Logfile of HijackThis v1.99.1
Scan saved at 12:35:50, on 2005-11-9
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Running processes:
E:\WINDOWS\System32\smss.exe
E:\WINDOWS\system32\winlogon.exe
E:\WINDOWS\system32\services.exe
E:\WINDOWS\system32\lsass.exe
E:\WINDOWS\system32\svchost.exe
E:\WINDOWS\System32\svchost.exe
F:\歌曲\RISING\RAV\Ravmond.exe
F:\歌曲\RISING\RAV\RavStub.exe
E:\WINDOWS\system32\spoolsv.exe
E:\WINDOWS\Explorer.EXE
C:\KV2004\KVMonXp_1.kxp
E:\WINDOWS\system32\rundll32.exe
E:\WINDOWS\SOUNDMAN.EXE
E:\WINDOWS\system32\BCUP.exe
F:\歌曲\RISING\RAV\RAVTIMER.EXE
F:\歌曲\RISING\RAV\RAVMON.EXE
E:\WINDOWS\system32\ctfmon.exe
F:\Program Files\Thunder Network\Thunder\Thunder.exe
E:\Program Files\Cisco Systems\VPN Client\cvpnd.exe
E:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\KV2004\KVSrvXP.exe
C:\KV2004\KVwsc.exe
F:\歌曲\RISING\RAV\CCENTER.EXE
f:\Program Files\System Safety Monitor\SSMService.exe
f:\Program Files\System Safety Monitor\sysSafe.exe
E:\WINDOWS\system32\wscntfy.exe
F:\Program Files\Tencent\QQ\TIMPlatform.exe
F:\Program Files\Tencent\QQ\QQ.EXE
F:\Program Files\Tencent\QQ\QQexternal.exe
E:\WINDOWS\system32\WISPTIS.EXE
F:\Program Files\Tencent\QQ\QQ.EXE
F:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE
E:\Program Files\WinRAR\WinRAR.exe
E:\DOCUME~1\SVW\LOCALS~1\Temp\Rar$EX00.640\HijackThis.exe
O2 - BHO: ThunderIEHelper Class - {0005A87D-D626-4B3A-84F9-1D9571695F55} - E:\WINDOWS\system32\xunleibho_v8.dll
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - F:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: QQIEHelper - {54EBD53A-9BC1-480B-966A-843A333CA162} - f:\Program Files\Tencent\QQ\QQIEHelper.dll
O2 - BHO: YDragSearch - {62EED7C6-9F02-42f9-B634-98E2899E147B} - E:\PROGRA~1\Yahoo!\ASSIST~1\Assist\YDRAGS~1.DLL (file missing)
O2 - BHO: BandIE Class - {77FEF28E-EB96-44FF-B511-3185DEA48697} - E:\PROGRA~1\baidu\bar\baidubar.dll
O2 - BHO: BrowseHelper Class - {80BF4637-D65B-43F3-BB60-C5DD3D5FB7B9} - C:\KV2004\KVShell_1.dll
O2 - BHO: YiSou - {EF1D17A9-089F-40cc-8D64-7324CDEBA0DB} - E:\PROGRA~1\yisou\yisoub.dll
O3 - Toolbar: 江民杀毒工具栏 - {B5A34A93-D538-43A7-8371-864CB6148D12} - C:\KV2004\KVShell_1.dll
O3 - Toolbar: 一搜工具条 - {115F6E46-FCBC-41ed-B3B5-3BDDD4AAB5E5} - E:\Program Files\yisou\yisou.dll
O3 - Toolbar: 百度超级搜霸 - {B580CF65-E151-49C3-B73F-70B13FCA8E86} - E:\PROGRA~1\baidu\bar\baidubar.dll
O4 - HKLM\..\Run: [IMJPMIG8.1] "E:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
O4 - HKLM\..\Run: [PHIME2002ASync] E:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC
O4 - HKLM\..\Run: [PHIME2002A] E:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName
O4 - HKLM\..\Run: [KvMonXP] C:\KV2004\KVMonXp_1.kxp /auto
O4 - HKLM\..\Run: [helper.dll] E:\WINDOWS\system32\rundll32.exe E:\PROGRA~1\3721\helper.dll,Rundll32
O4 - HKLM\..\Run: [Thunder] "F:\Program Files\Thunder Network\Thunder\ThunderShell.exe" /s
O4 - HKLM\..\Run: [IMSCMig] E:\PROGRA~1\COMMON~1\MICROS~1\IME\IMSC40A\IMSCMIG.EXE /Preload
O4 - HKLM\..\Run: [YLive.exe] E:\PROGRA~1\Yahoo!\ASSIST~1\YLive.exe
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [Show_B] C:\Ltdrv\Show_B.exe
O4 - HKLM\..\Run: [part559] c:\ltdrv\part559.exe ltrun
O4 - HKLM\..\Run: [BCUpdate] E:\WINDOWS\system32\BCUP.exe
O4 - HKLM\..\Run: [ADShow] E:\WINDOWS\system32\bcsysnote.ex
O4 - HKLM\..\Run: [SiSPower] Rundll32.exe SiSPower.dll,ModeAgent
O4 - HKLM\..\Run: [RavTimer] F:\歌曲\RISING\RAV\RAVTIMER.EXE
O4 - HKLM\..\Run: [RavMon] F:\歌曲\RISING\RAV\RAVMON.EXE -SYSTEM
O4 - HKCU\..\Run: [ctfmon.exe] E:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [RegBar] regsvr32.exe /u E:\progra~1\blogmark\bocaitoolbar.dll /s /i /n
O4 - Global Startup: Cisco Systems VPN Client.lnk = E:\Program Files\Cisco Systems\VPN Client\vpngui.exe
