run_tempa.exe百度搜到的都是求助的，没有解决办法．
谁知道这个怎么弄啊？是一个压缩包的图标，压缩文件不可用．
双击压缩文件就出现这个文件．机器运行的很慢．还会破坏某些
文件，比如ＱＱ，或.exe文件．重做系统也不好使．瑞星查不出来．

扫日志

ccenter.exec:\program files\rising\rav\ccenter.exe780820480014131202007-5-10 12:3818, 0, 0, 3108.00 KB (110,592 字节)2007-5-8 16:59
conime.exec:\windows\system32\conime.exe2772820480014131202007-5-10 12:415.1.2600.1106 (xpsp1.020828-1920)24.00 KB (24,576 字节)2002-10-7 20:00
csrss.exec:\windows\system32\csrss.exe4841320480014131202007-5-10 12:385.1.2600.0 (xpclient.010817-1148)4.00 KB (4,096 字节)2002-10-7 20:00
ctfmon.exec:\windows\system32\ctfmon.exe436820480014131202007-5-10 12:395.1.2600.1106 (xpsp1.020828-1920)13.00 KB (13,312 字节)2002-10-7 20:00
dmadmin.exec:\windows\system32\dmadmin.exe3968820480014131202007-5-10 15:042600.0.503.0200.00 KB (204,800 字节)2002-10-7 20:00
dmremote.exec:\windows\system32\dmremote.exe3044820480014131202007-5-10 15:042600.0.503.014.00 KB (14,336 字节)2002-10-7 20:00
explorer.exec:\windows\explorer.exe1212820480014131202007-5-10 12:386.00.2800.1106 (xpsp1.020828-1920)926.50 KB (948,736 字节)2002-10-7 20:00
helpctr.exec:\windows\pchealth\helpctr\binaries\helpctr.exe2440820480014131202007-5-10 16:425.1.2600.1515 (xpsp2.040410-0905)723.50 KB (740,864 字节)2004-4-14 17:50
helpsvc.exec:\windows\pchealth\helpctr\binaries\helpsvc.exe2252820480014131202007-5-10 16:385.1.2600.1106 (xpsp1.020828-1920)687.00 KB (703,488 字节)2007-5-8 16:40
hkcmd.exec:\windows\system32\hkcmd.exe1700820480014131202007-5-10 12:383,0,0,2104112.00 KB (114,688 字节)2007-5-8 16:52
iexplore.exec:\program files\internet explorer\iexplore.exe1416820480014131202007-5-10 12:396.00.2800.1106 (xpsp1.020828-1920)89.00 KB (91,136 字节)2007-5-8 16:40
iexplore.exec:\program files\internet explorer\iexplore.exe2856820480014131202007-5-10 14:446.00.2800.1106 (xpsp1.020828-1920)89.00 KB (91,136 字节)2007-5-8 16:40
iexplore.exec:\program files\internet explorer\iexplore.exe1880820480014131202007-5-10 14:496.00.2800.1106 (xpsp1.020828-1920)89.00 KB (91,136 字节)2007-5-8 16:40
igfxtray.exec:\windows\system32\igfxtray.exe1684820480014131202007-5-10 12:383,0,0,2104152.00 KB (155,648 字节)2007-5-8 16:52
ksvsvc.exec:\windows\ksvsvc.exe348820480014131202007-5-10 12:39不可用17.50 KB (17,920 字节)2007-5-10 11:26
lsass.exec:\windows\system32\lsass.exe564920480014131202007-5-10 12:385.1.2600.1106 (xpsp1.020828-1920)11.50 KB (11,776 字节)2002-10-7 20:00
main32.exec:\windows\main32.exe1964820480014131202007-5-10 12:39不可用17.50 KB (17,920 字节)2007-5-8 17:46
mmc.exec:\windows\system32\mmc.exe1372820480014131202007-5-10 14:585.1.2600.0 (xpclient.010817-1148)756.00 KB (774,144 字节)2002-10-7 20:00
mppds.exec:\windows\mppds.exe1580820480014131202007-5-10 13:38不可用21.00 KB (21,504 字节)2007-5-8 17:46
qq.exee:\tencent\qq\qq.exe344820480014131202007-5-10 16:090, 0, 0, 01.51 MB (1,585,152 字节)2007-2-2 19:00
rav.exec:\program files\rising\rav\rav.exe3628420480014131202007-5-10 15:5519, 0, 0, 36372.00 KB (380,928 字节)2007-5-8 16:59
