未知家族病毒分析
扫描结果:
无可疑文件

系统活动进程
C:\PROGRAM FILES\RISING\RFW\RAVTASK.EXE
C:\WINDOWS\SYSTEM32\KMON.DLL
C:\PROGRAM FILES\RISING\RFW\RSCONF.DLL
C:\PROGRAM FILES\RISING\RFW\RSAPPMGR.DLL
C:\PROGRAM FILES\RISING\RFW\CFGDLL.DLL
C:\PROGRAM FILES\RISING\RFW\PROCCOMM.DLL
C:\WINDOWS\SYSTEM32\MSVCR71.DLL
C:\WINDOWS\SYSTEM32\MSVCP71.DLL
C:\PROGRAM FILES\RISING\RFW\RSSTUB.DLL
C:\PROGRAM FILES\RISING\RFW\RSTASK.DLL
C:\PROGRAM FILES\SANDBOXIE\SBIESVC.EXE
C:\PROGRAM FILES\SANDBOXIE\SBIEDLL.DLL
C:\WINDOWS\SYSTEM32\KMON.DLL
C:\PROGRAM FILES\RISING\RFW\RSNETSVR.EXE
C:\PROGRAM FILES\RISING\RFW\NCOMM.DLL
C:\PROGRAM FILES\RISING\RFW\SYSLAY.DLL
C:\WINDOWS\SYSTEM32\KMON.DLL
C:\PROGRAM FILES\RISING\RFW\COMX3.DLL
C:\PROGRAM FILES\RISING\RFW\PROCCOMM.DLL
C:\WINDOWS\SYSTEM32\MSVCR71.DLL
C:\WINDOWS\SYSTEM32\MSVCP71.DLL
C:\WINDOWS\SYSTEM32\SMSS.EXE
C:\WINDOWS\SYSTEM32\CSRSS.EXE
C:\WINDOWS\SYSTEM32\WINLOGON.EXE
C:\WINDOWS\SYSTEM32\MSACM32.DRV
C:\WINDOWS\SYSTEM32\SERVICES.EXE
C:\WINDOWS\APPPATCH\ACADPROC.DLL
C:\WINDOWS\SYSTEM32\LSASS.EXE
C:\WINDOWS\SYSTEM32\SVCHOST.EXE
C:\WINDOWS\SYSTEM32\SVCHOST.EXE
C:\PROGRAM FILES\RISING\RFW\CCENTER.EXE
C:\PROGRAM FILES\RISING\RFW\COMBASE.DLL
C:\WINDOWS\SYSTEM32\KMON.DLL
C:\PROGRAM FILES\RISING\RFW\CNT09.DLL
C:\WINDOWS\SYSTEM32\SVCHOST.EXE
C:\WINDOWS\SYSTEM32\SVCHOST.EXE
C:\PROGRAM FILES\RISING\RFW\RFWSRV.EXE
C:\PROGRAM FILES\RISING\RFW\COMBASE.DLL
C:\WINDOWS\SYSTEM32\KMON.DLL
C:\WINDOWS\SYSTEM32\MSVCP71.DLL
C:\WINDOWS\SYSTEM32\MSVCR71.DLL
C:\PROGRAM FILES\RISING\RFW\MONBASE.DLL
C:\PROGRAM FILES\RISING\RFW\MONCOMM.DLL
C:\PROGRAM FILES\RISING\RFW\RFWLOG.DLL
C:\PROGRAM FILES\RISING\RFW\RFWRULE.DLL
C:\PROGRAM FILES\RISING\RFW\RFWSRV.DLL
C:\PROGRAM FILES\RISING\RFW\SYSLAY.DLL
C:\PROGRAM FILES\RISING\RFW\MPORTS.DLL
C:\PROGRAM FILES\RISING\RFW\RFWDRVC.DLL
C:\PROGRAM FILES\RISING\RFW\RFWDRV.DLL
C:\PROGRAM FILES\RISING\RFW\RSNETSVR.DLL
C:\PROGRAM FILES\RISING\RFW\COMX3.DLL
C:\PROGRAM FILES\RISING\RFW\URLRULE.DLL
C:\PROGRAM FILES\RISING\RFW\RECOMP.DLL
C:\PROGRAM FILES\RISING\RFW\REFS.DLL
C:\PROGRAM FILES\RISING\RFW\VIRUSLIB.DLL
C:\PROGRAM FILES\RISING\RFW\RELIBLDR.DLL
C:\PROGRAM FILES\RISING\RFW\RFWPROXY.DLL
C:\PROGRAM FILES\RISING\RFW\RSAPPMGR.DLL
C:\PROGRAM FILES\RISING\RFW\CFGDLL.DLL
C:\PROGRAM FILES\RISING\RFW\PROCCOMM.DLL
C:\PROGRAM FILES\RISING\RFW\URLLIB.DLL
C:\WINDOWS\SYSTEM32\SVCHOST.EXE
C:\PROGRAM FILES\NORTON ANTIVIRUS\ENGINE\16.2.0.7\CCSVCHST.EXE
C:\WINDOWS\SYSTEM32\KMON.DLL
C:\PROGRAM FILES\NORTON ANTIVIRUS\ENGINE\16.2.0.7\CCL80U.DLL
C:\PROGRAM FILES\NORTON ANTIVIRUS\ENGINE\16.2.0.7\CCVRTRST.DLL
C:\PROGRAM FILES\NORTON ANTIVIRUS\ENGINE\16.2.0.7\EFACLI.DLL
C:\PROGRAM FILES\NORTON ANTIVIRUS\ENGINE\16.2.0.7\CCSVC.DLL
C:\PROGRAM FILES\NORTON ANTIVIRUS\ENGINE\16.2.0.7\SRTSP32.DLL
C:\PROGRAM FILES\NORTON ANTIVIRUS\ENGINE\16.2.0.7\CCIPC.DLL
C:\PROGRAM FILES\NORTON ANTIVIRUS\ENGINE\16.2.0.7\DIMASTER.DLL
C:\PROGRAM FILES\NORTON ANTIVIRUS\ENGINE\16.2.0.7\CCSET.DLL
C:\PROGRAM FILES\NORTON ANTIVIRUS\ENGINE\16.2.0.7\IPSPLUG.DLL
C:\PROGRAM FILES\NORTON ANTIVIRUS\ENGINE\16.2.0.7\UIPERFSV.DLL
C:\DOCUMENTS AND SETTINGS\ALL USERS\APPLICATION DATA\NORTON\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NORTON\DEFINITIONS\IPSDEFS\20090115.001\IDSXPX86.DLL
C:\PROGRAM FILES\NORTON ANTIVIRUS\ENGINE\16.2.0.7\CCJOBMGR.DLL
C:\PROGRAM FILES\NORTON ANTIVIRUS\ENGINE\16.2.0.7\CCGEVT.DLL
C:\PROGRAM FILES\NORTON ANTIVIRUS\ENGINE\16.2.0.7\FWCORE.DLL
C:\PROGRAM FILES\NORTON ANTIVIRUS\ENGINE\16.2.0.7\HTEC.DLL
C:\PROGRAM FILES\NORTON ANTIVIRUS\ENGINE\16.2.0.7\CCSUBENG.DLL
C:\PROGRAM FILES\NORTON ANTIVIRUS\ENGINE\16.2.0.7\NCWTRUST.DLL
C:\PROGRAM FILES\NORTON ANTIVIRUS\ENGINE\16.2.0.7\AVPSVC32.DLL
C:\PROGRAM FILES\NORTON ANTIVIRUS\ENGINE\16.2.0.7\BHSVCPLG.DLL
C:\PROGRAM FILES\NORTON ANTIVIRUS\ENGINE\16.2.0.7\CCGLOG.DLL
C:\PROGRAM FILES\NORTON ANTIVIRUS\ENGINE\16.2.0.7\SNDSVC.DLL
C:\PROGRAM FILES\NORTON ANTIVIRUS\ENGINE\16.2.0.7\CLTLMC.DLL
C:\PROGRAM FILES\NORTON ANTIVIRUS\ENGINE\16.2.0.7\ISDATAPR.DLL
C:\PROGRAM FILES\NORTON ANTIVIRUS\ENGINE\16.2.0.7\ISDATASV.DLL
C:\PROGRAM FILES\NORTON ANTIVIRUS\ENGINE\16.2.0.7\CLTLMS.DLL
C:\PROGRAM FILES\NORTON ANTIVIRUS\ENGINE\16.2.0.7\SYMNETI.DLL
C:\PROGRAM FILES\NORTON ANTIVIRUS\ENGINE\16.2.0.7\AVIFC.DLL
