[C:\WINDOWS\system32\EBPMON2.DLL] [SEIKO EPSON CORPORATION, 2, 34, 0, 0]
[f:\新建文件夹 (3)\rising\rfw\ijt_base.dll] [Beijing Rising Technology Co., Ltd., 7.0.0.10]
[f:\新建文件夹 (3)\rising\rfw\olemon.dll] [Beijing Rising Technology Co., Ltd., 7.0.0.6]
[PID: 1948][f:\新建文件夹 (3)\rising\rfw\RfwMain.exe] [Beijing Rising Technology Co., Ltd., 7.0.1.65]
[C:\WINDOWS\system32\MFC71.DLL] [Microsoft Corporation, 7.10.3077.0]
[C:\WINDOWS\system32\MSVCR71.dll] [Microsoft Corporation, 7.10.3052.4]
[C:\WINDOWS\system32\MSVCP71.dll] [Microsoft Corporation, 7.10.3077.0]
[f:\新建文件夹 (3)\rising\rfw\RsGuiLib.dll] [Beijing Rising Technology Co., Ltd., 20, 0, 0, 88]
[C:\WINDOWS\system32\MFC71CHS.DLL] [Microsoft Corporation, 7.10.3077.0]
[F:\新建文件夹 (3)\Rising\Rfw\ProcCom.dll] [Beijing Rising Technology Co., Ltd., 20, 0, 0, 19]
[f:\新建文件夹 (3)\rising\rfw\RsCommX2.dll] [Beijing Rising Technology Co., Ltd., 20, 0, 0, 19]
[f:\新建文件夹 (3)\rising\rfw\RSAPPMGR.dll] [Beijing Rising Technology Co., Ltd., 20.0.0.0]
[f:\新建文件夹 (3)\rising\rfw\CfgDll.dll] [Beijing Rising Technology Co., Ltd., 20.0.0.16]
[f:\新建文件夹 (3)\rising\rfw\RSCOMMON.DLL] [Beijing Rising Technology Co., Ltd., 20, 0, 0, 16]
[f:\新建文件夹 (3)\rising\rfw\RfwCtrl.dll] [Beijing Rising Technology Co., Ltd., 7.0.0.7]
[f:\新建文件夹 (3)\rising\rfw\RsXML.dll] [Beijing Rising Technology Co., Ltd., 20, 0, 0, 0]
[f:\新建文件夹 (3)\rising\rfw\PngDll.dll] [Beijing Rising Technology Co., Ltd., 20, 0, 0, 4]
[f:\新建文件夹 (3)\rising\rfw\ijt_base.dll] [Beijing Rising Technology Co., Ltd., 7.0.0.10]
[f:\新建文件夹 (3)\rising\rfw\olemon.dll] [Beijing Rising Technology Co., Ltd., 7.0.0.6]
[f:\新建文件夹 (3)\rising\rfw\RfwRule.dll] [Beijing Rising Technology Co., Ltd., 7.0.0.13]
[F:\临时文件\360safe\safemon\safemon.dll] [360.CN, 4, 1, 5, 1001]
[PID: 264][C:\Program Files\Symantec AntiVirus\DefWatch.exe] [Symantec Corporation, 9.0.0.338]
[f:\新建文件夹 (3)\rising\rfw\ijt_base.dll] [Beijing Rising Technology Co., Ltd., 7.0.0.10]
[f:\新建文件夹 (3)\rising\rfw\olemon.dll] [Beijing Rising Technology Co., Ltd., 7.0.0.6]
[PID: 296][C:\Program Files\Common Files\EPSON\EBAPI\SAgent2.exe] [SEIKO EPSON CORPORATION, 2, 3, 0, 0]
[C:\WINDOWS\system32\EBAPI2.DLL] [SEIKO EPSON CORPORATION, 1, 4, 0, 0]
[C:\Program Files\Common Files\EPSON\EBAPI\EBPLPT.DLL] [SEIKO EPSON CORPORATION, 2, 26, 0, 0]
[f:\新建文件夹 (3)\rising\rfw\ijt_base.dll] [Beijing Rising Technology Co., Ltd., 7.0.0.10]
[f:\新建文件夹 (3)\rising\rfw\olemon.dll] [Beijing Rising Technology Co., Ltd., 7.0.0.6]
[PID: 344][C:\WINDOWS\system32\svchost.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[f:\新建文件夹 (3)\rising\rfw\ijt_base.dll] [Beijing Rising Technology Co., Ltd., 7.0.0.10]
