Logfile of HijackThis v1.99.1
Scan saved at 15:37:41, on 2005-10-2
Platform: Windows 2000 SP4 (WinNT 5.00.2195)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)
Running processes:
C:\WINNT\System32\smss.exe
C:\WINNT\system32\winlogon.exe
C:\WINNT\system32\services.exe
C:\WINNT\system32\lsass.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\system32\spoolsv.exe
C:\WINNT\System32\msdtc.exe
C:\WINNT\System32\svchost.exe
C:\WINNT\System32\llssrv.exe
d:\orant\bin\oracle80.exe
d:\orant\bin\OWASTsvr.exe
C:\Program Files\P4P\p2psvr.exe
C:\Program Files\PeanutHull\PHSvc.exe
C:\PROGRA~1\EFFICI~1\ENTERN~1\app\pppoeservice.exe
C:\WINNT\system32\regsvc.exe
C:\PROGRAM FILES\RISING\RAV\CCENTER.EXE
C:\WINNT\system32\MSTask.exe
C:\WINNT\System32\WBEM\WinMgmt.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\System32\certsrv.exe
C:\WINNT\System32\inetsrv\inetinfo.exe
d:\orant\BIN\strtdb80.exe
C:\PROGRA~1\SKYNET\FIREWALL\PFW.exe
C:\PROGRA~1\RISING\RAV\RAVTIMER.EXE
C:\PROGRA~1\RISING\RAV\RAVMON.EXE
C:\Program Files\CNNIC\Cdn\cdnup.exe
C:\Program Files\PeanutHull\phnt.exe
C:\WINNT\system32\internat.exe
C:\WINNT\system32\conime.exe
C:\WINNT\system32\Dfssvc.exe
C:\WINNT\System32\svchost.exe
C:\PROGRA~1\EFFICI~1\ENTERN~1\app\EnterNet.exe
C:\WINNT\System32\svchost.exe
C:\WINNT\system32\wuauclt.exe
d:\orant\BIN\TNSLSNR80.EXE
C:\Program Files\Tencent\QQ\QQ.exe
C:\Program Files\Tencent\QQ\TIMPlatform.exe
C:\WINNT\explorer.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Tencent\QQ\QQ.exe
E:\张明明\155847200541134207\HijackThis.exe
R3 - URLSearchHook: 虎翼DIY吧! -
{0A00D11E-B1E7-44b5-AD88-C9190876AAC4} -
C:\WINNT\system32\diybar2\diybar2.dll
O2 - BHO: ThunderIEHelper Class -
{0005A87D-D626-4B3A-84F9-1D9571695F55} -
C:\WINNT\system32\xunleibho_v5.dll
O2 - BHO: (no name) - {046167AA-53C2-4576-B362-291D9E852269} -
C:\WINNT\system32\BBDown.dll
O2 - BHO: CPub
Object - {0CA51D02-7739-43EA-8D9A-1E8AD4327B03} -
C:\Program Files\P4P\sodaie.dll
O2 - BHO: (no name) - {35980F6E-A137-4E50-953D-813BB8556899} - (no
file)
O2 - BHO: Link Filter - {4022F902-ABC7-4C79-924F-BB26F1D355A2} -
C:\WINNT\system32\diybar2\diybar2.dll
O2 - BHO: T2BHO Class - {B1D147E7-873E-4909-8127-695D9BB78728} -
C:\WINNT\Downloaded Program Files\barhelp22.0.dll
O2 - BHO: Infofo 工具栏 - {D74EC18E-3DDD-4174-B1B1-949FE3B8366D} -
C:\Program Files\Infofo Bar\infofobar.dll (file missing)
O2 - BHO: WMHlprObj Class - {F5824EFB-728A-4726-A5A5-85A68B20EDC3}
- C:\PROGRA~1\CNNIC\Cdn\wmhlpr.dll
O2 - BHO: AdSwpr - {FCADDC14-BD46-408A-9842-CDBE1C6D37EB} - E:\张
明明\IE优化\IERBar.dll (file missing)
O3 - Toolbar: @msdxmLC.dll,-1@2052,电台(&R) -
{8E718888-423F-11D2-876E-00A0C9082467} -
C:\WINNT\System32\msdxm.ocx
O3 - Toolbar: 完美网译通 - {F43BD772-ABDD-43b7-A96A-3E9E61946EC0} -
C:\WINNT\WORLD2\TOOLBAR\hmtoolbar.dll
O3 - Toolbar: (no name) - {B580CF65-E151-49C3-B73F-70B13FCA8E86} -
(no file)
O3 - Toolbar: &IE修复专家 - {123249EB-F891-44C4-946F-450064F9080E}
