瑞星卡卡电脑诊断日志 v1.20 (2007-7-10 21:5:30)  北京瑞星科技股份有限公司

注释:    [A]表示该文件存在自启动关联;
    [M]表示该文件在内存中;

+ 注册表自运行项目
  + Win32 Services
    + HKLM\System\CurrentControlSet\Services
      C-DillaCdaC11BA
        [AM] 1. c:\windows\system32\drivers\cdac11ba.exe
      ose
        [A ] 2. c:\program files\common files\microsoft shared\source engine\ose.exe
      RfwProxySrv
        [A ] 3. d:\program files\rising\rfw\rfwproxy.exe
      RfwService
        [A ] 4. d:\program files\rising\rfw\rfwsrv.exe
      RsCCenter
        [A ] 5. d:\program files\rising\rav\ccenter.exe
      RsRavMon
        [A ] 6. d:\program files\rising\rav\ravmond.exe
  + Kernel Drivers
    + HKLM\System\CurrentControlSet\Services
      ALCXSENS
        [A ] 7. c:\windows\system32\drivers\alcxsens.sys
      ALCXWDM
        [A ] 8. c:\windows\system32\drivers\alcxwdm.sys
      BaseTDI
        [A ] 9. c:\windows\system32\drivers\basetdi.sys
      CdaC15BA
        [A ] 10. c:\windows\system32\drivers\cdac15ba.sys
      ExpScaner
        [A ] 11. d:\program files\rising\rav\expscan.sys
      HookCont
        [A ] 12. d:\program files\rising\rav\hookcont.sys
      HookReg
        [A ] 13. d:\program files\rising\rav\hookreg.sys
      HookSys
        [A ] 14. d:\program files\rising\rav\hooksys.sys
      HookUrl
        [A ] 15. d:\program files\rising\rfw\hookurl.sys
      ialm
        [A ] 16. c:\windows\system32\drivers\ialmnt5.sys
      MEMSCAN
        [A ] 17. d:\program files\rising\rav\memscan.sys
      mProcRs
        [A ] 18. d:\program files\rising\rfw\mprocrs.sys
      npkcrypt
        [A ] 19. d:\program files\tencent\tm\tmdlls\npkcrypt.sys
      RsAntiSpyware
        [A ] 20. c:\windows\system32\drivers\rsboot.sys
      RsFwDrv
        [A ] 21. d:\program files\rising\rfw\rsfwdrv.sys
      RsNTGDI
        [A ] 22. c:\windows\system32\drivers\rsntgdi.sys
      RSPPSYS
        [A ] 23. d:\program files\rising\rav\rsppsys.sys
      Secdrv
        [A ] 24. c:\windows\system32\drivers\secdrv.sys
  + Winlogon
    + HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify
      igfxcui
        [AM] 25. c:\windows\system32\igfxsrvc.dll
    + HKCU\Control Panel\Desktop
      Scrnsave.exe
        [A ] 26. c:\windows\system32\七彩泡泡.scr
  + Internet Explorer
    + HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar
      {3F1ABCDB-A875-46c1-8345-B72A4567E486}
        [A ] 27. c:\program files\bitcomet\bitcometbar\bitcometbar0.6.dll
      {DB9ECD4F-FB8F-4311-B3CE-90B976C2707C}
        [A ] 28. c:\windows\system32\kakatool.dll
    + HKCU\SOFTWARE\Microsoft\Internet Explorer\URLSearchHooks
      {CFBFAE00-17A6-11D0-99CB-00C04FD64497}
        [AM] 29. c:\windows\system32\ieframe.dll
    + HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects
      {00000AAA-A363-466E-BEF5-9BB68697AA7F}
        [AM] 30. e:\program files\thunder network\webthunder\webthunderbho_now.dll

+ Explorer
    + HKLM\SOFTWARE\Classes\PROTOCOLS\Filter
      text/xml
        [AM] 31. c:\program files\common files\microsoft shared\office11\msoxmlmf.dll
    + HKLM\SOFTWARE\Classes\PROTOCOLS\Handler
      mso-offdap
        [A ] 32. c:\program files\common files\microsoft shared\web components\10\owc10.dll
    + HKLM\SOFTWARE\Microsoft\Active Setup\Installed Components
