瑞星卡卡电脑诊断日志 v1.20 (2007-7-9 16:19:27)  北京瑞星科技股份有限公司

注释:    [A]表示该文件存在自启动关联;
    [M]表示该文件在内存中;

+ 注册表自运行项目
  + Win32 Services
    + HKLM\System\CurrentControlSet\Services
      ose
        [A ] 1. c:\program files\common files\microsoft shared\source engine\ose.exe
      RfwProxySrv
        [A ] 2. c:\program files\rising\rfw\rfwproxy.exe
      RfwService
        [A ] 3. c:\program files\rising\rfw\rfwsrv.exe
      RsCCenter
        [A ] 4. c:\program files\rising\rav\ccenter.exe
      RsRavMon
        [A ] 5. c:\program files\rising\rav\ravmond.exe
      UMWdf
        [AM] 6. c:\windows\system32\wdfmgr.exe
  + Kernel Drivers
    + HKLM\System\CurrentControlSet\Services
      ALCXWDM
        [A ] 7. c:\windows\system32\drivers\alcxwdm.sys
      AmdK8
        [A ] 8. c:\windows\system32\drivers\amdk8.sys
      BaseTDI
        [A ] 9. c:\windows\system32\drivers\basetdi.sys
      ExpScaner
        [A ] 10. c:\program files\rising\rav\expscan.sys
      HookCont
        [A ] 11. c:\program files\rising\rav\hookcont.sys
      HookReg
        [A ] 12. c:\program files\rising\rav\hookreg.sys
      HookSys
        [A ] 13. c:\program files\rising\rav\hooksys.sys
      HookUrl
        [A ] 14. c:\program files\rising\rfw\hookurl.sys
      ljkhoa
        [A ] 15. c:\windows\system32\drivers\ljkhoa.sys
      MEMSCAN
        [A ] 16. c:\program files\rising\rav\memscan.sys
      mProcRs
        [A ] 17. c:\program files\rising\rfw\mprocrs.sys
      npkcrypt
        [A ] 18. c:\program files\qq2006\npkcrypt.sys
      npkycryp
        [A ] 19. c:\program files\qq2006\npkycryp.sys
      RsAntiSpyware
        [A ] 20. c:\windows\system32\drivers\rsboot.sys
      RsFwDrv
        [A ] 21. c:\program files\rising\rfw\rsfwdrv.sys
      RsNTGDI
        [A ] 22. c:\windows\system32\drivers\rsntgdi.sys
      RSPPSYS
        [A ] 23. c:\program files\rising\rav\rsppsys.sys
      RTL8023xp
        [A ] 24. c:\windows\system32\drivers\rtnicxp.sys
      Secdrv
        [A ] 25. c:\windows\system32\drivers\secdrv.sys
      SNP2STD
        [A ] 26. c:\windows\system32\drivers\snp2sxp.sys
      SSCFS
        [A ] 27. c:\windows\system32\drivers\sscfs.sys
      viagfx
        [A ] 28. c:\windows\system32\drivers\vtmini.sys
      ViaIde
        [A ] 29. c:\windows\system32\drivers\viaidexp.sys
      VIAMRAID
        [A ] 30. c:\windows\system32\drivers\viamraid.sys
  + Winlogon
    + HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify
      WgaLogon
        [AM] 31. c:\windows\system32\wgalogon.dll
  + Explorer
    + HKLM\SOFTWARE\Classes\PROTOCOLS\Filter
      text/xml
        [A ] 32. c:\program files\common files\microsoft shared\office11\msoxmlmf.dll
    + HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved
      HyperTerminal Icon Ext
        [A ] 33. c:\windows\system32\hticons.dll
      WinRAR shell extension
        [AM] 34. c:\program files\winrar\rarext.dll
      Shell Extensions for RealOne Player
        [A ] 35. c:\program files\real\realplayer\rpshell.dll
      Microsoft Office HTML Icon Handler
        [AM] 36. c:\program files\microsoft office\office11\msohev.dll
      Web Folders
        [A ] 37. c:\program files\common files\microsoft shared\web folders\msonsext.dll
      Portable Media Devices
        [AM] 38. c:\windows\system32\audiodev.dll
      Portable Media Devices Menu
        [AM] 38. c:\windows\system32\audiodev.dll
      RISING
        [AM] 39. c:\windows\system32\ravext.dll
