日志如下 ,无法贴全,附文档
瑞星卡卡电脑诊断日志 v1.30 (2007-7-16 14:52:39)  北京瑞星科技股份有限公司

注释:    [A]表示该文件存在自启动关联;
    [M]表示该文件在内存中;

+ 注册表自运行项目
  + 系统服务
    + HKLM\System\CurrentControlSet\Services
      Adobe LM Service
        [A ] 1. c:\program files\common files\adobe systems shared\service\adobelmsvc.exe


      Ati HotKey Poller
        [AM] 2. c:\windows\system32\ati2evxx.exe


      ATI Smart
        [A ] 3. c:\windows\system32\ati2sgag.exe


      IDriverT
        [A ] 4. c:\program files\common files\installshield\driver\1050\intel 32\idrivert.exe


      lm
        [AM] 5. c:\windows\system\zw10\wdfmgr.exe


      odserv
        [A ] 6. c:\program files\common files\microsoft shared\office12\odserv.exe


      ose
        [A ] 7. c:\program files\common files\microsoft shared\source engine\ose.exe


      RfwProxySrv
        [A ] 8. c:\program files\rising\rfw\rfwproxy.exe


      RfwService
        [A ] 9. c:\program files\rising\rfw\rfwsrv.exe


      RsCCenter
        [A ] 10. c:\program files\rising\rav\ccenter.exe


      RsRavMon
        [A ] 11. c:\program files\rising\rav\ravmond.exe


      Visual Studio Analyzer RPC bridge
        [A ] 12. c:\program files\microsoft visual studio\common\tools\vs-ent98\vanalyzr\varpc.exe


      WMPNetworkSvc
        [A ] 13. c:\program files\windows media player\wmpnetwk.exe


      WudfSvc
        [A ] 14. c:\windows\system32\wudfsvc.dll




  + 内核驱动
    + HKLM\System\CurrentControlSet\Services
      0ngc1kj
        [A ] 15. c:\windows\system32\drivers\0ngc1kj.sys