      <{12d0ed0d-0ee0-4f90-8827-78cefb8f4988}
        [A ] 33. c:\windows\system32\ieudinit.exe
    + HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved
      HyperTerminal Icon Ext
        [A ] 34. c:\windows\system32\hticons.dll
      IE Search Band
        [AM] 29. c:\windows\system32\ieframe.dll
      Shell DocObject Viewer
        [AM] 29. c:\windows\system32\ieframe.dll
      InternetShortcut
        [AM] 29. c:\windows\system32\ieframe.dll
      Microsoft Url History Service
        [AM] 29. c:\windows\system32\ieframe.dll
      History
        [AM] 29. c:\windows\system32\ieframe.dll
      Temporary Internet Files
        [AM] 29. c:\windows\system32\ieframe.dll
      Temporary Internet Files
        [AM] 29. c:\windows\system32\ieframe.dll
      Microsoft Url Search Hook
        [AM] 29. c:\windows\system32\ieframe.dll
      The Internet
        [AM] 29. c:\windows\system32\ieframe.dll
      Internet Name Space
        [AM] 29. c:\windows\system32\ieframe.dll
      WinRAR shell extension
        [AM] 35. c:\program files\winrar\rarext.dll
      PicaView
        [A ] 36. c:\program files\acdsee\picaview.dll
      IE Microsoft BrowserBand
        [AM] 29. c:\windows\system32\ieframe.dll
      IE Fade Task
        [AM] 29. c:\windows\system32\ieframe.dll
      IE Menu Desk Bar
        [AM] 29. c:\windows\system32\ieframe.dll
      IE AutoComplete
        [AM] 29. c:\windows\system32\ieframe.dll
      IE Navigation Bar
        [AM] 29. c:\windows\system32\ieframe.dll
      IE Menu Site
        [AM] 29. c:\windows\system32\ieframe.dll
      IE Menu Band
        [AM] 29. c:\windows\system32\ieframe.dll
      IE Microsoft History AutoComplete List
        [AM] 29. c:\windows\system32\ieframe.dll
      IE Tracking Shell Menu
        [AM] 29. c:\windows\system32\ieframe.dll
      IE IShellFolderBand
        [AM] 29. c:\windows\system32\ieframe.dll
      IE BandProxy
        [AM] 29. c:\windows\system32\ieframe.dll
      IE MRU AutoComplete List
        [AM] 29. c:\windows\system32\ieframe.dll
      IE RSS Feeder Folder
        [AM] 29. c:\windows\system32\ieframe.dll
      IE Microsoft Shell Folder AutoComplete List
        [AM] 29. c:\windows\system32\ieframe.dll
      IE Microsoft Multiple AutoComplete List Container
        [AM] 29. c:\windows\system32\ieframe.dll
      Microsoft Browser Architecture
        [AM] 29. c:\windows\system32\ieframe.dll
      IE Shell Rebar BandSite
        [AM] 29. c:\windows\system32\ieframe.dll
      IE Shell Band Site Menu
        [AM] 29. c:\windows\system32\ieframe.dll
      &Links
        [AM] 29. c:\windows\system32\ieframe.dll
      IE Registry Tree Options Utility
        [AM] 29. c:\windows\system32\ieframe.dll
      IE User Assist
        [AM] 29. c:\windows\system32\ieframe.dll
      IE Custom MRU AutoCompleted List
        [AM] 29. c:\windows\system32\ieframe.dll
      Microsoft Office HTML Icon Handler
        [AM] 37. c:\program files\microsoft office\office11\msohev.dll
      Web Folders
        [A ] 38. c:\program files\common files\microsoft shared\web folders\msonsext.dll
      RISING
        [AM] 39. c:\windows\system32\ravext.dll
      AutoCAD 数字签名图标覆盖处理程序

[AM] 40. c:\windows\system32\acsignicon.dll
      Autodesk Drawing Preview
