[05/20/2007, 23:24:56] - VirtumundoBeGone v1.5 ( "C:\Documents and Settings\Malossi Hyper Racing\Skrivebord\VirtumundoBeGone.exe" )
[05/20/2007, 23:25:10] - Detected System Information:
[05/20/2007, 23:25:10] -  Windows Version: 5.1.2600, Service Pack 1
[05/20/2007, 23:25:10] -  Current Username: Malossi Hyper Racing (Admin)
[05/20/2007, 23:25:10] -  Windows is in NORMAL mode.
[05/20/2007, 23:25:10] - Searching for Browser Helper Objects:
[05/20/2007, 23:25:10] -  BHO 1: {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} (AcroIEHlprObj Class)
[05/20/2007, 23:25:10] -  BHO 2: {53707962-6F74-2D53-2644-206D7942484F} ()
[05/20/2007, 23:25:10] - WARNING: BHO has no default name. Checking for Winlogon reference.
[05/20/2007, 23:25:10] -  Checking for HKLM\...\Winlogon\Notify\SDHelper
[05/20/2007, 23:25:10] -  Key not found: HKLM\...\Winlogon\Notify\SDHelper, continuing.
[05/20/2007, 23:25:10] -  BHO 3: {A24B57F8-505D-4fc5-9960-740E304D1ABA} ()
[05/20/2007, 23:25:10] - WARNING: BHO has no default name. Checking for Winlogon reference.
[05/20/2007, 23:25:10] -  Checking for HKLM\...\Winlogon\Notify\tmp2.tmp
[05/20/2007, 23:25:10] -  Key not found: HKLM\...\Winlogon\Notify\tmp2.tmp, continuing.
[05/20/2007, 23:25:10] -  BHO 4: {b88af703-0c92-4186-bcbc-a3d8ed889ee8} ()
[05/20/2007, 23:25:10] - WARNING: BHO has no default name. Checking for Winlogon reference.
[05/20/2007, 23:25:10] -  Checking for HKLM\...\Winlogon\Notify\atlame
[05/20/2007, 23:25:10] -  Found: HKLM\...\Winlogon\Notify\atlame - This is probably Virtumundo.
[05/20/2007, 23:25:10] -  Assigning {b88af703-0c92-4186-bcbc-a3d8ed889ee8} MSEvents Object
[05/20/2007, 23:25:10] - BHO list has been changed! Starting over...
[05/20/2007, 23:25:10] -  BHO 1: {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} (AcroIEHlprObj Class)
[05/20/2007, 23:25:10] -  BHO 2: {53707962-6F74-2D53-2644-206D7942484F} ()
[05/20/2007, 23:25:10] - WARNING: BHO has no default name. Checking for Winlogon reference.
[05/20/2007, 23:25:10] -  Checking for HKLM\...\Winlogon\Notify\SDHelper
[05/20/2007, 23:25:10] -  Key not found: HKLM\...\Winlogon\Notify\SDHelper, continuing.
[05/20/2007, 23:25:10] -  BHO 3: {A24B57F8-505D-4fc5-9960-740E304D1ABA} ()
[05/20/2007, 23:25:10] - WARNING: BHO has no default name. Checking for Winlogon reference.
[05/20/2007, 23:25:10] -  Checking for HKLM\...\Winlogon\Notify\tmp2.tmp
[05/20/2007, 23:25:10] -  Key not found: HKLM\...\Winlogon\Notify\tmp2.tmp, continuing.
[05/20/2007, 23:25:10] -  BHO 4: {b88af703-0c92-4186-bcbc-a3d8ed889ee8} (MSEvents Object)
[05/20/2007, 23:25:10] - ALERT: Found MSEvents Object!
[05/20/2007, 23:25:10] - Finished Searching Browser Helper Objects
[05/20/2007, 23:25:10] - *** Detected MSEvents Object
[05/20/2007, 23:25:10] - Trying to remove MSEvents Object...