      0nox
        [A ] 16. c:\windows\system32\drivers\0nox.sys


      ALCXWDM
        [A ] 17. c:\windows\system32\drivers\alcxwdm.sys


      BaseTDI
        [A ] 18. c:\windows\system32\drivers\basetdi.sys


      CA561
        [A ] 19. c:\windows\system32\drivers\spca561.sys


      d344bus
        [A ] 20. c:\windows\system32\drivers\d344bus.sys


      d344prt
        [A ] 21. c:\windows\system32\drivers\d344prt.sys


      dtscsi
        [A ] 22. c:\windows\system32\drivers\dtscsi.sys


      EagleNT
        [A ] 23. c:\windows\system32\drivers\eaglent.sys


      ExpScaner
        [A ] 24. c:\program files\rising\rav\expscan.sys


      GMSIPCI
        [A ] 25. g:\install\gmsipci.sys


      HookCont
        [A ] 26. c:\program files\rising\rav\hookcont.sys


      HookReg
        [A ] 27. c:\program files\rising\rav\hookreg.sys


      HookSys
        [A ] 28. c:\program files\rising\rav\hooksys.sys


      HookUrl
        [A ] 29. c:\program files\rising\rfw\hookurl.sys


      ibgedbij
        [A ] 30. c:\windows\system32\drivers\ibgedbij.sys


      lmxm
        [A ] 31. c:\windows\system32\drivers\lmxm.sys


      mchInjDrv
        [A ] 32. c:\docume~1\admini~1\locals~1\temp\mc2a.tmp


      MEMSCAN
        [A ] 33. c:\program files\rising\rav\memscan.sys


      mProcRs
        [A ] 34. c:\program files\rising\rfw\mprocrs.sys


      npkcrypt
        [A ] 35. f:\program files\tencent\qq\npkcrypt.sys


      npkycryp
        [A ] 36. f:\program files\tencent\qq\npkycryp.sys


      oreans32
        [A ] 37. c:\windows\system32\drivers\oreans32.sys


      QuakeDRV
        [A ] 38. c:\windows\system32\drivers\quakedrv.sys


      RsAntiSpyware
        [A ] 39. c:\windows\system32\drivers\rsboot.sys


      RsFwDrv
        [A ] 40. c:\program files\rising\rfw\rsfwdrv.sys


      RsNTGDI
        [A ] 41. c:\windows\system32\drivers\rsntgdi.sys


      RSPPSYS
        [A ] 42. c:\program files\rising\rav\rsppsys.sys


      Secdrv
        [A ] 43. c:\windows\system32\drivers\secdrv.sys


      sptd
        [A ] 44. c:\windows\system32\drivers\sptd.sys


      STEC3
        [A ] 45. c:\windows\system32\stec3.sys


      ttajwx94
        [A ] 46. c:\windows\system32\drivers\ttajwx94.sys


      viamraid
        [A ] 47. c:\windows\system32\drivers\viamraid.sys


      WudfPf
        [A ] 48. c:\windows\system32\drivers\wudfpf.sys


      WudfRd
        [A ] 49. c:\windows\system32\drivers\wudfrd.sys


      XDva001
        [A ] 50. c:\windows\system32\xdva001.sys




  + 文件系统驱动
    + HKLM\System\CurrentControlSet\Services
      medeaafw
        [A ] 51. c:\windows\system32\drivers\medeaafw.sys




  + IE浏览器加载模块
    + HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar
      {E0E899AB-F487-11D5-8D29-0050BA6940E3}
        [A ] 52. c:\program files\flashget\fgiebar.dll



    + HKCU\SOFTWARE\Microsoft\Internet Explorer\URLSearchHooks
      {CFBFAE00-17A6-11D0-99CB-00C04FD64497}
        [AM] 53. c:\windows\system32\ieframe.dll



    + HKLM\SOFTWARE\Microsoft\Internet Explorer\Extensions
      Exec
        [AM] 54. f:\program files\tencent\qq\qq.exe


      Exec
        [A ] 55. c:\program files\flashget\flashget.exe




  + 资源管理器加载模块
    + HKLM\SOFTWARE\Classes\PROTOCOLS\Filter
      text/xml
        [AM] 56. c:\program files\common files\microsoft shared\office12\msoxmlmf.dll



    + HKLM\SOFTWARE\Classes\PROTOCOLS\Handler
      ic32pp
        [A ] 57. c:\windows\wc98pp.dll


      KuGoo3
        [A ] 58. d:\program files\kugoo3\inextend\kugoo3downxcontrol.ocx


      ms-help
        [A ] 59. c:\program files\common files\microsoft shared\help\hxds.dll


      ms-itss
        [A ] 60. c:\program files\common files\microsoft shared\information retrieval\msitss.dll



    + HKLM\SOFTWARE\Microsoft\Active Setup\Installed Components
      <{12d0ed0d-0ee0-4f90-8827-78cefb8f4988}
        [A ] 61. c:\windows\system32\ieudinit.exe



    + HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved
      HyperTerminal Icon Ext
        [A ] 62. c:\windows\system32\hticons.dll


      IE Search Band
        [AM] 53. c:\windows\system32\ieframe.dll


      Shell DocObject Viewer
        [AM] 53. c:\windows\system32\ieframe.dll


      InternetShortcut
        [AM] 53. c:\windows\system32\ieframe.dll


      Microsoft Url History Service
        [AM] 53. c:\windows\system32\ieframe.dll


      History
        [AM] 53. c:\windows\system32\ieframe.dll


      Temporary Internet Files
        [AM] 53. c:\windows\system32\ieframe.dll


      Temporary Internet Files
        [AM] 53. c:\windows\system32\ieframe.dll


      Microsoft Url Search Hook
        [AM] 53. c:\windows\system32\ieframe.dll


      The Internet
        [AM] 53. c:\windows\system32\ieframe.dll


      Internet Name Space
        [AM] 53. c:\windows\system32\ieframe.dll


      RISING
        [AM] 63. c:\windows\system32\ravext.dll


      WinRAR shell extension
        [AM] 64. c:\program files\winrar\rarext.dll


      Shell Extensions for RealOne Player
        [A ] 65. c:\program files\real\realplayer\rpshell.dll


