Her kommer den så fra Hijackthis:
Logfile of HijackThis v1.99.1
Scan saved at 20:51:53, on 29-06-2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Programmer\Norton AntiVirus\navapsvc.exe
C:\Programmer\Norton Internet Security\NISUM.EXE
C:\WINDOWS\SYSTEM\DRIVER\ntuser.exe
C:\WINDOWS\SYSTEM\DRIVER\ntsrv.exe
C:\WINDOWS\system\driver\csrss.exe
C:\WINDOWS\System32\nvsvc32.exe
C:\WINDOWS\System32\svchost.exe
C:\Programmer\Norton Internet Security\SymProxySvc.exe
C:\Programmer\Norton Internet Security\NISSERV.EXE
C:\Programmer\Fælles filer\Symantec Shared\Security
Center\SymWSC.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\Mixer.exe
C:\PROGRA~1\NORTON~1\navapw32.exe
C:\Programmer\Norton Internet Security\IAMAPP.EXE
C:\WINDOWS\System32\rmctrl.exe
C:\Programmer\iWare\iWare Mouse\3.2\lwbwheel.exe
C:\Programmer\QuickTime\qttask.exe
C:\Programmer\Java\jre1.5.0_02\bin\jusched.exe
C:\Programmer\Winamp\winampa.exe
C:\WINDOWS\system32\RunDll32.exe
C:\WINDOWS\system\wcdvtray.exe
C:\WINDOWS\system32\LVCOMSX.EXE
C:\Programmer\Logitech\Video\LogiTray.exe
C:\Programmer\MSN
Apps\Updater\01.02.3000.1001\da\msnappau.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Programmer\Yahoo!\Messenger\ypager.exe
C:\Program Files\Logitech\Desktop
Messenger\8876480\Program\BackWeb-8876480.exe
C:\Programmer\Logitech\Video\FxSvr2.exe
C:\Programmer\Internet Explorer\iexplore.exe
C:\Programmer\MSN Messenger\msnmsgr.exe
C:\Programmer\Internet Explorer\iexplore.exe
C:\WINDOWS\system32\rundll32.exe
C:\Programmer\Internet Explorer\iexplore.exe
C:\Documents and Settings\Rasmus\Skrivebord\HijackThis.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start
Page =
http://www.google.dk/R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local
Page =
R1 -
HKCU\Software\Microsoft\Windows\CurrentVersion\Internet
Settings,ProxyOverride = localhost
R0 - HKCU\Software\Microsoft\Internet
Explorer\Toolbar,LinksFolderName = Hyperlinks
O1 - Hosts: 216.177.73.139 auto.search.msn.com
O1 - Hosts: 216.177.73.139 search.netscape.com
O1 - Hosts: 216.177.73.139 ieautosearch
O2 - BHO: AcroIEHlprObj Class -
{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} -
C:\Programmer\Adobe\Acrobat
5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: ST - {9394EDE7-C8B5-483E-8773-474BF36AF6E4} -
C:\Programmer\MSN Apps\ST\01.03.0000.1005\en-xu\stmain.dll
O2 - BHO: MSNToolBandBHO -
{BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Programmer\MSN
Apps\MSN Toolbar\01.02.4000.1001\da\msntb.dll
O2 - BHO: NAV Helper -
{BDF3E430-B101-42AD-A544-FADC6B084872} -
C:\Programmer\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: Norton AntiVirus -
{42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} -
C:\Programmer\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: MSN - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0}
- C:\Programmer\MSN Apps\MSN
Toolbar\01.02.4000.1001\da\msntb.dll
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE
C:\WINDOWS\System32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [C-Media Mixer] Mixer.exe /startup
O4 - HKLM\..\Run: [NAV Agent]
C:\PROGRA~1\NORTON~1\navapw32.exe
O4 - HKLM\..\Run: [iamapp] C:\Programmer\Norton Internet
Security\IAMAPP.EXE
O4 - HKLM\..\Run: [NeroCheck]
C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [RemoteControl]
C:\WINDOWS\System32\rmctrl.exe
O4 - HKLM\..\Run: [LWBMOUSE] C:\Programmer\iWare\iWare
