Logfile of HijackThis v1.99.1
Scan saved at 12:43:23, on 06/09/2008
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP3 (6.00.2900.5512)
Windows folder: C:\WINDOWS
System folder: C:\WINDOWS\SYSTEM32
Hosts file: C:\WINDOWS\System32\drivers\etc\hosts

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\Program Files\Nero 6\InCD\InCDsrv.exe
C:\WINDOWS\system32\S24EvMon.exe
C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\ATK0100\Hcontrol.exe
C:\Program Files\F-Secure Internet Security\Common\FSM32.EXE
C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe
C:\Program Files\Intel\PROSetWireless\NCS\PROSet\PRONoMgr.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Salaat Time\SalaatTime.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\F-Secure Internet Security\Anti-Virus\fsgk32st.exe
C:\Program Files\F-Secure Internet Security\backweb\4476822\program\fsbwsys.exe
C:\Program Files\F-Secure Internet Security\Anti-Virus\FSGK32.EXE
C:\Program Files\F-Secure Internet Security\Anti-Virus\fssm32.exe
C:\Program Files\F-Secure Internet Security\Common\FSMA32.EXE
C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
C:\Program Files\F-Secure Internet Security\Common\FSMB32.EXE
C:\WINDOWS\system32\RegSrvc.exe
C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
C:\Program Files\F-Secure Internet Security\Common\FCH32.EXE
C:\WINDOWS\System32\svchost.exe
C:\Program Files\F-Secure Internet Security\Common\FAMEH32.EXE
C:\Program Files\F-Secure Internet Security\Anti-Virus\fsqh.exe
C:\Program Files\F-Secure Internet Security\Anti-Virus\fsrw.exe
C:\Program Files\F-Secure Internet Security\FWES\Program\fsdfwd.exe
C:\WINDOWS\ATK0100\ATKOSD.exe
C:\Program Files\F-Secure Internet Security\Anti-Virus\fsav32.exe
C:\PROGRA~1\F-SECU~1\ANTI-S~1\fsaw.exe
C:\Program Files\F-Secure Internet Security\FSGUI\fsguidll.exe
C:\PROGRA~1\F-SECU~1\backweb\4476822\Program\SERVIC~1.EXE
C:\Program Files\F-Secure Internet Security\backweb\4476822\Program\fspex.exe
C:\WINDOWS\system32\mmc.exe
C:\Documents and Settings\Ahsan\My Documents\desktop icons\HijackThis.exe
C:\WINDOWS\system32\rundll32.exe
C:\WINDOWS\system32\wuauclt.exe

