启动项目
注册表
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
<Internat.exe><internat.exe> [Microsoft Corporation]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
<Synchronization Manager><mobsync.exe /logon> [Microsoft Corporation]
<SoundMAXPnP><C:\Program Files\Analog Devices\SoundMAX\SMax4PNP.exe> [Analog Devices, Inc.]
<SoundMAX><"C:\Program Files\Analog Devices\SoundMAX\Smax4.exe" /tray> [Analog Devices, Inc.]
<IgfxTray><C:\WINNT\system32\igfxtray.exe> [Intel Corporation]
<HotKeysCmds><C:\WINNT\system32\hkcmd.exe> [Intel Corporation]
<scon><C:\scon\scon.exe> []
<runeip><C:\Program Files\Rising\AntiSpyware\runiep.exe> [Beijing Rising Technology Co., Ltd.]
<RavTask><"D:\Rising\Rav\RavTask.exe" -system> [Beijing Rising Technology Co., Ltd.]
<TkBellExe><"C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot> [RealNetworks, Inc.]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
<shell><Explorer.exe> [Microsoft Corporation]
<Userinit><C:\WINNT\system32\userinit.exe,> [Microsoft Corporation]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
<{32CD708B-60A7-4C00-9377-D73EAA495F0F}><C:\WINNT\system32\RavExt.dll> [Beijing Rising Technology Co., Ltd.]
==================================
启动文件夹
服务
[Logical Disk Manager Administrative Service / dmadmin]
<C:\WINNT\System32\dmadmin.exe /com><VERITAS Software Corp.>
[Remote Packet Capture Protocol v.0 (experimental) / rpcapd]
<"C:\Program Files\WinPcap\rpcapd.exe" -d -f "C:\Program Files\WinPcap\rpcapd.ini"><N/A>
[Rising Process Communication Center / RsCCenter]
<"D:\Rising\Rav\CCenter.exe"><Beijing Rising Technology Co., Ltd.>
[Rising RealTime Monitor / RsRavMon]
<"D:\Rising\Rav\Ravmond.exe"><Beijing Rising Technology Co., Ltd.>
[SoundMAX Agent Service / SoundMAX Agent Service (default)]
<C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe><Analog Devices, Inc.>
[Utility Manager / UtilMan]
<C:\WINNT\System32\UtilMan.exe><N/A>
==================================
浏览器加载项
[网址大全]
{C18CB140-0BBB-11D4-8FE8-0088CC102438} <http://www.mpsoft.net/wz.htm, N/A>
[@shdoclc.dll,-866]
{c95fe080-8f5d-11d2-a20b-00aa003c157a} <, N/A>
[@msdxmLC.dll,-1@2052,电台(&R)]
{8E718888-423F-11D2-876E-00A0C9082467} <C:\WINNT\system32\msdxm.ocx, Microsoft Corporation>
[WUWebControl Class]
{6414512B-B978-451D-A0D8-FCFDF33E833C} <C:\WINNT\system32\wuweb.dll, Microsoft Corporation>
[XML DOM Document 4.0]
{88D969C0-F192-11D4-A65F-0040963251E5} <%SystemRoot%\system32\msxml4.dll, N/A>
[Shockwave Flash
Object]
{D27CDB6E-AE6D-11CF-96B8-444553540000} <C:\WINNT\system32\Macromed\Flash\Flash9.ocx, Adobe Systems, Inc.>
==================================
正在运行的进程
[PID: 152][\SystemRoot\System32\smss.exe] <Microsoft Corporation><5.00.2195.6601>
[PID: 176][\??\C:\WINNT\system32\csrss.exe] <Microsoft Corporation><5.00.2195.6601>
[PID: 196][\??\C:\WINNT\system32\winlogon.exe] <Microsoft Corporation><5.00.2195.6997>
[PID: 224][C:\WINNT\system32\services.exe] <Microsoft Corporation><5.00.2195.7035>
[C:\WINNT\system32\dmserver.dll] <VERITAS Software Corp.><2195.6605.297.3>
[PID: 236][C:\WINNT\system32\lsass.exe] <Microsoft Corporation><5.00.2195.7011>
[PID: 400][C:\WINNT\system32\svchost.exe] <Microsoft Corporation><5.00.2134.1>
[PID: 484][C:\WINNT\system32\spoolsv.exe] <Microsoft Corporation><5.00.2195.7059>
[PID: 520][C:\WINNT\system32\svchost.exe] <Microsoft Corporation><5.00.2134.1>
[PID: 568][C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe] <Analog Devices, Inc.><3, 2, 6, 0>
[PID: 604][C:\WINNT\System32\WBEM\WinMgmt.exe] <Microsoft Corporation><1.50.1085.0100>
[PID: 868][D:\Rising\Rav\RavStub.exe] <Beijing Rising Technology Co., Ltd.><19, 0, 0, 4>
[D:\Rising\Rav\RsCommX.dll] <rising><18, 0, 0, 1>
[D:\Rising\Rav\RSCOMMON.DLL] <Beijing Rising Technology Co., Ltd.><19, 0, 0, 5>
[PID: 1044][C:\WINNT\Explorer.EXE] <Microsoft Corporation><5.00.3700.6690>
[C:\Program Files\Rising\AntiSpyware\ieprot.dll] <Beijing Rising Technology Co., Ltd.><1, 0, 0, 8>
