[CODE]

2007-05-17,11:47:56

System Repair Engineer 2.4.12.806
Smallfrogs (http://www.KZTechs.com)

Windows XP Professional Service Pack 1 (Build 2600) - 管理权限用户 - 完整功能

以下内容被选中：
    所有的启动项目（包括注册表、启动文件夹、服务等）
    浏览器加载项
    正在运行的进程（包括进程模块信息）
    文件关联
    Winsock 提供者
    Autorun.inf
    HOSTS 文件


启动项目
注册表
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
    <ctfmon.exe><C:\WINDOWS\System32\ctfmon.exe>  [(Verified)Microsoft Windows XP Publisher]
    <MSMSGS><; "C:\Program Files\Messenger\MSMSGS.EXE" /background>  [(Verified)Microsoft Corporation]
    <STYLEXP><; C:\Program Files\TGTSoft\StyleXP\StyleXP.exe -Hide>  []
[HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows]
    <load><>  [N/A]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
    <PHIME2002ASync><C:\WINDOWS\System32\IME\TINTLGNT\TINTSETP.EXE /SYNC>  [(Verified)Microsoft Windows XP Publisher]
    <PHIME2002A><C:\WINDOWS\System32\IME\TINTLGNT\TINTSETP.EXE /IMEName>  [(Verified)Microsoft Windows XP Publisher]
    <IgfxTray><C:\WINDOWS\System32\igfxtray.exe>  [(Verified)Microsoft Windows Hardware Compatibility Publisher]
    <HotKeysCmds><C:\WINDOWS\System32\hkcmd.exe>  [(Verified)Microsoft Windows Hardware Compatibility Publisher]
    <OrderReminder><C:\Program Files\Hewlett-Packard\OrderReminder\OrderReminder.exe>  [Hewlett-Packard]
    <paTray><"C:\Program Files\AhnLab\APC2\Policy Agent\patray.exe">  []
    <AHNSD><"C:\Program Files\AhnLab\Smart Update Utility\AhnSD.exe">  [(Verified)AhnLab Inc.]
    <IMJPMIG8.1><; "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32>  [(Verified)Microsoft Windows XP Publisher]
    <MpAgent><; C:\Program Files\Zarvasoft\Policy Center\Policy Agent\MaDmon.exe>  [Ahnlab, Inc.]
    <RemoteControl><; C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe>  [Cyberlink Corp.]
    <SoundMan><; SOUNDMAN.EXE>  [(Verified)Microsoft Windows Hardware Compatibility Publisher]
    <Super Rabbit SRRestore><; C:\PROGRA~1\SUPERR~1\MAGICSET\SRRest.exe /FIRST>  [N/A]
    <SysHotKey_DFDD><; C:\Program Files\Common Files\!SUNV\GraspWord\SysHotKey.exe>  [N/A]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
    <shell><Explorer.exe>  [(Verified)Microsoft Windows XP Publisher]
    <Userinit><C:\WINDOWS\system32\userinit.exe,>  [(Verified)Microsoft Windows XP Publisher]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Windows]
    <AppInit_DLLs><>  [N/A]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
    <UIHost><C:\Program Files\TGTSoft\StyleXP\CurrentLogon.EXE>  []
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\WgaLogon]
    <WinlogonNotify: WgaLogon><WgaLogon.dll>  [(Verified)Microsoft Corporation]
[HKEY_CURRENT_USER\Control Panel\Desktop]
    <SCRNSAVE.EXE><C:\WINDOWS\System32\EARTH3~1.SCR>  []

