注释: [A]表示该文件存在自启动关联;
[M]表示该文件在内存中;
+ 注册表自运行项目
+ 系统服务
+ HKLM\System\CurrentControlSet\Services
C-DillaCdaC11BA
[AM] 1. c:\windows\system32\drivers\cdac11ba.exe
Macrovision
Macrovision RTS Service
.text,.rdata,.data,.rsrc,
RfwProxySrv
[A ] 2. c:\program files\rising\rfw\rfwproxy.exe
Beijing Rising Technology Co., Ltd.
Rising Personal Proxy Service
.text,.rdata,.data,.rsrc,
RfwService
[A ] 3. c:\program files\rising\rfw\rfwsrv.exe
Beijing Rising Technology Co., Ltd.
Rising Personal FireWall Service
.text,.rdata,.data,.rsrc,
RsCCenter
[A ] 4. c:\program files\rising\rav1\ccenter.exe
Beijing Rising Technology Co., Ltd.
CCenter
.text,.rdata,.data,.rsrc,
RsRavMon
[A ] 5. c:\program files\rising\rav1\ravmond.exe
Beijing Rising Technology Co., Ltd.
RavMond
.text,.rdata,.data,.rsrc,
ServiceLayer
[A ] 6. c:\program files\pc connectivity solution\servicelayer.exe
Nokia.
ServiceLayer Module
.text,.rdata,.data,.rsrc,
+ 内核驱动
+ HKLM\System\CurrentControlSet\Services
ALCXSENS
[A ] 7. c:\windows\system32\drivers\alcxsens.sys
Sensaura Ltd
Sensaura WDM 3D Audio Driver
.text,page,init,.data,init,INIT,.rsrc,.reloc,
ALCXWDM
[A ] 8. c:\windows\system32\drivers\alcxwdm.sys
Realtek Semiconductor Corp.
Realtek AC'97 Audio Driver (WDM)
.text,.rdata,.data,.CRT,PAGE,INIT,.rsrc,.reloc,
BaseTDI
[A ] 9. c:\windows\system32\drivers\basetdi.sys
Beijing Rising Technology Co., Ltd.
basetdi
.text,.rdata,.data,INIT,.rsrc,.reloc,
CdaC15BA
[A ] 10. c:\windows\system32\drivers\cdac15ba.sys
Macrovision Europe Ltd
Macrovision SECURITY Driver
.text,.data,INIT,.rsrc,.reloc,
ExpScaner
[A ] 11. c:\program files\rising\rav1\expscan.sys
ExpScan.sys
.text,.rdata,.data,INIT,.rsrc,.reloc,
HookCont
[A ] 12. c:\program files\rising\rav1\hookcont.sys
Rising
HookCont
.text,.rdata,.data,INIT,.rsrc,.reloc,
HookReg
[A ] 13. c:\program files\rising\rav1\hookreg.sys
.text,.rdata,.data,INIT,.rsrc,.reloc,
HookSys
[A ] 14. c:\program files\rising\rav1\hooksys.sys
Rising
Hooksys
.text,.rdata,.data,INIT,.rsrc,.reloc,
HookUrl
[A ] 15. c:\program files\rising\rfw\hookurl.sys
Beijing Rising Technology Co., Ltd.
HookUrl
.text,.rdata,.data,INIT,.rsrc,.reloc,
HOSTNT
[A ] 16. c:\windows\system32\drivers\hostnt.sys
.text,.data,INIT,.reloc,
hp5pv
[A ] 17. c:\windows\system32\drivers\hp5pv.sys
.text,.data,INIT,.reloc,
l8p8
[A ] 18. c:\windows\system32\drivers\l8p8.sys
.text,.data,INIT,.reloc,
MegaIDE
[A ] 19. c:\windows\system32\drivers\megaide.sys
LSI Logic Corporation.
LSI MegaRAID IDE Driver
.text,.rdata,.data,INIT,.rsrc,.reloc,
MEMSCAN
[A ] 20. c:\program files\rising\rav1\memscan.sys
Beijing Rising Technology Co., Ltd.
MemScan Driver
.text,.rdata,.data,INIT,.rsrc,.reloc,
MHDRV
[A ] 21. c:\windows\system32\drivers\mhdrv.sys
Rainbow China Co,.Ltd
Driver for RC-MH in W2K/XP,this driver depends gsmhwdm.sys
.text,.data,INIT,.rsrc,.reloc,
mProcRs
[A ] 22. c:\program files\rising\rfw\mprocrs.sys
Beijing Rising Technology Co., Ltd.
Rising Personal FireWall mprocrs.sys
.text,.rdata,.data,INIT,.rsrc,.reloc,
mxdispdr
[A ] 23. c:\windows\system32\drivers\mxdispdr.sys
.text,.rdata,.data,INIT,.reloc,
NPF
[A ] 24. c:\windows\system32\drivers\npf.sys
CACE Technologies
npf
.text,.rdata,.data,INIT,.rsrc,.reloc,
RCMHDOG
[A ] 25. c:\windows\system32\drivers\rcmhdog.sys
Rainbow China Co.,Ltd
Micro Dog NT Driver
.text,.data,INIT,.rsrc,.reloc,
RsAntiSpyware
[A ] 26. c:\windows\system32\drivers\rsboot.sys
Beijing Rising Technology Co., Ltd.
Anti-RootKit Driver
.text,.rdata,.data,INIT,.rsrc,.reloc,
RsFwDrv
[A ] 27. c:\program files\rising\rfw\rsfwdrv.sys
Beijing Rising Technology Co., Ltd.
nt_fwdrv
.text,.rdata,.data,INIT,.rsrc,.reloc,
RsNTGDI
[A ] 28. c:\windows\system32\drivers\rsntgdi.sys
Beijing Rising Technology Co., Ltd.
