瑞星卡卡电脑诊断日志 v1.30 (2008-6-10 21:57:49)  北京瑞星科技股份有限公司

注释:	[A]表示该文件存在自启动关联;
	[M]表示该文件在内存中;

+ 注册表自运行项目 
  + 系统服务
    + HKLM\System\CurrentControlSet\Services
      Ati HotKey Poller
        [AM] 1. c:\windows\system32\ati2evxx.exe
          .text,.rdata,.data,.rsrc,


      ATI Smart
        [A ] 2. c:\windows\system32\ati2sgag.exe
          ATI Smart
          .text,.rdata,.data,.rsrc,


      ccosm
        [AM] 3. d:\stormii\stormliv.exe
          北京暴风网际科技有限公司
          暴风影音媒体控制中心
          .text,.rdata,.data,.rsrc,


      imonNT
        [AM] 4. c:\program files\intel\intel(r) active monitor\imonnt.exe
          Intel Corp.
          Intel(R) Active Monitor Win9x Background Service
          .text,.rdata,.data,.rsrc,


      RsCCenter
        [AM] 5. d:\rav\ccenter.exe
          Beijing Rising Technology Co., Ltd.
          CCenter
          .text,.rdata,.data,.rsrc,


      RsRavMon
        [AM] 6. d:\rav\ravmond.exe
          Beijing Rising Technology Co., Ltd.
          Rising Realtime Moniter
          .text,.rdata,.data,.rsrc,


      SoundMAX Agent Service (default)
        [AM] 7. c:\program files\analog devices\soundmax\smagent.exe
          Analog Devices, Inc.
          SoundMAX service agent component
          .text,.rdata,.data,.rsrc,




  + 内核驱动
    + HKLM\System\CurrentControlSet\Services
      aeaudio
        [A ] 8. c:\windows\system32\drivers\aeaudio.sys
          Andrea Electronics Corporation
          Andrea Audio Noise Cancellation Driver
          .text,.rdata,.data,.data1,PAGE,INIT,.rsrc,.reloc,


      hffcay
        [A ] 9. c:\windows\system32\hffcay


      HookCont
        [A ] 10. c:\windows\system32\drivers\hookcont.sys
          Beijing Rising Technology Co., Ltd
          HookCont
          .text,.rdata,.data,INIT,.rsrc,.reloc,


      HookNtos
        [A ] 11. c:\windows\system32\drivers\hookntos.sys
          Beijing Rising Technology Co., Ltd
          HookNtos
          .text,.rdata,.data,INIT,.rsrc,.reloc,


      HookReg
        [A ] 12. c:\windows\system32\drivers\hookreg.sys
          Beijing Rising Technology Co., Ltd
          HookReg
          .text,.rdata,.data,INIT,.rsrc,.reloc,


      HookSys
        [A ] 13. c:\windows\system32\drivers\hooksys.sys
          Beijing Rising Technology Co., Ltd
          Hooksys
          .text,.rdata,.data,INIT,.rsrc,.reloc,


      iSMBIOS
        [A ] 14. c:\windows\system32\drivers\ismbios.sys
          Intel Corporation
          iSMBios Driver for Windows NT(R)
          .text,.data,INIT,.rsrc,.reloc,


      KPGuard
        [A ] 15. d:\jiangmin\antivi~1\kpguard.sys


      msfpfis64
        [A ] 16. c:\windows\system32\drivers\msosmsfpfis64.sys


      npkcrypt
        [A ] 17. d:\qq\npkcrypt.sys
          INCA Internet Co., Ltd.
          nProtect KeyCrypt Driver
          .text,.rdata,.data,INIT,.rsrc,.reloc,


      pmjkgd
        [A ] 18. c:\windows\system32\pmjkgd


      PxHelp20
        [A ] 19. c:\windows\system32\drivers\pxhelp20.sys
          Sonic Solutions
          Px Engine Device Driver for Windows 2000/XP
          .text,.rdata,.data,INIT,.rsrc,.reloc,


      RsAntiSpyware
        [A ] 20. c:\windows\system32\drivers\rsboot.sys
          Beijing Rising Technology Co., Ltd.
          Anti-RootKit Driver
          .text,.rdata,.data,INIT,.rsrc,.reloc,


      RsNTGDI
        [A ] 21. c:\windows\system32\drivers\rsntgdi.sys
          Beijing Rising Technology Co., Ltd.
          RsNTGDI
          .text,.rdata,INIT,.rsrc,.reloc,


      Secdrv
        [A ] 22. c:\windows\system32\drivers\secdrv.sys
          Macrovision Corporation, Macrovision Europe Limited, and Macrovision Japan and Asia K.K.
          Macrovision SECURITY Driver
          .text,.rdata,.data,PAGE,INIT,.rsrc,.reloc,


      SIODRV
        [A ] 23. c:\windows\system32\drivers\siodrv.sys
          Intel Corporation
          SuperIO Driver for Windows NT(R)
          .text,init,.data,PAGE,INIT,.rsrc,.reloc,


      smbusp
        [A ] 24. c:\windows\system32\drivers\smb.sys
          Intel Corporation
          System Management Bus 2.0 (SMBus) Driver
          .text,.rdata,.data,INIT,.rsrc,.reloc,


      smwdm
        [A ] 25. c:\windows\system32\drivers\smwdm.sys
          Analog Devices, Inc.
          SoundMAX Integrated Digital Audio 
          .text,_LTEXT,_PTEXT,.rdata,.data,_LDATA,_PDATA,.data1,.CRT,PAGE,PAGED,INIT,.rsrc,.reloc,


      SNPSTD3
        [A ] 26. c:\windows\system32\drivers\snpstd3.sys
          PC Camera driver
          .text,.rdata,.data,INIT,.rsrc,.reloc,


      ssm_bus
        [A ] 27. c:\windows\system32\drivers\ssm_bus.sys
          MCCI
          SAMSUNG Mobile USB Device II 1.0 Driver
          .text,.data,INIT,.rsrc,.reloc,


      ssm_mdfl
        [A ] 28. c:\windows\system32\drivers\ssm_mdfl.sys
          MCCI
          SAMSUNG Mobile USB Modem II 1.0 Filter Driver
          .text,.rdata,INIT,.rsrc,.reloc,


      ssm_mdm
        [A ] 29. c:\windows\system32\drivers\ssm_mdm.sys
          MCCI
          SAMSUNG Mobile USB Modem II 1.0 Driver
          .text,.data,INIT,.rsrc,.reloc,