[f:\新建文件夹 (3)\rising\rfw\olemon.dll] [Beijing Rising Technology Co., Ltd., 7.0.0.6]
[PID: 356][C:\PROGRA~1\SYMANT~1\VPTray.exe] [Symantec Corporation, 9.0.0.338]
[f:\新建文件夹 (3)\rising\rfw\ijt_base.dll] [Beijing Rising Technology Co., Ltd., 7.0.0.10]
[f:\新建文件夹 (3)\rising\rfw\olemon.dll] [Beijing Rising Technology Co., Ltd., 7.0.0.6]
[C:\Program Files\Symantec AntiVirus\SAVRT32.DLL] [Symantec Corporation, 9.3.0.28]
[C:\Program Files\Symantec AntiVirus\Cliscan.dll] [Symantec Corporation, 9.0.0.338]
[C:\PROGRA~1\SYMANT~1\NAVNTUTL.DLL] [Symantec Corporation, 9.0.0.338]
[C:\Program Files\Symantec AntiVirus\Cliproxy.dll] [Symantec Corporation, 9.0.0.338]
[F:\临时文件\360safe\safemon\safemon.dll] [360.CN, 4, 1, 5, 1001]
[PID: 892][C:\Program Files\Symantec AntiVirus\Rtvscan.exe] [Symantec Corporation, 9.0.0.338]
[C:\WINDOWS\system32\CBA.DLL] [Intel? Corporation, 6.12.0.112 E]
[C:\WINDOWS\system32\MsgSys.dll] [Intel? Corporation, 6.12.0.112 E]
[C:\WINDOWS\system32\NTS.dll] [Intel? Corporation, 6.12.0.112 E]
[C:\WINDOWS\system32\PDS.DLL] [Intel? Corporation, 6.12.0.112 E]
[C:\Program Files\Symantec AntiVirus\NAVLU.dll] [Symantec Corporation, 9.0.0.338]
[C:\Program Files\Symantec AntiVirus\I2ldvp3.dll] [Symantec Corporation, 9.0.0.338]
[C:\Program Files\Symantec AntiVirus\ecmldr32.DLL] [Symantec Corp., 1.1.0.3]
[C:\Program Files\Symantec AntiVirus\SAVRT32.DLL] [Symantec Corporation, 9.3.0.28]
[C:\Program Files\Symantec AntiVirus\NAVNTUTL.DLL] [Symantec Corporation, 9.0.0.338]
[C:\PROGRA~1\COMMON~1\SYMANT~1\VIRUSD~1\20080601.004\ecmsvr32.dll] [Symantec Corporation, 71.4.0.15]
[C:\PROGRA~1\COMMON~1\SYMANT~1\VIRUSD~1\20080601.004\NAVEX32a.DLL] [Symantec Corporation, 20071.4.3.10]
[C:\PROGRA~1\COMMON~1\SYMANT~1\VIRUSD~1\20080601.004\NAVENG32.DLL] [Symantec Corporation, 20071.4.3.10]
[C:\Program Files\Symantec AntiVirus\IMail.dll] [Symantec Corporation, 9.0.0.338]
[C:\Program Files\Symantec AntiVirus\NotesExt.dll] [Symantec Corporation, 9.0.0.338]
[C:\Program Files\Symantec AntiVirus\vpmsece.dll] [Symantec Corporation, 9.0.0.338]
[C:\Program Files\Common Files\Symantec Shared\SSC\scandlgs.dll] [Symantec Corporation, 9.0.0.338]
[C:\Program Files\Symantec AntiVirus\DecSDK.dll] [Symantec Corporation, 3.02.11.32]
[C:\Program Files\Symantec AntiVirus\Dec2.dll] [Symantec Corporation, 3.02.11.32]
[C:\Program Files\Symantec AntiVirus\Dec2ID.dll] [Symantec Corporation, 3.02.11.32]
[C:\Program Files\Symantec AntiVirus\Dec2ZIP.dll] [Symantec Corporation, 3.02.11.32]
