瑞星卡卡安全论坛
sophiejia - 2007-7-31 20:17:00
[CODE]
2007-07-31,20:00:25
System Repair Engineer 2.5.16.900
Smallfrogs (http://www.KZTechs.com)
Windows XP Professional Service Pack 2 (Build 2600) - 管理权限用户 - 完整功能
以下内容被选中：
所有的启动项目（包括注册表、启动文件夹、服务等）
浏览器加载项
正在运行的进程（包括进程模块信息）
文件关联
Winsock 提供者
Autorun.inf
HOSTS 文件
进程特权扫描
启动项目
注册表
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
<ctfmon.exe><C:\WINDOWS\system32\ctfmon.exe> [(Verified)Microsoft Windows Publisher]
<bgswitch><C:\WINDOWS\system32\bgswitch.exe> []
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
<IMJPMIG8.1><"C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32> [(Verified)Microsoft Windows Publisher]
<PHIME2002ASync><C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC> [(Verified)Microsoft Windows Publisher]
<PHIME2002A><C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName> [(Verified)Microsoft Windows Publisher]
<NvCplDaemon><RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup> [(Verified)Microsoft Windows Hardware Compatibility Publisher]
<nwiz><nwiz.exe /install> [N/A]
<NvMediaCenter><RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit> [(Verified)Microsoft Windows Publisher]
<Cmaudio><RunDll32 cmicnfg.cpl,CMICtrlWnd> [N/A]
<RavTask><"C:\Program Files\Rising\Rav\RavTask.exe" -system> [Beijing Rising Technology Co., Ltd.]
<RfwMain><"C:\Program Files\Rising\Rfw\rfwmain.exe" -Startup> [Beijing Rising Technology Co., Ltd.]
<360Safetray><C:\Program Files\360safe\safemon\360Tray.exe /start> [奇虎网]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
<shell><Explorer.exe> [(Verified)Microsoft Windows Publisher]
<Userinit><C:\WINDOWS\system32\userinit.exe,> [(Verified)Microsoft Windows Publisher]
<UIHost><logonui.exe> [(Verified)Microsoft Windows Publisher]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
<{32CD708B-60A7-4C00-9377-D73EAA495F0F}><C:\WINDOWS\system32\RavExt.dll> [Beijing Rising Technology Co., Ltd.]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\>{26923b43-4d38-484f-9b9e-de460746276c}]
<Internet Explorer><%systemroot%\system32\shmgrate.exe OCInstallUserConfigIE> [N/A]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\>{881dd1c5-3dcf-431b-b061-f3f88e8be88a}]
<Outlook Express><%systemroot%\system32\shmgrate.exe OCInstallUserConfigOE> [N/A]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{2C7339CF-2B09-4501-B3F3-F3508C9228ED}]
<Themes Setup><%SystemRoot%\system32\regsvr32.exe /s /n /i:/UserInstall %SystemRoot%\system32\themeui.dll> [N/A]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{44BBA840-CC51-11CF-AAFA-00AA00B6015C}]
<Microsoft Outlook Express 6><"%ProgramFiles%\Outlook Express\setup50.exe" /APP:OE /CALLER:WINNT /user /install> [N/A]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{44BBA842-CC51-11CF-AAFA-00AA00B6015B}]
<NetMeeting 3.01><rundll32.exe advpack.dll,LaunchINFSection C:\WINDOWS\INF\msnetmtg.inf,NetMtg.Install.PerUser.NT> [(Verified)Microsoft Windows Publisher]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{5945c046-1e7d-11d1-bc44-00c04fd912be}]
<Windows Messenger 4.7><rundll32.exe advpack.dll,LaunchINFSection C:\WINDOWS\INF\msmsgs.inf,BLC.QuietInstall.PerUser> [(Verified)Microsoft Windows Publisher]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{6BF52A52-394A-11d3-B153-00C04F79FAA6}]
<Microsoft Windows Media Player><rundll32.exe advpack.dll,LaunchINFSection C:\WINDOWS\INF\wmp10.inf,PerUserStub> [(Verified)Microsoft Windows Component Publisher]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{7790769C-0471-11d2-AF11-00C04FA35D02}]
<通讯簿 6><"%ProgramFiles%\Outlook Express\setup50.exe" /APP:WAB /CALLER:WINNT /user /install> [N/A]
==================================
[用户系统信息]Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)
sophiejia - 2007-7-31 20:23:00
启动文件夹
[Adobe Gamma Loader]
<C:\Documents and Settings\All Users\「开始」菜单\程序\启动\Adobe Gamma Loader.lnk --> C:\PROGRA~1\COMMON~1\Adobe\CALIBR~1\ADOBEG~1.EXE [Adobe Systems, Inc.]><N>
==================================
服务
[Google Updater Service / gusvc][Stopped/Manual Start]
<"C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe"><Google>
[Help and Support / helpsvc][Stopped/Auto Start]
<C:\WINDOWS\System32\svchost.exe -k netsvcs-->%WINDIR%\PCHealth\HelpCtr\Binaries\pchsvc.dll><N/A>
[Human Interface Device Access / HidServ][Stopped/Disabled]
<C:\WINDOWS\System32\svchost.exe -k netsvcs-->%SystemRoot%\System32\hidserv.dll><N/A>
[NVIDIA Display Driver Service / NVSvc][Running/Auto Start]
<C:\WINDOWS\system32\nvsvc32.exe><NVIDIA Corporation>
[Rising Proxy Service / RfwProxySrv][Stopped/Manual Start]
<c:\program files\rising\rfw\rfwproxy.exe><Beijing Rising Technology Co., Ltd.>
[Rising Personal Firewall Service / RfwService][Running/Auto Start]
<c:\program files\rising\rfw\rfwsrv.exe><Beijing Rising Technology Co., Ltd.>
