[CODE] 2008-07-18,12:50:54 System Repair Engineer 2.6.11.992 Smallfrogs (http://www.KZTechs.com) Windows XP Home Edition (Build 2600) - 管理权限用户 - 完整功能 以下内容被选中： 所有的启动项目（包括注册表、启动文件夹、服务等） 浏览器加载项 正在运行的进程（包括进程模块信息） 文件关联 Winsock 提供者 Autorun.inf HOSTS 文件 进程特权扫描 启动项目 注册表 [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run] [(Verified)Microsoft Windows XP Publisher] [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run] [(Verified)Microsoft Windows Hardware Compatibility Publisher] <"C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot> [RealNetworks, Inc.] [(Verified)Beijing Jiangmin New Sci.&Tec. Co. Ltd.] <"d:\Program Files\Rising\AntiSpyware\rstray.exe" /startup> [(Verified)BEIJING RISING SCIENCE AND TECHNOLOGY CORPORATION LIMITED] [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunOnce] [(Verified)BEIJING RISING SCIENCE AND TECHNOLOGY CORPORATION LIMITED] [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon] [(Verified)Microsoft Windows XP Publisher] [(Verified)Microsoft Windows XP Publisher] [(Verified)Microsoft Windows XP Publisher] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{2C7339CF-2B09-4501-B3F3-F3508C9228ED}] <%SystemRoot%\system32\regsvr32.exe /s /n /i:/UserInstall %SystemRoot%\system32\themeui.dll> [File is missing] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{44BBA840-CC51-11CF-AAFA-00AA00B6015C}] <"%ProgramFiles%\Outlook Express\setup50.exe" /APP:OE /CALLER:WINNT /user /install> [File is missing] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{44BBA842-CC51-11CF-AAFA-00AA00B6015B}] [(Verified)Microsoft Windows XP Publisher] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{5945c046-1e7d-11d1-bc44-00c04fd912be}] [(Verified)Microsoft Windows XP Publisher] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{6BF52A52-394A-11d3-B153-00C04F79FAA6}] [] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{7790769C-0471-11d2-AF11-00C04FA35D02}]
<"%ProgramFiles%\Outlook Express\setup50.exe" /APP:WAB /CALLER:WINNT /user /install> [File is missing] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{9EF0045A-CDD9-438e-95E6-02B9AFEC8E11}] <%SystemRoot%\System32\updcrl.exe -e -u %SystemRoot%\System32\verisignpub1.crl> [File is missing] ================================== 启动文件夹 [Adobe Gamma Loader] C:\PROGRA~1\COMMON~1\Adobe\CALIBR~1\ADOBEG~1.EXE [Adobe Systems, Inc.]> ================================== 服务 [Application Management / AppMgmt][Stopped/Manual Start] %SystemRoot%\System32\appmgmts.dll> [KVSrvXP / KVSrvXP][Running/Auto Start] [MSSQL$CXDY3 / MSSQL$CXDY3][Running/Auto Start] [MSSQLServerADHelper / MSSQLServerADHelper][Stopped/Manual Start] [SQLAgent$CXDY3 / SQLAgent$CXDY3][Stopped/Manual Start] [Portable Media Serial Number Service / WmdmPmSN][Stopped/Manual Start] C:\WINDOWS\System32\mspmsnsv.dll> ================================== 驱动程序 [Service for Realtek AC97 Audio (WDM) / ALCXWDM][Running/Manual Start] [Rising TDI Base Driver / BaseTDI][Running/Auto Start] [Broadcom 440x 10/100 Integrated Controller XP Driver / bcm4sbxp][Stopped/Manual Start] [BsDeamon / BsDeamon][Running/System Start] <\??