==================================
启动文件夹
N/A

==================================
服务
[AhnLab Task Scheduler / AhnLab Task Scheduler][Running/Auto Start]
  <"C:\Program Files\AhnLab\Smart Update Utility\AhnSDsv.exe"><AhnLab, Inc.>
[Diskeeper / Diskeeper][Running/Auto Start]
  <C:\Program Files\Executive Software\Diskeeper\DkService.exe><Executive Software International, Inc.>
[Human Interface Device Access / HidServ][Stopped/Disabled]
  <C:\WINDOWS\System32\svchost.exe -k netsvcs-->%SystemRoot%\System32\hidserv.dll><N/A>
[Messenger / Messenger][Stopped/Boot Start]
  <\SystemRoot\C:\WINDOWS\System32\svchost.exe -k netsvcs-->%SystemRoot%\System32\msgsvc.dll><Microsoft Corporation>
[MonSvcNT / MonSvcNT][Running/Auto Start]
  <C:\PROGRA~1\AhnLab\V3\MonSvcNT.exe><AhnLab, Inc.>
[Policy Agent Service V2.5 / paSvc][Running/Auto Start]
  <"C:\Program Files\AhnLab\APC2\Policy Agent\pasvc.exe"><AhnLab, Inc.>
[StyleXPService / StyleXPService][Running/Auto Start]
  <"C:\Program Files\TGTSoft\StyleXP\StyleXPService.exe"><>
[Portable Media Serial Number Service / WmdmPmSN][Stopped/Manual Start]
  <C:\WINDOWS\System32\svchost.exe -k netsvcs-->C:\WINDOWS\System32\mspmsnsv.dll><Microsoft Corporation>

==================================
驱动程序
[AhnFlt2K / AhnFlt2K][Running/Manual Start]
  <\??\C:\WINDOWS\System32\Drivers\AhnFlt2K.sys><AhnLab, Inc.>
[AhnRec2K / AhnRec2K][Running/Manual Start]
  <\??\C:\WINDOWS\System32\Drivers\AhnRec2K.sys><AhnLab, Inc.>
[Service for WDM 3D Audio Driver / ALCXSENS][Running/Manual Start]
  <system32\drivers\ALCXSENS.SYS><Sensaura>
[Service for Realtek AC97 Audio (WDM) / ALCXWDM][Running/Manual Start]
  <system32\drivers\ALCXWDM.SYS><Realtek Semiconductor Corp.>
[AnfdIont / AnfdIont][Running/Auto Start]
  <\??\C:\WINDOWS\System32\drivers\AnfdIont.sys><AhnLab, Inc.>
[AnfdTDnt / AnfdTDnt][Running/System Start]
  <\??\C:\WINDOWS\System32\drivers\AnfdTDnt.sys><AhnLab, Inc.>
[ApfIPXX / ApfIPXX][Stopped/Manual Start]
  <\??\C:\PROGRA~1\AhnLab\V3\ApfIPXX.sys><AhnLab, Inc.>
[HOSTNT / HOSTNT][Running/Auto Start]
  <\??\C:\WINDOWS\System32\drivers\hostnt.sys><N/A>
[ialm / ialm][Running/Manual Start]
  <System32\DRIVERS\ialmnt5.sys><Intel Corporation>
[IdeBusDr / IdeBusDr][Running/Boot Start]
  <\SystemRoot\System32\DRIVERS\IdeBusDr.sys><Intel Corporation>
[Intel(R) Ultra ATA Controller / IdeChnDr][Running/Boot Start]
  <\SystemRoot\System32\DRIVERS\IdeChnDr.sys><Intel Corporation>
[MHDRV / MHDRV][Running/Auto Start]
  <\??\C:\WINDOWS\System32\drivers\mhdrv.sys><SafeNet China Ltd.>
[Direct Parallel Link Driver / Ptilink][Running/Manual Start]
  <System32\DRIVERS\ptilink.sys><Parallel Technologies, Inc.>
[RCMHDOG / RCMHDOG][Running/Auto Start]
  <\??\C:\WINDOWS\System32\drivers\rcmhdog.sys><SafeNet China Ltd.>
[Realtek RTL8139(A/B/C)-based PCI Fast Ethernet Adapter NT Driver / rtl8139][Running/Manual Start]
  <System32\DRIVERS\RTL8139.SYS><Realtek Semiconductor Corporation>
[Secdrv / Secdrv][Stopped/Manual Start]
  <System32\DRIVERS\secdrv.sys><N/A>
[Sony USB Filter Driver (SONYPVU1) / SONYPVU1][Stopped/Manual Start]
  <System32\DRIVERS\SONYPVU1.SYS><Sony Corporation>
[StyleXPHelper / StyleXPHelper][Running/System Start]
  <\??\C:\Program Files\TGTSoft\StyleXP\StyleXPHelper.exe><Windows (R) 2000 DDK provider>
[v3engine / v3engine][Running/Manual Start]
  <\??\C:\WINDOWS\System32\drivers\v3engine.sys><AhnLab, Inc.>
[V3Flt2K / V3Flt2K][Running/Manual Start]
  <\??\C:\PROGRA~1\AhnLab\V3\V3Flt2K.sys><AhnLab, Inc.>
[V3IFt2K / V3IFt2K][Running/Manual Start]
  <\??\C:\PROGRA~1\AhnLab\V3\V3IFt2K.sys><AhnLab, Inc.>
[V3IPXX / V3IPXX][Stopped/Manual Start]
  <\??\C:\PROGRA~1\AhnLab\V3\V3IPXX.sys><AhnLab, Inc.>
[V3NfeNt / V3NfeNt][Running/Auto Start]
  <\??\C:\Program Files\AhnLab\V3\V3NfeNt.sys><AhnLab, Inc.>
[xmasbus / xmasbus][Running/Boot Start]
  <\SystemRoot\System32\DRIVERS\xmasbus.sys><>
[xmasscsi / xmasscsi][Running/Boot Start]
  <\SystemRoot\System32\Drivers\xmasscsi.sys><>