R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = http=127.0.0.1:8888;https=127.0.0.1:8888;
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll (filesize 501136 bytes, MD5 D6137540BDF0F9F9B9055C60ADD8007A)
O4 - HKLM\..\Run: [Hcontrol] C:\WINDOWS\ATK0100\Hcontrol.exeC:\WINDOWS\ATK0100\Hcontrol.exe
O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32 (filesize 208952 bytes, MD5 7BBE4CF421AECC7F0226EDD75F12079F)
O4 - HKLM\..\Run: [MSPY2002] C:\WINDOWS\system32\IME\PINTLGNT\ImScInst.exe /SYNC (filesize 59392 bytes, MD5 1B17E09C1223F6D17336D2DD7A1AF4F4)
O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC (filesize 455168 bytes, MD5 024DC0F68DF5FD6AE9DD82DFBAF479D6)
O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName (filesize 455168 bytes, MD5 024DC0F68DF5FD6AE9DD82DFBAF479D6)
O4 - HKLM\..\Run: [F-Secure Manager] "C:\Program Files\F-Secure Internet Security\Common\FSM32.EXE" /splash (filesize 122929 bytes, MD5 855E795383BED05C481575BD0C1C0D37)
O4 - HKLM\..\Run: [F-Secure TNB] "C:\Program Files\F-Secure Internet Security\TNB\TNBUtil.exe" /CHECKALL /WAITFORSW (filesize 700416 bytes, MD5 9153905D790DC0ADC7B992D0C948D247)
O4 - HKLM\..\Run: [F-Secure Startup Wizard] "C:\Program Files\F-Secure Internet Security\FSGUI\FSSW.EXE" /reboot (filesize 372736 bytes, MD5 D90838CBC9F7412EE26DCC17617E4D17)
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe" (filesize 132496 bytes, MD5 896E712A34D654A337C8CBB9DEB07200)
O4 - HKLM\..\Run: [BluetoothAuthenticationAgent] rundll32.exe bthprops.cpl,,BluetoothAuthenticationAgent (filesize 33280 bytes, MD5 037B1E7798960E0420003D05BB577EE6)
O4 - HKLM\..\Run: [PRONoMgr.exe] C:\Program Files\Intel\PROSetWireless\NCS\PROSet\PRONoMgr.exeC:\Program Files\Intel\PROSetWireless\NCS\PROSet\PRONoMgr.exe
O4 - HKLM\..\Run: [News Service] "C:\Program Files\F-Secure Internet Security\FSGUI\ispnews.exe" (filesize 356352 bytes, MD5 329F9DE88C88917E08F7F3D75704F23B)
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exeC:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [SalaatTime] C:\Program Files\Salaat Time\SalaatTime.exeC:\Program Files\Salaat Time\SalaatTime.exe
O4 - Global Startup: F-Secure 2006.lnk = C:\Program Files\F-Secure Internet Security\backweb\4476822\Program\fspex.exe (filesize 36903 bytes, MD5 CC2939B255697B4762A062AEB0B3E91E)
O8 - Extra context menu item: &Block this popup - C:\Program Files\F-Secure Internet Security\Anti-Spyware\blockpopups.htm (filesize 380 bytes, MD5 7D6B44419CEBF7B26CC106BAF0BE19B7)
O9 - Extra button: IE Shield - {300DB664-75B5-47c0-8B45-A44ACCF73C00} - C:\Program Files\F-Secure Internet Security\Anti-Spyware\ieshield.dll (filesize 49204 bytes, MD5 50F5BB31D5C3335822735E5B757AAB3E)
O9 - Extra 'Tools' menuitem: IE Shield... - {300DB664-75B5-47c0-8B45-A44ACCF73C00} - C:\Program Files\F-Secure Internet Security\Anti-Spyware\ieshield.dll (filesize 49204 bytes, MD5 50F5BB31D5C3335822735E5B757AAB3E)
O9 - Extra button: Fiddler - {CF819DA3-9882-4944-ADF5-6EF17ECF3C6E} - "C:\Program Files\Fiddler\Fiddler.exe" (file missing)
O9 - Extra 'Tools' menuitem: Fiddler - {CF819DA3-9882-4944-ADF5-6EF17ECF3C6E} - "C:\Program Files\Fiddler\Fiddler.exe" (file missing)
O23 - Service: Lavasoft Ad-Aware Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware\aawservice.exeC:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
O23 - Service: F-Secure 2006 (BackWeb Plug-in - 4476822) - F-Secure Internet Security 2005 - C:\PROGRA~1\F-SECU~1\backweb\4476822\Program\SERVIC~1.EXEC:\PROGRA~1\F-SECU~1\backweb\4476822\Program\SERVIC~1.EXE
O23 - Service: cc service (ccservice) - Unknown owner - C:\WINDOWS\system32\ccserv.exeC:\WINDOWS\system32\ccserv.exe
O23 - Service: FSGKHS (F-Secure Gatekeeper Handler Starter) - F-Secure Corporation - C:\Program Files\F-Secure Internet Security\Anti-Virus\fsgk32st.exeC:\Program Files\F-Secure Internet Security\Anti-Virus\fsgk32st.exe
O23 - Service: fsbwsys - F-Secure Corp. - C:\Program Files\F-Secure Internet Security\backweb\4476822\program\fsbwsys.exeC:\Program Files\F-Secure Internet Security\backweb\4476822\program\fsbwsys.exe
O23 - Service: F-Secure Anti-Virus Firewall Daemon (FSDFWD) - F-Secure Corporation - C:\Program Files\F-Secure Internet Security\FWES\Program\fsdfwd.exeC:\Program Files\F-Secure Internet Security\FWES\Program\fsdfwd.exe
O23 - Service: FSMA - F-Secure Corporation - C:\Program Files\F-Secure Internet Security\Common\FSMA32.EXEC:\Program Files\F-Secure Internet Security\Common\FSMA32.EXE
O23 - Service: InCD Helper (InCDsrv) - Nero AG - C:\Program Files\Nero 6\InCD\InCDsrv.exeC:\Program Files\Nero 6\InCD\InCDsrv.exe
O23 - Service: RegSrvc - Intel Corporation - C:\WINDOWS\system32\RegSrvc.exeC:\WINDOWS\system32\RegSrvc.exe
O23 - Service: Spectrum24 Event Monitor (S24EventMonitor) - Intel Corporation - C:\WINDOWS\system32\S24EvMon.exeC:\WINDOWS\system32\S24EvMon.exe
O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - C:\Program Files\Analog Devices\SoundMAX\SMAgent.exeC:\Program Files\Analog Devices\SoundMAX\SMAgent.exe

