启动项目
注册表
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
    <ctfmon.exe><ctfmon.exe>  [Microsoft Corporation]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
    <Synchronization Manager><mobsync.exe /logon>  [Microsoft Corporation]
    <igfxtray><; C:\WINNT\System32\igfxtray.exe>  [Intel Corporation]
    <igfxhkcmd><C:\WINNT\System32\hkcmd.exe>  [Intel Corporation]
    <igfxpers><C:\WINNT\System32\igfxpers.exe>  [Intel Corporation]
    <SoundMan><; SOUNDMAN.EXE>  [Realtek Semiconductor Corp.]
    <runeip><C:\Program Files\Rising\AntiSpyware\runiep.exe>  [Beijing Rising Technology Co., Ltd.]
    <IMSCMig><; C:\PROGRA~1\COMMON~1\MICROS~1\IME\IMSC40A\IMSCMIG.EXE /Preload>  [Microsoft Corporation]
    <Acrobat Assistant 7.0><; "D:\Program Files\Adobe\Acrobat 7.0\Distillr\Acrotray.exe">  [Adobe Systems Inc.]
    <RavTask><"d:\Program Files\Rising\Rav\RavTask.exe" -system>  [Beijing Rising Technology Co., Ltd.]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
    <shell><Explorer.exe crs.exe>  []
    <Userinit><C:\WINNT\system32\userinit.exe,>  [Microsoft Corporation]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\igfxcui]
    <WinlogonNotify: igfxcui><igfxdev.dll>  [Intel Corporation]

==================================
启动文件夹
[Adobe Acrobat Speed Launcher]
  <C:\Documents and Settings\All Users\「开始」菜单\程序\启动\Adobe Acrobat Speed Launcher.lnk><H>
[QQ游戏启动加速程序]
  <C:\Documents and Settings\YDJC55\「开始」菜单\程序\启动\QQ游戏启动加速程序.lnk><H>

==================================
服务
[Logical Disk Manager Administrative Service / dmadmin]
  <C:\WINNT\System32\dmadmin.exe /com><VERITAS Software Corp.>
[Vsn fpcv Service / fpcv]
  <C:\WINNT\system32\rundll32.exe C:\PROGRA~1\lvib\sspi.dll,Service><N/A>
[Messenger / Messenger]
  <\SystemRoot\C:\WINNT\System32\services.exe><N/A>
[Rising Process Communication Center / RsCCenter]
  <"d:\Program Files\Rising\Rav\CCenter.exe"><Beijing Rising Technology Co., Ltd.>
[Rising RealTime Monitor / RsRavMon]
  <"D:\PROGRAM FILES\RISING\RAV\Ravmond.exe"><Beijing Rising Technology Co., Ltd.>
[Std wgwp Service / wgwp]
  <C:\WINNT\system32\rundll32.exe C:\PROGRA~1\ryoh\blyu.dll,Service -s><N/A>

==================================
浏览器加载项
[AcroIEHlprObj Class]
  {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} <D:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll, Adobe Systems Incorporated>
[FGCatchUrl]
  {2F364306-AA45-47B5-9F9D-39A8B94E7EF7} <d:\Program Files\FlashGet\jccatch.dll, www.flashget.com>
[cmsv]
  {545200BC-A669-4969-ADCC-3A7BE73C9912} <C:\PROGRA~1\lvib\pwmf.dll, >
[]
  {5e87b863-9cf2-46cd-8b0d-4e03f37a8dbf} <C:\WINNT\system32\46cdcfsb.dll, N/A>
[实用搜索]
  {6CFD436C-7AAD-4e50-992F-C0C87A94CAD2} <C:\Program Files\superutilbar\superutilbar.dll, www.shiyongsousuo.com>
[]
  {99b741c9-6c42-4cec-ae2b-1b294ae19f4f} <C:\WINNT\system32\4cecntos.dll, N/A>
[AcroIEToolbarHelper Class]
