星卡卡电脑诊断日志 v1.30 (2007-10-7 0:56:11) 北京瑞星科技股份有限公司
注释: [A]表示该文件存在自启动关联;
[M]表示该文件在内存中;
+ 注册表自运行项目
+ 系统服务
+ HKLM\System\CurrentControlSet\Services
NVSvc
[AM] 1. c:\windows\system32\nvsvc32.exe
RsCCenter
[A ] 2. e:\瑞星杀毒\rising\rav\ccenter.exe
RsRavMon
[A ] 3. e:\瑞星杀毒\rising\rav\ravmond.exe
UMWdf
[AM] 4. c:\windows\system32\wdfmgr.exe
+ 内核驱动
+ HKLM\System\CurrentControlSet\Services
BaseTDI
[A ] 5. c:\windows\system32\drivers\basetdi.sys
ExpScaner
[A ] 6. e:\瑞星杀毒\rising\rav\expscan.sys
GMSIPCI
[A ] 7. g:\install\gmsipci.sys
HDAudBus
[A ] 8. c:\windows\system32\drivers\hdaudbus.sys
HookCont
[A ] 9. e:\瑞星杀毒\rising\rav\hookcont.sys
HookReg
[A ] 10. e:\瑞星杀毒\rising\rav\hookreg.sys
HookSys
[A ] 11. e:\瑞星杀毒\rising\rav\hooksys.sys
HookUrl
[A ] 12. e:\瑞星杀毒\rising\rfw\hookurl.sys
IntcAzAudAddService
[A ] 13. c:\windows\system32\drivers\rtkhdaud.sys
MEMSCAN
[A ] 14. e:\瑞星杀毒\rising\rav\memscan.sys
mProcRs
[A ] 15. e:\瑞星杀毒\rising\rfw\mprocrs.sys
npkcrypt
[A ] 16. c:\program files\tencent\qq\npkcrypt.sys
RsAntiSpyware
[A ] 17. c:\windows\system32\drivers\rsboot.sys
RsFwDrv
[A ] 18. e:\瑞星杀毒\rising\rfw\rsfwdrv.sys
RsNTGDI
[A ] 19. c:\windows\system32\drivers\rsntgdi.sys
RSPPSYS
[A ] 20. e:\瑞星杀毒\rising\rav\rsppsys.sys
RTL8023xp
[A ] 21. c:\windows\system32\drivers\rtnicxp.sys
Secdrv
[A ] 22. c:\windows\system32\drivers\secdrv.sys
+ 文件系统驱动
+ HKLM\System\CurrentControlSet\Services
BdGuard
[A ] 23. c:\windows\system32\drivers\bdguard.sys
+ IE浏览器加载模块
+ HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar
{DB9ECD4F-FB8F-4311-B3CE-90B976C2707C}
[A ] 24. c:\windows\system32\kakatool.dll
+ HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper
Objects
{77FEF28D-EB96-44FF-B511-3185DEA48697}
[A ] 25. c:\program files\thunder network\thunder\comdlls\xunleibho_007.dll
+ HKLM\SOFTWARE\Microsoft\Internet Explorer\Extensions
Exec
[A ] 26. c:\program files\thunder network\thunder\thunder.exe
Exec
[A ] 27. c:\herosoft\herov8\sthsdvd.exe
Exec
[A ] 28. c:\program files\tencent\qq\qq.exe
Exec
[A ] 29. c:\program files\messenger\msmsgs.exe
+ 资源管理器加载模块
+ HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved
HyperTerminal Icon Ext
[A ] 30. c:\windows\system32\hticons.dll
NvCpl DesktopContext Class
[AM] 31. c:\windows\system32\nvcpl.dll
Play on my TV helper
[AM] 31. c:\windows\system32\nvcpl.dll
Desktop Explorer
[AM] 32. c:\windows\system32\nvshell.dll
Desktop Explorer Menu
[AM] 32. c:\windows\system32\nvshell.dll
nView Desktop Context Menu
[AM] 32. c:\windows\system32\nvshell.dll
WinRAR shell extension
[A ] 33. c:\program files\winrar\rarext.dll
Shell Extensions for RealOne Player
[A ] 34. c:\program files\real\realplayer\rpshell.dll