ravmond.exec:\program files\rising\rav\ravmond.exe10128419430483886082007-5-10 12:3819, 0, 0, 49272.00 KB (278,528 字节)2007-5-8 17:22
ravstub.exec:\program files\rising\rav\ravstub.exe1396820480014131202007-5-10 12:3819, 0, 0, 488.00 KB (90,112 字节)2007-5-8 16:59
ravtask.exec:\program files\rising\rav\ravtask.exe1720420480014131202007-5-10 12:3819, 0, 0, 7116.00 KB (118,784 字节)2007-5-8 16:59
realsched.exec:\program files\common files\real\update_ob\realsched.exe1748820480014131202007-5-10 12:380.1.0.3510176.04 KB (180,269 字节)2007-5-8 17:40
services.exec:\windows\system32\services.exe552920480014131202007-5-10 12:385.1.2600.0 (xpclient.010817-1148)99.00 KB (101,376 字节)2002-10-7 20:00
shualai.exec:\windows\shualai.exe148820480014131202007-5-10 12:39不可用18.00 KB (18,432 字节)2007-5-9 10:44
smss.exec:\windows\system32\smss.exe4201120480014131202007-5-10 12:385.1.2600.1106 (xpsp1.020828-1920)44.50 KB (45,568 字节)2002-10-7 20:00
soundman.exec:\windows\soundman.exe1712820480014131202007-5-10 12:385.1.1056.00 KB (57,344 字节)2007-5-8 16:54
spoolsv.exec:\windows\system32\spoolsv.exe1308820480014131202007-5-10 12:385.1.2600.1699 (xpsp2.050610-1533)52.00 KB (53,248 字节)2007-5-8 18:13
svchost.exec:\windows\system32\svchost.exe728820480014131202007-5-10 12:385.1.2600.0 (xpclient.010817-1148)12.50 KB (12,800 字节)2002-10-7 20:00
svchost.exec:\windows\system32\svchost.exe796820480014131202007-5-10 12:385.1.2600.0 (xpclient.010817-1148)12.50 KB (12,800 字节)2002-10-7 20:00
svchost.exec:\windows\system32\svchost.exe948820480014131202007-5-10 12:385.1.2600.0 (xpclient.010817-1148)12.50 KB (12,800 字节)2002-10-7 20:00
svchost.exec:\windows\system32\svchost.exe996820480014131202007-5-10 12:385.1.2600.0 (xpclient.010817-1148)12.50 KB (12,800 字节)2002-10-7 20:00
svchost.exec:\windows\svchost.exe112820480014131202007-5-10 12:395.1.2600.0 (xpclient.010817-1148)64.50 KB (66,048 字节)2007-5-8 17:46
svchost.exec:\windows\svchost.exe2332820480014131202007-5-10 12:415.1.2600.0 (xpclient.010817-1148)64.50 KB (66,048 字节)2007-5-8 17:46
svchost.exec:\windows\svchost.exe3132820480014131202007-5-10 12:485.1.2600.0 (xpclient.010817-1148)64.50 KB (66,048 字节)2007-5-8 17:46
svchost.exec:\windows\svchost.exe3296820480014131202007-5-10 12:485.1.2600.0 (xpclient.010817-1148)64.50 KB (66,048 字节)2007-5-8 17:46
svchost.exec:\windows\svchost.exe3320820480014131202007-5-10 12:485.1.2600.0 (xpclient.010817-1148)64.50 KB (66,048 字节)2007-5-8 17:46
svchost.exec:\windows\svchost.exe3676820480014131202007-5-10 12:495.1.2600.0 (xpclient.010817-1148)64.50 KB (66,048 字节)2007-5-8 17:46
svchost.exec:\windows\svchost.exe4020820480014131202007-5-10 12:545.1.2600.0 (xpclient.010817-1148)64.50 KB (66,048 字节)2007-5-8 17:46
svchost.exec:\windows\svchost.exe3416820480014131202007-5-10 13:375.1.2600.0 (xpclient.010817-1148)64.50 KB (66,048 字节)2007-5-8 17:46
