运行魔兽世界后 瑞星发现木马并成功删除,重起电脑情况依旧!
瑞星卡卡电脑诊断日志 v1.30 (2007-7-19 9:23:9) 北京瑞星科技股份有限公司
注释: [A]表示该文件存在自启动关联;
[M]表示该文件在内存中;
+ 注册表自运行项目
+ 系统服务
+ HKLM\System\CurrentControlSet\Services
aspnet_state
[A ] 1. c:\windows\microsoft.net\framework\v2.0.50727\aspnet_state.exe
Microsoft Corporation
Microsoft ASP.NET State Server
.text,.data,.rsrc,
BlueSoleil Hid Service
[AM] 2. c:\program files\ivt corporation\bluesoleil\btntservice.exe
.text,.rdata,.data,
clr_optimization_v2.0.50727_32
[A ] 3. c:\windows\microsoft.net\framework\v2.0.50727\mscorsvw.exe
Microsoft Corporation
.NET Runtime Optimization Service
.text,.data,.rsrc,
MSSQL$SQLEXPRESS
[AM] 4. c:\program files\microsoft sql server\mssql.1\mssql\binn\sqlservr.exe
Microsoft Corporation
SQL Server Windows NT
.text,.data,.sdbid,.rsrc,
MSSQLServerADHelper
[A ] 5. c:\program files\microsoft sql server\90\shared\sqladhlp90.exe
Microsoft Corporation
Microsoft SQL Server Active Directory Helper Service
.text,.data,.rsrc,
msvsmon80
[A ] 6. d:\microsoft visual studio 8\common7\ide\remote debugger\x86\msvsmon.exe
Microsoft Corporation
Visual Studio Remote Debugging Monitor
.text,.orpc,.data,.rsrc,
NVSvc
[AM] 7. c:\windows\system32\nvsvc32.exe
NVIDIA Corporation
NVIDIA Driver Helper Service, Version 91.36
.text,.rdata,.data,.rsrc,
ose
[A ] 8. c:\program files\common files\microsoft shared\source engine\ose.exe
Microsoft Corporation
Office Source Engine
.text,.data,.rsrc,
RfwProxySrv
[A ] 9. c:\program files\rising\rfw\rfwproxy.exe
Beijing Rising Technology Co., Ltd.
Rising Personal Proxy Service
.text,.rdata,.data,.rsrc,
RfwService
[A ] 10. c:\program files\rising\rfw\rfwsrv.exe
Beijing Rising Technology Co., Ltd.
Rising Personal FireWall Service
.text,.rdata,.data,.rsrc,
RsCCenter
[A ] 11. c:\program files\rising\rav\ccenter.exe
Beijing Rising Technology Co., Ltd.
CCenter
.text,.rdata,.data,.rsrc,
RsRavMon
[A ] 12. c:\program files\rising\rav\ravmond.exe
Beijing Rising Technology Co., Ltd.
RavMond
.text,.rdata,.data,.rsrc,
SQLBrowser
[A ] 13. c:\program files\microsoft sql server\90\shared\sqlbrowser.exe
Microsoft Corporation
SQL Browser Service EXE
.text,.data,.sdbid,.rsrc,
SQLWriter
[AM] 14. c:\program files\microsoft sql server\90\shared\sqlwriter.exe
Microsoft Corporation
SQL Server VSS Writer
.text,.data,.rsrc,
WMPNetworkSvc
[A ] 15. c:\program files\windows media player\wmpnetwk.exe
Microsoft Corporation
Windows Media Player 网络共享服务
.text,.data,.rsrc,.reloc,
WudfSvc
[A ] 16. c:\windows\system32\wudfsvc.dll
Microsoft Corporation
Windows Driver Foundation - User-mode Driver Framework Service
.text,.data,.rsrc,.reloc,
+ 内核驱动
+ HKLM\System\CurrentControlSet\Services
ALCXWDM
[A ] 17. c:\windows\system32\drivers\alcxwdm.sys
Realtek Semiconductor Corp.
