瑞星卡卡电脑诊断日志 v1.30 (2007-7-16 16:31:21) 北京瑞星科技股份有限公司
注释: [A]表示该文件存在自启动关联;
[M]表示该文件在内存中;
+ 注册表自运行项目
+ 系统服务
+ HKLM\System\CurrentControlSet\Services
BlueSoleil Hid Service
[AM] 1. e:\蓝呀\btntservice.exe
NVSvc
[AM] 2. c:\windows\system32\nvsvc32.exe
RsCCenter
[A ] 3. e:\rising\rav\ccenter.exe
RsRavMon
[A ] 4. e:\rising\rav\ravmond.exe
UMWdf
[AM] 5. c:\windows\system32\wdfmgr.exe
+ 内核驱动
+ HKLM\System\CurrentControlSet\Services
ALCXWDM
[A ] 6. c:\windows\system32\drivers\alcxwdm.sys
AmdK8
[A ] 7. c:\windows\system32\drivers\amdk8.sys
BaseTDI
[A ] 8. c:\windows\system32\drivers\basetdi.sys
BlueletAudio
[A ] 9. c:\windows\system32\drivers\blueletaudio.sys
BT
[A ] 10. c:\windows\system32\drivers\btnetdrv.sys
Btcsrusb
[A ] 11. c:\windows\system32\drivers\btcusb.sys
BTHidEnum
[A ] 12. c:\windows\system32\drivers\vbtenum.sys
BTHidMgr
[A ] 13. c:\windows\system32\drivers\bthidmgr.sys
ExpScaner
[A ] 14. e:\rising\rav\expscan.sys
HookCont
[A ] 15. e:\rising\rav\hookcont.sys
HookReg
[A ] 16. e:\rising\rav\hookreg.sys
HookSys
[A ] 17. e:\rising\rav\hooksys.sys
MEMSCAN
[A ] 18. e:\rising\rav\memscan.sys
npkcrypt
[A ] 19. c:\program files\qq2006\npkcrypt.sys
RsAntiSpyware
[A ] 20. c:\windows\system32\drivers\rsboot.sys
RsNTGDI
[A ] 21. c:\windows\system32\drivers\rsntgdi.sys
RSPPSYS
[A ] 22. e:\rising\rav\rsppsys.sys
RTL8023xp
[A ] 23. c:\windows\system32\drivers\rtnicxp.sys
Secdrv
[A ] 24. c:\windows\system32\drivers\secdrv.sys
TesSafe
[A ] 25. c:\windows\system32\tessafe.sys
VComm
[A ] 26. c:\windows\system32\drivers\vcomm.sys
VcommMgr
[A ] 27. c:\windows\system32\drivers\vcommmgr.sys
ViaIde
[A ] 28. c:\windows\system32\drivers\viaidexp.sys
ZSMC301b
[A ] 29. c:\windows\system32\drivers\usbvm31b.sys
+ IE浏览器加载模块
+ HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar
{DB9ECD4F-FB8F-4311-B3CE-90B976C2707C}
[A ] 30. c:\windows\system32\kakatool.dll
+ HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper
Objects
{01443AEC-0FD1-40fd-9C87-E93D1494C233}
[A ] 31. e:\迅雷\comdlls\tdatonce_now.dll
{889D2FEB-5411-4565-8998-1DD2C5261283}
[A ] 32. e:\迅雷\comdlls\xunleibho_now.dll
+ 资源管理器加载模块
+ HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved
HyperTerminal Icon Ext
[A ] 33. c:\windows\system32\hticons.dll
Portable Media Devices
[A ] 34. c:\windows\system32\audiodev.dll
Portable Media Devices Menu
[A ] 34. c:\windows\system32\audiodev.dll
Web Folders
[A ] 35. c:\program files\common files\microsoft shared\web folders\msonsext.dll
WinRAR shell extension
[A ] 36. c:\program files\winrar\rarext.dll
NvCpl DesktopContext Class
[A ] 37. c:\windows\system32\nvcpl.dll
Play on my TV helper
[A ] 37. c:\windows\system32\nvcpl.dll
Desktop Explorer
[A ] 38. c:\windows\system32\nvshell.dll
Desktop Explorer Menu
[A ] 38. c:\windows\system32\nvshell.dll
nView Desktop Context Menu
[A ] 38. c:\windows\system32\nvshell.dll
RISING
[AM] 39. c:\windows\system32\ravext.dll
+ HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks
{32CD708B-60A7-4C00-9377-D73EAA495F0F}
[AM] 39. c:\windows\system32\ravext.dll
+ 用户登陆自运行项目
+ HKLM\Software\Microsoft\Windows\CurrentVersion\Run
