病毒也在测试09版本的？

我把09测试版的杀毒软件卸载了（是用杀毒软件自身的卸载方式），然后重装09测试版，出现中文简体界面点击下一步之后系统提示出现异常现象无法安装，试着安装了几次都是这样，查看安装文件夹（我不是安装在C盘里的），在其他盘里的内容全部清除了，可是在C盘里c:\Program Files\rising\settings和c:\RavBin有文件夹存在，我手动删除后，再次试着安装09测试版还是不行。我只好安装08版杀毒软件，可以安装，且使用也正常。
安装好08版后我试着不删除08版，直接安装09测试版，提示为更新，也很顺利的升级为09测试版，使用和升级都很正常。可是，升级完后安检发现病毒库还是提示没有及时更新。我的病毒库版本已经改变了，可能是杀毒软件自身的问题。


另外，我升级完杀毒软件在全盘杀毒过程中，系统出现警告提示杀毒软件已经关闭。我的杀毒软件一直在运行，我点击杀毒软件没有出现死机，还是正常运行和使用状态，我关闭杀毒软件再打开，系统警告提示依然存在。我重启后系统警告提示才消失。

我用卡卡“垃圾文件清理”功能，在清除垃圾文件时，发现杀毒软件有自我保护成功的页面跳出（我的杀毒软件自我保护功能设置的是自动进行只显示结果）。下面是我用卡卡清理的文件显示：
文件名  文件长度  清除标志
c:\Windows\temp\DMI6BC2.tmp  0KB  成功
c:\Users\home\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\907EDW9K\index［1］.htm  1KB  失败
c:\Users\home\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\907EDW9K\Logon［1］.htm  10KB  失败
c:\Users\home\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\907EDW9K\MatureQuestion［1］.htm  3KB  失败
c:\Users\home\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\desktop.ini  1KB  成功
c:\Users\home\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\PS2YFNZ9\freetools［1］.htm  2KB  成功
c:\Users\home\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\PS2YFNZ9\left［1］.htm  7KB  失败
c:\Users\home\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\PS2YFNZ9\main［1］.htm  1KB  失败
c:\Users\home\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\PS2YFNZ9\More［1］.htm  55KB  失败
c:\Users\home\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\WDAEAR03\game_list［1］.htm  76KB  失败
c:\Users\home\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\Y09PHZ8B\CANMZKZK  0KB  成功
c:\Users\home\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\Y09PHZ8B\CAPXY66K  0KB  成功
c:\Users\home\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\Y09PHZ8B\RecommendQuestion［1］.htm  6KB  失败
c:\Users\home\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\Y09PHZ8B\wbkB31F.tmp  1KB  成功
c:\Users\home\AppData\Local\Microsoft\Windows\Temporary Internet Files\desktop.ini  1KB 成功
c:\Users\home\AppData\Roaming\Microsoft\Windows\Recent\9.13全盘杀毒结果.jpg.lnk  1KB  成功
c:\Users\home\AppData\Roaming\Microsoft\Windows\Recent\新加卷(E).lnk  1KB  成功
c:\ProgramData\Microsoft\Search\Data\Applications\Windows\MSS.chk  8KB  成功
c:\ProgramData\Rising\Rav\Rsconfig.cfg.bak  252KB  失败
c:\ProgramData\Rising\Rav\RsConfig.cfg.tmp  252KB  失败
c:\Users\All Users\Microsoft\Search\Data\Applications\Windows\MSS.chk  8KB  失败
c:\Users\All Users\Rising\Rav\RsConfig.cfg.bak  252KB  失败
c:\Users\All Users\Rising\Rav\RsConfig.cfg.tmp  252KB  失败
c:\Users\home\AppData\Local\Microsoft Games\Minesweeper\MinesweeperSettings.xml.bak  121KB  成功
c:\Windows\SoftwareDistribution\DataStore\Logs\edb.chk  8KB  成功