  {AE7CD045-E861-484f-8273-0445EE161910} <D:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll, Adobe Systems Incorporated>
[信息检索(&R)]
  {92780B25-18CC-41C8-B9BE-3C9C571A8263} <D:\PROGRA~1\MICROS~1\OFFICE11\REFIEBAR.DLL, Microsoft Corporation>
[@shdoclc.dll,-866]
  {c95fe080-8f5d-11d2-a20b-00aa003c157a} <, N/A>
[快车]
  {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} <d:\Program Files\FlashGet\FlashGet.exe, FlashGet.com>
[QQIEFloatBarCfgCmd Class]
  {DEDEB80D-FA35-45d9-9460-4983E5A8AFE6} <, N/A>
[CaiFuCOM Class]
  {C1F0024B-8278-4999-B7E6-2718426D9FE6} <C:\Program Files\财富通\fcai.dll, N/A>
[电台(&R)]
  {8E718888-423F-11D2-876E-00A0C9082467} <C:\WINNT\system32\msdxm.ocx, Microsoft Corporation>
[Adobe PDF]
  {47833539-D0C5-4125-9FA8-0819E2EAAC93} <D:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll, Adobe Systems Incorporated>
[6c42]
  {DFCB34B6-902D-426E-AE2B-1B294AE19F4F} <C:\WINNT\system32\4cecntos.dll, N/A>
[实用搜索工具条2.0]
  {03465FF5-00AE-411a-9C34-960ED566EC03} <C:\Program Files\superutilbar\superutilbar.dll, www.shiyongsousuo.com>
[Shockwave Flash Object]
  {D27CDB6E-AE6D-11CF-96B8-444553540000} <C:\WINNT\system32\Macromed\Flash\Flash9b.ocx, Adobe Systems, Inc.>
[FGCatchUrl]
  {FB5DA724-162B-11D3-8B9B-AA70B4B0B524} <d:\Program Files\FlashGet\jccatch.dll, www.flashget.com>
[&使用快车(FlashGet)下载]
  <d:\Program Files\FlashGet\jc_link.htm, N/A>
[&使用快车(FlashGet)下载全部链接]
  <d:\Program Files\FlashGet\jc_all.htm, N/A>
[上传到QQ网络硬盘]
  <D:\Program Files\Tencent\QQ\AddToNetDisk.htm, N/A>
[导出到 Microsoft Office Excel(&X)]
  <res://D:\PROGRA~1\MICROS~1\OFFICE11\EXCEL.EXE/3000, N/A>
[添加到QQ自定义面板]
  <D:\Program Files\Tencent\QQ\AddPanel.htm, N/A>
[添加到QQ表情]
  <D:\Program Files\Tencent\QQ\AddEmotion.htm, N/A>
[用QQ彩信发送该图片]
  <D:\Program Files\Tencent\QQ\SendMMS.htm, N/A>
[转换为 Adobe PDF]
  <res://D:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html, N/A>
[转换为现有 PDF]
  <res://D:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html, N/A>
[转换选定的链接为 Adobe PDF]
  <res://D:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECaptureSelLinks.html, N/A>
[转换选定的链接为现有 PDF]
  <res://D:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppendSelLinks.html, N/A>
[转换选项为 Adobe PDF]
  <res://D:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html, N/A>
[转换选项为现有 PDF]
  <res://D:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html, N/A>
[转换链接目标为 Adobe PDF]
  <res://D:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html, N/A>
[转换链接目标为现有 PDF]
  <res://D:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html, N/A>

==================================

正在运行的进程
[PID: 156][\SystemRoot\System32\smss.exe]  <Microsoft Corporation><5.00.2195.6601>
[PID: 188][\??\C:\WINNT\system32\csrss.exe]  <Microsoft Corporation><5.00.2195.6601>
[PID: 208][\??\C:\WINNT\system32\winlogon.exe]  <Microsoft Corporation><5.00.2195.6970>
    [C:\PROGRA~1\ryoh\eobx.dll]  <><1, 0, 0, 6>
