瑞星卡卡电脑诊断日志 v1.30 (2008-6-27 8:0:15) 北京瑞星科技股份有限公司
注释: [a]表示该文件存在自启动关联;
[m]表示该文件在内存中;
+ 注册表自运行项目
+ 系统服务
+ hklm\system\currentcontrolset\services
ati hotkey poller
[am] 1. c:\windows\system32\ati2evxx.exe
ccproxy
[am] 2. j:\ccproxy\ccproxy.exe
mssql$msde_gsecms
[am] 3. d:\全国政府采购执行情况专项检查软件\msde_gsecms\binnmssql$msde_gsecms\binn\sqlservr.exe
mssqlserveradhelper
[a ] 4. c:\program files\microsoft sql server\80\tools\binn\sqladhlp.exe
ose
[a ] 5. c:\program files\common files\microsoft shared\source engine\ose.exe
rsccenter
[am] 6. c:\program files\rising\rav\ccenter.exe
rsravmon
[am] 7. c:\program files\rising\rav\ravmond.exe
sqlagent$msde_gsecms
[a ] 8. d:\全国政府采购执行情况专项检查软件\msde_gsecms\binnmssql$msde_gsecms\binn\sqlagent.exe
stormser
[am] 9. c:\program files\ringz studio\storm codec\stormser.exe
wmpnetworksvc
[a ] 10. c:\program files\windows media player\wmpnetwk.exe
wudfsvc
[a ] 11. c:\windows\system32\wudfsvc.dll
+ 内核驱动
+ hklm\system\currentcontrolset\services
100133
[a ] 12. c:\windows\system32\drivers\100133.sys
alcxwdm
[a ] 13. c:\windows\system32\drivers\alcxwdm.sys
amdk8
[a ] 14. c:\windows\system32\drivers\amdk8.sys
hookcont
[a ] 15. c:\windows\system32\drivers\hookcont.sys
hookntos
[a ] 16. c:\windows\system32\drivers\hookntos.sys
hookreg
[a ] 17. c:\windows\system32\drivers\hookreg.sys
hooksys
[a ] 18. c:\windows\system32\drivers\hooksys.sys
npkcrypt
[a ] 19. c:\program files\qq2006\npkcrypt.sys
oineksyzcu
[a ] 20. d:\downloads\wopticleangreen\wopticleangreen\wopticlean.sys
rsantispyware
[a ] 21. c:\windows\system32\drivers\rsboot.sys
rsntgdi
[a ] 22. c:\windows\system32\drivers\rsntgdi.sys
secdrv
[a ] 23. c:\windows\system32\drivers\secdrv.sys
wudfpf
[a ] 24. c:\windows\system32\drivers\wudfpf.sys
wudfrd
[a ] 25. c:\windows\system32\drivers\wudfrd.sys
+ 系统登陆自运行
+ hklm\software\microsoft\windows nt\currentversion\winlogon\notify
atiextevent
[am] 26. c:\windows\system32\ati2evxx.dll
+ ie浏览器加载模块
+ hklm\software\microsoft\internet explorer\toolbar
{db9ecd4f-fb8f-4311-b3ce-90b976c2707c}
[am] 27. c:\windows\system32\kakatool.dll
+ hkcu\software\microsoft\internet explorer\urlsearchhooks
{db8b2393-7a6c-4c76-88ce-6b1f6ff6ffe9}
[am] 28. c:\program files\tencent\ssplus\saddr1.dll
+ hklm\software\microsoft\windows\currentversion\explorer\browser helper objects
{0c7c23ef-a848-485b-873c-0ed954731014}
[am] 28. c:\program files\tencent\ssplus\saddr1.dll
{3049c3e9-b461-4bc5-8870-4c09146192ca}
[am] 29. c:\program files\real\realplayer\rpbrowserrecordplugin.dll
{39f7e362-828a-4b5a-bcaf-5b79bfdfea60}
[am] 30. c:\program files\bitcomet\tools\bitcometbho_1.2.2.28.dll
{889d2feb-5411-4565-8998-1dd2c5261283}
[am] 31. c:\program files\thunder\comdlls\xunleibho_002.dll
+ 资源管理器加载模块
+ hklm\software\classes\protocols\filter
text/xml
[a ] 32. c:\program files\common files\microsoft shared\office11\msoxmlmf.dll
+ hklm\software\microsoft\windows\currentversion\shell extensions\approved
hyperterminal icon ext
[a ] 33. c:\windows\system32\hticons.dll
winrar shell extension
[a ] 34. c:\program files\winrar\rarext.dll
shell extensions for realone player
[a ] 35. c:\program files\real\realplayer\rpshell.dll