[Rising Process Communication Center / RsCCenter][Running/Auto Start]
<"C:\Program Files\Rising\Rav\CCenter.exe"><Beijing Rising Technology Co., Ltd.>
[Rising RealTime Monitor / RsRavMon][Running/Auto Start]
<"C:\Program Files\Rising\Rav\Ravmond.exe"><Beijing Rising Technology Co., Ltd.>
[SoundMAX Agent Service / SoundMAX Agent Service (default)][Running/Auto Start]
<C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe><Analog Devices, Inc.>
==================================
sophiejia - 2007-7-31 20:24:00
驱动程序
[2310_00 / 2310_00][Stopped/Boot Start]
<\SystemRoot\System32\BIRD\2310_00.sys><HighPoint Technologies, Inc.>
[3WAREDRV / 3WAREDRV][Stopped/Boot Start]
<\SystemRoot\System32\BIRD\3WAREDRV.SYS><N/A>
[3WAREGSM / 3WAREGSM][Stopped/Boot Start]
<\SystemRoot\System32\BIRD\3waregsm.sys><N/A>
[3WDRV100 / 3WDRV100][Stopped/Boot Start]
<\SystemRoot\System32\BIRD\3WDRV100.SYS><N/A>
[A320RAID / A320RAID][Stopped/Boot Start]
<\SystemRoot\System32\BIRD\a320raid.sys><Adaptec, Inc.>
[AAC / AAC][Stopped/Boot Start]
<\SystemRoot\System32\BIRD\aac.sys><Adaptec, Inc.>
[AACSAS / AACSAS][Stopped/Boot Start]
<\SystemRoot\System32\BIRD\aacsas.sys><Adaptec, Inc.>
[AAR81XX / AAR81XX][Stopped/Boot Start]
<\SystemRoot\System32\BIRD\aar81xx.sys><Adaptec, Inc.>
[AARSI3X / AARSI3X][Stopped/Boot Start]
<\SystemRoot\System32\BIRD\aarsi3x.sys><Adaptec, Inc.>
[ADP94XX / ADP94XX][Stopped/Boot Start]
<\SystemRoot\System32\BIRD\adp94xx.sys><Adaptec, Inc.>
[adpu160m / adpu160m][Stopped/Boot Start]
<\SystemRoot\System32\BIRD\adpu160m.sys><Microsoft Corporation>
[ADPU320 / ADPU320][Stopped/Boot Start]
<\SystemRoot\System32\BIRD\adpu320.sys><Adaptec, Inc.>
[aeaudio / aeaudio][Running/Manual Start]
<system32\drivers\aeaudio.sys><Andrea Electronics Corporation>
[AEC6210 / AEC6210][Stopped/Boot Start]
<\SystemRoot\System32\BIRD\aec6210.sys><ACARD Technology Corp.>
[AEC6260 / AEC6260][Stopped/Boot Start]
<\SystemRoot\System32\BIRD\aec6260.sys><ACARD Technology Corp.>
[AEC6280 / AEC6280][Stopped/Boot Start]
<\SystemRoot\System32\BIRD\aec6280.sys><ACARD Technology Corp.>
[AEC67160 / AEC67160][Stopped/Boot Start]
<\SystemRoot\System32\BIRD\aec67160.sys><ACARD Technology Corp.>
[AEC67162 / AEC67162][Stopped/Boot Start]
<\SystemRoot\System32\BIRD\aec67162.sys><ACARD Technology Corp.>
[AEC671X / AEC671X][Stopped/Boot Start]
<\SystemRoot\System32\BIRD\AEC671X.sys><ACARD Technology Corp.>
[AEC6880 / AEC6880][Stopped/Boot Start]
<\SystemRoot\System32\BIRD\AEC6880.sys><ACARD Technology Corp.>
[AEC6897 / AEC6897][Stopped/Boot Start]
<\SystemRoot\System32\BIRD\aec6897.sys><ACARD Technology Corp.>
[AEC68X5 / AEC68X5][Stopped/Boot Start]
<\SystemRoot\System32\BIRD\aec68x5.sys><ACARD Technology Corp.>
[aic78u2 / aic78u2][Stopped/Boot Start]
<\SystemRoot\System32\BIRD\aic78u2.sys><Microsoft Corporation>
[aic78xx / aic78xx][Stopped/Boot Start]
<\SystemRoot\System32\BIRD\aic78xx.sys><Microsoft Corporation>
[ARCM_X86 / ARCM_X86][Stopped/Boot Start]
<\SystemRoot\System32\BIRD\arcm_x86.sys><ARECA Technology Corporation>
[asc / asc][Stopped/Boot Start]
<\SystemRoot\System32\BIRD\asc.sys><Advanced System Products, Inc.>
[Rising TDI Base Driver / BaseTDI][Running/Auto Start]
<System32\DRIVERS\BaseTDI.SYS><Beijing Rising Technology Co., Ltd.>
[BCHTSW32 / BCHTSW32][Stopped/Boot Start]
<\SystemRoot\System32\BIRD\bchtsw32.sys><Broadcom Corporation>
[bnhyzjsp / bnhyzjsp][Running/Boot Start]
<\SystemRoot\System32\DRIVERS\bnhyzjsp.sys><Yahoo! China Corporation>
[buslogic / buslogic][Stopped/Boot Start]
<\SystemRoot\System32\bird\buslogic.sys><Microsoft Corporation>
[CDA1000 / CDA1000][Stopped/Boot Start]
<\SystemRoot\System32\BIRD\cda1000.sys><Adaptec, Inc.>
Leoooo - 2007-8-1 21:19:00
http://download.rising.com.cn/for_down/kakatool/kakasetupv4.exe下载卡卡上网安全助手4.0
1 运行瑞星卡卡上网安全助手
2 诊断求助=》电脑诊断日志
3 选择"忽略系统文件"、"文件详细信息"、"文件名相似分析"3个选项
4 开始扫描＝》导出信息，导成txt格式（也可以是htm格式方便自己看，不过论坛不能上传htm格式
）
5 把日志中的报告完整拷贝贴上来，不要修改（一次发不完请分次发上来）
6 扫日志的时候尽量把不必要的软件关闭 如QQ TM等
7 把扫描出来的可疑文件上传给瑞星http://up.rising.com.cn/webmail/uploadnew.htm
喋血 - 2007-8-21 12:18:00
瑞星卡卡电脑诊断日志 v1.30 (2007-8-21 11:37:14) 北京瑞星科技股份有限公司
注释:[A]表示该文件存在自启动关联;
[M]表示该文件在内存中;
+ 注册表自运行项目
+ 系统服务
+ HKLM\System\CurrentControlSet\Services
aspnet_state
[A ] 1. c:\windows\microsoft.net\framework\v2.0.50727\aspnet_state.exe
Microsoft Corporation
Microsoft ASP.NET State Server
.text,.data,.rsrc,
Autodesk Licensing Service
[A ] 2. c:\program files\common files\autodesk shared\service\adskscsrv.exe
Autodesk
System Level Service Utility
.text,.rdata,.data,.rsrc,
clr_optimization_v2.0.50727_32
[A ] 3. c:\windows\microsoft.net\framework\v2.0.50727\mscorsvw.exe
Microsoft Corporation
.NET Runtime Optimization Service
.text,.data,.rsrc,
LexBceS
[AM] 4. c:\windows\system32\lexbces.exe
Lexmark International, Inc.
