瑞星卡卡电脑诊断日志 v1.30 (2008-6-16 22:8:21)  北京瑞星科技股份有限公司

注释:	[A]表示该文件存在自启动关联;
	[M]表示该文件在内存中;

+ 注册表自运行项目 
  + 系统服务
    + HKLM\System\CurrentControlSet\Services
      AVG Anti-Spyware Guard
        [AM] 1. d:\查杀\avg anti-spyware\guard.exe


      gusvc
        [A ] 2. c:\program files\google\common\google updater\googleupdaterservice.exe


      RfwProxySrv
        [AM] 3. d:\program files\rising\rising\rfw\rfwproxy.exe


      RfwService
        [AM] 4. d:\program files\rising\rising\rfw\rfwsrv.exe


      RsCCenter
        [AM] 5. d:\program files\rising\rising\ccenter.exe


      RsRavMon
        [AM] 6. d:\program files\rising\rising\ravmond.exe




  + 内核驱动
    + HKLM\System\CurrentControlSet\Services
      0006360f
        [A ] 7. c:\windows\system32\drivers\0006360f.sys


      ALCXWDM
        [A ] 8. c:\windows\system32\drivers\alcxwdm.sys


      AVG Anti-Spyware Driver
        [A ] 9. d:\查杀\avg anti-spyware\guard.sys


      AvgAsCln
        [A ] 10. c:\windows\system32\drivers\avgascln.sys


      BaseTDI
        [A ] 11. c:\windows\system32\drivers\basetdi.sys


      CDGscsi
        [A ] 12. c:\windows\system32\drivers\cdgscsi.sys


      cmuda
        [A ] 13. c:\windows\system32\drivers\cmuda.sys


      CnxEtP
        [A ] 14. c:\windows\system32\drivers\cnxetp.sys


      CnxEtU
        [A ] 15. c:\windows\system32\drivers\cnxetu.sys


      CnxTgNW
        [A ] 16. c:\windows\system32\drivers\cnxtgnw.sys


      HookCont
        [A ] 17. c:\windows\system32\drivers\hookcont.sys


      HookNtos
        [A ] 18. c:\windows\system32\drivers\hookntos.sys


      HookReg
        [A ] 19. c:\windows\system32\drivers\hookreg.sys


      HookSys
        [A ] 20. c:\windows\system32\drivers\hooksys.sys


      HookUrl
        [A ] 21. d:\program files\rising\rising\rfw\hookurl.sys


      KAVSafe
        [A ] 22. c:\windows\system32\drivers\kavsafe.sys


      kmsinput
        [A ] 23. c:\windows\system32\drivers\kmsinput.sys


      npkcrypt
        [A ] 24. d:\program files\聊天工具\qq2005\npkcrypt.sys


      RfwBase
        [A ] 25. c:\windows\system32\drivers\rfwbase.sys


      RsAntiSpyware
        [A ] 26. c:\windows\system32\drivers\rsboot.sys


      RsFwDrv
        [A ] 27. d:\program files\rising\rising\rfw\rsfwdrv.sys


      RsNTGDI
        [A ] 28. c:\windows\system32\drivers\rsntgdi.sys


      Secdrv
        [A ] 29. c:\windows\system32\drivers\secdrv.sys




  + IE浏览器加载模块
    + HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar
      {DB9ECD4F-FB8F-4311-B3CE-90B976C2707C}
        [A ] 30. c:\windows\system32\kakatool.dll



    + HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects
      {01443AEC-0FD1-40fd-9C87-E93D1494C233}
        [A ] 31. d:\program files\迅雷\comdlls\tdatonce_now.dll


      {889D2FEB-5411-4565-8998-1DD2C5261283}
        [A ] 32. d:\program files\迅雷\comdlls\xunleibho_now.dll



    + HKLM\SOFTWARE\Microsoft\Internet Explorer\Extensions
      Exec
        [A ] 33. d:\program files\迅雷\thunder.exe




  + 资源管理器加载模块
    + HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved
      HyperTerminal Icon Ext
        [A ] 34. c:\windows\system32\hticons.dll