      Portable Media Devices
        [A ] 66. c:\windows\system32\audiodev.dll


      Portable Devices
        [A ] 67. c:\windows\system32\wpdshext.dll


      Portable Devices Menu
        [A ] 67. c:\windows\system32\wpdshext.dll


      Web Folders
        [A ] 68. c:\program files\common files\microsoft shared\web folders\msonsext.dll


      Microsoft Office Outlook Custom Icon Handler
        [A ] 69. c:\program files\microsoft office\office12\olkfstub.dll


      Microsoft Office Outlook Desktop Icon Handler
        [A ] 70. c:\program files\microsoft office\office12\mlshext.dll


      Microsoft Office HTML Icon Handler
        [A ] 71. c:\program files\microsoft office\office12\msohev.dll


      Microsoft Office Metadata Handler
        [A ] 72. c:\program files\common files\microsoft shared\office12\msoshext.dll


      Microsoft Office Thumbnail Handler
        [A ] 72. c:\program files\common files\microsoft shared\office12\msoshext.dll


      IE Microsoft BrowserBand
        [AM] 53. c:\windows\system32\ieframe.dll


      IE Fade Task
        [AM] 53. c:\windows\system32\ieframe.dll


      IE Menu Desk Bar
        [AM] 53. c:\windows\system32\ieframe.dll


      IE AutoComplete
        [AM] 53. c:\windows\system32\ieframe.dll


      IE Navigation Bar
        [AM] 53. c:\windows\system32\ieframe.dll


      IE Menu Site
        [AM] 53. c:\windows\system32\ieframe.dll


      IE Menu Band
        [AM] 53. c:\windows\system32\ieframe.dll


      IE Microsoft History AutoComplete List
        [AM] 53. c:\windows\system32\ieframe.dll


      IE Tracking Shell Menu
        [AM] 53. c:\windows\system32\ieframe.dll


      IE IShellFolderBand
        [AM] 53. c:\windows\system32\ieframe.dll


      IE BandProxy
        [AM] 53. c:\windows\system32\ieframe.dll


      IE MRU AutoComplete List
        [AM] 53. c:\windows\system32\ieframe.dll


      IE RSS Feeder Folder
        [AM] 53. c:\windows\system32\ieframe.dll


      IE Microsoft Shell Folder AutoComplete List
        [AM] 53. c:\windows\system32\ieframe.dll


      IE Microsoft Multiple AutoComplete List Container
        [AM] 53. c:\windows\system32\ieframe.dll


      Microsoft Browser Architecture
        [AM] 53. c:\windows\system32\ieframe.dll


      IE Shell Rebar BandSite
        [AM] 53. c:\windows\system32\ieframe.dll


      IE Shell Band Site Menu
        [AM] 53. c:\windows\system32\ieframe.dll


      &Links
        [AM] 53. c:\windows\system32\ieframe.dll


      IE Registry Tree Options Utility
        [AM] 53. c:\windows\system32\ieframe.dll


      IE User Assist
        [AM] 53. c:\windows\system32\ieframe.dll


      IE Custom MRU AutoCompleted List
        [AM] 53. c:\windows\system32\ieframe.dll


      TextPad
        [AM] 73. c:\program files\textpad v4.7.2.php\system\shellext.dll


      Registered ActiveX Controls
        [A ] 74. c:\program files\microsoft visual studio\common\msdev98\bin\ide\devxpgl.dll


      Developer Studio Components
        [A ] 74. c:\program files\microsoft visual studio\common\msdev98\bin\ide\devxpgl.dll


      DllRegShlExt extension
        [AM] 75. c:\windows\system32\tudouupload.dll

+ HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad
      WPDShServiceObj
        [AM] 76. c:\windows\system32\wpdshserviceobj.dll




  + 用户登陆自运行项目
    + HKLM\Software\Microsoft\Windows\CurrentVersion\Run
      SoundMan
        [A ] 77. c:\windows\soundman.exe


