2007-03-26,01:02:57
System Repair Engineer 2.4.12.806
Smallfrogs (http://www.KZTechs.com)
Windows 2000 Professional Service Pack 4 (Build 2195) - 管理权限用户 - 完整功能
启动项目
注册表
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
<Internat.exe><internat.exe> [(Verified)Microsoft Windows 2000 Publisher]
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run]
<tx><C:\SysTx2\svchost.exe> []
<4><C:\SysWsj6\svchost.exe> []
<333><C:\Syswm1h\svchost.exe> []
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
<Synchronization Manager><mobsync.exe /logon> [(Verified)Microsoft Windows 2000 Publisher]
<C-Media Mixer><Mixer.exe /startup> [(Verified)Microsoft Windows Hardware Compatibility Publisher]
<Zone Labs Client><"d:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"> [(Verified)"Zone Labs, Inc"]
<nod32kui><"C:\Program Files\Eset\nod32kui.exe" /WAITSERVICE> [Eset ]
<CreativeMixer><C:\Program Files\Creative\Audio2K\PROGRAM\CTMIX32.EXE /t> [Creative Technology Ltd.]
<IMSCMIG40W><C:\PROGRA~1\COMMON~1\MICROS~1\IME\IMSC40W\IMSCMIG.EXE /SetPreload /Log> [Microsoft Corporation]
<QuickTime Task><; "D:\Program Files\QuickTime\qttask.exe" -atboottime> [Apple Computer, Inc.]
<TkBellExe><; "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot> [RealNetworks, Inc.]
<360Safetray><D:\Program Files\360safe\safemon\360Tray.exe /start> [奇虎网]
<upxdnd><C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\zz.exe> []
<mppds><C:\WINNT\mppds.exe> []
<wsttrs><C:\WINNT\wsttrs.exe> []
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
<shell><Explorer.exe> [(Verified)Microsoft Windows 2000 Publisher]
<Userinit><C:\WINNT\system32\userinit.exe,> [(Verified)Microsoft Windows 2000 Publisher]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
<{A6011F8F-A7F8-49AA-9ADA-49127D43138F}><C:\Program Files\Common Files\Microsoft Shared\MSINFO\NewInfo.rxk> []
<{A771A1EC-975E-4718-AF5E-A3F552D45C41}><C:\WINNT\system32\msipri.dll> []
<{E25C29AB-12B9-4523-A53C-324B5FBA648C}><c:\program files\eset\ufuycnqb.dll> []
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellService
ObjectDelayLoad]
<DLMon><C:\WINNT\system32\DLMain.dll> [N/A]
==================================
启动文件夹
N/A
==================================
服务
[Logical Disk Manager Administrative Service / dmadmin][Stopped/Manual Start]
<C:\WINNT\System32\dmadmin.exe /com><VERITAS Software Corp.>
[NOD32 Kernel Service / NOD32krn][Running/Auto Start]
<"C:\Program Files\Eset\nod32krn.exe"><Eset>
[NVIDIA Display Driver Service / NVSvc][Stopped/Manual Start]
<C:\WINNT\System32\nvsvc32.exe><NVIDIA Corporation>
[TrueVector Internet Monitor / vsmon][Running/Auto Start]
