[CODE]
2007-01-15,02:24:37
System Repair Engineer 2.3.13.690
Smallfrogs (http://www.KZTechs.com)
Windows XP Professional Service Pack 2 (Build 2600)
- 管理权限用户 - 完整功能
以下内容被选中：
所有的启动项目（包括注册表、启动文件夹、服务等）
浏览器加载项
正在运行的进程（包括进程模块信息）
文件关联
Winsock 提供者
Autorun.inf
HOSTS 文件
启动项目
注册表
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
<ctfmon.exe><C:\WINDOWS\system32\ctfmon.exe> [(Verified)Microsoft Corporation]
<svcshare><C:\WINDOWS\system32\drivers\spo0lsv.exe> [N/A]
[HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows]
<load><> [N/A]
<run><> [N/A]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
<50y><C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\alga.exe> [N/A]
<3tsfvmm6f><C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\iexpl0re.exe> [N/A]
<e4ds0x><C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\alga.exe> [N/A]
<mg1ziyhmi><C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\iexpl0re.exe> [N/A]
<qqdbc><C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\alga.exe> [N/A]
<fwqfiky7l7v7sd1><C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\iexpl0re.exe> [N/A]
<y6wu><C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\alga.exe> [N/A]
<5rjwzstkq350mu><C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\iexpl0re.exe> [N/A]
<q2itfy2g><C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\alga.exe> [N/A]
<mqct><C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\iexpl0re.exe> [N/A]
<k3wrxzb7c3ckl><C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\alga.exe> [N/A]
<xk2ghkgr0qs><C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\iexpl0re.exe> [N/A]
<ylf><C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\alga.exe> [N/A]
<hhjsgvi3ik><C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\iexpl0re.exe> [N/A]
<2uqcjfq5el34ele><C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\alga.exe> [N/A]
<yxiqz2><C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\iexpl0re.exe> [N/A]
<vgf><C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\alga.exe> [N/A]
<mxjtv6gcvxq><C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\iexpl0re.exe> [N/A]
<xwd><C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\alga.exe> [N/A]
<2i><C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\iexpl0re.exe> [N/A]
<m><C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\alga.exe> [N/A]
<y><C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\iexpl0re.exe> [N/A]
<d54><C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\alga.exe> [N/A]
<1><C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\iexpl0re.exe> [N/A]
<0qqlze5805><C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\alga.exe> [N/A]
<y64x64rb5fb4b><C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\iexpl0re.exe> [N/A]
<uicgd><C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\alga.exe> [N/A]
<9m39d85eskb><C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\iexpl0re.exe> [N/A]
<q26><C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\alga.exe> [N/A]
<y78bd><C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\iexpl0re.exe> [N/A]
<051wbclb6d><C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\alga.exe> [N/A]
<jlx1cm3hb6e><C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\iexpl0re.exe> [N/A]
<v2wqhkl48><C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\alga.exe> [N/A]
<hdz><C:\WINDOWS\iexpl0re.exe> [N/A]
<tjlildthd2zu30><C:\WINDOWS\alga.exe> [N/A]
<RavMonHelp><C:\WINDOWS\my.exe> [N/A]
<cmdbcs><C:\WINDOWS\rx.exe> [N/A]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
<shell><Explorer.exe> [(Verified)Microsoft Corporation]
<Userinit><c:\windows\system32\userinit.exe> [(Verified)Microsoft Corporation]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Windows]
<AppInit_DLLs><> [N/A]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
<UIHost><logonui.exe> [(Verified)Microsoft Corporation]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
<{32CD708B-60A7-4C00-9377-D73EAA495F0F}><C:\WINDOWS\system32\RavExt.dll> [Beijing Rising Technology Co., Ltd.]