\C:\Program Files\Jiangmin\AntiVirus\BsDeamon.sys> [Creative SBLive! Gameport / ctljystk][Stopped/Manual Start] [EagleNT / EagleNT][Stopped/Manual Start] <\??\C:\WINDOWS\System32\drivers\EagleNT.sys> [Creative SB Live! (WDM) / emu10k][Stopped/Manual Start] [ialm / ialm][Running/Manual Start] [KAVBootC / KAVBootC][Running/Boot Start] <\SystemRoot\System32\Drivers\KAVBootC.sys> [KAVSafe / KAVSafe][Running/Auto Start] <\??\C:\WINDOWS\System32\Drivers\KAVSafe.sys> [KRegEx / KRegEx][Running/Auto Start] <\??\C:\Program Files\Jiangmin\antivirus\KRegEx.sys> [Jiangmin Antivirus Software - SysCall Services / KSysCall][Running/System Start] <\??\C:\Program Files\Jiangmin\common\KSysCall.sys> [Jiangmin Antivirus Software - System Monitor / KSysMon][Running/System Start] <\??\C:\Program Files\Jiangmin\AntiVirus\KSysMon.sys> [Jiangmin Antivirus Software - File Tracer / KSysTrace][Running/System Start] <\??\C:\Program Files\Jiangmin\AntiVirus\KSysTrace.sys> [KVFileGuard From Jiangmin / KVFileGuard][Running/Manual Start] <\??\C:\Program Files\Jiangmin\AntiVirus\KVfg.sys> [KVRedir From Jiangmin / KVRedir][Running/System Start] <\??\C:\Program Files\Jiangmin\AntiVirus\KVREDIR.SYS> [802.11b USB Wireless Lan Network Adapter / m4301a][Stopped/Manual Start] [GeneLink Network Driver / Ndisusb][Stopped/Manual Start] [npkcrypt / npkcrypt][Running/Auto Start] <\??\C:\Program Files\Tencent\QQ\npkcrypt.sys> [nv4 / nv4][Stopped/Manual Start] [Direct Parallel Link Driver / Ptilink][Running/Manual Start] [QKeyServiceDisplay / QKeyService][Running/Boot Start] <\SystemRoot\System32\KeyCrypt.sys> [Realtek RTL8139(A/B/C)-based PCI Fast Ethernet Adapter NT Driver / rtl8139][Running/Manual Start] [Secdrv / Secdrv][Stopped/Manual Start] [SENSE4 v2.0 / sense4v2][Running/Manual Start] [Creative SoundFont Manager Driver (WDM) / sfman][Stopped/Manual Start] [Jiangmin AntiVirus Software - System Guard / SysGuard][Running/Boot Start] <\SystemRoot\System32\Drivers\SysGuard.sys> [TesSafe / TesSafe][Stopped/Manual Start] <\??\E:\Program Files\Tencent\QQ飞车\Releasephysx27\TesSafe.sys> [TQANTISYS / TQANTISYS][Running/Auto Start] <\??\C:\WINDOWS\System32\drivers\TQANTISYS.SYS><天晴数码娱乐公司> [GeneLink File Transfer Driver / USBHSB][Stopped/Disabled] [Intel(R) Graphics Platform (SoftBIOS) Driver / {6080A529-897E-4629-A488-ABA0C29B635E}][Running/System Start] [Intel(R) Graphics Chipset (KCH) Driver / {D31A0762-0CEB-444e-ACFF-B049A1F6FE91}][Running/Manual Start] ================================== 浏览器加载项 [QQCycloneHelper Class] {00000000-12C9-4305-82F9-43058F20E8D2} [BrowseHelper Class] {80BF4637-D65B-43F3-BB60-C5DD3D5FB7B9} [卡卡上网安全助手] {98B7C13A-E9CD-4959-8B46-FBEAB41E42A8} [SafeMon Class] {B69F34DD-F0F9-42DC-9EDD-957187DA688D} [kingsoft browser shield] {D963BE1A-6B35-47DB-B002-49FAE71D85CC} [RegisterHelper Class] {FF354A24-B490-4D4F-8EEC-B3ACD6E681A4} [IEBuddyExtControl Class] {3AECD3C1-7085-4731-96DC-47B6CF7EF749} [信息检索(&R)] {92780B25-18CC-41C8-B9BE-3C9C571A8263} [@shdoclc.dll,-866] {c95fe080-8f5d-11d2-a20b-00aa003c157a} <, N/A> [电台(&R)] {8E718888-423F-11D2-876E-00A0C9082467} [Symantec RuFSI Utility