[05/20/2007, 23:25:11] -    Terminating Process: IEXPLORE.EXE
[05/20/2007, 23:25:12] -    Terminating Process: RUNDLL32.EXE
[05/20/2007, 23:25:12] -    Disabling Automatic Shell Restart
[05/20/2007, 23:25:12] -    Terminating Process: EXPLORER.EXE
[05/20/2007, 23:25:13] -    Suspending the NT Session Manager System Service
[05/20/2007, 23:25:13] -    Terminating Windows NT Logon/Logoff Manager
[05/20/2007, 23:25:14] -    Re-enabling Automatic Shell Restart
[05/20/2007, 23:25:14] -   File to disable: C:\WINDOWS\system32\atlame.dll
[05/20/2007, 23:25:14] -  Renaming C:\WINDOWS\system32\atlame.dll -> C:\WINDOWS\system32\atlame.dll.vir
[05/20/2007, 23:25:14] -  File successfully renamed!
[05/20/2007, 23:25:14] -   Removing HKLM\...\Browser Helper Objects\{b88af703-0c92-4186-bcbc-a3d8ed889ee8}
[05/20/2007, 23:25:14] -   Removing HKCR\CLSID\{b88af703-0c92-4186-bcbc-a3d8ed889ee8}
[05/20/2007, 23:25:15] -   Adding Kill Bit for ActiveX for GUID: {b88af703-0c92-4186-bcbc-a3d8ed889ee8}
[05/20/2007, 23:25:15] -   Deleting ATLEvents/MSEvents Registry entries
[05/20/2007, 23:25:15] -   Removing HKLM\...\Winlogon\Notify\atlame
[05/20/2007, 23:25:15] - Searching for Browser Helper Objects:
[05/20/2007, 23:25:15] -  BHO 1: {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} (AcroIEHlprObj Class)
[05/20/2007, 23:25:15] -  BHO 2: {53707962-6F74-2D53-2644-206D7942484F} ()
[05/20/2007, 23:25:15] - WARNING: BHO has no default name. Checking for Winlogon reference.
[05/20/2007, 23:25:15] -  Checking for HKLM\...\Winlogon\Notify\SDHelper
[05/20/2007, 23:25:15] -  Key not found: HKLM\...\Winlogon\Notify\SDHelper, continuing.
[05/20/2007, 23:25:15] -  BHO 3: {A24B57F8-505D-4fc5-9960-740E304D1ABA} ()
[05/20/2007, 23:25:15] - WARNING: BHO has no default name. Checking for Winlogon reference.
[05/20/2007, 23:25:15] -  Checking for HKLM\...\Winlogon\Notify\tmp2.tmp
[05/20/2007, 23:25:15] -  Key not found: HKLM\...\Winlogon\Notify\tmp2.tmp, continuing.
[05/20/2007, 23:25:15] - Finished Searching Browser Helper Objects
[05/20/2007, 23:25:15] - Finishing up...
[05/20/2007, 23:25:15] - A restart is needed.
[05/20/2007, 23:25:28] - Attempting to Restart via STOP error (Blue Screen!)

