User Käyttäjä Salasana  
   
torstai 16.1.2025 / 15:16
Hae keskustelualueilta:        In English   Suomeksi   På svenska
afterdawn.com > keskustelu > yleistä keskustelua tietokoneista > virukset ja haittaohjelmat - hijackthis -logit > apua todella tarvitaan,
Näytä aiheet
 
Keskustelualueet
Keskustelualueet
Apua todella tarvitaan,
  Siirry:
 
Kirjoittaja Viesti
Jarru1
Newbie
_
21. huhtikuuta 2011 @ 14:48 _ Linkki tähän viestiin    Lähetä käyttäjälle yksityisviesti   
Hei,

Ongelma on siinä, että streamasin videoita, jonka jälkeen avira tunnisti koneessa 6 virusta. Alkoivat putsata konetta niin, että omat tiedostot deletoitiin täysin ja vain suurin osa järjestelmän tiedostoista selvisi. Onnistuin palauttamaan järjestelmän msconfigista, jonka jälkeen meno muuttui oudoksi. Päivitin mozillan ja flash playerin, javan ja virusohjelmat ja ajoin koneeni malwarebytesillä ja näyttää puhtaalta. Saan kuitenkin ihmeellisiä äänimainoksia koneelleni, vaikka itse en huomaa prosesseissa mitää ihmeellistä. Mikään webselain ei ole edes auki ja tämä voi tapahtua juuri sen jälkeen kun on käynnistänyt koneen eikä ole mitää muuta ehtinyt aloittaa. Olen suhteellisen kokenut käyttäjä mutta tämä on kyllä todella outoa. Käytän pankkitunnuksia päivittäin, joten voisiko joku varmistaa ettei logeissani ole mitää häikkää. kiitos.


Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 14:25:39, on 21.4.2011
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Avira\AntiVir Desktop\sched.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\hkcmd.exe
C:\WINDOWS\system32\igfxpers.exe
C:\WINDOWS\system32\igfxsrvc.exe
C:\Program Files\Avira\AntiVir Desktop\avgnt.exe
C:\Program Files\Common Files\Java\Java Update\jusched.exe
C:\Program Files\McAfee Security Scan\2.0.181\SSScheduler.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Avira\AntiVir Desktop\avguard.exe
C:\Program Files\Saunalahti\Avustaja\CC3Service.exe
C:\Program Files\Saunalahti\ESUS\ESUS.exe
C:\Program Files\Avira\AntiVir Desktop\avshadow.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Common Files\Logishrd\LVMVFM\LVPrcSrv.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\wbem\wmiapsrv.exe
C:\Program Files\Mozilla Firefox\plugin-container.exe
C:\WINDOWS\system32\CTFMON.EXE
C:\Program Files\Trend Micro\HiJackThis\HiJackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = Google
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = MSN.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = Bing
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = Bing
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = MSN.com
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Linkit
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - (no file)
O2 - BHO: ConnectionCentreBHO - {476AAF4E-3AA2-47FE-BEDB-3B45C404513B} - C:\Program Files\Saunalahti\Avustaja\BHO\CC3IEBHO.dll
O2 - BHO: Babylon IE plugin - {9CFACCB6-2F3F-4177-94EA-0D2B72D384C1} - C:\Program Files\Babylon\Babylon-Pro\Utils\BabylonIEPI.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O3 - Toolbar: (no name) - {CCC7A320-B3CA-4199-B1A6-9F516DD69829} - (no file)
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [Persistence] C:\WINDOWS\system32\igfxpers.exe
O4 - HKLM\..\Run: [HDAudDeck] C:\Program Files\VIA\VIAudioi\HDADeck\HDeck.exe 1
O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir Desktop\avgnt.exe" /min
O4 - HKLM\..\Run: [Saunalahti Avustaja] "C:\Program Files\Saunalahti\Avustaja\Saunalahti.exe" -autorun
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Common Files\Java\Java Update\jusched.exe"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Paikallinen palve')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Verkkopalve')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: McAfee Security Scan Plus.lnk = ?
O8 - Extra context menu item: Translate this web page with Babylon - res://C:\Program Files\Babylon\Babylon-Pro\Utils\BabylonIEPI.dll/ActionTU.htm
O8 - Extra context menu item: Translate with Babylon - res://C:\Program Files\Babylon\Babylon-Pro\Utils\BabylonIEPI.dll/Action.htm
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Translate this web page with Babylon - {F72841F0-4EF1-4df5-BCE5-B3AC8ACF5478} - C:\Program Files\Babylon\Babylon-Pro\Utils\BabylonIEPI.dll
O9 - Extra 'Tools' menuitem: Translate this web page with Babylon - {F72841F0-4EF1-4df5-BCE5-B3AC8ACF5478} - C:\Program Files\Babylon\Babylon-Pro\Utils\BabylonIEPI.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O22 - SharedTaskScheduler: Browseui preloader - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - C:\WINDOWS\system32\browseui.dll
O22 - SharedTaskScheduler: Component Categories cache daemon - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\WINDOWS\system32\browseui.dll
O23 - Service: Avira AntiVir Scheduler (AntiVirSchedulerService) - Avira GmbH - C:\Program Files\Avira\AntiVir Desktop\sched.exe
O23 - Service: Avira AntiVir Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir Desktop\avguard.exe
O23 - Service: Saunalahti Avustaja Service (CC3Svc) - Unknown owner - C:\Program Files\Saunalahti\Avustaja\CC3Service.exe
O23 - Service: Loogisen levyn hallinnan valvontapalvelu (dmadmin) - Unknown owner - C:\WINDOWS\System32\dmadmin.exe
O23 - Service: Saunalahti Software Update Service (ESUSClient) - Unknown owner - C:\Program Files\Saunalahti\ESUS\ESUS.exe
O23 - Service: Tapahtumaloki (Eventlog) - Unknown owner - C:\WINDOWS\system32\services.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: CD-levyjen kirjoittamisen IMAPI COM -palvelu (ImapiService) - Unknown owner - C:\WINDOWS\system32\imapi.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: Process Monitor (LVPrcSrv) - Logitech Inc. - C:\Program Files\Common Files\Logishrd\LVMVFM\LVPrcSrv.exe
O23 - Service: McAfee Security Scan Component Host Service (McComponentHostService) - McAfee, Inc. - C:\Program Files\McAfee Security Scan\2.0.181\McCHSvc.exe
O23 - Service: Plug and Play (PlugPlay) - Unknown owner - C:\WINDOWS\system32\services.exe
O23 - Service: Etätyöpöydän ohjeen istunnonhallinta (RDSessMgr) - Unknown owner - C:\WINDOWS\system32\sessmgr.exe
O23 - Service: Älykortti (SCardSvr) - Unknown owner - C:\WINDOWS\System32\SCardSvr.exe
O23 - Service: Aseman tilannevedos (VSS) - Unknown owner - C:\WINDOWS\System32\vssvc.exe
O23 - Service: WMI resurssisovitin (WmiApSrv) - Unknown owner - C:\WINDOWS\system32\wbem\wmiapsrv.exe

--
End of file - 7269 bytes

Viestiä on muokattu lähettämisen jälkeen. Viimeisin muokkaus 21. huhtikuuta 2011 @ 14:50

AfterDawn Addict
_
21. huhtikuuta 2011 @ 17:44 _ Linkki tähän viestiin    Lähetä käyttäjälle yksityisviesti   
.
HJT logilla ei näy viruksia, mutta
nykyään pöpöt ei siinä nykään.
Ovat muuttaneet tematiikkaansa.

-----------------------------

En ole kuullut, että terveet koneet juttelis omiaan.
Huolestuminen aihellista, jos ei Saunalahti ole keksinyt omiaan.

-------------------------------------

Ole hyvä ja lataa Combofix yhdestä alla olevista linkeistä:

Linkki 3

* TÄRKEÄÄ !!! Tallenna ComboFix.exe työpöydällesi

* Sulje/ota pois päältä kaikki virustorjunta- ja haittaohjelmien poisto-ohjelmat, jotta ne eivät häiritse ComboFixin ajoa.
(ei palomuuria)
* Tuplaklikkaa Combofix.exe ja noudata ohjeita.

* Osana skannausta Combofix tarkistaa onko palautuskonsoli asennettuna. Nykypäivän haittaohjelmien takia on erittäin suositeltua olla asennettuna palautuskonsoli ennen haittaohjelmien poistoa. Windowsin palautuskonsoli mahdollistaa käynnistyksen erityiseen palautustilaan. Palautuskonsolin kautta voimme auttaa sinua helpommin mikäli haittaohjelmien poiston yhteydessä ilmenee ongelmia.

* Seuraa ohjeita ja salli Combofixin ladata ja asentaa Microsoftin palautuskonsoli, ja kun pyydetään, hyväksy ohjelman takuuehdot asentaaksesi palautuskonsolin.

**Huomaa: Jos palautuskonsoli on jo asennettuna, Combofix jatkaa eteenpäin.




Kun Microsoftin palautuskonsoli on asennettu, sinun pitäisi nähdä seuraava viesti:




Klikkaa Kyllä jatkaaksesi skannausta.

Varoitus: ÄLÄ aja ComboFixia ilman valvontaa. Se ei ole lelu ja sitä ei tule käyttää rutiininomaisesti päivittäin.

Jos tarvitset apua, katso yksityiskohtaisempi ohje:
http://www.bleepingcomputer.com/combofix/fi/combofixin-kayttoohje

Kun ComboFix on valmis, se luo raportin. Ole hyvä ja kopioi/liitä
seuraavat raportit vastaukseesi:

C:\ComboFix.txt

:)

(:)
Jarru1
Newbie
_
21. huhtikuuta 2011 @ 19:43 _ Linkki tähän viestiin    Lähetä käyttäjälle yksityisviesti   
Lainaus, alkuperäisen viestin kirjoitti kalminen:
.
HJT logilla ei näy viruksia, mutta
nykyään pöpöt ei siinä nykään.
Ovat muuttaneet tematiikkaansa.

-----------------------------

En ole kuullut, että terveet koneet juttelis omiaan.
Huolestuminen aihellista, jos ei Saunalahti ole keksinyt omiaan.

-------------------------------------

Ole hyvä ja lataa Combofix yhdestä alla olevista linkeistä:

Linkki 3

* TÄRKEÄÄ !!! Tallenna ComboFix.exe työpöydällesi

* Sulje/ota pois päältä kaikki virustorjunta- ja haittaohjelmien poisto-ohjelmat, jotta ne eivät häiritse ComboFixin ajoa.
(ei palomuuria)
* Tuplaklikkaa Combofix.exe ja noudata ohjeita.

* Osana skannausta Combofix tarkistaa onko palautuskonsoli asennettuna. Nykypäivän haittaohjelmien takia on erittäin suositeltua olla asennettuna palautuskonsoli ennen haittaohjelmien poistoa. Windowsin palautuskonsoli mahdollistaa käynnistyksen erityiseen palautustilaan. Palautuskonsolin kautta voimme auttaa sinua helpommin mikäli haittaohjelmien poiston yhteydessä ilmenee ongelmia.

* Seuraa ohjeita ja salli Combofixin ladata ja asentaa Microsoftin palautuskonsoli, ja kun pyydetään, hyväksy ohjelman takuuehdot asentaaksesi palautuskonsolin.

**Huomaa: Jos palautuskonsoli on jo asennettuna, Combofix jatkaa eteenpäin.




Kun Microsoftin palautuskonsoli on asennettu, sinun pitäisi nähdä seuraava viesti:




Klikkaa Kyllä jatkaaksesi skannausta.

Varoitus: ÄLÄ aja ComboFixia ilman valvontaa. Se ei ole lelu ja sitä ei tule käyttää rutiininomaisesti päivittäin.

Jos tarvitset apua, katso yksityiskohtaisempi ohje:
http://www.bleepingcomputer.com/combofix/fi/combofixin-kayttoohje

Kun ComboFix on valmis, se luo raportin. Ole hyvä ja kopioi/liitä
seuraavat raportit vastaukseesi:

C:\ComboFix.txt

:)
Tassa olisi logi

ComboFix 11-04-20.04 - Sipa 21.04.2011 19:28:15.1.2 - x86
Microsoft Windows XP Home Edition 5.1.2600.3.1252.358.1035.18.3574.3121 [GMT 3:00]
Sijainti: c:\documents and settings\Sipa\Työpöytä\ComboFix.exe
AV: AntiVir Desktop *Disabled/Updated* {AD166499-45F9-482A-A743-FDD3350758C7}
.
.
(((((((((((((((((((((((((((((((((((((( Muut poistot ))))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\windows\Tasks\{35DC3473-A719-4d14-B7C1-FD326CA84A0C}.job
.
Saastunut kopio tiedostosta c:\windows\system32\drivers\volsnap.sys löytyi ja poistettiin
Puhdas kopio palautettiin paikasta - Kitty had a snack :p
.
((((( Tiedostot, jotka on luotu seuraavalla aikavälillä: 2011-03-21 to 2011-04-21 )))))))))))))))))
.
.
2011-04-21 11:15 . 2011-04-21 11:15 388096 ----a-r- c:\documents and settings\Sipa\Application Data\Microsoft\Installer\{45A66726-69BC-466B-A7A4-12FCBA4883D7}\HiJackThis.exe
2011-04-21 11:15 . 2011-04-21 11:15 -------- d-----w- c:\program files\Trend Micro
2011-04-18 12:19 . 2011-04-18 12:19 -------- d-----w- c:\documents and settings\NetworkService\Application Data\McAfee
2011-04-18 12:15 . 2011-03-18 17:58 142296 ----a-w- c:\program files\Mozilla Firefox\components\browsercomps.dll
2011-04-18 12:15 . 2011-03-18 17:58 781272 ----a-w- c:\program files\Mozilla Firefox\mozsqlite3.dll
2011-04-18 12:15 . 2011-03-18 17:58 1874904 ----a-w- c:\program files\Mozilla Firefox\mozjs.dll
2011-04-18 12:15 . 2011-03-18 17:58 728024 ----a-w- c:\program files\Mozilla Firefox\libGLESv2.dll
2011-04-18 12:15 . 2011-03-18 17:58 1975768 ----a-w- c:\program files\Mozilla Firefox\D3DCompiler_42.dll
2011-04-18 12:15 . 2011-03-18 17:58 1893336 ----a-w- c:\program files\Mozilla Firefox\d3dx9_42.dll
2011-04-18 12:15 . 2011-03-18 17:58 15832 ----a-w- c:\program files\Mozilla Firefox\mozalloc.dll
2011-04-18 12:15 . 2011-03-18 17:58 142296 ----a-w- c:\program files\Mozilla Firefox\libEGL.dll
2011-04-18 12:06 . 2011-04-18 12:06 -------- d-----w- c:\windows\system32\wbem\Repository
.
.
.
(((((((((((((((((((((((((((((((((((( Find3M-raportti ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2011-03-18 08:16 . 2010-07-19 16:18 137656 ----a-w- c:\windows\system32\drivers\avipbb.sys
2011-03-07 05:33 . 2009-09-06 07:48 692736 ----a-w- c:\windows\system32\inetcomm.dll
2011-03-04 06:36 . 2004-09-15 12:00 420864 ----a-w- c:\windows\system32\vbscript.dll
2011-03-03 13:52 . 2004-09-15 12:00 1858176 ----a-w- c:\windows\system32\win32k.sys
2011-02-22 23:08 . 2004-09-15 12:00 916480 ----a-w- c:\windows\system32\wininet.dll
2011-02-22 23:08 . 2004-09-15 12:00 43520 ----a-w- c:\windows\system32\licmgr10.dll
2011-02-22 23:08 . 2004-09-15 12:00 1469440 ------w- c:\windows\system32\inetcpl.cpl
2011-02-22 11:42 . 2004-09-15 12:00 385024 ----a-w- c:\windows\system32\html.iec
2011-02-17 13:18 . 2004-09-15 12:00 455936 ----a-w- c:\windows\system32\drivers\mrxsmb.sys
2011-02-17 13:18 . 2004-09-15 12:00 357888 ----a-w- c:\windows\system32\drivers\srv.sys
2011-02-17 12:54 . 2008-05-05 04:25 5120 ----a-w- c:\windows\system32\xpsp4res.dll
2011-02-15 12:56 . 2004-09-15 12:00 290432 ----a-w- c:\windows\system32\atmfd.dll
2011-02-09 13:53 . 2004-09-15 12:00 270848 ----a-w- c:\windows\system32\sbe.dll
2011-02-09 13:53 . 2004-09-15 12:00 186880 ----a-w- c:\windows\system32\encdec.dll
2011-02-08 13:33 . 2004-09-15 12:00 978944 ----a-w- c:\windows\system32\mfc42.dll
2011-02-08 13:33 . 2004-09-15 12:00 974848 ----a-w- c:\windows\system32\mfc42u.dll
2011-02-02 18:40 . 2010-07-19 17:08 472808 ----a-w- c:\windows\system32\deployJava1.dll
2011-02-02 16:19 . 2009-09-13 12:46 73728 ----a-w- c:\windows\system32\javacpl.cpl
2011-02-02 07:58 . 2009-09-06 07:47 2067456 ----a-w- c:\windows\system32\mstscax.dll
2011-01-27 11:57 . 2009-09-06 07:47 677888 ----a-w- c:\windows\system32\mstsc.exe
2009-05-01 21:02 . 2009-05-01 21:02 1044480 ----a-w- c:\program files\mozilla firefox\plugins\libdivx.dll
2009-05-01 21:02 . 2009-05-01 21:02 200704 ----a-w- c:\program files\mozilla firefox\plugins\ssldivx.dll
2011-03-18 17:58 . 2011-04-18 12:15 142296 ----a-w- c:\program files\mozilla firefox\components\browsercomps.dll
.
.
(((((((((((((((((((((((((((((( Rekisterin käynnistyskohteet )))))))))))))))))))))))))))))))))))))))))))))
.
.
*Huom* Tyhjiä arvoja ja laillisia oletusarvoja ei näytetä
REGEDIT4
.
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{476AAF4E-3AA2-47FE-BEDB-3B45C404513B}]
2010-07-09 08:02 95024 ----a-w- c:\program files\Saunalahti\Avustaja\BHO\CC3IEBHO.dll
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2008-03-21 141848]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2008-03-21 166424]
"Persistence"="c:\windows\system32\igfxpers.exe" [2008-03-21 137752]
"HDAudDeck"="c:\program files\VIA\VIAudioi\HDADeck\HDeck.exe" [2008-08-15 30003200]
"avgnt"="c:\program files\Avira\AntiVir Desktop\avgnt.exe" [2010-11-07 281768]
"Saunalahti Avustaja"="c:\program files\Saunalahti\Avustaja\Saunalahti.exe" [2010-07-09 234800]
"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2010-05-14 248552]
.
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360]
.
c:\documents and settings\All Users\K?ynnist?-valikko\Ohjelmat\K?ynnistys\
McAfee Security Scan Plus.lnk - c:\program files\McAfee Security Scan\2.0.181\SSScheduler.exe [2010-1-15 255536]
.
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Käynnistä-valikko^Ohjelmat^Käynnistys^Microsoft Office.lnk]
path=c:\documents and settings\All Users\Käynnistä-valikko\Ohjelmat\Käynnistys\Microsoft Office.lnk
backup=c:\windows\pss\Microsoft Office.lnkCommon Startup
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe ARM]
2010-09-20 21:07 932288 ----a-r- c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher]
2010-09-23 02:47 35760 ----a-w- c:\program files\Adobe\Reader 9.0\Reader\reader_sl.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Babylon Client]
2010-01-19 21:39 3723152 ----a-w- c:\program files\Babylon\Babylon-Pro\Babylon.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Google Update]
2010-10-30 09:35 136176 ----atw- c:\documents and settings\Sipa\Local Settings\Application Data\Google\Update\GoogleUpdate.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Logitech Vid HD]
2010-05-11 14:43 6061400 ----a-w- e:\program files\Logitech\Vid\Vid.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LWS]
2010-05-07 16:35 165208 ----a-w- e:\program files\Logitech\LWS\Webcam Software\LWS.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
"JavaQuickStarterService"=2 (0x2)
"WMPNetworkSvc"=3 (0x3)
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusOverride"=dword:00000001
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Messenger\\msmsgs.exe"=
"c:\\Program Files\\Java\\jre6\\bin\\java.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\uTorrent\\uTorrent.exe"=
"c:\\Program Files\\Skype\\Phone\\Skype.exe"=
"c:\\Program Files\\Skype\\Plugin Manager\\skypePM.exe"=
"c:\\Program Files\\SopCast\\adv\\SopAdver.exe"=
"c:\\Program Files\\SopCast\\SopCast.exe"=
"c:\\Program Files\\Mozilla Firefox\\firefox.exe"=
"e:\\Program Files\\Logitech\\Vid\\Vid.exe"=
.
R2 AntiVirSchedulerService;Avira AntiVir Scheduler;c:\program files\Avira\AntiVir Desktop\sched.exe [19.7.2010 19:18 135336]
R2 CC3Svc;Saunalahti Avustaja Service;c:\program files\Saunalahti\Avustaja\CC3Service.exe [9.7.2010 11:02 611120]
R2 ESUSClient;Saunalahti Software Update Service;c:\program files\Saunalahti\ESUS\ESUS.exe [29.6.2010 14:05 381776]
R3 VIAHdAudAddService;VIA High Definition Audio Driver Service;c:\windows\system32\drivers\viahduaa.sys [6.9.2009 11:04 845184]
S3 epmntdrv;epmntdrv;c:\windows\system32\epmntdrv.sys [5.7.2010 22:23 13192]
S3 EuGdiDrv;EuGdiDrv;c:\windows\system32\EuGdiDrv.sys [5.7.2010 22:23 8456]
S3 McComponentHostService;McAfee Security Scan Component Host Service;c:\program files\McAfee Security Scan\2.0.181\McCHSvc.exe [15.1.2010 15:49 227232]
.
'Ajoitetut tehtävät'-kansion sisältö
.
2011-04-21 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1957994488-413027322-839522115-1004Core.job
- c:\documents and settings\Sipa\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [2010-10-30 09:35]
.
2011-04-21 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1957994488-413027322-839522115-1004UA.job
- c:\documents and settings\Sipa\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [2010-10-30 09:35]
.
.
------- Täydentävä tarkistus -------
.
uStart Page = hxxp://www.google.fi/
uInternet Connection Wizard,ShellNext = iexplore
IE: Translate this web page with Babylon - c:\program files\Babylon\Babylon-Pro\Utils\BabylonIEPI.dll/ActionTU.htm
IE: Translate with Babylon - c:\program files\Babylon\Babylon-Pro\Utils\BabylonIEPI.dll/Action.htm
FF - ProfilePath - c:\documents and settings\Sipa\Application Data\Mozilla\Firefox\Profiles\cpeol7wx.default\
FF - prefs.js: browser.search.defaulturl - hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT1460988&SearchSource=3&q={searchTerms}
FF - prefs.js: browser.startup.homepage - www.ampparit.com
.
- - - - POISTETUT JÄMÄRIVIT - - - -
.
Toolbar-{CCC7A320-B3CA-4199-B1A6-9F516DD69829} - (no file)
WebBrowser-{CCC7A320-B3CA-4199-B1A6-9F516DD69829} - (no file)
WebBrowser-{D4027C7F-154A-4066-A1AD-4243D8127440} - (no file)
.
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2011-04-21 19:30
Windows 5.1.2600 Service Pack 3 NTFS
.
tarkistaa piilotettuja prosesseja ...
.
tarkistaa piilotettuja käynnistysarvoja ...
.
HKLM\Software\Microsoft\Windows\CurrentVersion\Run
HDAudDeck = c:\program files\VIA\VIAudioi\HDADeck\HDeck.exe 1????????????????????????????????????????????????
.
tarkistaa piilotettuja tiedostoja ...
.
tarkistus on valmis
piilotetut tiedostot: 0
.
**************************************************************************
.
--------------------- LUKITUT REKISTERIAVAIMET ---------------------
.
[HKEY_LOCAL_MACHINE\software\Microsoft\Windows\CurrentVersion\Installer\UserData\LocalSystem\Components\???|’’’’"??|ž»Ów*]
"b049C053C7D38EE4AB9A00CB3B5D2472"="C?\\Program Files\\Common Files\\Microsoft Shared\\Web Folders\\PUBPLACE.HTT"
.
Valmistumisajankohta: 2011-04-21 19:30:50
ComboFix-quarantined-files.txt 2011-04-21 16:30
.
Ennen ajoa: 60 235 382 784 tavua vapaana
Ajon jälkeen: 60 333 101 056 tavua vapaana
.
WindowsXP-KB310994-SP2-Home-BootDisk-FIN.EXE
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
UnsupportedDebug="do not select this" /debug
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Home Edition" /noexecute=optin /fastdetect
.
- - End Of File - - D7866D54770CEFDD9CB1ABA2E28DA798
AfterDawn Addict
_
21. huhtikuuta 2011 @ 22:03 _ Linkki tähän viestiin    Lähetä käyttäjälle yksityisviesti   
.
Aina sieltä tauhkaa löytyy !!!

