logfile of trend micro hijackthis v2.0.2
scan saved at 20:24:05, on 11/06/2009
platform: Windows vista (winnt 6.00.1904)
msie: Internet explorer v7.00 (7.00.6000.16851)
boot mode: Normal
running processes:
C:\windows\system32\dwm.exe
c:\windows\explorer.exe
c:\windows\system32\taskeng.exe
c:\windows\system32\igfxtray.exe
c:\windows\system32\hkcmd.exe
c:\windows\system32\igfxpers.exe
c:\program files\synaptics\syntp\syntpenh.exe
c:\program files\camera assistant software for toshiba\traybar.exe
c:\program files\nokia\nokia pc suite 6\launchapplication.exe
c:\program files\nero\nero 7\incd\nbhgui.exe
c:\windows\system32\igfxsrvc.exe
c:\program files\nero\nero 7\incd\incd.exe
c:\program files\hiyo\bin\hiyo.exe
c:\program files\microsoft office\office12\groovemonitor.exe
c:\program files\kaspersky lab\kaspersky internet security 2009\avp.exe
c:\program files\common files\real\update_ob\realsched.exe
c:\program files\windows sidebar\sidebar.exe
c:\program files\camera assistant software for toshiba\cec_main.exe
c:\program files\yahoo!\search protection\searchprotection.exe
c:\program files\windows live\messenger\msnmsgr.exe
c:\windows\system32\mobsync.exe
c:\program files\yahoo!\messenger\ymsgr_tray.exe
c:\program files\internet explorer\ieuser.exe
c:\program files\internet explorer\iexplore.exe
c:\program files\windows live\toolbar\wltuser.exe
c:\windows\system32\wbem\unsecapp.exe
c:\windows\system32\macromed\flash\flashutil10b.exe
f:\مجلد جديد (4)\اداة الهايجك\hijackthis.exe
r0 - hkcu\software\microsoft\internet explorer\main,start page =
r1 - hklm\software\microsoft\internet explorer\main,default_page_url =
r1 - hklm\software\microsoft\internet explorer\main,default_search_url =
r1 - hklm\software\microsoft\internet explorer\main,search page =
r0 - hkcu\software\microsoft\internet explorer\toolbar,linksfoldername =
o1 - hosts: ::1 localhost
o2 - bho: (no name) - {02478d38-c3f9-4efb-9b51-7695eca05670} - (no file)
o2 - bho: Adobe pdf reader link helper - {06849e9f-c8d7-4d59-b87d-784b7d6be0b3} - c:\program files\common files\adobe\acrobat\activex\acroiehelper.dll
o2 - bho: Realplayer download and record plugin for internet explorer - {3049c3e9-b461-4bc5-8870-4c09146192ca} - c:\program files\real\realplayer\rpbrowserrecordplugin.dll
o2 - bho: Ievkbdbho - {59273ab4-e7d3-40f9-a1a8-6fa9cca1862c} - c:\program files\kaspersky lab\kaspersky internet security 2009\ievkbd.dll
o2 - bho: (no name) - {5c255c8a-e604-49b4-9d64-90988571cecb} - (no file)
o2 - bho: Search helper - {6ebf7485-159f-4bff-a14f-b9e3aac4465b} - c:\program files\microsoft\search enhancement pack\search helper\sepsearchhelperie.dll
o2 - bho: Groove gfs browser helper - {72853161-30c5-4d22-b7f9-0bbc1d38a37e} - c:\program files\microsoft office\office12\grooveshellextensions.dll
o2 - bho: Windows live sign-in helper - {9030d464-4c02-4abf-8ecc-5164760863c6} - c:\program files\common files\microsoft shared\windows live\windowslivelogin.dll
o2 - bho: Windows live toolbar helper - {e15a8dc0-8516-42a1-81ea-dc94ec1acf10} - c:\program files\windows live\toolbar\wltcore.dll
o3 - toolbar: &windows live toolbar - {21fa44ef-376d-4d53-9b0f-8a89d3229068} - c:\program files\windows live\toolbar\wltcore.dll
o4 - hklm\..\run: [igfxtray] c:\windows\system32\igfxtray.exe
o4 - hklm\..\run: [hotkeyscmds] c:\windows\system32\hkcmd.exe
o4 - hklm\..\run: [persistence] c:\windows\system32\igfxpers.exe
o4 - hklm\..\run: [syntpenh] c:\program files\synaptics\syntp\syntpenh.exe
o4 - hklm\..\run: [camera assistant software] "c:\program files\camera assistant software for toshiba\traybar.exe" /start
o4 - hklm\..\run: [adobe reader speed launcher] "c:\program files\adobe\reader 8.0\reader\reader_sl.exe"
o4 - hklm\..\run: [pcsuitetrayapplication] c:\program files\nokia\nokia pc suite 6\launchapplication.exe -startup