RsNTGDI
.text,.rdata,INIT,.rsrc,.reloc,
RSPPSYS
[A ] 29. c:\program files\rising\rav1\rsppsys.sys
Rising
RSPPSYS.SYS
.text,.rdata,.data,INIT,.rsrc,.reloc,
Secdrv
[A ] 30. c:\windows\system32\drivers\secdrv.sys
.text,.data,INIT,.reloc,
+ 系统登陆自运行
+ HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon
UIHost
[A ] 31. c:\program files\logonui\royale.exe
Microsoft Corporation
Windows Logon UI
.text,.data,.rsrc,
+ IE浏览器加载模块
+ HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar
{E0E899AB-F487-11D5-8D29-0050BA6940E3}
[A ] 32. c:\program files\flashget\fgiebar.dll
Amaze Soft
FlashGet IE Bar
.text,.rdata,.data,.rsrc,.reloc,
+ HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper
Objects
{A5366673-E8CA-11D3-9CD9-0090271D075B}
[AM] 33. c:\program files\flashget\jccatch.dll
Amaze Soft
jccatch Module
.text,.rdata,.data,.rsrc,.reloc,
+ HKLM\SOFTWARE\Microsoft\Internet Explorer\Extensions
Exec
[A ] 34. c:\program files\flashget\flashget.exe
Amaze Soft
FlashGet
.text,.rdata,.data,.rsrc,
+ 资源管理器加载模块
+ HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved
HyperTerminal Icon Ext
[A ] 35. c:\windows\system32\hticons.dll
Hilgraeve, Inc.
HyperTerminal Applet Library
.text,.data,.rsrc,.reloc,
WinRAR shell extension
[A ] 36. c:\program files\winrar\rarext.dll
.text,.data,.tls,.idata,.edata,.rsrc,.reloc,
PicaView
[A ] 37. c:\program files\acdsee\picaview.dll
ACD Systems, Ltd.
PicaView 系统扩展 DLL
.text,.rdata,.data,.tls,.rsrc,.reloc,
诺基亚手机浏览器
[A ] 38. c:\program files\nokia\nokia pc suite 6\phonebrowser.dll
Nokia
Phone Browser
.text,.rdata,.data,.rsrc,.reloc,
AutoCAD 数字签名图标覆盖处理程序
[AM] 39. c:\windows\system32\acsignicon.dll
Autodesk
AcSignIcon Module
.text,.rdata,.data,.rsrc,.reloc,
Autodesk Drawing Preview
[A ] 40. c:\program files\common files\autodesk shared\thumbnail\acthumbnail16.dll
Autodesk
AcThumbnail Module
.text,.rdata,.data,.rsrc,.reloc,
RISING
[AM] 41. c:\windows\system32\ravext.dll
Beijing Rising Technology Co., Ltd.
Rising Shell Ext Module
.text,.rdata,.data,.rsrc,.reloc,
+ HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks
{AC2DC2EF-5165-40A3-8CDF-41DCA1B0901A}
[AM] 42. c:\windows\system32\shlhook.dll
Beijing Rising Technology Co., Ltd.
shlhook Module
.text,.rdata,.data,.rsrc,.reloc,
{32CD708B-60A7-4C00-9377-D73EAA495F0F}
[AM] 41. c:\windows\system32\ravext.dll
Beijing Rising Technology Co., Ltd.
Rising Shell Ext Module
.text,.rdata,.data,.rsrc,.reloc,
+ 用户登陆自运行项目
+ HKLM\Software\Microsoft\Windows\CurrentVersion\Run
SoundMan
[AM] 43. c:\windows\soundman.exe
Realtek Semiconductor Corp.
Realtek Sound Manager
.text,.rdata,.data,.rsrc,
EPSON ME 1
[AM] 44. c:\windows\system32\spool\drivers\w32x86\3\e_s4i3w1.exe
SEIKO EPSON CORPORATION
EPSON Status Monitor 3
.text,.rdata,.data,.rsrc,
runeip
[AM] 45. f:\ravbin\新建文件夹\runiep.exe
Beijing Rising Technology Co., Ltd.
Rising AntiSpyware Monitor
.text,.rdata,.data,.rsrc,
RavTask
[A ] 46. c:\program files\rising\rav1\ravtask.exe
Beijing Rising Technology Co., Ltd.
RavTimer
.text,.rdata,.data,.rsrc,
+ HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce
RavStub
[AM] 47. c:\program files\rising\rav1\ravstub.exe
Beijing Rising Technology Co., Ltd.
Rising RavStub
.text,.rdata,.data,.rsrc,
+ 开机执行
+ HKLM\SYSTEM\CurrentControlSet\Control\NetworkProvider\Order
BootExecute
[A ] 48. c:\windows\system32\bsmain.exe
Beijing Rising Technology Co., Ltd.
BootScan
.text,.data,.rsrc,.reloc,
+ 映像劫持
+ HKCR\.exe
exefile\启用/禁用数字签名图标\Command
[A ] 49. c:\windows\system32\acsignopt.exe
Autodesk
AcSignOpt Module
.text,.rdata,.data,.rsrc,
+ HKCR\.html
htmlfile\Edit\Command
[A ] 50. c:\program files\microsoft office\office\msohtmed.exe
Microsoft Corporation
Microsoft Office 2000 component
.text,.data,.idata,.rsrc,
htmlfile\Print\Command
[A ] 50. c:\program files\microsoft office\office\msohtmed.exe
Microsoft Corporation
Microsoft Office 2000 component
.text,.data,.idata,.rsrc,
+ HKCR\.htm
htmlfile\Edit\Command
[A ] 50. c:\program files\microsoft office\office\msohtmed.exe