      RfwMain
        [A ] 78. c:\program files\rising\rfw\rfwmain.exe


      RavTask
        [A ] 79. c:\program files\rising\rav\ravtask.exe


      runeip
        [A ] 80. c:\program files\rising\antispyware\runiep.exe



    + HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce
      KKDelay
        [A ] 81. c:\program files\rising\antispyware\runonce.exe




  + 开机执行
    + HKLM\SYSTEM\CurrentControlSet\Control\NetworkProvider\Order
      BootExecute
        [A ] 82. c:\windows\system32\bsmain.exe

        [A ] 83. c:\windows\system32\kknative.exe




  + 映像劫持
    + HKCR\Folder\shell
      Super Rabbit CDROM Eject
        [A ] 84. f:\program files\super rabbit\magicset\srcd2.exe



    + HKCR\.bat
      batfile\EditWithVS\Command
        [A ] 85. c:\program files\microsoft visual studio\common\ide\ide98\devenv.exe



    + HKCR\.html
      htmlfile\Edit\Command
        [A ] 86. c:\program files\microsoft office\office12\msohtmed.exe


      htmlfile\EditWithVS\Command
        [A ] 85. c:\program files\microsoft visual studio\common\ide\ide98\devenv.exe


      htmlfile\Maxthon\Command
        [AM] 87. c:\program files\maxthon2\maxthon.exe


      htmlfile\Print\Command
        [A ] 86. c:\program files\microsoft office\office12\msohtmed.exe



    + HKCR\.htm
      htmlfile\Edit\Command
        [A ] 86. c:\program files\microsoft office\office12\msohtmed.exe


      htmlfile\EditWithVS\Command
        [A ] 85. c:\program files\microsoft visual studio\common\ide\ide98\devenv.exe


      htmlfile\Maxthon\Command
        [AM] 87. c:\program files\maxthon2\maxthon.exe


      htmlfile\Print\Command
        [A ] 86. c:\program files\microsoft office\office12\msohtmed.exe



    + HKCR\.log
      txtfile\EditWithVS\Command
        [A ] 85. c:\program files\microsoft visual studio\common\ide\ide98\devenv.exe



    + HKCR\.txt
      txtfile\EditWithVS\Command
        [A ] 85. c:\program files\microsoft visual studio\common\ide\ide98\devenv.exe



    + HKCR\.cmd
      cmdfile\EditWithVS\Command
        [A ] 85. c:\program files\microsoft visual studio\common\ide\ide98\devenv.exe



    + HKCR\.ini
      inifile\EditWithVS\Command
        [A ] 85. c:\program files\microsoft visual studio\common\ide\ide98\devenv.exe




  + 打印机监控
    + HKLM\SYSTEM\CurrentControlSet\Control\Print\Monitors
      Microsoft Document Imaging Writer Monitor
        [AM] 88. c:\windows\system32\mdimon.dll





+ 其他自启动项目
  +
    1
      [A ] 89. c:\1


    Rav18_56_01.exe
      [A ] 90. c:\rav18_56_01.exe


    Rfw18_54_40.exe
      [A ] 91. c:\rfw18_54_40.exe



  + C:\Documents and Settings\Administrator\「开始」菜单\程序\启动
    AquariumDesktop2006.lnk
      [A ] 92. f:\program files\stardock\desktopgadgets\aquariumdesktop2006\aquariumdesktop2006.exe



  +
    1
      [A ] 89. c:\1


    Rav18_56_01.exe
      [A ] 90. c:\rav18_56_01.exe


    Rfw18_54_40.exe
      [A ] 91. c:\rfw18_54_40.exe




+ 正在运行的进程
  + 000002cc(716) csrss.exe
    10000000[00018000]
      [ M] 93. c:\documents and settings\administrator\local settings\temp\rsv8d.tmp



  + 000002e4(740) winlogon.exe
    72C80000[00008000]
      [ M] 94. c:\windows\system32\msacm32.drv


