w32/virtumonde.gdi
Her er log filenLogfile of HijackThis v1.99.1
Scan saved at 21:22:42, on 18-05-2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Running processes:
H:\WINDOWS\System32\smss.exe
H:\WINDOWS\system32\csrss.exe
H:\WINDOWS\system32\winlogon.exe
H:\WINDOWS\system32\services.exe
H:\WINDOWS\system32\lsass.exe
H:\WINDOWS\system32\svchost.exe
H:\WINDOWS\system32\svchost.exe
H:\WINDOWS\System32\svchost.exe
H:\Programmer\TDCpakke\npm\bin\nvoy.exe
H:\WINDOWS\system32\svchost.exe
H:\WINDOWS\system32\svchost.exe
H:\Programmer\TDCpakke\npf\bin\npfsvc32.exe
H:\WINDOWS\system32\spoolsv.exe
H:\WINDOWS\System32\SCardSvr.exe
H:\WINDOWS\Explorer.EXE
H:\Programmer\TDCpakke\Npm\Bin\Zanda.exe
H:\Programmer\CyberLink\PowerDVD\PDVDServ.exe
H:\Programmer\TDCpakke\npm\bin\ZLH.EXE
H:\WINDOWS\system32\ctfmon.exe
H:\Programmer\Microsoft Office\Office12\ONENOTEM.EXE
H:\Programmer\TDCpakke\npc\bin\npcsvc32.exe
H:\Programmer\TDCpakke\npm\bin\NJEEVES.EXE
H:\Programmer\TDCpakke\npc\bin\nuaa.exe
H:\WINDOWS\system32\wscntfy.exe
H:\WINDOWS\System32\alg.exe
H:\Programmer\TDCpakke\nvc\BIN\NIP.EXE
H:\Programmer\Internet Explorer\iexplore.exe
H:\Programmer\TDCpakke\nvc\bin\nvcoas.exe
H:\Programmer\TDCpakke\nvc\bin\cclaw.exe
H:\Programmer\TDCpakke\nvc\bin\nvcod.exe
H:\Programmer\TDCpakke\npm\bin\NREN.EXE
H:\Documents and Settings\Administrator\Skrivebord\Hijackthis\alternativ.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://tdconline.dk/
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Hyperlinks
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file)
F2 - REG:system.ini: UserInit=H:\WINDOWS\system32\Userinit.exe
O2 - BHO: (no name) - {3E71DC86-4A5C-4C71-A185-EBE9AC2EB607} - H:\WINDOWS\system32\ljjjijh.dll
O2 - BHO: (no name) - {5A752A67-39C5-4EA3-9825-E0D61EB523DA} - H:\WINDOWS\system32\ljjhh.dll
O4 - HKLM\..\Run: [RemoteControl] H:\Programmer\CyberLink\PowerDVD\PDVDServ.exe
O4 - HKLM\..\Run: [Norman ZANDA] H:\Programmer\TDCpakke\npm\bin\ZLH.EXE /LOAD /SPLASH
O4 - HKLM\..\Run: [NPCTray] H:\Programmer\TDCpakke\npc\bin\npc_tray.exe /LOAD
O4 - HKCU\..\Run: [CTFMON.EXE] H:\WINDOWS\system32\ctfmon.exe
O4 - Startup: RegistryDefender.lnk = H:\Programmer\Registry Defender\RegistryDefender.exe
O4 - Startup: Screen Clipper and Launcher til OneNote 2007.lnk = H:\Programmer\Microsoft Office\Office12\ONENOTEM.EXE
O8 - Extra context menu item: E&ksporter til Microsoft Excel - res://H:\PROGRA~1\MICROS~1\Office12\EXCEL.EXE/3000
O9 - Extra button: Send til OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - H:\PROGRA~1\MICROS~1\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: S&end til OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - H:\PROGRA~1\MICROS~1\Office12\ONBttnIE.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - H:\PROGRA~1\MICROS~1\Office12\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - H:\Programmer\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - H:\Programmer\Messenger\msmsgs.exe
O10 - Unknown file in Winsock LSP: h:\programmer\tdcpakke\npc\bin\nlf.dll
O10 - Unknown file in Winsock LSP: h:\programmer\tdcpakke\npc\bin\nlf.dll
O10 - Unknown file in Winsock LSP: h:\programmer\tdcpakke\npc\bin\nlf.dll
O10 - Unknown file in Winsock LSP: h:\programmer\tdcpakke\npc\bin\nlf.dll
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - H:\Programmer\Yahoo!\Common\yinsthelper.dll
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1179372527022
O17 - HKLM\System\CCS\Services\Tcpip\..\{9FA63CC8-4BC8-43A1-82E6-AB54D80AF1A8}: NameServer = 194.239.134.83,193.162.153.164
O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - H:\PROGRA~1\MICROS~1\Office12\GR99D3~1.DLL
O18 - Protocol: ms-help - {314111C7-A502-11D2-BBCA-00C04F8EC294} - H:\Programmer\Fælles filer\Microsoft Shared\Help\hxds.dll
O18 - Filter hijack: text/xml - {807563E5-5146-11D5-A672-00B0D022E945} - H:\PROGRA~1\FLLESF~1\MICROS~1\OFFICE12\MSOXMLMF.DLL
O20 - Winlogon Notify: ljjhh - H:\WINDOWS\system32\ljjhh.dll
O20 - Winlogon Notify: ljjjijh - H:\WINDOWS\SYSTEM32\ljjjijh.dll
O23 - Service: Norman NJeeves - Unknown owner - H:\Programmer\TDCpakke\npm\bin\NJEEVES.EXE
O23 - Service: Norman ZANDA - Unknown owner - H:\Programmer\TDCpakke\Npm\Bin\Zanda.exe
O23 - Service: Norman Parental Control (NPC) - Norman ASA - H:\Programmer\TDCpakke\npc\bin\npcsvc32.exe
O23 - Service: Norman Personal Firewall Service (NPFSvc32) - Norman ASA - H:\Programmer\TDCpakke\npf\bin\npfsvc32.exe
O23 - Service: Norman User Activity Agent (NUAA) - Norman ASA - H:\Programmer\TDCpakke\npc\bin\nuaa.exe
O23 - Service: Norman Virus Control on-access component (nvcoas) - Norman ASA - H:\Programmer\TDCpakke\nvc\bin\nvcoas.exe
O23 - Service: Norman V.O.Y. (NVOY) - Norman ASA - H:\Programmer\TDCpakke\npm\bin\nvoy.exe
