启动项目
注册表
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
    <ctfmon.exe><E:\WINDOWS\system32\ctfmon.exe>  [(Verified)Microsoft Windows Publisher]
    <bgswitch><C:\WINDOWS\system32\bgswitch.exe>  [N/A]
    <QQDownload><"E:\Program Files\Tencent\QQDownload\QQDownload.exe" autostart>  [N/A]
[HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows]
    <load><>  [N/A]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
    <CnsMin><Rundll32.exe E:\WINDOWS\DOWNLO~1\CnsMin.dll,Rundll32>  [(Verified)"INTER CHINA NETWORK SOFTWARE (BEIJING) CO., LTD."]
    <ATIPTA><E:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe>  [ATI Technologies, Inc.]
    <SoundMan><SOUNDMAN.EXE>  [(Verified)Microsoft Windows Hardware Compatibility Publisher]
    <helper.dll><E:\WINDOWS\system32\rundll32.exe E:\PROGRA~1\3721\helper.dll,Rundll32>  [(Verified)"INTER CHINA NETWORK SOFTWARE (BEIJING) CO., LTD."]
    <runeip><"E:\Program Files\Rising\AntiSpyware\runiep.exe" /startup>  [Beijing Rising Technology Co., Ltd.]
    <RavTask><"E:\Program Files\Rising\Rav\RavTask.exe" -system>  [Beijing Rising Technology Co., Ltd.]
    <RfwMain><"E:\Program Files\Rising\Rfw\rfwmain.exe" -Startup>  [Beijing Rising Technology Co., Ltd.]
    <TkBellExe><"E:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot>  [RealNetworks, Inc.]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunOnce]
    <KKDelay><E:\Program Files\Rising\AntiSpyware\RunOnce.exe>  [Beijing Rising Technology Co., Ltd.]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
    <shell><Explorer.exe>  [(Verified)Microsoft Windows Publisher]
    <Userinit><E:\WINDOWS\system32\userinit.exe,>  [(Verified)Microsoft Windows Publisher]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Windows]
    <AppInit_DLLs><avwgbmn.dll>  []
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
    <UIHost><logonui.exe>  [(Verified)Microsoft Windows Publisher]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
    <{0EA66AD2-CF26-2E23-532B-B292E22F3266}><E:\Program Files\Internet Explorer\PLUGINS\NewTemp.dll>  []
    <{1E32FA58-3453-FA2D-BC49-F340348ACCE1}><E:\WINDOWS\system32\rsmyapm.dll>  [N/A]
    <{5D83AD9C-3BFC-43F5-979D-2904DBC54A8E}><E:\Program Files\Internet Explorer\PLUGINS\WinSys64.Sys>  []
    <{D157330A-9EF3-49F8-9A67-4141AC41ADD4}><E:\WINDOWS\DOWNLO~1\CnsHook.dll>  [(Verified)"INTER CHINA NETWORK SOFTWARE (BEIJING) CO., LTD."]
    <{AC2DC2EF-5165-40A3-8CDF-41DCA1B0901A}><E:\WINDOWS\system32\shlhook.dll>  [Beijing Rising Technology Co., Ltd.]
    <{32CD708B-60A7-4C00-9377-D73EAA495F0F}><E:\WINDOWS\system32\RavExt.dll>  [Beijing Rising Technology Co., Ltd.]
    <{2D47B341-43DF-4563-753F-345FFA3157D2}><E:\WINDOWS\system32\kvmxbma.dll>  [N/A]
    <{26650011-3344-6688-4899-345FABCD1562}><E:\WINDOWS\system32\ratbbpi.dll>  []
    <{28907901-1416-3389-9981-372178569982}><E:\WINDOWS\system32\kawdbzy.dll>  [N/A]
    <{C5E87A05-F463-4841-B19E-DD3EC3862368}><E:\Program Files\Internet Explorer\IEXPLORE32.Sys>  []
    <{A45B2C37-01D0-4D3E-BE5E-CC119B17BE9E}><E:\Program Files\Internet Explorer\IEXPLORE32.win>  []
    <{2A1247C1-53DA-FF43-ABD3-345F323A48D2}><E:\WINDOWS\system32\avwgbmn.dll>  []
    <{1859245F-345D-BC13-AC4F-145D47DA34F1}><E:\WINDOWS\system32\avzxamn.dll>  []
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\>{26923b43-4d38-484f-9b9e-de460746276c}]
    <Internet Explorer><%systemroot%\system32\shmgrate.exe OCInstallUserConfigIE>  [N/A]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\>{881dd1c5-3dcf-431b-b061-f3f88e8be88a}]
    <Outlook Express><%systemroot%\system32\shmgrate.exe OCInstallUserConfigOE>  [N/A]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{2C7339CF-2B09-4501-B3F3-F3508C9228ED}]
    <Themes Setup><%SystemRoot%\system32\regsvr32.exe /s /n /i:/UserInstall %SystemRoot%\system32\themeui.dll>  [N/A]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{44BBA840-CC51-11CF-AAFA-00AA00B6015C}]
    <Microsoft Outlook Express 6><"%ProgramFiles%\Outlook Express\setup50.exe" /APP:OE /CALLER:WINNT /user /install>  [N/A]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{44BBA842-CC51-11CF-AAFA-00AA00B6015B}]