      WinRAR shell extension
        [A ] 35. d:\应用软件\winrar\rarext.dll


      Microsoft Outlook Custom Icon Handler
        [A ] 36. c:\program files\microsoft office\office\olkfstub.dll


      Shell Extensions for RealOne Player
        [A ] 37. c:\program files\real\realplayer\rpshell.dll


      RISING
        [A ] 38. c:\windows\system32\ravext.dll



    + HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks
      {32CD708B-60A7-4C00-9377-D73EAA495F0F}
        [A ] 38. c:\windows\system32\ravext.dll


      {AC2DC2EF-5165-40A3-8CDF-41DCA1B0901A}
        [A ] 39. c:\windows\system32\shlhook.dll




  + 用户登陆自运行项目
    + HKLM\Software\Microsoft\Windows\CurrentVersion\Run
      RfwMain
        [AM] 40. d:\program files\rising\rising\rfw\rfwmain.exe


      RavTask
        [AM] 41. d:\program files\rising\rising\ravtask.exe




  + 开机执行
    + HKLM\SYSTEM\CurrentControlSet\Control\NetworkProvider\Order
      BootExecute
        [A ] 42. c:\windows\system32\bsmain.exe

        [A ] 43. c:\windows\system32\kknative.exe




  + 映像劫持
    + HKCR\.html
      htmlfile\Edit\Command
        [A ] 44. c:\program files\microsoft office\office\msohtmed.exe


      htmlfile\Print\Command
        [A ] 44. c:\program files\microsoft office\office\msohtmed.exe



    + HKCR\.htm
      htmlfile\Edit\Command
        [A ] 44. c:\program files\microsoft office\office\msohtmed.exe


      htmlfile\Print\Command
        [A ] 44. c:\program files\microsoft office\office\msohtmed.exe





+ 正在运行的进程
  + 0000014c(332) svchost.exe

  + 00000174(372) smss.exe

  + 000001cc(460) csrss.exe
    70000000[00019000]
      [ M] 45. d:\program files\rising\rising\rfw\ijt_base.dll


    60000000[0000F000]
      [ M] 46. d:\program files\rising\rising\rfw\olemon.dll



  + 000001e4(484) winlogon.exe
    70000000[00019000]
      [ M] 45. d:\program files\rising\rising\rfw\ijt_base.dll


    60000000[0000F000]
      [ M] 46. d:\program files\rising\rising\rfw\olemon.dll


    72C80000[00008000]
      [ M] 47. c:\windows\system32\msacm32.drv



  + 00000210(528) services.exe
    70000000[00019000]
      [ M] 45. d:\program files\rising\rising\rfw\ijt_base.dll


    60000000[0000F000]
      [ M] 46. d:\program files\rising\rising\rfw\olemon.dll



  + 0000021c(540) lsass.exe
    70000000[00019000]
      [ M] 45. d:\program files\rising\rising\rfw\ijt_base.dll


    60000000[0000F000]
      [ M] 46. d:\program files\rising\rising\rfw\olemon.dll



  + 000002a8(680) svchost.exe
    70000000[00019000]
      [ M] 45. d:\program files\rising\rising\rfw\ijt_base.dll


    60000000[0000F000]
      [ M] 46. d:\program files\rising\rising\rfw\olemon.dll



  + 000002d8(728) svchost.exe
    70000000[00019000]
      [ M] 45. d:\program files\rising\rising\rfw\ijt_base.dll


    60000000[0000F000]
      [ M] 46. d:\program files\rising\rising\rfw\olemon.dll



  + 00000300(768) CCenter.exe
    00400000[00029000]
      [AM] 5. d:\program files\rising\rising\ccenter.exe


    70000000[00019000]
      [ M] 45. d:\program files\rising\rising\rfw\ijt_base.dll


    60000000[0000F000]
      [ M] 46. d:\program files\rising\rising\rfw\olemon.dll



  + 00000310(784) svchost.exe
    70000000[00019000]
      [ M] 45. d:\program files\rising\rising\rfw\ijt_base.dll