C:\PROGRAM FILES\NORTON ANTIVIRUS\ENGINE\16.2.0.7\APPMGR32.DLL
C:\PROGRAM FILES\NORTON ANTIVIRUS\ENGINE\16.2.0.7\HNCORE.DLL
C:\PROGRAM FILES\NORTON ANTIVIRUS\ENGINE\16.2.0.7\AVMODULE.DLL
C:\PROGRAM FILES\NORTON ANTIVIRUS\ENGINE\16.2.0.7\FWGENPLG.DLL
C:\PROGRAM FILES\NORTON ANTIVIRUS\ENGINE\16.2.0.7\BHCLIENT.DLL
C:\PROGRAM FILES\NORTON ANTIVIRUS\ENGINE\16.2.0.7\FWHELPER.DLL
C:\PROGRAM FILES\NORTON ANTIVIRUS\ENGINE\16.2.0.7\CCSEBIND.DLL
C:\PROGRAM FILES\NORTON ANTIVIRUS\ENGINE\16.2.0.7\HTECSUB.DLL
C:\WINDOWS\SYSTEM32\ODBCBCP.DLL
C:\PROGRAM FILES\NORTON ANTIVIRUS\ENGINE\16.2.0.7\QBACKUP.DLL
C:\PROGRAM FILES\NORTON ANTIVIRUS\ENGINE\16.2.0.7\IMCFG.DLL
C:\PROGRAM FILES\NORTON ANTIVIRUS\ENGINE\16.2.0.7\NUMENG.DLL
C:\PROGRAM FILES\NORTON ANTIVIRUS\ENGINE\16.2.0.7\LUE.DLL
C:\PROGRAM FILES\NORTON ANTIVIRUS\ENGINE\16.2.0.7\BBRGEN.DLL
C:\PROGRAM FILES\NORTON ANTIVIRUS\ENGINE\16.2.0.7\CCSVCHST.EXE
C:\WINDOWS\SYSTEM32\KMON.DLL
C:\PROGRAM FILES\NORTON ANTIVIRUS\ENGINE\16.2.0.7\CCL80U.DLL
C:\PROGRAM FILES\NORTON ANTIVIRUS\ENGINE\16.2.0.7\CCVRTRST.DLL
C:\PROGRAM FILES\NORTON ANTIVIRUS\ENGINE\16.2.0.7\EFACLI.DLL
C:\PROGRAM FILES\NORTON ANTIVIRUS\ENGINE\16.2.0.7\CCIPC.DLL
C:\PROGRAM FILES\NORTON ANTIVIRUS\ENGINE\16.2.0.7\CCSVC.DLL
C:\PROGRAM FILES\NORTON ANTIVIRUS\ENGINE\16.2.0.7\SRTSP32.DLL
C:\PROGRAM FILES\NORTON ANTIVIRUS\ENGINE\16.2.0.7\UIHOST.DLL
C:\PROGRAM FILES\NORTON ANTIVIRUS\ENGINE\16.2.0.7\NPCTRAY.DLL
C:\PROGRAM FILES\NORTON ANTIVIRUS\ENGINE\16.2.0.7\ISDATAPR.DLL
C:\PROGRAM FILES\NORTON ANTIVIRUS\ENGINE\16.2.0.7\AVPAPP32.DLL
C:\PROGRAM FILES\NORTON ANTIVIRUS\ENGINE\16.2.0.7\BHCLIENT.DLL
C:\PROGRAM FILES\NORTON ANTIVIRUS\ENGINE\16.2.0.7\AVIFC.DLL
C:\PROGRAM FILES\NORTON ANTIVIRUS\ENGINE\16.2.0.7\CCSET.DLL
C:\PROGRAM FILES\NORTON ANTIVIRUS\ENGINE\16.2.0.7\CCJOBMGR.DLL
C:\PROGRAM FILES\NORTON ANTIVIRUS\ENGINE\16.2.0.7\CCGEVT.DLL
C:\PROGRAM FILES\NORTON ANTIVIRUS\ENGINE\16.2.0.7\CCEMLPXY.DLL
C:\PROGRAM FILES\NORTON ANTIVIRUS\ENGINE\16.2.0.7\CLTALDIS.DLL
C:\PROGRAM FILES\NORTON ANTIVIRUS\MUI\16.1.0.33\04\02\CLTRES.LOC
C:\PROGRAM FILES\NORTON ANTIVIRUS\ENGINE\16.2.0.7\SYMREDIR.DLL
C:\PROGRAM FILES\NORTON ANTIVIRUS\ENGINE\16.2.0.7\FWSESAL.DLL
C:\PROGRAM FILES\NORTON ANTIVIRUS\ENGINE\16.2.0.7\CLTLMC.DLL
C:\PROGRAM FILES\NORTON ANTIVIRUS\ENGINE\16.2.0.7\NPCSTATUS.DLL
C:\PROGRAM FILES\NORTON ANTIVIRUS\ENGINE\16.2.0.7\SDKCMN.DLL
C:\PROGRAM FILES\NORTON ANTIVIRUS\ENGINE\16.2.0.7\AVMAIL.DLL
C:\PROGRAM FILES\NORTON ANTIVIRUS\ENGINE\16.2.0.7\APPMGR32.DLL
C:\PROGRAM FILES\NORTON ANTIVIRUS\ENGINE\16.2.0.7\UIALERT.DLL
C:\PROGRAM FILES\NORTON ANTIVIRUS\ENGINE\16.2.0.7\HSUI.DLL
C:\PROGRAM FILES\NORTON ANTIVIRUS\ENGINE\16.2.0.7\CLTUI.DLL
C:\DOCUMENTS AND SETTINGS\ALL USERS\APPLICATION DATA\NORTON\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NORTON\CLT\CLTLMSX.DLL
C:\PROGRAM FILES\NORTON ANTIVIRUS\ENGINE\16.2.0.7\ISPWD.DLL
C:\PROGRAM FILES\NORTON ANTIVIRUS\ENGINE\16.2.0.7\SYMHTML.DLL
C:\PROGRAM FILES\NORTON ANTIVIRUS\ENGINE\16.2.0.7\UIPERFSV.DLL
C:\PROGRAM FILES\360\360SAFE\SAFEMON\SAFEMON.DLL
F:\装备集\清理专家\KINGSO~1\IEBUDDY2.DLL
C:\WINDOWS\EXPLORER.EXE
C:\WINDOWS\SYSTEM32\KMON.DLL
C:\WINDOWS\SYSTEM32\WPDSHSERVICEOBJ.DLL
C:\WINDOWS\SYSTEM32\PORTABLEDEVICETYPES.DLL
C:\WINDOWS\SYSTEM32\PORTABLEDEVICEAPI.DLL
C:\PROGRAM FILES\360\360SAFE\SAFEMON\SAFEMON.DLL
F:\装备集\清理专家\KINGSO~1\IEBUDDY2.DLL
C:\WINDOWS\SYSTEM32\MSACM32.DRV
C:\PROGRAM FILES\COMMON FILES\NERO\LIB\NERODIGITALEXT.DLL
C:\PROGRAM FILES\NORTON ANTIVIRUS\ENGINE\16.2.0.7\CCL80U.DLL
C:\PROGRAM FILES\NORTON ANTIVIRUS\ENGINE\16.2.0.7\CCSET.DLL
C:\PROGRAM FILES\TENCENT\QQ\QDSHM.DLL
C:\PROGRAM FILES\TENCENT\QQ\MFC42.DLL
C:\PROGRAM FILES\WINRAR\RAREXT.DLL
C:\PROGRAM FILES\NORTON ANTIVIRUS\ENGINE\16.2.0.7\NAVSHEXT.DLL
C:\PROGRAM FILES\NORTON ANTIVIRUS\ENGINE\16.2.0.7\CCVRTRST.DLL
C:\PROGRAM FILES\NORTON ANTIVIRUS\ENGINE\16.2.0.7\EFACLI.DLL
E:\JIHE\123\QVODPLAYER\QVODBAND.DLL
E:\JIHE\VWMARE\NAMIROBOT\DATA\NAMIPANEXT1.DLL
C:\WINDOWS\SYSTEM32\MSVCR71.DLL
C:\WINDOWS\SYSTEM32\YOUKUDESKTOPSHELL.DLL
C:\WINDOWS\SYSTEM32\QQPINYIN.IME
C:\WINDOWS\SYSTEM32\HKCMD.EXE
C:\WINDOWS\SYSTEM32\HCCUTILS.DLL
C:\WINDOWS\SYSTEM32\KMON.DLL
C:\WINDOWS\SYSTEM32\IGFXSRVC.DLL
C:\WINDOWS\SYSTEM32\IGFXRES.DLL
