注册表
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
<Internat.exe><internat.exe> [(Verified)Microsoft Corporation]
[HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows]
<load><> [N/A]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
<Synchronization Manager><mobsync.exe /logon> [(Verified)Microsoft Corporation]
<IgfxTray><C:\WINNT\System32\igfxtray.exe> [Intel Corporation]
<HotKeysCmds><C:\WINNT\System32\hkcmd.exe> [Intel Corporation]
<load><C:\WINNT\uninstall\rundl132.exe> [N/A]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
<shell><Explorer.exe> [(Verified)Microsoft Corporation]
<Userinit><C:\WINNT\system32\userinit.exe,> [(Verified)Microsoft Corporation]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Windows]
<AppInit_DLLs><> [N/A]
[HKEY_CURRENT_USER\Control Panel\Desktop]
<SCRNSAVE.EXE><(无)> [N/A]
==================================
启动文件夹
N/A
==================================
服务
[Logical Disk Manager Administrative Service / dmadmin][Stopped/Manual Start]
<C:\WINNT\System32\dmadmin.exe /com><VERITAS Software Corp.>
==================================
驱动程序
[dmboot / dmboot][Stopped/Disabled]
<System32\drivers\dmboot.sys><VERITAS Software Corp.>
[Logical Disk Manager Driver / dmio][Running/Boot Start]
<\SystemRoot\System32\drivers\dmio.sys><VERITAS Software Corp.>
[dmload / dmload][Running/Boot Start]
<\SystemRoot\System32\drivers\dmload.sys><VERITAS Software Corp.>
[ialm / ialm][Running/Manual Start]
<System32\DRIVERS\ialmnt5.sys><Intel Corporation>
[Direct Parallel Link Driver / Ptilink][Running/Manual Start]
<System32\DRIVERS\ptilink.sys><Parallel Technologies, Inc.>
[Realtek RTL8029(AS)-based PCI Ethernet Adapter NT Driver / rtl8029][Running/Manual Start]
<System32\DRIVERS\RTL8029.SYS><REALTEK Semiconductor Corp.>
==================================
浏览器加载项
[@shdoclc.dll,-866]
{c95fe080-8f5d-11d2-a20b-00aa003c157a} <, N/A>
[@msdxmLC.dll,-1@2052,电台(&R)]
{8E718888-423F-11D2-876E-00A0C9082467} <C:\WINNT\System32\msdxm.ocx, Microsoft Corporation>
==================================
正在运行的进程
[PID: 136][\SystemRoot\System32\smss.exe] [Microsoft Corporation, 5.00.2170.1]
[PID: 164][\??\C:\WINNT\system32\csrss.exe] [Microsoft Corporation, 5.00.2137.1]
[PID: 184][\??\C:\WINNT\system32\winlogon.exe] [Microsoft Corporation, 5.00.2182.1]
[PID: 212][C:\WINNT\system32\services.exe] [Microsoft Corporation, 5.00.2134.1]
[C:\WINNT\system32\dmserver.dll] [VERITAS Software Corp., 2191.1.296.2]
[PID: 224][C:\WINNT\system32\lsass.exe] [Microsoft Corporation, 5.00.2184.1]
[PID: 392][C:\WINNT\system32\svchost.exe] [Microsoft Corporation, 5.00.2134.1]
[PID: 412][C:\WINNT\system32\spoolsv.exe] [Microsoft Corporation, 5.00.2161.1]
[PID: 444][C:\WINNT\System32\svchost.exe] [Microsoft Corporation, 5.00.2134.1]
[PID: 480][C:\WINNT\system32\regsvc.exe] [Microsoft Corporation, 5.00.2155.1]
[PID: 496][C:\WINNT\system32\MSTask.exe] [Microsoft Corporation, 4.71.2137.1]
[PID: 676][C:\WINNT\Explorer.exe] [Microsoft Corporation, 5.00.2920.0000]
[C:\WINNT\RichDll.dll] [N/A, N/A]
[C:\WINNT\System32\igfxpph.dll] [Intel Corporation, 3.0.0.4020]
[C:\WINNT\System32\hccutils.DLL] [Intel Corporation, 3.0.0.4020]
[C:\WINNT\System32\igfxres.dll] [Intel Corporation, 3.0.0.4020]
[C:\WINNT\System32\igfxsrvc.dll] [Intel Corporation, 3.0.0.4020]
[C:\WINNT\System32\igfxdev.dll] [Intel Corporation, 3.0.0.4020]
[C:\Program Files\WinRAR\rarext.dll] [N/A, N/A]
[PID: 756][C:\WINNT\System32\hkcmd.exe] [Intel Corporation, 3.0.0.4020]
[C:\WINNT\System32\hccutils.DLL] [Intel Corporation, 3.0.0.4020]
[C:\WINNT\System32\igfxdev.dll] [Intel Corporation, 3.0.0.4020]
[C:\WINNT\System32\igfxsrvc.dll] [Intel Corporation, 3.0.0.4020]
[C:\WINNT\System32\igfxhk.dll] [Intel Corporation, 3.0.0.4020]
[C:\WINNT\System32\igfxres.dll] [Intel Corporation, 3.0.0.4020]
[PID: 772][C:\WINNT\System32\internat.exe] [Microsoft Corporation, 5.00.2920.0000]
[PID: 820][C:\WINNT\System32\conime.exe] [Microsoft Corporation, 5.00.2180.1]
[PID: 812][C:\WINNT\Logo1_.exe] [, 1.0.0.0]
[PID: 724][G:\软件\SRE\SREng.EXE] [Smallfrogs Studio, 2.3.13.690]
==================================
文件关联
.TXT OK. [%SystemRoot%\system32\NOTEPAD.EXE %1]
.EXE OK. ["%1" %*]
.COM OK. ["%1" %*]
.PIF OK. ["%1" %*]
.REG OK. [regedit.exe "%1"]
.BAT OK. ["%1" %*]
.SCR OK. ["%1" /S]
.CHM OK. ["C:\WINNT\hh.exe" %1]
.HLP OK. [%SystemRoot%\System32\winhlp32.exe %1]
.INI OK. [%SystemRoot%\System32\NOTEPAD.EXE %1]
.INF OK. [%SystemRoot%\System32\NOTEPAD.EXE %1]
.VBS OK. [%SystemRoot%\System32\WScript.exe "%1" %*]
.JS OK. [%SystemRoot%\System32\WScript.exe "%1" %*]
.LNK OK. [{00021401-0000-0000-C000-000000000046}]
==================================
Winsock 提供者
N/A
[用户系统信息]Mozilla/4.0 (compatible; MSIE 5.01; Windows NT 5.0)