svchost.exec:\windows\svchost.exe3972820480014131202007-5-10 13:375.1.2600.0 (xpclient.010817-1148)64.50 KB (66,048 字节)2007-5-8 17:46
svchost.exec:\windows\svchost.exe980820480014131202007-5-10 13:375.1.2600.0 (xpclient.010817-1148)64.50 KB (66,048 字节)2007-5-8 17:46
svchost.exec:\windows\svchost.exe3424820480014131202007-5-10 13:375.1.2600.0 (xpclient.010817-1148)64.50 KB (66,048 字节)2007-5-8 17:46
svchost.exec:\windows\svchost.exe2532820480014131202007-5-10 13:375.1.2600.0 (xpclient.010817-1148)64.50 KB (66,048 字节)2007-5-8 17:46
svchost.exec:\windows\svchost.exe2928820480014131202007-5-10 13:375.1.2600.0 (xpclient.010817-1148)64.50 KB (66,048 字节)2007-5-8 17:46
svchost.exec:\windows\svchost.exe3068820480014131202007-5-10 13:375.1.2600.0 (xpclient.010817-1148)64.50 KB (66,048 字节)2007-5-8 17:46
svchost.exec:\windows\svchost.exe3196820480014131202007-5-10 13:375.1.2600.0 (xpclient.010817-1148)64.50 KB (66,048 字节)2007-5-8 17:46
svchost.exec:\windows\svchost.exe1992820480014131202007-5-10 13:385.1.2600.0 (xpclient.010817-1148)64.50 KB (66,048 字节)2007-5-8 17:46
svchost.exec:\windows\system32\svchost.exe3952820480014131202007-5-10 13:495.1.2600.0 (xpclient.010817-1148)12.50 KB (12,800 字节)2002-10-7 20:00
svchost.exec:\windows\svchost.exe2480820480014131202007-5-10 13:525.1.2600.0 (xpclient.010817-1148)64.50 KB (66,048 字节)2007-5-8 17:46
svchost.exec:\windows\svchost.exe852820480014131202007-5-10 14:005.1.2600.0 (xpclient.010817-1148)64.50 KB (66,048 字节)2007-5-8 17:46
svchost.exec:\windows\svchost.exe2288820480014131202007-5-10 14:005.1.2600.0 (xpclient.010817-1148)64.50 KB (66,048 字节)2007-5-8 17:46
svchost.exec:\windows\svchost.exe3084820480014131202007-5-10 14:005.1.2600.0 (xpclient.010817-1148)64.50 KB (66,048 字节)2007-5-8 17:46
system不可用4801413120不可用不可用不可用不可用
system idle process不可用00不可用不可用不可用不可用不可用不可用
timplatform.exee:\tencent\qq\timplatform.exe3784820480014131202007-5-10 12:490, 3, 1, 868.00 KB (69,632 字节)2007-2-2 16:41
upxdnd.exec:\docume~1\wangli~1\locals~1\temp\upxdnd.exe2272820480014131202007-5-10 13:38不可用19.00 KB (19,456 字节)2007-5-8 17:46
upxdnd.exec:\docume~1\wangli~1\locals~1\temp\upxdnd.exe2464820480014131202007-5-10 13:38不可用19.00 KB (19,456 字节)2007-5-8 17:46
upxdnd.exec:\docume~1\wangli~1\locals~1\temp\upxdnd.exe1368820480014131202007-5-10 13:39不可用19.00 KB (19,456 字节)2007-5-8 17:46
upxdnd.exec:\docume~1\wangli~1\locals~1\temp\upxdnd.exe3612820480014131202007-5-10 13:39不可用19.00 KB (19,456 字节)2007-5-8 17:46
wdfmgr.exec:\windows\system32\wdfmgr.exe1976820480014131202007-5-10 12:395.2.3790.1230 built by: dnsrv(bld4act)38.00 KB (38,912 字节)2005-1-28 1:36
winlogon.exec:\windows\system32\winlogon.exe5081320480014131202007-5-10 12:385.1.2600.1557 (xpsp2_gdr.040517-1325)457.50 KB (468,480 字节)2002-10-7 20:00
wmiprvse.exec:\windows\system32\wbem\wmiprvse.exe2068820480014131202007-5-10 16:435.1.2600.1106 (xpsp1.020828-1920)199.00 KB (203,776 字节)2007-5-8 16:38
