瑞星卡卡电脑诊断日志 v1.20 (2007-7-7 22:8:36)  北京瑞星科技股份有限公司

注释:    [A]表示该文件存在自启动关联;
    [M]表示该文件在内存中;

+ 注册表自运行项目
  + Win32 Services
    + HKLM\System\CurrentControlSet\Services
      msn
        [AM] 1. c:\windows\system32\microsoft\svchost.exe
      NVSvc
        [AM] 2. c:\windows\system32\nvsvc32.exe
      ose
        [AM] 3. c:\program files\common files\microsoft shared\source engine\ose.exe
      RfwProxySrv
        [A ] 4. c:\program files\rising\rfw\rfwproxy.exe
      RfwService
        [A ] 5. c:\program files\rising\rfw\rfwsrv.exe
      RsCCenter
        [A ] 6. c:\program files\rising\rav\ccenter.exe
      RsRavMon
        [A ] 7. c:\program files\rising\rav\ravmond.exe
      UMWdf
        [AM] 8. c:\windows\system32\wdfmgr.exe
  + Kernel Drivers
    + HKLM\System\CurrentControlSet\Services
      ALCXWDM
        [A ] 9. c:\windows\system32\drivers\alcxwdm.sys
      AmdK8
        [A ] 10. c:\windows\system32\drivers\amdk8.sys
      autorun
        [A ] 11. c:\huadio.tmp
      BaseTDI
        [A ] 12. c:\windows\system32\drivers\basetdi.sys
      ExpScaner
        [A ] 13. c:\program files\rising\rav\expscan.sys
      HookCont
        [A ] 14. c:\program files\rising\rav\hookcont.sys
      HookReg
        [A ] 15. c:\program files\rising\rav\hookreg.sys
      HookSys
        [A ] 16. c:\program files\rising\rav\hooksys.sys
      HookUrl
        [A ] 17. c:\program files\rising\rfw\hookurl.sys
      MEMSCAN
        [A ] 18. c:\program files\rising\rav\memscan.sys
      mProcRs
        [A ] 19. c:\program files\rising\rfw\mprocrs.sys
      npkcrypt
        [A ] 20. d:\program files\qq2006\npkcrypt.sys
      RsAntiSpyware
        [A ] 21. c:\windows\system32\drivers\rsboot.sys
      RsFwDrv
        [A ] 22. c:\program files\rising\rfw\rsfwdrv.sys
      RsNTGDI
        [A ] 23. c:\windows\system32\drivers\rsntgdi.sys
      RSPPSYS
        [A ] 24. c:\program files\rising\rav\rsppsys.sys
      RTL8023xp
        [A ] 25. c:\windows\system32\drivers\rtnicxp.sys
      Secdrv
        [A ] 26. c:\windows\system32\drivers\secdrv.sys
      sipfp
        [A ] 27. c:\windows\system32\drivers\sipfp.sys
      ZSMC301b
        [A ] 28. c:\windows\system32\drivers\usbvm31b.sys
  + File System Drivers
    + HKLM\System\CurrentControlSet\Services
      gwcjtwas
        [A ] 29. c:\windows\system32\drivers\gwcjtwas.sys
  + Explorer
    + HKLM\SOFTWARE\Classes\PROTOCOLS\Filter
      application/x-shockwave-flash
        [AM] 30. c:\program files\netmeeting\msn6161.dll
      text/html
        [AM] 30. c:\program files\netmeeting\msn6161.dll
      text/xml
        [A ] 31. c:\program files\common files\microsoft shared\office11\msoxmlmf.dll
    + HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved
      HyperTerminal Icon Ext
        [A ] 32. c:\windows\system32\hticons.dll
      Portable Media Devices
        [A ] 33. c:\windows\system32\audiodev.dll
      Portable Media Devices Menu
        [A ] 33. c:\windows\system32\audiodev.dll
      Shell Extensions for RealOne Player
        [A ] 34. c:\program files\real\realplayer\rpshell.dll
