logfile of trend micro hijackthis v2.0.2
scan saved at 05:42:05 م, on 2008-10-25
platform: Windows xp sp2 (winnt 5.01.2600)
msie: Internet explorer v7.00 (7.00.6000.16735)
boot mode: Normal
running processes:
C:\windows\system32\smss.exe
c:\windows\system32\winlogon.exe
c:\windows\system32\services.exe
c:\windows\system32\lsass.exe
c:\windows\system32\ibmpmsvc.exe
c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe
c:\program files\intel\wifi\bin\s24evmon.exe
c:\windows\system32\spoolsv.exe
c:\windows\explorer.exe
c:\program files\kaspersky lab\kaspersky internet security 2009\avp.exe
c:\windows\system32\igfxtray.exe
c:\windows\system32\hkcmd.exe
c:\program files\java\jre1.6.0_07\bin\jusched.exe
c:\program files\intel\wifi\bin\evteng.exe
c:\program files\intel\wifi\bin\zcfgsvc.exe
c:\program files\hotspot shield\bin\openvpnas.exe
c:\program files\common files\intel\wirelesscommon\ifrmewrk.exe
c:\program files\common files\intel\wirelesscommon\regsrvc.exe
c:\program files\kaspersky lab\kaspersky internet security 2009\avp.exe
c:\program files\common files\real\update_ob\realsched.exe
c:\windows\system32\svchost.exe
c:\windows\system32\ctfmon.exe
c:\program files\windows live\messenger\msnmsgr.exe
c:\windows\system32\wbem\unsecapp.exe
c:\windows\system32\wscntfy.exe
c:\windows\system32\svchost.exe
c:\documents and settings\administrator\desktop\zyzoom_hijackthis.exe
r1 - hklm\software\microsoft\internet explorer\main,default_page_url =
r1 - hklm\software\microsoft\internet explorer\main,default_search_url =
r1 - hklm\software\microsoft\internet explorer\main,search page =
r0 - hklm\software\microsoft\internet explorer\main,start page = about:blank
r0 - hkcu\software\microsoft\internet explorer\main,local page =
r0 - hklm\software\microsoft\internet explorer\main,local page =
r1 - hkcu\software\microsoft\internet explorer\main,window title = microsoft internet explorer
o2 - bho: Ievkbdbho - {59273ab4-e7d3-40f9-a1a8-6fa9cca1862c} - c:\program files\kaspersky lab\kaspersky internet security 2009\ievkbd.dll
o2 - bho: Ssvhelper class - {761497bb-d6f0-462c-b6eb-d4daf1d92d43} - c:\program files\java\jre1.6.0_07\bin\ssv.dll
o2 - bho: (no name) - {7e853d72-626a-48ec-a868-ba8d5e23e045} - (no file)
o2 - bho: مساعد تسجيل الدخول إلى windows live - {9030d464-4c02-4abf-8ecc-5164760863c6} - c:\program files\common files\microsoft shared\windows live\windowslivelogin.dll
o4 - hklm\..\run: [avp] "c:\program files\kaspersky lab\kaspersky internet security 2009\avp.exe"
o4 - hklm\..\run: [tkbellexe] "c:\program files\common files\real\update_ob\realsched.exe" -osboot
o4 - hkcu\..\run: [ctfmon.exe] c:\windows\system32\ctfmon.exe
o4 - hkcu\..\run: [msnmsgr] "c:\program files\windows live\messenger\msnmsgr.exe" /background
o4 - hkus\s-1-5-18\..\run: [ctfmon.exe] c:\windows\system32\ctfmon.exe (user 'system')
o4 - hkus\.default\..\run: [ctfmon.exe] c:\windows\system32\ctfmon.exe (user 'default user')
o8 - extra context menu item: أضافة إلى مانع الأعلانات - c:\program files\kaspersky lab\kaspersky internet security 2009\ie_banner_deny.htm
o9 - extra button: (no name) - {08b0e5c0-4fcb-11cf-aaa5-00401c608501} - c:\program files\java\jre1.6.0_07\bin\ssv.dll
o9 - extra 'tools' menuitem: Sun java console - {08b0e5c0-4fcb-11cf-aaa5-00401c608501} - c:\program files\java\jre1.6.0_07\bin\ssv.dll
o9 - extra button: Web traffic protection statistics - {1f460357-8a94-4d71-9ca3-aa4acf32ed8e} - c:\program files\kaspersky lab\kaspersky internet security 2009\scieplgn.dll
o9 - extra button: Messenger - {fb5f1910-f110-11d2-bb9e-00c04f795683} - c:\program files\messenger\msmsgs.exe
o9 - extra 'tools' menuitem: Windows messenger - {fb5f1910-f110-11d2-bb9e-00c04f795683} - c:\program files\messenger\msmsgs.exe
o10 - unknown file in winsock lsp: C:\windows\system32\nwprovau.dll
o16 - dpf: {867e13f2-7f31-44fb-ac97-cd38e0dc46ef} (hardwaredetection control) -
o23 - service: Kaspersky internet security (avp) - kaspersky lab - c:\program files\kaspersky lab\kaspersky internet security 2009\avp.exe
o23 - service: Intel® proset/wireless event log (evteng) - intel(r) corporation - c:\program files\intel\wifi\bin\evteng.exe
o23 - service: Hotspot shield service (hotspotshieldservice) - unknown owner - c:\program files\hotspot shield\bin\openvpnas.exe
o23 - service: Ibm pm service (ibmpmsvc) - unknown owner - c:\windows\system32\ibmpmsvc.exe
o23 - service: Ma-config service (maconfservice) - cybelsoft - c:\program files\ma-config.com\maconfservice.exe
o23 - service: Intel® proset/wireless registry service (regsrvc) - intel(r) corporation - c:\program files\common files\intel\wirelesscommon\regsrvc.exe
o23 - service: Remote packet capture protocol v.0 (experimental) (rpcapd) - cace technologies - c:\program files\winpcap\rpcapd.exe
o23 - service: Intel® proset/wireless wifi service (s24eventmonitor) - intel(r) corporation - c:\program files\intel\wifi\bin\s24evmon.exe
o23 - service: Servicelayer - nokia. - c:\program files\pc connectivity solution\servicelayer.exe
--
end of file - 5377 bytes
k: