Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 11:33:09 AM, on 6/8/2010
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Avira\AntiVir Desktop\sched.exe
C:\Program Files\Avira\AntiVir Desktop\avgnt.exe
C:\WINDOWS\system32\igfxtray.exe
C:\WINDOWS\system32\hkcmd.exe
C:\WINDOWS\system32\igfxpers.exe
C:\Program Files\Internet Download Manager\IDMan.exe
C:\WINDOWS\system32\igfxsrvc.exe
C:\Program Files\Avira\AntiVir Desktop\avguard.exe
C:\Program Files\Avira\AntiVir Desktop\avshadow.exe
C:\Program Files\Internet Download Manager\IEMonitor.exe
D:\u\UniKeyNT.exe
C:\Program Files\Yahoo!\Messenger\ymsgr_tray.exe
C:\Program Files\Trend Micro\HiJackThis\HiJackThis.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.ongame.com.vn
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://support.microsoft.com/kb/279783/en
O2 - BHO: IDM Helper - {0055C089-8582-441B-A0BF-17B458C2A3A8} - C:\Program Files\Internet Download Manager\IDMIECC.dll
O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir Desktop\avgnt.exe" /min
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [Persistence] C:\WINDOWS\system32\igfxpers.exe
O4 - HKCU\..\Run: [Yahoo! Pager] "C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe" -quiet
O4 - HKCU\..\Run: [IDMan] C:\Program Files\Internet Download Manager\IDMan.exe /onboot
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O8 - Extra context menu item: Download all links with IDM - C:\Program Files\Internet Download Manager\IEGetAll.htm
O8 - Extra context menu item: Download FLV video content with IDM - C:\Program Files\Internet Download Manager\IEGetVL.htm
O8 - Extra context menu item: Download with IDM - C:\Program Files\Internet Download Manager\IEExt.htm
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Yahoo! Messenger - {E5D12C4E-7B4F-11D3-B5C9-0050045C3C96} - C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe
O9 - Extra 'Tools' menuitem: Yahoo! Messenger - {E5D12C4E-7B4F-11D3-B5C9-0050045C3C96} - C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {7FB87A62-C850-4FA8-A82F-A12468FEBC1F} (OnGameDownloader Control) - http://ongame.vn/activeX/OnGameDownLoader.cab
O22 - SharedTaskScheduler: Browseui preloader - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - C:\WINDOWS\system32\browseui.dll
O22 - SharedTaskScheduler: Component Categories cache daemon - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\WINDOWS\system32\browseui.dll
O23 - Service: Avira AntiVir Scheduler (AntiVirSchedulerService) - Avira GmbH - C:\Program Files\Avira\AntiVir Desktop\sched.exe
O23 - Service: Avira AntiVir Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir Desktop\avguard.exe
O23 - Service: nProtect GameGuard Service (npggsvc) - Unknown owner - C:\WINDOWS\system32\GameMon.des.exe (file missing)