- E:\张明明\IE优化\IERBar.dll (file missing)
O3 - Toolbar: (no name) - {F60C7D81-8471-4D40-AAFE-56D318F34C2D} -
(no file)
O3 - Toolbar: 虎翼DIY吧! - {0A00D11E-B1E7-44b5-AD88-C9190876AAC4}
- C:\WINNT\system32\diybar2\diybar2.dll
O3 - Toolbar: 捜狗直通车 - {DBBB7978-AF21-4EF4-9AD1-B2F4BC75696C} -
C:\PROGRA~1\P4P\ToolBar.dll
O3 - Toolbar: Infofo 工具栏 -
{D74EC18E-3DDD-4174-B1B1-949FE3B8366D} - C:\Program Files\Infofo
Bar\infofobar.dll (file missing)
O4 - HKLM\..\Run: [SKYNET Personal FireWall]
C:\PROGRA~1\SKYNET\FIREWALL\PFW.exe
O4 - HKLM\..\Run: [RavTimer] C:\PROGRA~1\RISING\RAV\RAVTIMER.EXE
O4 - HKLM\..\Run: [RavMon] C:\PROGRA~1\RISING\RAV\RAVMON.EXE
-SYSTEM
O4 - HKLM\..\Run: [CdnCtr] C:\Program Files\CNNIC\Cdn\cdnup.exe
O4 - HKLM\..\Run: [renewup] C:\Program
Files\CNNIC\Cdn\cdnrenew.exe
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common
Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKCU\..\Run: [Peanut Hull Client] C:\Program
Files\PeanutHull\phnt.exe -sa
O4 - HKCU\..\Run: [internat] internat.exe
O4 - HKCU\..\Run: [DrvMon.exe] C:\WINNT\system32\DrvMon.exe
O4 - Startup: 迅雷4.lnk = ?
O4 - Global Startup: Microsoft Office.lnk = C:\Program
Files\Microsoft Office\Office\OSA9.EXE
O8 - Extra context menu item: &使用迅雷下载 -
E:\电脑\12124\geturl.htm
O8 - Extra context menu item: &使用迅雷下载全部链接 -
E:\电脑\12124\getAllurl.htm
O8 - Extra context menu item: 上传到QQ网络硬盘 - C:\Program
Files\Tencent\QQ\AddToNetDisk.htm
O8 - Extra context menu item: 使用搜狗直通车下载 -
C:\PROGRA~1\P4P\dl.htm
O8 - Extra context menu item: 发送图片到手机 -
C:\PROGRA~1\P4P\cx.htm
O8 - Extra context menu item: 添加到QQ自定义面板 - C:\Program
Files\Tencent\QQ\AddPanel.htm
O8 - Extra context menu item: 添加到QQ表情 - C:\Program
Files\Tencent\QQ\AddEmotion.htm
O8 - Extra context menu item: 用QQ彩信发送该图片 - C:\Program
Files\Tencent\QQ\SendMMS.htm
O9 - Extra button: (no name) -
{3F686D91-4AFA-4ed1-B43F-F1DB46ED480C} -
C:\WINNT\system32\shdocvw.dll
O9 - Extra 'Tools' menuitem: Link Filter -
{3F686D91-4AFA-4ed1-B43F-F1DB46ED480C} -
C:\WINNT\system32\shdocvw.dll
O9 - Extra button: Infofo 工具栏 -
{8507326C-B5C1-4559-BB91-0919E753836F} - C:\Program Files\Infofo
Bar\infofobar.dll (file missing)
O9 - Extra 'Tools' menuitem: Infofo 工具栏 -
{8507326C-B5C1-4559-BB91-0919E753836F} - C:\Program Files\Infofo
Bar\infofobar.dll (file missing)
O9 - Extra button: SoQ - {8F67DCF3-B1DF-4A39-A787-3775784BF737} -
http://www.soq.com (file missing)
O9 - Extra button: Related -
{c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINNT\web\related.htm
O9 - Extra 'Tools' menuitem: Show &Related Links -
{c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINNT\web\related.htm
O9 - Extra button: QQ - {c95fe080-8f5d-11d2-a20b-00aa003c157b} -
C:\Program Files\Tencent\QQ\QQ.EXE
O9 - Extra 'Tools' menuitem: 腾讯QQ -
{c95fe080-8f5d-11d2-a20b-00aa003c157b} - C:\Program
Files\Tencent\QQ\QQ.EXE
O10 - Unknown file in Winsock LSP: c:\winnt\system32\cdnns.dll
O11 - Options group: [CDNCLIENT] 中文上网
