2006-10-23,16:43:17

System Repair Engineer 2.2.6.605
Smallfrogs (http://www.KZTechs.com)

Windows XP Professional Service Pack 2 (Build 2600)
- 管理权限用户 - 完整功能

以下内容被选中：
    所有的启动项目（包括注册表、启动文件夹、服务等）
    浏览器加载项
    正在运行的进程（包括进程模块信息）
    文件关联
    Winsock 提供者
    Autorun.inf
    HOSTS 文件


启动项目
注册表
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
    <ctfmon.exe><C:\WINDOWS\system32\ctfmon.exe>  [(Verified)Microsoft Corporation]
    <UberIcon><C:\Program Files\Vista\systool\UberIcon\UberIcon Manager.exe>  [N/A]
    <Taskbar><C:\Program Files\Vista\systool\Taskbar.exe>  [i00]
[HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows]
    <load><>  [N/A]
    <run><>  [N/A]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
    <SoundMan><SOUNDMAN.EXE>  [(Verified)Realtek Semiconductor Corp.]
    <KavStart><"D:\KAV2006\KAVStart.exe" -startup>  [Kingsoft Corporation]
    <UpdateRun><C:\Program Files\Common Files\updat\Update.exe>  [N/A]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunOnce]
    <Super Rabbit SRCK><"D:\Program Files\Super Rabbit\MagicSet\SRCK.exe" /autokill:151>  [Super Rabbit Soft]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
    <shell><Explorer.exe>  [Microsoft Corporation]
    <Userinit><C:\WINDOWS\system32\userinit.exe,>  [(Verified)Microsoft Corporation]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Windows]
    <AppInit_DLLs><>  [N/A]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
    <UIHost><logolove.exe>  [N/A]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
    <{AEB6717E-7E19-11d0-97EE-00C04FD91972}><shell32.dll>  [Microsoft Corporation]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
    <PostBootReminder><%SystemRoot%\system32\SHELL32.dll>  [Microsoft Corporation]
    <CDBurn><%SystemRoot%\system32\SHELL32.dll>  [Microsoft Corporation]
    <WebCheck><%SystemRoot%\system32\webcheck.dll>  [Microsoft Corporation]
    <SysTray><C:\WINDOWS\system32\stobject.dll>  [Microsoft Corporation]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\crypt32chain]
    <WinlogonNotify: crypt32chain><crypt32.dll>  [(Verified)Microsoft Corporation]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\cryptnet]
    <WinlogonNotify: cryptnet><cryptnet.dll>  [(Verified)Microsoft Corporation]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\cscdll]
    <WinlogonNotify: cscdll><cscdll.dll>  [(Verified)Microsoft Corporation]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\ScCertProp]
    <WinlogonNotify: ScCertProp><wlnotify.dll>  [(Verified)Microsoft Corporation]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\Schedule]
    <WinlogonNotify: Schedule><wlnotify.dll>  [(Verified)Microsoft Corporation]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\sclgntfy]
    <WinlogonNotify: sclgntfy><sclgntfy.dll>  [(Verified)Microsoft Corporation]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\SensLogn]
    <WinlogonNotify: SensLogn><WlNotify.dll>  [(Verified)Microsoft Corporation]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\termsrv]
    <WinlogonNotify: termsrv><wlnotify.dll>  [(Verified)Microsoft Corporation]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\wlballoon]
    <WinlogonNotify: wlballoon><wlnotify.dll>  [(Verified)Microsoft Corporation]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
    <{438755C2-A8BA-11D1-B96B-00A0C90312E1}><%SystemRoot%\system32\browseui.dll>  [Microsoft Corporation]
    <{8C7461EF-2B13-11d2-BE35-3078302C2030}><%SystemRoot%\system32\browseui.dll>  [Microsoft Corporation]
[HKEY_CURRENT_USER\Control Panel\Desktop]
    <SCRNSAVE.EXE><C:\WINDOWS\system32\七彩泡泡.scr>  [Microsoft Corporation]

==================================
启动文件夹
[TaskbarEx]
  <C:\Documents and Settings\1\「开始」菜单\程序\启动\TaskbarEx.lnk --> C:\PROGRA~1\Vista\systool\TASKBA~1\TASKBA~1.EXE [N/A]><N>

