Logfile of HijackThis v1.99.1
Scan saved at 23:51:53, on 2007-04-04
Platform: Windows 2003 SP1 (WinNT 5.02.3790)
MSIE: Internet Explorer v7.00 (7.00.5730.0011)
Running processes:
C:\WIN2003\System32\smss.exe
C:\WIN2003\system32\winlogon.exe
C:\WIN2003\system32\services.exe
C:\WIN2003\system32\lsass.exe
C:\WIN2003\system32\svchost.exe
C:\WIN2003\System32\svchost.exe
C:\KAV2007\KWatch.EXE
C:\WIN2003\system32\spoolsv.exe
C:\WIN2003\System32\svchost.exe
C:\WIN2003\system32\inetsrv\inetinfo.exe
C:\KAV2007\KPfwSvc.EXE
C:\WIN2003\System32\svchost.exe
C:\WIN2003\Explorer.EXE
C:\WIN2003\System32\svchost.exe
C:\WIN2003\system32\igfxtray.exe
C:\WIN2003\system32\hkcmd.exe
C:\WIN2003\system32\igfxpers.exe
C:\WIN2003\RTHDCPL.EXE
C:\KAV2007\KAVStart.exe
C:\WIN2003\system32\RUNDLL32.EXE
C:\WIN2003\system32\ctfmon.exe
C:\KAV2007\KPFW32.EXE
C:\WIN2003\System32\svchost.exe
C:\KAV2007\KMailMon.EXE
C:\WIN2003\system32\conime.exe
C:\Program Files\MSN Messenger\usnsvc.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\ThunderBird.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\TDdownload\服务器问题查看软件\ha_hijackthis_1991\HijackThis.exe
R3 - URLSearchHook: BdSearchHook Class - {02496EBD-8455-48db-B3C7-5DAC97D9F5A7} - C:\PROGRA~1\baidu\iexp\BDSrHook.dll
F2 - REG:system.ini: UserInit=C:\WIN2003\system32\Userinit.exe
O2 - BHO: Thunder Browser Helper - {0005A87C-D626-4B3A-84F9-1D9571695F55} - C:\Program Files\Thunder Network\Thunder\ComDlls\XunLeiBHO_006.dll
O2 - BHO: ThunderIEHelper Class - {0005A87D-D626-4B3A-84F9-1D9571695F55} - C:\WIN2003\system32\xunleibho_v14.dll
O2 - BHO: BdSearch - {02496EBD-8455-48db-B3C7-5DAC97D9F5A7} - C:\PROGRA~1\baidu\iexp\BDSrHook.dll
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: QQIEHelper - {54EBD53A-9BC1-480B-966A-843A333CA162} - C:\WIN2003SP1 (F)\QQ\QQIEHelper.dll
O2 - BHO: KAVAntiFishing - {55302805-482E-470E-8A57-6795A1487F90} - C:\KAV2007\KAVAFish.DLL
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: FCBHOBHO Class - {8B3868B4-EBA8-48FA-A19B-E1DFB99066FA} - C:\Program Files\FlashCapture\fcbho.dll
O2 - BHO: (no name) - {A5366673-E8CA-11D3-9CD9-0090271D075B} - (no file)
O3 - Toolbar: 卡卡上网安全助手 - {DB9ECD4F-FB8F-4311-B3CE-90B976C2707C} - C:\WIN2003\system32\KakaTool.dll
O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WIN2003\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
O4 - HKLM\..\Run: [IMEKRMIG6.1] C:\WIN2003\ime\imkr6_1\IMEKRMIG.EXE
O4 - HKLM\..\Run: [IgfxTray] C:\WIN2003\system32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WIN2003\system32\hkcmd.exe
O4 - HKLM\..\Run: [Persistence] C:\WIN2003\system32\igfxpers.exe