    00DA0000[00009000]
      [ M] 95. c:\windows\system32\normaliz.dll


    41D50000[00045000]
      [ M] 96. c:\windows\system32\iertutil.dll


    10000000[00018000]
      [ M] 93. c:\documents and settings\administrator\local settings\temp\rsv8d.tmp



  + 00000314(788) services.exe
    47260000[0000F000]
      [ M] 97. c:\windows\apppatch\acadproc.dll


    10000000[00018000]
      [ M] 93. c:\documents and settings\administrator\local settings\temp\rsv8d.tmp



  + 00000320(800) lsass.exe
    10000000[00018000]
      [ M] 93. c:\documents and settings\administrator\local settings\temp\rsv8d.tmp



  + 000003b8(952) Ati2evxx.exe
    00400000[0005B000]
      [AM] 2. c:\windows\system32\ati2evxx.exe


    003E0000[0000F000]
      [ M] 98. c:\windows\system32\ati2edxx.dll


    10000000[00018000]
      [ M] 93. c:\documents and settings\administrator\local settings\temp\rsv8d.tmp



  + 000003d0(976) svchost.exe
    10000000[00018000]
      [ M] 93. c:\documents and settings\administrator\local settings\temp\rsv8d.tmp



  + 00000420(1056) svchost.exe

  + 00000458(1112) wdfmgr.exe
    00400000[0007C000]
      [AM] 5. c:\windows\system\zw10\wdfmgr.exe


    41D50000[00045000]
      [ M] 96. c:\windows\system32\iertutil.dll


    422B0000[005CB000]
      [AM] 53. c:\windows\system32\ieframe.dll


    01130000[00009000]
      [ M] 95. c:\windows\system32\normaliz.dll


    61930000[0004A000]
      [ M] 99. c:\program files\internet explorer\ieproxy.dll


    01660000[00011000]
      [ M] 100. c:\windows\system32\shlhook.dll


    10000000[00018000]
      [ M] 93. c:\documents and settings\administrator\local settings\temp\rsv8d.tmp



  + 00000490(1168) svchost.exe
    009F0000[00009000]
      [ M] 95. c:\windows\system32\normaliz.dll


    41D50000[00045000]
      [ M] 96. c:\windows\system32\iertutil.dll


    50E60000[0000C000]
      [ M] 101. c:\windows\system32\wups2.dll


    10000000[00018000]
      [ M] 93. c:\documents and settings\administrator\local settings\temp\rsv8d.tmp



  + 000004b8(1208) svchost.exe

  + 00000500(1280) 360Tray.exe
    41D50000[00045000]
      [ M] 96. c:\windows\system32\iertutil.dll


    10000000[0001C000]
      [ M] 102. f:\program files\360safe\safemon\safemon.dll


    00AF0000[0000C000]
      [ M] 103. f:\program files\360safe\safemon\safekrnl.dll


    00B00000[00022000]
      [ M] 104. f:\program files\360safe\antiadwa.dll


    00B30000[00009000]
      [ M] 95. c:\windows\system32\normaliz.dll


    01730000[0001B000]
      [ M] 105. c:\program files\rising\antispyware\ieprot.dll


    01A80000[0001C000]
      [ M] 106. f:\program files\360safe\live.dll


    019B0000[00008000]
      [ M] 107. c:\program files\flashget\fgmgr.dll


    00C50000[00018000]
      [ M] 93. c:\documents and settings\administrator\local settings\temp\rsv8d.tmp



  + 00000520(1312) runiep.exe
    00C00000[0001B000]
      [ M] 105. c:\program files\rising\antispyware\ieprot.dll


    10000000[00018000]
      [ M] 93. c:\documents and settings\administrator\local settings\temp\rsv8d.tmp



  + 00000534(1332) svchost.exe
    00800000[00009000]
      [ M] 95. c:\windows\system32\normaliz.dll


    41D50000[00045000]
      [ M] 96. c:\windows\system32\iertutil.dll



  + 0000058c(1420) ctfmon.exe
    10000000[0001B000]
      [ M] 105. c:\program files\rising\antispyware\ieprot.dll