microsoft office html icon handler
[am] 36. c:\program files\microsoft office\office11\msohev.dll
web folders
[a ] 37. c:\program files\common files\microsoft shared\web folders\msonxxxt.dll
portable media devices
[a ] 38. c:\windows\system32\audiodev.dll
portable media devices menu
[a ] 38. c:\windows\system32\audiodev.dll
portable devices
[a ] 39. c:\windows\system32\wpdshext.dll
portable devices menu
[a ] 39. c:\windows\system32\wpdshext.dll
rising
[a ] 40. c:\windows\system32\ravext.dll
+ hklm\software\microsoft\windows\currentversion\explorer\shellexecutehooks
{ac2dc2ef-5165-40a3-8cdf-41dca1b0901a}
[am] 41. c:\windows\system32\shlhook.dll
+ hklm\software\microsoft\windows\currentversion\shellserviceobjectdelayload
wpdshserviceobj
[am] 42. c:\windows\system32\wpdshserviceobj.dll
+ 用户登陆自运行项目
+ hklm\software\microsoft\windows\currentversion\run
ravtask
[am] 43. c:\program files\rising\rav\ravtask.exe
runeip
[am] 44. c:\program files\rising\antispyware\runiep.exe
tkbellexe
[am] 45. c:\program files\common files\real\update_ob\realsched.exe
+ 开机执行
+ hklm\system\currentcontrolset\control\networkprovider\order
bootexecute
[a ] 46. c:\windows\system32\bsmain.exe
+ 映像劫持
+ hkcr\.html
htmlfile\edit\command
[a ] 47. c:\program files\microsoft office\office11\msohtmed.exe
htmlfile\print\command
[a ] 47. c:\program files\microsoft office\office11\msohtmed.exe
+ hkcr\.htm
htmlfile\edit\command
[a ] 47. c:\program files\microsoft office\office11\msohtmed.exe
htmlfile\print\command
[a ] 47. c:\program files\microsoft office\office11\msohtmed.exe
+ hkcr\.mp3
realplayer.mp3.6\open\command
[a ] 48. c:\program files\real\realplayer\realplay.exe
+ 其他自启动项目
+ c:\documents and settings\all users\「开始」菜单\程序\启动
服务管理器.lnk
[am] 49. c:\program files\microsoft sql server\80\tools\binn\sqlmangr.exe
+ 正在运行的进程
+ 000001d4(468) smss.exe
+ 00000200(512) alg.exe
+ 0000020c(524) csrss.exe
+ 00000228(552) winlogon.exe
10000000[00018000]
[am] 26. c:\windows\system32\ati2evxx.dll
72c80000[00008000]
[ m] 50. c:\windows\system32\msacm32.drv
+ 00000254(596) services.exe
47260000[0000f000]
[ m] 51. c:\windows\apppatch\acadproc.dll
+ 00000260(608) lsass.exe
+ 000002f4(756) ati2evxx.exe
00400000[0006e000]
[am] 1. c:\windows\system32\ati2evxx.exe
00ca0000[00010000]
[ m] 52. c:\windows\system32\ati2edxx.dll
+ 00000308(776) svchost.exe
+ 00000350(848) svchost.exe
+ 00000390(912) ccenter.exe
00400000[00029000]
[am] 6. c:\program files\rising\rav\ccenter.exe
+ 000003a8(936) svchost.exe
+ 00000408(1032) svchost.exe
+ 00000414(1044) ati2evxx.exe
00400000[0006e000]
[am] 1. c:\windows\system32\ati2evxx.exe
00ca0000[00010000]
[ m] 52. c:\windows\system32\ati2edxx.dll
10000000[00018000]
[am] 26. c:\windows\system32\ati2evxx.dll
+ 00000464(1124) svchost.exe
+ 000004d8(1240) ras.exe
00400000[001ff000]
[ m] 53. c:\program files\rising\antispyware\ras.exe
7c140000[00103000]
[ m] 54. c:\program files\rising\antispyware\mfc71.dll
7c340000[00056000]
[ m] 55. c:\program files\rising\antispyware\msvcr71.dll
7c3a0000[0007b000]
[ m] 56. c:\program files\rising\antispyware\msvcp71.dll
10000000[00013000]