Portable Media Devices
[A ] 35. c:\windows\system32\audiodev.dll
Portable Media Devices Menu
[A ] 35. c:\windows\system32\audiodev.dll
RISING
[AM] 36. c:\windows\system32\ravext.dll
+ HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks
{32CD708B-60A7-4C00-9377-D73EAA495F0F}
[AM] 36. c:\windows\system32\ravext.dll
{AC2DC2EF-5165-40A3-8CDF-41DCA1B0901A}
[AM] 37. c:\windows\system32\shlhook.dll
+ 用户登陆自运行项目
+ HKLM\Software\Microsoft\Windows\CurrentVersion\Run
RTHDCPL
[AM] 38. c:\windows\rthdcpl.exe
SkyTel
[A ] 39. c:\windows\skytel.exe
Alcmtr
[A ] 40. c:\windows\alcmtr.exe
nwiz
[A ] 41. c:\windows\system32\nwiz.exe
SW20
[A ] 42. c:\windows\system32\sw20.exe
SW24
[A ] 43. c:\windows\system32\sw24.exe
WinSys2
[AM] 44. c:\windows\system32\winsys2.exe
SysExplr
[AM] 45. c:\herosoft\herov8\sysexplr.exe
TkBellExe
[AM] 46. c:\program files\common files\real\update_ob\realsched.exe
RavTask
[A ] 47. e:\瑞星杀毒\rising\rav\ravtask.exe
runeip
[AM] 48. c:\program files\rising\antispyware\runiep.exe
+ HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce
RavStub
[AM] 49. e:\瑞星杀毒\rising\rav\ravstub.exe
KKDelay
[A ] 50. c:\program files\rising\antispyware\runonce.exe
+ 开机执行
+ HKLM\SYSTEM\CurrentControlSet\Control\NetworkProvider\Order
BootExecute
[A ] 51. c:\windows\system32\bsmain.exe
[A ] 52. c:\windows\system32\kknative.exe
+ 正在运行的进程
+ 00000080(128) nvsvc32.exe
00400000[0002C000]
[AM] 1. c:\windows\system32\nvsvc32.exe
009C0000[00032000]
[ M] 53. c:\windows\system32\nvapi.dll
+ 000000c0(192) wdfmgr.exe
01000000[0000C000]
[AM] 4. c:\windows\system32\wdfmgr.exe
+ 0000019c(412) SYSEXPLR.EXE
00400000[00015000]
[AM] 45. c:\herosoft\herov8\sysexplr.exe
00370000[00022000]
[ M] 54. c:\herosoft\herov8\avcdrom.dll
10000000[00014000]
[ M] 55. c:\herosoft\herov8\coolmenu.dll
01190000[00006000]
[ M] 56. c:\herosoft\herov8\sys936.dll
013D0000[0001B000]
[ M] 57. c:\program files\rising\antispyware\ieprot.dll
+ 00000264(612) winsys2.exe
00400000[00039000]
[AM] 44. c:\windows\system32\winsys2.exe
44400000[00024000]
[ M] 58. c:\windows\system32\madchook.dll
10000000[0001B000]
[ M] 57. c:\program files\rising\antispyware\ieprot.dll
+ 00000268(616) RUNDLL32.EXE
10000000[00017000]
[ M] 59. c:\windows\system32\nvmctray.dll
00AC0000[00032000]
[ M] 53. c:\windows\system32\nvapi.dll
00B30000[00036000]
[ M] 60. c:\windows\system32\nvrszhc.dll
00A60000[0001B000]
[ M] 57. c:\program files\rising\antispyware\ieprot.dll
+ 00000284(644) smss.exe
+ 000002ac(684) realsched.exe
00400000[0002E000]
[AM] 46. c:\program files\common files\real\update_ob\realsched.exe
10000000[0001B000]