-------------------------

Kirjoita windowsin käynnistävalikon suorita-kenttään Combofix /uninstall paina OK

********************************************************

Lataa työpöydälle => TÄMÄ
* Sulje kaikki päälläolevat ikkunat ja sovellukset.
* Tuplaklikkaa OTL.exeä käynnistääksesi OTListIt:n.
* Laita siihen ruxit kuvan mukaan.




* Klikkaa Run Scan nappulaa.
* Kun tarkistus on valmis, OTListIt luo kaksi tekstitiedostoa työpöydälle, tai alapalkkiin OTListIt.Txt ja Extras.txt
* Kopioi ja lähetä tiedostojen sisältö tänne.


Mikä siellä on tilanne ???
:)

(:)

Viestiä on muokattu lähettämisen jälkeen. Viimeisin muokkaus 21. huhtikuuta 2011 @ 22:03

Jarru1
Newbie
_
22. huhtikuuta 2011 @ 11:28 _ Linkki tähän viestiin    Lähetä käyttäjälle yksityisviesti   
Lainaus, alkuperäisen viestin kirjoitti kalminen:
.
Aina sieltä tauhkaa löytyy !!!

-------------------------

Kirjoita windowsin käynnistävalikon suorita-kenttään Combofix /uninstall paina OK

********************************************************

Lataa työpöydälle => TÄMÄ
* Sulje kaikki päälläolevat ikkunat ja sovellukset.
* Tuplaklikkaa OTL.exeä käynnistääksesi OTListIt:n.
* Laita siihen ruxit kuvan mukaan.




* Klikkaa Run Scan nappulaa.
* Kun tarkistus on valmis, OTListIt luo kaksi tekstitiedostoa työpöydälle, tai alapalkkiin OTListIt.Txt ja Extras.txt
* Kopioi ja lähetä tiedostojen sisältö tänne.


Mikä siellä on tilanne ???
:)

OTL.Txt:


OTL logfile created on: 22.4.2011 11:21:21 - Run 1
OTL by OldTimer - Version 3.2.22.3 Folder = C:\Documents and Settings\Sipa\Työpöytä
Windows XP Home Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18702)
Locale: 0000040B | Country: Suomi | Language: FIN | Date Format: d.M.yyyy

3,00 Gb Total Physical Memory | 3,00 Gb Available Physical Memory | 85,00% Memory free
5,00 Gb Paging File | 5,00 Gb Available in Paging File | 91,00% Paging File free
Paging file location(s): C:\pagefile.sys 2046 4092 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 97,65 Gb Total Space | 59,22 Gb Free Space | 60,64% Space Free | Partition Type: NTFS
Drive E: | 244,14 Gb Total Space | 237,51 Gb Free Space | 97,28% Space Free | Partition Type: NTFS
Drive F: | 254,36 Gb Total Space | 252,01 Gb Free Space | 99,07% Space Free | Partition Type: NTFS

Computer Name: COREDUO | User Name: Sipa | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: All users
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: Off | File Age = 30 Days

[color=#E56717]========== Processes (SafeList) ==========[/color]

PRC - [2011.04.22 11:19:46 | 000,580,608 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\Sipa\Työpöytä\OTL.exe
PRC - [2011.03.18 20:58:47 | 000,924,632 | ---- | M] (Mozilla Corporation) -- C:\Program Files\Mozilla Firefox\firefox.exe
PRC - [2011.03.18 11:16:33 | 000,269,480 | ---- | M] (Avira GmbH) -- C:\Program Files\Avira\AntiVir Desktop\avguard.exe
PRC - [2010.11.07 12:47:14 | 000,281,768 | ---- | M] (Avira GmbH) -- C:\Program Files\Avira\AntiVir Desktop\avgnt.exe
PRC - [2010.11.07 12:47:14 | 000,135,336 | ---- | M] (Avira GmbH) -- C:\Program Files\Avira\AntiVir Desktop\sched.exe
PRC - [2010.07.09 11:02:26 | 000,611,120 | ---- | M] (Saunalahti) -- C:\Program Files\Saunalahti\Avustaja\CC3Service.exe
PRC - [2010.07.09 11:01:58 | 000,234,800 | ---- | M] (Saunalahti) -- C:\Program Files\Saunalahti\Avustaja\Saunalahti.exe
PRC - [2010.06.29 14:05:38 | 000,381,776 | ---- | M] () -- C:\Program Files\Saunalahti\ESUS\ESUS.exe
PRC - [2010.01.15 15:49:20 | 000,255,536 | ---- | M] (McAfee, Inc.) -- C:\Program Files\McAfee Security Scan\2.0.181\SSScheduler.exe
PRC - [2010.01.14 22:11:00 | 000,076,968 | ---- | M] (Avira GmbH) -- C:\Program Files\Avira\AntiVir Desktop\avshadow.exe
PRC - [2008.04.14 19:12:11 | 001,034,240 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\explorer.exe


[color=#E56717]========== Modules (SafeList) ==========[/color]

MOD - [2011.04.22 11:19:46 | 000,580,608 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\Sipa\Työpöytä\OTL.exe
MOD - [2010.08.23 19:12:31 | 001,054,208 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.6028_x-ww_61e65202\comctl32.dll


[color=#E56717]========== Win32 Services (SafeList) ==========[/color]

SRV - File not found [Disabled | Stopped] -- -- (HidServ) HID (Human Interface Device)
SRV - File not found [On_Demand | Stopped] -- -- (AppMgmt)
SRV - [2011.03.18 11:16:33 | 000,269,480 | ---- | M] (Avira GmbH) [Auto | Running] -- C:\Program Files\Avira\AntiVir Desktop\avguard.exe -- (AntiVirService)
SRV - [2010.11.07 12:47:14 | 000,135,336 | ---- | M] (Avira GmbH) [Auto | Running] -- C:\Program Files\Avira\AntiVir Desktop\sched.exe -- (AntiVirSchedulerService)
SRV - [2010.07.09 11:02:26 | 000,611,120 | ---- | M] (Saunalahti) [Auto | Running] -- C:\Program Files\Saunalahti\Avustaja\CC3Service.exe -- (CC3Svc)
SRV - [2010.06.29 14:05:38 | 000,381,776 | ---- | M] () [Auto | Running] -- C:\Program Files\Saunalahti\ESUS\ESUS.exe -- (ESUSClient)
SRV - [2010.05.07 19:47:32 | 000,162,648 | ---- | M] (Logitech Inc.) [Auto | Stopped] -- C:\Program Files\Common Files\Logishrd\LVMVFM\LVPrcSrv.exe -- (LVPrcSrv)
SRV - [2010.01.15 15:49:20 | 000,227,232 | ---- | M] (McAfee, Inc.) [On_Demand | Stopped] -- C:\Program Files\McAfee Security Scan\2.0.181\McCHSvc.exe -- (McComponentHostService)


[color=#E56717]========== Driver Services (SafeList) ==========[/color]

DRV - [2011.03.18 11:16:35 | 000,137,656 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\WINDOWS\system32\drivers\avipbb.sys -- (avipbb)
DRV - [2010.11.28 11:43:29 | 000,061,960 | ---- | M] (Avira GmbH) [File_System | Auto | Running] -- C:\WINDOWS\system32\drivers\avgntflt.sys -- (avgntflt)
DRV - [2010.07.27 11:15:20 | 000,023,904 | ---- | M] (Logitech Inc.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\lvuvcflt.sys -- (FilterService)
DRV - [2010.07.27 11:14:58 | 006,842,464 | ---- | M] (Logitech Inc.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\lvuvc.sys -- (LVUVC) Logitech HD Webcam C270(UVC)
DRV - [2010.07.27 11:12:50 | 000,282,336 | ---- | M] (Logitech Inc.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\lvrs.sys -- (LVRS)
DRV - [2010.07.27 11:12:26 | 000,114,784 | ---- | M] (Logitech Inc.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\lvpopflt.sys -- (lvpopflt)
DRV - [2010.05.11 16:29:52 | 000,013,192 | ---- | M] () [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\epmntdrv.sys -- (epmntdrv)
DRV - [2010.05.11 16:29:50 | 000,008,456 | ---- | M] () [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\EuGdiDrv.sys -- (EuGdiDrv)
DRV - [2010.05.07 19:43:30 | 000,025,824 | ---- | M] () [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\LVPr2Mon.sys -- (LVPr2Mon)
DRV - [2009.05.11 12:49:19 | 000,011,608 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\Program Files\Avira\AntiVir Desktop\avgio.sys -- (avgio)
DRV - [2009.05.11 10:12:49 | 000,028,520 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\WINDOWS\system32\drivers\ssmdrv.sys -- (ssmdrv)
DRV - [2008.08.07 14:14:00 | 000,111,360 | R--- | M] (Realtek Semiconductor Corporation ) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\Rtenicxp.sys -- (RTLE8023xp)
DRV - [2008.07.25 15:09:24 | 000,845,184 | R--- | M] (VIA Technologies, Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\viahduaa.sys -- (VIAHdAudAddService)
DRV - [2008.02.14 09:12:00 | 001,389,056 | R--- | M] (Creative Technology Ltd.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\monfilt.sys -- (monfilt)
DRV - [2006.04.07 17:06:38 | 000,038,496 | ---- | M] (OLYMPUS IMAGING CORP.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\VNUSB.sys -- (VNUSB)
DRV - [2004.08.13 13:56:20 | 000,005,810 | R--- | M] () [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\ASACPI.sys -- (MTsensor)


[color=#E56717]========== Standard Registry (SafeList) ==========[/color]


[color=#E56717]========== Internet Explorer ==========[/color]



IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0



IE - HKU\S-1-5-21-1957994488-413027322-839522115-1004\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.google.fi/
IE - HKU\S-1-5-21-1957994488-413027322-839522115-1004\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

[color=#E56717]========== FireFox ==========[/color]

FF - prefs.js..browser.search.defaultthis.engineName: "Web Search"
FF - prefs.js..browser.search.defaulturl: "http://search.conduit.com/ResultsExt.aspx?ctid=CT1460988&SearchSource=3&q={searchTerms}"
FF - prefs.js..browser.startup.homepage: "www.ampparit.com"
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}:6.0.20
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA}:6.0.21
FF - prefs.js..extensions.enabledItems: {e4a8a97b-f2ed-450b-b12d-ee082ba24781}:0.8.20100408.6
FF - prefs.js..extensions.enabledItems: {d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}:1.3.3
FF - prefs.js..extensions.enabledItems: {8D03DB51-DA47-46a9-8F14-53ABE84263F5}:1.0

FF - HKLM\software\mozilla\Firefox\extensions\\{8D03DB51-DA47-46a9-8F14-53ABE84263F5}: C:\Program Files\Saunalahti\Avustaja\BHO\Firefox [2011.01.01 14:24:52 | 000,000,000 | ---D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 4.0\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2011.04.18 15:15:46 | 000,000,000 | ---D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 4.0\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2011.04.18 15:15:41 | 000,000,000 | ---D | M]

[2009.09.13 15:48:23 | 000,000,000 | ---D | M] (No name found) -- C:\Documents and Settings\Sipa\Application Data\Mozilla\Extensions
[2011.04.19 12:05:27 | 000,000,000 | ---D | M] (No name found) -- C:\Documents and Settings\Sipa\Application Data\Mozilla\Firefox\Profiles\cpeol7wx.default\extensions
[2010.01.21 17:09:36 | 000,000,879 | -H-- | M] () -- C:\Documents and Settings\Sipa\Application Data\Mozilla\Firefox\Profiles\cpeol7wx.default\searchplugins\conduit.xml
[2011.04.18 20:03:07 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files\Mozilla Firefox\extensions
[2010.07.19 20:08:29 | 000,000,000 | ---D | M] (Java Console) -- C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}
[2010.08.22 18:25:22 | 000,000,000 | ---D | M] (Java Console) -- C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA}
[2011.04.18 20:03:07 | 000,000,000 | ---D | M] (Java Console) -- C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA}
File not found (No name found) --
() (No name found) -- C:\DOCUMENTS AND SETTINGS\SIPA\APPLICATION DATA\MOZILLA\FIREFOX\PROFILES\CPEOL7WX.DEFAULT\EXTENSIONS\{D10D0BF8-F5B5-C8B4-A8B2-2B9879E08C5D}.XPI
() (No name found) -- C:\DOCUMENTS AND SETTINGS\SIPA\APPLICATION DATA\MOZILLA\FIREFOX\PROFILES\CPEOL7WX.DEFAULT\EXTENSIONS\{E4A8A97B-F2ED-450B-B12D-EE082BA24781}.XPI
[2011.03.18 20:58:48 | 000,142,296 | ---- | M] (Mozilla Foundation) -- C:\Program Files\Mozilla Firefox\components\browsercomps.dll
[2011.02.02 21:40:24 | 000,472,808 | ---- | M] (Sun Microsystems, Inc.) -- C:\Program Files\Mozilla Firefox\plugins\npdeployJava1.dll
[2010.01.01 11:00:00 | 000,002,252 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\bing.xml
[2010.01.01 11:00:00 | 000,002,062 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\bookplus-fi.xml
[2010.01.01 11:00:00 | 000,000,972 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\eBay-fi.xml
[2010.01.01 11:00:00 | 000,001,183 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\wikipedia-fi.xml
[2010.01.01 11:00:00 | 000,001,100 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\yahoo-fi.xml

