Logfile of Kaka v2. 0. 0. 8 Scan Module v2. 0. 0. 1
Scan saved at 12:17:48, on 2006-04-16
Platform: Microsoft Windows XP Professional Service Pack 2 (Build 2600)
MSIE: Internet Explorer v6.00 SP2; (6.00.2900.2180 (xpsp_sp2_rtm.040803-2158))
Running processes:
[SMSS.EXE]
CommandLine =
[csrss.exe]
CommandLine = C:\WINDOWS\system32\csrss.exe
ObjectDirectory=\Windows SharedSection=1024,3072,512 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ProfileControl=Off MaxRequestThreads=16
[winlogon.exe]
CommandLine = winlogon.exe
[services.exe]
CommandLine = C:\WINDOWS\system32\services.exe
[lsass.exe]
CommandLine = C:\WINDOWS\system32\lsass.exe
[svchost.exe]
CommandLine = C:\WINDOWS\system32\svchost -k DcomLaunch
[svchost.exe]
CommandLine = C:\WINDOWS\system32\svchost -k rpcss
[CCenter.exe]
CommandLine = "F:\新建文件夹\Rising\Rav\CCenter.exe"
[svchost.exe]
CommandLine = C:\WINDOWS\System32\svchost.exe -k netsvcs
[RavMonD.exe]
CommandLine = "F:\新建文件夹\Rising\Rav\Ravmond.exe"
[rfwsrv.exe]
CommandLine = f:\新建文件夹\rising\rfw\rfwsrv.exe
[RavStub.exe]
CommandLine = F:\新建文件夹\Rising\Rav\RavStub.exe /RAVMOND
[Explorer.EXE]
CommandLine = C:\WINDOWS\Explorer.EXE
[RfwMain.exe]
CommandLine = -StartUp
[RavTask.exe]
CommandLine = "F:\新建文件夹\RISING\RAV\RAVTASK.EXE" -SYSTEM
[RavMon.exe]
CommandLine = "F:\新建文件夹\Rising\Rav\Ravmon.exe" -SYSTEM
[ctfmon.exe]
CommandLine = "C:\WINDOWS\system32\ctfmon.exe"
[svchost.exe]
CommandLine = C:\WINDOWS\system32\svchost.exe -k LocalService
[spoolsv.exe]
CommandLine = C:\WINDOWS\system32\spoolsv.exe
[BitComet.exe]
CommandLine = "C:\Program Files\BitComet\BitComet.exe"
[QQ.exe]
CommandLine = "D:\新建文件夹 (4)\QQ.exe"
[KkScan.exe]
CommandLine = "C:\Program Files\Rising\KakaToolBar\KkScan.exe"
O2 - BHO: - {A9930D97-9CF0-42A0-A10D-4F28836579D5} - C:\PROGRA~1\KuGoo3\KUGOO3~1.OCX
O3 - Toolbar: 卡卡上网安全助手 - {DB9ECD4F-FB8F-4311-B3CE-90B976C2707C} - C:\WINDOWS\system32\kakatool.dll
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [RfwMain] "F:\新建文件夹\Rising\Rfw\rfwmain.exe" -Startup
O4 - HKLM\..\Run: [RavTask] "F:\新建文件夹\Rising\Rav\RavTask.exe" -system
O4 - HKLM\..\Run: [DAEMON Tools-2052] "D:\新建文件夹 (7)\daemon.exe" -lang 2052
O8 - Extra context menu item: 使用KuGoo3下载(&K) - C:\Program Files\KuGoo3\KuGoo3DownX.htm
O8 - Extra context menu item: 添加到QQ自定义面板 - D:\新建文件夹 (4)\AddPanel.htm
O8 - Extra context menu item: 用QQ彩信发送该图片 - D:\新建文件夹 (4)\SendMMS.htm
O9 - Extra Button: 浩方对战平台 - {0A155D3C-68E2-4215-A47A-E800A446447A} - C:\Program Files\浩方对战平台\GameClient.exe
O14 - IERESET.INF: START_PAGE_URL=http://www.microsoft.com/isapi/redir.dll?prd=ie&pver=6&ar=msnhome
O17 - HKLM\System\CCS\Services\Tcpip\..\{3EAC93A6-DE36-41E9-A087-5189EA1AF8B4}: NameServer = 202.96.209.134 202.96.209.6
O18 - Protocol: ipp - (no CLSID) - (no file)这个有可疑
O18 - Protocol: msdaipp - (no CLSID) - (no file)这个有可疑
O23 - Service: Human Interface Device Access (HidServ) - - C:\WINDOWS\system32\svchost.exe -k netsvcs
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: Rising Proxy Service (RfwProxySrv) - Beijing Rising Technology Co., Ltd. - f:\新建文件夹\rising\rfw\rfwproxy.exe
O23 - Service: Rising Personal Firewall Service (RfwService) - Beijing Rising Technology Co., Ltd. - f:\新建文件夹\rising\rfw\rfwsrv.exe
O23 - Service: Rising Process Communication Center (RsCCenter) - Beijing Rising Technology Co., Ltd. - "F:\新建文件夹\Rising\Rav\CCenter.exe"
O23 - Service: RsRavMon Service (RsRavMon) - Beijing Rising Technology Co., Ltd. - "F:\新建文件夹\Rising\Rav\Ravmond.exe"
O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
