Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 1:25:14 AM, on 2/22/2009
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)
Boot mode: Normal
Running processes:
C:WINDOWSSystem32smss.exe
C:WINDOWSsystem32csrss.exe
C:WINDOWSsystem32winlogon.exe
C:WINDOWSsystem32services.exe
C:WINDOWSsystem32lsass.exe
C:WINDOWSsystem32svchost.exe
C:WINDOWSsystem32svchost.exe
C:WINDOWSSystem32svchost.exe
C:WINDOWSSystem32svchost.exe
C:WINDOWSsystem32svchost.exe
C:WINDOWSsystem32svchost.exe
C:WINDOWSSystem32svchost.exe
C:WINDOWSsystem32spoolsv.exe
C:WINDOWSSystem32alg.exe
C:PROGRA~1AVGAVG8avgwdsvc.exe
C:Program FilesFirebirdFirebird_2_1binfbguard.exe
C:Program FilesJavajre6binjqs.exe
C:PROGRA~1AVGAVG8avgrsx.exe
C:PROGRA~1AVGAVG8avgnsx.exe
C:Program FilesSpyware DoctorpctsAuxs.exe
C:WINDOWSSystem32tcpsvcs.exe
C:WINDOWSSystem32svchost.exe
C:PROGRA~1AVGAVG8avgemc.exe
C:Program FilesAVGAVG8avgcsrvx.exe
C:WINDOWSTEMP93197324exe
C:WINDOWSSystem32svchost.exe
C:WINDOWSSystem32svchost.exe
C:WINDOWSSystem32svchost.exe
C:WINDOWSTEMP783691308exe
C:WINDOWSSystem32svchost.exe
C:WINDOWSTEMPwtl1D.tmp
C:WINDOWSsystem32svchost.exe
C:WINDOWSsystem32svchost.exe
C:Program FilesInternet Exploreriexplore.exe
C:WINDOWSsystem32svchost.exe
C:Program FilesCommon FilesMicrosoft SharedWindows LiveWLLoginProxy.exe
C:WINDOWSTEMP683682347exe
C:PROGRA~1AVGAVG8aAvgApi.exe
C:WINDOWSSystem32svchost.exe
C:Program FilesCommon FilesMicrosoft SharedWindows LiveWLLoginProxy.exe
C:PROGRA~1AVGAVG8aAvgApi.exe
C:WINDOWSsystem32svchost.exe
C:WINDOWSExplorer.EXE
C:WINDOWSsystem32svchost.exe
C:WINDOWSSystem32carpserv.exe
C:Program FilesCommon FilesRealUpdate_OBrealsched.exe
C:Program FilesJavajre6binjusched.exe
C:Program FilesCyberLinkPowerDVDPDVDServ.exe
C:PROGRA~1AVGAVG8avgtray.exe
C:Program FilesSpyware DoctorpctsTray.exe
C:Program FilesANIANIWZCS2 ServiceWZCSLDR2.exe
C:Program FilesD-LinkD-Link Wireless G DWA-110AirGCFG.exe
C:WINDOWSSystem32ctfmon.exe
C:Program FilesRegistry MechanicRegMech.exe
C:Program FilesFirebirdFirebird_2_1binfbserver.exe
C:Program FilesAVGAVG8avgui.exe
C:Program FilesAVGAVG8avgupd.exe
C:Program FilesInternet Exploreriexplore.exe
C:Program FilesSpyware DoctorpctsSvc.exe
C:Program FilesInternet Exploreriexplore.exe
C:Program FilesCommon FilesMicrosoft SharedWindows LiveWLLoginProxy.exe
C:PROGRA~1AVGAVG8aAvgApi.exe
C:Program FilesInternet Exploreriexplore.exe
C:Program FilesCommon FilesMicrosoft SharedWindows LiveWLLoginProxy.exe
C:PROGRA~1AVGAVG8aAvgApi.exe
C:WINDOWSSystem32svchost.exe
C:Program FilesInternet Exploreriexplore.exe
C:Program FilesCommon FilesMicrosoft SharedWindows LiveWLLoginProxy.exe
C:PROGRA~1AVGAVG8aAvgApi.exe
C:Program FilesAVGAVG8avgscanx.exe
C:Program FilesAVGAVG8avgcsrvx.exe
C:Program FilesBPKbpk.exe
C:Program FilesShareaza ApplicationsShareazaShareaza.exe
C:Program FilesHTVHTV.exe
C:Program FilesMozilla Firefoxfirefox.exe
