Hijack this

Øhh måske det var en ide at sende log'en med :) ups...


Logfile of HijackThis v1.98.2
Scan saved at 18:54:44, on 30-10-2004
Platform: Windows XP  (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 (6.00.2600.0000)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\System32\alg.exe
C:\Programmer\Fælles filer\EPSON\EBAPI\SAgent2.exe
C:\NORMAN\Nvc\BIN\NPFSVICE.EXE
C:\Norman\NVC\BIN\Zanda.exe
C:\WINDOWS\System32\nvsvc32.exe
C:\Programmer\Analog Devices\SoundMAX\Smtray.exe
C:\Programmer\Logitech\iTouch\iTouch.exe
C:\PROGRA~1\Logitech\MOUSEW~1\SYSTEM\EM_EXEC.EXE
C:\NORMAN\Nvc\BIN\ZLH.EXE
C:\Programmer\QuickTime\qttask.exe
C:\WINDOWS\System32\ctfmon.exe
C:\Programmer\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe
C:\Programmer\MSN Messenger\MsnMsgr.Exe
C:\Programmer\TEXTware\HotKey\TWALINK.EXE
C:\WINDOWS\System32\svchost.exe
C:\NORMAN\Nvc\BIN\NYMSE.EXE
C:\NORMAN\Nvc\BIN\NIP.EXE
C:\NORMAN\Nvc\BIN\npfmsg2.exe
C:\Programmer\Logitech\iTouch\kbdtray.exe
C:\NORMAN\Nvc\BIN\nvcoas.exe
C:\NORMAN\Nvc\BIN\nipsvc.exe
C:\NORMAN\Nvc\BIN\NJEEVES.EXE
C:\NORMAN\Nvc\BIN\NVCSCHED.EXE
C:\NORMAN\Nvc\BIN\cclaw.exe
C:\WINDOWS\System32\wuauclt.exe
C:\WINDOWS\System32\wuauclt.exe
C:\Documents and Settings\Matias\Skrivebord\hijackthis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = about:blank
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = about:blank
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = localhost
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Hyperlinks
F2 - REG:system.ini: Shell=Explorer.exe C:\WINDOWS\System32\cmd32.exe
O2 - BHO: MyWebSearch Search Assistant BHO - {00A6FAF1-072E-44cf-8957-5838F569A31D} - C:\Programmer\MyWebSearch\SrchAstt\1.bin\MWSSRCAS.DLL (file missing)
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programmer\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: mwsBar BHO - {07B18EA1-A523-4961-B6BB-170DE4475CCA} - C:\Programmer\MyWebSearch\bar\1.bin\MWSBAR.DLL (file missing)
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O4 - HKLM\..\Run: [Smapp] C:\Programmer\Analog Devices\SoundMAX\Smtray.exe
O4 - HKLM\..\Run: [DrvListnr] C:\Programmer\Analog Devices\SoundMAX\DrvListnr.exe
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE NvQTwk,NvCplDaemon initialize
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [DXM6Patch_981116] C:\WINDOWS\p_981116.exe /Q:A
O4 - HKLM\..\Run: [zBrowser Launcher] C:\Programmer\Logitech\iTouch\iTouch.exe
O4 - HKLM\..\Run: [EM_EXEC] C:\PROGRA~1\Logitech\MOUSEW~1\SYSTEM\EM_EXEC.EXE
O4 - HKLM\..\Run: [ICQ Lite] C:\Programmer\ICQLite\ICQLite.exe -minimize
O4 - HKLM\..\Run: [Ms Spool32] C:\windows\win32dll.exe
O4 - HKLM\..\Run: [TaskReg] C:\Programmer\Kazaa\My Shared Folder\Super Mario Bros 2.exe
O4 - HKLM\..\Run: [Norman ZANDA] C:\NORMAN\Nvc\BIN\ZLH.EXE /LOAD /SPLASH
O4 - HKLM\..\Run: [QuickTime Task] "C:\Programmer\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [MyWebSearch Email Plugin] C:\PROGRA~1\MYWEBS~1\bar\1.bin\mwsoemon.exe
O4 - HKLM\..\RunServices: [CMD] cmd32.exe
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\ctfmon.exe
O4 - HKCU\..\Run: [LDM] C:\Programmer\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe
O4 - HKCU\..\Run: [MsnMsgr] "C:\Programmer\MSN Messenger\MsnMsgr.Exe" /background
O4 - Global Startup: Adobe Gamma Loader.lnk = ?
O4 - Global Startup: HotKey.lnk = C:\Programmer\TEXTware\HotKey\TWALINK.EXE
O4 - Global Startup: Logitech Desktop Messenger.lnk = C:\Programmer\Desktop Messenger\8876480\Program\LDMConf.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Programmer\Microsoft Office\Office\OSA9.EXE
