瑞星卡卡电脑诊断日志 v1.20 (2007-7-11 10:36:32) 北京瑞星科技股份有限公司
注释:[A]表示该文件存在自启动关联;
[M]表示该文件在内存中;
+ 注册表自运行项目
+ Win32 Services
+ HKLM\System\CurrentControlSet\Services
Adobe LM Service
[A ] 1. c:\program files\common files\adobe systems shared\service\adobelmsvc.exe
RsCCenter
[A ] 2. d:\program files\rising\rav\ccenter.exe
RsRavMon
[A ] 3. d:\program files\rising\rav\ravmond.exe
WudfSvc
[A ] 4. c:\windows\system32\wudfsvc.dll
xmlpro
[A ] 5. c:\windows\system32\lysvr.exe
+ Kernel Drivers
+ HKLM\System\CurrentControlSet\Services
ALCXSENS
[A ] 6. c:\windows\system32\drivers\alcxsens.sys
ALCXWDM
[A ] 7. c:\windows\system32\drivers\alcxwdm.sys
BaseTDI
[A ] 8. c:\windows\system32\drivers\basetdi.sys
BlueletAudio
[A ] 9. c:\windows\system32\drivers\blueletaudio.sys
BlueletSCOAudio
[A ] 10. c:\windows\system32\drivers\blueletscoaudio.sys
BT
[A ] 11. c:\windows\system32\drivers\btnetdrv.sys
Btcsrusb
[A ] 12. c:\windows\system32\drivers\btcusb.sys
BTHidEnum
[A ] 13. c:\windows\system32\drivers\vbtenum.sys
BTHidMgr
[A ] 14. c:\windows\system32\drivers\bthidmgr.sys
ExpScaner
[A ] 15. d:\program files\rising\rav\expscan.sys
HookCont
[A ] 16. d:\program files\rising\rav\hookcont.sys
HookReg
[A ] 17. d:\program files\rising\rav\hookreg.sys
HookSys
[A ] 18. d:\program files\rising\rav\hooksys.sys
ialm
[A ] 19. c:\windows\system32\drivers\ialmnt5.sys
MEMSCAN
[A ] 20. d:\program files\rising\rav\memscan.sys
npkcrypt
[A ] 21. d:\program files\tencent\qq\npkcrypt.sys
RsAntiSpyware
[A ] 22. c:\windows\system32\drivers\rsboot.sys
RsNTGDI
[A ] 23. c:\windows\system32\drivers\rsntgdi.sys
RSPPSYS
[A ] 24. d:\program files\rising\rav\rsppsys.sys
rtl8139
[A ] 25. c:\windows\system32\drivers\r8139n51.sys
Secdrv
[A ] 26. c:\windows\system32\drivers\secdrv.sys
VComm
[A ] 27. c:\windows\system32\drivers\vcomm.sys
VcommMgr
[A ] 28. c:\windows\system32\drivers\vcommmgr.sys
WudfPf
[A ] 29. c:\windows\system32\drivers\wudfpf.sys
WudfRd
[A ] 30. c:\windows\system32\drivers\wudfrd.sys
ZSMC301b
[A ] 31. c:\windows\system32\drivers\usbvm31b.sys
{6080A529-897E-4629-A488-ABA0C29B635E}
[A ] 32. c:\windows\system32\drivers\ialmsbw.sys
{D31A0762-0CEB-444e-ACFF-B049A1F6FE91}
[A ] 33. c:\windows\system32\drivers\ialmkchw.sys
+ Winlogon
+ HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify
igfxcui
[A ] 34. c:\windows\system32\igfxsrvc.dll
WgaLogon
[AM] 35. c:\windows\system32\wgalogon.dll
+ Internet Explorer
+ HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar
{DB9ECD4F-FB8F-4311-B3CE-90B976C2707C}
[A ] 36. c:\windows\system32\kakatool.dll
+ HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper
Objects
{01443AEC-0FD1-40fd-9C87-E93D1494C233}
[A ] 37. d:\program files\迅雷\comdlls\tdatonce_now.dll
{889D2FEB-5411-4565-8998-1DD2C5261283}
[A ] 38. d:\program files\迅雷\comdlls\xunleibho_now.dll
+ HKLM\SOFTWARE\Microsoft\Internet Explorer\Extensions
Exec
[A ] 39. d:\program files\迅雷\thunder.exe
Exec
[AM] 40. d:\program files\tencent\qq\qq.exe
+ Explorer