<C:\WINNT\system32\ZONELABS\vsmon.exe -service><Zone Labs Inc.>
[Portable Media Serial Number Service / WmdmPmSN][Stopped/Manual Start]
<C:\WINNT\System32\svchost.exe -k netsvcs-->C:\WINNT\system32\mspmsnsv.dll><Microsoft Corporation>
==================================
驱动程序
[AMON / AMON][Running/Auto Start]
<\??\C:\WINNT\system32\drivers\amon.sys><Eset>
[C-Media PCI Audio Driver (WDM) / cmpci][Stopped/Manual Start]
<system32\drivers\cmaudio.sys><C-Media Inc>
[d347bus / d347bus][Running/Boot Start]
<\SystemRoot\system32\DRIVERS\d347bus.sys><>
[d347prt / d347prt][Running/Boot Start]
<\SystemRoot\System32\Drivers\d347prt.sys><>
[D-Link DFE-530TX PCI Fast Ethernet Adapter / DLKFET][Running/Manual Start]
<System32\DRIVERS\DLKFET.sys><D-Link>
[dmboot / dmboot][Stopped/Disabled]
<System32\drivers\dmboot.sys><VERITAS Software Corp.>
[Logical Disk Manager Driver / dmio][Running/Boot Start]
<\SystemRoot\System32\drivers\dmio.sys><VERITAS Software Corp.>
[dmload / dmload][Running/Boot Start]
<\SystemRoot\System32\drivers\dmload.sys><VERITAS Software Corp.>
[EagleNT / EagleNT][Stopped/Manual Start]
<\??\C:\WINNT\system32\drivers\EagleNT.sys><N/A>
[Creative SB AudioPCI Audio Driver (WDM) / ev19x8mp][Running/Manual Start]
<system32\drivers\ev19x8mp.sys><Creative Technology Ltd.>
[F-SECURE AVP / F-SECURE AVP][Stopped/Manual Start]
<\??\d:\Program Files\AntiViral Toolkit Pro\FSAVP.SYS><Kaspersky Labs.>
[F-SECURE Filter / F-SECURE Filter][Stopped/Manual Start]
<\??\d:\Program Files\AntiViral Toolkit Pro\FSFILTER.SYS><F-Secure Corporation>
[F-SECURE Gatekeeper / F-SECURE Gatekeeper][Stopped/Manual Start]
<\??\d:\Program Files\AntiViral Toolkit Pro\FSGK.SYS><F-Secure Corporation>
[F-SECURE Recognizer / F-SECURE Recognizer][Stopped/Manual Start]
<\??\d:\Program Files\AntiViral Toolkit Pro\FSREC.SYS><F-Secure Corporation>
[Nokia USB Generic / Nokia USB Generic][Stopped/Manual Start]
<system32\drivers\nmwcdc.sys><Nokia>
[Nokia USB Modem / Nokia USB Modem][Stopped/Manual Start]
<system32\drivers\nmwcdcm.sys><Nokia>
[Nokia USB Phone Parent / Nokia USB Phone Parent][Stopped/Manual Start]
<system32\drivers\nmwcd.sys><Nokia>
[Netgroup Packet Filter / NPF][Stopped/Manual Start]
<\??\C:\WINNT\system32\drivers\npf.sys><Politecnico di Torino>
[npkcrypt / npkcrypt][Running/Auto Start]
<\??\D:\Program Files\Tencent\qq\npkcrypt.sys><INCA Internet Co., Ltd.>
[NTSIM / NTSIM][Stopped/Manual Start]
<\??\C:\WINNT\System32\ntsim.sys><Fast Ethernet Adapter Manufacturer>
[nv / nv][Running/Manual Start]
<System32\DRIVERS\nv4_mini.sys><NVIDIA Corporation>
[PfModNT / PfModNT][Running/Auto Start]
<\??\C:\WINNT\system32\PfModNT.sys><Creative Technology Ltd.>