C:Documents and SettingsSeanLDesktopHiJackThis.exe
C:WINDOWSSystem32wbemwmiprvse.exe
R0 - HKCUSoftwareMicrosoftInternet ExplorerMain,Start Page = http://security.microsoft.com/status/
R1 - HKLMSoftwareMicrosoftInternet ExplorerMain,Search Bar = http://us.rd.yahoo.com/customize/ie/def ... earch.html
R0 - HKCUSoftwareMicrosoftInternet ExplorerMain,Local Page =
R0 - HKLMSoftwareMicrosoftInternet ExplorerMain,Local Page =
R3 - URLSearchHook: Peer2Peer-EN Toolbar - {da21bd13-ca22-42e3-a071-98f08f1ca1e7} - C:Program FilesPeer2Peer-ENtbPeer.dll
R3 - URLSearchHook: P2P Energy Toolbar - {2bae58c2-79f9-45d1-a286-81f911301c3a} - C:Program FilesP2P_EnergytbP2P_.dll
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:PROGRA~1Yahoo!CompanionInstallscpnyt.dll
F2 - REG:system.ini: UserInit=c:windowssystem32userinit.exe
O1 - Hosts: 207.182.144.198 security.yahoo.com
O1 - Hosts: 207.182.144.198 security.google.com
O1 - Hosts: 207.182.144.198 advisor.microsoft.com
O1 - Hosts: 207.182.144.198 upgrade.microsoft.com
O1 - Hosts: 207.182.144.198 security.microsoft.com
O1 - Hosts: 207.182.144.198 store.microsoft.com
O2 - BHO: &Yahoo! Toolbar Helper - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:PROGRA~1Yahoo!CompanionInstallscpnyt.dll
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:Program FilesAdobeAcrobat 7.0ActiveXAcroIEHelper.dll
O2 - BHO: PK IE Plugin - {1E1B2879-88FF-11D3-8D96-D7ACAC95951A} - C:Program FilesBPKbpkwb.dll
O2 - BHO: P2P Energy Toolbar - {2bae58c2-79f9-45d1-a286-81f911301c3a} - C:Program FilesP2P_EnergytbP2P_.dll
O2 - BHO: RealPlayer Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:Program FilesRealRealPlayerrpbrowserrecordplugin.dll
O2 - BHO: BitComet ClickCapture - {39F7E362-828A-4B5A-BCAF-5B79BFDFEA60} - C:Program FilesBitComettoolsBitCometBHO_1.3.1.15.dll
O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:Program FilesAVGAVG8avgssie.dll
O2 - BHO: (no name) - {68B6E215-53D6-49DE-8CBD-B0C0708B8AB1} - (no file)
O2 - BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:Program FilesJavajre6binssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:Program FilesCommon FilesMicrosoft SharedWindows LiveWindowsLiveLogin.dll
O2 - BHO: AVG Security Toolbar - {A057A204-BACC-4D26-9990-79A187E2698E} - C:PROGRA~1AVGAVG8AVGTOO~1.DLL
O2 - BHO: Windows Live Toolbar Helper - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:Program FilesWindows Live Toolbarmsntb.dll
O2 - BHO: Peer2Peer-EN Toolbar - {da21bd13-ca22-42e3-a071-98f08f1ca1e7} - C:Program FilesPeer2Peer-ENtbPeer.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:Program FilesJavajre6binjp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:Program FilesJavajre6libdeployjqsiejqs_plugin.dll
O2 - BHO: SingleInstance Class - {FDAD4DA1-61A2-4FD8-9C17-86F7AC245081} - C:PROGRA~1Yahoo!CompanionInstallscpnYTSingleInstance.dll
