瑞星卡卡电脑诊断日志 v1.30 (2007-11-18 23:24:16) 北京瑞星科技股份有限公司
注释: [A]表示该文件存在自启动关联;
[M]表示该文件在内存中;
+ 注册表自运行项目
+ 系统服务
+ HKLM\System\CurrentControlSet\Services
RsCCenter
[AM] 1. c:\program files\rising\rav\ccenter.exe
+ 内核驱动
+ HKLM\System\CurrentControlSet\Services
ALCXWDM
[A ] 2. c:\windows\system32\drivers\alcxwdm.sys
FETND5BV
[A ] 3. c:\windows\system32\drivers\fetnd5bv.sys
IpInIp
[A ] 4. c:\windows\system32\drivers\ipinip.sys
RsAntiSpyware
[A ] 5. c:\windows\system32\drivers\rsboot.sys
RsNTGDI
[A ] 6. c:\windows\system32\drivers\rsntgdi.sys
Secdrv
[A ] 7. c:\windows\system32\drivers\secdrv.sys
viagfx
[A ] 8. c:\windows\system32\drivers\vtmini.sys
viamraid
[A ] 9. c:\windows\system32\drivers\viamraid.sys
+ IE浏览器加载模块
+ HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper
Objects
{01443AEC-0FD1-40fd-9C87-E93D1494C233}
[AM] 10. c:\program files\thunder network\thunder\comdlls\tdatonce_now.dll
{889D2FEB-5411-4565-8998-1DD2C5261283}
[AM] 11. c:\program files\thunder network\thunder\comdlls\xunleibho_now.dll
{B69F34DD-F0F9-42DC-9EDD-957187DA688D}
[AM] 12. c:\program files\360safe\safemon\safemon.dll
+ HKLM\SOFTWARE\Microsoft\Internet Explorer\Extensions
Exec
[A ] 13. c:\program files\thunder network\thunder\thunder.exe
+ 资源管理器加载模块
+ HKLM\SOFTWARE\Classes\PROTOCOLS\Filter
application/octet-stream
[A ] 14. c:\windows\system32\mscoree.dll
application/x-complus
[A ] 14. c:\windows\system32\mscoree.dll
application/x-msdownload
[A ] 14. c:\windows\system32\mscoree.dll
+ HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved
Fusion Cache
[A ] 14. c:\windows\system32\mscoree.dll
WinRAR shell extension
[AM] 15. c:\program files\winrar\rarext.dll
RISING
[AM] 16. c:\windows\system32\ravext.dll
+ HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks
{32CD708B-60A7-4C00-9377-D73EAA495F0F}
[AM] 16. c:\windows\system32\ravext.dll
{AC2DC2EF-5165-40A3-8CDF-41DCA1B0901A}
[AM] 17. c:\windows\system32\shlhook.dll
+ 用户登陆自运行项目
+ HKCU\Software\Microsoft\Windows\CurrentVersion\Run
bgswitch
[A ] 18. c:\windows\system32\bgswitch.exe
+ HKLM\Software\Microsoft\Windows\CurrentVersion\Run
VTTimer
[AM] 19. c:\windows\system32\vttimer.exe
VTTrayp
[A ] 20. c:\windows\system32\vttrayp.exe
SoundMan
[AM] 21. c:\windows\soundman.exe
RavTask
[AM] 22. c:\program files\rising\rav\ravtask.exe
runeip
[AM] 23. c:\program files\rising\antispyware\runiep.exe
+ HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce
KKDelay
[A ] 24. c:\program files\rising\antispyware\runonce.exe
+ 开机执行
+ HKLM\SYSTEM\CurrentControlSet\Control\NetworkProvider\Order
BootExecute
[A ] 25. c:\windows\system32\bsmain.exe
[A ] 26. c:\windows\system32\kknative.exe
+ 正在运行的进程
+ 000000e8(232) spoolsv.exe
+ 00000128(296) msdtc.exe
+ 00000148(328) svchost.exe
+ 000001c4(452) stormliv.exe
00400000[0006D000]
[ M] 27. c:\program files\stormii\stormliv.exe
75FF0000[00065000]
[ M] 28. c:\program files\stormii\msvcp60.dll
+ 00000224(548) alg.exe
+ 00000244(580) smss.exe
+ 0000029c(668) csrss.exe
+ 00000348(840) svchost.exe
+ 00000440(1088) Explorer.EXE
00F80000[0001B000]
[ M] 29. c:\program files\rising\antispyware\ieprot.dll
72C30000[00008000]
[ M] 30. c:\windows\system32\msacm32.drv
23050000[0000D000]
[ M] 31. c:\program files\thunder network\thunder\components\resworker\dsbho_00.dll
23020000[0000D000]
[ M] 32. c:\program files\thunder network\thunder\components\resworker\dataprocessor_00.dll
01500000[0002B000]
[AM] 15. c:\program files\winrar\rarext.dll
00C00000[0001C000]
[AM] 16. c:\windows\system32\ravext.dll
23700000[00028000]
