瑞星卡卡安全论坛

Logfile of Kaka v2. 0. 0. 1 Scan Module v2. 0. 0. 0
Scan saved at 14:29:09, on 2006-06-28
Platform: Microsoft Windows XP Professional Service Pack 2 (Build 2600)
MSIE: Internet Explorer v6.00 SP2; (6.00.2900.2180 (xpsp_sp2_rtm.040803-2158))


Running processes:
[smss.exe]
CommandLine =

[csrss.exe]
CommandLine = C:\WINDOWS\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,3072,512 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ProfileControl=Off MaxRequestThreads=16

[winlogon.exe]
CommandLine = winlogon.exe

[services.exe]
CommandLine = C:\WINDOWS\system32\services.exe

[lsass.exe]
CommandLine = C:\WINDOWS\system32\lsass.exe

[vtserver.exe]
CommandLine = "C:\Program Files\Common Files\Virtual Token\vtserver.exe"

[ibmpmsvc.exe]
CommandLine = C:\WINDOWS\system32\ibmpmsvc.exe

[ati2evxx.exe]
CommandLine = C:\WINDOWS\system32\Ati2evxx.exe

[svchost.exe]
CommandLine = C:\WINDOWS\system32\svchost -k DcomLaunch

[svchost.exe]
CommandLine = C:\WINDOWS\system32\svchost -k rpcss

[CCenter.exe]
CommandLine = "D:\program\Rising\Rav\CCenter.exe"

[svchost.exe]
CommandLine = C:\WINDOWS\System32\svchost.exe -k netsvcs

[EvtEng.exe]
CommandLine = "C:\Program Files\Intel\Wireless\Bin\EvtEng.exe"

[S24EvMon.exe]
CommandLine = "C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe"

[svchost.exe]
CommandLine = C:\WINDOWS\system32\svchost.exe -k NetworkService

[svchost.exe]
CommandLine = C:\WINDOWS\system32\svchost.exe -k LocalService

[RavMonD.exe]
CommandLine = "D:\program\Rising\Rav\Ravmond.exe"

[rfwsrv.exe]
CommandLine = d:\program\rising\rfw\rfwsrv.exe

[spoolsv.exe]
CommandLine = C:\WINDOWS\system32\spoolsv.exe

[RavStub.exe]
CommandLine = D:\program\Rising\Rav\RavStub.exe /RAVMOND

[svchost.exe]
CommandLine = C:\WINDOWS\system32\svchost.exe -k bthsvcs

[QCONSVC.EXE]
CommandLine = System32\QCONSVC.EXE

[RegSrvc.exe]
CommandLine = "C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe"

[RichVideo.exe]
CommandLine = "C:\Program Files\Cyberlink\Shared files\RichVideo.exe"

[SMAgent.exe]
CommandLine = "C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe"

[ati2evxx.exe]
CommandLine = Ati2evxx.exe -Client

[explorer.exe]
CommandLine = C:\WINDOWS\Explorer.EXE

[TPHDEXLG.exe]
CommandLine = System32\TPHDEXLG.EXE

[alg.exe]
CommandLine = C:\WINDOWS\System32\alg.exe

[rfwmain.exe]
CommandLine =  -StartUp

[QCTRAY.EXE]
CommandLine = "C:\Program Files\ThinkPad\ConnectUtilities\QCTRAY.EXE"

[QCWLICON.EXE]
CommandLine = "C:\Program Files\ThinkPad\ConnectUtilities\QCWLICON.EXE"

[TPHKMGR.exe]
CommandLine = "C:\PROGRA~1\Lenovo\PkgMgr\HOTKEY\TPHKMGR.exe"

[TpShocks.exe]
CommandLine = "C:\WINDOWS\system32\TpShocks.exe"

[TPONSCR.exe]
CommandLine = "C:\Program Files\Lenovo\PkgMgr\HOTKEY\TPONSCR.exe"

[TpScrex.exe]
CommandLine = "C:\Program Files\Lenovo\PkgMgr\HOTKEY_1\TpScrex.exe"

