Logfile of HijackThis v1.99.1
Scan saved at 10:03:56, on 12.10.2006
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)
Running processes:
C:\windows\System32\smss.exe
C:\windows\system32\winlogon.exe
C:\windows\system32\services.exe
C:\windows\system32\lsass.exe
C:\windows\System32\Ati2evxx.exe
C:\windows\system32\svchost.exe
C:\windows\System32\svchost.exe
C:\windows\explorer.exe
C:\windows\system32\spoolsv.exe
C:\windows\system32\crypserv.exe
C:\Program Files\Pwrchute\ups.exe
C:\windows\System32\UAService7.exe
C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
C:\windows\System32\mpcsvc.exe
C:\Program Files\D-Tools\daemon.exe
C:\PROGRA~1\MYWEBS~1\bar\3.bin\mwsoemon.exe
C:\windows\System32\ctfmon.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\Microsoft Office\Office\1050\msoffice.exe
C:\Program Files\Opera2\Opera.exe
C:\windows\System32\svchost.exe
C:\Program Files\TUGZip\TUGZip.exe
C:\DOCUME~1\Admin\LOCALS~1\Temp\tz_exec.tmp\HijackThis.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.ba/
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = about:blank
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
R3 - URLSearchHook: (no name) - {9F2C253D-ECAA-E67A-ACFC-E13B82002192} - C:\windows\System32\urarkk.dll
R3 - URLSearchHook: (no name) - {00A6FAF6-072E-44cf-8957-5838F569A31D} - C:\Program Files\MyWebSearch\SrchAstt\3.bin\MWSSRCAS.DLL
F2 - REG:system.ini: Shell=explorer.exe C:\windows\System32\sxlntr.exe
F3 - REG:win.ini: load=C:\windows\System32\sxlntr.exe
F3 - REG:win.ini: run=C:\windows\System32\sxlntr.exe
O2 - BHO: MyWebSearch Search Assistant BHO - {00A6FAF1-072E-44cf-8957-5838F569A31D} - C:\Program Files\MyWebSearch\SrchAstt\3.bin\MWSSRCAS.DLL
O2 - BHO: mwsBar BHO - {07B18EA1-A523-4961-B6BB-170DE4475CCA} - C:\Program Files\MyWebSearch\bar\3.bin\MWSBAR.DLL
O2 - BHO: (no name) - {455875B5-93F3-429D-FF34-660B206D897A} - C:\windows\System32\lxdenroop105.dll
O3 - Toolbar: My &Web Search - {07B18EA9-A523-4961-B6BB-170DE4475CCA} - C:\Program Files\MyWebSearch\bar\3.bin\MWSBAR.DLL
O4 - HKLM\..\Run: [c‰¸u0–4C
}iÁzî[8C:\Program Files\ISTsvc\istsvc.exe] C:\WINDOWS\mmggoyl.exe
O4 - HKLM\..\Run: [c‰¸u0Ô@ÔÁÔ]ú"ü‰üžiC:\Program Files\ISTsvc\istsvc.exe] C:\WINDOWS\mmggoyl.exe
O4 - HKLM\..\Run: [c‰¸u0Ô@ÔÁÔ]ú"ü‰¸u0C:\Program Files\ISTsvc\istsvc.exe] C:\WINDOWS\mmggoyl.exe
O4 - HKLM\..\Run: [c‰¸u0Ô@ÔÁÔÁÔ]ú"ü‰üC:\Program Files\ISTsvc\istsvc.exe] C:\WINDOWS\mmggoyl.exe
O4 - HKLM\..\Run: [c‰¸u0–4C
}iÁzîžigÝC:\Program Files\ISTsvc\istsvc.exe] C:\WINDOWS\mmggoyl.exe
O4 - HKLM\..\Run: [c‰¸u0Ô@ÔÁÔÁÔ]ú"ü‰¸C:\Program Files\ISTsvc\istsvc.exe] C:\WINDOWS\mmggoyl.exe
O4 - HKLM\..\Run: [c‰¸u0ÔÁÔ]ú"ü‰üžigÝC:\Program Files\ISTsvc\istsvc.exe] C:\WINDOWS\mmggoyl.exe
O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [cDexCD2n] C:\WINDOWS\mmggoyl.exe
O4 - HKLM\..\Run: [Cleanup] C:\DOCUME~1\Admin\LOCALS~1\Temp\20051118205128_mcappins.exe /v=3 /cleanup
O4 - HKLM\..\Run: [MS FIREWALL] msfirewall.exe
O4 - HKLM\..\Run: [msnappau] "C:\Program Files\MSN Apps\Updater\01.02.0002.1001\en-us\msnappau.exe"
O4 - HKLM\..\Run: [Personal AntiSpy keylogger] C:\windows\System32\systemwb.dll
O4 - HKLM\..\Run: [Repair Service Manager] C:\windows\System32\mpcsvc.exe
O4 - HKLM\..\Run: [TrayComm] TrayComm.exe
O4 - HKLM\..\Run: [IExplore adviser] Regsvr32.exe /s C:\windows\System32\lxdenroop105.dll
O4 - HKLM\..\Run: [RepServ Manager] C:\windows\System32\mpcsvc.exe
O4 - HKLM\..\Run: [RepServ23 Manager] C:\windows\System32\mpcsvc.exe
O4 - HKLM\..\Run: [NeroFilterCheck] C:\windows\system32\NeroCheck.exe
O4 - HKLM\..\Run: [DAEMON Tools-1033] "C:\Program Files\D-Tools\daemon.exe" -lang 1033
O4 - HKLM\..\Run: [SiS Mpc Service] C:\windows\System32\mpcsvc.exe
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O4 - HKLM\..\Run: [My Web Search Bar] rundll32 C:\PROGRA~1\MYWEBS~1\bar\3.bin\MWSBAR.DLL,S