[ M] 33. c:\program files\rising\rav\rscommon.dll
01530000[00011000]
[AM] 17. c:\windows\system32\shlhook.dll
+ 000004c4(1220) winlogon.exe
72C30000[00008000]
[ M] 30. c:\windows\system32\msacm32.drv
+ 000004e8(1256) VTTimer.exe
00400000[0000D000]
[AM] 19. c:\windows\system32\vttimer.exe
10000000[0001B000]
[ M] 29. c:\program files\rising\antispyware\ieprot.dll
+ 00000500(1280) services.exe
+ 0000050c(1292) lsass.exe
+ 0000054c(1356) SOUNDMAN.EXE
00400000[00015000]
[AM] 21. c:\windows\soundman.exe
10000000[0001B000]
[ M] 29. c:\program files\rising\antispyware\ieprot.dll
+ 000005d8(1496) svchost.exe
+ 00000610(1552) RavTask.exe
00400000[00034000]
[AM] 22. c:\program files\rising\rav\ravtask.exe
10000000[0001F000]
[ M] 34. c:\program files\rising\rav\proccom.dll
00A20000[00024000]
[ M] 35. c:\program files\rising\rav\rscommx2.dll
23700000[00028000]
[ M] 33. c:\program files\rising\rav\rscommon.dll
00C70000[0000E000]
[ M] 36. c:\program files\rising\rav\rsappmgr.dll
08C90000[00030000]
[ M] 37. c:\program files\rising\rav\cfgdll.dll
08F40000[0001B000]
[ M] 29. c:\program files\rising\antispyware\ieprot.dll
+ 00000618(1560) runiep.exe
00400000[00013000]
[AM] 23. c:\program files\rising\antispyware\runiep.exe
00D60000[0001B000]
[ M] 29. c:\program files\rising\antispyware\ieprot.dll
+ 00000644(1604) svchost.exe
+ 0000066c(1644) CCenter.exe
00400000[00028000]
[AM] 1. c:\program files\rising\rav\ccenter.exe
+ 00000680(1664) svchost.exe
+ 00000698(1688) svchost.exe
+ 000006a8(1704) svchost.exe
+ 000006c8(1736) ctfmon.exe
10000000[0001B000]
[ M] 29. c:\program files\rising\antispyware\ieprot.dll
+ 000006e4(1764) svchost.exe
+ 00000780(1920) wmiprvse.exe
+ 00000934(2356) IEXPLORE.EXE
10000000[0005F000]
[AM] 10. c:\program files\thunder network\thunder\comdlls\tdatonce_now.dll
00EC0000[00029000]
[AM] 11. c:\program files\thunder network\thunder\comdlls\xunleibho_now.dll
23050000[0000D000]
[ M] 31. c:\program files\thunder network\thunder\components\resworker\dsbho_00.dll
23020000[0000D000]
[ M] 32. c:\program files\thunder network\thunder\components\resworker\dataprocessor_00.dll
00F30000[0001D000]
[AM] 12. c:\program files\360safe\safemon\safemon.dll
01D90000[0001B000]
[ M] 29. c:\program files\rising\antispyware\ieprot.dll
72C30000[00008000]
[ M] 30. c:\windows\system32\msacm32.drv
03060000[00004000]
[ M] 38. c:\windows\system32\w03a2409.dll
30000000[002EF000]
[ M] 39. c:\windows\system32\macromed\flash\flash9d.ocx
+ 00000e0c(3596) Ras.exe
00400000[00170000]
[ M] 40. c:\program files\rising\antispyware\ras.exe
780C0000[00061000]
[ M] 41. c:\program files\rising\antispyware\msvcp60.dll
10000000[00013000]
[ M] 42. c:\program files\rising\antispyware\topsoft.dll
7C140000[00103000]
[ M] 43. c:\program files\rising\antispyware\mfc71.dll
7C340000[00056000]
[ M] 44. c:\program files\rising\antispyware\msvcr71.dll
7C3A0000[0007B000]
[ M] 45. c:\program files\rising\antispyware\msvcp71.dll
00EE0000[0001F000]
[ M] 34. c:\program files\rising\rav\proccom.dll
00F00000[00024000]
[ M] 35. c:\program files\rising\rav\rscommx2.dll
01050000[000BD000]
[ M] 46. c:\program files\rising\antispyware\rasgui.dll
01030000[0001B000]
[ M] 29. c:\program files\rising\antispyware\ieprot.dll
02F60000[0001F000]
[ M] 47. c:\program files\rising\antispyware\secscan.dll
03050000[00015000]
[ M] 48. c:\program files\rising\antispyware\secex.dll
02280000[0002F000]
[ M] 49. c:\program files\rising\antispyware\engine.dll
022D0000[00012000]
[ M] 50. c:\program files\rising\antispyware\zip.dll