wuauclt.exec:\windows\system32\wuauclt.exe2364820480014131202007-5-10 14:555.8.0.2469 built by: lab01_n(wmbla)121.27 KB (124,184 字节)2007-5-8 16:38

我是菜鸟！还需要哪个呀？

服务
AlerterAlerter停止手动共享进程c:\windows\system32\svchost.exe -k localservicenormalNT AUTHORITY\LocalService0
Application Layer Gateway ServiceALG停止手动自身的进程c:\windows\system32\alg.exenormalNT AUTHORITY\LocalService0
Application ManagementAppMgmt停止手动共享进程c:\windows\system32\svchost.exe -k netsvcsnormalLocalSystem0
Automatic Updateswuauserv正在运行自动共享进程c:\windows\system32\svchost.exe -k netsvcsnormalLocalSystem0
Background Intelligent Transfer ServiceBITS正在运行手动共享进程c:\windows\system32\svchost.exe -k netsvcsnormalLocalSystem0
COM+ Event SystemEventSystem正在运行手动共享进程c:\windows\system32\svchost.exe -k netsvcsnormalLocalSystem0
COM+ System ApplicationCOMSysApp停止手动自身的进程c:\windows\system32\dllhost.exe /processid:{02d4b3f1-fd88-11d1-960d-00805fc79235}normalLocalSystem0
ClipBookClipSrv停止手动自身的进程c:\windows\system32\clipsrv.exenormalLocalSystem0
Computer BrowserBrowser正在运行自动共享进程c:\windows\system32\svchost.exe -k netsvcsnormalLocalSystem0
Cryptographic ServicesCryptSvc正在运行自动共享进程c:\windows\system32\svchost.exe -k netsvcsnormalLocalSystem0
DHCP ClientDhcp正在运行自动共享进程c:\windows\system32\svchost.exe -k netsvcsnormalLocalSystem0
DNS ClientDnscache正在运行自动共享进程c:\windows\system32\svchost.exe -k networkservicenormalNT AUTHORITY\NetworkService0
Distributed Link Tracking ClientTrkWks正在运行自动共享进程c:\windows\system32\svchost.exe -k netsvcsnormalLocalSystem0
Distributed Transaction CoordinatorMSDTC停止手动自身的进程c:\windows\system32\msdtc.exenormalNT AUTHORITY\NetworkService0
Error Reporting ServiceERSvc正在运行自动共享进程c:\windows\system32\svchost.exe -k netsvcs忽略LocalSystem0
Event LogEventlog正在运行自动共享进程c:\windows\system32\services.exenormalLocalSystem0
Fast User Switching CompatibilityFastUserSwitchingCompatibility正在运行手动共享进程c:\windows\system32\svchost.exe -k netsvcsnormalLocalSystem0
Help and Supporthelpsvc正在运行自动共享进程c:\windows\system32\svchost.exe -k netsvcsnormalLocalSystem0
Human Interface Device AccessHidServ停止已停用共享进程c:\windows\system32\svchost.exe -k netsvcsnormalLocalSystem0
IMAPI CD-Burning COM ServiceImapiService停止手动自身的进程c:\windows\system32\imapi.exenormalLocalSystem0
IPSEC ServicesPolicyAgent正在运行自动共享进程c:\windows\system32\lsass.exenormalLocalSystem0
Indexing ServiceCiSvc停止手动共享进程c:\windows\system32\cisvc.exenormalLocalSystem0
Internet Connection Firewall (ICF) / Internet Connection Sharing (ICS)SharedAccess停止手动共享进程c:\windows\system32\svchost.exe -k netsvcsnormalLocalSystem0
Logical Disk Managerdmserver正在运行自动共享进程c:\windows\system32\svchost.exe -k netsvcsnormalLocalSystem0
Logical Disk Manager Administrative Servicedmadmin正在运行手动共享进程c:\windows\system32\dmadmin.exe /comnormalLocalSystem0
MS Software Shadow Copy ProviderSwPrv停止手动自身的进程c:\windows\system32\dllhost.exe /processid:{fa76c771-37ac-4dff-b8be-9112306697f6}忽略LocalSystem0