    <NetMeeting 3.01><rundll32.exe advpack.dll,LaunchINFSection E:\WINDOWS\INF\msnetmtg.inf,NetMtg.Install.PerUser.NT>  [(Verified)Microsoft Windows Publisher]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{6BF52A52-394A-11d3-B153-00C04F79FAA6}]
    <Microsoft Windows Media Player><rundll32.exe advpack.dll,LaunchINFSection E:\WINDOWS\INF\wmp.inf,PerUserStub>  [(Verified)Microsoft Windows Publisher]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{7790769C-0471-11d2-AF11-00C04FA35D02}]
    <通讯簿 6><"%ProgramFiles%\Outlook Express\setup50.exe" /APP:WAB /CALLER:WINNT /user /install>  [N/A]

==================================
启动文件夹
[QQ游戏启动加速程序]
  <E:\Documents and Settings\Administrator\「开始」菜单\程序\启动\QQ游戏启动加速程序.lnk --> D:\PROGRA~1\Tencent\QQGAME\Accel.exe [深圳市腾讯计算机系统有限公司]><N>
[腾讯QQ]
  <E:\Documents and Settings\Administrator\「开始」菜单\程序\启动\腾讯QQ.lnk --> D:\PROGRA~1\Tencent\QQ\QQ.exe [TENCENT]><N>

==================================
服务
[Ati HotKey Poller / Ati HotKey Poller][Stopped/Auto Start]
  <E:\WINDOWS\system32\Ati2evxx.exe><>
[ATI Smart / ATI Smart][Stopped/Auto Start]
  <E:\WINDOWS\system32\ati2sgag.exe><>
[Human Interface Device Access / HidServ][Stopped/Disabled]
  <E:\WINDOWS\System32\svchost.exe -k netsvcs-->%SystemRoot%\System32\hidserv.dll><N/A>
[Rising Proxy  Service / RfwProxySrv][Stopped/Manual Start]
  <e:\program files\rising\rfw\rfwproxy.exe><Beijing Rising Technology Co., Ltd.>
[Rising Personal Firewall Service / RfwService][Running/Auto Start]
  <e:\program files\rising\rfw\rfwsrv.exe><Beijing Rising Technology Co., Ltd.>
[Rising Process Communication Center / RsCCenter][Running/Auto Start]
  <"E:\Program Files\Rising\Rav\CCenter.exe"><Beijing Rising Technology Co., Ltd.>
[Rising RealTime Monitor / RsRavMon][Running/Auto Start]
  <"E:\PROGRAM FILES\RISING\RAV\Ravmond.exe"><Beijing Rising Technology Co., Ltd.>

==================================
驱动程序
[Service for Realtek AC97 Audio (WDM) / ALCXWDM][Running/Manual Start]
  <system32\drivers\ALCXWDM.SYS><Realtek Semiconductor Corp.>
[ati2mtag / ati2mtag][Running/Manual Start]
  <system32\DRIVERS\ati2mtag.sys><ATI Technologies Inc.>
[Rising TDI Base Driver / BaseTDI][Running/Auto Start]
  <System32\DRIVERS\BaseTDI.SYS><Beijing Rising Technology Co., Ltd.>
[CnsMinKP / CnsMinKP][Running/Boot Start]
  <\SystemRoot\system32\drivers\CnsMinKP.sys><国风因特软件（北京）有限公司>
[ExpScaner / ExpScaner][Running/Auto Start]
  <\??\E:\PROGRAM FILES\RISING\RAV\ExpScan.sys><>
[GMSIPCI / GMSIPCI][Stopped/Manual Start]
  <\??\F:\INSTALL\GMSIPCI.SYS><N/A>
[HookCont / HookCont][Running/Auto Start]
  <\??\E:\PROGRAM FILES\RISING\RAV\HOOKCONT.sys><Rising>
[HookReg / HookReg][Running/Auto Start]
  <\??\E:\PROGRAM FILES\RISING\RAV\HookReg.sys><>
[HookSys / HookSys][Running/Auto Start]
  <\??\E:\PROGRAM FILES\RISING\RAV\HookSys.sys><Rising>
[HookUrl / HookUrl][Running/Auto Start]
  <\??\E:\Program Files\Rising\Rfw\HookUrl.sys><Beijing Rising Technology Co., Ltd.>
[MEMSCAN / MEMSCAN][Running/Auto Start]
  <\??\E:\PROGRAM FILES\RISING\RAV\MEMSCAN.sys><Beijing Rising Technology Co., Ltd.>
[mProcRs / mProcRs][Running/Auto Start]
  <\??\e:\program files\rising\rfw\mProcRs.sys><Beijing Rising Technology Co., Ltd.>
[MSICPL / MSICPL][Stopped/Manual Start]
  <\??\F:\install4\MSICPL.sys><N/A>
[NTACCESS / NTACCESS][Stopped/Manual Start]
  <\??\F:\NTACCESS.sys><N/A>
[obmbqgo / obmbqgo][Running/Boot Start]
  <\SystemRoot\\SystemRoot\System32\drivers\obmbqgo.sys><N/A>
[Direct Parallel Link Driver / Ptilink][Running/Manual Start]
  <system32\DRIVERS\ptilink.sys><Parallel Technologies, Inc.>
[RsAntiSpyware / RsAntiSpyware][Running/Boot Start]
  <\SystemRoot\system32\drivers\RsBoot.sys><Beijing Rising Technology Co., Ltd.>
[RsFwDrv / RsFwDrv][Running/Auto Start]
  <\??\E:\Program Files\Rising\Rfw\RsFwDrv.sys><Beijing Rising Technology Co., Ltd.>
[RsNTGDI / RsNTGDI][Running/Boot Start]
  <\SystemRoot\system32\Drivers\RsNTGdi.sys><Beijing Rising Technology Co., Ltd.>
[RSPPSYS / RSPPSYS][Running/Auto Start]
  <\??\E:\PROGRAM FILES\RISING\RAV\RSPPSYS.sys><Rising>
