前几天用HIJACKTHIS发过日志，按照版主的方法，修复了023-NT服务的
DCMHELP.EXE,DISTFSV.EXE,DUMPREG.EXE，开始是好了，两三天后又出来 了，现在用SRENG发个
日志，请大家帮忙！
2006-01-11,20:58:47
System Repair Engineer 2.0.12.350 (2.0 RC 1)
Windows XP Professional Service Pack 1 - 管理权限用户 - 完整功能
以下内容被选中：
所有的启动项目（包括注册表、启动文件夹、服务等）
浏览器加载项
正在运行的进程（包括进程模块信息）
文件关联
启动项目
注册表
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
<ctfmon.exe><C:\WINDOWS.0\System32\ctfmon.exe>
[HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows]
<load><>
[HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows]
<run><>
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
<KuGoo3><; C:\Program Files\KuGoo3\KuGoo.exe>
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
<TkBellExe><; "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot>
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
<Super Rabbit SRRestore><C:\Program Files\Super Rabbit\MagicSet\srrest.exe /autosave>
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
<RavTimer><C:\PROGRA~1\RISING\RAV\RAVTIMER.EXE>
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
<RavMon><C:\PROGRA~1\RISING\RAV\RAVMON.EXE -SYSTEM>
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
<shell><Explorer.exe>
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
<Userinit><C:\WINDOWS.0\System32\Userinit.exe,>
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Windows]
<AppInit_DLLs><>
==================================
启动文件夹
服务
[Ati HotKey Poller / Ati HotKey Poller]
<C:\WINDOWS.0\System32\Ati2evxx.exe><ATI Technologies Inc.>
[C-DillaCdaC11BA / C-DillaCdaC11BA]
<C:\WINDOWS.0\System32\drivers\CDAC11BA.EXE><Macrovision>
[DcomHelper Service / DcomHelper]
<"C:\WINDOWS.0\dcmhelp.exe"><N/A>
[Distributed File System Services / Distfsv]
<C:\WINDOWS.0\System32\Distfsv.exe -service><N/A>
[Microsoft Registry Viewer / dumpreg]
<"C:\WINDOWS.0\dumpreg.exe"><N/A>
[LexBce Server / LexBceS]
<C:\WINDOWS.0\system32\LEXBCES.EXE><Lexmark International, Inc.>
[Rising Process Communication Center / RsCCenter]
<C:\PROGRAM FILES\RISING\RAV\CCENTER.EXE><rising>
[RsRavMon Service / RsRavMon]
<C:\PROGRAM FILES\RISING\RAV\Ravmond.exe><Beijing Rising Technology Co., Ltd.>
==================================
浏览器加载项
[bho Class]
{ED8DFC5C-10EF-45AB-9DC2-0639AFF5A270} <C:\PROGRA~1\COMMON~1\Wnwb\wnwbio.dll, 深圳世强软件开发部>
[电台(&R)]
{8E718888-423F-11D2-876E-00A0C9082467} <C:\WINDOWS.0\System32\msdxm.ocx, Microsoft Corporation>
[Shockwave Flash
Object]
{D27CDB6E-AE6D-11CF-96B8-444553540000} <C:\WINDOWS.0\System32\Macromed\Flash\Flash8.ocx, Macromedia, Inc.>
==================================
正在运行的进程
[PID: 584][\SystemRoot\System32\smss.exe] <Microsoft Corporation><5.1.2600.1106 (xpsp1.020828-1920)>
[PID: 648][\??\C:\WINDOWS.0\system32\csrss.exe] <Microsoft Corporation><5.1.2600.0 (xpclient.010817-1148)>
[PID: 672][\??\C:\WINDOWS.0\system32\winlogon.exe] <Microsoft Corporation><5.1.2600.1106 (xpsp1.020828-1920)>
[PID: 716][C:\WINDOWS.0\system32\services.exe] <Microsoft Corporation><5.1.2600.0 (xpclient.010817-1148)>
[PID: 728][C:\WINDOWS.0\system32\lsass.exe] <Microsoft Corporation><5.1.2600.1106 (xpsp1.020828-1920)>
[PID: 888][C:\WINDOWS.0\System32\Ati2evxx.exe] <ATI Technologies Inc.><6.14.10.4116>
[C:\WINDOWS.0\System32\Ati2edxx.dll] <ATI Technologies, Inc.><6, 14, 10, 2497>
[PID: 928][C:\WINDOWS.0\system32\svchost.exe] <Microsoft Corporation><5.1.2600.0 (xpclient.010817-1148)>
[PID: 1028][C:\WINDOWS.0\System32\svchost.exe] <Microsoft Corporation><5.1.2600.0 (xpclient.010817-1148)>
[PID: 1260][C:\WINDOWS.0\System32\svchost.exe] <Microsoft Corporation><5.1.2600.0 (xpclient.010817-1148)>
[PID: 1328][C:\WINDOWS.0\System32\svchost.exe] <Microsoft Corporation><5.1.2600.0 (xpclient.010817-1148)>