Mouse\3.2\lwbwheel.exe
O4 - HKLM\..\Run: [QuickTime Task]
"C:\Programmer\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [SunJavaUpdateSched]
C:\Programmer\Java\jre1.5.0_02\bin\jusched.exe
O4 - HKLM\..\Run: [Symantec NetDriver Monitor]
C:\PROGRA~1\SYMNET~1\SNDMon.exe /Consumer
O4 - HKLM\..\Run: [WinampAgent]
C:\Programmer\Winamp\winampa.exe
O4 - HKLM\..\Run: [SiSUSBRG] C:\WINDOWS\SiSUSBrg.exe
O4 - HKLM\..\Run: [Cmaudio] RunDll32 cmicnfg.cpl,CMICtrlWnd
O4 - HKLM\..\Run: [OWCWebCamDV]
C:\WINDOWS\system\wcdvtray.exe
O4 - HKLM\..\Run: [LVCOMSX] C:\WINDOWS\system32\LVCOMSX.EXE
O4 - HKLM\..\Run: [LogitechVideoRepair]
C:\Programmer\Logitech\Video\ISStart.exe
O4 - HKLM\..\Run: [LogitechVideoTray]
C:\Programmer\Logitech\Video\LogiTray.exe
O4 - HKLM\..\Run: [msnappau] "C:\Programmer\MSN
Apps\Updater\01.02.3000.1001\da\msnappau.exe"
O4 - HKLM\..\RunServices: [unitek] "C:\Program
Files\unitek\unitekco.exe"
O4 - HKCU\..\Run: [CTFMON.EXE]
C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [Versato]
C:\Programmer\MediaKey\MagicRun.exe
O4 - HKCU\..\Run: [Yahoo! Pager]
C:\Programmer\Yahoo!\Messenger\ypager.exe -quiet
O4 - HKCU\..\Run: [LogitechSoftwareUpdate]
C:\Programmer\Logitech\Video\ManifestEngine.exe boot
O4 - HKCU\..\Run: [LDM] C:\Program Files\Logitech\Desktop
Messenger\8876480\Program\BackWeb-8876480.exe
O4 - Startup: DLHelperEXE.exe
O4 - Global Startup: Logitech Desktop Messenger.lnk =
C:\Program Files\Logitech\Desktop
Messenger\8876480\Program\LDMConf.exe
O4 - Global Startup: Microsoft Office.lnk =
C:\Programmer\Microsoft Office\Office10\OSA.EXE
O8 - Extra context menu item: E&xport to Microsoft Excel -
res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000O9 - Extra button: (no name) -
{08B0E5C0-4FCB-11CF-AAA5-00401C608501} -
C:\Programmer\Java\jre1.5.0_02\bin\npjpi150_02.dll
O9 - Extra 'Tools' menuitem: Sun Java Console -
{08B0E5C0-4FCB-11CF-AAA5-00401C608501} -
C:\Programmer\Java\jre1.5.0_02\bin\npjpi150_02.dll
O9 - Extra button: Messenger -
{4528BBE0-4E08-11D5-AD55-00010333D0AD} -
C:\Programmer\Yahoo!\Messenger\yhexbmes0411.dll
O9 - Extra 'Tools' menuitem: Yahoo! Messenger -
{4528BBE0-4E08-11D5-AD55-00010333D0AD} -
C:\Programmer\Yahoo!\Messenger\yhexbmes0411.dll
O9 - Extra button: EmpirePoker -
{77E68763-4284-41d6-B7E7-B6E1F053A9E7} -
C:\Programmer\EmpirePoker\EmpirePoker.exe
O9 - Extra 'Tools' menuitem: EmpirePoker -
{77E68763-4284-41d6-B7E7-B6E1F053A9E7} -
C:\Programmer\EmpirePoker\EmpirePoker.exe
O9 - Extra button: PartyPoker.com -
{B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} -
C:\Programmer\PartyPoker\PartyPoker.exe
O9 - Extra 'Tools' menuitem: PartyPoker.com -
{B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} -
C:\Programmer\PartyPoker\PartyPoker.exe
O9 - Extra button: Ladbrokes Poker -
{C2A80015-C447-4dc4-82DD-AED83D6ED57E} -
C:\Programmer\ladbrokesMPP\MPPoker.exe
O9 - Extra button: Messenger -
{FB5F1910-F110-11d2-BB9E-00C04F795683} -
C:\Programmer\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger -
{FB5F1910-F110-11d2-BB9E-00C04F795683} -
C:\Programmer\Messenger\msmsgs.exe
O16 - DPF: {00B71CFB-6864-4346-A978-C0A14556272C} (Checkers
Class) -
http://messenger.zone.msn.com/binary/msgrchkr.cab31267.cabO16 - DPF: {03F998B2-0E00-11D3-A498-00104B6EB52E}
(MetaStreamCtl Class) -
https://components.viewpoint.com/MTSInstallers/MetaStream3.cab?url=http://www.viewpoint.com/cgi-bin/vet_install_popup.