Class] {644E432F-49D3-41A1-8DD5-E099162EEEC5} [Shockwave Flash Object] {D27CDB6E-AE6D-11CF-96B8-444553540000} [XMP Class] {6483F145-A768-4C41-AACC-52D4D7845851} [XDRM] {693571CB-54A3-4E90-9D52-EEAE1334E2D3} [BrowseHelper Class] {80BF4637-D65B-43F3-BB60-C5DD3D5FB7B9} [360SafeLive] {87515F61-A66C-4319-A0E0-D416CB8059E3} [RMGetLicense Class] {A9FC132B-096D-460B-B7D5-1DB0FAE0C062} [江民杀毒工具栏] {B5A34A93-D538-43A7-8371-864CB6148D12} [XPPlayer Class] {F3E70CEA-956E-49CC-B444-73AFE593AD7F} [&使用超级旋风下载] [&使用超级旋风下载全部链接] [Easy-WebPrint打印] [Easy-WebPrint添加到打印列表] [Easy-WebPrint预览] [Easy-WebPrint高速打印] [导出到 Microsoft Office Excel(&X)] [收藏到QQ书签] [检查此下载链接是否安全] [添加到QQ表情] ================================== 正在运行的进程 [PID: 464 / SYSTEM][\SystemRoot\System32\smss.exe] [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)] [PID: 528 / SYSTEM][\??\C:\WINDOWS\system32\csrss.exe] [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)] [PID: 560 / SYSTEM][\??\C:\WINDOWS\system32\winlogon.exe] [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)] [C:\WINDOWS\system32\wdmaud.drv] [Microsoft Corporation, 5.1.2600.0 (XPClient.010817-1148)] [C:\WINDOWS\system32\msacm32.drv] [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)] [PID: 608 / SYSTEM][C:\WINDOWS\system32\services.exe] [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)] [PID: 620 / SYSTEM][C:\WINDOWS\system32\lsass.exe] [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)] [PID: 800 / SYSTEM][C:\WINDOWS\system32\svchost.exe] [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)] [PID: 864 / SYSTEM][C:\WINDOWS\System32\svchost.exe] [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)] [PID: 920 / SYSTEM][C:\WINDOWS\System32\conime.exe] [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)] [PID: 1140 / NETWORK SERVICE][C:\WINDOWS\System32\svchost.exe] [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)] [PID: 1332 / winXP][C:\WINDOWS\Explorer.EXE] [Microsoft Corporation, 6.00.2600.0000 (xpclient.010817-1148)] [C:\Program Files\Jiangmin\AntiVirus\KsPec.dll] [Jiangmin Co., Ltd., 1, 0, 8, 317] [C:\Program Files\Jiangmin\common\KvTrust.dll] [Jiangmin Co., Ltd., 10, 0, 8, 326] [C:\Program Files\Jiangmin\common\KvTools.dll] [Jiangmin Co., Ltd., 2, 0, 7, 1224] [C:\WINDOWS\System32\HiveBase.dll] [Jiangmin Co., Ltd., 1, 0, 7, 717] [C:\WINDOWS\System32\kvinstall.dll] [Jiangmin Co.,Ltd, 2, 0, 7, 831] [C:\Program Files\Jiangmin\common\KvTrustInit.dll] [Jiangmin Co., Ltd., 11, 0, 8, 327] [C:\WINDOWS\System32\wdmaud.drv] [Microsoft Corporation, 5.1.2600.0 (XPClient.010817-1148)] [C:\WINDOWS\System32\msacm32.drv] [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)] [C:\Program Files\Jiangmin\AntiVirus\KVshell.dll] [Jiangmin Co.Ltd, 2, 0, 7, 1018] [C:\Program Files\Jiangmin\AntiVirus\lang\kvxp0804.lng] [N/A, ] [C:\WINDOWS\System32\igfxpph.dll] [Intel Corporation, 3,0,0,1847] [C:\WINDOWS\System32\hccutils.DLL] [Intel Corporation, 3,0,0,1847] [C:\WINDOWS\System32\igfxres.dll] [Intel Corporation, 3,0,0,1847] [C:\WINDOWS\System32\igfxsrvc.dll] [Intel Corporation, 3,0,0,1847] [C:\WINDOWS\System32\igfxdev.dll] [Intel