Logfile of HijackThis v1.99.1
Scan saved at 21:27:22, on 25.10.2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\SYSTEM32\DWRCS.EXE
C:\WINDOWS\System32\eTSrv.exe
C:\Programfiler\iPass\iPassConnect\iPCAgent.exe
C:\Programfiler\Fellesfiler\Microsoft Shared\VS7Debug\mdm.exe
C:\OfficeScan NT\ntrtscan.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\Programfiler\CheckPoint\SecuRemote\bin\SR_WatchDog.exe
C:\WINDOWS\System32\svchost.exe
C:\Programfiler\TOSHIBA\TME3\Tmesbs32.exe
C:\OfficeScan NT\tmlisten.exe
C:\Programfiler\CheckPoint\SecuRemote\bin\SR_GUI.exe
C:\Programfiler\iPass\iPassConnect\downloader\ipccheck.exe
C:\Programfiler\QuickTime\qttask.exe
C:\OfficeScan NT\ofcdog.exe
C:\Documents and Settings\johan\Lokale innstillinger\Temp\{231F68F4-70E4-41A6-BEDA-7E7934169B54}\MXOALDR.EXE
C:\Programfiler\Maxtor\OneTouch\utils\Onetouch.exe
C:\programfiler\tiny disk tools2.95\tinydisk.exe
C:\Programfiler\Pinnacle\Shared Files\Programs\Remote\Remoterm.exe
C:\WINDOWS\system32\00THotkey.exe
C:\Programfiler\Picasa2\PicasaMediaDetector.exe
C:\WINDOWS\system32\ctfmon.exe
c:\progra~1\intern~1\iexplore.exe
C:\Programfiler\Internet Explorer\iexplore.exe
C:\Programfiler\CheckPoint\SecuRemote\bin\SR_Service.exe
C:\DOCUME~1\johan\LOKALE~1\Temp\Midlertidig mappe 3 for hijackthis.zip\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.lcxwtjmtihzpws.us/Fnrdwmz4dZW3S…R_i/bsAVB2.html
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://h/
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = about:blank
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,SearchURL = http://nonstopsearch.com/?a=2&b=test
R1 - HKLM\Software\Microsoft\Internet Explorer\SearchURL,SearchURL = http://nonstopsearch.com/?a=2&b=test
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Koblinger
O2 - BHO: (no name) - {37391BCA-9B2E-AABC-AE5D-9AADF6C73F85} - C:\DOCUME~1\johan\PROGRA~1\STARTS~1\Move That.exe (file missing)
O2 - BHO: (no name) - {5EF2E834-FFBE-460B-812C-FB01C0D551CE} - (no file)
O2 - BHO: (no name) - {6CFAEE6C-06F0-AEE4-F864-814B3212A749} - C:\DOCUME~1\johan\PROGRA~1\STARTS~1\CAKE CAST.exe (file missing)
O4 - HKLM\..\Run: [QuickTime Task] "C:\Programfiler\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [Synchronization Manager] %SystemRoot%\system32\mobsync.exe /logon
O4 - HKLM\..\Run: [MXOBG] C:\Documents and Settings\johan\Lokale innstillinger\Temp\{231F68F4-70E4-41A6-BEDA-7E7934169B54}\MXOALDR.EXE
O4 - HKLM\..\Run: [MaxtorOneTouch] C:\Programfiler\Maxtor\OneTouch\utils\Onetouch.exe
O4 - HKLM\..\Run: [TinyDis] c:\programfiler\tiny disk tools2.95\tinydisk.exe sys_auto_run C:\Programfiler\Tiny Disk Tools2.95
O4 - HKLM\..\Run: [PMCRemote] C:\Programfiler\Pinnacle\Shared Files\Programs\Remote\Remoterm.exe
O4 - HKLM\..\Run: [PinnacleDriverCheck] C:\WINDOWS\system32\PSDrvCheck.exe -CheckReg
O4 - HKLM\..\Run: [00THotkey] C:\WINDOWS\system32\00THotkey.exe
O4 - HKLM\..\Run: [000StTHK] 000StTHK.exe
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE NvQTwk,NvCplDaemon initialize
O4 - HKLM\..\Run: [nwiz] nwiz.exe /installquiet
O4 - HKLM\..\Run: [Picasa Media Detector] C:\Programfiler\Picasa2\PicasaMediaDetector.exe
O4 - HKLM\..\Run: [Grid Mp3 Ref Upload] C:\Documents and Settings\All Users\Programdata\bowsmetagridmp3\1Grey.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [Junkthunk] C:\DOCUME~1\johan\PROGRA~1\PLANCR~1\Deaf Mess.exe
O4 - Startup: VersionTracker Pro.lnk = ?