O1 HOSTS File: ([2011.04.21 19:30:00 | 000,000,027 | ---- | M]) - C:\WINDOWS\system32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 localhost
O2 - BHO: (AVG Safe Search) - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - Reg Error: Value error. File not found
O2 - BHO: (ConnectionCentreBHO Class) - {476AAF4E-3AA2-47FE-BEDB-3B45C404513B} - C:\Program Files\Saunalahti\Avustaja\BHO\CC3IEBHO.dll (Saunalahti)
O2 - BHO: (Babylon IE plugin) - {9CFACCB6-2F3F-4177-94EA-0D2B72D384C1} - C:\Program Files\Babylon\Babylon-Pro\Utils\BabylonIEPI.dll (Babylon Ltd.)
O3 - HKU\S-1-5-21-1957994488-413027322-839522115-1004\..\Toolbar\ShellBrowser: (no name) - {CCC7A320-B3CA-4199-B1A6-9F516DD69829} - No CLSID value found.
O4 - HKLM..\Run: [avgnt] C:\Program Files\Avira\AntiVir Desktop\avgnt.exe (Avira GmbH)
O4 - HKLM..\Run: [Saunalahti Avustaja] C:\Program Files\Saunalahti\Avustaja\Saunalahti.exe (Saunalahti)
O4 - Startup: C:\Documents and Settings\All Users\Käynnistä-valikko\Ohjelmat\Käynnistys\McAfee Security Scan Plus.lnk = C:\Program Files\McAfee Security Scan\2.0.181\SSScheduler.exe (McAfee, Inc.)
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Infodelivery present
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: LinkResolveIgnoreLinkInfo = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoResolveSearch = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O7 - HKU\.DEFAULT\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O7 - HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O7 - HKU\S-1-5-18\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O7 - HKU\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O7 - HKU\S-1-5-19\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-19\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\S-1-5-20\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\S-1-5-21-1957994488-413027322-839522115-1004\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-21-1957994488-413027322-839522115-1004\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O7 - HKU\S-1-5-21-1957994488-413027322-839522115-1004\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: LinkResolveIgnoreLinkInfo = 0
O7 - HKU\S-1-5-21-1957994488-413027322-839522115-1004\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O7 - HKU\S-1-5-21-1957994488-413027322-839522115-1004\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O8 - Extra context menu item: Translate this web page with Babylon - C:\Program Files\Babylon\Babylon-Pro\Utils\BabylonIEPI.dll (Babylon Ltd.)
O8 - Extra context menu item: Translate with Babylon - C:\Program Files\Babylon\Babylon-Pro\Utils\BabylonIEPI.dll (Babylon Ltd.)
O9 - Extra Button: Translate this web page with Babylon - {F72841F0-4EF1-4df5-BCE5-B3AC8ACF5478} - C:\Program Files\Babylon\Babylon-Pro\Utils\BabylonIEPI.dll (Babylon Ltd.)
O9 - Extra 'Tools' menuitem : Translate this web page with Babylon - {F72841F0-4EF1-4df5-BCE5-B3AC8ACF5478} - C:\Program Files\Babylon\Babylon-Pro\Utils\BabylonIEPI.dll (Babylon Ltd.)
O16 - DPF: {166B1BCA-3F9C-11CF-8075-444553540000} http://download.macromedia.com/pub/shockwave/cabs/director/sw.cab (Shockwave ActiveX Control)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-1_6_0_24-windows-i586.cab (Java Plug-in 1.6.0_24)
O16 - DPF: {CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_24-windows-i586.cab (Java Plug-in 1.6.0_24)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_24-windows-i586.cab (Java Plug-in 1.6.0_24)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.0.1
O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files\Common Files\Skype\Skype4COM.dll (Skype Technologies)
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation)
O24 - Desktop Components:0 (Nykyinen kotisivu) - About:Home
O24 - Desktop WallPaper: C:\Documents and Settings\Sipa\Local Settings\Application Data\Microsoft\Wallpaper1.bmp
O24 - Desktop BackupWallPaper: C:\Documents and Settings\Sipa\Local Settings\Application Data\Microsoft\Wallpaper1.bmp
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2009.09.06 10:50:37 | 000,000,000 | ---- | M] () - C:\AUTOEXEC.BAT -- [ NTFS ]
O34 - HKLM BootExecute: (autocheck autochk *) - File not found
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*

[color=#E56717]========== Files/Folders - Created Within 30 Days ==========[/color]

[2011.04.22 11:19:45 | 000,580,608 | ---- | C] (OldTimer Tools) -- C:\Documents and Settings\Sipa\Työpöytä\OTL.exe
[2011.04.21 19:52:22 | 000,000,000 | -HSD | C] -- C:\RECYCLER
[2011.04.21 19:27:37 | 000,000,000 | RHSD | C] -- C:\cmdcons
[2011.04.21 19:20:04 | 000,000,000 | ---D | C] -- C:\WINDOWS\ERDNT
[2011.04.21 14:15:21 | 000,000,000 | ---D | C] -- C:\Program Files\Trend Micro
[2011.04.21 14:15:21 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Sipa\Käynnistä-valikko\Ohjelmat\HiJackThis
[2011.04.18 15:19:50 | 000,000,000 | ---D | C] -- C:\Documents and Settings\NetworkService\Application Data\McAfee
[2011.04.18 15:05:34 | 000,000,000 | RH-D | C] -- C:\Documents and Settings\Sipa\Recent
[2011.04.07 16:41:30 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Sipa\Työpöytä\album.php_tiedostot
[4 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]
[3 C:\Documents and Settings\Sipa\Omat tiedostot\*.tmp files -> C:\Documents and Settings\Sipa\Omat tiedostot\*.tmp -> ]
[1 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]
[1 C:\Documents and Settings\Sipa\Työpöytä\*.tmp files -> C:\Documents and Settings\Sipa\Työpöytä\*.tmp -> ]

[color=#E56717]========== Files - Modified Within 30 Days ==========[/color]

[2011.04.22 11:19:46 | 000,580,608 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\Sipa\Työpöytä\OTL.exe
[2011.04.22 11:13:48 | 000,000,006 | -H-- | M] () -- C:\WINDOWS\tasks\SA.DAT
[2011.04.22 11:13:46 | 000,002,048 | --S- | M] () -- C:\WINDOWS\bootstat.dat
[2011.04.21 20:58:05 | 004,550,656 | ---- | M] () -- C:\Documents and Settings\Sipa\ntuser.dat
[2011.04.21 20:58:05 | 000,000,188 | -HS- | M] () -- C:\Documents and Settings\Sipa\ntuser.ini
[2011.04.21 20:40:00 | 000,001,084 | ---- | M] () -- C:\WINDOWS\tasks\GoogleUpdateTaskUserS-1-5-21-1957994488-413027322-839522115-1004UA.job
[2011.04.21 19:50:45 | 034,161,834 | -H-- | M] () -- C:\Documents and Settings\Sipa\Local Settings\Application Data\IconCache.db
[2011.04.21 19:30:05 | 000,000,227 | ---- | M] () -- C:\WINDOWS\system.ini
[2011.04.21 19:30:00 | 000,000,027 | ---- | M] () -- C:\WINDOWS\System32\drivers\etc\hosts
[2011.04.21 19:27:40 | 000,000,327 | RHS- | M] () -- C:\boot.ini
[2011.04.21 14:25:34 | 000,002,445 | ---- | M] () -- C:\Documents and Settings\Sipa\Työpöytä\HiJackThis.lnk
[2011.04.21 12:40:00 | 000,001,032 | ---- | M] () -- C:\WINDOWS\tasks\GoogleUpdateTaskUserS-1-5-21-1957994488-413027322-839522115-1004Core.job
[2011.04.18 19:59:20 | 000,010,752 | ---- | M] () -- C:\Documents and Settings\Sipa\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2011.04.18 15:25:55 | 000,013,646 | ---- | M] () -- C:\WINDOWS\System32\wpa.dbl
[2011.04.18 15:15:50 | 000,000,742 | ---- | M] () -- C:\Documents and Settings\Sipa\Application Data\Microsoft\Internet Explorer\Quick Launch\Mozilla Firefox.lnk
[2011.04.18 15:15:50 | 000,000,724 | ---- | M] () -- C:\Documents and Settings\All Users\Työpöytä\Mozilla Firefox.lnk
[2011.04.16 17:09:09 | 000,002,387 | ---- | M] () -- C:\Documents and Settings\Sipa\Työpöytä\Microsoft Word.lnk
[2011.04.15 08:51:24 | 000,137,256 | ---- | M] () -- C:\WINDOWS\System32\FNTCACHE.DAT
[2011.04.15 00:21:56 | 000,001,374 | ---- | M] () -- C:\WINDOWS\imsins.BAK
[2011.04.07 16:41:31 | 000,143,206 | -H-- | M] () -- C:\Documents and Settings\Sipa\Työpöytä\album.php.htm
[2011.04.05 16:17:43 | 000,035,579 | -H-- | M] () -- C:\Documents and Settings\Sipa\Työpöytä\Terveyden edistäminen klk 2011.odt
[2011.04.05 10:52:54 | 000,027,384 | -H-- | M] () -- C:\Documents and Settings\Sipa\Työpöytä\AIKAS15 oikea.odt
[2011.04.02 17:26:43 | 000,027,647 | -H-- | M] () -- C:\Documents and Settings\Sipa\Työpöytä\AIKAS15.odt
[2011.03.27 14:40:37 | 000,002,277 | ---- | M] () -- C:\Documents and Settings\Sipa\Työpöytä\Google Chrome.lnk
[2011.03.27 14:40:37 | 000,002,255 | ---- | M] () -- C:\Documents and Settings\Sipa\Application Data\Microsoft\Internet Explorer\Quick Launch\Google Chrome.lnk
[2011.03.27 09:20:59 | 000,690,576 | ---- | M] () -- C:\WINDOWS\System32\PerfStringBackup.INI
[2011.03.27 09:20:59 | 000,311,740 | ---- | M] () -- C:\WINDOWS\System32\perfh009.dat
[2011.03.27 09:20:59 | 000,283,356 | ---- | M] () -- C:\WINDOWS\System32\perfh00B.dat
[2011.03.27 09:20:59 | 000,048,660 | ---- | M] () -- C:\WINDOWS\System32\perfc00B.dat
[2011.03.27 09:20:59 | 000,040,128 | ---- | M] () -- C:\WINDOWS\System32\perfc009.dat
[4 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]
[3 C:\Documents and Settings\Sipa\Omat tiedostot\*.tmp files -> C:\Documents and Settings\Sipa\Omat tiedostot\*.tmp -> ]
[1 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]
[1 C:\Documents and Settings\Sipa\Työpöytä\*.tmp files -> C:\Documents and Settings\Sipa\Työpöytä\*.tmp -> ]

[color=#E56717]========== Files Created - No Company Name ==========[/color]