Corporation, 3,0,0,1847] [C:\PROGRA~1\360safe\safemon\safemon.dll] [360.CN, 4, 1, 5, 1002] [C:\Program Files\Microsoft Office\OFFICE11\msohev.dll] [Microsoft Corporation, 11.0.5510] [PID: 1392 / SYSTEM][C:\WINDOWS\system32\spoolsv.exe] [Microsoft Corporation, 5.1.2600.0 (XPClient.010817-1148)] [C:\WINDOWS\system32\CNMLM6e.DLL] [CANON INC., 1.80.2.50] [C:\WINDOWS\system32\CNMLM3y.DLL] [CANON INC., 1.52.2.0] [C:\WINDOWS\system32\EBPMON24.DLL] [SEIKO EPSON CORPORATION, 5, 4, 0, 0] [C:\WINDOWS\system32\LMonhsfk.dll] [Hi-Touch Imaging Technologies, 3, 5, 13, 135] [C:\WINDOWS\system32\HPBMMON.DLL] [Hewlett-Packard, 10.00.16] [C:\WINDOWS\system32\hpdomon.dll] [Hewlett-Packard, 03.42.00] [C:\WINDOWS\system32\HPBHealr.dll] [N/A, ] [C:\WINDOWS\system32\mdimon.dll] [Microsoft Corporation, 11.3.1897.0] [C:\WINDOWS\System32\spool\PRTPROCS\W32X86\CNMPD6e.DLL] [CANON INC., 1.80.2.50] [C:\WINDOWS\System32\spool\PRTPROCS\W32X86\CNMPD3y.DLL] [CANON INC., 1.52.2.0] [C:\WINDOWS\System32\spool\PRTPROCS\W32X86\HPPRN05.DLL] [Hewlett-Packard Corporation, 60.05.17.02] [C:\WINDOWS\System32\spool\PRTPROCS\W32X86\mdippr.dll] [Microsoft Corporation, 11.3.1897.0] [PID: 1468 / LOCAL SERVICE][C:\WINDOWS\System32\svchost.exe] [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)] [PID: 1584 / SYSTEM][C:\Program Files\Microsoft SQL Server\MSSQL$CXDY3\Binn\sqlservr.exe] [Microsoft Corporation, 2000.080.0760.00] [C:\Program Files\Microsoft SQL Server\MSSQL$CXDY3\Binn\OPENDS60.DLL] [Microsoft Corporation, 2000.080.0194.00] [C:\Program Files\Microsoft SQL Server\MSSQL$CXDY3\Binn\UMS.DLL] [Microsoft Corporation, 2000.080.0760.00] [C:\Program Files\Microsoft SQL Server\MSSQL$CXDY3\Binn\SQLSORT.DLL] [Microsoft Corporation, 2000.080.0760.00] [C:\Program Files\Microsoft SQL Server\MSSQL$CXDY3\Binn\Resources\2052\sqlevn70.RLL] [Microsoft Corporation, 2000.080.0760.00] [C:\Program Files\Microsoft SQL Server\MSSQL$CXDY3\Binn\SSNETLIB.dll] [Microsoft Corporation, 2000.080.0766.00] [C:\Program Files\Microsoft SQL Server\MSSQL$CXDY3\Binn\SSNMPN70.dll] [Microsoft Corporation, 2000.080.0534.00] [C:\Program Files\Microsoft SQL Server\MSSQL$CXDY3\Binn\SSmsLPCn.dll] [Microsoft Corporation, 2000.080.0760.00] [PID: 1980 / SYSTEM][C:\WINDOWS\System32\svchost.exe] [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)] [PID: 508 / winXP][C:\WINDOWS\System32\hkcmd.exe] [Intel Corporation, 3,0,0,1847] [C:\WINDOWS\System32\hccutils.DLL] [Intel Corporation, 3,0,0,1847] [C:\WINDOWS\System32\igfxdev.dll] [Intel Corporation, 3,0,0,1847] [C:\WINDOWS\System32\igfxsrvc.dll] [Intel Corporation, 3,0,0,1847] [C:\WINDOWS\System32\igfxhk.dll] [Intel Corporation, 3,0,0,1847] [C:\WINDOWS\System32\igfxres.dll] [Intel Corporation, 3,0,0,1847] [PID: 316 / winXP][D:\Program Files\Rising\AntiSpyware\rstray.exe] [Beijing Rising Technology Co., Ltd., 21.0.0.14] [D:\Program Files\Rising\AntiSpyware\rsmginfo.dll] [Beijing Rising Technology Co., Ltd., 21, 0, 0, 5] [D:\Program Files\Rising\AntiSpyware\RsXML.dll] [Beijing Rising Technology Co., Ltd., 20, 0, 0, 0] [D:\Program Files\Rising\AntiSpyware\MSVCP71.dll] [Microsoft