[PID: 1020][C:\WINNT\system32\svchost.exe] <Microsoft Corporation><5.00.2134.1>
[C:\WINNT\system32\EntApi.dll] <Network Associates, Inc><8.0.0.448>
[PID: 1200][C:\WINNT\system32\Rundll32.exe] <Microsoft Corporation><5.00.2134.1>
[C:\WINNT\DOWNLO~1\CnsMin.dll] <北京三七二一科技有限公司><1, 5, 3, 3>
[C:\WINNT\DOWNLO~1\CnsMinEx.dll] <国风因特软件(北京)有限公司><1, 0, 3, 2>
[C:\PROGRA~1\3721\helper.dll] <><1, 0, 9, 1324>
[C:\WINNT\DOWNLO~1\CnsMinIO.dll] <北京三七二一科技有限公司><1, 0, 3, 6>
[C:\WINNT\DOWNLO~1\cnsio.dll] <北京三七二一科技有限公司><1, 0, 2, 7>
[PID: 1208][D:\小蒙恬5.0手写系统\win32\pphidpad.exe] <N/A><N/A>
[C:\WINNT\DOWNLO~1\CnsMin.dll] <北京三七二一科技有限公司><1, 5, 3, 3>
[PID: 1420][C:\WINNT\System32\hkcmd.exe] <Intel Corporation><3.0.0.3751>
[C:\WINNT\System32\hccutils.DLL] <Intel Corporation><3.0.0.3751>
[C:\WINNT\DOWNLO~1\CnsMin.dll] <北京三七二一科技有限公司><1, 5, 3, 3>
[C:\WINNT\System32\igfxdev.dll] <Intel Corporation><3.0.0.3751>
[C:\WINNT\System32\igfxsrvc.dll] <Intel Corporation><3.0.0.3751>
[C:\WINNT\System32\igfxhk.dll] <Intel Corporation><3.0.0.3751>
[C:\WINNT\System32\igfxres.dll] <Intel Corporation><3.0.0.3751>
[PID: 1400][C:\WINNT\system32\cmd.exe] <Microsoft Corporation><5.00.2195.6995>
[PID: 1444][C:\WINNT\system32\net.exe] <Microsoft Corporation><5.00.2160.1>
[PID: 1428][C:\Program Files\Network Associates\Common Framework\UpdaterUI.exe] <Network Associates, Inc.><3.5.0.456>
[C:\Program Files\Network Associates\Common Framework\nailog.dll] <Network Associates, Inc.><3.5.0.536>
[C:\Program Files\Network Associates\Common Framework\naCmnLib.dll] <Network Associates, Inc.><3.5.0.536>
[C:\Program Files\Network Associates\Common Framework\naXML.dll] <Network Associates, Inc.><3.5.0.536>
[C:\Program Files\Network Associates\Common Framework\0409\UpdRes.dll] <Network Associates, Inc.><3.5.0.456>
[C:\Program Files\Network Associates\Common Framework\0409\AgentRes.dll] <Network Associates, Inc.><3.5.0.456>
[C:\WINNT\DOWNLO~1\CnsMin.dll] <北京三七二一科技有限公司><1, 5, 3, 3>
[C:\Program Files\Network Associates\Common Framework\SecureFrameworkFactory.dll] <Network Associates, Inc.><3.5.0.456>
[PID: 604][C:\Program Files\Network Associates\VirusScan\SHSTAT.EXE] <Network Associates, Inc.><8.0.0.912>
[C:\Program Files\Network Associates\VirusScan\SHUTIL.dll] <Network Associates, Inc.><8.0.0.989>
[C:\Program Files\Network Associates\VirusScan\naiwmain.dll] <Network Associates, Inc.><8.0.0.912>
[C:\Program Files\Network Associates\VirusScan\RES04\shstat.dll] <Network Associates, Inc.><8.0.0.912>
[C:\Program Files\Network Associates\VirusScan\RES04\Product.dll] <Network Associates, Inc.><8.0.0.912>
[C:\Program Files\Network Associates\VirusScan\RES04\McShield.dll] <Network Associates, Inc.><8.0.0.251>
[C:\Program Files\Network Associates\VirusScan\RES04\Shutilrc.dll] <Network Associates, Inc.><8.0.0.912>
[C:\Program Files\Network Associates\VirusScan\Graphics.dll] <Network Associates, Inc.><8.0.0.912>
[C:\WINNT\DOWNLO~1\CnsMin.dll] <北京三七二一科技有限公司><1, 5, 3, 3>
[C:\PROGRA~1\3721\helper.dll] <><1, 0, 9, 1324>
[PID: 1476][C:\WINNT\system32\net1.exe] <Microsoft Corporation><5.00.2195.6601>
[PID: 1460][C:\Program Files\Common Files\Real\Update_OB\realsched.exe] <RealNetworks, Inc.><0.1.0.1622>
[C:\WINNT\DOWNLO~1\CnsMin.dll] <北京三七二一科技有限公司><1, 5, 3, 3>
[PID: 1580][C:\WINNT\system32\internat.exe] <Microsoft Corporation><5.00.2920.0000>
[C:\WINNT\DOWNLO~1\CnsMin.dll] <北京三七二一科技有限公司><1, 5, 3, 3>
[PID: 1716][C:\WINNT\system32\rundll32.exe] <Microsoft Corporation><5.00.2134.1>
[C:\PROGRA~1\3721\helper.dll] <><1, 0, 9, 1324>
[C:\WINNT\DOWNLO~1\CnsMin.dll] <北京三七二一科技有限公司><1, 5, 3, 3>
[C:\PROGRA~1\3721\autolive.dll] <><1, 1, 5, 1324>
[C:\PROGRA~1\3721\notifier.dll] <><1, 0, 0, 5>
[PID: 988][d:\Rising\Rav\CCenter.exe] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 3>
