[CODE]
2007-02-28,17:35:22
System Repair Engineer 2.3.13.690
Smallfrogs (http://www.KZTechs.com)
Windows XP Professional Service Pack 1 (Build 2600)
- 管理权限用户 - 完整功能
以下内容被选中：
所有的启动项目（包括注册表、启动文件夹、服务等）
浏览器加载项
正在运行的进程（包括进程模块信息）
文件关联
Winsock 提供者
Autorun.inf
HOSTS 文件
启动项目
注册表
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
<ctfmon.exe><C:\WINDOWS\System32\ctfmon.exe> [(Verified)Microsoft Corporation]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
<360Safetray><C:\Program Files\360safe\safemon\360tray.exe /start> [奇虎网]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
<shell><Explorer.exe> [(Verified)Microsoft Corporation]
<Userinit><C:\WINDOWS\system32\userinit.exe,> [(Verified)Microsoft Corporation]
<UIHost><logonui.exe> [(Verified)Microsoft Corporation]
==================================
启动文件夹
N/A
==================================
服务
[Human Interface Device Access / HidServ][Stopped/Disabled]
<C:\WINDOWS\System32\svchost.exe -k netsvcs-->%SystemRoot%\System32\hidserv.dll><N/A>
==================================
驱动程序
[Intel(r) 82801 Audio Driver Install Service (WDM) / ac97intc][Running/Manual Start]
<system32\drivers\ac97intc.sys><Intel Corporation>
[Intel(R) PRO Adapter Driver / E100B][Running/Manual Start]
<System32\DRIVERS\e100b325.sys><Intel Corporation>
[ialm / ialm][Running/Manual Start]
<System32\DRIVERS\ialmnt5.sys><Intel Corporation>
[Ich / Ich][Stopped/Manual Start]
<System32\DRIVERS\Ich.sys><N/A>
[npkcrypt / npkcrypt][Running/Auto Start]
<\??\C:\Program Files\Tencent\QQ\npkcrypt.sys><INCA Internet Co., Ltd.>
[Direct Parallel Link Driver / Ptilink][Running/Manual Start]
<System32\DRIVERS\ptilink.sys><Parallel Technologies, Inc.>
[Rksample / Rksample][Stopped/Manual Start]
<System32\DRIVERS\rksample.sys><N/A>
[Secdrv / Secdrv][Stopped/Manual Start]
<System32\DRIVERS\secdrv.sys><N/A>
[Sony Notebook Control Device / SNC][Running/Manual Start]
<System32\DRIVERS\SonyNC.sys><Sony Corporation>
[Sony Programmable I/O Control Device / SPI][Running/Manual Start]
<System32\DRIVERS\SonyPI.sys><Sony Corporation>
[winachsf / winachsf][Stopped/Manual Start]
<System32\DRIVERS\HSF_CNXT.sys><N/A>
[AIM 3.0 Part 01 Codec Driver VCH-A / {A7E39B01-B403-11d4-BD18-00D0B7A1821E}][Running/Manual Start]
<system32\drivers\Vch.sys><Intel Corporation>
==================================
浏览器加载项
[Thunder Browser Helper]
{0005A87C-D626-4B3A-84F9-1D9571695F55} <C:\Program Files\Thunder Network\Thunder\ComDlls\XunLeiBHO_006.dll, N/A>
[ThunderIEHelper Class]
{0005A87D-D626-4B3A-84F9-1D9571695F55} <C:\WINDOWS\System32\xunleibho_v1.dll, >
[CLDown
Object]
{0BECAB3A-E1F8-45E6-8332-38DD750EBA01} <C:\Program Files\Tuotu\TuoTuHelper.dll, N/A>
[FGCatchUrl]
{2F364306-AA45-47B5-9F9D-39A8B94E7EF7} <C:\Documents and Settings\Administrator\Local Settings\Temp\Rar$EX00.377\FlashGet\jccatch.dll, www.flashget.com>
