【回复“Leoooo”的帖子】
+ 用户登陆自运行项目
+ HKCU\Software\Microsoft\Windows\CurrentVersion\Run
bgswitch
[A ] 39. c:\windows\system32\bgswitch.exe
.text,.data,.rsrc,
+ HKLM\Software\Microsoft\Windows\CurrentVersion\Run
SiSUSBRG
[A ] 40. c:\windows\sisusbrg.exe
Silicon Integrated Systems Corp.
SiSUSBrg
.text,.rdata,.data,.rsrc,
runeip
[AM] 41. c:\program files\rising\antispyware\runiep.exe
Beijing Rising Technology Co., Ltd.
Rising AntiSpyware Monitor
.text,.rdata,.data,.rsrc,
RavTask
[A ] 42. c:\program files\rising\rav\ravtask.exe
Beijing Rising Technology Co., Ltd.
RavTimer
.text,.rdata,.data,.rsrc,
RfwMain
[AM] 43. c:\program files\rising\rfw\rfwmain.exe
Beijing Rising Technology Co., Ltd.
Rising Personal FireWall Main Program
.text,.rdata,.data,.rsrc,
+ 开机执行
+ HKLM\SYSTEM\CurrentControlSet\Control\NetworkProvider\Order
BootExecute
[A ] 44. c:\windows\system32\bsmain.exe
Beijing Rising Technology Co., Ltd.
BootScan
.text,.data,.rsrc,.reloc,
+ 映像劫持
+ HKCR\.html
htmlfile\Edit\Command
[A ] 45. c:\program files\microsoft office\office\msohtmed.exe
Microsoft Corporation
Microsoft Office 2000 component
.text,.data,.idata,.rsrc,
htmlfile\Print\Command
[A ] 45. c:\program files\microsoft office\office\msohtmed.exe
Microsoft Corporation
Microsoft Office 2000 component
.text,.data,.idata,.rsrc,
+ HKCR\.htm
htmlfile\Edit\Command
[A ] 45. c:\program files\microsoft office\office\msohtmed.exe
Microsoft Corporation
Microsoft Office 2000 component
.text,.data,.idata,.rsrc,
htmlfile\Print\Command
[A ] 45. c:\program files\microsoft office\office\msohtmed.exe
Microsoft Corporation
Microsoft Office 2000 component
.text,.data,.idata,.rsrc,
+ 其他自启动项目
+ C:\Documents and Settings\All Users\「开始」菜单\程序\启动
Microsoft Office.lnk
[A ] 46. c:\program files\microsoft office\office\osa9.exe
Microsoft Corporation
Microsoft Office 2000 component
.text,.data,.rsrc,
+ 正在运行的进程
+ 00000118(280) smss.exe
+ 00000150(336) csrss.exe
+ 00000168(360) winlogon.exe
72C80000[00008000]
[ M] 47. c:\windows\system32\msacm32.drv
Microsoft Corporation
Microsoft Sound Mapper
.text,.data,.rsrc,.reloc,
+ 00000194(404) services.exe
+ 000001a0(416) lsass.exe
+ 00000234(564) svchost.exe
+ 00000260(608) svchost.exe
+ 00000298(664) svchost.exe
+ 000002d4(724) svchost.exe
+ 0000032c(812) svchost.exe
+ 000003e0(992) Explorer.EXE
72C80000[00008000]
[ M] 47. c:\windows\system32\msacm32.drv
Microsoft Corporation
Microsoft Sound Mapper
.text,.data,.rsrc,.reloc,
01BC0000[0001B000]
[ M] 48. c:\program files\rising\antispyware\ieprot.dll
Beijing Rising Technology Co., Ltd.
IE Protector
.text,.rdata,.data,.rsrc,.reloc,
10000000[0001B000]
[AM] 36. c:\windows\system32\ravext.dll
Beijing Rising Technology Co., Ltd.