[PID: 1360][C:\PROGRAM FILES\RISING\RAV\Ravmond.exe] <Beijing Rising Technology Co., Ltd.><17, 0, 1, 57>
[C:\PROGRAM FILES\RISING\RAV\guidll.dll] <rising><17, 0, 0, 13>
[C:\PROGRAM FILES\RISING\RAV\RsCommX.dll] <rising><17, 0, 0, 3>
[C:\PROGRAM FILES\RISING\RAV\RSAPPMGR.DLL] <Rising Corp.><17, 0, 0, 7>
[C:\PROGRAM FILES\RISING\RAV\CfgDll.dll] <rising><17, 0, 0, 60>
[C:\Program Files\Rising\Rav\Scanner.dll] <Rising><17, 0, 0, 43>
[C:\PROGRAM FILES\RISING\RAV\RSCOMMON.DLL] <Beijing Rising Technology Co., Ltd.><17, 0, 0, 17>
[C:\Program Files\Rising\Rav\libload.dll] <Rising><17, 0, 0, 14>
[C:\Program Files\Rising\Rav\VirusLib.dll] <Rising><17, 0, 0, 26>
[C:\PROGRAM FILES\RISING\RAV\MailMon.dll] < ><17, 0, 0, 9>
[C:\Program Files\Rising\Rav\SpamEng.dll] <N/A><17, 0, 0, 7>
[C:\PROGRAM FILES\RISING\RAV\MemMon.dll] <北京瑞星><17, 8, 0, 0>
[C:\PROGRAM FILES\RISING\RAV\expscan.dll] <N/A><17, 0, 0, 6>
[C:\PROGRAM FILES\RISING\RAV\mPorts.dll] <Beijing Rising Technology Corporation Limited><3, 0, 0, 3>
[C:\PROGRAM FILES\RISING\RAV\regmon.dll] < ><17, 0, 0, 12>
[C:\PROGRAM FILES\RISING\RAV\HookWeb.dll] <rising><17, 0, 0, 4>
[PID: 1596][C:\WINDOWS.0\system32\LEXBCES.EXE] <Lexmark International, Inc.><9.47>
[C:\WINDOWS.0\system32\lexp2p32.dll] <Lexmark International, Inc.><9.47>
[C:\WINDOWS.0\system32\lex2kusb.dll] <Lexmark International, Inc.><9.47>
[PID: 1640][C:\WINDOWS.0\system32\spoolsv.exe] <Microsoft Corporation><5.1.2600.0 (XPClient.010817-1148)>
[C:\WINDOWS.0\system32\CNMLM16.DLL] <CANON INC.><1.50.2.6>
[C:\WINDOWS.0\system32\LEXLMPM.DLL] <Lexmark International, Inc.><96.9.42>
[C:\WINDOWS.0\system32\LexBce.dll] <Lexmark International, Inc.><9.47>
[C:\WINDOWS.0\System32\spool\PRTPROCS\W32X86\CNMPD16.DLL] <CANON INC.><1.50.2.6>
[C:\WINDOWS.0\System32\spool\PRTPROCS\W32X86\LVBCPP5C.dll] <Lenovo (Beijing) Ltd.><1.0.2.2>
[C:\WINDOWS.0\system32\LVBCpwr.dll] <Lenovo (Beijing) Ltd.><1, 0, 1, 0>
[PID: 1700][C:\WINDOWS.0\system32\LEXPPS.EXE] <Lexmark International, Inc.><9.46>
[C:\WINDOWS.0\system32\LEXBCE.DLL] <Lexmark International, Inc.><9.47>
[PID: 252][C:\WINDOWS.0\System32\alg.exe] <Microsoft Corporation><5.1.2600.1106 (xpsp1.020828-1920)>
[PID: 268][C:\WINDOWS.0\System32\drivers\CDAC11BA.EXE] <Macrovision><4.20.020>
[PID: 432][C:\PROGRAM FILES\RISING\RAV\CCENTER.EXE] <rising><17, 0, 0, 1>
[PID: 572][C:\WINDOWS.0\System32\wdfmgr.exe] <Microsoft Corporation><5.2.3790.1230 built by: DNSRV(bld4act)>
[PID: 1084][C:\WINDOWS.0\Explorer.EXE] <Microsoft Corporation><6.00.2800.1106 (xpsp1.020828-1920)>
[C:\WINDOWS.0\System32\AcSignIcon.dll] <Autodesk><16.0.0.86>
[C:\Program Files\Common Files\Autodesk Shared\AcSignCore16.dll] <Autodesk><16.0.0.86>
[PID: 1380][C:\PROGRA~1\RISING\RAV\RAVTIMER.EXE] <Beijing Rising Technology Co., Ltd.><17, 0, 0, 41>
[C:\PROGRA~1\RISING\RAV\RSCOMMON.DLL] <Beijing Rising Technology Co., Ltd.><17, 0, 0, 17>
[C:\PROGRA~1\RISING\RAV\RSAPPMGR.DLL] <Rising Corp.><17, 0, 0, 7>
[C:\PROGRA~1\RISING\RAV\CfgDll.dll] <rising><17, 0, 0, 60>
[C:\PROGRA~1\RISING\RAV\RsCommX.dll] <rising><17, 0, 0, 3>
[PID: 1476][C:\WINDOWS.0\System32\ctfmon.exe] <Microsoft Corporation><5.1.2600.1106 (xpsp1.020828-1920)>
[PID: 1984][E:\liangch\mysoftware\sreng2\SREng.exe] <Smallfrogs Studio><2.0.12.350>
==================================
文件关联
.TXT OK. [%SystemRoot%\system32\NOTEPAD.EXE %1]
.EXE OK. ["%1" %*]
.COM OK. ["%1" %*]
.PIF OK. ["%1" %*]
.REG OK. [regedit.exe "%1"]
.BAT OK. ["%1" %*]
.SCR OK. ["%1" /S]
.CHM OK. ["C:\WINDOWS.0\hh.exe" %1]
.HLP OK. [%SystemRoot%\system32\winhlp32.exe %1]
.INI OK. [%SystemRoot%\system32\NOTEPAD.EXE %1]
.INF OK. [%SystemRoot%\system32\NOTEPAD.EXE %1]
.VBS OK. [%SystemRoot%\System32\WScript.exe "%1" %*]
.JS OK. [%SystemRoot%\System32\WScript.exe "%1" %*]
.LNK OK. [{00021401-0000-0000-C000-000000000046}]
