瑞星卡卡电脑诊断日志 v1.30 (2008-9-30 0:18:31) 北京瑞星信息技术有限公司
注释: [A]表示该文件存在自启动关联;
[M]表示该文件在内存中;
+ 注册表自运行项目
+ 系统服务
+ HKLM\System\CurrentControlSet\Services
Adobe LM Service
[A ] 1. c:\program files\common files\adobe systems shared\service\adobelmsvc.exe
aspnet_state
[A ] 2. c:\windows\microsoft.net\framework\v2.0.50727\aspnet_state.exe
Autodesk Licensing Service
[A ] 3. c:\program files\common files\autodesk shared\service\adskscsrv.exe
clr_optimization_v2.0.50727_32
[A ] 4. c:\windows\microsoft.net\framework\v2.0.50727\mscorsvw.exe
FLEXlm server for PTC
[AM] 5. d:\pro\i486_nt\obj\lmgrd.exe
NVSvc
[AM] 6. c:\windows\system32\nvsvc32.exe
ose
[A ] 7. c:\program files\common files\microsoft shared\source engine\ose.exe
RfwProxySrv
[AM] 8. d:\rising\rfw\rfwproxy.exe
RfwService
[AM] 9. d:\rising\rfw\rfwsrv.exe
RsCCenter
[AM] 10. c:\program files\rising\rav\ccenter.exe
RsRavMon
[AM] 11. c:\program files\rising\rav\ravmond.exe
WMPNetworkSvc
[A ] 12. c:\program files\windows media player\wmpnetwk.exe
WudfSvc
[A ] 13. c:\windows\system32\wudfsvc.dll
+ 内核驱动
+ HKLM\System\CurrentControlSet\Services
360AntiArp
[A ] 14. c:\windows\system32\drivers\360antiarp.sys
Alidevice
[A ] 15. c:\windows\system32\drivers\alidevice.sys
AmdK8
[A ] 16. c:\windows\system32\drivers\amdk8.sys
HDAudBus
[A ] 17. c:\windows\system32\drivers\hdaudbus.sys
HookCont
[A ] 18. c:\windows\system32\drivers\hookcont.sys
HookNtos
[A ] 19. c:\windows\system32\drivers\hookntos.sys
HookReg
[A ] 20. c:\windows\system32\drivers\hookreg.sys
HookSys
[A ] 21. c:\windows\system32\drivers\hooksys.sys
HookUrl
[A ] 22. d:\rising\rfw\hookurl.sys
IntcAzAudAddService
[A ] 23. c:\windows\system32\drivers\rtkhdaud.sys
MTsensor
[A ] 24. c:\windows\system32\drivers\asacpi.sys
npkcrypt
[A ] 25. c:\program files\tencent\qq\npkcrypt.sys
nvata
[A ] 26. c:\windows\system32\drivers\nvata.sys
NVENETFD
[A ] 27. c:\windows\system32\drivers\nvenetfd.sys
nvnetbus
[A ] 28. c:\windows\system32\drivers\nvnetbus.sys
Packet
[A ] 29. c:\windows\system32\drivers\protodrv.sys
QKeyService
[A ] 30. c:\windows\system32\keycrypt.sys
RfwBase
[A ] 31. c:\windows\system32\drivers\rfwbase.sys
RsFwDrv
[A ] 32. d:\rising\rfw\rsfwdrv.sys
RsNTGDI
[A ] 33. c:\windows\system32\drivers\rsntgdi.sys
Secdrv
[A ] 34. c:\windows\system32\drivers\secdrv.sys
TesSafe
[A ] 35. c:\windows\system32\tessafe.sys
WudfPf
[A ] 36. c:\windows\system32\drivers\wudfpf.sys
WudfRd
[A ] 37. c:\windows\system32\drivers\wudfrd.sys
+ IE浏览器加载模块
+ HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects
{01443AEC-0FD1-40fd-9C87-E93D1494C233}
[AM] 38. c:\program files\thunder network\thunder\comdlls\tdatonce_now.dll
{3049C3E9-B461-4BC5-8870-4C09146192CA}
[AM] 39. c:\program files\real\realplayer\rpbrowserrecordplugin.dll
{4E83D567-4697-4F7B-B1F0-A513B01DB89A}
[AM] 40. c:\program files\chinanet\vnettransfer.dll
{889D2FEB-5411-4565-8998-1DD2C5261283}
[AM] 41. c:\program files\thunder network\thunder\comdlls\xunleibho_now.dll
{98B7C13A-E9CD-4959-8B46-FBEAB41E42A8}
[AM] 42. c:\windows\system32\urlfilter.dll
{B69F34DD-F0F9-42DC-9EDD-957187DA688D}
[AM] 43. c:\program files\360safe\safemon\safemon.dll
+ HKLM\SOFTWARE\Microsoft\Internet Explorer\Extensions
Exec
[A ] 44. c:\program files\thunder network\thunder\thunder.exe
