瑞星卡卡电脑诊断日志 v1.30 (2008-8-20 10:59:8) 北京瑞星信息技术有限公司
注释: [A]表示该文件存在自启动关联;
[M]表示该文件在内存中;
+ 注册表自运行项目
+ 系统服务
+ HKLM\System\CurrentControlSet\Services
Apple Mobile Device
[A ] 1. c:\program files\common files\apple\mobile device support\bin\applemobiledeviceservice.exe
aspnet_state
[A ] 2. c:\windows\microsoft.net\framework\v1.1.4322\aspnet_state.exe
Bonjour Service
[A ] 3. c:\program files\bonjour\mdnsresponder.exe
NVSvc
[AM] 4. c:\windows\system32\nvsvc32.exe
ose
[A ] 5. c:\program files\common files\microsoft shared\source engine\ose.exe
RfwProxySrv
[AM] 6. e:\rising\rfw\rfwproxy.exe
RfwService
[AM] 7. e:\rising\rfw\rfwsrv.exe
RsCCenter
[AM] 8. e:\rising\rav\ccenter.exe
RsRavMon
[AM] 9. e:\rising\rav\ravmond.exe
WMPNetworkSvc
[A ] 10. c:\program files\windows media player\wmpnetwk.exe
WudfSvc
[AM] 11. c:\windows\system32\wudfsvc.dll
+ 内核驱动
+ HKLM\System\CurrentControlSet\Services
360AntiArp
[A ] 12. c:\windows\system32\drivers\360antiarp.sys
aaatimeo
[A ] 13. c:\windows\system32\drivers\aaatimeo.sys
AFAMgt
[A ] 14. c:\windows\system32\drivers\afamgt.sys
ahcix86
[A ] 15. c:\windows\system32\drivers\ahcix86.sys
ALCXWDM
[A ] 16. c:\windows\system32\drivers\alcxwdm.sys
amdbusdr
[A ] 17. c:\windows\system32\drivers\amdbusdr.sys
amdeide
[A ] 18. c:\windows\system32\drivers\amdeide.sys
AmdK8
[A ] 19. c:\windows\system32\drivers\amdk8.sys
ASH1205
[A ] 20. c:\windows\system32\drivers\ash1205.sys
ASTDriver
[A ] 21. c:\documents and settings\administrator\桌面\r\ast\astdriver.sys
ata1200a
[A ] 22. c:\windows\system32\drivers\ata1200a.sys
atiide
[A ] 23. c:\windows\system32\drivers\atiide.sys
bb-run
[A ] 24. c:\windows\system32\drivers\bb-run.sys
cercsr6
[A ] 25. c:\windows\system32\drivers\cercsr6.sys
Cpq32fs2
[A ] 26. c:\windows\system32\drivers\cpq32fs2.sys
cs429x
[A ] 27. c:\windows\system32\drivers\cwawdm.sys
dontgo
[A ] 28. c:\windows\system32\drivers\dontgo.sys
fttxr52P
[A ] 29. c:\windows\system32\drivers\fttxr52p.sys
HookCont
[A ] 30. c:\windows\system32\drivers\hookcont.sys
HookNtos
[A ] 31. c:\windows\system32\drivers\hookntos.sys
HookReg
[A ] 32. c:\windows\system32\drivers\hookreg.sys
HookSys
[A ] 33. c:\windows\system32\drivers\hooksys.sys
HookUrl
[A ] 34. e:\rising\rfw\hookurl.sys
HpCISSm2
[A ] 35. c:\windows\system32\drivers\hpcissm2.sys
hptmv6
[A ] 36. c:\windows\system32\drivers\hptmv6.sys
iaStor55
[A ] 37. c:\windows\system32\drivers\iastor55.sys
iaStor70
[A ] 38. c:\windows\system32\drivers\iastor70.sys
mdmxsdk
[A ] 39. c:\windows\system32\drivers\mdmxsdk.sys
mv61xx
[A ] 40. c:\windows\system32\drivers\mv61xx.sys
mvSata
[A ] 41. c:\windows\system32\drivers\mvsata.sys
npkcrypt
[A ] 42. c:\windows\system32\npkcrypt.sys
npkycryp
[A ] 43. c:\windows\system32\npkycryp.sys
nvgts
[A ] 44. c:\windows\system32\drivers\nvgts.sys
nvrd32
[A ] 45. c:\windows\system32\drivers\nvrd32.sys
Packet
[A ] 46. c:\windows\system32\drivers\protodrv.sys
PxHelp20
[A ] 47. c:\windows\system32\drivers\pxhelp20.sys
ql2100
[A ] 48. c:\windows\system32\drivers\ql2100.sys
ql2200
[A ] 49. c:\windows\system32\drivers\ql2200.sys
RfwBase
[A ] 50. c:\windows\system32\drivers\rfwbase.sys
rr172x
[A ] 51. c:\windows\system32\drivers\rr172x.sys
rr174x
[A ] 52. c:\windows\system32\drivers\rr174x.sys