MessengerMessenger正在运行自动共享进程c:\windows\system32\svchost.exe -k netsvcsnormalLocalSystem0
NT LM Security Support ProviderNtLmSsp停止手动共享进程c:\windows\system32\lsass.exenormalLocalSystem0
Net LogonNetlogon停止手动共享进程c:\windows\system32\lsass.exenormalLocalSystem0
NetMeeting Remote Desktop Sharingmnmsrvc停止手动自身的进程c:\windows\system32\mnmsrvc.exenormalLocalSystem0
Network ConnectionsNetman正在运行手动共享进程c:\windows\system32\svchost.exe -k netsvcsnormalLocalSystem0
Network DDENetDDE停止手动共享进程c:\windows\system32\netdde.exenormalLocalSystem0
Network DDE DSDMNetDDEdsdm停止手动共享进程c:\windows\system32\netdde.exenormalLocalSystem0
Network Location Awareness (NLA)Nla正在运行手动共享进程c:\windows\system32\svchost.exe -k netsvcsnormalLocalSystem0
Performance Logs and AlertsSysmonLog停止手动自身的进程c:\windows\system32\smlogsvc.exenormalNT Authority\NetworkService0
Plug and PlayPlugPlay正在运行自动共享进程c:\windows\system32\services.exenormalLocalSystem0
Portable Media Serial Number ServiceWmdmPmSN停止手动共享进程c:\windows\system32\svchost.exe -k netsvcsnormalLocalSystem0
Print SpoolerSpooler正在运行自动自身的进程c:\windows\system32\spoolsv.exenormalLocalSystem0
Protected StorageProtectedStorage正在运行自动共享进程c:\windows\system32\lsass.exenormalLocalSystem0
QoS RSVPRSVP停止手动自身的进程c:\windows\system32\rsvp.exenormalLocalSystem0
Remote Access Auto Connection ManagerRasAuto停止手动共享进程c:\windows\system32\svchost.exe -k netsvcsnormalLocalSystem0
Remote Access Connection ManagerRasMan停止手动共享进程c:\windows\system32\svchost.exe -k netsvcsnormalLocalSystem0
Remote Desktop Help Session ManagerRDSessMgr停止手动自身的进程c:\windows\system32\sessmgr.exenormalLocalSystem0
Remote Procedure Call (RPC)RpcSs正在运行自动共享进程c:\windows\system32\svchost -k rpcssnormalLocalSystem0
Remote Procedure Call (RPC) LocatorRpcLocator停止手动自身的进程c:\windows\system32\locator.exenormalNT AUTHORITY\NetworkService0
Remote RegistryRemoteRegistry正在运行自动共享进程c:\windows\system32\svchost.exe -k localservicenormalNT AUTHORITY\LocalService0
Removable StorageNtmsSvc停止手动共享进程c:\windows\system32\svchost.exe -k netsvcsnormalLocalSystem0
Rising Process Communication CenterRsCCenter正在运行自动自身的进程"c:\program files\rising\rav\ccenter.exe"normalLocalSystem0
Rising RealTime MonitorRsRavMon正在运行自动自身的进程"c:\program files\rising\rav\ravmond.exe"normalLocalSystem0
Routing and Remote AccessRemoteAccess停止已停用共享进程c:\windows\system32\svchost.exe -k netsvcsnormalLocalSystem0
SSDP Discovery ServiceSSDPSRV正在运行手动共享进程c:\windows\system32\svchost.exe -k localservicenormalNT AUTHORITY\LocalService0
Secondary Logonseclogon正在运行自动共享进程c:\windows\system32\svchost.exe -k netsvcs忽略LocalSystem0
Security Accounts ManagerSamSs正在运行自动共享进程c:\windows\system32\lsass.exenormalLocalSystem0
Serverlanmanserver正在运行自动共享进程c:\windows\system32\svchost.exe -k netsvcsnormalLocalSystem0
Shell Hardware DetectionShellHWDetection正在运行自动共享进程c:\windows\system32\svchost.exe -k netsvcs忽略LocalSystem0