C:\WINDOWS\SYSTEM32\IGFXPERS.EXE
C:\WINDOWS\SYSTEM32\KMON.DLL
C:\WINDOWS\SYSTEM32\IGFXSRVC.DLL
C:\PROGRAM FILES\COMMON FILES\REAL\UPDATE_OB\REALSCHED.EXE
C:\WINDOWS\SYSTEM32\KMON.DLL
C:\PROGRAM FILES\RISING\ANTISPYWARE\RSTRAY.EXE
C:\WINDOWS\SYSTEM32\KMON.DLL
C:\PROGRAM FILES\RISING\ANTISPYWARE\RSMGINFO.DLL
C:\PROGRAM FILES\RISING\ANTISPYWARE\RSXML.DLL
C:\PROGRAM FILES\RISING\ANTISPYWARE\MSVCP71.DLL
C:\PROGRAM FILES\RISING\ANTISPYWARE\MSVCR71.DLL
C:\PROGRAM FILES\RISING\ANTISPYWARE\COMSERV.DLL
C:\PROGRAM FILES\RISING\ANTISPYWARE\SYSLAY.DLL
C:\PROGRAM FILES\RISING\ANTISPYWARE\RSCOMMON.DLL
C:\PROGRAM FILES\RISING\ANTISPYWARE\COMX3.DLL
C:\PROGRAM FILES\RISING\ANTISPYWARE\PNGDLL.DLL
C:\PROGRAM FILES\RISING\ANTISPYWARE\RUNIEP.DLL
C:\PROGRAM FILES\RISING\ANTISPYWARE\NCOMM.DLL
C:\PROGRAM FILES\RISING\ANTISPYWARE\PROCCOM.DLL
C:\PROGRAM FILES\RISING\ANTISPYWARE\RSCOMMX2.DLL
C:\PROGRAM FILES\RISING\RFW\RSTRAY.EXE
C:\WINDOWS\SYSTEM32\KMON.DLL
C:\PROGRAM FILES\RISING\RFW\COMSERV.DLL
C:\WINDOWS\SYSTEM32\MSVCP71.DLL
C:\WINDOWS\SYSTEM32\MSVCR71.DLL
C:\PROGRAM FILES\RISING\RFW\RSLANG.DLL
C:\PROGRAM FILES\RISING\RFW\COMX3.DLL
C:\PROGRAM FILES\RISING\RFW\SYSLAY.DLL
C:\PROGRAM FILES\RISING\RFW\RSXML.DLL
C:\PROGRAM FILES\RISING\RFW\PROCCOMM.DLL
C:\PROGRAM FILES\RISING\RFW\MONSTATE.DLL
C:\PROGRAM FILES\RISING\RFW\RFWRULE.DLL
C:\PROGRAM FILES\RISING\RFW\RSCONF.DLL
C:\PROGRAM FILES\RISING\RFW\RSAPPMGR.DLL
C:\PROGRAM FILES\RISING\RFW\CFGDLL.DLL
C:\PROGRAM FILES\RISING\RFW\RSPALVD.DLL
C:\PROGRAM FILES\RISING\RFW\RSGUILIB.DLL
C:\WINDOWS\SYSTEM32\MFC71.DLL
C:\PROGRAM FILES\RISING\RFW\RAVBINTL.DLL
C:\PROGRAM FILES\RISING\RFW\RSNETSVR.DLL
C:\PROGRAM FILES\RISING\RFW\RSMGINFO.DLL
C:\PROGRAM FILES\RISING\RFW\RFWTRAY.DLL
C:\PROGRAM FILES\RISING\RFW\PNGDLL.DLL
C:\PROGRAM FILES\RISING\RFW\RFWLOG.DLL
C:\PROGRAM FILES\360\360SAFE\SAFEMON\SAFEMON.DLL
F:\装备集\清理专家\KINGSO~1\IEBUDDY2.DLL
C:\WINDOWS\RTHDCPL.EXE
C:\WINDOWS\SYSTEM32\KMON.DLL
C:\WINDOWS\SYSTEM32\MSACM32.DRV
C:\PROGRAM FILES\360\360SAFE\SAFEMON\SAFEMON.DLL
C:\WINDOWS\SYSTEM32\CTFMON.EXE
C:\WINDOWS\SYSTEM32\KMON.DLL
C:\PROGRAM FILES\SANDBOXIE\SBIECTRL.EXE
C:\PROGRAM FILES\SANDBOXIE\SBIEDLL.DLL
C:\WINDOWS\SYSTEM32\KMON.DLL
C:\PROGRAM FILES\SANDBOXIE\SBIEMSG.DLL
F:\装备集\清理专家\KINGSOFT ANTISPY\MONITOR\KASTRAY.EXE
C:\WINDOWS\SYSTEM32\KMON.DLL
C:\PROGRAM FILES\RISING\ANTISPYWARE\COMX3.DLL
C:\PROGRAM FILES\RISING\ANTISPYWARE\SYSLAY.DLL
C:\PROGRAM FILES\360\360SAFE\SAFEMON\SAFEMON.DLL
C:\PROGRAM FILES\KINGSOFT\KAC\SERVICE\KACCTL.DLL
F:\装备集\清理专家\KINGSOFT ANTISPY\MONITOR\KASPOP.DLL
F:\装备集\清理专家\KINGSO~1\IEBUDDY2.DLL
C:\PROGRAM FILES\KINGSOFT\KAC\SERVICE\KACCORE.EXE
C:\WINDOWS\SYSTEM32\KMON.DLL
C:\PROGRAM FILES\RISING\ANTISPYWARE\COMX3.DLL
C:\PROGRAM FILES\RISING\ANTISPYWARE\SYSLAY.DLL
C:\PROGRAM FILES\KINGSOFT\KAC\SERVICE\COREHELPER.DLL
F:\装备集\清理专家\KINGSOFT ANTISPY\KUTLTPROXY.DLL
F:\装备集\清理专家\KINGSOFT ANTISPY\PROXY\REGMONITORPROXY.DLL
F:\装备集\清理专家\KINGSOFT ANTISPY\PROXY\KHISTORYERASEPROXY.DLL
F:\装备集\清理专家\KINGSOFT ANTISPY\PROXY\KSTARTUPPROXY.DLL
F:\装备集\清理专家\KINGSOFT ANTISPY\KACC.DLL
F:\装备集\清理专家\KINGSOFT ANTISPY\KAEAUTORUNEX.DLL
F:\装备集\清理专家\KINGSOFT ANTISPY\MONITOR\KUDISKMON.EXE
C:\WINDOWS\SYSTEM32\KMON.DLL
C:\PROGRAM FILES\RISING\ANTISPYWARE\COMX3.DLL
C:\PROGRAM FILES\RISING\ANTISPYWARE\SYSLAY.DLL
C:\PROGRAM FILES\360\360SAFE\SAFEMON\SAFEMON.DLL
C:\PROGRAM FILES\TENCENT\QQ\TXPLATFORM.EXE
C:\WINDOWS\SYSTEM32\KMON.DLL
C:\PROGRAM FILES\RISING\ANTISPYWARE\COMX3.DLL
C:\PROGRAM FILES\RISING\ANTISPYWARE\SYSLAY.DLL
C:\PROGRAM FILES\360\360SAFE\SAFEMON\SAFEMON.DLL
C:\PROGRAM FILES\TENCENT\QQ\QQ.EXE
C:\PROGRAM FILES\TENCENT\QQ\QQBASECLASSINDLL.DLL
C:\PROGRAM FILES\TENCENT\QQ\QQHELPERDLL.DLL
C:\PROGRAM FILES\TENCENT\QQ\BASICCTRLDLL.DLL
C:\PROGRAM FILES\TENCENT\QQ\MFC42.DLL
C:\PROGRAM FILES\TENCENT\QQ\MSIMG32.DLL
C:\WINDOWS\SYSTEM32\KMON.DLL
C:\PROGRAM FILES\360\360SAFE\SAFEMON\SAFEMON.DLL
C:\PROGRAM FILES\RISING\ANTISPYWARE\COMX3.DLL
C:\PROGRAM FILES\RISING\ANTISPYWARE\SYSLAY.DLL
C:\PROGRAM FILES\TENCENT\QQ\RICHED32.DLL
C:\PROGRAM FILES\TENCENT\QQ\RICHED20.DLL
C:\PROGRAM FILES\TENCENT\QQ\QQAPI.DLL
C:\PROGRAM FILES\TENCENT\QQ\LOGINCTRL.DLL
C:\PROGRAM FILES\TENCENT\QQ\LOGINCTRLRES.DLL
