+ HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify
igfxcui
[A ] 44. c:\windows\system32\igfxdev.dll
+ IE浏览器加载模块
+ HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar
{DB9ECD4F-FB8F-4311-B3CE-90B976C2707C}
[A ] 45. c:\windows\system32\kakatool.dll
+ HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper
Objects
{01443AEC-0FD1-40fd-9C87-E93D1494C233}
[AM] 46. c:\program files\thunder network\thunder\comdlls\tdatonce_now.dll
{889D2FEB-5411-4565-8998-1DD2C5261283}
[AM] 47. c:\program files\thunder network\thunder\comdlls\xunleibho_now.dll
+ HKLM\SOFTWARE\Microsoft\Internet Explorer\Extensions
Exec
[A ] 48. c:\program files\thunder network\thunder\thunder.exe
+ 资源管理器加载模块
+ HKLM\SOFTWARE\Classes\PROTOCOLS\Filter
application/octet-stream
[AM] 49. c:\windows\system32\mscoree.dll
application/x-complus
[AM] 49. c:\windows\system32\mscoree.dll
application/x-msdownload
[AM] 49. c:\windows\system32\mscoree.dll
text/xml
[A ] 50. c:\program files\common files\microsoft shared\office11\msoxmlmf.dll
+ HKLM\SOFTWARE\Classes\PROTOCOLS\Handler
KuGoo3
[A ] 51. d:\kgoo\kugoo3\inextend\kugoo3downxcontrol.ocx
+ HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved
HyperTerminal Icon Ext
[A ] 52. c:\windows\system32\hticons.dll
WinRAR shell extension
[A ] 53. c:\program files\winrar\rarext.dll
Shell Extensions for RealOne Player
[A ] 54. c:\program files\real\realplayer\rpshell.dll
Microsoft Office HTML Icon Handler
[AM] 55. c:\program files\microsoft office\office11\msohev.dll
Portable Media Devices
[A ] 56. c:\windows\system32\audiodev.dll
Portable Devices
[A ] 57. c:\windows\system32\wpdshext.dll
Portable Devices Menu
[A ] 57. c:\windows\system32\wpdshext.dll
Fusion Cache
[AM] 49. c:\windows\system32\mscoree.dll
Web Folders
[A ] 58. c:\program files\common files\microsoft shared\web folders\msonsext.dll
RISING
[AM] 59. c:\windows\system32\ravext.dll
+ HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks
{32CD708B-60A7-4C00-9377-D73EAA495F0F}
[AM] 59. c:\windows\system32\ravext.dll
+ 用户登陆自运行项目
+ HKLM\Software\Microsoft\Windows\CurrentVersion\Run
switch
[A ] 60. c:\windows\system32\壁纸自动换.exe
High Definition Audio Property Page Shortcut
[A ] 61. c:\windows\system32\chdaudpropshortcut.exe
FixCamera
[AM] 62. c:\windows\fixcamera.exe
runeip
[AM] 63. c:\program files\rising\antispyware\runiep.exe
RavTask
[AM] 64. e:\rising\rising\rav\ravtask.exe
RfwMain
[AM] 65. e:\rising\rising\rfw\rfwmain.exe
+ 开机执行
+ HKLM\SYSTEM\CurrentControlSet\Control\NetworkProvider\Order
BootExecute
[A ] 66. c:\windows\system32\bsmain.exe
+ 映像劫持
+ HKCR\.html
htmlfile\Edit\Command
[A ] 67. c:\program files\microsoft office\office11\msohtmed.exe
htmlfile\Print\Command
[A ] 67. c:\program files\microsoft office\office11\msohtmed.exe
+ HKCR\.htm
htmlfile\Edit\Command
[A ] 67. c:\program files\microsoft office\office11\msohtmed.exe
htmlfile\Print\Command
[A ] 67. c:\program files\microsoft office\office11\msohtmed.exe
+ HKCR\.mp3
RealPlayer.MP3.6\open\Command
[A ] 68. c:\program files\real\realplayer\realplay.exe
+ 打印机监控
+ HKLM\SYSTEM\CurrentControlSet\Control\Print\Monitors
HP Standard TCP/IP Port
[AM] 69. c:\windows\system32\hptcpmon.dll
Language Monitor
[AM] 70. c:\windows\system32\hpz3l3xu.dll