[ m] 57. c:\program files\rising\antispyware\topsoft.dll
00370000[00032000]
[ m] 58. c:\program files\rising\antispyware\ncomm.dll
00d50000[0001f000]
[ m] 59. c:\program files\rising\rav\proccom.dll
00f20000[00024000]
[ m] 60. c:\program files\rising\rav\rscommx2.dll
01060000[0014d000]
[ m] 61. c:\program files\rising\antispyware\rasgui.dll
23800000[00022000]
[ m] 62. c:\program files\rising\antispyware\rsxml.dll
03020000[00018000]
[ m] 63. c:\program files\rising\antispyware\ktrojan.dll
03050000[0002f000]
[ m] 64. c:\program files\rising\antispyware\engine.dll
03090000[00041000]
[ m] 65. c:\program files\rising\antispyware\rsdialog.dll
030f0000[00024000]
[ m] 66. c:\program files\rising\antispyware\scanunv.dll
03130000[0001f000]
[ m] 67. c:\program files\rising\antispyware\secscan.dll
03530000[00015000]
[ m] 68. c:\program files\rising\antispyware\secex.dll
03910000[00012000]
[ m] 69. c:\program files\rising\antispyware\zip.dll
02f30000[00028000]
[ m] 70. c:\program files\rising\rav\ravscrch.dll
30000000[003ae000]
[ m] 71. c:\windows\system32\macromed\flash\flash9e.ocx
72c80000[00008000]
[ m] 50. c:\windows\system32\msacm32.drv
+ 0000056c(1388) spoolsv.exe
+ 0000063c(1596) ccproxy.exe
00400000[00120000]
[am] 2. j:\ccproxy\ccproxy.exe
+ 000006dc(1756) sqlservr.exe
00400000[008bb000]
[am] 3. d:\全国政府采购执行情况专项检查软件\msde_gsecms\binnmssql$msde_gsecms\binn\sqlservr.exe
7c3a0000[0007b000]
[ m] 72. c:\windows\system32\msvcp71.dll
7c340000[00056000]
[ m] 73. c:\windows\system32\msvcr71.dll
41060000[00006000]
[ m] 74. d:\全国政府采购执行情况专项检查软件\msde_gsecms\binnmssql$msde_gsecms\binn\opends60.dll
42ae0000[00090000]
[ m] 75. d:\全国政府采购执行情况专项检查软件\msde_gsecms\binnmssql$msde_gsecms\binn\sqlsort.dll
41070000[0000e000]
[ m] 76. d:\全国政府采购执行情况专项检查软件\msde_gsecms\binnmssql$msde_gsecms\binn\ums.dll
41080000[0000b000]
[ m] 77. d:\全国政府采购执行情况专项检查软件\msde_gsecms\binnmssql$msde_gsecms\binn\resources\2052\sqlevn70.rll
42cf0000[00016000]
[ m] 78. d:\全国政府采购执行情况专项检查软件\msde_gsecms\binnmssql$msde_gsecms\binn\ssnetlib.dll
42cd0000[00008000]
[ m] 79. d:\全国政府采购执行情况专项检查软件\msde_gsecms\binnmssql$msde_gsecms\binn\ssmslpcn.dll
410d0000[00007000]
[ m] 80. d:\全国政府采购执行情况专项检查软件\msde_gsecms\binnmssql$msde_gsecms\binn\ssnmpn70.dll
+ 000007c0(1984) stormser.exe
00400000[000f6000]
[am] 9. c:\program files\ringz studio\storm codec\stormser.exe
+ 000008ec(2284) ravmond.exe
00400000[00069000]
[am] 7. c:\program files\rising\rav\ravmond.exe
10000000[00042000]
[ m] 81. c:\program files\rising\rav\bwlist.dll
7c140000[00103000]
[ m] 82. c:\windows\system32\mfc71.dll
7c340000[00056000]
[ m] 73. c:\windows\system32\msvcr71.dll
7c3a0000[0007b000]
[ m] 72. c:\windows\system32\msvcp71.dll
00b60000[0000e000]
[ m] 83. c:\program files\rising\rav\rsappmgr.dll
00b80000[00030000]
[ m] 84. c:\program files\rising\rav\cfgdll.dll
00df0000[00067000]
[ m] 85. c:\program files\rising\rav\rslog.dll
00e60000[0001f000]
[ m] 59. c:\program files\rising\rav\proccom.dll
00e80000[00024000]
[ m] 60. c:\program files\rising\rav\rscommx2.dll
00ed0000[00075000]
[ m] 86. c:\program files\rising\rav\monrule.dll
00f60000[00013000]
[ m] 87. c:\program files\rising\rav\hooksys.dll