Realtek AC'97 Audio Driver (WDM)
.text,CODE,.rdata,.data,.data1,PAGE,INIT,.rsrc,.reloc,
AmdK8
[A ] 18. c:\windows\system32\drivers\amdk8.sys
Advanced Micro Devices
AMD Processor Driver
.text,.rdata,.data,PAGE,PAGELK,INIT,.rsrc,.reloc,
AvgAsCln
[A ] 19. c:\windows\system32\drivers\avgascln.sys
GRISOFT, s.r.o.
AVG7 Clean Driver
.text,.rdata,.data,INIT,.rsrc,.reloc,
BaseTDI
[A ] 20. c:\windows\system32\drivers\basetdi.sys
Beijing Rising Technology Co., Ltd.
basetdi
.text,.rdata,.data,INIT,.rsrc,.reloc,
BlueletAudio
[A ] 21. c:\windows\system32\drivers\blueletaudio.sys
IVT Corporation
Bluelet Audio Driver
.text,.rdata,.data,PAGE,INIT,.rsrc,.reloc,
BT
[A ] 22. c:\windows\system32\drivers\btnetdrv.sys
IVT Corporation
Bluetooth PAN Network Adapter Driver
.text,.data,.STL,.CRT,PAGE,INIT,.rsrc,.reloc,
Btcsrusb
[A ] 23. c:\windows\system32\drivers\btcusb.sys
IVT Corporation
Bluetooth USB Device Driver
.text,.data,INIT,.rsrc,.reloc,
BTHidEnum
[A ] 24. c:\windows\system32\drivers\vbtenum.sys
.text,PAGE,INIT,.reloc,
BTHidMgr
[A ] 25. c:\windows\system32\drivers\bthidmgr.sys
IVT Corporation
Bluetooth HID Manager driver
.text,.data,.CRT,.STL,PAGE,INIT,.rsrc,.reloc,
BTNetFilter
[A ] 26. c:\windows\system32\drivers\btnetfilter.sys
.text,.rdata,.data,INIT,.reloc,
ExpScaner
[A ] 27. c:\program files\rising\rav\expscan.sys
ExpScan.sys
.text,.rdata,.data,INIT,.rsrc,.reloc,
HookCont
[A ] 28. c:\program files\rising\rav\hookcont.sys
Rising
HookCont
.text,.rdata,.data,INIT,.rsrc,.reloc,
HookReg
[A ] 29. c:\program files\rising\rav\hookreg.sys
.text,.rdata,.data,INIT,.rsrc,.reloc,
HookSys
[A ] 30. c:\program files\rising\rav\hooksys.sys
Rising
Hooksys
.text,.rdata,.data,INIT,.rsrc,.reloc,
HookUrl
[A ] 31. c:\program files\rising\rfw\hookurl.sys
Beijing Rising Technology Co., Ltd.
HookUrl
.text,.rdata,.data,INIT,.rsrc,.reloc,
MEMSCAN
[A ] 32. c:\program files\rising\rav\memscan.sys
瑞星软件有限公司
MemScan Driver
.text,.rdata,.data,INIT,.rsrc,.reloc,
mProcRs
[A ] 33. c:\program files\rising\rfw\mprocrs.sys
Beijing Rising Technology Co., Ltd.
Rising Personal FireWall mprocrs.sys
.text,.rdata,.data,INIT,.rsrc,.reloc,
NPF
[A ] 34. c:\windows\system32\drivers\npf.sys
CACE Technologies
npf
.text,.rdata,.data,INIT,.rsrc,.reloc,
npkcrypt
[A ] 35. d:\program files\qq2007\npkcrypt.sys
INCA Internet Co., Ltd.
nProtect KeyCrypt Driver
.text,.rdata,.data,INIT,.rsrc,.reloc,
npkcusb
[A ] 36. d:\program files\qq2007\npkcusb.sys
INCA Internet Co., Ltd.
