未知家族病毒分析 扫描结果: 无可疑文件 系统活动进程 C:\PROGRAM FILES\RISING\RIS\RSTRAY.EXE C:\PROGRAM FILES\RISING\RIS\COMSERV.DLL C:\PROGRAM FILES\RISING\RIS\RSLANG.DLL C:\PROGRAM FILES\RISING\RIS\COMX3.DLL C:\PROGRAM FILES\RISING\RIS\SYSLAY.DLL C:\PROGRAM FILES\RISING\RIS\PROCCOMM.DLL C:\PROGRAM FILES\RISING\RIS\RSXML.DLL C:\PROGRAM FILES\RISING\RIS\MONSTATE.DLL C:\PROGRAM FILES\RISING\RIS\SCANEVNT.DLL C:\PROGRAM FILES\RISING\RIS\RSGUILIB.DLL C:\PROGRAM FILES\RISING\RIS\RSCONF.DLL C:\PROGRAM FILES\RISING\RIS\RFWRULE.DLL C:\WINDOWS\SYSTEM32\MSVCP71.DLL C:\WINDOWS\SYSTEM32\MSVCR71.DLL C:\PROGRAM FILES\RISING\RIS\RSPALVD.DLL C:\PROGRAM FILES\RISING\RIS\RSNETSVR.DLL C:\PROGRAM FILES\RISING\RIS\RAVBINTL.DLL C:\PROGRAM FILES\RISING\RIS\MRULEUI.DLL C:\PROGRAM FILES\RISING\RIS\MONTRAY.DLL C:\PROGRAM FILES\RISING\RIS\RAVITRAY.DLL C:\PROGRAM FILES\RISING\RIS\RFWTRAY.DLL C:\PROGRAM FILES\RISING\RIS\RSMGINFO.DLL C:\PROGRAM FILES\RISING\RIS\SCANLEAK.DLL C:\PROGRAM FILES\RISING\RIS\RAVPPOPS.DLL C:\PROGRAM FILES\RISING\RIS\RSAPPMGR.DLL C:\PROGRAM FILES\RISING\RIS\CFGDLL.DLL C:\PROGRAM FILES\RISING\RIS\PNGDLL.DLL C:\PROGRAM FILES\RISING\RIS\SCANPRXY.DLL C:\PROGRAM FILES\RISING\RIS\RFWLOG.DLL C:\PROGRAM FILES\RISING\ANTISPYWARE\RSTRAY.EXE C:\PROGRAM FILES\RISING\ANTISPYWARE\RSMGINFO.DLL C:\PROGRAM FILES\RISING\ANTISPYWARE\REGCALL.DLL C:\PROGRAM FILES\RISING\ANTISPYWARE\RSXML.DLL C:\PROGRAM FILES\RISING\ANTISPYWARE\COMSERV.DLL C:\PROGRAM FILES\RISING\ANTISPYWARE\SYSLAY.DLL C:\PROGRAM FILES\RISING\ANTISPYWARE\MSVCP71.DLL C:\PROGRAM FILES\RISING\ANTISPYWARE\MSVCR71.DLL C:\PROGRAM FILES\RISING\ANTISPYWARE\RSCOMMON.DLL C:\PROGRAM FILES\RISING\ANTISPYWARE\COMX3.DLL C:\PROGRAM FILES\RISING\ANTISPYWARE\RSXML1.DLL C:\PROGRAM FILES\RISING\ANTISPYWARE\PNGDLL.DLL C:\PROGRAM FILES\RISING\ANTISPYWARE\RUNIEP.DLL C:\PROGRAM FILES\RISING\ANTISPYWARE\NCOMM.DLL C:\PROGRAM FILES\RISING\ANTISPYWARE\PROCCOM.DLL C:\PROGRAM FILES\RISING\ANTISPYWARE\RSCOMMX2.DLL C:\PROGRAM FILES\RISING\RIS\RSSAFETY.EXE C:\WINDOWS\SYSTEM32\CTFMON.EXE C:\WINDOWS\SYSTEM32\SMSS.EXE C:\WINDOWS\SYSTEM32\CONIME.EXE C:\PROGRAM FILES\RISING\ANTISPYWARE\REGCALL.DLL C:\WINDOWS\SYSTEM32\SVCHOST.EXE C:\WINDOWS\SYSTEM32\WDFMGR.EXE C:\WINDOWS\SYSTEM32\CSRSS.EXE C:\WINDOWS\SYSTEM32\WINLOGON.EXE C:\WINDOWS\SYSTEM32\MSACM32.DRV C:\WINDOWS\SYSTEM32\SERVICES.EXE C:\WINDOWS\SYSTEM32\LSASS.EXE C:\WINDOWS\SYSTEM32\SVCHOST.EXE C:\WINDOWS\SYSTEM32\SVCHOST.EXE C:\PROGRAM FILES\RISING\RIS\RAVMOND.EXE C:\PROGRAM FILES\RISING\RIS\COMBASE.DLL C:\PROGRAM FILES\RISING\RIS\CNT09.DLL C:\PROGRAM FILES\RISING\RIS\MONCOMM.DLL C:\PROGRAM