Smart CardSCardSvr停止手动共享进程c:\windows\system32\scardsvr.exe忽略NT AUTHORITY\LocalService0
Smart Card HelperSCardDrv停止手动共享进程c:\windows\system32\scardsvr.exe忽略NT AUTHORITY\LocalService0
System Event NotificationSENS正在运行自动共享进程c:\windows\system32\svchost.exe -k netsvcsnormalLocalSystem0
System Restore Servicesrservice正在运行自动共享进程c:\windows\system32\svchost.exe -k netsvcsnormalLocalSystem0
TCP/IP NetBIOS HelperLmHosts正在运行自动共享进程c:\windows\system32\svchost.exe -k localservicenormalNT AUTHORITY\LocalService0
Task SchedulerSchedule正在运行自动共享进程c:\windows\system32\svchost.exe -k netsvcsnormalLocalSystem0
TelephonyTapiSrv停止手动共享进程c:\windows\system32\svchost.exe -k netsvcsnormalLocalSystem0
TelnetTlntSvr停止已停用自身的进程c:\windows\system32\tlntsvr.exenormalLocalSystem0
Terminal ServicesTermService正在运行手动共享进程c:\windows\system32\svchost.exe -k netsvcsnormalLocalSystem0
ThemesThemes正在运行自动共享进程c:\windows\system32\svchost.exe -k netsvcsnormalLocalSystem0
Uninterruptible Power SupplyUPS停止手动自身的进程c:\windows\system32\ups.exenormalNT AUTHORITY\LocalService0
Universal Plug and Play Device Hostupnphost停止手动共享进程c:\windows\system32\svchost.exe -k localservicenormalNT AUTHORITY\LocalService0
Upload Manageruploadmgr正在运行自动共享进程c:\windows\system32\svchost.exe -k netsvcsnormalLocalSystem0
Volume Shadow CopyVSS停止手动自身的进程c:\windows\system32\vssvc.exenormalLocalSystem0
WMI Performance AdapterWmiApSrv停止手动自身的进程c:\windows\system32\wbem\wmiapsrv.exenormalLocalSystem0
WebClientWebClient正在运行自动共享进程c:\windows\system32\svchost.exe -k localservicenormalNT AUTHORITY\LocalService0
Windows AudioAudioSrv正在运行自动共享进程c:\windows\system32\svchost.exe -k netsvcsnormalLocalSystem0
Windows Image Acquisition (WIA)stisvc正在运行手动共享进程c:\windows\system32\svchost.exe -k imgsvcnormalLocalSystem0
Windows InstallerMSIServer停止手动共享进程c:\windows\system32\msiexec.exe /vnormalLocalSystem0
Windows Management Instrumentationwinmgmt正在运行自动共享进程c:\windows\system32\svchost.exe -k netsvcs忽略LocalSystem0
Windows Management Instrumentation Driver ExtensionsWmi停止手动共享进程c:\windows\system32\svchost.exe -k netsvcsnormalLocalSystem0
Windows TimeW32Time正在运行自动共享进程c:\windows\system32\svchost.exe -k netsvcsnormalLocalSystem0
Windows User Mode Driver FrameworkUMWdf正在运行自动自身的进程c:\windows\system32\wdfmgr.exenormalNT AUTHORITY\LocalService0
Wireless Zero ConfigurationWZCSVC正在运行自动共享进程c:\windows\system32\svchost.exe -k netsvcsnormalLocalSystem0
Workstationlanmanworkstation正在运行自动共享进程c:\windows\system32\svchost.exe -k netsvcsnormalLocalSystem0
局域网通讯协议Hello World停止自动自身的进程c:\program files\common files\microsoft shared\web folders\msosv.exenormalLocalSystem0

启动程序
8mh3c:\windows\temp\iexpl0re.exeNT AUTHORITY\SYSTEMHKU\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
8mh3c:\windows\temp\iexpl0re.exe.DEFAULTHKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
HotKeysCmdsc:\windows\system32\hkcmd.exeAll UsersHKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