C:\PROGRAM FILES\TENCENT\QQ\QQRES.DLL
F:\装备集\清理专家\KINGSO~1\IEBUDDY2.DLL
C:\PROGRAM FILES\TENCENT\QQ\QQMAINFRAME.DLL
C:\PROGRAM FILES\TENCENT\QQ\GDIPLUS.DLL
C:\PROGRAM FILES\TENCENT\QQ\UNREADMSGMGR.DLL
C:\PROGRAM FILES\TENCENT\QQ\QQALLINONE.DLL
C:\PROGRAM FILES\TENCENT\QQ\SCCORE.DLL
C:\PROGRAM FILES\TENCENT\QQ\CAMERADLL.DLL
C:\PROGRAM FILES\TENCENT\QQ\CQQAPPLICATION.DLL
C:\PROGRAM FILES\TENCENT\QQ\FLASHAVATARDLL.DLL
C:\PROGRAM FILES\TENCENT\QQ\NEWSKIN.DLL
C:\PROGRAM FILES\TENCENT\QQ\MAILSUMMARY.DLL
C:\PROGRAM FILES\TENCENT\QQ\QQSPACE.DLL
C:\PROGRAM FILES\TENCENT\QQ\USERDEFINEDHEAD.DLL
C:\PROGRAM FILES\TENCENT\QQ\QQPLUGIN.DLL
C:\PROGRAM FILES\TENCENT\QQ\VBSCRIPT.DLL
C:\WINDOWS\SYSTEM32\MACROMED\FLASH\FLASH10A.OCX
C:\WINDOWS\SYSTEM32\MSACM32.DRV
C:\PROGRAM FILES\TENCENT\QQ\QQAVATAR.DLL
C:\PROGRAM FILES\TENCENT\QQ\OEMAPPLICATION.DLL
C:\PROGRAM FILES\TENCENT\QQ\QQKNOWLEDGESEARCH.DLL
C:\PROGRAM FILES\TENCENT\QQ\QQGROUPMNG.DLL
C:\PROGRAM FILES\TENCENT\QQ\QQSYSMSGMNG.DLL
C:\PROGRAM FILES\TENCENT\QQ\QQPET.DLL
C:\PROGRAM FILES\TENCENT\QQ\QRINGMNG.DLL
C:\PROGRAM FILES\TENCENT\QQ\QQCONFIGPLUGIN.DLL
C:\PROGRAM FILES\TENCENT\QQ\QQCUSTOMFACE.DLL
C:\PROGRAM FILES\TENCENT\QQ\LONGCONNECTION.DLL
C:\PROGRAM FILES\TENCENT\QQ\PHONEAPI.DLL
C:\PROGRAM FILES\TENCENT\QQ\DIALERALLINONE.DLL
C:\PROGRAM FILES\TENCENT\QQ\BQQAPPLICATION.DLL
C:\PROGRAM FILES\TENCENT\QQ\COMMERCESMNG.DLL
C:\PROGRAM FILES\TENCENT\QQ\PERSONALDESKTOP.DLL
C:\PROGRAM FILES\TENCENT\QQ\QQADDR.DLL
C:\PROGRAM FILES\TENCENT\QQ\QQSCENEMNG.DLL
C:\PROGRAM FILES\TENCENT\QQ\ADDRSEARCH.DLL
C:\PROGRAM FILES\COMMON FILES\MICROSOFT SHARED\OFFICE11\MSOXMLMF.DLL
C:\PROGRAM FILES\TENCENT\QQ\QQ.EXE
C:\PROGRAM FILES\TENCENT\QQ\QQBASECLASSINDLL.DLL
C:\PROGRAM FILES\TENCENT\QQ\QQHELPERDLL.DLL
C:\PROGRAM FILES\TENCENT\QQ\BASICCTRLDLL.DLL
C:\PROGRAM FILES\TENCENT\QQ\MFC42.DLL
C:\PROGRAM FILES\TENCENT\QQ\MSIMG32.DLL
C:\WINDOWS\SYSTEM32\KMON.DLL
C:\PROGRAM FILES\360\360SAFE\SAFEMON\SAFEMON.DLL
C:\PROGRAM FILES\RISING\ANTISPYWARE\COMX3.DLL
C:\PROGRAM FILES\RISING\ANTISPYWARE\SYSLAY.DLL
C:\PROGRAM FILES\TENCENT\QQ\RICHED32.DLL
C:\PROGRAM FILES\TENCENT\QQ\RICHED20.DLL
C:\PROGRAM FILES\TENCENT\QQ\QQAPI.DLL
C:\PROGRAM FILES\TENCENT\QQ\LOGINCTRL.DLL
C:\PROGRAM FILES\TENCENT\QQ\LOGINCTRLRES.DLL
C:\PROGRAM FILES\TENCENT\QQ\QQRES.DLL
F:\装备集\清理专家\KINGSO~1\IEBUDDY2.DLL
C:\PROGRAM FILES\TENCENT\QQ\QQMAINFRAME.DLL
C:\PROGRAM FILES\TENCENT\QQ\GDIPLUS.DLL
C:\PROGRAM FILES\TENCENT\QQ\UNREADMSGMGR.DLL
C:\PROGRAM FILES\TENCENT\QQ\QQALLINONE.DLL
C:\PROGRAM FILES\TENCENT\QQ\SCCORE.DLL
C:\PROGRAM FILES\TENCENT\QQ\CAMERADLL.DLL
C:\PROGRAM FILES\TENCENT\QQ\CQQAPPLICATION.DLL
C:\PROGRAM FILES\TENCENT\QQ\FLASHAVATARDLL.DLL
C:\PROGRAM FILES\TENCENT\QQ\NEWSKIN.DLL
C:\PROGRAM FILES\TENCENT\QQ\MAILSUMMARY.DLL
C:\PROGRAM FILES\TENCENT\QQ\QQSPACE.DLL
C:\PROGRAM FILES\TENCENT\QQ\VBSCRIPT.DLL
C:\WINDOWS\SYSTEM32\MACROMED\FLASH\FLASH10A.OCX
C:\WINDOWS\SYSTEM32\MSACM32.DRV
C:\PROGRAM FILES\TENCENT\QQ\QQAVATAR.DLL
C:\PROGRAM FILES\TENCENT\QQ\OEMAPPLICATION.DLL
C:\PROGRAM FILES\TENCENT\QQ\QQKNOWLEDGESEARCH.DLL
C:\PROGRAM FILES\TENCENT\QQ\QQGROUPMNG.DLL
C:\PROGRAM FILES\TENCENT\QQ\QQPLUGIN.DLL
C:\PROGRAM FILES\TENCENT\QQ\QQSYSMSGMNG.DLL
C:\PROGRAM FILES\TENCENT\QQ\USERDEFINEDHEAD.DLL
C:\PROGRAM FILES\TENCENT\QQ\QQMAGICFACE.DLL
C:\PROGRAM FILES\TENCENT\QQ\QQCUSTOMFACE.DLL
C:\PROGRAM FILES\TENCENT\QQ\IMAGEOLE.DLL
C:\PROGRAM FILES\TENCENT\QQ\QRINGMNG.DLL
C:\PROGRAM FILES\TENCENT\QQ\QQCONFIGPLUGIN.DLL
C:\PROGRAM FILES\TENCENT\QQ\QQLIVEQMNG.DLL
C:\PROGRAM FILES\TENCENT\QQ\QQPET.DLL
C:\PROGRAM FILES\COMMON FILES\MICROSOFT SHARED\OFFICE11\MSOXMLMF.DLL
C:\PROGRAM FILES\TENCENT\QQ\LONGCONNECTION.DLL
C:\PROGRAM FILES\TENCENT\QQ\PHONEAPI.DLL
C:\PROGRAM FILES\TENCENT\QQ\DIALERALLINONE.DLL
C:\WINDOWS\SYSTEM32\QQPINYIN.IME
C:\PROGRAM FILES\TENCENT\QQ\BQQAPPLICATION.DLL
C:\PROGRAM FILES\TENCENT\QQ\COMMERCESMNG.DLL
C:\PROGRAM FILES\TENCENT\QQ\PERSONALDESKTOP.DLL
C:\PROGRAM FILES\TENCENT\QQ\QQADDR.DLL
C:\PROGRAM FILES\TENCENT\QQ\QQSCENEMNG.DLL
C:\PROGRAM FILES\TENCENT\QQ\GROUPCONNECTION.DLL
C:\PROGRAM FILES\TENCENT\QQ\ADDRSEARCH.DLL
C:\PROGRAM FILES\INTERNET EXPLORER\IEXPLORE.EXE
C:\WINDOWS\SYSTEM32\KMON.DLL
C:\PROGRAM FILES\RISING\ANTISPYWARE\COMX3.DLL
C:\PROGRAM FILES\RISING\ANTISPYWARE\SYSLAY.DLL
C:\PROGRAM FILES\360\360SAFE\SAFEMON\SAFEMON.DLL
C:\WINDOWS\SYSTEM32\URLFILTER.DLL
C:\PROGRAM FILES\RISING\ANTISPYWARE\URLRULE.DLL
C:\PROGRAM FILES\KINGSOFT\POWERWORD LITE\CBEBAND.DLL
F:\装备集\清理专家\KINGSO~1\KASBROWSERSHIELD.DLL
F:\装备集\清理专家\KINGSO~1\IEBUDDY.DLL
F:\装备集\清理专家\KINGSO~1\IEBUDDY2.DLL
F:\装备集\清理专家\KINGSO~1\IEBUDDYEXT.DLL
F:\装备集\清理专家\KINGSO~1\KIS.DLL
F:\装备集\清理专家\KINGSO~1\KANTRAY.DLL
F:\装备集\清理专家\KINGSO~1\KAEINFOLOG.DLL
F:\装备集\清理专家\KINGSO~1\KAVAFISH.DLL
C:\PROGRAM FILES\360\360SAFE\SAFEMON\URLPROC.DLL
C:\PROGRAM FILES\MICROSOFT OFFICE\OFFICE11\MSOHEV.DLL
C:\WINDOWS\SYSTEM32\QQPINYIN.IME
C:\WINDOWS\SYSTEM32\MACROMED\FLASH\FLASH10A.OCX
C:\WINDOWS\SYSTEM32\MSACM32.DRV
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\1234.EXE
C:\WINDOWS\SYSTEM32\KMON.DLL
C:\PROGRAM FILES\RISING\ANTISPYWARE\COMX3.DLL
C:\PROGRAM FILES\RISING\ANTISPYWARE\SYSLAY.DLL
C:\PROGRAM FILES\360\360SAFE\SAFEMON\SAFEMON.DLL
F:\装备集\清理专家\KINGSO~1\IEBUDDY2.DLL

普通自启动项
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
igfxhkcmd = C:\WINDOWS\SYSTEM32\HKCMD.EXE
igfxpers = C:\WINDOWS\SYSTEM32\IGFXPERS.EXE
TkBellExe = "C:\PROGRAM FILES\COMMON FILES\REAL\UPDATE_OB\REALSCHED.EXE" -OSBOOT
runeip = "C:\PROGRAM FILES\RISING\ANTISPYWARE\RSTRAY.EXE" /STARTUP
RFWTray = "C:\PROGRAM FILES\RISING\RFW\RSTRAY.EXE" -SYSTEM
RTHDCPL = RTHDCPL.EXE
Alcmtr = ALCMTR.EXE
360Safebox = "C:\PROGRAM FILES\360\360SAFEBOX\SAFEBOXTRAY.EXE" /R
360Safetray = C:\PROGRAM FILES\360\360SAFE\SAFEMON\360TRAY.EXE /START
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce
KKDelay = C:\PROGRAM FILES\RISING\ANTISPYWARE\RUNONCE.EXE
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
ctfmon.exe = C:\WINDOWS\SYSTEM32\CTFMON.EXE
SandboxieControl = "C:\PROGRAM FILES\SANDBOXIE\SBIECTRL.EXE"
iKu = C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\桌面\STUDY\IKU\IKU.EXE
金山清理专家实时保护 = "F:\装备集\清理专家\KINGSOFT ANTISPY\MONITOR\KASTRAY.EXE"

AppInit_DLLs
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows
AppInit_DLLs = kmon.dll

系统文件关联
.exe ==> exefile = "%1" %*
.com ==> comfile = "%1" %*
.cmd ==> cmdfile = "%1" %*
.bat ==> batfile = "%1" %*
.txt ==> txtfile = C:\WINDOWS\notepad.exe %1
.scr ==> scrfile = "%1" /S
.reg ==> regfile = regedit.exe "%1"
.doc ==> Word.Document.8 = "C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE" /n /dde

其它启动项
WIN.INI
无信息
SYSTEM.INI
SHELL = Explorer.exe
SCRNSAVE.EXE = C:\WINDOWS\system32\梦幻水~1.SCR

Winlogon 启动项
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify
crypt32chain = CRYPT32.DLL
cryptnet = CRYPTNET.DLL
cscdll = CSCDLL.DLL
igfxcui = IGFXDEV.DLL
ScCertProp = WLNOTIFY.DLL
Schedule = WLNOTIFY.DLL
sclgntfy = SCLGNTFY.DLL
SensLogn = WLNOTIFY.DLL
termsrv = WLNOTIFY.DLL
wlballoon = WLNOTIFY.DLL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon
Userinit = C:\WINDOWS\SYSTEM32\USERINIT.EXE,
shell = EXPLORER.EXE

IE - BHO
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects
{98B7C13A-E9CD-4959-8B46-FBEAB41E42A8} = C:\WINDOWS\system32\UrlFilter.dll
{A412E581-59B2-485E-834F-C5F0C0268C79} = C:\Program Files\Kingsoft\PowerWord Lite\CBEBand.dll
{B69F34DD-F0F9-42DC-9EDD-957187DA688D} = C:\Program Files\360\360Safe\safemon\safemon.dll
{D963BE1A-6B35-47DB-B002-49FAE71D85CC} = F:\装备集\清理专家\KINGSO~1\KASBrowserShield.DLL

Winsock SPI
MSAFD Tcpip [TCP/IP] = C:\WINDOWS\SYSTEM32\MSWSOCK.DLL
MSAFD Tcpip [UDP/IP] = C:\WINDOWS\SYSTEM32\MSWSOCK.DLL
MSAFD Tcpip [RAW/IP] = C:\WINDOWS\SYSTEM32\MSWSOCK.DLL
RSVP UDP Service Provider = C:\WINDOWS\SYSTEM32\RSVPSP.DLL
RSVP TCP Service Provider = C:\WINDOWS\SYSTEM32\RSVPSP.DLL
MSAFD NetBIOS [\Device\NetBT_Tcpip_{01493FE4-D086-470D-8FCD-A5DD88830D58}] SEQPACKET 0 = C:\WINDOWS\SYSTEM32\MSWSOCK.DLL
MSAFD NetBIOS [\Device\NetBT_Tcpip_{01493FE4-D086-470D-8FCD-A5DD88830D58}] DATAGRAM 0 = C:\WINDOWS\SYSTEM32\MSWSOCK.DLL
MSAFD NetBIOS [\Device\NetBT_Tcpip_{FCD4B0C8-53FA-44D6-A408-6C7060274ED9}] SEQPACKET 1 = C:\WINDOWS\SYSTEM32\MSWSOCK.DLL
MSAFD NetBIOS [\Device\NetBT_Tcpip_{FCD4B0C8-53FA-44D6-A408-6C7060274ED9}] DATAGRAM 1 = C:\WINDOWS\SYSTEM32\MSWSOCK.DLL
MSAFD NetBIOS [\Device\NetBT_Tcpip_{980B5A24-5754-498C-AE73-EBFAA6E25AE8}] SEQPACKET 2 = C:\WINDOWS\SYSTEM32\MSWSOCK.DLL
