启动项目
注册表
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
<Internat.exe><; internat.exe> [Microsoft Corporation]
[HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows]
<load><> []
<run><> []
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
<Synchronization Manager><; mobsync.exe /logon> [Microsoft Corporation]
<AtiPTA><; Atiptaxx.exe> [ATI Technologies, Inc.]
<TkBellExe><; "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot> [RealNetworks, Inc.]
<RavTimer><; C:\Program Files\rising\rav\RavTimer.exe> [rising]
<RavMon><; C:\Program Files\rising\rav\RavMon.exe> [rising]
<RavService><; C:\Program Files\Rising\Rav\RavService.exe> []
<kpcdst><; C:\001\001\cdsprite.exe> []
<Super Rabbit Desktop Set><; C:\Program Files\Super Rabbit\MagicSet\DS.EXE /Load> [Super Rabbit Software]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunServices]
<RavMon><; C:\Program Files\rising\rav\RavMon.exe /AUTO> [rising]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
<shell><explorer.exe> [Microsoft Corporation]
<Userinit><C:\WINNT\system32\userinit.exe,> [Microsoft Corporation]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Windows]
<AppInit_DLLs><> []
==================================
启动文件夹
服务
[Ati HotKey Poller / Ati HotKey Poller]
<C:\WINNT\System32\ati2plab.exe><N/A>
[Logical Disk Manager Administrative Service / dmadmin]
<C:\WINNT\System32\dmadmin.exe /com><VERITAS Software Corp.>
[Microsoft NetWork FireWall Services / Microsoft NetWork FireWall Services]
<Net_Services.exe><N/A>
[Microsoft NetWork FireWall Services / Microsoft NetWork FireWall Services]
<NetServices.exe><N/A>
[Rising Process Communication Center / RsCCenter]
<C:\Program Files\Rising\Rav\CCenter.exe><rising>
[Rising Realtime Monitor Service / RsRavMon]
<C:\Program Files\Rising\Rav\RavMonD.exe><rising>
[Smart Card Helper / SCardDrv]
<C:\WINNT\system32\scardsvr32.exe -v><N/A>
==================================
浏览器加载项
[@shdoclc.dll,-866]
{c95fe080-8f5d-11d2-a20b-00aa003c157a} <, N/A>
[电台(&R)]
{8E718888-423F-11D2-876E-00A0C9082467} <C:\WINNT\system32\msdxm.ocx, Microsoft Corporation>
[Shockwave Flash
Object]
{D27CDB6E-AE6D-11CF-96B8-444553540000} <C:\WINNT\system32\macromed\flash\Flash.ocx, Macromedia, Inc.>
==================================
正在运行的进程
[PID: 160][\SystemRoot\System32\smss.exe] <Microsoft Corporation><5.00.2195.6601>
[PID: 184][\??\C:\WINNT\system32\csrss.exe] <Microsoft Corporation><5.00.2195.6601>
[PID: 180][\??\C:\WINNT\system32\winlogon.exe] <Microsoft Corporation><5.00.2195.6970>
[C:\Program Files\Rising\Rav\ApiHook.dll] <北京瑞星><16, 0, 0, 19>
[C:\Program Files\Rising\Rav\MemMon.dll] <北京瑞星><16, 2, 0, 6>
[PID: 232][C:\WINNT\system32\services.exe] <Microsoft Corporation><5.00.2195.6700>