        [A ] 41. c:\program files\common files\autodesk shared\thumbnail\acthumbnail16.dll
    + HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks
      {32CD708B-60A7-4C00-9377-D73EAA495F0F}
        [AM] 39. c:\windows\system32\ravext.dll
      {AC2DC2EF-5165-40A3-8CDF-41DCA1B0901A}
        [AM] 42. c:\windows\system32\shlhook.dll
  + Logon
    + HKCU\Software\Microsoft\Windows\CurrentVersion\Run
      bgswitch
        [A ] 43. c:\windows\system32\bgswitch.exe
    + HKLM\Software\Microsoft\Windows\CurrentVersion\Run
      IgfxTray
        [AM] 44. c:\windows\system32\igfxtray.exe
      HotKeysCmds
        [A ] 45. c:\windows\system32\hkcmd.exe
      SoundMan
        [AM] 46. c:\windows\soundman.exe
      RavTask
        [A ] 47. d:\program files\rising\rav\ravtask.exe
      RfwMain
        [AM] 48. d:\program files\rising\rfw\rfwmain.exe
      runeip
        [AM] 49. d:\program files\rising\antispyware\runiep.exe
    + HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce
      RavStub
        [AM] 50. d:\program files\rising\rav\ravstub.exe
  + Boot Execute
    + HKLM\SYSTEM\CurrentControlSet\Control\NetworkProvider\Order
      BootExecute
        [A ] 51. c:\windows\system32\bsmain.exe
  + Image Hijacks
    + HKCR\.exe
      exefile\启用/禁用数字签名图标\Command
        [A ] 52. c:\windows\system32\acsignopt.exe
    + HKCR\.html
      htmlfile\Edit\Command
        [A ] 53. c:\program files\microsoft office\office11\msohtmed.exe
      htmlfile\Print\Command
        [A ] 53. c:\program files\microsoft office\office11\msohtmed.exe
    + HKCR\.htm
      htmlfile\Edit\Command
        [A ] 53. c:\program files\microsoft office\office11\msohtmed.exe
      htmlfile\Print\Command
        [A ] 53. c:\program files\microsoft office\office11\msohtmed.exe
+ 其他自启动项目
  + C:\Documents and Settings\Administrator\「开始」菜单\程序\启动
    QQ游戏启动加速程序.lnk
      [A ] 54. e:\program files\tencent\qqgame\accel.exe
+ 系统活动模块
  + 0000009c(156) RfwMain.exe
    00400000[00073000]
      [AM] 48. d:\program files\rising\rfw\rfwmain.exe
    26600000[0007D000]
      [ M] 55. d:\program files\rising\rfw\rsguilib.dll
    23700000[0001A000]
      [ M] 56. d:\program files\rising\rfw\rscommon.dll
    10000000[0000F000]
      [ M] 57. d:\program files\rising\rfw\rfwctrl.dll
    23800000[0001A000]
      [ M] 58. d:\program files\rising\rfw\rsxml.dll
    23900000[00031000]
      [ M] 59. d:\program files\rising\rfw\pngdll.dll
    01150000[0001B000]
      [ M] 60. d:\program files\rising\antispyware\ieprot.dll
  + 000000b8(184) CDAC11BA.EXE
    00400000[00012000]
      [AM] 1. c:\windows\system32\drivers\cdac11ba.exe
  + 000001ac(428) smss.exe
  + 000001e8(488) csrss.exe
  + 00000200(512) winlogon.exe
    72C80000[00008000]
      [ M] 61. c:\windows\system32\msacm32.drv
  + 0000022c(556) services.exe
  + 00000238(568) lsass.exe
  + 00000274(628) Ras.exe
    00400000[0013D000]
      [ M] 62. d:\program files\rising\antispyware\ras.exe
    00370000[00009000]
      [ M] 63. c:\windows\system32\normaliz.dll
    41D50000[00045000]
      [ M] 64. c:\windows\system32\iertutil.dll
    10000000[000A0000]
      [ M] 65. d:\program files\rising\antispyware\rasgui.dll
    017C0000[0001B000]
      [ M] 60. d:\program files\rising\antispyware\ieprot.dll
    422B0000[005CB000]

[AM] 29. c:\windows\system32\ieframe.dll