O4 - HKLM\..\Run: [MyWebSearch Email Plugin] C:\PROGRA~1\MYWEBS~1\bar\3.bin\mwsoemon.exe
O4 - HKLM\..\RunServices: [MS FIREWALL] msfirewall.exe
O4 - HKLM\..\RunServices: [Windows System] system.exe
O4 - HKCU\..\Run: [CTFMON.EXE] C:\windows\System32\ctfmon.exe
O4 - HKCU\..\Run: [CTFMON.EXE] C:\windows\System32\ctfmon.exe
O4 - HKCU\..\Run: [MS FIREWALL] msfirewall.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [MSN Messenge] winlogin.exe
O4 - HKCU\..\Run: [Online News Screensaver] C:\Program Files\Online News Screensaver\onsagent.exe
O4 - HKCU\..\Run: [Repair Service Manager] C:\windows\System32\mpcsvc.exe
O4 - HKCU\..\Run: [NBJ] "C:\Program Files\Ahead\Nero BackItUp\nbj.exe"
O4 - HKCU\..\Run: [RepServ Manager] C:\windows\System32\mpcsvc.exe
O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Common Files\Ahead\lib\NMBgMonitor.exe"
O4 - HKCU\..\Run: [RepServ23 Manager] C:\windows\System32\mpcsvc.exe
O4 - HKCU\..\Run: [MyWebSearch Email Plugin] C:\PROGRA~1\MYWEBS~1\bar\3.bin\mwsoemon.exe
O4 - HKCU\..\RunServices: [MS FIREWALL] msfirewall.exe
O4 - HKCU\..\RunServices: [MSN Messenge] winlogin.exe
O4 - HKCU\..\RunServices: [Windows System] system.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O8 - Extra context menu item: &Google Search - res://c:\program files\google\GoogleToolbar1.dll/cmsearch.html
O8 - Extra context menu item: &Search - http://edits.mywebsearch.com/toolbaredits/menusearch.jhtml?p=ZCfox000
O8 - Extra context menu item: &Translate English Word - res://c:\program files\google\GoogleToolbar1.dll/cmwordtrans.html
O8 - Extra context menu item: Backward Links - res://c:\program files\google\GoogleToolbar1.dll/cmbacklinks.html
O8 - Extra context menu item: Cached Snapshot of Page - res://c:\program files\google\GoogleToolbar1.dll/cmcache.html
O8 - Extra context menu item: Download with Go!Zilla - file://C:\Program Files\Go!Zilla\download-with-gozilla.html
O8 - Extra context menu item: Similar Pages - res://c:\program files\google\GoogleToolbar1.dll/cmsimilar.html
O8 - Extra context menu item: Translate Page into English - res://c:\program files\google\GoogleToolbar1.dll/cmtrans.html
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_01\bin\npjpi150_01.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_01\bin\npjpi150_01.dll
O9 - Extra button: (no name) - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - (no file)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O9 - Extra 'Tools' menuitem: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O16 - DPF: {11111111-1111-1111-1111-111111113457} - file://c:\explorer.cab
O16 - DPF: {91433D86-9F27-402C-B5E3-DEBDD122C339} - http://www.netvenda.com/sites/games-intl/ww/games3.cab
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/MsnMessengerSetupDownloader.cab
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)
O20 - Winlogon Notify: URL - C:\windows\system32\azcol5931.dll (file missing)
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\windows\System32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: Crypkey License - Kenonic Controls Ltd. - C:\windows\SYSTEM32\crypserv.exe
O23 - Service: Microsoft Management - Unknown owner - C:\windows\System32\lmas.exe" -netsvcs (file missing)
O23 - Service: Norton Unerase Protection (NProtectService) - Unknown owner - C:\Documents and Settings\Admin\Desktop\Norton AntiVirus\AdvTools\NPROTECT.EXE (file missing)
O23 - Service: snapple - Unknown owner - C:\windows\System32\snapple.exe" -netsvcs (file missing)
O23 - Service: UPS - APC PowerChute plus (UPS) - APC - C:\Program Files\Pwrchute\ups.exe
O23 - Service: SecuROM User Access Service (V7) (UserAccess7) - Sony DADC Austria AG. - C:\windows\System32\UAService7.exe