  + Logon
    + HKLM\Software\Microsoft\Windows\CurrentVersion\Run
      switch
        [A ] 40. c:\windows\system32\壁纸自动换.exe
      SoundMan
        [AM] 41. c:\windows\soundman.exe
      VTTimer
        [AM] 42. c:\windows\system32\vttimer.exe
      VTTrayp
        [AM] 43. c:\windows\system32\vttrayp.exe
      snp2std
        [AM] 44. c:\windows\vsnp2std.exe
      miniqqlive
        [A ] 45. c:\program files\tencent\qqlive\miniqqlive.exe
      runeip
        [AM] 46. c:\program files\rising\antispyware\runiep.exe
      RavTask
        [A ] 47. c:\program files\rising\rav\ravtask.exe
      RfwMain
        [AM] 48. c:\program files\rising\rfw\rfwmain.exe
    + HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce
      RavStub
        [AM] 49. c:\program files\rising\rav\ravstub.exe
      KKDelay
        [A ] 50. c:\program files\rising\antispyware\runonce.exe
  + Boot Execute
    + HKLM\SYSTEM\CurrentControlSet\Control\NetworkProvider\Order
      BootExecute
        [A ] 51. c:\windows\system32\bsmain.exe
        [A ] 52. c:\windows\system32\kknative.exe
  + Image Hijacks
    + HKCR\.html
      htmlfile\Edit\Command
        [A ] 53. c:\program files\microsoft office\office11\msohtmed.exe
      htmlfile\Print\Command
        [A ] 53. c:\program files\microsoft office\office11\msohtmed.exe
      htmlfile\TencentTraveler\Command
        [A ] 54. c:\program files\tt\ttraveler.exe
    + HKCR\.htm
      htmlfile\Edit\Command
        [A ] 53. c:\program files\microsoft office\office11\msohtmed.exe
      htmlfile\Print\Command
        [A ] 53. c:\program files\microsoft office\office11\msohtmed.exe
      htmlfile\TencentTraveler\Command
        [A ] 54. c:\program files\tt\ttraveler.exe
    + HKCR\.scr
      scrfile\nEO iMAGING\Command
        [A ] 55. c:\program files\neo imaging\neoimaging.exe
    + HKCR\.mp3
      Audio.MP3\open\Command
        [A ] 56. c:\program files\ttplayer\ttplayer.exe
      Audio.MP3\PlayList\Command
        [A ] 56. c:\program files\ttplayer\ttplayer.exe
+ 其他自启动项目
  + C:\Documents and Settings\Administrator\「开始」菜单\程序\启动
    QQ游戏启动加速程序.lnk
      [A ] 57. c:\program files\tencent\qqgame\accel.exe
+ 系统活动模块
  + 00000144(324) svchost.exe
  + 00000154(340) Ras.exe
    00400000[0013D000]
      [ M] 58. c:\program files\rising\antispyware\ras.exe
    10000000[000A0000]
      [ M] 59. c:\program files\rising\antispyware\rasgui.dll
    01490000[0001B000]
      [ M] 60. c:\program files\rising\antispyware\ieprot.dll
    02D40000[0002F000]
      [ M] 61. c:\program files\rising\antispyware\engine.dll
    02820000[00012000]
      [ M] 62. c:\program files\rising\antispyware\zip.dll
  + 00000158(344) wdfmgr.exe
    01000000[0000C000]
      [AM] 6. c:\windows\system32\wdfmgr.exe
  + 000001b8(440) smss.exe
  + 00000204(516) csrss.exe
  + 0000021c(540) winlogon.exe
    01240000[0003B000]
      [AM] 31. c:\windows\system32\wgalogon.dll
    72C80000[00008000]
      [ M] 63. c:\windows\system32\msacm32.drv
  + 00000248(584) services.exe
  + 00000254(596) lsass.exe
  + 000002f0(752) svchost.exe
  + 0000031c(796) svchost.exe
  + 00000388(904) svchost.exe
    50E60000[0000C000]
      [ M] 64. c:\windows\system32\wups2.dll
  + 000003cc(972) svchost.exe
  + 00000424(1060) svchost.exe
  + 000004e8(1256) Explorer.EXE
    10000000[0001B000]
      [ M] 60. c:\program files\rising\antispyware\ieprot.dll
    72C80000[00008000]
      [ M] 63. c:\windows\system32\msacm32.drv
    60EA0000[0001B000]