  + 000002d0(720) svchost.exe
  + 000002fc(764) svchost.exe
  + 00000370(880) svchost.exe
    00F30000[00009000]
      [ M] 63. c:\windows\system32\normaliz.dll
    41D50000[00045000]
      [ M] 64. c:\windows\system32\iertutil.dll
    50E60000[0000C000]
      [ M] 66. c:\windows\system32\wups2.dll
  + 000003d0(976) svchost.exe
  + 00000418(1048) svchost.exe
    00800000[00009000]
      [ M] 63. c:\windows\system32\normaliz.dll
    41D50000[00045000]
      [ M] 64. c:\windows\system32\iertutil.dll
  + 00000518(1304) Explorer.EXE
    00400000[00009000]
      [ M] 63. c:\windows\system32\normaliz.dll
    41D50000[00045000]
      [ M] 64. c:\windows\system32\iertutil.dll
    62830000[00026000]
      [AM] 40. c:\windows\system32\acsignicon.dll
    10000000[0001B000]
      [AM] 39. c:\windows\system32\ravext.dll
    00EA0000[00011000]
      [AM] 42. c:\windows\system32\shlhook.dll
    422B0000[005CB000]
      [AM] 29. c:\windows\system32\ieframe.dll
    628E0000[00039000]
      [ M] 67. c:\program files\common files\autodesk shared\acsigncore16.dll
    01700000[0001B000]
      [ M] 60. d:\program files\rising\antispyware\ieprot.dll
    72C80000[00008000]
      [ M] 61. c:\windows\system32\msacm32.drv
    02220000[0003C000]
      [ M] 68. c:\windows\system32\igfxpph.dll
    016E0000[0001E000]
      [ M] 69. c:\windows\system32\hccutils.dll
    02260000[00024000]
      [ M] 70. c:\windows\system32\igfxres.dll
    02290000[00058000]
      [AM] 25. c:\windows\system32\igfxsrvc.dll
    022F0000[00024000]
      [ M] 71. c:\windows\system32\igfxdev.dll
    01660000[0002C000]
      [AM] 35. c:\program files\winrar\rarext.dll
    23700000[0001A000]
      [ M] 72. d:\program files\rising\rav\rscommon.dll
  + 00000604(1540) spoolsv.exe
  + 000006a8(1704) RavStub.exe
    00400000[00018000]
      [AM] 50. d:\program files\rising\rav\ravstub.exe
    10000000[0001B000]
      [ M] 73. d:\program files\rising\rav\rscommx.dll
    23700000[0001A000]
      [ M] 72. d:\program files\rising\rav\rscommon.dll
  + 0000074c(1868) igfxtray.exe
    00400000[0002B000]
      [AM] 44. c:\windows\system32\igfxtray.exe
    10000000[0001E000]
      [ M] 69. c:\windows\system32\hccutils.dll
    00A90000[00024000]
      [ M] 71. c:\windows\system32\igfxdev.dll
    00BB0000[0001B000]
      [ M] 60. d:\program files\rising\antispyware\ieprot.dll
    00CE0000[00058000]
      [AM] 25. c:\windows\system32\igfxsrvc.dll
    00D60000[00024000]
      [ M] 70. c:\windows\system32\igfxres.dll
    00DA0000[00131000]
      [ M] 74. c:\windows\system32\igfxress.dll
    00EF0000[0003C000]
      [ M] 68. c:\windows\system32\igfxpph.dll
    00F40000[00015000]
      [ M] 75. c:\windows\system32\igfxdo.dll
  + 0000075c(1884) SOUNDMAN.EXE
    00400000[00014000]
      [AM] 46. c:\windows\soundman.exe
    10000000[0001B000]
      [ M] 60. d:\program files\rising\antispyware\ieprot.dll
  + 00000784(1924) runiep.exe
    00400000[00012000]
      [AM] 49. d:\program files\rising\antispyware\runiep.exe
    00C00000[0001B000]
      [ M] 60. d:\program files\rising\antispyware\ieprot.dll
  + 000007e0(2016) ctfmon.exe
    10000000[0001B000]
      [ M] 60. d:\program files\rising\antispyware\ieprot.dll
  + 00000830(2096) alg.exe
  + 0000091c(2332) IEXPLORE.EXE
    41D50000[00045000]