SUPERAntiSpyware Scan Log
http://www.superantispyware.com

Generated 05/21/2007 at 00:28 AM

Application Version : 3.7.1018

Core Rules Database Version : 3227
Trace Rules Database Version: 1238

Scan type       : Complete Scan
Total Scan Time : 00:55:35

Memory items scanned      : 160
Memory threats detected   : 0
Registry items scanned    : 4797
Registry threats detected : 5
File items scanned        : 27826
File threats detected     : 93

Adware.Vundo Variant
	HKLM\Software\Classes\CLSID\{D651AFF4-9590-424d-BD1E-8E33E090DFB3}
	HKCR\CLSID\{D651AFF4-9590-424D-BD1E-8E33E090DFB3}
	HKCR\CLSID\{D651AFF4-9590-424D-BD1E-8E33E090DFB3}\InprocServer32
	HKCR\CLSID\{D651AFF4-9590-424D-BD1E-8E33E090DFB3}\InprocServer32#ThreadingModel
	C:\WINDOWS\SYSTEM32\TMP1E.TMP.DLL
	HKCR\CLSID\{D651AFF4-9590-424D-BD1E-8E33E090DFB3}

Adware.Tracking Cookie
	C:\Documents and Settings\Malossi Hyper Racing\Cookies\malossi hyper racing@tradedoubler[2].txt
	C:\Documents and Settings\Malossi Hyper Racing\Cookies\malossi hyper racing@advertising[1].txt
	C:\Documents and Settings\Malossi Hyper Racing\Cookies\malossi hyper racing@linksynergy[1].txt
	C:\Documents and Settings\Malossi Hyper Racing\Cookies\malossi hyper racing@cpvfeed[2].txt
	C:\Documents and Settings\Malossi Hyper Racing\Cookies\malossi hyper racing@3.adbrite[1].txt
	C:\Documents and Settings\Malossi Hyper Racing\Cookies\malossi hyper racing@drivecleaner[1].txt
	C:\Documents and Settings\Malossi Hyper Racing\Cookies\malossi hyper racing@www.winantiviruspro[1].txt
	C:\Documents and Settings\Malossi Hyper Racing\Cookies\malossi hyper racing@indexstats[2].txt
	C:\Documents and Settings\Malossi Hyper Racing\Cookies\malossi hyper racing@ad.yieldmanager[1].txt
	C:\Documents and Settings\Malossi Hyper Racing\Cookies\malossi hyper racing@winantivirus[1].txt
	C:\Documents and Settings\Malossi Hyper Racing\Cookies\malossi hyper racing@adbrite[2].txt
	C:\Documents and Settings\Malossi Hyper Racing\Cookies\malossi hyper racing@www.amaena[2].txt
	C:\Documents and Settings\Malossi Hyper Racing\Cookies\malossi hyper racing@mediaplex[1].txt
	C:\Documents and Settings\Malossi Hyper Racing\Cookies\malossi hyper racing@ads.adbrite[2].txt
	C:\Documents and Settings\Malossi Hyper Racing\Cookies\malossi hyper racing@no.drivecleaner[2].txt
	C:\Documents and Settings\Malossi Hyper Racing\Cookies\malossi hyper racing@stats1.reliablestats[2].txt
	C:\Documents and Settings\Malossi Hyper Racing\Cookies\malossi hyper racing@ads.pointroll[2].txt
	C:\Documents and Settings\Malossi Hyper Racing\Cookies\malossi hyper racing@trafficmp[1].txt
	C:\Documents and Settings\Malossi Hyper Racing\Cookies\malossi hyper racing@ad.zanox[1].txt
	C:\Documents and Settings\Malossi Hyper Racing\Cookies\malossi hyper racing@stats.drivecleaner[2].txt
	C:\Documents and Settings\Malossi Hyper Racing\Cookies\malossi hyper racing@www.drivecleaner[2].txt
	C:\Documents and Settings\Malossi Hyper Racing\Cookies\malossi hyper racing@no.winantivirus[2].txt
	C:\Documents and Settings\Malossi Hyper Racing\Cookies\malossi hyper racing@ad1.hardware[1].txt

BearShare File Sharing Client
	C:\PROGRAMFILER\BEARSHARE\BEARSHARE.EXE
	C:\PROGRAMFILER\BITLORD\DOWNLOADS\BEARSHARE_PRO_V5[1].2.5.3-DIGERATI\CRACK\BEARSHARE.EXE