注：游戏是系统自带的扫雷，卡卡清理垃圾文件时是断网状态。

我都用的好好的

开机杀毒还是运行不起来，IE浏览器点击被杀毒软件阻止，现在只能从卡卡里面点击网页可以打开。下载瑞星听诊器不行，可是换系统下载正常。
我还发现杀毒软件开机运行的时间晚了，在网卡程序和自动链接上网运行后才出现绿伞和监控已打开标志，不知道是不是系统有问题的原因。防火墙倒是最先运行的，没有变化。
用卡卡里面的诊断日志扫描了一个日志，用瑞星听诊器也扫描了一个日志，附件里面。看了一下，跟以前一样，没有扫描全。我这是正常运行和使用状态下扫描的，没有进入安全模式。
听诊器信息：

未知家族病毒分析
扫描结果:

无可疑文件

系统活动进程
C:\WINDOWS\SYSTEM32\IGFXSRVC.EXE

F:\RUIXING\FANGHUO\RISING\RFW\IJT_BASE.DLL
C:\WINDOWS\WINSXS\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_6.0.6001.18000_NONE_5CDBAA5A083979CC\COMCTL32.DLL
F:\RUIXING\FANGHUO\RISING\RFW\OLEMON.DLL
C:\WINDOWS\SYSTEM32\IGFXSRVC.DLL
C:\WINDOWS\SYSTEM32\IGFXDEV.DLL

C:\WINDOWS\SYSTEM32\TASKENG.EXE

C:\WINDOWS\WINSXS\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_6.0.6001.18000_NONE_5CDBAA5A083979CC\COMCTL32.DLL
F:\RUIXING\FANGHUO\RISING\RFW\IJT_BASE.DLL
F:\RUIXING\FANGHUO\RISING\RFW\OLEMON.DLL
C:\WINDOWS\SYSTEM32\WN.IME
F:\WUBI\SHIQIANG\WNIME\DLL32\WNPY_STATUSWND.DLL
C:\WINDOWS\WINSXS\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.6001.18000_NONE_886786F450A74A05\COMCTL32.DLL
F:\WUBI\SHIQIANG\WNIME\DLL32\WNPY_COMPWND.DLL
F:\WUBI\SHIQIANG\WNIME\DLL32\WNPY_QUERY.DLL
F:\WUBI\SHIQIANG\WNIME\DLL32\WNUPDATE.DLL
C:\WINDOWS\SYSTEM32\IGFXTMM.DLL
C:\WINDOWS\SYSTEM32\IGFXDEV.DLL

C:\WINDOWS\SYSTEM32\DWM.EXE

C:\WINDOWS\WINSXS\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_6.0.6001.18000_NONE_5CDBAA5A083979CC\COMCTL32.DLL

C:\WINDOWS\EXPLORER.EXE

C:\WINDOWS\WINSXS\X86_MICROSOFT.WINDOWS.GDIPLUS_6595B64144CCF1DF_1.0.6001.18065_NONE_9E7ABE2EC9C13222\GDIPLUS.DLL
C:\WINDOWS\WINSXS\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_6.0.6001.18000_NONE_5CDBAA5A083979CC\COMCTL32.DLL
C:\WINDOWS\SYSTEM32\WN.IME
F:\WUBI\SHIQIANG\WNIME\DLL32\WNPY_STATUSWND.DLL
F:\WUBI\SHIQIANG\WNIME\DLL32\WNPY_COMPWND.DLL
F:\WUBI\SHIQIANG\WNIME\DLL32\WNPY_QUERY.DLL
F:\WUBI\SHIQIANG\WNIME\DLL32\WNUPDATE.DLL