wallpaper
[A ] 40. c:\windows\system32\壁纸自动换.exe
nwiz
[A ] 41. c:\windows\system32\nwiz.exe
BigDogPath
[AM] 42. c:\windows\vm_sti.exe
SoundMan
[AM] 43. c:\windows\soundman.exe
RavTask
[A ] 44. e:\rising\rav\ravtask.exe
runeip
[AM] 45. e:\瑞星卡卡\runiep.exe
TkBellExe
[A ] 46. c:\program files\common files\real\update_ob\realsched.exe
+ HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce
RavStub
[AM] 47. e:\rising\rav\ravstub.exe
KKDelay
[A ] 48. e:\瑞星卡卡\runonce.exe
+ 开机执行
+ HKLM\SYSTEM\CurrentControlSet\Control\NetworkProvider\Order
BootExecute
[A ] 49. c:\windows\system32\bsmain.exe
[A ] 50. c:\windows\system32\kknative.exe
+ 映像劫持
+ HKCR\.mp3
RealPlayer.MP3.6\open\Command
[A ] 51. e:\realpiay播放器\realplay.exe
+ 其他自启动项目
+ C:\Documents and Settings\All Users\「开始」菜单\程序\启动
BlueSoleil.lnk
[A ] 52. e:\蓝呀\bluesoleil.exe
+ 正在运行的进程
+ 000000f4(244) ctfmon.exe
00A00000[00037000]
[ M] 53. c:\windows\system32\winabcx.ime
10000000[0001B000]
[ M] 54. e:\瑞星卡卡\ieprot.dll
+ 00000230(560) smss.exe
+ 0000027c(636) csrss.exe
+ 00000294(660) winlogon.exe
01320000[00037000]
[ M] 53. c:\windows\system32\winabcx.ime
72C80000[00008000]
[ M] 55. c:\windows\system32\msacm32.drv
+ 000002c0(704) services.exe
+ 000002cc(716) lsass.exe
+ 00000354(852) svchost.exe
+ 0000039c(924) svchost.exe
+ 00000408(1032) svchost.exe
+ 0000043c(1084) svchost.exe
+ 00000484(1156) alg.exe
+ 0000049c(1180) svchost.exe
+ 000004dc(1244) wdfmgr.exe
01000000[0000C000]
[AM] 5. c:\windows\system32\wdfmgr.exe
+ 000004f8(1272) BTNtService.exe
00400000[0001A000]
[AM] 1. e:\蓝呀\btntservice.exe
+ 0000056c(1388) nvsvc32.exe
00400000[00022000]
[AM] 2. c:\windows\system32\nvsvc32.exe
00A50000[00037000]
[ M] 53. c:\windows\system32\winabcx.ime
+ 000005a4(1444) svchost.exe
+ 000005e4(1508) Explorer.EXE
00AA0000[00037000]
[ M] 53. c:\windows\system32\winabcx.ime
10000000[0001B000]
[AM] 39. c:\windows\system32\ravext.dll
015E0000[0001B000]
[ M] 54. e:\瑞星卡卡\ieprot.dll
72C80000[00008000]
[ M] 55. c:\windows\system32\msacm32.drv
+ 00000614(1556) spoolsv.exe
+ 000006c8(1736) RavStub.exe
00400000[00018000]
[AM] 47. e:\rising\rav\ravstub.exe
10000000[0001B000]
[ M] 56. e:\rising\rav\rscommx.dll
23700000[0001A000]
[ M] 57. e:\rising\rav\rscommon.dll
+ 0000076c(1900) VM_STI.EXE
00400000[00010000]
[AM] 42. c:\windows\vm_sti.exe
10000000[00037000]
[ M] 58. c:\windows\system32\vm31bprp.ax
00BF0000[0001B000]
[ M] 54. e:\瑞星卡卡\ieprot.dll
+ 00000778(1912) SOUNDMAN.EXE
00400000[0008F000]
[AM] 43. c:\windows\soundman.exe
00B50000[00037000]
[ M] 53. c:\windows\system32\winabcx.ime
10000000[0001B000]
[ M] 54. e:\瑞星卡卡\ieprot.dll
+ 00000794(1940) runiep.exe
00400000[00012000]
[AM] 45. e:\瑞星卡卡\runiep.exe
00AD0000[00037000]
[ M] 53. c:\windows\system32\winabcx.ime
00D30000[0001B000]
[ M] 54. e:\瑞星卡卡\ieprot.dll
+ 00000990(2448) Ras.exe
00400000[0013F000]
[ M] 59. e:\瑞星卡卡\ras.exe
10000000[000A3000]
[ M] 60. e:\瑞星卡卡\rasgui.dll
01300000[00037000]
[ M] 53. c:\windows\system32\winabcx.ime
01510000[0001B000]
[ M] 54. e:\瑞星卡卡\ieprot.dll
02680000[0002F000]
[ M] 61. e:\瑞星卡卡\engine.dll
026B0000[00012000]
[ M] 62. e:\瑞星卡卡\zip.dll