      TesSafe
        [A ] 30. c:\windows\system32\tessafe.sys
          TENCENT
          TesSafe NT Driver
          .text,.rdata,.data,INIT,.rsrc,.reloc,


      wuromk
        [A ] 31. c:\windows\system32\wuromk




  + 系统登陆自运行
    + HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify
      AtiExtEvent
        [AM] 32. c:\windows\system32\ati2evxx.dll
          .text,.rdata,.data,.rsrc,.reloc,


      WgaLogon
        [AM] 33. c:\windows\system32\wgalogon.dll
          Microsoft Corporation
          Windows 正版增值计划通知
          .text,.data,.rsrc,.reloc,




  + IE浏览器加载模块
    + HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar
      {E0E899AB-F487-11D5-8D29-0050BA6940E3}
        [A ] 34. d:\flashget\fgiebar.dll
          Amaze Soft
          FlashGet IE Bar
          .text,.rdata,.data,.rsrc,.reloc,


      {DB9ECD4F-FB8F-4311-B3CE-90B976C2707C}
        [A ] 35. c:\windows\system32\kakatool.dll
          Beijing Rising Technology Co., Ltd.
          Rising AntiSpyware Toolbar
          .text,.rdata,.data,MonitorS,.rsrc,.reloc,



    + HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects
      {01443AEC-0FD1-40fd-9C87-E93D1494C233}
        [AM] 36. d:\thunder\comdlls\tdatonce_now.dll
          Thunder Networking Technologies,LTD
          迅雷浏览器高级特性支持模块
          .text,.rdata,.data,.rsrc,.reloc,


      {2F364306-AA45-47B5-9F9D-39A8B94E7EF7}
        [AM] 37. d:\flashget\jccatch.dll
          www.flashget.com
          Flashget CatchUrl Module
          .text,.rdata,.data,.rsrc,.reloc,


      {39F7E362-828A-4B5A-BCAF-5B79BFDFEA60}
        [AM] 38. d:\bitcomet\tools\bitcometbho_1.2.2.28.dll
          BitComet
          BitCometBHO
          .text,.rdata,.data,.rsrc,.reloc,


      {889D2FEB-5411-4565-8998-1DD2C5261283}
        [AM] 39. d:\thunder\comdlls\xunleibho_now.dll
          Thunder Networking Technologies,LTD
          XunLeiBHO
          .text,.rdata,.data,.rsrc,.reloc,


      {F156768E-81EF-470C-9057-481BA8380DBA}
        [AM] 40. d:\flashget\getflash.dll
          www.flashget.com
          Flashget GetFlash Module
          .text,.rdata,.data,.rsrc,.reloc,



    + HKLM\SOFTWARE\Microsoft\Internet Explorer\Extensions
      Exec
        [A ] 41. d:\thunder\thunder.exe
          Thunder Networking Technologies,LTD
          .text,.rdata,.data,.rsrc,


      Exec
        [A ] 42. d:\flashget\flashget.exe
          FlashGet.com
          FlashGet
          .text,.rdata,.data,.rsrc,


      Exec
        [A ] 43. c:\windows\network diagnostic\xpnetdiag.exe
          Microsoft Corporation
          Network Diagnostic for Windows XP
          .text,.data,.rsrc,


      Exec
        [A ] 44. c:\program files\messenger\msmsgs.exe
          Microsoft Corporation
          Windows Messenger
          .text,.data,.rsrc,




  + 资源管理器加载模块
    + HKLM\SOFTWARE\Microsoft\Active Setup\Installed Components
      <{12d0ed0d-0ee0-4f90-8827-78cefb8f4988}
        [A ] 45. c:\windows\system32\ieudinit.exe
          Microsoft Corporation
          IE Per User Active Setup Uninstall Utility
          .text,.data,.rsrc,.reloc,



    + HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved
      HyperTerminal Icon Ext
        [A ] 46. c:\windows\system32\hticons.dll
          Hilgraeve, Inc.
          HyperTerminal Applet Library
          .text,.data,.rsrc,.reloc,


      WinRAR shell extension
        [A ] 47. c:\program files\winrar\rarext.dll
          .text,.data,.tls,.idata,.edata,.rsrc,.reloc,


      Shell Extensions for RealOne Player
        [A ] 48. c:\program files\real\realplayer\rpshell.dll
          RealNetworks, Inc.
          RealPlayer Shell Extensions
          .text,.rdata,.data,.rsrc,.reloc,


      RISING
        [AM] 49. c:\windows\system32\ravext.dll
          Beijing Rising Technology Co., Ltd.
          Rising Shell Ext Module
          .text,.rdata,.data,.rsrc,.reloc,



    + HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks
      {32CD708B-60A7-4C00-9377-D73EAA495F0F}
        [AM] 49. c:\windows\system32\ravext.dll
          Beijing Rising Technology Co., Ltd.
          Rising Shell Ext Module
          .text,.rdata,.data,.rsrc,.reloc,


      {AC2DC2EF-5165-40A3-8CDF-41DCA1B0901A}
        [AM] 50. c:\windows\system32\shlhook.dll
          Beijing Rising Technology Co., Ltd.
          shlhook Module
          .text,.rdata,.data,.rsrc,.reloc,




  + 用户登陆自运行项目
    + HKLM\Software\Microsoft\Windows\CurrentVersion\Run
      RavTask
        [AM] 51. d:\rav\ravtask.exe
          Beijing Rising Technology Co., Ltd.
          RavTimer
          .text,.rdata,.data,.rsrc,


      runeip
        [AM] 52. d:\rising\antispyware\runiep.exe
          Beijing Rising Technology Co., Ltd.
          Rising AntiSpyware Monitor
          .text,.rdata,.data,.rsrc,




  + 开机执行
    + HKLM\SYSTEM\CurrentControlSet\Control\NetworkProvider\Order
      BootExecute
        [A ] 53. c:\windows\system32\bsmain.exe
          Beijing Rising Technology Co., Ltd.
          Rising Antivirus 2008
          .text,.rdata,.data,.rsrc,.reloc,




