logfile of trend micro hijackthis v2.0.2
scan saved at 4:59:11 pm, on 4/9/2009
platform: Windows xp sp3 (winnt 5.01.2600)
msie: Internet explorer v6.00 (6.00.2900.5512)
boot mode: Normal
running processes:
C:\windows\system32\smss.exe
c:\windows\system32\winlogon.exe
c:\windows\system32\services.exe
c:\windows\system32\lsass.exe
c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe
c:\windows\system32\spoolsv.exe
c:\windows\explorer.exe
c:\program files\eset\eset nod32 antivirus\egui.exe
c:\program files\unlocker\unlockerassistant.exe
c:\windows\system32\wscript.exe
c:\windows\system32\ctfmon.exe
c:\program files\internet download manager\idman.exe
c:\program files\eset\eset nod32 antivirus\ekrn.exe
c:\program files\internet download manager\iemonitor.exe
c:\program files\mozilla firefox\firefox.exe
c:\program files\avramovic web solutions\imageshack hotspot\ishs.exe
c:\documents and settings\raouf_dz\desktop\zyzoom_hijackthis.exe
r1 - hklm\software\microsoft\internet explorer\main,default_page_url =
r1 - hklm\software\microsoft\internet explorer\main,default_search_url =
r1 - hklm\software\microsoft\internet explorer\main,search page =
r0 - hklm\software\microsoft\internet explorer\main,start page =
o2 - bho: Idm helper - {0055c089-8582-441b-a0bf-17b458c2a3a8} - c:\program files\internet download manager\idmiecc.dll
o2 - bho: Ssvhelper class - {761497bb-d6f0-462c-b6eb-d4daf1d92d43} - c:\program files\java\jre1.6.0_07\bin\ssv.dll
o4 - hklm\..\run: [imjpmig8.1] "c:\windows\ime\imjp8_1\imjpmig.exe" /spoil /remadvdef /migration32
o4 - hklm\..\run: [phime2002async] c:\windows\system32\ime\tintlgnt\tintsetp.exe /sync
o4 - hklm\..\run: [phime2002a] c:\windows\system32\ime\tintlgnt\tintsetp.exe /imename
o4 - hklm\..\run: [egui] "c:\program files\eset\eset nod32 antivirus\egui.exe" /hide /waitservice
o4 - hklm\..\run: [unlockerassistant] "c:\program files\unlocker\unlockerassistant.exe"
o4 - hklm\..\run: [regdiit] c:\windows\system32\winxp.exe
o4 - hklm\..\run: [ctfmon] c:\windows\system32\wscript.exe /e:vbs c:\windows\system32\winjpg.jpg
o4 - hklm\..\runonce: [noie4stubprocessing] c:\windows\system32\reg.exe delete "hklm\software\microsoft\active setup\installed components" /v "noie4stubprocessing" /f
o4 - hkcu\..\run: [ctfmon.exe] c:\windows\system32\ctfmon.exe
o4 - hkcu\..\run: [idman] c:\program files\internet download manager\idman.exe /onboot
o4 - hkus\s-1-5-19\..\run: [ctfmon.exe] c:\windows\system32\ctfmon.exe (user 'local service')
o4 - hkus\s-1-5-20\..\run: [ctfmon.exe] c:\windows\system32\ctfmon.exe (user 'network service')
o4 - hkus\s-1-5-18\..\run: [ctfmon.exe] c:\windows\system32\ctfmon.exe (user 'system')
o4 - hkus\.default\..\run: [ctfmon.exe] c:\windows\system32\ctfmon.exe (user 'default user')
o4 - startup: Internet download manager.lnk = c:\program files\internet download manager\idman.exe
o8 - extra context menu item: Download all links with idm - c:\program files\internet download manager\iegetall.htm
o8 - extra context menu item: Download flv video content with idm - c:\program files\internet download manager\iegetvl.htm
o8 - extra context menu item: Download with idm - c:\program files\internet download manager\ieext.htm
o9 - extra button: (no name) - {08b0e5c0-4fcb-11cf-aaa5-00401c608501} - c:\program files\java\jre1.6.0_07\bin\ssv.dll
o9 - extra 'tools' menuitem: Sun java console - {08b0e5c0-4fcb-11cf-aaa5-00401c608501} - c:\program files\java\jre1.6.0_07\bin\ssv.dll
o9 - extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - c:\windows\network diagnostic\xpnetdiag.exe
o9 - extra 'tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - c:\windows\network diagnostic\xpnetdiag.exe
o9 - extra button: Messenger - {fb5f1910-f110-11d2-bb9e-00c04f795683} - c:\program files\messenger\msmsgs.exe
o9 - extra 'tools' menuitem: Windows messenger - {fb5f1910-f110-11d2-bb9e-00c04f795683} - c:\program files\messenger\msmsgs.exe
o17 - hklm\system\ccs\services\tcpip\..\{f9491f86-15f1-415d-ae6e-5ffcab5c56b7}: Nameserver = 208.67.222.222 193.55.10.102
o20 - winlogon notify: Antiwpa - c:\windows\system32\antiwpa.dll
o23 - service: Eset http server (ehttpsrv) - eset - c:\program files\eset\eset nod32 antivirus\ehttpsrv.exe
o23 - service: Eset service (ekrn) - eset - c:\program files\eset\eset nod32 antivirus\ekrn.exe
--
end of file - 4612 bytes