[ M] 57. c:\program files\rising\antispyware\ieprot.dll
+ 000002cc(716) csrss.exe
+ 000002e4(740) winlogon.exe
72C80000[00008000]
[ M] 61. c:\windows\system32\msacm32.drv
+ 00000310(784) services.exe
+ 0000031c(796) lsass.exe
+ 000003cc(972) svchost.exe
+ 00000418(1048) svchost.exe
+ 00000444(1092) RTHDCPL.EXE
00400000[0105B000]
[AM] 38. c:\windows\rthdcpl.exe
72C80000[00008000]
[ M] 61. c:\windows\system32\msacm32.drv
10000000[0001B000]
[ M] 57. c:\program files\rising\antispyware\ieprot.dll
+ 000004a0(1184) svchost.exe
+ 00000500(1280) runiep.exe
00400000[00013000]
[AM] 48. c:\program files\rising\antispyware\runiep.exe
00C40000[0001B000]
[ M] 57. c:\program files\rising\antispyware\ieprot.dll
+ 00000514(1300) svchost.exe
+ 0000053c(1340) svchost.exe
+ 00000570(1392) ctfmon.exe
10000000[0001B000]
[ M] 57. c:\program files\rising\antispyware\ieprot.dll
+ 0000064c(1612) Explorer.EXE
10000000[0001B000]
[AM] 36. c:\windows\system32\ravext.dll
00F80000[00011000]
[AM] 37. c:\windows\system32\shlhook.dll
014F0000[0001B000]
[ M] 57. c:\program files\rising\antispyware\ieprot.dll
72C80000[00008000]
[ M] 61. c:\windows\system32\msacm32.drv
01E00000[0075B000]
[AM] 31. c:\windows\system32\nvcpl.dll
01B20000[00036000]
[ M] 60. c:\windows\system32\nvrszhc.dll
025A0000[00032000]
[ M] 53. c:\windows\system32\nvapi.dll
025E0000[00073000]
[AM] 32. c:\windows\system32\nvshell.dll
+ 000006d0(1744) spoolsv.exe
+ 00000738(1848) RavStub.exe
00400000[00018000]
[AM] 49. e:\瑞星杀毒\rising\rav\ravstub.exe
10000000[0001B000]
[ M] 62. e:\瑞星杀毒\rising\rav\rscommx.dll
23700000[0001A000]
[ M] 63. e:\瑞星杀毒\rising\rav\rscommon.dll
+ 000007ac(1964) alg.exe
+ 000008f8(2296) Ras.exe
00400000[00160000]
[ M] 64. c:\program files\rising\antispyware\ras.exe
10000000[00013000]
[ M] 65. c:\program files\rising\antispyware\topsoft.dll
7C140000[00103000]
[ M] 66. c:\program files\rising\antispyware\mfc71.dll
7C340000[00056000]
[ M] 67. c:\program files\rising\antispyware\msvcr71.dll
7C3A0000[0007B000]
[ M] 68. c:\program files\rising\antispyware\msvcp71.dll
00D10000[000BD000]
[ M] 69. c:\program files\rising\antispyware\rasgui.dll
015A0000[0001B000]
[ M] 57. c:\program files\rising\antispyware\ieprot.dll
02010000[0002F000]
[ M] 70. c:\program files\rising\antispyware\engine.dll
02730000[00012000]
[ M] 71. c:\program files\rising\antispyware\zip.dll
027C0000[00019000]
[ M] 72. e:\瑞星杀毒\rising\rav\ravscrch.dll
+ 00000a34(2612) wmiprvse.exe
+ 00000a5c(2652) mmc.exe
10000000[0001B000]
[ M] 57. c:\program files\rising\antispyware\ieprot.dll
+ 00000a70(2672) DfrgFat.exe
10000000[0001B000]
[ M] 57. c:\program files\rising\antispyware\ieprot.dll