O3 - Toolbar: Windows Live Toolbar - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:Program FilesWindows Live Toolbarmsntb.dll
O3 - Toolbar: AVG Security Toolbar - {A057A204-BACC-4D26-9990-79A187E2698E} - C:PROGRA~1AVGAVG8AVGTOO~1.DLL
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:WINDOWSSystem32msdxm.ocx
O3 - Toolbar: Peer2Peer-EN Toolbar - {da21bd13-ca22-42e3-a071-98f08f1ca1e7} - C:Program FilesPeer2Peer-ENtbPeer.dll
O3 - Toolbar: P2P Energy Toolbar - {2bae58c2-79f9-45d1-a286-81f911301c3a} - C:Program FilesP2P_EnergytbP2P_.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:PROGRA~1Yahoo!CompanionInstallscpnyt.dll
O4 - HKLM..Run: [CARPService] carpserv.exe
O4 - HKLM..Run: [TkBellExe] "C:Program FilesCommon FilesRealUpdate_OBrealsched.exe" -osboot
O4 - HKLM..Run: [SunJavaUpdateSched] "C:Program FilesJavajre6binjusched.exe"
O4 - HKLM..Run: [RemoteControl] "C:Program FilesCyberLinkPowerDVDPDVDServ.exe"
O4 - HKLM..Run: [AVG8_TRAY] C:PROGRA~1AVGAVG8avgtray.exe
O4 - HKLM..Run: [20bd9f8b] rundll32.exe "C:WINDOWSsystem32uwjxwveb.dll",b
O4 - HKLM..Run: [ISTray] "C:Program FilesSpyware DoctorpctsTray.exe"
O4 - HKLM..Run: [ANIWZCS2Service] C:Program FilesANIANIWZCS2 ServiceWZCSLDR2.exe
O4 - HKLM..Run: [D-Link D-Link Wireless G DWA-110] C:Program FilesD-LinkD-Link Wireless G DWA-110AirGCFG.exe
O4 - HKLM..Run: [KernelFaultCheck] %systemroot%system32dumprep 0 -k
O4 - HKLM..Run: [HTV Agent] C:Program FilesHTVHTV.exe
O4 - HKCU..Run: [ctfmon.exe] C:WINDOWSSystem32ctfmon.exe
O4 - HKCU..Run: [msnmsgr] "C:Program FilesWindows LiveMessengermsnmsgr.exe" /background
O4 - HKCU..Run: [RegistryMechanic] C:Program FilesRegistry MechanicRegMech.exe /H
O4 - HKCU..Run: [Windows] C:Program FilesBPKWindows.exe
O4 - HKCU..Run: [bpk] C:Program FilesBPKbpk.exe
O4 - HKUSS-1-5-21-1644491937-813497703-854245398-1004..Run: [ctfmon.exe] C:WINDOWSSystem32ctfmon.exe (User rick)
O4 - HKUSS-1-5-21-1644491937-813497703-854245398-1004..Run: [MsnMsgr] "C:Program FilesWindows LiveMessengerMsnMsgr.Exe" /background (User rick)
O4 - HKUSS-1-5-21-1644491937-813497703-854245398-1004..Run: [RegistryMechanic] C:Program FilesRegistry MechanicRegMech.exe /S (User rick)
O4 - HKUSS-1-5-21-1644491937-813497703-854245398-1004..Run: [Messenger (Yahoo!)] "C:Program FilesYahoo!MessengerYahooMessenger.exe" -quiet (User rick)
O4 - HKUSS-1-5-21-1644491937-813497703-854245398-1006..Run: [ctfmon.exe] C:WINDOWSSystem32ctfmon.exe (User Ricky)
O4 - HKUSS-1-5-18..Run: [msnmsgr] "C:Program FilesWindows LiveMessengermsnmsgr.exe" /background (User SYSTEM)
O4 - HKUS.DEFAULT..Run: [msnmsgr] "C:Program FilesWindows LiveMessengermsnmsgr.exe" /background (User Default user)
O4 - Startup: DesktopVideoPlayer.LNK = C:Program Filesvghdvghd.exe
O4 - Startup: MalwareRemoval.lnk = C:Program FilesMalwareRemovalMalwareRemoval.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:Program FilesAdobeAcrobat 7.0Readerreader_sl.exe
