业牡缒匀鹦怯没畔瑞星用户机器信息
自启动项
HKEY_LOCAL_MACHINE Software\Microsoft\Windows\Currentversion\Run
IMJPMIG8.1 = C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE /Spoil /RemAdvDef /Migration32
PHIME2002ASync = C:\WINDOWS\System32\IME\TINTLGNT\TINTSETP.EXE /SYNC
PHIME2002A = C:\WINDOWS\System32\IME\TINTLGNT\TINTSETP.EXE /IMEName
IgfxTray = C:\WINDOWS\System32\igfxtray.exe
HotKeysCmds = C:\WINDOWS\System32\hkcmd.exe
VirtualDrive = C:\Program Files\FarStone\VirtualDrive\vdtask.exe /AutoRestore
vcdplayx = "C:\WINDOWS\vcdplayx.exe"
BigDogPath = C:\WINDOWS\VM_STI.EXE USB PC Camera 301P
CnsMin = Rundll32.exe C:\WINDOWS\DOWNLO~1\CnsMin.dll,Rundll32
helper.dll = C:\WINDOWS\system32\rundll32.exe C:\PROGRA~1\3721\helper.dll,Rundll32
RavMon = C:\PROGRA~1\RISING\RAV\RAVMON.EXE -SYSTEM
RfwMain = "C:\Program Files\Rising\Rfw\rfwmain.exe" -Startup
YLive.exe = C:\PROGRA~1\Yahoo!\ASSIST~1\YLive.exe
yassistse = "C:\PROGRA~1\Yahoo!\Assistant\yassistse.exe"
RavTimer = C:\PROGRA~1\RISING\RAV\RAVTIMER.EXE
TkBellExe = "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
timessquare = C:\windows\timessquare.exe

HKEY_CURRENT_USER Software\Microsoft\Windows\Currentversion\Run
ctfmon.exe = C:\WINDOWS\System32\ctfmon.exe

HKEY_LOCAL_MACHINE Software\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks
shell32.dll = C:\WINDOWS\System32\ctfmon.exe
C:\WINDOWS\DOWNLO~1\CnsHook.dll= C:\WINDOWS\System32\ctfmon.exe

HKEY_LOCAL_MACHINE Software\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad
PostBootReminder = %SystemRoot%\system32\SHELL32.dll
CDBurn = %SystemRoot%\system32\SHELL32.dll
WebCheck = %SystemRoot%\System32\webcheck.dll
SysTray = C:\WINDOWS\System32\stobject.dll

HKEY_LOCAL_MACHINE Software\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler
%SystemRoot%\System32\browseui.dll= Browseui 预加载程序
%SystemRoot%\System32\browseui.dll= 组件类别缓存程序


SYSTEM.INI BOOT SHELL Explorer.exe
SYSTEM.INI BOOT SCRNSAVE.EXE C:\WINDOWS\System32\logon.scr


其他相关项
HKEY_CURRENT_USER Software\Microsoft\Internet Explorer\Main start page ----> www.qq.com
HKEY_LOCAL_MACHINE Software\Microsoft\Internet Explorer\Main search page ----> http://searchbar.findthewebsiteyouneed.com
HKEY_LOCAL_MACHINE Software\Microsoft\internet explorer\search searchassistant ----> http://seek.yisou.com/srchasst.htm
HKEY_LOCAL_MACHINE Software\Microsoft\internet explorer\search CustomizeSearch ----> http://seek.yisou.com/srchcust.htm
HKEY_LOCAL_MACHINE Software\Microsoft\Windows NT\CurrentVersion\Winlogon DefaultUserName ----> 彭轩
HKEY_LOCAL_MACHINE Software\Microsoft\Windows NT\CurrentVersion\Winlogon AltDefaultUserName ----> 彭轩
HKEY_LOCAL_MACHINE Software\Microsoft\Windows NT\CurrentVersion\Winlogon Userinit ----> C:\WINDOWS\system32\userinit.exe,
HKEY_USERS .Default\Software\Microsoft\Internet Explorer\Main start page ----> http://www.findthewebsiteyouneed.com
HKEY_USERS .Default\Software\Microsoft\Internet Explorer\Main search page ----> http://searchbar.findthewebsiteyouneed.com
HKEY_USERS .Default\Software\Microsoft\Internet Explorer\Main search bar ----> http://searchbar.findthewebsiteyouneed.com
HKEY_USERS .Default\Software\Microsoft\Internet Explorer\Main default_search_url ----> http://searchbar.findthewebsiteyouneed.com
附前贴