  + 映像劫持
    + HKCR\.mp3
      Winamp.File.MP3\Enqueue\Command
        [A ] 54. d:\winamp\winamp.exe
          Nullsoft
          Winamp
          .text,.rdata,.data,.tls,.rsrc,.reloc,


      Winamp.File.MP3\ListBookmark\Command
        [A ] 54. d:\winamp\winamp.exe
          Nullsoft
          Winamp
          .text,.rdata,.data,.tls,.rsrc,.reloc,


      Winamp.File.MP3\open\Command
        [A ] 54. d:\winamp\winamp.exe
          Nullsoft
          Winamp
          .text,.rdata,.data,.tls,.rsrc,.reloc,


      Winamp.File.MP3\Play\Command
        [A ] 54. d:\winamp\winamp.exe
          Nullsoft
          Winamp
          .text,.rdata,.data,.tls,.rsrc,.reloc,




  + 程序初始化和已知动态连接库
    + HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows
      AppInit_DLLs
        [AM] 55. c:\windows\system32\ieprot.dll
          Beijing Rising Technology Co., Ltd.
          IE Protector
          .text,.rdata,.data,.rsrc,.reloc,




  + 打印机监控
    + HKLM\SYSTEM\CurrentControlSet\Control\Print\Monitors
      Canon BJ Language Monitor S200SP
        [AM] 56. c:\windows\system32\cnmlm3y.dll
          CANON INC.
          BJ Language Monitor
          .text,.data,.rsrc,.reloc,





+ 正在运行的进程
  + 00000080(128) SMAgent.exe
    00400000[0000B000]
      [AM] 7. c:\program files\analog devices\soundmax\smagent.exe
        Analog Devices, Inc.
        SoundMAX service agent component
        .text,.rdata,.data,.rsrc,


    10000000[00020000]
      [AM] 55. c:\windows\system32\ieprot.dll
        Beijing Rising Technology Co., Ltd.
        IE Protector
        .text,.rdata,.data,.rsrc,.reloc,



  + 000000cc(204) svchost.exe
    6BD00000[0000D000]
      [ M] 57. c:\windows\system32\syncor11.dll
        SoundMAX
        SynthCore R2.0 Midi Interface Driver
        .text,.data,.edata,SHARED,.rsrc,.reloc,



  + 0000012c(300) smss.exe

  + 00000168(360) imonnt.exe
    00400000[0001A000]
      [AM] 4. c:\program files\intel\intel(r) active monitor\imonnt.exe
        Intel Corp.
        Intel(R) Active Monitor Win9x Background Service
        .text,.rdata,.data,.rsrc,


    10000000[00020000]
      [AM] 55. c:\windows\system32\ieprot.dll
        Beijing Rising Technology Co., Ltd.
        IE Protector
        .text,.rdata,.data,.rsrc,.reloc,


    00A00000[00098000]
      [ M] 58. c:\program files\intel\intel(r) active monitor\imonres.lrc
        Intel Corp.
        Intel Active System Monitor Resource File
        .rsrc,.reloc,


    00AA0000[00020000]
      [ M] 59. c:\windows\system32\sensordll.dll
        Intel Corp.
        Intel Active Monitor Sensor Encapsulation DLL
        .text,.rdata,.data,.rsrc,.reloc,



  + 0000016c(364) csrss.exe

  + 00000184(388) winlogon.exe
    10000000[00020000]
      [AM] 55. c:\windows\system32\ieprot.dll
        Beijing Rising Technology Co., Ltd.
        IE Protector
        .text,.rdata,.data,.rsrc,.reloc,


    6BD00000[0000D000]
      [ M] 57. c:\windows\system32\syncor11.dll
        SoundMAX
        SynthCore R2.0 Midi Interface Driver
        .text,.data,.edata,SHARED,.rsrc,.reloc,


    01190000[00017000]
      [AM] 32. c:\windows\system32\ati2evxx.dll
        .text,.rdata,.data,.rsrc,.reloc,


    01300000[0003B000]
      [AM] 33. c:\windows\system32\wgalogon.dll
        Microsoft Corporation
        Windows 正版增值计划通知
        .text,.data,.rsrc,.reloc,


    72C80000[00008000]
      [ M] 60. c:\windows\system32\msacm32.drv
        Microsoft Corporation
        Microsoft Sound Mapper
        .text,.data,.rsrc,.reloc,



  + 000001b4(436) services.exe
    6BD00000[0000D000]
      [ M] 57. c:\windows\system32\syncor11.dll
        SoundMAX
        SynthCore R2.0 Midi Interface Driver
        .text,.data,.edata,SHARED,.rsrc,.reloc,



  + 000001c0(448) lsass.exe
    6BD00000[0000D000]
      [ M] 57. c:\windows\system32\syncor11.dll
        SoundMAX
        SynthCore R2.0 Midi Interface Driver
        .text,.data,.edata,SHARED,.rsrc,.reloc,



  + 0000022c(556) JMCATVLogin.exe
    00400000[000EB000]
      [ M] 61. d:\江门有线\登陆软件\jmcatvlogin.exe
        江门有线广电网络中心
        CODE,DATA,BSS,.idata,.tls,.rdata,.reloc,.rsrc,


    10000000[00020000]
      [AM] 55. c:\windows\system32\ieprot.dll
        Beijing Rising Technology Co., Ltd.
        IE Protector
        .text,.rdata,.data,.rsrc,.reloc,



  + 0000024c(588) Ati2evxx.exe
    00400000[00062000]
      [AM] 1. c:\windows\system32\ati2evxx.exe
        .text,.rdata,.data,.rsrc,


    10000000[00020000]
      [AM] 55. c:\windows\system32\ieprot.dll
        Beijing Rising Technology Co., Ltd.
        IE Protector
        .text,.rdata,.data,.rsrc,.reloc,



  + 0000025c(604) svchost.exe
    6BD00000[0000D000]
      [ M] 57. c:\windows\system32\syncor11.dll
        SoundMAX
        SynthCore R2.0 Midi Interface Driver
        .text,.data,.edata,SHARED,.rsrc,.reloc,