rr2340
[A ] 53. c:\windows\system32\drivers\rr2340.sys
RsAntiSpyware
[A ] 54. c:\windows\system32\drivers\rsboot.sys
RsFwDrv
[A ] 55. e:\rising\rfw\rsfwdrv.sys
RsNTGDI
[A ] 56. c:\windows\system32\drivers\rsntgdi.sys
RTL8023xp
[A ] 57. c:\windows\system32\drivers\rtlnicxp.sys
Secdrv
[A ] 58. c:\windows\system32\drivers\secdrv.sys
SiRemFil
[A ] 59. c:\windows\system32\drivers\siremfil.sys
sisraidx
[A ] 60. c:\windows\system32\drivers\sisraidx.sys
USBAAPL
[A ] 61. c:\windows\system32\drivers\usbaapl.sys
ViBus
[A ] 62. c:\windows\system32\drivers\vibus.sys
videX32
[A ] 63. c:\windows\system32\drivers\videx32.sys
ViPrt
[A ] 64. c:\windows\system32\drivers\viprt.sys
WpdUsb
[A ] 65. c:\windows\system32\drivers\wpdusb.sys
WudfPf
[A ] 66. c:\windows\system32\drivers\wudfpf.sys
WudfRd
[A ] 67. c:\windows\system32\drivers\wudfrd.sys
xfilt
[A ] 68. c:\windows\system32\drivers\xfilt.sys
+ 系统登陆自运行
+ HKCU\Control Panel\Desktop
Scrnsave.exe
[A ] 69. c:\windows\system32\夜光时钟.scr
+ IE浏览器加载模块
+ HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar
{43869BB3-22FD-4F15-9B46-238106BA2F4E}
[A ] 70. c:\program files\super rabbit\magicset\haokanbar.dll
+ HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects
{01443AEC-0FD1-40fd-9C87-E93D1494C233}
[A ] 71. e:\迅雷6\thunder6\comdlls\tdatonce_now.dll
{7369D35A-5B70-4A5B-B789-B25FE09B4AF3}
[A ] 70. c:\program files\super rabbit\magicset\haokanbar.dll
{889D2FEB-5411-4565-8998-1DD2C5261283}
[AM] 72. e:\迅雷6\thunder6\comdlls\xunleibho_now.dll
{B69F34DD-F0F9-42DC-9EDD-957187DA688D}
[AM] 73. e:\360safe\safemon\safemon.dll
+ HKLM\SOFTWARE\Microsoft\Internet Explorer\Extensions
Exec
[A ] 74. g:\yx\浩方对战平台\gameclient.exe
+ 资源管理器加载模块
+ HKLM\SOFTWARE\Classes\PROTOCOLS\Filter
application/octet-stream
[A ] 75. c:\windows\system32\mscoree.dll
application/x-complus
[A ] 75. c:\windows\system32\mscoree.dll
application/x-msdownload
[A ] 75. c:\windows\system32\mscoree.dll
text/xml
[AM] 76. c:\program files\common files\microsoft shared\office11\msoxmlmf.dll
+ HKLM\SOFTWARE\Classes\PROTOCOLS\Handler
KuGoo
[A ] 77. c:\windows\system32\kugoo3downxcontrol.ocx
KuGoo3
[A ] 77. c:\windows\system32\kugoo3downxcontrol.ocx
+ HKLM\SOFTWARE\Microsoft\Active Setup\Installed Components
<{12d0ed0d-0ee0-4f90-8827-78cefb8f4988}
[A ] 78. c:\windows\system32\ieudinit.exe
+ HKLM\SOFTWARE\Classes\Folder\shellex\ColumnHandlers
{F9DB5320-233E-11D1-9F84-707F02C10627}
[AM] 79. c:\program files\common files\adobe\acrobat\activex\pdfshell.dll
+ HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved
HyperTerminal Icon Ext
[A ] 80. c:\windows\system32\hticons.dll
WinRAR shell extension
[AM] 81. c:\program files\winrar\rarext.dll
Microsoft Office HTML Icon Handler
[AM] 82. c:\program files\microsoft office\office11\msohev.dll
Web Folders
[A ] 83. c:\program files\common files\microsoft shared\web folders\msonsext.dll
RISING
[AM] 84. c:\windows\system32\ravext.dll
Portable Media Devices
[A ] 85. c:\windows\system32\audiodev.dll
Portable Devices
[A ] 86. c:\windows\system32\wpdshext.dll
Portable Devices Menu
[A ] 86. c:\windows\system32\wpdshext.dll
EncryptFile
[A ] 87. e:\优化大师\woptiencryptmodule.dll
NvCpl DesktopContext Class
[A ] 88. c:\windows\system32\nvcpl.dll
Play on my TV helper
