http://forum.lowyat.net/ Wed, 29 Jul 2026 06:35:55 +0800 FeedCreator 1.7.2 http://forum.lowyat.net/topic/520499 <!--SPOILER BEGIN--><div class="spoilertop" onClick="openClose('22c289d0ad49484c3dad6292c24926c1')" style="font-weight: bold"><u>&raquo; Click to show Spoiler - click again to hide... &laquo;</u></div><div class="spoilermain" id="22c289d0ad49484c3dad6292c24926c1" style="display:none"><!--SPOILER END-->Logfile of HijackThis v1.99.1<br />Scan saved at 4:17:55 PM, on 9/14/2007<br />Platform: Windows XP SP2 (WinNT 5.01.2600)<br />MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)<br /><br />Running processes:<br />G:&#092;WINDOWS&#092;System32&#092;smss.exe<br />G:&#092;WINDOWS&#092;system32&#092;winlogon.exe<br />G:&#092;WINDOWS&#092;system32&#092;services.exe<br />G:&#092;WINDOWS&#092;system32&#092;lsass.exe<br />G:&#092;WINDOWS&#092;system32&#092;svchost.exe<br />G:&#092;WINDOWS&#092;System32&#092;svchost.exe<br />G:&#092;WINDOWS&#092;system32&#092;spoolsv.exe<br />G:&#092;PROGRA~1&#092;Grisoft&#092;AVGFRE~1&#092;avgupsvc.exe<br />G:&#092;Program Files&#092;Common Files&#092;Microsoft Shared&#092;VS7DEBUG&#092;MDM.EXE<br />G:&#092;WINDOWS&#092;system32&#092;nvsvc32.exe<br />G:&#092;Program Files&#092;Analog Devices&#092;SoundMAX&#092;SMAgent.exe<br />C:&#092;Program Files&#092;Intel&#092;Intel&reg; Active Monitor&#092;imonnt.exe<br />G:&#092;Program Files&#092;AlienGUIse&#092;wbload.exe<br />G:&#092;WINDOWS&#092;Explorer.EXE<br />G:&#092;Program Files&#092;Analog Devices&#092;SoundMAX&#092;Smtray.exe<br />C:&#092;Program Files&#092;Intel&#092;Intel&reg; Active Monitor&#092;imontray.exe<br />G:&#092;WINDOWS&#092;system32&#092;RUNDLL32.EXE<br />G:&#092;Program Files&#092;Java&#092;jre1.6.0_02&#092;bin&#092;jusched.exe<br />G:&#092;WINDOWS&#092;System32&#092;spool&#092;DRIVERS&#092;W32X86&#092;3&#092;fpdisp5a.exe<br />G:&#092;Program Files&#092;CursorXP&#092;CursorXP.exe<br />G:&#092;WINDOWS&#092;system32&#092;ctfmon.exe<br />G:&#092;Program Files&#092;Messenger&#092;msmsgs.exe<br />G:&#092;Program Files&#092;MSN Messenger&#092;msnmsgr.exe<br />G:&#092;Program Files&#092;MSN Messenger&#092;usnsvc.exe<br />G:&#092;Program Files&#092;Windows Media Player&#092;wmplayer.exe<br />G:&#092;Program Files&#092;Mozilla Firefox&#092;firefox.exe<br />G:&#092;WINDOWS&#092;tmpie&#092;iehelper.exe<br />G:&#092;Program Files&#092;BillP Studios&#092;WinPatrol&#092;WinPatrol.exe<br />G:&#092;Program Files&#092;Anti-keylogger&#092;Anti-keylogger.exe<br />G:&#092;Program Files&#092;Ashampoo&#092;Ashampoo AntiSpyWare 2&#092;AntiSpyWareService.exe<br />G:&#092;PROGRA~1&#092;Grisoft&#092;AVGFRE~1&#092;avgamsvr.exe<br />G:&#092;PROGRA~1&#092;Grisoft&#092;AVGFRE~1&#092;avgemc.exe<br />G:&#092;Program Files&#092;Grisoft&#092;AVG Free&#092;avgcc.exe<br />G:&#092;WINDOWS&#092;tmpie&#092;iecom.exe<br />&#092;Ymteh&#092;shareddocs&#092;HijackThis.exe<br /><br />R3 - URLSearchHook: Yahoo&#33; Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - G:&#092;PROGRA~1&#092;Yahoo&#33;&#092;Companion&#092;Installs&#092;cpn&#092;yt.dll<br />O1 - Hosts: 212.203.110.45 L2authd.lineage2.com<br />O2 - BHO: &amp;Yahoo&#33; Toolbar Helper - {02478D38-C3F9-4efb-9B51-7695ECA05670} - G:&#092;PROGRA~1&#092;Yahoo&#33;&#092;Companion&#092;Installs&#092;cpn&#092;yt.dll<br />O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - G:&#092;Program Files&#092;Common Files&#092;Adobe&#092;Acrobat&#092;ActiveX&#092;AcroIEHelper.dll<br />O2 - BHO: flashget urlcatch - {2F364306-AA45-47B5-9F9D-39A8B94E7EF7} - G:&#092;Program Files&#092;FlashGet&#092;jccatch.dll<br />O2 - BHO: Yahoo&#33; IE Services Button - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - G:&#092;Program Files&#092;Yahoo&#33;&#092;Common&#092;yiesrvc.dll<br />O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - G:&#092;Program Files&#092;Java&#092;jre1.6.0_02&#092;bin&#092;ssv.dll<br />O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)<br />O2 - BHO: FlashGet GetFlash Class - {F156768E-81EF-470C-9057-481BA8380DBA} - G:&#092;Program Files&#092;FlashGet&#092;getflash.dll<br />O3 - Toolbar: Yahoo&#33; Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - G:&#092;PROGRA~1&#092;Yahoo&#33;&#092;Companion&#092;Installs&#092;cpn&#092;yt.dll<br />O4 - HKLM&#092;..