[C:\WINNT\system32\dmserver.dll] <VERITAS Software Corp.><2195.6605.297.3>
[C:\Program Files\Rising\Rav\ApiHook.dll] <北京瑞星><16, 0, 0, 19>
[C:\Program Files\Rising\Rav\MemMon.dll] <北京瑞星><16, 2, 0, 6>
[PID: 244][C:\WINNT\system32\lsass.exe] <Microsoft Corporation><5.00.2195.6902>
[PID: 412][C:\WINNT\system32\svchost.exe] <Microsoft Corporation><5.00.2134.1>
[PID: 456][C:\WINNT\System32\svchost.exe] <Microsoft Corporation><5.00.2134.1>
[C:\Program Files\Rising\Rav\ApiHook.dll] <北京瑞星><16, 0, 0, 19>
[C:\Program Files\Rising\Rav\MemMon.dll] <北京瑞星><16, 2, 0, 6>
[PID: 508][C:\WINNT\system32\spoolsv.exe] <Microsoft Corporation><5.00.2195.6659>
[C:\Program Files\Rising\Rav\ApiHook.dll] <北京瑞星><16, 0, 0, 19>
[C:\Program Files\Rising\Rav\MemMon.dll] <北京瑞星><16, 2, 0, 6>
[PID: 664][C:\WINNT\Explorer.EXE] <Microsoft Corporation><5.00.3700.6690>
[C:\Program Files\Rising\Rav\ApiHook.dll] <北京瑞星><16, 0, 0, 19>
[C:\Program Files\Rising\Rav\MemMon.dll] <北京瑞星><16, 2, 0, 6>
[C:\PROGRA~1\WINZIP\WZSHLSTB.DLL] <WinZip Computing, Inc.><4.1 (32-bit)>
[C:\PROGRA~1\WINZIP\wzshlex1.dll] <WinZip Computing, Inc.><4.1 (32-bit)>
[C:\PROGRA~1\WINZIP\WZCAB3.DLL] <WinZip Computing, Inc.><3.1 (32-bit)>
[C:\PROGRA~1\COMMON~1\MICROS~1\WEBFOL~1\MSONSEXT.DLL] <N/A><N/A>
[C:\Program Files\WinRAR\rarext.dll] <N/A><N/A>
[C:\WINNT\system32\RAVEXT.DLL] <Beijing Rising Technology Co., Ltd.><16, 0, 0, 4>
[PID: 760][C:\Program Files\rising\rav\RavTimer.exe] <rising><16, 0, 0, 23>
[C:\Program Files\rising\rav\Language.dll] <RiSing><15, 0, 0, 17>
[C:\Program Files\rising\rav\RsCommX.dll] <rising><15, 0, 1, 13>
[C:\Program Files\Rising\Rav\ApiHook.dll] <北京瑞星><16, 0, 0, 19>
[C:\Program Files\Rising\Rav\MemMon.dll] <北京瑞星><16, 2, 0, 6>
[PID: 768][C:\Program Files\rising\rav\RavMon.exe] <rising><16, 0, 0, 32>
[C:\Program Files\Rising\Rav\ApiHook.dll] <北京瑞星><16, 0, 0, 19>
[C:\Program Files\Rising\Rav\MemMon.dll] <北京瑞星><16, 2, 0, 6>
[C:\Program Files\rising\rav\RavMon.dll] <Beijing Rising Tech. Co. Ltd.><16, 0, 0, 63>
[C:\Program Files\rising\rav\guidll.dll] <rising><16, 0, 0, 36>
[C:\Program Files\rising\rav\RsCommX.dll] <rising><15, 0, 1, 13>
[C:\Program Files\rising\rav\Language.dll] <RiSing><15, 0, 0, 17>
[PID: 776][C:\Program Files\Super Rabbit\MagicSet\DS.EXE] <Super Rabbit Software><1.50>
[PID: 676][C:\Program Files\Rising\Rav\CCenter.exe] <rising><15, 0, 1, 8>
[PID: 796][C:\Program Files\Rising\Rav\RavMonD.exe] <rising><16, 0, 0, 12>
[C:\Program Files\Rising\Rav\RavMon.dll] <Beijing Rising Tech. Co. Ltd.><16, 0, 0, 63>
[C:\Program Files\Rising\Rav\guidll.dll] <rising><16, 0, 0, 36>
[C:\Program Files\Rising\Rav\RsCommX.dll] <rising><15, 0, 1, 13>