[A ] 88. c:\windows\system32\nvcpl.dll
Fusion Cache
[A ] 75. c:\windows\system32\mscoree.dll
+ 用户登陆自运行项目
+ HKLM\Software\Microsoft\Windows\CurrentVersion\Run
360Safetray
[AM] 89. e:\360safe\safemon\360tray.exe
RavTask
[AM] 90. e:\rising\rav\ravtask.exe
RfwMain
[AM] 91. e:\rising\rfw\rfwmain.exe
runeip
[AM] 92. e:\rising\rstray.exe
+ HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce
KKDelay
[A ] 93. e:\rising\runonce.exe
+ 开机执行
+ HKLM\SYSTEM\CurrentControlSet\Control\NetworkProvider\Order
BootExecute
[A ] 94. c:\windows\system32\bsmain.exe
[A ] 95. c:\windows\system32\kknative.exe
+ 映像劫持
+ HKCR\.html
htmlfile\Edit\Command
[A ] 96. c:\program files\microsoft office\office11\msohtmed.exe
htmlfile\Print\Command
[A ] 96. c:\program files\microsoft office\office11\msohtmed.exe
+ HKCR\.htm
htmlfile\Edit\Command
[A ] 96. c:\program files\microsoft office\office11\msohtmed.exe
htmlfile\Print\Command
[A ] 96. c:\program files\microsoft office\office11\msohtmed.exe
+ HKCR\.mp3
KuGoo.MP3\Open\Command
[A ] 97. e:\kugou2008\kugoo.exe
KuGoo.MP3\PlayList\Command
[A ] 97. e:\kugou2008\kugoo.exe
+ 程序初始化和已知动态连接库
+ HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows
AppInit_DLLs
[AM] 98. c:\windows\system32\kmon.dll
+ 正在运行的进程
+ 000000d8(216) spoolsv.exe
16080000[00025000]
[ M] 99. c:\program files\bonjour\mdnsnsp.dll
00A30000[0000F000]
[ M] 158. e:\360safe\safemon\safekrnl.dll
00A40000[00020000]
[ M] 159. e:\360safe\antiadwa.dll
00EE0000[0001F000]
[ M] 160. e:\360safe\live.dll
16080000[00025000]
[ M] 99. c:\program files\bonjour\mdnsnsp.dll
+ 000002a0(672) csrss.exe
7C140000[00103000]
[ M] 102. c:\windows\system32\mfc71.dll
7C340000[00056000]
[ M] 103. c:\windows\system32\msvcr71.dll
7C3A0000[0007B000]
[ M] 104. c:\windows\system32\msvcp71.dll
+ 00000324(804) services.exe
46040000[0000F000]
[ M] 163. c:\windows\apppatch\acadproc.dll
+ 00000438(1080) svchost.exe
16080000[00025000]
[ M] 99. c:\program files\bonjour\mdnsnsp.dll
+ 000004d4(1236) svchost.exe
006C0000[00010000]
[AM] 11. c:\windows\system32\wudfsvc.dll
006D0000[0002C000]
[ M] 174. c:\windows\system32\wudfplatform.dll
7C140000[00103000]
[ M] 102. c:\windows\system32\mfc71.dll
7C340000[00056000]
[ M] 103. c:\windows\system32\msvcr71.dll
7C3A0000[0007B000]
[ M] 104. c:\windows\system32\msvcp71.dll
60000000[00074000]
[AM] 98. c:\windows\system32\kmon.dll
10000000[00029000]
[AM] 73. e:\360safe\safemon\safemon.dll
03080000[0005B000]
[AM] 79. c:\program files\common files\adobe\acrobat\activex\pdfshell.dll
030E0000[0004C000]
[ M] 190. c:\program files\common files\adobe\acrobat\activex\pdfshell.chs
02490000[00020000]
[AM] 72. e:\迅雷6\thunder6\comdlls\xunleibho_now.dll
02030000[0002E000]
[AM] 81. c:\program files\winrar\rarext.dll
02410000[0001C000]
[AM] 84. c:\windows\system32\ravext.dll
02B40000[00024000]
[ M] 191. e:\hanlin ebook\wolext.dll
+ 000006ec(1772) rfwstub.exe
00400000[00017000]
[ M] 192. e:\rising\rfw\rfwstub.exe
7C3A0000[0007B000]
[ M] 104. c:\windows\system32\msvcp71.dll
7C340000[00056000]
[ M] 103. c:\windows\system32\msvcr71.dll
60000000[00074000]
[AM] 98. c:\windows\system32\kmon.dll
23700000[00028000]
[ M] 110. e:\rising\rfw\rscommon.dll
70000000[00019000]
[ M] 100. e:\rising\rfw\ijt_base.dll
