[CODE]

2007-09-03,08:31:18

System Repair Engineer 2.5.16.900
Smallfrogs (http://www.KZTechs.com)

Windows 2000 Server Service Pack 4 (Build 2195) - 管理权限用户 - 完整功能

以下内容被选中：
    所有的启动项目（包括注册表、启动文件夹、服务等）
    浏览器加载项
    正在运行的进程（包括进程模块信息）
    文件关联
    Winsock 提供者
    Autorun.inf
    HOSTS 文件
    进程特权扫描


启动项目
注册表
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
    <Internat.exe><internat.exe>  [(Verified)]
[HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows]
    <load><>  [N/A]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
    <shell><Explorer.exe>  [(Verified)]
    <Userinit><C:\WINNT\system32\userinit.exe,>  [(Verified)]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Windows]
    <AppInit_DLLs><>  [N/A]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{44BBA840-CC51-11CF-AAFA-00AA00B6015C}]
    <Microsoft Outlook Express 6><"%ProgramFiles%\Outlook Express\setup50.exe" /APP:OE /CALLER:WINNT /user /install>  [N/A]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{44BBA842-CC51-11CF-AAFA-00AA00B6015B}]
    <NetMeeting 3.01><rundll32.exe advpack.dll,LaunchINFSection C:\WINNT\INF\msnetmtg.inf,NetMtg.Install.PerUser.NT>  []
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{6BF52A52-394A-11d3-B153-00C04F79FAA6}]
    <Microsoft Windows Media Player><rundll32.exe advpack.dll,LaunchINFSection C:\WINNT\INF\wmp.inf,PerUserStub>  []
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{7790769C-0471-11d2-AF11-00C04FA35D02}]
    <Address Book 5><"%ProgramFiles%\Outlook Express\setup50.exe" /APP:WAB /CALLER:WINNT /user /install>  [N/A]
[HKEY_CURRENT_USER\Control Panel\Desktop]
    <SCRNSAVE.EXE><(无)>  [N/A]

==================================
启动文件夹
N/A

==================================
服务
[Logical Disk Manager Administrative Service / dmadmin][Stopped/Manual Start]
  <C:\WINNT\System32\dmadmin.exe /com><VERITAS Software Corp.>
[Trend ServerProtect / SpntSvc][Others/Auto Start]
  <"C:\Program Files\Trend\SProtect\SpntSvc.exe"><Trend Micro Inc.>
[Portable Media Serial Number Service / WmdmPmSN][Stopped/Manual Start]
  <C:\WINNT\System32\svchost.exe -k netsvcs-->C:\WINNT\system32\mspmsnsv.dll><Microsoft Corporation>
[Automatic Updates / wuauserv][Others/Auto Start]
  <C:\WINNT\system32\svchost.exe -k wugroup-->c:\winnt\system32\wins\bot.dll><N/A>
[NOTEPAD / NOTEPAD][Running/Auto Start]
  <"C:\WINNT\system\NOTEPAD.exe"><N/A>

==================================
驱动程序
[Legend DFE-530TX PCI Fast Ethernet Adapter / dlkfet][Running/Manual Start]
  <system32\DRIVERS\dlkfet.sys><Fast Ethernet PCI Adapter Manufacturer>
[dmboot / dmboot][Stopped/Disabled]
  <System32\drivers\dmboot.sys><VERITAS Software Corp.>
[Logical Disk Manager Driver / dmio][Running/Boot Start]
  <\SystemRoot\System32\drivers\dmio.sys><VERITAS Software Corp.>
[dmload / dmload][Running/Boot Start]
  <\SystemRoot\System32\drivers\dmload.sys><VERITAS Software Corp.>
[BDA MPE Filter / MPE][Stopped/Manual Start]
  <system32\DRIVERS\MPE.sys><Microsoft Corporation>
[NABTS/FEC VBI Codec / NABTSFEC][Stopped/Manual Start]
  <system32\DRIVERS\NABTSFEC.sys><Microsoft Corporation>
[Direct Parallel Link Driver / Ptilink][Running/Manual Start]
  <system32\DRIVERS\ptilink.sys><Parallel Technologies, Inc.>
[S3Inc / S3Inc][Running/Manual Start]
  <system32\DRIVERS\s3mt3d.sys><S3 Incorporated>
[BDA Slip De-Framer / SLIP][Stopped/Manual Start]
  <system32\DRIVERS\SLIP.sys><Microsoft Corporation>
[BDA IPSink / streamip][Stopped/Manual Start]
  <system32\DRIVERS\StreamIP.sys><Microsoft Corporation>
[symc8xx / symc8xx][Running/Boot Start]
  <\SystemRoot\system32\DRIVERS\symc8xx.sys><LSI Logic>
[Trend ServerProtect Filter / TMFilter][Running/Auto Start]
  <\??\C:\Program Files\Trend\SProtect\TMFilter.sys><Trend Micro Inc.>
[Trend ServerProtect Scan Engine / VsapiNT][Running/Auto Start]
  <\??\C:\Program Files\Trend\SProtect\VsapiNT.sys><Trend Micro Inc.>
[World Standard Teletext Codec / WSTCODEC][Stopped/Manual Start]
  <system32\DRIVERS\WSTCODEC.SYS><Microsoft Corporation>