[Realtek RTL8139/810x/8169/8110 all in one NDIS XP Driver / RTL8023xp][Running/Manual Start]
  <system32\DRIVERS\Rtlnicxp.sys><Realtek Semiconductor Corporation>
[Secdrv / Secdrv][Stopped/Manual Start]
  <system32\DRIVERS\secdrv.sys><N/A>
[SetupNTGLM7X / SetupNTGLM7X][Stopped/Manual Start]
  <\??\F:\NTGLM7X.sys><N/A>
[R2A / R2A][Stopped/Disabled]
  <\??\E:\WINDOWS\system32a2.sys><N/A>

==================================
浏览器加载项
N/A

==================================
正在运行的进程
[PID: 580 / SYSTEM][\SystemRoot\System32\smss.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 640 / SYSTEM][\??\E:\WINDOWS\system32\csrss.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 664 / SYSTEM][\??\E:\WINDOWS\system32\winlogon.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
    [E:\WINDOWS\system32\ratbbpi.dll]  [N/A, ]
    [E:\WINDOWS\system32\msacm32.drv]  [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)]
[PID: 712 / SYSTEM][E:\WINDOWS\system32\services.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
    [E:\WINDOWS\system32\ratbbpi.dll]  [N/A, ]
[PID: 724 / SYSTEM][E:\WINDOWS\system32\lsass.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
    [E:\WINDOWS\system32\ratbbpi.dll]  [N/A, ]
[PID: 888 / SYSTEM][E:\WINDOWS\system32\svchost.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
    [E:\WINDOWS\system32\ratbbpi.dll]  [N/A, ]
[PID: 980 / NETWORK SERVICE][E:\WINDOWS\system32\svchost.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
    [E:\WINDOWS\system32\ratbbpi.dll]  [N/A, ]
[PID: 1076 / SYSTEM][E:\Program Files\Rising\Rav\CCenter.exe]  [Beijing Rising Technology Co., Ltd., 18, 0, 0, 3]
    [E:\WINDOWS\system32\avwgbmn.dll]  [N/A, ]
[PID: 1092 / SYSTEM][E:\WINDOWS\System32\svchost.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
    [E:\WINDOWS\System32\ratbbpi.dll]  [N/A, ]
    [E:\WINDOWS\system32\avwgbmn.dll]  [N/A, ]

[用户系统信息]Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)

[PID: 1144 / NETWORK SERVICE][E:\WINDOWS\system32\svchost.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
    [E:\WINDOWS\system32\ratbbpi.dll]  [N/A, ]
[PID: 1300 / SYSTEM][E:\PROGRAM FILES\RISING\RAV\Ravmond.exe]  [Beijing Rising Technology Co., Ltd., 19, 0, 0, 49]
    [E:\PROGRAM FILES\RISING\RAV\BWList.dll]  [Beijing Rising Technology Co., Ltd., 19, 0, 0, 10]
    [E:\PROGRAM FILES\RISING\RAV\RsCommX.dll]  [rising, 18, 0, 0, 1]
    [E:\PROGRAM FILES\RISING\RAV\rfwctrl.dll]  [Beijing Rising Technology Co., Ltd., 5, 0, 0, 11]
    [E:\PROGRAM FILES\RISING\RAV\RsPPsys.dll]  [Beijing Rising Technology Co., Ltd., 18, 0, 0, 6]
    [E:\PROGRAM FILES\RISING\RAV\RSAPPMGR.DLL]  [Beijing Rising Technology Co., Ltd., 18, 0, 0, 2]
    [E:\PROGRAM FILES\RISING\RAV\CfgDll.dll]  [Beijing Rising Technology Co., Ltd., 18, 0, 0, 13]
    [E:\PROGRAM FILES\RISING\RAV\RSCOMMON.DLL]  [Beijing Rising Technology Co., Ltd., 19, 0, 0, 5]
    [E:\PROGRAM FILES\RISING\RAV\RsLog.dll]  [Beijing Rising Technology Co., Ltd., 18, 0, 0, 20]
    [E:\PROGRAM FILES\RISING\RAV\HOOKSYS.dll]  [Beijing Rising Technology Co., Ltd., 19, 0, 0, 0]
    [E:\Program Files\Rising\Rav\Scanner.dll]  [Beijing Rising Technology Co., Ltd., 19, 0, 0, 15]
    [E:\Program Files\Rising\Rav\libload.dll]  [Beijing Rising Technology Co., Ltd., 19, 0, 0, 19]
    [E:\Program Files\Rising\Rav\VirusLib.dll]  [Beijing Rising Technology Co., Ltd., 19, 0, 0, 15]
    [E:\PROGRAM FILES\RISING\RAV\regmon.dll]  [Beijing Rising Technology Co., Ltd., 18, 0, 0, 6]
    [E:\PROGRAM FILES\RISING\RAV\psapi.dll]  [Microsoft Corporation, 4.00]
    [E:\PROGRAM FILES\RISING\RAV\HookWeb.dll]  [Beijing Rising Technology Co., Ltd., 19, 0, 0, 1]
    [E:\PROGRAM FILES\RISING\RAV\MemMon.dll]  [Beijing Rising Technology Co., Ltd., 18, 0, 0, 14]
    [E:\PROGRAM FILES\RISING\RAV\expscan.dll]  [Beijing Rising Technology Co., Ltd., 18, 0, 0, 4]
    [E:\PROGRAM FILES\RISING\RAV\mPorts.dll]  [Beijing Rising Technology Co., Ltd., 4, 0, 0, 3]
    [E:\PROGRAM FILES\RISING\RAV\HookCont.dll]  [Rising, 19, 0, 0, 0]
    [E:\Program Files\Rising\Rav\SpamEng.dll]  [, 18, 0, 0, 6]