O8 - Extra context menu item: &D&ownload &with BitComet - res://C:Program FilesBitCometBitComet.exe/AddLink.htm
O8 - Extra context menu item: &D&ownload all video with BitComet - res://C:Program FilesBitCometBitComet.exe/AddVideo.htm
O8 - Extra context menu item: &D&ownload all with BitComet - res://C:Program FilesBitCometBitComet.exe/AddAllLink.htm
O8 - Extra context menu item: &Windows Live Search - res://C:Program FilesWindows Live Toolbarmsntb.dll/search.htm
O8 - Extra context menu item: Add to Windows &Live Favorites - http://favorites.live.com/quickadd.aspx
O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:WINDOWSwebrelated.htm
O9 - Extra Tools menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:WINDOWSwebrelated.htm
O9 - Extra button: BitComet - {D18A0B52-D63C-4ed0-AFC6-C1E3DC1AF43A} - res://C:Program FilesBitComettoolsBitCometBHO_1.3.1.15.dll/206 (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:Program FilesMessengermsmsgs.exe
O9 - Extra Tools menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:Program FilesMessengermsmsgs.exe
O16 - DPF: {1D4DB7D2-6EC9-47A3-BD87-1E41684E07BB} - http://ak.exe.imgfarm.com/images/nocach ... .0.1.1.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/windows ... 0112282135
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftup ... 0123967042
O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:Program FilesAVGAVG8avgpp.dll
O20 - Winlogon Notify: avgrsstarter - C:WINDOWSSYSTEM32avgrsstx.dll
O20 - Winlogon Notify: hgGwWNee - hgGwWNee.dll (file missing)
O20 - Winlogon Notify: qhizrl - C:WINDOWSSYSTEM32qhizrl.dll
O20 - Winlogon Notify: UpdateNf - C:WINDOWSSYSTEM32updatenf.dll
O23 - Service: ANIWZCSd Service (ANIWZCSdService) - Wireless Service - C:Program FilesANIANIWZCS2 ServiceANIWZCSdS.exe
O23 - Service: AVG Free8 E-mail Scanner (avg8emc) - AVG Technologies CZ, s.r.o. - C:PROGRA~1AVGAVG8avgemc.exe
O23 - Service: AVG Free8 WatchDog (avg8wd) - AVG Technologies CZ, s.r.o. - C:PROGRA~1AVGAVG8avgwdsvc.exe
O23 - Service: FCI (fci) - Unknown owner - C:WINDOWSsystem32svchost.exe:ext.exe
O23 - Service: Firebird Guardian - DefaultInstance (FirebirdGuardianDefaultInstance) - FirebirdSQL Project - C:Program FilesFirebirdFirebird_2_1binfbguard.exe
O23 - Service: Firebird Server - DefaultInstance (FirebirdServerDefaultInstance) - FirebirdSQL Project - C:Program FilesFirebirdFirebird_2_1binfbserver.exe
O23 - Service: ICF - Unknown owner - C:WINDOWSsystem32svchost.exe:ext.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:Program FilesJavajre6binjqs.exe
O23 - Service: PC Tools Auxiliary Service (sdAuxService) - PC Tools - C:Program FilesSpyware DoctorpctsAuxs.exe
O23 - Service: PC Tools Security Service (sdCoreService) - PC Tools - C:Program FilesSpyware DoctorpctsSvc.exe
--
End of file - 13034 bytes
please tell me if i have any keyloggers or spyware, thnx
Read More...
No comments:
Post a Comment