MSAFD NetBIOS [\Device\NetBT_Tcpip_{980B5A24-5754-498C-AE73-EBFAA6E25AE8}] DATAGRAM 2 = C:\WINDOWS\SYSTEM32\MSWSOCK.DLL

系统服务项
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services
Adobe LM Service = "C:\PROGRAM FILES\COMMON FILES\ADOBE SYSTEMS SHARED\SERVICE\ADOBELMSVC.EXE"
Alerter = C:\WINDOWS\SYSTEM32\SVCHOST.EXE -K LOCALSERVICE
ALG = C:\WINDOWS\SYSTEM32\ALG.EXE
AppMgmt = C:\WINDOWS\SYSTEM32\SVCHOST.EXE -K NETSVCS
AudioSrv = C:\WINDOWS\SYSTEM32\SVCHOST.EXE -K NETSVCS
BITS = C:\WINDOWS\SYSTEM32\SVCHOST.EXE -K NETSVCS
Browser = C:\WINDOWS\SYSTEM32\SVCHOST.EXE -K NETSVCS
CiSvc = C:\WINDOWS\SYSTEM32\CISVC.EXE
ClipSrv = C:\WINDOWS\SYSTEM32\CLIPSRV.EXE
COMSysApp = C:\WINDOWS\SYSTEM32\DLLHOST.EXE /PROCESSID:{02D4B3F1-FD88-11D1-960D-00805FC79235}
CryptSvc = C:\WINDOWS\SYSTEM32\SVCHOST.EXE -K NETSVCS
DcomLaunch = C:\WINDOWS\SYSTEM32\SVCHOST -K DCOMLAUNCH
Dhcp = C:\WINDOWS\SYSTEM32\SVCHOST.EXE -K NETSVCS
dmadmin = C:\WINDOWS\SYSTEM32\DMADMIN.EXE /COM
dmserver = C:\WINDOWS\SYSTEM32\SVCHOST.EXE -K NETSVCS
Dnscache = C:\WINDOWS\SYSTEM32\SVCHOST.EXE -K NETWORKSERVICE
ERSvc = C:\WINDOWS\SYSTEM32\SVCHOST.EXE -K NETSVCS
Eventlog = C:\WINDOWS\SYSTEM32\SERVICES.EXE
EventSystem = C:\WINDOWS\SYSTEM32\SVCHOST.EXE -K NETSVCS
FastUserSwitchingCompatibility = C:\WINDOWS\SYSTEM32\SVCHOST.EXE -K NETSVCS
helpsvc = C:\WINDOWS\SYSTEM32\SVCHOST.EXE -K NETSVCS
HidServ = C:\WINDOWS\SYSTEM32\SVCHOST.EXE -K NETSVCS
HTTPFilter = C:\WINDOWS\SYSTEM32\SVCHOST.EXE -K HTTPFILTER
ImapiService = C:\WINDOWS\SYSTEM32\IMAPI.EXE
kaccore = "C:\PROGRAM FILES\KINGSOFT\KAC\SERVICE\KACCORE.EXE"
lanmanserver = C:\WINDOWS\SYSTEM32\SVCHOST.EXE -K NETSVCS
lanmanworkstation = C:\WINDOWS\SYSTEM32\SVCHOST.EXE -K NETSVCS
LmHosts = C:\WINDOWS\SYSTEM32\SVCHOST.EXE -K LOCALSERVICE
Messenger = C:\WINDOWS\SYSTEM32\SVCHOST.EXE -K NETSVCS
mnmsrvc = C:\WINDOWS\SYSTEM32\MNMSRVC.EXE
MSDTC = C:\WINDOWS\SYSTEM32\MSDTC.EXE
MSIServer = C:\WINDOWS\SYSTEM32\MSIEXEC.EXE /V
NetDDE = C:\WINDOWS\SYSTEM32\NETDDE.EXE
NetDDEdsdm = C:\WINDOWS\SYSTEM32\NETDDE.EXE
Netlogon = C:\WINDOWS\SYSTEM32\LSASS.EXE
Netman = C:\WINDOWS\SYSTEM32\SVCHOST.EXE -K NETSVCS
Nla = C:\WINDOWS\SYSTEM32\SVCHOST.EXE -K NETSVCS
Norton AntiVirus = "C:\PROGRAM FILES\NORTON ANTIVIRUS\ENGINE\16.2.0.7\CCSVCHST.EXE" /S "NORTON ANTIVIRUS" /M "C:\PROGRAM FILES\NORTON ANTIVIRUS\ENGINE\16.2.0.7\DIMASTER.DLL" /PREFETCH:1
Norton Helper = C:\DOCUMENTS AND SETTINGS\ALL USERS\APPLICATION DATA\NORTON\NETFXSBX20.EXE
NtLmSsp = C:\WINDOWS\SYSTEM32\LSASS.EXE
NtmsSvc = C:\WINDOWS\SYSTEM32\SVCHOST.EXE -K NETSVCS
ose = "C:\PROGRAM FILES\COMMON FILES\MICROSOFT SHARED\SOURCE ENGINE\OSE.EXE"
PlugPlay = C:\WINDOWS\SYSTEM32\SERVICES.EXE
PolicyAgent = C:\WINDOWS\SYSTEM32\LSASS.EXE
ProtectedStorage = C:\WINDOWS\SYSTEM32\LSASS.EXE
Qvod Terminal = E:\JIHE\123\QVODPLAYER\QVODTERMINAL.EXE
RasAuto = C:\WINDOWS\SYSTEM32\SVCHOST.EXE -K NETSVCS
RasMan = C:\WINDOWS\SYSTEM32\SVCHOST.EXE -K NETSVCS
RDSessMgr = C:\WINDOWS\SYSTEM32\SESSMGR.EXE
RemoteAccess = C:\WINDOWS\SYSTEM32\SVCHOST.EXE -K NETSVCS
RemoteRegistry = C:\WINDOWS\SYSTEM32\SVCHOST.EXE -K LOCALSERVICE
RfwCCenter = C:\PROGRAM FILES\RISING\RFW\CCENTER.EXE
RfwService = C:\PROGRAM FILES\RISING\RFW\RFWSRV.EXE
RfwTask = "C:\PROGRAM FILES\RISING\RFW\RAVTASK.EXE" RFWTASK
RpcLocator = C:\WINDOWS\SYSTEM32\LOCATOR.EXE
RpcSs = C:\WINDOWS\SYSTEM32\SVCHOST -K RPCSS
RSVP = C:\WINDOWS\SYSTEM32\RSVP.EXE
SamSs = C:\WINDOWS\SYSTEM32\LSASS.EXE
SbieSvc = "C:\PROGRAM FILES\SANDBOXIE\SBIESVC.EXE"
SCardSvr = C:\WINDOWS\SYSTEM32\SCARDSVR.EXE
Schedule = C:\WINDOWS\SYSTEM32\SVCHOST.EXE -K NETSVCS
seclogon = C:\WINDOWS\SYSTEM32\SVCHOST.EXE -K NETSVCS
SENS = C:\WINDOWS\SYSTEM32\SVCHOST.EXE -K NETSVCS
SharedAccess = C:\WINDOWS\SYSTEM32\SVCHOST.EXE -K NETSVCS
ShellHWDetection = C:\WINDOWS\SYSTEM32\SVCHOST.EXE -K NETSVCS
Spooler = C:\WINDOWS\SYSTEM32\SPOOLSV.EXE
srservice = C:\WINDOWS\SYSTEM32\SVCHOST.EXE -K NETSVCS
SSDPSRV = C:\WINDOWS\SYSTEM32\SVCHOST.EXE -K LOCALSERVICE
stisvc = C:\WINDOWS\SYSTEM32\SVCHOST.EXE -K IMGSVC
SwPrv = C:\WINDOWS\SYSTEM32\DLLHOST.EXE /PROCESSID:{736153B1-B3B4-4FAF-B875-C5AA11CCFBF6}
SysmonLog = C:\WINDOWS\SYSTEM32\SMLOGSVC.EXE
TapiSrv = C:\WINDOWS\SYSTEM32\SVCHOST.EXE -K NETSVCS
