Logfile of HijackThis v1.99.1
Scan saved at 08:46:34, on 06-04-2005
Platform: Windows 2000 SP4 (WinNT 5.00.2195)
MSIE: Internet Explorer v5.00 SP4 (5.00.2920.0000)
Running processes:
C:\WINNT\System32\smss.exe
C:\WINNT\system32\winlogon.exe
C:\WINNT\system32\services.exe
C:\WINNT\system32\lsass.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\system32\spoolsv.exe
C:\WINNT\System32\msdtc.exe
C:\program files\nav\defwatch.exe
C:\WINNT\system32\Dfssvc.exe
C:\WINNT\System32\tcpsvcs.exe
C:\WINNT\System32\svchost.exe
C:\WINNT\System32\cba\pds.exe
C:\WINNT\System32\ismserv.exe
C:\WINNT\System32\llssrv.exe
C:\program files\nav\rtvscan.exe
C:\WINNT\system32\ntfrs.exe
C:\WINNT\system32\regsvc.exe
C:\WINNT\System32\locator.exe
C:\WINNT\system32\MSTask.exe
C:\WINNT\System32\svchost.exe
C:\WINNT\System32\WBEM\WinMgmt.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\System32\inetsrv\inetinfo.exe
C:\msp\mspadmin.exe
C:\WINNT\Explorer.EXE
C:\PROGRA~1\nav\vptray.exe
C:\WINNT\system32\internat.exe
C:\Program Files\RMClient\PMClient.exe
C:\WINNT\system32\mmc.exe
C:\msp\W3Prefch.exe
C:\WINNT\System32\mdm.exe
C:\msp\w3proxy.exe
C:\msp\wspsrv.exe
D:\Faelles\hjt.exe
C:\WINNT\system32\mmc.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page =
http://securityresponse.symantec.com/avcenter/download/pages/US-NAVCE.htmlR0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Qeq Pro
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = xserver:8080
O3 - Toolbar: @msdxmLC.dll,-1@1033,&Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINNT\System32\msdxm.ocx
O4 - HKLM\..\Run: [vptray] C:\PROGRA~1\nav\vptray.exe
O4 - HKLM\..\Run: [DU Meter] C:\Program Files\DU Meter\DUMeter.exe
O4 - HKCU\..\Run: [internat.exe] internat.exe
O4 - Global Startup: Aficio Manager 3.5 for Client.lnk = C:\Program Files\RMClient\PMClient.exe
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINNT\web\related.htm
O9 - Extra 'Tools' menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINNT\web\related.htm
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) -
http://www.pandasoftware.com/activescan/as5/asinst.cabO17 - HKLM\System\CCS\Services\Tcpip\Parameters: Domain = kontor.local
O17 - HKLM\System\CCS\Services\Tcpip\..\{93C094BB-4D64-45D4-8EEA-CAD1EBFCBAAD}: NameServer = xxx.xx.xx.50
O17 - HKLM\System\CCS\Services\Tcpip\..\{C79D09F9-3F55-4F48-A5EE-B63229254165}: NameServer = xxx.xxx.xxx.7,xxx.xxx.xxx.11
O17 - HKLM\System\CS1\Services\Tcpip\Parameters: Domain = kontor.local
O17 - HKLM\System\CS2\Services\Tcpip\Parameters: Domain = kontor.local
O18 - Protocol: ayb - (no CLSID) - (no file)
O20 - Winlogon Notify: NavLogon - C:\WINNT\System32\NavLogon.dll
O23 - Service: DefWatch - Symantec Corporation - C:\program files\nav\defwatch.exe
O23 - Service: Logical Disk Manager Administrative Service (dmadmin) - VERITAS Software Corp. - C:\WINNT\System32\dmadmin.exe
O23 - Service: Intel PDS - Intel Corporation - C:\WINNT\System32\cba\pds.exe
O23 - Service: Norton AntiVirus Server - Symantec Corporation - C:\program files\nav\rtvscan.exe