    60000000[0000F000]
      [ M] 46. d:\program files\rising\rising\rfw\olemon.dll


    50E60000[0000C000]
      [ M] 48. c:\windows\system32\wups2.dll



  + 00000344(836) svchost.exe
    70000000[00019000]
      [ M] 45. d:\program files\rising\rising\rfw\ijt_base.dll


    60000000[0000F000]
      [ M] 46. d:\program files\rising\rising\rfw\olemon.dll



  + 00000394(916) svchost.exe
    70000000[00019000]
      [ M] 45. d:\program files\rising\rising\rfw\ijt_base.dll


    60000000[0000F000]
      [ M] 46. d:\program files\rising\rising\rfw\olemon.dll



  + 0000042c(1068) Explorer.EXE
    70000000[00019000]
      [ M] 45. d:\program files\rising\rising\rfw\ijt_base.dll


    60000000[0000F000]
      [ M] 46. d:\program files\rising\rising\rfw\olemon.dll


    72C80000[00008000]
      [ M] 47. c:\windows\system32\msacm32.drv



  + 0000046c(1132) ravmond.exe
    00400000[00069000]
      [AM] 6. d:\program files\rising\rising\ravmond.exe


    10000000[00042000]
      [ M] 49. d:\program files\rising\rising\bwlist.dll


    7C140000[00103000]
      [ M] 50. c:\windows\system32\mfc71.dll


    7C340000[00056000]
      [ M] 51. c:\windows\system32\msvcr71.dll


    7C3A0000[0007B000]
      [ M] 52. c:\windows\system32\msvcp71.dll


    00B20000[0000E000]
      [ M] 53. d:\program files\rising\rising\rsappmgr.dll


    00B40000[00030000]
      [ M] 54. d:\program files\rising\rising\cfgdll.dll


    00DE0000[00067000]
      [ M] 55. d:\program files\rising\rising\rslog.dll


    00B80000[0001F000]
      [ M] 56. d:\program files\rising\rising\proccom.dll


    00E50000[00024000]
      [ M] 57. d:\program files\rising\rising\rscommx2.dll


    00E90000[00075000]
      [ M] 58. d:\program files\rising\rising\monrule.dll


    00F20000[00013000]
      [ M] 59. d:\program files\rising\rising\hooksys.dll


    70000000[00019000]
      [ M] 45. d:\program files\rising\rising\rfw\ijt_base.dll


    60000000[0000F000]
      [ M] 46. d:\program files\rising\rising\rfw\olemon.dll


    00F80000[00013000]
      [ M] 60. d:\program files\rising\rising\hookreg.dll


    00FE0000[00013000]
      [ M] 61. d:\program files\rising\rising\hookntos.dll


    01180000[0001C000]
      [ M] 62. d:\program files\rising\rising\rswalmon.dll


    01FA0000[00035000]
      [ M] 63. d:\program files\rising\rising\recomp.dll


    01FF0000[00036000]
      [ M] 64. d:\program files\rising\rising\refs.dll


    02040000[00023000]
      [ M] 65. d:\program files\rising\rising\ffr.dll


    02080000[00020000]
      [ M] 66. d:\program files\rising\rising\rsstore.dll


    020B0000[00013000]
      [ M] 67. d:\program files\rising\rising\hookcont.dll


    020E0000[00027000]
      [ M] 68. d:\program files\rising\rising\fakescan.dll


    02120000[00022000]
      [ M] 69. d:\program files\rising\rising\scanner.dll


    02760000[0002F000]
      [ M] 70. d:\program files\rising\rising\viruslib.dll


    028A0000[00028000]
      [ M] 71. d:\program files\rising\rising\relibldr.dll


    02F90000[0000D000]
      [ M] 72. d:\program files\rising\rising\hookweb.dll


    04120000[00021000]
      [ M] 73. d:\program files\rising\rising\nvfile.dll


    13AB0000[0004A000]
      [ M] 74. d:\program files\rising\rising\scanexec.dll


    05A10000[002DC000]
      [ M] 75. d:\program files\rising\rising\unexe.dll


    05D00000[000CD000]
      [ M] 76. d:\program files\rising\rising\scanex.dll


    06150000[00027000]
      [ M] 77. d:\program files\rising\rising\pearc.dll


    04AF0000[000DC000]
      [ M] 78. d:\program files\rising\rising\extfile.dll


    02DE0000[00023000]
      [ M] 79. d:\program files\rising\rising\scansct.dll



  + 0000047c(1148) rfwsrv.exe
    00400000[00037000]
      [AM] 4. d:\program files\rising\rising\rfw\rfwsrv.exe