--
End of file - 3835 bytes

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 5:32:46 PM, on 5/12/2010
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP3 (6.00.2900.5512)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\VMware\VMware Workstation\vmware-tray.exe
C:\Program Files\DeviceVM\Browser Configuration Utility\BCU.exe
C:\WINDOWS\RTHDCPL.EXE
C:\WINDOWS\system32\igfxtray.exe
C:\WINDOWS\system32\hkcmd.exe
C:\WINDOWS\system32\igfxsrvc.exe
C:\WINDOWS\system32\igfxpers.exe
C:\Program Files\DeviceVM\Browser Configuration Utility\BCUService.exe
C:\Program Files\GIGABYTE\EnergySaver\GSvr.exe
C:\Program Files\Norton Internet Security\Engine\16.7.0.30\ccSvcHst.exe
C:\Program Files\Common Files\VMware\USB\vmware-usbarbitrator.exe
C:\WINDOWS\system32\vmnat.exe
C:\WINDOWS\system32\vmnetdhcp.exe
C:\Program Files\VMware\VMware Workstation\vmware-authd.exe
C:\Program Files\Norton Internet Security\Engine\16.7.0.30\ccSvcHst.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\WINDOWS\system32\taskmgr.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://google.com.vn/
R3 - URLSearchHook: SearchHook Class - {BC86E1AB-EDA5-4059-938F-CE307B0C6F0A} - C:\Program Files\DeviceVM\Browser Configuration Utility\AddressBarSearch.dll
O2 - BHO: Symantec NCO BHO - {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} - C:\Program Files\Norton Internet Security\Engine\16.7.0.30\coIEPlg.dll
O2 - BHO: Symantec Intrusion Prevention - {6D53EC84-6AAE-4787-AEEE-F4628F01010C} - C:\Program Files\Norton Internet Security\Engine\16.7.0.30\IPSBHO.DLL
O3 - Toolbar: Norton Toolbar - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - C:\Program Files\Norton Internet Security\Engine\16.7.0.30\coIEPlg.dll
O4 - HKLM\..\Run: [vmware-tray] "C:\Program Files\VMware\VMware Workstation\vmware-tray.exe"
O4 - HKLM\..\Run: [BCU] "C:\Program Files\DeviceVM\Browser Configuration Utility\BCU.exe"
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [Persistence] C:\WINDOWS\system32\igfxpers.exe
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O10 - Unknown file in Winsock LSP: c:\program files\vmware\vmware workstation\vsocklib.dll
O10 - Unknown file in Winsock LSP: c:\program files\vmware\vmware workstation\vsocklib.dll
O18 - Protocol: symres - {AA1061FE-6C41-421F-9344-69640C9732AB} - C:\Program Files\Norton Internet Security\Engine\16.7.0.30\coIEPlg.dll
O23 - Service: Browser Configuration Utility Service (BCUService) - DeviceVM, Inc. - C:\Program Files\DeviceVM\Browser Configuration Utility\BCUService.exe
O23 - Service: GEST Service for program management. (GEST Service) - Unknown owner - C:\Program Files\GIGABYTE\EnergySaver\GSvr.exe
O23 - Service: Norton Internet Security - Symantec Corporation - C:\Program Files\Norton Internet Security\Engine\16.7.0.30\ccSvcHst.exe
O23 - Service: VMware Agent Service (ufad-ws60) - VMware, Inc. - C:\Program Files\VMware\VMware Workstation\vmware-ufad.exe
O23 - Service: VMware Authorization Service (VMAuthdService) - VMware, Inc. - C:\Program Files\VMware\VMware Workstation\vmware-authd.exe
O23 - Service: VMware DHCP Service (VMnetDHCP) - VMware, Inc. - C:\WINDOWS\system32\vmnetdhcp.exe
O23 - Service: VMware USB Arbitration Service (VMUSBArbService) - VMware, Inc. - C:\Program Files\Common Files\VMware\USB\vmware-usbarbitrator.exe
O23 - Service: VMware NAT Service - VMware, Inc. - C:\WINDOWS\system32\vmnat.exe

--
End of file - 4327 bytes

+===================================+
| New Account Info                  |
+===================================+
| Domain: dkons.vn
| Ip: 67.228.109.148 (y)
| HasCgi: y
| UserName: dkonsvn
| PassWord: $DwdVzm1p=j@6j(h|
| CpanelMod: x3
| HomeRoot: /home
| Quota: 0 Meg
| NameServer1: dns18.fpt.vn
| NameServer2: dns17.fpt.vn
| NameServer3: 
| NameServer4: 
| Contact Email: 
| Package: default
| Feature list: default
| Language: english


