hijack log
En der gider kigge på dette snavsRunning processes:
> C:\WINDOWS\System32\smss.exe
> C:\WINDOWS\system32\winlogon.exe
> C:\WINDOWS\system32\services.exe
> C:\WINDOWS\system32\lsass.exe
> C:\WINDOWS\system32\svchost.exe
> C:\WINDOWS\System32\svchost.exe
> C:\WINDOWS\system32\LEXBCES.EXE
> C:\WINDOWS\system32\spoolsv.exe
> C:\WINDOWS\system32\LEXPPS.EXE
> C:\WINDOWS\Explorer.EXE
> C:\Programmer\SoftDisc\softdisc.exe
> C:\Programmer\D-Tools\daemon.exe
> C:\WINDOWS\System32\LXSUPMON.EXE
> C:\Programmer\Common files\updmgr\updmgr.exe
> C:\Programmer\ISTsvc\istsvc.exe
> C:\WINDOWS\System32\32360476.exe
> C:\WINDOWS\System32\ctfmon.exe
> C:\Programmer\MSN Messenger\msnmsgr.exe
> C:\Programmer\Fælles filer\Microsoft Shared\VS7Debug\mdm.exe
> C:\WINDOWS\System32\nvsvc32.exe
> C:\Programmer\Panda Software\Panda Antivirus Titanium\Pavsrv51.exe
> C:\Programmer\Panda Software\Panda Antivirus Titanium\AVENGINE.EXE
> C:\Programmer\Winamp\winamp.exe
> C:\Programmer\Panda Software\Panda Antivirus Titanium\apvxdwin.exe
> C:\Programmer\Panda Software\Panda Antivirus Titanium\pavProxy.exe
> A:\HijackThis.exe
>
> R1 - HKCU\Software\Microsoft\Internet Explorer,SearchURL =
> http://www.searchv.com/search.html
> R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar =
> http://www.searchv.com/search.html
> R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page =
> http://www.searchv.com/search.html
> R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page =
> http://www.searchv.com/
> R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL =
> http://www.searchv.com/search.html
> R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page =
> http://www.searchv.com/
> R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page =
> http://www.searchv.com/w/search.html
> R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL =
> http://www.searchv.com/w/
> R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL =
> http://www.searchv.com/w/search.html
> R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
> http://www.searchv.com/w/search.html
> R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
> http://www.searchv.com/w/search.html
> R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) =
> http://www.searchv.com/w/
> R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page_bak =
> http://www.dds.dk/
> R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
> Hyperlinks
> R1 - HKCU\Software\Microsoft\Internet Explorer,SearchAssistant =
> http://www.searchv.com/search.html
> R1 - HKCU\Software\Microsoft\Internet Explorer,CustomizeSearch =
> http://www.searchv.com/search.html
> R3 - URLSearchHook: (no name) - _{CFBFAE00-17A6-11D0-99CB-00C04FD64497} -
> (no file)
> O1 - Hosts: 209.66.114.130 sitefinder.verisign.com
> O2 - BHO: NavErrRedir Class - {0428FFC7-1931-45b7-95CB-3CBB919777E1} -
> C:\PROGRA~1\PERFEC~1\BHO\PERFEC~1.DLL
> O2 - BHO: (no name) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} -
> C:\Programmer\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
> O2 - BHO: WinShow module - {6CC1C918-AE8B-4373-A5B4-28BA1851E39A} -
> C:\Documents and Settings\Kasper Larsen\Application
Data\winshow\winshow.dll
> O2 - BHO: (no name) - {8786386E-4B22-11D6-9C60-E5DA06D87378} -
> C:\WINDOWS\System32\BandObjs1,0,0,3.dll
> O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} -
> C:\WINDOWS\System32\msdxm.ocx
> O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE
> C:\WINDOWS\System32\NvCpl.dll,NvStartup
> O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
> O4 - HKLM\..\Run: [APVXDWIN] "C:\Programmer\Panda Software\Panda Antivirus
> Titanium\APVXDWIN.EXE" /s
> O4 - HKLM\..\Run: [HotVideo_nl] c:\program
> files\gsoft\dialers\hotvideo_nl\hotvideo_nl.exe /noconnect