+ HKLM\SOFTWARE\Classes\PROTOCOLS\Handler
KuGoo3
[A ] 41. d:\program files\kugoo3\inextend\kugoo3downxcontrol.ocx
+ HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved
HyperTerminal Icon Ext
[A ] 42. c:\windows\system32\hticons.dll
WinRAR shell extension
[AM] 43. d:\program files\winrar\rarext.dll
Portable Media Devices
[A ] 44. c:\windows\system32\audiodev.dll
Portable Devices
[A ] 45. c:\windows\system32\wpdshext.dll
Portable Devices Menu
[A ] 45. c:\windows\system32\wpdshext.dll
RISING
[AM] 46. c:\windows\system32\ravext.dll
+ HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks
{32CD708B-60A7-4C00-9377-D73EAA495F0F}
[AM] 46. c:\windows\system32\ravext.dll
{AC2DC2EF-5165-40A3-8CDF-41DCA1B0901A}
[AM] 47. c:\windows\system32\shlhook.dll
+ HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellService
ObjectDelayLoad
WPDShServiceObj
[AM] 48. c:\windows\system32\wpdshserviceobj.dll
+ Logon
+ HKLM\Software\Microsoft\Windows\CurrentVersion\Run
RavTask
[A ] 49. d:\program files\rising\rav\ravtask.exe
runeip
[AM] 50. d:\program files\rising\runiep.exe
upxdnd
[A ] 51. c:\windows\upxdnd.exe
+ HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce
RavStub
[AM] 52. d:\program files\rising\rav\ravstub.exe
+ HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run
MSDEG32
[A ] 53. c:\windows\system32\lyloader.exe
MSDMG32
[A ] 54. c:\windows\system32\lyloadmr.exe
+ Boot Execute
+ HKLM\SYSTEM\CurrentControlSet\Control\NetworkProvider\Order
BootExecute
[A ] 55. c:\windows\system32\bsmain.exe
+ Image Hijacks
+ HKCR\.html
htmlfile\Edit\Command
[A ] 56. d:\program files\免安装\microsoft office 2003\office\msohtmed.exe
htmlfile\Print\Command
[A ] 56. d:\program files\免安装\microsoft office 2003\office\msohtmed.exe
+ HKCR\.htm
htmlfile\Edit\Command
[A ] 56. d:\program files\免安装\microsoft office 2003\office\msohtmed.exe
htmlfile\Print\Command
[A ] 56. d:\program files\免安装\microsoft office 2003\office\msohtmed.exe
+ 其他自启动项目
+
Privilege.dat
[A ] 57. c:\privilege.dat
+
Privilege.dat
[A ] 57. c:\privilege.dat
+ 系统活动模块
+ 000001a0(416) runiep.exe
00400000[00012000]
[AM] 50. d:\program files\rising\runiep.exe
10000000[00017000]
[ M] 58. c:\windows\system32\netsrvcs.dll
01010000[0001B000]
[ M] 59. d:\program files\rising\ieprot.dll
+ 000001b4(436) smss.exe
+ 000001f4(500) csrss.exe
+ 0000020c(524) winlogon.exe
01200000[0003B000]
[AM] 35. c:\windows\system32\wgalogon.dll
72C80000[00008000]
[ M] 60. c:\windows\system32\msacm32.drv
+ 00000238(568) services.exe
47260000[0000F000]
[ M] 61. c:\windows\apppatch\acadproc.dll
+ 00000244(580) lsass.exe
+ 000002d8(728) svchost.exe
+ 00000304(772) svchost.exe
+ 00000354(852) svchost.exe
+ 00000380(896) svchost.exe
+ 00000398(920) ctfmon.exe
10000000[00017000]
[ M] 58. c:\windows\system32\netsrvcs.dll
00E60000[0001B000]
[ M] 59. d:\program files\rising\ieprot.dll
+ 00000424(1060) svchost.exe
+ 000005b4(1460) RavStub.exe
00400000[00018000]
[AM] 52. d:\program files\rising\rav\ravstub.exe