F:\RUIXING\FANGHUO\RISING\RFW\RFWMAIN.EXE

C:\WINDOWS\SYSTEM32\MFC71.DLL
C:\WINDOWS\SYSTEM32\MSVCR71.DLL
C:\WINDOWS\WINSXS\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_6.0.6001.18000_NONE_5CDBAA5A083979CC\COMCTL32.DLL
C:\WINDOWS\SYSTEM32\MSVCP71.DLL
F:\RUIXING\FANGHUO\RISING\RFW\RSGUILIB.DLL
F:\RUIXING\FANGHUO\RISING\RFW\PROCCOM.DLL
F:\RUIXING\FANGHUO\RISING\RFW\RSCOMMX2.DLL
F:\RUIXING\FANGHUO\RISING\RFW\RSAPPMGR.DLL
F:\RUIXING\FANGHUO\RISING\RFW\CFGDLL.DLL
F:\RUIXING\FANGHUO\RISING\RFW\RSCOMMON.DLL
F:\RUIXING\FANGHUO\RISING\RFW\RFWCTRL.DLL
F:\RUIXING\FANGHUO\RISING\RFW\RSXML.DLL
F:\RUIXING\FANGHUO\RISING\RFW\PNGDLL.DLL
F:\RUIXING\FANGHUO\RISING\RFW\RFWRULE.DLL

C:\WINDOWS\SYSTEM32\WUAUCLT.EXE

C:\WINDOWS\WINSXS\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_6.0.6001.18000_NONE_5CDBAA5A083979CC\COMCTL32.DLL
F:\RUIXING\FANGHUO\RISING\RFW\IJT_BASE.DLL
F:\RUIXING\FANGHUO\RISING\RFW\OLEMON.DLL

C:\PROGRAM FILES\HEWLETT-PACKARD\HP WIRELESS ASSISTANT\WIFIMSG.EXE

C:\WINDOWS\WINSXS\X86_MICROSOFT.WINDOWS.GDIPLUS_6595B64144CCF1DF_1.0.6001.18065_NONE_9E7ABE2EC9C13222\GDIPLUS.DLL
C:\WINDOWS\WINSXS\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.6001.18000_NONE_886786F450A74A05\COMCTL32.DLL
C:\WINDOWS\WINSXS\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_6.0.6001.18000_NONE_5CDBAA5A083979CC\COMCTL32.DLL
C:\WINDOWS\SYSTEM32\WN.IME
F:\WUBI\SHIQIANG\WNIME\DLL32\WNPY_STATUSWND.DLL
F:\WUBI\SHIQIANG\WNIME\DLL32\WNPY_COMPWND.DLL
F:\WUBI\SHIQIANG\WNIME\DLL32\WNPY_QUERY.DLL
F:\WUBI\SHIQIANG\WNIME\DLL32\WNUPDATE.DLL

C:\PROGRAM FILES\HEWLETT-PACKARD\SHARED\HPQTOASTER.EXE

C:\WINDOWS\WINSXS\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.6001.18000_NONE_886786F450A74A05\COMCTL32.DLL
C:\WINDOWS\WINSXS\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_6.0.6001.18000_NONE_5CDBAA5A083979CC\COMCTL32.DLL
F:\RUIXING\FANGHUO\RISING\RFW\IJT_BASE.DLL
F:\RUIXING\FANGHUO\RISING\RFW\OLEMON.DLL
C:\WINDOWS\SYSTEM32\WN.IME
F:\WUBI\SHIQIANG\WNIME\DLL32\WNPY_STATUSWND.DLL
F:\WUBI\SHIQIANG\WNIME\DLL32\WNPY_COMPWND.DLL
F:\WUBI\SHIQIANG\WNIME\DLL32\WNPY_QUERY.DLL
F:\WUBI\SHIQIANG\WNIME\DLL32\WNUPDATE.DLL

C:\PROGRAM FILES\WINDOWS DEFENDER\MSASCUI.EXE

C:\WINDOWS\WINSXS\X86_MICROSOFT.WINDOWS.GDIPLUS_6595B64144CCF1DF_1.0.6001.18065_NONE_9E7ABE2EC9C13222\GDIPLUS.DLL
C:\WINDOWS\WINSXS\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_6.0.6001.18000_NONE_5CDBAA5A083979CC\COMCTL32.DLL
C:\WINDOWS\SYSTEM32\WN.IME
F:\WUBI\SHIQIANG\WNIME\DLL32\WNPY_STATUSWND.DLL
F:\WUBI\SHIQIANG\WNIME\DLL32\WNPY_COMPWND.DLL
F:\WUBI\SHIQIANG\WNIME\DLL32\WNPY_QUERY.DLL
F:\WUBI\SHIQIANG\WNIME\DLL32\WNUPDATE.DLL