	C:\WINDOWS\Prefetch\BEARSHARE.EXE-19787EF4.pf

Trace.Known Threat Sources
	C:\Documents and Settings\Malossi Hyper Racing\Lokale innstillinger\Temporary Internet Files\Content.IE5\JDAYQ0R2\checksoft[1].js
	C:\Documents and Settings\Malossi Hyper Racing\Lokale innstillinger\Temporary Internet Files\Content.IE5\JDAYQ0R2\arrow[1].gif
	C:\Documents and Settings\Malossi Hyper Racing\Lokale innstillinger\Temporary Internet Files\Content.IE5\FTSI9Y91\download2[1].php
	C:\Documents and Settings\Malossi Hyper Racing\Lokale innstillinger\Temporary Internet Files\Content.IE5\MOYQZOQY\top1_menu[1].gif
	C:\Documents and Settings\Malossi Hyper Racing\Lokale innstillinger\Temporary Internet Files\Content.IE5\MOYQZOQY\WinAntiVirusPro2006FreeInstall_no[1].exe
	C:\Documents and Settings\Malossi Hyper Racing\Lokale innstillinger\Temporary Internet Files\Content.IE5\FTSI9Y91\wav_banner[1].swf
	C:\Documents and Settings\Malossi Hyper Racing\Lokale innstillinger\Temporary Internet Files\Content.IE5\0JBRZBPW\top1[1].gif
	C:\Documents and Settings\Malossi Hyper Racing\Lokale innstillinger\Temporary Internet Files\Content.IE5\FTSI9Y91\styles[1].css
	C:\Documents and Settings\Malossi Hyper Racing\Lokale innstillinger\Temporary Internet Files\Content.IE5\MOYQZOQY\tracking[1].js
	C:\Documents and Settings\Malossi Hyper Racing\Lokale innstillinger\Temporary Internet Files\Content.IE5\FTSI9Y91\ico2[1].gif
	C:\Documents and Settings\Malossi Hyper Racing\Lokale innstillinger\Temporary Internet Files\Content.IE5\0JBRZBPW\logo[1].gif
	C:\Documents and Settings\Malossi Hyper Racing\Lokale innstillinger\Temporary Internet Files\Content.IE5\JDAYQ0R2\button2[1].gif
	C:\Documents and Settings\Malossi Hyper Racing\Lokale innstillinger\Temporary Internet Files\Content.IE5\MOYQZOQY\ico1[1].gif
	C:\Documents and Settings\Malossi Hyper Racing\Lokale innstillinger\Temporary Internet Files\Content.IE5\JDAYQ0R2\spacer[2].gif
	C:\Documents and Settings\Malossi Hyper Racing\Lokale innstillinger\Temporary Internet Files\Content.IE5\0JBRZBPW\shadow_bg1[1].gif
	C:\Documents and Settings\Malossi Hyper Racing\Lokale innstillinger\Temporary Internet Files\Content.IE5\FTSI9Y91\minus[1].gif
	C:\Documents and Settings\Malossi Hyper Racing\Lokale innstillinger\Temporary Internet Files\Content.IE5\JDAYQ0R2\new_article[1].gif
	C:\Documents and Settings\Malossi Hyper Racing\Lokale innstillinger\Temporary Internet Files\Content.IE5\MOYQZOQY\ratings[1].gif
	C:\Documents and Settings\Malossi Hyper Racing\Lokale innstillinger\Temporary Internet Files\Content.IE5\0JBRZBPW\menu_bg[1].gif
	C:\Documents and Settings\Malossi Hyper Racing\Lokale innstillinger\Temporary Internet Files\Content.IE5\JDAYQ0R2\logo[3].gif
	C:\Documents and Settings\Malossi Hyper Racing\Lokale innstillinger\Temporary Internet Files\Content.IE5\0JBRZBPW\comp_naw[1].gif
	C:\Documents and Settings\Malossi Hyper Racing\Lokale innstillinger\Temporary Internet Files\Content.IE5\MOYQZOQY\bottom_bg[1].gif
	C:\Documents and Settings\Malossi Hyper Racing\Lokale innstillinger\Temporary Internet Files\Content.IE5\0JBRZBPW\bg_testi_right[1].gif
	C:\Documents and Settings\Malossi Hyper Racing\Lokale innstillinger\Temporary Internet Files\Content.IE5\FTSI9Y91\topbox_bg[1].gif
