启动项目
注册表
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
<ctfmon.exe><C:\WINDOWS\System32\ctfmon.exe>
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
<SKYNET Personal FireWall><D:\Program Files\SkyNet\FireWall\PFW.exe>
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
<shell><Explorer.exe>
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
<Userinit><userinit.exe,>
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Windows]
<AppInit_DLLs><>
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
<bgoomain.exe><; C:\Program Files\baigoo\bgoomain.exe>
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
<IMSCMig><; C:\PROGRA~1\COMMON~1\MICROS~1\IME\IMSC40A\IMSCMIG.EXE /Preload>
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
<MSMSGS><; "C:\Program Files\Messenger\msmsgs.exe" /background>
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
<NvCplDaemon><; RUNDLL32.EXE NvQTwk,NvCplDaemon initialize>
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
<nwiz><; nwiz.exe /install>
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
<Smapp><; C:\Program Files\Analog Devices\SoundMAX\Smtray.exe>
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
<StormCodec_Helper><; "D:\Storm Codec\StormSet.exe" /S /opti>
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
<TkBellExe><; >
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
<yassistse><; "C:\PROGRA~1\Yahoo!\Assistant\yassistse.exe">
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
<YLive.exe><; C:\PROGRA~1\Yahoo!\ASSIST~1\YLive.exe>
==================================
启动文件夹
服务
[C-DillaCdaC11BA / C-DillaCdaC11BA]
<C:\WINDOWS\System32\drivers\CDAC11BA.EXE><Macrovision>
[NVIDIA Driver Helper Service / NVSvc]
<C:\WINDOWS\System32\nvsvc32.exe><NVIDIA Corporation>
[Rising Process Communication Center / RsCCenter]
<"D:\Rising\Rav\CCenter.exe"><Beijing Rising Technology Co., Ltd.>
[RsRavMon Service / RsRavMon]
<"D:\Rising\Rav\Ravmond.exe"><Beijing Rising Technology Co., Ltd.>
[SoundMAX Agent Service / SoundMAX Agent Service (default)]
<C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe><Analog Devices, Inc.>
正在运行的进程
[PID: 432][\SystemRoot\System32\smss.exe] <Microsoft Corporation><5.1.2600.1106 (xpsp1.020828-1920)>
[PID: 488][\??\C:\WINDOWS\system32\csrss.exe] <Microsoft Corporation><5.1.2600.0 (xpclient.010817-1148)>
[C:\WINDOWS\Game32.dll] <><1, 0, 0, 1>
[PID: 512][\??\C:\WINDOWS\system32\winlogon.exe] <Microsoft Corporation><5.1.2600.1106 (xpsp1.020828-1920)>
[C:\WINDOWS\System32\SYNCOR11.DLL] <SoundMAX><1.2.2>
[C:\WINDOWS\Game32.dll] <><1, 0, 0, 1>
[PID: 556][C:\WINDOWS\system32\services.exe] <Microsoft Corporation><5.1.2600.0 (xpclient.010817-1148)>
[C:\WINDOWS\Game32.dll] <><1, 0, 0, 1>
[C:\WINDOWS\system32\SYNCOR11.DLL] <SoundMAX><1.2.2>
[PID: 568][C:\WINDOWS\system32\lsass.exe] <Microsoft Corporation><5.1.2600.1106 (xpsp1.020828-1920)>
[C:\WINDOWS\Game32.dll] <><1, 0, 0, 1>
[C:\WINDOWS\system32\SYNCOR11.DLL] <SoundMAX><1.2.2>
[PID: 728][C:\WINDOWS\system32\svchost.exe] <Microsoft Corporation><5.1.2600.0 (xpclient.010817-1148)>
[C:\WINDOWS\Game32.dll] <><1, 0, 0, 1>
[C:\WINDOWS\system32\SYNCOR11.DLL] <SoundMAX><1.2.2>