O4 - Global Startup: Microsoft Office.lnk = C:\Programfiler\Microsoft Office\Office10\OSA.EXE
O8 - Extra context menu item: E&ksporter til Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programfiler\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programfiler\Messenger\msmsgs.exe
O14 - IERESET.INF: START_PAGE_URL=http://intranett
O15 - Trusted Zone: http://*.windowsupdate.com
O16 - DPF: {41F17733-B041-4099-A042-B518BB6A408C} - http://a1408.g.akamai.net/7/1408/9955/2003…iTunesSetup.exe
O16 - DPF: {C4925E65-7A1E-11D2-8BB4-00A0C9CC72C3} (Virtools WebPlayer Class) - http://a532.g.akamai.net/7/532/6712/6c5b0a…5/Installer.exe
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: Domain = tromkom.intern
O17 - HKLM\Software\..\Telephony: DomainName = tromkom.intern
O17 - HKLM\System\CCS\Services\Tcpip\..\{04A51602-C2DA-4087-B76B-BA1C941984E3}: NameServer = 69.50.176.156,195.225.176.31
O17 - HKLM\System\CCS\Services\Tcpip\..\{3C660BA8-2192-40A6-9DD4-CF2C5AC0A954}: NameServer = 69.50.176.156,195.225.176.31
O17 - HKLM\System\CCS\Services\Tcpip\..\{73428AC1-B6A4-4C5D-BEE9-10F770948CBF}: NameServer = 69.50.176.156,195.225.176.31
O17 - HKLM\System\CCS\Services\Tcpip\..\{73B61B87-459B-4EF4-B490-C7558016F724}: NameServer = 69.50.176.156,195.225.176.31
O17 - HKLM\System\CCS\Services\Tcpip\..\{7D79A25F-C8D0-4C3A-8852-F52F5B1CF143}: NameServer = 69.50.176.156,195.225.176.31
O17 - HKLM\System\CCS\Services\Tcpip\..\{885FAEA6-BE45-4489-8B2F-E20972FCF269}: NameServer = 69.50.176.156,195.225.176.31
O17 - HKLM\System\CCS\Services\Tcpip\..\{888E09A8-7D4D-42CF-9EBD-113C50250772}: NameServer = 69.50.176.156,195.225.176.31
O17 - HKLM\System\CCS\Services\Tcpip\..\{AE483F11-5D7C-4024-A4BD-997E9F7F1160}: NameServer = 69.50.176.156,195.225.176.31
O17 - HKLM\System\CCS\Services\Tcpip\..\{B31EAD93-A296-456F-8BD6-55C629827028}: NameServer = 69.50.176.156,195.225.176.31
O17 - HKLM\System\CS1\Services\Tcpip\Parameters: Domain = tromkom.intern
O17 - HKLM\System\CS2\Services\Tcpip\Parameters: Domain = tromkom.intern
O20 - Winlogon Notify: ckpNotify - C:\WINDOWS\SYSTEM32\ckpNotify.dll
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O23 - Service: DameWare Mini Remote Control (DWMRCS) - DameWare Development - C:\WINDOWS\SYSTEM32\DWRCS.EXE
O23 - Service: eToken Notification Service (ETOKSRV) - Aladdin Knowledge Systems Ltd. - C:\WINDOWS\System32\eTSrv.exe
O23 - Service: iPassConnectEngine - iPass - C:\Programfiler\iPass\iPassConnect\iPassConnectEngine.exe
O23 - Service: iPCAgent - iPass, Inc. - C:\Programfiler\iPass\iPassConnect\iPCAgent.exe
O23 - Service: OfficeScanNT RealTime Scan (ntrtscan) - Trend Micro Inc. - C:\OfficeScan NT\ntrtscan.exe
O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: OracleOraHome81ClientCache - Unknown owner - C:\oracle\ora81\bin\ONRSD.EXE
O23 - Service: Check Point SecuRemote Service (SR_Service) - Check Point Software Technologies - C:\Programfiler\CheckPoint\SecuRemote\bin\SR_Service.exe
O23 - Service: Check Point SecuRemote WatchDog (SR_WatchDog) - Check Point Software Technologies - C:\Programfiler\CheckPoint\SecuRemote\bin\SR_WatchDog.exe
O23 - Service: Tmesbs32 (Tmesbs) - TOSHIBA Corporation - C:\Programfiler\TOSHIBA\TME3\Tmesbs32.exe
O23 - Service: OfficeScanNT Listener (tmlisten) - Unknown owner - C:\OfficeScan NT\tmlisten.exe