Logfile of HijackThis v1.97.7
Scan saved at 12:51:27, on 04-04-04
Platform: Windows 98 SE (Win9x 4.10.2222A)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)
Running processes:
C:\WINDOWS\SYSTEM\KERNEL32.DLL
C:\WINDOWS\SYSTEM\MSGSRV32.EXE
C:\WINDOWS\SYSTEM\MPREXE.EXE
C:\WINDOWS\SYSTEM\mmtask.tsk
C:\WINDOWS\EXPLORER.EXE
C:\WINDOWS\SYSTEM\SYSTRAY.EXE
C:\SBPCI\CTMIX32.EXE
C:\PROGRAMMER\LEXMARK X1100 SERIES\LXBKBMGR.EXE
C:\WINDOWS\LOADQM.EXE
C:\PROGRAMMER\LEXMARK X1100 SERIES\LXBKBMON.EXE
C:\PROGRAMMER\KODAK\KODAK_DR\KODAKCCS.EXE
C:\PROGRAMMER\CASIO\PHOTO LOADER\PLAUTO.EXE
C:\PROGRAMMER\KODAK\KODAK EASYSHARE SOFTWARE\BIN\EASYSHARE.EXE
C:\PROGRAMMER\KODAK\KODAK SOFTWARE UPDATER\7288971\PROGRAM\BACKWEB-7288971.EXE
C:\WINDOWS\SYSTEM\LEXBCES.EXE
C:\WINDOWS\SYSTEM\RPCSS.EXE
C:\WINDOWS\SYSTEM\WMIEXE.EXE
C:\WINDOWS\SYSTEM\LEXPPS.EXE
C:\WINDOWS\SKRIVEBORD\HIJACKTHIS.EXE
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = about:blank
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page =
http://212.10.10.20/R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = about:blank
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = about:blank
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = about:blank
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = about:blank
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = about:blank
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = about:blank
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = localhost
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,HomeOldSP =
http://www.ewebsearch.net/R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Hyperlinks
R1 - HKCU\Software\Microsoft\Internet Explorer,Search =
http://out.true-counter.com/b/?656387 (obfuscated)
R1 - HKLM\Software\Microsoft\Internet Explorer,Search =
http://out.true-counter.com/b/?656387 (obfuscated)
O1 - Hosts: 645238813 auto.search.msn.com
O1 - Hosts: 216.177.73.139 search.netscape.com
O1 - Hosts: 66.159.20.52 www1.ndhosting.com
O1 - Hosts: 66.159.20.52 www3.ndhosting.com
O1 - Hosts: 66.159.20.52 www2.ndhosting.com
O1 - Hosts: 66.159.20.52
www.ndhosting.comO1 - Hosts: 66.159.20.52
www.kinghost.comO1 - Hosts: 66.159.20.52 kinghost.com
O1 - Hosts: 66.159.20.52 www1.kinghost.com
O1 - Hosts: 66.159.20.52 www2.kinghost.com
O1 - Hosts: 66.159.20.52 www3.kinghost.com
O1 - Hosts: 66.159.20.52 www4.kinghost.com
O1 - Hosts: 66.159.20.52 www5.kinghost.com
O1 - Hosts: 66.159.20.52 www6.kinghost.com
O1 - Hosts: 66.159.20.52 www7.kinghost.com
O1 - Hosts: 66.159.20.52 www8.kinghost.com
O1 - Hosts: 66.159.20.52 www9.kinghost.com
O1 - Hosts: 66.159.20.52 www10.kinghost.com
O1 - Hosts: 66.159.20.52
www.smutserver.comO1 - Hosts: 66.159.20.52 smutserver.com
O1 - Hosts: 66.159.20.52 www1.smutserver.com
O1 - Hosts: 66.159.20.52 www2.smutserver.com
O1 - Hosts: 66.159.20.52 www16.smutserver.com
O1 - Hosts: 66.159.20.52 www3.smutserver.com
O1 - Hosts: 66.159.20.52 www4.smutserver.com
O1 - Hosts: 66.159.20.52 www5.smutserver.com
O1 - Hosts: 66.159.20.52 www6.smutserver.com
O1 - Hosts: 66.159.20.52 www7.smutserver.com
O1 - Hosts: 66.159.20.52 www8.smutserver.com
O1 - Hosts: 66.159.20.52 www9.smutserver.com
O1 - Hosts: 66.159.20.52 www10.smutserver.com
O1 - Hosts: 66.159.20.52 www11.smutserver.com
O1 - Hosts: 66.159.20.52 www12.smutserver.com