<!-- ack=0-->
<!-- time=1220652335-->
<!-- product=1.3.6.1.4.1.2213.12-->
<!-- severity=5-->
<!-- user=MONSTERS\Ahsa-->
<!-- version=2-->
<!-- encoding=ISO-8859-1-->


<meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1">

<html>
<font style="COLOR: black; FONT: 10pt verdana">
<head>
<title>F-Secure Anti-Virus 2006 6.12 - Scanning Report - 05 September 2008 23:05:35</title>
</head>

<h1><font face="Arial">Scanning Report</font></h1>
<h2><font face="Arial">05 September 2008 23:02:40 - 23:02:40</font></h2>
<p>
Computer name: MONSTERS
<br>Scanning type: Scan target for viruses
<br>Target: C:\
<hr noshade>
<h2><font face="Arial" color="#5A6ED2">Result: 12 malware found</font></h2>
<a href="http://www.Europe.F-Secure.com/cgi-bin/AT-Wdescssearch.cgi?search=Trojan-Downloader">Trojan-Downloader.Win32.Small.acxh</a> (virus)
<ul>
<li>C:\WINDOWS\system32\a.exe Action: deleted</ul>
<a href="http://www.Europe.F-Secure.com/cgi-bin/AT-Wdescssearch.cgi?search=Trojan-Downloader">Trojan-Downloader.JS.Agent.cnn</a> (virus)
<ul>
<li>C:\WINDOWS\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\UJS5OLMR\ac[1].htm Action: deleted<li>C:\WINDOWS\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\2JMJWDQH\ac[1].htm Action: deleted<li>C:\WINDOWS\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\UJS5OLMR\ac[2].htm Action: deleted<li>C:\WINDOWS\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\2JMJWDQH\ac[2].htm Action: deleted<li>C:\WINDOWS\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\UJS5OLMR\ac[3].htm Action: deleted<li>C:\WINDOWS\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\2JMJWDQH\midroll[1].htm Action: deleted<li>C:\WINDOWS\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\UJS5OLMR\Near-Death-Experience[1].htm Action: deleted<li>C:\WINDOWS\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\MZUJQR4D\showadvertising[1].htm Action: deleted<li>C:\WINDOWS\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\CPU1IHKX\showadvertising[1].htm Action: deleted<li>C:\WINDOWS\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\UJS5OLMR\stats_js[1].htm Action: deleted<li>C:\WINDOWS\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\CPU1IHKX\zfillers_990_500[1].htm Action: deleted</ul>
</ul>
<p>
</ul>
<p>
<hr noshade>
<h2><font face="Arial" color="#5A6ED2">Statistics</font></h2>
Scanned:
<ul>
<li>Files: 31559
<li>System: 0
<li>Not scanned: 15
</ul>
Result:
<ul>
<li>Viruses: 12
<li>Spyware: 0
<li>Suspicious items: 0
</ul>
Actions:
<ul>
<li>Disinfected: 0
<li>Renamed: 0
<li>Deleted: 12
<li>Quarantined: 0
<li>Failed: 0
</ul>
Boot Sectors:
<ul>
<li>Scanned: 1
<li>Infected: 0
<li>Suspicious items: 0
<li>Disinfected: 0
</ul>
Files not scanned:
<ul>
<li>Cannot open file C:\hiberfil.sys<li>Cannot open file C:\WINDOWS\system32\config\default<li>Scanning of C:\WINDOWS\Driver Cache\i386\driver.cab was aborted [F-Secure AVP]<li>Cannot open a file in archive C:\Program Files\Nero 6\InCD\dma.bin<li>Cannot open a file in archive C:\Program Files\Nero 6\InCD\gaa.bin<li>Cannot open a file in archive C:\Program Files\Nero 6\InCD\lgc.bin<li>Cannot open a file in archive C:\Program Files\Mosby\Oral Pathology Clinical Pathologic Correlations, 4e\images\image 13.pct<li>Cannot open a file in archive C:\Program Files\Mosby\Oral Pathology Clinical Pathologic Correlations, 4e\BoardReview\images\image 13.pct<li>Scanning of C:\Program Files\mobile PhoneTools\widcomm\Data1.cab was aborted [F-Secure AVP]<li>Scanning of C:\Program Files\Java\jre1.6.0_02\lib\rt.jar was aborted [F-Secure AVP]<li>Scanning of C:\Program Files\Java\jre1.5.0_06\lib\rt.jar was aborted [F-Secure AVP]<li>Scanning of C:\Program Files\F-Secure Internet Security\backweb\4476822\Users\Default\Data\707a\1060a610\pex_6.12-90.jar was aborted [F-Secure AVP]<li>Cannot open a file in archive C:\Documents and Settings\All Users\Application Data\BVRP Software\mobile PhoneTools\faxres.cmd<li>Cannot open a file in archive C:\Documents and Settings\All Users\Application Data\BVRP Software\mobile PhoneTools\Profiles\#Default Profile.cab\C:\Documents and Settings\All Users\Application Data\BVRP Software\mobile PhoneTools\fax0mid.mid<li>Cannot open a file in archive C:\Documents and Settings\All Users\Application Data\BVRP Software\mobile PhoneTools\Profiles\#Default Profile.cab\C:\Documents and Settings\All Users\Application Data\BVRP Software\mobile PhoneTools\Profile.reg</ul>
<p>
<hr noshade>
<h2><font face="Arial" color="#5A6ED2">Options</font></h2>