==================================
浏览器加载项
[联想]
  {6096E38F-5AC1-4391-8EC4-75DFA92FB32F} <http://www.lenovo.com, N/A>
[@shdoclc.dll,-866]
  {c95fe080-8f5d-11d2-a20b-00aa003c157a} <, N/A>
[Messenger]
  {FB5F1910-F110-11d2-BB9E-00C04F795683} <C:\Program Files\Messenger\MSMSGS.EXE, Microsoft Corporation>
[V3]
  {9E3849D6-41EF-4B2F-86B7-632EF90758E4} <"C:\Program Files\AhnLab\V3\V3Bar.dll", N/A>
[Office Update Installation Engine]
  {3E68E405-C6DE-49FF-83AE-41EE9F4C36CE} <C:\WINDOWS\opuc.dll, Microsoft Corporation>
[MUWebControl Class]
  {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} <C:\WINDOWS\System32\muweb.dll, Microsoft Corporation>
[Shockwave Flash Object]
  {D27CDB6E-AE6D-11CF-96B8-444553540000} <C:\WINDOWS\System32\macromed\flash\Flash.ocx, Macromedia, Inc.>
[导出到 Microsoft Excel(&x)]
  <res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000, N/A>

正在运行的进程
[PID: 472][\SystemRoot\System32\smss.exe]  [Microsoft Corporation, 5.1.2600.1106 (xpsp1.020828-1920)]
[PID: 528][\??\C:\WINDOWS\system32\csrss.exe]  [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)]
[PID: 560][\??\C:\WINDOWS\system32\winlogon.exe]  [Microsoft Corporation, 5.1.2600.1106 (xpsp1.020828-1920)]
    [C:\WINDOWS\system32\WgaLogon.dll]  [Microsoft Corporation, 1.7.0018.5]
    [C:\WINDOWS\system32\wdmaud.drv]  [Microsoft Corporation, 5.1.2600.0 (XPClient.010817-1148)]
    [C:\WINDOWS\system32\msacm32.drv]  [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)]
[PID: 1264][C:\WINDOWS\Explorer.EXE]  [Microsoft Corporation, 6.00.2800.1106 (xpsp1.020828-1920)]
    [C:\WINDOWS\System32\wdmaud.drv]  [Microsoft Corporation, 5.1.2600.0 (XPClient.010817-1148)]
    [C:\WINDOWS\System32\msacm32.drv]  [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)]
    [C:\Program Files\AhnLab\V3\V3Bar.dll]  [AhnLab, Inc., 6, 0, 0, 23]
    [C:\Program Files\AhnLab\V3\NLS\bar0804.nls]  [AhnLab, Inc., 6, 0, 0, 7]
    [C:\WINDOWS\System32\igfxpph.dll]  [Intel Corporation, 3.0.0.3762]
    [C:\WINDOWS\System32\hccutils.DLL]  [Intel Corporation, 3.0.0.3762]
    [C:\WINDOWS\System32\igfxres.dll]  [Intel Corporation, 3.0.0.3762]
    [C:\WINDOWS\System32\igfxsrvc.dll]  [Intel Corporation, 3.0.0.3762]
    [C:\WINDOWS\System32\igfxdev.dll]  [Intel Corporation, 3.0.0.3762]
    [C:\Program Files\Microsoft Office\Office10\msohev.dll]  [Microsoft Corporation, 10.0.2609]
    [C:\Program Files\WinRAR\rarext.dll]  [N/A, ]
    [C:\Program Files\AhnLab\V3\V3ShllEx.dll]  [AhnLab, Inc., 6, 0, 0, 13]
    [C:\Program Files\AhnLab\V3\NLS\V3SH0804.nls]  [AhnLab, Inc., 6, 0, 0, 7]
    [C:\Program Files\EmEditor\EMEDSHL.DLL]  [N/A, ]
[PID: 1428][C:\WINDOWS\System32\hkcmd.exe]  [Intel Corporation, 3.0.0.3762]