  + 00000298(664) svchost.exe
    6BD00000[0000D000]
      [ M] 57. c:\windows\system32\syncor11.dll
        SoundMAX
        SynthCore R2.0 Midi Interface Driver
        .text,.data,.edata,SHARED,.rsrc,.reloc,



  + 000002c0(704) CCenter.exe
    00400000[00029000]
      [AM] 5. d:\rav\ccenter.exe
        Beijing Rising Technology Co., Ltd.
        CCenter
        .text,.rdata,.data,.rsrc,



  + 000002d0(720) svchost.exe
    6BD00000[0000D000]
      [ M] 57. c:\windows\system32\syncor11.dll
        SoundMAX
        SynthCore R2.0 Midi Interface Driver
        .text,.data,.edata,SHARED,.rsrc,.reloc,


    711A0000[00011000]
      [ M] 62. c:\windows\system32\help32.dll
        .text,.rdata,.data,.reloc,



  + 000002fc(764) svchost.exe
    6BD00000[0000D000]
      [ M] 57. c:\windows\system32\syncor11.dll
        SoundMAX
        SynthCore R2.0 Midi Interface Driver
        .text,.data,.edata,SHARED,.rsrc,.reloc,



  + 00000364(868) svchost.exe
    6BD00000[0000D000]
      [ M] 57. c:\windows\system32\syncor11.dll
        SoundMAX
        SynthCore R2.0 Midi Interface Driver
        .text,.data,.edata,SHARED,.rsrc,.reloc,



  + 000003ec(1004) Ati2evxx.exe
    00400000[00062000]
      [AM] 1. c:\windows\system32\ati2evxx.exe
        .text,.rdata,.data,.rsrc,


    10000000[00020000]
      [AM] 55. c:\windows\system32\ieprot.dll
        Beijing Rising Technology Co., Ltd.
        IE Protector
        .text,.rdata,.data,.rsrc,.reloc,



  + 00000438(1080) Explorer.EXE
    10000000[00020000]
      [AM] 55. c:\windows\system32\ieprot.dll
        Beijing Rising Technology Co., Ltd.
        IE Protector
        .text,.rdata,.data,.rsrc,.reloc,


    6BD00000[0000D000]
      [ M] 57. c:\windows\system32\syncor11.dll
        SoundMAX
        SynthCore R2.0 Midi Interface Driver
        .text,.data,.edata,SHARED,.rsrc,.reloc,


    72C80000[00008000]
      [ M] 60. c:\windows\system32\msacm32.drv
        Microsoft Corporation
        Microsoft Sound Mapper
        .text,.data,.rsrc,.reloc,


    01BF0000[0001C000]
      [AM] 49. c:\windows\system32\ravext.dll
        Beijing Rising Technology Co., Ltd.
        Rising Shell Ext Module
        .text,.rdata,.data,.rsrc,.reloc,


    01C10000[00011000]
      [AM] 50. c:\windows\system32\shlhook.dll
        Beijing Rising Technology Co., Ltd.
        shlhook Module
        .text,.rdata,.data,.rsrc,.reloc,



  + 0000045c(1116) ravmond.exe
    00400000[00069000]
      [AM] 6. d:\rav\ravmond.exe
        Beijing Rising Technology Co., Ltd.
        Rising Realtime Moniter
        .text,.rdata,.data,.rsrc,


    10000000[00042000]
      [ M] 63. d:\rav\bwlist.dll
        Beijing Rising Technology Co., Ltd.
        BWList DLL
        .text,.rdata,.data,.rsrc,.reloc,


    7C140000[00103000]
      [ M] 64. c:\windows\system32\mfc71.dll
        Microsoft Corporation
        MFCDLL Shared Library - Retail Version
        .text,.data,.rsrc,.reloc,


    7C340000[00056000]
      [ M] 65. c:\windows\system32\msvcr71.dll
        Microsoft Corporation
        Microsoft? C Runtime Library
        .text,.rdata,.data,.rsrc,.reloc,


    7C3A0000[0007B000]
      [ M] 66. c:\windows\system32\msvcp71.dll
        Microsoft Corporation
        Microsoft? C++ Runtime Library
        .text,.rdata,.data,.rsrc,.reloc,


    00B20000[0000E000]
      [ M] 67. d:\rav\rsappmgr.dll
        Beijing Rising Technology Co., Ltd.
        Rising Application Manager
        .text,.rdata,.data,.rsrc,.reloc,


    00B40000[00030000]
      [ M] 68. d:\rav\cfgdll.dll
        Beijing Rising Technology Co., Ltd.
        CfgDll
        .text,.rdata,.data,.rsrc,.reloc,


    00DE0000[00067000]
      [ M] 69. d:\rav\rslog.dll
        Beijing Rising Technology Co., Ltd.
        RsLog DLL
        .text,.rdata,.data,.rsrc,.reloc,


    00B80000[0001F000]
      [ M] 70. d:\rav\proccom.dll
        Beijing Rising Technology Co., Ltd.
        ProcessC Dynamic Link Library
        .text,.rdata,.data,.rsrc,.reloc,


    00E50000[00024000]
      [ M] 71. d:\rav\rscommx2.dll
        Beijing Rising Technology Co., Ltd.
        RsCommX2
        .text,.rdata,.data,.rsrc,.reloc,


    00E90000[00075000]
      [ M] 72. d:\rav\monrule.dll
        Beijing Rising Technology Co., Ltd.
        MonRule 
        .text,.rdata,.data,.rsrc,.reloc,


    00F20000[00013000]
      [ M] 73. d:\rav\hooksys.dll
        Beijing Rising Technology Co., Ltd
        Hooksys Dynamic Link Library
        .text,.rdata,.data,.rsrc,.reloc,


    01080000[00013000]
      [ M] 74. d:\rav\hookreg.dll
        Beijing Rising Technology Co., Ltd
        HookReg Dynamic Link Library
        .text,.rdata,.data,.rsrc,.reloc,


    010E0000[00013000]
      [ M] 75. d:\rav\hookntos.dll
        Beijing Rising Technology Co., Ltd
        SysMon Dynamic Link Library
        .text,.rdata,.data,.rsrc,.reloc,


    01140000[0001C000]
      [ M] 76. d:\rav\rswalmon.dll
        Beijing Rising Technology Co., Ltd.
        Rising WAL Monitor DLL
        .text,.rdata,.data,.rsrc,.reloc,


