Logfile of HijackThis v1.99.1
Scan saved at 18:40:16, on 2007-2-27
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\System32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
D:\瑞星\Rising\Rav\CCenter.exe
C:\WINDOWS\System32\svchost.exe
D:\瑞星\Rising\Rav\Ravmond.exe
C:\WINDOWS\Explorer.EXE
C:\program files\internet explorer\iexplore.exe
C:\WINDOWS\System32\ctfmon.exe
C:\program files\internet explorer\iexplore.exe
C:\WINDOWS\system32\spoolsv.exe
D:\瑞星\Rising\Rav\RavStub.exe
C:\WINDOWS\System32\svchosts.exe
C:\WINDOWS\System32\rundll32.exe
C:\WINDOWS\System32\ffudf.exe
C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
D:\瑞星\Rising\Rav\RavTask.exe
D:\瑞星\Rising\Rav\Ravmon.exe
C:\Program Files\Rising\AntiSpyware\runiep.exe
C:\WINDOWS\System32\conime.exe
C:\WINDOWS\rund1132.exe
D:\大智慧\dzh\internet\hypwise.exe
C:\WINDOWS\system32\NOTEPAD.EXE
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Internet Explorer\iexplore.exe
D:\ha_hijackthis_1991\HijackThis.exe
F2 - REG:system.ini: UserInit=C:\WINDOWS\System32\Userinit.exe,rundll32.exe C:\WINDOWS\System32\winsys16_070221.dll start
O3 - Toolbar: 电台(&R) - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O3 - Toolbar: 卡卡上网安全助手 - {DB9ECD4F-FB8F-4311-B3CE-90B976C2707C} - C:\WINDOWS\System32\kakatool.dll
O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\System32\IME\TINTLGNT\TINTSETP.EXE /SYNC
O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\System32\IME\TINTLGNT\TINTSETP.EXE /IMEName
O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe
O4 - HKLM\..\Run: [RavTask] "D:\瑞星\Rising\Rav\RavTask.exe" -system
O4 - HKLM\..\Run: [wWinlogin] C:\DOCUME~1\mld\LOCALS~1\Temp\wkernel33.exe
O4 - HKLM\..\Run: [runeip] C:\Program Files\Rising\AntiSpyware\runiep.exe
O4 - HKLM\..\RunOnce: [RavStub] "D:\瑞星\Rising\Rav\ravstub.exe" /RUNONCE
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\System32\ctfmon.exe
O4 - HKCU\..\Run: [ravshell] C:\WINDOWS\rund1132.exe
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O8 - Extra context menu item: 使用影音传送带下载 - C:\Program Files\Xi\NetTransport 2\NTAddLink.html
O8 - Extra context menu item: 使用影音传送带下载全部链接 - C:\Program Files\Xi\NetTransport 2\NTAddList.html
O8 - Extra context menu item: 用比特精灵下载(&B) - D:\bt\BitSpirit\bsurl.htm
O9 - Extra button: 红心游戏 - {00000000-DAEB-480d-867B-D746D955765B} - D:\新建文件夹\redheart\GameHall.exe
O9 - Extra 'Tools' menuitem: 红心游戏世界 - {00000000-DAEB-480d-867B-D746D955765B} - D:\新建文件夹\redheart\GameHall.exe
O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
O9 - Extra 'Tools' menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
O9 - Extra button: 访问瑞星网站 - {FF2DE7A6-ECB1-4CBC-9C0E-D92A9E66E444} - http://www.rising.com.cn/?u=RSTB (file missing)
O9 - Extra button: 访问卡卡社区 - {FF2DE7A6-ECB1-4CBC-9C0E-D92A9E66E445} - http://www.ikaka.com/?u=RSTB (file missing)
O9 - Extra button: 财富通 - {C1F0024B-8278-4999-B7E6-2718426D9FE6} - C:\Program Files\财富通\caif.dll (HKCU)
O14 - IERESET.INF: START_PAGE_URL=http://www.zbfda.gov.cn
O16 - DPF: {474C3391-9226-4EB0-A15A-CBB03FED7830} - http://www.591bo.com/bcCab/bc.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1166273266328
O17 - HKLM\System\CCS\Services\Tcpip\..\{E7794AD1-7870-4FA0-A036-E3D73D21B51C}: NameServer = 202.102.154.3 202.102.152.3
O23 - Service: Ati HotKey Poller - Unknown owner - C:\WINDOWS\System32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: Client IP-IPX - Unknown owner - C:\WINDOWS\System32\svchosts.exe" -e te-110-12-0000327 (file missing)
O23 - Service: Intranet Messenger (Mercha2) - Unknown owner - C:\WINDOWS\SYSTEM32\RUNDLLFROMWIN2000.EXE (file missing)
O23 - Service: Rising Process Communication Center (RsCCenter) - Beijing Rising Technology Co., Ltd. - D:\瑞星\Rising\Rav\CCenter.exe
O23 - Service: Rising RealTime Monitor (RsRavMon) - Beijing Rising Technology Co., Ltd. - D:\瑞星\Rising\Rav\Ravmond.exe
O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