[Direct Parallel Link Driver / Ptilink][Running/Manual Start]
<System32\DRIVERS\ptilink.sys><Parallel Technologies, Inc.>
[WAN 微型端口 (PPP over Ethernet 协议) / RMSPPPOE][Running/Manual Start]
<system32\DRIVERS\RMSPPPOE.SYS><Robert Schlabbach>
[SecDrv / SecDrv][Running/Auto Start]
<\??\C:\WINNT\system32\drivers\SECDRV.SYS><Macrovision Corporation, Macrovision Europe Limited, and Macrovision Japan and Asia K.K.>
[VIA AC'97 Audio Controller (WDM) / VIAudio][Running/Manual Start]
<system32\drivers\viaudio.sys><VIA Technologies, Inc.>
[VNICPKT5 Protocol Driver / VNICPKT5][Stopped/Manual Start]
<\??\C:\WINNT\System32\VNICPKT5.SYS><N/A>
[vsdatant / vsdatant][Running/System Start]
<System32\vsdatant.sys><Zone Labs Inc.>
[World Standard Teletext Codec / WSTCODEC][Stopped/Manual Start]
<system32\DRIVERS\WSTCODEC.SYS><Microsoft Corporation>
[154151 / 154151][Running/]
<2 - 系统找不到指定的文件。
><N/A>
==================================
浏览器加载项
==================================
正在运行的进程
[PID: 164][\SystemRoot\System32\smss.exe] [Microsoft Corporation, 5.00.2195.6601]
[PID: 188][\??\C:\WINNT\system32\csrss.exe] [Microsoft Corporation, 5.00.2195.6601]
[PID: 208][\??\C:\WINNT\system32\winlogon.exe] [Microsoft Corporation, 5.00.2195.6898]
[C:\WINNT\system32\wdmaud.drv] [Microsoft Corporation, 5.00.2195.6673]
[C:\WINNT\system32\msacm32.drv] [Microsoft Corporation, 5.00.2134.1]
[c:\program files\eset\rwbkwprs.dll] [N/A, ]
[c:\program files\eset\ufuycnqb.dll] [N/A, ]
[PID: 760][C:\WINNT\system32\taskmgr.exe] [Microsoft Corporation, 5.00.2195.6620]
[C:\Program Files\Common Files\Microsoft Shared\MSINFO\NewInfo.rxk] [N/A, ]
[C:\WINNT\system32\msipri.dll] [N/A, ]
[C:\Syswm1h\Ghook.dll] [N/A, ]
[C:\SysWsj6\Ghook.dll] [N/A, ]
[PID: 348][C:\WINNT\explorer.exe] [Microsoft Corporation, 5.00.3700.6690]
[C:\WINNT\AppPatch\AcLayers.DLL] [Microsoft Corporation, 5.00.2195.6717]
[C:\Program Files\Common Files\Microsoft Shared\MSINFO\NewInfo.rxk] [N/A, ]
[C:\WINNT\system32\msipri.dll] [N/A, ]
[c:\program files\eset\rwbkwprs.dll] [N/A, ]
[D:\Program Files\WinRAR\rarext.dll] [N/A, ]
[C:\Program Files\Eset\nodshex.dll] [Eset , 2, 50, 45 ]
[C:\Program Files\Eset\pr_nod32.dll] [Eset , 2, 50, 45 ]
[C:\Program Files\Eset\pu_nod32.dll] [Eset , 2, 50, 45 ]
[d:\Program Files\AntiViral Toolkit Pro\avpshlex.dll] [N/A, ]
[d:\Program Files\360safe\safemon\safemon.dll] [, 3, 2, 0, 1001]
[C:\WINNT\system32\wdmaud.drv] [Microsoft Corporation, 5.00.2195.6673]
[C:\WINNT\system32\msacm32.drv] [Microsoft Corporation, 5.00.2134.1]
[C:\WINNT\system32\msadp32.acm] [Microsoft Corporation, 5.00.2134.1]
[d:\Program Files\UltraEdit\ue32ctmn.dll] [, 1.0]
[C:\WINNT\system32\imon.dll] [Eset , 2, 50, 45 ]