[2011.04.21 19:27:40 | 000,000,211 | ---- | C] () -- C:\Boot.bak
[2011.04.21 19:27:38 | 000,260,352 | RHS- | C] () -- C:\cmldr
[2011.04.21 14:15:21 | 000,002,445 | ---- | C] () -- C:\Documents and Settings\Sipa\Työpöytä\HiJackThis.lnk
[2011.04.18 15:15:49 | 000,000,730 | ---- | C] () -- C:\Documents and Settings\All Users\Käynnistä-valikko\Ohjelmat\Mozilla Firefox.lnk
[2011.04.17 11:57:23 | 004,550,656 | ---- | C] () -- C:\Documents and Settings\Sipa\ntuser.dat
[2011.04.07 16:41:30 | 000,143,206 | -H-- | C] () -- C:\Documents and Settings\Sipa\Työpöytä\album.php.htm
[2011.04.05 15:02:02 | 000,035,579 | -H-- | C] () -- C:\Documents and Settings\Sipa\Työpöytä\Terveyden edistäminen klk 2011.odt
[2011.04.05 10:52:54 | 000,027,384 | -H-- | C] () -- C:\Documents and Settings\Sipa\Työpöytä\AIKAS15 oikea.odt
[2011.04.02 15:30:50 | 000,027,647 | -H-- | C] () -- C:\Documents and Settings\Sipa\Työpöytä\AIKAS15.odt
[2010.11.07 19:38:25 | 000,000,056 | -H-- | C] () -- C:\WINDOWS\System32\ezsidmv.dat
[2010.07.27 11:03:20 | 010,829,656 | ---- | C] () -- C:\WINDOWS\System32\LogiDPP.dll
[2010.07.27 11:03:20 | 000,102,744 | ---- | C] () -- C:\WINDOWS\System32\LogiDPPApp.exe
[2010.07.27 11:03:18 | 000,290,648 | ---- | C] () -- C:\WINDOWS\System32\DevManagerCore.dll
[2010.07.27 10:56:04 | 000,090,411 | ---- | C] () -- C:\WINDOWS\System32\lvcoinst.ini
[2010.07.20 11:05:30 | 000,010,752 | ---- | C] () -- C:\Documents and Settings\Sipa\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2010.07.05 22:23:41 | 001,774,720 | ---- | C] () -- C:\WINDOWS\System32\BootMan.exe
[2010.07.05 22:23:41 | 000,086,408 | ---- | C] () -- C:\WINDOWS\System32\setupempdrv03.exe
[2010.07.05 22:23:41 | 000,014,848 | ---- | C] () -- C:\WINDOWS\System32\EuEpmGdi.dll
[2010.07.05 22:23:41 | 000,013,192 | ---- | C] () -- C:\WINDOWS\System32\epmntdrv.sys
[2010.07.05 22:23:41 | 000,008,456 | ---- | C] () -- C:\WINDOWS\System32\EuGdiDrv.sys
[2010.05.07 19:46:36 | 000,014,168 | ---- | C] () -- C:\WINDOWS\System32\drivers\iKeyLFT2.dll
[2010.05.07 19:43:30 | 000,025,824 | ---- | C] () -- C:\WINDOWS\System32\drivers\LVPr2Mon.sys
[2009.09.13 15:48:18 | 000,000,000 | ---- | C] () -- C:\WINDOWS\nsreg.dat
[2009.09.06 18:44:17 | 000,690,576 | ---- | C] () -- C:\WINDOWS\System32\PerfStringBackup.INI
[2009.09.06 18:44:16 | 000,004,381 | ---- | C] () -- C:\WINDOWS\ODBCINST.INI
[2009.09.06 18:41:16 | 000,137,256 | ---- | C] () -- C:\WINDOWS\System32\FNTCACHE.DAT
[2009.09.06 12:27:48 | 000,000,413 | ---- | C] () -- C:\WINDOWS\ODBC.INI
[2009.09.06 12:13:47 | 000,024,840 | -H-- | C] () -- C:\Documents and Settings\Sipa\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
[2009.09.06 11:03:06 | 034,161,834 | -H-- | C] () -- C:\Documents and Settings\Sipa\Local Settings\Application Data\IconCache.db
[2009.09.06 11:01:53 | 000,147,456 | R--- | C] () -- C:\WINDOWS\System32\igfxCoIn_v4935.dll
[2009.09.06 10:57:33 | 000,019,926 | ---- | C] () -- C:\WINDOWS\Ascd_log.ini
[2009.09.06 10:57:16 | 000,019,609 | ---- | C] () -- C:\WINDOWS\Ascd_tmp.ini
[2009.09.06 10:57:14 | 000,005,810 | R--- | C] () -- C:\WINDOWS\System32\drivers\ASACPI.sys
[2009.09.06 10:57:02 | 000,012,536 | ---- | C] () -- C:\WINDOWS\System32\drivers\ASUSHWIO.SYS
[2009.09.06 10:51:56 | 000,002,048 | --S- | C] () -- C:\WINDOWS\bootstat.dat
[2009.09.06 10:50:37 | 000,000,000 | ---- | C] () -- C:\WINDOWS\control.ini
[2009.09.06 10:49:58 | 000,000,488 | RH-- | C] () -- C:\WINDOWS\System32\logonui.exe.manifest
[2009.09.06 10:49:55 | 000,000,749 | RH-- | C] () -- C:\WINDOWS\System32\cdplayer.exe.manifest
[2009.09.06 10:48:38 | 000,021,672 | ---- | C] () -- C:\WINDOWS\System32\emptyregdb.dat
[2009.09.06 10:48:28 | 000,000,059 | ---- | C] () -- C:\WINDOWS\vbaddin.ini
[2009.09.06 10:48:28 | 000,000,036 | ---- | C] () -- C:\WINDOWS\vb.ini
[2009.09.06 10:47:48 | 000,026,181 | ---- | C] () -- C:\WINDOWS\System32\tslabels.ini
[2009.09.06 10:47:47 | 000,003,836 | ---- | C] () -- C:\WINDOWS\System32\msdtcprf.ini
[2004.09.15 15:00:00 | 013,107,200 | ---- | C] () -- C:\WINDOWS\System32\oembios.bin
[2004.09.15 15:00:00 | 001,015,477 | ---- | C] () -- C:\WINDOWS\System32\esentprf.ini
[2004.09.15 15:00:00 | 000,733,696 | ---- | C] () -- C:\WINDOWS\System32\qedwipes.dll
[2004.09.15 15:00:00 | 000,673,088 | ---- | C] () -- C:\WINDOWS\System32\mlang.dat
[2004.09.15 15:00:00 | 000,355,112 | ---- | C] () -- C:\WINDOWS\System32\msjetoledb40.dll
[2004.09.15 15:00:00 | 000,311,740 | ---- | C] () -- C:\WINDOWS\System32\perfh009.dat
[2004.09.15 15:00:00 | 000,283,356 | ---- | C] () -- C:\WINDOWS\System32\perfh00B.dat
[2004.09.15 15:00:00 | 000,272,128 | ---- | C] () -- C:\WINDOWS\System32\perfi009.dat
[2004.09.15 15:00:00 | 000,270,848 | ---- | C] () -- C:\WINDOWS\System32\sbe.dll
[2004.09.15 15:00:00 | 000,253,440 | ---- | C] () -- C:\WINDOWS\System32\compatui.dll
[2004.09.15 15:00:00 | 000,243,832 | ---- | C] () -- C:\WINDOWS\System32\perfi00B.dat
[2004.09.15 15:00:00 | 000,218,003 | ---- | C] () -- C:\WINDOWS\System32\dssec.dat
[2004.09.15 15:00:00 | 000,199,168 | ---- | C] () -- C:\WINDOWS\System32\ir32_32.dll
[2004.09.15 15:00:00 | 000,186,880 | ---- | C] () -- C:\WINDOWS\System32\encdec.dll
[2004.09.15 15:00:00 | 000,094,282 | ---- | C] () -- C:\WINDOWS\System32\msencode.dll
[2004.09.15 15:00:00 | 000,070,656 | ---- | C] () -- C:\WINDOWS\System32\amstream.dll
[2004.09.15 15:00:00 | 000,070,270 | ---- | C] () -- C:\WINDOWS\System32\edit.com
[2004.09.15 15:00:00 | 000,053,904 | ---- | C] () -- C:\WINDOWS\System32\dosx.exe
[2004.09.15 15:00:00 | 000,053,478 | ---- | C] () -- C:\WINDOWS\System32\tcpmon.ini
[2004.09.15 15:00:00 | 000,051,096 | ---- | C] () -- C:\WINDOWS\System32\command.com
[2004.09.15 15:00:00 | 000,048,660 | ---- | C] () -- C:\WINDOWS\System32\perfc00B.dat
[2004.09.15 15:00:00 | 000,046,258 | ---- | C] () -- C:\WINDOWS\System32\mib.bin
[2004.09.15 15:00:00 | 000,042,809 | ---- | C] () -- C:\WINDOWS\System32\key01.sys
[2004.09.15 15:00:00 | 000,042,537 | ---- | C] () -- C:\WINDOWS\System32\keyboard.sys
[2004.09.15 15:00:00 | 000,040,128 | ---- | C] () -- C:\WINDOWS\System32\perfc009.dat
[2004.09.15 15:00:00 | 000,039,322 | ---- | C] () -- C:\WINDOWS\System32\mem.exe
[2004.09.15 15:00:00 | 000,035,648 | ---- | C] () -- C:\WINDOWS\System32\ntio411.sys
[2004.09.15 15:00:00 | 000,035,424 | ---- | C] () -- C:\WINDOWS\System32\ntio412.sys
[2004.09.15 15:00:00 | 000,034,560 | ---- | C] () -- C:\WINDOWS\System32\ntio804.sys
[2004.09.15 15:00:00 | 000,034,560 | ---- | C] () -- C:\WINDOWS\System32\ntio404.sys
[2004.09.15 15:00:00 | 000,034,270 | ---- | C] () -- C:\WINDOWS\System32\perfd00B.dat
[2004.09.15 15:00:00 | 000,033,920 | ---- | C] () -- C:\WINDOWS\System32\ntio.sys
[2004.09.15 15:00:00 | 000,029,370 | ---- | C] () -- C:\WINDOWS\System32\ntdos411.sys
[2004.09.15 15:00:00 | 000,029,274 | ---- | C] () -- C:\WINDOWS\System32\ntdos412.sys
[2004.09.15 15:00:00 | 000,029,146 | ---- | C] () -- C:\WINDOWS\System32\ntdos804.sys
[2004.09.15 15:00:00 | 000,029,146 | ---- | C] () -- C:\WINDOWS\System32\ntdos404.sys
[2004.09.15 15:00:00 | 000,028,626 | ---- | C] () -- C:\WINDOWS\System32\perfd009.dat
[2004.09.15 15:00:00 | 000,027,882 | ---- | C] () -- C:\WINDOWS\System32\ntdos.sys
[2004.09.15 15:00:00 | 000,027,097 | ---- | C] () -- C:\WINDOWS\System32\country.sys
[2004.09.15 15:00:00 | 000,020,730 | ---- | C] () -- C:\WINDOWS\System32\debug.exe
[2004.09.15 15:00:00 | 000,019,758 | ---- | C] () -- C:\WINDOWS\System32\graphics.com
[2004.09.15 15:00:00 | 000,015,536 | ---- | C] () -- C:\WINDOWS\System32\rsvp.ini
[2004.09.15 15:00:00 | 000,015,360 | ---- | C] () -- C:\WINDOWS\System32\tsd32.dll
[2004.09.15 15:00:00 | 000,014,766 | ---- | C] () -- C:\WINDOWS\System32\kb16.com
[2004.09.15 15:00:00 | 000,014,336 | ---- | C] () -- C:\WINDOWS\System32\msdmo.dll
[2004.09.15 15:00:00 | 000,013,727 | ---- | C] () -- C:\WINDOWS\System32\pschdprf.ini
[2004.09.15 15:00:00 | 000,013,312 | ---- | C] () -- C:\WINDOWS\System32\win87em.dll
[2004.09.15 15:00:00 | 000,012,706 | ---- | C] () -- C:\WINDOWS\System32\edlin.exe
[2004.09.15 15:00:00 | 000,012,562 | ---- | C] () -- C:\WINDOWS\System32\append.exe
[2004.09.15 15:00:00 | 000,011,717 | ---- | C] () -- C:\WINDOWS\System32\setver.exe
[2004.09.15 15:00:00 | 000,009,026 | ---- | C] () -- C:\WINDOWS\System32\ansi.sys
[2004.09.15 15:00:00 | 000,008,424 | ---- | C] () -- C:\WINDOWS\System32\exe2bin.exe
[2004.09.15 15:00:00 | 000,007,052 | ---- | C] () -- C:\WINDOWS\System32\nlsfunc.exe
[2004.09.15 15:00:00 | 000,005,746 | ---- | C] () -- C:\WINDOWS\System32\rasctrs.ini
[2004.09.15 15:00:00 | 000,004,848 | ---- | C] () -- C:\WINDOWS\System32\himem.sys
[2004.09.15 15:00:00 | 000,004,569 | ---- | C] () -- C:\WINDOWS\System32\secupd.dat
[2004.09.15 15:00:00 | 000,004,461 | ---- | C] () -- C:\WINDOWS\System32\oembios.dat
[2004.09.15 15:00:00 | 000,003,340 | ---- | C] () -- C:\WINDOWS\System32\redir.exe
[2004.09.15 15:00:00 | 000,003,041 | ---- | C] () -- C:\WINDOWS\System32\perfci.ini
[2004.09.15 15:00:00 | 000,002,920 | ---- | C] () -- C:\WINDOWS\System32\perfwci.ini
[2004.09.15 15:00:00 | 000,001,804 | ---- | C] () -- C:\WINDOWS\System32\dcache.bin
[2004.09.15 15:00:00 | 000,001,405 | ---- | C] () -- C:\WINDOWS\msdfmap.ini
[2004.09.15 15:00:00 | 000,001,258 | ---- | C] () -- C:\WINDOWS\System32\perffilt.ini
[2004.09.15 15:00:00 | 000,001,146 | ---- | C] () -- C:\WINDOWS\System32\loadfix.com
[2004.09.15 15:00:00 | 000,000,882 | ---- | C] () -- C:\WINDOWS\System32\share.exe
[2004.09.15 15:00:00 | 000,000,882 | ---- | C] () -- C:\WINDOWS\System32\fastopen.exe
[2004.09.15 15:00:00 | 000,000,817 | ---- | C] () -- C:\WINDOWS\System32\mscdexnt.exe
[2004.09.15 15:00:00 | 000,000,741 | ---- | C] () -- C:\WINDOWS\System32\noise.dat
[2004.09.15 15:00:00 | 000,000,507 | ---- | C] () -- C:\WINDOWS\win.ini
[2004.09.15 15:00:00 | 000,000,344 | ---- | C] () -- C:\WINDOWS\System32\prodspec.ini
[2004.09.15 15:00:00 | 000,000,227 | ---- | C] () -- C:\WINDOWS\system.ini
[2002.10.16 01:54:04 | 000,153,088 | ---- | C] () -- C:\WINDOWS\System32\unrar.dll
[2001.10.05 19:31:54 | 000,055,296 | ---- | C] () -- C:\WINDOWS\System32\dvdplay.exe
[2001.10.05 19:31:34 | 000,157,696 | ---- | C] () -- C:\WINDOWS\System32\paqsp.dll
[1999.01.22 18:46:58 | 000,065,536 | ---- | C] () -- C:\WINDOWS\System32\MSRTEDIT.DLL

