Logfile of HijackThis v1.99.1
Scan saved at 17:39:03, on 2006-7-6
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
E:\Rav\Rising\Rav\CCenter.exe
C:\WINDOWS\System32\svchost.exe
E:\Rav\Rising\Rav\Ravmond.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\svchost.exe
E:\Rav\Rising\Rav\RavStub.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\SOUNDMAN.EXE
E:\Rav\Rising\Rav\RavTask.exe
E:\Rav\Rising\Rav\Ravmon.exe
C:\WINDOWS\vsnpstd3.exe
C:\WINDOWS\system32\ctfmon.exe
E:\Program Files\Tencent\TT\TTraveler.exe
C:\WINDOWS\system32\conime.exe
F:\BitComet\rules\ha_hijackthis_1991\HijackThis.exe
R3 - URLSearchHook: (no name) - {C28DDEA9-FBAB-4EC8-9741-7236816EDB7C} - C:\WINDOWS\system32\Xtza.dll (file missing)
R3 - URLSearchHook: (no name) - {07C1B0FF-BED8-4D7C-A771-48A8EAF76929} - C:\WINDOWS\system32\Zaif.dll (file missing)
R3 - URLSearchHook: (no name) - {2FBC7AE0-A1DC-4342-BDD6-BCC99ACF5CD1} - C:\WINDOWS\system32\Zfwhex.dll (file missing)
R3 - URLSearchHook: (no name) - {E9D5FCF3-2FDC-4844-AB0F-C64823A744B7} - C:\WINDOWS\system32\Bdfqv.dll (file missing)
R3 - URLSearchHook: (no name) - {C17D45EC-23D7-4A73-81DB-DCA9821AEB3D} - C:\WINDOWS\system32\Ualnoq.dll (file missing)
R3 - URLSearchHook: (no name) - {5C61E1FA-37C4-4C1E-8BAA-8738569568B7} - C:\WINDOWS\system32\Inqvv.dll (file missing)
R3 - URLSearchHook: (no name) - {695610A7-9A29-4B2B-9401-85976C1B9A7C} - C:\WINDOWS\system32\Svqyl.dll (file missing)
R3 - URLSearchHook: (no name) - {40F8447A-6DC8-45EA-A99A-54A73FCE05B3} - C:\WINDOWS\system32\Zbzsng.dll (file missing)
R3 - URLSearchHook: (no name) - {D495CDE5-E5A1-4DD2-BADC-E2974D823B1A} - C:\WINDOWS\system32\Jbczaq.dll (file missing)
R3 - URLSearchHook: (no name) - {7340B19A-A5AB-4FD7-B599-CBA964B7522E} - C:\WINDOWS\system32\Yciwsd.dll (file missing)
R3 - URLSearchHook: (no name) - {43670F2F-B12B-4036-9F3E-F3B2FAC3D509} - C:\WINDOWS\system32\Ilthal.dll (file missing)
F2 - REG:system.ini: UserInit=userinit.exe,
O3 - Toolbar: Zango Toolbar - {EA0D26BD-9029-431A-86E0-83152D67828A} - C:\Program Files\Zango Programs\Zango Toolbar\ZangoTB.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [RavTask] "E:\Rav\Rising\Rav\RavTask.exe" -system
O4 - HKLM\..\Run: [snpstd3] C:\WINDOWS\vsnpstd3.exe
O4 - HKLM\..\Run: [StormCodec_Helper] ; "C:\Program Files\Ringz Studio\Storm Codec\StormSet.exe" /S /opti
O4 - HKLM\..\Run: [Thunder] "C:\Program Files\Thunder Network\Thunder\Thunder.exe" /s
O4 - HKLM\..\Run: [helper.dll] ; C:\WINDOWS\system32\rundll32.exe C:\PROGRA~1\3721\helper.dll,Rundll32
O4 - HKLM\..\Run: [IMJPMIG8.1] ; "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
O4 - HKLM\..\Run: [PHIME2002A] ;
O4 - HKLM\..\Run: [PHIME2002ASync] ;
O4 - HKLM\..\Run: [stup.exe] ;
O4 - HKLM\..\Run: [yassistse] ;
O4 - HKLM\..\Run: [YLive.exe] ;