LexBce Service
.text,.rdata,.data,.rsrc,
NVSvc
[AM] 5. c:\windows\system32\nvsvc32.exe
NVIDIA Corporation
NVIDIA Driver Helper Service, Version 61.76
.text,.rdata,.data,.rsrc,
ose
[A ] 6. c:\program files\common files\microsoft shared\source engine\ose.exe
Microsoft Corporation
Office Source Engine
.text,.data,.rsrc,
RfwProxySrv
[A ] 7. c:\program files\rising\rfw\rfwproxy.exe
Beijing Rising Technology Co., Ltd.
Rising Personal Proxy Service
.text,.rdata,.data,.rsrc,
RfwService
[A ] 8. c:\program files\rising\rfw\rfwsrv.exe
Beijing Rising Technology Co., Ltd.
Rising Personal FireWall Service
.text,.rdata,.data,.rsrc,
RsCCenter
[A ] 9. c:\program files\rising\rav\ccenter.exe
Beijing Rising Technology Co., Ltd.
CCenter
.text,.rdata,.data,.rsrc,
RsRavMon
[A ] 10. c:\program files\rising\rav\ravmond.exe
Beijing Rising Technology Co., Ltd.
RavMond
.text,.rdata,.data,.rsrc,
UMWdf
[AM] 11. c:\windows\system32\wdfmgr.exe
Microsoft Corporation
Windows User Mode Driver Manager
.text,.data,.rsrc,
usnjsvc
[A ] 12. c:\program files\msn messenger\usnsvc.exe
Microsoft Corporation
Messenger Sharing USN Journal Reader Service
.text,.data,.rsrc,
WmdmPmSN
[A ] 13. c:\windows\system32\mspmsnsv.dll
Microsoft Corporation
Microsoft Media Device Service Provider
.text,.data,.rsrc,.reloc,
+ 内核驱动
+ HKLM\System\CurrentControlSet\Services
BaseTDI
[A ] 14. c:\windows\system32\drivers\basetdi.sys
Beijing Rising Technology Co., Ltd.
basetdi
.text,.rdata,.data,INIT,.rsrc,.reloc,
cmuda
[A ] 15. c:\windows\system32\drivers\cmuda.sys
C-Media Inc
C-Media Audio WDM Driver
.text,_LTEXT,_PTEXT,.data,_PDATA,_LDATA,.data1,PAGE,INIT,.rsrc,.reloc,
ExpScaner
[A ] 16. c:\program files\rising\rav\expscan.sys
ExpScan.sys
.text,.rdata,.data,INIT,.rsrc,.reloc,
HookCont
[A ] 17. c:\program files\rising\rav\hookcont.sys
Rising
HookCont
.text,.rdata,.data,INIT,.rsrc,.reloc,
HookReg
[A ] 18. c:\program files\rising\rav\hookreg.sys
.text,.rdata,.data,INIT,.rsrc,.reloc,
HookSys
[A ] 19. c:\program files\rising\rav\hooksys.sys
Rising
Hooksys
.text,.rdata,.data,INIT,.rsrc,.reloc,
HookUrl
[A ] 20. c:\program files\rising\rfw\hookurl.sys
Beijing Rising Technology Co., Ltd.
HookUrl
.text,.rdata,.data,INIT,.rsrc,.reloc,
HTTP
[A ] 21. c:\windows\system32\drivers\http.sys
ip6fw
[A ] 22. c:\windows\system32\drivers\ip6fw.sys
kamjjdk
[A ] 23. c:\windows\system32\drivers\kamjjdk.sys
北京三七二一科技有限公司
sys 应用程序
.text,.rdata,.data,INIT,.rsrc,.reloc,
MEMSCAN
[A ] 24. c:\program files\rising\rav\memscan.sys
Beijing Rising Technology Co., Ltd.
MemScan Driver
.text,.rdata,.data,INIT,.rsrc,.reloc,
mProcRs
[A ] 25. c:\program files\rising\rfw\mprocrs.sys
Beijing Rising Technology Co., Ltd.
Rising Personal FireWall mprocrs.sys
.text,.rdata,.data,INIT,.rsrc,.reloc,
ntiopnp
[A ] 26. c:\windows\system32\drivers\ntiopnp.sys
1.00
.text,.rdata,.data,INIT,.rsrc,.reloc,
nvatabus
[A ] 27. c:\windows\system32\drivers\nvatabus.sys
NVIDIA Corporation
NVIDIA? nForce(TM) IDE Performance Driver
.text,.rdata,.data,PAGE,INIT,.rsrc,.reloc,
NVENET
[A ] 28. c:\windows\system32\drivers\nvenet.sys
NVIDIA Corporation
NVIDIA nForce MCP Networking Driver.