IMJPMIG8.1"c:\windows\ime\imjp8_1\imjpmig.exe" /spoil /remadvdef /migration32All UsersHKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
IgfxTrayc:\windows\system32\igfxtray.exeAll UsersHKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
KSVSvcc:\windows\ksvsvc.exe /iAll UsersHKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
PHIME2002Ac:\windows\system32\ime\tintlgnt\tintsetp.exe /imenameAll UsersHKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
PHIME2002ASyncc:\windows\system32\ime\tintlgnt\tintsetp.exe /syncAll UsersHKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
RavTask"c:\program files\rising\rav\ravtask.exe" -systemAll UsersHKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
SoundMansoundman.exeAll UsersHKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
TkBellExe"c:\program files\common files\real\update_ob\realsched.exe"  -osbootAll UsersHKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
ctfmon.exec:\windows\system32\ctfmon.exeNT AUTHORITY\SYSTEMHKU\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
ctfmon.exec:\windows\system32\ctfmon.exeNT AUTHORITY\LOCAL SERVICEHKU\S-1-5-19\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
ctfmon.exec:\windows\system32\ctfmon.exeNT AUTHORITY\NETWORK SERVICEHKU\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
ctfmon.exec:\windows\system32\ctfmon.exeLIANG\wangliangHKU\S-1-5-21-1606980848-1383384898-1343024091-1003\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
ctfmon.exec:\windows\system32\ctfmon.exe.DEFAULTHKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
desktopdesktop.iniNT AUTHORITY\SYSTEM启动
desktopdesktop.iniLIANG\wangliang启动
desktopdesktop.ini.DEFAULT启动
desktopdesktop.iniAll Users公用启动
gukyjmiic:\docume~1\wangli~1\locals~1\temp\iexpl0re.exeLIANG\wangliangHKU\S-1-5-21-1606980848-1383384898-1343024091-1003\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
iPProc:\windows\ippro.exeAll UsersHKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
main32c:\windows\main32.exe /iAll UsersHKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
mppdsc:\windows\mppds.exeAll UsersHKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
rundll32c:\program files\common files\microsoft shared\web folders\msosv.exeNT AUTHORITY\SYSTEMHKU\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
rundll32c:\program files\common files\microsoft shared\web folders\msosv.exeLIANG\wangliangHKU\S-1-5-21-1606980848-1383384898-1343024091-1003\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
rundll32c:\program files\common files\microsoft shared\web folders\msosv.exe.DEFAULTHKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
shualaic:\windows\shualai.exe /iAll UsersHKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
upxdndc:\docume~1\wangli~1\locals~1\temp\upxdnd.exeAll UsersHKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
腾讯QQ腾讯qq.lnkLIANG\wangliang启动