Sohu games are also rogue?

EndurerOriginal

2006-09-101Version

On the desktop of a netizen's computer, the Sohu game icon appears inexplicably. After the "add and delete program" icon on the control panel is uninstalled, the system will go out again the next time it starts. Concurrency comes to hijackthis (you can download to the http://endurer.ys168.com) to scan the log.

The following suspicious items are found in log:

/--------------
Hijackthis_zww Chinese Version scan log v1.99.1
Saved on 21:33:37, date
Operating System: Windows XP SP2 (winnt 5.01.2600)
Browser: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Currently running process:

C:/program files/common files/update2/update.exe
C:/program files/CNNIC/CDN/cdnunins.exe

O2-BHO: adpopup-{11f09afd-75ad-4e51-ab43-e09e9351ce16}-C:/program files/common files/cpush. dll

O2-BHO: cdnforie class-{5c3853cf-c7e0-4946-b3fa-1abdb6f48108}-C:/progra ~ 1/CNNIC/CDN/cdnforie. dll

O2-BHO: quickbtn-{D1BB7CF4-4463-4e91-88D7-ECC3CE0A13B7}-C:/program files/kuzhan. dll

O4-startup Item HKLM // run: [update] C:/program files/common files/update2/update.exe

O4-startup Item HKLM // run: [cdnctr] C:/program files/CNNIC/CDN/cdnup.exe

Add a project in the right-click o8-ie menu: access the General website-C:/program files/CNNIC/CDN/cnnic.htm

O9-Additional browser buttons: Cool station navigation-{1d903167-2529-4a9b-9b6b-7a1db3a44cb5}-C:/program files/kuzhan. dll

O9-Additional buttons in the browser: Chinese surfing-{5c3853cf-c7e0-4946-b3fa-1abdb6f48108}-C:/progra ~ 1/CNNIC/CDN/cdnforie. dll

O9-Additional "tool" menu items in the browser: Chinese surfing-{5c3853cf-c7e0-4946-b3fa-1abdb6f48108}-C:/progra ~ 1/CNNIC/CDN/cdnforie. dll

O11-Options Group: [cdnclient] accessing Chinese
--------------/

Repair suggestions:

Uninstall: kuzhan, Chinese online

Process Termination: C:/program files/common files/update2/update.exe

Download cmd GUI shell from http://purpleendurer.ys168.com (GUI Command Prompt shell)
Check related folders:
/--------------
D:/tools/cmdshell> CMD/C dir "C:/program files/common files/cpush"/
The volume in drive C is not labeled.
The serial number of the volume is 1013-3afe.
C:/program files/common files/cpush directory

<Dir>.
<Dir> ..
32,913 uninst.exe
155,648 cpush0.dll
151,552 cpush. dll
3 files in 340,113 bytes

D:/tools/cmdshell> CMD/C dir "C:/program files/common files/update2"/
The volume in drive C is not labeled.
The serial number of the volume is 1013-3afe.
C:/program files/common files/update2 directory
<Dir>.
<Dir> ..
143,360 update.exe
1 file, 143,360 bytes
2 directories, 1,350,053,888 available bytes
2 directories, 1,351,753,728 available bytes
--------------/

Use WinRAR to package the backup and delete it.

Close all browsers and folders, use hijackthis to scan and fix the items listed above.

Clear temporary ie folders

Clear C:/Documents ents and settings/user/Local Settings/temp (where user is the user name)

Clear C:/Windows/temp