    01F70000[00035000]
      [ M] 77. d:\rav\recomp.dll
        Beijing Rising Technology Co., Ltd.
        component manager Dynamic Link Library
        .text,.rdata,.data,.rsrc,.reloc,


    01FC0000[00036000]
      [ M] 78. d:\rav\refs.dll
        Beijing Rising Technology Co., Ltd.
        filesystem Dynamic Link Library
        .text,.rdata,.data,.rsrc,.reloc,


    02010000[00023000]
      [ M] 79. d:\rav\ffr.dll
        Beijing Rising Technology Co., Ltd.
        ffr Dynamic Link Library
        .text,.rdata,.data,.rsrc,.reloc,


    02050000[00020000]
      [ M] 80. d:\rav\rsstore.dll
        Beijing Rising Technology Co., Ltd.
        RSStore
        .text,.rdata,.data,.rsrc,.reloc,


    02080000[00013000]
      [ M] 81. d:\rav\hookcont.dll
        Beijing Rising Technology Co., Ltd
        HookCont Dynamic Link Library
        .text,.rdata,.data,.rsrc,.reloc,


    020B0000[00027000]
      [ M] 82. d:\rav\fakescan.dll
        Beijing Rising Technology Co., Ltd.
        FakeScan Module
        .text,.rdata,.data,.rsrc,.reloc,


    020F0000[00022000]
      [ M] 83. d:\rav\scanner.dll
        Beijing Rising Technology Co., Ltd.
        RsScanner Module
        .text,.rdata,.data,.rsrc,.reloc,


    02730000[0002F000]
      [ M] 84. d:\rav\viruslib.dll
        Beijing Rising Technology Co., Ltd.
        VirusLib Dynamic Link Library
        .text,.rdata,.data,.rsrc,.reloc,


    02770000[000DC000]
      [ M] 85. d:\rav\extfile.dll
        Beijing Rising Technology Co., Ltd.
        extFile Dynamic Link Library
        .text,.rdata,.data,.rsrc,.reloc,


    02960000[00028000]
      [ M] 86. d:\rav\relibldr.dll
        Beijing Rising Technology Co., Ltd.
        libloader Dynamic Link Library
        .text,.rdata,.data,.rsrc,.reloc,


    029A0000[00027000]
      [ M] 87. d:\rav\pearc.dll
        Beijing Rising Technology Co., Ltd.
        pearchive Dynamic Link Library
        .text,.rdata,.data,.rsrc,.reloc,


    03090000[0000D000]
      [ M] 88. d:\rav\hookweb.dll
        Beijing Rising Technology Co., Ltd.
        Rising HookWeb Dll
        .text,.rdata,.data,.rsrc,.reloc,


    04030000[00021000]
      [ M] 89. d:\rav\nvfile.dll
        Beijing Rising Technology Co., Ltd.
        NVFile
        .text,.rdata,.data,.rsrc,.reloc,


    13AB0000[0004A000]
      [ M] 90. d:\rav\scanexec.dll
        Beijing Rising Technology Co., Ltd.
        ScanExec
        .text,.rdata,.data,.rsrc,.reloc,


    05BC0000[002DC000]
      [ M] 91. d:\rav\unexe.dll
        Beijing Rising Technology Co., Ltd.
        UnExe
        .text,.rdata,.data,.rsrc,.reloc,


    05EA0000[000CB000]
      [ M] 92. d:\rav\scanex.dll
        Beijing Rising Technology Co., Ltd.
        ScanEx
        .text,.rdata,.data,.rsrc,.reloc,


    063D0000[00036000]
      [ M] 93. d:\rav\scanpack.dll
        Beijing Rising Technology Co., Ltd.
        Unpack Engine
        .text,.rdata,.data,.rsrc,.reloc,


    06420000[000B4000]
      [ M] 94. d:\rav\revm.dll
        Beijing Rising Technology Co., Ltd.
        REVM Dynamic Link Library
        .text,.rdata,.data,.rsrc,.reloc,


    06610000[00020000]
      [ M] 95. d:\rav\urutils.dll
        urutils Dynamic Link Library
        .text,.rdata,.data,.rsrc,.reloc,


    06640000[00018000]
      [ M] 96. d:\rav\ur000.dat
        Beijing Rising Technology Co., Ltd.
        Unpack Routine
        .text,.rdata,.data,.rsrc,.reloc,


    07900000[00036000]
      [ M] 97. d:\rav\scriptci.dll
        Beijing Rising Technology Co., Ltd.
        scriptci Dynamic Link Library
        .text,.rdata,.data,.rsrc,.reloc,


    07950000[000F3000]
      [ M] 98. d:\rav\uroutine.dll
        Beijing Rising Technology Co., Ltd.
        Unpack Routine
        .text,.rdata,.data,.rsrc,.reloc,


    082B0000[0001D000]
      [ M] 99. d:\rav\ur001.dat
        Beijing Rising Technology Co., Ltd.
        Unpack Routine
        .text,.rdata,.data,.rsrc,.reloc,


    048D0000[00023000]
      [ M] 100. d:\rav\scansct.dll
        Beijing Rising Technology Co., Ltd.
        ScanSct Dynamic Link Library
        .text,.rdata,.data,.rsrc,.reloc,


    04990000[00017000]
      [ M] 101. d:\rav\ur023.dat
        Beijing Rising Technology Co., Ltd.
        Unpack Routine
        .text,.rdata,.data,.rsrc,.reloc,



  + 000004c4(1220) spoolsv.exe
    10000000[00020000]
      [AM] 55. c:\windows\system32\ieprot.dll
        Beijing Rising Technology Co., Ltd.
        IE Protector
        .text,.rdata,.data,.rsrc,.reloc,


    6BD00000[0000D000]
      [ M] 57. c:\windows\system32\syncor11.dll
        SoundMAX
        SynthCore R2.0 Midi Interface Driver
        .text,.data,.edata,SHARED,.rsrc,.reloc,


    66F40000[0001A000]
      [AM] 56. c:\windows\system32\cnmlm3y.dll
        CANON INC.
        BJ Language Monitor
        .text,.data,.rsrc,.reloc,