==================================
服务
[Ati HotKey Poller / Ati HotKey Poller]
  <C:\WINDOWS\system32\Ati2evxx.exe><ATI Technologies Inc.>
[ATI Smart / ATI Smart]
  <C:\WINDOWS\system32\ati2sgag.exe><>
[DCOM Server Process Launcher / DcomLaunch]
  <C:\WINDOWS\system32\svchost -k DcomLaunch-->%SystemRoot%\system32\rpcss.dll><Microsoft Corporation>
[DHCP Client / Dhcp]
  <C:\WINDOWS\system32\svchost.exe -k netsvcs-->%SystemRoot%\System32\dhcpcsvc.dll><Microsoft Corporation>
[COM+ Event System / EventSystem]
  <C:\WINDOWS\system32\svchost.exe -k netsvcs-->C:\WINDOWS\system32\es.dll><Microsoft Corporation>
[Human Interface Device Access / HidServ]
  <C:\WINDOWS\System32\svchost.exe -k netsvcs-->%SystemRoot%\System32\hidserv.dll><N/A>
[Kingsoft Personal Firewall Service / KPfwSvc]
  <"D:\KAV2006\KPfwSvc.EXE"><Kingsoft Corporation>
[Kingsoft Antivirus KWatch Service / KWatchSvc]
  <D:\KAV2006\KWatch.EXE><Kingsoft Corporation>
[Server / lanmanserver]
  <C:\WINDOWS\system32\svchost.exe -k netsvcs-->%SystemRoot%\System32\srvsvc.dll><Microsoft Corporation>
[Windows Installer / MSIServer]
  <C:\WINDOWS\system32\msiexec.exe /V><Microsoft Corporation>
[Network Connections / Netman]
  <C:\WINDOWS\System32\svchost.exe -k netsvcs-->%SystemRoot%\System32\netman.dll><Microsoft Corporation>
[Remote Procedure Call (RPC) / RpcSs]
  <C:\WINDOWS\system32\svchost -k rpcss-->%SystemRoot%\system32\rpcss.dll><Microsoft Corporation>
[Servicel / Servicel]
  <C:\WINDOWS\System32\svchost.exe -k netsvcs-->C:\WINDOWS\system32\jetspeed.dll><>
[Print Spooler / Spooler]
  <C:\WINDOWS\system32\spoolsv.exe><Microsoft Corporation>
[Telephony / TapiSrv]
  <C:\WINDOWS\System32\svchost.exe -k netsvcs-->%SystemRoot%\System32\tapisrv.dll><Microsoft Corporation>
[WebClient / WebClient]
  <C:\WINDOWS\system32\svchost.exe -k LocalService-->%SystemRoot%\System32\webclnt.dll><Microsoft Corporation>

==================================
正在运行的进程
[PID: 380][\SystemRoot\System32\smss.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 428][\??\C:\WINDOWS\system32\csrss.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 452][\??\C:\WINDOWS\system32\winlogon.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
   
[C:\WINDOWS\system32\Ati2evxx.dll]  [ATI Technologies Inc., 6.14.10.4117]
[PID: 496][C:\WINDOWS\system32\services.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 508][C:\WINDOWS\system32\lsass.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 652][C:\WINDOWS\system32\Ati2evxx.exe]  [ATI Technologies Inc., 6.14.10.4117]
    [C:\WINDOWS\system32\Ati2edxx.dll]  [ATI Technologies, Inc., 6, 14, 10, 2497]
[PID: 664][C:\WINDOWS\system32\svchost.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 748][C:\WINDOWS\system32\svchost.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 784][C:\WINDOWS\System32\svchost.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
    [c:\windows\system32\jetspeed.dll]  [, 1, 0, 0, 1]
[PID: 836][C:\WINDOWS\system32\svchost.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 860][C:\WINDOWS\system32\svchost.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 992][D:\KAV2006\KWatch.EXE]  [Kingsoft Corporation, 2005, 9, 27, 51]
    [D:\KAV2006\KAVIPC2.DLL]  [Kingsoft Corporation, 2004, 12, 28, 20]
    [D:\KAV2006\KAEPlat.DLL]  [Kingsoft Corp., 2006, 5, 30, 59]
    [D:\KAV2006\KAEMem.DAT]  [Kingsoft, 2006, 9, 25, 16]
    [D:\KAV2006\KAEUnpack.DAT]  [Kingsoft Corp., 2006, 7, 27, 59]
[PID: 1064][C:\WINDOWS\system32\spoolsv.exe]  [Microsoft Corporation, 5.1.2600.2696 (xpsp_sp2_gdr.050610-1519)]
[PID: 1228][C:\WINDOWS\system32\Ati2evxx.exe]  [ATI Technologies Inc., 6.14.10.4117]
    [C:\WINDOWS\system32\Ati2edxx.dll]  [ATI Technologies, Inc., 6, 14, 10, 2497]
    [C:\Program Files\Vista\systool\UberIcon\UberIcon.dll]  [N/A, N/A]
    [D:\KAV2006\KASocket.dll]  [Kingsoft Corporation, 2005, 2, 22, 233]
    [C:\Program Files\Vista\systool\TaskbarEx\TaskbarExHelper.dll]  [N/A, N/A]
[PID: 1324][C:\WINDOWS\Explorer.EXE]  [Microsoft Corporation, 6.00.2900.2180 (xpsp_sp2_rtm.040803-2158)]
    [C:\Program Files\Vista\systool\Rtback\ContextBG.dll]  [Grigri, 1, 0, 0, 1]
    [C:\PROGRA~1\Vista\systool\WinKld\Winkld.dat]  [www.88dog.com, 2, 0, 0, 1]
    [D:\KAV2006\KASocket.dll]  [Kingsoft Corporation, 2005, 2, 22, 233]
    [D:\KAV2006\KMailOEBand.dll]  [N/A, 2006, 5, 19, 118]
    [C:\Program Files\Vista\systool\UberIcon\UberIcon.dll]  [N/A, N/A]
    [C:\Program Files\Vista\systool\TaskbarEx\TaskbarExHelper.dll]  [N/A, N/A]
    [C:\Program Files\WinRAR\rarext.dll]  [N/A, N/A]

