2005-09-02,12:55:08
System Repair Engineer 2.5.16.900
Smallfrogs (http://www.KZTechs.com)
Windows XP Professional Service Pack 1 (Build 2600) - 管理权限用户 - 完整功能
以下内容被选中：
所有的启动项目（包括注册表、启动文件夹、服务等）
浏览器加载项
正在运行的进程（包括进程模块信息）
文件关联
Winsock 提供者
Autorun.inf
HOSTS 文件
进程特权扫描
启动项目
注册表
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
<ctfmon.exe><C:\WINDOWS\System32\ctfmon.exe> [(Verified)Microsoft Windows XP Publisher]
[HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows]
<load><> [N/A]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
<IMJPMIG8.1><"C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32> [(Verified)Microsoft Windows XP Publisher]
<PHIME2002A><C:\WINDOWS\System32\IME\TINTLGNT\TINTSETP.EXE /IMEName> [(Verified)Microsoft Windows XP Publisher]
<TkBellExe><"C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot> [RealNetworks, Inc.]
<RavTask><"D:\Program files\Rising\Rising\Rav\RavTask.exe" -system> [Beijing Rising Technology Co., Ltd.]
<runeip><"C:\Program Files\Rising\AntiSpyware\runiep.exe" /startup> [Beijing Rising Technology Co., Ltd.]
<UnlockerAssistant><"D:\Program files\Unlocker\UnlockerAssistant.exe"> []
<logogo><C:\WINDOWS\system\logogo.exe> []
<inudhya><C:\WINDOWS\system\svchost.exe> []
<MsIMMs32><; C:\WINDOWS\MsIMMs32.exe> []
<ravcqmon><; C:\Program Files\NetMeeting\ravcqmon.exe> []
<ravmsmon><C:\Program Files\NetMeeting\ravmsmon.exe> []
<ravzxmon><; C:\Program Files\NetMeeting\ravzxmon.exe> []
<WinForm><C:\WINDOWS\WinForm.exe> []
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run]
<owfh><rundll32 "C:\WINDOWS\Downlo~1\owfh.dll",Run> [Microsoft Corporation]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
<shell><Explorer.exe> [(Verified)Microsoft Windows XP Publisher]
<Userinit><C:\WINDOWS\System32\UserInit.exe,> [(Verified)Microsoft Windows XP Publisher]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Windows]
<AppInit_DLLs><ztaman.dll> []
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
<UIHost><logonui.exe> [(Verified)Microsoft Windows XP Publisher]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
<{B12BC423-3713-224D-3F55-32B35C62B11B}><C:\WINDOWS\System32\tlvpri.dll> []
<{2231A43A-1642-641A-64FD-146ADAB223B2}><C:\WINDOWS\System32\mxbman.dll> []
<{E1351752-5628-1547-FFAB-BADC13512AFE}><C:\WINDOWS\System32\ztaman.dll> []
<{90BC520C-9175-470E-94B8-10FD869D170B}><C:\Program Files\Common Files\Microsoft Shared\MSINFO\SysInfo.yer> []
<{0EA66AD2-CF26-2E23-532B-B292E22F3266}><C:\Program Files\Internet Explorer\PLUGINS\NewTemp.dll> [N/A]
<{352D2432-37A2-324F-2A54-21BF5CF2F1A3}><C:\WINDOWS\System32\jhbpri.dll> []
<{4F12545B-1212-1314-5679-4512ACEF8904}><C:\WINDOWS\System32\wddpri.dll> []
<{52311A42-AC1B-158F-FD32-5674345F23A5}><C:\WINDOWS\System32\dhepri.dll> []
<{7A65498A-7653-9801-1647-987114AB7F47}><C:\WINDOWS\System32\zxgpri.dll> []
<{725AB2F3-234A-7469-2F43-E341713ABFA7}><C:\WINDOWS\System32\wggpri.dll> []
<{5182C1EB-375C-573D-1F5E-234552345215}><C:\WINDOWS\System32\wlhpri.dll> []
<{8562452F-FA36-BA4F-892A-FF5FBBAC5318}><C:\WINDOWS\System32\myhpri.dll> []
<{A12BC423-3713-224D-3F55-32B35C62B11A}><C:\WINDOWS\System32\tlupri.dll> []
<{54123FF1-8371-9834-9021-184518451FA5}><C:\WINDOWS\System32\qjepri.dll> []
<{46368135-64FA-BC34-DA32-DCF4FD431C94}><C:\WINDOWS\System32\qhdpri.dll> []
<{959AFD5B-159F-ACD8-954C-ACD545FA6589}><C:\WINDOWS\System32\jzipri.dll> []
<{33472AF2-174F-AC37-197C-CAC3BCA146C3}><C:\WINDOWS\System32\fycpri.dll> []