TermService = C:\WINDOWS\SYSTEM32\SVCHOST -K DCOMLAUNCH
Themes = C:\WINDOWS\SYSTEM32\SVCHOST.EXE -K NETSVCS
TlntSvr = C:\WINDOWS\SYSTEM32\TLNTSVR.EXE
TrkWks = C:\WINDOWS\SYSTEM32\SVCHOST.EXE -K NETSVCS
upnphost = C:\WINDOWS\SYSTEM32\SVCHOST.EXE -K LOCALSERVICE
UPS = C:\WINDOWS\SYSTEM32\UPS.EXE
VSS = C:\WINDOWS\SYSTEM32\VSSVC.EXE
W32Time = C:\WINDOWS\SYSTEM32\SVCHOST.EXE -K NETSVCS
WebClient = C:\WINDOWS\SYSTEM32\SVCHOST.EXE -K LOCALSERVICE
winmgmt = C:\WINDOWS\SYSTEM32\SVCHOST.EXE -K NETSVCS
WmdmPmSN = C:\WINDOWS\SYSTEM32\SVCHOST.EXE -K NETSVCS
Wmi = C:\WINDOWS\SYSTEM32\SVCHOST.EXE -K NETSVCS
WmiApSrv = C:\WINDOWS\SYSTEM32\WBEM\WMIAPSRV.EXE
WMPNetworkSvc = "C:\PROGRAM FILES\WINDOWS MEDIA PLAYER\WMPNETWK.EXE"
wscsvc = C:\WINDOWS\SYSTEM32\SVCHOST.EXE -K NETSVCS
wuauserv = C:\WINDOWS\SYSTEM32\SVCHOST.EXE -K NETSVCS
WZCSVC = C:\WINDOWS\SYSTEM32\SVCHOST.EXE -K NETSVCS
xmlprov = C:\WINDOWS\SYSTEM32\SVCHOST.EXE -K NETSVCS

文件驱动
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services
FltMgr = C:\WINDOWS\SYSTEM32\DRIVERS\FLTMGR.SYS
MRxDAV = C:\WINDOWS\SYSTEM32\DRIVERS\MRXDAV.SYS
MRxSmb = C:\WINDOWS\SYSTEM32\DRIVERS\MRXSMB.SYS
NetBIOS = C:\WINDOWS\SYSTEM32\DRIVERS\NETBIOS.SYS
Rdbss = C:\WINDOWS\SYSTEM32\DRIVERS\RDBSS.SYS
sr = C:\WINDOWS\SYSTEM32\DRIVERS\SR.SYS
SRTSP = C:\WINDOWS\SYSTEM32\DRIVERS\NAV\1002000.007\SRTSP.SYS
Srv = C:\WINDOWS\SYSTEM32\DRIVERS\SRV.SYS
SymEFA = C:\WINDOWS\SYSTEM32\DRIVERS\NAV\1002000.007\SYMEFA.SYS

系统驱动项
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services
360AntiArp = C:\WINDOWS\SYSTEM32\DRIVERS\360ANTIARP.SYS
360procmon = C:\PROGRAM FILES\360\360SAFE\SAFEMON\360PROCMON.SYS
ac97intc = C:\WINDOWS\SYSTEM32\DRIVERS\AC97INTC.SYS
ACPI = C:\WINDOWS\SYSTEM32\DRIVERS\ACPI.SYS
aec = C:\WINDOWS\SYSTEM32\DRIVERS\AEC.SYS
AFD = C:\WINDOWS\SYSTEM32\DRIVERS\AFD.SYS
agp440 = C:\WINDOWS\SYSTEM32\DRIVERS\AGP440.SYS
AliIde = C:\WINDOWS\SYSTEM32\DRIVERS\ALIIDE.SYS
AmdK8 = C:\WINDOWS\SYSTEM32\DRIVERS\AMDK8.SYS
ASTTools = C:\DOCUME~1\ADMINI~1\LOCALS~1\TEMP\RARSFX0\FILED.SYS
AsyncMac = C:\WINDOWS\SYSTEM32\DRIVERS\ASYNCMAC.SYS
atapi = C:\WINDOWS\SYSTEM32\DRIVERS\ATAPI.SYS
Atmarpc = C:\WINDOWS\SYSTEM32\DRIVERS\ATMARPC.SYS
audstub = C:\WINDOWS\SYSTEM32\DRIVERS\AUDSTUB.SYS
BHDrvx86 = C:\WINDOWS\SYSTEM32\DRIVERS\NAV\1002000.007\BHDRVX86.SYS
ccHP = C:\WINDOWS\SYSTEM32\DRIVERS\NAV\1002000.007\CCHPX86.SYS
Cdrom = C:\WINDOWS\SYSTEM32\DRIVERS\CDROM.SYS
CmdIde = C:\WINDOWS\SYSTEM32\DRIVERS\CMDIDE.SYS
Disk = C:\WINDOWS\SYSTEM32\DRIVERS\DISK.SYS
dmboot = C:\WINDOWS\SYSTEM32\DRIVERS\DMBOOT.SYS
dmio = C:\WINDOWS\SYSTEM32\DRIVERS\DMIO.SYS
dmload = C:\WINDOWS\SYSTEM32\DRIVERS\DMLOAD.SYS
DMusic = C:\WINDOWS\SYSTEM32\DRIVERS\DMUSIC.SYS
drmkaud = C:\WINDOWS\SYSTEM32\DRIVERS\DRMKAUD.SYS
eeCtrl = C:\PROGRAM FILES\COMMON FILES\SYMANTEC SHARED\EENGINE\EECTRL.SYS
EraserUtilRebootDrv = C:\PROGRAM FILES\COMMON FILES\SYMANTEC SHARED\EENGINE\ERASERUTILREBOOTDRV.SYS
Fdc = C:\WINDOWS\SYSTEM32\DRIVERS\FDC.SYS
FETNDIS = C:\WINDOWS\SYSTEM32\DRIVERS\FETND5.SYS
Flpydisk = C:\WINDOWS\SYSTEM32\DRIVERS\FLPYDISK.SYS
FsVga = C:\WINDOWS\SYSTEM32\DRIVERS\FSVGA.SYS
Ftdisk = C:\WINDOWS\SYSTEM32\DRIVERS\FTDISK.SYS
gameenum = C:\WINDOWS\SYSTEM32\DRIVERS\GAMEENUM.SYS
Gpc = C:\WINDOWS\SYSTEM32\DRIVERS\MSGPC.SYS
HDAudBus = C:\WINDOWS\SYSTEM32\DRIVERS\HDAUDBUS.SYS
HidUsb = C:\WINDOWS\SYSTEM32\DRIVERS\HIDUSB.SYS
HTTP = C:\WINDOWS\SYSTEM32\DRIVERS\HTTP.SYS
i8042prt = C:\WINDOWS\SYSTEM32\DRIVERS\I8042PRT.SYS
ialm = C:\WINDOWS\SYSTEM32\DRIVERS\IALMNT5.SYS
IDSxpx86 = C:\DOCUMENTS AND SETTINGS\ALL USERS\APPLICATION DATA\NORTON\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NORTON\DEFINITIONS\IPSDEFS\20090115.001\IDSXPX86.SYS
Imapi = C:\WINDOWS\SYSTEM32\DRIVERS\IMAPI.SYS
IntcAzAudAddService = C:\WINDOWS\SYSTEM32\DRIVERS\RTKHDAUD.SYS
IntelIde = C:\WINDOWS\SYSTEM32\DRIVERS\INTELIDE.SYS
intelppm = C:\WINDOWS\SYSTEM32\DRIVERS\INTELPPM.SYS
Ip6Fw = C:\WINDOWS\SYSTEM32\DRIVERS\IP6FW.SYS
IpFilterDriver = C:\WINDOWS\SYSTEM32\DRIVERS\IPFLTDRV.SYS
IpInIp = C:\WINDOWS\SYSTEM32\DRIVERS\IPINIP.SYS
IpNat = C:\WINDOWS\SYSTEM32\DRIVERS\IPNAT.SYS
IPSec = C:\WINDOWS\SYSTEM32\DRIVERS\IPSEC.SYS
IRENUM = C:\WINDOWS\SYSTEM32\DRIVERS\IRENUM.SYS