C:\PROGRAM FILES\HEWLETT-PACKARD\HP WIRELESS ASSISTANT\HPWAMAIN.EXE

C:\WINDOWS\WINSXS\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_6.0.6001.18000_NONE_5CDBAA5A083979CC\COMCTL32.DLL
C:\WINDOWS\SYSTEM32\WN.IME
F:\WUBI\SHIQIANG\WNIME\DLL32\WNPY_STATUSWND.DLL
F:\WUBI\SHIQIANG\WNIME\DLL32\WNPY_COMPWND.DLL
F:\WUBI\SHIQIANG\WNIME\DLL32\WNPY_QUERY.DLL
F:\WUBI\SHIQIANG\WNIME\DLL32\WNUPDATE.DLL

F:\RUIXING\KAKA\RISING\ANTISPYWARE\RSTRAY.EXE

C:\WINDOWS\WINSXS\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_6.0.6001.18000_NONE_5CDBAA5A083979CC\COMCTL32.DLL
F:\RUIXING\KAKA\RISING\ANTISPYWARE\RSMGINFO.DLL
C:\WINDOWS\SYSTEM32\WN.IME
F:\WUBI\SHIQIANG\WNIME\DLL32\WNPY_STATUSWND.DLL
F:\WUBI\SHIQIANG\WNIME\DLL32\WNPY_COMPWND.DLL
F:\WUBI\SHIQIANG\WNIME\DLL32\WNPY_QUERY.DLL
F:\WUBI\SHIQIANG\WNIME\DLL32\WNUPDATE.DLL
F:\RUIXING\KAKA\RISING\ANTISPYWARE\RSXML.DLL
F:\RUIXING\KAKA\RISING\ANTISPYWARE\MSVCP71.DLL
F:\RUIXING\KAKA\RISING\ANTISPYWARE\MSVCR71.DLL
F:\RUIXING\KAKA\RISING\ANTISPYWARE\COMSERV.DLL
F:\RUIXING\KAKA\RISING\ANTISPYWARE\SYSLAY.DLL
F:\RUIXING\KAKA\RISING\ANTISPYWARE\RSCOMMON.DLL
F:\RUIXING\KAKA\RISING\ANTISPYWARE\COMX3.DLL
F:\RUIXING\KAKA\RISING\ANTISPYWARE\PNGDLL.DLL
F:\RUIXING\KAKA\RISING\ANTISPYWARE\RUNIEP.DLL
F:\RUIXING\KAKA\RISING\ANTISPYWARE\NCOMM.DLL
F:\RUIXING\SHADU\RISING\RAV\PROCCOM.DLL
F:\RUIXING\SHADU\RISING\RAV\RSCOMMX2.DLL

C:\WINDOWS\SYSTEM32\IGFXTRAY.EXE

C:\WINDOWS\SYSTEM32\HCCUTILS.DLL
C:\WINDOWS\WINSXS\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_6.0.6001.18000_NONE_5CDBAA5A083979CC\COMCTL32.DLL
C:\WINDOWS\SYSTEM32\WN.IME
F:\WUBI\SHIQIANG\WNIME\DLL32\WNPY_STATUSWND.DLL
C:\WINDOWS\WINSXS\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.6001.18000_NONE_886786F450A74A05\COMCTL32.DLL
F:\WUBI\SHIQIANG\WNIME\DLL32\WNPY_COMPWND.DLL
F:\WUBI\SHIQIANG\WNIME\DLL32\WNPY_QUERY.DLL
F:\WUBI\SHIQIANG\WNIME\DLL32\WNUPDATE.DLL
C:\WINDOWS\SYSTEM32\IGFXSRVC.DLL
C:\WINDOWS\SYSTEM32\IGFXRCHS.LRC
C:\WINDOWS\SYSTEM32\IGFXRESS.DLL