    00BC0000[00018000]
      [ M] 93. c:\documents and settings\administrator\local settings\temp\rsv8d.tmp



  + 00000644(1604) QQ.exe
    00400000[00187000]
      [AM] 54. f:\program files\tencent\qq\qq.exe


    61360000[00236000]
      [ M] 108. f:\program files\tencent\qq\qqbaseclassindll.dll


    616B0000[00099000]
      [ M] 109. f:\program files\tencent\qq\qqhelperdll.dll


    60090000[00040000]
      [ M] 110. f:\program files\tencent\qq\basicctrldll.dll


    60B20000[000F2000]
      [ M] 111. f:\program files\tencent\qq\mfc42.dll


    00390000[00009000]
      [ M] 95. c:\windows\system32\normaliz.dll


    41D50000[00045000]
      [ M] 96. c:\windows\system32\iertutil.dll


    10000000[00008000]
      [ M] 107. c:\program files\flashget\fgmgr.dll


    00C50000[0001C000]
      [ M] 102. f:\program files\360safe\safemon\safemon.dll


    61FC0000[00005000]
      [ M] 112. f:\program files\tencent\qq\riched32.dll


    61F50000[00068000]
      [ M] 113. f:\program files\tencent\qq\riched20.dll


    612E0000[00038000]
      [ M] 114. f:\program files\tencent\qq\qqapi.dll


    01540000[00007000]
      [ M] 115. f:\program files\tencent\qq\tmdlls\timproxy.dll


    01550000[0001B000]
      [ M] 105. c:\program files\rising\antispyware\ieprot.dll


    01AA0000[00033000]
      [ M] 116. f:\program files\tencent\qq\loginctrl.dll

01AE0000[00044000]
      [ M] 117. f:\program files\tencent\qq\npkcntc.dll


    01B30000[0000E000]
      [ M] 118. f:\program files\tencent\qq\npkpdb.dll


    608B0000[00054000]
      [ M] 119. f:\program files\tencent\qq\loginctrlres.dll


    02380000[0041A000]
      [ M] 120. f:\program files\tencent\qq\qqres.dll


    61780000[0008A000]
      [ M] 121. f:\program files\tencent\qq\qqmainframe.dll


    601A0000[00119000]
      [ M] 122. f:\program files\tencent\qq\cqqapplication.dll


    030B0000[0005D000]
      [ M] 123. f:\program files\tencent\qq\newskin.dll


    60680000[000B0000]
      [ M] 124. f:\program files\tencent\qq\hostingmgr.dll


    600F0000[00022000]
      [ M] 125. f:\program files\tencent\qq\cameradll.dll


    609E0000[0002F000]
      [ M] 126. f:\program files\tencent\qq\mailsummary.dll


    61750000[00015000]
      [ M] 127. f:\program files\tencent\qq\qqknowledgesearch.dll


    61100000[001D3000]
      [ M] 128. f:\program files\tencent\qq\qqallinone.dll


    60640000[00034000]
      [ M] 129. f:\program files\tencent\qq\grouplive.dll


    620D0000[0002A000]
      [ M] 130. f:\program files\tencent\qq\sccore.dll


    60350000[001A3000]
      [ M] 131. f:\program files\tencent\qq\gdiplus.dll


    61EF0000[0001E000]
      [ M] 132. f:\program files\tencent\qq\qqspace.dll


    62330000[00071000]
      [ M] 133. f:\program files\tencent\qq\vbscript.dll


    61640000[0006B000]
      [ M] 134. f:\program files\tencent\qq\qqgroupmng.dll


    72C80000[00008000]
      [ M] 94. c:\windows\system32\msacm32.drv


    62220000[00017000]
      [ M] 135. f:\program files\tencent\qq\userdefinedhead.dll


    61950000[000CE000]
      [ M] 136. f:\program files\tencent\qq\qqplugin.dll
    615A0000[0000C000]
      [ M] 137. f:\program files\tencent\qq\qqconfigplugin.dll