O4 - Global Startup: EPSON Status Monitor 3 环境检查.lnk = E:\WINDOWS\system32\spool\drivers\w32x86\3\E_SRCV03.EXE
O8 - Extra context menu item: !搜一搜 - res://E:\Program Files\yisou\yisou.dll/232
O8 - Extra context menu item: !搜一搜(&S) - res://E:\Program Files\yisou\yisou.dll/232
O8 - Extra context menu item: &使用迅雷下载 - f:\Program Files\Thunder Network\Thunder\geturl.htm
O8 - Extra context menu item: &使用迅雷下载全部链接 - f:\Program Files\Thunder Network\Thunder\getAllurl.htm
O8 - Extra context menu item: 使用超级解霸播放 - e:\Program Files\Herosoft\Hero 9\MPURLGET.HTM
O8 - Extra context menu item: 导出到 Microsoft Office Excel(&X) - res://F:\PROGRA~1\MICROS~1\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: 添加到QQ自定义面板 - F:\Program Files\Tencent\QQ\AddPanel.htm
O8 - Extra context menu item: 添加到QQ表情 - F:\Program Files\Tencent\QQ\AddEmotion.htm
O8 - Extra context menu item: 用QQ彩信发送该图片 - F:\Program Files\Tencent\QQ\SendMMS.htm
O8 - Extra context menu item: 百度-搜索MP3 - res://E:\PROGRA~1\baidu\bar\baidubar.dll/BAIDUMP3.HTM
O8 - Extra context menu item: 百度-搜索图片 - res://E:\PROGRA~1\baidu\bar\baidubar.dll/BAIDUIMG.HTM
O8 - Extra context menu item: 百度-搜索新闻 - res://E:\PROGRA~1\baidu\bar\baidubar.dll/BAIDUNEWS.HTM
O8 - Extra context menu item: 百度-搜索歌词 - res://E:\PROGRA~1\baidu\bar\baidubar.dll/BAIDULYRIC.HTM
O8 - Extra context menu item: 百度-搜索网页 - res://E:\PROGRA~1\baidu\bar\baidubar.dll/BAIDUSEARCH.HTM
O8 - Extra context menu item: 百度-搜索贴吧 - res://E:\PROGRA~1\baidu\bar\baidubar.dll/BAIDUPOST.HTM
O8 - Extra context menu item: 百度-词典搜索 - res://E:\PROGRA~1\baidu\bar\baidubar.dll/BAIDU_DIC.HTM
O9 - Extra button: 江民在线杀毒 - {06926B30-424E-4f1c-8EE3-543CD96573DC} - http://club.jiangmin.com/kvscan/KvOnline.asp (file missing)
O9 - Extra button: (no name) - {367E0A21-8601-4986-9C9A-153BF5ACA118} - (no file)
O9 - Extra button: 信息检索 - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - F:\PROGRA~1\MICROS~1\OFFICE11\REFIEBAR.DLL
O9 - Extra button: QQ - {c95fe080-8f5d-11d2-a20b-00aa003c157b} - f:\Program Files\Tencent\QQ\QQ.EXE
O9 - Extra 'Tools' menuitem: 腾讯QQ - {c95fe080-8f5d-11d2-a20b-00aa003c157b} - f:\Program Files\Tencent\QQ\QQ.EXE
O9 - Extra button: (no name) - {DEDEB80D-FA35-45d9-9460-4983E5A8AFE6} - f:\Program Files\Tencent\QQ\QQIEHelper.dll
O9 - Extra 'Tools' menuitem: QQ炫彩工具条设置 - {DEDEB80D-FA35-45d9-9460-4983E5A8AFE6} - f:\Program Files\Tencent\QQ\QQIEHelper.dll
O9 - Extra button: 网上购物 - {EE60714F-AC27-427e-861A-FD60CBDF119A} - http://www.imhero.com/popup/url.aspx****1 (file missing)
O9 - Extra 'Tools' menuitem: 网上购物 - {EE60714F-AC27-427e-861A-FD60CBDF119A} - http://www.imhero.com/popup/url.aspx****1 (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - E:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - E:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {E4E2F180-CB8B-4DE9-ACBB-DA745D3BA153} (Rising Web Scan
Object) - http://download.rising.com.cn/register/pcver/autoupgradepad/Ver2005/OL2005.cab
O16 - DPF: {EF6205C1-3F17-4829-BCB5-1336ED89E356} - http://club.jiangmin.com/kvscan/KvDown.cab
O20 - Winlogon Notify: System Safety Monitor - E:\WINDOWS\SYSTEM32\SSMWinlogonEx.dll
O23 - Service: Cisco Systems, Inc. VPN Service (CVPND) - Cisco Systems, Inc. - E:\Program Files\Cisco Systems\VPN Client\cvpnd.exe
O23 - Service: Windows Internet/Server (Internet) - Unknown owner - E:\WINDOWS\system32\RavExt\winlogo.exe
O23 - Service: KVSrvXP - JiangMin Ltd. - C:\KV2004\KVSrvXP.exe
O23 - Service: KVWSC - Jiangmin Co - C:\KV2004\KVwsc.exe
O23 - Service: Rising Process Communication Center (RsCCenter) - rising - F:\歌曲\RISING\RAV\CCENTER.EXE
O23 - Service: RsRavMon Service (RsRavMon) - Beijing Rising Technology Co., Ltd. - F:\歌曲\RISING\RAV\Ravmond.exe
O23 - Service: System Safety Monitor (SSM) - System Safety - f:\Program Files\System Safety Monitor\SSMService.exe
