2007-03-18,03:02:35
System Repair Engineer 2.4.12.806
Smallfrogs (http://www.KZTechs.com)
Windows Server 2003 Enterprise Edition Service Pack 1 (Build 3790) - 管理权限用户 - 完整功能
以下内容被选中：
所有的启动项目（包括注册表、启动文件夹、服务等）
浏览器加载项
正在运行的进程（包括进程模块信息）
文件关联
Winsock 提供者
Autorun.inf
HOSTS 文件
启动项目
注册表
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
(ctfmon.exe)(C:\WINDOWS\system32\ctfmon.exe) [(Verified)Microsoft Windows Publisher]
[HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows]
(load)() [N/A]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
(IMJPMIG8.1)("C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32) [(Verified)Microsoft Windows Publisher]
(IMEKRMIG6.1)(C:\WINDOWS\ime\imkr6_1\IMEKRMIG.EXE) [(Verified)Microsoft Windows Publisher]
(PHIME2002ASync)(C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC) [(Verified)Microsoft Windows Publisher]
(PHIME2002A)(C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName) [(Verified)Microsoft Windows Publisher]
(SunJavaUpdateSched)(C:\Program Files\Java\j2re1.4.2_04\bin\jusched.exe) []
(RavTask)("C:\Program Files\Rising\Rav\RavTask.exe" -system) [Beijing Rising Technology Co., Ltd.]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
(shell)(Explorer.exe) [(Verified)Microsoft Windows Publisher]
(Userinit)(C:\WINDOWS\system32\userinit.exe,) [(Verified)Microsoft Windows Publisher]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Windows]
(AppInit_DLLs)() [N/A]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
(UIHost)(%SystemRoot%\system32\logonui.exe) [(Verified)Microsoft Windows Publisher]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
({32CD708B-60A7-4C00-9377-D73EAA495F0F})(C:\WINDOWS\system32\RavExt.dll) [Beijing Rising Technology Co., Ltd.]
--------------------------------------------------------------------------------
启动文件夹
N/A
--------------------------------------------------------------------------------
服务
[3Com BOOTP / 3ComBOOTP][Stopped/Manual Start]
(C:\Program Files\Venturcom\BXP\3CBOOTPS.EXE)(3Com Corporation)
[3Com PXE / 3ComPXE][Running/Auto Start]
(C:\Program Files\Venturcom\BXP\3CPXES.EXE)(3Com Corporation)
[BXP Adaptive Boot Server / BNAbs][Running/Auto Start]
(C:\Program Files\Venturcom\BXP\BNAbs.exe)(N/A)
[BXP Write Cache I/O Server / BNWcIos][Running/Auto Start]
(C:\Program Files\Venturcom\BXP\BNWcIos.exe)(N/A)
[BXP Managed Disk Server / BxpDiskCopy][Running/Auto Start]
(C:\Program Files\Venturcom\BXP\BxpDiskCopy.exe)()
[BXP TFTP Service / BXPTFTP][Running/Auto Start]
(C:\Program Files\Venturcom\BXP\BXPTFTP.exe)(Venturcom Inc.)
[Human Interface Device Access / HidServ][Stopped/Disabled]
(C:\WINDOWS\System32\svchost.exe -k netsvcs--)%SystemRoot%\System32\hidserv.dll)(N/A)
[Promise Array Message Agent / RAIDmAgt][Running/Auto Start]
(C:\Program Files\Promise Technology, Inc.\Promise Array Management\MsgAgt.exe)(Promise Technology, Inc.)
[Rising Process Communication Center / RsCCenter][Running/Auto Start]
("C:\Program Files\Rising\Rav\CCenter.exe")(Beijing Rising Technology Co., Ltd.)
[RsRavMon Service / RsRavMon][Running/Auto Start]
("C:\Program Files\Rising\Rav\Ravmond.exe")(Beijing Rising Technology Co., Ltd.)
[BXP IO Service / VLDIOS][Running/Auto Start]
(C:\Program Files\Venturcom\BXP\VLDIOS.EXE)(Venturcom or its subsidiaries.)
[BXP Login Service / VLDLOG][Running/Auto Start]
(C:\Program Files\Venturcom\BXP\VLDLS.EXE)(Venturcom Corporation or its subsidiaries.)
--------------------------------------------------------------------------------
驱动程序
[ati2mpad / ati2mpad][Running/Manual Start]
(system32\DRIVERS\ati2mpad.sys)(ATI Technologies Inc.)