    7C140000[00103000]
      [ M] 50. c:\windows\system32\mfc71.dll


    7C340000[00056000]
      [ M] 51. c:\windows\system32\msvcr71.dll


    7C3A0000[0007B000]
      [ M] 52. c:\windows\system32\msvcp71.dll


    10000000[0001F000]
      [ M] 80. d:\program files\rising\rising\rfw\proccom.dll


    00770000[00024000]
      [ M] 81. d:\program files\rising\rising\rfw\rscommx2.dll


    009B0000[0000E000]
      [ M] 82. d:\program files\rising\rising\rfw\rsappmgr.dll


    009D0000[00030000]
      [ M] 83. d:\program files\rising\rising\rfw\cfgdll.dll


    00AE0000[0000F000]
      [ M] 84. d:\program files\rising\rising\rfw\rfwrule.dll


    00AF0000[0000C000]
      [ M] 85. d:\program files\rising\rising\rfw\rfwlog.dll


    00B00000[00018000]
      [ M] 86. d:\program files\rising\rising\rfw\rfwdrv.dll


    731B0000[0000A000]
      [ M] 87. d:\program files\rising\rising\rfw\psapi.dll


    00C20000[0000E000]
      [ M] 88. d:\program files\rising\rising\rfw\ijt_ctrl.dll


    70000000[00019000]
      [ M] 45. d:\program files\rising\rising\rfw\ijt_base.dll


    60000000[0000F000]
      [ M] 46. d:\program files\rising\rising\rfw\olemon.dll


    00C50000[00016000]
      [ M] 89. d:\program files\rising\rising\rfw\unvdet.dll


    00CA0000[00013000]
      [ M] 90. d:\program files\rising\rising\rfw\mports.dll



  + 000004a4(1188) rfwProxy.exe
    00400000[00236000]
      [AM] 3. d:\program files\rising\rising\rfw\rfwproxy.exe


    7C140000[00103000]
      [ M] 50. c:\windows\system32\mfc71.dll


    7C340000[00056000]
      [ M] 51. c:\windows\system32\msvcr71.dll


    731B0000[0000A000]
      [ M] 87. d:\program files\rising\rising\rfw\psapi.dll


    10000000[0001F000]
      [ M] 80. d:\program files\rising\rising\rfw\proccom.dll


    00B60000[00024000]
      [ M] 81. d:\program files\rising\rising\rfw\rscommx2.dll


    00C90000[0000F000]
      [ M] 84. d:\program files\rising\rising\rfw\rfwrule.dll


    00DB0000[00011000]
      [ M] 91. d:\program files\rising\rising\rfw\urlrule.dll


    70000000[00019000]
      [ M] 45. d:\program files\rising\rising\rfw\ijt_base.dll


    60000000[0000F000]
      [ M] 46. d:\program files\rising\rising\rfw\olemon.dll


    01300000[00016000]
      [ M] 92. d:\program files\rising\rising\rfw\monmid.dll



  + 0000056c(1388) rfwstub.exe
    00400000[00017000]
      [ M] 93. d:\program files\rising\rising\rfw\rfwstub.exe


    7C3A0000[0007B000]
      [ M] 52. c:\windows\system32\msvcp71.dll


    7C340000[00056000]
      [ M] 51. c:\windows\system32\msvcr71.dll


    70000000[00019000]
      [ M] 45. d:\program files\rising\rising\rfw\ijt_base.dll


