Logfile of HijackThis v1.99.1
Scan saved at 17:14:12, on 2006-9-13
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
D:\Program Files\Rising\Rav\CCenter.exe
C:\WINDOWS\system32\svchost.exe
D:\Program Files\Rising\Rav\Ravmond.exe
D:\Program Files\Rising\Rav\RavStub.exe
C:\WINDOWS\system32\oodag.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\System32\dmadmin.exe
D:\Program Files\Rising\Rav\RavTask.exe
C:\WINDOWS\VM_STI.EXE
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Super Rabbit\MagicSet\SRIECLI.EXE
F:\qq\QQ.exe
F:\qq\TIMPlatform.exe
D:\ha_hijackthis_1991\HijackThis.exe
R3 - URLSearchHook: (no name) - {E175C58C-3C6B-4553-873D-DE34C90AB5CF} - C:\WINDOWS\system32\Ezijf.dll (file missing)
R3 - URLSearchHook: (no name) - {BF2614AC-9CCC-4E15-AFA3-2A82D34275FD} - C:\WINDOWS\system32\Xmqfw.dll (file missing)
R3 - URLSearchHook: (no name) - {5585CC78-A70E-4992-819E-19E2A719564B} - C:\WINDOWS\system32\Aeml.dll (file missing)
R3 - URLSearchHook: (no name) - {AF9546E4-BA1F-4671-A1D3-FE607B4314EA} - C:\WINDOWS\system32\Clhspd.dll (file missing)
R3 - URLSearchHook: (no name) - {33FD82AE-1A14-4736-9CC6-D8D2E8214F50} - C:\WINDOWS\system32\Iwlrhg.dll (file missing)
R3 - URLSearchHook: (no name) - {633BAD94-EAEA-41FA-B1D7-C578EF5C11DD} - C:\WINDOWS\system32\Ufso.dll (file missing)
R3 - URLSearchHook: (no name) - {B69D92DD-29CE-48C3-863D-78385A8A4503} - C:\WINDOWS\system32\Nylx.dll (file missing)
R3 - URLSearchHook: (no name) - {94B96F84-02CE-407E-9A44-372F461D9C1D} - C:\WINDOWS\system32\Jeql.dll (file missing)
R3 - URLSearchHook: (no name) - {4E3FAA77-8FDF-4953-83CA-F3BCC71D3E71} - C:\WINDOWS\system32\Ovtfm.dll (file missing)
R3 - URLSearchHook: (no name) - {E9DBE250-C34F-44AD-8505-32F264D9F774} - C:\WINDOWS\system32\Drcayi.dll (file missing)
R3 - URLSearchHook: (no name) - {D71FD486-0B43-4271-ADED-2DDE85FAAA44} - C:\WINDOWS\system32\Qtfctd.dll (file missing)
R3 - URLSearchHook: (no name) - {9D26BE79-91C0-4CE6-8D9D-CE33B49B6365} - C:\WINDOWS\system32\Cprptg.dll (file missing)
R3 - URLSearchHook: (no name) - {7B4714B4-D89C-4213-90A8-9BC8BE18564E} - C:\WINDOWS\system32\Isonqq.dll (file missing)
R3 - URLSearchHook: (no name) - {7F0CEEF7-981F-4BAA-B5C3-CD1CDED5211C} - C:\WINDOWS\system32\Cjrvtq.dll (file missing)
R3 - URLSearchHook: (no name) - {F60BC207-9243-4519-BC04-FE4AAEA0C8B0} - C:\WINDOWS\system32\Gyuygd.dll (file missing)
R3 - URLSearchHook: (no name) - {A1BCC55A-988D-4D82-862B-0AFD5533CA16} - C:\WINDOWS\system32\Urbv.dll
R3 - URLSearchHook: (no name) - {804867EA-8589-4D54-B7D4-3280FD42A059} - C:\WINDOWS\system32\Xvjp.dll
R3 - URLSearchHook: (no name) - {ACB0CC45-E564-4109-BBE2-A39BABC630AB} - C:\WINDOWS\system32\Qpwkx.dll