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [StormCodec_Helper] "C:\Program Files\Ringz Studio\Storm Codec\StormSet.exe" /S /opti
O4 - HKLM\..\Run: [Microsoft Pinyin IME Migration] C:\PROGRA~1\COMMON~1\MICROS~1\IME12\IMESC\IMSCMIG.EXE /INSTALL
O4 - HKLM\..\Run: [KavStart] "C:\KAV2007\KAVStart.exe" -startup
O4 - HKLM\..\Run: [BIE] RUNDLL32.EXE C:\PROGRA~1\baidu\iexp\BDSrHook.dll,Rundll32
O4 - HKLM\..\Run: [UserFaultCheck] %systemroot%\system32\dumprep 0 -u
O4 - HKLM\..\RunOnce: [spuninst] C:\WIN2003\$NtServicePackUninstall$\spuninst\spuninst.exe /@@
O4 - HKCU\..\Run: [ctfmon.exe] C:\WIN2003\system32\ctfmon.exe
O4 - HKCU\..\Run: [KavPFW] "C:\KAV2007\KPFW32.EXE"
O4 - Startup: 腾讯QQ.lnk = C:\WIN2003SP1 (F)\QQ\QQ.exe
O8 - Extra context menu item: &使用迅雷下载 - C:\Program Files\Thunder Network\Thunder\Program\geturl.htm
O8 - Extra context menu item: &使用迅雷下载全部链接 - C:\Program Files\Thunder Network\Thunder\Program\getallurl.htm
O8 - Extra context menu item: 上传到QQ网络硬盘 - C:\WIN2003SP1 (F)\QQ\AddToNetDisk.htm
O8 - Extra context menu item: 添加到QQ自定义面板 - C:\WIN2003SP1 (F)\QQ\AddPanel.htm
O8 - Extra context menu item: 添加到QQ表情 - C:\WIN2003SP1 (F)\QQ\AddEmotion.htm
O8 - Extra context menu item: 用QQ彩信发送该图片 - C:\WIN2003SP1 (F)\QQ\SendMMS.htm
O8 - Extra context menu item: 金山毒霸反钓鱼... - C:\KAV2007\KAF\ShowSet.htm
O9 - Extra button: 启动迅雷 - {0062C9BD-B349-40DE-91A0-755F37ACD559} - C:\Program Files\Thunder Network\Thunder\Thunder.exe
O9 - Extra 'Tools' menuitem: 启动迅雷 - {0062C9BD-B349-40DE-91A0-755F37ACD559} - C:\Program Files\Thunder Network\Thunder\Thunder.exe
O9 - Extra button: 江民在线杀毒 - {06926B30-424E-4f1c-8EE3-543CD96573DC} - http://club.jiangmin.com/kvscan/KvOnline.asp (file missing)
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_05\bin\npjpi150_05.dll
O9 - Extra 'Tools' menuitem: Sun Java 控制台 - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_05\bin\npjpi150_05.dll
O9 - Extra button: 就要你 - {42CE9921-7259-11D6-B76A-0010A48548DC} - url:http://www.91ni.com (file missing)
O9 - Extra button: 网吧.net计划 - {64187580-726B-11D6-B76A-0010A48548DC} - url:http://www.sicent.net (file missing)
O9 - Extra button: FlashCapture - {753BBC4B-CC73-4fb8-A5B5-CA09C804C1DD} - C:\Program Files\FlashCapture\fciext.dll
O9 - Extra button: kele8 - {84920E5F-3788-49cd-A274-E365578DF174} - http://www.kele8.com/ (file missing)
O9 - Extra 'Tools' menuitem: kele8 - {84920E5F-3788-49cd-A274-E365578DF174} - http://www.kele8.com/ (file missing)
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O9 - Extra button: QQ - {c95fe080-8f5d-11d2-a20b-00aa003c157b} - C:\WIN2003SP1 (F)\QQ\QQ.EXE
O9 - Extra 'Tools' menuitem: 腾讯QQ - {c95fe080-8f5d-11d2-a20b-00aa003c157b} - C:\WIN2003SP1 (F)\QQ\QQ.EXE