[C:\Program Files\Eset\pr_imon.dll] [N/A, ]
[C:\Syswm1h\Ghook.dll] [N/A, ]
[C:\SysWsj6\Ghook.dll] [N/A, ]
[C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\upxdnd.dll] [N/A, ]
[C:\WINNT\system32\mppds.dll] [N/A, ]
[C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\LgSy0.dll] [N/A, ]
[c:\program files\eset\ufuycnqb.dll] [N/A, ]
[PID: 968][C:\Program Files\Eset\nod32kui.exe] [Eset , 2, 50, 45 ]
[C:\Program Files\Eset\nod32rui.dll] [N/A, ]
[C:\Program Files\Eset\pu_amon.dll] [Eset , 2, 50, 45 ]
[C:\Program Files\Eset\pr_amon.dll] [Eset , 2, 50, 45 ]
[C:\Program Files\Eset\pu_dmon.dll] [Eset , 2, 50, 45 ]
[C:\Program Files\Eset\pr_dmon.dll] [N/A, ]
[C:\Program Files\Eset\pu_emon.dll] [Eset , 2, 50, 45 ]
[C:\Program Files\Eset\pr_emon.dll] [N/A, ]
[C:\Program Files\Eset\pu_imon.dll] [Eset , 2, 50, 45 ]
[C:\Program Files\Eset\pr_imon.dll] [N/A, ]
[C:\Program Files\Eset\pu_nod32.dll] [Eset , 2, 50, 45 ]
[C:\Program Files\Eset\pr_nod32.dll] [Eset , 2, 50, 45 ]
[C:\Program Files\Eset\pu_upd.dll] [Eset , 2, 50, 45 ]
[C:\Program Files\Eset\pr_upd.dll] [N/A, ]
[C:\Syswm1h\Ghook.dll] [N/A, ]
[C:\SysWsj6\Ghook.dll] [N/A, ]
[PID: 468][D:\Program Files\360safe\safemon\360Tray.exe] [奇虎网, 3, 2, 0, 1001]
[D:\Program Files\360safe\safemon\safemon.dll] [, 3, 2, 0, 1001]
[D:\Program Files\360safe\safemon\SafeKrnl.dll] [奇虎网, 3, 2, 0, 1001]
[D:\Program Files\360safe\AntiAdwa.dll] [360Safe.com, 3, 2, 0, 1001]
[C:\Syswm1h\Ghook.dll] [N/A, ]
[C:\SysWsj6\Ghook.dll] [N/A, ]
[C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\LgSy0.dll] [N/A, ]
[PID: 1048][C:\Syswm1h\svchost.exe] [N/A, ]
[C:\Syswm1h\Ghook.dll] [N/A, ]
[PID: 1116][C:\SysWsj6\svchost.exe] [N/A, ]
[C:\SysWsj6\Ghook.dll] [N/A, ]
[PID: 1172][C:\WINNT\system32\conime.exe] [Microsoft Corporation, 5.00.2195.6655]
[D:\Program Files\360safe\safemon\safemon.dll] [, 3, 2, 0, 1001]
[C:\SysWsj6\Ghook.dll] [N/A, ]
[C:\Syswm1h\Ghook.dll] [N/A, ]
[PID: 284][C:\WINNT\wsttrs.exe] [N/A, ]
[C:\WINNT\system32\wdmaud.drv] [Microsoft Corporation, 5.00.2195.6673]
[C:\WINNT\system32\wsttrs.dll] [N/A, ]
[PID: 1220][I:\tool\SREng\SREng.EXE] [Smallfrogs Studio, 2.4.12.806]
[D:\Program Files\360safe\safemon\safemon.dll] [, 3, 2, 0, 1001]
[C:\SysWsj6\Ghook.dll] [N/A, ]
[C:\Syswm1h\Ghook.dll] [N/A, ]
[C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\LgSy0.dll] [N/A, ]
[C:\WINNT\system32\imon.dll] [Eset , 2, 50, 45 ]
[C:\Program Files\Eset\pr_imon.dll] [N/A, ]
==================================
API HOOK
入口点错误：CreateProcessA (危险等级: 一般, 被下面模块所HOOK: D:\Program Files\360safe\safemon\safemon.dll)
入口点错误：CreateProcessW (危险等级: 一般, 被下面模块所HOOK: D:\Program Files\360safe\safemon\safemon.dll)
