Log til Hijack This
Logfile of HijackThis v1.97.7Scan saved at 12:25:37, on 20-05-04
Platform: Windows NT 4 SP6 (WinNT 4.00.1381)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)
Running processes:
C:\WINNT\System32\smss.exe
C:\WINNT\system32\winlogon.exe
C:\WINNT\system32\services.exe
C:\WINNT\system32\lsass.exe
C:\WINNT\system32\spoolss.exe
C:\WINNT\System32\mgabg.exe
C:\WINNT\System32\mgasc.exe
C:\WINNT\System32\nddeagnt.exe
C:\WINNT\System32\mgactrl.exe
C:\WINNT\Explorer.exe
C:\WINNT\system32\RpcSs.exe
C:\WINNT\System32\NMSSvc.exe
c:\winnt\system32\pstores.exe
C:\WINNT\System32\SysTray.Exe
C:\WINNT\System32\loadwc.exe
C:\WINNT\System32\PROMon.exe
C:\Programmer\MGA NT PowerDesk\QDesk\MGAQDESK.EXE
C:\WINNT\System32\hpnra.exe
C:\PROGRA~1\Logitech\MOUSEW~1\SYSTEM\EM_EXEC.EXE
C:\Programmer\Logitech\Desktop Messenger\8876480\Program\backWeb-8876480.exe
C:\WINNT\loadqm.exe
C:\WINNT\System32\qttask.exe
C:\Programmer\Adobe\Acrobat 4.0\Distillr\AcroTray.exe
C:\Programmer\Microsoft Office\Office\MSOFFICE.EXE
C:\Programmer\Microsoft Office\Office\OSA.EXE
C:\Programmer\Plus!\Microsoft Internet\IEXPLORE.EXE
C:\Programmer\Microsoft Office\Office\OUTLOOK.EXE
C:\Programmer\Fælles filer\System\MAPI\1033\nt\MAPISP32.EXE
C:\Programmer\Spybot - Search & Destroy\TeaTimer.exe
C:\WINNT\Profiles\johannes.001\Skrivebord\Arlet.dk\hjt.exe
C:\WINNT\System32\ddhelp.exe
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.dk.msn.com/access/allinone.htm
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.cse.dk/kf
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = 10.233.29.30:80
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Hyperlinks
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,Shellnext = http://gpbors/intranet/SBSClientHelp/default.asp
F2 - REG:system.ini: UserInit=userinit,nddeagnt.exe
O2 - BHO: (no name) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - D:\adobereader\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINNT\System32\msdxm.ocx
O4 - HKLM\..\Run: [SystemTray] SysTray.Exe
O4 - HKLM\..\Run: [BrowserWebCheck] loadwc.exe
O4 - HKLM\..\Run: [PROMon.exe] PROMon.exe
O4 - HKLM\..\Run: [MGABG] "C:\WINNT\System32\MGABG.EXE"
O4 - HKLM\..\Run: [MGA QuickDesk] "C:\Programmer\MGA NT PowerDesk\QDesk\MGAQDESK.EXE"
O4 - HKLM\..\Run: [HP Network Registry Agent] C:\WINNT\System32\hpnra.exe
O4 - HKLM\..\Run: [EM_EXEC] C:\PROGRA~1\Logitech\MOUSEW~1\SYSTEM\EM_EXEC.EXE
O4 - HKLM\..\Run: [LDM] C:\Programmer\Logitech\Desktop Messenger\8876480\Program\backWeb-8876480.exe
O4 - HKLM\..\Run: [LoadQM] loadqm.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\WINNT\System32\qttask.exe" -atboottime
O4 - HKLM\..\Run: [SchedulingAgent] mstinit.exe /logon
O4 - HKCU\..\Run: [LDM] C:\Programmer\Logitech\Desktop Messenger\8876480\Program\BackWeb-8876480.exe
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Programmer\Spybot - Search & Destroy\TeaTimer.exe
O4 - Global Startup: Acrobat Assistant.lnk = C:\Programmer\Adobe\Acrobat 4.0\Distillr\AcroTray.exe
O4 - Global Startup: Logitech Desktop Messenger.lnk = C:\Programmer\Logitech\Desktop Messenger\8876480\Program\LDMConf.exe
O4 - Global Startup: Microsoft Office Programlinje.lnk = C:\Programmer\Microsoft Office\Office\MSOFFICE.EXE
O4 - Global Startup: Microsoft Office-start.lnk = C:\Programmer\Microsoft Office\Office\OSA.EXE
O4 - Global Startup: Microsoft Office.lnk = C:\Programmer\Microsoft Office\Office\OSA9.EXE
O9 - Extra button: Related (HKLM)
O9 - Extra 'Tools' menuitem: Show &Related Links (HKLM)
O12 - Plugin for .com/publicPublicationGuideLatest?command=fetch&publication_id=5716: C:\PROGRA~1\Plus!\MICROS~1\PLUGINS\nppdf32.dll
O12 - Plugin for .pdf: C:\PROGRA~1\Plus!\MICROS~1\PLUGINS\nppdf32.dll
O13 - WWW. Prefix: http://
O16 - DPF: Online investering - http://www.onlineinvestering.unibank.dk/sign/310/oicab.cab
O16 - DPF: {02BF25D5-8C17-4B23-BC80-D3488ABDDC6B} (QuickTime Object) - http://www.apple.com/qtactivex/qtplugin.cab
O16 - DPF: {166B1BCA-3F9C-11CF-8075-444553540000} (Shockwave ActiveX Control) - http://download.macromedia.com/pub/shockwave/cabs/director/sw.cab
O16 - DPF: {1A8790BD-AEBD-11BD-A2BD-00620BD00020} (Egnsbank Nords Netbank) - https://www.nordbank.dk/segnsbanknordibp2000ib100.cab
O16 - DPF: {21F49842-BFA9-11D2-A89C-00104B62BDDA} (ChartFX Internet Control) -
O16 - DPF: {31B7EB4E-8B4B-11D1-A789-00A0CC6651A8} (Cult3D ActiveX Player) - http://www.cult3d.com/download/cult.cab
O16 - DPF: {33564D57-0000-0010-8000-00AA00389B71} - http://download.microsoft.com/download/F/6/E/F6E491A6-77E1-4E20-9F5F-94901338C922/wmv9VCM.CAB
O16 - DPF: {6CB5E471-C305-11D3-99A8-000086395495} - http://toolbar.google.com/data/da/big/1.1.62-big/GoogleNav.cab
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai.net/7/840/537/2002112001/housecall.antivirus.com/housecall/xscan53.cab
O16 - DPF: {917623D1-D8E5-11D2-BE8B-00104B06BDE3} (CamImage Class) - http://www.hornsrev.dk/cgi-bin3/AxisCamControl.ocx
O16 - DPF: {C81B5180-AFD1-41A3-97E1-99E8D254DB98} (CSS Web Installer Class) - http://scanner.virus112.com/cabs/cssweb.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab
O16 - DPF: {DC765522-D5BE-49C9-AF5F-8C715A44BA28} (MS Investor Ticker) - http://fdl.msn.com/public/investor/v9.5/ticker.cab
O16 - DPF: {FC25B780-75BE-11CF-8B01-444553540000} (Chart Object) - http://activex.microsoft.com/activex/controls/iexplorer/x86/iechart.cab