pl?1&04.00.07.02&
http://www.gameboyadvance.com/sp/vp/content.html
O16 - DPF: {18D9C485-7EEC-4395-95DA-DC3875B10E81}
(TEInstallPlugIn) -
http://www.skylinesoft.com/interactive/TerraExplorer/Install/TEInstallPlugIn.cab
O16 - DPF: {1D4DB7D2-6EC9-47A3-BD87-1E41684E07BB} -
http://ak.imgfarm.com/images/nocache/funwebproducts/ei-2/FunBuddyIconsFWBInitialSetup1.0.0.8-2.cab
O16 - DPF: {2917297F-F02B-4B9D-81DF-494B6333150B}
(Minesweeper Flags Class) -
http://messenger.zone.msn.com/binary/MineSweeper.cab31267.cab
O16 - DPF: {2BC66F54-93A8-11D3-BEB6-00105AA9B6AE} (Symantec
AntiVirus scanner) -
http://security.symantec.com/sscv6/SharedContent/vc/bin/AvSniff.cab
O16 - DPF: {3D6DDD23-870A-4FC8-B3AF-5F67C935A9B7} (Util
Class) -
https://udstedelse.certifikat.tdc.dk/csp/authenticode/PrimeInkCSP-1204.exe
O16 - DPF: {41F17733-B041-4099-A042-B518BB6A408C} -
http://a1540.g.akamai.net/7/1540/52/20030530/qtinstall.info.apple.com/bonnie/us/win/QuickTimeInstaller.exe
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN
Photo Upload Tool) -
http://by22fd.bay22.hotmail.msn.com/resources/MsnPUpld.cabO16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} (Symantec
RuFSI Utility Class) -
http://security.symantec.com/sscv6/SharedContent/common/bin/cabsa.cab
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D}
(MessengerStatsClient Class) -
http://messenger.zone.msn.com/binary/MessengerStatsClient.cab31267.cab
O16 - DPF: {917623D1-D8E5-11D2-BE8B-00104B06BDE3} (CamImage
Class) -
http://www.axis.com/products/camera_servers/AxisCamControl.ocx
O16 - DPF: {AED98630-0251-4E83-917D-43A23D66D507}
(WebHandler Class) -
http://activex.microgaming.com/dlhelper/version4/dlhelper.cab
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF}
(MsnMessengerSetupDownloadControl Class) -
http://messenger.msn.com/download/MsnMessengerSetupDownloader.cab
O16 - DPF: {CAFEEFAC-0014-0000-0000-ABCDEFFEDCBA} (Java
Runtime Environment 1.4.0) -
O16 - DPF: {D77EF652-9A6B-40C8-A4B9-1C0697C6CF41} (TikGames
Online Control) -
http://www.shockwave.com/content/shapo/shapo.cabO16 - DPF: {D8089245-3211-40F6-819B-9E5E92CD61A2}
(FlashXControl Object) -
https://register3.valueactive.com/236/webolr/OCX/FlashAX.cab
O16 - DPF: {EDAF796E-9210-4417-ADDC-2AB18E4F6C27}
(Hjemmeside.KvikFoto) -
http://www.123hjemmeside.dk/builder/pages/KvikFoto.cabO16 - DPF: {EF791A6B-FC12-4C68-99EF-FB9E207A39E6}
(McFreeScan Class) -
http://download.mcafee.com/molbin/iss-loc/vso/en-us/tools/mcfscan/1,5,0,4276/mcfscan.cab
O16 - DPF: {F00F4763-7355-4725-82F7-0DA94A256D46}
(IncrediMail) -
http://www2.incredimail.com/contents/setup/downloader_sp1/imloader.cab
O23 - Service: Macromedia Licensing Service - Unknown owner
- C:\Programmer\Fælles filer\Macromedia
Shared\Service\Macromedia Licensing.exe
O23 - Service: Norton AntiVirus Auto Protect Service
(navapsvc) - Symantec Corporation - C:\Programmer\Norton
AntiVirus\navapsvc.exe
O23 - Service: Norton Internet Security Service (NISSERV) -
Symantec Corporation - C:\Programmer\Norton Internet
Security\NISSERV.EXE
O23 - Service: Norton Internet Security Accounts Manager
(NISUM) - Symantec Corporation - C:\Programmer\Norton
Internet Security\NISUM.EXE
O23 - Service: NTBOOTMGR (NTBOOT) - Unknown owner -
C:\WINDOWS\SYSTEM\DRIVER\ntuser.exe
O23 - Service: NTLOAD - Unknown owner -
C:\WINDOWS\SYSTEM\DRIVER\ntsrv.exe
O23 - Service: NTSVCMGR - Unknown owner -
C:\WINDOWS\SYSTEM\DRIVER\ntsrv.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) -
NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
O23 - Service: ScriptBlocking Service (SBService) -
Symantec Corporation -
C:\PROGRA~1\FLLESF~1\SYMANT~1\SCRIPT~1\SBServ.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) -
Symantec Corporation - C:\Programmer\Fælles filer\Symantec
Shared\SNDSrvc.exe
O23 - Service: Norton Internet Security Proxy Service
(SymProxySvc) - Symantec Corporation - C:\Programmer\Norton
Internet Security\SymProxySvc.exe
O23 - Service: SymWMI Service (SymWSC) - Symantec
Corporation - C:\Programmer\Fælles filer\Symantec
Shared\Security Center\SymWSC.exe