    422B0000[005CB000]
      [AM] 53. c:\windows\system32\ieframe.dll


    62020000[00016000]
      [ M] 138. f:\program files\tencent\qq\qringmng.dll


    61320000[00032000]
      [ M] 139. f:\program files\tencent\qq\qqavatar.dll


    60310000[0003E000]
      [ M] 140. f:\program files\tencent\qq\flashavatardll.dll


    03C30000[000A6000]
      [ M] 141. f:\program files\tencent\qq\longconnection.dll


    60D10000[00026000]
      [ M] 142. f:\program files\tencent\qq\phoneapi.dll


    602C0000[0000D000]
      [ M] 143. f:\program files\tencent\qq\dialerallinone.dll


    61910000[0002A000]
      [ M] 144. f:\program files\tencent\qq\qqpet.dll


    615B0000[00032000]
      [ M] 145. f:\program files\tencent\qq\qqcustomface.dll


    600D0000[0001F000]
      [ M] 146. f:\program files\tencent\qq\bqqapplication.dll


    60610000[00024000]
      [ M] 147. f:\program files\tencent\qq\groupconnection.dll


    72C60000[00007000]
      [ M] 148. c:\windows\system32\msadp32.acm


    60730000[0001A000]
      [ M] 149. f:\program files\tencent\qq\imageole.dll


    38A70000[0000C000]
      [AM] 56. c:\program files\common files\microsoft shared\office12\msoxmlmf.dll


    60120000[0004F000]
      [ M] 150. f:\program files\tencent\qq\commercesmng.dll


    60C90000[0000F000]
      [ M] 151. f:\program files\tencent\qq\personaldesktop.dll


    06C00000[0028B000]
      [ M] 152. f:\program files\tencent\qq\qqaddr.dll


    06EC0000[00011000]
      [ M] 100. c:\windows\system32\shlhook.dll


    61E40000[0002D000]
      [ M] 153. f:\program files\tencent\qq\qqscenemng.dll


    03E30000[0002A000]
      [ M] 154. f:\program files\tencent\qq\qqphonehelper.dll


    03E60000[00041000]
      [ M] 155. f:\program files\tencent\qq\qqsysmsgmng.dll


    30000000[002EE000]
      [ M] 156. c:\windows\system32\macromed\flash\flash9b.ocx


    61770000[0000E000]
      [ M] 157. f:\program files\tencent\qq\qqmagicface.dll


    03F10000[0001C000]
      [ M] 158. c:\windows\system32\unispim.ime


    05470000[00053000]
      [ M] 159. c:\windows\system32\upengine.dll


    05880000[0005B000]
      [ M] 160. f:\program files\tencent\qq\qqzip.dll


    01410000[00018000]
      [ M] 93. c:\documents and settings\administrator\local settings\temp\rsv8d.tmp



  + 00000794(1940) Explorer.EXE
    00400000[00009000]
      [ M] 95. c:\windows\system32\normaliz.dll


    41D50000[00045000]
      [ M] 96. c:\windows\system32\iertutil.dll


    10000000[00011000]
      [ M] 100. c:\windows\system32\shlhook.dll


    422B0000[005CB000]
      [AM] 53. c:\windows\system32\ieframe.dll


    00FC0000[00011000]
      [ M] 161. c:\windows\system32\lkj4x.dll


    01150000[00014000]
      [ M] 162. c:\windows\system32\k5b49y0.dll
  164A0000[00023000]
      [AM] 76. c:\windows\system32\wpdshserviceobj.dll


    72C80000[00008000]
      [ M] 94. c:\windows\system32\msacm32.drv


    109C0000[0002C000]
      [ M] 163. c:\windows\system32\portabledevicetypes.dll


    10930000[00049000]
      [ M] 164. c:\windows\system32\portabledeviceapi.dll


    01A50000[0001B000]
      [ M] 105. c:\program files\rising\antispyware\ieprot.dll


