logfile of trend micro hijackthis v2.0.2
scan saved at 06:55:11 ص, on 06/12/2008
platform: Windows xp sp2 (winnt 5.01.2600)
msie: Internet explorer v6.00 sp2 (6.00.2900.2180)
boot mode: Normal
running processes:
C:\windows\system32\smss.exe
c:\windows\system32\winlogon.exe
c:\windows\system32\services.exe
c:\windows\system32\lsass.exe
c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe
c:\windows\system32\spoolsv.exe
c:\windows\explorer.exe
c:\windows\system32\ctfmon.exe
c:\program files\common files\microsoft shared\vs7debug\mdm.exe
c:\program files\norton internet security\engine\16.1.0.33\ccsvchst.exe
c:\windows\system32\svchost.exe
c:\program files\norton internet security\engine\16.1.0.33\ccsvchst.exe
c:\program files\common files\microsoft shared\source engine\ose.exe
c:\windows\system32\wuauclt.exe
c:\program files\internet explorer\iexplore.exe
c:\documents and settings\admin\local settings\temporary internet files\.ie5\qbyfwtaf\zyzoom_hijackthis[1].exe
r0 - hkcu\software\microsoft\internet explorer\main,start page = about:blank
r1 - hkcu\software\microsoft\internet connection wizard,shellnext =
o2 - bho: Adobe pdf reader link helper - {06849e9f-c8d7-4d59-b87d-784b7d6be0b3} - c:\program files\common files\adobe\acrobat\activex\acroiehelper.dll
o2 - bho: Realplayer download and record plugin for internet explorer - {3049c3e9-b461-4bc5-8870-4c09146192ca} - c:\program files\real\realplayer\rpbrowserrecordplugin.dll
o2 - bho: Symantec nco bho - {602adb0e-4aff-4217-8aa1-95dac4dfa408} - c:\program files\norton internet security\engine\16.1.0.33\coieplg.dll
o2 - bho: Symantec intrusion prevention - {6d53ec84-6aae-4787-aeee-f4628f01010c} - c:\program files\norton internet security\engine\16.1.0.33\ipsbho.dll
o3 - toolbar: Norton toolbar - {7febefe3-6b19-4349-98d2-ffb09d4b49ca} - c:\program files\norton internet security\engine\16.1.0.33\coieplg.dll
o4 - hkcu\..\run: [ctfmon.exe] c:\windows\system32\ctfmon.exe
o4 - hkcu\..\run: [msnmsgr] "c:\program files\windows live\messenger\msnmsgr.exe" /background
o4 - hkcu\..\run: [kamsoft] c:\windows\system32\kamsoft.exe
o4 - hkus\s-1-5-18\..\run: [ctfmon.exe] c:\windows\system32\ctfmon.exe (user 'system')
o4 - hkus\.default\..\run: [ctfmon.exe] c:\windows\system32\ctfmon.exe (user 'default user')
o4 - startup: Delxp.exe
o8 - extra context menu item: E&xport to microsoft excel - res://c:\progra~1\micros~2\office11\excel.exe/3000
o9 - extra button: Research - {92780b25-18cc-41c8-b9be-3c9c571a8263} - c:\progra~1\micros~2\office11\refiebar.dll
o9 - extra button: Messenger - {fb5f1910-f110-11d2-bb9e-00c04f795683} - c:\program files\messenger\msmsgs.exe
o9 - extra 'tools' menuitem: Windows messenger - {fb5f1910-f110-11d2-bb9e-00c04f795683} - c:\program files\messenger\msmsgs.exe
o16 - dpf: {17492023-c23a-453e-a040-c7c580bbf700} (windows genuine advantage validation tool) -
o16 - dpf: {6414512b-b978-451d-a0d8-fcfdf33e833c} (wuwebcontrol class) -
o23 - service: Norton internet security - symantec corporation - c:\program files\norton internet security\engine\16.1.0.33\ccsvchst.exe
--
end of file - 3359 bytes