C:\WINDOWS\SYSTEM32\HKCMD.EXE

C:\WINDOWS\SYSTEM32\HCCUTILS.DLL
C:\WINDOWS\WINSXS\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_6.0.6001.18000_NONE_5CDBAA5A083979CC\COMCTL32.DLL
C:\WINDOWS\SYSTEM32\IGFXSRVC.DLL
C:\WINDOWS\SYSTEM32\WN.IME
F:\WUBI\SHIQIANG\WNIME\DLL32\WNPY_STATUSWND.DLL
C:\WINDOWS\WINSXS\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.6001.18000_NONE_886786F450A74A05\COMCTL32.DLL
F:\WUBI\SHIQIANG\WNIME\DLL32\WNPY_COMPWND.DLL
F:\WUBI\SHIQIANG\WNIME\DLL32\WNPY_QUERY.DLL
F:\WUBI\SHIQIANG\WNIME\DLL32\WNUPDATE.DLL
C:\WINDOWS\SYSTEM32\IGFXRCHS.LRC

C:\WINDOWS\SYSTEM32\IGFXPERS.EXE

C:\WINDOWS\SYSTEM32\IGFXSRVC.DLL
C:\WINDOWS\SYSTEM32\WN.IME
C:\WINDOWS\WINSXS\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_6.0.6001.18000_NONE_5CDBAA5A083979CC\COMCTL32.DLL
F:\WUBI\SHIQIANG\WNIME\DLL32\WNPY_STATUSWND.DLL
C:\WINDOWS\WINSXS\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.6001.18000_NONE_886786F450A74A05\COMCTL32.DLL
F:\WUBI\SHIQIANG\WNIME\DLL32\WNPY_COMPWND.DLL
F:\WUBI\SHIQIANG\WNIME\DLL32\WNPY_QUERY.DLL
F:\WUBI\SHIQIANG\WNIME\DLL32\WNUPDATE.DLL

E:\RSDETECT.EXE

C:\WINDOWS\WINSXS\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.6001.18000_NONE_886786F450A74A05\COMCTL32.DLL
C:\WINDOWS\WINSXS\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_6.0.6001.18000_NONE_5CDBAA5A083979CC\COMCTL32.DLL
C:\WINDOWS\SYSTEM32\WN.IME
F:\WUBI\SHIQIANG\WNIME\DLL32\WNPY_STATUSWND.DLL
F:\WUBI\SHIQIANG\WNIME\DLL32\WNPY_COMPWND.DLL
F:\WUBI\SHIQIANG\WNIME\DLL32\WNPY_QUERY.DLL
F:\WUBI\SHIQIANG\WNIME\DLL32\WNUPDATE.DLL

F:\RUIXING\SHADU\RISING\RAV\RSTRAY.EXE

C:\WINDOWS\WINSXS\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_6.0.6001.18000_NONE_5CDBAA5A083979CC\COMCTL32.DLL
C:\WINDOWS\SYSTEM32\WN.IME
F:\WUBI\SHIQIANG\WNIME\DLL32\WNPY_STATUSWND.DLL
F:\WUBI\SHIQIANG\WNIME\DLL32\WNPY_COMPWND.DLL
F:\WUBI\SHIQIANG\WNIME\DLL32\WNPY_QUERY.DLL
F:\WUBI\SHIQIANG\WNIME\DLL32\WNUPDATE.DLL
F:\RUIXING\SHADU\RISING\RAV\COMSERV.DLL
C:\WINDOWS\SYSTEM32\MSVCP71.DLL
C:\WINDOWS\SYSTEM32\MSVCR71.DLL
F:\RUIXING\SHADU\RISING\RAV\RSLANG.DLL
F:\RUIXING\SHADU\RISING\RAV\COMX3.DLL
F:\RUIXING\SHADU\RISING\RAV\SYSLAY.DLL
F:\RUIXING\SHADU\RISING\RAV\RSXML.DLL
F:\RUIXING\SHADU\RISING\RAV\PROCCOMM.DLL
F:\RUIXING\SHADU\RISING\RAV\MONSTATE.DLL
F:\RUIXING\SHADU\RISING\RAV\SCANEVNT.DLL
F:\RUIXING\SHADU\RISING\RAV\RSVRINFO.DLL
F:\RUIXING\SHADU\RISING\RAV\RECOMP.DLL
F:\RUIXING\SHADU\RISING\RAV\REFS.DLL
F:\RUIXING\SHADU\RISING\RAV\VIRUSLIB.DLL
F:\RUIXING\SHADU\RISING\RAV\RELIBLDR.DLL
F:\RUIXING\SHADU\RISING\RAV\RSGUILIB.DLL
C:\WINDOWS\SYSTEM32\MFC71.DLL
F:\RUIXING\SHADU\RISING\RAV\RSCONF.DLL
F:\RUIXING\SHADU\RISING\RAV\RSAPPMGR.DLL
F:\RUIXING\SHADU\RISING\RAV\CFGDLL.DLL
F:\RUIXING\SHADU\RISING\RAV\RSPALVD.DLL
F:\RUIXING\SHADU\RISING\RAV\MRULEUI.DLL
F:\RUIXING\SHADU\RISING\RAV\MONTRAY.DLL
F:\RUIXING\SHADU\RISING\RAV\PNGDLL.DLL
F:\RUIXING\SHADU\RISING\RAV\RAVITRAY.DLL

C:\PROGRAM FILES\WINDOWS SIDEBAR\SIDEBAR.EXE

C:\WINDOWS\WINSXS\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_6.0.6001.18000_NONE_5CDBAA5A083979CC\COMCTL32.DLL
C:\WINDOWS\WINSXS\X86_MICROSOFT.WINDOWS.GDIPLUS_6595B64144CCF1DF_1.0.6001.18065_NONE_9E7ABE2EC9C13222\GDIPLUS.DLL
C:\WINDOWS\SYSTEM32\WN.IME
F:\WUBI\SHIQIANG\WNIME\DLL32\WNPY_STATUSWND.DLL
F:\WUBI\SHIQIANG\WNIME\DLL32\WNPY_COMPWND.DLL
F:\WUBI\SHIQIANG\WNIME\DLL32\WNPY_QUERY.DLL
F:\WUBI\SHIQIANG\WNIME\DLL32\WNUPDATE.DLL
F:\RUIXING\SHADU\RISING\RAV\RAVSCRCH.DLL
C:\WINDOWS\SYSTEM32\MSVCP71.DLL
C:\WINDOWS\SYSTEM32\MSVCR71.DLL
C:\WINDOWS\SYSTEM32\IGDUMD32.DLL

普通自启动项
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run

Windows Defender = %PROGRAMFILES%\WINDOWS DEFENDER\MSASCUI.EXE -HIDE
hpWirelessAssistant = C:\PROGRAM FILES\HEWLETT-PACKARD\HP WIRELESS ASSISTANT\HPWAMAIN.EXE
RfwMain = "F:\RUIXING\FANGHUO\RISING\RFW\RFWMAIN.EXE" -STARTUP
runeip = "F:\RUIXING\KAKA\RISING\ANTISPYWARE\RSTRAY.EXE" /STARTUP
IgfxTray = C:\WINDOWS\SYSTEM32\IGFXTRAY.EXE
HotKeysCmds = C:\WINDOWS\SYSTEM32\HKCMD.EXE
Persistence = C:\WINDOWS\SYSTEM32\IGFXPERS.EXE
RavTray = "F:\RUIXING\SHADU\RISING\RAV\RSTRAY.EXE" -SYSTEM

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce

KKDelay = F:\RUIXING\KAKA\RISING\ANTISPYWARE\RUNONCE.EXE

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run

Sidebar = C:\PROGRAM FILES\WINDOWS SIDEBAR\SIDEBAR.EXE /AUTORUN

系统文件关联
.exe ==> exefile = "%1" %*
.com ==> comfile = "%1" %*
.cmd ==> cmdfile = "%1" %*
.bat ==> batfile = "%1" %*
.txt ==> txtfile = %SystemRoot%\system32\NOTEPAD.EXE %1
.scr ==> scrfile = "%1" /S
.reg ==> regfile = regedit.exe "%1"

