logfile of trend micro hijackthis v2.0.2
scan saved at 04:12:12 م, on 21/07/2009
platform: Windows xp sp2 (winnt 5.01.2600)
msie: Internet explorer v7.00 (7.00.5730.0013)
boot mode: Normal
running processes:
C:\windows\system32\smss.exe
c:\windows\system32\winlogon.exe
c:\windows\system32\services.exe
c:\windows\system32\lsass.exe
c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe
c:\program files\widcomm\bluetooth software\bin\btwdins.exe
c:\windows\system32\spoolsv.exe
c:\windows\explorer.exe
c:\windows\rthdcpl.exe
c:\program files\common files\real\update_ob\realsched.exe
c:\windows\system32\ctfmon.exe
c:\program files\windows live\messenger\msnmsgr.exe
c:\program files\widcomm\bluetooth software\bttray.exe
c:\program files\realtek rtl8187 wireless lan driver and utility\rtwlan.exe
c:\docume~1\fahdal~1\locals~1\temp\rtkbtmnt.exe
c:\windows\system32\wscntfy.exe
c:\windows\system32\svchost.exe
c:\docume~1\fahdal~1\locals~1\temp\pbiooj.exe
c:\docume~1\fahdal~1\locals~1\temp\winsvhahk.exe
c:\docume~1\fahdal~1\locals~1\temp\w6064c.exe
c:\program files\windows live\messenger\usnsvc.exe
c:\windows\system32\svchost.exe
c:\program files\internet explorer\iexplore.exe
c:\docume~1\fahdal~1\locals~1\temp\mcta.exe
c:\docume~1\fahdal~1\locals~1\temp\ygwcg.exe
c:\docume~1\fahdal~1\locals~1\temp\ieeiug.exe
c:\program files\windows live\messenger\msnmsgr.exe
c:\program files\windows live\messenger\msnmsgr.exe
c:\docume~1\fahdal~1\locals~1\temp\svlwew.exe
c:\program files\trend micro\hijackthis\hijackthis.exe
r1 - hklm\software\microsoft\internet explorer\main,default_page_url =
r1 - hklm\software\microsoft\internet explorer\main,default_search_url =
r1 - hklm\software\microsoft\internet explorer\main,search page =
r0 - hklm\software\microsoft\internet explorer\main,start page =
o2 - bho: Realplayer download and record plugin for internet explorer - {3049c3e9-b461-4bc5-8870-4c09146192ca} - c:\program files\real\realplayer\rpbrowserrecordplugin.dll
o2 - bho: (no name) - {7e853d72-626a-48ec-a868-ba8d5e23e045} - (no file)
o4 - hklm\..\run: [rthdcpl] rthdcpl.exe
o4 - hklm\..\run: [azmixersel] c:\program files\realtek\installshield\azmixersel.exe
o4 - hklm\..\run: [tkbellexe] "c:\program files\common files\real\update_ob\realsched.exe" -osboot
o4 - hklm\..\run: [anti lite title debug] c:\documents and settings\all users\application data\okay meta anti lite\flap eggs.exe
o4 - hkcu\..\run: [ctfmon.exe] c:\windows\system32\ctfmon.exe
o4 - hkcu\..\run: [cbvcs] c:\windows\system32\urretnd.exe
o4 - hkcu\..\run: [msnmsgr] "c:\program files\windows live\messenger\msnmsgr.exe" /background
o4 - hkcu\..\run: [mags locks] c:\docume~1\fahdal~1\applic~1\isomp3~1\spamcamp.ex e
o4 - hkus\s-1-5-19\..\run: [ctfmon.exe] c:\windows\system32\ctfmon.exe (user 'local service')
o4 - hkus\s-1-5-20\..\run: [ctfmon.exe] c:\windows\system32\ctfmon.exe (user 'network service')
o4 - hkus\s-1-5-18\..\run: [ctfmon.exe] c:\windows\system32\ctfmon.exe (user 'system')
o4 - hkus\.default\..\run: [ctfmon.exe] c:\windows\system32\ctfmon.exe (user 'default user')
o4 - global startup: Bluetooth.lnk = ?
O4 - global startup: Realtek rtl8187 wireless lan utility.lnk = ?
O8 - extra context menu item: Send to &bluetooth device... - c:\program files\widcomm\bluetooth software\btsendto_ie_ctx.htm
o9 - extra button: @btrez.dll,-4015 - {cca281ca-c863-46ef-9331-5c8d4460577f} - c:\program files\widcomm\bluetooth software\btsendto_ie.htm
o9 - extra 'tools' menuitem: @btrez.dll,-12650 - {cca281ca-c863-46ef-9331-5c8d4460577f} - c:\program files\widcomm\bluetooth software\btsendto_ie.htm
o9 - extra button: Messenger - {fb5f1910-f110-11d2-bb9e-00c04f795683} - c:\program files\messenger\msmsgs.exe
o9 - extra 'tools' menuitem: Windows messenger - {fb5f1910-f110-11d2-bb9e-00c04f795683} - c:\program files\messenger\msmsgs.exe
o10 - unknown file in winsock lsp: C:\windows\system32\nwprovau.dll
o16 - dpf: {c171ff59-8c55-4796-a398-4f5d02b4c763} (imc_sec control) -
o23 - service: Bluetooth service (btwdins) - broadcom corporation. - c:\program files\widcomm\bluetooth software\bin\btwdins.exe
--
end of file - 4411 bytes
k: