Logfile of HijackThis v1.99.1
Scan saved at 8:09:06, on 2006-8-7
Platform: Windows 2000 SP4 (WinNT 5.00.2195)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)
Running processes:
C:\WINNT\System32\smss.exe
C:\WINNT\system32\csrss.exe
C:\WINNT\system32\winlogon.exe
C:\WINNT\system32\services.exe
C:\WINNT\system32\lsass.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\system32\spoolsv.exe
C:\WINNT\System32\msdtc.exe
C:\WINNT\System32\svchost.exe
C:\WINNT\System32\svchost.exe
C:\WINNT\System32\tcpsvcs.exe
C:\WINNT\System32\svchost.exe
C:\WINNT\system32\rundll32.exe
C:\WINNT\System32\llssrv.exe
C:\WINNT\System32\nvsvc32.exe
C:\WINNT\system32\regsvc.exe
C:\WINNT\System32\svchost.exe
C:\WINNT\System32\rsvp.exe
C:\WINNT\system32\MSTask.exe
C:\WINNT\System32\snmp.exe
C:\WINNT\System32\WBEM\WinMgmt.exe
C:\WINNT\system32\mspmspsv.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\system32\Dfssvc.exe
C:\WINNT\System32\dns.exe
C:\WINNT\System32\inetsrv\inetinfo.exe
C:\WINNT\Explorer.EXE
C:\WINNT\System32\svchost.exe
C:\WINNT\system32\rundll32.exe
C:\WINNT\SOUNDMAN.EXE
C:\Program Files\rising\Rav\RavTask.exe
C:\WINNT\LSASS.exe
C:\PROGRA~1\Yahoo!\ASSIST~1\YLive.exe
C:\WINNT\system32\Rundll32.exe
C:\WINNT\system32\rundll32.exe
C:\Program Files\baigoo\bgoomain.exe
C:\WINNT\system32\internat.exe
I:\Adobe\Acrobat 7.0\Reader\reader_sl.exe
C:\Program Files\rising\Rav\Smartup.exe
C:\Documents and Settings\Administrator\桌面\HijackThis.exe
O2 - BHO: wmpdrm - {0E674588-66B7-4E19-9D0E-2053B800F69F} -
C:\WINNT\system32\wmpdrm.dll
O2 - BHO: Shockwave Flash
Object -
{14A21378-5BB1-4BC4-95D5-5D3F51527F6F} - C:\WINNT\system32\smflash.ocx
O2 - BHO: CdnForIE Class - {5C3853CF-C7E0-4946-B3FA-1ABDB6F48108} -
C:\PROGRA~1\CNNIC\Cdn\cdnforie.dll
O2 - BHO: Vision - {6671A431-5C3D-463d-A7CF-5587F9B7E191} -
C:\PROGRA~1\MMSASS~1\mmsass~1.dll
O2 - BHO: bg - {7BDAF75A-0D6F-4F50-AFE9-333D08DF4005} - (no file)
O3 - Toolbar: 电台(&R) - {8E718888-423F-11D2-876E-00A0C9082467} -
C:\WINNT\system32\msdxm.ocx
O3 - Toolbar: 雅虎助手 - {406F94F0-504F-4A40-8DFD-58B0666ABEBD} -
C:\PROGRA~1\Yahoo!\ASSIST~1\Assist\yasbar.dll
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE
C:\WINNT\System32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [RavTask] "C:\Program Files\rising\Rav\RavTask.exe"
-system
O4 - HKLM\..\Run: [CnsMHlp.exe] C:\WINNT\Downloaded Program
files\CnsMHlp.exe
O4 - HKLM\..\Run: [YLive.exe] C:\PROGRA~1\Yahoo!\ASSIST~1\YLive.exe
O4 - HKLM\..\Run: [CnsMin] Rundll32.exe
C:\WINNT\DOWNLO~1\CnsMin.dll,Rundll32
O4 - HKLM\..\Run: [helper.dll] C:\WINNT\system32\rundll32.exe
C:\PROGRA~1\3721\helper.dll,Rundll32
O4 - HKLM\..\Run: [yassistse]
"C:\PROGRA~1\Yahoo!\Assistant\yassistse.exe"
O4 - HKLM\..\Run: [spoolsv] C:\WINNT\system32\spoolsv\spoolsv.exe
-printer
O4 - HKLM\..\Run: [bgoomain.exe] C:\Program Files\baigoo\bgoomain.exe
O4 - HKLM\..\Run: [ToP] C:\WINNT\LSASS.exe
O4 - HKCU\..\Run: [Internat.exe] internat.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft
Office\Office\OSA9.EXE
O4 - Global Startup: Adobe Reader Speed Launch.lnk = I:\Adobe\Acrobat
7.0\Reader\reader_sl.exe
O8 - Extra context menu item: >>彩信发送<< -
res://C:\PROGRA~1\MMSASS~1\mmsass~1.dll/mms.htm
O8 - Extra context menu item: 添加到雅虎订阅(&Y) -
res://C:\PROGRA~1\Yahoo!\ASSIST~1\assist\yrss.dll/YRSSMENUEXT