R3 - URLSearchHook: (no name) - {7DAFB443-4604-4068-9C2F-99A322293AAB} - C:\WINDOWS\system32\Zwpc.dll
R3 - URLSearchHook: (no name) - {6965EF91-1054-4459-999C-9B651E2BA524} - C:\WINDOWS\system32\Vuhdpu.dll
R3 - URLSearchHook: (no name) - {9B735A88-0224-4294-801B-4DEC21E12F44} - C:\WINDOWS\system32\Mvje.dll
R3 - URLSearchHook: (no name) - {8D7699B2-1B49-4CCA-864A-0052CF96CB03} - C:\WINDOWS\system32\Iracl.dll (file missing)
R3 - URLSearchHook: (no name) - {40258099-7ACB-4254-80D2-96321C27C1F8} - C:\WINDOWS\system32\Medif.dll (file missing)
R3 - URLSearchHook: (no name) - {0BFE5F0B-0ED9-4ED4-983D-89CBC2E935D0} - C:\WINDOWS\system32\Kvaowa.dll (file missing)
R3 - URLSearchHook: (no name) - {FADDA0D2-478D-4B92-8899-0BE66AF88933} - C:\WINDOWS\system32\Iouiyx.dll (file missing)
R3 - URLSearchHook: (no name) - {7B2479A1-1F4D-498D-8D7C-1C363E53F0E0} - C:\WINDOWS\system32\Ouax.dll (file missing)
R3 - URLSearchHook: (no name) - {F964BEC0-0CEE-4BFF-A5F1-8472A77F569A} - C:\WINDOWS\system32\Qowuk.dll (file missing)
R3 - URLSearchHook: (no name) - {BFD5783D-68C1-4A45-B093-19D047A610E6} - C:\WINDOWS\system32\Gnbuy.dll (file missing)
R3 - URLSearchHook: (no name) - {8825571D-09B0-4C76-B279-17E5C8B27207} - C:\WINDOWS\system32\Vcyygn.dll (file missing)
R3 - URLSearchHook: (no name) - {8F624DCC-9371-42CC-B341-AD3AE8B5EF21} - C:\WINDOWS\system32\Yymdpw.dll (file missing)
R3 - URLSearchHook: (no name) - {8801477E-50C0-4F05-9FC1-71E12C978E6C} - C:\WINDOWS\system32\Dxbff.dll (file missing)
R3 - URLSearchHook: (no name) - {3B4044BC-63A0-4442-9DD2-ED4D51C78933} - C:\WINDOWS\system32\Semslb.dll (file missing)
R3 - URLSearchHook: (no name) - {BB5E6B97-F752-4E23-837B-E685461776CC} - C:\WINDOWS\system32\Hkxd.dll (file missing)
R3 - URLSearchHook: (no name) - {7E85F98E-AAF0-4841-AC65-60A6D525B981} - C:\WINDOWS\system32\Wrezi.dll (file missing)
R3 - URLSearchHook: (no name) - {AABEC4F9-045B-40A6-BB27-AFADE4BB60F5} - C:\WINDOWS\system32\Khbbn.dll (file missing)
R3 - URLSearchHook: (no name) - {84C56809-6358-46C3-B857-69A52D835A6A} - C:\WINDOWS\system32\Obccrd.dll (file missing)
R3 - URLSearchHook: (no name) - {7FE8BC1F-3DC8-43A1-91F8-4FFEB21D25B7} - C:\WINDOWS\system32\Ulgw.dll (file missing)
R3 - URLSearchHook: (no name) - {1ECE7655-D4D0-4D7C-8888-175E430A1B61} - C:\WINDOWS\system32\Cstgu.dll (file missing)
R3 - URLSearchHook: (no name) - {C3E58080-7578-4CDE-B8DE-82CB6696046C} - C:\WINDOWS\system32\Bbpt.dll (file missing)
R3 - URLSearchHook: (no name) - {E5C60E1D-6F2E-4FF6-BB85-6592487F98D4} - C:\WINDOWS\system32\Aflyo.dll (file missing)
R3 - URLSearchHook: (no name) - {F6C4D0B0-FDD0-4A1F-9658-653D7FFF79D8} - C:\WINDOWS\system32\Jkxdfk.dll (file missing)