FILES\RISING\RIS\MONBASE.DLL C:\PROGRAM FILES\RISING\RIS\RSLOG.DLL C:\PROGRAM FILES\RISING\RIS\MONDRV.DLL C:\PROGRAM FILES\RISING\RIS\DEFMON.DLL C:\PROGRAM FILES\RISING\RIS\MONCOM08.DLL C:\PROGRAM FILES\RISING\RIS\MONRULE.DLL C:\PROGRAM FILES\RISING\RIS\FILEMON.DLL C:\PROGRAM FILES\RISING\RIS\MAILMON.DLL C:\PROGRAM FILES\RISING\RIS\HOOKWEB.DLL C:\PROGRAM FILES\RISING\RIS\RFWLOG.DLL C:\PROGRAM FILES\RISING\RIS\RFWRULE.DLL C:\WINDOWS\SYSTEM32\MSVCP71.DLL C:\WINDOWS\SYSTEM32\MSVCR71.DLL C:\PROGRAM FILES\RISING\RIS\RFWSRV.DLL C:\PROGRAM FILES\RISING\RIS\SYSLAY.DLL C:\PROGRAM FILES\RISING\RIS\MPORTS.DLL C:\PROGRAM FILES\RISING\RIS\RFWDRVC.DLL C:\PROGRAM FILES\RISING\RIS\RFWDRV.DLL C:\PROGRAM FILES\RISING\RIS\RFWARP.DLL C:\PROGRAM FILES\RISING\RIS\RSNETSVR.DLL C:\PROGRAM FILES\RISING\RIS\COMX3.DLL C:\PROGRAM FILES\RISING\RIS\URLRULE.DLL C:\PROGRAM FILES\RISING\RIS\RECOMP.DLL C:\PROGRAM FILES\RISING\RIS\REFS.DLL C:\PROGRAM FILES\RISING\RIS\VIRUSLIB.DLL C:\PROGRAM FILES\RISING\RIS\RELIBLDR.DLL C:\PROGRAM FILES\RISING\RIS\RFWPROXY.DLL C:\PROGRAM FILES\RISING\RIS\RSLANG.DLL C:\PROGRAM FILES\RISING\RIS\RSINDENT.DLL C:\PROGRAM FILES\RISING\RIS\TASKPLUG.DLL C:\PROGRAM FILES\RISING\RIS\SCANSRVP.DLL C:\PROGRAM FILES\RISING\RIS\CNT08.DLL C:\PROGRAM FILES\RISING\RIS\PROCCOMM.DLL C:\PROGRAM FILES\RISING\RIS\RSAPPMGR.DLL C:\PROGRAM FILES\RISING\RIS\CFGDLL.DLL C:\PROGRAM FILES\RISING\RIS\HOOKSYS.DLL C:\PROGRAM FILES\RISING\RIS\PROCCOM.DLL C:\PROGRAM FILES\RISING\RIS\RSCOMMX2.DLL C:\PROGRAM FILES\RISING\RIS\HOOKCONT.DLL C:\PROGRAM FILES\RISING\RIS\BACORE.DLL C:\PROGRAM FILES\RISING\RIS\BAWHITE.DLL C:\PROGRAM FILES\RISING\RIS\RSSTORE.DLL C:\PROGRAM FILES\RISING\RIS\SCANNER.DLL C:\PROGRAM FILES\RISING\RIS\SCANADD.DLL C:\PROGRAM FILES\RISING\RIS\NCOMM2.DLL C:\PROGRAM FILES\RISING\RIS\RSTASK.DLL C:\PROGRAM FILES\RISING\RIS\RSSTUB.DLL C:\PROGRAM FILES\RISING\RIS\SCANSRV.DLL C:\PROGRAM FILES\RISING\RIS\SCANPE.DLL C:\PROGRAM FILES\RISING\RIS\PEARC.DLL C:\PROGRAM FILES\RISING\RIS\UR000.DAT C:\PROGRAM FILES\RISING\RIS\URUTILS.DLL C:\PROGRAM FILES\RISING\RIS\REVM.DLL C:\PROGRAM FILES\RISING\RIS\UR025.DAT C:\PROGRAM FILES\RISING\RIS\FFR.DLL C:\PROGRAM FILES\RISING\RIS\NVFILE.DLL C:\PROGRAM FILES\RISING\RIS\SCANEXEC.DLL C:\PROGRAM FILES\RISING\RIS\UNEXE.DLL C:\PROGRAM FILES\RISING\RIS\SCANEX.DLL C:\PROGRAM FILES\RISING\RIS\URLLIB.DLL C:\PROGRAM FILES\RISING\RIS\UR001.DAT C:\PROGRAM FILES\RISING\RIS\SCANTJ.DLL C:\PROGRAM FILES\RISING\RIS\METHODEX.DLL C:\PROGRAM FILES\RISING\RIS\SCANRAVT.DLL C:\PROGRAM FILES\RISING\RIS\SCANBT.DLL C:\PROGRAM