.text,.rdata,.data,INIT,.rsrc,.reloc,
nv_agp
[A ] 29. c:\windows\system32\drivers\nv_agp.sys
NVIDIA Corporation
NVIDIA nForce AGP Filter
.text,.rdata,.data,PAGE,INIT,.rsrc,.reloc,
QKeyService
[A ] 30. c:\windows\system32\keycrypt.sys
Tencent Technology (Shenzhen) Company Limited
KeyCrypt Device Driver
.text,.rdata,.data,.CRT,.STL,INIT,.rsrc,.reloc,
RsAntiSpyware
[A ] 31. c:\windows\system32\drivers\rsboot.sys
Beijing Rising Technology Co., Ltd.
Anti-RootKit Driver
.text,.rdata,.data,INIT,.rsrc,.reloc,
喋血 - 2007-8-21 12:19:00
RsFwDrv
[A ] 32. c:\program files\rising\rfw\rsfwdrv.sys
Beijing Rising Technology Co., Ltd.
nt_fwdrv
.text,.rdata,.data,INIT,.rsrc,.reloc,
RsNTGDI
[A ] 33. c:\windows\system32\drivers\rsntgdi.sys
Beijing Rising Technology Co., Ltd.
RsNTGDI
.text,.rdata,INIT,.rsrc,.reloc,
RSPPSYS
[A ] 34. c:\program files\rising\rav\rsppsys.sys
Rising
RSPPSYS.SYS
.text,.rdata,.data,INIT,.rsrc,.reloc,
Secdrv
[A ] 35. c:\windows\system32\drivers\secdrv.sys
.text,.data,INIT,.reloc,
TesSafe
[A ] 36. c:\windows\system32\tessafe.sys
TENCENT
TesSafe NT Driver
.text,.rdata,.data,INIT,.rsrc,.reloc,
usbehci
[A ] 37. c:\windows\system32\drivers\usbehci.sys
Microsoft Corporation
EHCI eUSB Miniport Driver
.text,.rdata,.data,INIT,.rsrc,.reloc,
ZSMC303
[A ] 38. c:\windows\system32\drivers\usbvm303.sys
Vimicro Corporation
Video streaming and Capture Device Driver
.text,.data,.data1,PAGECONS,INIT,.rsrc,.reloc,
+ IE浏览器加载模块
+ HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar
{DB9ECD4F-FB8F-4311-B3CE-90B976C2707C}
[A ] 39. c:\windows\system32\kakatool.dll
Beijing Rising Technology Co., Ltd.
Rising AntiSpyware Toolbar
.text,.rdata,.data,MonitorS,.rsrc,.reloc,
{BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0}
[AM] 40. c:\program files\windows live toolbar\msntb.dll
Microsoft Corporation
Windows Live Toolbar for Internet Explorer
.text,.data,.rsrc,.reloc,
+ HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects
{00000000-12C9-4305-82F9-43058F20E8D2}
[AM] 41. c:\program files\tencent\qqdownload\qqiehelper01.dll
腾讯公司
超级旋风下载组件
.text,.rdata,.data,.rsrc,.reloc,
{0005A87D-D626-4B3A-84F9-1D9571695F55}
[AM] 42. c:\windows\system32\xunleibho_v8.dll
xunleibho BHO
.text,.rdata,.data,.rsrc,.reloc,
{9030D464-4C02-4ABF-8ECC-5164760863C6}
[AM] 43. c:\program files\common files\microsoft shared\windows live\windowslivelogin.dll
Microsoft Corporation
WindowsLiveLogin.dll
.text,.data,.rsrc,.reloc,
{BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0}
[AM] 40. c:\program files\windows live toolbar\msntb.dll
Microsoft Corporation
Windows Live Toolbar for Internet Explorer
.text,.data,.rsrc,.reloc,
+ HKLM\SOFTWARE\Microsoft\Internet Explorer\Extensions
Script
[A ] 44. c:\windows\web\related.htm
Exec
[A ] 45. c:\program files\messenger\msmsgs.exe
Microsoft Corporation
Messenger
.text,.data,.rsrc,
+ 资源管理器加载模块
+ HKLM\SOFTWARE\Classes\PROTOCOLS\Filter
application/octet-stream
[AM] 46. c:\windows\system32\mscoree.dll
Microsoft Corporation
Microsoft .NET Runtime Execution Engine
.text,.data,.rsrc,.reloc,
application/x-complus
[AM] 46. c:\windows\system32\mscoree.dll
Microsoft Corporation
Microsoft .NET Runtime Execution Engine
.text,.data,.rsrc,.reloc,
application/x-msdownload
[AM] 46. c:\windows\system32\mscoree.dll
Microsoft Corporation
Microsoft .NET Runtime Execution Engine
.text,.data,.rsrc,.reloc,
text/xml
[AM] 47. c:\program files\common files\microsoft shared\office11\msoxmlmf.dll
Microsoft Corporation
Microsoft Office XML MIME Filter
.text,.data,.rsrc,.reloc,
+ HKLM\SOFTWARE\Classes\PROTOCOLS\Handler
KuGoo3
[A ] 48. e:\kugoo\kugoo3\inextend\kugoo3downxcontrol.ocx
CODE,DATA,BSS,.idata,.edata,.reloc,.rsrc,
livecall
[A ] 49. c:\program files\msn messenger\msgrapp.8.1.0178.00.dll
Microsoft Corporation
MSN Messenger Protocol Handler
.text,.data,.rsrc,.reloc,
msnim
[A ] 49. c:\program files\msn messenger\msgrapp.8.1.0178.00.dll
Microsoft Corporation
MSN Messenger Protocol Handler
.text,.data,.rsrc,.reloc,
mso-offdap11
[A ] 50. c:\program files\common files\microsoft shared\web components\11\owc11.dll
Microsoft Corporation
Microsoft Office Web Components 2003
.text,.data,.rtext,Shared,.rsrc,.reloc,
+ HKLM\SOFTWARE\Classes\Folder\shellex\ColumnHandlers
{8A0BC933-7552-42E2-A228-3BE055777227}
[AM] 51. c:\program files\common files\autodesk shared\acshellex\acshellextension.dll
Autodesk
AutoCAD Dwg common shell extension handler
.text,.orpc,.rdata,.data,.rsrc,.reloc,
+ HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved
HyperTerminal Icon Ext
[A ] 52. c:\windows\system32\hticons.dll
Hilgraeve, Inc.