[C:\Program Files\Symantec AntiVirus\Dec2SS.dll] [Symantec Corporation, 3.02.11.32]
[C:\Program Files\Symantec AntiVirus\Dec2GZIP.dll] [Symantec Corporation, 3.02.11.32]
[C:\Program Files\Symantec AntiVirus\Dec2CAB.dll] [Symantec Corporation, 3.02.11.32]
[C:\Program Files\Symantec AntiVirus\Dec2LHA.dll] [Symantec Corporation, 3.02.11.32]
[C:\Program Files\Symantec AntiVirus\Dec2ARJ.dll] [Symantec Corporation, 3.02.11.32]
[C:\Program Files\Symantec AntiVirus\Dec2TNEF.dll] [Symantec Corporation, 3.02.11.32]
[C:\Program Files\Symantec AntiVirus\Dec2LZ.dll] [Symantec Corporation, 3.02.11.32]
[C:\Program Files\Symantec AntiVirus\Dec2AMG.dll] [Symantec Corporation, 3.02.11.32]
[C:\Program Files\Symantec AntiVirus\Dec2TAR.dll] [Symantec Corporation, 3.02.11.32]
[C:\Program Files\Symantec AntiVirus\Dec2RTF.dll] [Symantec Corporation, 3.02.11.32]
[C:\Program Files\Symantec AntiVirus\Dec2Text.dll] [Symantec Corporation, 3.02.11.32]
[PID: 1188][C:\WINDOWS\system32\ctfmon.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[f:\新建文件夹 (3)\rising\rfw\ijt_base.dll] [Beijing Rising Technology Co., Ltd., 7.0.0.10]
[f:\新建文件夹 (3)\rising\rfw\olemon.dll] [Beijing Rising Technology Co., Ltd., 7.0.0.6]
[F:\临时文件\360safe\safemon\safemon.dll] [360.CN, 4, 1, 5, 1001]
[PID: 1288][C:\WINDOWS\system32\wdfmgr.exe] [Microsoft Corporation, 5.2.3790.1230 built by: dnsrv(bld4act)]
[PID: 2160][C:\WINDOWS\System32\alg.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 3192][C:\WINDOWS\system32\conime.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[F:\临时文件\360safe\safemon\safemon.dll] [360.CN, 4, 1, 5, 1001]
[PID: 2140][C:\Program Files\Internet Explorer\iexplore.exe] [Microsoft Corporation, 6.00.2900.2180 (xpsp_sp2_rtm.040803-2158)]
[f:\新建文件夹 (3)\rising\rfw\ijt_base.dll] [Beijing Rising Technology Co., Ltd., 7.0.0.10]
[f:\新建文件夹 (3)\rising\rfw\olemon.dll] [Beijing Rising Technology Co., Ltd., 7.0.0.6]
[F:\临时文件\360safe\safemon\safemon.dll] [360.CN, 4, 1, 5, 1001]
[C:\Program Files\Microsoft Office\OFFICE11\msohev.dll] [Microsoft Corporation, 11.0.5510]
[C:\WINDOWS\system32\msacm32.drv] [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)]
[C:\WINDOWS\system32\UNISPIM6.IME] [北京紫光华宇软件股份有限公司, 6.1.0.6229]
[C:\WINDOWS\system32\Macromed\Flash\Flash9f.ocx] [Adobe Systems, Inc., 9,0,124,0]
[PID: 2668][C:\Program Files\WinRAR\WinRAR.exe] [N/A, ]
[F:\临时文件\360safe\safemon\safemon.dll] [360.CN, 4, 1, 5, 1001]
[C:\WINDOWS\system32\Audiodev.dll] [Microsoft Corporation, 5.2.3802.3802 built by: dnsrv(bld4act)]
