Logfile of HijackThis v1.99.1
Scan saved at 21:05:49, on 2006-7-26
Platform: Windows 2000 SP4 (WinNT 5.00.2195)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINNT\System32\smss.exe
C:\WINNT\system32\winlogon.exe
C:\WINNT\system32\services.exe
C:\WINNT\system32\lsass.exe
C:\PROGRAM FILES\RISING\RAV\CCENTER.EXE
C:\Program Files\Rising\Rav\Ravmond.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\system32\spoolsv.exe
C:\WINNT\System32\svchost.exe
C:\Program Files\Rising\Rav\RavStub.exe
C:\WINNT\Explorer.EXE
C:\WINNT\System32\nvsvc32.exe
C:\Program Files\Rising\Rav\RavService.exe
C:\WINNT\system32\MSTask.exe
C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
C:\WINNT\sqlmanagement.exe
C:\Program Files\Rising\Rav\RavTray.exe
C:\Program Files\Rising\Rav\RavTask.exe
C:\Program Files\CNNIC\Cdn\cdnup.exe
C:\WINNT\system32\rundll32.exe
C:\WINNT\System32\WBEM\WinMgmt.exe
C:\KAVPFW6\KAVPFW.EXE
c:\winsock\winvnc\winvnc.exe
C:\WINNT\system32\Internat.exe
C:\Program Files\MSN Messenger\MsnMsgr.Exe
C:\WINNT\system32\svchost.exe
C:\WINNT\system32\drwtsn32.exe
C:\JLEXE\DOWN\DOWN.exe
C:\WINNT\system32\drwtsn32.exe
C:\Program Files\Maxthon\Max.exe
E:\pica\tools\sreng2\SREng2\SREng.exe
C:\WINNT\system32\mmc.exe
C:\WINNT\system32\drwtsn32.exe
C:\WINNT\system32\drwtsn32.exe
C:\WINNT\system32\rundll32.exe
C:\WINNT\system32\taskmgr.exe
C:\WINNT\system32\drwtsn32.exe
E:\pica\tools\hijackthis\HijackThis.exe

