Logfile of HijackThis v1.99.1
Scan saved at 13:05:39, on 2007-3-2
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\drivers\CDAC11BA.EXE
C:\Program Files\ewido anti-malware\ewidoctrl.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\SOUNDMAN.EXE
C:\Program Files\IPMsg\ipmsg.exe
C:\WINDOWS\SYSTEM32\MRCARD.EXE
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\Super Rabbit\MagicSet\SRIECLI.EXE
C:\WINDOWS\system32\rundll32.exe
C:\WINDOWS\system32\RunDll32.exe
C:\WINDOWS\system32\rundll32.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\ipdcl.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\wscntfy.exe
C:\Program Files\AutoCAD 2004\acad.exe
C:\DOCUME~1\zqr\LOCALS~1\Temp\~e5d141.tmp
C:\Program Files\Common Files\Autodesk Shared\WSCommCntr1.exe
C:\Program Files\Tencent\QQ\qq.exe
C:\Program Files\Tencent\QQ2\TIMPlatform.exe
C:\WINDOWS\system32\conime.exe
C:\Program Files\Tencent\QQ\QQ.exe
C:\Program Files\Microsoft Office\OFFICE11\EXCEL.EXE
C:\Program Files\Tencent\QQ\QQexternal.exe
C:\Program Files\Morrowsoft\MRICU\MRICU.exe
C:\Program Files\Maxthon\Max.exe
C:\WINDOWS\system32\zieninl.exe
C:\WINDOWS\system32\taskmgr.exe
C:\Documents and Settings\zqr\桌面\yhgidki.exe
C:\Documents and Settings\zqr\桌面\软件工具\ha_hijackthis_1991\HijackThis.exe
R3 - URLSearchHook: (no name) - {BAB1AC41-6FF7-4F2E-A04E-5C592CCFEA7D} - (no file)
O2 - BHO: HelpIE Class - {5EF1DFF3-AF25-4000-A6ED-41668F83B82B} - C:\WINDOWS\system\C0MMDLG.DLL
O2 - BHO: 超级兔子上网精灵 - {7369D35A-5B70-4A5B-B789-B25FE09B4AF3} - C:\Program Files\Super Rabbit\MagicSet\haokanbar.dll
O2 - BHO: Advance Helper - {8E25AC4A-B129-451B-BEE2-3B510BB751DA} - C:\WINDOWS\system32\NTDLL32.dll
O2 - BHO: IE Browser Helper - {D0903A3B-F0EA-434a-9742-98C5335C7946} - C:\WINDOWS\system32\IEHelper.dll
O3 - Toolbar: 超级兔子上网精灵 - {43869BB3-22FD-4F15-9B46-238106BA2F4E} - C:\Program Files\Super Rabbit\MagicSet\haokanbar.dll
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [KAVPersonal50] "C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus Personal Pro\kav.exe" /minimize
O4 - HKLM\..\Run: [IMSCMig] C:\PROGRA~1\COMMON~1\MICROS~1\IME\IMSC40A\IMSCMIG.EXE /Preload
O4 - HKLM\..\Run: [MrCard] C:\UPWIN\MRCARD.EXE
O4 - HKLM\..\Run: [ipmsg] C:\Program Files\IPMsg\ipmsg.exe
O4 - HKLM\..\Run: [rhejhki] C:\WINDOWS\system32\rhejhki.exe
O4 - HKLM\..\Run: [wk] C:\WINDOWS\system32\7a5f7bb.exe
O4 - HKLM\..\Run: [IEBarUp] RunDll32 "C:\WINDOWS\system32\IeBar1.dll",Run
O4 - HKLM\..\Run: [tfdjdeh] C:\WINDOWS\system32\tfdjdeh.exe
O4 - HKLM\..\Run: [Internet] "C:\WINDOWS\system32\internet.exe"
O4 - HKLM\..\Run: [Desktop] "C:\WINDOWS\system32\internet.exe"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [MrCard] C:\UPWIN\MRCARD.EXE
O4 - HKCU\..\Run: [MRICU2] C:\Program Files\CREC\MRICU\MRICU.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [Super Rabbit IEPro] C:\Program Files\Super Rabbit\MagicSet\SRIECLI.EXE /LOAD
O4 - HKCU\..\Run: [1MJPM1G9.l] C:\WINDOWS\system32\rundll32.exe C:\WINDOWS\system\MSVIDE0.dll,Run
O4 - Startup: QQ游戏启动加速程序.lnk = C:\Program Files\Tencent\QQGame\Accel.exe
O4 - Startup: 腾讯QQ.lnk = C:\Program Files\Tencent\QQ\QQ.exe
O4 - Startup: 腾讯QQ珊瑚虫版.lnk = C:\Program Files\Tencent\QQ2\CoralQQ.exe
O4 - Global Startup: WanSo.lnk = ?
