Logfile of HijackThis v1.99.1
Scan saved at 9:08:25, on 06-9-30
Platform: Windows 98 SE (Win9x 4.10.2222A)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)
Running processes:
E:\WINDOWS\SYSTEM\KERNEL32.DLL
E:\WINDOWS\SYSTEM\MSGSRV32.EXE
E:\WINDOWS\SYSTEM\MPREXE.EXE
E:\PROGRAM FILES\RISING\RAV\CCENTER.EXE
E:\PROGRAM FILES\RISING\RAV\RAVMOND.EXE
E:\PROGRAM FILES\RISING\RAV\RAVMON.EXE
E:\WINDOWS\RUNDLL32.EXE
E:\WINDOWS\SYSTEM\mmtask.tsk
E:\WINDOWS\EXPLORER.EXE
E:\WINDOWS\SYSTEM\RPCSS.EXE
E:\WINDOWS\RUNDLL32.EXE
E:\WINDOWS\SYSTEM\INTERNAT.EXE
E:\WINDOWS\TASKMON.EXE
E:\WINDOWS\SYSTEM\SYSTRAY.EXE
E:\PROGRAM FILES\RISING\RAV\RAVTASK.EXE
E:\PROGRAM FILES\FJCA\FJCAUSERTOOLS\AUTOREGC.EXE
E:\PROGRAM FILES\FJCA\FJCAUSERTOOLS\CERTREG.EXE
E:\PROGRAM FILES\YAHOO!\ASSISTANT\YASSISTSE.EXE
E:\WINDOWS\SYSTEM\WMIEXE.EXE
E:\PROGRAM FILES\TENCENT\QQ\QQ.EXE
E:\PROGRAM FILES\TENCENT\QQ\TIMPLATFORM.EXE
E:\WINDOWS\SYSTEM\DDHELP.EXE
E:\PROGRAM FILES\INTERNET EXPLORER\IEXPLORE.EXE
E:\WINDOWS\SYSTEM\PSTORES.EXE
D:\小邱的文件夹\248783200522382732\HIJACKTHIS.EXE
O2 - BHO: IE - {D157330A-9EF3-49F8-9A67-4141AC41ADD4} - E:\WINDOWS\DOWNLOADED PROGRAM FILES\CNSHOOK.DLL
O2 - BHO: (no name) - {A5366673-E8CA-11D3-9CD9-0090271D075B} - (no file)
O2 - BHO: stdup - {6A512BF7-EC78-4e8d-9841-6C02E8FA9838} - E:\WINDOWS\SYSTEM32\stdup.dll
O3 - Toolbar: 雅虎助手 - {406F94F0-504F-4a40-8DFD-58B0666ABEBD} - E:\PROGRAM FILES\YAHOO!\ASSISTANT\ASSIST\YASBAR.DLL (file missing)
O3 - Toolbar: 电台(&R) - {8E718888-423F-11D2-876E-00A0C9082467} - E:\WINDOWS\SYSTEM\MSDXM.OCX
O4 - HKLM\..\Run: [internat.exe] internat.exe
O4 - HKLM\..\Run: [ScanRegistry] E:\WINDOWS\scanregw.exe /autorun
O4 - HKLM\..\Run: [TaskMonitor] E:\WINDOWS\taskmon.exe
O4 - HKLM\..\Run: [SystemTray] SysTray.Exe
O4 - HKLM\..\Run: [CnsMin] Rundll32.exe E:\WINDOWS\DOWNLO~1\CNSMIN.DLL,Rundll32
O4 - HKLM\..\Run: [assistse] "E:\PROGRAM FILES\3721\ASSISTSE.EXE"
O4 - HKLM\..\Run: [MiniMsgr] ; C:\PROGRAM FILES\YAHOO!\MINIMSGR\YMiniSvr.exe
O4 - HKLM\..\Run: [mdac_runonce] E:\WINDOWS\SYSTEM\runonce.exe
O4 - HKLM\..\Run: [CalSprite] ; E:\Program Files\SnowFox\CalSprite\CalSprite.exe
O4 - HKLM\..\Run: [YLive.exe] ; E:\PROGRA~1\YAHOO!\ASSIST~1\YLive.exe
O4 - HKLM\..\Run: [RavTask] "E:\Program Files\rising\Rav\RavTask.exe" -system
O4 - HKLM\..\Run: [Autoregc] E:\Program Files\FJCA\FJCAUserTools\autoregc.exe
O4 - HKLM\..\Run: [eKeyAgentUser] E:\Program Files\FJCA\FJCAUserTools\CertReg.exe
O4 - HKLM\..\Run: [KillTrojanMaster] E:\PROGRAM FILES\木马专杀大师\木马专杀大师.EXE
O4 - HKLM\..\Run: [bgoomain.exe] E:\PROGRAM FILES\BAIGOO\bgoomain.exe
O4 - HKLM\..\Run: [yassistse] "E:\PROGRAM FILES\YAHOO!\ASSISTANT\YASSISTSE.EXE"
O4 - HKLM\..\RunServices: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
O4 - HKLM\..\RunServices: [RsCcenter] "E:\Program Files\rising\Rav\CCenter.exe"
O4 - HKLM\..\RunServices: [RavMond] "E:\Program Files\rising\Rav\RavMond.exe"