Rising Shell Ext Module
.text,.rdata,.data,.rsrc,.reloc,
02030000[00011000]
[AM] 38. c:\windows\system32\shlhook.dll
Beijing Rising Technology Co., Ltd.
shlhook Module
.text,.rdata,.data,.rsrc,.reloc,
02060000[0004F000]
[AM] 37. c:\program files\yahoo!\assistant\assist\ywiper.dll
Yahoo! China
Wiper 动态链接库
.text,.rdata,.data,.rsrc,.reloc,
020B0000[0002B000]
[AM] 35. c:\program files\winrar\rarext.dll
.text,.data,.tls,.idata,.edata,.rsrc,.reloc,
23700000[0001A000]
[ M] 49. c:\program files\rising\rav\rscommon.dll
Beijing Rising Technology Co., Ltd.
Rising Common Function Dynamic Link Library
.text,.rdata,.data,.rsrc,.reloc,
53000000[00015000]
[ M] 50. c:\program files\yahoo!\assistant\yhelper.dll
Yahoo! China
Helper Module
.text,.rdata,.data,.cnshelp,.rsrc,.reloc,
+ 000004ac(1196) spoolsv.exe
+ 000004f8(1272) ctfmon.exe
10000000[0001B000]
[ M] 48. c:\program files\rising\antispyware\ieprot.dll
Beijing Rising Technology Co., Ltd.
IE Protector
.text,.rdata,.data,.rsrc,.reloc,
+ 00000554(1364) wdfmgr.exe
01000000[0000C000]
[AM] 5. c:\windows\system32\wdfmgr.exe
Microsoft Corporation
Windows User Mode Driver Manager
.text,.data,.rsrc,
+ 00000638(1592) RfwMain.exe
00400000[00073000]
[AM] 43. c:\program files\rising\rfw\rfwmain.exe
Beijing Rising Technology Co., Ltd.
Rising Personal FireWall Main Program
.text,.rdata,.data,.rsrc,
26600000[0007D000]
[ M] 51. c:\program files\rising\rfw\rsguilib.dll
Beijing Rising Technology Co., Ltd.
Rising GUI Library Loader
.text,.rdata,.data,.rsrc,.reloc,
23700000[0001A000]
[ M] 52. c:\program files\rising\rfw\rscommon.dll
Beijing Rising Technology Co., Ltd.
Rising Common Function Dynamic Link Library
.text,.rdata,.data,.rsrc,.reloc,
10000000[0000F000]
[ M] 53. c:\program files\rising\rfw\rfwctrl.dll
Beijing Rising Technology Co., Ltd.
RfwCtrl DLL
.text,.rdata,.data,.rsrc,.reloc,
23800000[0001A000]
[ M] 54. c:\program files\rising\rfw\rsxml.dll
Beijing Rising Technology Co., Ltd.
RsXML
.text,.rdata,.data,.rsrc,.reloc,
23900000[00031000]
[ M] 55. c:\program files\rising\rfw\pngdll.dll
Beijing Rising Technology Co., Ltd.
Rising .Png File Loader Dynamic Link Library
.text,.rdata,.data,.rsrc,.reloc,
01310000[0001B000]
[ M] 48. c:\program files\rising\antispyware\ieprot.dll
Beijing Rising Technology Co., Ltd.
IE Protector
.text,.rdata,.data,.rsrc,.reloc,
+ 00000780(1920) alg.exe
+ 00000c80(3200) ylive.exe
00400000[00016000]
[ M] 56. c:\program files\yahoo!\assistant\ylive.exe
Yahoo! China
YLive
.text,.rdata,.data,.rsrc,
53000000[00015000]
[ M] 50. c:\program files\yahoo!\assistant\yhelper.dll
Yahoo! China
Helper Module
.text,.rdata,.data,.cnshelp,.rsrc,.reloc,
3C400000[00039000]
[ M] 57. c:\program files\yahoo!\assistant\yalive.dll
yahoo! china
AutoLive Module
.text,.rdata,.data,.ylive_d,.rsrc,.reloc,
40000000[0002A000]
[ M] 58. c:\program files\yahoo!\assistant\yalliveex.dll
Yahoo! China
LiveEx
.text,.rdata,.data,.rsrc,.reloc,
10000000[0001B000]
[ M] 48. c:\program files\rising\antispyware\ieprot.dll
Beijing Rising Technology Co., Ltd.