HyperTerminal Applet Library
.text,.data,.rsrc,.reloc,
Auto Update Property Sheet Extension
[A ] 53. c:\windows\system32\wuaucpl.cpl
Microsoft Corporation
Automatic Updates Control Panel
.text,.data,.rsrc,.reloc,
WinRAR shell extension
[AM] 54. c:\program files\winrar\rarext.dll
.text,.data,.tls,.idata,.edata,.rsrc,.reloc,
NvCpl DesktopContext Class
[AM] 55. c:\windows\system32\nvcpl.dll
NVIDIA Corporation
NVIDIA Display Properties Extension
.text,.rdata,.data,.rsrc,.reloc,
Play on my TV helper
[AM] 55. c:\windows\system32\nvcpl.dll
NVIDIA Corporation
NVIDIA Display Properties Extension
.text,.rdata,.data,.rsrc,.reloc,
Desktop Explorer
[AM] 56. c:\windows\system32\nvshell.dll
NVIDIA Corporation
NVIDIA Desktop Explorer, Version 61.76
.text,.rdata,.data,.idata,.shared,.rsrc,.reloc,
Desktop Explorer Menu
[AM] 56. c:\windows\system32\nvshell.dll
NVIDIA Corporation
NVIDIA Desktop Explorer, Version 61.76
.text,.rdata,.data,.idata,.shared,.rsrc,.reloc,
nView Desktop Context Menu
[AM] 56. c:\windows\system32\nvshell.dll
NVIDIA Corporation
NVIDIA Desktop Explorer, Version 61.76
.text,.rdata,.data,.idata,.shared,.rsrc,.reloc,
Web Folders
[A ] 57. c:\program files\common files\microsoft shared\web folders\msonsext.dll
Microsoft Corporation
Microsoft Web Folders
.text,.data,.rsrc,.reloc,
Microsoft Office HTML Icon Handler
[AM] 58. c:\program files\microsoft office\office11\msohev.dll
Microsoft Corporation
Microsoft Office 2003 component
.text,.data,.rsrc,.reloc,
Shell Extensions for RealOne Player
[A ] 59. c:\program files\real\realplayer\rpshell.dll
RealNetworks, Inc.
RealPlayer Shell Extensions
.text,.rdata,.data,.rsrc,.reloc,
Portable Media Devices
[A ] 60. c:\windows\system32\audiodev.dll
Microsoft Corporation
便携媒体设备命令行解释器扩展
.text,.data,.rsrc,.reloc,
Portable Media Devices Menu
[A ] 60. c:\windows\system32\audiodev.dll
Microsoft Corporation
便携媒体设备命令行解释器扩展
.text,.data,.rsrc,.reloc,
RISING
[AM] 61. c:\windows\system32\ravext.dll
Beijing Rising Technology Co., Ltd.
Rising Shell Ext Module
.text,.rdata,.data,.rsrc,.reloc,
Messenger Sharing Folders
[A ] 62. c:\program files\msn messenger\fsshext.8.1.0178.00.dll
Microsoft Corporation
Messenger File Sharing Shell Extensions
.text,.data,.rsrc,.reloc,
ShellLink for Application References
[A ] 63. c:\windows\system32\dfshim.dll
Microsoft Corporation
Application Deployment Support Library
.text,.data,.rsrc,.reloc,
Shell Icon Handler for Application References
[A ] 63. c:\windows\system32\dfshim.dll
Microsoft Corporation
Application Deployment Support Library
.text,.data,.rsrc,.reloc,
AutoCAD DWG 列处理程序
[AM] 51. c:\program files\common files\autodesk shared\acshellex\acshellextension.dll
Autodesk
AutoCAD Dwg common shell extension handler
.text,.orpc,.rdata,.data,.rsrc,.reloc,
AutoCAD DWG 信息提示处理程序
[AM] 51. c:\program files\common files\autodesk shared\acshellex\acshellextension.dll
Autodesk
AutoCAD Dwg common shell extension handler
.text,.orpc,.rdata,.data,.rsrc,.reloc,
AutoCAD 数字签名图标覆盖处理程序
[AM] 64. c:\windows\system32\acsignicon.dll
Autodesk, Inc.
AutoCAD component
.text,.rdata,.data,.rsrc,.reloc,
Autodesk 图形预览
[A ] 65. c:\program files\common files\autodesk shared\thumbnail\acthumbnail16.dll
Autodesk, Inc.
AutoCAD component
.text,.rdata,.data,.rsrc,.reloc,
Autodesk Dgn 文件预览
[A ] 66. c:\program files\common files\autodesk shared\acdgncom17.dll
Autodesk
AcDgnCOM Module
.text,.rdata,.data,.rsrc,.reloc,
+ HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks
{32CD708B-60A7-4C00-9377-D73EAA495F0F}
[AM] 61. c:\windows\system32\ravext.dll
Beijing Rising Technology Co., Ltd.