Exec
[A ] 45. c:\program files\messenger\msmsgs.exe
+ 资源管理器加载模块
+ HKLM\SOFTWARE\Classes\PROTOCOLS\Filter
application/octet-stream
[A ] 46. c:\windows\system32\mscoree.dll
application/x-complus
[A ] 46. c:\windows\system32\mscoree.dll
application/x-msdownload
[A ] 46. c:\windows\system32\mscoree.dll
text/xml
[AM] 47. c:\program files\common files\microsoft shared\office11\msoxmlmf.dll
+ HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved
HyperTerminal Icon Ext
[A ] 48. c:\windows\system32\hticons.dll
WinRAR shell extension
[AM] 49. c:\program files\winrar\rarext.dll
NvCpl DesktopContext Class
[AM] 50. c:\windows\system32\nvcpl.dll
Play on my TV helper
[AM] 50. c:\windows\system32\nvcpl.dll
Desktop Explorer
[AM] 51. c:\windows\system32\nvshell.dll
Desktop Explorer Menu
[AM] 51. c:\windows\system32\nvshell.dll
nView Desktop Context Menu
[AM] 51. c:\windows\system32\nvshell.dll
Microsoft Office HTML Icon Handler
[AM] 52. c:\program files\microsoft office\office11\msohev.dll
Web Folders
[A ] 53. c:\program files\common files\microsoft shared\web folders\msonsext.dll
Shell Extensions for RealOne Player
[A ] 54. c:\program files\real\realplayer\rpshell.dll
RISING
[AM] 55. c:\windows\system32\ravext.dll
ShellLink for Application References
[A ] 56. c:\windows\system32\dfshim.dll
Shell Icon Handler for Application References
[A ] 56. c:\windows\system32\dfshim.dll
AutoCAD 数字签名图标覆盖处理程序
[AM] 57. c:\windows\system32\acsignicon.dll
Autodesk Drawing Preview
[A ] 58. c:\program files\common files\autodesk shared\thumbnail\acthumbnail16.dll
Portable Media Devices
[A ] 59. c:\windows\system32\audiodev.dll
Portable Devices
[A ] 60. c:\windows\system32\wpdshext.dll
Portable Devices Menu
[A ] 60. c:\windows\system32\wpdshext.dll
+ HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks
{32CD708B-60A7-4C00-9377-D73EAA495F0F}
[AM] 55. c:\windows\system32\ravext.dll
+ HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad
WPDShServiceObj
[AM] 61. c:\windows\system32\wpdshserviceobj.dll
+ 用户登陆自运行项目
+ HKCU\Software\Microsoft\Windows\CurrentVersion\Run
PPS Accelerator
[AM] 62. d:\ppstream\ppsap.exe
+ HKLM\Software\Microsoft\Windows\CurrentVersion\Run
RfwMain
[AM] 63. d:\rising\rfw\rfwmain.exe
RavTask
[AM] 64. c:\program files\rising\rav\ravtask.exe
TkBellExe
[AM] 65. c:\program files\common files\real\update_ob\realsched.exe
runeip
[AM] 66. d:\antispyware\rstray.exe
+ 开机执行
+ HKLM\SYSTEM\CurrentControlSet\Control\NetworkProvider\Order
BootExecute
[A ] 67. c:\windows\system32\bsmain.exe
+ 映像劫持
+ HKCR\.exe
exefile\启用/禁用数字签名图标\Command
[A ] 68. c:\windows\system32\acsignopt.exe
+ HKCR\.html
htmlfile\Edit\Command
[A ] 69. c:\program files\microsoft office\office11\msohtmed.exe
htmlfile\Print\Command
[A ] 69. c:\program files\microsoft office\office11\msohtmed.exe
+ HKCR\.htm
htmlfile\Edit\Command
[A ] 69. c:\program files\microsoft office\office11\msohtmed.exe
htmlfile\Print\Command
[A ] 69. c:\program files\microsoft office\office11\msohtmed.exe
+ 程序初始化和已知动态连接库
+ HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows
AppInit_DLLs
[AM] 70. c:\windows\system32\kmon.dll
+ 其他自启动项目
+ C:\Documents and Settings\www\「开始」菜单\程序\启动
QQ游戏启动加速程序.lnk