    01C70000[0001C000]
      [ M] 102. f:\program files\360safe\safemon\safemon.dll


    029D0000[00008000]
      [ M] 107. c:\program files\flashget\fgmgr.dll


    23700000[0001A000]
      [ M] 165. c:\program files\rising\rav\rscommon.dll


    72C60000[00007000]
      [ M] 148. c:\windows\system32\msadp32.acm


    024F0000[0002B000]
      [AM] 64. c:\program files\winrar\rarext.dll


    00CB0000[0000D000]
      [AM] 73. c:\program files\textpad v4.7.2.php\system\shellext.dll


    02A00000[0001B000]
      [AM] 63. c:\windows\system32\ravext.dll


    02A70000[00017000]
      [ M] 166. d:\program files\kingsoft\knightv\tools\kvd\kscdrush.dll


    02AB0000[00017000]
      [AM] 75. c:\windows\system32\tudouupload.dll


    00F40000[00018000]
      [ M] 93. c:\documents and settings\administrator\local settings\temp\rsv8d.tmp



  + 000007d8(2008) RavStub.exe
    10000000[0001B000]
      [ M] 167. c:\program files\rising\rav\rscommx.dll


    23700000[0001A000]
      [ M] 165. c:\program files\rising\rav\rscommon.dll



  + 00000828(2088) svchost.exe
    10000000[00018000]
      [ M] 93. c:\documents and settings\administrator\local settings\temp\rsv8d.tmp



  + 00000aa0(2720) alg.exe

  + 00000b14(2836) spoolsv.exe
    00AE0000[00009000]
      [AM] 88. c:\windows\system32\mdimon.dll


    00B10000[00009000]
      [ M] 168. c:\windows\system32\spool\prtprocs\w32x86\mdippr.dll


    00E30000[00005000]
      [ M] 169. c:\windows\system32\spool\prtprocs\w32x86\vprproc.dll


    10000000[00018000]
      [ M] 93. c:\documents and settings\administrator\local settings\temp\rsv8d.tmp



  + 00000b94(2964) Ras.exe
    00390000[00009000]
      [ M] 95. c:\windows\system32\normaliz.dll


    41D50000[00045000]
      [ M] 96. c:\windows\system32\iertutil.dll


    10000000[00018000]
      [ M] 93. c:\documents and settings\administrator\local settings\temp\rsv8d.tmp


    00E50000[00008000]
      [ M] 107. c:\program files\flashget\fgmgr.dll


    01180000[0001C000]
      [ M] 102. f:\program files\360safe\safemon\safemon.dll


    011F0000[000A3000]
      [ M] 170. c:\program files\rising\antispyware\rasgui.dll


    01A00000[0001B000]
      [ M] 105. c:\program files\rising\antispyware\ieprot.dll


    422B0000[005CB000]
      [AM] 53. c:\windows\system32\ieframe.dll


    02720000[0002F000]
      [ M] 171. c:\program files\rising\antispyware\engine.dll


    02420000[00012000]
      [ M] 172. c:\program files\rising\antispyware\zip.dll



  + 00000bc8(3016) wuauclt.exe
    10000000[0001C000]
      [ M] 102. f:\program files\360safe\safemon\safemon.dll


    50E60000[0000C000]
      [ M] 101. c:\windows\system32\wups2.dll


    00B10000[0001B000]
      [ M] 105. c:\program files\rising\antispyware\ieprot.dll


    00B50000[00008000]
      [ M] 107. c:\program files\flashget\fgmgr.dll


    00AE0000[00018000]
      [ M] 93. c:\documents and settings\administrator\local settings\temp\rsv8d.tmp

【回复“zhott”的帖子】
把以下文件打包通过：http://up.rising.com.cn/webmail/uploadnew.htm
发送给瑞星，及时升级瑞星杀毒软件查杀！
可疑文件：
c:\windows\system\zw10\wdfmgr.exe
c:\windows\system32\drivers\0ngc1kj.sys
c:\windows\system32\drivers\ibgedbij.sys
c:\docume~1\admini~1\locals~1\temp\mc2a.tmp
c:\windows\system32\drivers\ttajwx94.sys
c:\windows\system32\drivers\medeaafw.sys
c:\documents and settings\administrator\local settings\temp\rsv8d.tmp