijing Rising Technology Co., Ltd.)(18, 0, 0, 10)
[C:\Program Files\rising\Rav\RSCOMMON.DLL] (Beijing Rising Technology Co., Ltd.)(18, 0, 0, 4)
[C:\Program Files\rising\Rav\RsCommX.dll] (rising)(18, 0, 0, 1)
[C:\Program Files\rising\Rav\PngDll.dll] (Beijing Rising Technology Co., Ltd.)(18, 0, 0, 5)
[PID: 876][D:\Program Files\Filseclab\xfilter\xfilter.exe] (费尔安全实验室)(3.0)
[d:\Program Files\Filseclab\xfilter\XFILTER.DLL] (Filseclab Corporation)(3, 0, 0, 3644)
[PID: 884][C:\WINDOWS\System32\ctfmon.exe] (Microsoft Corporation)(5.1.2600.1106 (xpsp1.020828-1920))
[PID: 1068][C:\Program Files\Common Files\Filseclab\FilMsg.exe] (费尔安全实验室)(3, 1, 0, 927)
[PID: 988][F:\WOW\World of Warcraft\Launcher.exe] (The9 Limited)(1.2.1.33)
[C:\WINDOWS\System32\qlpxdrv.dll] (qeeloo.com)(1, 0, 0, 1)
[d:\Program Files\Filseclab\xfilter\XFILTER.DLL] (Filseclab Corporation)(3, 0, 0, 3644)
[PID: 1748][F:\WOW\World of Warcraft\wow.exe] (Blizzard Entertainment)(1, 11, 1, 5462)
[F:\WOW\World of Warcraft\DivxDecoder.dll] (N/A)(N/A)
[F:\WOW\World of Warcraft\fmod.dll] (Firelight Technologies Pty, Ltd)(3.74)
[C:\WINDOWS\System32\qlpxdrv.dll] (qeeloo.com)(1, 0, 0, 1)
[d:\Program Files\Filseclab\xfilter\XFILTER.DLL] (Filseclab Corporation)(3, 0, 0, 3644)
[C:\WINDOWS\System32\KIme.ime] (金山软件公司)(1, 0, 0, 1)
[PID: 164][F:\WOW\World of Warcraft\BackgroundDownloader.exe] (Blizzard Entertainment)(1, 6, 2, 72)
[C:\WINDOWS\System32\qlpxdrv.dll] (qeeloo.com)(1, 0, 0, 1)
[d:\Program Files\Filseclab\xfilter\XFILTER.DLL] (Filseclab Corporation)(3, 0, 0, 3644)
[PID: 1628][C:\Program Files\Internet Explorer\iexplore.exe] (Microsoft Corporation)(6.00.2800.1106 (xpsp1.020828-1920))
[D:\Program Files\Super Rabbit\MagicSet\haokanbar.dll] (Xiang Feng Technology)(2, 1, 0, 1463)
[C:\WINDOWS\System32\qlpxdrv.dll] (qeeloo.com)(1, 0, 0, 1)
[d:\Program Files\Filseclab\xfilter\XFILTER.DLL] (Filseclab Corporation)(3, 0, 0, 3644)
[C:\WINDOWS\System32\Macromed\Flash\Flash8.ocx] (Macromedia, Inc.)(8,0,22,0)
[PID: 2484][C:\Program Files\Internet Explorer\iexplore.exe] (Microsoft Corporation)(6.00.2800.1106 (xpsp1.020828-1920))
[D:\Program Files\Super Rabbit\MagicSet\haokanbar.dll] (Xiang Feng Technology)(2, 1, 0, 1463)
[C:\WINDOWS\System32\qlpxdrv.dll] (qeeloo.com)(1, 0, 0, 1)
[d:\Program Files\Filseclab\xfilter\XFILTER.DLL] (Filseclab Corporation)(3, 0, 0, 3644)
[PID: 2644][C:\Documents and Settings\Owner\桌面\SREng2\SREng.exe] (Smallfrogs Studio)(2.0.21.505)
[C:\WINDOWS\System32\qlpxdrv.dll] (qeeloo.com)(1, 0, 0, 1)
[d:\Program Files\Filseclab\xfilter\XFILTER.DLL] (Filseclab Corporation)(3, 0, 0, 3644)
[C:\Documents and Settings\Owner\桌面\SREng2\Plugins\SREngPluginDemo.SRE] (Smallfrogs Studio)(1, 1, 1, 0)

文件关联

.TXT OK. [%SystemRoot%\system32\NOTEPAD.EXE %1]
.EXE OK. ["%1" %*]
.COM OK. ["%1" %*]
.PIF OK. ["%1" %*]
.REG OK. [regedit.exe "%1"]
.BAT OK. ["%1" %*]
.SCR OK. ["%1" /S]
.CHM OK. ["C:\WINDOWS\hh.exe" %1]
.HLP Error. [C:\WINDOWS\System32\mshta.exe "%1" %*]
.INI OK. [%SystemRoot%\system32\NOTEPAD.EXE %1]
.INF OK. [%SystemRoot%\system32\NOTEPAD.EXE %1]
.VBS Error. []
.JS Error. []
.LNK OK. [{00021401-0000-0000-C000-000000000046}]



--------------------------------------------------------------------------------


Winsock 提供者



--------------------------------------------------------------------------------

[C:\WINDOWS\system32\qlpxdrv.dll] (qeeloo.com)(1, 0, 0, 1)
这项怎么给他弄没来？

这项我也想知道，如果你知道，就告诉我吧
日志看不出问题
运行(双击)System Repair Engineer，使用“系统修复，文件关联，勾选“全选”点“修复”使所有扩展名都恢复正常。

这向是奇乐网的游戏代理程序卸了之后的尾巴不知道咋弄掉。。我当时以为卸干净了现在居然发现还个尾巴