	C:\Documents and Settings\Malossi Hyper Racing\Lokale innstillinger\Temporary Internet Files\Content.IE5\JDAYQ0R2\plus[1].gif
	C:\Documents and Settings\Malossi Hyper Racing\Lokale innstillinger\Temporary Internet Files\Content.IE5\0JBRZBPW\small3[1].gif
	C:\Documents and Settings\Malossi Hyper Racing\Lokale innstillinger\Temporary Internet Files\Content.IE5\MOYQZOQY\bg_testi_subleft[1].gif
	C:\Documents and Settings\Malossi Hyper Racing\Lokale innstillinger\Temporary Internet Files\Content.IE5\FTSI9Y91\body_bg[1].gif
	C:\Documents and Settings\Malossi Hyper Racing\Lokale innstillinger\Temporary Internet Files\Content.IE5\MOYQZOQY\boxh_bg[1].gif
	C:\Documents and Settings\Malossi Hyper Racing\Lokale innstillinger\Temporary Internet Files\Content.IE5\0JBRZBPW\bg_rate_right[1].gif
	C:\Documents and Settings\Malossi Hyper Racing\Lokale innstillinger\Temporary Internet Files\Content.IE5\0JBRZBPW\bt_download1[1].gif
	C:\Documents and Settings\Malossi Hyper Racing\Lokale innstillinger\Temporary Internet Files\Content.IE5\0JBRZBPW\h_text[1].gif
	C:\Documents and Settings\Malossi Hyper Racing\Lokale innstillinger\Temporary Internet Files\Content.IE5\0JBRZBPW\dot_bg[1].gif
	C:\Documents and Settings\Malossi Hyper Racing\Lokale innstillinger\Temporary Internet Files\Content.IE5\0JBRZBPW\awful[1].gif
	C:\Documents and Settings\Malossi Hyper Racing\Lokale innstillinger\Temporary Internet Files\Content.IE5\JDAYQ0R2\bg_testi_bottomright[1].gif
	C:\Documents and Settings\Malossi Hyper Racing\Lokale innstillinger\Temporary Internet Files\Content.IE5\0JBRZBPW\box[1].jpg
	C:\Documents and Settings\Malossi Hyper Racing\Lokale innstillinger\Temporary Internet Files\Content.IE5\JDAYQ0R2\star_full[1].gif
	C:\Documents and Settings\Malossi Hyper Racing\Lokale innstillinger\Temporary Internet Files\Content.IE5\0JBRZBPW\pic3[1].gif
	C:\Documents and Settings\Malossi Hyper Racing\Lokale innstillinger\Temporary Internet Files\Content.IE5\MOYQZOQY\bg_testi_topright[1].gif
	C:\Documents and Settings\Malossi Hyper Racing\Lokale innstillinger\Temporary Internet Files\Content.IE5\JDAYQ0R2\box_sm1[1].gif
	C:\Documents and Settings\Malossi Hyper Racing\Lokale innstillinger\Temporary Internet Files\Content.IE5\MOYQZOQY\mac[1].gif
	C:\Documents and Settings\Malossi Hyper Racing\Lokale innstillinger\Temporary Internet Files\Content.IE5\MOYQZOQY\bg_testi_topleft[1].gif
	C:\Documents and Settings\Malossi Hyper Racing\Lokale innstillinger\Temporary Internet Files\Content.IE5\JDAYQ0R2\pic2[1].gif
	C:\Documents and Settings\Malossi Hyper Racing\Lokale innstillinger\Temporary Internet Files\Content.IE5\FTSI9Y91\header_bg[1].gif
	C:\Documents and Settings\Malossi Hyper Racing\Lokale innstillinger\Temporary Internet Files\Content.IE5\FTSI9Y91\pic1[1].gif
	C:\Documents and Settings\Malossi Hyper Racing\Lokale innstillinger\Temporary Internet Files\Content.IE5\JDAYQ0R2\small2[1].gif
	C:\Documents and Settings\Malossi Hyper Racing\Lokale innstillinger\Temporary Internet Files\Content.IE5\MOYQZOQY\main_box[1].png
	C:\Documents and Settings\Malossi Hyper Racing\Lokale innstillinger\Temporary Internet Files\Content.IE5\MOYQZOQY\spacer[3].gif
	C:\Documents and Settings\Malossi Hyper Racing\Lokale innstillinger\Temporary Internet Files\Content.IE5\FTSI9Y91\info_bg[1].gif