[color=#E56717]========== LOP Check ==========[/color]

[2010.07.11 17:58:02 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Babylon
[2009.09.26 09:24:24 | 000,000,000 | -H-D | M] -- C:\Documents and Settings\All Users\Application Data\CanonBJ
[2010.09.22 17:07:06 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\DAEMON Tools Net
[2011.01.01 14:25:47 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Emotum
[2011.01.01 14:25:44 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Saunalahti
[2010.07.11 17:58:02 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Sipa\Application Data\Babylon
[2010.09.15 20:45:45 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Sipa\Application Data\Canon
[2010.09.22 17:07:44 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Sipa\Application Data\DAEMON Tools Net
[2011.03.01 15:18:28 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Sipa\Application Data\ImgBurn
[2010.07.19 19:08:37 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Sipa\Application Data\IObit
[2010.09.22 17:16:34 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Sipa\Application Data\Leadertech
[2010.07.05 12:12:11 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Sipa\Application Data\OpenOffice.org
[2010.08.02 17:17:52 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Sipa\Application Data\Printer Info Cache
[2011.02.07 02:25:15 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Sipa\Application Data\StreamTorrent
[2011.04.18 19:59:26 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Sipa\Application Data\uTorrent

[color=#E56717]========== Purity Check ==========[/color]



< End of report >


Extras.Txt:


OTL Extras logfile created on: 22.4.2011 11:21:21 - Run 1
OTL by OldTimer - Version 3.2.22.3 Folder = C:\Documents and Settings\Sipa\Työpöytä
Windows XP Home Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18702)
Locale: 0000040B | Country: Suomi | Language: FIN | Date Format: d.M.yyyy

3,00 Gb Total Physical Memory | 3,00 Gb Available Physical Memory | 85,00% Memory free
5,00 Gb Paging File | 5,00 Gb Available in Paging File | 91,00% Paging File free
Paging file location(s): C:\pagefile.sys 2046 4092 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 97,65 Gb Total Space | 59,22 Gb Free Space | 60,64% Space Free | Partition Type: NTFS
Drive E: | 244,14 Gb Total Space | 237,51 Gb Free Space | 97,28% Space Free | Partition Type: NTFS
Drive F: | 254,36 Gb Total Space | 252,01 Gb Free Space | 99,07% Space Free | Partition Type: NTFS

Computer Name: COREDUO | User Name: Sipa | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: All users
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: Off | File Age = 30 Days

[color=#E56717]========== Extra Registry (SafeList) ==========[/color]


[color=#E56717]========== File Associations ==========[/color]

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.cpl [@ = cplfile] -- rundll32.exe shell32.dll,Control_RunDLL "%1",%*
.url [@ = InternetShortcut] -- rundll32.exe ieframe.dll,OpenURL %l

[HKEY_USERS\S-1-5-21-1957994488-413027322-839522115-1004\SOFTWARE\Classes\<extension>]
.html [@ = FirefoxHTML] -- C:\Program Files\Mozilla Firefox\firefox.exe (Mozilla Corporation)

[color=#E56717]========== Shell Spawning ==========[/color]

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
cplfile [cplopen] -- rundll32.exe shell32.dll,Control_RunDLL "%1",%*
exefile [open] -- "%1" %*
htmlfile [edit] -- "E:\Program Files\Microsoft Office\Office\msohtmed.exe" %1 (Microsoft Corporation)
InternetShortcut [open] -- rundll32.exe ieframe.dll,OpenURL %l
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [AddToPlaylistVLC] -- "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file --playlist-enqueue "%1" ()
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Directory [PlayWithVLC] -- "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file --no-playlist-enqueue "%1" ()
Folder [open] -- %SystemRoot%\Explorer.exe /idlist,%I,%L (Microsoft Corporation)
Folder [explore] -- %SystemRoot%\Explorer.exe /e,/idlist,%I,%L (Microsoft Corporation)
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)

[color=#E56717]========== Security Center Settings ==========[/color]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"FirstRunDisabled" = 1
"AntiVirusDisableNotify" = 0
"FirewallDisableNotify" = 0
"UpdatesDisableNotify" = 0
"AntiVirusOverride" = 1
"FirewallOverride" = 0

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\AhnlabAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ComputerAssociatesAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\KasperskyAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SophosAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TinyFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ZoneLabsFirewall]

[color=#E56717]========== System Restore Settings ==========[/color]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore]
"DisableSR" = 1

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Sr]
"Start" = 4

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SrService]
"Start" = 2

[color=#E56717]========== Firewall Settings ==========[/color]

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile]

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\StandardProfile]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"EnableFirewall" = 1
"DoNotAllowExceptions" = 0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List]

[color=#E56717]========== Authorized Applications List ==========[/color]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]
"C:\Program Files\Java\jre6\bin\java.exe" = C:\Program Files\Java\jre6\bin\java.exe:*:Enabled:Java(TM) Platform SE binary -- (Sun Microsystems, Inc.)
"C:\Program Files\uTorrent\uTorrent.exe" = C:\Program Files\uTorrent\uTorrent.exe:*:Enabled:µTorrent -- (BitTorrent, Inc.)
"C:\Program Files\SopCast\adv\SopAdver.exe" = C:\Program Files\SopCast\adv\SopAdver.exe:*:Enabled:SopCast Adver -- (www.sopcast.com)
"C:\Program Files\SopCast\SopCast.exe" = C:\Program Files\SopCast\SopCast.exe:*:Enabled:SopCast Main Application -- (www.sopcast.com)
"C:\Program Files\Mozilla Firefox\firefox.exe" = C:\Program Files\Mozilla Firefox\firefox.exe:*:Enabled:Firefox -- (Mozilla Corporation)
"E:\Program Files\Logitech\Vid\Vid.exe" = E:\Program Files\Logitech\Vid\Vid.exe:*:Enabled:Logitech Vid HD -- (Logitech Inc.)


[color=#E56717]========== HKEY_LOCAL_MACHINE Uninstall List ==========[/color]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{0000040B-78E1-11D2-B60F-006097C998E7}" = Microsoft Office 2000 Premium
"{00BA866C-F2A2-4BB9-A308-3DFA695B6F7C}" = Java DB 10.5.3.0
"{08610298-29AE-445B-B37D-EFBE05802967}" = LWS Pictures And Video
"{138A4072-9E64-46BD-B5F9-DB2BB395391F}" = LWS VideoEffects
"{15634701-BACE-4449-8B25-1567DA8C9FD3}" = CameraHelperMsi
"{1651216E-E7AD-4250-92A1-FB8ED61391C9}" = LWS Help_main
"{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
"{20D4A895-748C-4D88-871C-FDB1695B0169}" = Platform
"{21DF0294-6B9D-4741-AB6F-B2ABFBD2387E}" = LWS YouTube Plugin
"{26A24AE4-039D-4CA4-87B4-2F83216012FF}" = Java(TM) 6 Update 24
"{32A3A4F4-B792-11D6-A78A-00B0D0160210}" = Java(TM) SE Development Kit 6 Update 21
"{350C940b-3D7C-4EE8-BAA9-00BCB3D54227}" = WebFldrs XP
"{3EE9BCAE-E9A9-45E5-9B1C-83A4D357E05C}" = erLT
"{45A66726-69BC-466B-A7A4-12FCBA4883D7}" = HiJackThis
"{464157E0-100C-4747-A5EC-50AA534C031C}" = Saunalahti Software Update Service
"{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater
"{4FBCEA31-5D18-4212-9231-DE7CF1BE7DBB}" = Logitech Vid
"{505AFDC0-5E72-4928-8368-5DEA385E3647}" = CorelDRAW Graphics Suite 12
"{5EE7D259-D137-4438-9A5F-42F432EC0421}" = VC80CRTRedist - 8.0.50727.4053
"{69FDFBB6-351D-4B8C-89D8-867DC9D0A2A4}" = Windows Media Player Firefox Plugin
"{6F76EC3C-34B1-436E-97FB-48C58D7BEDCD}" = LWS Gallery
"{71E66D3F-A009-44AB-8784-75E2819BA4BA}" = LWS Motion Detection
"{770657D0-A123-3C07-8E44-1C83EC895118}" = Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053
"{837b34e3-7c30-493c-8f6a-2b0f04e2912c}" = Microsoft Visual C++ 2005 Redistributable
"{83C8FA3C-F4EA-46C4-8392-D3CE353738D6}" = LWS Launcher
"{86CE85E6-DBAC-3FFD-B977-E4B79F83C909}" = Microsoft Visual C++ 2008 Redistributable - KB2467174 - x86 9.0.30729.5570
"{8937D274-C281-42E4-8CDB-A0B2DF979189}" = LWS Webcam Software
"{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}" = Microsoft Silverlight
"{90120000-00B2-0409-0000-0000000FF1CE}" = Microsoft Save as PDF or XPS Add-in for 2007 Microsoft Office programs
"{9DAEA76B-E50F-4272-A595-0124E826553D}" = LWS WLM Plugin
"{a0fe116e-9a8a-466f-aee0-625cb7c207e3}" = Microsoft Visual C++ 2005 Redistributable - KB2467175
"{AC76BA86-7AD7-1035-7B44-A94000000001}" = Adobe Reader 9.4.0 - Suomi
"{B194272D-1F92-46DF-99EB-8D5CE91CB4EC}" = Adobe AIR
"{B22806DA-C1BF-43AE-8B23-BF0BF2B6AC1E}" = Saunalahti Avustaja
"{B7050CBDB2504B34BC2A9CA0A692CC29}" = DivX Web Player
"{BE7CD87D-BC9E-4350-9A8E-2EF4A65A2437}" = OpenOffice.org 3.1
"{C9BED750-1211-4480-B1A5-718A3BE15525}" = REALTEK GbE & FE Ethernet PCI-E NIC Driver
"{D40EB009-0499-459c-A8AF-C9C110766215}" = Logitech Webcam Software
"{E633D396-5188-4E9D-8F6B-BFB8BF3467E8}" = Skype? 5.0
"{EED027B7-0DB6-404B-8F45-6DFEE34A0441}" = LWS Video Mask Maker
"{F2B5A2A7-2DF9-4361-8BD5-362714528B51}" = NHL® 09
"{FF167195-9EE4-46C0-8CD7-FBA3457E88AB}" = LWS Facebook
"AC3Filter_is1" = AC3Filter 1.63b
"Adobe AIR" = Adobe AIR
"Adobe Flash Player ActiveX" = Adobe Flash Player 10 ActiveX
"Adobe Flash Player Plugin" = Adobe Flash Player 10 Plugin
"Adobe Photoshop 6.0" = Adobe Photoshop 6.0
"Adobe Shockwave Player" = Adobe Shockwave Player 11.5
"Adobe SVG Viewer" = Adobe SVG Viewer
"Advanced SystemCare 3_is1" = Advanced SystemCare 3
"Avira AntiVir Desktop" = Avira AntiVir Personal - Free Antivirus
"Babylon" = Babylon
"DivX Setup.divx.com" = DivX Setup
"EASEUS Partition Master Home Edition_is1" = EASEUS Partition Master 6.0.1 Home Edition
"HDMI" = Intel(R) Graphics Media Accelerator Driver
"IDNMitigationAPIs" = Microsoft Internationalized Domain Names Mitigation APIs
"ie8" = Windows Internet Explorer 8
"ImgBurn" = ImgBurn
"InstallShield_{20D4A895-748C-4D88-871C-FDB1695B0169}" = VIA Ohjelmistoalustan laitehallinta
"McAfee Security Scan" = McAfee Security Scan Plus
"Mozilla Firefox 4.0 (x86 fi)" = Mozilla Firefox 4.0 (x86 fi)
"MSCompPackV1" = Microsoft Compression Client Pack 1.0 for Windows XP
"NLSDownlevelMapping" = Microsoft National Language Support Downlevel APIs
"SopCast" = SopCast 3.2.8
"Tappio" = Tappio-kirjanpito
"uTorrent" = µTorrent
"Veetle TV" = Veetle TV 0.9.18
"Windows Media Format Runtime" = Windows Media Format 11 runtime
"Windows Media Player" = Windows Media Player 11
"Windows XP Service Pack" = Windows XP Service Pack 3
"WinRAR archiver" = WinRAR archiver
"VLC media player" = VLC media player 1.1.4
"WMFDist11" = Windows Media Format 11 runtime
"wmp11" = Windows Media Player 11
"VobSub" = VobSub v2.23 (Remove Only)
"Wudf01000" = Microsoft User-Mode Driver Framework Feature Pack 1.0