      [ M] 64. c:\windows\system32\iertutil.dll
    422B0000[005CB000]
      [AM] 29. c:\windows\system32\ieframe.dll
    5DFF0000[0002F000]
      [ M] 76. c:\windows\system32\ieui.dll
    47060000[00021000]
      [ M] 77. c:\windows\system32\xmllite.dll
    62830000[00026000]
      [AM] 40. c:\windows\system32\acsignicon.dll
    325C0000[00012000]
      [AM] 37. c:\program files\microsoft office\office11\msohev.dll
    61930000[0004A000]
      [ M] 78. c:\program files\internet explorer\ieproxy.dll
    10000000[0001B000]
      [ M] 60. d:\program files\rising\antispyware\ieprot.dll
    01AB0000[00009000]
      [ M] 63. c:\windows\system32\normaliz.dll
    020B0000[00019000]
      [AM] 30. e:\program files\thunder network\webthunder\webthunderbho_now.dll
    43560000[00060000]
      [ M] 79. c:\windows\system32\ieapfltr.dll
    30000000[002EE000]
      [ M] 80. c:\windows\system32\macromed\flash\flash9b.ocx
    72C80000[00008000]
      [ M] 61. c:\windows\system32\msacm32.drv
    053C0000[0000B000]
      [AM] 31. c:\program files\common files\microsoft shared\office11\msoxmlmf.dll
  + 00000980(2432) QQ.exe
    00400000[001B4000]
      [ M] 81. d:\program files\tencent\qq\qq.exe
    10000000[0025A000]
      [ M] 82. d:\program files\tencent\qq\qqbaseclassindll.dll
    005C0000[0009F000]
      [ M] 83. d:\program files\tencent\qq\qqhelperdll.dll
    00380000[00071000]
      [ M] 84. d:\program files\tencent\qq\basicctrldll.dll
    60A80000[000F2000]
      [ M] 85. d:\program files\tencent\qq\mfc42.dll

00660000[00009000]
      [ M] 63. c:\windows\system32\normaliz.dll
    41D50000[00045000]
      [ M] 64. c:\windows\system32\iertutil.dll
    621E0000[00005000]
      [ M] 86. d:\program files\tencent\qq\riched32.dll
    62170000[00068000]
      [ M] 87. d:\program files\tencent\qq\riched20.dll
    61310000[0003A000]
      [ M] 88. d:\program files\tencent\qq\qqapi.dll
    62330000[00007000]
      [ M] 89. d:\program files\tencent\qq\timproxy.dll
    01450000[0001B000]
      [ M] 60. d:\program files\rising\antispyware\ieprot.dll
    014A0000[00038000]
      [ M] 90. d:\program files\tencent\qq\loginctrl.dll
    608D0000[00099000]
      [ M] 91. d:\program files\tencent\qq\loginctrlres.dll
    01D20000[004A9000]
      [ M] 92. d:\program files\tencent\qq\qqres.dll
    60A40000[00032000]
      [ M] 93. d:\program files\tencent\qq\mailsummary.dll
    61800000[00095000]
      [ M] 94. d:\program files\tencent\qq\qqmainframe.dll
    603C0000[001A3000]
      [ M] 95. d:\program files\tencent\qq\gdiplus.dll
    60200000[00124000]
      [ M] 96. d:\program files\tencent\qq\cqqapplication.dll
    60380000[0003E000]
      [ M] 97. d:\program files\tencent\qq\flashavatardll.dll
    60C20000[0005E000]
      [ M] 98. d:\program files\tencent\qq\newskin.dll
    02D90000[000BD000]
      [ M] 99. d:\program files\tencent\qq\hostingmgr.dll
    60140000[00034000]
      [ M] 100. d:\program files\tencent\qq\cameradll.dll
    617B0000[00017000]
      [ M] 101. d:\program files\tencent\qq\qqknowledgesearch.dll
    03100000[001F1000]
      [ M] 102. d:\program files\tencent\qq\qqallinone.dll
    62210000[0002B000]
      [ M] 103. d:\program files\tencent\qq\sccore.dll
    62020000[00022000]
      [ M] 104. d:\program files\tencent\qq\qqspace.dll