O4 - HKLM\..\RunOnce: [Super Rabbit Winspeed] "F:\Program Files\Super Rabbit\MagicSet\winspeed.exe" /autokill:54,35,14
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O8 - Extra context menu item: &Google Search - res://C:\Program Files\Google\GoogleToolbar1.dll/cmsearch.html
O8 - Extra context menu item: &Translate English Word - res://C:\Program Files\Google\GoogleToolbar1.dll/cmwordtrans.html
O8 - Extra context menu item: &使用迅雷下载 - C:\Program Files\Thunder Network\Thunder\Program\GetUrl.htm
O8 - Extra context menu item: &使用迅雷下载全部链接 - C:\Program Files\Thunder Network\Thunder\Program\GetAllUrl.htm
O8 - Extra context menu item: Backward Links - res://C:\Program Files\Google\GoogleToolbar1.dll/cmbacklinks.html
O8 - Extra context menu item: Cached Snapshot of Page - res://C:\Program Files\Google\GoogleToolbar1.dll/cmcache.html
O8 - Extra context menu item: Similar Pages - res://C:\Program Files\Google\GoogleToolbar1.dll/cmsimilar.html
O8 - Extra context menu item: Translate Page into English - res://C:\Program Files\Google\GoogleToolbar1.dll/cmtrans.html
O8 - Extra context menu item: 上传到QQ网络硬盘 - E:\Program Files\QQ2005\AddToNetDisk.htm
O8 - Extra context menu item: 添加到QQ自定义面板 - E:\Program Files\QQ2005\AddPanel.htm
O8 - Extra context menu item: 添加到QQ表情 - E:\Program Files\QQ2005\AddEmotion.htm
O8 - Extra context menu item: 用QQ彩信发送该图片 - E:\Program Files\QQ2005\SendMMS.htm
O9 - Extra button: Yahoo 1G电邮 - {507F9113-CD77-4866-BA92-0E86DA3D0B97} - http://cn.zs.yahoo.com/cnsbutton.htm?source=cns&btn=yahoomail (file missing)
O9 - Extra button: 雅虎助手 - {5D73EE86-05F1-49ed-B850-E423120EC338} - http://cn.zs.yahoo.com/cnsbutton.htm?source=cns&btn=yassist (file missing)
O9 - Extra button: 易趣购物 - {DE607145-AC19-425e-865A-5D70ABDF119A} - http://click2.ad4all.net/url2/urlmanage/url.asp?id=5 (file missing)
O9 - Extra 'Tools' menuitem: 易趣购物 - {DE607145-AC19-425e-865A-5D70ABDF119A} - http://click2.ad4all.net/url2/urlmanage/url.asp?id=5 (file missing)
O9 - Extra button: 情景聊天 - {E5D12C4E-7B4F-11D3-B5C9-0050045C3C96} - http://cn.zs.yahoo.com/cnsbutton.htm?source=cns&btn=yahoomsg (file missing)
O16 - DPF: {DECEAAA2-370A-49BB-9362-68C3A58DDC62} (SAIX) - http://static.zangocash.com/cab/Zango/ie/bridge-c18.cab?da8058c66c08fbf6b7765fb0f3159a55044a4bf4d84035dec0a09acb6467328be4fe4bc84d7bf66a7ac19bce14966dbe7f291de8076653b0508a8f0ff65fc8a22502fdad81df4a8b:278a3d34c2078d9522cc73d7fb3f8d5b
O17 - HKLM\System\CCS\Services\Tcpip\..\{C6D2BBA8-65EE-46CC-81EA-C3B12B0E9BDE}: NameServer = 202.100.192.68 202.100.199.8
O23 - Service: Rising Personal Firewall - Unknown owner - C:\WINDOWS\uninstrs.exe
O23 - Service: Rising Process Communication Center (RsCCenter) - Beijing Rising Technology Co., Ltd. - E:\Rav\Rising\Rav\CCenter.exe
O23 - Service: RsRavMon Service (RsRavMon) - Beijing Rising Technology Co., Ltd. - E:\Rav\Rising\Rav\Ravmond.exe