[A ] 71. d:\tencent\qqgame\accel.exe
+ C:\Documents and Settings\All Users\「开始」菜单\程序\启动
AutoCAD 启动加速器.lnk
[A ] 72. c:\program files\common files\autodesk shared\acstart17.exe
+ C:\WINDOWS\Tasks
SogouImeMgr.job
[A ] 73. d:\sogouinput\3.6.0.1653\pinyinrepair.exe
+ 正在运行的进程
+ 000000c8(200) IEXPLORE.EXE
60000000[00074000]
[AM] 70. c:\windows\system32\kmon.dll
10000000[0002E000]
[ M] 74. d:\antispyware\comx3.dll
00A20000[00019000]
[ M] 75. d:\antispyware\syslay.dll
70000000[00019000]
[ M] 76. d:\rising\rfw\ijt_base.dll
75000000[0000F000]
[ M] 77. d:\rising\rfw\olemon.dll
60560000[00033000]
[AM] 57. c:\windows\system32\acsignicon.dll
01050000[0002C000]
[AM] 38. c:\program files\thunder network\thunder\comdlls\tdatonce_now.dll
01090000[0004A000]
[AM] 39. c:\program files\real\realplayer\rpbrowserrecordplugin.dll
7C3A0000[0007B000]
[ M] 78. c:\windows\system32\msvcp71.dll
7C340000[00056000]
[ M] 79. c:\windows\system32\msvcr71.dll
61540000[0001A000]
[ M] 80. c:\program files\real\realplayer\lang\rpbrp_cn.dll
01110000[00018000]
[AM] 40. c:\program files\chinanet\vnettransfer.dll
01130000[0000D000]
[ M] 81. c:\program files\chinanet\communicate.dll
014D0000[0002D000]
[ M] 82. c:\program files\chinanet\clientapi.dll
01640000[00031000]
[AM] 41. c:\program files\thunder network\thunder\comdlls\xunleibho_now.dll
24190000[0000E000]
[ M] 83. c:\program files\thunder network\thunder\components\resworker\dsbho_02.dll
24140000[0001E000]
[ M] 84. c:\program files\thunder network\thunder\components\resworker\dataprocessor_02.dll
016F0000[00018000]
[AM] 42. c:\windows\system32\urlfilter.dll
01720000[00011000]
[ M] 85. d:\antispyware\urlrule.dll
01750000[00029000]
[AM] 43. c:\program files\360safe\safemon\safemon.dll
325C0000[00012000]
[AM] 52. c:\program files\microsoft office\office11\msohev.dll
03030000[00028000]
[ M] 86. c:\program files\rising\rav\ravscrch.dll
30000000[003AF000]
[ M] 87. c:\windows\system32\macromed\flash\flash9f.ocx
72C80000[00008000]
[ M] 88. c:\windows\system32\msacm32.drv
0B840000[0014F000]
[ M] 89. c:\windows\system32\sogoupy.ime
+ 0000012c(300) RfwMain.exe
00400000[00092000]
[AM] 63. d:\rising\rfw\rfwmain.exe
7C140000[00103000]
[ M] 90. c:\windows\system32\mfc71.dll
7C340000[00056000]
[ M] 79. c:\windows\system32\msvcr71.dll
7C3A0000[0007B000]
[ M] 78. c:\windows\system32\msvcp71.dll
26600000[000A8000]
[ M] 91. d:\rising\rfw\rsguilib.dll
10000000[0001F000]
[ M] 92. d:\rising\rfw\proccom.dll
00B50000[00024000]
[ M] 93. d:\rising\rfw\rscommx2.dll
00C90000[0000E000]
[ M] 94. d:\rising\rfw\rsappmgr.dll
00CB0000[00030000]
[ M] 95. d:\rising\rfw\cfgdll.dll
23700000[00028000]
[ M] 96. d:\rising\rfw\rscommon.dll
00F00000[00014000]
[ M] 97. d:\rising\rfw\rfwctrl.dll
23800000[00022000]
[ M] 98. d:\rising\rfw\rsxml.dll
23900000[00040000]
[ M] 99. d:\rising\rfw\pngdll.dll
70000000[00019000]
[ M] 76. d:\rising\rfw\ijt_base.dll
75000000[0000F000]
[ M] 77. d:\rising\rfw\olemon.dll
013F0000[0000F000]
[ M] 100. d:\rising\rfw\rfwrule.dll
+ 00000184(388) antiarp.exe
00400000[00074000]
[ M] 101. c:\program files\360safe\antiarp\antiarp.exe
60000000[00074000]
[AM] 70. c:\windows\system32\kmon.dll
+ 0000026c(620) smss.exe
+ 000002b0(688) csrss.exe
70000000[00019000]
