2006-08-05,20:54:33

System Repair Engineer 2.0.21.505 (2.0 RC 2)
Smallfrogs (http://www.KZTechs.com)

Windows XP Professional Service Pack 2 (Build 2600)
- 管理权限用户 - 完整功能

以下内容被选中：
    所有的启动项目（包括注册表、启动文件夹、服务等）
    浏览器加载项
    正在运行的进程（包括进程模块信息）
    文件关联


启动项目
注册表
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
    <ctfmon.exe><C:\WINDOWS\system32\ctfmon.exe>  [Microsoft Corporation]
    <bgswitch><C:\WINDOWS\system32\bgswitch.exe>  []
    <WDSHOOK><C:\WINDOWS\XXXStarter.exe>  []
    <KavPFW><"D:\KPFW32.EXE">  [Kingsoft Corporation]
    <NetCounter><c:\Program Files\NetCounter\NetCount.exe>  []
    <msnnt><C:\WINDOWS\Updateb.exe>  []
[HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows]
    <load><C:\WINDOWS\system\c44i38e.exe>  []
    <run><>  []
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
    <IMJPMIG8.1><"C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32>  [Microsoft Corporation]
    <PHIME2002ASync><C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC>  [Microsoft Corporation]
    <PHIME2002A><C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName>  [Microsoft Corporation]
    <NvCplDaemon><RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup>  [NVIDIA Corporation]
    <NvMediaCenter><RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit>  [NVIDIA Corporation]
    <Thunder><C:\Thunder\Thunder.exe /s>  [Thunder Networking Technologies,LTD]
    <sysmini><C:\WINDOWS\system32\sysmini.exe>  []
    <YLive.exe><C:\PROGRA~1\Yahoo!\ASSIST~1\YLive.exe>  [ ]
    <CnsMin><Rundll32.exe C:\WINDOWS\DOWNLO~1\CnsMin.dll,Rundll32>  [北京三七二一科技有限公司]
    <yassistse><"C:\PROGRA~1\Yahoo!\Assistant\yassistse.exe">  [Yahoo!]
    <bgoomain.exe><C:\PROGRA~1\baigoo\bgoomain.exe>  [BGoo]
    <KavStart><"D:\KAVStart.exe" -startup>  [Kingsoft Corporation]
    <LetsCool><C:\Program Files\LetsCool\LetsCool.exe>  []
    <MSService_v1.0><C:\WINDOWS\system\realsched.exe>  []
    <spoolsv><C:\WINDOWS\system32\spoolsv\spoolsv.exe -printer>  [广州傲讯信息科技有限公司]
    <CdnCtr><C:\Program Files\CNNIC\Cdn\cdnup.exe>  []
    <YOKAssiant><Rundll32.exe C:\PROGRA~1\YOK.com\SUPERS~1\YOK_SuperSearch.dll,YOKAssiant>  [www.YOK.com]
    <MiniPPGou.exe><C:\Program Files\MiniPPGou\MiniPPGou.exe>  []
    <helper.dll><C:\WINDOWS\system32\rundll32.exe C:\PROGRA~1\3721\helper.dll,Rundll32>  []
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
    <shell><Explorer.exe>  [Microsoft Corporation]
    <Userinit><C:\WINDOWS\system32\userinit.exe,C:\WINDOWS\system32\mouser.exe>  []
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Windows]
    <AppInit_DLLs><>  []
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
    <UIHost><logonui.exe>  [Microsoft Corporation]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
    <{D157330A-9EF3-49F8-9A67-4141AC41ADD4}><C:\WINDOWS\DOWNLO~1\CnsHook.dll>  [北京三七二一科技有限公司]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
    <DelayRun><C:\WINDOWS\system32\c44d38e0.dll>  []
    <Vision><C:\PROGRA~1\MMSASS~1\Mmsass~1.dll>  []

==================================
启动文件夹
[IE-Bar]
  <C:\Documents and Settings\All Users\「开始」菜单\程序\启动\IE-Bar.lnk><N>
[腾讯QQ]
  <C:\Documents and Settings\administor\「开始」菜单\程序\启动\腾讯QQ.lnk><N>

http://forum.ikaka.com/topic.asp?board=28&artid=8105899
下HijackThis
帖日志上来

日志没法全

【回复“合合美美”的帖子】
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
<WDSHOOK><C:\WINDOWS\XXXStarter.exe> []
<NetCounter><c:\Program Files\NetCounter\NetCount.exe> []
<msnnt><C:\WINDOWS\Updateb.exe> []
[HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows]
<load><C:\WINDOWS\system\c44i38e.exe> []
<run><> []
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
<sysmini><C:\WINDOWS\system32\sysmini.exe> []
<LetsCool><C:\Program Files\LetsCool\LetsCool.exe> []
<MSService_v1.0><C:\WINDOWS\system\realsched.exe> []
<spoolsv><C:\WINDOWS\system32\spoolsv\spoolsv.exe -printer> [广州傲讯信息科技有限公司]
<CdnCtr><C:\Program Files\CNNIC\Cdn\cdnup.exe> []
<YOKAssiant><Rundll32.exe C:\PROGRA~1\YOK.com\SUPERS~1\YOK_SuperSearch.dll,YOKAssiant> [www.YOK.com]
<MiniPPGou.exe><C:\Program Files\MiniPPGou\MiniPPGou.exe> []
<helper.dll><C:\WINDOWS\system32\rundll32.exe C:\PROGRA~1\3721\helper.dll,Rundll32> []
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
<Userinit><C:\WINDOWS\system32\userinit.exe,C:\WINDOWS\system32\mouser.exe> []
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
<DelayRun><C:\WINDOWS\system32\c44d38e0.dll> []
<Vision><C:\PROGRA~1\MMSASS~1\Mmsass~1.dll> []

流氓、木马——大杂烩。
如果我遇到这样的系统——系统还原，或用GHOST备份回复系统。