010c0000[00013000]
[ m] 88. c:\program files\rising\rav\hookreg.dll
01150000[00013000]
[ m] 89. c:\program files\rising\rav\hookntos.dll
011e0000[0001c000]
[ m] 90. c:\program files\rising\rav\rswalmon.dll
02010000[00035000]
[ m] 91. c:\program files\rising\rav\recomp.dll
02060000[00036000]
[ m] 92. c:\program files\rising\rav\refs.dll
020b0000[00023000]
[ m] 93. c:\program files\rising\rav\ffr.dll
020f0000[00020000]
[ m] 94. c:\program files\rising\rav\rsstore.dll
02120000[00013000]
[ m] 95. c:\program files\rising\rav\hookcont.dll
02150000[00027000]
[ m] 96. c:\program files\rising\rav\fakescan.dll
02190000[00022000]
[ m] 97. c:\program files\rising\rav\scanner.dll
027d0000[0002f000]
[ m] 98. c:\program files\rising\rav\viruslib.dll
02910000[00028000]
[ m] 99. c:\program files\rising\rav\relibldr.dll
02ee0000[0000d000]
[ m] 100. c:\program files\rising\rav\hookweb.dll
03f80000[00021000]
[ m] 101. c:\program files\rising\rav\nvfile.dll
13ab0000[0004a000]
[ m] 102. c:\program files\rising\rav\scanexec.dll
05920000[002dc000]
[ m] 103. c:\program files\rising\rav\unexe.dll
05c00000[000d1000]
[ m] 104. c:\program files\rising\rav\scanex.dll
03f00000[00027000]
[ m] 105. c:\program files\rising\rav\pearc.dll
050a0000[00023000]
[ m] 106. c:\program files\rising\rav\scansct.dll
07150000[000dc000]
[ m] 107. c:\program files\rising\rav\extfile.dll
+ 000009dc(2524) explorer.exe
015c0000[0002d000]
[ m] 108. c:\program files\tencent\ssplus\splus1.dll
164a0000[00023000]
[am] 42. c:\windows\system32\wpdshserviceobj.dll
109c0000[0002c000]
[ m] 109. c:\windows\system32\portabledevicetypes.dll
10930000[00049000]
[ m] 110. c:\windows\system32\portabledeviceapi.dll
72c80000[00008000]
[ m] 50. c:\windows\system32\msacm32.drv
+ 00000a18(2584) ravtask.exe
00400000[00034000]
[am] 43. c:\program files\rising\rav\ravtask.exe
10000000[0001f000]
[ m] 59. c:\program files\rising\rav\proccom.dll
00a30000[00024000]
[ m] 60. c:\program files\rising\rav\rscommx2.dll
23700000[00028000]
[ m] 111. c:\program files\rising\rav\rscommon.dll
00c90000[0000e000]
[ m] 83. c:\program files\rising\rav\rsappmgr.dll
08cb0000[00030000]
[ m] 84. c:\program files\rising\rav\cfgdll.dll
+ 00000a28(2600) runiep.exe
00400000[00020000]
[am] 44. c:\program files\rising\antispyware\runiep.exe
7c140000[00103000]
[ m] 54. c:\program files\rising\antispyware\mfc71.dll
7c340000[00056000]
[ m] 55. c:\program files\rising\antispyware\msvcr71.dll
00db0000[00020000]
[ m] 112. c:\windows\system32\ieprot.dll
10000000[0002d000]
[ m] 108. c:\program files\tencent\ssplus\splus1.dll
+ 00000a64(2660) realsched.exe
00400000[0002f000]
[am] 45. c:\program files\common files\real\update_ob\realsched.exe
10000000[0002d000]
[ m] 108. c:\program files\tencent\ssplus\splus1.dll
+ 00000a6c(2668) rundll32.exe
10000000[0002d000]
[ m] 108. c:\program files\tencent\ssplus\splus1.dll
+ 00000ac8(2760) ctfmon.exe
10000000[0002d000]
[ m] 108. c:\program files\tencent\ssplus\splus1.dll
+ 00000afc(2812) ravmon.exe
00400000[00067000]
[ m] 113. c:\program files\rising\rav\ravmon.exe
7c140000[00103000]
[ m] 82. c:\windows\system32\mfc71.dll
7c340000[00056000]