R3 - URLSearchHook: (no name) - {2B12DAC0-7655-47D2-8288-DC67E5D19EEB} - C:\WINDOWS\system32\Ejfndm.dll (file missing)
R3 - URLSearchHook: (no name) - {DB7BF4CD-312B-428A-ACC3-F72BF26037CE} - C:\WINDOWS\system32\Vhuzzn.dll (file missing)
R3 - URLSearchHook: (no name) - {AE07C32D-0EFD-4EAF-93BB-5F4406F100E2} - C:\WINDOWS\system32\Feozv.dll (file missing)
R3 - URLSearchHook: (no name) - {2B60C950-7A4E-4B1D-9BE6-3DEBC109ED56} - C:\WINDOWS\system32\Zogg.dll (file missing)
R3 - URLSearchHook: (no name) - {5F2C3153-63CD-461F-BBB1-BEDE6A807D1F} - C:\WINDOWS\system32\Afkr.dll (file missing)
R3 - URLSearchHook: (no name) - {8FEC1208-4F6D-4DD3-A3CD-4FDF726D5BBD} - C:\WINDOWS\system32\Goqbbm.dll (file missing)
R3 - URLSearchHook: (no name) - {86711B05-435B-4F4D-9A59-EA94FB16CB49} - C:\WINDOWS\system32\Oqwio.dll (file missing)
R3 - URLSearchHook: (no name) - {68A7B2BE-631E-42DE-ADA9-AC6609260104} - C:\WINDOWS\system32\Tgnecj.dll (file missing)
R3 - URLSearchHook: (no name) - {5074ADA2-99C3-4B39-B9E0-10982A87D427} - C:\WINDOWS\system32\Xcsxsn.dll (file missing)
R3 - URLSearchHook: (no name) - {4999F0B8-7207-47CB-88A1-C64951B40FCD} - C:\WINDOWS\system32\Qrnyu.dll (file missing)
R3 - URLSearchHook: (no name) - {AF29688B-9966-4575-A372-029DDA67D4A5} - C:\WINDOWS\system32\Fguug.dll (file missing)
R3 - URLSearchHook: (no name) - {5448483F-CD01-4CB8-8F39-1B264B2289C7} - C:\WINDOWS\system32\Mfjmr.dll (file missing)
R3 - URLSearchHook: (no name) - {4E896B41-7D3B-4400-A42E-C33A61D3A875} - C:\WINDOWS\system32\Ptbarz.dll (file missing)
R3 - URLSearchHook: (no name) - {49B6CC18-3F10-49DE-A2BF-13FCCAAE7FF4} - C:\WINDOWS\system32\Uays.dll (file missing)
R3 - URLSearchHook: (no name) - {B515733D-6F08-41B5-ACF9-96A0AF18978D} - C:\WINDOWS\system32\Arlh.dll (file missing)
R3 - URLSearchHook: (no name) - {C7CFA027-A008-4A13-83A9-A9D0DF0BACC7} - C:\WINDOWS\system32\Rscpc.dll (file missing)
R3 - URLSearchHook: (no name) - {77AB2DD6-EF9B-47CE-960A-ACB84FDE510C} - C:\WINDOWS\system32\Fbznbd.dll (file missing)
R3 - URLSearchHook: (no name) - {DB8B2393-7A6C-4C76-88CE-6B1F6FF6FFE9} - (no file)
O2 - BHO: (no name) - {4BBC1A4D-DD20-4980-A645-2E13F6FC286D} - C:\WINDOWS\system32\3721.1.dll
O2 - BHO: 超级兔子上网精灵 - {7369D35A-5B70-4A5B-B789-B25FE09B4AF3} - C:\PROGRA~1\SUPERR~1\MagicSet\haokanbar.dll
O2 - BHO: Proxy 服务 - {AE1CA795-C4DB-4204-AAE4-9F005524622D} - C:\WINDOWS\system32\QQGame.dll
O2 - BHO: falsha Class - {FB8D3C9B-95EE-4EB2-A1F0-5F97BB8780A8} - C:\WINDOWS\DOWNLO~1\Falsh.dll
O3 - Toolbar: 超级兔子上网精灵 - {43869BB3-22FD-4F15-9B46-238106BA2F4E} - C:\PROGRA~1\SUPERR~1\MagicSet\haokanbar.dll
O4 - HKLM\..\Run: [IMJPMIG8.1] ; "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
