Logfile of HijackThis v1.99.1
Scan saved at 18:08:19, on 08.06.2005
Platform: Windows 2000 SP4 (WinNT 5.00.2195)
MSIE: Internet Explorer v5.00 SP4 (5.00.2920.0000)
Running processes:
C:\WINNT\System32\smss.exe
C:\WINNT\system32\winlogon.exe
C:\WINNT\system32\services.exe
C:\WINNT\system32\lsass.exe
C:\WINNT\system32\Ati2evxx.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\system32\spoolsv.exe
C:\WINNT\system32\svchost.exe
F:\System\mysql\bin\mysqld-nt.exe
C:\WINNT\system32\regsvc.exe
C:\WINNT\system32\MSTask.exe
C:\Programme\Analog Devices\SoundMAX\SMAgent.exe
C:\WINNT\System32\WBEM\WinMgmt.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\system32\Ati2evxx.exe
C:\WINNT\Explorer.EXE
C:\Programme\ATI Technologies\ATI Control Panel\atiptaxx.exe
C:\Programme\Java\jre1.5.0_02\bin\jusched.exe
C:\Programme\D-Tools\daemon.exe
F:\Media\Mp3PlayerSoftware\HDDDMM\DMM\bin\AutoLaunchHDD70.exe
F:\System\Logitech\MouseWare\system\em_exec.exe
C:\PROGRA~1\GEMEIN~1\PHILIP~1\USBCON~1.EXE
F:\Internet\mIRC\mirc.exe
F:\Internet\Trillian\trillian.exe
C:\WINNT\system32\msdtc.exe
F:\Sound\Winamp v2.91\winamp.exe
F:\Internet\Opera\Opera.exe
F:\Internet\Hamachi\hamachi.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\system32\TCPService2.exe
F:\ReInstall\hijackthis1991.exe
R1 - HKCU\Software\Microsoft\Internet Explorer,SearchURL =
http://searchforfree.info/browser/
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar =
http://hot-searches.com/search.php?v=6&aff=8364248
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page =
http://hot-searches.com/index.php?v=6&aff=8364248
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page =
http://hot-searches.com/index.php?v=6&aff=8364248
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL =
http://searchforfree.info/?sid=u002
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL =
http://searchforfree.info/browser/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page =
http://searchforfree.info/browser/
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page =
http://searchforfree.info/?sid=u002
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
http://searchforfree.info/browser/
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
http://searchforfree.info/browser/
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *hot-searches.com*;*lender-search.com*
F3 - REG:win.ini: run=C:\WINNT\htmlsync.exe
O1 - Hosts file is located at: C:\WINNT\nsdb\hosts
O1 - Hosts: 82.179.166.164 lender-search.com
O1 - Hosts: 82.179.166.165 hot-searches.com
O2 - BHO: WHttpHelper Class - {9896231A-C487-43A5-8369-6EC9B0A96CC0} - C:\WINNT\system32\WStart.dll
O3 - Toolbar: @msdxmLC.dll,-1@1031,&Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINNT\system32\msdxm.ocx
O4 - HKLM\..\Run: [Synchronization Manager] mobsync.exe /logon
O4 - HKLM\..\Run: [ATIPTA] C:\Programme\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Programme\Java\jre1.5.0_02\bin\jusched.exe
O4 - HKLM\..\Run: [DAEMON Tools-1033] "C:\Programme\D-Tools\daemon.exe" -lang 1033
O4 - HKLM\..\Run: [Logitech Utility] Logi_MwX.Exe
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINNT\system32\NeroCheck.exe
O4 - HKLM\..\Run: [/AutoLaunchHDD70] F:\Media\Mp3PlayerSoftware\HDDDMM\DMM\bin\AutoLaunchHDD70.exe
O4 - HKLM\..\Run: [REGSHAVE] C:\Programme\REGSHAVE\REGSHAVE.EXE /AUTORUN
O4 - HKLM\..\Run: [isystem] C:\WINNT\system32\isystem.exe
O4 - HKCU\..\Run: [ldriver] C:\WINNT\system32\ldriver.exe
O4 - Startup: Trillian.lnk = F:\Internet\Trillian\trillian.exe
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programme\Java\jre1.5.0_02\bin\npjpi150_02.dll
O9 - Extra 'Tools' menuitem: Sun Java Konsole - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programme\Java\jre1.5.0_02\bin\npjpi150_02.dll
O14 - IERESET.INF: SEARCH_PAGE_URL=
O14 - IERESET.INF: START_PAGE_URL=
O17 - HKLM\System\CCS\Services\Tcpip\..\{F69FF9DA-04F2-4B3D-96C1-A0ED60DC642C}: NameServer = 192.168.1.1
O18 - Filter: text/html - {4F7681E5-6CAF-478D-9CB8-4CA593BEE7FB} - C:\WINNT\system32\xplugin.dll
O21 - SSODL: giauTQj - {F8536351-52F9-C9FB-A5A4-1A72C5BFB47A} - C:\WINNT\system32\sqz.dll
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINNT\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINNT\system32\ati2sgag.exe
O23 - Service: Verwaltungsdienst für die Verwaltung logischer Datenträger (dmadmin) - VERITAS Software Corp. - C:\WINNT\System32\dmadmin.exe
O23 - Service: MySql - Unknown owner - F:/System/mysql/bin/mysqld-nt.exe
O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - C:\Programme\Analog Devices\SoundMAX\SMAgent.exe