O4 - HKLM\..\RunServices: [RavMon] "E:\Program Files\rising\Rav\RavMon.exe" -system
O4 - HKLM\..\RunServices: [SchedulingAgent] mstask.exe
O4 - HKLM\..\RunServices: [StdService] E:\WINDOWS\rundll32.exe E:\WINDOWS\SYSTEM32\STDSVER.DLL,Service
O4 - HKLM\..\RunServices: [JMediaService] E:\WINDOWS\rundll32.exe E:\PROGRA~1\MMSASS~1\MMSSVER.DLL,Service
O4 - Startup: 腾讯QQ.lnk = E:\Program Files\Tencent\QQ\QQ.exe
O4 - Global Startup: IE-BAR.lnk = E:\WINDOWS\rundll32.exe
O8 - Extra context menu item: 添加到QQ表情 - E:\PROGRAM FILES\TENCENT\QQ\AddEmotion.htm
O8 - Extra context menu item: 上传到QQ网络硬盘 - E:\PROGRAM FILES\TENCENT\QQ\AddToNetDisk.htm
O8 - Extra context menu item: 使用网际快车下载 - E:\PROGRAM FILES\FLASHGET\jc_link.htm
O8 - Extra context menu item: 添加到QQ自定义面板 - E:\PROGRAM FILES\TENCENT\QQ\AddPanel.htm
O8 - Extra context menu item: 用QQ彩信发送该图片 - E:\PROGRAM FILES\TENCENT\QQ\SendMMS.htm
O8 - Extra context menu item: 使用网际快车下载全部链接 - E:\PROGRAM FILES\FLASHGET\jc_all.htm
O8 - Extra context menu item: 用比特精灵下载(&B) - E:\PROGRAM FILES\BITSPIRIT\bsurl.htm
O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - E:\WINDOWS\web\related.htm
O9 - Extra 'Tools' menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - E:\WINDOWS\web\related.htm
O9 - Extra button: QQ - {c95fe080-8f5d-11d2-a20b-00aa003c157b} - E:\PROGRAM FILES\TENCENT\QQ\QQ.EXE
O9 - Extra 'Tools' menuitem: 腾讯QQ - {c95fe080-8f5d-11d2-a20b-00aa003c157b} - E:\PROGRAM FILES\TENCENT\QQ\QQ.EXE
O9 - Extra button: 雅虎助手 - {5D73EE86-05F1-49ed-B850-E423120EC338} - http://cn.zs.yahoo.com/cnsbutton.htm?source=cns&btn=yassist (file missing)
O9 - Extra button: 名品折扣 - {59BC54A2-56B3-44a0-93E5-432D58746E26} - http://adtaobao.allyes.com/main/adfclick?db=adtaobao&bid=138,140,18&cid=816,8,1&sid=5042&show=ignore&url=http://www.taobao.com/vertical/mall/pro.php?allyesPara=816 (file missing)
O9 - Extra button: Yahoo 3.5G电邮 - {507F9113-CD77-4866-BA92-0E86DA3D0B97} - http://cn.zs.yahoo.com/cnsbutton.htm?source=cns&btn=yahoomail (file missing)
O9 - Extra button: 情景聊天 - {E5D12C4E-7B4F-11D3-B5C9-0050045C3C96} - http://cn.zs.yahoo.com/cnsbutton.htm?source=cns&btn=yahoomsg (file missing)
O9 - Extra button: 雅虎WIDGET - {6354ABE6-05F1-49ed-B850-E423120EC338} - http://cn.widget.yahoo.com/index.htm?source=Cns (file missing)
O9 - Extra button: (no name) - {FD00D911-7529-4084-9946-A29F1BDF4FE5} - http://cn.zs.yahoo.com/cnsbutton.htm?source=cns&btn=clean (file missing)
O9 - Extra 'Tools' menuitem: 清理上网记录 - {FD00D911-7529-4084-9946-A29F1BDF4FE5} - http://cn.zs.yahoo.com/cnsbutton.htm?source=cns&btn=clean (file missing)
O9 - Extra button: (no name) - {ECF2E268-F28C-48d2-9AB7-8F69C11CCB71} - http://cn.zs.yahoo.com/cnsbutton.htm?source=cns&btn=repair (file missing)
O9 - Extra 'Tools' menuitem: 修复浏览器 - {ECF2E268-F28C-48d2-9AB7-8F69C11CCB71} - http://cn.zs.yahoo.com/cnsbutton.htm?source=cns&btn=repair (file missing)
O11 - Options group: [!CNS] 中文上网