O1 - Hosts: 66.159.20.52 www13.smutserver.com
O1 - Hosts: 66.159.20.52 www14.smutserver.com
O1 - Hosts: 66.159.20.52 www15.smutserver.com
O1 - Hosts: 66.159.20.52 www17.smutserver.com
O1 - Hosts: 66.159.20.52 www18.smutserver.com
O1 - Hosts: 66.159.20.52 www19.smutserver.com
O1 - Hosts: 66.159.20.52 www20.smutserver.com
O1 - Hosts: 66.159.20.52 www21.smutserver.com
O1 - Hosts: 66.159.20.52 www22.smutserver.com
O1 - Hosts: 66.159.20.52 www23.smutserver.com
O1 - Hosts: 66.159.20.52 www24.smutserver.com
O1 - Hosts: 66.159.20.52 www25.smutserver.com
O1 - Hosts: 66.159.20.52 www26.smutserver.com
O1 - Hosts: 66.159.20.52 www27.smutserver.com
O1 - Hosts: 66.159.20.52 www28.smutserver.com
O1 - Hosts: 66.159.20.52 www29.smutserver.com
O1 - Hosts: 66.159.20.52 www30.smutserver.com
O1 - Hosts: 66.159.20.52 www31.smutserver.com
O1 - Hosts: 66.159.20.52 www32.smutserver.com
O1 - Hosts: 66.159.20.52 agreathost.net
O1 - Hosts: 66.159.20.52
www.agreathost.netO1 - Hosts: 66.159.20.52 hotfreehost.com
O1 - Hosts: 66.159.20.52
www.hotfreehost.comO1 - Hosts: 66.159.20.52 greatfreehost.com
O1 - Hosts: 66.159.20.52
www.greatfreehost.comO1 - Hosts: 66.159.20.52 freesmutpages.com
O1 - Hosts: 66.159.20.52
www.freesmutpages.comO1 - Hosts: 66.159.20.52 apornhost.com
O1 - Hosts: 66.159.20.52
www.apornhost.comO1 - Hosts: 66.159.20.52 nasty-pages.com
O1 - Hosts: 66.159.20.52
www.nasty-pages.comO1 - Hosts: 66.159.20.52 sexyfreehost.com
O1 - Hosts: 66.159.20.52
www.sexyfreehost.comO1 - Hosts: 66.159.20.52 x4web.com
O1 - Hosts: 66.159.20.52
www.x4web.comO1 - Hosts: 66.159.20.52 sexplanets.com
O1 - Hosts: 66.159.20.52
www.sexplanets.comO1 - Hosts: 66.159.20.52 maxismut.com
O1 - Hosts: 66.159.20.52
www.maxismut.comO1 - Hosts: 66.159.20.52 tgpfriendly.com
O1 - Hosts: 66.159.20.52
www.tgpfriendly.comO1 - Hosts: 66.159.20.52 tgp-server.com
O1 - Hosts: 66.159.20.52
www.tgp-server.comO1 - Hosts: 66.159.20.52 magnaplza.com
O1 - Hosts: 66.159.20.52
www.magnaplza.comO1 - Hosts: 66.159.20.52 free-xxx-server.com
O1 - Hosts: 66.159.20.52
www.free-xxx-server.comO1 - Hosts: 66.159.20.52 libereco.net
O1 - Hosts: 66.159.20.52
www.libereco.netO1 - Hosts: 66.159.20.52 0190-dialer.com
O1 - Hosts: 66.159.20.52
www.0190-dialer.comO1 - Hosts: 66.159.20.52 xxxod.net
O1 - Hosts: 66.159.20.52
www.xxxod.netO1 - Hosts: 66.159.20.52 altsights.com
O1 - Hosts: 66.159.20.52
www.altsights.comO1 - Hosts: 66.159.20.52 adulthosting.com
O1 - Hosts: 66.159.20.52
www.adulthosting.comO1 - Hosts: 66.159.20.52 superhova.com
O1 - Hosts: 66.159.20.52
www.superhova.comO1 - Hosts: 66.159.20.52 bestpornhost.com
O1 - Hosts: 66.159.20.52
www.bestpornhost.comO1 - Hosts: 66.159.20.52 hostingfree.com
O1 - Hosts: 66.159.20.52
www.hostingfree.comO1 - Hosts: 66.159.20.52 xfreehosting.com
O1 - Hosts: 66.159.20.52
www.xfreehosting.comO1 - Hosts: 66.159.20.52 blinghosting.com
O1 - Hosts: 66.159.20.52
www.blinghosting.comO1 - Hosts: 66.159.20.52 x-x-x-hosting.com
O2 - BHO: (no name) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\PROGRAMMER\ADOBE\ACROBAT 5.0\READER\ACTIVEX\ACROIEHELPER.OCX
O2 - BHO: (no name) - {EBCDDA60-2A68-11D3-8A43-0060083CFB9C} - C:\WINDOWS\SYSTEM\NZDD.DLL
O2 - BHO: (no name) - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\programmer\google\googletoolbar2.dll
O3 - Toolbar: (no name) - {1CEFFA60-0BBE-11D7-8EB7-0000B4C62DE9} - (no file)
