瑞星卡卡电脑诊断日志 v1.30 (2007-9-2 23:35:51) 北京瑞星科技股份有限公司
注释: [A]表示该文件存在自启动关联;
[M]表示该文件在内存中;
+ 注册表自运行项目
+ 系统服务
+ HKLM\System\CurrentControlSet\Services
NVSvc
[AM] 1. c:\windows\system32\nvsvc32.exe
ose
[AM] 2. c:\program files\common files\microsoft shared\source engine\ose.exe
RsCCenter
[A ] 3. c:\program files\rising\rav\ccenter.exe
RsRavMon
[A ] 4. c:\program files\rising\rav\ravmond.exe
UMWdf
[A ] 5. c:\windows\system32\wdfmgr.exe
+ 内核驱动
+ HKLM\System\CurrentControlSet\Services
A320RAID
[A ] 6. c:\windows\system32\drivers\a320raid.sys
ADPU320
[A ] 7. c:\windows\system32\drivers\adpu320.sys
ahci8086
[A ] 8. c:\windows\system32\drivers\ahci8086.sys
ALCXWDM
[A ] 9. c:\windows\system32\drivers\alcxwdm.sys
AmdK8
[A ] 10. c:\windows\system32\drivers\amdk8.sys
BaseTDI
[A ] 11. c:\windows\system32\drivers\basetdi.sys
CSB6IDE
[A ] 12. c:\windows\system32\drivers\csb6ide.sys
EagleNT
[A ] 13. c:\windows\system32\drivers\eaglent.sys
ExpScaner
[A ] 14. c:\program files\rising\rav\expscan.sys
FASTTRAK
[A ] 15. c:\windows\system32\drivers\fasttrak.sys
FETNDISB
[A ] 16. c:\windows\system32\drivers\fetnd5b.sys
FTSATA2
[A ] 17. c:\windows\system32\drivers\ftsata2.sys
HookCont
[A ] 18. c:\program files\rising\rav\hookcont.sys
HookReg
[A ] 19. c:\program files\rising\rav\hookreg.sys
HookSys
[A ] 20. c:\program files\rising\rav\hooksys.sys
IASTOR
[A ] 21. c:\windows\system32\drivers\iastor.sys
ITERAID
[A ] 22. c:\windows\system32\drivers\iteraid.sys
JRAID
[A ] 23. c:\windows\system32\drivers\jraid.sys
M5228
[A ] 24. c:\windows\system32\drivers\m5228.sys
M5281
[A ] 25. c:\windows\system32\drivers\m5281.sys
M5289
[A ] 26. c:\windows\system32\drivers\m5289.sys
MEMSCAN
[A ] 27. c:\program files\rising\rav\memscan.sys
npkcrypt
[A ] 28. c:\program files\tencent\qq\npkcrypt.sys
NVATABUS
[A ] 29. c:\windows\system32\drivers\nvatabus.sys
NVENETFD
[A ] 30. c:\windows\system32\drivers\nvenetfd.sys
nvnetbus
[A ] 31. c:\windows\system32\drivers\nvnetbus.sys
NVRAID
[A ] 32. c:\windows\system32\drivers\nvraid.sys
RsAntiSpyware
[A ] 33. c:\windows\system32\drivers\rsboot.sys
RsNTGDI
[A ] 34. c:\windows\system32\drivers\rsntgdi.sys
RSPPSYS
[A ] 35. c:\program files\rising\rav\rsppsys.sys
Secdrv
[A ] 36. c:\windows\system32\drivers\secdrv.sys
SI3112R
[A ] 37. c:\windows\system32\drivers\si3112r.sys
SI3114R
[A ] 38. c:\windows\system32\drivers\si3114r.sys
SI3114R5
[A ] 39. c:\windows\system32\drivers\si3114r5.sys
SI3124
[A ] 40. c:\windows\system32\drivers\si3124.sys
SI3124R
[A ] 41. c:\windows\system32\drivers\si3124r.sys
SI3124R5
[A ] 42. c:\windows\system32\drivers\si3124r5.sys
SI3132
[A ] 43. c:\windows\system32\drivers\si3132.sys
SI3132R5
[A ] 44. c:\windows\system32\drivers\si3132r5.sys
SISRAID2
[A ] 45. c:\windows\system32\drivers\sisraid2.sys
SISRAID4
[A ] 46. c:\windows\system32\drivers\sisraid4.sys
SYMMPI
[A ] 47. c:\windows\system32\drivers\symmpi.sys
ULSATA