其它启动项
WIN.INI

无信息

SYSTEM.INI

SHELL = explorer.exe
SCRNSAVE.EXE = C:\Windows\system32\Bubbles.scr

Winlogon 启动项
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify

igfxcui = IGFXDEV.DLL

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon

Userinit = C:\WINDOWS\SYSTEM32\USERINIT.EXE,
shell = EXPLORER.EXE

IE - BHO
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects

{98B7C13A-E9CD-4959-8B46-FBEAB41E42A8} = C:\Windows\system32\UrlFilter.dll

Winsock SPI
MSAFD Tcpip [TCP/IP] = C:\Windows\SYSTEM32\MSWSOCK.DLL
MSAFD Tcpip [UDP/IP] = C:\Windows\SYSTEM32\MSWSOCK.DLL
MSAFD Tcpip [RAW/IP] = C:\Windows\SYSTEM32\MSWSOCK.DLL
MSAFD Tcpip [TCP/IPv6] = C:\Windows\SYSTEM32\MSWSOCK.DLL
MSAFD Tcpip [UDP/IPv6] = C:\Windows\SYSTEM32\MSWSOCK.DLL
MSAFD Tcpip [RAW/IPv6] = C:\Windows\SYSTEM32\MSWSOCK.DLL
RSVP TCPv6 = C:\Windows\SYSTEM32\MSWSOCK.DLL
RSVP TCP = C:\Windows\SYSTEM32\MSWSOCK.DLL
RSVP UDPv6 = C:\Windows\SYSTEM32\MSWSOCK.DLL
RSVP UDP = C:\Windows\SYSTEM32\MSWSOCK.DLL
MSAFD NetBIOS [\Device\NetBT_Tcpip_{90A15FA3-358B-4E65-B3F8-A64A25B2FF22}] SEQPACKET 0 = C:\Windows\SYSTEM32\MSWSOCK.DLL
MSAFD NetBIOS [\Device\NetBT_Tcpip_{90A15FA3-358B-4E65-B3F8-A64A25B2FF22}] DATAGRAM 0 = C:\Windows\SYSTEM32\MSWSOCK.DLL
MSAFD NetBIOS [\Device\NetBT_Tcpip_{39613E03-5AD2-404E-AB5F-9BA830730B33}] SEQPACKET 4 = C:\Windows\SYSTEM32\MSWSOCK.DLL
MSAFD NetBIOS [\Device\NetBT_Tcpip_{39613E03-5AD2-404E-AB5F-9BA830730B33}] DATAGRAM 4 = C:\Windows\SYSTEM32\MSWSOCK.DLL
MSAFD NetBIOS [\Device\NetBT_Tcpip6_{B363E3A1-81AD-4726-B032-D66603E7032C}] SEQPACKET 2 = C:\Windows\SYSTEM32\MSWSOCK.DLL
MSAFD NetBIOS [\Device\NetBT_Tcpip6_{B363E3A1-81AD-4726-B032-D66603E7032C}] DATAGRAM 2 = C:\Windows\SYSTEM32\MSWSOCK.DLL
MSAFD NetBIOS [\Device\NetBT_Tcpip6_{15178D00-2F72-4D0E-A3A6-5D95E570053C}] SEQPACKET 3 = C:\Windows\SYSTEM32\MSWSOCK.DLL
MSAFD NetBIOS [\Device\NetBT_Tcpip6_{15178D00-2F72-4D0E-A3A6-5D95E570053C}] DATAGRAM 3 = C:\Windows\SYSTEM32\MSWSOCK.DLL
MSAFD NetBIOS [\Device\NetBT_Tcpip6_{E5C834E6-0F57-4826-8EAD-BA1F1AB063D7}] SEQPACKET 6 = C:\Windows\SYSTEM32\MSWSOCK.DLL
MSAFD NetBIOS [\Device\NetBT_Tcpip6_{E5C834E6-0F57-4826-8EAD-BA1F1AB063D7}] DATAGRAM 6 = C:\Windows\SYSTEM32\MSWSOCK.DLL
MSAFD NetBIOS [\Device\NetBT_Tcpip6_{90A15FA3-358B-4E65-B3F8-A64A25B2FF22}] SEQPACKET 1 = C:\Windows\SYSTEM32\MSWSOCK.DLL
MSAFD NetBIOS [\Device\NetBT_Tcpip6_{90A15FA3-358B-4E65-B3F8-A64A25B2FF22}] DATAGRAM 1 = C:\Windows\SYSTEM32\MSWSOCK.DLL
MSAFD NetBIOS [\Device\NetBT_Tcpip6_{39613E03-5AD2-404E-AB5F-9BA830730B33}] SEQPACKET 5 = C:\Windows\SYSTEM32\MSWSOCK.DLL
MSAFD NetBIOS [\Device\NetBT_Tcpip6_{39613E03-5AD2-404E-AB5F-9BA830730B33}] DATAGRAM 5 = C:\Windows\SYSTEM32\MSWSOCK.DLL