[PID: 1480][D:\KAV2006\KPfwSvc.EXE]  [Kingsoft Corporation, 2005, 9, 5, 28]
[PID: 1704][C:\WINDOWS\SOUNDMAN.EXE]  [Realtek Semiconductor Corp., 5.1.0.30]
    [C:\Program Files\Vista\systool\UberIcon\UberIcon.dll]  [N/A, N/A]
    [D:\KAV2006\KASocket.dll]  [Kingsoft Corporation, 2005, 2, 22, 233]
    [C:\Program Files\Vista\systool\TaskbarEx\TaskbarExHelper.dll]  [N/A, N/A]
[PID: 1712][D:\KAV2006\KAVStart.exe]  [Kingsoft Corporation, 2006, 9, 27, 210]
    [D:\KAV2006\KAVIPC2.DLL]  [Kingsoft Corporation, 2004, 12, 28, 20]
    [D:\KAV2006\PopSprt3.dll]  [Kingsoft Corporation, 2006, 9, 26, 38]
    [D:\KAV2006\KAVPassp.dll]  [Kingsoft Corporation, 2006, 6, 7, 252]
    [C:\Program Files\Vista\systool\UberIcon\UberIcon.dll]  [N/A, N/A]
    [D:\KAV2006\KASocket.dll]  [Kingsoft Corporation, 2005, 2, 22, 233]
    [C:\Program Files\Vista\systool\TaskbarEx\TaskbarExHelper.dll]  [N/A, N/A]
    [D:\KAV2006\KMailOEBand.dll]  [N/A, 2006, 5, 19, 118]
[PID: 1776][C:\WINDOWS\System32\rundll32.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
    [C:\WINDOWS\TEMP\jtemp\comare.dll]  [N/A, N/A]
[PID: 1792][C:\WINDOWS\system32\ctfmon.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
    [C:\Program Files\Vista\systool\UberIcon\UberIcon.dll]  [N/A, N/A]
    [D:\KAV2006\KASocket.dll]  [Kingsoft Corporation, 2005, 2, 22, 233]
    [C:\Program Files\Vista\systool\TaskbarEx\TaskbarExHelper.dll]  [N/A, N/A]
[PID: 1940][D:\KAV2006\KMailMon.EXE]  [Kingsoft Corporation, 2006, 4, 12, 106]
    [D:\KAV2006\KAntiSpm.dll]  [N/A, 1, 0, 0, 2]
    [D:\KAV2006\KAVIPC2.DLL]  [Kingsoft Corporation, 2004, 12, 28, 20]
    [D:\KAV2006\KAECall2.DLL]  [Kingsoft Corporation, 2004, 12, 28, 7]
    [D:\KAV2006\KAEPlat.DLL]  [Kingsoft Corp., 2006, 5, 30, 59]
    [D:\KAV2006\KAEMem.DAT]  [Kingsoft, 2006, 9, 25, 16]
    [D:\KAV2006\KAEUnpack.DAT]  [Kingsoft Corp., 2006, 7, 27, 59]
    [D:\KAV2006\KAConfig.DLL]  [Kingsoft Corporation, 2005, 3, 23, 30]
    [D:\KAV2006\KASocket.dll]  [Kingsoft Corporation, 2005, 2, 22, 233]
    [D:\KAV2006\KMailOEBand.dll]  [N/A, 2006, 5, 19, 118]
    [C:\Program Files\Vista\systool\UberIcon\UberIcon.dll]  [N/A, N/A]
    [C:\Program Files\Vista\systool\TaskbarEx\TaskbarExHelper.dll]  [N/A, N/A]
[PID: 2008][C:\Program Files\Vista\systool\UberIcon\UberIcon Manager.exe]  [N/A, N/A]
    [D:\KAV2006\KMailOEBand.dll]  [N/A, 2006, 5, 19, 118]
    [D:\KAV2006\KASocket.dll]  [Kingsoft Corporation, 2005, 2, 22, 233]
    [C:\Program Files\Vista\systool\UberIcon\UberIcon.dll]  [N/A, N/A]
    [C:\Program Files\Vista\systool\UberIcon\Plugins\iBounce\fx.dll]  [N/A, N/A]
