Logfile of HijackThis v1.99.1
Scan saved at 19:57:16, on 2006-1-29
Platform: Windows 2000 SP4 (WinNT 5.00.2195)
MSIE: Internet Explorer v5.00 SP4 (5.00.2920.0000)
Running processes:
C:\WINNT\System32\smss.exe
C:\WINNT\system32\winlogon.exe
C:\WINNT\system32\services.exe
C:\WINNT\system32\lsass.exe
C:\WINNT\System32\Ati2evxx.exe
C:\WINNT\system32\svchost.exe
F:\rising\Rav\CCenter.exe
F:\rising\Rav\Ravmond.exe
C:\WINNT\system32\spoolsv.exe
C:\WINNT\System32\svchost.exe
C:\WINNT\system32\MSTask.exe
F:\rising\Rav\RavStub.exe
C:\WINNT\System32\WBEM\WinMgmt.exe
C:\Program Files\WinPoET\WrOS.EXE
C:\WINNT\system32\svchost.exe
C:\WINNT\system32\Ati2evxx.exe
C:\WINNT\Explorer.EXE
C:\WINNT\system32\Rundll32.exe
C:\WINNT\SOUNDMAN.EXE
F:\SKYNET\FIREWALL\PFW.exe
F:\rising\Rav\RavTask.exe
C:\WINNT\system32\internat.exe
F:\rising\Rav\Ravmon.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Documents and Settings\Glacier\桌面\248783200522382732\HijackThis.exe
R3 - URLSearchHook: BDSrchHook Class - {2C5AA40E-8814-4EB6-876E-7EFB8B3F9662} - C:\WINNT\DOWNLO~1\BDSrHook.dll
F2 - REG:system.ini: UserInit=C:\WINNT\system32\userinit.exe,C:\WINNT\system32\userint.exe
O3 - Toolbar: @msdxmLC.dll,-1@2052,电台(&R) - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINNT\System32\msdxm.ocx
O3 - Toolbar: 卡卡上网安全助手 - {DB9ECD4F-FB8F-4311-B3CE-90B976C2707C} - C:\WINNT\System32\kakatool.dll
O4 - HKLM\..\Run: [Synchronization Manager] mobsync.exe /logon
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [a-winpoet-service] ; C:\Program Files\WinPoET\WinPPPoverEthernet.exe
O4 - HKLM\..\Run: [Super Rabbit Desktop Set] ; F:\MagicSet\DS.EXE /Load
O4 - HKLM\..\Run: [internat.exe] ; internat.exe
O4 - HKLM\..\Run: [SKYNET Personal FireWall] F:\SKYNET\FIREWALL\PFW.exe
O4 - HKLM\..\Run: [ATIPTA] ; C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [POINTER] ; point32.exe
O4 - HKLM\..\Run: [RavTask] "F:\rising\Rav\RavTask.exe" -system
O4 - HKCU\..\Run: [internat.exe] internat.exe
O4 - Startup: 腾讯QQ.lnk = F:\qq\QQ.exe
O4 - Startup: ADSL超频奇兵 V3.06.lnk = ?
O4 - Global Startup: ImageFox.lnk = C:\Program Files\ACD Systems\ImageFox\ImageFox.exe
O4 - Global Startup: Adobe Gamma Loader.exe.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINNT\web\related.htm
O9 - Extra 'Tools' menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINNT\web\related.htm
O14 - IERESET.INF: SEARCH_PAGE_URL=
O14 - IERESET.INF: START_PAGE_URL=
O16 - DPF: {ABA7CC7F-019D-47DB-A0D2-B3C2B3AC1B44} (Fc2Boot Class) - http://61.138.178.22/system_c/fc2boot.cab
O16 - DPF: {C0C13879-6A17-429E-80F1-60B23FC1F720} (FcBoot Class) - http://61.135.133.213/game/system/activex/fcboot.cab
O16 - DPF: {D7F0CC2E-FB09-4B38-B9A7-6807CBCD4859} (NMChatX Control) - http://igame.sina.com.cn/cab/nmchatx.cab
O16 - DPF: {DA984A6D-508E-11D6-AA49-0050FF3C628D} (Ravonline) - http://download.rising.com.cn/ravkill/rsonline.cab
O16 - DPF: {DDA166FA-B3EA-4A3B-8EE2-4F552CDEEE81} (KATScan Control) - http://db.17173.com/tscan/KATScan.CAB
O16 - DPF: {FA463B6E-93D5-4E02-B7F2-E0BA98DA73FC} (SHLaunch Control) - http://61.155.9.9/SHLaunch_0935.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{01106B6B-024B-4809-8AEF-45B4EFAE0796}: NameServer = 202.99.96.68 202.99.64.69
O17 - HKLM\System\CS2\Services\Tcpip\..\{01106B6B-024B-4809-8AEF-45B4EFAE0796}: NameServer = 202.99.96.68 202.99.64.69
O20 - AppInit_DLLs: apihookdll.dll
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINNT\System32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINNT\system32\ati2sgag.exe
O23 - Service: Logical Disk Manager Administrative Service (dmadmin) - VERITAS Software Corp. - C:\WINNT\System32\dmadmin.exe
O23 - Service: Net Login Helper (netlog) - Unknown owner - C:\WINNT\system32\SCardSer.exe (file missing)
O23 - Service: Rising Process Communication Center (RsCCenter) - Beijing Rising Technology Co., Ltd. - F:\rising\Rav\CCenter.exe
O23 - Service: RsRavMon Service (RsRavMon) - Beijing Rising Technology Co., Ltd. - F:\rising\Rav\Ravmond.exe
O23 - Service: WinPPPoverEthernet - iVasion, a Routerware Company - C:\Program Files\WinPoET\WrOS.EXE