    [E:\Program Files\Rising\Rav\engine.dll]  [Beijing Rising Technology Co., Ltd., 19, 0, 0, 30]
    [E:\Program Files\Rising\Rav\PostTrt.dll]  [Beijing Rising Technology Co., Ltd., 19, 0, 0, 17]
    [E:\Program Files\Rising\Rav\UnExe.dll]  [Beijing Rising Technology Co., Ltd., 19, 0, 0, 10]
    [E:\Program Files\Rising\Rav\ScanExec.dll]  [Beijing Rising Technology Co., Ltd., 19, 0, 0, 19]
    [E:\Program Files\Rising\Rav\ScanEx.dll]  [Beijing Rising Technology Co., Ltd., 19, 0, 0, 82]
    [E:\Program Files\Rising\Rav\ExtFile.dll]  [Beijing Rising Technology Co., Ltd., 19, 0, 0, 36]
    [E:\Program Files\Rising\Rav\NvFile.dll]  [Beijing Rising Technology Co., Ltd., 19, 0, 0, 11]
    [E:\Program Files\Rising\Rav\ScanMac.dll]  [Beijing Rising Technology Co., Ltd., 19, 0, 0, 17]
    [E:\Program Files\Rising\Rav\ScanSct.dll]  [Beijing Rising Technology Co., Ltd., 19, 0, 0, 20]
    [E:\Program Files\Rising\Rav\ScanPack.dll]  [Beijing Rising Technology Co., Ltd., 19, 0, 0, 24]
    [E:\Program Files\Rising\Rav\RsVM.dll]  [, 19, 0, 0, 20]
    [E:\Program Files\Rising\Rav\Uroutine.dll]  [Beijing Rising Technology Co., Ltd., 19, 0, 0, 57]
    [E:\Program Files\Rising\Rav\Uscript.dll]  [Beijing Rising Technology Co., Ltd., 19, 0, 0, 19]
    [E:\Program Files\Rising\Rav\RsStore.dll]  [Beijing Rising Technology Co., Ltd., 19, 0, 0, 2]
    [E:\Program Files\Rising\Rav\ExtOLE.dll]  [Beijing Rising Technology Co., Ltd., 19, 0, 0, 14]
    [E:\Program Files\Rising\Rav\ExtMail.dll]  [Beijing Rising Technology Co., Ltd., 19, 0, 0, 14]
    [E:\WINDOWS\system32\avwgbmn.dll]  [N/A, ]
    [E:\Program Files\Rising\Rav\ScanNet.dll]  [Beijing Rising Technology Co., Ltd., 18, 0, 0, 5]
[PID: 1396 / SYSTEM][e:\program files\rising\rfw\rfwsrv.exe]  [Beijing Rising Technology Co., Ltd., 5, 0, 0, 35]
    [E:\WINDOWS\system32\ratbbpi.dll]  [N/A, ]
    [e:\program files\rising\rfw\RfwRule.dll]  [Beijing Rising Technology Co., Ltd., 5, 0, 0, 3]
    [e:\program files\rising\rfw\rfwlog.dll]  [Beijing Rising Technology Co., Ltd., 5, 0, 0, 2]
    [e:\program files\rising\rfw\Rfwdrv.dll]  [Beijing Rising Technology Co., Ltd., 5, 0, 0, 10]
    [e:\program files\rising\rfw\psapi.dll]  [Microsoft Corporation, 4.00]
    [e:\program files\rising\rfw\MonDrv.dll]  [rs, 1, 0, 0, 4]
    [e:\program files\rising\rfw\ProcLib.dll]  [Beijing Rising Technology Co., Ltd., 5, 0, 0, 5]
    [e:\program files\rising\rfw\mPorts.dll]  [Beijing Rising Technology Co., Ltd., 4, 0, 0, 3]
    [E:\WINDOWS\system32\avwgbmn.dll]  [N/A, ]
[PID: 1684 / SYSTEM][E:\WINDOWS\system32\spoolsv.exe]  [Microsoft Corporation, 5.1.2600.2696 (xpsp_sp2_gdr.050610-1519)]
    [E:\WINDOWS\system32\ratbbpi.dll]  [N/A, ]
[PID: 1792 / SYSTEM][E:\PROGRAM FILES\RISING\RAV\RavStub.exe]  [Beijing Rising Technology Co., Ltd., 19, 0, 0, 4]
    [E:\PROGRAM FILES\RISING\RAV\RsCommX.dll]  [rising, 18, 0, 0, 1]
    [E:\PROGRAM FILES\RISING\RAV\RSCOMMON.DLL]  [Beijing Rising Technology Co., Ltd., 19, 0, 0, 5]
[PID: 1512 / LOCAL SERVICE][E:\WINDOWS\system32\svchost.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
    [E:\WINDOWS\system32\ratbbpi.dll]  [N/A, ]
[PID: 1352 / LOCAL SERVICE][E:\WINDOWS\System32\alg.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 3152 / Administrator][E:\WINDOWS\Explorer.EXE]  [Microsoft Corporation, 6.00.2900.2180 (xpsp_sp2_rtm.040803-2158)]
    [E:\WINDOWS\system32\ratbbpi.dll]  [N/A, ]
    [E:\Program Files\Internet Explorer\PLUGINS\NewTemp.dll]  [N/A, ]
    [E:\Program Files\Internet Explorer\PLUGINS\WinSys64.Sys]  [N/A, ]
    [E:\WINDOWS\DOWNLO~1\CnsHook.dll]  [国风因特软件（北京）有限公司, 2.5.1.6]
    [E:\WINDOWS\system32\shlhook.dll]  [Beijing Rising Technology Co., Ltd., 4.0.0.9]
    [E:\WINDOWS\system32\RavExt.dll]  [Beijing Rising Technology Co., Ltd., 19, 0, 0, 9]
    [E:\Program Files\Internet Explorer\IEXPLORE32.Sys]  [N/A, ]
    [E:\Program Files\Internet Explorer\IEXPLORE32.win]  [N/A, ]
    [E:\WINDOWS\DOWNLO~1\CnsMin.dll]  [国风因特软件（北京）有限公司, 2.5.1.2]
    [E:\PROGRA~1\3721\helper.dll]  [国风因特软件（北京）有限公司, 2.5.2.1005]
    [E:\PROGRA~1\3721\alrex.dll]  [国风因特软件（北京）有限公司, 2.5.1.1003]