[QQBrowserHelper
Object Class]
{54EBD53A-9BC1-480B-966A-843A333CA162} <C:\Program Files\Tencent\QQ\QQIEHelper.dll, 深圳市腾讯计算机系统有限公司>
[NavigatMon Class]
{B69F34DD-F0F9-42DC-9EDD-957187DA688D} <C:\Program Files\360safe\safemon\safemon.dll, N/A>
[@shdoclc.dll,-866]
{c95fe080-8f5d-11d2-a20b-00aa003c157a} <, N/A>
[QQ]
{c95fe080-8f5d-11d2-a20b-00aa003c157b} <C:\Program Files\Tencent\QQ\QQ.EXE, TENCENT>
[快车]
{D6E814A0-E0C5-11d4-8D29-0050BA6940E3} <C:\DOCUME~1\ADMINI~1\LOCALS~1\TEMP\RAR$EX00.377\FLASHGET\flashget.exe, FlashGet.com>
[QQIEFloatBarCfgCmd Class]
{DEDEB80D-FA35-45d9-9460-4983E5A8AFE6} <C:\Program Files\Tencent\QQ\QQIEHelper.dll, 深圳市腾讯计算机系统有限公司>
[电台(&R)]
{8E718888-423F-11D2-876E-00A0C9082467} <C:\WINDOWS\System32\msdxm.ocx, Microsoft Corporation>
[金山快译(&K)]
{6C3797D2-3FEF-4cd4-B654-D3AE55B4128C} <C:\PROGRA~1\Kingsoft\FastAIT\IEBand.dll, >
[快车(FlashGet)]
{E0E899AB-F487-11D5-8D29-0050BA6940E3} <C:\DOCUME~1\ADMINI~1\LOCALS~1\TEMP\RAR$EX00.377\FLASHGET\fgiebar.dll, Amaze Soft>
[Shockwave Flash
Object]
{D27CDB6E-AE6D-11CF-96B8-444553540000} <C:\WINDOWS\System32\Macromed\Flash\Flash9b.ocx, Adobe Systems, Inc.>
[FGCatchUrl]
{FB5DA724-162B-11D3-8B9B-AA70B4B0B524} <C:\Documents and Settings\Administrator\Local Settings\Temp\Rar$EX00.377\FlashGet\jccatch.dll, www.flashget.com>
[&使用快车(FlashGet)下载]
<C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\Rar$EX00.377\FlashGet\jc_link.htm, N/A>
[&使用快车(FlashGet)下载全部链接]
<C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\Rar$EX00.377\FlashGet\jc_all.htm, N/A>
[&使用网际快车下载]
<C:\Documents and Settings\Administrator\Local Settings\Temp\Rar$EX00.377\FlashGet\jc_link.htm, N/A>
[&使用网际快车下载全部链接]
<C:\Documents and Settings\Administrator\Local Settings\Temp\Rar$EX00.377\FlashGet\jc_all.htm, N/A>
[上传到QQ网络硬盘]
<C:\Program Files\Tencent\QQ\AddToNetDisk.htm, N/A>
[使用脱兔下载]
<C:\Program Files\Tuotu\TT_one.htm, N/A>
[使用脱兔下载全部链接]
<C:\Program Files\Tuotu\TT_all.htm, N/A>
[添加到QQ自定义面板]
<C:\Program Files\Tencent\QQ\AddPanel.htm, N/A>
[添加到QQ表情]
<C:\Program Files\Tencent\QQ\AddEmotion.htm, N/A>
[用QQ彩信发送该图片]
<C:\Program Files\Tencent\QQ\SendMMS.htm, N/A>
==================================
正在运行的进程
[PID: 548][\SystemRoot\System32\smss.exe] [Microsoft Corporation, 5.1.2600.1106 (xpsp1.020828-1920)]
[PID: 624][\??\C:\WINDOWS\system32\csrss.exe] [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)]
[PID: 648][\??\C:\WINDOWS\system32\winlogon.exe] [Microsoft Corporation, 5.1.2600.1106 (xpsp1.020828-1920)]
[PID: 696][C:\WINDOWS\system32\services.exe] [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)]
[PID: 708][C:\WINDOWS\system32\lsass.exe] [Microsoft Corporation, 5.1.2600.1106 (xpsp1.020828-1920)]
[PID: 868][C:\WINDOWS\system32\svchost.exe] [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)]