Definitions version:<ul>
<li>Viruses: 2008-09-05_02
<li>Spyware: 2008-07-18_08
</ul>
Scanning Engines:<ul>
<li>F-Secure AVP: 6.00.169, 2008-09-05
<li>F-Secure Libra: 2.04.04, 2008-09-02
<li>F-Secure Orion: 1.02.37, 2008-09-05
<li>F-Secure Draco: 1.00.35, 2008-07-18
</ul>Scanning options:
<ul>
<li>Scan defined files: COM EXE SYS OV? BIN SCR DLL SHS HTM HTML HTT VBS JS INF VXD DO? XL? RTF CPL WIZ HTA PP? PWZ P?T MSO PIF . ACM ASP AX CNV CSC DRV INI MDB MPD MPP MPT OBD OBT OCX PCI TLB TSP WBK WBT WPC WSH VWP WML BOO HLP TD0 TT6 MSG ASD JSE VBE WSC CHM EML PRC SHB LNK WSF {* PDF ZL? XML ANI AVB BAT CEO CMD JPG LSP MAP MHT MIF PHP POT SWF WMF NWS TAR TGZ ZIP JAR ARJ LZH TAR TGZ GZ CAB RAR BZ2 HQX
<li>Scan inside archives
</ul></ul>Actions:<ul>
<li>Viruses: Ask after scan
<li>Spyware: Ask after scan
</ul>
<hr noshade>
<ul><h6>Copyright © 1998-2005 <a href="http://support.f-secure.com/">Product support</a> |
<a href="http://support.f-secure.com/enu/home/virusproblem/sample/">Send virus sample to F-Secure</a></h6>
<h6>F-Secure assumes no responsibility for material created or published by third parties that
F-Secure World Wide Web pages have a link to.
Unless you have clearly stated otherwise, by submitting material to any of our servers, for example by
E-mail or via our F-Secure's CGI E-mail, you agree that the material you make available may be
published in the F-Secure World Wide Pages or hard-copy publications.

You will reach F-Secure public web site by clicking on underlined links. While doing this,
your access will be logged to our private access statistics with your domain name.
This information will not be given to any third party.
You agree not to take action against us in relation to material that you submit. Unless you have clearly
stated otherwise, by submitting material you warrant that F-Secure may incorporate any concepts
described in it in the F-Secure products/publications without liability.
</h6></ul></body>
</font>
</html>