    [E:\Program Files\Rising\AntiSpyware\ieprot.dll]  [Beijing Rising Technology Co., Ltd., 1, 0, 0, 12]
    [E:\WINDOWS\system32\avzxamn.dll]  [N/A, ]
    [E:\WINDOWS\system32\avwgbmn.dll]  [N/A, ]
    [E:\WINDOWS\system32\msacm32.drv]  [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)]
    [E:\PROGRA~1\3721\autolive.dll]  [国风因特软件（北京）有限公司, 2.5.5.1010]
    [E:\PROGRA~1\3721\alLiveEx.dll]  [ , 1, 0, 3, 1006]
    [E:\Program Files\Rising\Rav\RSCOMMON.DLL]  [Beijing Rising Technology Co., Ltd., 19, 0, 0, 5]
    [E:\Program Files\Rising\Rav\RavScrCh.dll]  [Beijing Rising Technology Co., Ltd., 18, 0, 0, 4]
    [E:\WINDOWS\system32\msdmo.dll]  [, ]
[PID: 520 / Administrator][E:\WINDOWS\system32\Rundll32.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
    [E:\WINDOWS\DOWNLO~1\CnsMin.dll]  [国风因特软件（北京）有限公司, 2.5.1.2]
    [E:\WINDOWS\DOWNLO~1\CnsMinIO.dll]  [国风因特软件（北京）有限公司, 2.5.0.6]
    [E:\WINDOWS\DOWNLO~1\cnsio.dll]  [国风因特软件（北京）有限公司, 2.5.0.4]
    [E:\WINDOWS\DOWNLO~1\CnsMinEx.dll]  [国风因特软件（北京）有限公司, 2.5.0.4]
    [E:\Program Files\Internet Explorer\IEXPLORE32.Sys]  [N/A, ]
    [E:\WINDOWS\system32\ratbbpi.dll]  [N/A, ]
    [E:\Program Files\Internet Explorer\PLUGINS\WinSys64.Sys]  [N/A, ]
    [E:\Program Files\Rising\AntiSpyware\ieprot.dll]  [Beijing Rising Technology Co., Ltd., 1, 0, 0, 12]
    [E:\WINDOWS\system32\avwgbmn.dll]  [N/A, ]
    [E:\WINDOWS\system32\avzxamn.dll]  [N/A, ]
[PID: 904 / Administrator][E:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe]  [ATI Technologies, Inc., 6.14.10.5120]
    [E:\PROGRA~1\3721\helper.dll]  [国风因特软件（北京）有限公司, 2.5.2.1005]
    [E:\WINDOWS\DOWNLO~1\CnsMin.dll]  [国风因特软件（北京）有限公司, 2.5.1.2]
    [E:\Program Files\Internet Explorer\PLUGINS\WinSys64.Sys]  [N/A, ]
    [E:\Program Files\ATI Technologies\ATI Control Panel\atipdsxx.dll]  [ATI Technologies, Inc., 6.14.10.5120]
    [E:\PROGRAM FILES\ATI TECHNOLOGIES\ATI CONTROL PANEL\ATRPUIXX.CHS]  [ATI Technologies, Inc., 6.14.10.5120]
    [E:\Program Files\ATI Technologies\ATI Control Panel\atipdxxx.dll]  [ATI Technologies, Inc., 6.14.10.5120]
    [E:\Program Files\Rising\AntiSpyware\ieprot.dll]  [Beijing Rising Technology Co., Ltd., 1, 0, 0, 12]
    [E:\Program Files\Internet Explorer\IEXPLORE32.Sys]  [N/A, ]
    [E:\WINDOWS\system32\ratbbpi.dll]  [N/A, ]
    [E:\WINDOWS\system32\avzxamn.dll]  [N/A, ]
    [E:\WINDOWS\system32\avwgbmn.dll]  [N/A, ]
[PID: 3328 / Administrator][E:\WINDOWS\SOUNDMAN.EXE]  [Realtek Semiconductor Corp., 5.1.0.33]
    [E:\PROGRA~1\3721\helper.dll]  [国风因特软件（北京）有限公司, 2.5.2.1005]
    [E:\WINDOWS\DOWNLO~1\CnsMin.dll]  [国风因特软件（北京）有限公司, 2.5.1.2]
    [E:\Program Files\Internet Explorer\PLUGINS\WinSys64.Sys]  [N/A, ]
    [E:\WINDOWS\system32\avzxamn.dll]  [N/A, ]
    [E:\Program Files\Rising\AntiSpyware\ieprot.dll]  [Beijing Rising Technology Co.,

[E:\WINDOWS\system32\avwgbmn.dll]  [N/A, ]
    [E:\Program Files\Internet Explorer\IEXPLORE32.Sys]  [N/A, ]
    [E:\WINDOWS\system32\ratbbpi.dll]  [N/A, ]
[PID: 3704 / Administrator][E:\WINDOWS\system32\rundll32.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
    [E:\PROGRA~1\3721\helper.dll]  [国风因特软件（北京）有限公司, 2.5.2.1005]
    [E:\WINDOWS\DOWNLO~1\CnsMin.dll]  [国风因特软件（北京）有限公司, 2.5.1.2]
    [E:\Program Files\Internet Explorer\PLUGINS\WinSys64.Sys]  [N/A, ]
    [E:\PROGRA~1\3721\autolive.dll]  [国风因特软件（北京）有限公司, 2.5.5.1010]
    [E:\PROGRA~1\3721\notifier.dll]  [国风因特软件（北京）有限公司, 2.5.1.1003]
    [E:\PROGRA~1\3721\alLiveEx.dll]  [ , 1, 0, 3, 1006]
    [E:\Program Files\Internet Explorer\IEXPLORE32.Sys]  [N/A, ]
    [E:\WINDOWS\system32\ratbbpi.dll]  [N/A, ]
    [E:\Program Files\Rising\AntiSpyware\ieprot.dll]  [Beijing Rising Technology Co., Ltd., 1, 0, 0, 12]
    [E:\WINDOWS\system32\avzxamn.dll]  [N/A, ]
    [E:\WINDOWS\system32\avwgbmn.dll]  [N/A, ]
[PID: 1008 / Administrator][E:\Program Files\Rising\AntiSpyware\runiep.exe]  [Beijing Rising Technology Co., Ltd., 4.0.0.18]
    [E:\WINDOWS\DOWNLO~1\CnsMin.dll]  [国风因特软件（北京）有限公司, 2.5.1.2]
    [E:\Program Files\Internet Explorer\PLUGINS\WinSys64.Sys]  [N/A, ]
    [E:\PROGRA~1\3721\helper.dll]  [国风因特软件（北京）有限公司, 2.5.2.1005]
    [E:\Program Files\Rising\AntiSpyware\ieprot.dll]  [Beijing Rising Technology Co., Ltd., 1, 0, 0, 12]