[color=#E56717]========== HKEY_USERS Uninstall List ==========[/color]

[HKEY_USERS\S-1-5-21-1957994488-413027322-839522115-1004\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"Google Chrome" = Google Chrome

[color=#E56717]========== Last 10 Event Log Errors ==========[/color]

[ Application Events ]
Error - 18.4.2011 7:46:52 | Computer Name = COREDUO | Source = VSS | ID = 12289
Description = Aseman tilannevedospalvelun virhe: Odottamaton virhe CreateFileW(\\?\Volume{a13cd0f5-9afa-11de-83ed-806d6172696f},0xc0000000,0x00000003,...).
hr = 0x80070005.

Error - 18.4.2011 7:47:19 | Computer Name = COREDUO | Source = VSS | ID = 5013
Description = Aseman tilannevedospalvelun virhe: Tilannevedoksen tallentaja RemovableStorageManager
kutsui toimintoa OpenNtmsSessionW, joka epäonnistui, tila: 0x80070015 (muunnettu:
0x800423f3).

Error - 18.4.2011 7:47:32 | Computer Name = COREDUO | Source = VSS | ID = 12289
Description = Aseman tilannevedospalvelun virhe: Odottamaton virhe CreateFileW(\\?\Volume{a13cd0f5-9afa-11de-83ed-806d6172696f},0xc0000000,0x00000003,...).
hr = 0x80070005.

Error - 18.4.2011 7:47:57 | Computer Name = COREDUO | Source = VSS | ID = 5013
Description = Aseman tilannevedospalvelun virhe: Tilannevedoksen tallentaja RemovableStorageManager
kutsui toimintoa OpenNtmsSessionW, joka epäonnistui, tila: 0x80070015 (muunnettu:
0x800423f3).

Error - 18.4.2011 7:50:41 | Computer Name = COREDUO | Source = VSS | ID = 12289
Description = Aseman tilannevedospalvelun virhe: Odottamaton virhe CreateFileW(\\?\Volume{a13cd0f5-9afa-11de-83ed-806d6172696f},0xc0000000,0x00000003,...).
hr = 0x80070005.

Error - 18.4.2011 7:51:09 | Computer Name = COREDUO | Source = VSS | ID = 5013
Description = Aseman tilannevedospalvelun virhe: Tilannevedoksen tallentaja RemovableStorageManager
kutsui toimintoa OpenNtmsSessionW, joka epäonnistui, tila: 0x80070015 (muunnettu:
0x800423f3).

Error - 18.4.2011 8:14:56 | Computer Name = COREDUO | Source = VSS | ID = 12289
Description = Aseman tilannevedospalvelun virhe: Odottamaton virhe CreateFileW(\\?\Volume{a13cd0f5-9afa-11de-83ed-806d6172696f},0xc0000000,0x00000003,...).
hr = 0x80070005.

Error - 18.4.2011 8:15:23 | Computer Name = COREDUO | Source = VSS | ID = 5013
Description = Aseman tilannevedospalvelun virhe: Tilannevedoksen tallentaja RemovableStorageManager
kutsui toimintoa OpenNtmsSessionW, joka epäonnistui, tila: 0x80070015 (muunnettu:
0x800423f3).

Error - 18.4.2011 8:30:09 | Computer Name = COREDUO | Source = VSS | ID = 12289
Description = Aseman tilannevedospalvelun virhe: Odottamaton virhe CreateFileW(\\?\Volume{a13cd0f5-9afa-11de-83ed-806d6172696f},0xc0000000,0x00000003,...).
hr = 0x80070005.

Error - 18.4.2011 8:30:37 | Computer Name = COREDUO | Source = VSS | ID = 5013
Description = Aseman tilannevedospalvelun virhe: Tilannevedoksen tallentaja RemovableStorageManager
kutsui toimintoa OpenNtmsSessionW, joka epäonnistui, tila: 0x80070015 (muunnettu:
0x800423f3).

[ System Events ]
Error - 18.4.2011 9:12:19 | Computer Name = COREDUO | Source = Service Control Manager | ID = 7023
Description = Palvelu Sovellusten hallinta lopetettiin virheen takia. Virhe: %%126

Error - 18.4.2011 9:12:19 | Computer Name = COREDUO | Source = Service Control Manager | ID = 7023
Description = Palvelu Sovellusten hallinta lopetettiin virheen takia. Virhe: %%126

Error - 18.4.2011 9:12:19 | Computer Name = COREDUO | Source = Service Control Manager | ID = 7023
Description = Palvelu Sovellusten hallinta lopetettiin virheen takia. Virhe: %%126

Error - 18.4.2011 9:12:19 | Computer Name = COREDUO | Source = Service Control Manager | ID = 7023
Description = Palvelu Sovellusten hallinta lopetettiin virheen takia. Virhe: %%126

Error - 18.4.2011 9:12:19 | Computer Name = COREDUO | Source = Service Control Manager | ID = 7023
Description = Palvelu Sovellusten hallinta lopetettiin virheen takia. Virhe: %%126

Error - 18.4.2011 9:12:19 | Computer Name = COREDUO | Source = Service Control Manager | ID = 7023
Description = Palvelu Sovellusten hallinta lopetettiin virheen takia. Virhe: %%126

Error - 18.4.2011 9:12:19 | Computer Name = COREDUO | Source = Service Control Manager | ID = 7023
Description = Palvelu Sovellusten hallinta lopetettiin virheen takia. Virhe: %%126

Error - 21.4.2011 12:14:06 | Computer Name = COREDUO | Source = Service Control Manager | ID = 7034
Description = Palvelu Process Monitor lopetti yllättäen toimintansa. Se on tehnyt
näin jo 1 kertaa.

Error - 21.4.2011 12:28:09 | Computer Name = COREDUO | Source = Service Control Manager | ID = 7034
Description = Palvelu Process Monitor lopetti yllättäen toimintansa. Se on tehnyt
näin jo 1 kertaa.

Error - 22.4.2011 4:18:33 | Computer Name = COREDUO | Source = Service Control Manager | ID = 7034
Description = Palvelu Process Monitor lopetti yllättäen toimintansa. Se on tehnyt
näin jo 1 kertaa.


< End of report >
AfterDawn Addict
_
22. huhtikuuta 2011 @ 15:00 _ Linkki tähän viestiin    Lähetä käyttäjälle yksityisviesti   
.

Mikä siellä on tilanne ???

:)

Onko se häirikkö SopCast ad = mainos ???
(SopAdver.exe)
:)

(:)
Jarru1
Newbie
_
22. huhtikuuta 2011 @ 15:28 _ Linkki tähän viestiin    Lähetä käyttäjälle yksityisviesti   
Lainaus, alkuperäisen viestin kirjoitti Jarru1:
Lainaus, alkuperäisen viestin kirjoitti kalminen:
.
Aina sieltä tauhkaa löytyy !!!

-------------------------

Kirjoita windowsin käynnistävalikon suorita-kenttään Combofix /uninstall paina OK

********************************************************

Lataa työpöydälle => TÄMÄ
* Sulje kaikki päälläolevat ikkunat ja sovellukset.
* Tuplaklikkaa OTL.exeä käynnistääksesi OTListIt:n.
* Laita siihen ruxit kuvan mukaan.




* Klikkaa Run Scan nappulaa.
* Kun tarkistus on valmis, OTListIt luo kaksi tekstitiedostoa työpöydälle, tai alapalkkiin OTListIt.Txt ja Extras.txt
* Kopioi ja lähetä tiedostojen sisältö tänne.


Mikä siellä on tilanne ???
:)

OTL.Txt:


OTL logfile created on: 22.4.2011 11:21:21 - Run 1
OTL by OldTimer - Version 3.2.22.3 Folder = C:\Documents and Settings\Sipa\Työpöytä
Windows XP Home Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18702)
Locale: 0000040B | Country: Suomi | Language: FIN | Date Format: d.M.yyyy

3,00 Gb Total Physical Memory | 3,00 Gb Available Physical Memory | 85,00% Memory free
5,00 Gb Paging File | 5,00 Gb Available in Paging File | 91,00% Paging File free
Paging file location(s): C:\pagefile.sys 2046 4092 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 97,65 Gb Total Space | 59,22 Gb Free Space | 60,64% Space Free | Partition Type: NTFS
Drive E: | 244,14 Gb Total Space | 237,51 Gb Free Space | 97,28% Space Free | Partition Type: NTFS
Drive F: | 254,36 Gb Total Space | 252,01 Gb Free Space | 99,07% Space Free | Partition Type: NTFS

Computer Name: COREDUO | User Name: Sipa | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: All users
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: Off | File Age = 30 Days

[color=#E56717]========== Processes (SafeList) ==========[/color]

PRC - [2011.04.22 11:19:46 | 000,580,608 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\Sipa\Työpöytä\OTL.exe
PRC - [2011.03.18 20:58:47 | 000,924,632 | ---- | M] (Mozilla Corporation) -- C:\Program Files\Mozilla Firefox\firefox.exe
PRC - [2011.03.18 11:16:33 | 000,269,480 | ---- | M] (Avira GmbH) -- C:\Program Files\Avira\AntiVir Desktop\avguard.exe
PRC - [2010.11.07 12:47:14 | 000,281,768 | ---- | M] (Avira GmbH) -- C:\Program Files\Avira\AntiVir Desktop\avgnt.exe
PRC - [2010.11.07 12:47:14 | 000,135,336 | ---- | M] (Avira GmbH) -- C:\Program Files\Avira\AntiVir Desktop\sched.exe
PRC - [2010.07.09 11:02:26 | 000,611,120 | ---- | M] (Saunalahti) -- C:\Program Files\Saunalahti\Avustaja\CC3Service.exe
PRC - [2010.07.09 11:01:58 | 000,234,800 | ---- | M] (Saunalahti) -- C:\Program Files\Saunalahti\Avustaja\Saunalahti.exe
PRC - [2010.06.29 14:05:38 | 000,381,776 | ---- | M] () -- C:\Program Files\Saunalahti\ESUS\ESUS.exe
PRC - [2010.01.15 15:49:20 | 000,255,536 | ---- | M] (McAfee, Inc.) -- C:\Program Files\McAfee Security Scan\2.0.181\SSScheduler.exe
PRC - [2010.01.14 22:11:00 | 000,076,968 | ---- | M] (Avira GmbH) -- C:\Program Files\Avira\AntiVir Desktop\avshadow.exe
PRC - [2008.04.14 19:12:11 | 001,034,240 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\explorer.exe


[color=#E56717]========== Modules (SafeList) ==========[/color]

MOD - [2011.04.22 11:19:46 | 000,580,608 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\Sipa\Työpöytä\OTL.exe
MOD - [2010.08.23 19:12:31 | 001,054,208 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.6028_x-ww_61e65202\comctl32.dll


[color=#E56717]========== Win32 Services (SafeList) ==========[/color]