[A ] 48. c:\windows\system32\drivers\ulsata.sys
ULSATA2
[A ] 49. c:\windows\system32\drivers\ulsata2.sys
VIAMRAID
[A ] 50. c:\windows\system32\drivers\viamraid.sys
vmscsi
[A ] 51. c:\windows\system32\drivers\vmscsi.sys
+ IE浏览器加载模块
+ HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper
Objects
{889D2FEB-5411-4565-8998-1DD2C5261283}
[AM] 52. c:\program files\thunder network\thunder\comdlls\xunleibho_002.dll
+ HKLM\SOFTWARE\Microsoft\Internet Explorer\Extensions
Exec
[A ] 53. c:\program files\thunder network\thunder\thunder.exe
+ 资源管理器加载模块
+ HKLM\SOFTWARE\Classes\PROTOCOLS\Filter
text/xml
[A ] 54. c:\program files\common files\microsoft shared\office11\msoxmlmf.dll
+ HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved
HyperTerminal Icon Ext
[A ] 55. c:\windows\system32\hticons.dll
Portable Media Devices
[A ] 56. c:\windows\system32\audiodev.dll
Portable Media Devices Menu
[A ] 56. c:\windows\system32\audiodev.dll
WinRAR shell extension
[A ] 57. c:\program files\winrar\rarext.dll
Microsoft Office HTML Icon Handler
[A ] 58. c:\program files\microsoft office\office11\msohev.dll
Web Folders
[A ] 59. c:\program files\common files\microsoft shared\web folders\msonsext.dll
Shell Extensions for RealOne Player
[A ] 60. c:\program files\real\realplayer\rpshell.dll
NvCpl DesktopContext Class
[AM] 61. c:\windows\system32\nvcpl.dll
Play on my TV helper
[AM] 61. c:\windows\system32\nvcpl.dll
RISING
[AM] 62. c:\windows\system32\ravext.dll
+ HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks
{32CD708B-60A7-4C00-9377-D73EAA495F0F}
[AM] 62. c:\windows\system32\ravext.dll
{AC2DC2EF-5165-40A3-8CDF-41DCA1B0901A}
[AM] 63. c:\windows\system32\shlhook.dll
+ 用户登陆自运行项目
+ HKLM\Software\Microsoft\Windows\CurrentVersion\Run
SoundMan
[AM] 64. c:\windows\soundman.exe
TkBellExe
[AM] 65. c:\program files\common files\real\update_ob\realsched.exe
runeip
[AM] 66. c:\program files\rising\antispyware\runiep.exe
RavTask
[A ] 67. c:\program files\rising\rav\ravtask.exe
+ 开机执行
+ HKLM\SYSTEM\CurrentControlSet\Control\NetworkProvider\Order
BootExecute
[A ] 68. c:\windows\system32\bsmain.exe
+ 映像劫持
+ HKCR\.html
htmlfile\Edit\Command
[A ] 69. c:\program files\microsoft office\office11\msohtmed.exe
htmlfile\Print\Command
[A ] 69. c:\program files\microsoft office\office11\msohtmed.exe
+ HKCR\.htm
htmlfile\Edit\Command
[A ] 69. c:\program files\microsoft office\office11\msohtmed.exe
htmlfile\Print\Command
[A ] 69. c:\program files\microsoft office\office11\msohtmed.exe
+ HKCR\.mp3
RealPlayer.MP3.6\open\Command
[A ] 70. c:\program files\real\realplayer\realplay.exe
+ 正在运行的进程
+ 000001bc(444) alg.exe
+ 00000248(584) smss.exe
+ 00000294(660) csrss.exe
+ 000002ac(684) winlogon.exe
72C80000[00008000]
[ M] 71. c:\windows\system32\msacm32.drv
+ 000002d8(728) services.exe
+ 000002e4(740) lsass.exe
+ 00000380(896) svchost.exe
+ 000003b8(952) svchost.exe
+ 00000428(1064) svchost.exe