    [E:\Program Files\Internet Explorer\IEXPLORE32.Sys]  [N/A, ]
    [E:\WINDOWS\system32\ratbbpi.dll]  [N/A, ]
    [E:\WINDOWS\system32\avzxamn.dll]  [N/A, ]
    [E:\WINDOWS\system32\avwgbmn.dll]  [N/A, ]
[PID: 836 / Administrator][E:\Program Files\Rising\Rav\RavTask.exe]  [Beijing Rising Technology Co., Ltd., 19, 0, 0, 9]
    [E:\Program Files\Rising\Rav\RSCOMMON.DLL]  [Beijing Rising Technology Co., Ltd., 19, 0, 0, 5]
    [E:\Program Files\Rising\Rav\RSAPPMGR.DLL]  [Beijing Rising Technology Co., Ltd., 18, 0, 0, 2]
    [E:\Program Files\Rising\Rav\CfgDll.dll]  [Beijing Rising Technology Co., Ltd., 18, 0, 0, 13]
    [E:\Program Files\Rising\Rav\RsCommX.dll]  [rising, 18, 0, 0, 1]
    [E:\PROGRA~1\3721\helper.dll]  [国风因特软件（北京）有限公司, 2.5.2.1005]
    [E:\WINDOWS\DOWNLO~1\CnsMin.dll]  [国风因特软件（北京）有限公司, 2.5.1.2]
    [E:\Program Files\Internet Explorer\PLUGINS\WinSys64.Sys]  [N/A, ]
    [E:\Program Files\Rising\AntiSpyware\ieprot.dll]  [Beijing Rising Technology Co., Ltd., 1, 0, 0, 12]
    [E:\Program Files\Internet Explorer\IEXPLORE32.Sys]  [N/A, ]
    [E:\WINDOWS\system32\ratbbpi.dll]  [N/A, ]
    [E:\WINDOWS\system32\avzxamn.dll]  [N/A, ]
    [E:\WINDOWS\system32\avwgbmn.dll]  [N/A, ]
[PID: 3636 / Administrator][E:\Program Files\Rising\Rfw\rfwmain.exe]  [Beijing Rising Technology Co., Ltd., 5, 0, 0, 72]
    [E:\Program Files\Rising\Rfw\RsGuiLib.dll]  [Beijing Rising Technology Co., Ltd., 19, 0, 0, 33]
    [E:\Program Files\Rising\Rfw\RSCOMMON.DLL]  [Beijing Rising Technology Co., Ltd., 19, 0, 0, 5]
    [E:\Program Files\Rising\Rfw\RfwCtrl.dll]  [Beijing Rising Technology Co., Ltd., 5, 0, 0, 11]
    [E:\Program Files\Rising\Rfw\RsXML.dll]  [Beijing Rising Technology Co., Ltd., 19, 0, 0, 2]
    [E:\Program Files\Rising\Rfw\PngDll.dll]  [Beijing Rising Technology Co., Ltd., 18, 0, 0, 5]
    [E:\PROGRA~1\3721\helper.dll]  [国风因特软件（北京）有限公司, 2.5.2.1005]
    [E:\WINDOWS\DOWNLO~1\CnsMin.dll]  [国风因特软件（北京）有限公司, 2.5.1.2]
    [E:\Program Files\Internet Explorer\PLUGINS\WinSys64.Sys]  [N/A, ]
    [E:\WINDOWS\system32\avwgbmn.dll]  [N/A, ]
    [E:\WINDOWS\system32\avzxamn.dll]  [N/A, ]
    [E:\Program Files\Rising\AntiSpyware\ieprot.dll]  [Beijing Rising Technology Co., Ltd., 1, 0, 0, 12]
    [E:\Program Files\Internet Explorer\IEXPLORE32.Sys]  [N/A, ]
    [E:\WINDOWS\system32\ratbbpi.dll]  [N/A, ]
    [E:\Program Files\Rising\Rfw\PSAPI.DLL]  [Microsoft Corporation, 4.00]
[PID: 4036 / Administrator][E:\Program Files\Common Files\Real\Update_OB\realsched.exe]  [RealNetworks, Inc., 0.1.0.1622]
    [E:\PROGRA~1\3721\helper.dll]  [国风因特软件（北京）有限公司, 2.5.2.1005]
    [E:\WINDOWS\DOWNLO~1\CnsMin.dll]  [国风因特软件（北京）有限公司, 2.5.1.2]
    [E:\Program Files\Internet Explorer\PLUGINS\WinSys64.Sys]  [N/A, ]
    [E:\Program Files\Internet Explorer\IEXPLORE32.Sys]  [N/A, ]
    [E:\WINDOWS\system32\ratbbpi.dll]  [N/A, ]
    [E:\Program Files\Rising\AntiSpyware\ieprot.dll]  [Beijing Rising Technology Co., Ltd., 1, 0, 0, 12]
    [E:\WINDOWS\system32\avzxamn.dll]  [N/A, ]
    [E:\WINDOWS\system32\avwgbmn.dll]  [N/A, ]
[PID: 572 / Administrator][E:\WINDOWS\system32\ctfmon.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
    [E:\WINDOWS\system32\ratbbpi.dll]  [N/A, ]
    [E:\PROGRA~1\3721\helper.dll]  [国风因特软件（北京）有限公司, 2.5.2.1005]
    [E:\WINDOWS\DOWNLO~1\CnsMin.dll]  [国风因特软件（北京）有限公司, 2.5.1.2]
    [E:\Program Files\Internet Explorer\PLUGINS\WinSys64.Sys]  [N/A, ]
    [E:\Program Files\Internet Explorer\IEXPLORE32.Sys]  [N/A, ]
    [E:\Program Files\Rising\AntiSpyware\ieprot.dll]  [Beijing Rising Technology Co., Ltd., 1, 0, 0, 12]
    [E:\WINDOWS\system32\avzxamn.dll]  [N/A, ]
    [E:\WINDOWS\system32\avwgbmn.dll]  [N/A, ]
[PID: 2788 / Administrator][E:\Program Files\Rising\Rav\Ravmon.exe]  [Beijing Rising Technology Co., Ltd., 19, 0, 0, 45]
    [E:\Program Files\Rising\Rav\RsGuiLib.dll]  [Beijing Rising Technology Co., Ltd., 19, 0, 0, 33]
    [E:\Program Files\Rising\Rav\BWList.dll]  [Beijing Rising Technology Co., Ltd., 19, 0, 0, 10]
    [E:\WINDOWS\system32\ratbbpi.dll]  [N/A, ]