IE Protector
.text,.rdata,.data,.rsrc,.reloc,
40800000[0001A000]
[ M] 59. c:\program files\yahoo!\assistant\ynotifier.dll
yahoo! china
Notifier Module
.text,.rdata,.data,.YahooNT,.rsrc,.reloc,
+ 00000e0c(3596) runiep.exe
00400000[00012000]
[AM] 41. c:\program files\rising\antispyware\runiep.exe
Beijing Rising Technology Co., Ltd.
Rising AntiSpyware Monitor
.text,.rdata,.data,.rsrc,
53000000[00015000]
[ M] 50. c:\program files\yahoo!\assistant\yhelper.dll
Yahoo! China
Helper Module
.text,.rdata,.data,.cnshelp,.rsrc,.reloc,
00C50000[0001B000]
[ M] 48. c:\program files\rising\antispyware\ieprot.dll
Beijing Rising Technology Co., Ltd.
IE Protector
.text,.rdata,.data,.rsrc,.reloc,
+ 00000ea0(3744) WINWORD.EXE
30000000[00836000]
[ M] 60. c:\program files\microsoft office\office\winword.exe
Microsoft Corporation
Microsoft Word for Windows
.text,.data,.tls,.CRT,.rsrc,
308C0000[00559000]
[ M] 61. c:\program files\microsoft office\office\mso9.dll
Microsoft Corporation
Microsoft Office 2000 component
.text,.data,.rsrc,.reloc,
53000000[00015000]
[ M] 50. c:\program files\yahoo!\assistant\yhelper.dll
Yahoo! China
Helper Module
.text,.rdata,.data,.cnshelp,.rsrc,.reloc,
10000000[0002D000]
[ M] 62. c:\program files\rising\rav\rsplugin.dll
Beijing Rising Technology Co., Ltd.
RsPlugIn Module
.text,.rdata,.data,.rsrc,.reloc,
01930000[0001B000]
[ M] 48. c:\program files\rising\antispyware\ieprot.dll
Beijing Rising Technology Co., Ltd.
IE Protector
.text,.rdata,.data,.rsrc,.reloc,
507C0000[00084000]
[ M] 63. c:\program files\common files\microsoft shared\proof\mslid.dll
Microsoft Corporation
Microsoft Language Identification DLL
.text,.data,.rsrc,.reloc,
02320000[000AB000]
[ M] 64. c:\program files\common files\microsoft shared\proof\wdbrkchs.dll
Microsoft Corporation
Microsoft (R) Simplified Chinese Wordbreaker
.text,.rdata,.data,.idata,.rsrc,.reloc,
+ 00000ebc(3772) Ras.exe
00400000[0013F000]
[ M] 65. c:\program files\rising\antispyware\ras.exe
Beijing Rising Technology Co., Ltd.
Rising AntiSpyware
.text,.rdata,.data,.rsrc,
53000000[00015000]
[ M] 50. c:\program files\yahoo!\assistant\yhelper.dll
Yahoo! China
Helper Module
.text,.rdata,.data,.cnshelp,.rsrc,.reloc,
10000000[000A3000]
[ M] 66. c:\program files\rising\antispyware\rasgui.dll
Beijing Rising Technology Co., Ltd.
RasGUI
.text,.rdata,.data,.rsrc,.reloc,
015D0000[0001B000]
[ M] 48. c:\program files\rising\antispyware\ieprot.dll
Beijing Rising Technology Co., Ltd.
IE Protector
.text,.rdata,.data,.rsrc,.reloc,