logfile of trend micro hijackthis v2.0.2
scan saved at 04:57:35 م, on 24/01/2009
platform: Windows xp sp2 (winnt 5.01.2600)
msie: Internet explorer v7.00 (7.00.6000.16762)
boot mode: Normal
running processes:
C:\windows\system32\smss.exe
c:\windows\system32\winlogon.exe
c:\windows\system32\services.exe
c:\windows\system32\lsass.exe
c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe
c:\program files\alwil software\avast4\aswupdsv.exe
c:\program files\alwil software\avast4\ashserv.exe
c:\windows\system32\spoolsv.exe
c:\program files\bonjour\mdnsresponder.exe
c:\program files\diskeeper corporation\diskeeper\dkservice.exe
c:\program files\java\jre6\bin\jqs.exe
c:\program files\analog devices\soundmax\smagent.exe
c:\windows\system32\svchost.exe
c:\windows\system32\tuprogst.exe
c:\program files\analog devices\soundmax\smax4pnp.exe
c:\program files\analog devices\soundmax\smax4.exe
c:\program files\microsoft hardware\keyboard\type32.exe
c:\program files\java\jre6\bin\jusched.exe
c:\progra~1\alwils~1\avast4\ashdisp.exe
c:\windows\system32\ctfmon.exe
c:\windows\explorer.exe
c:\program files\alwil software\avast4\ashmaisv.exe
c:\program files\alwil software\avast4\ashwebsv.exe
c:\program files\trend micro\hijackthis\hijackthis.exe
r1 - hklm\software\microsoft\internet explorer\main,default_page_url =
r1 - hklm\software\microsoft\internet explorer\main,default_search_url =
r1 - hklm\software\microsoft\internet explorer\main,search page =
r0 - hklm\software\microsoft\internet explorer\main,start page =
r1 - hkcu\software\microsoft\windows\currentversion\internet settings,proxyoverride = *.local
o2 - bho: Acroiehelperstub - {18df081c-e8ad-4283-a596-fa578c2ebdc3} - c:\program files\common files\adobe\acrobat\activex\acroiehelpershim.dll
o2 - bho: Wormradar.com iesiteblocker.navfilter - {3ca2f312-6f6e-4b53-a66e-4e65e497c8c0} - (no file)
o2 - bho: Java(tm) plug-in ssv helper - {761497bb-d6f0-462c-b6eb-d4daf1d92d43} - c:\program files\java\jre6\bin\ssv.dll
o2 - bho: مساعد تسجيل الدخول إلى windows live - {9030d464-4c02-4abf-8ecc-5164760863c6} - c:\program files\common files\microsoft shared\windows live\windowslivelogin.dll
o2 - bho: Java(tm) plug-in 2 ssv helper - {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll
o2 - bho: Jqsiestartdetectorimpl - {e7e6f031-17ce-4c07-bc86-eabfe594f69c} - c:\program files\java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
o2 - bho: Epsontoolbandkicker class - {e99421fb-68dd-40f0-b4ac-b7027cae2f1a} - c:\program files\epson\epson web-to-page\epson web-to-page.dll
o3 - toolbar: Epson web-to-page - {ee5d279f-081b-4404-994d-c6b60aaeba6d} - c:\program files\epson\epson web-to-page\epson web-to-page.dll
o3 - toolbar: Stylertoolbar - {d2f8f919-690b-4ea2-9fa7-a203d1e04f75} - c:\program files\styler\tb\stylertb.dll
o4 - hklm\..\run: [soundmaxpnp] c:\program files\analog devices\soundmax\smax4pnp.exe
o4 - hklm\..\run: [soundmax] "c:\program files\analog devices\soundmax\smax4.exe" /tray
o4 - hklm\..\run: [intellitype] "c:\program files\microsoft hardware\keyboard\type32.exe"
o4 - hklm\..\run: [sunjavaupdatesched] "c:\program files\java\jre6\bin\jusched.exe"
o4 - hklm\..\run: [avast!] c:\progra~1\alwils~1\avast4\ashdisp.exe
o4 - hkcu\..\run: [time watch] c:\program files\time watch\timewatch.exe hide
o4 - hkcu\..\run: [ctfmon.exe] c:\windows\system32\ctfmon.exe
o4 - hkcu\..\run: [epson stylus cx4300 series] c:\windows\system32\spool\drivers\w32x86\3\e_faticar.exe /fu "c:\windows\temp\e_sa8.tmp" /ef "hkcu"
o4 - hkus\s-1-5-19\..\run: [ctfmon.exe] c:\windows\system32\ctfmon.exe (user 'local service')
o4 - hkus\s-1-5-20\..\run: [ctfmon.exe] c:\windows\system32\ctfmon.exe (user 'network service')
o4 - hkus\s-1-5-18\..\run: [ctfmon.exe] c:\windows\system32\ctfmon.exe (user 'system')
o4 - hkus\.default\..\run: [ctfmon.exe] c:\windows\system32\ctfmon.exe (user 'default user')
o4 - startup: Ela-salaty.lnk = c:\program files\ela-salaty\salaty.exe
o4 - startup: Styler.lnk = ?
O8 - extra context menu item: &تصدير إلى microsoft excel - res://c:\progra~1\micros~2\office11\excel.exe/3000
o9 - extra button: بحث - {92780b25-18cc-41c8-b9be-3c9c571a8263} - c:\progra~1\micros~2\office11\refiebar.dll
o9 - extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - c:\windows\network diagnostic\xpnetdiag.exe
o9 - extra 'tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - c:\windows\network diagnostic\xpnetdiag.exe
o9 - extra button: Messenger - {fb5f1910-f110-11d2-bb9e-00c04f795683} - c:\program files\messenger\msmsgs.exe
o9 - extra 'tools' menuitem: Windows messenger - {fb5f1910-f110-11d2-bb9e-00c04f795683} - c:\program files\messenger\msmsgs.exe
o20 - winlogon notify: Antiwpa - c:\windows\system32\antiwpa.dll
o23 - service: Avast! Iavs4 control service (aswupdsv) - alwil software - c:\program files\alwil software\avast4\aswupdsv.exe
o23 - service: Avast! Antivirus - alwil software - c:\program files\alwil software\avast4\ashserv.exe
o23 - service: Avast! Mail scanner - alwil software - c:\program files\alwil software\avast4\ashmaisv.exe
o23 - service: Avast! Web scanner - alwil software - c:\program files\alwil software\avast4\ashwebsv.exe
o23 - service: ##id_string1.6844f930_1628_4223_b5cc_5bb94b879762## (bonjour service) - apple computer, inc. - c:\program files\bonjour\mdnsresponder.exe
o23 - service: Diskeeper - diskeeper corporation - c:\program files\diskeeper corporation\diskeeper\dkservice.exe
o23 - service: Flexnet licensing service - macrovision europe ltd. - c:\program files\common files\macrovision shared\flexnet publisher\fnplicensingservice.exe
o23 - service: Java quick starter (javaquickstarterservice) - sun microsystems, inc. - c:\program files\java\jre6\bin\jqs.exe
o23 - service: Servicelayer - nokia. - c:\program files\pc connectivity solution\servicelayer.exe
o23 - service: Soundmax agent service (soundmax agent service (default)) - analog devices, inc. - c:\program files\analog devices\soundmax\smagent.exe
o23 - service: Tuneup drive defrag service (tuneup.defrag) - tuneup software - c:\windows\system32\tuneupdefragservice.exe
o23 - service: Tuneup program statistics service (tuneup.programstatisticssvc) - tuneup software - c:\windows\system32\tuprogst.exe
--
end of file - 6544 bytes
