Logfile of HijackThis v1.99.1 Scan saved at 11:06:06, on 2005-06-29 Platform: Windows XP SP1 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\System32\taskmgr.exe C:\Program\hjt\HijackThis.exe C:\WINDOWS\msxmidi.exe C:\Program\Internet Explorer\iexplore.exe C:\WINDOWS\system32\cmd.exe C:\Program\Delade filer\services.exe C:\WINDOWS\system32\cmd.exe C:\Program\Delade filer\services.exe c:\windows\system32\blzbvnz.exe C:\Program Files\Internet Optimizer\optimize.exe C:\DOCUME~1\Roger\LOKALA~1\Temp\i42.tmp C:\WINDOWS\shop1004.exe C:\DOCUME~1\Roger\LOKALA~1\Temp\SskUpdater3.exe C:\DOCUME~1\Roger\LOKALA~1\Temp\180sainstaller.exe C:\Documents and Settings\Roger\Skrivbord\sex.exe C:\Program\BullsEye Network\bin\bargains.exe C:\WINDOWS\System32\msxct.exe C:\Program\180searchassistant\sac.exe C:\Program\WebSiteViewer\127062.dlr C:\Program\WeirdOnTheWeb\WeirdOnTheWeb.exe C:\WINDOWS\explorer.exe C:\Program\COMMON~1\wmfk\wmfkm.exe C:\Program\COMMON~1\wmfk\wmfka.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Länkar R3 - URLSearchHook: (no name) - _{CFBFAE00-17A6-11D0-99CB-00C04FD64497} - (no file) F2 - REG:system.ini: Shell=Explorer.exe C:\WINDOWS\Nail.exe F3 - REG:win.ini: run=C:\WINDOWS\System32\svhost.exe O2 - BHO: BHObj Class - {00000010-6F7D-442C-93E3-4A4827C2E4C8} - C:\WINDOWS\nem220.dll O2 - BHO: Shorty - {11A4CA8C-A8B9-49c2-A6D3-3F64C9EEBAE6} - C:\Program\DNS\Catcher.dll O2 - BHO: IE Update Class - {5B4AB8E2-6DC5-477A-B637-BF3C1A2E5993} - C:\WINDOWS\isrvs\sysupd.dll O2 - BHO: ohb - {999A06FF-10EF-4A29-8640-69E99882C26B} - C:\WINDOWS\System32\nslB.dll O2 - BHO: (no name) - {B699EE50-7BD1-5454-9378-5EABE8C6D296} - C:\WINDOWS\System32\cdmagent\mglmvswshj.dll O2 - BHO: ADP UrlCatcher Class - {F4E04583-354E-4076-BE7D-ED6A80FD66DA} - C:\WINDOWS\System32\msbe.dll O2 - BHO: RichEditor Class - {F79A2C4B-8776-4ED7-8B2F-4786A4A3500A} - C:\WINDOWS\System32\richedtr.dll O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx O3 - Toolbar: UCmore XP - The Search Accelerator - {44BE0690-5429-47f0-85BB-3FFD8020233E} - C:\Program\TheSearchAccelerator\UCMTSAIE.dll O4 - HKLM\..\Run: [System backup] C:\WINDOWS\System32\msxmidi.exe O4 - HKLM\..\Run: [Desktop Search] C:\WINDOWS\isrvs\desktop.exe O4 - HKLM\..\Run: [ffis] C:\WINDOWS\isrvs\ffisearch.exe O4 - HKLM\..\Run: [Internet Optimizer] "C:\Program Files\Internet Optimizer\optimize.exe" O4 - HKLM\..\Run: [richup] C:\WINDOWS\System32\richup.exe O4 - HKLM\..\Run: [bgviyfy] c:\windows\system32\blzbvnz.exe r O4 - HKLM\..\Run: [Windows Service] C:\WINDOWS\System32\sex.exe O4 - HKLM\..\Run: [SAHBundle] C:\DOCUME~1\Roger\LOKALA~1\Temp\shop1004.exe run O4 - HKLM\..\Run: [BullsEye Network] C:\Program\BullsEye Network\bin\bargains.exe O4 - HKLM\..\Run: [msxct] msxct.exe O4 - HKLM\..\Run: [sac] c:\program\180searchassistant\sac.exe O4 - HKLM\..\Run: [WeirdOnTheWeb] "C:\Program\WeirdOnTheWeb\WeirdOnTheWeb.exe" O4 - HKCU\..\Run: [System backup] C:\WINDOWS\System32\msxmidi.exe O4 - HKCU\..\Run: [DNS] C:\Program\Delade filer\mc-58-12-0000093.exe O4 - HKCU\..\Run: [Windows installer] C:\winstall.exe O4 - HKCU\..\Run: [SpySheriff] C:\Program Files\SpySheriff\SpySheriff.exe O4 - HKCU\..\Run: [wmfk] C:\Program\COMMON~1\wmfk\wmfkm.exe O4 - HKCU\..\Run: [Windows Service] C:\WINDOWS\System32\sex.exe O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm O9 - Extra 'Tools' menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm O15 - Trusted Zone: *.addictivetechnologies.com O15 - Trusted Zone: *.addictivetechnologies.net O15 - Trusted Zone: *.awmdabest.com O15 - Trusted Zone: *.c4tdownload.com O15 - Trusted Zone: *.clickspring.net O15 - Trusted Zone: *.f1organizer.com O15 - Trusted Zone: *.media-motor.net O15 - Trusted Zone: *.megapornix.com O15 - Trusted Zone: *.mt-download.com O15 - Trusted Zone: *.overpro.com O15 - Trusted Zone: *.searchmiracle.com O15 - Trusted Zone: *.slotch.com O15 - Trusted Zone: *.slotchbar.com O15 - Trusted Zone: *.windupdates.com O15 - Trusted Zone: *.xxxtoolbar.com O15 - Trusted Zone: *.ysbweb.com O15 - Trusted Zone: *.addictivetechnologies.com (HKLM) O15 - Trusted Zone: *.addictivetechnologies.net (HKLM) O15 - Trusted Zone: *.awmdabest.com (HKLM) O15 - Trusted Zone: *.c4tdownload.com (HKLM) O15 - Trusted Zone: *.clickspring.net (HKLM) O15 - Trusted Zone: *.f1organizer.com (HKLM) O15 - Trusted Zone: *.media-motor.net (HKLM) O15 - Trusted Zone: *.megapornix.com (HKLM) O15 - Trusted Zone: *.mt-download.com (HKLM) O15 - Trusted Zone: *.overpro.com (HKLM) O15 - Trusted Zone: *.searchmiracle.com (HKLM) O15 - Trusted Zone: *.slotch.com (HKLM) O15 - Trusted Zone: *.slotchbar.com (HKLM) O15 - Trusted Zone: *.windupdates.com (HKLM) O15 - Trusted Zone: *.xxxtoolbar.com (HKLM) O15 - Trusted Zone: *.ysbweb.com (HKLM) O15 - ProtocolDefaults: 'http' protocol is in Trusted Zone, should be Internet Zone O15 - ProtocolDefaults: 'http' protocol is in Trusted Zone, should be Internet Zone (HKLM) O16 - DPF: {79849612-A98F-45B8-95E9-4D13C7B6B35C} (Loader2 Control) - http://static.topconverting.com/activex/mp3.ocx O16 - DPF: {99410CDE-6F16-42ce-9D49-3807F78F0287} (ClientInstaller Class) - http://www.180searchassistant.com/180saax.cab O18 - Filter: text/html - {950238FB-C706-4791-8674-4D429F85897E} - C:\WINDOWS\isrvs\mfiltis.dll O23 - Service: Remote Packet Capture Protocol v.0 (experimental) (rpcapd) - Unknown owner - %ProgramFiles%\WinPcap\rpcapd.exe" -d -f "%ProgramFiles%\WinPcap\rpcapd.ini (file missing) O23 - Service: System Startup Service (SvcProc) - Unknown owner - C:\WINDOWS\svcproc.exe