Corporation, 7.10.3077.0] [D:\Program Files\Rising\AntiSpyware\MSVCR71.dll] [Microsoft Corporation, 7.10.3052.4] [D:\Program Files\Rising\AntiSpyware\ComServ.dll] [Beijing Rising Technology Co., Ltd., 21.0.0.29] [D:\Program Files\Rising\AntiSpyware\Syslay.dll] [Beijing Rising Technology Co., Ltd., 21.0.0.4] [D:\Program Files\Rising\AntiSpyware\rscommon.dll] [Beijing Rising Technology Co., Ltd., 20.0.1.0] [D:\Program Files\Rising\AntiSpyware\comx3.dll] [Beijing Rising Technology Co., Ltd., 21.0.0.20] [D:\Program Files\Rising\AntiSpyware\pngdll.dll] [Beijing Rising Technology Co., Ltd., 20, 0, 0, 4] [D:\Program Files\Rising\AntiSpyware\runiep.dll] [Beijing Rising Technology Co., Ltd., 6.0.0.30] [PID: 532 / winXP][C:\WINDOWS\System32\ctfmon.exe] [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)] [PID: 1632 / winXP][D:\Program Files\Rising\AntiSpyware\knownsvr.exe] [Beijing Rising Technology Co., Ltd., 6.0.0.10] [D:\Program Files\Rising\AntiSpyware\NComm.dll] [Beijing Rising Technology Co., Ltd., 6.0.0.5] [D:\Program Files\Rising\AntiSpyware\comx3.dll] [Beijing Rising Technology Co., Ltd., 21.0.0.20] [D:\Program Files\Rising\AntiSpyware\Syslay.dll] [Beijing Rising Technology Co., Ltd., 21.0.0.4] [PID: 3792 / winXP][D:\Program Files\TTPlayer\TTPlayer.exe] [Alen Soft, 5, 2, 1, 0] [D:\Program Files\TTPlayer\ttpcomm.dll] [N/A, ] [D:\Program Files\TTPlayer\ttpres.dll] [Alen Soft, 5, 2, 1, 0] [D:\Program Files\TTPlayer\msdmo.dll] [Microsoft Corporation, 6.03.01.0400] [C:\WINDOWS\System32\wdmaud.drv] [Microsoft Corporation, 5.1.2600.0 (XPClient.010817-1148)] [C:\WINDOWS\System32\msacm32.drv] [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)] [D:\Program Files\TTPlayer\AddIn\ttp_asf.dll] [N/A, ] [PID: 4016 / winXP][D:\Downloads\Rav\sreng2\SREngLdr.EXE] [Smallfrogs Studio, 2.6.11.992] [PID: 4036 / winXP][D:\Downloads\Rav\sreng2\SRE30243fe5.EXE] [Smallfrogs Studio, 2.6.11.992] [D:\Downloads\Rav\sreng2\Upload\3rdUpd.DLL] [Smallfrogs Studio, 2, 1, 0, 15] ================================== 文件关联 .TXT Error. [C:\WINDOWS\notepad.exe %1] .EXE OK. ["%1" %*] .COM OK. ["%1" %*] .PIF OK. ["%1" %*] .REG OK. [regedit.exe "%1"] .BAT OK. ["%1" %*] .SCR OK. ["%1" /S] .CHM Error. ["hh.exe" %1] .HLP OK. [%SystemRoot%\system32\winhlp32.exe %1] .INI Error. [C:\WINDOWS\System32\NOTEPAD.EXE %1] .INF OK. [%SystemRoot%\system32\NOTEPAD.EXE %1] .VBS OK. [%SystemRoot%\System32\WScript.exe "%1" %*] .JS OK. [%SystemRoot%\System32\WScript.exe "%1" %*] .LNK OK. [{00021401-0000-0000-C000-000000000046}] ================================== Winsock 提供者 N/A ================================== Autorun.inf N/A ================================== HOSTS 文件 N/A ================================== 进程特权扫描 特殊特权被允许： SeLoadDriverPrivilege [PID = 560, C:\WINDOWS\SYSTEM32\WINLOGON.EXE] 特殊特权被允许： SeLoadDriverPrivilege [PID = 3792, D:\PROGRAM FILES\TTPLAYER\TTPLAYER.EXE] 特殊特权被允许： SeLoadDriverPrivilege [PID = 4016, D:\DOWNLOADS\RAV\SRENG2\SRENGLDR.EXE] ================================== API HOOK N/A ================================== 隐藏进程 N/A ================================== [/CODE]