瑞星卡卡电脑诊断日志 v1.30 (2008-1-16 22:21:22) 北京瑞星科技股份有限公司
注释: [A]表示该文件存在自启动关联;
[M]表示该文件在内存中;
+ 注册表自运行项目
+ 系统服务
+ HKLM\System\CurrentControlSet\Services
AVP
[A ] 1. c:\program files\kaspersky lab\kaspersky anti-virus 6.0\avp.exe
ose
[A ] 2. c:\program files\common files\microsoft shared\source engine\ose.exe
WMPNetworkSvc
[A ] 3. c:\program files\windows media player\wmpnetwk.exe
WudfSvc
[A ] 4. c:\windows\system32\wudfsvc.dll
+ 内核驱动
+ HKLM\System\CurrentControlSet\Services
AmdK8
[A ] 5. c:\windows\system32\drivers\amdk8.sys
HDAudBus
[A ] 6. c:\windows\system32\drivers\hdaudbus.sys
ialm
[A ] 7. c:\windows\system32\drivers\ialmnt5.sys
IntcAzAudAddService
[A ] 8. c:\windows\system32\drivers\rtkhdaud.sys
kl1
[A ] 9. c:\windows\system32\drivers\kl1.sys
klif
[A ] 10. c:\windows\system32\drivers\klif.sys
npkcrypt
[A ] 11. c:\program files\tencent\qq\npkcrypt.sys
pcrgjj
[A ] 12. c:\windows\system32\drivers\pcrgjj.sys
RsAntiSpyware
[A ] 13. c:\windows\system32\drivers\rsboot.sys
RTL8023xp
[A ] 14. c:\windows\system32\drivers\rtnicxp.sys
Secdrv
[A ] 15. c:\windows\system32\drivers\secdrv.sys
SNP325
[A ] 16. c:\windows\system32\drivers\snp325.sys
WudfPf
[A ] 17. c:\windows\system32\drivers\wudfpf.sys
WudfRd
[A ] 18. c:\windows\system32\drivers\wudfrd.sys
+ 文件系统驱动
+ HKLM\System\CurrentControlSet\Services
ADProt
[A ] 19. c:\windows\system32\drivers\adprot.sys
+ 系统登陆自运行
+ HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify
igfxcui
[A ] 20. c:\windows\system32\igfxdev.dll
klogon
[AM] 21. c:\windows\system32\klogon.dll
WgaLogon
[AM] 22. c:\windows\system32\wgalogon.dll
+ IE浏览器加载模块
+ HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper
Objects
{0C7C23EE-A848-485B-873C-0ED954731014}
[A ] 23. c:\program files\thunder\comdlls\xunleibho_007.dll
{889D2FEB-5411-4565-8998-1DD2C5261283}
[A ] 23. c:\program files\thunder\comdlls\xunleibho_007.dll
{B69F34DD-F0F9-42DC-9EDD-957187DA688D}
[AM] 24. f:\360safe_3.4\safemon\safemon.dll
+ 资源管理器加载模块
+ HKLM\SOFTWARE\Classes\PROTOCOLS\Filter
text/xml
[A ] 25. c:\program files\common files\microsoft shared\office11\msoxmlmf.dll
+ HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved
HyperTerminal Icon Ext
[A ] 26. c:\windows\system32\hticons.dll
WinRAR shell extension
[AM] 27. c:\program files\winrar\rarext.dll
Microsoft Office HTML Icon Handler
[A ] 28. c:\program files\microsoft office\office11\msohev.dll
Web Folders
[A ] 29. c:\program files\common files\microsoft shared\web folders\msonsext.dll
PicaView
[A ] 30. c:\program files\acdsee\picaview.dll
Web反病毒保护
[A ] 31. c:\program files\kaspersky lab\kaspersky anti-virus 6.0\scieplugin.dll
Portable Media Devices
[A ] 32. c:\windows\system32\audiodev.dll
Portable Media Devices Menu
[A ] 32. c:\windows\system32\audiodev.dll
Portable Devices
[A ] 33. c:\windows\system32\wpdshext.dll
Portable Devices Menu
[A ] 33. c:\windows\system32\wpdshext.dll
+ HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks
{AC2DC2EF-5165-40A3-8CDF-41DCA1B0901A}
[AM] 34. c:\windows\system32\shlhook.dll
+ HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellService
ObjectDelayLoad
WPDShServiceObj
[AM] 35. c:\windows\system32\wpdshserviceobj.dll
+ 用户登陆自运行项目
+ HKLM\Software\Microsoft\Windows\CurrentVersion\Run
kav
[A ] 1. c:\program files\kaspersky lab\kaspersky anti-virus 6.0\avp.exe
360Safetray
[AM] 36. f:\360safe_3.4\safemon\360tray.exe
5QIM
[AM] 37. c:\program files\校内\校内通\5qim.exe
runeip
[AM] 38. c:\program files\rising\antispyware\runiep.exe
+ HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce
KKDelay
[A ] 39. c:\program files\rising\antispyware\runonce.exe
+ 开机执行
+ HKLM\SYSTEM\CurrentControlSet\Control\NetworkProvider\Order
BootExecute
[A ] 40. c:\windows\system32\kknative.exe
+ 映像劫持
+ HKCR\.html
htmlfile\Edit\Command
[A ] 41. c:\program files\microsoft office\office11\msohtmed.exe
htmlfile\Print\Command
[A ] 41. c:\program files\microsoft office\office11\msohtmed.exe
+ HKCR\.htm
htmlfile\Edit\Command
[A ] 41. c:\program files\microsoft office\office11\msohtmed.exe
htmlfile\Print\Command
[A ] 41. c:\program files\microsoft office\office11\msohtmed.exe