[PID: 2860][C:\Program Files\Symantec AntiVirus\VPC32.EXE] [Symantec Corporation, 9.0.0.338]
[f:\新建文件夹 (3)\rising\rfw\ijt_base.dll] [Beijing Rising Technology Co., Ltd., 7.0.0.10]
[f:\新建文件夹 (3)\rising\rfw\olemon.dll] [Beijing Rising Technology Co., Ltd., 7.0.0.6]
[F:\临时文件\360safe\safemon\safemon.dll] [360.CN, 4, 1, 5, 1001]
[C:\Program Files\Common Files\Symantec Shared\SSC\LDVPTask.ocx] [Symantec Corporation, 9.0.0.338]
[C:\Program Files\Symantec AntiVirus\Cliscan.dll] [Symantec Corporation, 9.0.0.338]
[C:\Program Files\Symantec AntiVirus\NAVNTUTL.DLL] [Symantec Corporation, 9.0.0.338]
[C:\Program Files\Common Files\Symantec Shared\SSC\LDVPView.ocx] [Symantec Corporation, 9.0.0.338]
[C:\Program Files\Common Files\Symantec Shared\SSC\LDVPCtls.ocx] [Symantec Corporation, 9.0.0.338]
[C:\Program Files\Symantec AntiVirus\Cliproxy.dll] [Symantec Corporation, 9.0.0.338]
[C:\WINDOWS\system32\msacm32.drv] [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)]
[C:\Program Files\Common Files\Symantec Shared\SSC\scandlgs.dll] [Symantec Corporation, 9.0.0.338]
[PID: 2704][F:\临时文件\新建文件夹 (4)\SREngPS.EXE] [Smallfrogs Studio, 2.5.16.900]
[f:\新建文件夹 (3)\rising\rfw\ijt_base.dll] [Beijing Rising Technology Co., Ltd., 7.0.0.10]
[f:\新建文件夹 (3)\rising\rfw\olemon.dll] [Beijing Rising Technology Co., Ltd., 7.0.0.6]
[F:\临时文件\360safe\safemon\safemon.dll] [360.CN, 4, 1, 5, 1001]
[F:\临时文件\新建文件夹 (4)\Upload\3rdUpd.DLL] [Smallfrogs Studio, 2, 1, 0, 15]
==================================
文件关联
.TXT Error. [C:\WINDOWS\notepad.exe %1]
.EXE OK. ["%1" %*]
.COM OK. ["%1" %*]
.PIF OK. ["%1" %*]
.REG OK. [regedit.exe "%1"]
.BAT OK. ["%1" %*]
.SCR OK. ["%1" /S]
.CHM Error. ["hh.exe" %1]
.HLP Error. [C:\WINDOWS\system32\winhlp32.exe %1]
.INI Error. [C:\WINDOWS\System32\NOTEPAD.EXE %1]
.INF OK. [%SystemRoot%\System32\NOTEPAD.EXE %1]
.VBS OK. [%SystemRoot%\System32\WScript.exe "%1" %*]
.JS OK. [%SystemRoot%\System32\WScript.exe "%1" %*]
.LNK OK. [{00021401-0000-0000-C000-000000000046}]
==================================
Winsock 提供者
N/A
==================================
Autorun.inf
N/A
==================================
HOSTS 文件
127.0.0.2 localhost
==================================
进程特权扫描
特殊特权被允许： SeDebugPrivilege [PID = 2668, C:\PROGRAM FILES\WINRAR\WINRAR.EXE]
特殊特权被允许： SeLoadDriverPrivilege [PID = 2668, C:\PROGRAM FILES\WINRAR\WINRAR.EXE]
==================================
API HOOK
入口点错误：CreateProcessA (危险等级: 高, 被下面模块所HOOK: 0x00E81FFD)
入口点错误：CreateProcessW (危险等级: 高, 被下面模块所HOOK: 0x00E820E5)
==================================
隐藏进程
N/A
==================================