F2 - REG:system.ini: UserInit=C:\WINDOWS\system32\userinit.exe,C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\ifcb.exe
O2 - BHO: CdnForIE Class - {5C3853CF-C7E0-4946-B3FA-1ABDB6F48108} - C:\PROGRA~1\CNNIC\Cdn\cdnforie.dll
O2 - BHO: ActiveBHO Class - {63C55A7F-6E29-8D4F-5C76-4F850F28D13A} - C:\Progra~1\DoDoorRSSFinder\ActiveBandObject.dll
O2 - BHO: MSHlper Class - {721E6521-4CAD-4A8D-A7F1-4E230B31EF19} - C:\WINNT\system32\mshlp.dll
O2 - BHO: IEHlprObj Class - {999ADFA2-8AD1-47ff-97FC-69FB847458F4} - C:\Progra~1\NetMeeting\nmview.dll
O4 - HKLM\..\Run: [Synchronization Manager] mobsync.exe /logon
O4 - HKLM\..\Run: [RavTray] "C:\Program Files\Rising\Rav\RavTray.exe"
O4 - HKLM\..\Run: [RavTask] "C:\Program Files\Rising\Rav\RavTask.exe" -system
O4 - HKLM\..\Run: [CdnCtr] C:\Program Files\CNNIC\Cdn\cdnup.exe
O4 - HKLM\..\Run: [helper.dll] C:\WINNT\system32\rundll32.exe C:\PROGRA~1\3721\helper.dll,Rundll32
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINNT\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [iDuba Personal FireWall] C:\KAVPFW6\KAVPFW.EXE
O4 - HKLM\..\Run: [YLive.exe] ; C:\PROGRA~1\Yahoo!\ASSIST~1\YLive.exe
O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe
O4 - HKCU\..\Run: [internat.exe] Internat.exe
O4 - HKCU\..\Run: [iDuba Personal FireWall] C:\KAVPFW6\KAVPFW.EXE
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - Global Startup: 下载程序.lnk = C:\JLEXE\DOWN\DOWN.exe
O8 - Extra context menu item: &使用迅雷下载 - C:\Program Files\Thunder Network\Thunder\Program\GetUrl.htm
O8 - Extra context menu item: &使用迅雷下载全部链接 - C:\Program Files\Thunder Network\Thunder\Program\GetAllUrl.htm
O8 - Extra context menu item: 使用KuGoo3下载(&K) - C:\Program Files\KuGoo3\KuGoo3DownX.htm
O8 - Extra context menu item: 添加到雅虎收藏+ - http://myweb.cn.yahoo.com/post.html?F=D2_A
O9 - Extra button: 中文上网 - {5C3853CF-C7E0-4946-B3FA-1ABDB6F48108} - C:\PROGRA~1\CNNIC\Cdn\cdnforie.dll
O9 - Extra 'Tools' menuitem: 中文上网 - {5C3853CF-C7E0-4946-B3FA-1ABDB6F48108} - C:\PROGRA~1\CNNIC\Cdn\cdnforie.dll
O9 - Extra button: kele8 - {84920E5F-3788-49cd-A274-E365578DF174} - http://www.kele8.com/ (file missing)
O9 - Extra 'Tools' menuitem: kele8 - {84920E5F-3788-49cd-A274-E365578DF174} - http://www.kele8.com/ (file missing)
O9 - Extra button: 信息检索 - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra 'Tools' menuitem: 信息检索 - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: 相关站点 - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINNT\web\related.htm
O9 - Extra 'Tools' menuitem: 相关站点 - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINNT\web\related.htm
O10 - Broken Internet access because of LSP provider 'c:\winnt\system32\cdnns.dll' missing
O11 - Options group: [CDNCLIENT]  中文上网
O16 - DPF: {3BFFE033-BF43-11D5-A271-00A024A51325} - http://210.72.241.36/iNotes6.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1151981167328
O16 - DPF: {ABA7CC7F-019D-47DB-A0D2-B3C2B3AC1B44} (Fc2Boot Class) - http://210.51.5.71/onet/ActiveX/fc2boot.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{6AC6E905-51BD-4588-AF58-5D99EE6404BE}: NameServer = 211.94.33.193,10.2.0.20
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)
O21 - SSODL: SysTime - {724C75F1-B757-408D-A50A-4CF99DA35D73} - C:\PROGRA~1\WinKld\WinKld.dll
O23 - Service: Logical Disk Manager Administrative Service (dmadmin) - VERITAS Software Corp. - C:\WINNT\System32\dmadmin.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPodService - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINNT\System32\nvsvc32.exe
O23 - Service: RavService - Unknown owner - C:\Program Files\Rising\Rav\RavService.exe" /service (file missing)
O23 - Service: Rising Process Communication Center (RsCCenter) - Beijing Rising Technology Co., Ltd. - C:\PROGRAM FILES\RISING\RAV\CCENTER.EXE
O23 - Service: RsRavMon Service (RsRavMon) - Beijing Rising Technology Co., Ltd. - C:\Program Files\Rising\Rav\Ravmond.exe
O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
O23 - Service: Sybase BCKServer _ LXC_ASE_BS (SYBBCK_LXC_ASE_BS) - Unknown owner - C:\SYBASE\ASE-12_5\bin\bcksrvr.exe
O23 - Service: Sybase MONServer _ LXC_ASE_MS (SYBMON_LXC_ASE_MS) - Unknown owner - C:\SYBASE\ASE-12_5\bin\monsrvr.exe
O23 - Service: Sybase SQLServer _ LXC_ASE (SYBSQL_LXC_ASE) - Unknown owner - C:\SYBASE\ASE-12_5\bin\sqlsrvr.exe
O23 - Service: SYBSQL_ZL_ASE - Unknown owner - (no file)
O23 - Service: Sybase XPServer _ LXC_ASE_XP (SYBXPS_LXC_ASE_XP) - Unknown owner - C:\SYBASE\ASE-12_5\bin\xpserver.exe
O23 - Service: VNC Server (winvnc) - Unknown owner - c:\winsock\winvnc\winvnc.exe" -service (file missing)

thank you for help

how to deliver
F2 - REG:system.ini: UserInit=C:\WINDOWS\system32\userinit.exe,C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\ifcb.exe
>>????
zip ifcb.exe???

well, i have told you that i can not use chinese in this computer because of the virus.!!!!!!!

i can't find this file:
C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\ifcb.exe

O23 - Service: Sybase BCKServer _ LXC_ASE_BS (SYBBCK_LXC_ASE_BS) - Unknown owner - C:\SYBASE\ASE-12_5\bin\bcksrvr.exe
O23 - Service: Sybase MONServer _ LXC_ASE_MS (SYBMON_LXC_ASE_MS) - Unknown owner - C:\SYBASE\ASE-12_5\bin\monsrvr.exe
O23 - Service: Sybase SQLServer _ LXC_ASE (SYBSQL_LXC_ASE) - Unknown owner - C:\SYBASE\ASE-12_5\bin\sqlsrvr.exe
O23 - Service: SYBSQL_ZL_ASE - Unknown owner - (no file)
O23 - Service: Sybase XPServer _ LXC_ASE_XP (SYBXPS_LXC_ASE_XP) - Unknown owner - C:\SYBASE\ASE-12_5\bin\xpserver.exe
O23 - Service: VNC Server (winvnc) - Unknown owner - c:\winsock\winvnc\winvnc.exe" -service (file missing)
这一把东东你知道是什么吗？？？

these are useful services, not virus