      Web Folders
        [A ] 35. c:\program files\common files\microsoft shared\web folders\msonsext.dll
      WinRAR shell extension
        [AM] 36. c:\program files\winrar\rarext.dll
      Microsoft Office HTML Icon Handler
        [AM] 37. c:\program files\microsoft office\office11\msohev.dll
      NvCpl DesktopContext Class
        [A ] 38. c:\windows\system32\nvcpl.dll
      Play on my TV helper
        [A ] 38. c:\windows\system32\nvcpl.dll
      Desktop Explorer
        [A ] 39. c:\windows\system32\nvshell.dll
      Desktop Explorer Menu
        [A ] 39. c:\windows\system32\nvshell.dll
      nView Desktop Context Menu
        [A ] 39. c:\windows\system32\nvshell.dll
      RISING
        [AM] 40. c:\windows\system32\ravext.dll
    + HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks
      {32CD708B-60A7-4C00-9377-D73EAA495F0F}
        [AM] 40. c:\windows\system32\ravext.dll
      {AC2DC2EF-5165-40A3-8CDF-41DCA1B0901A}
        [AM] 41. c:\windows\system32\shlhook.dll
  + Logon
    + HKLM\Software\Microsoft\Windows\CurrentVersion\Run
      RavTask
        [A ] 42. c:\program files\rising\rav\ravtask.exe
      runeip
        [A ] 43. c:\program files\rising\antispyware\runiep.exe
    + HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce
      KKDelay
        [A ] 44. c:\program files\rising\antispyware\runonce.exe
  + Boot Execute
    + HKLM\SYSTEM\CurrentControlSet\Control\NetworkProvider\Order
      BootExecute
        [A ] 45. c:\windows\system32\bsmain.exe
        [A ] 46. c:\windows\system32\kknative.exe
  + Image Hijacks
    + HKCR\.html
      htmlfile\Edit\Command
        [A ] 47. c:\program files\microsoft office\office11\msohtmed.exe
      htmlfile\Print\Command
        [A ] 47. c:\program files\microsoft office\office11\msohtmed.exe
      htmlfile\TencentTraveler\Command
        [A ] 48. d:\program files\tt\ttraveler.exe
    + HKCR\.htm
      htmlfile\Edit\Command
        [A ] 47. c:\program files\microsoft office\office11\msohtmed.exe
      htmlfile\Print\Command
        [A ] 47. c:\program files\microsoft office\office11\msohtmed.exe
      htmlfile\TencentTraveler\Command
        [A ] 48. d:\program files\tt\ttraveler.exe
+ 系统活动模块
  + 0000008c(140) tlntsvr.exe
  + 00000154(340) iexplore.exe
    10000000[00017000]
      [ M] 49. c:\program files\flashget\jccatch.dll
    019C0000[00022000]
      [AM] 30. c:\program files\netmeeting\msn6161.dll
    30000000[002EE000]
      [ M] 50. c:\windows\system32\macromed\flash\flash9b.ocx
    72C80000[00008000]
      [ M] 51. c:\windows\system32\msacm32.drv
    04B20000[00019000]
      [ M] 52. c:\program files\rising\rav\ravscrch.dll
    051B0000[00035000]
      [ M] 53. c:\windows\system32\xpsp3res.dll
    01360000[0001B000]
      [ M] 54. c:\program files\rising\antispyware\ieprot.dll
    325C0000[00012000]
      [AM] 37. c:\program files\microsoft office\office11\msohev.dll
  + 000001c8(456) smss.exe
  + 000001dc(476) wdfmgr.exe
    01000000[0000C000]
      [AM] 8. c:\windows\system32\wdfmgr.exe
  + 00000210(528) csrss.exe