[ m] 73. c:\windows\system32\msvcr71.dll
7c3a0000[0007b000]
[ m] 72. c:\windows\system32\msvcp71.dll
10000000[0001f000]
[ m] 59. c:\program files\rising\rav\proccom.dll
00b20000[00024000]
[ m] 60. c:\program files\rising\rav\rscommx2.dll
23700000[00028000]
[ m] 111. c:\program files\rising\rav\rscommon.dll
00d70000[00035000]
[ m] 91. c:\program files\rising\rav\recomp.dll
00dc0000[00036000]
[ m] 92. c:\program files\rising\rav\refs.dll
01020000[0002f000]
[ m] 98. c:\program files\rising\rav\viruslib.dll
01160000[00028000]
[ m] 99. c:\program files\rising\rav\relibldr.dll
011e0000[0000e000]
[ m] 83. c:\program files\rising\rav\rsappmgr.dll
01200000[00030000]
[ m] 84. c:\program files\rising\rav\cfgdll.dll
01360000[00075000]
[ m] 86. c:\program files\rising\rav\monrule.dll
23900000[00040000]
[ m] 114. c:\program files\rising\rav\pngdll.dll
26600000[000b8000]
[ m] 115. c:\program files\rising\rav\rsguilib.dll
23800000[00018000]
[ m] 116. c:\program files\rising\rav\rsxml.dll
+ 00000b08(2824) sqlmangr.exe
00400000[00016000]
[am] 49. c:\program files\microsoft sql server\80\tools\binn\sqlmangr.exe
7c340000[00056000]
[ m] 73. c:\windows\system32\msvcr71.dll
41140000[0000d000]
[ m] 117. c:\program files\microsoft sql server\80\tools\binn\w95scm.dll
42c40000[0001b000]
[ m] 118. c:\program files\microsoft sql server\80\tools\binn\sqlsvc.dll
4b4f0000[00006000]
[ m] 119. c:\windows\system32\odbcbcp.dll
42ac0000[0000c000]
[ m] 120. c:\program files\microsoft sql server\80\tools\binn\sqlresld.dll
43970000[00003000]
[ m] 121. c:\program files\microsoft sql server\80\tools\binn\resources\2052\sqlsvc.rll
43790000[00018000]
[ m] 122. c:\program files\microsoft sql server\80\tools\binn\resources\2052\sqlmangr.rll
10000000[0002d000]
[ m] 108. c:\program files\tencent\ssplus\splus1.dll
+ 00000c60(3168) ravstub.exe
00400000[00021000]
[ m] 123. c:\program files\rising\rav\ravstub.exe
10000000[0001f000]
[ m] 59. c:\program files\rising\rav\proccom.dll
00620000[00024000]
[ m] 60. c:\program files\rising\rav\rscommx2.dll
23700000[00028000]
[ m] 111. c:\program files\rising\rav\rscommon.dll
+ 00000c74(3188) iexplore.exe
10000000[0002d000]
[ m] 108. c:\program files\tencent\ssplus\splus1.dll
00b00000[00047000]
[am] 28. c:\program files\tencent\ssplus\saddr1.dll
015f0000[00063000]
[am] 27. c:\windows\system32\kakatool.dll
655e0000[00059000]
[am] 29. c:\program files\real\realplayer\rpbrowserrecordplugin.dll
7c3a0000[0007b000]
[ m] 72. c:\windows\system32\msvcp71.dll
7c340000[00056000]
[ m] 73. c:\windows\system32\msvcr71.dll
603c0000[0001a000]
[ m] 124. c:\program files\real\realplayer\lang\rpbrp_cn.dll
07270000[00074000]
[am] 30. c:\program files\bitcomet\tools\bitcometbho_1.2.2.28.dll
07320000[0000c000]
[am] 31. c:\program files\thunder\comdlls\xunleibho_002.dll
325c0000[00012000]
[am] 36. c:\program files\microsoft office\office11\msohev.dll
09300000[00028000]
[ m] 70. c:\program files\rising\rav\ravscrch.dll
09ce0000[00011000]
[am] 41. c:\windows\system32\shlhook.dll
30000000[003ae000]
[ m] 71. c:\windows\system32\macromed\flash\flash9e.ocx
72c80000[00008000]
[ m] 50. c:\windows\system32\msacm32.drv