    [C:\PROGRA~1\ryoh\jtgs.dll]  < ><1, 0, 0, 6>
    [c:\PROGRA~1\iesnap\navstub.dll]  <><1, 0, 1, 1>
[PID: 236][C:\WINNT\system32\services.exe]  <Microsoft Corporation><5.00.2195.6700>
    [C:\WINNT\system32\dmserver.dll]  <VERITAS Software Corp.><2195.6605.297.3>
[PID: 248][C:\WINNT\system32\lsass.exe]  <Microsoft Corporation><5.00.2195.6902>
[PID: 416][C:\WINNT\system32\svchost.exe]  <Microsoft Corporation><5.00.2134.1>
[PID: 504][C:\WINNT\system32\spoolsv.exe]  <Microsoft Corporation><5.00.2195.7059>
    [C:\WINNT\system32\AdobePDF.dll]  <Adobe Systems Incorporated.><7.0.0.00>
    [D:\Program Files\Adobe\Acrobat 7.0\Distillr\AdistRes.CHS]  <N/A><N/A>
    [C:\WINNT\system32\KMPJLMNT.DLL]  <KYOCERA MITA Corporation><1, 0, 0, 6>
[PID: 552][C:\WINNT\System32\svchost.exe]  <Microsoft Corporation><5.00.2134.1>
    [c:\program files\iesnap\navoct.dll]  < ><1, 0, 1, 1>
    [c:\PROGRA~1\iesnap\navstub.dll]  <><1, 0, 1, 1>
    [C:\PROGRA~1\ryoh\eobx.dll]  <><1, 0, 0, 6>
    [C:\PROGRA~1\ryoh\jtgs.dll]  < ><1, 0, 0, 6>
[PID: 576][C:\WINNT\system32\rundll32.exe]  <Microsoft Corporation><5.00.2134.1>
    [C:\PROGRA~1\lvib\sspi.dll]  <><1, 2, 0, 8>
    [C:\PROGRA~1\ryoh\eobx.dll]  <><1, 0, 0, 6>
    [C:\PROGRA~1\ryoh\jtgs.dll]  < ><1, 0, 0, 6>
    [c:\PROGRA~1\iesnap\navstub.dll]  <><1, 0, 1, 1>
[PID: 836][C:\WINNT\system32\MSTask.exe]  <Microsoft Corporation><4.71.2195.6920>
    [C:\PROGRA~1\ryoh\eobx.dll]  <><1, 0, 0, 6>
    [C:\PROGRA~1\ryoh\jtgs.dll]  < ><1, 0, 0, 6>
    [c:\PROGRA~1\iesnap\navstub.dll]  <><1, 0, 1, 1>
[PID: 784][C:\WINNT\system32\stisvc.exe]  <Microsoft Corporation><5.00.2195.6656>
[PID: 932][C:\WINNT\system32\rundll32.exe]  <Microsoft Corporation><5.00.2134.1>
    [C:\PROGRA~1\ryoh\blyu.dll]  < ><4, 1, 0, 4>
    [c:\PROGRA~1\iesnap\navstub.dll]  <><1, 0, 1, 1>
    [C:\PROGRA~1\ryoh\eobx.dll]  <><1, 0, 0, 6>
    [C:\PROGRA~1\ryoh\jtgs.dll]  < ><1, 0, 0, 6>
    [C:\PROGRA~1\ryoh\gqdw.dll]  < ><1, 0, 0, 6>
[PID: 1008][C:\WINNT\System32\WBEM\WinMgmt.exe]  <Microsoft Corporation><1.50.1085.0100>
[PID: 1044][C:\WINNT\system32\svchost.exe]  <Microsoft Corporation><5.00.2134.1>
[PID: 3748][C:\WINNT\Explorer.exe]  <Microsoft Corporation><5.00.3700.6690>
    [C:\PROGRA~1\ryoh\eobx.dll]  <><1, 0, 0, 6>
    [C:\PROGRA~1\ryoh\jtgs.dll]  < ><1, 0, 0, 6>
    [c:\PROGRA~1\iesnap\navstub.dll]  <><1, 0, 1, 1>
    [C:\WINNT\system32\winform.dll]  <N/A><N/A>
    [f:\Temp\Gjzo0.dll]  <N/A><N/A>
    [C:\WINNT\system32\ntmsusr.dll]  <N/A><N/A>
    [C:\Program Files\Rising\AntiSpyware\ieprot.dll]  <Beijing Rising Technology Co., Ltd.><1, 0, 0, 5>
    [f:\Temp\upxdnd.dll]  <N/A><N/A>
    [C:\WINNT\system32\msccrt.dll]  <N/A><N/A>
    [C:\WINNT\system32\cmdbcs.dll]  <N/A><N/A>
    [C:\WINNT\system32\mppds.dll]  <N/A><N/A>
    [C:\WINNT\System32\igfxpph.dll]  <Intel Corporation><3.0.0.4396>
    [C:\WINNT\System32\hccutils.DLL]  <Intel Corporation><3.0.0.4396>