	C:\Documents and Settings\Malossi Hyper Racing\Lokale innstillinger\Temporary Internet Files\Content.IE5\FTSI9Y91\bg_rate_left[1].gif
	C:\Documents and Settings\Malossi Hyper Racing\Lokale innstillinger\Temporary Internet Files\Content.IE5\JDAYQ0R2\four_plus_one[1].gif
	C:\Documents and Settings\Malossi Hyper Racing\Lokale innstillinger\Temporary Internet Files\Content.IE5\MOYQZOQY\shadow_bg[1].gif
	C:\Documents and Settings\Malossi Hyper Racing\Lokale innstillinger\Temporary Internet Files\Content.IE5\FTSI9Y91\small1[1].gif
	C:\Documents and Settings\Malossi Hyper Racing\Lokale innstillinger\Temporary Internet Files\Content.IE5\FTSI9Y91\bottom_threats[1].gif
	C:\Documents and Settings\Malossi Hyper Racing\Lokale innstillinger\Temporary Internet Files\Content.IE5\0JBRZBPW\na_li_item[1].gif
	C:\Documents and Settings\Malossi Hyper Racing\Lokale innstillinger\Temporary Internet Files\Content.IE5\0JBRZBPW\dot[1].gif
	C:\Documents and Settings\Malossi Hyper Racing\Lokale innstillinger\Temporary Internet Files\Content.IE5\JDAYQ0R2\link_bg[1].gif
	C:\Documents and Settings\Malossi Hyper Racing\Lokale innstillinger\Temporary Internet Files\Content.IE5\JDAYQ0R2\ten[1].gif
	C:\Documents and Settings\Malossi Hyper Racing\Lokale innstillinger\Temporary Internet Files\Content.IE5\FTSI9Y91\box_sm[1].gif
	C:\Documents and Settings\Malossi Hyper Racing\Lokale innstillinger\Temporary Internet Files\Content.IE5\FTSI9Y91\download[1].gif
	C:\Documents and Settings\Malossi Hyper Racing\Lokale innstillinger\Temporary Internet Files\Content.IE5\JDAYQ0R2\star_empty[1].gif
	C:\Documents and Settings\Malossi Hyper Racing\Lokale innstillinger\Temporary Internet Files\Content.IE5\MOYQZOQY\h4_bg[1].gif
	C:\Documents and Settings\Malossi Hyper Racing\Lokale innstillinger\Temporary Internet Files\Content.IE5\FTSI9Y91\bg_testi_bottomleft[1].gif
	C:\Documents and Settings\Malossi Hyper Racing\Lokale innstillinger\Temporary Internet Files\Content.IE5\MOYQZOQY\exellent[1].gif
	C:\Documents and Settings\Malossi Hyper Racing\Lokale innstillinger\Temporary Internet Files\Content.IE5\MOYQZOQY\box_sm2[1].gif
	C:\Documents and Settings\Malossi Hyper Racing\Lokale innstillinger\Temporary Internet Files\Content.IE5\JDAYQ0R2\top_threats[1].gif

Logfile of HijackThis v1.99.1
Scan saved at 00:56:36, on 21.05.2007
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\System32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\spoolsv.exe
C:\PROGRA~1\FELLES~1\Stardock\SDMCP.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\System32\CTSvcCDA.EXE
C:\Programfiler\ewido\security suite\ewidoctrl.exe
C:\Norman\Bin\Zanda.exe
C:\Norman\bin\ZLH.EXE
C:\Programfiler\QuickTime\qttask.exe
C:\WINDOWS\system32\pctspk.exe
C:\Programfiler\SUPERAntiSpyware\SUPERAntiSpyware.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\MsPMSPSv.exe
C:\Norman\Nvc\bin\nvcoas.exe
C:\Norman\Nvc\BIN\nipsvc.exe
C:\Norman\Nvc\BIN\NVCSCHED.EXE
C:\Norman\bin\NJEEVES.EXE
C:\Programfiler\Internet Explorer\iexplore.exe
C:\Programfiler\Windows NT\Tilbehør\wordpad.exe
C:\Documents and Settings\Malossi Hyper Racing\Skrivebord\Ny mappe\Test.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.no/
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Koblinger