O9 - Extra button: (no name) - {DEDEB80D-FA35-45d9-9460-4983E5A8AFE6} - C:\WIN2003SP1 (F)\QQ\QQIEHelper.dll
O9 - Extra 'Tools' menuitem: QQ炫彩工具条设置 - {DEDEB80D-FA35-45d9-9460-4983E5A8AFE6} - C:\WIN2003SP1 (F)\QQ\QQIEHelper.dll
O11 - Options group: [!IESearch] !IESearch
O11 - Options group: [INTERNATIONAL] International*
O16 - DPF: {05C1004E-2596-48E5-8E26-39362985EEB9} (MMCPlayer Class) - http://p3p.sogou.com/MMCShell.cab
O16 - DPF: {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - http://www.ics.kagoshima-u.ac.jp/edu/ProgramingJava/DataStruct/java
O16 - DPF: {1C960AA3-FAEE-11D0-9262-00A0243D2412} (TegoSoft SmartLoader ActiveX Control) - http://cnsafer.com/ActiveX/TegoLoad.cab
O16 - DPF: {2E28242B-A689-11D4-80F2-0040266CBB8D} (KX-HCM10 Control) - http://lailai.iobb.net/kxhcm10.ocx
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://by124w.bay124.mail.live.com/mail/resources/MsnPUpld.cab
O16 - DPF: {75DB194D-86A1-4475-B44A-28501AF66EEA} (FlashPlayer8 Control) - http://download.xhd.cn/FlashPlayer8.cab
O16 - DPF: {91DFB26C-AFD7-47C2-A07D-D22AF3548169} (NamoWeCtl 6.0 for YahooJpn) - http://geocities.yahoo.co.jp/namo/geocreator/NamoWec6.cab
O16 - DPF: {EF6205C1-3F17-4829-BCB5-1336ED89E356} - http://club.jiangmin.com/kvscan/KvDown.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{2A760051-7A68-44B6-A58D-C7CFCAAB47FD}: NameServer = 192.168.1.1
O17 - HKLM\System\CS2\Services\Tcpip\..\{2A760051-7A68-44B6-A58D-C7CFCAAB47FD}: NameServer = 192.168.1.1
O17 - HKLM\System\CS3\Services\Tcpip\..\{2A760051-7A68-44B6-A58D-C7CFCAAB47FD}: NameServer = 192.168.1.1
O18 - Protocol: koboo - {7DEE9D05-FA0A-4416-A6F3-6537D0EAB6A6} - C:\WIN2003\system32\mbprot.dll
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Protocol: ms-help - {314111C7-A502-11D2-BBCA-00C04F8EC294} - C:\Program Files\Common Files\Microsoft Shared\Help\hxds.dll
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Filter: text/x-mrml - {C51721BE-858B-4A66-A8BF-D2882FF49820} - C:\Program Files\wavtoringtone\MidRadio.ocx
O18 - Filter hijack: text/xml - {807563E5-5146-11D5-A672-00B0D022E945} - C:\PROGRA~1\COMMON~1\MICROS~1\OFFICE12\MSOXMLMF.DLL
O20 - Winlogon Notify: dimsntfy - C:\WIN2003\SYSTEM32\dimsntfy.dll
O20 - Winlogon Notify: igfxcui - C:\WIN2003\SYSTEM32\igfxdev.dll
O23 - Service: Kingsoft Personal Firewall Service (KPfwSvc) - Kingsoft Corporation - C:\KAV2007\KPfwSvc.EXE
O23 - Service: Kingsoft Antivirus KWatch Service (KWatchSvc) - Kingsoft Corporation - C:\KAV2007\KWatch.EXE
O23 - Service: Remote Packet Capture Protocol v.0 (experimental) (rpcapd) - Unknown owner - %ProgramFiles%\WinPcap\rpcapd.exe" -d -f "%ProgramFiles%\WinPcap\rpcapd.ini (file missing)