    [E:\Program Files\Rising\Rav\RSAPPMGR.DLL]  [Beijing Rising Technology Co., Ltd., 18, 0, 0, 2]
    [E:\Program Files\Rising\Rav\CfgDll.dll]  [Beijing Rising Technology Co., Ltd., 18, 0, 0, 13]
    [E:\Program Files\Rising\Rav\RSCOMMON.DLL]  [Beijing Rising Technology Co., Ltd., 19, 0, 0, 5]
    [E:\Program Files\Rising\Rav\RsCommX.dll]  [rising, 18, 0, 0, 1]
    [E:\Program Files\Rising\Rav\RsXML.dll]  [Beijing Rising Technology Co., Ltd., 19, 0, 0, 2]
    [E:\Program Files\Rising\Rav\PngDll.dll]  [Beijing Rising Technology Co., Ltd., 18, 0, 0, 5]
    [E:\PROGRA~1\3721\helper.dll]  [国风因特软件（北京）有限公司, 2.5.2.1005]
    [E:\WINDOWS\DOWNLO~1\CnsMin.dll]  [国风因特软件（北京）有限公司, 2.5.1.2]
    [E:\Program Files\Internet Explorer\PLUGINS\WinSys64.Sys]  [N/A, ]
    [E:\Program Files\Rising\AntiSpyware\ieprot.dll]  [Beijing Rising Technology Co., Ltd., 1, 0, 0, 12]
    [E:\Program Files\Internet Explorer\IEXPLORE32.Sys]  [N/A, ]
    [E:\WINDOWS\system32\avwgbmn.dll]  [N/A, ]
    [E:\WINDOWS\system32\avzxamn.dll]  [N/A, ]
[PID: 2140 / Administrator][E:\WINDOWS\system32\avwgbst.exe]  [N/A, ]
    [E:\WINDOWS\system32\ratbbpi.dll]  [N/A, ]
    [E:\WINDOWS\system32\avwgbmn.dll]  [N/A, ]
[PID: 2712 / Administrator][E:\WINDOWS\system32\avzxast.exe]  [N/A, ]
    [E:\WINDOWS\system32\ratbbpi.dll]  [N/A, ]
    [E:\WINDOWS\system32\avzxamn.dll]  [N/A, ]
[PID: 3576 / Administrator][E:\WINDOWS\system32\conime.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
    [E:\PROGRA~1\3721\helper.dll]  [国风因特软件（北京）有限公司, 2.5.2.1005]
    [E:\WINDOWS\DOWNLO~1\CnsMin.dll]  [国风因特软件（北京）有限公司, 2.5.1.2]
    [E:\Program Files\Internet Explorer\PLUGINS\WinSys64.Sys]  [N/A, ]
    [E:\WINDOWS\system32\avzxamn.dll]  [N/A, ]
    [E:\Program Files\Rising\AntiSpyware\ieprot.dll]  [Beijing Rising Technology Co., Ltd., 1, 0, 0, 12]
    [E:\WINDOWS\system32\avwgbmn.dll]  [N/A, ]
    [E:\Program Files\Internet Explorer\IEXPLORE32.Sys]  [N/A, ]
    [E:\WINDOWS\system32\ratbbpi.dll]  [N/A, ]
[PID: 2656 / Administrator][E:\WINDOWS\system32\ctfmon.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
    [E:\WINDOWS\system32\avzxamn.dll]  [N/A, ]

[E:\WINDOWS\system32\avwgbmn.dll]  [N/A, ]
[PID: 3812 / Administrator][E:\Program Files\Rising\Rav\RsAgent.exe]  [Beijing Rising Technology Co., Ltd., 19, 0, 0, 12]
    [E:\PROGRA~1\3721\helper.dll]  [国风因特软件（北京）有限公司, 2.5.2.1005]
    [E:\WINDOWS\DOWNLO~1\CnsMin.dll]  [国风因特软件（北京）有限公司, 2.5.1.2]
    [E:\Program Files\Internet Explorer\PLUGINS\WinSys64.Sys]  [N/A, ]
    [E:\Program Files\Rising\Rav\RsCommX.dll]  [rising, 18, 0, 0, 1]
    [E:\WINDOWS\system32\avzxamn.dll]  [N/A, ]
    [E:\Program Files\Rising\AntiSpyware\ieprot.dll]  [Beijing Rising Technology Co., Ltd., 1, 0, 0, 12]
    [E:\WINDOWS\system32\avwgbmn.dll]  [N/A, ]
[PID: 1992 / Administrator][E:\WINDOWS\msagent\AgentSvr.exe]  [Microsoft Corporation, 2.00.0.3424]
    [E:\WINDOWS\system32\avwgbmn.dll]  [N/A, ]
    [E:\PROGRA~1\3721\helper.dll]  [国风因特软件（北京）有限公司, 2.5.2.1005]
    [E:\WINDOWS\DOWNLO~1\CnsMin.dll]  [国风因特软件（北京）有限公司, 2.5.1.2]
    [E:\Program Files\Internet Explorer\PLUGINS\WinSys64.Sys]  [N/A, ]
    [E:\WINDOWS\system32\avzxamn.dll]  [N/A, ]
    [E:\Program Files\Rising\AntiSpyware\ieprot.dll]  [Beijing Rising Technology Co., Ltd., 1, 0, 0, 12]
    [E:\WINDOWS\system32\msacm32.drv]  [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)]
    [E:\WINDOWS\system32\ratbbpi.dll]  [N/A, ]
[PID: 1432 / Administrator][E:\Program Files\Tencent\QQDownload\QQDownload.exe]  [Tencent Technology (Shenzhen) Company Limited, 1, 5, 130, 130]
    [E:\WINDOWS\system32\avzxamn.dll]  [N/A, ]
    [E:\PROGRA~1\3721\helper.dll]  [国风因特软件（北京）有限公司, 2.5.2.1005]
    [E:\WINDOWS\DOWNLO~1\CnsMin.dll]  [国风因特软件（北京）有限公司, 2.5.1.2]
    [E:\Program Files\Internet Explorer\PLUGINS\WinSys64.Sys]  [N/A, ]
    [E:\Program Files\Tencent\QQDownload\QQDownload.dll]  [Tencent Technology (Shenzhen) Company Limited, 1, 5, 130, 130]
    [E:\Program Files\Tencent\QQDownload\TNProxy.dll]  [Tencent Technology(Shenzhen) Company Limited, 2, 1, 101, 90]
    [E:\WINDOWS\system32\avwgbmn.dll]  [N/A, ]
    [E:\Program Files\Rising\AntiSpyware\ieprot.dll]  [Beijing Rising Technology Co., Ltd., 1, 0, 0, 12]