[PID: 780][D:\Rising\Rav\CCenter.exe] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 3>
[C:\WINDOWS\Game32.dll] <><1, 0, 0, 1>
[C:\WINDOWS\System32\SYNCOR11.DLL] <SoundMAX><1.2.2>
[PID: 808][C:\WINDOWS\System32\svchost.exe] <Microsoft Corporation><5.1.2600.0 (xpclient.010817-1148)>
[C:\WINDOWS\System32\SYNCOR11.DLL] <SoundMAX><1.2.2>
[C:\WINDOWS\Game32.dll] <><1, 0, 0, 1>
[PID: 888][C:\WINDOWS\System32\svchost.exe] <Microsoft Corporation><5.1.2600.0 (xpclient.010817-1148)>
[C:\WINDOWS\Game32.dll] <><1, 0, 0, 1>
[C:\WINDOWS\System32\SYNCOR11.DLL] <SoundMAX><1.2.2>
[PID: 936][C:\WINDOWS\System32\svchost.exe] <Microsoft Corporation><5.1.2600.0 (xpclient.010817-1148)>
[C:\WINDOWS\Game32.dll] <><1, 0, 0, 1>
[C:\WINDOWS\System32\SYNCOR11.DLL] <SoundMAX><1.2.2>
[PID: 964][D:\Rising\Rav\Ravmond.exe] <Beijing Rising Technology Co., Ltd.><18, 0, 1, 10>
[PID: 1252][C:\WINDOWS\Explorer.EXE] <Microsoft Corporation><6.00.2800.1106 (xpsp1.020828-1920)>
[C:\WINDOWS\System32\AcSignIcon.dll] <Autodesk><16.0.0.86>
[C:\Program Files\Common Files\Autodesk Shared\AcSignCore16.dll] <Autodesk><16.0.0.86>
[C:\WINDOWS\System32\SYNCOR11.DLL] <SoundMAX><1.2.2>
[C:\PROGRA~1\Yahoo!\ASSIST~1\assist\ywiper.dll] <N/A><1, 0, 1, 1014>
[C:\Program Files\WinRAR\rarext.dll] <N/A><N/A>
[C:\WINDOWS\system32\RavExt.dll] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 13>
[C:\WINDOWS\Game32.dll] <><1, 0, 0, 1>
[C:\PROGRA~1\Yahoo!\ASSIST~1\assist\yphtb.dll] <Yahoo! China><1, 1, 2, 1034>
[C:\PROGRA~1\Yahoo!\ASSIST~1\assist\yasbar.dll] <Yahoo!><2, 1, 3, 1043>
[C:\PROGRA~1\Yahoo!\ASSIST~1\assist\YDRAGS~1.DLL] <><1, 2, 7, 1006>
[PID: 1300][C:\WINDOWS\system32\spoolsv.exe] <Microsoft Corporation><5.1.2600.0 (XPClient.010817-1148)>
[C:\WINDOWS\Game32.dll] <><1, 0, 0, 1>
[C:\WINDOWS\system32\SYNCOR11.DLL] <SoundMAX><1.2.2>
[PID: 1504][C:\WINDOWS\System32\ctfmon.exe] <Microsoft Corporation><5.1.2600.1106 (xpsp1.020828-1920)>
[C:\WINDOWS\Game32.dll] <><1, 0, 0, 1>
[C:\WINDOWS\System32\SYNCOR11.DLL] <SoundMAX><1.2.2>
[PID: 1532][D:\Rising\Rav\RavStub.exe] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 12>
[D:\Rising\Rav\RsCommX.dll] <rising><18, 0, 0, 1>
[D:\Rising\Rav\RSCOMMON.DLL] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 4>
[C:\WINDOWS\Game32.dll] <><1, 0, 0, 1>
[C:\WINDOWS\System32\SYNCOR11.DLL] <SoundMAX><1.2.2>
[PID: 1668][C:\WINDOWS\System32\drivers\CDAC11BA.EXE] <Macrovision><4.20.020>
[C:\WINDOWS\Game32.dll] <><1, 0, 0, 1>
[C:\WINDOWS\System32\SYNCOR11.DLL] <SoundMAX><1.2.2>
[PID: 1720][C:\WINDOWS\System32\nvsvc32.exe] <NVIDIA Corporation><6.13.10.4104>
[C:\WINDOWS\Game32.dll] <><1, 0, 0, 1>
[C:\WINDOWS\System32\SYNCOR11.DLL] <SoundMAX><1.2.2>
[PID: 1756][C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe] <Analog Devices, Inc.><3, 2, 5, 0>
[C:\WINDOWS\Game32.dll] <><1, 0, 0, 1>
[C:\WINDOWS\System32\SYNCOR11.DLL] <SoundMAX><1.2.2>
[PID: 184][D:\Program Files\SkyNet\FireWall\PFW.exe] <广州众达天网技术有限公司><2.5.1.160>
[C:\WINDOWS\System32\SYNCOR11.DLL] <SoundMAX><1.2.2>
[C:\WINDOWS\Game32.dll] <><1, 0, 0, 1>
[PID: 1160][D:\Rising\Rav\RavMon.exe] <Beijing Rising Technology Co., Ltd.><18, 0, 1, 14>
[D:\Rising\Rav\RsGuiLib.dll] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 23>