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\>{26923b43-4d38-484f-9b9e-de460746276c}]
<Internet Explorer><%systemroot%\system32\shmgrate.exe OCInstallUserConfigIE> [N/A]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\>{881dd1c5-3dcf-431b-b061-f3f88e8be88a}]
<Outlook Express><%systemroot%\system32\shmgrate.exe OCInstallUserConfigOE> [N/A]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{22d6f312-b0f6-11d0-94ab-0080c74c7e95}]
<Microsoft Windows Media Player 6.4><rundll32.exe advpack.dll,LaunchINFSection C:\WINDOWS\INF\mplayer2.inf,PerUserStub.NT> [(Verified)Microsoft Windows XP Publisher]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{2C7339CF-2B09-4501-B3F3-F3508C9228ED}]
<Themes Setup><%SystemRoot%\system32\regsvr32.exe /s /n /i:/UserInstall %SystemRoot%\system32\themeui.dll> [N/A]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{306D6C21-C1B6-4629-986C-E59E1875B8AF}]
<N/A><"C:\WINDOWS\System32\rundll32.exe" "C:\Program Files\Messenger\msgsc.dll",ShowIconsUser> [(Verified)Microsoft Windows XP Publisher]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{44BBA840-CC51-11CF-AAFA-00AA00B6015C}]
<Microsoft Outlook Express 6><"%ProgramFiles%\Outlook Express\setup50.exe" /APP:OE /CALLER:WINNT /user /install> [N/A]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{44BBA842-CC51-11CF-AAFA-00AA00B6015B}]
<NetMeeting 3.01><rundll32.exe advpack.dll,LaunchINFSection C:\WINDOWS\INF\msnetmtg.inf,NetMtg.Install.PerUser.NT> [(Verified)Microsoft Windows XP Publisher]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{5945c046-1e7d-11d1-bc44-00c04fd912be}]
<Windows Messenger 4.7><rundll32.exe advpack.dll,LaunchINFSection C:\WINDOWS\INF\msmsgs.inf,BLC.Install.PerUser> [(Verified)Microsoft Windows XP Publisher]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{6BF52A52-394A-11d3-B153-00C04F79FAA6}]
<Microsoft Windows Media Player 8><rundll32.exe advpack.dll,LaunchINFSection C:\WINDOWS\INF\wmp.inf,PerUserStub> [(Verified)Microsoft Windows XP Publisher]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{7790769C-0471-11d2-AF11-00C04FA35D02}]
<通讯簿 6><"%ProgramFiles%\Outlook Express\setup50.exe" /APP:WAB /CALLER:WINNT /user /install> [N/A]
[HKEY_CURRENT_USER\Control Panel\Desktop]
<SCRNSAVE.EXE><D:\DOWNLOAD\系统工具\1900-1~1.SCR> [N/A]
==================================
启动文件夹
N/A
==================================
服务
[32CDC02 / 32CDC02][Stopped/Auto Start]
<C:\WINDOWS\System32\A9A04660.EXE -g><Microsoft Corporation>
[Human Interface Device Access / HidServ][Stopped/Disabled]
<C:\WINDOWS\System32\svchost.exe -k netsvcs-->%SystemRoot%\System32\hidserv.dll><N/A>
[Windows Management Service / MmServer][Stopped/Auto Start]
<C:\WINDOWS\System32\Winmm.exe><>
[Remote Procedure Call (RPC) / RpcSs][Running/Auto Start]
<C:\WINDOWS\system32\svchost -k rpcss-->%SystemRoot%\system32\rpcss.dll><>
[Rising Process Communication Center / RsCCenter][Running/Auto Start]
<"D:\Program files\Rising\Rising\Rav\CCenter.exe"><Beijing Rising Technology Co., Ltd.>
[Rising RealTime Monitor / RsRavMon][Running/Auto Start]
<"D:\PROGRAM FILES\RISING\RISING\RAV\Ravmond.exe"><Beijing Rising Technology Co., Ltd.>
[svchost / svchost][Stopped/Auto Start]
<C:\WINDOWS\System32\dllcache\svchost.exe -g><Microsoft Corporation>
[Windows Accounts Driver / windows_0][Stopped/Auto Start]
<C:\WINDOWS\System32\449.exe><N/A>
[用户系统信息]Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1)