系统服务项

文件驱动

系统驱动项

我今天特意截图全盘杀毒结果，发现病毒破坏系统后，虽然是全盘杀毒，但是查杀的文件数却不对，每次都不一样，而且刚重装好后查杀文件数量明显比后面的数量要多，有不少文件被自动跳过去了。


注意查杀文件数量对比。




下图是我在查杀毒过程中的截图，注意文件数，另外，查毒进程光标只在整个光标的前面一点，却在查F盘的毒，这很不正常，这次截图完后，没有一分钟查杀毒就结束了。上图是查杀毒完后显示的结果。

我使用了金山毒霸发现查杀毒的文件数也出现了异常。


连续二次查杀毒，但是显示的文件数却有所不同。
我又使用了江民09测试版，09测试版的软件本身程序升级不起来，病毒库也无法更新。不过，二次查杀毒文件数的结果却是正确的。另外，所有的监控均无法打开。

系统居然出现验证副本是否正版的信息，而且系统一直提示出错。前面在使用过程中，发现屏保出现异常改动，我查看设置是对的，待我查看后，原来没有屏保出现的，现在有了但是跟我的设置不一样，而且也没有屏保开机密码录入。另，刚系统重装好后，声音使用正常。更新补丁后声音显示没有安装设备，我查看硬件管理后，再次系统更新，声音又恢复正常了。下面二图是系统异常的提示。

晕了。。。。。。。凑活用吧，瑞星没那么智能。。。而且有的是伪装，如果让瑞星验证就麻烦了。。。用户应该学会用智慧判断。。。

我在安装了江民09测试版后，想安装瑞星防火墙，可是却安装失败了。

另外，在使用金山毒霸和江民09测试版时我用卡卡扫描了日志，可以对比一下。
在使用金山杀毒软件的时候，我用卡卡一键搞定，在运行查杀木马病毒的时候，死机运行不下去了。我又单独使用木马查杀功能，全盘查找没有发现病毒，可是查找的文件数却有问题。

我又用其他系统仔细查看了一下，在一个盘里发现了奇怪的txt文本格式的文件，而且有部分的jpg格式的图片有些异常。会不会这二个是病毒的一个部分。
我安装江民09测试版后，系统自动搜索更新没有发现新的补丁。可是，在之前使用瑞星杀毒软件的时候，有个Ricoh Company driver up date for Ricoh MMC Host Controller 这个补丁一直没有更新成功，也一直有自动更新的提示，我觉得非常奇怪。

我在安装金山毒霸的过程中，出现下图的提示，我在安装瑞星防火墙的时候，也需要安装类似的软件，但是瑞星程序却没有这种提示，一开始我怀疑是病毒没有安装，结果后面修复。建议防火墙以后版本中也加入这种提示。