O4 - HKLM\..\Run: [PHIME2002ASync] ; C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC
O4 - HKLM\..\Run: [PHIME2002A] ; C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName
O4 - HKLM\..\Run: [RavTask] "D:\Program Files\Rising\Rav\RavTask.exe" -system
O4 - HKLM\..\Run: [BigDogPath] C:\WINDOWS\VM_STI.EXE VIMICRO USB PC Camera
O4 - HKLM\..\RunOnce: [WIAWizardMenu] RUNDLL32.EXE C:\WINDOWS\system32\sti_ci.dll,WiaCreateWizardMenu
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [Super Rabbit IEPro] C:\Program Files\Super Rabbit\MagicSet\SRIECLI.EXE /LOAD
O8 - Extra context menu item: 上传到QQ网络硬盘 - F:\qq\AddToNetDisk.htm
O8 - Extra context menu item: 导出到 Microsoft Office Excel(&X) - res://C:\PROGRA~1\MICROS~1\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: 添加到QQ自定义面板 - F:\qq\AddPanel.htm
O8 - Extra context menu item: 添加到QQ表情 - F:\qq\AddEmotion.htm
O8 - Extra context menu item: 用QQ彩信发送该图片 - F:\qq\SendMMS.htm
O9 - Extra button: kele8 - {84920E5F-3788-49cd-A274-E365578DF174} - http://www.kele8.com/ (file missing)
O9 - Extra 'Tools' menuitem: kele8 - {84920E5F-3788-49cd-A274-E365578DF174} - http://www.kele8.com/ (file missing)
O9 - Extra button: 易趣购物 - {A8168688-F1E4-4824-8CD9-089AF2CF043B} - http://adfarm.mediaplex.com/ad/ck/4080-22910-9640-54?cn=chaoyue;jujumao;hp&mpro=http://www.ebay.com.cn (file missing)
O9 - Extra button: QQ - {c95fe080-8f5d-11d2-a20b-00aa003c157b} - F:\qq\QQ.EXE
O9 - Extra 'Tools' menuitem: 腾讯QQ - {c95fe080-8f5d-11d2-a20b-00aa003c157b} - F:\qq\QQ.EXE
O9 - Extra button: (no name) - {DEDEB80D-FA35-45d9-9460-4983E5A8AFE6} - F:\qq\QQIEHelper.dll (file missing)
O9 - Extra 'Tools' menuitem: QQ炫彩工具条设置 - {DEDEB80D-FA35-45d9-9460-4983E5A8AFE6} - F:\qq\QQIEHelper.dll (file missing)
O16 - DPF: {488A4255-3236-44B3-8F27-FA1AECAA8844} (CEditCtrl
Object) - https://img.alipay.com/download/1007/aliedit.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1132901179500
O16 - DPF: {8D9E0B29-563C-4226-86C1-5FF2AE77E1D2} (AxSubmitControl Class) - https://mybank.icbc.com.cn/icbc/perbank/AxSafeControls.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{2E8484AD-8260-4CDB-9B8A-0FD31F381802}: NameServer = 202.103.225.68 202.103.224.68
O17 - HKLM\System\CCS\Services\Tcpip\..\{FCB8873C-DD98-4B4D-9E31-BE0665480920}: NameServer = 202.103.224.68,202.103.225.68
O23 - Service: O&O Defrag - O&O Software GmbH - C:\WINDOWS\system32\oodag.exe
O23 - Service: Rising Process Communication Center (RsCCenter) - Beijing Rising Technology Co., Ltd. - D:\Program Files\Rising\Rav\CCenter.exe
O23 - Service: RsRavMon Service (RsRavMon) - Beijing Rising Technology Co., Ltd. - D:\Program Files\Rising\Rav\Ravmond.exe
