HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
+ casbmh File not found: C:\WINDOWS\system32\ijmnhst.exe r
+ CnsMin 3721 北京三七二一科技有限公司 c:\windows\downloaded program files\cnsmin.dll
+ RavMon RavMon Rising realtime monitor Beijing Rising Technology Co., Ltd. c:\program files\rising\rav\ravmon.exe
+ RavTimer RavTimer Beijing Rising Technology Co., Ltd. c:\program files\rising\rav\ravtimer.exe
+ RavTray RavNet Tray Rising c:\program files\rising\rav\ravtray.exe
HKCU\Software\Microsoft\Windows\CurrentVersion\Run
+ DrvMon.exe Drive Monitor Alcor Micro, Corp. c:\windows\system32\drvmon.exe
+ jjxhid c:\windows\system32\mnouzai.exe
HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks
+ cnshook.dll 3721 CNS Module 北京三七二一科技有限公司 c:\windows\downloaded program files\cnshook.dll
HKLM\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved
+ "RISING" Rising Shell Ext Module Beijing Rising Technology Co., Ltd. c:\windows\system32\ravext.dll
+ Display Panning CPL Extension File not found: deskpan.dll
+ HyperTerminal Icon Ext HyperTerminal Applet Library Hilgraeve, Inc. c:\windows\system32\hticons.dll
+ WinRAR shell extension c:\program files\winrar\rarext.dll
+ Yahoo!Photo yPhtb Yahoo! China c:\program files\yahoo!\assistant\assist\yphtb.dll
+ 粉碎文件 Wiper 动态链接库 c:\program files\yahoo!\assistant\assist\ywiper.dll
HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper
Objects
+ AntiFish Class yangling.dll Yahoo. c:\program files\yahoo!\assistant\assist\yangling.dll
+ CnsHook Class 3721 CNS Module 北京三七二一科技有限公司 c:\windows\downloaded program files\cnshook.dll
+ DragSearch BHO DragSearch c:\program files\yahoo!\assistant\assist\ydragsearch.dll
+ DragSearch BHO DragSearch c:\program files\yisou\yisoub.dll
+ IeCatch2 Class jccatch Module Amaze Soft c:\program files\flashget\jccatch.dll
+ QQBrowserHelper
Object Class QQIEHelper Module 深圳市腾讯计算机系统有限公司 c:\program files\tencent\qq\qqiehelper.dll
+ Yahoo!Photo yPhtb Yahoo! China c:\program files\yahoo!\assistant\assist\yphtb.dll
+ 雅虎助手 ToolBar Yahoo! c:\program files\yahoo!\assistant\assist\yasbar.dll
HKCU\Software\Microsoft\Internet Explorer\UrlSearchHooks
+ coolbar ToolBar Yahoo! c:\program files\yahoo!\assistant\assist\yasbar.dll
HKLM\Software\Microsoft\Internet Explorer\Toolbar
+ 雅虎助手 ToolBar Yahoo! c:\program files\yahoo!\assistant\assist\yasbar.dll
+ 一搜 YiSou ToolBar 3721 c:\program files\yisou\yisou.dll
HKLM\Software\Microsoft\Internet Explorer\Extensions
+ &FlashGet FlashGet Amaze Soft c:\program files\flashget\flashget.exe
+ Yahoo 1G电邮 File not found: http://cn.mail.yahoo.com/promo/rd1
+ 清理上网记录 File not found: http://assistant.3721.com/clean1.htm?fb=Cns
+ 情景聊天 File not found: http://cn.rd.yahoo.com/home/messenger/bjk/clientbtn/?http://cn.messenger.yahoo.com/
+ 上网助手 File not found: http://assistant.3721.com/index.htm?fb=Cns
+ 手机短信 File not found: http://sms.3721.com/ie/index.htm
+ 腾讯QQ QQ TENCENT c:\program files\tencent\qq\qq.exe
+ 修复浏览器 File not found: http://assistant.3721.com/security1.htm?fb=Cns
+ 寻宝乐趣多 File not found: http://hot.3721.com/rd/shop_btn.htm
HKLM\System\CurrentControlSet\Services
+ RavService 瑞星杀毒软件网络版客户端通讯代理 Beijing Rising Technology Co., Ltd. c:\program files\rising\rav\ravservice.exe
+ RsCCenter 瑞星系统通讯中心 Beijing Rising Technology Co., Ltd. c:\program files\rising\rav\ccenter.exe
+ RsRavMon RavMon Beijing Rising Technology Co., Ltd. c:\program files\rising\rav\ravmond.exe
+ SLService User-Level Modem Service c:\windows\system32\slserv.exe
+ SvcProc c:\windows\svcproc.exe
HKLM\System\CurrentControlSet\Services
+ BaseTDI basetdi Rising c:\windows\system32\drivers\basetdi.sys
+ ExpScaner ExpScan.sys c:\program files\rising\rav\expscan.sys
+ HookCont TDI HOOK Driver Rising tech Co. ltd c:\program files\rising\rav\hookcont.sys
+ HookReg c:\program files\rising\rav\hookreg.sys
+ hooksys 瑞星 c:\program files\rising\rav\hooksys.sys
+ Mtlmnt5 mtlmnt5 driver c:\windows\system32\drivers\mtlmnt5.sys
+ Mtlstrm Data pump driver c:\windows\system32\drivers\mtlstrm.sys
+ New0 c:\windows\system32\new.sys
+ NPPTNT2 nProtect NPSC Kernel Mode Driver for NT INCA Internet Co., Ltd. c:\windows\system32\npptnt2.sys
+ NtMtlFax NtMtlFax driver c:\windows\system32\drivers\ntmtlfax.sys
+ oshack20.sys File not found: C:\WINDOWS\system32\drivers\oshack20.sys
+ Ptilink Direct Parallel Link Driver Parallel Technologies, Inc. c:\windows\system32\drivers\ptilink.sys
+ QuakeDRV c:\windows\system32\drivers\quakedrv.sys
+ Secdrv SafeDisc driver c:\windows\system32\drivers\secdrv.sys
+ SiS315 SiS Compatible Super VGA Driver Silicon Integrated Systems Corporation c:\windows\system32\drivers\sisgrp.sys
+ SiS7012 SiS 7012 Audio Device WDM Driver Silicon Integrated Systems Corporation c:\windows\system32\drivers\sis7012.sys
+ sisagp SiS NT AGP Filter Silicon Integrated Systems Corporation c:\windows\system32\drivers\sisagp.sys
+ SiSkp c:\windows\system32\drivers\srvkp.sys
+ SISNIC SiS PCI Fast Ethernet Adapter Driver SiS Corporation c:\windows\system32\drivers\sisnic.sys
+ Slntamr slntamr driver c:\windows\system32\drivers\slntamr.sys
+ SlNtHal HAL driver c:\windows\system32\drivers\slnthal.sys
+ SlWdmSup Description string for SlWdmSup driver Vireo Software c:\windows\system32\drivers\slwdmsup.sys
+ SNPSTD3 PC Camera driver c:\windows\system32\drivers\snpstd3.sys
HKLM\SYSTEM\CurrentControlSet\Control\Print\Monitors
+ ZepMon DrPMon PrintMonitor Direct Revenue c:\windows\system32\drpmon.dll