O16 - DPF: {3D8F74EE-8692-4F8F-B8D2-7522E732519E} (WebActivater Control) - http://game.qq.com/QQGame2.cab
O16 - DPF: {0400AC1C-EEF0-4638-A501-31D5A0DC2002} (VTPlug3 Class) - http://s4.liaoliao.com:1995/VTrans.cab
O16 - DPF: {6924091F-CD97-41E1-B1D4-D9079409D413} (IMCv1 Control) - http://s4.liaoliao.com:1995/talk.cab
O16 - DPF: {88734439-46D0-42C0-A13F-7E881EE550CF} (Filetran Control) - http://www.bluesky.cn/download/filetran.cab
O16 - DPF: {87CCFDB0-C4BE-4BC2-A78C-9EAA7CF96667} - http://ps.itv.mop.com/dn/files/vodupdate_1.0.0.8_20051009.cab
O16 - DPF: {F138084D-84D7-48CD-BEA8-04772457516E} (VqqSpeedDlProxy Class) - http://218.85.138.27/vqqsdl1009.cab
O16 - DPF: {5932517A-3326-4439-A708-1C98EDB5C549} (Downloader Class) -
file://E:\WINDOWS\All Users\Application Data\Share Helper\Cast\GGS\d11016918c\js\iMopDl.cab
O16 - DPF: {E4E2F180-CB8B-4DE9-ACBB-DA745D3BA153} (Rising Web Scan
Object) - http://download.rising.com.cn/register/pcver/autoupgradepad/pcver2006new/OL2006.cab
O18 - Protocol: http - {79EAC9E2-BAF9-11CE-8C82-00AA004BA90B} - E:\WINDOWS\SYSTEM\urlmon.dll
O18 - Protocol: ftp - {79EAC9E3-BAF9-11CE-8C82-00AA004BA90B} - E:\WINDOWS\SYSTEM\urlmon.dll
O18 - Protocol: gopher - {79EAC9E4-BAF9-11CE-8C82-00AA004BA90B} - E:\WINDOWS\SYSTEM\urlmon.dll
O18 - Protocol: https - {79EAC9E5-BAF9-11CE-8C82-00AA004BA90B} - E:\WINDOWS\SYSTEM\urlmon.dll
O18 - Protocol: mk - {79EAC9E6-BAF9-11CE-8C82-00AA004BA90B} - E:\WINDOWS\SYSTEM\urlmon.dll
O18 - Protocol: file - {79EAC9E7-BAF9-11CE-8C82-00AA004BA90B} - E:\WINDOWS\SYSTEM\urlmon.dll
O18 - Protocol: local - {79EAC9E7-BAF9-11CE-8C82-00AA004BA90B} - E:\WINDOWS\SYSTEM\urlmon.dll
O18 - Protocol: cdl - {3DD53D40-7B8B-11D0-B013-00AA0059CE02} - E:\WINDOWS\SYSTEM\urlmon.dll
O18 - Protocol: javascript - {3050F3B2-98B5-11CF-BB82-00AA00BDCE0B} - E:\WINDOWS\SYSTEM\MSHTML.DLL
O18 - Protocol: vbscript - {3050F3B2-98B5-11CF-BB82-00AA00BDCE0B} - E:\WINDOWS\SYSTEM\MSHTML.DLL
O18 - Protocol: about - {3050F406-98B5-11CF-BB82-00AA00BDCE0B} - E:\WINDOWS\SYSTEM\MSHTML.DLL
O18 - Protocol: res - {3050F3BC-98B5-11CF-BB82-00AA00BDCE0B} - E:\WINDOWS\SYSTEM\MSHTML.DLL
O18 - Protocol: mailto - {3050F3DA-98B5-11CF-BB82-00AA00BDCE0B} - E:\WINDOWS\SYSTEM\MSHTML.DLL
O18 - Protocol: sysimage - {76E67A63-06E9-11D2-A840-006008059382} - E:\WINDOWS\SYSTEM\MSHTML.DLL
O18 - Protocol: its - {9D148291-B9C8-11D0-A4CC-0000F80149F6} - E:\WINDOWS\SYSTEM\ITSS.DLL
O18 - Protocol: ms-its - {9D148291-B9C8-11D0-A4CC-0000F80149F6} - E:\WINDOWS\SYSTEM\ITSS.DLL
O18 - Protocol: mhtml - {05300401-BCBC-11D0-85E3-00C04FD85AB4} - E:\WINDOWS\SYSTEM\INETCOMM.DLL
O18 - Protocol: msdaipp - (no CLSID) - (no file)
O18 - Protocol: ipp - (no CLSID) - (no file)
O18 - Protocol: vnd.ms.radio - {3DA2AA3B-3D96-11D2-9BD2-204C4F4F5020} - E:\WINDOWS\SYSTEM\MSDXM.OCX
O21 - SSODL: webwork - {4C611512-2C1D-44b2-A044-872AD2AD5A61} - E:\WINDOWS\WEBWORK\WEBWORK.DLL