    00B40000[00007000]
      [ M] 102. c:\windows\system32\spool\prtprocs\w32x86\cnmpd3y.dll
        CANON INC.
        Canon BJ Print Processor Dispatcher
        .text,.data,.rsrc,.reloc,



  + 000005d0(1488) RavTask.exe
    00400000[00034000]
      [AM] 51. d:\rav\ravtask.exe
        Beijing Rising Technology Co., Ltd.
        RavTimer
        .text,.rdata,.data,.rsrc,


    10000000[0001F000]
      [ M] 70. d:\rav\proccom.dll
        Beijing Rising Technology Co., Ltd.
        ProcessC Dynamic Link Library
        .text,.rdata,.data,.rsrc,.reloc,


    00A30000[00024000]
      [ M] 71. d:\rav\rscommx2.dll
        Beijing Rising Technology Co., Ltd.
        RsCommX2
        .text,.rdata,.data,.rsrc,.reloc,


    23700000[00028000]
      [ M] 103. d:\rav\rscommon.dll
        Beijing Rising Technology Co., Ltd.
        Rising Common Function Dynamic Link Library
        .text,.rdata,.data,.rsrc,.reloc,


    00C90000[0000E000]
      [ M] 67. d:\rav\rsappmgr.dll
        Beijing Rising Technology Co., Ltd.
        Rising Application Manager
        .text,.rdata,.data,.rsrc,.reloc,


    08CB0000[00030000]
      [ M] 68. d:\rav\cfgdll.dll
        Beijing Rising Technology Co., Ltd.
        CfgDll
        .text,.rdata,.data,.rsrc,.reloc,



  + 000005d8(1496) runiep.exe
    00400000[00020000]
      [AM] 52. d:\rising\antispyware\runiep.exe
        Beijing Rising Technology Co., Ltd.
        Rising AntiSpyware Monitor
        .text,.rdata,.data,.rsrc,


    7C140000[00103000]
      [ M] 104. d:\rising\antispyware\mfc71.dll
        Microsoft Corporation
        MFCDLL Shared Library - Retail Version
        .text,.data,.rsrc,.reloc,


    7C340000[00056000]
      [ M] 105. d:\rising\antispyware\msvcr71.dll
        Microsoft Corporation
        Microsoft? C Runtime Library
        .text,.rdata,.data,.rsrc,.reloc,


    10000000[00020000]
      [AM] 55. c:\windows\system32\ieprot.dll
        Beijing Rising Technology Co., Ltd.
        IE Protector
        .text,.rdata,.data,.rsrc,.reloc,



  + 000005e0(1504) ctfmon.exe
    10000000[00020000]
      [AM] 55. c:\windows\system32\ieprot.dll
        Beijing Rising Technology Co., Ltd.
        IE Protector
        .text,.rdata,.data,.rsrc,.reloc,


    6BD00000[0000D000]
      [ M] 57. c:\windows\system32\syncor11.dll
        SoundMAX
        SynthCore R2.0 Midi Interface Driver
        .text,.data,.edata,SHARED,.rsrc,.reloc,



  + 00000650(1616) RavStub.exe
    00400000[00021000]
      [ M] 106. d:\rav\ravstub.exe
        Beijing Rising Technology Co., Ltd.
        Rising RavStub
        .text,.rdata,.data,.rsrc,


    10000000[0001F000]
      [ M] 70. d:\rav\proccom.dll
        Beijing Rising Technology Co., Ltd.
        ProcessC Dynamic Link Library
        .text,.rdata,.data,.rsrc,.reloc,


    00620000[00024000]
      [ M] 71. d:\rav\rscommx2.dll
        Beijing Rising Technology Co., Ltd.
        RsCommX2
        .text,.rdata,.data,.rsrc,.reloc,


    23700000[00028000]
      [ M] 103. d:\rav\rscommon.dll
        Beijing Rising Technology Co., Ltd.
        Rising Common Function Dynamic Link Library
        .text,.rdata,.data,.rsrc,.reloc,



  + 00000654(1620) Ravmon.exe
    00400000[00067000]
      [ M] 107. d:\rav\ravmon.exe
        Beijing Rising Technology Co., Ltd.
        Rising realtime monitor shell
        .text,.rdata,.data,.rsrc,


    7C140000[00103000]
      [ M] 64. c:\windows\system32\mfc71.dll
        Microsoft Corporation
        MFCDLL Shared Library - Retail Version
        .text,.data,.rsrc,.reloc,


    7C340000[00056000]
      [ M] 65. c:\windows\system32\msvcr71.dll
        Microsoft Corporation
        Microsoft? C Runtime Library
        .text,.rdata,.data,.rsrc,.reloc,


    7C3A0000[0007B000]
      [ M] 66. c:\windows\system32\msvcp71.dll
        Microsoft Corporation
        Microsoft? C++ Runtime Library
        .text,.rdata,.data,.rsrc,.reloc,


    10000000[0001F000]
      [ M] 70. d:\rav\proccom.dll
        Beijing Rising Technology Co., Ltd.
        ProcessC Dynamic Link Library
        .text,.rdata,.data,.rsrc,.reloc,


    00B20000[00024000]
      [ M] 71. d:\rav\rscommx2.dll
        Beijing Rising Technology Co., Ltd.
        RsCommX2
        .text,.rdata,.data,.rsrc,.reloc,


    23700000[00028000]
      [ M] 103. d:\rav\rscommon.dll
        Beijing Rising Technology Co., Ltd.
        Rising Common Function Dynamic Link Library
        .text,.rdata,.data,.rsrc,.reloc,


    00D70000[00035000]
      [ M] 77. d:\rav\recomp.dll
        Beijing Rising Technology Co., Ltd.
        component manager Dynamic Link Library
        .text,.rdata,.data,.rsrc,.reloc,


    00DC0000[00036000]
      [ M] 78. d:\rav\refs.dll
        Beijing Rising Technology Co., Ltd.
        filesystem Dynamic Link Library
        .text,.rdata,.data,.rsrc,.reloc,


    01020000[0002F000]
      [ M] 84. d:\rav\viruslib.dll
        Beijing Rising Technology Co., Ltd.
        VirusLib Dynamic Link Library
        .text,.rdata,.data,.rsrc,.reloc,