FILES\RISING\RIS\SCANSTUB.DLL C:\PROGRAM FILES\RISING\RIS\HEUREX.DLL C:\PROGRAM FILES\RISING\RIS\PECOMPD.DLL C:\PROGRAM FILES\RISING\RIS\EXTSFX.DLL C:\PROGRAM FILES\RISING\RIS\SCANSCT.DLL C:\PROGRAM FILES\RISING\RIS\EXTARCH.DLL C:\PROGRAM FILES\RISING\RIS\EXTCOMP.DLL C:\PROGRAM FILES\RISING\RIS\EXTOLE.DLL C:\PROGRAM FILES\RISING\RIS\EXTMAIL.DLL C:\WINDOWS\SYSTEM32\SVCHOST.EXE C:\WINDOWS\SYSTEM32\SVCHOST.EXE C:\WINDOWS\SYSTEM32\SVCHOST.EXE C:\WINDOWS\EXPLORER.EXE C:\PROGRAM FILES\RISING\ANTISPYWARE\REGCALL.DLL C:\WINDOWS\SYSTEM32\MSACM32.DRV C:\WINDOWS\SYSTEM32\SPOOLSV.EXE C:\WINDOWS\SYSTEM32\MDIMON.DLL C:\WINDOWS\SYSTEM32\SPOOL\PRTPROCS\W32X86\MDIPPR.DLL E:\RSDETECT.EXE C:\PROGRAM FILES\RISING\ANTISPYWARE\REGCALL.DLL C:\WINDOWS\SYSTEM32\ALG.EXE C:\WINDOWS\EXPLORER.EXE C:\PROGRAM FILES\RISING\ANTISPYWARE\REGCALL.DLL C:\PROGRAM FILES\THUNDER\COMDLLS\TDATONCE_NOW.DLL C:\PROGRAM FILES\THUNDER\COMDLLS\XUNLEIBHO_NOW.DLL C:\PROGRAM FILES\MICROSOFT OFFICE\OFFICE11\MSOHEV.DLL C:\WINDOWS\SYSTEM32\MSACM32.DRV 普通自启动项 HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run RisTray = "C:\PROGRAM FILES\RISING\RIS\RSTRAY.EXE" -SYSTEM runeip = "C:\PROGRAM FILES\RISING\ANTISPYWARE\RSTRAY.EXE" /STARTUP safety3 = "C:\PROGRAM FILES\RISING\RIS\RSSAFETY.EXE" /STARTUP HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run ctfmon.exe = C:\WINDOWS\SYSTEM32\CTFMON.EXE AppInit_DLLs HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows AppInit_DLLs = 系统文件关联 .exe ==> exefile = "%1" %* .com ==> comfile = "%1" %* .cmd ==> cmdfile = "%1" %* .bat ==> batfile = "%1" %* .txt ==> txtfile = C:\WINDOWS\notepad.exe %1 .scr ==> scrfile = "%1" /S .reg ==> regfile = regedit.exe "%1" .doc ==> Word.Document.8 = "C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE" /n /dde 其它启动项 WIN.INI 无信息 SYSTEM.INI SHELL = Explorer.exe SCRNSAVE.EXE = C:\WINDOWS\system32\pptv.scr Winlogon 启动项 HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify crypt32chain = CRYPT32.DLL cryptnet = CRYPTNET.DLL cscdll = CSCDLL.DLL igfxcui = IGFXSRVC.DLL ScCertProp = WLNOTIFY.DLL Schedule = WLNOTIFY.DLL sclgntfy = SCLGNTFY.DLL SensLogn = WLNOTIFY.DLL termsrv = WLNOTIFY.DLL wlballoon = WLNOTIFY.DLL HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon Userinit = C:\WINDOWS\SYSTEM32\USERINIT.EXE, shell = EXPLORER.EXE IE - BHO HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects {01443AEC-0FD1-40fd-9C87-E93D1494C233} = C:\Program Files\Thunder\ComDlls\TDAtOnce_Now.dll {889D2FEB-5411-4565-8998-1DD2C5261283} = C:\Program Files\Thunder\ComDlls\xunleiBHO_Now.dll {98B7C13A-E9CD-4959-8B46-FBEAB41E42A8} = C:\WINDOWS\system32\UrlFilter.dll Winsock SPI MSAFD Tcpip [TCP/IP] = C:\WINDOWS\SYSTEM32\MSWSOCK.DLL MSAFD Tcpip [UDP/IP] = C:\WINDOWS\SYSTEM32\MSWSOCK.DLL MSAFD Tcpip [RAW/IP] = C:\WINDOWS\SYSTEM32\MSWSOCK.DLL RSVP UDP Service Provider = C:\WINDOWS\SYSTEM32\RSVPSP.DLL RSVP TCP Service Provider = C:\WINDOWS\SYSTEM32\RSVPSP.DLL MSAFD NetBIOS [\Device\NetBT_Tcpip_{F784E4E2-2E04-4BAD-954F-C6E05988A28D}] SEQPACKET 0 = C:\WINDOWS\SYSTEM32\MSWSOCK.DLL MSAFD NetBIOS [\Device\NetBT_Tcpip_{F784E4E2-2E04-4BAD-954F-C6E05988A28D}] DATAGRAM 0 = C:\WINDOWS\SYSTEM32\MSWSOCK.DLL MSAFD NetBIOS [\Device\NetBT_Tcpip_{2F89D63F-17E9-4306-BC4B-0263AE9CCA1D}] SEQPACKET 1 = C:\WINDOWS\SYSTEM32\MSWSOCK.DLL MSAFD NetBIOS [\Device\NetBT_Tcpip_{2F89D63F-17E9-4306-BC4B-0263AE9CCA1D}] DATAGRAM 1 = C:\WINDOWS\SYSTEM32\MSWSOCK.DLL MSAFD NetBIOS [\Device\NetBT_Tcpip_{3AF3E2EB-8998-463D-B8CF-94AEC77AB819}] SEQPACKET 2 = C:\WINDOWS\SYSTEM32\MSWSOCK.DLL MSAFD NetBIOS [\Device\NetBT_Tcpip_{3AF3E2EB-8998-463D-B8CF-94AEC77AB819}] DATAGRAM 2 = C:\WINDOWS\SYSTEM32\MSWSOCK.DLL 系统服务项 HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services 3wareSrv = C:\WINDOWS\SYSTEM32\3WARESRV.EXE Alerter = C:\WINDOWS\SYSTEM32\SVCHOST.EXE -K LOCALSERVICE ALG = C:\WINDOWS\SYSTEM32\ALG.EXE AppMgmt = C:\WINDOWS\SYSTEM32\SVCHOST.EXE -K NETSVCS AudioSrv = C:\WINDOWS\SYSTEM32\SVCHOST.EXE -K NETSVCS BITS = C:\WINDOWS\SYSTEM32\SVCHOST.EXE -K NETSVCS Browser = C:\WINDOWS\SYSTEM32\SVCHOST.EXE -K NETSVCS ccosm = C:\PROGRAM FILES\STORMII\STORMLIV.EXE /ASSERVICE CiSvc = C:\WINDOWS\SYSTEM32\CISVC.EXE ClipSrv = C:\WINDOWS\SYSTEM32\CLIPSRV.EXE COMSysApp = C:\WINDOWS\SYSTEM32\DLLHOST.EXE /PROCESSID:{02D4B3F1-FD88-11D1-960D-00805FC79235} CryptSvc = C:\WINDOWS\SYSTEM32\SVCHOST.EXE -K NETSVCS DcomLaunch = C:\WINDOWS\SYSTEM32\SVCHOST -K DCOMLAUNCH Dhcp = C:\WINDOWS\SYSTEM32\SVCHOST.EXE -K NETSVCS dmadmin = C:\WINDOWS\SYSTEM32\DMADMIN.EXE /COM dmserver = C:\WINDOWS\SYSTEM32\SVCHOST.EXE -K NETSVCS Dnscache = C:\WINDOWS\SYSTEM32\SVCHOST.EXE -K NETWORKSERVICE ERSvc = C:\WINDOWS\SYSTEM32\SVCHOST.EXE -K NETSVCS Eventlog = C:\WINDOWS\SYSTEM32\SERVICES.EXE EventSystem = C:\WINDOWS\SYSTEM32\SVCHOST.EXE -K NETSVCS FastUserSwitchingCompatibility = C:\WINDOWS\SYSTEM32\SVCHOST.EXE -K NETSVCS helpsvc = C:\WINDOWS\SYSTEM32\SVCHOST.EXE -K NETSVCS HidServ = C:\WINDOWS\SYSTEM32\SVCHOST.EXE -K NETSVCS HTTPFilter = C:\WINDOWS\SYSTEM32\SVCHOST.EXE -K HTTPFILTER ImapiService = C:\WINDOWS\SYSTEM32\IMAPI.EXE lanmanserver = C:\WINDOWS\SYSTEM32\SVCHOST.EXE -K NETSVCS lanmanworkstation = C:\WINDOWS\SYSTEM32\SVCHOST.EXE -K NETSVCS LmHosts = C:\WINDOWS\SYSTEM32\SVCHOST.EXE -K LOCALSERVICE Messenger = C:\WINDOWS\SYSTEM32\SVCHOST.EXE -K NETSVCS mnmsrvc = C:\WINDOWS\SYSTEM32\MNMSRVC.EXE MSDTC = C:\WINDOWS\SYSTEM32\MSDTC.EXE MSIServer = C:\WINDOWS\SYSTEM32\MSIEXEC.EXE /V NetDDE = C:\WINDOWS\SYSTEM32\NETDDE.EXE NetDDEdsdm = C:\WINDOWS\SYSTEM32\NETDDE.EXE Netlogon = C:\WINDOWS\SYSTEM32\LSASS.EXE Netman = C:\WINDOWS\SYSTEM32\SVCHOST.EXE -K NETSVCS Nla = C:\WINDOWS\SYSTEM32\SVCHOST.EXE -K NETSVCS NtLmSsp = C:\WINDOWS\SYSTEM32\LSASS.EXE NtmsSvc = C:\WINDOWS\SYSTEM32\SVCHOST.EXE -K NETSVCS ose = "C:\PROGRAM FILES\COMMON FILES\MICROSOFT SHARED\SOURCE ENGINE\OSE.EXE" PlugPlay = C:\WINDOWS\SYSTEM32\SERVICES.EXE PolicyAgent = C:\WINDOWS\SYSTEM32\LSASS.EXE ProtectedStorage = C:\WINDOWS\SYSTEM32\LSASS.EXE RasAuto = C:\WINDOWS\SYSTEM32\SVCHOST.EXE -K NETSVCS RasMan = C:\WINDOWS\SYSTEM32\SVCHOST.EXE -K NETSVCS RDSessMgr = C:\WINDOWS\SYSTEM32\SESSMGR.EXE RemoteAccess = C:\WINDOWS\SYSTEM32\SVCHOST.EXE -K NETSVCS RemoteRegistry = C:\WINDOWS\SYSTEM32\SVCHOST.EXE -K LOCALSERVICE RpcLocator = C:\WINDOWS\SYSTEM32\LOCATOR.EXE RpcSs = C:\WINDOWS\SYSTEM32\SVCHOST -K RPCSS RsRisMon = "C:\PROGRAM FILES\RISING\RIS\RAVMOND.EXE" RSVP = C:\WINDOWS\SYSTEM32\RSVP.EXE SamSs = C:\WINDOWS\SYSTEM32\LSASS.EXE SCardSvr = C:\WINDOWS\SYSTEM32\SCARDSVR.EXE Schedule = C:\WINDOWS\SYSTEM32\SVCHOST.EXE -K NETSVCS seclogon = C:\WINDOWS\SYSTEM32\SVCHOST.EXE -K NETSVCS SENS = C:\WINDOWS\SYSTEM32\SVCHOST.EXE -K NETSVCS SharedAccess = C:\WINDOWS\SYSTEM32\SVCHOST.EXE -K NETSVCS ShellHWDetection = C:\WINDOWS\SYSTEM32\SVCHOST.EXE -K NETSVCS Spooler = C:\WINDOWS\SYSTEM32\SPOOLSV.EXE srservice = C:\WINDOWS\SYSTEM32\SVCHOST.EXE -K NETSVCS SSDPSRV = C:\WINDOWS\SYSTEM32\SVCHOST.EXE -K LOCALSERVICE stisvc = C:\WINDOWS\SYSTEM32\SVCHOST.EXE -K IMGSVC SwPrv = C:\WINDOWS\SYSTEM32\DLLHOST.EXE /PROCESSID:{AECA6A6B-723E-4DE1-8E86-A543A880ADB7} SysmonLog = C:\WINDOWS\SYSTEM32\SMLOGSVC.EXE TapiSrv = C:\WINDOWS\SYSTEM32\SVCHOST.EXE -K NETSVCS TermService = C:\WINDOWS\SYSTEM32\SVCHOST -K DCOMLAUNCH Themes = C:\WINDOWS\SYSTEM32\SVCHOST.EXE -K NETSVCS TlntSvr = C:\WINDOWS\SYSTEM32\TLNTSVR.EXE TrkWks = C:\WINDOWS\SYSTEM32\SVCHOST.EXE -K NETSVCS UMWdf = C:\WINDOWS\SYSTEM32\WDFMGR.EXE upnphost = C:\WINDOWS\SYSTEM32\SVCHOST.EXE -K LOCALSERVICE UPS = C:\WINDOWS\SYSTEM32\UPS.EXE VSS = C:\WINDOWS\SYSTEM32\VSSVC.EXE W32Time = C:\WINDOWS\SYSTEM32\SVCHOST.EXE -K NETSVCS WebClient = C:\WINDOWS\SYSTEM32\SVCHOST.EXE -K LOCALSERVICE winmgmt = C:\WINDOWS\SYSTEM32\SVCHOST.EXE -K NETSVCS WmdmPmSN = C:\WINDOWS\SYSTEM32\SVCHOST.EXE -K NETSVCS Wmi = C:\WINDOWS\SYSTEM32\SVCHOST.EXE -K NETSVCS WmiApSrv = C:\WINDOWS\SYSTEM32\WBEM\WMIAPSRV.EXE wscsvc = C:\WINDOWS\SYSTEM32\SVCHOST.EXE -K NETSVCS wuauserv = C:\WINDOWS\SYSTEM32\SVCHOST.EXE -K NETSVCS WZCSVC = C:\WINDOWS\SYSTEM32\SVCHOST.EXE -K NETSVCS xmlprov = C:\WINDOWS\SYSTEM32\SVCHOST.EXE -K NETSVCS 文件驱动 HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services FltMgr = C:\WINDOWS\SYSTEM32\DRIVERS\FLTMGR.SYS MRxDAV = C:\WINDOWS\SYSTEM32\DRIVERS\MRXDAV.SYS MRxSmb = C:\WINDOWS\SYSTEM32\DRIVERS\MRXSMB.SYS NetBIOS = C:\WINDOWS\SYSTEM32\DRIVERS\NETBIOS.SYS Rdbss = C:\WINDOWS\SYSTEM32\DRIVERS\RDBSS.SYS sr = C:\WINDOWS\SYSTEM32\DRIVERS\SR.SYS Srv = C:\WINDOWS\SYSTEM32\DRIVERS\SRV.SYS 系统驱动项 HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services aaatimeo = C:\WINDOWS\SYSTEM32\DRIVERS\AAATIMEO.SYS ACPI = C:\WINDOWS\SYSTEM32\DRIVERS\ACPI.SYS aec = C:\WINDOWS\SYSTEM32\DRIVERS\AEC.SYS AFAMgt = C:\WINDOWS\SYSTEM32\DRIVERS\AFAMGT.SYS AFD = C:\WINDOWS\SYSTEM32\DRIVERS\AFD.SYS agp440 = C:\WINDOWS\SYSTEM32\DRIVERS\AGP440.SYS agpCPQ = C:\WINDOWS\SYSTEM32\DRIVERS\AGPCPQ.SYS Aha154x = C:\WINDOWS\SYSTEM32\DRIVERS\AHA154X.SYS ahcix86 = C:\WINDOWS\SYSTEM32\DRIVERS\AHCIX86.SYS ALCXWDM = C:\WINDOWS\SYSTEM32\DRIVERS\ALCXWDM.SYS AliIde = C:\WINDOWS\SYSTEM32\DRIVERS\ALIIDE.SYS alim1541 = C:\WINDOWS\SYSTEM32\DRIVERS\ALIM1541.SYS amdagp = C:\WINDOWS\SYSTEM32\DRIVERS\AMDAGP.SYS amdbusdr = C:\WINDOWS\SYSTEM32\DRIVERS\AMDBUSDR.SYS amdeide = C:\WINDOWS\SYSTEM32\DRIVERS\AMDEIDE.SYS AmdK8 = C:\WINDOWS\SYSTEM32\DRIVERS\AMDK8.SYS asc3350p = C:\WINDOWS\SYSTEM32\DRIVERS\ASC3350P.SYS ASH1205 = C:\WINDOWS\SYSTEM32\DRIVERS\ASH1205.SYS AsyncMac = C:\WINDOWS\SYSTEM32\DRIVERS\ASYNCMAC.SYS ata1200a = C:\WINDOWS\SYSTEM32\DRIVERS\ATA1200A.SYS atapi = C:\WINDOWS\SYSTEM32\DRIVERS\ATAPI.SYS atiide = C:\WINDOWS\SYSTEM32\DRIVERS\ATIIDE.SYS Atmarpc = C:\WINDOWS\SYSTEM32\DRIVERS\ATMARPC.SYS audstub = C:\WINDOWS\SYSTEM32\DRIVERS\AUDSTUB.SYS bb-run = C:\WINDOWS\SYSTEM32\DRIVERS\BB-RUN.SYS cd20xrnt = C:\WINDOWS\SYSTEM32\DRIVERS\CD20XRNT.SYS Cdrom = C:\WINDOWS\SYSTEM32\DRIVERS\CDROM.SYS cercsr6 = C:\WINDOWS\SYSTEM32\DRIVERS\CERCSR6.SYS CmdIde = C:\WINDOWS\SYSTEM32\DRIVERS\CMDIDE.SYS Cpq32fs2 = C:\WINDOWS\SYSTEM32\DRIVERS\CPQ32FS2.SYS Disk = C:\WINDOWS\SYSTEM32\DRIVERS\DISK.SYS dmboot = C:\WINDOWS\SYSTEM32\DRIVERS\DMBOOT.SYS dmio = C:\WINDOWS\SYSTEM32\DRIVERS\DMIO.SYS dmload = C:\WINDOWS\SYSTEM32\DRIVERS\DMLOAD.SYS DMusic = C:\WINDOWS\SYSTEM32\DRIVERS\DMUSIC.SYS dontgo = C:\WINDOWS\SYSTEM32\DRIVERS\DONTGO.SYS drmkaud = C:\WINDOWS\SYSTEM32\DRIVERS\DRMKAUD.SYS Fdc = C:\WINDOWS\SYSTEM32\DRIVERS\FDC.SYS Flpydisk = C:\WINDOWS\SYSTEM32\DRIVERS\FLPYDISK.SYS FsVga = C:\WINDOWS\SYSTEM32\DRIVERS\FSVGA.SYS Ftdisk = C:\WINDOWS\SYSTEM32\DRIVERS\FTDISK.SYS fttxr52P = C:\WINDOWS\SYSTEM32\DRIVERS\FTTXR52P.SYS gameenum = C:\WINDOWS\SYSTEM32\DRIVERS\GAMEENUM.SYS Gpc = C:\WINDOWS\SYSTEM32\DRIVERS\MSGPC.SYS hidusb = C:\WINDOWS\SYSTEM32\DRIVERS\HIDUSB.SYS hookcont = C:\WINDOWS\SYSTEM32\DRIVERS\HOOKCONT.SYS hooksys = C:\WINDOWS\SYSTEM32\DRIVERS\HOOKSYS.SYS HpCISSm2 = C:\WINDOWS\SYSTEM32\DRIVERS\HPCISSM2.SYS hpn = C:\WINDOWS\SYSTEM32\DRIVERS\HPN.SYS hptmv6 = C:\WINDOWS\SYSTEM32\DRIVERS\HPTMV6.SYS HTTP = C:\WINDOWS\SYSTEM32\DRIVERS\HTTP.SYS i8042prt = C:\WINDOWS\SYSTEM32\DRIVERS\I8042PRT.SYS ialm = C:\WINDOWS\SYSTEM32\DRIVERS\IALMNT5.SYS iaStor55 = C:\WINDOWS\SYSTEM32\DRIVERS\IASTOR55.SYS iaStor70 = C:\WINDOWS\SYSTEM32\DRIVERS\IASTOR70.SYS Imapi = C:\WINDOWS\SYSTEM32\DRIVERS\IMAPI.SYS IntelIde = C:\WINDOWS\SYSTEM32\DRIVERS\INTELIDE.SYS intelppm = C:\WINDOWS\SYSTEM32\DRIVERS\INTELPPM.SYS Ip6Fw = C:\WINDOWS\SYSTEM32\DRIVERS\IP6FW.SYS IpFilterDriver = C:\WINDOWS\SYSTEM32\DRIVERS\IPFLTDRV.SYS IpInIp = C:\WINDOWS\SYSTEM32\DRIVERS\IPINIP.SYS IpNat = C:\WINDOWS\SYSTEM32\DRIVERS\IPNAT.SYS IPSec = C:\WINDOWS\SYSTEM32\DRIVERS\IPSEC.SYS IRENUM = C:\WINDOWS\SYSTEM32\DRIVERS\IRENUM.SYS isapnp = C:\WINDOWS\SYSTEM32\DRIVERS\ISAPNP.SYS Kbdclass = C:\WINDOWS\SYSTEM32\DRIVERS\KBDCLASS.SYS kbdhid = C:\WINDOWS\SYSTEM32\DRIVERS\KBDHID.SYS kmixer = C:\WINDOWS\SYSTEM32\DRIVERS\KMIXER.SYS Mouclass = C:\WINDOWS\SYSTEM32\DRIVERS\MOUCLASS.SYS mouhid = C:\WINDOWS\SYSTEM32\DRIVERS\MOUHID.SYS MSKSSRV = C:\WINDOWS\SYSTEM32\DRIVERS\MSKSSRV.SYS MSPCLOCK = C:\WINDOWS\SYSTEM32\DRIVERS\MSPCLOCK.SYS MSPQM = C:\WINDOWS\SYSTEM32\DRIVERS\MSPQM.SYS mssmbios = C:\WINDOWS\SYSTEM32\DRIVERS\MSSMBIOS.SYS ms_mpu401 = C:\WINDOWS\SYSTEM32\DRIVERS\MSMPU401.SYS mv61xx = C:\WINDOWS\SYSTEM32\DRIVERS\MV61XX.SYS mvSata = C:\WINDOWS\SYSTEM32\DRIVERS\MVSATA.SYS NdisTapi = C:\WINDOWS\SYSTEM32\DRIVERS\NDISTAPI.SYS Ndisuio = C:\WINDOWS\SYSTEM32\DRIVERS\NDISUIO.SYS NdisWan = C:\WINDOWS\SYSTEM32\DRIVERS\NDISWAN.SYS NetBT = C:\WINDOWS\SYSTEM32\DRIVERS\NETBT.SYS nvgts = C:\WINDOWS\SYSTEM32\DRIVERS\NVGTS.SYS nvrd32 = C:\WINDOWS\SYSTEM32\DRIVERS\NVRD32.SYS NwlnkFlt = C:\WINDOWS\SYSTEM32\DRIVERS\NWLNKFLT.SYS NwlnkFwd = C:\WINDOWS\SYSTEM32\DRIVERS\NWLNKFWD.SYS Parport = C:\WINDOWS\SYSTEM32\DRIVERS\PARPORT.SYS PCI = C:\WINDOWS\SYSTEM32\DRIVERS\PCI.SYS PCIIde = C:\WINDOWS\SYSTEM32\DRIVERS\PCIIDE.SYS PptpMiniport = C:\WINDOWS\SYSTEM32\DRIVERS\RASPPTP.SYS