Rising Shell Ext Module
.text,.rdata,.data,.rsrc,.reloc,
喋血 - 2007-8-21 12:19:00
{AC2DC2EF-5165-40A3-8CDF-41DCA1B0901A}
[AM] 67. c:\windows\system32\shlhook.dll
Beijing Rising Technology Co., Ltd.
shlhook Module
.text,.rdata,.data,.rsrc,.reloc,
+ 用户登陆自运行项目
+ HKCU\Software\Microsoft\Windows\CurrentVersion\Run
MsnMsgr
[AM] 68. c:\program files\msn messenger\msnmsgr.exe
Microsoft Corporation
Messenger
.text,.data,.rsrc,
+ HKLM\Software\Microsoft\Windows\CurrentVersion\Run
nwiz
[A ] 69. c:\windows\system32\nwiz.exe
NVIDIA Corporation
NVIDIA nView Wizard, Version 61.76
.text,.rdata,.data,.rsrc,
NVIDIA nForce APU1 Utilities
[AM] 70. c:\windows\system32\nvatray.exe
NVIDIA? Corporation
NV Audio Panel Tray Application
.text,.rdata,.data,.rsrc,
IMSCMig
[A ] 71. c:\program files\common files\microsoft shared\ime\imsc40a\imscmig.exe
Microsoft Corporation
微软拼音输入法安装工具
.text,.data,.rsrc,
TkBellExe
[AM] 72. c:\program files\common files\real\update_ob\realsched.exe
RealNetworks, Inc.
RealNetworks Scheduler
.text,.rdata,.data,.rsrc,
StormCodec_Helper
[A ] 73. c:\program files\ringz studio\storm codec\stormset.exe
.text,.rdata,.data,.ndata,.rsrc,
runeip
[AM] 74. c:\program files\rising\antispyware\runiep.exe
Beijing Rising Technology Co., Ltd.
Rising AntiSpyware Monitor
.text,.rdata,.data,.rsrc,
RavTask
[A ] 75. c:\program files\rising\rav\ravtask.exe
Beijing Rising Technology Co., Ltd.
RavTimer
.text,.rdata,.data,.rsrc,
BigDog303
[AM] 76. c:\windows\vm303_sti.exe
Vimicro
Vimicro
.text,.rdata,.data,.rsrc,
RfwMain
[AM] 77. c:\program files\rising\rfw\rfwmain.exe
Beijing Rising Technology Co., Ltd.
Rising Personal FireWall Main Program
.text,.rdata,.data,.rsrc,
KuGoo3
[A ] 78. e:\kugoo\kugoo3\kugoo.exe
专业音乐P2P传输软件
CODE,DATA,BSS,.idata,.tls,.rdata,.reloc,.rsrc,
+ HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce
RavStub
[AM] 79. c:\program files\rising\rav\ravstub.exe
Beijing Rising Technology Co., Ltd.
Rising RavStub
.text,.rdata,.data,.rsrc,
+ 开机执行
+ HKLM\SYSTEM\CurrentControlSet\Control\NetworkProvider\Order
BootExecute
[A ] 80. c:\windows\system32\bsmain.exe
Beijing Rising Technology Co., Ltd.
BootScan
.text,.data,.rsrc,.reloc,
+ 映像劫持
+ HKCR\.exe
exefile\启用/禁用数字签名图标\Command
[A ] 81. c:\windows\system32\acsignopt.exe
Autodesk, Inc.
AutoCAD component
.text,.rdata,.data,.rsrc,
+ HKCR\.bat
batfile\edit\Command
[A ] 82. c:\windows\system32\notepad.exe
Microsoft Corporation
记事本
.text,.data,.rsrc,
batfile\print\Command
[A ] 82. c:\windows\system32\notepad.exe
Microsoft Corporation
记事本
.text,.data,.rsrc,
+ HKCR\.html
htmlfile\Edit\Command
[A ] 83. c:\program files\microsoft office\office11\msohtmed.exe
Microsoft Corporation
Microsoft Office 2003 component
.text,.data,.rsrc,
htmlfile\Print\Command
[A ] 83. c:\program files\microsoft office\office11\msohtmed.exe
Microsoft Corporation
Microsoft Office 2003 component
.text,.data,.rsrc,
+ HKCR\.htm
htmlfile\Edit\Command
[A ] 83. c:\program files\microsoft office\office11\msohtmed.exe
Microsoft Corporation
Microsoft Office 2003 component
.text,.data,.rsrc,
htmlfile\Print\Command
[A ] 83. c:\program files\microsoft office\office11\msohtmed.exe
Microsoft Corporation
Microsoft Office 2003 component
.text,.data,.rsrc,
+ HKCR\.log
txtfile\print\Command
[A ] 82. c:\windows\system32\notepad.exe
Microsoft Corporation
记事本
.text,.data,.rsrc,
txtfile\printto\Command
[A ] 82. c:\windows\system32\notepad.exe
Microsoft Corporation
记事本
.text,.data,.rsrc,
+ HKCR\.txt
txtfile\print\Command
[A ] 82. c:\windows\system32\notepad.exe
Microsoft Corporation
记事本
.text,.data,.rsrc,
txtfile\printto\Command
[A ] 82. c:\windows\system32\notepad.exe
Microsoft Corporation
记事本
.text,.data,.rsrc,
+ HKCR\.cmd
cmdfile\edit\Command
[A ] 82. c:\windows\system32\notepad.exe
Microsoft Corporation
记事本
.text,.data,.rsrc,
cmdfile\print\Command
[A ] 82. c:\windows\system32\notepad.exe
Microsoft Corporation
记事本
.text,.data,.rsrc,
+ HKCR\.reg
regfile\edit\Command
[A ] 82. c:\windows\system32\notepad.exe
Microsoft Corporation
记事本
.text,.data,.rsrc,
regfile\print\Command
[A ] 82. c:\windows\system32\notepad.exe
Microsoft Corporation
记事本
.text,.data,.rsrc,
+ HKCR\.vbs
VBSFile\Edit\Command
[A ] 82. c:\windows\system32\notepad.exe
Microsoft Corporation
记事本
.text,.data,.rsrc,
VBSFile\Print\Command
[A ] 82. c:\windows\system32\notepad.exe
Microsoft Corporation
记事本
.text,.data,.rsrc,
+ HKCR\.js
JSFile\Edit\Command
[A ] 82. c:\windows\system32\notepad.exe
Microsoft Corporation
记事本
.text,.data,.rsrc,
JSFile\Print\Command
[A ] 82. c:\windows\system32\notepad.exe
Microsoft Corporation
记事本
.text,.data,.rsrc,
+ HKCR\.ini
inifile\open\Command
[A ] 82. c:\windows\system32\notepad.exe
Microsoft Corporation
记事本
.text,.data,.rsrc,
inifile\print\Command
[A ] 82. c:\windows\system32\notepad.exe
Microsoft Corporation
记事本
.text,.data,.rsrc,
+ HKCR\.inf
inffile\open\Command
[A ] 82. c:\windows\system32\notepad.exe
Microsoft Corporation
记事本
.text,.data,.rsrc,
inffile\print\Command
[A ] 82. c:\windows\system32\notepad.exe
Microsoft Corporation
记事本
.text,.data,.rsrc,
喋血 - 2007-8-21 12:21:00
+ 打印机监控
+ HKLM\SYSTEM\CurrentControlSet\Control\Print\Monitors
Lenovo Network Port
[AM] 84. c:\windows\system32\lexlmpm.dll
Lexmark International, Inc.