  + 00000228(552) winlogon.exe
    72C80000[00008000]
      [ M] 51. c:\windows\system32\msacm32.drv
  + 00000254(596) services.exe
  + 00000260(608) lsass.exe
  + 000002fc(764) svchost.exe
  + 00000328(808) svchost.exe
  + 00000378(888) svchost.exe
  + 000003a0(928) svchost.exe
  + 00000408(1032) svchost.exe
  + 000004c8(1224) Explorer.EXE
    72C80000[00008000]
      [ M] 51. c:\windows\system32\msacm32.drv
    10000000[0001B000]
      [AM] 40. c:\windows\system32\ravext.dll
    01E50000[0001B000]
      [ M] 54. c:\program files\rising\antispyware\ieprot.dll
    00BD0000[0002C000]
      [AM] 36. c:\program files\winrar\rarext.dll
    23700000[0001A000]
      [ M] 55. c:\program files\rising\rav\rscommon.dll
  + 000005c4(1476) spoolsv.exe
  + 000005ec(1516) alg.exe
  + 00000694(1684) RfwMain.exe
    00400000[00073000]
      [ M] 56. c:\program files\rising\rfw\rfwmain.exe
    26600000[0007D000]
      [ M] 57. c:\program files\rising\rfw\rsguilib.dll
    23700000[0001A000]
      [ M] 58. c:\program files\rising\rfw\rscommon.dll
    10000000[0000F000]
      [ M] 59. c:\program files\rising\rfw\rfwctrl.dll
    23800000[0001A000]
      [ M] 60. c:\program files\rising\rfw\rsxml.dll
    23900000[00031000]
      [ M] 61. c:\program files\rising\rfw\pngdll.dll
    012C0000[0001B000]
      [ M] 54. c:\program files\rising\antispyware\ieprot.dll
  + 000006f0(1776) netdde.exe
  + 00000720(1824) cisvc.exe
  + 0000072c(1836) clipsrv.exe
  + 00000764(1892) imapi.exe
  + 00000788(1928) svchost.exe
    00400000[00004000]
      [AM] 1. c:\windows\system32\microsoft\svchost.exe
  + 000007a8(1960) nvsvc32.exe
    00400000[00022000]
      [AM] 2. c:\windows\system32\nvsvc32.exe
  + 000007d0(2000) svchost.exe
  + 00000810(2064) Indexbz.exe
    00400000[0020A000]
      [ M] 62. d:\program files\baizhaobox\indexbz.exe
    10000000[0001B000]
      [ M] 54. c:\program files\rising\antispyware\ieprot.dll
  + 00000828(2088) ctfmon.exe
    10000000[0001B000]
      [ M] 54. c:\program files\rising\antispyware\ieprot.dll
  + 00000958(2392) OSE.EXE
    30000000[00017000]
      [AM] 3. c:\program files\common files\microsoft shared\source engine\ose.exe
  + 00000bb0(2992) Ras.exe
    00400000[0013D000]
      [ M] 63. c:\program files\rising\antispyware\ras.exe
    10000000[000A0000]
      [ M] 64. c:\program files\rising\antispyware\rasgui.dll
    01540000[0001B000]
      [AM] 40. c:\windows\system32\ravext.dll
    01570000[00011000]
      [AM] 41. c:\windows\system32\shlhook.dll
    015F0000[0001B000]
      [ M] 54. c:\program files\rising\antispyware\ieprot.dll
    023C0000[00022000]
      [AM] 30. c:\program files\netmeeting\msn6161.dll
    02350000[0002F000]
      [ M] 65. c:\program files\rising\antispyware\engine.dll
    02380000[00012000]
      [ M] 66. c:\program files\rising\antispyware\zip.dll
    72C80000[00008000]
      [ M] 51. c:\windows\system32\msacm32.drv
  + 00000c10(3088) conime.exe
    10000000[0001B000]
      [ M] 54. c:\program files\rising\antispyware\ieprot.dll
  + 00000e74(3700) cidaemon.exe