o4 - hklm\..\run: [nerofiltercheck] c:\program files\common files\ahead\lib\nerocheck.exe
o4 - hklm\..\run: [securdisc] c:\program files\nero\nero 7\incd\nbhgui.exe
o4 - hklm\..\run: [incd] c:\program files\nero\nero 7\incd\incd.exe
o4 - hklm\..\run: [hiyo] c:\program files\hiyo\bin\hiyo.exe /runfromstartup
o4 - hklm\..\run: [groovemonitor] "c:\program files\microsoft office\office12\groovemonitor.exe"
o4 - hklm\..\run: [avp] "c:\program files\kaspersky lab\kaspersky internet security 2009\avp.exe"
o4 - hklm\..\run: [tkbellexe] "c:\program files\common files\real\update_ob\realsched.exe" -osboot
o4 - hkcu\..\run: [sidebar] c:\program files\windows sidebar\sidebar.exe /autorun
o4 - hkcu\..\run: [msnmsgr] "c:\program files\windows live\messenger\msnmsgr.exe" /background
o4 - hkcu\..\run: [search protection] c:\program files\yahoo!\search protection\searchprotection.exe
o4 - hkcu\..\run: [messenger (yahoo!)] "c:\program files\yahoo!\messenger\yahoomessenger.exe" -quiet
o4 - hkus\s-1-5-18\..\run: [nokia.pcsync] c:\program files\nokia\nokia pc suite 6\pcsync2.exe /nodialog (user 'system')
o4 - hkus\.default\..\run: [nokia.pcsync] c:\program files\nokia\nokia pc suite 6\pcsync2.exe /nodialog (user 'default user')
o4 - global startup: Adobe gamma loader.lnk = c:\program files\common files\adobe\calibration\adobe gamma loader.exe
o4 - global startup: Bluetooth monitor.lnk = ?
O8 - extra context menu item: Add to banner ad blocker - c:\program files\kaspersky lab\kaspersky internet security 2009\ie_banner_deny.htm
o8 - extra context menu item: E&xport to microsoft excel - res://c:\progra~1\micros~2\office11\excel.exe/3000
o8 - extra context menu item: ت&صدير إلى microsoft excel - res://c:\progra~1\micros~2\office12\excel.exe/3000
o9 - extra button: Web traffic protection statistics - {1f460357-8a94-4d71-9ca3-aa4acf32ed8e} - c:\program files\kaspersky lab\kaspersky internet security 2009\scieplgn.dll
o9 - extra button: Blog this - {219c3416-8cb2-491a-a3c7-d9fcddc9d600} - c:\program files\windows live\writer\writerbrowserextension.dll
o9 - extra 'tools' menuitem: &blog this in windows live writer - {219c3416-8cb2-491a-a3c7-d9fcddc9d600} - c:\program files\windows live\writer\writerbrowserextension.dll
o9 - extra button: إرسال إلى onenote - {2670000a-7350-4f3c-8081-5663ee0c6c49} - c:\progra~1\micros~2\office12\onbttnie.dll
o9 - extra 'tools' menuitem: إر&سال إلى onenote - {2670000a-7350-4f3c-8081-5663ee0c6c49} - c:\progra~1\micros~2\office12\onbttnie.dll
o9 - extra button: Research - {92780b25-18cc-41c8-b9be-3c9c571a8263} - c:\progra~1\micros~2\office12\refiebar.dll
o13 - gopher prefix:
O16 - dpf: {d27cdb6e-ae6d-11cf-96b8-444553540000} (shockwave flash object) -
o18 - protocol: Groovelocalgws - {88fed34c-f0ca-4636-a375-3cb6248b04cd} - c:\program files\microsoft office\office12\groovesystemservices.dll
o20 - appinit_dlls: C:\progra~1\kasper~1\kasper~1\mzvkbd.dll c:\progra~1\kasper~1\kasper~1\mzvkbd3.dll c:\progra~1\kasper~1\kasper~1\adialhk.dll c:\progra~1\kasper~1\kasper~1\kloehk.dll
o23 - service: Kaspersky internet security (avp) - kaspersky lab - c:\program files\kaspersky lab\kaspersky internet security 2009\avp.exe
o23 - service: Incd helper (incdsrv) - nero ag - c:\program files\nero\nero 7\incd\incdsrv.exe
o23 - service: Nbservice - nero ag - c:\program files\nero\nero 7\nero backitup\nbservice.exe
o23 - service: Nmindexingservice - nero ag - c:\program files\common files\ahead\lib\nmindexingservice.exe
o23 - service: Servicelayer - nokia. - c:\program files\pc connectivity solution\servicelayer.exe
o23 - service: Xaudioservice - conexant systems, inc. - c:\windows\system32\drivers\xaudio.exe
--
end of file - 7818 bytes
.png)
.png)