    [C:\WINDOWS\System32\hccutils.DLL]  [Intel Corporation, 3.0.0.3762]
    [C:\WINDOWS\System32\igfxdev.dll]  [Intel Corporation, 3.0.0.3762]
    [C:\WINDOWS\System32\igfxsrvc.dll]  [Intel Corporation, 3.0.0.3762]
    [C:\WINDOWS\System32\igfxres.dll]  [Intel Corporation, 3.0.0.3762]
    [C:\WINDOWS\System32\igfxhk.dll]  [Intel Corporation, 3.0.0.3762]
[PID: 1448][C:\Program Files\Hewlett-Packard\OrderReminder\OrderReminder.exe]  [Hewlett-Packard, 2, 0, 1, 26]
[PID: 1456][C:\Program Files\AhnLab\APC2\Policy Agent\patray.exe]  [, 2, 5, 0, 9]
    [C:\Program Files\AhnLab\APC2\Policy Agent\AhnInst.dll]  [AhnLab, Inc., 6, 0, 0, 52]
    [C:\Program Files\AhnLab\APC2\Policy Agent\MaCfgRw.dll]  [AhnLab, 2, 5, 5, 11]
    [C:\Program Files\AhnLab\APC2\Policy Agent\IniRW.dll]  [AhnLab, 2, 1, 0, 0]
    [C:\Program Files\AhnLab\APC2\Policy Agent\MSVCP60.dll]  [Microsoft Corporation, 6.00.8168.0]
    [C:\Program Files\AhnLab\APC2\Policy Agent\SBase64.dll]  [AhnLab, 2, 1, 0, 0]
    [C:\Program Files\AhnLab\APC2\Policy Agent\SLogW.dll]  [AhnLab, 2, 1, 0, 0]
    [C:\Program Files\AhnLab\APC2\Policy Agent\SSync.dll]  [AhnLab, 2, 1, 0, 0]
    [C:\Program Files\AhnLab\APC2\Policy Agent\AhnI18N.dll]  [AhnLab, Inc., 6, 0, 0, 18]
    [C:\Program Files\AhnLab\APC2\Policy Agent\MFC42.DLL]  [Microsoft Corporation, 6.00.8665.0]
    [C:\Program Files\AhnLab\APC2\Policy Agent\NLS\MTRY0804.nls]  [, 2, 0, 0, 2]
[PID: 1468][C:\Program Files\AhnLab\Smart Update Utility\AhnSD.exe]  [AhnLab, Inc., 5, 5, 0, 7]
    [C:\Program Files\AhnLab\Smart Update Utility\NLS\ASD0804.nls]  [AhnLab, Inc., 5, 0, 0, 6]
[PID: 1480][C:\WINDOWS\System32\ctfmon.exe]  [Microsoft Corporation, 5.1.2600.1106 (xpsp1.020828-1920)]
[PID: 1500][C:\Program Files\Messenger\MSMSGS.EXE]  [Microsoft Corporation, 4.7.2010]
    [C:\Program Files\Messenger\MSGSLANG.DLL]  [Microsoft Corporation, 4.7.2009]
    [C:\PROGRA~1\MESSEN~1\rtcimsp.dll]  [Microsoft Corporation, 4.0.3599.0 (Lab02_N(ntvbl02).020107-1351)]
    [C:\WINDOWS\System32\wdmaud.drv]  [Microsoft Corporation, 5.1.2600.0 (XPClient.010817-1148)]
    [C:\WINDOWS\System32\msacm32.drv]  [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)]
    [C:\WINDOWS\System32\msdmo.dll]  [, ]
[PID: 1680][C:\Program Files\AhnLab\V3\MonSysNT.exe]  [AhnLab, Inc., 6, 1, 0, 91]
    [C:\Program Files\AhnLab\V3\V3CfgE.dll]  [AhnLab, Inc., 6, 0, 0, 96]
    [C:\Program Files\AhnLab\V3\MSVCP60.dll]  [Microsoft Corporation, 6.00.8972.0]
    [C:\Program Files\AhnLab\V3\V3SSCtrl.dll]  [AhnLab, Inc., 6, 0, 0, 100]
    [C:\Program Files\AhnLab\V3\AhnI18N.dll]  [AhnLab, Inc., 6, 0, 0, 18]
    [C:\Program Files\AhnLab\V3\MFC42.DLL]  [Microsoft Corporation, 6.00.8665.0]
    [C:\Program Files\AhnLab\V3\NLS\Mon0804.nls]  [AhnLab, Inc., 6, 0, 0, 26]
    [C:\Program Files\AhnLab\V3\AhnAlert.dll]  [AhnLab, Inc., 6, 0, 0, 17]
[PID: 1692][C:\Program Files\AhnLab\V3\V3P3AT.exe]  [AhnLab, Inc., 6, 1, 0, 201]
    [C:\Program Files\AhnLab\V3\v3if.dll]  [AhnLab, Inc., 6, 1, 0, 3]
    [C:\Program Files\AhnLab\V3\V3CfgE.dll]  [AhnLab, Inc., 6, 0, 0, 96]
    [C:\Program Files\AhnLab\V3\MSVCP60.dll]  [Microsoft Corporation, 6.00.8972.0]
    [C:\Program Files\AhnLab\V3\V3DrEx.dll]  [AhnLab, Inc., 7, 0, 0, 112]
    [C:\Program Files\AhnLab\V3\V3P3ATHL.dll]  [AhnLab, Inc., 6, 0, 0, 23]
    [C:\Program Files\AhnLab\V3\AhnI18N.dll]  [AhnLab, Inc., 6, 0, 0, 18]
    [C:\Program Files\AhnLab\V3\V3MsgFlt.dll]  [AhnLab, Inc., 6, 0, 0, 63]
    [C:\Program Files\AhnLab\V3\MFC42.DLL]  [Microsoft Corporation, 6.00.8665.0]
    [C:\Program Files\AhnLab\V3\V3NfCtl.dll]  [AhnLab, Inc., 6, 0, 0, 3]
    [C:\Program Files\AhnLab\V3\AnfdCtrl.dll]  [AhnLab, Inc., 2, 0, 0, 12]
    [C:\Program Files\AhnLab\V3\AhnCtlKD.dll]  [AhnLab, Inc., 1, 0, 1, 7]
    [C:\Program Files\AhnLab\V3\AhnIConv.dll]  [AhnLab, Inc., 1, 0, 0, 1]
    [C:\Program Files\AhnLab\V3\NLS\V3Dr0804.nls]  [AhnLab, Inc., 7, 0, 0, 8]
    [C:\Program Files\AhnLab\V3\NLS\V3MF0804.nls]  [AhnLab, Inc., 6, 0, 0, 8]
    [C:\Program Files\AhnLab\V3\v3logex.dll]  [AhnLab, Inc., 6, 1, 0, 2]
    [C:\Program Files\AhnLab\V3\NLS\p3at0804.nls]  [AhnLab, Inc., 6, 0, 0, 14]
    [C:\Program Files\AhnLab\V3\System\4\V3pro32e.dll]  [AhnLab, Inc., 2007,05,16,01]
    [C:\WINDOWS\System32\v3w32se2.dll]  [Ahnlab, Inc., 2002, 12, 16, 1]
    [C:\Program Files\AhnLab\V3\V3SR32.dll]  [AhnLab, Inc., 5, 0, 0, 2]
    [C:\Program Files\AhnLab\V3\V3azex.dll]  [AhnLab, Inc., 5, 0, 0, 14]
    [C:\Program Files\AhnLab\V3\AZMain.DLL]  [ESTSoft Corp, 3.6.9.543]
    [C:\Program Files\AhnLab\V3\V3MailDt.dll]  [AhnLab, Inc., 6, 0, 0, 91]
[PID: 1956][C:\WINDOWS\System32\WgaTray.exe]  [Microsoft Corporation, 1.7.0018.5]
[PID: 3692][C:\PROGRA~1\AhnLab\V3\V3IMPro.exe]  [AhnLab, Inc., 6, 0, 0, 33]
    [C:\PROGRA~1\AhnLab\V3\V3IM.dll]  [AhnLab, Inc., 6, 0, 0, 47]
    [C:\PROGRA~1\AhnLab\V3\V3Ift.dll]  [AhnLab, Inc., 6, 0, 0, 5]
    [C:\PROGRA~1\AhnLab\V3\AhnCtlKD.dll]  [AhnLab, Inc., 1, 0, 1, 7]
    [C:\PROGRA~1\AhnLab\V3\NLS\V3IM0804.nls]  [AhnLab, Inc., 6, 0, 0, 8]
    [C:\PROGRA~1\AhnLab\V3\V3CfgE.dll]  [AhnLab, Inc., 6, 0, 0, 96]
    [C:\PROGRA~1\AhnLab\V3\MSVCP60.dll]  [Microsoft Corporation, 6.00.8972.0]
[PID: 2296][C:\Program Files\WinRAR\WinRAR.exe]  [Eugene Roshal, 3.30]
[PID: 2292][C:\Program Files\WinRAR\WinRAR.exe]  [Eugene Roshal, 3.30]
[PID: 2332][C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\Rar$EX03.203\SREng.EXE]  [Smallfrogs Studio, 2.4.12.806]