O9 - Extra button: ICQ Lite - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - C:\Programmer\ICQLite\ICQLite.exe (file missing)
O9 - Extra 'Tools' menuitem: ICQ Lite - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - C:\Programmer\ICQLite\ICQLite.exe (file missing)
O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
O9 - Extra 'Tools' menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programmer\Messenger\MSMSGS.EXE
O9 - Extra 'Tools' menuitem: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programmer\Messenger\MSMSGS.EXE
O12 - Plugin for .spop: C:\Programmer\Internet Explorer\Plugins\NPDocBox.dll
O15 - Trusted Zone: www.online-banking.dk
O16 - DPF: {03C543A1-C090-418F-A1D0-FB96380D601D} (preload control) - http://www.thepaymentcentre.com/build/preload.cab
O16 - DPF: {1663ed61-23eb-11d2-b92f-008048fdd814} (MeadCo ScriptX Basic) - http://www.meadroid.com/scriptx/ScriptX.cab
O16 - DPF: {1D4DB7D2-6EC9-47A3-BD87-1E41684E07BB} - http://imgfarm.com/images/nocache/funwebproducts/SmileyCentralInitialSetup1.0.0.6.cab
O16 - DPF: {498A0AC2-A3AC-11D4-80A9-0050DA680987} (HearMe (Firewall) Voice Control) - http://www.englishtown.com/EtownResources/HearMe/hmvcfe.cab
O16 - DPF: {4AE9E3BF-409D-4F61-9804-920968603919} (Vacpro.emsat_ver2) - http://www.7adpower.com/dialer/emsat_ver2.CAB
O16 - DPF: {71AEE1E3-1B65-41FA-BBD2-565CBD1359D8} - https://udstedelse.certifikat.tdc.dk/csp/authenticode/PrimeInkCSPInstall0703.exe
O16 - DPF: {AD7FAFB0-16D6-40C3-AF27-585D6E6453FD} -
O16 - DPF: {C81B5180-AFD1-41A3-97E1-99E8D254DB98} (CSS Web Installer Class) - http://scanner.virus112.com/cabs/cssweb.cab
O18 - Protocol: bw+0 - {AA4A1C7C-B52D-4813-A38F-A93B39E41D87} - C:\Programmer\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw+0s - {AA4A1C7C-B52D-4813-A38F-A93B39E41D87} - C:\Programmer\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw-0 - {AA4A1C7C-B52D-4813-A38F-A93B39E41D87} - C:\Programmer\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw-0s - {AA4A1C7C-B52D-4813-A38F-A93B39E41D87} - C:\Programmer\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw00 - {AA4A1C7C-B52D-4813-A38F-A93B39E41D87} - C:\Programmer\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw00s - {AA4A1C7C-B52D-4813-A38F-A93B39E41D87} - C:\Programmer\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw10 - {AA4A1C7C-B52D-4813-A38F-A93B39E41D87} - C:\Programmer\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw10s - {AA4A1C7C-B52D-4813-A38F-A93B39E41D87} - C:\Programmer\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw20 - {AA4A1C7C-B52D-4813-A38F-A93B39E41D87} - C:\Programmer\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw20s - {AA4A1C7C-B52D-4813-A38F-A93B39E41D87} - C:\Programmer\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw30 - {AA4A1C7C-B52D-4813-A38F-A93B39E41D87} - C:\Programmer\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw30s - {AA4A1C7C-B52D-4813-A38F-A93B39E41D87} - C:\Programmer\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw40 - {AA4A1C7C-B52D-4813-A38F-A93B39E41D87} - C:\Programmer\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw40s - {AA4A1C7C-B52D-4813-A38F-A93B39E41D87} - C:\Programmer\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw50 - {AA4A1C7C-B52D-4813-A38F-A93B39E41D87} - C:\Programmer\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw50s - {AA4A1C7C-B52D-4813-A38F-A93B39E41D87} - C:\Programmer\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw60 - {AA4A1C7C-B52D-4813-A38F-A93B39E41D87} - C:\Programmer\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw60s - {AA4A1C7C-B52D-4813-A38F-A93B39E41D87} - C:\Programmer\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw70 - {AA4A1C7C-B52D-4813-A38F-A93B39E41D87} - C:\Programmer\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw70s - {AA4A1C7C-B52D-4813-A38F-A93B39E41D87} - C:\Programmer\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw80 - {AA4A1C7C-B52D-4813-A38F-A93B39E41D87} - C:\Programmer\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw80s - {AA4A1C7C-B52D-4813-A38F-A93B39E41D87} - C:\Programmer\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw90 - {AA4A1C7C-B52D-4813-A38F-A93B39E41D87} - C:\Programmer\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw90s - {AA4A1C7C-B52D-4813-A38F-A93B39E41D87} - C:\Programmer\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwa0 - {AA4A1C7C-B52D-4813-A38F-A93B39E41D87} - C:\Programmer\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwa0s - {AA4A1C7C-B52D-4813-A38F-A93B39E41D87} - C:\Programmer\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwb0 - {AA4A1C7C-B52D-4813-A38F-A93B39E41D87} - C:\Programmer\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwb0s - {AA4A1C7C-B52D-4813-A38F-A93B39E41D87} - C:\Programmer\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwc0 - {AA4A1C7C-B52D-4813-A38F-A93B39E41D87} - C:\Programmer\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwc0s - {AA4A1C7C-B52D-4813-A38F-A93B39E41D87} - C:\Programmer\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwd0 - {AA4A1C7C-B52D-4813-A38F-A93B39E41D87} - C:\Programmer\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwd0s - {AA4A1C7C-B52D-4813-A38F-A93B39E41D87} - C:\Programmer\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwe0 - {AA4A1C7C-B52D-4813-A38F-A93B39E41D87} - C:\Programmer\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwe0s - {AA4A1C7C-B52D-4813-A38F-A93B39E41D87} - C:\Programmer\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwf0 - {AA4A1C7C-B52D-4813-A38F-A93B39E41D87} - C:\Programmer\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwf0s - {AA4A1C7C-B52D-4813-A38F-A93B39E41D87} - C:\Programmer\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwfile-8876480 - {9462A756-7B47-47BC-8C80-C34B9B80B32B} - C:\Programmer\Desktop Messenger\8876480\Program\GAPlugProtocol-8876480.dll
O18 - Protocol: bwg0 - {AA4A1C7C-B52D-4813-A38F-A93B39E41D87} - C:\Programmer\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwg0s - {AA4A1C7C-B52D-4813-A38F-A93B39E41D87} - C:\Programmer\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwh0 - {AA4A1C7C-B52D-4813-A38F-A93B39E41D87} - C:\Programmer\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwh0s - {AA4A1C7C-B52D-4813-A38F-A93B39E41D87} - C:\Programmer\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwi0 - {AA4A1C7C-B52D-4813-A38F-A93B39E41D87} - C:\Programmer\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwi0s - {AA4A1C7C-B52D-4813-A38F-A93B39E41D87} - C:\Programmer\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwj0 - {AA4A1C7C-B52D-4813-A38F-A93B39E41D87} - C:\Programmer\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwj0s - {AA4A1C7C-B52D-4813-A38F-A93B39E41D87} - C:\Programmer\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwk0 - {AA4A1C7C-B52D-4813-A38F-A93B39E41D87} - C:\Programmer\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwk0s - {AA4A1C7C-B52D-4813-A38F-A93B39E41D87} - C:\Programmer\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwl0 - {AA4A1C7C-B52D-4813-A38F-A93B39E41D87} - C:\Programmer\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwl0s - {AA4A1C7C-B52D-4813-A38F-A93B39E41D87} - C:\Programmer\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwm0 - {AA4A1C7C-B52D-4813-A38F-A93B39E41D87} - C:\Programmer\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwm0s - {AA4A1C7C-B52D-4813-A38F-A93B39E41D87} - C:\Programmer\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwn0 - {AA4A1C7C-B52D-4813-A38F-A93B39E41D87} - C:\Programmer\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwn0s - {AA4A1C7C-B52D-4813-A38F-A93B39E41D87} - C:\Programmer\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwo0 - {AA4A1C7C-B52D-4813-A38F-A93B39E41D87} - C:\Programmer\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwo0s - {AA4A1C7C-B52D-4813-A38F-A93B39E41D87} - C:\Programmer\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwp0 - {AA4A1C7C-B52D-4813-A38F-A93B39E41D87} - C:\Programmer\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwp0s - {AA4A1C7C-B52D-4813-A38F-A93B39E41D87} - C:\Programmer\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwq0 - {AA4A1C7C-B52D-4813-A38F-A93B39E41D87} - C:\Programmer\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwq0s - {AA4A1C7C-B52D-4813-A38F-A93B39E41D87} - C:\Programmer\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwr0 - {AA4A1C7C-B52D-4813-A38F-A93B39E41D87} - C:\Programmer\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwr0s - {AA4A1C7C-B52D-4813-A38F-A93B39E41D87} - C:\Programmer\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bws0 - {AA4A1C7C-B52D-4813-A38F-A93B39E41D87} - C:\Programmer\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bws0s - {AA4A1C7C-B52D-4813-A38F-A93B39E41D87} - C:\Programmer\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwt0 - {AA4A1C7C-B52D-4813-A38F-A93B39E41D87} - C:\Programmer\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwt0s - {AA4A1C7C-B52D-4813-A38F-A93B39E41D87} - C:\Programmer\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwu0 - {AA4A1C7C-B52D-4813-A38F-A93B39E41D87} - C:\Programmer\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwu0s - {AA4A1C7C-B52D-4813-A38F-A93B39E41D87} - C:\Programmer\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwv0 - {AA4A1C7C-B52D-4813-A38F-A93B39E41D87} - C:\Programmer\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwv0s - {AA4A1C7C-B52D-4813-A38F-A93B39E41D87} - C:\Programmer\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bww0 - {AA4A1C7C-B52D-4813-A38F-A93B39E41D87} - C:\Programmer\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bww0s - {AA4A1C7C-B52D-4813-A38F-A93B39E41D87} - C:\Programmer\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwx0 - {AA4A1C7C-B52D-4813-A38F-A93B39E41D87} - C:\Programmer\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwx0s - {AA4A1C7C-B52D-4813-A38F-A93B39E41D87} - C:\Programmer\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwy0 - {AA4A1C7C-B52D-4813-A38F-A93B39E41D87} - C:\Programmer\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwy0s - {AA4A1C7C-B52D-4813-A38F-A93B39E41D87} - C:\Programmer\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwz0 - {AA4A1C7C-B52D-4813-A38F-A93B39E41D87} - C:\Programmer\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwz0s - {AA4A1C7C-B52D-4813-A38F-A93B39E41D87} - C:\Programmer\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: offline-8876480 - {AA4A1C7C-B52D-4813-A38F-A93B39E41D87} - C:\Programmer\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll

Fy for den da *GG*
Jeg kigger lige på den og vender tilbage lidt senere *S*

He he... Super duper rock og der-ud-af!
Ja, der er virkelig noget der er gået op for mig mht. det der spy-crap... Så mine maskiner har aldrig været tjekket før...
:)
-MattB

Forresten... Når jeg starter comp'en op står der når windows er åbnet en fejlmelding...

C:\WINDOWS\system32\cmd32.exe er ikke et gyldigt win32 program

Hvad skal det betyde? :/
-Matt B

Download denne engangsscanner - den skal du bruge senere - tryk på gem.
HUSK at hente en NY hvis du skulle ha' den liggende i forvejen.
http://www.spywareinfo.dk/download/mwav.exe

Her er en hjælp til at fjerne alt kazaa fra computeren: http://www.spychecker.com/program/kazaagone.html

---------------------------------------------------------------------------------------------------------------------------------------

Du skal nu i gang med at fixe, men først skal du lige arbejde lidt - gør følgende:

Opret en mappe KUN til HijackThis - programmet skal køres derinde fra fordi det under fix, danner nogle backupfiler.

Åbn en mappe, klik i menuen på Funktioner => Mappeindstillinger => Vis.
Fjern flueben ved "Skjul beskyttede operativsystemfiler".
Fjern flueben ved "Skjul filtypenavne for kendte filtyper".
Sæt prik i "Vis skjulte filer og mapper".

Deaktiver systemgendannelse. Hvis du ikke ved hvordan du gør det så kig her: http://www.spywarefri.dk/virus.htm#alle - derefter skal du åbne hijackthis.

Du får herunder nogle filer som du skal fixe og det du skal gøre er, at sætte vinge ud for alle disse filer. Når du har gjort det så lukker du alle andre vinduer ned. Det er meget vigtigt, at det eneste vindue som er åbent er HijackThis vinduet. Husk også at lukke dette vindue (din Internet browser) når du har markeret filerne. Nu må du fixe. Klik på <Fix cheked>.
---------------------------------------------------------------------------------------------------------------------------------------

Her er de filer, du skal fixe :

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = about:blank
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = about:blank

O2 - BHO: MyWebSearch Search Assistant BHO - {00A6FAF1-072E-44cf-8957-5838F569A31D} - C:\Programmer\MyWebSearch\SrchAstt\1.bin\MWSSRCAS.DLL (file missing)
O2 - BHO: mwsBar BHO - {07B18EA1-A523-4961-B6BB-170DE4475CCA} - C:\Programmer\MyWebSearch\bar\1.bin\MWSBAR.DLL (file missing)

O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [DXM6Patch_981116] C:\WINDOWS\p_981116.exe /Q:A
O4 - HKLM\..\Run: [Ms Spool32] C:\windows\win32dll.exe
O4 - HKLM\..\Run: [TaskReg] C:\Programmer\Kazaa\My Shared Folder\Super Mario Bros 2.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Programmer\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [MyWebSearch Email Plugin] C:\PROGRA~1\MYWEBS~1\bar\1.bin\mwsoemon.exe
O4 - HKLM\..\RunServices: [CMD] cmd32.exe
O4 - HKCU\..\Run: [LDM] C:\Programmer\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe
O4 - Global Startup: Logitech Desktop Messenger.lnk = C:\Programmer\Desktop Messenger\8876480\Program\LDMConf.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Programmer\Microsoft Office\Office\OSA9.EXE

O9 - Extra button: ICQ Lite - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - C:\Programmer\ICQLite\ICQLite.exe (file missing)
O9 - Extra 'Tools' menuitem: ICQ Lite - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - C:\Programmer\ICQLite\ICQLite.exe (file missing)
O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
O9 - Extra 'Tools' menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm

O16 - DPF: {03C543A1-C090-418F-A1D0-FB96380D601D} (preload control) - http://www.thepaymentcentre.com/build/preload.cab
O16 - DPF: {1663ed61-23eb-11d2-b92f-008048fdd814} (MeadCo ScriptX Basic) - http://www.meadroid.com/scriptx/ScriptX.cab
O16 - DPF: {1D4DB7D2-6EC9-47A3-BD87-1E41684E07BB} - http://imgfarm.com/images/nocache/funwebproducts/SmileyCentralInitialSetup1.0.0.6.cab
O16 - DPF: {4AE9E3BF-409D-4F61-9804-920968603919} (Vacpro.emsat_ver2) - http://www.7adpower.com/dialer/emsat_ver2.CAB

Og ALLE O18 - Protocol: .......