O8 - Extra context menu item: 雅虎搜索 -
res://C:\PROGRA~1\Yahoo!\ASSIST~1\Assist\yasbar.dll/203
O9 - Extra button: Yahoo 3.5G电邮 -
{507F9113-CD77-4866-BA92-0E86DA3D0B97} -
http://cn.zs.yahoo.com/cnsbutton.htm?source=cns&btn=yahoomail (file
missing)
O9 - Extra button: 寻宝乐趣多 - {59BC54A2-56B3-44a0-93E5-432D58746E26}
- http://cn.zs.yahoo.com/cnsbutton.htm?source=cns&btn=taobao (file
missing)
O9 - Extra button: 中文上网 - {5C3853CF-C7E0-4946-B3FA-1ABDB6F48108} -
C:\PROGRA~1\CNNIC\Cdn\cdnforie.dll
O9 - Extra 'Tools' menuitem: 中文上网 -
{5C3853CF-C7E0-4946-B3FA-1ABDB6F48108} -
C:\PROGRA~1\CNNIC\Cdn\cdnforie.dll
O9 - Extra button: 雅虎助手 - {5D73EE86-05F1-49ed-B850-E423120EC338} -
http://cn.zs.yahoo.com/cnsbutton.htm?source=cns&btn=yassist (file
missing)
O9 - Extra button: (no name) - {6671A433-5C3D-463d-A7CF-5587F9B7E191} -
C:\PROGRA~1\MMSASS~1\mmsass~1.dll
O9 - Extra 'Tools' menuitem: 彩E精灵设置 -
{6671A433-5C3D-463d-A7CF-5587F9B7E191} -
C:\PROGRA~1\MMSASS~1\mmsass~1.dll
O9 - Extra button: 酷热影音 - {7D73FF86-05F1-39ed-C850-A423120EC338} -
www.kuree.com/index.htm?id=00011001 (file missing)
O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} -
C:\WINNT\web\related.htm
O9 - Extra 'Tools' menuitem: Show &Related Links -
{c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINNT\web\related.htm
O9 - Extra button: 情景聊天 - {E5D12C4E-7B4F-11D3-B5C9-0050045C3C96} -
http://cn.zs.yahoo.com/cnsbutton.htm?source=cns&btn=yahoomsg (file
missing)
O9 - Extra button: (no name) - {ECF2E268-F28C-48d2-9AB7-8F69C11CCB71} -
http://cn.zs.yahoo.com/cnsbutton.htm?source=cns&btn=repair (file
missing)
O9 - Extra 'Tools' menuitem: 修复浏览器 -
{ECF2E268-F28C-48d2-9AB7-8F69C11CCB71} -
http://cn.zs.yahoo.com/cnsbutton.htm?source=cns&btn=repair (file
missing)
O9 - Extra button: (no name) - {FD00D911-7529-4084-9946-A29F1BDF4FE5} -
http://cn.zs.yahoo.com/cnsbutton.htm?source=cns&btn=clean (file
missing)
O9 - Extra 'Tools' menuitem: 清理上网记录 -
{FD00D911-7529-4084-9946-A29F1BDF4FE5} -
http://cn.zs.yahoo.com/cnsbutton.htm?source=cns&btn=clean (file
missing)
O10 - Unknown file in Winsock LSP: c:\winnt\system32\cdnns.dll
O11 - Options group: [!CNS] 网络实名
O11 - Options group: [CDNCLIENT] 中文上网
O17 -
HKLM\System\CCS\Services\Tcpip\..\{29619FE9-07A8-4088-BE43-CBEF4DE1AE0D
}: NameServer = 210.52.149.2,210.52.207.2,61.137.94.195
O17 -
HKLM\System\CS1\Services\Tcpip\..\{29619FE9-07A8-4088-BE43-CBEF4DE1AE0D
}: NameServer = 210.52.149.2,210.52.207.2,61.137.94.195
O17 -
HKLM\System\CS2\Services\Tcpip\..\{29619FE9-07A8-4088-BE43-CBEF4DE1AE0D
}: NameServer = 210.52.149.2,210.52.207.2,61.137.94.195
O21 - SSODL: DelayRun - {5A6F2F95-3191-433B-8533-EB0B596A7BAC} -
C:\WINNT\system32\e98d6ed0.dll
O23 - Service: Logical Disk Manager Administrative Service (dmadmin) -
VERITAS Software Corp. - C:\WINNT\System32\dmadmin.exe
O23 - Service: Macromedia Licensing Service - Unknown owner -
C:\Program Files\Common Files\Macromedia Shared\Service\Macromedia
Licensing.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA
Corporation - C:\WINNT\System32\nvsvc32.exe
O23 - Service: Rising Process Communication Center (RsCCenter) -
Beijing Rising Technology Co., Ltd. - C:\PROGRAM
FILES\RISING\RAV\CCENTER.EXE
O23 - Service: RsRavMon Service (RsRavMon) - Beijing Rising Technology
Co., Ltd. - C:\Program Files\rising\Rav\Ravmond.exe