O3 - Toolbar: (no name) - {82599E0A-8C81-11d7-9F97-0050FC5441CB} - C:\WINDOWS\SYSTEM\shdocvw.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\SYSTEM\MSDXM.OCX
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\programmer\google\googletoolbar2.dll
O4 - HKLM\..\Run: [Skan registreringsdatabase] C:\WINDOWS\scanregw.exe /autorun
O4 - HKLM\..\Run: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
O4 - HKLM\..\Run: [SystemTray] SysTray.Exe
O4 - HKLM\..\Run: [CreativeMixer] C:\SBPCI\ctmix32.exe /T
O4 - HKLM\..\Run: [Lexmark X1100 Series] "C:\Programmer\Lexmark X1100 Series\lxbkbmgr.exe"
O4 - HKLM\..\Run: [LexStart] lexstart.exe
O4 - HKLM\..\Run: [LoadQM] loadqm.exe
O4 - HKLM\..\Run: [KodakCCS] C:\Programmer\KODAK\KODAK_DR\KodakCCS.exe --pdr: "C:\Programmer\KODAK\KODAK_DR\dcmnter.pdr"
O4 - HKLM\..\RunServices: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
O4 - HKLM\..\RunOnce: [test]
O4 - HKCU\..\RunOnce: [test]
O4 - Startup: Microsoft Office.lnk = C:\Programmer\Microsoft Office\Office\OSA9.EXE
O4 - Startup: Adobe Gamma Loader.exe.lnk = ?
O4 - Startup: Photo Loader supervisory.lnk = C:\Programmer\CASIO\Photo Loader\Plauto.exe
O4 - Startup: Kodak EasyShare software.lnk = C:\Programmer\Kodak\Kodak EasyShare software\bin\EasyShare.exe
O4 - Startup: KODAK Software Updater.lnk = C:\Programmer\Kodak\KODAK Software Updater\7288971\Program\backWeb-7288971.exe
O8 - Extra context menu item: &Google Search -
res://C:\PROGRAMMER\GOOGLE\GOOGLETOOLBAR2.DLL/cmsearch.htmlO8 - Extra context menu item: Cac&hed Snapshot of Page -
res://C:\PROGRAMMER\GOOGLE\GOOGLETOOLBAR2.DLL/cmcache.htmlO8 - Extra context menu item: Si&milar Pages -
res://C:\PROGRAMMER\GOOGLE\GOOGLETOOLBAR2.DLL/cmsimilar.htmlO8 - Extra context menu item: Backward &Links -
res://C:\PROGRAMMER\GOOGLE\GOOGLETOOLBAR2.DLL/cmbacklinks.htmlO8 - Extra context menu item: Translate into English -
res://C:\PROGRAMMER\GOOGLE\GOOGLETOOLBAR2.DLL/cmtrans.htmlO9 - Extra button: Net2Phone (HKLM)
O9 - Extra 'Tools' menuitem: Net2Phone (HKLM)
O9 - Extra button: ICQ (HKLM)
O9 - Extra 'Tools' menuitem: ICQ (HKLM)
O15 - Trusted Zone:
www.tips.dkO16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) -
http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cabO16 - DPF: {02BF25D5-8C17-4B23-BC80-D3488ABDDC6B} -
http://www.apple.com/qtactivex/qtplugin.cabO16 - DPF: {EE5CA45C-BFAC-48E6-BE6C-3C607620FF43} (IMViewerControl Class) -
http://companion.logitech.com/companion/logitech/ver1.3.1.2083/bin/imvid.cabO16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) -
http://a840.g.akamai.net/7/840/537/2003120501/housecall.antivirus.com/housecall/xscan53.cabO16 - DPF: {41F17733-B041-4099-A042-B518BB6A408C} -
http://a1540.g.akamai.net/7/1540/52/20030523/qtinstall.info.apple.com/drakken/dk/win/QuickTimeInstaller.exeO16 - DPF: {9F1C11AA-197B-4942-BA54-47A8489BB47F} (Update Class) -
http://v4.windowsupdate.microsoft.com/CAB/x86/ansi/iuctl.CAB?37890.5881828704O16 - DPF: {166B1BCA-3F9C-11CF-8075-444553540000} (Shockwave ActiveX Control) -
http://download.macromedia.com/pub/shockwave/cabs/director/sw.cabO16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) -
http://www.pandasoftware.com/activescan/as5/asinst.cabO19 - User stylesheet: C:\WINDOWS\Web\oslogo.bmp (file missing)
O19 - User stylesheet: C:\WINDOWS\default.css (HKLM)