    60000000[0000F000]
      [ M] 46. d:\program files\rising\rising\rfw\olemon.dll


    23700000[00028000]
      [ M] 94. d:\program files\rising\rising\rfw\rscommon.dll



  + 00000630(1584) RavStub.exe
    00400000[00021000]
      [ M] 95. d:\program files\rising\rising\ravstub.exe


    10000000[0001F000]
      [ M] 56. d:\program files\rising\rising\proccom.dll


    00620000[00024000]
      [ M] 57. d:\program files\rising\rising\rscommx2.dll


    23700000[00028000]
      [ M] 96. d:\program files\rising\rising\rscommon.dll


    70000000[00019000]
      [ M] 45. d:\program files\rising\rising\rfw\ijt_base.dll


    60000000[0000F000]
      [ M] 46. d:\program files\rising\rising\rfw\olemon.dll



  + 0000069c(1692) RfwMain.exe
    00400000[00092000]
      [AM] 40. d:\program files\rising\rising\rfw\rfwmain.exe


    7C140000[00103000]
      [ M] 50. c:\windows\system32\mfc71.dll


    7C340000[00056000]
      [ M] 51. c:\windows\system32\msvcr71.dll


    7C3A0000[0007B000]
      [ M] 52. c:\windows\system32\msvcp71.dll


    26600000[000B8000]
      [ M] 97. d:\program files\rising\rising\rfw\rsguilib.dll


    10000000[0001F000]
      [ M] 80. d:\program files\rising\rising\rfw\proccom.dll


    00B50000[00024000]
      [ M] 81. d:\program files\rising\rising\rfw\rscommx2.dll


    00C90000[0000E000]
      [ M] 82. d:\program files\rising\rising\rfw\rsappmgr.dll


    00CB0000[00030000]
      [ M] 83. d:\program files\rising\rising\rfw\cfgdll.dll


    23700000[00028000]
      [ M] 94. d:\program files\rising\rising\rfw\rscommon.dll


    00F00000[00014000]
      [ M] 98. d:\program files\rising\rising\rfw\rfwctrl.dll


    23800000[00018000]
      [ M] 99. d:\program files\rising\rising\rfw\rsxml.dll


    23900000[00040000]
      [ M] 100. d:\program files\rising\rising\rfw\pngdll.dll


    70000000[00019000]
      [ M] 45. d:\program files\rising\rising\rfw\ijt_base.dll


    60000000[0000F000]
      [ M] 46. d:\program files\rising\rising\rfw\olemon.dll


    013F0000[0000F000]
      [ M] 84. d:\program files\rising\rising\rfw\rfwrule.dll



  + 000006cc(1740) spoolsv.exe
    70000000[00019000]
      [ M] 45. d:\program files\rising\rising\rfw\ijt_base.dll


    60000000[0000F000]
      [ M] 46. d:\program files\rising\rising\rfw\olemon.dll


    00AF0000[00005000]
      [ M] 101. c:\windows\system32\spool\prtprocs\w32x86\vprproc.dll



  + 000006dc(1756) RavMon.exe
    00400000[00067000]
      [ M] 102. d:\program files\rising\rising\ravmon.exe


