logfile of trend micro hijackthis v2.0.2
scan saved at 01:35:44 م, on 03/12/2008
platform: Windows xp sp3 (winnt 5.01.2600)
msie: Internet explorer v7.00 (7.00.6000.16735)
boot mode: Normal
running processes:
C:\windows\system32\smss.exe
c:\windows\system32\winlogon.exe
c:\windows\system32\services.exe
c:\windows\system32\lsass.exe
c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe
c:\program files\widcomm\bluetooth software\bin\btwdins.exe
c:\windows\system32\spoolsv.exe
c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe
c:\program files\winpoet broadband connection\wros.exe
c:\windows\system32\wscntfy.exe
c:\windows\explorer.exe
c:\program files\common files\real\update_ob\realsched.exe
c:\program files\synaptics\syntp\syntpenh.exe
c:\windows\rthdcpl.exe
c:\windows\system32\igfxpers.exe
c:\windows\system32\igfxtray.exe
c:\windows\system32\hkcmd.exe
c:\windows\system32\igfxsrvc.exe
c:\progra~1\launch~1\qtzgacer.exe
c:\program files\nokia\nokia pc suite 6\launchapplication.exe
c:\progra~1\mywebs~1\bar\2.bin\mwsoemon.exe
c:\program files\hp\hp software update\hpwuschd2.exe
c:\program files\adobe\reader 8.0\reader\reader_sl.exe
c:\program files\pc connectivity solution\servicelayer.exe
c:\progra~1\mywebs~1\bar\2.bin\m3srchmn.exe
c:\program files\internet download manager\idman.exe
c:\windows\system32\ctfmon.exe
c:\program files\skype\phone\skype.exe
c:\program files\widcomm\bluetooth software\bttray.exe
c:\program files\hp\digital imaging\bin\hpqtra08.exe
c:\program files\cafe\cafeagent.exe
c:\program files\internet download manager\iemonitor.exe
c:\windows\system32\igfxext.exe
c:\documents and settings\tazebama.dl_
c:\docume~1\abusha~1\locals~1\temp\rtkbtmnt.exe
c:\program files\hp\digital imaging\bin\hpqste08.exe
c:\windows\system32\wuauclt.exe
c:\program files\mozilla firefox\firefox.exe
c:\program files\trend micro\hijackthis\hijackthis.exe
r1 - hklm\software\microsoft\internet explorer\main,default_page_url =
r1 - hklm\software\microsoft\internet explorer\main,default_search_url =
r1 - hklm\software\microsoft\internet explorer\main,search page =
r0 - hklm\software\microsoft\internet explorer\main,start page =
r3 - urlsearchhook: Defaultsearchhook class - {c94e154b-1459-4a47-966b-4b843befc7db} - c:\program files\asksearch\bin\defaultsearch.dll
r3 - urlsearchhook: (no name) - {00a6faf6-072e-44cf-8957-5838f569a31d} - c:\program files\mywebsearch\srchastt\2.bin\mwssrcas.dll
o2 - bho: Idm helper - {0055c089-8582-441b-a0bf-17b458c2a3a8} - c:\program files\internet download manager\idmiecc.dll
o2 - bho: Mywebsearch search assistant bho - {00a6faf1-072e-44cf-8957-5838f569a31d} - c:\program files\mywebsearch\srchastt\2.bin\mwssrcas.dll
o2 - bho: Adobe pdf reader link helper - {06849e9f-c8d7-4d59-b87d-784b7d6be0b3} - c:\program files\common files\adobe\acrobat\activex\acroiehelper.dll
o2 - bho: Mwsbar bho - {07b18ea1-a523-4961-b6bb-170de4475cca} - c:\program files\mywebsearch\bar\2.bin\mwsbar.dll
o2 - bho: Askbar bho - {201f27d4-3704-41d6-89c1-aa35e39143ed} - c:\program files\askbardis\bar\bin\askbar.dll