    01160000[00028000]
      [ M] 86. d:\rav\relibldr.dll
        Beijing Rising Technology Co., Ltd.
        libloader Dynamic Link Library
        .text,.rdata,.data,.rsrc,.reloc,


    011E0000[0000E000]
      [ M] 67. d:\rav\rsappmgr.dll
        Beijing Rising Technology Co., Ltd.
        Rising Application Manager
        .text,.rdata,.data,.rsrc,.reloc,


    01200000[00030000]
      [ M] 68. d:\rav\cfgdll.dll
        Beijing Rising Technology Co., Ltd.
        CfgDll
        .text,.rdata,.data,.rsrc,.reloc,


    01360000[00075000]
      [ M] 72. d:\rav\monrule.dll
        Beijing Rising Technology Co., Ltd.
        MonRule 
        .text,.rdata,.data,.rsrc,.reloc,


    23900000[00040000]
      [ M] 108. d:\rav\pngdll.dll
        Beijing Rising Technology Co., Ltd.
        Rising .Png File Loader Dynamic Link Library
        .text,.rdata,.data,.rsrc,.reloc,


    26600000[000B8000]
      [ M] 109. d:\rav\rsguilib.dll
        Beijing Rising Technology Co., Ltd.
        Rising GUI Library Loader
        .text,.rdata,.data,.rsrc,.reloc,


    23800000[00018000]
      [ M] 110. d:\rav\rsxml.dll
        Beijing Rising Technology Co., Ltd.
        RsXML
        .text,.rdata,.data,.rsrc,.reloc,



  + 000006fc(1788) stormliv.exe
    00400000[00075000]
      [AM] 3. d:\stormii\stormliv.exe
        北京暴风网际科技有限公司
        暴风影音媒体控制中心
        .text,.rdata,.data,.rsrc,


    75FF0000[00065000]
      [ M] 111. d:\stormii\msvcp60.dll
        Microsoft Corporation
        Microsoft (R) C++ Runtime Library
        .text,.rdata,.data,.rsrc,.reloc,


    10000000[00020000]
      [AM] 55. c:\windows\system32\ieprot.dll
        Beijing Rising Technology Co., Ltd.
        IE Protector
        .text,.rdata,.data,.rsrc,.reloc,



  + 000008ac(2220) alg.exe
    10000000[00020000]
      [AM] 55. c:\windows\system32\ieprot.dll
        Beijing Rising Technology Co., Ltd.
        IE Protector
        .text,.rdata,.data,.rsrc,.reloc,


    6BD00000[0000D000]
      [ M] 57. c:\windows\system32\syncor11.dll
        SoundMAX
        SynthCore R2.0 Midi Interface Driver
        .text,.data,.edata,SHARED,.rsrc,.reloc,



  + 00000a2c(2604) iexplore.exe
    10000000[00020000]
      [AM] 55. c:\windows\system32\ieprot.dll
        Beijing Rising Technology Co., Ltd.
        IE Protector
        .text,.rdata,.data,.rsrc,.reloc,


    01200000[0002C000]
      [AM] 36. d:\thunder\comdlls\tdatonce_now.dll
        Thunder Networking Technologies,LTD
        迅雷浏览器高级特性支持模块
        .text,.rdata,.data,.rsrc,.reloc,


    01230000[00011000]
      [AM] 37. d:\flashget\jccatch.dll
        www.flashget.com
        Flashget CatchUrl Module
        .text,.rdata,.data,.rsrc,.reloc,


    01250000[00074000]
      [AM] 38. d:\bitcomet\tools\bitcometbho_1.2.2.28.dll
        BitComet
        BitCometBHO
        .text,.rdata,.data,.rsrc,.reloc,


    01870000[00034000]
      [AM] 39. d:\thunder\comdlls\xunleibho_now.dll
        Thunder Networking Technologies,LTD
        XunLeiBHO
        .text,.rdata,.data,.rsrc,.reloc,


    23BE0000[0000E000]
      [ M] 112. d:\thunder\components\resworker\dsbho_00.dll
        Thunder Networking Technologies,LTD
        DsBho
        .text,.rdata,.data,.rsrc,.reloc,


    23BA0000[0001E000]
      [ M] 113. d:\thunder\components\resworker\dataprocessor_00.dll
        Thunder Networking Technologies,LTD
        DataProcessor
        .text,.rdata,.data,.rsrc,.reloc,


    01910000[00021000]
      [AM] 40. d:\flashget\getflash.dll
        www.flashget.com
        Flashget GetFlash Module
        .text,.rdata,.data,.rsrc,.reloc,


    6BD00000[0000D000]
      [ M] 57. c:\windows\system32\syncor11.dll
        SoundMAX
        SynthCore R2.0 Midi Interface Driver
        .text,.data,.edata,SHARED,.rsrc,.reloc,


    02D60000[00028000]
      [ M] 114. d:\rav\ravscrch.dll
        Beijing Rising Technology Co., Ltd.
        RavScrCh Module
        .text,.rdata,.data,.rsrc,.reloc,


    30000000[003AE000]
      [ M] 115. c:\windows\system32\macromed\flash\flash9e.ocx
        Adobe Systems, Inc.
        Adobe Flash Player 9.0  r115
        .text,.rdata,.data,.rodata,.rsrc,.reloc,


    72C80000[00008000]
      [ M] 60. c:\windows\system32\msacm32.drv
        Microsoft Corporation
        Microsoft Sound Mapper
        .text,.data,.rsrc,.reloc,


    756B0000[00016000]
      [ M] 116. c:\windows\system32\macromed\common\swsupport.dll
        Macromedia, Inc.
        Shockwave Remote Support
        .text,.rdata,.data,.rsrc,.reloc,


    08620000[0012D000]
      [ M] 117. c:\windows\system32\sogoupy.ime
        Sogou.com Inc.
        搜狗拼音输入法
        .text,.rdata,.data,.rsrc,.reloc,



  + 00000a68(2664) BitComet.exe
    00400000[009A3000]
      [ M] 118. d:\bitcomet\bitcomet.exe
        www.BitComet.com
        BitComet - a BitTorrent Client
        .text,.rsrc,


    10000000[00020000]
      [AM] 55. c:\windows\system32\ieprot.dll
        Beijing Rising Technology Co., Ltd.
        IE Protector
        .text,.rdata,.data,.rsrc,.reloc,


