logfile of trend micro hijackthis v2.0.2
scan saved at 1052 م, on 07/05/2009
platform: Windows xp sp2 (winnt 5.01.2600)
msie: Internet explorer v7.00 (7.00.5730.0013)
boot mode: Normal

running processes:
C:\windows\system32\smss.exe
c:\windows\system32\winlogon.exe
c:\windows\system32\services.exe
c:\windows\system32\lsass.exe
c:\program files\faronics\deep freeze\install c-0\df5serv.exe
c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe
c:\windows\system32\spoolsv.exe
c:\program files\avira\antivir personaledition classic\sched.exe
c:\windows\explorer.exe
c:\program files\google\update\googleupdate.exe
c:\windows\system32\runouce.exe
c:\windows\soundman.exe
c:\program files\topro\tppoll.exe
c:\program files\avira\antivir personaledition classic\avgnt.exe
c:\program files\common files\real\update_ob\realsched.exe
c:\windows\system32\ctfmon.exe
c:\program files\windows live\messenger\msnmsgr.exe
c:\program files\messenger\msmsgs.exe
d:\فهدوون\برامج منوعه\idm_5[1].15__build_6www.supersy.com\idm 5.15 build 6\idmportable\app\internet download manager\idman.exe
c:\program files\avira\antivir personaledition classic\avguard.exe
c:\program files\common files\microsoft shared\vs7debug\mdm.exe
c:\program files\microsoft\search enhancement pack\seaport\seaport.exe
c:\windows\system32\svchost.exe
c:\program files\faronics\deep freeze\install c-0\_$df\frzstate2k.exe
c:\program files\windows live\contacts\wlcomm.exe
c:\program files\windows live\toolbar\wltuser.exe
c:\program files\internet explorer\iexplore.exe
c:\program files\hotspot shield\bin\openvpnas.exe
c:\program files\no-ip\duc20.exe
c:\program files\internet explorer\iexplore.exe
c:\program files\windows live\messenger\msnmsgr.exe
c:\program files\internet explorer\iexplore.exe
c:\program files\windows media player\wmplayer.exe
c:\program files\internet explorer\iexplore.exe
c:\documents and settings\nawar\سطح المكتب\متفجرآت\(3) bifrost coffin of evil 1.2.1d\bifrost coffin of evil 1.2.1d\bifrost coffin of evil 1.2.1d.exe
c:\documents and settings\nawar\سطح المكتب\hijackthis.exe