[D:\Rising\Rav\BWList.dll] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 16>
[D:\Rising\Rav\RSAPPMGR.DLL] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 2>
[D:\Rising\Rav\CfgDll.dll] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 6>
[D:\Rising\Rav\RSCOMMON.DLL] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 4>
[D:\Rising\Rav\RsCommX.dll] <rising><18, 0, 0, 1>
[D:\Rising\Rav\PngDll.dll] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 5>
[C:\WINDOWS\Game32.dll] <><1, 0, 0, 1>
[C:\WINDOWS\System32\SYNCOR11.DLL] <SoundMAX><1.2.2>
[PID: 1084][F:\haofang\hfgame3\GameClient.exe] <上海浩方在线信息技术有限公司><4, 0, 0, 0>
[F:\haofang\hfgame3\GameShell.dll] <上海浩方在线信息技术有限公司><3, 6, 0, 0>
[F:\haofang\hfgame3\Proxy.dll] <><1, 0, 0, 1>
[F:\haofang\hfgame3\MeteorCheck.dll] <N/A><N/A>
[F:\haofang\hfgame3\ComCtrlLib.dll] <><1, 0, 0, 1>
[F:\haofang\hfgame3\SkinPlusPlusDLL.dll] <><1, 0, 0, 1>
[F:\haofang\hfgame3\GameData.dll] <><1, 0, 0, 1>
[F:\haofang\hfgame3\UserAvatar.dll] <><1, 0, 0, 1>
[F:\haofang\hfgame3\IShowSocket.dll] <><1, 0, 0, 1>
[F:\haofang\hfgame3\IMUIDll.dll] <><1, 0, 0, 1>
[F:\haofang\hfgame3\IMbase.dll] <><1, 0, 0, 1>
[C:\WINDOWS\System32\SYNCOR11.DLL] <SoundMAX><1.2.2>
[F:\haofang\hfgame3\IMRes.dll] <><1, 0, 0, 1>
[F:\haofang\hfgame3\GameRes.dll] <上海浩方在线信息技术有限公司><3, 6, 0, 0>
[F:\haofang\hfgame3\AdsManager.dll] <N/A><N/A>
[D:\Rising\Rav\RavScrCh.dll] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 3>
[F:\haofang\hfgame3\CASocket.dll] <><4, 0, 1, 0>
[C:\WINDOWS\Game32.dll] <><1, 0, 0, 1>
[PID: 2128][C:\Program Files\Internet Explorer\iexplore.exe] <Microsoft Corporation><6.00.2800.1106 (xpsp1.020828-1920)>
[C:\WINDOWS\Game32.dll] <><1, 0, 0, 1>
[C:\WINDOWS\System32\SYNCOR11.DLL] <SoundMAX><1.2.2>
[C:\WINDOWS\System32\AcSignIcon.dll] <Autodesk><16.0.0.86>
[C:\PROGRA~1\Yahoo!\ASSIST~1\assist\yasbar.dll] <Yahoo!><2, 1, 3, 1043>
[C:\PROGRA~1\Yahoo!\ASSIST~1\assist\yphtb.dll] <Yahoo! China><1, 1, 2, 1034>
[C:\PROGRA~1\Yahoo!\ASSIST~1\assist\yaswiper.dll] <Yahoo><1, 0, 1, 1004>
[C:\PROGRA~1\Yahoo!\ASSIST~1\assist\yasiesec.dll] <Yahoo><1, 0, 1, 1000>
[C:\PROGRA~1\Yahoo!\ASSIST~1\assist\yasnoad.dll] <><1, 1, 1, 1003>
[C:\PROGRA~1\Yahoo!\ASSIST~1\assist\yzsNetProto.dll] <Yahoo><1, 0, 0, 1>
[C:\PROGRA~1\Yahoo!\ASSIST~1\assist\yangling.dll] <Yahoo.><1, 0, 2, 1002>
[C:\PROGRA~1\Yahoo!\ASSIST~1\assist\YDRAGS~1.DLL] <><1, 2, 7, 1006>
[D:\Rising\Rav\RavScrCh.dll] <Beijing Rising Technology Co., Ltd.><18, 0, 0, 3>
[C:\WINDOWS\System32\Macromed\Flash\Flash8.ocx] <Macromedia, Inc.><8,0,22,0>
[C:\PROGRA~1\Yahoo!\ASSIST~1\assist\yrepair.dll] <Yahoo><1, 0, 6, 1319>
[C:\PROGRA~1\Yahoo!\ASSIST~1\assist\yasfsks.dll] <3721.com><2, 1, 1, 87>
[C:\PROGRA~1\Yahoo!\ASSIST~1\assist\yoptimum.dll] <Yahoo><1, 0, 1, 1001>
[c:\progra~1\yahoo!\assist~1\assist\yadfil~1.dll] < ><1, 0, 1, 6>
[C:\PROGRA~1\yahoo!\assistant\Shell\yAssecblk.dll] <Yahoo><1, 0, 2, 1002>
[C:\PROGRA~1\Yahoo!\ASSIST~1\assist\yXPStyle.dll] <Yahoo><1, 0, 2, 1309>
[PID: 3612][C:\Documents and Settings\dian\桌面\进程分析\SREng.exe] <Smallfrogs Studio><2.0.12.350>
[C:\WINDOWS\Game32.dll] <><1, 0, 0, 1>
[C:\WINDOWS\System32\SYNCOR11.DLL] <SoundMAX><1.2.2>