LEXLMPM DLL
.text,.rdata,.data,.rsrc,.reloc,
Microsoft Document Imaging Writer Monitor
[AM] 85. c:\windows\system32\mdimon.dll
Microsoft Corporation
Microsoft? Document Imaging
.text,.data,.rsrc,.reloc,
+ 其他自启动项目
+ C:\WINDOWS\Tasks
查看 Windows Live Toolbar 更新.job
[A ] 86. c:\program files\windows live toolbar\msntbup.exe
Microsoft Corporation
MSN Search Toolbar Scheduled Update Utility
.text,.data,.rsrc,
+ 正在运行的进程
+ 000000b4(180) RfwMain.exe
00400000[00073000]
[AM] 77. c:\program files\rising\rfw\rfwmain.exe
Beijing Rising Technology Co., Ltd.
Rising Personal FireWall Main Program
.text,.rdata,.data,.rsrc,
26600000[0007D000]
[ M] 87. c:\program files\rising\rfw\rsguilib.dll
Beijing Rising Technology Co., Ltd.
Rising GUI Library Loader
.text,.rdata,.data,.rsrc,.reloc,
23700000[0001A000]
[ M] 88. c:\program files\rising\rfw\rscommon.dll
Beijing Rising Technology Co., Ltd.
Rising Common Function Dynamic Link Library
.text,.rdata,.data,.rsrc,.reloc,
10000000[0000F000]
[ M] 89. c:\program files\rising\rfw\rfwctrl.dll
Beijing Rising Technology Co., Ltd.
RfwCtrl DLL
.text,.rdata,.data,.rsrc,.reloc,
23800000[0001A000]
[ M] 90. c:\program files\rising\rfw\rsxml.dll
Beijing Rising Technology Co., Ltd.
RsXML
.text,.rdata,.data,.rsrc,.reloc,
23900000[00031000]
[ M] 91. c:\program files\rising\rfw\pngdll.dll
Beijing Rising Technology Co., Ltd.
Rising .Png File Loader Dynamic Link Library
.text,.rdata,.data,.rsrc,.reloc,
53000000[0000E000]
[ M] 92. c:\program files\3721\helper.dll
国风因特软件（北京）有限公司
helperup
.text,.rdata,.data,.cnshelp,.rsrc,.reloc,
01110000[0001B000]
[ M] 93. c:\program files\rising\antispyware\ieprot.dll
Beijing Rising Technology Co., Ltd.
IE Protector
.text,.rdata,.data,.rsrc,.reloc,
+ 00000114(276) svchost.exe
+ 00000138(312) RUNDLL32.EXE
10000000[00016000]
[ M] 94. c:\windows\system32\nvmctray.dll
NVIDIA Corporation
NVIDIA Media Center Library
.text,.rdata,.data,.shared,.rsrc,.reloc,
009F0000[0001B000]
[ M] 93. c:\program files\rising\antispyware\ieprot.dll
Beijing Rising Technology Co., Ltd.
IE Protector
.text,.rdata,.data,.rsrc,.reloc,
+ 00000140(320) RunDll32.exe
10000000[002C7000]
[ M] 95. c:\windows\system\cmicnfg.cpl
C-Media Corporation
CmiCnfg DLL
.text,.rdata,.data,.Shared,.rsrc,.reloc,
00A90000[00008000]
[ M] 96. c:\windows\system32\udaprop.dll
C-Media Corporation
CMI UDA Property Page
.text,.rdata,.data,.GPIO,.rsrc,.reloc,
72C90000[00009000]
[ M] 97. c:\windows\system32\wdmaud.drv
Microsoft Corporation
WDM Audio driver mapper
.text,.data,.rsrc,.reloc,
72C80000[00008000]
[ M] 98. c:\windows\system32\msacm32.drv
Microsoft Corporation
Microsoft Sound Mapper
.text,.data,.rsrc,.reloc,
00B40000[0001B000]
[ M] 93. c:\program files\rising\antispyware\ieprot.dll
Beijing Rising Technology Co., Ltd.
IE Protector
.text,.rdata,.data,.rsrc,.reloc,
+ 00000148(328) NVATray.exe
00400000[0000C000]
[AM] 70. c:\windows\system32\nvatray.exe
NVIDIA? Corporation
NV Audio Panel Tray Application
.text,.rdata,.data,.rsrc,
10000000[0001B000]
[ M] 93. c:\program files\rising\antispyware\ieprot.dll
Beijing Rising Technology Co., Ltd.
IE Protector
.text,.rdata,.data,.rsrc,.reloc,
+ 00000180(384) realsched.exe
00400000[0002F000]
[AM] 72. c:\program files\common files\real\update_ob\realsched.exe
RealNetworks, Inc.
