2007-05-07,21:37:38
System Repair Engineer 2.3.13.690
Smallfrogs (http://www.KZTechs.com)
Windows XP Professional Service Pack 1 (Build 2600)
- 管理权限用户 - 完整功能
以下内容被选中：
所有的启动项目（包括注册表、启动文件夹、服务等）
浏览器加载项
正在运行的进程（包括进程模块信息）
文件关联
Winsock 提供者
Autorun.inf
HOSTS 文件
启动项目
注册表
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
<ctfmon.exe><C:\WINDOWS\System32\ctfmon.exe> [(Verified)Microsoft Corporation]
[HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows]
<load><> [N/A]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
<shell><Explorer.exe> [(Verified)Microsoft Corporation]
<Userinit><C:\WINDOWS\System32\USERINIT.EXE,> [(Verified)Microsoft Corporation]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Windows]
<AppInit_DLLs><> [N/A]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
<UIHost><logonui.exe> [(Verified)Microsoft Corporation]
==================================
服务
[Human Interface Device Access / HidServ][Stopped/Disabled]
<C:\windows\System32\svchost.exe -k netsvcs-->%SystemRoot%\System32\hidserv.dll><N/A>
[MsHS64 / MsHS64][Stopped/Auto Start]
<"C:\WINDOWS\MsHS64.exe"><N/A>
[Shadow System Service / ShadowSystemService][Running/Auto Start]
<C:\WINDOWS\System32\shadow\ShadowService.exe><N/A>
==================================
驱动程序
[Service for Avance AC97 Audio (WDM) / ALCXWDM][Running/Manual Start]
<system32\drivers\ALCXWDM.SYS><Avance Logic, Inc.>
[CnsMinKP / CnsMinKP][Running/Boot Start]
<\SystemRoot\System32\drivers\CnsMinKP.sys><Copyright (C) 3721 Corporation.>
[ialm / ialm][Running/Manual Start]
<System32\DRIVERS\ialmnt5.sys><Intel Corporation>
[Direct Parallel Link Driver / Ptilink][Running/Manual Start]
<System32\DRIVERS\ptilink.sys><Parallel Technologies, Inc.>
[Realtek RTL8139(A/B/C)-based PCI Fast Ethernet Adapter NT Driver / rtl8139][Running/Manual Start]
<System32\DRIVERS\RTL8139.SYS><Realtek Semiconductor Corporation>
[Secdrv / Secdrv][Stopped/Manual Start]
<System32\DRIVERS\secdrv.sys><N/A>
[SKNFW / SKNFW][Running/System Start]
<\??\C:\WINDOWS\System32\Drivers\SKNFW.sys><N/A>
[World Standard Teletext Codec / WSTCODEC][Stopped/Manual Start]
<System32\DRIVERS\WSTCODEC.SYS><Microsoft Corporation>
[XPROTECTOR / XPROTECTOR][Running/Auto Start]
<\??\C:\WINDOWS\system32\drivers\Xprotector.sys><N/A>
[VIMICRO USB PC Camera (ZC0301PLH) / ZSMC303][Running/Manual Start]
<System32\Drivers\usbVM303.sys><Vimicro Corporation>
[Intel(R) Graphics Platform (SoftBIOS) Driver / {6080A529-897E-4629-A488-ABA0C29B635E}][Running/System Start]
<system32\drivers\ialmsbw.sys><Intel Corporation>
[Intel(R) Graphics Chipset (KCH) Driver / {D31A0762-0CEB-444e-ACFF-B049A1F6FE91}][Running/Manual Start]
<system32\drivers\ialmkchw.sys><Intel Corporation>
==================================
浏览器加载项
N/A
==================================
正在运行的进程
[PID: 428][\SystemRoot\System32\smss.exe] [Microsoft Corporation, 5.1.2600.1106 (xpsp1.020828-1920)]
[PID: 496][\??\C:\windows\system32\csrss.exe] [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)]
[PID: 520][\??\C:\windows\system32\winlogon.exe] [Microsoft Corporation, 5.1.2600.1106 (xpsp1.020828-1920)]
[PID: 564][C:\windows\system32\services.exe] [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)]
[PID: 576][C:\windows\system32\lsass.exe] [Microsoft Corporation, 5.1.2600.1106 (xpsp1.020828-1920)]
[C:\WINDOWS\System32\ESPI11.dll] [DYWT, 1, 1, 0, 0]
[PID: 736][C:\windows\system32\svchost.exe] [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)]
[C:\WINDOWS\System32\ESPI11.dll] [DYWT, 1, 1, 0, 0]
[PID: 788][C:\windows\System32\svchost.exe] [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)]
[C:\WINDOWS\System32\ESPI11.dll] [DYWT, 1, 1, 0, 0]
[PID: 848][C:\windows\System32\svchost.exe] [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)]
[C:\WINDOWS\System32\ESPI11.dll] [DYWT, 1, 1, 0, 0]