o2 - bho: Realplayer download and record plugin for internet explorer - {3049c3e9-b461-4bc5-8870-4c09146192ca} - c:\program files\real\realplayer\rpbrowserrecordplugin.dll
o2 - bho: (no name) - {7e853d72-626a-48ec-a868-ba8d5e23e045} - (no file)
o2 - bho: مساعد تسجيل الدخول إلى windows live - {9030d464-4c02-4abf-8ecc-5164760863c6} - c:\program files\common files\microsoft shared\windows live\windowslivelogin.dll
o3 - toolbar: (no name) - {381ffde8-2394-4f90-b10d-fc6124a40f8c} - (no file)
o3 - toolbar: Foxit toolbar - {3041d03e-fd4b-44e0-b742-2d9b88305f98} - c:\program files\askbardis\bar\bin\askbar.dll
o3 - toolbar: My web search - {07b18ea9-a523-4961-b6bb-170de4475cca} - c:\program files\mywebsearch\bar\2.bin\mwsbar.dll
o4 - hklm\..\run: [vptray] c:\progra~1\symant~1\vptray.exe
o4 - hklm\..\run: [tkbellexe] "c:\program files\common files\real\update_ob\realsched.exe" -osboot
o4 - hklm\..\run: [syntpenh] c:\program files\synaptics\syntp\syntpenh.exe
o4 - hklm\..\run: [rthdcpl] rthdcpl.exe
o4 - hklm\..\run: [plfset] rundll32.exe c:\windows\plfset.dll,plfdefsetting
o4 - hklm\..\run: [persistence] c:\windows\system32\igfxpers.exe
o4 - hklm\..\run: [igfxtray] c:\windows\system32\igfxtray.exe
o4 - hklm\..\run: [hotkeyscmds] c:\windows\system32\hkcmd.exe
o4 - hklm\..\run: [azmixersel] c:\program files\realtek\installshield\azmixersel.exe
o4 - hklm\..\run: [alcmtr] alcmtr.exe
o4 - hklm\..\run: [lmanager] c:\progra~1\launch~1\qtzgacer.exe
o4 - hklm\..\run: [pcsuitetrayapplication] c:\program files\nokia\nokia pc suite 6\launchapplication.exe -startup
o4 - hklm\..\run: [mywebsearch plugin] rundll32 c:\progra~1\mywebs~1\bar\2.bin\m3plugin.dll,upf
o4 - hklm\..\run: [mywebsearch email plugin] c:\progra~1\mywebs~1\bar\2.bin\mwsoemon.exe
o4 - hklm\..\run: [hp software update] c:\program files\hp\hp software update\hpwuschd2.exe
o4 - hklm\..\run: [adobe reader speed launcher] "c:\program files\adobe\reader 8.0\reader\reader_sl.exe"
o4 - hklm\..\run: [my web search bar search scope monitor] "c:\progra~1\mywebs~1\bar\2.bin\m3srchmn.exe" /m=2 /w
o4 - hkcu\..\run: [idman] c:\program files\internet download manager\idman.exe /onboot
o4 - hkcu\..\run: [ctfmon.exe] c:\windows\system32\ctfmon.exe
o4 - hkcu\..\run: [skype] "c:\program files\skype\phone\skype.exe" /nosplash /minimized
o4 - hkcu\..\run: [mywebsearch email plugin] c:\progra~1\mywebs~1\bar\2.bin\mwsoemon.exe
o4 - hkus\s-1-5-19\..\run: [ctfmon.exe] c:\windows\system32\ctfmon.exe (user 'local service')
o4 - hkus\s-1-5-20\..\run: [ctfmon.exe] c:\windows\system32\ctfmon.exe (user 'network service')
o4 - hkus\s-1-5-18\..\run: [ctfmon.exe] c:\windows\system32\ctfmon.exe (user 'system')
o4 - hkus\.default\..\run: [ctfmon.exe] c:\windows\system32\ctfmon.exe (user 'default user')
o4 - s-1-5-18 startup: Cafe.lnk = c:\program files\cafe\cafeagent.exe (user 'system')
o4 - .default startup: Cafe.lnk = c:\program files\cafe\cafeagent.exe (user 'default user')
o4 - startup: Cafe.lnk = c:\program files\cafe\cafeagent.exe
o4 - global startup: Adobe gamma loader.lnk = c:\program files\common files\adobe\calibration\adobe gamma loader.exe
o4 - global startup: Bluetooth.lnk = ?