    6BD00000[0000D000]
      [ M] 57. c:\windows\system32\syncor11.dll
        SoundMAX
        SynthCore R2.0 Midi Interface Driver
        .text,.data,.edata,SHARED,.rsrc,.reloc,


    02B80000[0001C000]
      [AM] 49. c:\windows\system32\ravext.dll
        Beijing Rising Technology Co., Ltd.
        Rising Shell Ext Module
        .text,.rdata,.data,.rsrc,.reloc,


    02BB0000[00011000]
      [AM] 50. c:\windows\system32\shlhook.dll
        Beijing Rising Technology Co., Ltd.
        shlhook Module
        .text,.rdata,.data,.rsrc,.reloc,


    045B0000[00028000]
      [ M] 114. d:\rav\ravscrch.dll
        Beijing Rising Technology Co., Ltd.
        RavScrCh Module
        .text,.rdata,.data,.rsrc,.reloc,



  + 00000d3c(3388) notepad.exe
    10000000[00020000]
      [AM] 55. c:\windows\system32\ieprot.dll
        Beijing Rising Technology Co., Ltd.
        IE Protector
        .text,.rdata,.data,.rsrc,.reloc,


    6BD00000[0000D000]
      [ M] 57. c:\windows\system32\syncor11.dll
        SoundMAX
        SynthCore R2.0 Midi Interface Driver
        .text,.data,.edata,SHARED,.rsrc,.reloc,



  + 00000ed0(3792) Ras.exe
    00400000[001FF000]
      [ M] 119. d:\rising\antispyware\ras.exe
        Beijing Rising Technology Co., Ltd.
        Rising AntiSpyware
        .text,.rdata,.data,.rsrc,


    7C140000[00103000]
      [ M] 104. d:\rising\antispyware\mfc71.dll
        Microsoft Corporation
        MFCDLL Shared Library - Retail Version
        .text,.data,.rsrc,.reloc,


    7C340000[00056000]
      [ M] 105. d:\rising\antispyware\msvcr71.dll
        Microsoft Corporation
        Microsoft? C Runtime Library
        .text,.rdata,.data,.rsrc,.reloc,


    7C3A0000[0007B000]
      [ M] 120. d:\rising\antispyware\msvcp71.dll
        Microsoft Corporation
        Microsoft? C++ Runtime Library
        .text,.rdata,.data,.rsrc,.reloc,


    10000000[00013000]
      [ M] 121. d:\rising\antispyware\topsoft.dll
        Beijing Rising Technology Co., Ltd.
        Rising AntiSpyware TopSoft
        .text,.rdata,.data,.rsrc,.reloc,


    00370000[00032000]
      [ M] 122. d:\rising\antispyware\ncomm.dll
        Beijing Rising Technology Co., Ltd.
        Rising AntiSpyware
        .text,.rdata,.data,.rsrc,.reloc,


    00D60000[0001F000]
      [ M] 70. d:\rav\proccom.dll
        Beijing Rising Technology Co., Ltd.
        ProcessC Dynamic Link Library
        .text,.rdata,.data,.rsrc,.reloc,


    00ED0000[00024000]
      [ M] 71. d:\rav\rscommx2.dll
        Beijing Rising Technology Co., Ltd.
        RsCommX2
        .text,.rdata,.data,.rsrc,.reloc,


    01020000[0014D000]
      [ M] 123. d:\rising\antispyware\rasgui.dll
        Beijing Rising Technology Co., Ltd.
        RasGUI
        .text,.rdata,.data,.rsrc,.reloc,


    23800000[00022000]
      [ M] 124. d:\rising\antispyware\rsxml.dll
        Beijing Rising Technology Co., Ltd.
        RsXML
        .text,.rdata,.data,.rsrc,.reloc,


    032E0000[00018000]
      [ M] 125. d:\rising\antispyware\ktrojan.dll
        Beijing Rising Technology Co., Ltd.
        Rising AntiSpyware
        .text,.rdata,.data,.rsrc,.reloc,


    03310000[0002F000]
      [ M] 126. d:\rising\antispyware\engine.dll
        Beijing Rising Technology Co., Ltd.
        kaka engine
        .text,.rdata,.data,.rsrc,.reloc,


    03350000[00040000]
      [ M] 127. d:\rising\antispyware\rsdialog.dll
        Beijing Rising Technology Co., Ltd.
        Rsdiaglo DLL
        .text,.rdata,.data,.rsrc,.reloc,


    033A0000[00024000]
      [ M] 128. d:\rising\antispyware\scanunv.dll
        Beijing Rising Technology Co., Ltd.
        .text,.rdata,.data,.rsrc,.reloc,


    033E0000[0001F000]
      [ M] 129. d:\rising\antispyware\secscan.dll
        Copyright(c) 1998-2006 Beijing  Rising  Technology  Corporation  Limited
        SecScan Dynamic Link Library
        .text,.rdata,.data,.rsrc,.reloc,


    034C0000[00015000]
      [ M] 130. d:\rising\antispyware\secex.dll
        Copyright(c) 1998-2006 Beijing  Rising  Technology  Corporation  Limited
        SecScanE Dynamic Link Library
        .text,.rdata,.data,.rsrc,.reloc,


    03BA0000[00012000]
      [ M] 131. d:\rising\antispyware\zip.dll
        rising
        zip
        UPX0,UPX1,.rsrc,


    6BD00000[0000D000]
      [ M] 57. c:\windows\system32\syncor11.dll
        SoundMAX
        SynthCore R2.0 Midi Interface Driver
        .text,.data,.edata,SHARED,.rsrc,.reloc,


    72C80000[00008000]
      [ M] 60. c:\windows\system32\msacm32.drv
        Microsoft Corporation
        Microsoft Sound Mapper
        .text,.data,.rsrc,.reloc,


    03230000[00028000]
      [ M] 114. d:\rav\ravscrch.dll
        Beijing Rising Technology Co., Ltd.
        RavScrCh Module
        .text,.rdata,.data,.rsrc,.reloc,


    30000000[003AE000]
      [ M] 115. c:\windows\system32\macromed\flash\flash9e.ocx
        Adobe Systems, Inc.
        Adobe Flash Player 9.0  r115
        .text,.rdata,.data,.rodata,.rsrc,.reloc,