&#092;Run: [IMJPMIG8.1] &quot;G:&#092;WINDOWS&#092;IME&#092;imjp8_1&#092;IMJPMIG.EXE&quot; /Spoil /RemAdvDef /Migration32<br />O4 - HKLM&#092;..&#092;Run: [PHIME2002ASync] G:&#092;WINDOWS&#092;system32&#092;IME&#092;TINTLGNT&#092;TINTSETP.EXE /SYNC<br />O4 - HKLM&#092;..&#092;Run: [PHIME2002A] G:&#092;WINDOWS&#092;system32&#092;IME&#092;TINTLGNT&#092;TINTSETP.EXE /IMEName<br />O4 - HKLM&#092;..&#092;Run: [Smapp] G:&#092;Program Files&#092;Analog Devices&#092;SoundMAX&#092;Smtray.exe<br />O4 - HKLM&#092;..&#092;Run: [IMONTRAY] C:&#092;Program Files&#092;Intel&#092;Intel&reg; Active Monitor&#092;imontray.exe<br />O4 - HKLM&#092;..&#092;Run: [Ins3DT] H:&#092;INSTALL4&#092;INS3DT.EXE<br />O4 - HKLM&#092;..&#092;Run: [NvCplDaemon] RUNDLL32.EXE G:&#092;WINDOWS&#092;system32&#092;NvCpl.dll,NvStartup<br />O4 - HKLM&#092;..&#092;Run: [nwiz] nwiz.exe /install<br />O4 - HKLM&#092;..&#092;Run: [NvMediaCenter] RUNDLL32.EXE G:&#092;WINDOWS&#092;system32&#092;NvMcTray.dll,NvTaskbarInit<br />O4 - HKLM&#092;..&#092;Run: [AVG7_CC] G:&#092;PROGRA~1&#092;Grisoft&#092;AVGFRE~1&#092;avgcc.exe /STARTUP<br />O4 - HKLM&#092;..&#092;Run: [StormCodec_Helper] &quot;G:&#092;Program Files&#092;Ringz Studio&#092;Storm Codec&#092;StormSet.exe&quot; /S /opti<br />O4 - HKLM&#092;..&#092;Run: [DAEMON Tools] &quot;G:&#092;Program Files&#092;DAEMON Tools&#092;daemon.exe&quot; -lang 1033<br />O4 - HKLM&#092;..&#092;Run: [SunJavaUpdateSched] &quot;G:&#092;Program Files&#092;Java&#092;jre1.6.0_02&#092;bin&#092;jusched.exe&quot;<br />O4 - HKLM&#092;..&#092;Run: [FinePrint Dispatcher v5] &quot;G:&#092;WINDOWS&#092;System32&#092;spool&#092;DRIVERS&#092;W32X86&#092;3&#092;fpdisp5a.exe&quot; /source=HKLM<br />O4 - HKLM&#092;..&#092;Run: [Adobe Reader Speed Launcher] &quot;G:&#092;Program Files&#092;Adobe&#092;Reader 8.0&#092;Reader&#092;Reader_sl.exe&quot;<br />O4 - HKLM&#092;..&#092;Run: [WinPatrol] G:&#092;Program Files&#092;BillP Studios&#092;WinPatrol&#092;winpatrol.exe<br />O4 - HKLM&#092;..&#092;Run: [AntiSpyWare2Guard] G:&#092;Program Files&#092;Ashampoo&#092;Ashampoo AntiSpyWare 2&#092;AntiSpyWare2Guard.exe<br />O4 - HKCU&#092;..&#092;Run: [CursorXP] &quot;G:&#092;Program Files&#092;CursorXP&#092;CursorXP.exe&quot; -s<br />O4 - HKCU&#092;..&#092;Run: [ctfmon.exe] G:&#092;WINDOWS&#092;system32&#092;ctfmon.exe<br />O4 - HKCU&#092;..&#092;Run: [MSMSGS] &quot;G:&#092;Program Files&#092;Messenger&#092;msmsgs.exe&quot; /background<br />O4 - HKCU&#092;..&#092;Run: [Yahoo&#33; Pager] &quot;G:&#092;Program Files&#092;Yahoo&#33;&#092;Messenger&#092;YahooMessenger.exe&quot; -quiet<br />O4 - Startup: Metacafe.lnk = G:&#092;Program Files&#092;Metacafe&#092;MetacafeAgent.exe<br />O4 - Global Startup: Metacafe.lnk = G:&#092;Program Files&#092;Metacafe&#092;MetacafeAgent.exe<br />O8 - Extra context menu item: &amp;Download All with FlashGet - G:&#092;Program Files&#092;FlashGet&#092;jc_all.htm<br />O8 - Extra context menu item: &amp;Download with FlashGet - G:&#092;Program Files&#092;FlashGet&#092;jc_link.htm<br />O8 - Extra context menu item: E&amp;xport to Microsoft Excel - res://G:&#092;PROGRA~1&#092;MICROS~2&#092;OFFICE11&#092;EXCEL.EXE/3000<br />O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - G:&#092;Program Files&#092;Java&#092;jre1.6.0_02&#092;bin&#092;ssv.dll<br />O9 - Extra &#39;Tools&#39; menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - G:&#092;Program Files&#092;Java&#092;jre1.6.0_02&#092;bin&#092;ssv.dll<br />O9 - Extra button: Yahoo&#33; Services - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - G:&#092;Program Files&#092;Yahoo&#33;&#092;Common&#092;yiesrvc.dll<br />O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - G:&#092;PROGRA~1&#092;MICROS~2&#092;OFFICE11&#092;REFIEBAR.DLL<br />O9 - Extra button: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - G:&#092;Program Files&#092;FlashGet&#092;FlashGet.exe<br />O9 - Extra &#39;Tools&#39; menuitem: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - G:&#092;Program Files&#092;FlashGet&#092;FlashGet.exe<br />O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - G:&#092;Program Files&#092;Messenger&#092;msmsgs.exe<br />O9 - Extra &#39;Tools&#39; menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - G:&#092;Program Files&#092;Messenger&#092;msmsgs.exe<br />O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (Installation Support) - G:&#092;Program Files&#092;Yahoo&#33;&#092;Common&#092;Yinsthelper.dll<br />O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - <a href='http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab' target='_blank'>http://messenger.zone.msn.com/binary/Messe...nt.cab56907.cab</a><br />O16 - DPF: {F5A7706B-B9C0-4C89-A715-7A0C6B05DD48} (Minesweeper Flags Class) - <a href='http://messenger.zone.msn.com/binary/MineSweeper.cab56986.cab' target='_blank'>http://messenger.zone.msn.com/binary/MineS...er.cab56986.cab</a><br />O17 - HKLM&#092;System&#092;CCS&#092;Services&#092;Tcpip&#092;..&#092;{73622AC8-CEFC-4F52-AFCE-37868F3A015A}: NameServer = 202.188.1.5,202.188.0.133<br />O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - G:&#092;PROGRA~1&#092;MSNMES~1&#092;MSGRAP~1.DLL<br />O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - G:&#092;PROGRA~1&#092;MSNMES~1&#092;MSGRAP~1.DLL<br />O20 - Winlogon Notify: WB - G:&#092;Program Files&#092;AlienGUIse&#092;fastload.dll<br />O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - G:&#092;WINDOWS&#092;system32&#092;WPDShServiceObj.dll<br />O23 - Service: Ashampoo AntiSpyWare 2 Service (AASW2_Service) - Unknown owner - G:&#092;Program Files&#092;Ashampoo&#092;Ashampoo AntiSpyWare 2&#092;AntiSpyWareService.exe<br />O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - G:&#092;PROGRA~1&#092;Grisoft&#092;AVGFRE~1&#092;avgamsvr.exe<br />O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - G:&#092;PROGRA~1&#092;Grisoft&#092;AVGFRE~1&#092;avgupsvc.exe<br />O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - G:&#092;PROGRA~1&#092;Grisoft&#092;AVGFRE~1&#092;avgemc.exe<br />O23 - Service: Intel&reg; Active Monitor (imonNT) - Intel Corp. - C:&#092;Program Files&#092;Intel&#092;Intel&reg; Active Monitor&#092;imonnt.exe<br />O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - G:&#092;WINDOWS&#092;system32&#092;nvsvc32.exe<br />O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - G:&#092;Program Files&#092;Analog Devices&#092;SoundMAX&#092;SMAgent.exe<!--SPOILER DIV--></div><!--SPOILER DIV--><br /><br />Yesterday some1 in maplestory asked me to add him in friendster, i thought he is my long lost friends so i added him, but once i added him in friendster the profile page re-directed me to another page and started dl/ing a file into my computer, and the file execute automatically. So im afraid it might be a keylogger. Please help me check my log. Thank in advance <!--emo&:respect:--><img src='http://static.lowyat.net/style_emoticons/default/notworthy.gif' border='0' style='vertical-align:middle' alt='notworthy.gif' /><!--endemo--> gdfreak Technical Support Fri, 14 Sep 2007 16:24:41 +0800