---------------------------------------------------------------------------------------------------------------------------------------

Derefter genstarter du i fejlsikker tilstand (fejlsikret tilstand kommer du i, ved at trykke på <F8> når maskinen starter op, lige inden den begynder at indlæse Windows) - finder og sletter følgende filer.

C:\WINDOWS\system32\cmd32.exe >>>> FILEN
C:\WINDOWS\p_981116.exe /Q:A >>>> FILEN
C:\Programmer\Kazaa >>>> MAPPEN
C:\PROGRA~1\MYWEBS~1 >>>> MAPPEN

---------------------------------------------------------------------------------------------------------------------------------------

Prøv så en tur med Regedit.
Klik på Start->Kør skriv regedit og klik OK.
Du får et vindue frem - lidt ligesom stifinder.
Klik dig frem til:
HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main
Tjek om der ligger en nøgle/tekst der hedder "HOMEOldSP", gør der det, så slet den.
Klik så på "Denne computer" i Regedit-vinduet, derefter på "Redigér->Søg" skriv "Homeoldsp" klik på "find næste" slet det den finder og tryk på <F3> slet, <F3> til du får at vide at søgningen er afsluttet.
Samme fremgangsmåde med søgeordet About:blank.

Derefter Genstarter du i fejlsikret tilstand og kører engangsscanneren du downloadede i starten. Aktiver ALT i opsætningen og lad den arbejde helt færdig. Det kan godt ta' lang tid.

Derefter genstarter du normalt og sender en frisk log herind så vi kan konstatere, om vi har fået den helt ren.
Først når din log er endelig godkendt, må du aktivere din systemgendannelse igen.

Okay... Øhhmmm her er den nye log.
Jeg kunne ikke finde filen : C:\WINDOWS\p_981116.exe /Q:A
Og heller ikke mappen: C:\PROGRA~1\MYWEBS~1
Der var ikke nogen "HOMEOldSP" at finde...
Når jeg starter op giver cmd32.exe stadig en fejlmelding... Noget med at jeg har skrevet forkert... ?!?

Her er loggen


Logfile of HijackThis v1.98.2
Scan saved at 16:28:32, on 31-10-2004
Platform: Windows XP  (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 (6.00.2600.0000)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\System32\alg.exe
C:\Programmer\Fælles filer\EPSON\EBAPI\SAgent2.exe
C:\NORMAN\Nvc\BIN\NPFSVICE.EXE
C:\Norman\NVC\BIN\Zanda.exe
C:\WINDOWS\System32\nvsvc32.exe
C:\WINDOWS\System32\svchost.exe
C:\Programmer\Analog Devices\SoundMAX\Smtray.exe
C:\WINDOWS\System32\wuauclt.exe
C:\Programmer\Logitech\iTouch\iTouch.exe
C:\PROGRA~1\Logitech\MOUSEW~1\SYSTEM\EM_EXEC.EXE
C:\NORMAN\Nvc\BIN\ZLH.EXE
C:\WINDOWS\System32\ctfmon.exe
C:\Programmer\MSN Messenger\MsnMsgr.Exe
C:\Programmer\TEXTware\HotKey\TWALINK.EXE
C:\NORMAN\Nvc\BIN\NYMSE.EXE
C:\NORMAN\Nvc\BIN\NIP.EXE
C:\NORMAN\Nvc\BIN\npfmsg2.exe
C:\Programmer\Logitech\iTouch\kbdtray.exe
C:\NORMAN\Nvc\BIN\nvcoas.exe
C:\NORMAN\Nvc\BIN\nipsvc.exe
C:\NORMAN\Nvc\BIN\NJEEVES.EXE
C:\NORMAN\Nvc\BIN\NVCSCHED.EXE
C:\NORMAN\Nvc\BIN\cclaw.exe
C:\Documents and Settings\Matias\Skrivebord\Ny mappe\hijackthis.exe