O16 - DPF: {28E0FA88-ABA8-4937-A247-3031F1A11165} (Installer
Class) - http://pi.51.net/download/diybar2.cab
O16 - DPF: {2EA6D939-4445-43F1-A12B-8CB3DDA8B855} (BlueskyVideo
Control) - http://www.bluesky.cn/download/v2_60.cab
O16 - DPF: {3D8F74EE-8692-4F8F-B8D2-7522E732519E} (WebActivater
Control) - http://game.qq.com/QQGame2.cab
O16 - DPF: {56A7DC70-E102-4408-A34A-AE06FEF01586} (天下搜索) -
http://iebar.t2t2.com/iebar.cab
O16 - DPF: {7253A666-8D4A-11D7-A4DC-00E04C504779} (BDC Control) -
http://bbs.liao119.com/BDC.cab
O16 - DPF: {73E4740C-08EB-4133-896B-8D0A7C9EE3CD} (AxInputControl
Class) -
https://mybank.icbc.com.cn/icbc/perbank/AxSafeControls.cab
O16 - DPF: {9242BB35-0DB0-43AC-8DFC-8EA07E63B92A} (LiveMediaOcx
Control) - http://219.133.60.95:1080/qqtv/QQLive1.0Beta02.exe
O16 - DPF: {98A62E3F-A8C5-4EF0-8A00-C70CF9D18A89} (LoaderCore
Class) - http://tb.sogou.com/DLLoader.cab
O16 - DPF: {991481A7-4669-4E15-8C24-100404E1F5CB} (Blueskyvoice
Control) - http://www.bluesky.cn/download/blueskyvoice_60.cab
O16 - DPF: {AC3A36A8-9BFF-410A-A33D-2279FFEB69D2} (QQPlayer
Control) - http://imgcache.qq.com/music/QQMusicSetup.exe
O16 - DPF: {E787FD25-8D7C-4693-AE67-9406BC6E22DF}
(CPasswordEditCtrl
Object) -
https://tenpay.qq.com/download/qqedit.cab
O16 - DPF: {F138084D-84D7-48CD-BEA8-04772457516E} (VqqSpeedDlProxy
Class) - http://218.85.138.27/vqqsdl1009.cab
O20 - AppInit_DLLs: C:\WINNT\system32\SoDAHK.DLL
O23 - Service: pcAnywhere Host Service (awhost32) - Symantec
Corporation - C:\Program Files\Symantec\pcAnywhere\awhost32.exe
O23 - Service: Logical Disk Manager Administrative Service
(dmadmin) - VERITAS Software Corp. - C:\WINNT\System32\dmadmin.exe
O23 - Service: NetWorker Backup and Recover Server (nsrd) -
Unknown owner - (no file)
O23 - Service: NetWorker Remote Exec Service (nsrexecd) - Unknown
owner - (no file)
O23 - Service: OracleAgent80 - oracle -
d:\orant\agentbin\DBSNMP.EXE
O23 - Service: OracleClientCache80 - Unknown owner -
d:\orant\BIN\ONRSD80.EXE
O23 - Service: OracleDataGatherer - Unknown owner -
d:\orant\bin\vppdc.exe
O23 - Service: OracleExtprocAgent - Unknown owner -
d:\orant\BIN\EXTPROCT.EXE
O23 - Service: OracleNamesService80 - Unknown owner -
d:\orant\BIN\NAMES80.EXE
O23 - Service: OracleServiceORCL - Oracle Corporation -
d:\orant\bin\oracle80.exe
O23 - Service: OracleStartORCL - Unknown owner -
d:\orant\BIN\strtdb80.exe
O23 - Service: OracleTNSListener80 - Unknown owner -
d:\orant\BIN\TNSLSNR80.EXE
O23 - Service: OracleWebAssistant - Oracle Corporation -
d:\orant\bin\OWASTsvr.exe
O23 - Service: P4P Service - Sohu.com Inc. - C:\Program
Files\P4P\p2psvr.exe
O23 - Service: Peanut Hull Client Service - Vavic Network
Technology Inc. - C:\Program Files\PeanutHull\PHSvc.exe
O23 - Service: PPPoE Service (PPPoEService) - Unknown owner -
C:\PROGRA~1\EFFICI~1\ENTERN~1\app\pppoeservice.exe
O23 - Service: Rising Process Communication Center (RsCCenter) -
rising - C:\PROGRAM FILES\RISING\RAV\CCENTER.EXE