    [C:\WINNT\system32\igfxres.dll]  <Intel Corporation><3.0.0.4396>
    [C:\WINNT\system32\igfxress.dll]  <Intel Corporation><3.0.0.4396>
    [C:\WINNT\System32\igfxsrvc.dll]  <Intel Corporation><3.0.0.4396>
    [D:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll]  <Adobe Systems Incorporated><7.0.0.2004121400>
    [C:\PROGRA~1\lvib\pwmf.dll]  <><1, 2, 0, 8>
    [C:\Program Files\superutilbar\superutilbar.dll]  <www.shiyongsousuo.com><2, 1, 8, 24>
    [C:\Program Files\Common Files\Microsoft Shared\Web Folders\2052\nsextint.dll]  <N/A><N/A>
    [D:\Program Files\Adobe\Acrobat 7.0\ActiveX\PDFShell.dll]  <Adobe Systems, Inc.><7.0.0.0>
[PID: 3864][C:\WINNT\system32\crs.exe]  <N/A><N/A>
    [C:\Program Files\Rising\AntiSpyware\ieprot.dll]  <Beijing Rising Technology Co., Ltd.><1, 0, 0, 5>
[PID: 4084][C:\WINNT\System32\hkcmd.exe]  <Intel Corporation><3.0.0.4396>
    [C:\WINNT\System32\hccutils.DLL]  <Intel Corporation><3.0.0.4396>
    [C:\PROGRA~1\ryoh\eobx.dll]  <><1, 0, 0, 6>
    [C:\PROGRA~1\ryoh\jtgs.dll]  < ><1, 0, 0, 6>
    [c:\PROGRA~1\iesnap\navstub.dll]  <><1, 0, 1, 1>
    [C:\WINNT\System32\igfxsrvc.dll]  <Intel Corporation><3.0.0.4396>
    [C:\WINNT\System32\igfxres.dll]  <Intel Corporation><3.0.0.4396>
[PID: 4060][C:\WINNT\System32\igfxpers.exe]  <Intel Corporation><3.0.0.4396>
    [C:\PROGRA~1\ryoh\eobx.dll]  <><1, 0, 0, 6>
    [C:\PROGRA~1\ryoh\jtgs.dll]  < ><1, 0, 0, 6>
    [c:\PROGRA~1\iesnap\navstub.dll]  <><1, 0, 1, 1>
    [C:\WINNT\System32\igfxsrvc.dll]  <Intel Corporation><3.0.0.4396>
[PID: 4036][C:\Program Files\Rising\AntiSpyware\runiep.exe]  <Beijing Rising Technology Co., Ltd.><1, 0, 1, 3>
    [C:\Program Files\Rising\AntiSpyware\iep_ctrl.dll]  <Beijing Rising Technology Co., Ltd.><1, 0, 0, 4>
    [C:\Program Files\Rising\AntiSpyware\ieprot.dll]  <Beijing Rising Technology Co., Ltd.><1, 0, 0, 5>
    [C:\PROGRA~1\ryoh\eobx.dll]  <><1, 0, 0, 6>
    [C:\PROGRA~1\ryoh\jtgs.dll]  < ><1, 0, 0, 6>
    [c:\PROGRA~1\iesnap\navstub.dll]  <><1, 0, 1, 1>
[PID: 1228][C:\WINNT\system32\ctfmon.exe]  <Microsoft Corporation><1.00.2409.34 built by: Lab06_N>
    [C:\PROGRA~1\ryoh\eobx.dll]  <><1, 0, 0, 6>
    [C:\PROGRA~1\ryoh\jtgs.dll]  < ><1, 0, 0, 6>
    [c:\PROGRA~1\iesnap\navstub.dll]  <><1, 0, 1, 1>
    [C:\Program Files\Rising\AntiSpyware\ieprot.dll]  <Beijing Rising Technology Co., Ltd.><1, 0, 0, 5>
[PID: 3920][C:\WINNT\system32\wuauclt.exe]  <Microsoft Corporation><5.4.3630.2554 built by: lab04_n>
    [C:\PROGRA~1\ryoh\eobx.dll]  <><1, 0, 0, 6>
    [C:\PROGRA~1\ryoh\jtgs.dll]  < ><1, 0, 0, 6>
    [c:\PROGRA~1\iesnap\navstub.dll]  <><1, 0, 1, 1>
[PID: 3420][C:\WINNT\wsttrs.exe]  <N/A><N/A>
    [C:\WINNT\system32\wsttrs.dll]  <N/A><N/A>
[PID: 3372][C:\WINNT\system32\crs.exe]  <N/A><N/A>
    [C:\Program Files\Rising\AntiSpyware\ieprot.dll]  <Beijing Rising Technology Co., Ltd.><1, 0, 0, 5>