+ 00000460(1120) svchost.exe
+ 000004b4(1204) nvsvc32.exe
00400000[00027000]
[AM] 1. c:\windows\system32\nvsvc32.exe
+ 000004d4(1236) svchost.exe
+ 00000528(1320) Ras.exe
00400000[0013F000]
[ M] 72. c:\program files\rising\antispyware\ras.exe
10000000[000A3000]
[ M] 73. c:\program files\rising\antispyware\rasgui.dll
015E0000[0001B000]
[ M] 74. c:\program files\rising\antispyware\ieprot.dll
+ 000005e0(1504) Explorer.EXE
01560000[0001B000]
[ M] 74. c:\program files\rising\antispyware\ieprot.dll
72C80000[00008000]
[ M] 71. c:\windows\system32\msacm32.drv
10000000[00748000]
[AM] 61. c:\windows\system32\nvcpl.dll
00DF0000[00036000]
[ M] 75. c:\windows\system32\nvrszhc.dll
013B0000[0000C000]
[AM] 52. c:\program files\thunder network\thunder\comdlls\xunleibho_002.dll
+ 00000620(1568) spoolsv.exe
+ 00000674(1652) DfrgFat.exe
10000000[0001B000]
[ M] 74. c:\program files\rising\antispyware\ieprot.dll
+ 00000718(1816) SOUNDMAN.EXE
00400000[0008F000]
[AM] 64. c:\windows\soundman.exe
10000000[0001B000]
[ M] 74. c:\program files\rising\antispyware\ieprot.dll
+ 0000072c(1836) realsched.exe
00400000[0002F000]
[AM] 65. c:\program files\common files\real\update_ob\realsched.exe
10000000[0001B000]
[ M] 74. c:\program files\rising\antispyware\ieprot.dll
+ 00000734(1844) runiep.exe
00400000[00013000]
[AM] 66. c:\program files\rising\antispyware\runiep.exe
00C00000[0001B000]
[ M] 74. c:\program files\rising\antispyware\ieprot.dll
+ 000007a0(1952) ctfmon.exe
10000000[0001B000]
[ M] 74. c:\program files\rising\antispyware\ieprot.dll
+ 00000a7c(2684) OSE.EXE
30000000[00017000]
[AM] 2. c:\program files\common files\microsoft shared\source engine\ose.exe
+ 00000cb0(3248) Thunder5.exe
00400000[00209000]
[ M] 76. c:\program files\thunder network\thunder\program\thunder5.exe
10000000[00006000]
[ M] 77. c:\program files\thunder network\thunder\program\updatedownload.dll
00380000[00031000]
[ M] 78. c:\program files\thunder network\thunder\program\msgmanage.dll
00610000[000CB000]
[ M] 79. c:\program files\thunder network\thunder\program\stlport_vc646.dll
006E0000[00041000]
[ M] 80. c:\program files\thunder network\thunder\program\log4cplus.dll
003C0000[00009000]
[ M] 81. c:\program files\thunder network\thunder\program\historyinfo_manage.dll
014E0000[00282000]
[ M] 82. c:\program files\thunder network\thunder\program\download_interface.dll
01770000[00031000]
[ M] 83. c:\program files\thunder network\thunder\program\asyn_dns.dll
017C0000[00051000]
[ M] 84. c:\program files\thunder network\thunder\program\registerdll.dll
02040000[0000F000]
[ M] 85. c:\program files\thunder network\thunder\program\floatbar.dll
022B0000[0001B000]
[AM] 62. c:\windows\system32\ravext.dll
02F80000[00011000]
[AM] 63. c:\windows\system32\shlhook.dll
02FF0000[0001B000]
[ M] 74. c:\program files\rising\antispyware\ieprot.dll
[用户系统信息]Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)