[PID: 888][C:\windows\System32\svchost.exe] [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)]
[C:\WINDOWS\System32\ESPI11.dll] [DYWT, 1, 1, 0, 0]
[PID: 1100][C:\windows\system32\spoolsv.exe] [Microsoft Corporation, 5.1.2600.0 (XPClient.010817-1148)]
[C:\windows\System32\spool\PRTPROCS\W32X86\vprproc.dll] [Windows (R) 2000 DDK provider, 5.00.2195.1620]
[PID: 1388][C:\windows\System32\alg.exe] [Microsoft Corporation, 5.1.2600.1106 (xpsp1.020828-1920)]
[C:\WINDOWS\System32\ESPI11.dll] [DYWT, 1, 1, 0, 0]
[PID: 1404][C:\windows\system32\cisvc.exe] [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)]
[PID: 1520][C:\WINDOWS\System32\shadow\ShadowService.exe] [N/A, N/A]
[PID: 1588][C:\windows\System32\svchost.exe] [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)]
[PID: 1832][C:\windows\Explorer.EXE] [Microsoft Corporation, 6.00.2800.1106 (xpsp1.020828-1920)]
[C:\rar\rarext.dll] [N/A, N/A]
[C:\WINDOWS\SYSTEM32\shadow\pDeskTop.dll] [N/A, N/A]
[C:\WINDOWS\System32\igfxpph.dll] [Intel Corporation, 3,0,0,1847]
[C:\WINDOWS\System32\hccutils.DLL] [Intel Corporation, 3,0,0,1847]
[PID: 160][C:\WINDOWS\VM303_STI.EXE] [Vimicro, 4, 3, 625, 61]
[C:\windows\System32\msdmo.dll] [N/A, N/A]
[C:\windows\System32\VM303Prp.Ax] [Vimicro, 4.3. 625.61]
[PID: 208][C:\WINDOWS\System32\ctfmon.exe] [Microsoft Corporation, 5.1.2600.1106 (xpsp1.020828-1920)]
[PID: 240][C:\windows\System32\conime.exe] [Microsoft Corporation, 5.1.2600.1106 (xpsp1.020828-1920)]
[PID: 1648][F:\qq\凝逸QQ\凝逸QQ.exe] [N/A, N/A]
[C:\DOCUME~1\系1\LOCALS~1\Temp\E_4\krnln.fnr] [, 1, 0, 0, 1]
[C:\DOCUME~1\系1\LOCALS~1\Temp\E_4\iext2.fne] [, 1, 0, 0, 1]
[C:\DOCUME~1\系1\LOCALS~1\Temp\E_4\xplib.fne] [N/A, N/A]
[C:\DOCUME~1\系1\LOCALS~1\Temp\E_4\dp1.fne] [N/A, N/A]
[C:\DOCUME~1\系1\LOCALS~1\Temp\E_4\eAPI.fne] [, 1, 0, 0, 1]
[C:\DOCUME~1\系1\LOCALS~1\Temp\E_4\HtmlView.fne] [, 1, 0, 0, 1]
[C:\DOCUME~1\系1\LOCALS~1\Temp\E_4\iext3.fne] [, 1, 0, 0, 1]
[C:\DOCUME~1\系1\LOCALS~1\Temp\E_4\EThread.fne] [N/A, N/A]
[C:\DOCUME~1\系1\LOCALS~1\Temp\E_4\internet.fne] [, 1, 0, 0, 1]
[PID: 1980][C:\WINDOWS\SYSTEM32\shadow\ShadowTip.exe] [PowerShadow, 1, 0, 0, 1]
[C:\WINDOWS\SYSTEM32\shadow\pDeskTop.dll] [N/A, N/A]
[PID: 748][C:\windows\system32\cidaemon.exe] [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)]
[PID: 2384][C:\WINDOWS\system32\notepad.exe] [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)]
[PID: 3388][C:\中易浏览器\enjoyie.exe] [, 2.1.10.4]
[C:\WINDOWS\System32\ESPI11.dll] [DYWT, 1, 1, 0, 0]
[PID: 2612][C:\Program Files\Internet Explorer\iexplore.exe] [Microsoft Corporation, 6.00.2800.1106 (xpsp1.020828-1920)]
[PID: 1472][C:\系统修复扫描\系统修复扫描.EXE] [Smallfrogs Studio, 2.3.13.690]
[C:\WINDOWS\System32\ESPI11.dll] [DYWT, 1, 1, 0, 0]
==================================
文件关联
.TXT OK. [%SystemRoot%\system32\NOTEPAD.EXE %1]
.EXE OK. ["%1" %*]
.COM OK. ["%1" %*]
.PIF OK. ["%1" %*]
.REG OK. [regedit.exe "%1"]
.BAT OK. ["%1" %*]
.SCR OK. ["%1" /S]
.CHM OK. ["C:\WINDOWS\hh.exe" %1]
.HLP OK. [%SystemRoot%\system32\winhlp32.exe %1]
.INI OK. [%SystemRoot%\system32\NOTEPAD.EXE %1]
.INF OK. [%SystemRoot%\system32\NOTEPAD.EXE %1]
.VBS OK. [%SystemRoot%\System32\WScript.exe "%1" %*]
.JS OK. [%SystemRoot%\System32\WScript.exe "%1" %*]
.LNK OK. [{00021401-0000-0000-C000-000000000046}]
==================================
Winsock 提供者
MSAFD Tcpip [TCP/IP]
C:\WINDOWS\System32\ESPI11.dll(DYWT, ESPI)
MSAFD Tcpip [UDP/IP]
C:\WINDOWS\System32\ESPI11.dll(DYWT, ESPI)
MSAFD Tcpip [RAW/IP]
C:\WINDOWS\System32\ESPI11.dll(DYWT, ESPI)
RSVP UDP Service Provider
C:\WINDOWS\System32\ESPI11.dll(DYWT, ESPI)
RSVP TCP Service Provider
C:\WINDOWS\System32\ESPI11.dll(DYWT, ESPI)
==================================
Autorun.inf
N/A
==================================
HOSTS 文件
127.0.0.1 localhost
==================================
API HOOK
N/A
==================================