==================================
文件关联
.TXT  OK. [%SystemRoot%\system32\NOTEPAD.EXE %1]
.EXE  OK. ["%1" %*]
.COM  OK. ["%1" %*]
.PIF  OK. ["%1" %*]
.REG  OK. [regedit.exe "%1"]
.BAT  OK. ["%1" %*]
.SCR  OK. ["%1" /S]
.CHM  OK. ["C:\WINDOWS\hh.exe" %1]
.HLP  OK. [%SystemRoot%\system32\winhlp32.exe %1]
.INI  OK. [%SystemRoot%\system32\NOTEPAD.EXE %1]
.INF  OK. [%SystemRoot%\system32\NOTEPAD.EXE %1]
.VBS  OK. [%SystemRoot%\System32\WScript.exe "%1" %*]
.JS  OK. [%SystemRoot%\System32\WScript.exe "%1" %*]
.LNK  OK. [{00021401-0000-0000-C000-000000000046}]

==================================
Winsock 提供者
N/A

==================================
Autorun.inf
N/A

==================================
HOSTS 文件
127.0.0.1      localhost

==================================
API HOOK
N/A

==================================
隐藏进程
N/A

==================================


[/CODE]

注册表值UIHOST被修改为非正常值（默认值是logonui.exe)
系统登陆界面。。。。。