ows\system32\drivers\ialmsbw.sys
Intel Corporation
Intel Graphics Platform (SoftBIOS) Driver for Windows 2000(R) & Windows XP(TM)
.text,.rdata,.data,.edata,INIT,.rsrc,.reloc,
{D31A0762-0CEB-444e-ACFF-B049A1F6FE91}
[A ] 26. c:\windows\system32\drivers\ialmkchw.sys
Intel Corporation
Intel Graphics Chipset (KCH) Driver for Windows 2000(R) & Windows XP(TM)
.text,.rdata,.data,.edata,INIT,.rsrc,.reloc,
+ 系统登陆自运行
+ HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify
igfxcui
[AM] 27. c:\windows\system32\igfxsrvc.dll
Intel Corporation
igfxsrvc Module
.text,.rdata,.data,.rsrc,.reloc,
+ IE浏览器加载模块
+ HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar
{7A38130D-BEB7-4d60-BE7A-4C4AB6A85CD1}
[A ] 28. c:\windows\vcbar11.dll
VCBar Module
.rdata,.data,.rsrc,.reloc,
+ HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper
Objects
{00000AAA-A363-466E-BEF5-9BB68697AA7F}
[A ] 29. c:\program files\thunder network\webthunder\webthunderbho_now.dll
Thunder Networking Technologies,LTD
XunLeiBHO
.text,.rdata,.data,.rsrc,.reloc,
{0005A87D-D626-4B3A-84F9-1D9571695F55}
[A ] 30. c:\windows\system32\xunleibho_v8.dll
Thunder Networking Technologies,LTD
xunleibho BHO
.text,.rdata,.data,.rsrc,.reloc,
+ HKLM\SOFTWARE\Microsoft\Internet Explorer\Extensions
Exec
[A ] 31. e:\tencent\qq.exe
TENCENT
QQ
.text,.rdata,.data,.rsrc,
+ 资源管理器加载模块
+ HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved
HyperTerminal Icon Ext
[A ] 32. c:\windows\system32\hticons.dll
Hilgraeve, Inc.
HyperTerminal Applet Library
.text,.data,.rsrc,.reloc,
WinRAR shell extension
[A ] 33. c:\program files\winrar\rarext.dll
.text,.data,.tls,.idata,.edata,.rsrc,.reloc,
Shell Extensions for RealOne Player
[A ] 34. c:\program files\real\realplayer\rpshell.dll
RealNetworks, Inc.
RealPlayer Shell Extensions
.text,.rdata,.data,.rsrc,.reloc,
RISING
[AM] 35. c:\windows\system32\ravext.dll
Beijing Rising Technology Co., Ltd.
Rising Shell Ext Module
.text,.rdata,.data,.rsrc,.reloc,
+ HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks
{32CD708B-60A7-4C00-9377-D73EAA495F0F}
[AM] 35. c:\windows\system32\ravext.dll
Beijing Rising Technology Co., Ltd.
Rising Shell Ext Module
.text,.rdata,.data,.rsrc,.reloc,
{AC2DC2EF-5165-40A3-8CDF-41DCA1B0901A}
[AM] 36. c:\windows\system32\shlhook.dll
Beijing Rising Technology Co., Ltd.
shlhook Module
.text,.rdata,.data,.rsrc,.reloc,
+ 用户登陆自运行项目
+ HKLM\Software\Microsoft\Windows\CurrentVersion\Run
RavTask
[A ] 37. c:\program files\rising\rav\ravtask.exe
Beijing Rising Technology Co., Ltd.
RavTimer
.text,.rdata,.data,.rsrc,
RfwMain
[A ] 38. c:\program files\rising\rfw\rfwmain.exe
Beijing Rising Technology Co., Ltd.
Rising Personal FireWall Main Program
.text,.rdata,.data,.rsrc,
StormCodec_Helper
[A ] 39. c:\program files\ringz studio\storm codec\stormset.exe
.text,.rdata,.data,.ndata,.rsrc,
runeip
[AM] 40. c:\program files\rising\antispyware\runiep.exe
Beijing Rising Technology Co., Ltd.
Rising AntiSpyware Monitor
.text,.rdata,.data,.rsrc,
+ 开机执行
+ HKLM\SYSTEM\CurrentControlSet\Control\NetworkProvider\Order
BootExecute
[A ] 41. c:\windows\system32\bsmain.exe
Beijing Rising Technology Co., Ltd.