O4 - Global Startup: WNSO.lnk = C:\Program Files\Common Files\RGGZS\WNSO.exe
O4 - Global Startup: yhgidk.lnk = ?
O8 - Extra context menu item: &使用迅雷下载 - C:\Program Files\Thunder Network\Thunder\Program\GetUrl.htm
O8 - Extra context menu item: &使用迅雷下载全部链接 - C:\Program Files\Thunder Network\Thunder\Program\GetAllUrl.htm
O8 - Extra context menu item: 上传到QQ网络硬盘 - C:\Program Files\Tencent\QQ\AddToNetDisk.htm
O8 - Extra context menu item: 导出到 Microsoft Office Excel(&X) - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: 添加到QQ自定义面板 - C:\Program Files\Tencent\QQ\AddPanel.htm
O8 - Extra context menu item: 添加到QQ表情 - C:\Program Files\Tencent\QQ\AddEmotion.htm
O8 - Extra context menu item: 用QQ彩信发送该图片 - C:\Program Files\Tencent\QQ\SendMMS.htm
O9 - Extra button: 启动迅雷5 - {09BA8F6D-CB54-424B-839C-C2A6C8E6B436} - C:\Program Files\Thunder Network\Thunder\Thunder.exe
O9 - Extra 'Tools' menuitem: 启动迅雷5 - {09BA8F6D-CB54-424B-839C-C2A6C8E6B436} - C:\Program Files\Thunder Network\Thunder\Thunder.exe
O9 - Extra button: 雅虎WIDGET - {6354ABE6-05F1-49ed-B850-E423120EC338} - http://cn.widget.yahoo.com/index.htm?source=Cns (file missing)
O9 - Extra button: QQ - {c95fe080-8f5d-11d2-a20b-00aa003c157b} - C:\Program Files\Tencent\QQ\QQ.EXE
O9 - Extra 'Tools' menuitem: 腾讯QQ - {c95fe080-8f5d-11d2-a20b-00aa003c157b} - C:\Program Files\Tencent\QQ\QQ.EXE
O9 - Extra button: (no name) - {DEDEB80D-FA35-45d9-9460-4983E5A8AFE6} - C:\Program Files\Tencent\QQ2\QQIEHelper.dll
O9 - Extra 'Tools' menuitem: QQ炫彩工具条设置 - {DEDEB80D-FA35-45d9-9460-4983E5A8AFE6} - C:\Program Files\Tencent\QQ2\QQIEHelper.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O14 - IERESET.INF: START_PAGE_URL=http://www.microsoft.com/
O17 - HKLM\System\CCS\Services\Tcpip\..\{3B4BB3DC-4EB6-4BC5-9982-E5AFE387AC24}: NameServer = 172.18.2.2
O17 - HKLM\System\CS7\Services\Tcpip\..\{3B4BB3DC-4EB6-4BC5-9982-E5AFE387AC24}: NameServer = 172.18.2.2
O17 - HKLM\System\CS8\Services\Tcpip\..\{3B4BB3DC-4EB6-4BC5-9982-E5AFE387AC24}: NameServer = 172.18.2.2
O17 - HKLM\System\CS9\Services\Tcpip\..\{3B4BB3DC-4EB6-4BC5-9982-E5AFE387AC24}: NameServer = 172.18.2.2
O20 - AppInit_DLLs: C:\WINDOWS\system32\NTDLL32.dll
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
O23 - Service: C-DillaCdaC11BA - Macrovision - C:\WINDOWS\system32\drivers\CDAC11BA.EXE
O23 - Service: ewido security suite control - ewido networks - C:\Program Files\ewido anti-malware\ewidoctrl.exe
O23 - Service: kavsvc - Kaspersky Lab - C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus Personal Pro\kavsvc.exe
O23 - Service: W0RKSTATI0N (LANMANW0RKSTATI0N) - Unknown owner - C:\WINDOWS\system\WINSP00L.EXE (file missing)
O23 - Service: MICR0SOFT SVCH0ST (MS_SVCH0ST) - Unknown owner - C:\WINDOWS\system\SVCH0ST.EXE (file missing)
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: Voolume Shadow Copyre2 (ServiceCopyre9) - Unknown owner - c:\windows\system\Microsoft\kav.exe (file missing)
O23 - Service: Windows Inventory Management Service (Servicewrapper) - Unknown owner - C:\WINDOWS\system32\ipdcl.exe
O23 - Service: StarWind iSCSI Service (StarWindService) - Rocket Division Software - C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe
O23 - Service: winmum - Unknown owner - C:\DOCUME~1\zqr\LOCALS~1\Temp\mum1\mum1.exe (file missing)