[PID: 1520][D:\Rising\Rav\RavTask.exe] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 22>
[D:\Rising\Rav\RSCOMMON.DLL] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 4>
[D:\Rising\Rav\RSAPPMGR.DLL] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 2>
[D:\Rising\Rav\CfgDll.dll] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 11>
[D:\Rising\Rav\RsCommX.dll] <rising><18, 0, 0, 1>
[C:\PROGRA~1\3721\helper.dll] <><1, 0, 9, 1324>
[C:\WINNT\DOWNLO~1\CnsMin.dll] <北京三七二一科技有限公司><1, 5, 3, 3>
[PID: 1008][d:\Rising\Rav\Ravmond.exe] <Beijing Rising Technology Co., Ltd.><18, 0, 1, 29>
[d:\Rising\Rav\BWList.dll] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 19>
[d:\Rising\Rav\RsCommX.dll] <rising><18, 0, 0, 1>
[d:\Rising\Rav\RSAPPMGR.DLL] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 2>
[d:\Rising\Rav\CfgDll.dll] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 11>
[d:\Rising\Rav\RSCOMMON.DLL] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 4>
[d:\Rising\Rav\RsLog.dll] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 20>
[d:\Rising\Rav\HOOKSYS.dll] <Rising><18, 1, 0, 9>
[d:\Rising\Rav\Scanner.dll] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 30>
[d:\Rising\Rav\libload.dll] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 10>
[d:\Rising\Rav\VirusLib.dll] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 10>
[d:\Rising\Rav\regmon.dll] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 6>
[d:\Rising\Rav\HookWeb.dll] <rising><18, 0, 0, 2>
[d:\Rising\Rav\MemMon.dll] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 9>
[d:\Rising\Rav\expscan.dll] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 4>
[d:\Rising\Rav\mPorts.dll] <Beijing Rising Technology Co., Ltd.><4, 0, 0, 3>
[d:\Rising\Rav\MailMon.dll] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 5>
[d:\Rising\Rav\SpamEng.dll] <N/A><18, 0, 0, 6>
[d:\Rising\Rav\engine.dll] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 30>
[d:\Rising\Rav\PostTrt.dll] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 9>
[d:\Rising\Rav\UnExe.dll] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 11>
[d:\Rising\Rav\ScanExec.dll] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 11>
[d:\Rising\Rav\ScanEx.dll] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 11>
[d:\Rising\Rav\NvFile.dll] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 7>
[d:\Rising\Rav\ScanMac.dll] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 8>
[d:\Rising\Rav\ScanSct.dll] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 17>
[d:\Rising\Rav\Unpacker.dll] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 3>
[d:\Rising\Rav\ExtMail.dll] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 13>
[d:\Rising\Rav\ScanNet.dll] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 5>
[PID: 1792][d:\Rising\Rav\RavStub.exe] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 16>
[d:\Rising\Rav\RsCommX.dll] <rising><18, 0, 0, 1>
[d:\Rising\Rav\RSCOMMON.DLL] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 4>
[PID: 1824][C:\DOCUME~1\123\LOCALS~1\Temp\Rar$EX00.187\SREng2\SREng.exe] <Smallfrogs Studio><2.0.21.505>
[C:\PROGRA~1\3721\helper.dll] <><1, 0, 9, 1324>
[C:\WINNT\DOWNLO~1\CnsMin.dll] <北京三七二一科技有限公司><1, 5, 3, 3>
==================================
文件关联
.TXT OK. [%SystemRoot%\system32\NOTEPAD.EXE %1]
.EXE OK. ["%1" %*]
.COM OK. ["%1" %*]
.PIF OK. ["%1" %*]
.REG OK. [regedit.exe "%1"]
.BAT OK. ["%1" %*]
.SCR OK. ["%1" /S]
.CHM OK. ["C:\WINNT\hh.exe" %1]
.HLP OK. [%SystemRoot%\System32\winhlp32.exe %1]
.INI OK. [%SystemRoot%\System32\NOTEPAD.EXE %1]
.INF OK. [%SystemRoot%\System32\NOTEPAD.EXE %1]
.VBS OK. [%SystemRoot%\System32\WScript.exe "%1" %*]
.JS OK. [%SystemRoot%\System32\WScript.exe "%1" %*]
.LNK OK. [{00021401-0000-0000-C000-000000000046}]
