瑞星卡卡电脑诊断日志 v1.30 (2007-7-23 13:52:48) 北京瑞星科技股份有限公司
注释: [A]表示该文件存在自启动关联;
[M]表示该文件在内存中;
+ 注册表自运行项目
+ 系统服务
+ HKLM\System\CurrentControlSet\Services
ose
[A ] 1. c:\program files\common files\microsoft shared\source engine\ose.exe
RsCCenter
[A ] 2. d:\program files\rising\rav\ccenter.exe
RsRavMon
[A ] 3. d:\program files\rising\rav\ravmond.exe
Visual WEB
[A ] 4. c:\windows\system32\wnipsvr.exe
+ 内核驱动
+ HKLM\System\CurrentControlSet\Services
aeaudio
[A ] 5. c:\windows\system32\drivers\aeaudio.sys
BaseTDI
[A ] 6. c:\windows\system32\drivers\basetdi.sys
ExpScaner
[A ] 7. d:\program files\rising\rav\expscan.sys
HookCont
[A ] 8. d:\program files\rising\rav\hookcont.sys
HookReg
[A ] 9. d:\program files\rising\rav\hookreg.sys
HookSys
[A ] 10. d:\program files\rising\rav\hooksys.sys
MEMSCAN
[A ] 11. d:\program files\rising\rav\memscan.sys
NPF
[A ] 12. c:\windows\system32\drivers\npf.sys
RsAntiSpyware
[A ] 13. c:\windows\system32\drivers\rsboot.sys
RsNTGDI
[A ] 14. c:\windows\system32\drivers\rsntgdi.sys
RSPPSYS
[A ] 15. d:\program files\rising\rav\rsppsys.sys
Secdrv
[A ] 16. c:\windows\system32\drivers\secdrv.sys
senfilt
[A ] 17. c:\windows\system32\drivers\senfilt.sys
SiSkp
[A ] 18. c:\windows\system32\drivers\srvkp.sys
smwdm
[A ] 19. c:\windows\system32\drivers\smwdm.sys
+ IE浏览器加载模块
+ HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper
Objects
{B69F34DD-F0F9-42DC-9EDD-957187DA688D}
[AM] 20. d:\program files\360safe\safemon\safemon.dll
+ 资源管理器加载模块
+ HKLM\SOFTWARE\Classes\PROTOCOLS\Filter
text/xml
[A ] 21. c:\program files\common files\microsoft shared\office11\msoxmlmf.dll
+ HKLM\SOFTWARE\Classes\PROTOCOLS\Handler
ms-itss
[A ] 22. c:\program files\common files\microsoft shared\information retrieval\msitss.dll
mso-offdap
[A ] 23. c:\program files\common files\microsoft shared\web components\10\owc10.dll
+ HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved
HyperTerminal Icon Ext
[A ] 24. c:\windows\system32\hticons.dll
WinRAR shell extension
[AM] 25. c:\program files\winrar\rarext.dll
RISING
[AM] 26. c:\windows\system32\ravext.dll
Shell Extensions for RealOne Player
[A ] 27. d:\program files\real\realplayer\rpshell.dll
Microsoft Office HTML Icon Handler
[AM] 28. c:\program files\microsoft office\office11\msohev.dll
Web Folders
[A ] 29. c:\program files\common files\microsoft shared\web folders\msonsext.dll
+ HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks
{459AFD5B-159F-ACD8-954C-ACD545FA6584}
[AM] 30. c:\windows\system32\jzdpri.dll
{AC2DC2EF-5165-40A3-8CDF-41DCA1B0901A}
[AM] 31. c:\windows\system32\shlhook.dll
+ 用户登陆自运行项目
+ HKLM\Software\Microsoft\Windows\CurrentVersion\Run
RavTask
[A ] 32. d:\program files\rising\rav\ravtask.exe
runeip
[AM] 33. d:\program files\rising\antispyware\runiep.exe
+ HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce
KKDelay
[A ] 34. d:\program files\rising\antispyware\runonce.exe
+ 开机执行
+ HKLM\SYSTEM\CurrentControlSet\Control\NetworkProvider\Order
BootExecute
[A ] 35. c:\windows\system32\bsmain.exe
[A ] 36. c:\windows\system32\kknative.exe
+ 映像劫持
+ HKCR\.html
htmlfile\Edit\Command
[A ] 37. c:\program files\microsoft office\office11\msohtmed.exe
htmlfile\Print\Command
[A ] 37. c:\program files\microsoft office\office11\msohtmed.exe
+ HKCR\.htm
htmlfile\Edit\Command
[A ] 37. c:\program files\microsoft office\office11\msohtmed.exe
htmlfile\Print\Command
[A ] 37. c:\program files\microsoft office\office11\msohtmed.exe
+ HKCR\.mp3
Audio.MP3\open\Command
[A ] 38. d:\program files\ttplayer\ttplayer.exe
Audio.MP3\PlayList\Command
[A ] 38. d:\program files\ttplayer\ttplayer.exe
+ 程序初始化和已知动态连接库
+ HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows
AppInit_DLLs
[AM] 30. c:\windows\system32\jzdpri.dll
+ 其他自启动项目
+
Hide.exe
[A ] 39. c:\hide.exe
+
Hide.exe
[A ] 39. c:\hide.exe