    [D:\Program Files\Tencent\QQ\TIMProxy.dll]  [tencent, 0, 3, 2, 4]
    [E:\WINDOWS\system32\msacm32.drv]  [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)]
    [E:\WINDOWS\system32\msadp32.acm]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
    [E:\WINDOWS\system32\ratbbpi.dll]  [N/A, ]
    [E:\Program Files\Internet Explorer\PLUGINS\NewTemp.dll]  [N/A, ]
    [E:\WINDOWS\DOWNLO~1\CnsHook.dll]  [国风因特软件（北京）有限公司, 2.5.1.6]
    [E:\WINDOWS\system32\shlhook.dll]  [Beijing Rising Technology Co., Ltd., 4.0.0.9]
    [E:\WINDOWS\system32\RavExt.dll]  [Beijing Rising Technology Co., Ltd., 19, 0, 0, 9]
    [E:\Program Files\Internet Explorer\IEXPLORE32.Sys]  [N/A, ]
    [E:\Program Files\Internet Explorer\IEXPLORE32.win]  [N/A, ]
[PID: 1192 / Administrator][E:\Program Files\Internet Explorer\iexplore.exe]  [Microsoft Corporation, 6.00.2900.2180 (xpsp_sp2_rtm.040803-2158)]
    [E:\WINDOWS\system32\ratbbpi.dll]  [N/A, ]
    [E:\PROGRA~1\3721\helper.dll]  [国风因特软件（北京）有限公司, 2.5.2.1005]
    [E:\PROGRA~1\3721\alrex.dll]  [国风因特软件（北京）有限公司, 2.5.1.1003]
    [E:\WINDOWS\DOWNLO~1\CnsMin.dll]  [国风因特软件（北京）有限公司, 2.5.1.2]
    [E:\WINDOWS\DOWNLO~1\CnsHint.dll]  [国风因特软件（北京）有限公司, 2.5.0.3]
    [E:\Program Files\Internet Explorer\PLUGINS\WinSys64.Sys]  [N/A, ]
    [E:\PROGRA~1\3721\autolive.dll]  [国风因特软件（北京）有限公司, 2.5.5.1010]
    [E:\PROGRA~1\3721\alLiveEx.dll]  [ , 1, 0, 3, 1006]
    [E:\WINDOWS\DOWNLO~1\cnsplus.dll]  [国风因特软件（北京）有限公司, 2.5.0.3]
    [E:\Program Files\Tencent\QQDownload\QQIEHelper01.dll]  [腾讯公司, 1, 1, 0, 5]
    [E:\WINDOWS\DOWNLO~1\CnsHook.dll]  [国风因特软件（北京）有限公司, 2.5.1.6]
    [E:\WINDOWS\system32\avwgbmn.dll]  [N/A, ]
    [E:\Program Files\Rising\AntiSpyware\ieprot.dll]  [Beijing Rising Technology Co., Ltd., 1, 0, 0, 12]
    [E:\WINDOWS\system32\avzxamn.dll]  [N/A, ]
    [E:\Program Files\Rising\Rav\RavScrCh.dll]  [Beijing Rising Technology Co., Ltd., 18, 0, 0, 4]
    [E:\WINDOWS\system32\Macromed\Flash\Flash9.ocx]  [Adobe Systems, Inc., 9,0,16,0]
    [E:\WINDOWS\system32\msacm32.drv]  [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)]
[PID: 2336 / Administrator][E:\Program Files\WinRAR\WinRAR.exe]  [N/A, ]
    [E:\WINDOWS\system32\avzxamn.dll]  [N/A, ]
    [E:\PROGRA~1\3721\helper.dll]  [国风因特软件（北京）有限公司, 2.5.2.1005]
    [E:\WINDOWS\DOWNLO~1\CnsMin.dll]  [国风因特软件（北京）有限公司, 2.5.1.2]
    [E:\Program Files\Internet Explorer\PLUGINS\WinSys64.Sys]  [N/A, ]
    [E:\WINDOWS\system32\avwgbmn.dll]  [N/A, ]
    [E:\Program Files\Rising\AntiSpyware\ieprot.dll]  [Beijing Rising Technology Co., Ltd., 1, 0, 0, 12]
    [E:\WINDOWS\system32\ratbbpi.dll]  [N/A, ]
[PID: 1488 / Administrator][E:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\Rar$EX01.969\SREngPS.EXE]  [Smallfrogs Studio, 2.5.16.900]
    [E:\WINDOWS\system32\ratbbpi.dll]  [N/A, ]
    [E:\PROGRA~1\3721\helper.dll]  [国风因特软件（北京）有限公司, 2.5.2.1005]
    [E:\WINDOWS\DOWNLO~1\CnsMin.dll]  [国风因特软件（北京）有限公司, 2.5.1.2]
    [E:\Program Files\Internet Explorer\PLUGINS\WinSys64.Sys]  [N/A, ]
    [E:\WINDOWS\system32\avwgbmn.dll]  [N/A, ]
    [E:\Program Files\Rising\AntiSpyware\ieprot.dll]  [Beijing Rising Technology Co., Ltd., 1, 0, 0, 12]
    [E:\WINDOWS\system32\avzxamn.dll]  [N/A, ]
    [E:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\Rar$EX01.969\Upload\3rdUpd.DLL]  [Smallfrogs Studio, 2, 1, 0, 15]
    [E:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\Rar$EX01.969\Plugins\NTFSTREAM.SRE]  [Smallfrogs Studio, 1, 0, 0, 5]

========Content========
在安全模式下
用冰刃强制删除
E:\Program Files\Internet Explorer\PLUGINS\NewTemp.dll
E:\WINDOWS\system32\rsmyapm.dll
E:\WINDOWS\system32\kvmxbma.dll
E:\WINDOWS\system32\ratbbpi.dll
E:\WINDOWS\system32\kawdbzy.dll
E:\Program Files\Internet Explorer\IEXPLORE32.Sys
E:\Program Files\Internet Explorer\IEXPLORE32.win
E:\WINDOWS\system32\avwgbmn.dll
E:\WINDOWS\system32\avzxamn.dll
F:\install4\MSICPL.sys
F:\NTACCESS.sys
E:\WINDOWS\system32a2.sys
F:\NTGLM7X.sys
E:\Program Files\Internet Explorer\PLUGINS\WinSys64.Sys
E:\WINDOWS\system32\avwgbst.exe
E:\WINDOWS\system32\avzxast.exe

日志不全。。可能会漏。。。
在注册表搜索病毒名后删除相应项目
修复文件关联