isapnp = C:\WINDOWS\SYSTEM32\DRIVERS\ISAPNP.SYS
KAVBootC = C:\WINDOWS\SYSTEM32\DRIVERS\KAVBOOTC.SYS
Kbdclass = C:\WINDOWS\SYSTEM32\DRIVERS\KBDCLASS.SYS
kbdhid = C:\WINDOWS\SYSTEM32\DRIVERS\KBDHID.SYS
kmixer = C:\WINDOWS\SYSTEM32\DRIVERS\KMIXER.SYS
Mouclass = C:\WINDOWS\SYSTEM32\DRIVERS\MOUCLASS.SYS
mouhid = C:\WINDOWS\SYSTEM32\DRIVERS\MOUHID.SYS
MSKSSRV = C:\WINDOWS\SYSTEM32\DRIVERS\MSKSSRV.SYS
MSPCLOCK = C:\WINDOWS\SYSTEM32\DRIVERS\MSPCLOCK.SYS
MSPQM = C:\WINDOWS\SYSTEM32\DRIVERS\MSPQM.SYS
mssmbios = C:\WINDOWS\SYSTEM32\DRIVERS\MSSMBIOS.SYS
ms_mpu401 = C:\WINDOWS\SYSTEM32\DRIVERS\MSMPU401.SYS
NAVENG = C:\DOCUMENTS AND SETTINGS\ALL USERS\APPLICATION DATA\NORTON\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NORTON\DEFINITIONS\VIRUSDEFS\20090122.053\NAVENG.SYS
NAVEX15 = C:\DOCUMENTS AND SETTINGS\ALL USERS\APPLICATION DATA\NORTON\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NORTON\DEFINITIONS\VIRUSDEFS\20090122.053\NAVEX15.SYS
NdisTapi = C:\WINDOWS\SYSTEM32\DRIVERS\NDISTAPI.SYS
Ndisuio = C:\WINDOWS\SYSTEM32\DRIVERS\NDISUIO.SYS
NdisWan = C:\WINDOWS\SYSTEM32\DRIVERS\NDISWAN.SYS
NetBT = C:\WINDOWS\SYSTEM32\DRIVERS\NETBT.SYS
nm = C:\WINDOWS\SYSTEM32\DRIVERS\NMNT.SYS
NPF = C:\WINDOWS\SYSTEM32\DRIVERS\NPF.SYS
nv = C:\WINDOWS\SYSTEM32\DRIVERS\NV4_MINI.SYS
NwlnkFlt = C:\WINDOWS\SYSTEM32\DRIVERS\NWLNKFLT.SYS
NwlnkFwd = C:\WINDOWS\SYSTEM32\DRIVERS\NWLNKFWD.SYS
P3 = C:\WINDOWS\SYSTEM32\DRIVERS\P3.SYS
Packet = C:\WINDOWS\SYSTEM32\DRIVERS\PROTODRV.SYS
Parport = C:\WINDOWS\SYSTEM32\DRIVERS\PARPORT.SYS
PCI = C:\WINDOWS\SYSTEM32\DRIVERS\PCI.SYS
PCIIde = C:\WINDOWS\SYSTEM32\DRIVERS\PCIIDE.SYS
PptpMiniport = C:\WINDOWS\SYSTEM32\DRIVERS\RASPPTP.SYS
PSched = C:\WINDOWS\SYSTEM32\DRIVERS\PSCHED.SYS
Ptilink = C:\WINDOWS\SYSTEM32\DRIVERS\PTILINK.SYS
QKeyService = C:\WINDOWS\SYSTEM32\KEYCRYPT.SYS
RasAcd = C:\WINDOWS\SYSTEM32\DRIVERS\RASACD.SYS
Rasl2tp = C:\WINDOWS\SYSTEM32\DRIVERS\RASL2TP.SYS
RasPppoe = C:\WINDOWS\SYSTEM32\DRIVERS\RASPPPOE.SYS
Raspti = C:\WINDOWS\SYSTEM32\DRIVERS\RASPTI.SYS
RDPCDD = C:\WINDOWS\SYSTEM32\DRIVERS\RDPCDD.SYS
rdpdr = C:\WINDOWS\SYSTEM32\DRIVERS\RDPDR.SYS
redbook = C:\WINDOWS\SYSTEM32\DRIVERS\REDBOOK.SYS
RfwBase9 = C:\WINDOWS\SYSTEM32\DRIVERS\RFWBASE.SYS
rfwtdi = C:\PROGRAM FILES\RISING\RFW\RFWTDI.SYS
rsfwdrv = C:\PROGRAM FILES\RISING\RFW\RSFWDRV.SYS
RTL8023xp = C:\WINDOWS\SYSTEM32\DRIVERS\RTNICXP.SYS
SafeBoxKrnl = C:\WINDOWS\SYSTEM32\DRIVERS\SAFEBOXKRNL.SYS
SbieDrv = C:\PROGRAM FILES\SANDBOXIE\SBIEDRV.SYS
Secdrv = C:\WINDOWS\SYSTEM32\DRIVERS\SECDRV.SYS
Ser2pl = C:\WINDOWS\SYSTEM32\DRIVERS\SER2PL.SYS
serenum = C:\WINDOWS\SYSTEM32\DRIVERS\SERENUM.SYS
Serial = C:\WINDOWS\SYSTEM32\DRIVERS\SERIAL.SYS
sermouse = C:\WINDOWS\SYSTEM32\DRIVERS\SERMOUSE.SYS
splitter = C:\WINDOWS\SYSTEM32\DRIVERS\SPLITTER.SYS
SRTSPX = C:\WINDOWS\SYSTEM32\DRIVERS\NAV\1002000.007\SRTSPX.SYS
swenum = C:\WINDOWS\SYSTEM32\DRIVERS\SWENUM.SYS
swmidi = C:\WINDOWS\SYSTEM32\DRIVERS\SWMIDI.SYS
SYMDNS = C:\WINDOWS\SYSTEM32\DRIVERS\NAV\1002000.007\SYMDNS.SYS
SymEvent = C:\WINDOWS\SYSTEM32\DRIVERS\SYMEVENT.SYS
SYMFW = C:\WINDOWS\SYSTEM32\DRIVERS\NAV\1002000.007\SYMFW.SYS
SYMIDS = C:\WINDOWS\SYSTEM32\DRIVERS\NAV\1002000.007\SYMIDS.SYS
SymIM = C:\WINDOWS\SYSTEM32\DRIVERS\SYMIM.SYS
SymIMMP = C:\WINDOWS\SYSTEM32\DRIVERS\SYMIM.SYS
SYMNDIS = C:\WINDOWS\SYSTEM32\DRIVERS\NAV\1002000.007\SYMNDIS.SYS
SYMREDRV = C:\WINDOWS\SYSTEM32\DRIVERS\NAV\1002000.007\SYMREDRV.SYS
SYMTDI = C:\WINDOWS\SYSTEM32\DRIVERS\NAV\1002000.007\SYMTDI.SYS
sysaudio = C:\WINDOWS\SYSTEM32\DRIVERS\SYSAUDIO.SYS
Tcpip = C:\WINDOWS\SYSTEM32\DRIVERS\TCPIP.SYS
TermDD = C:\WINDOWS\SYSTEM32\DRIVERS\TERMDD.SYS
TesDrvPt = C:\WINDOWS\SYSTEM32\TESDRVPT.SYS
TesSafe = C:\WINDOWS\SYSTEM32\TESSAFE.SYS
Update = C:\WINDOWS\SYSTEM32\DRIVERS\UPDATE.SYS
usbccgp = C:\WINDOWS\SYSTEM32\DRIVERS\USBCCGP.SYS
usbehci = C:\WINDOWS\SYSTEM32\DRIVERS\USBEHCI.SYS
usbhub = C:\WINDOWS\SYSTEM32\DRIVERS\USBHUB.SYS
USBOHCI = C:\WINDOWS\SYSTEM32\DRIVERS\USBOHCI.SYS
USBSTOR = C:\WINDOWS\SYSTEM32\DRIVERS\USBSTOR.SYS
usbuhci = C:\WINDOWS\SYSTEM32\DRIVERS\USBUHCI.SYS
VgaSave = C:\WINDOWS\SYSTEM32\DRIVERS\VGA.SYS
Wanarp = C:\WINDOWS\SYSTEM32\DRIVERS\WANARP.SYS
wdmaud = C:\WINDOWS\SYSTEM32\DRIVERS\WDMAUD.SYS