Logfile of HijackThis v1.99.1
Scan saved at 22:49:47, on 2007-2-22
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Rising\Rav\CCenter.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Rising\Rav\Ravmond.exe
c:\program files\rising\rfw\rfwsrv.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\drivers\CDAC11BA.EXE
C:\WINDOWS\system32\6C0EF24.exe
C:\Program Files\NavNT\defwatch.exe
c:\program files\rising\rfw\RfwMain.exe
C:\Program Files\Common Files\EPSON\EBAPI\SAgent2.exe
C:\PROGRA~1\ROCKWE~1\RSCOMMON\RSOBSERV.EXE
C:\Program Files\NavNT\rtvscan.exe
C:\Program Files\Common Files\OPC Foundation\OPCENUM.EXE
C:\WINDOWS\system32\rundll32.exe
F:\PROGRA~1\ROCKWE~1\RSLINX\RSLINX.EXE
C:\program files\common files\Siemens\S7IEPG\s7oiehsx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\VM_STI.EXE
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\NavNT\vptray.exe
C:\Program Files\Rising\AntiSpyware\runiep.exe
C:\Program Files\Rising\Rav\RavTask.exe
C:\Program Files\Rising\Rav\Ravmon.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\MSN Messenger\msnmsgr.exe
C:\program files\common files\Siemens\sws\almsrv\almsrvx.exe
C:\Program Files\Rising\Rav\RsAgent.exe
C:\WINDOWS\msagent\AgentSvr.exe
C:\Program Files\Internet Explorer\iexplore.exe
F:\HijackThis.exe
R3 - Default URLSearchHook is missing
F2 - REG:system.ini: UserInit=userinit.exe,
O2 - BHO: (no name) - RsAutorunsDisabled - (no file)
O2 - BHO: (no name) - {0005A87D-D626-4B3A-84F9-1D9571695F55}? - (no file)
O2 - BHO: (no name) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}? - (no file)
O2 - BHO: wecv - {1D2480D4-F025-42E4-83DD-E0D71121E47E}? - (no file)
O2 - BHO: (no name) - {2F364306-AA45-47B5-9F9D-39A8B94E7EF7}? - (no file)
O2 - BHO: QQIEHelper - {54EBD53A-9BC1-480B-966A-843A333CA162}? - (no file)
O2 - BHO: (no name) - {5C3853CF-C7E0-4946-B3FA-1ABDB6F48108}? - (no file)
O2 - BHO: BandIE Class - {77FEF28E-EB96-44FF-B511-3185DEA48697} - C:\PROGRA~1\baidu\bar\BaiduBar.dll
O2 - BHO: (no name) - {77FEF28E-EB96-44FF-B511-3185DEA48697}? - (no file)
O2 - BHO: (no name) - {9030D464-4C02-4ABF-8ECC-5164760863C6}? - (no file)
O2 - BHO: (no name) - {A9930D97-9CF0-42A0-A10D-4F28836579D5}? - (no file)
O2 - BHO: (no name) - {AA58ED58-01DD-4d91-8333-CF10577473F7}? - (no file)
O2 - BHO: XTTBPos00 - {BBBE1C1A-89F7-4AF6-ABD1-2B2EF2D7A73B}? - (no file)
O2 - BHO: Windows Live Toolbar Helper - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
O2 - BHO: (no name) - {DE7C3CF0-4B15-11D1-ABED-709549C10000}? - (no file)
O2 - BHO: (no name) - {f1668d3a-b8c5-4ac4-8b0d-4e03f37a8dbf} - C:\WINDOWS\system32\4ac4cfsb.dll
O2 - BHO: (no name) - {f1668d3a-b8c5-4ac4-8b0d-4e03f37a8dbf}? - (no file)
O3 - Toolbar: (no name) - {B7D3E479-CC68-42B5-A338-C6B1F168274C}? - (no file)
O3 - Toolbar: (no name) - {03465FF5-00AE-411a-9C34-960ED566EC03}? - (no file)
O3 - Toolbar: (no name) - {DFCB34B6-902D-426E-AE2B-1B294AE19F4F}? - (no file)
O3 - Toolbar: (no name) - {E0E899AB-F487-11D5-8D29-0050BA6940E3}? - (no file)
O3 - Toolbar: (no name) - {2318C2B1-4965-11d4-9B18-009027A5CD4F}? - (no file)
O3 - Toolbar: 卡卡上网安全助手 - {DB9ECD4F-FB8F-4311-B3CE-90B976C2707C} - C:\WINDOWS\system32\kakatool.dll
O3 - Toolbar: Windows Live Toolbar - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
O3 - Toolbar: 百度超级搜霸 - {B580CF65-E151-49C3-B73F-70B13FCA8E86} - C:\PROGRA~1\baidu\bar\BaiduBar.dll
O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC
O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName
O4 - HKLM\..\Run: [BigDogPath] C:\WINDOWS\VM_STI.EXE VIMICRO USB PC Camera
O4 - HKLM\..\Run: [YDTMain.exe] C:\PROGRA~1\YDT\YDTMain.exe
O4 - HKLM\..\Run: [Thunder] G:\Program Files\Thunder Network\Thunder\Thunder.exe /s
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [vptray] C:\Program Files\NavNT\vptray.exe
O4 - HKLM\..\Run: [runeip] C:\Program Files\Rising\AntiSpyware\runiep.exe
O4 - HKLM\..\Run: [RavTask] "C:\Program Files\Rising\Rav\RavTask.exe" -system
O4 - HKLM\..\Run: [RfwMain] "C:\Program Files\Rising\Rfw\rfwmain.exe" -Startup
O4 - HKLM\..\Run: [C:\WINDOWS\system32\bind_50101.exe] C:\WINDOWS\system32\bind_50101.exe
O4 - HKLM\..\Run: [C:\WINDOWS\system32\cf15.exe] C:\WINDOWS\system32\cf15.exe
O4 - HKLM\..\Run: [C:\WINDOWS\system32\bind_50075.exe] C:\WINDOWS\system32\bind_50075.exe
O4 - HKLM\..\Run: [C:\DOCUME~1\lc\LOCALS~1\Temp\woohu.exe] C:\DOCUME~1\lc\LOCALS~1\Temp\woohu.exe
O4 - HKLM\..\Run: [C:\DOCUME~1\lc\LOCALS~1\Temp\seveneleven.exe] C:\DOCUME~1\lc\LOCALS~1\Temp\seveneleven.exe
O4 - HKLM\..\Run: [C:\DOCUME~1\lc\LOCALS~1\Temp\dodolook029.exe] C:\DOCUME~1\lc\LOCALS~1\Temp\dodolook029.exe
O4 - HKLM\..\Run: [C:\DOCUME~1\lc\LOCALS~1\Temp\setup133.exe] C:\DOCUME~1\lc\LOCALS~1\Temp\setup133.exe
O4 - HKLM\..\RunOnce: [KKDelay] C:\Program Files\Rising\AntiSpyware\RunOnce.exe
O4 - HKLM\..\RunOnce: [BaiduInstall] C:\WINDOWS\system32\rundll32.exe C:\PROGRA~1\baidu\bar\BDBAR_~1\BaiduBar.dll,Install
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [winsamps] C:\WINDOWS\winamps.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