R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = localhost
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Hyperlinks
F2 - REG:system.ini: Shell=Explorer.exe C:\WINDOWS\System32\cmd32.exe
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programmer\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O4 - HKLM\..\Run: [Smapp] C:\Programmer\Analog Devices\SoundMAX\Smtray.exe
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE NvQTwk,NvCplDaemon initialize
O4 - HKLM\..\Run: [zBrowser Launcher] C:\Programmer\Logitech\iTouch\iTouch.exe
O4 - HKLM\..\Run: [EM_EXEC] C:\PROGRA~1\Logitech\MOUSEW~1\SYSTEM\EM_EXEC.EXE
O4 - HKLM\..\Run: [Norman ZANDA] C:\NORMAN\Nvc\BIN\ZLH.EXE /LOAD /SPLASH
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\ctfmon.exe
O4 - HKCU\..\Run: [MsnMsgr] "C:\Programmer\MSN Messenger\MsnMsgr.Exe" /background
O4 - Global Startup: Adobe Gamma Loader.lnk = ?
O4 - Global Startup: HotKey.lnk = C:\Programmer\TEXTware\HotKey\TWALINK.EXE
O12 - Plugin for .spop: C:\Programmer\Internet Explorer\Plugins\NPDocBox.dll
O15 - Trusted Zone: www.online-banking.dk
O16 - DPF: {498A0AC2-A3AC-11D4-80A9-0050DA680987} (HearMe (Firewall) Voice Control) - http://www.englishtown.com/EtownResources/HearMe/hmvcfe.cab
O16 - DPF: {71AEE1E3-1B65-41FA-BBD2-565CBD1359D8} - https://udstedelse.certifikat.tdc.dk/csp/authenticode/PrimeInkCSPInstall0703.exe
O16 - DPF: {AD7FAFB0-16D6-40C3-AF27-585D6E6453FD} -
O16 - DPF: {C81B5180-AFD1-41A3-97E1-99E8D254DB98} (CSS Web Installer Class) - http://scanner.virus112.com/cabs/cssweb.cab


-MattB

Så vidt jeg kan bedømme, er din pc nu ren og du kan genaktivere din systemgendannelse, samt sætte mappeindstillinger tilbage til standard:

Men du "lever" farligt !
Hent, gem og installer SP1 som du finder her - http://intern.sdu.dk/it-service/tjenester/ftphotel/ftpindhold/
Derefter skal du deaktivere DCOM - her finder du både manual og værktøj - http://www.spywarefri.dk/tipsogtricks.htm
Besøg derefter Windows Update og få installeret ALLE sikkerhedsopdateringer i en fart, ellers varer det ikke længe før vi ser dig i denne situation igen.

For at sikre din fremtidige færden på Internettet vil jeg også foreslå, at du henter og installerer følgende programmer :
SPYBOT S&D, SPYWAREBLASTER, SPYWAREGUARD og IE-SPYAD -

Alle programmerne finder du her http://www.spywarefri.dk/vaerktoj.htm

Her finder du også en beskrivelse af programmerne, samt en installations vejledning. Alt sammen skal løbende opdateres, ligesom dit windows og IE. Derefter kan du trygt surfe på Internettet, uden at få alt det snavs på computeren.
Men husk at god og sund fornuft, også er en del af sikkerheden.

Super duper.... Det var fedt du gad! Der er bare lige et problem... Når jeg vil installere den nye "Service pack II" melder den fejl... Noget med en nøgle der er ugyldig...
Men i hvert fald tak for det. Kun Go' karma herfra!
-Matt B

Takker for point *S*
Det med nøglen må være fordi du bruger en kopi-version af XP.
Så - smut du hellere ud og køb dig en lovlig version som kan opdateres. Før er du ikke i sikkerhed *S*

Det gør jeg faktisk ikke... det er det der undre mig... ;)

Hvis du har "rent mel" i posen, er det da bare med at få kontaktet Microsoft i en fart. De kan sikkert løse det lille problem så.