==================================
浏览器加载项
[@shdoclc.dll,-866]
  {c95fe080-8f5d-11d2-a20b-00aa003c157a} <, N/A>
[@msdxmLC.dll,-1@2052,电台(&R)]
  {8E718888-423F-11D2-876E-00A0C9082467} <C:\WINNT\system32\msdxm.ocx, Microsoft Corporation>
[CKAVWebScan Object]
  {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} <C:\WINNT\system32\Kaspersky Lab\Kaspersky Online Scanner Pro\kavwebscan.dll, Kaspersky Lab>
[Symantec AntiVirus scanner]
  {2BC66F54-93A8-11D3-BEB6-00105AA9B6AE} <C:\WINNT\Downloaded Program Files\avsniff.dll, Symantec Corporation>
[Symantec RuFSI Utility Class]
  {644E432F-49D3-41A1-8DD5-E099162EEEC5} <C:\WINNT\Downloaded Program Files\rufsi.dll, Symantec Corporation>

==================================

[用户系统信息]Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0; Maxthon; .NET CLR 1.1.4322; .NET CLR 2.0.50727)

正在运行的进程
[PID: 156][\SystemRoot\System32\smss.exe]  [Microsoft Corporation, 5.00.2195.6601]
[PID: 184][\??\C:\WINNT\system32\csrss.exe]  [Microsoft Corporation, 5.00.2195.6601]
[PID: 204][\??\C:\WINNT\system32\winlogon.exe]  [Microsoft Corporation, 5.00.2195.6997]
[PID: 232][C:\WINNT\system32\services.exe]  [Microsoft Corporation, 5.00.2195.7035]
    [C:\WINNT\system32\dmserver.dll]  [VERITAS Software Corp., 2195.6605.297.3]
[PID: 244][C:\WINNT\system32\lsass.exe]  [Microsoft Corporation, 5.00.2195.7011]
[PID: 468][C:\WINNT\system32\svchost.exe]  [Microsoft Corporation, 5.00.2134.1]
[PID: 504][C:\WINNT\system32\spoolsv.exe]  [Microsoft Corporation, 5.00.2195.7059]
[PID: 760][C:\Program Files\Trend\SProtect\StWatchDog.exe]  [Trend Micro Inc., 5.58.0.1060]
    [C:\Program Files\Trend\SProtect\TmRpcSrv.dll]  [Trend Micro Inc., 5.58.0.1060]
[PID: 792][C:\Program Files\Trend\SProtect\StOPP.exe]  [Trend Micro Inc., 5.58.0.1119]
    [C:\Program Files\Trend\SProtect\LogMaster.dll]  [Trend Micro Inc., 5.58.0.1119]
    [C:\Program Files\Trend\SProtect\SpTrace.dll]  [Trend Micro Inc., 5.58.0.1060]
    [C:\Program Files\Trend\SProtect\LogDb.dll]  [Trend Micro Inc., 5.58.0.1119]
    [C:\Program Files\Trend\SProtect\StCommon.dll]  [Trend Micro Inc., 5.58.0.1119]
    [C:\Program Files\Trend\SProtect\GENKEY32.dll]  [Trend Micro Inc., 1, 0, 0, 0]
    [C:\Program Files\Trend\SProtect\GetRemoteVer.dll]  [Trend Micro Inc., 5.58.0.1060]
    [C:\Program Files\Trend\SProtect\CheckEVC.dll]  [Trend Micro Inc., 5.58.0.1060]
    [C:\Program Files\Trend\SProtect\MFC42u.DLL]  [Microsoft Corporation, 6.00.8665.0]
[PID: 816][C:\WINNT\system32\svchost.exe]  [Microsoft Corporation, 5.00.2134.1]
[PID: 836][C:\WINNT\System32\llssrv.exe]  [Microsoft Corporation, 5.00.2195.7021]
[PID: 924][C:\WINNT\system32\MSTask.exe]  [Microsoft Corporation, 4.71.2195.6972]
[PID: 936][C:\WINNT\System32\WBEM\WinMgmt.exe]  [Microsoft Corporation, 1.50.1085.0100]
[PID: 976][C:\WINNT\system32\svchost.exe]  [Microsoft Corporation, 5.00.2134.1]
[PID: 984][C:\WINNT\system32\inetsrv\inetinfo.exe]  [Microsoft Corporation, 5.00.0984]
[PID: 996][C:\WINNT\system32\msdtc.exe]  [Microsoft Corporation, 1999.9.3421.3]
[PID: 1168][C:\WINNT\system32\Dfssvc.exe]  [Microsoft Corporation, 5.00.2195.6664]
[PID: 1288][C:\WINNT\Explorer.EXE]  [Microsoft Corporation, 5.00.3700.6690]
[PID: 1388][C:\WINNT\system32\internat.exe]  [Microsoft Corporation, 5.00.2920.0000]
[PID: 572][C:\WINNT\system32\dllhost.exe]  [Microsoft Corporation, 5.00.2195.6692]
    [C:\WINNT\system32\pdm.dll]  [Microsoft Corporation, 6.00.8424]
    [C:\WINNT\system32\msdbg.dll]  [Microsoft Corporation, 6.00.8424]
    [C:\WINNT\system32\SQLWOA.dll]  [Microsoft Corporation, 1999.10.20]
[PID: 1520][C:\WINNT\system32\dllhost.exe]  [Microsoft Corporation, 5.00.2195.6692]
[PID: 1648][C:\WINNT\system32\mdm.exe]  [Microsoft Corporation, 6.00.8424]
    [C:\WINNT\system32\msdbg.dll]  [Microsoft Corporation, 6.00.8424]
[PID: 1392][C:\WINNT\System32\svchost.exe]  [Microsoft Corporation, 5.00.2134.1]
    [C:\WINNT\System32\unimdm.tsp]  [Microsoft Corporation, 5.00.2195.6601]
    [C:\WINNT\System32\kmddsp.tsp]  [Microsoft Corporation, 5.00.2150.1]
    [C:\WINNT\System32\ndptsp.tsp]  [Microsoft Corporation, 5.00.2143.1]
    [C:\WINNT\System32\ipconf.tsp]  [Microsoft Corporation, 5.00.2143.1]
[PID: 9744][C:\Documents and Settings\Administrator\桌面\sreng2\SREngPS.EXE]  [Smallfrogs Studio, 2.5.16.900]
    [C:\Documents and Settings\Administrator\桌面\sreng2\Upload\3rdUpd.DLL]  [Smallfrogs Studio, 2, 1, 0, 15]