Dressup24h.com
games9x
K$Tv?-qv&!kK6{k%8



dressup9x.com
dressup9
J$W/YLS#A{W=p9wgJ


gamesfor9x.com
gamesfor
@},#s.FdhIRczNVX?p


ilovegirlgames.com
lovegl
i2Pn?=X8qJ8*+KsD{


imageswho.com
imageswh
@y)G%~32iiP:@!s<b

inthesofts.com
intheso
wvl><Pl}@@)PMCD{S(


protectyourhealth.biz
protect
GT)cqD:?c2If%plSt

roomdecor5.com
roomder
hWz+rBiZ{AT+.}~Zx


teenxinh.biz
teenxinh
S~81Hj3m3,~A7;Py)


itechnew.com
itechnew
MP@e&61?(4c%1M%C&


thongtinchungkhoan.org
thongtin
ZPidspB(J1KuN!I)X

tiptop.vn
tiptop
bBF@8,bpBKTxI-9z1


67.228.106.34:2086
root
FLq|b2?9#!%V4wfb


smiles24h.com
smiles24
@},#s.FdhIRcz*@!


| Domain: saywithhoney.com
| Ip: 67.228.109.164 (y)
| HasCgi: y
| UserName: saywith
| PassWord: Y}rFIY@*rP}jR,+g
| CpanelMod: x3


| Domain: cdresell.com
| Ip: 67.228.109.162 (y)
| HasCgi: y
| UserName: cdresell
| PassWord: {2GaB9q*k~l*,#V#=
| CpanelMod: x3
| HomeRoot: /home
| Quota: 0 Meg
| NameServer1: ns1.softlayer.com
| NameServer2: ns2.softlayer.com
| NameServer3: 
| NameServer4: 
| Contact Email: 
| Package: default
| Feature list: default
| Language: english



+===================================+
| New Account Info                  |
+===================================+
| Domain: timvieclam247.com
| Ip: 67.228.109.155 (y)
| HasCgi: y
| UserName: timviec
| PassWord: qNXqk|3A+a=R=b=Y?
| CpanelMod: x3
| HomeRoot: /home
| Quota: 0 Meg
| NameServer1: ns2.everydns.net
| NameServer2: ns1.everydns.net
| NameServer3: ns4.everydns.net
| NameServer4: ns3.everydns.net
| Contact Email: 
| Package: default
| Feature list: default
| Language: english
+===================================+
...Done


| Domain: yadressup.com
| Ip: 67.228.109.151 (y)
| HasCgi: y
| UserName: yadress
| PassWord: UP6RP><~=acGc/qame
| CpanelMod: x3
| HomeRoot: /home
| Quota: 0 Meg
| NameServer1: ns2.everydns.net
| NameServer2: ns1.everydns.net
| NameServer3: ns4.everydns.net
| NameServer4: ns3.everydns.net
| Contact Email: 
| Package: default
| Feature list: default
| Language: english


+===================================+
| New Account Info                  |
+===================================+
| Domain: softswaretips.com
| Ip: 67.228.109.165 (y)
| HasCgi: y
| UserName: softstip
| PassWord: m+f&e<2bnYk6zP#2|
| CpanelMod: x3
| HomeRoot: /home
| Quota: 0 Meg
| NameServer1: ns2.everydns.net
| NameServer2: ns1.everydns.net
| NameServer3: ns4.everydns.net
| NameServer4: ns3.everydns.net
| Contact Email: 
| Package: default
| Feature list: default
| Language: english
+===================================+
...Done


+===================================+
| New Account Info                  |
+===================================+
| Domain: story24h.com
| Ip: 67.228.109.160 (y)
| HasCgi: y
| UserName: story24h
| PassWord: E7c~x6-WA//NN:sFJ
| CpanelMod: x3
| HomeRoot: /home
| Quota: 0 Meg
| NameServer1: ns52.domaincontrol.com
| NameServer2: ns51.domaincontrol.com
| NameServer3: 
| NameServer4: 
| Contact Email: 
| Package: default
| Feature list: default
| Language: english
+===================================+

123dressupgirl.com
dress123
D$q)~4CbGJl1