75000000[0000F000]
[ M] 101. e:\rising\rfw\olemon.dll
+ 000007cc(1996) RavStub.exe
00400000[00021000]
[ M] 193. e:\rising\rav\ravstub.exe
10000000[0001F000]
[ M] 117. e:\rising\rav\proccom.dll
00620000[00024000]
[ M] 118. e:\rising\rav\rscommx2.dll
23700000[00028000]
[ M] 122. e:\rising\rav\rscommon.dll
70000000[00019000]
[ M] 100. e:\rising\rfw\ijt_base.dll
75000000[0000F000]
[ M] 101. e:\rising\rfw\olemon.dll
+ 0000084c(2124) svchost.exe
+ 00000878(2168) ctfmon.exe
60000000[00074000]
[AM] 98. c:\windows\system32\kmon.dll
70000000[00019000]
[ M] 100. e:\rising\rfw\ijt_base.dll
75000000[0000F000]
[ M] 101. e:\rising\rfw\olemon.dll
10000000[00029000]
[AM] 73. e:\360safe\safemon\safemon.dll
+ 000008d4(2260) msiexec.exe
60000000[00074000]
[AM] 98. c:\windows\system32\kmon.dll
10000000[0002E000]
[ M] 171. e:\rising\comx3.dll
006A0000[00019000]
[ M] 169. e:\rising\syslay.dll
+ 00000a98(2712) ras.exe
00400000[0000B000]
[ M] 194. e:\rising\ras.exe
7C140000[00103000]
[ M] 195. e:\rising\mfc71.dll
7C340000[00056000]
[ M] 167. e:\rising\msvcr71.dll
10000000[00029000]
[AM] 73. e:\360safe\safemon\safemon.dll
00A10000[00047000]
[ M] 196. e:\rising\kakamgr.dll
7C3A0000[0007B000]
[ M] 166. e:\rising\msvcp71.dll
00A60000[00019000]
[ M] 169. e:\rising\syslay.dll
00A90000[0001F000]
[ M] 117. e:\rising\rav\proccom.dll
00AB0000[00024000]
[ M] 118. e:\rising\rav\rscommx2.dll
00C00000[0002E000]
[ M] 171. e:\rising\comx3.dll
00E70000[00058000]
[ M] 197. e:\rising\dbmgr.dll
23800000[00022000]
[ M] 165. e:\rising\rsxml.dll
00FD0000[0002D000]
[ M] 198. e:\rising\pweb.dll
01000000[000C1000]
[ M] 199. e:\rising\pscan.dll
010D0000[0002F000]
[ M] 200. e:\rising\ncomm.dll
01120000[00070000]
[ M] 201. e:\rising\pset.dll
011B0000[0002A000]
[ M] 202. e:\rising\pdefend.dll
01210000[000B6000]
[ M] 203. e:\rising\ptools.dll
013D0000[0008C000]
[ M] 204. e:\rising\psysinfo.dll
23900000[00040000]
[ M] 172. e:\rising\pngdll.dll
16080000[00025000]
[ M] 99. c:\program files\bonjour\mdnsnsp.dll
03AD0000[0002F000]
[ M] 205. e:\rising\engine.dll
03980000[0000F000]
[ M] 206. e:\rising\zip.dll
60000000[00074000]
[AM] 98. c:\windows\system32\kmon.dll
10000000[0002E000]
[ M] 171. e:\rising\comx3.dll
00E20000[00019000]
[ M] 169. e:\rising\syslay.dll
70000000[00019000]
[ M] 100. e:\rising\rfw\ijt_base.dll
75000000[0000F000]
[ M] 101. e:\rising\rfw\olemon.dll
011A0000[00029000]
[AM] 73. e:\360safe\safemon\safemon.dll
16080000[00025000]
[ M] 99. c:\program files\bonjour\mdnsnsp.dll
325C0000[00012000]
[AM] 82. c:\program files\microsoft office\office11\msohev.dll
03930000[0000D000]
[AM] 76. c:\program files\common files\microsoft shared\office11\msoxmlmf.dll
+ 00000e3c(3644) knownsvr.exe
00400000[00072000]
[ M] 218. e:\rising\knownsvr.exe
10000000[0002F000]
[ M] 200. e:\rising\ncomm.dll
60000000[00074000]
[AM] 98. c:\windows\system32\kmon.dll
009A0000[0002E000]
[ M] 171. e:\rising\comx3.dll
009D0000[00019000]
[ M] 169. e:\rising\syslay.dll
00FA0000[00029000]
[AM] 73. e:\360safe\safemon\safemon.dll
16080000[00025000]
[ M] 99. c:\program files\bonjour\mdnsnsp.dll
用户系统信息：Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; User-agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; http://bsalsa.com) ; .NET CLR 1.1.4322)