RealNetworks Scheduler
.text,.rdata,.data,.rsrc,
10000000[0001B000]
[ M] 93. c:\program files\rising\antispyware\ieprot.dll
Beijing Rising Technology Co., Ltd.
IE Protector
.text,.rdata,.data,.rsrc,.reloc,
+ 000001b4(436) runiep.exe
00400000[00013000]
[AM] 74. c:\program files\rising\antispyware\runiep.exe
Beijing Rising Technology Co., Ltd.
Rising AntiSpyware Monitor
.text,.rdata,.data,.rsrc,
00C20000[0001B000]
[ M] 93. c:\program files\rising\antispyware\ieprot.dll
Beijing Rising Technology Co., Ltd.
IE Protector
.text,.rdata,.data,.rsrc,.reloc,
+ 00000204(516) VM303_STI.EXE
00400000[00013000]
[AM] 76. c:\windows\vm303_sti.exe
Vimicro
Vimicro
.text,.rdata,.data,.rsrc,
10000000[00030000]
[ M] 99. c:\windows\system32\vm303prp.ax
Vimicro
DirectShow Extension Page
.text,.rdata,.data,.idata,.CRT,.rsrc,.reloc,
00E10000[0001B000]
[ M] 93. c:\program files\rising\antispyware\ieprot.dll
Beijing Rising Technology Co., Ltd.
IE Protector
.text,.rdata,.data,.rsrc,.reloc,
+ 00000248(584) rundll32.exe
53000000[0000E000]
[ M] 92. c:\program files\3721\helper.dll
国风因特软件（北京）有限公司
helperup
.text,.rdata,.data,.cnshelp,.rsrc,.reloc,
10000000[00021000]
[ M] 100. c:\program files\3721\autolive.dll
国风因特软件（北京）有限公司
autolvup
.text,.rdata,.data,.autoliv,.rsrc,.reloc,
00C10000[00017000]
[ M] 101. c:\program files\3721\notifier.dll
国风因特软件（北京）有限公司
notifup
.rdata,.data,.YahooNT,.rsrc,.reloc,
00F00000[0002D000]
[ M] 102. c:\program files\3721\alliveex.dll
LiveEx
.text,.rdata,.data,.rsrc,.reloc,
00F40000[0001B000]
[ M] 93. c:\program files\rising\antispyware\ieprot.dll
Beijing Rising Technology Co., Ltd.
IE Protector
.text,.rdata,.data,.rsrc,.reloc,
+ 00000250(592) ctfmon.exe
53000000[0000E000]
[ M] 92. c:\program files\3721\helper.dll
国风因特软件（北京）有限公司
helperup
.text,.rdata,.data,.cnshelp,.rsrc,.reloc,
10000000[0001B000]
[ M] 93. c:\program files\rising\antispyware\ieprot.dll
Beijing Rising Technology Co., Ltd.
IE Protector
.text,.rdata,.data,.rsrc,.reloc,
+ 00000264(612) MsnMsgr.Exe
00400000[0056A000]
[AM] 68. c:\program files\msn messenger\msnmsgr.exe
Microsoft Corporation
Messenger
.text,.data,.rsrc,
59100000[000F7000]
[ M] 103. c:\program files\msn messenger\msncore.dll
Microsoft Corporation
Windows Live Client Code Module
.text,.data,.rsrc,.reloc,
27500000[000C8000]
[ M] 104. c:\program files\msn messenger\msidcrl40.dll
Microsoft Corporation
IDCRL Dynamic Link Library
.text,.data,.rsrc,.reloc,
5A700000[00055000]
[ M] 105. c:\program files\msn messenger\contactsux.dll
Microsoft Corporation
Contact UX
.text,.data,.rsrc,.reloc,
53000000[0000E000]
[ M] 92. c:\program files\3721\helper.dll
国风因特软件（北京）有限公司
helperup
.text,.rdata,.data,.cnshelp,.rsrc,.reloc,
59300000[00185000]
[ M] 106. c:\program files\msn messenger\msgslang.8.1.0178.00.dll
Microsoft Corporation
Messenger Language Specific Resources
.rsrc,.reloc,
5B200000[0023E000]
[ M] 107. c:\program files\msn messenger\msgsres.dll
Microsoft Corporation
Messenger Resources
.rsrc,.reloc,
10000000[0001B000]
[ M] 93. c:\program files\rising\antispyware\ieprot.dll
Beijing Rising Technology Co., Ltd.
IE Protector
.text,.rdata,.data,.rsrc,.reloc,
5B500000[000A4000]
[ M] 108. c:\program files\msn messenger\msgswcam.dll
Microsoft Corporation
Messenger WebCam Library
.text,.data,.rsrc,.reloc,
5A600000[00013000]
[ M] 109. c:\windows\system32\sirenacm.dll
Microsoft Corp.
Messenger Audio Codec
.text,.data,.rsrc,.reloc,
侯伟 - 2007-8-21 12:53:00
高手在哪 这个我看不懂啊!~谁来救我~!加我QQ 我发远程你帮我解决好吗?
请帮我电脑解决一下好吗~?求你了!!~我恨死这病毒了~!已经第七次中毒了 我装系统已经6次了~!不是单装一个系统 而是我把所有的盘都要格式化 才行啊`!你看看我的病毒怎么解决好吗?
MSDEG32 MSDWG32 MSDCG32 MSDOG32 MSDMG32 MSDQG32 MSDHG32 VISIN
都是从瑞星卡卡系统启动项管理检测出来 怎么解决啊 我用瑞星正版杀毒软件跟本杀不掉~1重新启动以后又出来了`!难道非要把所有盘格式化了吗?
楼主你救救我吧?~!求你了~~小弟感激不尽 小弟QQ200508006 请楼主加我~ 小弟我不太会这个~~所以还请耐心教我好吗~?!
1
© 2000 - 2026 Rising Corp. Ltd.