[C:\Program Files\Rising\Rav\Language.dll] <RiSing><15, 0, 0, 17>
[C:\Program Files\Rising\Rav\Engine.dll] <rising><16, 0, 0, 56>
[C:\Program Files\Rising\Rav\LibLoad.dll] <Rising><16, 0, 0, 34>
[C:\Program Files\Rising\Rav\StoreDll.dll] <Beijing Rising Technology Co., Ltd.><16, 0, 0, 10>
[C:\Program Files\Rising\Rav\ScanFile.dll] <rising><16, 0, 0, 52>
[C:\Program Files\Rising\Rav\NVFile.dll] <rising><16, 0, 0, 4>
[C:\Program Files\Rising\Rav\PostTrt.dll] <Rising><16, 0, 0, 27>
[C:\Program Files\Rising\Rav\PostTrtX.dll] <瑞星科技股份有限公司><16, 0, 0, 10>
[C:\Program Files\Rising\Rav\ExtFile.dll] <RiSing><16, 0, 0, 28>
[C:\Program Files\Rising\Rav\ExtMail.dll] <rising><16, 0, 0, 31>
[C:\Program Files\Rising\Rav\ScanEx.dll] <rising><16, 0, 0, 62>
[C:\Program Files\Rising\Rav\UnMacro.dll] <rising><16, 0, 0, 10>
[C:\Program Files\Rising\Rav\UnExe.dll] <Rising><16, 0, 0, 36>
[C:\Program Files\Rising\Rav\UnMail.dll] <rising><16, 0, 0, 7>
[C:\Program Files\Rising\Rav\BtEngine.dll] <rising><16, 0, 0, 31>
[C:\Program Files\Rising\Rav\ApiHook.dll] <北京瑞星><16, 0, 0, 19>
[C:\Program Files\Rising\Rav\setup.dll] <北京瑞星科技股份有限公司><14, 10, 0, 11>
[C:\Program Files\Rising\Rav\MemMon.dll] <北京瑞星><16, 2, 0, 6>
[C:\Program Files\Rising\Rav\zip.dll] <rising><13, 0, 0, 1>
[C:\Program Files\Rising\Rav\VirusLib.dll] <rs><16, 0, 0, 16>
[PID: 812][C:\WINNT\system32\MSTask.exe] <Microsoft Corporation><4.71.2195.6920>
[PID: 856][C:\WINNT\System32\WBEM\WinMgmt.exe] <Microsoft Corporation><1.50.1085.0100>
[C:\Program Files\Rising\Rav\ApiHook.dll] <北京瑞星><16, 0, 0, 19>
[C:\Program Files\Rising\Rav\MemMon.dll] <北京瑞星><16, 2, 0, 6>
[PID: 876][C:\WINNT\system32\svchost.exe] <Microsoft Corporation><5.00.2134.1>
[C:\Program Files\Rising\Rav\ApiHook.dll] <北京瑞星><16, 0, 0, 19>
[C:\Program Files\Rising\Rav\MemMon.dll] <北京瑞星><16, 2, 0, 6>
[PID: 1188][C:\WINNT\system32\wuauclt.exe] <Microsoft Corporation><5.8.0.2469 built by: lab01_n(wmbla)>
[C:\Program Files\Rising\Rav\ApiHook.dll] <北京瑞星><16, 0, 0, 19>
[C:\Program Files\Rising\Rav\MemMon.dll] <北京瑞星><16, 2, 0, 6>
[PID: 304][D:\009\SREng2\SREng.exe] <Smallfrogs Studio><2.0.21.505>
[C:\Program Files\Rising\Rav\ApiHook.dll] <北京瑞星><16, 0, 0, 19>
[C:\Program Files\Rising\Rav\MemMon.dll] <北京瑞星><16, 2, 0, 6>
[C:\Program Files\Rising\Rav\RavProxy.dll] <rising><16, 0, 0, 6>
[PID: 316][C:\Program Files\rising\rav\RavService.exe] <><16, 0, 0, 33>
[C:\Program Files\Rising\Rav\ApiHook.dll] <北京瑞星><16, 0, 0, 19>
[C:\Program Files\Rising\Rav\MemMon.dll] <北京瑞星><16, 2, 0, 6>
[C:\Program Files\rising\rav\RsCommX.dll] <rising><15, 0, 1, 13>
[C:\Program Files\rising\rav\RavService936.dll] <瑞星><16, 0, 0, 9>
[C:\Program Files\Rising\Rav\RavProxy.dll] <rising><16, 0, 0, 6>