      [ M] 65. c:\program files\qq2006\qdshm.dll
    60AC0000[000F2000]
      [ M] 66. c:\program files\qq2006\mfc42.dll
    01450000[0002C000]
      [AM] 34. c:\program files\winrar\rarext.dll
    016D0000[0001B000]
      [AM] 39. c:\windows\system32\ravext.dll
    23700000[0001A000]
      [ M] 67. c:\program files\rising\rav\rscommon.dll
  + 0000056c(1388) alg.exe
  + 000005ec(1516) RavStub.exe
    00400000[00018000]
      [AM] 49. c:\program files\rising\rav\ravstub.exe
    10000000[0001B000]
      [ M] 68. c:\program files\rising\rav\rscommx.dll
    23700000[0001A000]
      [ M] 67. c:\program files\rising\rav\rscommon.dll
  + 00000668(1640) spoolsv.exe
  + 00000670(1648) RfwMain.exe
    00400000[00073000]
      [AM] 48. c:\program files\rising\rfw\rfwmain.exe
    26600000[0007D000]
      [ M] 69. c:\program files\rising\rfw\rsguilib.dll
    23700000[0001A000]
      [ M] 70. c:\program files\rising\rfw\rscommon.dll
    10000000[0000F000]
      [ M] 71. c:\program files\rising\rfw\rfwctrl.dll
    23800000[0001A000]
      [ M] 72. c:\program files\rising\rfw\rsxml.dll
    23900000[00031000]
      [ M] 73. c:\program files\rising\rfw\pngdll.dll
    012F0000[0001B000]
      [ M] 60. c:\program files\rising\antispyware\ieprot.dll
  + 00000718(1816) SOUNDMAN.EXE
    00400000[0008F000]
      [AM] 41. c:\windows\soundman.exe
    10000000[0001B000]
      [ M] 60. c:\program files\rising\antispyware\ieprot.dll
  + 00000720(1824) VTTimer.exe
    00400000[0000D000]
      [AM] 42. c:\windows\system32\vttimer.exe
    10000000[0001B000]
      [ M] 60. c:\program files\rising\antispyware\ieprot.dll
  + 00000734(1844) VTtrayp.exe
    00400000[0002B000]
      [AM] 43. c:\windows\system32\vttrayp.exe
    6BB00000[00091000]
      [ M] 74. c:\windows\system32\vtdisply.dll
    6BE00000[0006F000]
      [ M] 75. c:\windows\system32\vtgamma2.dll
    6C000000[00051000]
      [ M] 76. c:\windows\system32\vtinfo2.dll
    6C200000[00088000]
      [ M] 77. c:\windows\system32\vtovrlay.dll
    10000000[0001B000]
      [ M] 60. c:\program files\rising\antispyware\ieprot.dll
  + 00000750(1872) vsnp2std.exe
    00400000[000A9000]
      [AM] 44. c:\windows\vsnp2std.exe
    10000000[0001B000]
      [ M] 60. c:\program files\rising\antispyware\ieprot.dll
    72C80000[00008000]
      [ M] 63. c:\windows\system32\msacm32.drv
  + 00000784(1924) runiep.exe
    00400000[00012000]
      [AM] 46. c:\program files\rising\antispyware\runiep.exe
    00C00000[0001B000]
      [ M] 60. c:\program files\rising\antispyware\ieprot.dll
  + 000008b0(2224) ctfmon.exe
    10000000[0001B000]
      [ M] 60. c:\program files\rising\antispyware\ieprot.dll
  + 00000f38(3896) iexplore.exe
    10000000[0001B000]
      [ M] 60. c:\program files\rising\antispyware\ieprot.dll
    325C0000[00012000]
      [AM] 36. c:\program files\microsoft office\office11\msohev.dll
    096C0000[0007A000]
      [AM] 38. c:\windows\system32\audiodev.dll
    72C80000[00008000]
      [ M] 63. c:\windows\system32\msacm32.drv

+ 注册表自运行项目
  + Win32 Services(Win32服务项目)
    + HKLM\System\CurrentControlSet\Services（服务项目对应的注册表子项）
      ose（注册表值项名称）
        [A ] 1. c:\program files\common files\microsoft shared\source engine\ose.exe（OSE这个注册表值项对应的映像文件）
      ………………………………………………………………………………
  + Kernel Drivers（核心驱动程序）
    + HKLM\System\CurrentControlSet\Services（核心驱动程序对应的注册表子项）
      ………………………………………………………………………………
以此类推（彩色字是解释）。
“+”表示当前项目下有子项或值项。

如果您熟悉注册表的话，我想您应该明白了。