[BaseTDI / BaseTDI][Running/Auto Start]
(\??\C:\WINDOWS\system32\drivers\basetdi.sys)(Beijing Rising Technology Co., Ltd.)
[Promise driver accelerator / bb-run][Running/Boot Start]
(\SystemRoot\system32\DRIVERS\bb-run.sys)(Promise Technology, Inc.)
[BXP TDI Interface Driver / BNITdi][Running/System Start]
(system32\DRIVERS\bnitdi.sys)(VenturCom, Inc.)
[BXP SCSI Miniport Driver / BNSM][Running/System Start]
(system32\DRIVERS\bnsm.sys)(N/A)
[BXP SCSI Miniport Disk Filter Driver / BNSMDF][Running/Boot Start]
(\SystemRoot\system32\DRIVERS\bnsmdf.sys)(VenturCom, Inc.)
[Intel(R) PRO/1000 Network Connection Driver / E1000][Running/Manual Start]
(system32\DRIVERS\e1000325.sys)(Intel Corporation)
[ExpScaner / ExpScaner][Running/Auto Start]
(\??\C:\Program Files\Rising\Rav\ExpScan.sys)()
[fttxr54P / fttxr54P][Running/Boot Start]
(\SystemRoot\system32\DRIVERS\fttxr54P.sys)(Promise Technology, Inc.)
[HookCont / HookCont][Running/Auto Start]
(\??\C:\Program Files\Rising\Rav\HOOKCONT.sys)(Rising tech Co. ltd)
[HookReg / HookReg][Running/Auto Start]
(\??\C:\Program Files\Rising\Rav\HookReg.sys)()
[HookSys / HookSys][Running/Auto Start]
(\??\C:\Program Files\Rising\Rav\HookSys.sys)(Rising)
[IP in IP Tunnel Driver / IpInIp][Stopped/Manual Start]
(system32\DRIVERS\ipinip.sys)(N/A)
[MEMSCAN / MEMSCAN][Running/Auto Start]
(\??\C:\Program Files\Rising\Rav\MEMSCAN.sys)(瑞星软件有限公司)
[Direct Parallel Link Driver / Ptilink][Running/Manual Start]
(system32\DRIVERS\ptilink.sys)(Parallel Technologies, Inc.)
[Secdrv / Secdrv][Stopped/Manual Start]
(system32\DRIVERS\secdrv.sys)(Macrovision Corporation, Macrovision Europe Limited, and Macrovision Japan and Asia K.K.)
[Intel (R) System Management BIOS Service / SMBios][Running/Manual Start]
(system32\DRIVERS\SMBios.sys)(Intel Corporation)
[NDIS5.1 Miniport Driver for Marvell Yukon Ethernet Controller / yukonwxp][Stopped/Manual Start]
(system32\DRIVERS\yk51x86.sys)(Marvell)
--------------------------------------------------------------------------------
浏览器加载项
[Java Plug-in 1.4.2_04]
{8AD9C840-044E-11D1-B3E9-00805F499D93} (C:\Program Files\Java\j2re1.4.2_04\bin\npjpi142_04.dll, JavaSoft / Sun Microsystems, Inc.)
[Java Plug-in 1.4.2_04]
{CAFEEFAC-0014-0002-0004-ABCDEFFEDCBA} (C:\Program Files\Java\j2re1.4.2_04\bin\npjpi142_04.dll, JavaSoft / Sun Microsystems, Inc.)