    62380000[00071000]
      [ M] 105. d:\program files\tencent\qq\vbscript.dll
    61690000[00071000]
      [ M] 106. d:\program files\tencent\qq\qqgroupmng.dll
    61600000[00034000]
      [ M] 107. d:\program files\tencent\qq\qqcustomface.dll
    62360000[00017000]
      [ M] 108. d:\program files\tencent\qq\userdefinedhead.dll
    619D0000[000D9000]
      [ M] 109. d:\program files\tencent\qq\qqplugin.dll
    72C80000[00008000]
      [ M] 61. c:\windows\system32\msacm32.drv
    72C60000[00007000]
      [ M] 110. c:\windows\system32\msadp32.acm
    02340000[0002A000]
      [ M] 111. d:\program files\tencent\qq\qqpet.dll
    61350000[0003D000]
      [ M] 112. d:\program files\tencent\qq\qqavatar.dll
    30000000[002EE000]
      [ M] 80. c:\windows\system32\macromed\flash\flash9b.ocx
    62150000[00016000]
      [ M] 113. d:\program files\tencent\qq\qringmng.dll
    60770000[0001A000]
      [ M] 114. d:\program files\tencent\qq\imageole.dll
    617D0000[00015000]
      [ M] 115. d:\program files\tencent\qq\qqliveqmng.dll
    617F0000[0000E000]
      [ M] 116. d:\program files\tencent\qq\qqmagicface.dll
    61F60000[0002C000]
      [ M] 117. d:\program files\tencent\qq\qqscenemng.dll
    422B0000[005CB000]
      [AM] 29. c:\windows\system32\ieframe.dll
    615F0000[0000C000]
      [ M] 118. d:\program files\tencent\qq\qqconfigplugin.dll
    60970000[000A8000]
      [ M] 119. d:\program files\tencent\qq\longconnection.dll
    60D20000[00026000]
      [ M] 120. d:\program files\tencent\qq\phoneapi.dll
    60330000[0000D000]
      [ M] 121. d:\program files\tencent\qq\dialerallinone.dll
    60120000[0001F000]
      [ M] 122. d:\program files\tencent\qq\bqqapplication.dll
    60180000[0004F000]
      [ M] 123. d:\program files\tencent\qq\commercesmng.dll
    60CA0000[0000F000]
      [ M] 124. d:\program files\tencent\qq\personaldesktop.dll
    0B520000[00286000]
      [ M] 125. d:\program files\tencent\qq\qqaddr.dll
    0B7C0000[0002E000]
      [ M] 126. d:\program files\tencent\qq\qqplayerproxy.dll
    01320000[0002A000]
      [ M] 127. d:\program files\tencent\qq\addrsearch.dll
    62050000[0003D000]
      [ M] 128. d:\program files\tencent\qq\qqsysmsgmng.dll
  + 0000099c(2460) TIMPlatform.exe
    00400000[00013000]
      [ M] 129. d:\program files\tencent\qq\timplatform.exe
    10000000[0001B000]
      [ M] 60. d:\program files\rising\antispyware\ieprot.dll
    62330000[00007000]
      [ M] 89. d:\program files\tencent\qq\timproxy.dll
  + 00000d4c(3404) QQPlayerSvr.exe
    00400000[00027000]
      [ M] 130. d:\program files\tencent\qq\qqplayersvr.exe
    00370000[00009000]
      [ M] 63. c:\windows\system32\normaliz.dll
    41D50000[00045000]
      [ M] 64. c:\windows\system32\iertutil.dll
    60A80000[000F2000]
      [ M] 85. d:\program files\tencent\qq\mfc42.dll
    10000000[0001B000]
      [ M] 60. d:\program files\rising\antispyware\ieprot.dll
    01590000[0003D000]
      [ M] 131. d:\program files\tencent\qq\vqqplayer.ocx
    01A00000[0008C000]
      [ M] 132. d:\program files\tencent\qq\vqqsdl.dll
    01B90000[000C3000]
      [ M] 133. d:\program files\tencent\qq\tnproxy.dll
  + 00000e0c(3596) IMEPADSV.EXE
    10000000[0001B000]
      [ M] 60. d:\program files\rising\antispyware\ieprot.dll