注释: [A]表示该文件存在自启动关联;
[M]表示该文件在内存中;
+ 注册表自运行项目
+ 系统服务
+ HKLM\System\CurrentControlSet\Services
NVSvc
[A ] 1. c:\windows\system32\nvsvc32.exe
RfwProxySrv
[A ] 2. c:\program files\rising\rfw\rfwproxy.exe
RfwService
[A ] 3. c:\program files\rising\rfw\rfwsrv.exe
RsCCenter
[A ] 4. c:\program files\rising\rav\ccenter.exe
RsRavMon
[A ] 5. c:\program files\rising\rav\ravmond.exe
sfrem01
[A ] 6. c:\windows\system32\sfrem01.exe
UMWdf
[A ] 7. c:\windows\system32\wdfmgr.exe
Wdswsdewn
[A ] 8. c:\windows\system32\serdst.exe
WMPNetworkSvc
[A ] 9. c:\program files\windows media player\wmpnetwk.exe
WudfSvc
[A ] 10. c:\windows\system32\wudfsvc.dll
+ 内核驱动
+ HKLM\System\CurrentControlSet\Services
BaseTDI
[A ] 11. c:\windows\system32\drivers\basetdi.sys
Cdsys
[A ] 12. c:\windows\system32\cdcd.sys
cmpci
[A ] 13. c:\windows\system32\drivers\cmpci.sys
ExpScaner
[A ] 14. c:\program files\rising\rav\expscan.sys
HookCont
[A ] 15. c:\program files\rising\rav\hookcont.sys
HookReg
[A ] 16. c:\program files\rising\rav\hookreg.sys
HookSys
[A ] 17. c:\program files\rising\rav\hooksys.sys
HookUrl
[A ] 18. c:\program files\rising\rfw\hookurl.sys
MEMSCAN
[A ] 19. c:\program files\rising\rav\memscan.sys
NPF
[A ] 20. c:\windows\system32\drivers\npf.sys
npkcrypt
[A ] 21. c:\windows\system32\npkcrypt.sys
npkycryp
[A ] 22. c:\windows\system32\npkycryp.sys
OVT511Plus
[A ] 23. c:\windows\system32\drivers\omcamvid.sys
qcusbmdm
[A ] 24. c:\windows\system32\drivers\qcusbmdm.sys
qcusbser
[A ] 25. c:\windows\system32\drivers\qcusbser.sys
RfwBase
[A ] 26. c:\windows\system32\drivers\rfwbase.sys
RsAntiSpyware
[A ] 27. c:\windows\system32\drivers\rsboot.sys
RsFwDrv
[A ] 28. c:\program files\rising\rfw\rsfwdrv.sys
RsNTGDI
[A ] 29. c:\windows\system32\drivers\rsntgdi.sys
RSPPSYS
[A ] 30. c:\program files\rising\rav\rsppsys.sys
Secdrv
[A ] 31. c:\windows\system32\drivers\secdrv.sys
Sentinel
[A ] 32. c:\windows\system32\drivers\sentinel.sys
sfdrv01
[A ] 33. c:\windows\system32\drivers\sfdrv01.sys
sfdrv01a
[A ] 34. c:\windows\system32\drivers\sfdrv01a.sys
sfhlp02
[A ] 35. c:\windows\system32\drivers\sfhlp02.sys
sfsync02
[A ] 36. c:\windows\system32\drivers\sfsync02.sys
sfsync03
[A ] 37. c:\windows\system32\drivers\sfsync03.sys
附件:
96875320071027224647.txt