    [C:\Program Files\Vista\systool\TaskbarEx\TaskbarExHelper.dll]  [N/A, N/A]
[PID: 2016][C:\WINDOWS\System32\alg.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 2032][C:\Program Files\Vista\systool\Taskbar.exe]  [i00, 1.00]
    [D:\KAV2006\KMailOEBand.dll]  [N/A, 2006, 5, 19, 118]
    [C:\Program Files\Vista\systool\UberIcon\UberIcon.dll]  [N/A, N/A]
    [D:\KAV2006\KASocket.dll]  [Kingsoft Corporation, 2005, 2, 22, 233]
    [C:\Program Files\Vista\systool\TaskbarEx\TaskbarExHelper.dll]  [N/A, N/A]
[PID: 280][C:\Program Files\Vista\systool\TaskbarEx\TaskbarEx.exe]  [N/A, N/A]
    [C:\Program Files\Vista\systool\TaskbarEx\TaskbarExHelper.dll]  [N/A, N/A]
    [D:\KAV2006\KMailOEBand.dll]  [N/A, 2006, 5, 19, 118]
    [C:\Program Files\Vista\systool\UberIcon\UberIcon.dll]  [N/A, N/A]
    [D:\KAV2006\KASocket.dll]  [Kingsoft Corporation, 2005, 2, 22, 233]
[PID: 1164][C:\WINDOWS\system32\wuauclt.exe]  [Microsoft Corporation, 5.8.0.2469 built by: lab01_n(wmbla)]
    [C:\Program Files\Vista\systool\TaskbarEx\TaskbarExHelper.dll]  [N/A, N/A]
    [D:\KAV2006\KMailOEBand.dll]  [N/A, 2006, 5, 19, 118]
    [C:\Program Files\Vista\systool\UberIcon\UberIcon.dll]  [N/A, N/A]
    [D:\KAV2006\KASocket.dll]  [Kingsoft Corporation, 2005, 2, 22, 233]
[PID: 720][C:\WINDOWS\SYSTEM32\RUN32.EXE]  [Microsoft Corporation, 5.00.2134.1]
[PID: 1192][C:\WINDOWS\system32\wuauclt.exe]  [Microsoft Corporation, 5.8.0.2469 built by: lab01_n(wmbla)]
[PID: 1180][D:\工具\SREng\SREng.exe]  [Smallfrogs Studio, 2.2.6.605]
    [C:\Program Files\Vista\systool\TaskbarEx\TaskbarExHelper.dll]  [N/A, N/A]
    [D:\KAV2006\KMailOEBand.dll]  [N/A, 2006, 5, 19, 118]
    [C:\Program Files\Vista\systool\UberIcon\UberIcon.dll]  [N/A, N/A]
    [D:\KAV2006\KASocket.dll]  [Kingsoft Corporation, 2005, 2, 22, 233]

==================================
文件关联
.TXT  OK. [%SystemRoot%\system32\NOTEPAD.EXE %1]
.EXE  OK. ["%1" %*]
.COM  OK. ["%1" %*]
.PIF  OK. ["%1" %*]
.REG  OK. [regedit.exe "%1"]
.BAT  OK. ["%1" %*]
.SCR  OK. ["%1" /S]
.CHM  OK. ["C:\WINDOWS\hh.exe" %1]
.HLP  OK. [%SystemRoot%\system32\winhlp32.exe %1]
.INI  OK. [%SystemRoot%\System32\NOTEPAD.EXE %1]
.INF  OK. [%SystemRoot%\System32\NOTEPAD.EXE %1]
.VBS  OK. [%SystemRoot%\System32\WScript.exe "%1" %*]
.JS  OK. [%SystemRoot%\System32\WScript.exe "%1" %*]
.LNK  OK. [{00021401-0000-0000-C000-000000000046}]

==================================
Winsock 提供者
N/A

==================================
Autorun.inf
N/A

==================================
HOSTS 文件
127.0.0.1      localhost

==================================

贴子回复过了，找一下你发的贴子