[SynTPLpr.exe]
CommandLine = "C:\Program Files\Synaptics\SynTP\SynTPLpr.exe"

[SynTPEnh.exe]
CommandLine = "C:\Program Files\Synaptics\SynTP\SynTPEnh.exe"

[rundll32.exe]
CommandLine = "C:\WINDOWS\system32\RunDll32.exe" C:\PROGRA~1\ThinkPad\UTILIT~1\pwrmonit.dll,StartPwrMonitor

[rundll32.exe]
CommandLine = "C:\WINDOWS\system32\rundll32.exe" C:\PROGRA~1\ThinkPad\UTILIT~1\BatInfEx.dll,BMMAutonomicMonitor

[EZEJMNAP.EXE]
CommandLine = "C:\PROGRA~1\ThinkPad\UTILIT~1\EzEjMnAp.Exe"

[SMax4PNP.exe]
CommandLine = "C:\Program Files\Analog Devices\SoundMAX\SMax4PNP.exe"

[SMax4.exe]
CommandLine = "C:\Program Files\Analog Devices\SoundMAX\Smax4.exe" /tray

[rundll32.exe]
CommandLine = "C:\WINDOWS\system32\rundll32.exe" bthprops.cpl,,BluetoothAuthenticationAgent

[rundll32.exe]
CommandLine = "C:\WINDOWS\system32\Rundll32.exe" C:\WINDOWS\system32\hookdll.dll,ExecFilter solo

[RavTask.exe]
CommandLine = "D:\PROGRAM\RISING\RAV\RAVTASK.EXE" -SYSTEM

[RavMon.exe]
CommandLine = "D:\program\Rising\Rav\Ravmon.exe" -SYSTEM

[PDVDServ.exe]
CommandLine = "D:\program\PDVDServ.exe"

[realsched.exe]
CommandLine = "C:\Program Files\Common Files\Real\Update_OB\realsched.exe"  -osboot

[ctfmon.exe]
CommandLine = "C:\WINDOWS\system32\ctfmon.exe"

[DLG.exe]
CommandLine = "C:\Program Files\Digital Line Detect\DLG.exe"

[RsAgent.exe]
CommandLine = "D:\program\Rising\Rav\RsAgent.exe"

[agentsvr.exe]
CommandLine = C:\WINDOWS\msagent\AgentSvr.exe -Embedding

[conime.exe]
CommandLine = C:\WINDOWS\system32\conime.exe

[wuauclt.exe]
CommandLine = "C:\WINDOWS\system32\wuauclt.exe"

[IEXPLORE.EXE]
CommandLine = "C:\Program Files\Internet Explorer\IEXPLORE.EXE"

[WINWORD.EXE]
CommandLine = "D:\program\OFFICE11\WINWORD.EXE"  /n /dde

[IEXPLORE.EXE]
CommandLine = "C:\Program Files\Internet Explorer\IEXPLORE.EXE"

[KkScan.exe]
CommandLine = "D:\program\KkScan.exe"

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page=C:\WINDOWS\system32\blank.htm
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page=%SystemRoot%\system32\blank.htm
O1 - Hosts: 127.0.0.1      localhost
O1 - Hosts: 127.0.0.1      www.powernum123.com
O1 - Hosts: 127.0.0.1      www.chebl.com.cn
O1 - Hosts: 127.0.0.1      www.chebuluo.com
O2 - BHO: MMSAssist BHO - {6671A431-5C3D-463d-A7CF-5587F9B7E191} - C:\PROGRA~1\MMSASS~1\Mmsass~1.dll
O2 - BHO: stdup - {6A512BF7-EC78-4e8d-9841-6C02E8FA9838} - C:\WINDOWS\System32\stdup.dll
O2 - BHO: IeCatch2 Class - {A5366673-E8CA-11D3-9CD9-0090271D075B} - D:\program\FlashGet\jccatch.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar.dll
O2 - BHO: MacroMediapd - {B8CCDD47-38E4-4CD2-B7FA-3B4B690F74BD} - C:\WINDOWS\system32\microapmddt.dll