O4 - global startup: Hp digital imaging monitor.lnk = c:\program files\hp\digital imaging\bin\hpqtra08.exe
o4 - global startup: Cafe.lnk = c:\program files\cafe\cafeagent.exe
o8 - extra context menu item: &search -
o8 - extra context menu item: &تصدير إلى microsoft excel - res://c:\progra~1\micros~2\office11\excel.exe/3000
o8 - extra context menu item: Send to &bluetooth device... - c:\program files\widcomm\bluetooth software\btsendto_ie_ctx.htm
o8 - extra context menu item: تحميل الكل بـ إنترنت داونلود مانيجر - c:\program files\internet download manager\iegetall.htm
o8 - extra context menu item: تحميل بـ إنترنت داونلود مانيجر - c:\program files\internet download manager\ieext.htm
o8 - extra context menu item: تحميل محتوى فيديو (إف.إل.في) بـ إنترنت داونلود مانيجر - c:\program files\internet download manager\iegetvl.htm
o9 - extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - c:\windows\bdoscandel.exe
o9 - extra 'tools' menuitem: Uninstall bitdefender online scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - c:\windows\bdoscandel.exe
o9 - extra button: بحث - {92780b25-18cc-41c8-b9be-3c9c571a8263} - c:\progra~1\micros~2\office11\refiebar.dll
o9 - extra button: @btrez.dll,-4015 - {cca281ca-c863-46ef-9331-5c8d4460577f} - c:\program files\widcomm\bluetooth software\btsendto_ie.htm
o9 - extra 'tools' menuitem: @btrez.dll,-12650 - {cca281ca-c863-46ef-9331-5c8d4460577f} - c:\program files\widcomm\bluetooth software\btsendto_ie.htm
o9 - extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - c:\windows\network diagnostic\xpnetdiag.exe
o9 - extra 'tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - c:\windows\network diagnostic\xpnetdiag.exe
o9 - extra button: Messenger - {fb5f1910-f110-11d2-bb9e-00c04f795683} - c:\program files\messenger\msmsgs.exe
o9 - extra 'tools' menuitem: Windows messenger - {fb5f1910-f110-11d2-bb9e-00c04f795683} - c:\program files\messenger\msmsgs.exe
o16 - dpf: {5d86ddb5-bdf9-441b-9e9e-d4730f4ee499} (bdscanonline control) -
o18 - protocol: Skype4com - {ffc8b962-9b40-4dff-9458-1830c7dd7f5d} - c:\progra~1\common~1\skype\skype4~1.dll
o23 - service: Bitdefender arrakis server (arrakis3) - unknown owner - c:\program files\common files\bitdefender\bitdefender arrakis server\bin\arrakis3.exe (file missing)
o23 - service: Bluetooth service (btwdins) - broadcom corporation. - c:\program files\widcomm\bluetooth software\bin\btwdins.exe
o23 - service: Symantec antivirus definition watcher (defwatch) - unknown owner - c:\program files\symantec antivirus\defwatch.exe (file missing)
o23 - service: My web search service (mywebsearchservice) - mywebsearch.com - c:\progra~1\mywebs~1\bar\2.bin\mwssvc.exe
o23 - service: Savroam (savroam) - unknown owner - c:\program files\symantec antivirus\savroam.exe (file missing)
o23 - service: Servicelayer - nokia. - c:\program files\pc connectivity solution\servicelayer.exe
o23 - service: Symantec antivirus - unknown owner - c:\program files\symantec antivirus\rtvscan.exe (file missing)
o23 - service: Winpppoverethernet - ivasion, a routerware company - c:\program files\winpoet broadband connection\wros.exe
--
end of file - 10011 bytes
