Logfile of HijackThis v1.99.1 Scan saved at 21:53:41, on 15.6.2006 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Running processes: F:\WINDOWS\System32\smss.exe F:\WINDOWS\system32\csrss.exe F:\WINDOWS\system32\winlogon.exe F:\WINDOWS\system32\services.exe F:\WINDOWS\system32\lsass.exe F:\WINDOWS\system32\Ati2evxx.exe F:\WINDOWS\system32\svchost.exe F:\WINDOWS\system32\svchost.exe F:\WINDOWS\System32\svchost.exe F:\WINDOWS\system32\svchost.exe F:\WINDOWS\system32\svchost.exe F:\WINDOWS\system32\Ati2evxx.exe F:\WINDOWS\Explorer.EXE F:\WINDOWS\system32\spoolsv.exe F:\Program Files\Java\jre1.5.0\bin\jusched.exe F:\WINDOWS\SOUNDMAN.EXE F:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe F:\Norman\bin\ZLH.EXE F:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb10.exe F:\Program Files\Winamp\winampa.exe F:\WINDOWS\system32\ctfmon.exe F:\Program Files\Norman\NPF\NPFMSG.EXE F:\Program Files\Norman\NPF\NPFSVICE.EXE F:\Norman\Bin\Zanda.exe F:\WINDOWS\system32\svchost.exe F:\WINDOWS\system32\wdfmgr.exe F:\Norman\Nvc\BIN\NIP.EXE F:\Norman\Nvc\BIN\NVCSCHED.EXE F:\WINDOWS\system32\wbem\wmiprvse.exe F:\Norman\Nvc\BIN\nipsvc.exe F:\Norman\bin\NJEEVES.EXE F:\Norman\Nvc\bin\nvcoas.exe F:\WINDOWS\System32\alg.exe F:\Program Files\Internet Explorer\iexplore.exe F:\WINDOWS\system32\wuauclt.exe F:\Norman\Nvc\bin\cclaw.exe F:\WINDOWS\system32\wuauclt.exe F:\Program Files\Mozilla Firefox\firefox.exe F:\WINDOWS\SoftwareDistribution\Download\Install\dotnetfx.exe F:\DOCUME~1\Jussi\LOCALS~1\Temp\IXP000.TMP\install.exe F:\WINDOWS\system32\msiexec.exe F:\WINDOWS\system32\MsiExec.exe F:\WINDOWS\system32\MsiExec.exe F:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe F:\Program Files\hijackthis\HijackThis.exe R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://windowsupdate.microsoft.com/ R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Linkit O4 - HKLM\..\Run: [SunJavaUpdateSched] F:\Program Files\Java\jre1.5.0\bin\jusched.exe O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE O4 - HKLM\..\Run: [ATIPTA] F:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe O4 - HKLM\..\Run: [Norman ZANDA] F:\Norman\bin\ZLH.EXE /LOAD /SPLASH O4 - HKLM\..\Run: [HPDJ Taskbar Utility] F:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb10.exe O4 - HKLM\..\Run: [WinampAgent] F:\Program Files\Winamp\winampa.exe O4 - HKLM\..\RunOnce: [wextract_cleanup0] rundll32.exe F:\WINDOWS\system32\advpack.dll,DelNodeRunDLL32 "F:\DOCUME~1\Jussi\LOCALS~1\Temp\IXP000.TMP\" O4 - HKCU\..\Run: [CTFMON.EXE] F:\WINDOWS\system32\ctfmon.exe O4 - Global Startup: NPF Messenger.lnk = ? O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - F:\Program Files\Java\jre1.5.0\bin\npjpi150.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - F:\Program Files\Java\jre1.5.0\bin\npjpi150.dll O9 - Extra button: @F:\Program Files\Messenger\Msgslang.dll,-61144 - {FB5F1910-F110-11d2-BB9E-00C04F795683} - F:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: @F:\Program Files\Messenger\Msgslang.dll,-61144 - {FB5F1910-F110-11d2-BB9E-00C04F795683} - F:\Program Files\Messenger\msmsgs.exe O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - F:\WINDOWS\system32\Ati2evxx.exe O23 - Service: Norman API-hooking helper (NipSvc) - Unknown owner - F:\Norman\Nvc\BIN\nipsvc.exe O23 - Service: Norman NJeeves - Unknown owner - F:\Norman\bin\NJEEVES.EXE O23 - Service: Norman Type-R - Unknown owner - F:\Program Files\Norman\NPF\NPFSVICE.EXE O23 - Service: Norman ZANDA - Unknown owner - F:\Norman\Bin\Zanda.exe O23 - Service: Norman Virus Control on-access component (nvcoas) - Norman ASA - F:\Norman\Nvc\bin\nvcoas.exe O23 - Service: Norman Virus Control Scheduler (NVCScheduler) - Norman Data Defense Systems - F:\Norman\Nvc\BIN\NVCSCHED.EXE