[ M] 76. d:\rising\rfw\ijt_base.dll
75000000[0000F000]
[ M] 77. d:\rising\rfw\olemon.dll
+ 000002c8(712) winlogon.exe
70000000[00019000]
[ M] 76. d:\rising\rfw\ijt_base.dll
75000000[0000F000]
[ M] 77. d:\rising\rfw\olemon.dll
72C80000[00008000]
[ M] 88. c:\windows\system32\msacm32.drv
+ 000002f4(756) services.exe
47260000[0000F000]
[ M] 102. c:\windows\apppatch\acadproc.dll
70000000[00019000]
[ M] 76. d:\rising\rfw\ijt_base.dll
75000000[0000F000]
[ M] 77. d:\rising\rfw\olemon.dll
+ 00000300(768) lsass.exe
70000000[00019000]
[ M] 76. d:\rising\rfw\ijt_base.dll
75000000[0000F000]
[ M] 77. d:\rising\rfw\olemon.dll
+ 00000394(916) svchost.exe
+ 0000039c(924) svchost.exe
70000000[00019000]
[ M] 76. d:\rising\rfw\ijt_base.dll
75000000[0000F000]
[ M] 77. d:\rising\rfw\olemon.dll
+ 000003b0(944) RavTask.exe
00400000[00034000]
[AM] 64. c:\program files\rising\rav\ravtask.exe
10000000[0001F000]
[ M] 103. c:\program files\rising\rav\proccom.dll
00A30000[00024000]
[ M] 104. c:\program files\rising\rav\rscommx2.dll
23700000[00028000]
[ M] 105. c:\program files\rising\rav\rscommon.dll
00C90000[0000E000]
[ M] 106. c:\program files\rising\rav\rsappmgr.dll
08CB0000[00030000]
[ M] 107. c:\program files\rising\rav\cfgdll.dll
+ 000003d8(984) svchost.exe
70000000[00019000]
[ M] 76. d:\rising\rfw\ijt_base.dll
75000000[0000F000]
[ M] 77. d:\rising\rfw\olemon.dll
+ 00000428(1064) Ravmon.exe
00400000[00067000]
[ M] 108. c:\program files\rising\rav\ravmon.exe
7C140000[00103000]
[ M] 90. c:\windows\system32\mfc71.dll
7C340000[00056000]
[ M] 79. c:\windows\system32\msvcr71.dll
7C3A0000[0007B000]
[ M] 78. c:\windows\system32\msvcp71.dll
10000000[0001F000]
[ M] 103. c:\program files\rising\rav\proccom.dll
00B20000[00024000]
[ M] 104. c:\program files\rising\rav\rscommx2.dll
23700000[00028000]
[ M] 105. c:\program files\rising\rav\rscommon.dll
00D70000[00035000]
[ M] 109. c:\program files\rising\rav\recomp.dll
00DC0000[00036000]
[ M] 110. c:\program files\rising\rav\refs.dll
01020000[0002F000]
[ M] 111. c:\program files\rising\rav\viruslib.dll
01160000[00028000]
[ M] 112. c:\program files\rising\rav\relibldr.dll
011E0000[0000E000]
[ M] 106. c:\program files\rising\rav\rsappmgr.dll
01200000[00030000]
[ M] 107. c:\program files\rising\rav\cfgdll.dll
01360000[00075000]
[ M] 113. c:\program files\rising\rav\monrule.dll
23900000[00040000]
[ M] 114. c:\program files\rising\rav\pngdll.dll
26600000[000A8000]
[ M] 115. c:\program files\rising\rav\rsguilib.dll
23800000[00022000]
[ M] 116. c:\program files\rising\rav\rsxml.dll
+ 00000430(1072) CCenter.exe
00400000[0002A000]
[AM] 10. c:\program files\rising\rav\ccenter.exe
70000000[00019000]
[ M] 76. d:\rising\rfw\ijt_base.dll
75000000[0000F000]
[ M] 77. d:\rising\rfw\olemon.dll
+ 00000440(1088) svchost.exe
70000000[00019000]
[ M] 76. d:\rising\rfw\ijt_base.dll
75000000[0000F000]
[ M] 77. d:\rising\rfw\olemon.dll
+ 0000047c(1148) stormliv.exe
00400000[00075000]
[ M] 117. c:\program files\stormii\stormliv.exe
75FF0000[00065000]
[ M] 118. c:\program files\stormii\msvcp60.dll
60000000[00074000]
[AM] 70. c:\windows\system32\kmon.dll
+ 00000494(1172) svchost.exe
70000000[00019000]
[ M] 76. d:\rising\rfw\ijt_base.dll
75000000[0000F000]
[ M] 77. d:\rising\rfw\olemon.dll