[C:\WINNT\system32\igfxpph.dll] <Intel Corporation><3,0,0,2082>
[C:\WINNT\system32\hccutils.DLL] <Intel Corporation><3,0,0,2082>
[C:\WINNT\system32\igfxres.dll] <Intel Corporation><3,0,0,2082>
[C:\WINNT\system32\igfxsrvc.dll] <Intel Corporation><3,0,0,2082>
[C:\WINNT\system32\igfxdev.dll] <Intel Corporation><3,0,0,2082>
[C:\WINNT\system32\RavExt.dll] <Beijing Rising Technology Co., Ltd.><19, 0, 0, 9>
[D:\Rising\Rav\RSCOMMON.DLL] <Beijing Rising Technology Co., Ltd.><19, 0, 0, 5>
[C:\WINNT\system32\WINABC.IME] <PKUETI><5.22.216>
[C:\Program Files\WinRAR\rarext.dll] <N/A><N/A>
[PID: 1588][C:\Program Files\Analog Devices\SoundMAX\SMax4PNP.exe] <Analog Devices, Inc.><4, 0, 3, 6>
[C:\Program Files\Analog Devices\SoundMAX\SMWDMIF.dll] <Analog Device, Inc.><1, 0, 20, 1>
[C:\Program Files\Rising\AntiSpyware\ieprot.dll] <Beijing Rising Technology Co., Ltd.><1, 0, 0, 8>
[PID: 1312][C:\Program Files\Analog Devices\SoundMAX\Smax4.exe] <Analog Devices, Inc.><4, 0, 4, 11>
[C:\Program Files\Rising\AntiSpyware\ieprot.dll] <Beijing Rising Technology Co., Ltd.><1, 0, 0, 8>
[PID: 616][C:\WINNT\system32\hkcmd.exe] <Intel Corporation><3,0,0,2082>
[C:\WINNT\system32\hccutils.DLL] <Intel Corporation><3,0,0,2082>
[C:\WINNT\system32\igfxdev.dll] <Intel Corporation><3,0,0,2082>
[C:\WINNT\system32\igfxsrvc.dll] <Intel Corporation><3,0,0,2082>
[C:\Program Files\Rising\AntiSpyware\ieprot.dll] <Beijing Rising Technology Co., Ltd.><1, 0, 0, 8>
[C:\WINNT\system32\igfxhk.dll] <Intel Corporation><3,0,0,2082>
[C:\WINNT\system32\igfxres.dll] <Intel Corporation><3,0,0,2082>
[PID: 1460][C:\Program Files\Rising\AntiSpyware\runiep.exe] <Beijing Rising Technology Co., Ltd.><1, 0, 1, 6>
[C:\Program Files\Rising\AntiSpyware\iep_ctrl.dll] <Beijing Rising Technology Co., Ltd.><1, 0, 0, 4>
[C:\Program Files\Rising\AntiSpyware\ieprot.dll] <Beijing Rising Technology Co., Ltd.><1, 0, 0, 8>
[PID: 1708][C:\Program Files\Common Files\Real\Update_OB\realsched.exe] <RealNetworks, Inc.><0.1.0.3536>
[C:\Program Files\Rising\AntiSpyware\ieprot.dll] <Beijing Rising Technology Co., Ltd.><1, 0, 0, 8>
[PID: 1300][C:\WINNT\system32\internat.exe] <Microsoft Corporation><5.00.2920.0000>
[C:\Program Files\Rising\AntiSpyware\ieprot.dll] <Beijing Rising Technology Co., Ltd.><1, 0, 0, 8>
[PID: 1084][C:\WINNT\system32\conime.exe] <Microsoft Corporation><5.00.2195.6655>
[C:\Program Files\Rising\AntiSpyware\ieprot.dll] <Beijing Rising Technology Co., Ltd.><1, 0, 0, 8>
[PID: 1140][C:\Program Files\Internet Explorer\iexplore.exe] <Microsoft Corporation><6.00.2800.1106>
[C:\Program Files\Rising\AntiSpyware\ieprot.dll] <Beijing Rising Technology Co., Ltd.><1, 0, 0, 8>
[C:\WINNT\system32\Macromed\Flash\Flash9.ocx] <Adobe Systems, Inc.><9,0,16,0>
[C:\WINNT\system32\WINABC.IME] <PKUETI><5.22.216>
[PID: 952][C:\Program Files\WinRAR\WinRAR.exe] <N/A><N/A>
[C:\Program Files\Rising\AntiSpyware\ieprot.dll] <Beijing Rising Technology Co., Ltd.><1, 0, 0, 8>
[PID: 1692][C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\Rar$EX00.923\SREng2 系统修复\SREng.exe] <Smallfrogs Studio><2.0.21.505>
[C:\Program Files\Rising\AntiSpyware\ieprot.dll] <Beijing Rising Technology Co., Ltd.><1, 0, 0, 8>
[C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\Rar$EX00.923\SREng2 系统修复\Plugins\SREngPluginDemo.SRE] <Smallfrogs Studio><1, 1, 1, 0>
==================================
文件关联
.TXT OK. [%SystemRoot%\system32\NOTEPAD.EXE %1]
.EXE OK. ["%1" %*]
.COM OK. ["%1" %*]
.PIF OK. ["%1" %*]
.REG OK. [regedit.exe "%1"]
.BAT OK. ["%1" %*]
.SCR OK. ["%1" /S]
.CHM OK. ["C:\WINNT\hh.exe" %1]
.HLP OK. [%SystemRoot%\System32\winhlp32.exe %1]
.INI OK. [%SystemRoot%\System32\NOTEPAD.EXE %1]
.INF OK. [%SystemRoot%\System32\NOTEPAD.EXE %1]
.VBS OK. [%SystemRoot%\System32\WScript.exe "%1" %*]
.JS OK. [%SystemRoot%\System32\WScript.exe "%1" %*]
.LNK OK. [{00021401-0000-0000-C000-000000000046}]
