[CODE] 2008-08-06,17:31:19 System Repair Engineer 2.6.11.992 Smallfrogs (http://www.KZTechs.com) Windows XP Home Edition (Build 2600) - 管理权限用户 - 完整功能 以下内容被选中： 所有的启动项目（包括注册表、启动文件夹、服务等） 浏览器加载项 正在运行的进程（包括进程模块信息） 文件关联 Winsock 提供者 Autorun.inf HOSTS 文件 进程特权扫描 启动项目 注册表 [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run] [(Verified)Microsoft Windows XP Publisher] [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run] [(Verified)Microsoft Windows Hardware Compatibility Publisher] <"C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot> [RealNetworks, Inc.] <"C:\Program Files\Jiangmin\AntiVirus\KVMonXP.kxp"> [(Verified)Beijing Jiangmin New Sci.&Tec. Co. Ltd.] [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon] [(Verified)Microsoft Windows XP Publisher] [(Verified)Microsoft Windows XP Publisher] [(Verified)Microsoft Windows XP Publisher] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{2C7339CF-2B09-4501-B3F3-F3508C9228ED}] <%SystemRoot%\system32\regsvr32.exe /s /n /i:/UserInstall %SystemRoot%\system32\themeui.dll> [File is missing] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{44BBA840-CC51-11CF-AAFA-00AA00B6015C}] <"%ProgramFiles%\Outlook Express\setup50.exe" /APP:OE /CALLER:WINNT /user /install> [File is missing] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{44BBA842-CC51-11CF-AAFA-00AA00B6015B}] [(Verified)Microsoft Windows XP Publisher] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{5945c046-1e7d-11d1-bc44-00c04fd912be}] [(Verified)Microsoft Windows XP Publisher] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{6BF52A52-394A-11d3-B153-00C04F79FAA6}] [] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{7790769C-0471-11d2-AF11-00C04FA35D02}] <通讯簿 6><"%ProgramFiles%\Outlook Express\setup50.exe" /APP:WAB /CALLER:WINNT /user /install> [File is missing] ================================== 启动文件夹 [Adobe Gamma Loader] C:\PROGRA~1\COMMON~1\Adobe\CALIBR~1\ADOBEG~1.EXE [Adobe Systems, Inc.]> ================================== 服务 [Application Management / AppMgmt][Stopped/Manual Start] %SystemRoot%\System32\appmgmts.dll> [KVSrvXP / KVSrvXP][Running/Auto Start] [MSSQL$CXDY3 / MSSQL$CXDY3][Running/Auto Start] [MSSQLServerADHelper / MSSQLServerADHelper][Stopped/Manual Start] [SQLAgent$CXDY3 / SQLAgent$CXDY3][Stopped/Manual Start] [Portable Media Serial Number Service / WmdmPmSN][Stopped/Manual Start] C:\WINDOWS\System32\mspmsnsv.dll> ================================== 驱动程序 [Service for Realtek AC97 Audio (WDM) / ALCXWDM][Running/Manual Start] [Broadcom 440x 10/100 Integrated Controller XP Driver / bcm4sbxp][Stopped/Manual Start] [BsDeamon / BsDeamon][Running/System Start] <\??\C:\Program Files\Jiangmin\AntiVirus\BsDeamon.sys> [Creative SBLive! Gameport / ctljystk][Stopped/Manual Start] [Creative SB Live! (WDM) / emu10k][Stopped/Manual Start] [Creative Interface Manager Driver (WDM) / emu10k1][Stopped/Manual Start] [ExpScaner / ExpScaner][Stopped/Auto Start] <\??\C:\Program Files\Rising\Rav\ExpScan.sys> [HookCont / HookCont][Stopped/Auto Start] <\??\C:\Program Files\Rising\Rav\HOOKCONT.sys> [HookReg / HookReg][Stopped/Auto Start] <\??\C:\Program Files\Rising\Rav\HookReg.sys> [HookSys / HookSys][Stopped/Auto Start] <\??\C:\Program Files\Rising\Rav\HookSys.sys> [ialm / ialm][Running/Manual Start] [KRegEx / KRegEx][Running/Auto Start] <\??\C:\Program Files\Jiangmin\antivirus\KRegEx.sys> [Jiangmin Antivirus Software - SysCall Services / KSysCall][Running/System Start] <\??\C:\Program Files\Jiangmin\common\KSysCall.sys> [Jiangmin Antivirus Software - System Monitor / KSysMon][Running/System Start] <\??\C:\Program Files\Jiangmin\AntiVirus\KSysMon.sys> [Jiangmin Antivirus Software - File Tracer / KSysTrace][Running/System Start] <\??\C:\Program Files\Jiangmin\AntiVirus\KSysTrace.sys> [KVFileGuard From Jiangmin / KVFileGuard][Running/Manual Start] <\??\C:\Program Files\Jiangmin\AntiVirus\KVfg.sys> [KVRedir From Jiangmin / KVRedir][Running/System Start] <\??\C:\Program Files\Jiangmin\AntiVirus\KVREDIR.SYS> [802.11b USB Wireless Lan Network Adapter / m4301a][Stopped/Manual Start] [MEMSCAN / MEMSCAN][Stopped/Auto Start] <\??\C:\Program Files\Rising\Rav\MEMSCAN.sys> [GeneLink Network Driver / Ndisusb][Stopped/Manual Start] [npkcrypt / npkcrypt][Running/Auto Start] <\??\C:\Program Files\Tencent\QQ\npkcrypt.sys> [nv4 / nv4][Stopped/Manual Start] [Direct Parallel Link Driver / Ptilink][Running/Manual Start] [Realtek RTL8139(A/B/C)-based PCI Fast Ethernet Adapter NT Driver / rtl8139][Running/Manual Start] [Secdrv / Secdrv][Stopped/Manual Start] [SENSE4 v2.0 / sense4v2][Running/Manual Start] [Creative SoundFont Manager Driver (WDM) / sfman][Stopped/Manual Start] [Jiangmin AntiVirus Software - System Guard / SysGuard][Running/Boot Start] <\SystemRoot\System32\Drivers\SysGuard.sys> [GeneLink File Transfer Driver / USBHSB][Stopped/Auto Start] [Intel(R) Graphics Platform (SoftBIOS) Driver / {6080A529-897E-4629-A488-ABA0C29B635E}][Running/System Start] [Intel(R) Graphics Chipset (KCH) Driver / {D31A0762-0CEB-444e-ACFF-B049A1F6FE91}][Running/Manual Start] ================================== 浏览器加载项 [BrowseHelper Class] {80BF4637-D65B-43F3-BB60-C5DD3D5FB7B9} [RegisterHelper Class] {FF354A24-B490-4D4F-8EEC-B3ACD6E681A4} [信息检索(&R)] {92780B25-18CC-41C8-B9BE-3C9C571A8263} [@shdoclc.dll,-866] {c95fe080-8f5d-11d2-a20b-00aa003c157a} <, N/A> [QQ] {c95fe080-8f5d-11d2-a20b-00aa003c157b} [QQIEFloatBarCfgCmd Class] {DEDEB80D-FA35-45d9-9460-4983E5A8AFE6} [电台(&R)] {8E718888-423F-11D2-876E-00A0C9082467} [江民杀毒工具栏] {B5A34A93-D538-43A7-8371-864CB6148D12} [&使用超级旋风下载] [&使用超级旋风下载全部链接] [上传到QQ网络硬盘] [导出到 Microsoft Office Excel(&X)] [添加到QQ自定义面板] [添加到QQ表情] [用QQ彩信发送该图片] [豪杰超级解霸V8实时播放] ================================== 正在运行的进程 [PID: 456 / SYSTEM][\SystemRoot\System32\smss.exe] [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)] [PID: 524 / SYSTEM][\??\C:\WINDOWS\system32\csrss.exe] [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)] [PID: 548 / SYSTEM][\??\C:\WINDOWS\system32\winlogon.exe] [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)] [C:\WINDOWS\system32\wdmaud.drv] [Microsoft Corporation, 5.1.2600.0 (XPClient.010817-1148)] [C:\WINDOWS\system32\msacm32.drv] [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)] [PID: 596 / SYSTEM][C:\WINDOWS\system32\services.exe] [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)] [PID: 608 / SYSTEM][C:\WINDOWS\system32\lsass.exe] [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)] [PID: 784 / SYSTEM][C:\WINDOWS\system32\svchost.exe] [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)] [PID: 852 / SYSTEM][C:\WINDOWS\System32\svchost.exe] [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)] [PID: 1072 / NETWORK SERVICE][C:\WINDOWS\System32\svchost.exe] [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)] [PID: 1248 / winXP][C:\WINDOWS\Explorer.EXE] [Microsoft Corporation, 6.00.2600.0000 (xpclient.010817-1148)] [C:\Program Files\Jiangmin\AntiVirus\KsPec.dll] [Jiangmin Co., Ltd., 1, 0, 8, 317] [C:\Program Files\Jiangmin\common\KvTrust.dll] [Jiangmin Co., Ltd., 10, 0, 8, 326] [C:\Program Files\Jiangmin\common\KvTools.dll] [Jiangmin Co., Ltd., 2, 0, 7, 1224] [C:\WINDOWS\System32\HiveBase.dll] [Jiangmin Co., Ltd., 1, 0, 7, 717] [C:\WINDOWS\System32\kvinstall.dll] [Jiangmin Co.,Ltd, 2, 0, 7, 831] [C:\Program Files\Jiangmin\common\KvTrustInit.dll] [Jiangmin Co., Ltd., 11, 0, 8, 327] [C:\WINDOWS\System32\wdmaud.drv] [Microsoft Corporation, 5.1.2600.0 (XPClient.010817-1148)] [C:\WINDOWS\System32\msacm32.drv] [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)] [C:\Program Files\Jiangmin\AntiVirus\KVshell.dll] [Jiangmin Co.Ltd, 2, 0, 7, 1018] [C:\Program Files\Jiangmin\AntiVirus\lang\kvxp0804.lng] [N/A, ] [C:\WINDOWS\System32\igfxpph.dll] [Intel Corporation, 3,0,0,1847] [C:\WINDOWS\System32\hccutils.DLL] [Intel Corporation, 3,0,0,1847] [C:\WINDOWS\System32\igfxres.dll] [Intel Corporation, 3,0,0,1847] [C:\WINDOWS\System32\igfxsrvc.dll] [Intel Corporation, 3,0,0,1847] [C:\WINDOWS\System32\igfxdev.dll] [Intel Corporation, 3,0,0,1847] [C:\Program Files\Microsoft Office\OFFICE11\msohev.dll] [Microsoft Corporation, 11.0.5510] [PID: 1284 / SYSTEM][C:\WINDOWS\system32\spoolsv.exe] [Microsoft Corporation, 5.1.2600.0 (XPClient.010817-1148)] [C:\WINDOWS\system32\CNMLM6e.DLL] [CANON INC., 1.80.2.50] [C:\WINDOWS\system32\CNMLM3y.DLL] [CANON INC., 1.52.2.0] [C:\WINDOWS\system32\EBPMON24.DLL] [SEIKO EPSON CORPORATION, 5, 4, 0, 0] [C:\WINDOWS\system32\LMonhsfk.dll] [Hi-Touch Imaging Technologies, 3, 5, 13, 135] [C:\WINDOWS\system32\HPBMMON.DLL] [Hewlett-Packard, 10.00.16] [C:\WINDOWS\system32\hpdomon.dll] [Hewlett-Packard, 03.42.00] [C:\WINDOWS\system32\HPBHealr.dll] [N/A, ] [C:\WINDOWS\system32\mdimon.dll] [Microsoft Corporation, 11.3.1897.0] [C:\WINDOWS\System32\spool\PRTPROCS\W32X86\CNMPD6e.DLL] [CANON INC., 1.80.2.50] [C:\WINDOWS\System32\spool\PRTPROCS\W32X86\CNMPD3y.DLL] [CANON INC., 1.52.2.0] [C:\WINDOWS\System32\spool\PRTPROCS\W32X86\HPPRN05.DLL] [Hewlett-Packard Corporation, 60.05.17.02] [C:\WINDOWS\System32\spool\PRTPROCS\W32X86\mdippr.dll] [Microsoft Corporation, 11.3.1897.0] [PID: 1392 / LOCAL SERVICE][C:\WINDOWS\System32\svchost.exe] [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)] [PID: 1412 / SYSTEM][C:\WINDOWS\System32\conime.exe] [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)] [PID: 1540 / winXP][C:\WINDOWS\System32\hkcmd.exe] [Intel Corporation, 3,0,0,1847] [C:\WINDOWS\System32\hccutils.DLL] [Intel Corporation, 3,0,0,1847] [C:\WINDOWS\System32\igfxdev.dll] [Intel Corporation, 3,0,0,1847] [C:\WINDOWS\System32\igfxsrvc.dll] [Intel Corporation, 3,0,0,1847] [C:\WINDOWS\System32\igfxhk.dll] [Intel Corporation, 3,0,0,1847] [C:\WINDOWS\System32\igfxres.dll] [Intel Corporation, 3,0,0,1847] [PID: 1548 / winXP][C:\Program Files\Common Files\Real\Update_OB\realsched.exe] [RealNetworks, Inc., 0.1.0.3018] [PID: 1564 / winXP][C:\WINDOWS\System32\ctfmon.exe] [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)] [PID: 1928 / SYSTEM][C:\Program Files\Microsoft SQL Server\MSSQL$CXDY3\Binn\sqlservr.exe] [Microsoft Corporation, 2000.080.0760.00] [C:\Program Files\Microsoft SQL Server\MSSQL$CXDY3\Binn\OPENDS60.DLL] [Microsoft Corporation, 2000.080.0194.00] [C:\Program