启动项目
注册表
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
<ctfmon.exe><C:\WINDOWS\system32\ctfmon.exe> [(Verified)Microsoft Windows Publisher]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
<NvCplDaemon><RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup> [NVIDIA Corporation]
<IMJPMIG8.1><; "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32> [(Verified)Microsoft Windows Publisher]
<PHIME2002A><; C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName> [File is missing]
<PHIME2002ASync><; C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC> [File is missing]
<SoundMan><; SOUNDMAN.EXE> [(Verified)Microsoft Windows Hardware Compatibility Publisher]
<YY><C:\Program Files\duowan\yy\Start.exe> [广州多玩信息技术有限公司]
<3PMmUpdate><rundll32 "C:\WINDOWS\Update.dll",Main> []
<MSConfig><C:\WINDOWS\system32\msconfig.exe /auto> [(Verified)Microsoft Windows Publisher]
<HBService32><System.exe> [File is missing]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
<shell><Explorer.exe> [(Verified)Microsoft Windows Component Publisher]
<Userinit><C:\WINDOWS\system32\userinit.exe,> [(Verified)Microsoft Windows Publisher]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Windows]
<AppInit_DLLs><eskisl.dll lensch.dll micsus.dll cupops.dll jolndyo.dll johandy.dll aotoppt.dll pewire.dll comboaus.dll catower.dll wllame.dll> [N/A]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
<UIHost><logonui.exe> [(Verified)Microsoft Windows Publisher]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
<{898E02AB-9372-4a2c-9C4A-FFE1AF61097F}><C:\WINDOWS\system32\comuidsg.dll> [File is missing]
<{65056902-6E7B-4bd7-95BA-688DB5FA5BEB}><C:\WINDOWS\system32\mstimewd.dll> [File is missing]
<{71A78CD4-E470-4a18-8457-E0E0283DD507}><C:\WINDOWS\system32\ecbyllfl.dll> []
<{6B9FEAD7-4319-4312-AB05-D8C9CD255BFE}><C:\WINDOWS\system32\avicapwm.dll> []
<{F0930A2F-D971-4828-8209-B7DFD266ED44}><C:\WINDOWS\system32\iedlemyw.dll> []
<{2CB77746-8ECC-40ca-8217-10CA8BE5EFC8}><C:\WINDOWS\system32\iedlemyw.dll> []
<{434FA69C-5F0A-42e1-82B8-10AF2C8E53C6}><C:\WINDOWS\system32\yabhgmla.dll> []
<{EB9660D8-E1CD-4ff0-B4A9-00CD907F928A}><C:\WINDOWS\system32\bkwmyndl.dll> []
<{D3112B69-A745-4805-874E-ABD480EA1299}><C:\WINDOWS\system32\iedlemyw.dll> []
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
<qxypoqoa.dll><C:\WINDOWS\system32\iedlemyw.dll> []
<hqlfnmuc.dll><C:\WINDOWS\system32\iedlemyw.dll> []
<sysocmgr><C:\WINDOWS\sysocmgr.dll> [Microsoft Corporation]
<comuidsg.dll><C:\WINDOWS\system32\comuidsg.dll> [File is missing]
<mstimewd.dll><C:\WINDOWS\system32\mstimewd.dll> [File is missing]
<lweurqhx.dll><C:\WINDOWS\system32\ecbyllfl.dll> []
<avicapwm.dll><C:\WINDOWS\system32\avicapwm.dll> []
<oymtoqph.dll><C:\WINDOWS\system32\iedlemyw.dll> []
<rigyyriz.dll><C:\WINDOWS\system32\iedlemyw.dll> []
<ThunderAdvise><C:\WINDOWS\Downloaded Program Files\ThunderAdvise.dll> [Thunder Networking Technologies,LTD]
<msnmsg><C:\Program Files\Messenger\msgmr.dll> [Microsoft Corporation]
<ksvkhuzo.dll><C:\WINDOWS\system32\yabhgmla.dll> []
<sjrcjuui.dll><C:\WINDOWS\system32\yabhgmla.dll> []
<mdgqaqtu.dll><C:\WINDOWS\system32\bkwmyndl.dll> []
<mlkxdock.dll><C:\WINDOWS\system32\ecbyllfl.dll> []
<gukzxqtm.dll><C:\WINDOWS\system32\iedlemyw.dll> []
<gcngsocc.dll><C:\WINDOWS\system32\iedlemyw.dll> []
<jttafmec.dll><C:\WINDOWS\system32\iedlemyw.dll> []
<yabhgmla.dll><C:\WINDOWS\system32\yabhgmla.dll> []
<bkwmyndl.dll><C:\WINDOWS\system32\bkwmyndl.dll> []
<ecbyllfl.dll><C:\WINDOWS\system32\ecbyllfl.dll> []
<iedlemyw.dll><C:\WINDOWS\system32\iedlemyw.dll> []
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\>{26923b43-4d38-484f-9b9e-de460746276c}]
<Internet Explorer><%systemroot%\system32\shmgrate.exe OCInstallUserConfigIE> [File is missing]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\>{881dd1c5-3dcf-431b-b061-f3f88e8be88a}]
<Outlook Express><%systemroot%\system32\shmgrate.exe OCInstallUserConfigOE> [File is missing]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{2C7339CF-2B09-4501-B3F3-F3508C9228ED}]
<Themes Setup><%SystemRoot%\system32\regsvr32.exe /s /n /i:/UserInstall %SystemRoot%\system32\themeui.dll> [File is missing]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{44BBA840-CC51-11CF-AAFA-00AA00B6015C}]
<Microsoft Outlook Express 6><"%ProgramFiles%\Outlook Express\setup50.exe" /APP:OE /CALLER:WINNT /user /install> [File is missing]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{44BBA842-CC51-11CF-AAFA-00AA00B6015B}]
<NetMeeting 3.01><rundll32.exe advpack.dll,LaunchINFSection C:\WINDOWS\INF\msnetmtg.inf,NetMtg.Remove.PerUser.NT> [(Verified)Microsoft Windows Publisher]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{5945c046-1e7d-11d1-bc44-00c04fd912be}]
<Windows Messenger 4.7><rundll32.exe advpack.dll,LaunchINFSection C:\WINDOWS\INF\msmsgs.inf,BLC.QuietInstall.PerUser> [(Verified)Microsoft Windows Publisher]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{6BF52A52-394A-11d3-B153-00C04F79FAA6}]
<Microsoft Windows Media Player><rundll32.exe advpack.dll,LaunchINFSection C:\WINDOWS\INF\wmp10.inf,PerUserStub> [(Verified)Microsoft Windows Component Publisher]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{7790769C-0471-11d2-AF11-00C04FA35D02}]
<通讯簿 6><"%ProgramFiles%\Outlook Express\setup50.exe" /APP:WAB /CALLER:WINNT /user /install> [File is missing]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
<HBService32><; System.exe> [File is missing]
<iSpeak6><; C:\Program Files\Changetech\iSpeak6.0\iSpeak.exe> [上海勤和互联网技术软件开发有限公司]