[XML DOM Document]
{2933BF90-7B36-11D2-B20E-00C04F983E60} (C:\WINDOWS\system32\msxml3.dll, Microsoft Corporation)
--------------------------------------------------------------------------------
正在运行的进程
[PID: 440][\SystemRoot\System32\smss.exe] [Microsoft Corporation, 5.2.3790.1830 (srv03_sp1_rtm.050324-1447)]
[PID: 512][\??\C:\WINDOWS\system32\csrss.exe] [Microsoft Corporation, 5.2.3790.0 (srv03_rtm.030324-2048)]
[PID: 144][C:\WINDOWS\Explorer.EXE] [Microsoft Corporation, 6.00.3790.1830 (srv03_sp1_rtm.050324-1447)]
[C:\WINDOWS\system32\RavExt.dll] [Beijing Rising Technology Co., Ltd., 18, 0, 0, 21]
[C:\Program Files\Rising\Rav\RSCOMMON.DLL] [Beijing Rising Technology Co., Ltd., 18, 0, 0, 4]
[PID: 1112][C:\Program Files\Java\j2re1.4.2_04\bin\jusched.exe] [N/A, ]
[PID: 1116][C:\Program Files\Rising\Rav\RavTask.exe] [Beijing Rising Technology Co., Ltd., 18, 0, 0, 22]
[C:\Program Files\Rising\Rav\RSCOMMON.DLL] [Beijing Rising Technology Co., Ltd., 18, 0, 0, 4]
[C:\Program Files\Rising\Rav\RSAPPMGR.DLL] [Beijing Rising Technology Co., Ltd., 18, 0, 0, 2]
[C:\Program Files\Rising\Rav\CfgDll.dll] [Beijing Rising Technology Co., Ltd., 18, 0, 0, 11]
[C:\Program Files\Rising\Rav\RsCommX.dll] [rising, 18, 0, 0, 1]
[PID: 1144][C:\WINDOWS\system32\ctfmon.exe] [Microsoft Corporation, 5.2.3790.1830 (srv03_sp1_rtm.050324-1447)]
[PID: 1200][C:\Program Files\Rising\Rav\Ravmon.exe] [Beijing Rising Technology Co., Ltd., 18, 0, 1, 33]
[C:\Program Files\Rising\Rav\RsGuiLib.dll] [Beijing Rising Technology Co., Ltd., 18, 0, 0, 25]
[C:\Program Files\Rising\Rav\BWList.dll] [Beijing Rising Technology Co., Ltd., 18, 0, 0, 19]
[C:\Program Files\Rising\Rav\RSAPPMGR.DLL] [Beijing Rising Technology Co., Ltd., 18, 0, 0, 2]
[C:\Program Files\Rising\Rav\CfgDll.dll] [Beijing Rising Technology Co., Ltd., 18, 0, 0, 11]
[C:\Program Files\Rising\Rav\RSCOMMON.DLL] [Beijing Rising Technology Co., Ltd., 18, 0, 0, 4]
[C:\Program Files\Rising\Rav\RsCommX.dll] [rising, 18, 0, 0, 1]
[C:\Program Files\Rising\Rav\PngDll.dll] [Beijing Rising Technology Co., Ltd., 18, 0, 0, 5]
[PID: 956][Z:\资料\SREng.EXE] [Smallfrogs Studio, 2.4.12.806]
--------------------------------------------------------------------------------
文件关联
.TXT OK. [%SystemRoot%\system32\NOTEPAD.EXE %1]
.EXE OK. ["%1" %*]
.COM OK. ["%1" %*]
.PIF OK. ["%1" %*]
.REG OK. [regedit.exe "%1"]
.BAT OK. ["%1" %*]
.SCR OK. ["%1" /S]
.CHM OK. ["C:\WINDOWS\hh.exe" %1]
.HLP OK. [%SystemRoot%\System32\winhlp32.exe %1]
.INI OK. [%SystemRoot%\System32\NOTEPAD.EXE %1]
.INF OK. [%SystemRoot%\System32\NOTEPAD.EXE %1]
.VBS OK. [%SystemRoot%\System32\WScript.exe "%1" %*]
.JS OK. [%SystemRoot%\System32\WScript.exe "%1" %*]
.LNK OK. [{00021401-0000-0000-C000-000000000046}]
--------------------------------------------------------------------------------
Winsock 提供者
N/A
--------------------------------------------------------------------------------
Autorun.inf
N/A
--------------------------------------------------------------------------------
HOSTS 文件
127.0.0.1 localhost
--------------------------------------------------------------------------------
API HOOK
N/A
--------------------------------------------------------------------------------
隐藏进程
N/A
--------------------------------------------------------------------------------
上面是用那个，SREng 软件扫描出来的。 时间也有。但不知道缺什么.
每次都会中病毒的. 这次不知道是中了什么病毒.用瑞星2007杀毒.竟然米杀出来什么来.
懂得人.都该知道.这台电脑是拿来做什么用的了。不用我多讲吧.
就望高手.能指点一下,我对病毒,跟系统进程方面那是一窍不通.
可以给藕发email:wangzhenbaby0216@163.com QQ:349166539
非常感谢.米有什么好表达的.只有心中默默的感激!~