==================================
启动文件夹
N/A
==================================
服务
[Adobe LM Service / Adobe LM Service][Stopped/Manual Start]
<"C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe"><N/A>
[Human Interface Device Access / HidServ][Stopped/Disabled]
<C:\WINDOWS\System32\svchost.exe -k netsvcs-->%SystemRoot%\System32\hidserv.dll><N/A>
[WinXP DHCP Service / WinXPDHCPsvc][Stopped/Auto Start]
<C:\WINDOWS\system32\\rundll32.exe xpdhcp.dll,start><Microsoft Corporation>
[Win32 Display Driver / Win32DDS][Stopped/Auto Start]
<C:\WINDOWS\system32\\rundll32.exe windds32.dll,start><Microsoft Corporation>
[Windows DHCP Service / WinDHCPsvc][Stopped/Auto Start]
<C:\WINDOWS\system32\\rundll32.exe windhcp.ocx,start><Microsoft Corporation>
[QQTM / QQTM][Stopped/Auto Start]
<C:\WINDOWS\qqtm.exe><N/A>
==================================
驱动程序
[Intel(r) 82801 Audio Driver Install Service (WDM) / ac97intc][Running/Manual Start]
<system32\drivers\ac97intc.sys><Intel Corporation>
[Rising TDI Base Driver / BaseTDI][Running/Auto Start]
<System32\DRIVERS\BaseTDI.SYS><Beijing Rising Technology Co., Ltd.>
[EagleNT / EagleNT][Stopped/Manual Start]
<\??\C:\WINDOWS\system32\drivers\EagleNT.sys><N/A>
[ExpScaner / ExpScaner][Running/Auto Start]
<\??\f:\Program Files\Rising\Rav\ExpScan.sys><>
[front / front][Stopped/System Start]
<system32\drivers\front.sys><N/A>
[HOOKAPI / HOOKAPI][Stopped/Manual Start]
<\??\F:\PROGRAM FILES\RISING\RAV\HookApi.Sys><瑞星软件有限公司>
[HookCont / HookCont][Running/Auto Start]
<\??\f:\Program Files\Rising\Rav\HOOKCONT.sys><Rising>
[HookReg / HookReg][Running/Auto Start]
<\??\f:\Program Files\Rising\Rav\HookReg.sys><>
[HookSys / HookSys][Running/Auto Start]
<\??\f:\Program Files\Rising\Rav\HookSys.sys><Rising>
[icehill / icehill][Stopped/System Start]
<system32\drivers\icehill.sys><N/A>
[MEMSCAN / MEMSCAN][Running/Auto Start]
<\??\f:\Program Files\Rising\Rav\MEMSCAN.sys><瑞星软件有限公司>
[npkycryp / npkycryp][Stopped/Manual Start]
<\??\F:\Program Files\Tencent\qq\npkycryp.sys><N/A>
[nv / nv][Running/Manual Start]
<system32\DRIVERS\nv4_mini.sys><NVIDIA Corporation>
[nVidia WDM Video Capture (universal) / nvcap][Stopped/Auto Start]
<system32\DRIVERS\nvcap.sys><N/A>
[qioiods / qioiods][Running/Boot Start]
<\SystemRoot\\SystemRoot\System32\drivers\qioiods.sys><N/A>
[roreg / roreg][Stopped/System Start]
<system32\drivers\roreg.sys><N/A>
[RsNTGDI / RsNTGDI][Running/Boot Start]
<\SystemRoot\system32\Drivers\RsNTGdi.sys><Beijing Rising Technology Co., Ltd.>
[RSPPSYS / RSPPSYS][Running/Auto Start]
<\??\f:\Program Files\Rising\Rav\RSPPSYS.sys><Rising>
[Realtek RTL8139(A/B/C)-based PCI Fast Ethernet Adapter NT Driver / rtl8139][Running/Manual Start]
<system32\DRIVERS\RTL8139.SYS><Realtek Semiconductor Corporation>
[Secdrv / Secdrv][Stopped/Manual Start]
<system32\DRIVERS\secdrv.sys><N/A>
[TCP/IP Protocol Driver / Tcpip][Running/System Start]
<system32\DRIVERS\tcpip.sys><Microsoft Corporation>
[World Standard Teletext Codec / WSTCODEC][Stopped/Manual Start]
<system32\DRIVERS\WSTCODEC.SYS><Microsoft Corporation>