> O4 - HKLM\..\Run: [sys] regedit /s C:\WINDOWS\sys.reg
> O4 - HKLM\..\Run: [AltnetPointsManager] c:\program files\altnet\points
> manager\points manager.exe -s
> O4 - HKLM\..\Run: [EasyDates_dk] c:\program
> files\comsoft\dialers\easydates_dk\easydates_dk.exe /noconnect
> O4 - HKLM\..\Run: [SoftDisc] "C:\Programmer\SoftDisc\softdisc.exe" -hide
> O4 - HKLM\..\Run: [DAEMON Tools-1033] "C:\Programmer\D-Tools\daemon.exe"
> -lang 1033
> O4 - HKLM\..\Run: [LXSUPMON] C:\WINDOWS\System32\LXSUPMON.EXE RUN
> O4 - HKLM\..\Run: [Pop-Up Stopper] "C:\PANICW~1\POP-UP~1\dpps2.exe"
> O4 - HKLM\..\Run: [KAZAA] C:\Programmer\Kazaa\kazaa.exe /SYSTRAY
> O4 - HKLM\..\Run: [updmgr] C:\Programmer\Common files\updmgr\updmgr.exe
> O4 - HKLM\..\Run: [IST Service] C:\Programmer\ISTsvc\istsvc.exe
> O4 - HKLM\..\Run: [16195315.exe] C:\WINDOWS\System32\16195315.exe
> O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\ctfmon.exe
> O4 - HKCU\..\Run: [msnmsgr] "C:\Programmer\MSN Messenger\msnmsgr.exe"
> /background
> O4 - HKCU\..\Run: [Steam] "c:\games\steam\steam.exe" -silent
> O4 - Startup: PowerReg Scheduler V3.exe
> O4 - Global Startup: Microsoft Office.lnk = C:\Programmer\Microsoft
> Office\Office10\OSA.EXE
> O8 - Extra context menu item: E&ksporter til Microsoft Excel -
> res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
> O12 - Plugin for .spop: C:\Programmer\Internet
Explorer\Plugins\NPDocBox.dll
> O16 - DPF: {00B71CFB-6864-4346-A978-C0A14556272C} (Checkers Class) -
> http://messenger.zone.msn.com/binary/msgrchkr.cab
> O16 - DPF: {03C543A1-C090-418F-A1D0-FB96380D601D} (preload control) -
> http://216.82.66.200/build/preload.cab
> O16 - DPF: {0556834E-F56C-4545-8FAD-4F0ED25999BE} (Jackie Control) -
> http://www.6jackpot.com/dialup/jackie.cab
> O16 - DPF: {1D6711C8-7154-40BB-8380-3DEA45B69CBF} (Web P2P Installer) -
> O16 - DPF: {23B7A816-3647-49D2-9756-6F41CE8F9201}
(ddm_download.ddm_control)
> - http://download.rfwnad.com/cab/ddm_control.CAB
> O16 - DPF: {2917297F-F02B-4B9D-81DF-494B6333150B} (Minesweeper Flags
Class)
> - http://messenger.zone.msn.com/binary/MineSweeper.cab
> O16 - DPF: {486E48B5-ABF2-42BB-A327-2679DF3FB822} -
> http://akamai.downloadv3.com/binaries/IA/ia_XP.cab
> O16 - DPF: {54B52E52-8000-4413-BD67-FC7FE24B59F2} (EARTPatchX Class) -
> http://www.ea.com/downloads/rtpatch/EARTPX.cab
> O16 - DPF: {56336BCB-3D8A-11D6-A00B-0050DA18DE71} (RdxIE Class) -
> http://software-dl.real.com/03f5174f279c76c0ad20/netzip/RdxIE601.cab
> O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) -
>
http://a840.g.akamai.net/7/840/537/2003080601/housecall.antivirus.com/housecall/xscan53.cab
> O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient
> Class) - http://messenger.zone.msn.com/binary/MessengerStatsClient.cab
> O16 - DPF: {8EC18CE2-D7B4-11D2-88C8-006008A717FD} (NCSView Class) -
> http://130.228.229.67/ecwplugins/ncs.cab
> O16 - DPF: {94742E3F-D9A1-4780-9A87-2FFA43655DA2} -
> http://akamai.downloadv3.com/binaries/DialHTML/EGDHTML_pack_XP.cab
> O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer
> Class) - http://www.pandasoftware.com/activescan/as5/asinst.cab
> O16 - DPF: {9F1C11AA-197B-4942-BA54-47A8489BB47F} (Update Class) -
>
http://v4.windowsupdate.microsoft.com/CAB/x86/unicode/iuctl.CAB?37885.382974537
> O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash
Object) -
> http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab
> O16 - DPF: {D8575CE3-3432-4540-88A9-85A1325D3375} (e-Safekey®) -
> https://netbank.bgbank.dk/html/activex/e-Safekey/BG/e-Safekey.cab
> O16 - DPF: {F6A56D95-A3A3-11D2-AC26-400000058481} (Danske e-Sec) -
> https://netbank.bgbank.dk/html/activex/danskesikker/BG/DanskeSikker.cab
> O16 - DPF: {F6BF0D00-0B2A-4A75-BF7B-F385591623AF} (Solitaire Showdown
Class)