[PID: 3288][C:\WINNT\system32\crs.exe]  <N/A><N/A>
    [C:\Program Files\Rising\AntiSpyware\ieprot.dll]  <Beijing Rising Technology Co., Ltd.><1, 0, 0, 5>
[PID: 3384][C:\WINNT\system32\conime.exe]  <Microsoft Corporation><5.00.2195.6655>
    [C:\PROGRA~1\ryoh\eobx.dll]  <><1, 0, 0, 6>
    [C:\PROGRA~1\ryoh\jtgs.dll]  < ><1, 0, 0, 6>
    [c:\PROGRA~1\iesnap\navstub.dll]  <><1, 0, 1, 1>
[PID: 3252][C:\WINNT\system32\crs.exe]  <N/A><N/A>
    [C:\Program Files\Rising\AntiSpyware\ieprot.dll]  <Beijing Rising Technology Co., Ltd.><1, 0, 0, 5>
[PID: 752][C:\WINNT\SYSTEM32\RUNDLL2000.EXE]  <Microsoft Corporation><5.00.2134.1>
[PID: 3936][C:\WINNT\system32\crs.exe]  <N/A><N/A>
    [C:\Program Files\Rising\AntiSpyware\ieprot.dll]  <Beijing Rising Technology Co., Ltd.><1, 0, 0, 5>
[PID: 3176][C:\WINNT\system32\crs.exe]  <N/A><N/A>
    [C:\Program Files\Rising\AntiSpyware\ieprot.dll]  <Beijing Rising Technology Co., Ltd.><1, 0, 0, 5>
[PID: 3212][C:\WINNT\system32\crs.exe]  <N/A><N/A>
    [C:\Program Files\Rising\AntiSpyware\ieprot.dll]  <Beijing Rising Technology Co., Ltd.><1, 0, 0, 5>
[PID: 3224][C:\WINNT\system32\crs.exe]  <N/A><N/A>
    [C:\Program Files\Rising\AntiSpyware\ieprot.dll]  <Beijing Rising Technology Co., Ltd.><1, 0, 0, 5>
[PID: 1332][C:\WINNT\system32\crs.exe]  <N/A><N/A>
    [C:\Program Files\Rising\AntiSpyware\ieprot.dll]  <Beijing Rising Technology Co., Ltd.><1, 0, 0, 5>
[PID: 4188][C:\WINNT\system32\crs.exe]  <N/A><N/A>
    [C:\Program Files\Rising\AntiSpyware\ieprot.dll]  <Beijing Rising Technology Co., Ltd.><1, 0, 0, 5>
[PID: 3964][C:\WINNT\system32\crs.exe]  <N/A><N/A>
    [C:\Program Files\Rising\AntiSpyware\ieprot.dll]  <Beijing Rising Technology Co., Ltd.><1, 0, 0, 5>
[PID: 3948][C:\WINNT\system32\crs.exe]  <N/A><N/A>
    [C:\Program Files\Rising\AntiSpyware\ieprot.dll]  <Beijing Rising Technology Co., Ltd.><1, 0, 0, 5>
[PID: 3892][\\Ydjc02\lucd\安全\sreng2\SRENG.EXE]  <N/A><N/A>
    [C:\PROGRA~1\ryoh\eobx.dll]  <><1, 0, 0, 6>
    [C:\PROGRA~1\ryoh\jtgs.dll]  < ><1, 0, 0, 6>
    [c:\PROGRA~1\iesnap\navstub.dll]  <><1, 0, 1, 1>
    [C:\Program Files\Rising\AntiSpyware\ieprot.dll]  <Beijing Rising Technology Co., Ltd.><1, 0, 0, 5>
    [C:\WINNT\system32\cmdbcs.dll]  <N/A><N/A>
    [f:\Temp\Gjzo0.dll]  <N/A><N/A>
[PID: 1488][C:\WINNT\system32\crs.exe]  <N/A><N/A>
    [C:\Program Files\Rising\AntiSpyware\ieprot.dll]  <Beijing Rising Technology Co., Ltd.><1, 0, 0, 5>
[PID: 452][C:\WINNT\system32\crs.exe]  <N/A><N/A>
    [C:\Program Files\Rising\AntiSpyware\ieprot.dll]  <Beijing Rising Technology Co., Ltd.><1, 0, 0, 5>
[PID: 3080][C:\WINNT\system32\crs.exe]  <N/A><N/A>
    [C:\Program Files\Rising\AntiSpyware\ieprot.dll]  <Beijing Rising Technology Co., Ltd.><1, 0, 0, 5>
[PID: 3048][C:\WINNT\system32\crs.exe]  <N/A><N/A>
    [C:\Program Files\Rising\AntiSpyware\ieprot.dll]  <Beijing Rising Technology Co., Ltd.><1, 0, 0, 5>

qq85167803