Processor = C:\WINDOWS\SYSTEM32\DRIVERS\PROCESSR.SYS PSched = C:\WINDOWS\SYSTEM32\DRIVERS\PSCHED.SYS Ptilink = C:\WINDOWS\SYSTEM32\DRIVERS\PTILINK.SYS ql2100 = C:\WINDOWS\SYSTEM32\DRIVERS\QL2100.SYS ql2200 = C:\WINDOWS\SYSTEM32\DRIVERS\QL2200.SYS RasAcd = C:\WINDOWS\SYSTEM32\DRIVERS\RASACD.SYS Rasl2tp = C:\WINDOWS\SYSTEM32\DRIVERS\RASL2TP.SYS RasPppoe = C:\WINDOWS\SYSTEM32\DRIVERS\RASPPPOE.SYS Raspti = C:\WINDOWS\SYSTEM32\DRIVERS\RASPTI.SYS RDPCDD = C:\WINDOWS\SYSTEM32\DRIVERS\RDPCDD.SYS rdpdr = C:\WINDOWS\SYSTEM32\DRIVERS\RDPDR.SYS redbook = C:\WINDOWS\SYSTEM32\DRIVERS\REDBOOK.SYS RFWARP = C:\WINDOWS\SYSTEM32\DRIVERS\RFWARP.SYS RfwBase9 = C:\WINDOWS\SYSTEM32\DRIVERS\RFWBASE.SYS rfwtdi = C:\PROGRAM FILES\RISING\RIS\RFWTDI.SYS rr172x = C:\WINDOWS\SYSTEM32\DRIVERS\RR172X.SYS rr174x = C:\WINDOWS\SYSTEM32\DRIVERS\RR174X.SYS rr2340 = C:\WINDOWS\SYSTEM32\DRIVERS\RR2340.SYS rsassist = C:\WINDOWS\SYSTEM32\DRIVERS\RSASSIST.SYS rsfwdrv = C:\PROGRAM FILES\RISING\RIS\RSFWDRV.SYS RsNTGDI = C:\WINDOWS\SYSTEM32\DRIVERS\RSNTGDI.SYS RsProtect = C:\WINDOWS\SYSTEM32\DRIVERS\RSPTECT.SYS RTL8023xp = C:\WINDOWS\SYSTEM32\DRIVERS\RTNICXP.SYS Secdrv = C:\WINDOWS\SYSTEM32\DRIVERS\SECDRV.SYS serenum = C:\WINDOWS\SYSTEM32\DRIVERS\SERENUM.SYS Serial = C:\WINDOWS\SYSTEM32\DRIVERS\SERIAL.SYS sermouse = C:\WINDOWS\SYSTEM32\DRIVERS\SERMOUSE.SYS SiRemFil = C:\WINDOWS\SYSTEM32\DRIVERS\SIREMFIL.SYS sisagp = C:\WINDOWS\SYSTEM32\DRIVERS\SISAGP.SYS sisraidx = C:\WINDOWS\SYSTEM32\DRIVERS\SISRAIDX.SYS splitter = C:\WINDOWS\SYSTEM32\DRIVERS\SPLITTER.SYS swenum = C:\WINDOWS\SYSTEM32\DRIVERS\SWENUM.SYS swmidi = C:\WINDOWS\SYSTEM32\DRIVERS\SWMIDI.SYS sysaudio = C:\WINDOWS\SYSTEM32\DRIVERS\SYSAUDIO.SYS Tcpip = C:\WINDOWS\SYSTEM32\DRIVERS\TCPIP.SYS TermDD = C:\WINDOWS\SYSTEM32\DRIVERS\TERMDD.SYS TosIde = C:\WINDOWS\SYSTEM32\DRIVERS\TOSIDE.SYS Update = C:\WINDOWS\SYSTEM32\DRIVERS\UPDATE.SYS usbccgp = C:\WINDOWS\SYSTEM32\DRIVERS\USBCCGP.SYS usbehci = C:\WINDOWS\SYSTEM32\DRIVERS\USBEHCI.SYS usbhub = C:\WINDOWS\SYSTEM32\DRIVERS\USBHUB.SYS usbohci = C:\WINDOWS\SYSTEM32\DRIVERS\USBOHCI.SYS USBSTOR = C:\WINDOWS\SYSTEM32\DRIVERS\USBSTOR.SYS usbuhci = C:\WINDOWS\SYSTEM32\DRIVERS\USBUHCI.SYS VgaSave = C:\WINDOWS\SYSTEM32\DRIVERS\VGA.SYS viaagp = C:\WINDOWS\SYSTEM32\DRIVERS\VIAAGP.SYS ViBus = C:\WINDOWS\SYSTEM32\DRIVERS\VIBUS.SYS videX32 = C:\WINDOWS\SYSTEM32\DRIVERS\VIDEX32.SYS ViPrt = C:\WINDOWS\SYSTEM32\DRIVERS\VIPRT.SYS Wanarp = C:\WINDOWS\SYSTEM32\DRIVERS\WANARP.SYS wdmaud = C:\WINDOWS\SYSTEM32\DRIVERS\WDMAUD.SYS xfilt = C:\WINDOWS\SYSTEM32\DRIVERS\XFILT.SYS