nProtect KeyCrypt Driver
.text,page,init,.rdata,.data,INIT,.rsrc,.reloc,
nvata
[A ] 37. c:\windows\system32\drivers\nvata.sys
NVIDIA Corporation
NVIDIA? nForce(TM) IDE Performance Driver
.text,.rdata,.data,PAGE,INIT,.rsrc,.reloc,
NVATABUS
[A ] 38. c:\windows\system32\drivers\nvatabus.sys
NVIDIA Corporation
NVIDIA? nForce(TM) IDE Performance Driver
.text,.rdata,.data,PAGE,INIT,.rsrc,.reloc,
NVENETFD
[A ] 39. c:\windows\system32\drivers\nvenetfd.sys
NVIDIA Corporation
NVIDIA Networking Function Driver.
.text,.rdata,.data,INIT,.rsrc,.reloc,
nvnetbus
[A ] 40. c:\windows\system32\drivers\nvnetbus.sys
NVIDIA Corporation
NVIDIA Networking Bus Driver.
.text,.rdata,.data,INIT,.rsrc,.reloc,
RsAntiSpyware
[A ] 41. c:\windows\system32\drivers\rsboot.sys
Beijing Rising Technology Co., Ltd.
Anti-RootKit Driver
.text,.rdata,.data,INIT,.rsrc,.reloc,
RsFwDrv
[A ] 42. c:\program files\rising\rfw\rsfwdrv.sys
Beijing Rising Technology Co., Ltd.
nt_fwdrv
.text,.rdata,.data,INIT,.rsrc,.reloc,
RsNTGDI
[A ] 43. c:\windows\system32\drivers\rsntgdi.sys
Beijing Rising Technology Co., Ltd.
RsNTGDI
.text,.rdata,INIT,.rsrc,.reloc,
RSPPSYS
[A ] 44. c:\program files\rising\rav\rsppsys.sys
Rising
RSPPSYS.SYS
.text,.rdata,.data,INIT,.rsrc,.reloc,
RTL8023xp
[A ] 45. c:\windows\system32\drivers\rtnicxp.sys
Realtek Semiconductor Corporation
Realtek 10/100/1000 NDIS 5.1 Driver
.text,.rdata,.data,PAGE,INIT,.rsrc,.reloc,
Secdrv
[A ] 46. c:\windows\system32\drivers\secdrv.sys
.text,.data,INIT,.reloc,
sptd
[A ] 47. c:\windows\system32\drivers\sptd.sys
VComm
[A ] 48. c:\windows\system32\drivers\vcomm.sys
IVT Corporation
Bluetooth Serial Port Driver
.text,PAGE,.data,.CRT,.STL,INIT,INIT,.rsrc,.reloc,
VcommMgr
[A ] 49. c:\windows\system32\drivers\vcommmgr.sys
IVT Corporation
Bluetooth VcommMgr driver
.text,PAGE,.data,.STL,.CRT,INIT,INIT,.rsrc,.reloc,
vcs
[A ] 50. g:\downloads\av vcs 3.0\av vcs 3.0\vcs.sys
.text,.data,INIT,.reloc,
VSPerfDrv
[A ] 51. d:\microsoft visual studio 8\team tools\performance tools\vsperfdrv.sys
Microsoft Corporation
VSPerf - Profiling Control Driver
.text,.data,PAGE,INIT,.rsrc,.reloc,
WudfPf
[A ] 52. c:\windows\system32\drivers\wudfpf.sys
Microsoft Corporation
Windows Driver Foundation - User-mode Driver Framework Platform Driver
.text,.rdata,.data,PAGE,.edata,INIT,.rsrc,.reloc,
WudfRd
[A ] 53. c:\windows\system32\drivers\wudfrd.sys
Microsoft Corporation
Windows Driver Foundation - User-mode Driver Framework Reflector
.text,.rdata,.data,PAGE,INIT,.rsrc,.reloc,