BootScan
.text,.data,.rsrc,.reloc,
+ 映像劫持
+ HKCR\.mp3
RealPlayer.MP3.6\open\Command
[A ] 42. c:\program files\ringz studio\storm codec\mplayerc.exe
Gabest
Media Player Classic
.text,_TEXT64,.rdata,.data,.rsrc,.IIDKing,
+ 正在运行的进程
+ 000001bc(444) smss.exe
+ 00000208(520) csrss.exe
+ 00000220(544) winlogon.exe
72C80000[00008000]
[ M] 43. c:\windows\system32\msacm32.drv
Microsoft Corporation
Microsoft Sound Mapper
.text,.data,.rsrc,.reloc,
+ 0000024c(588) services.exe
+ 00000258(600) lsass.exe
+ 000002f0(752) svchost.exe
+ 00000320(800) svchost.exe
+ 00000374(884) svchost.exe
+ 0000039c(924) svchost.exe
+ 00000418(1048) svchost.exe
+ 000004a4(1188) alg.exe
+ 000004d0(1232) Explorer.EXE
10000000[0001B000]
[AM] 35. c:\windows\system32\ravext.dll
Beijing Rising Technology Co., Ltd.
Rising Shell Ext Module
.text,.rdata,.data,.rsrc,.reloc,
00BF0000[00011000]
[AM] 36. c:\windows\system32\shlhook.dll
Beijing Rising Technology Co., Ltd.
shlhook Module
.text,.rdata,.data,.rsrc,.reloc,
013D0000[0001B000]
[ M] 44. c:\program files\rising\antispyware\ieprot.dll
Beijing Rising Technology Co., Ltd.
IE Protector
.text,.rdata,.data,.rsrc,.reloc,
72C80000[00008000]
[ M] 43. c:\windows\system32\msacm32.drv
Microsoft Corporation
Microsoft Sound Mapper
.text,.data,.rsrc,.reloc,
011E0000[00037000]
[ M] 45. c:\windows\system32\igfxpph.dll
Intel Corporation
igfxpph Module
.text,.rdata,.data,.rsrc,.reloc,
00AB0000[0001D000]
[ M] 46. c:\windows\system32\hccutils.dll
Intel Corporation
hccutils Module
.text,.rdata,.data,.rsrc,.reloc,
01A70000[00026000]
[ M] 47. c:\windows\system32\igfxres.dll
Intel Corporation
xxxxres Module
.text,.rdata,.data,.rsrc,.reloc,
01AA0000[00050000]
[AM] 27. c:\windows\system32\igfxsrvc.dll
Intel Corporation
igfxsrvc Module
.text,.rdata,.data,.rsrc,.reloc,
01AF0000[00026000]
[ M] 48. c:\windows\system32\igfxdev.dll
Intel Corporation
igfxdev Module
.text,.rdata,.data,.rsrc,.reloc,
+ 0000058c(1420) spoolsv.exe
+ 00000714(1812) runiep.exe
00400000[00013000]
[AM] 40. c:\program files\rising\antispyware\runiep.exe
Beijing Rising Technology Co., Ltd.
Rising AntiSpyware Monitor
.text,.rdata,.data,.rsrc,
00BB0000[0001B000]
[ M] 44. c:\program files\rising\antispyware\ieprot.dll
Beijing Rising Technology Co., Ltd.
IE Protector
.text,.rdata,.data,.rsrc,.reloc,
+ 000007dc(2012) ctfmon.exe
10000000[0001B000]
[ M] 44. c:\program files\rising\antispyware\ieprot.dll
Beijing Rising Technology Co., Ltd.
IE Protector
.text,.rdata,.data,.rsrc,.reloc,
+ 000009f0(2544) wuauclt.exe
+ 00000fc4(4036) Ras.exe
00400000[0013F000]
[ M] 49. c:\program files\rising\antispyware\ras.exe
Beijing Rising Technology Co., Ltd.
Rising AntiSpyware
.text,.rdata,.data,.rsrc,
10000000[000A3000]
[ M] 50. c:\program files\rising\antispyware\rasgui.dll
Beijing Rising Technology Co., Ltd.
RasGUI
.text,.rdata,.data,.rsrc,.reloc,
01590000[0001B000]
[ M] 44. c:\program files\rising\antispyware\ieprot.dll
Beijing Rising Technology Co., Ltd.
IE Protector
.text,.rdata,.data,.rsrc,.reloc,