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programfiler\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: (no name) - {A24B57F8-505D-4fc5-9960-740E304D1ABA} - C:\WINDOWS\System32\tmp2.tmp.dll (file missing)
O2 - BHO: (no name) - {b88af703-0c92-4186-bcbc-a3d8ed889ee8} - C:\WINDOWS\system32\key949.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\programfiler\google\googletoolbar2.dll
O4 - HKLM\..\Run: [Norman ZANDA] C:\Norman\bin\ZLH.EXE /LOAD /SPLASH
O4 - HKLM\..\Run: [KBD] C:\HP\KBD\KBD.EXE
O4 - HKLM\..\Run: [ATIPTA] C:\Programfiler\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Programfiler\Java\j2re1.4.2_04\bin\jusched.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Programfiler\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [setup] rundll32.exe "C:\WINDOWS\jkhhii.dll",realset
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Programfiler\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKCU\..\Run: [SUPERAntiSpyware] C:\Programfiler\SUPERAntiSpyware\SUPERAntiSpyware.exe
O4 - Startup: PowerReg Scheduler V3.exe
O8 - Extra context menu item: E&ksporter til Microsoft Excel - res://C:\PROGRA~1\MICROS~3\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~3\Office10\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programfiler\Java\j2re1.4.2_04\bin\npjpi142_04.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programfiler\Java\j2re1.4.2_04\bin\npjpi142_04.dll
O9 - Extra button: Oppslag - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\OFFICE11\REFIEBAR.DLL
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://by143fd.bay143.hotmail.msn.com/resources/MsnPUpld.cab
O16 - DPF: {745395C8-D0E1-4227-8586-624CA9A10A8D} (AxisMediaControl Class) - http://campuscentercam.its.wesleyan.edu/activex/AMC.cab
O16 - DPF: {DE625294-70E6-45ED-B895-CFFA13AEB044} (AxisMediaControlEmb Class) - http://213.28.44.184/activex/AMC.cab
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O20 - AppInit_DLLs: c:\windows\system32\pmnonmm.dll
O20 - Winlogon Notify: !SASWinLogon - C:\Programfiler\SUPERAntiSpyware\SASWINLO.dll
O20 - Winlogon Notify: key949 - C:\WINDOWS\SYSTEM32\key949.dll
O20 - Winlogon Notify: MCPClient - C:\PROGRA~1\FELLES~1\Stardock\mcpstub.dll
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\System32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\System32\CTSvcCDA.EXE
O23 - Service: ewido security suite control - ewido networks - C:\Programfiler\ewido\security suite\ewidoctrl.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Programfiler\Fellesfiler\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPodService - Apple Computer, Inc. - C:\Programfiler\iPod\bin\iPodService.exe
O23 - Service: Norman API-hooking helper (NipSvc) - Unknown owner - C:\Norman\Nvc\BIN\nipsvc.exe
O23 - Service: Norman NJeeves - Unknown owner - C:\Norman\bin\NJEEVES.EXE
O23 - Service: Norman ZANDA - Unknown owner - C:\Norman\Bin\Zanda.exe
O23 - Service: Norman Virus Control on-access component (nvcoas) - Norman ASA - C:\Norman\Nvc\bin\nvcoas.exe
O23 - Service: Norman Virus Control Scheduler (NVCScheduler) - Norman Data Defense Systems - C:\Norman\Nvc\BIN\NVCSCHED.EXE
O23 - Service: PCTEL Speaker Phone (Pctspk) - PCtel, Inc. - C:\WINDOWS\system32\pctspk.exe