[PID: 912][C:\WINDOWS\System32\svchost.exe] [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)]
[PID: 1052][C:\WINDOWS\System32\svchost.exe] [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)]
[PID: 1064][C:\WINDOWS\System32\svchost.exe] [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)]
[PID: 1192][C:\WINDOWS\system32\spoolsv.exe] [Microsoft Corporation, 5.1.2600.0 (XPClient.010817-1148)]
[C:\WINDOWS\system32\OLFMNT40.DLL] [Microsoft Corporation, 9.0.98.0105]
[C:\WINDOWS\System32\spool\PRTPROCS\W32X86\olfpnt40.dll] [Microsoft Corporation, 9.0.98.0105]
[PID: 1312][C:\WINDOWS\System32\alg.exe] [Microsoft Corporation, 5.1.2600.1106 (xpsp1.020828-1920)]
[PID: 1432][C:\WINDOWS\System32\wdfmgr.exe] [Microsoft Corporation, 5.2.3790.1230 built by: dnsrv(bld4act)]
[PID: 1976][C:\WINDOWS\Explorer.EXE] [Microsoft Corporation, 6.00.2800.1106 (xpsp1.020828-1920)]
[C:\Program Files\360safe\safemon\safemon.dll] [N/A, 1, 0, 0, 1001]
[C:\WINDOWS\System32\xunleibho_v1.dll] [, 1, 0, 0, 1]
[C:\Program Files\Tuotu\TuoTuHelper.dll] [N/A, 2.0.0.6]
[C:\WINDOWS\System32\igfxpph.dll] [Intel Corporation, 3,0,0,1370]
[C:\WINDOWS\System32\hccutils.DLL] [Intel Corporation, 3,0,0,1370]
[C:\WINDOWS\System32\igfxres.dll] [Intel Corporation, 3,0,0,1370]
[C:\WINDOWS\System32\igfxsrvc.dll] [Intel Corporation, 3,0,0,1370]
[C:\WINDOWS\System32\igfxdev.dll] [Intel Corporation, 3,0,0,1370]
[PID: 116][C:\Program Files\360safe\safemon\360tray.exe] [奇虎网, 1, 0, 0, 1001]
[C:\Program Files\360safe\safemon\safemon.dll] [N/A, 1, 0, 0, 1001]
[C:\Program Files\360safe\safemon\SafeKrnl.dll] [奇虎网, 1, 0, 0, 1001]
[C:\Program Files\360safe\AntiAdwa.dll] [360Safe.com, 2, 2, 1, 2000]
[PID: 164][C:\WINDOWS\System32\ctfmon.exe] [Microsoft Corporation, 5.1.2600.1106 (xpsp1.020828-1920)]
[C:\Program Files\360safe\safemon\safemon.dll] [N/A, 1, 0, 0, 1001]
[PID: 460][C:\WINDOWS\System32\wuauclt.exe] [Microsoft Corporation, 5.4.3630.1106 (xpsp1.020828-1920)]
[C:\Program Files\360safe\safemon\safemon.dll] [N/A, 1, 0, 0, 1001]
[PID: 1492][C:\Documents and Settings\Administrator\Local Settings\Temp\Rar$EX00.377\FlashGet\flashget.exe] [FlashGet.com, 1, 8, 1, 1002]
[C:\Documents and Settings\Administrator\Local Settings\Temp\Rar$EX00.377\FlashGet\FGBTCORE.dll] [N/A, 1, 0, 0, 36]
[C:\Program Files\360safe\safemon\safemon.dll] [N/A, 1, 0, 0, 1001]
[C:\Documents and Settings\Administrator\Local Settings\Temp\Rar$EX00.377\FlashGet\fgupdate.dll] [www.flashget.com, 1, 8, 1, 1002]
[PID: 1564][C:\Program Files\Internet Explorer\iexplore.exe] [Microsoft Corporation, 6.00.2800.1106 (xpsp1.020828-1920)]
[C:\Program Files\360safe\safemon\safemon.dll] [N/A, 1, 0, 0, 1001]
[C:\PROGRA~1\Kingsoft\FastAIT\IEBand.dll] [, 1, 0, 0, 0]
[C:\WINDOWS\System32\xunleibho_v1.dll] [, 1, 0, 0, 1]
[C:\Program Files\Tuotu\TuoTuHelper.dll] [N/A, 2.0.0.6]