+ 正在运行的进程
+ 00000110(272) Ras.exe
00400000[00170000]
[ M] 42. c:\program files\rising\antispyware\ras.exe
780C0000[00061000]
[ M] 43. c:\program files\rising\antispyware\msvcp60.dll
10000000[00013000]
[ M] 44. c:\program files\rising\antispyware\topsoft.dll
7C140000[00103000]
[ M] 45. c:\program files\rising\antispyware\mfc71.dll
7C340000[00056000]
[ M] 46. c:\program files\rising\antispyware\msvcr71.dll
7C3A0000[0007B000]
[ M] 47. c:\program files\rising\antispyware\msvcp71.dll
00DF0000[0001D000]
[AM] 24. f:\360safe_3.4\safemon\safemon.dll
00E20000[000BD000]
[ M] 48. c:\program files\rising\antispyware\rasgui.dll
01540000[0001B000]
[ M] 49. c:\program files\rising\antispyware\ieprot.dll
02970000[00011000]
[AM] 34. c:\windows\system32\shlhook.dll
67500000[00010000]
[ M] 50. c:\program files\kaspersky lab\kaspersky anti-virus 6.0\scr_ch_pg.dll
67000000[00008000]
[ M] 51. c:\program files\kaspersky lab\kaspersky anti-virus 6.0\klscav.dll
66600000[00022000]
[ M] 52. c:\program files\kaspersky lab\kaspersky anti-virus 6.0\pr_remote.dll
64D00000[00047000]
[ M] 53. c:\program files\kaspersky lab\kaspersky anti-virus 6.0\prloader.dll
64A00000[00030000]
[ M] 54. c:\program files\kaspersky lab\kaspersky anti-virus 6.0\prkernel.ppl
66200000[00043000]
[ M] 55. c:\program files\kaspersky lab\kaspersky anti-virus 6.0\params.ppl
66900000[0002D000]
[ M] 56. c:\program files\kaspersky lab\kaspersky anti-virus 6.0\pxstub.ppl
67F00000[00007000]
[ M] 57. c:\program files\kaspersky lab\kaspersky anti-virus 6.0\tempfile.ppl
+ 000001a0(416) conime.exe
10000000[0001D000]
[AM] 24. f:\360safe_3.4\safemon\safemon.dll
00A60000[0001B000]
[ M] 49. c:\program files\rising\antispyware\ieprot.dll
+ 00000224(548) smss.exe
+ 00000268(616) csrss.exe
+ 00000280(640) winlogon.exe
10000000[00007000]
[AM] 21. c:\windows\system32\klogon.dll
01880000[0003B000]
[AM] 22. c:\windows\system32\wgalogon.dll
72C80000[00008000]
[ M] 58. c:\windows\system32\msacm32.drv
+ 000002ac(684) services.exe
47260000[0000F000]
[ M] 59. c:\windows\apppatch\acadproc.dll
+ 000002b8(696) lsass.exe
+ 00000350(848) svchost.exe
+ 0000038c(908) svchost.exe
+ 000003dc(988) svchost.exe
+ 00000424(1060) svchost.exe
+ 00000440(1088) alg.exe
+ 00000458(1112) svchost.exe
+ 00000528(1320) spoolsv.exe
+ 000005d4(1492) Explorer.EXE
017D0000[0001B000]
[ M] 49. c:\program files\rising\antispyware\ieprot.dll
018E0000[0001D000]
[AM] 24. f:\360safe_3.4\safemon\safemon.dll
164A0000[00023000]
[AM] 35. c:\windows\system32\wpdshserviceobj.dll
109C0000[0002C000]
[ M] 60. c:\windows\system32\portabledevicetypes.dll
72C80000[00008000]
[ M] 58. c:\windows\system32\msacm32.drv
10930000[00049000]
[ M] 61. c:\windows\system32\portabledeviceapi.dll
01EB0000[0002E000]
[AM] 27. c:\program files\winrar\rarext.dll
67800000[0000A000]
[ M] 62. c:\program files\kaspersky lab\kaspersky anti-virus 6.0\shellex.dll
+ 00000684(1668) 360tray.exe
00400000[0002A000]
[AM] 36. f:\360safe_3.4\safemon\360tray.exe
10000000[0001D000]
[AM] 24. f:\360safe_3.4\safemon\safemon.dll
00A20000[0000C000]
[ M] 63. f:\360safe_3.4\safemon\safekrnl.dll
00B00000[00022000]
[ M] 64. f:\360safe_3.4\antiadwa.dll
00B70000[0001B000]
[ M] 49. c:\program files\rising\antispyware\ieprot.dll
+ 0000068c(1676) 5QIM.exe
00400000[00204000]
[AM] 37. c:\program files\校内\校内通\5qim.exe
7C3A0000[0007B000]
[ M] 65. c:\program files\校内\校内通\msvcp71.dll
7C340000[00056000]
[ M] 66. c:\program files\校内\校内通\msvcr71.dll
10000000[00058000]
[ M] 67. c:\program files\校内\校内通\5qimmedia.dll
00610000[000E5000]
[ M] 68. c:\program files\校内\校内通\group.dll
00380000[00041000]
[ M] 69. c:\program files\校内\校内通\litedb.dll
00EB0000[0001D000]
[AM] 24. f:\360safe_3.4\safemon\safemon.dll
02880000[0001B000]
[ M] 49. c:\program files\rising\antispyware\ieprot.dll
+ 0000069c(1692) runiep.exe
00400000[00016000]
[AM] 38. c:\program files\rising\antispyware\runiep.exe
10000000[0001D000]
[AM] 24. f:\360safe_3.4\safemon\safemon.dll
00C20000[0001B000]
[ M] 49. c:\program files\rising\antispyware\ieprot.dll
+ 00000738(1848) svchost.exe
+ 00000888(2184) msiexec.exe