    7C140000[00103000]
      [ M] 50. c:\windows\system32\mfc71.dll


    7C340000[00056000]
      [ M] 51. c:\windows\system32\msvcr71.dll


    7C3A0000[0007B000]
      [ M] 52. c:\windows\system32\msvcp71.dll


    10000000[0001F000]
      [ M] 56. d:\program files\rising\rising\proccom.dll


    00B20000[00024000]
      [ M] 57. d:\program files\rising\rising\rscommx2.dll


    23700000[00028000]
      [ M] 96. d:\program files\rising\rising\rscommon.dll


    00D70000[00035000]
      [ M] 63. d:\program files\rising\rising\recomp.dll


    00DC0000[00036000]
      [ M] 64. d:\program files\rising\rising\refs.dll


    01020000[0002F000]
      [ M] 70. d:\program files\rising\rising\viruslib.dll


    01160000[00028000]
      [ M] 71. d:\program files\rising\rising\relibldr.dll


    011E0000[0000E000]
      [ M] 53. d:\program files\rising\rising\rsappmgr.dll


    01200000[00030000]
      [ M] 54. d:\program files\rising\rising\cfgdll.dll


    01360000[00075000]
      [ M] 58. d:\program files\rising\rising\monrule.dll


    23900000[00040000]
      [ M] 103. d:\program files\rising\rising\pngdll.dll


    26600000[000B8000]
      [ M] 104. d:\program files\rising\rising\rsguilib.dll


    23800000[00018000]
      [ M] 105. d:\program files\rising\rising\rsxml.dll



  + 000007b0(1968) guard.exe
    00400000[0004E000]
      [AM] 1. d:\查杀\avg anti-spyware\guard.exe


    10000000[000DE000]
      [ M] 106. d:\查杀\avg anti-spyware\engine.dll



  + 000007c0(1984) alg.exe

  + 000007c4(1988) RavTask.exe
    00400000[00034000]
      [AM] 41. d:\program files\rising\rising\ravtask.exe


    10000000[0001F000]
      [ M] 56. d:\program files\rising\rising\proccom.dll


    00A30000[00024000]
      [ M] 57. d:\program files\rising\rising\rscommx2.dll


    23700000[00028000]
      [ M] 96. d:\program files\rising\rising\rscommon.dll


    00C90000[0000E000]
      [ M] 53. d:\program files\rising\rising\rsappmgr.dll


    08CB0000[00030000]
      [ M] 54. d:\program files\rising\rising\cfgdll.dll



  + 00000a34(2612) wuauclt.exe
    70000000[00019000]
      [ M] 45. d:\program files\rising\rising\rfw\ijt_base.dll


    60000000[0000F000]
      [ M] 46. d:\program files\rising\rising\rfw\olemon.dll


    50E60000[0000C000]
      [ M] 48. c:\windows\system32\wups2.dll



  + 00000a8c(2700) Ras.exe
    00400000[001FF000]
      [ M] 107. d:\program files\卡卡\ras.exe


    7C140000[00103000]
      [ M] 108. d:\program files\卡卡\mfc71.dll


    7C340000[00056000]
      [ M] 109. d:\program files\卡卡\msvcr71.dll


    7C3A0000[0007B000]
      [ M] 110. d:\program files\卡卡\msvcp71.dll


    10000000[00013000]
      [ M] 111. d:\program files\卡卡\topsoft.dll


    00370000[00032000]
      [ M] 112. d:\program files\卡卡\ncomm.dll


    00D50000[0001F000]
      [ M] 56. d:\program files\rising\rising\proccom.dll


    00E90000[00024000]
      [ M] 57. d:\program files\rising\rising\rscommx2.dll


    00FD0000[0014D000]
      [ M] 113. d:\program files\卡卡\rasgui.dll


    23800000[00022000]
      [ M] 114. d:\program files\卡卡\rsxml.dll


    02C50000[00018000]
      [ M] 115. d:\program files\卡卡\ktrojan.dll


    02C80000[0002F000]
      [ M] 116. d:\program files\卡卡\engine.dll


    02CC0000[00041000]
      [ M] 117. d:\program files\卡卡\rsdialog.dll


    02D20000[00024000]
      [ M] 118. d:\program files\卡卡\scanunv.dll


    02D60000[0001F000]
      [ M] 119. d:\program files\卡卡\secscan.dll


    02B50000[00015000]
      [ M] 120. d:\program files\卡卡\secex.dll


    02C30000[00012000]
      [ M] 121. d:\program files\卡卡\zip.dll


    02A10000[00028000]
      [ M] 122. d:\program files\rising\rising\ravscrch.dll



  + 00000aec(2796) wuauclt.exe
    70000000[00019000]
      [ M] 45. d:\program files\rising\rising\rfw\ijt_base.dll


    60000000[0000F000]
      [ M] 46. d:\program files\rising\rising\rfw\olemon.dll


    50E60000[0000C000]
      [ M] 48. c:\windows\system32\wups2.dll