==================================
文件关联
.TXT  OK. [%SystemRoot%\system32\NOTEPAD.EXE %1]
.EXE  OK. ["%1" %*]
.COM  OK. ["%1" %*]
.PIF  OK. ["%1" %*]
.REG  OK. [regedit.exe "%1"]
.BAT  OK. ["%1" %*]
.SCR  OK. ["%1" /S]
.CHM  OK. ["C:\WINNT\hh.exe" %1]
.HLP  OK. [%SystemRoot%\System32\winhlp32.exe %1]
.INI  OK. [%SystemRoot%\System32\NOTEPAD.EXE %1]
.INF  OK. [%SystemRoot%\System32\NOTEPAD.EXE %1]
.VBS  OK. [%SystemRoot%\System32\WScript.exe "%1" %*]
.JS  OK. [%SystemRoot%\System32\WScript.exe "%1" %*]
.LNK  OK. [{00021401-0000-0000-C000-000000000046}]

==================================
Winsock 提供者
N/A

==================================
Autorun.inf
N/A

==================================
HOSTS 文件
127.0.0.1      localhost

==================================
进程特权扫描
特殊特权被允许： SeLoadDriverPrivilege [PID = 816, C:\WINNT\SYSTEM32\SVCHOST.EXE]
特殊特权被允许： SeLoadDriverPrivilege [PID = 936, C:\WINNT\SYSTEM32\WBEM\WINMGMT.EXE]
特殊特权被允许： SeLoadDriverPrivilege [PID = 976, C:\WINNT\SYSTEM32\SVCHOST.EXE]
特殊特权被允许： SeLoadDriverPrivilege [PID = 984, C:\WINNT\SYSTEM32\INETSRV\INETINFO.EXE]
特殊特权被允许： SeLoadDriverPrivilege [PID = 996, C:\WINNT\SYSTEM32\MSDTC.EXE]
特殊特权被允许： SeLoadDriverPrivilege [PID = 1168, C:\WINNT\SYSTEM32\DFSSVC.EXE]
特殊特权被允许： SeLoadDriverPrivilege [PID = 1288, C:\WINNT\EXPLORER.EXE]
特殊特权被允许： SeLoadDriverPrivilege [PID = 1388, C:\WINNT\SYSTEM32\INTERNAT.EXE]
特殊特权被允许： SeLoadDriverPrivilege [PID = 1392, C:\WINNT\SYSTEM32\SVCHOST.EXE]

==================================
API HOOK
N/A

==================================
隐藏进程
N/A

==================================


[/CODE]
要病毒文件的流邮箱