10000000[0001B000]
[ M] 62. d:\program files\rising\rav\rscommx.dll
23700000[0001A000]
[ M] 63. d:\program files\rising\rav\rscommon.dll
+ 00000614(1556) explorer.exe
10000000[00017000]
[ M] 58. c:\windows\system32\netsrvcs.dll
01230000[0001B000]
[ M] 59. d:\program files\rising\ieprot.dll
164A0000[00023000]
[AM] 48. c:\windows\system32\wpdshserviceobj.dll
109C0000[0002C000]
[ M] 64. c:\windows\system32\portabledevicetypes.dll
10930000[00049000]
[ M] 65. c:\windows\system32\portabledeviceapi.dll
72C80000[00008000]
[ M] 60. c:\windows\system32\msacm32.drv
23700000[0001A000]
[ M] 63. d:\program files\rising\rav\rscommon.dll
58050000[0008A000]
[ M] 66. c:\windows\system32\l3codeca.acm
0BEF0000[00037000]
[ M] 67. c:\windows\system32\mfplat.dll
01410000[0001B000]
[AM] 46. c:\windows\system32\ravext.dll
60DF0000[0001B000]
[ M] 68. d:\program files\tencent\qq\qdshm.dll
60A10000[000F2000]
[ M] 69. d:\program files\tencent\qq\mfc42.dll
02B00000[0002B000]
[AM] 43. d:\program files\winrar\rarext.dll
+ 000006a8(1704) svchost.exe
+ 00000998(2456) QQ.exe
00400000[00187000]
[AM] 40. d:\program files\tencent\qq\qq.exe
10000000[00022000]
[ M] 70. d:\program files\tencent\qq\coralassist.dll
003A0000[0003E000]
[ M] 71. d:\program files\tencent\qq\coralqq.dll
005A0000[00029000]
[ M] 72. d:\program files\tencent\qq\kql.dll
7C420000[00087000]
[ M] 73. d:\program files\tencent\qq\msvcp80.dll
78130000[0009B000]
[ M] 74. d:\program files\tencent\qq\msvcr80.dll
60A10000[000F2000]
[ M] 69. d:\program files\tencent\qq\mfc42.dll
005D0000[00007000]
[ M] 75. d:\program files\tencent\qq\ipsearcher.dll
61360000[00236000]
[ M] 76. d:\program files\tencent\qq\qqbaseclassindll.dll
616B0000[00099000]
[ M] 77. d:\program files\tencent\qq\qqhelperdll.dll
60090000[00040000]
[ M] 78. d:\program files\tencent\qq\basicctrldll.dll
00D60000[00008000]
[ M] 79. d:\program files\tencent\qq\nodisturbfilter.cqx
00F70000[00006000]
[ M] 80. d:\program files\tencent\qq\confighotkey.cqx
01260000[00017000]
[ M] 58. c:\windows\system32\netsrvcs.dll
620B0000[00005000]
[ M] 81. d:\program files\tencent\qq\riched32.dll
62040000[00068000]
[ M] 82. d:\program files\tencent\qq\riched20.dll
612E0000[00038000]
[ M] 83. d:\program files\tencent\qq\qqapi.dll
621F0000[00007000]
[ M] 84. d:\program files\tencent\qq\timproxy.dll
01380000[0001B000]
[ M] 59. d:\program files\rising\ieprot.dll
013D0000[00006000]
[ M] 85. d:\program files\tencent\qq\autoreconnect.cqx
01D20000[00033000]
[ M] 86. d:\program files\tencent\qq\loginctrl.dll
01D60000[00044000]
[ M] 87. d:\program files\tencent\qq\npkcntc.dll
013F0000[0000E000]
[ M] 88. d:\program files\tencent\qq\npkpdb.dll
608B0000[00054000]
[ M] 89. d:\program files\tencent\qq\loginctrlres.dll
025F0000[0041A000]
[ M] 90. d:\program files\tencent\qq\qqres.dll
61780000[0008A000]
[ M] 91. d:\program files\tencent\qq\qqmainframe.dll
601A0000[00119000]
[ M] 92. d:\program files\tencent\qq\cqqapplication.dll