r1 - hklm\software\microsoft\internet explorer\main,default_page_url = http://go.microsoft.com/fwlink/?linkid=69157
r1 - hklm\software\microsoft\internet explorer\main,default_search_url = http://go.microsoft.com/fwlink/?linkid=54896
r1 - hklm\software\microsoft\internet explorer\main,search page = http://go.microsoft.com/fwlink/?linkid=54896
r0 - hklm\software\microsoft\internet explorer\main,start page = http://go.microsoft.com/fwlink/?linkid=69157
r0 - hkcu\software\microsoft\internet explorer\main,local page = \blank.htm
o2 - bho: Idm helper - {0055c089-8582-441b-a0bf-17b458c2a3a8} - d:\فهدوون\برامج منوعه\idm_5[1].15__build_6www.supersy.com\idm 5.15 build 6\idmportable\app\internet download manager\idmiecc.dll
o2 - bho: Acroiehelperstub - {18df081c-e8ad-4283-a596-fa578c2ebdc3} - c:\program files\common files\adobe\acrobat\activex\acroiehelpershim.dll
o2 - bho: Realplayer download and record plugin for internet explorer - {3049c3e9-b461-4bc5-8870-4c09146192ca} - c:\program files\real\realplayer\rpbrowserrecordplugin.dll
o2 - bho: Search helper - {6ebf7485-159f-4bff-a14f-b9e3aac4465b} - c:\program files\microsoft\search enhancement pack\search helper\searchhelper.dll
o2 - bho: مساعد تسجيل الدخول إلى windows live - {9030d464-4c02-4abf-8ecc-5164760863c6} - c:\program files\common files\microsoft shared\windows live\windowslivelogin.dll
o2 - bho: Google toolbar helper - {aa58ed58-01dd-4d91-8333-cf10577473f7} - c:\program files\google\google toolbar\googletoolbar.dll
o2 - bho: Google toolbar notifier bho - {af69de43-7d58-4638-b6fa-ce66b5ad205d} - c:\program files\google\googletoolbarnotifier\5.1.1309.3572\s wg.dll
o2 - bho: Af bho - {b7154c4d-87c0-4a2c-ab64-da132bac2ee6} - c:\program files\anchorfree\bin\afbho.dll
o2 - bho: Google dictionary compression sdch - {c84d72fe-e17d-4195-bb24-76c02e2e7c4e} - c:\program files\google\google toolbar\component\fastsearch_a8904fb862bd9564.dll
o2 - bho: Windows live toolbar helper - {e15a8dc0-8516-42a1-81ea-dc94ec1acf10} - c:\program files\windows live\toolbar\wltcore.dll
o3 - toolbar: Aftoolbar - {1f385865-f3d4-41ff-960d-7b7d0a7a72f6} - c:\program files\anchorfree\bin\aftoolbar.dll
o3 - toolbar: &windows live toolbar - {21fa44ef-376d-4d53-9b0f-8a89d3229068} - c:\program files\windows live\toolbar\wltcore.dll
o3 - toolbar: Google toolbar - {2318c2b1-4965-11d4-9b18-009027a5cd4f} - c:\program files\google\google toolbar\googletoolbar.dll
o4 - hklm\..\run: [soundman] soundman.exe
o4 - hklm\..\run: [tppoll] c:\program files\topro\tppoll.exe
o4 - hklm\..\run: [runonce] c:\windows\system32\runouce.exe
o4 - hklm\..\run: [avgnt] "c:\program files\avira\antivir personaledition classic\avgnt.exe" /min
o4 - hklm\..\run: [tkbellexe] "c:\program files\common files\real\update_ob\realsched.exe" -osboot
o4 - hkcu\..\run: [ctfmon.exe] c:\windows\system32\ctfmon.exe
o4 - hkcu\..\run: [swg] c:\program files\google\googletoolbarnotifier\googletoolbarno tifier.exe
o4 - hkcu\..\run: [msnmsgr] "c:\program files\windows live\messenger\msnmsgr.exe" /background
o4 - hkcu\..\run: [vamsoft] c:\windows\system32\vamsoft.exe
o4 - hkcu\..\run: [software informer] "c:\program files\software informer\softinfo.exe" -autorun
o4 - hkcu\..\run: [msmsgs] "c:\program files\messenger\msmsgs.exe" /background
o4 - hkcu\..\run: [idman] d:\فهدوون\برامج منوعه\idm_5[1].15__build_6www.supersy.com\idm 5.15 build 6\idmportable\app\internet download manager\idman.exe /onboot
o4 - hkcu\..\run: [afprog] c:\program files\anchorfree\bin\ctrl\afcontroller.exe
o4 - hkus\s-1-5-19\..\run: [ctfmon.exe] c:\windows\system32\ctfmon.exe (user 'local service')
o4 - hkus\s-1-5-20\..\run: [ctfmon.exe] c:\windows\system32\ctfmon.exe (user 'network service')
o4 - hkus\s-1-5-18\..\run: [ctfmon.exe] c:\windows\system32\ctfmon.exe (user 'system')
o4 - hkus\.default\..\run: [ctfmon.exe] c:\windows\system32\ctfmon.exe (user 'default user')
o8 - extra context menu item: تحميل الكل بواسطة internet download manager - d:\فهدوون\برامج منوعه\idm_5[1].15__build_6www.supersy.com\idm 5.15 build 6\idmportable\app\internet download manager\iegetall.htm
o8 - extra context menu item: تحميل بواسطة internet download manager - d:\فهدوون\برامج منوعه\idm_5[1].15__build_6www.supersy.com\idm 5.15 build 6\idmportable\app\internet download manager\ieext.htm
o8 - extra context menu item: تحميل محتوى flv بواسطة internet download manager - d:\فهدوون\برامج منوعه\idm_5[1].15__build_6www.supersy.com\idm 5.15 build 6\idmportable\app\internet download manager\iegetvl.htm
o9 - extra button: تدوين هذا في المدونة - {219c3416-8cb2-491a-a3c7-d9fcddc9d600} - c:\program files\windows live\writer\writerbrowserextension.dll
o9 - extra 'tools' menuitem: &تدوين هذا في windows live writer - {219c3416-8cb2-491a-a3c7-d9fcddc9d600} - c:\program files\windows live\writer\writerbrowserextension.dll
o9 - extra button: بحث - {92780b25-18cc-41c8-b9be-3c9c571a8263} - c:\progra~1\micros~2\office11\refiebar.dll
o9 - extra button: Messenger - {fb5f1910-f110-11d2-bb9e-00c04f795683} - c:\program files\messenger\msmsgs.exe
o9 - extra 'tools' menuitem: Windows messenger - {fb5f1910-f110-11d2-bb9e-00c04f795683} - c:\program files\messenger\msmsgs.exe
o16 - dpf: {1e54d648-b804-468d-bc78-4affed8e262e} (system requirements lab) - http://www.systemrequirementslab.com...reqlab_srl.cab
o16 - dpf: {4f1e5b1a-2a80-42ca-8532-2d05cb959537} (msn photo upload tool) - http://gfx1.hotmail.com/mail/w3/resources/msnpupld.cab
o16 - dpf: {8c159dfd-dc9c-4077-b3b6-114a8d64b6d2} (userauthenticate class) - http://voice7.emkanat.com/cp/files/talk3.cab
o17 - hklm\system\ccs\services\tcpip\..\{b1f212af-b623-4bcf-bbe7-a32ead321425}: Nameserver = 10.5.144.1
o18 - filter: X-sdch - {b1759355-3eec-4c1e-b0f1-b719fe26e377} - c:\program files\google\google toolbar\component\fastsearch_a8904fb862bd9564.dll
o20 - winlogon notify: Dflogon - c:\windows\system32\logondll.dll
o23 - service: Avira antivir personal - free antivirus scheduler (antivirscheduler) - avira gmbh - c:\program files\avira\antivir personaledition classic\sched.exe
o23 - service: Avira antivir personal - free antivirus guard (antivirservice) - avira gmbh - c:\program files\avira\antivir personaledition classic\avguard.exe
o23 - service: Df5serv - faronics corporation - c:\program files\faronics\deep freeze\install c-0\df5serv.exe
o23 - service: خدمة تحديث google (gupdate1c9cf1ecc883c7e) (gupdate1c9cf1ecc883c7e) - google inc. - c:\program files\google\update\googleupdate.exe
o23 - service: Google software updater (gusvc) - google - c:\program files\google\common\google updater\googleupdaterservice.exe
o23 - service: Hotspot shield service (hotspotshieldservice) - unknown owner - c:\program files\hotspot shield\bin\openvpnas.exe

--
end of file - 8914 bytes