Files\Microsoft SQL Server\MSSQL$CXDY3\Binn\UMS.DLL] [Microsoft Corporation, 2000.080.0760.00] [C:\Program Files\Microsoft SQL Server\MSSQL$CXDY3\Binn\SQLSORT.DLL] [Microsoft Corporation, 2000.080.0760.00] [C:\Program Files\Microsoft SQL Server\MSSQL$CXDY3\Binn\Resources\2052\sqlevn70.RLL] [Microsoft Corporation, 2000.080.0760.00] [C:\Program Files\Microsoft SQL Server\MSSQL$CXDY3\Binn\SSNETLIB.dll] [Microsoft Corporation, 2000.080.0766.00] [C:\Program Files\Microsoft SQL Server\MSSQL$CXDY3\Binn\SSNMPN70.dll] [Microsoft Corporation, 2000.080.0534.00] [C:\Program Files\Microsoft SQL Server\MSSQL$CXDY3\Binn\SSmsLPCn.dll] [Microsoft Corporation, 2000.080.0760.00] [PID: 1968 / SYSTEM][C:\WINDOWS\System32\svchost.exe] [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)] [PID: 1100 / winXP][D:\Program Files\Maxthon2\Maxthon.exe] [Maxthon International ltd., 2, 1, 2, 649] [D:\Program Files\Maxthon2\mxpp.dll] [Maxthon International ltd., 1, 0, 0, 117] [D:\Program Files\Maxthon2\MxSk.dll] [Maxthon, 1, 0, 0, 358] [D:\Program Files\Maxthon2\MxProxy2.dll] [Maxthon International ltd., 1, 0, 0, 4033] [D:\Program Files\Maxthon2\MxExt.dll] [N/A, ] [D:\Program Files\Maxthon2\MxUI.dll] [Maxthon International, 3, 3, 0, 3] [D:\Program Files\Maxthon2\mxtool.dll] [, 1, 0, 0, 1] [D:\Program Files\Maxthon2\maxzlib.dll] [, 1.2.3] [D:\Program Files\Maxthon2\Modules\MxPageSearch\MxPageSearch.dll] [Maxthon International ltd., 1,0,0,1330] [D:\Program Files\Maxthon2\Modules\MxWebBoost\MxWebBoost.dll] [Maxthon, 1,0,2,1259] [D:\Program Files\Maxthon2\mxdb.dll] [Max, 3, 5, 3, 125] [D:\Program Files\Maxthon2\Modules\MxHistory\MxHistory.dll] [Maxthon International ltd., 1, 0, 0, 7] [C:\WINDOWS\System32\WINWB86.IME] [Microsoft Corporation, 4.00.950] [C:\WINDOWS\System32\wdmaud.drv] [Microsoft Corporation, 5.1.2600.0 (XPClient.010817-1148)] [C:\WINDOWS\System32\msacm32.drv] [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)] [PID: 684 / winXP][D:\Downloads\Rav\sreng2\SREngLdr.EXE] [Smallfrogs Studio, 2.6.11.992] [PID: 212 / winXP][D:\Downloads\Rav\sreng2\SRE30243fe5.EXE] [Smallfrogs Studio, 2.6.11.992] [D:\Downloads\Rav\sreng2\Upload\3rdUpd.DLL] [Smallfrogs Studio, 2, 1, 0, 15] [C:\PROGRA~1\MICROS~2\OFFICE11\MCPS.DLL] [Microsoft Corporation, 11.0.5510] ================================== 文件关联 .TXT OK. [%SystemRoot%\system32\NOTEPAD.EXE %1] .EXE OK. ["%1" %*] .COM OK. ["%1" %*] .PIF OK. ["%1" %*] .REG OK. [regedit.exe "%1"] .BAT OK. ["%1" %*] .SCR OK. ["%1" /S] .CHM OK. ["C:\WINDOWS\hh.exe" %1] .HLP OK. [%SystemRoot%\System32\winhlp32.exe %1] .INI OK. [%SystemRoot%\System32\NOTEPAD.EXE %1] .INF OK. [%SystemRoot%\System32\NOTEPAD.EXE %1] .VBS OK. [%SystemRoot%\System32\WScript.exe "%1" %*] .JS OK. [%SystemRoot%\System32\WScript.exe "%1" %*] .LNK OK. [{00021401-0000-0000-C000-000000000046}] ================================== Winsock 提供者 N/A ================================== Autorun.inf N/A ================================== HOSTS 文件 127.0.0.1 localhost ================================== 进程特权扫描 特殊特权被允许： SeLoadDriverPrivilege [PID = 548, C:\WINDOWS\SYSTEM32\WINLOGON.EXE] 特殊特权被允许： SeLoadDriverPrivilege [PID = 1548, C:\PROGRAM FILES\COMMON FILES\REAL\UPDATE_OB\REALSCHED.EXE] 特殊特权被允许： SeLoadDriverPrivilege [PID = 684, D:\DOWNLOADS\RAV\SRENG2\SRENGLDR.EXE] ================================== API HOOK N/A ================================== 隐藏进程 N/A ================================== [/CODE]