SRV - File not found [Disabled | Stopped] -- -- (HidServ) HID (Human Interface Device)
SRV - File not found [On_Demand | Stopped] -- -- (AppMgmt)
SRV - [2011.03.18 11:16:33 | 000,269,480 | ---- | M] (Avira GmbH) [Auto | Running] -- C:\Program Files\Avira\AntiVir Desktop\avguard.exe -- (AntiVirService)
SRV - [2010.11.07 12:47:14 | 000,135,336 | ---- | M] (Avira GmbH) [Auto | Running] -- C:\Program Files\Avira\AntiVir Desktop\sched.exe -- (AntiVirSchedulerService)
SRV - [2010.07.09 11:02:26 | 000,611,120 | ---- | M] (Saunalahti) [Auto | Running] -- C:\Program Files\Saunalahti\Avustaja\CC3Service.exe -- (CC3Svc)
SRV - [2010.06.29 14:05:38 | 000,381,776 | ---- | M] () [Auto | Running] -- C:\Program Files\Saunalahti\ESUS\ESUS.exe -- (ESUSClient)
SRV - [2010.05.07 19:47:32 | 000,162,648 | ---- | M] (Logitech Inc.) [Auto | Stopped] -- C:\Program Files\Common Files\Logishrd\LVMVFM\LVPrcSrv.exe -- (LVPrcSrv)
SRV - [2010.01.15 15:49:20 | 000,227,232 | ---- | M] (McAfee, Inc.) [On_Demand | Stopped] -- C:\Program Files\McAfee Security Scan\2.0.181\McCHSvc.exe -- (McComponentHostService)


[color=#E56717]========== Driver Services (SafeList) ==========[/color]

DRV - [2011.03.18 11:16:35 | 000,137,656 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\WINDOWS\system32\drivers\avipbb.sys -- (avipbb)
DRV - [2010.11.28 11:43:29 | 000,061,960 | ---- | M] (Avira GmbH) [File_System | Auto | Running] -- C:\WINDOWS\system32\drivers\avgntflt.sys -- (avgntflt)
DRV - [2010.07.27 11:15:20 | 000,023,904 | ---- | M] (Logitech Inc.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\lvuvcflt.sys -- (FilterService)
DRV - [2010.07.27 11:14:58 | 006,842,464 | ---- | M] (Logitech Inc.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\lvuvc.sys -- (LVUVC) Logitech HD Webcam C270(UVC)
DRV - [2010.07.27 11:12:50 | 000,282,336 | ---- | M] (Logitech Inc.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\lvrs.sys -- (LVRS)
DRV - [2010.07.27 11:12:26 | 000,114,784 | ---- | M] (Logitech Inc.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\lvpopflt.sys -- (lvpopflt)
DRV - [2010.05.11 16:29:52 | 000,013,192 | ---- | M] () [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\epmntdrv.sys -- (epmntdrv)
DRV - [2010.05.11 16:29:50 | 000,008,456 | ---- | M] () [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\EuGdiDrv.sys -- (EuGdiDrv)
DRV - [2010.05.07 19:43:30 | 000,025,824 | ---- | M] () [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\LVPr2Mon.sys -- (LVPr2Mon)
DRV - [2009.05.11 12:49:19 | 000,011,608 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\Program Files\Avira\AntiVir Desktop\avgio.sys -- (avgio)
DRV - [2009.05.11 10:12:49 | 000,028,520 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\WINDOWS\system32\drivers\ssmdrv.sys -- (ssmdrv)
DRV - [2008.08.07 14:14:00 | 000,111,360 | R--- | M] (Realtek Semiconductor Corporation ) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\Rtenicxp.sys -- (RTLE8023xp)
DRV - [2008.07.25 15:09:24 | 000,845,184 | R--- | M] (VIA Technologies, Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\viahduaa.sys -- (VIAHdAudAddService)
DRV - [2008.02.14 09:12:00 | 001,389,056 | R--- | M] (Creative Technology Ltd.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\monfilt.sys -- (monfilt)
DRV - [2006.04.07 17:06:38 | 000,038,496 | ---- | M] (OLYMPUS IMAGING CORP.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\VNUSB.sys -- (VNUSB)
DRV - [2004.08.13 13:56:20 | 000,005,810 | R--- | M] () [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\ASACPI.sys -- (MTsensor)


[color=#E56717]========== Standard Registry (SafeList) ==========[/color]


[color=#E56717]========== Internet Explorer ==========[/color]



IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0



IE - HKU\S-1-5-21-1957994488-413027322-839522115-1004\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.google.fi/
IE - HKU\S-1-5-21-1957994488-413027322-839522115-1004\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

[color=#E56717]========== FireFox ==========[/color]

FF - prefs.js..browser.search.defaultthis.engineName: "Web Search"
FF - prefs.js..browser.search.defaulturl: "http://search.conduit.com/ResultsExt.aspx?ctid=CT1460988&SearchSource=3&q={searchTerms}"
FF - prefs.js..browser.startup.homepage: "www.ampparit.com"
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}:6.0.20
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA}:6.0.21
FF - prefs.js..extensions.enabledItems: {e4a8a97b-f2ed-450b-b12d-ee082ba24781}:0.8.20100408.6
FF - prefs.js..extensions.enabledItems: {d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}:1.3.3
FF - prefs.js..extensions.enabledItems: {8D03DB51-DA47-46a9-8F14-53ABE84263F5}:1.0

FF - HKLM\software\mozilla\Firefox\extensions\\{8D03DB51-DA47-46a9-8F14-53ABE84263F5}: C:\Program Files\Saunalahti\Avustaja\BHO\Firefox [2011.01.01 14:24:52 | 000,000,000 | ---D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 4.0\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2011.04.18 15:15:46 | 000,000,000 | ---D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 4.0\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2011.04.18 15:15:41 | 000,000,000 | ---D | M]

[2009.09.13 15:48:23 | 000,000,000 | ---D | M] (No name found) -- C:\Documents and Settings\Sipa\Application Data\Mozilla\Extensions
[2011.04.19 12:05:27 | 000,000,000 | ---D | M] (No name found) -- C:\Documents and Settings\Sipa\Application Data\Mozilla\Firefox\Profiles\cpeol7wx.default\extensions
[2010.01.21 17:09:36 | 000,000,879 | -H-- | M] () -- C:\Documents and Settings\Sipa\Application Data\Mozilla\Firefox\Profiles\cpeol7wx.default\searchplugins\conduit.xml
[2011.04.18 20:03:07 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files\Mozilla Firefox\extensions
[2010.07.19 20:08:29 | 000,000,000 | ---D | M] (Java Console) -- C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}
[2010.08.22 18:25:22 | 000,000,000 | ---D | M] (Java Console) -- C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA}
[2011.04.18 20:03:07 | 000,000,000 | ---D | M] (Java Console) -- C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA}
File not found (No name found) --
() (No name found) -- C:\DOCUMENTS AND SETTINGS\SIPA\APPLICATION DATA\MOZILLA\FIREFOX\PROFILES\CPEOL7WX.DEFAULT\EXTENSIONS\{D10D0BF8-F5B5-C8B4-A8B2-2B9879E08C5D}.XPI
() (No name found) -- C:\DOCUMENTS AND SETTINGS\SIPA\APPLICATION DATA\MOZILLA\FIREFOX\PROFILES\CPEOL7WX.DEFAULT\EXTENSIONS\{E4A8A97B-F2ED-450B-B12D-EE082BA24781}.XPI
[2011.03.18 20:58:48 | 000,142,296 | ---- | M] (Mozilla Foundation) -- C:\Program Files\Mozilla Firefox\components\browsercomps.dll
[2011.02.02 21:40:24 | 000,472,808 | ---- | M] (Sun Microsystems, Inc.) -- C:\Program Files\Mozilla Firefox\plugins\npdeployJava1.dll
[2010.01.01 11:00:00 | 000,002,252 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\bing.xml
[2010.01.01 11:00:00 | 000,002,062 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\bookplus-fi.xml
[2010.01.01 11:00:00 | 000,000,972 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\eBay-fi.xml
[2010.01.01 11:00:00 | 000,001,183 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\wikipedia-fi.xml
[2010.01.01 11:00:00 | 000,001,100 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\yahoo-fi.xml

O1 HOSTS File: ([2011.04.21 19:30:00 | 000,000,027 | ---- | M]) - C:\WINDOWS\system32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 localhost
O2 - BHO: (AVG Safe Search) - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - Reg Error: Value error. File not found
O2 - BHO: (ConnectionCentreBHO Class) - {476AAF4E-3AA2-47FE-BEDB-3B45C404513B} - C:\Program Files\Saunalahti\Avustaja\BHO\CC3IEBHO.dll (Saunalahti)
O2 - BHO: (Babylon IE plugin) - {9CFACCB6-2F3F-4177-94EA-0D2B72D384C1} - C:\Program Files\Babylon\Babylon-Pro\Utils\BabylonIEPI.dll (Babylon Ltd.)
O3 - HKU\S-1-5-21-1957994488-413027322-839522115-1004\..\Toolbar\ShellBrowser: (no name) - {CCC7A320-B3CA-4199-B1A6-9F516DD69829} - No CLSID value found.
O4 - HKLM..\Run: [avgnt] C:\Program Files\Avira\AntiVir Desktop\avgnt.exe (Avira GmbH)
O4 - HKLM..\Run: [Saunalahti Avustaja] C:\Program Files\Saunalahti\Avustaja\Saunalahti.exe (Saunalahti)
O4 - Startup: C:\Documents and Settings\All Users\Käynnistä-valikko\Ohjelmat\Käynnistys\McAfee Security Scan Plus.lnk = C:\Program Files\McAfee Security Scan\2.0.181\SSScheduler.exe (McAfee, Inc.)
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Infodelivery present
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: LinkResolveIgnoreLinkInfo = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoResolveSearch = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O7 - HKU\.DEFAULT\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O7 - HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O7 - HKU\S-1-5-18\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O7 - HKU\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O7 - HKU\S-1-5-19\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-19\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\S-1-5-20\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\S-1-5-21-1957994488-413027322-839522115-1004\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-21-1957994488-413027322-839522115-1004\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O7 - HKU\S-1-5-21-1957994488-413027322-839522115-1004\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: LinkResolveIgnoreLinkInfo = 0
O7 - HKU\S-1-5-21-1957994488-413027322-839522115-1004\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O7 - HKU\S-1-5-21-1957994488-413027322-839522115-1004\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O8 - Extra context menu item: Translate this web page with Babylon - C:\Program Files\Babylon\Babylon-Pro\Utils\BabylonIEPI.dll (Babylon Ltd.)
O8 - Extra context menu item: Translate with Babylon - C:\Program Files\Babylon\Babylon-Pro\Utils\BabylonIEPI.dll (Babylon Ltd.)
O9 - Extra Button: Translate this web page with Babylon - {F72841F0-4EF1-4df5-BCE5-B3AC8ACF5478} - C:\Program Files\Babylon\Babylon-Pro\Utils\BabylonIEPI.dll (Babylon Ltd.)
O9 - Extra 'Tools' menuitem : Translate this web page with Babylon - {F72841F0-4EF1-4df5-BCE5-B3AC8ACF5478} - C:\Program Files\Babylon\Babylon-Pro\Utils\BabylonIEPI.dll (Babylon Ltd.)
O16 - DPF: {166B1BCA-3F9C-11CF-8075-444553540000} http://download.macromedia.com/pub/shockwave/cabs/director/sw.cab (Shockwave ActiveX Control)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-1_6_0_24-windows-i586.cab (Java Plug-in 1.6.0_24)
O16 - DPF: {CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_24-windows-i586.cab (Java Plug-in 1.6.0_24)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_24-windows-i586.cab (Java Plug-in 1.6.0_24)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.0.1
O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files\Common Files\Skype\Skype4COM.dll (Skype Technologies)
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation)
O24 - Desktop Components:0 (Nykyinen kotisivu) - About:Home
O24 - Desktop WallPaper: C:\Documents and Settings\Sipa\Local Settings\Application Data\Microsoft\Wallpaper1.bmp
O24 - Desktop BackupWallPaper: C:\Documents and Settings\Sipa\Local Settings\Application Data\Microsoft\Wallpaper1.bmp
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2009.09.06 10:50:37 | 000,000,000 | ---- | M] () - C:\AUTOEXEC.BAT -- [ NTFS ]
O34 - HKLM BootExecute: (autocheck autochk *) - File not found
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*

[color=#E56717]========== Files/Folders - Created Within 30 Days ==========[/color]

[2011.04.22 11:19:45 | 000,580,608 | ---- | C] (OldTimer Tools) -- C:\Documents and Settings\Sipa\Työpöytä\OTL.exe
[2011.04.21 19:52:22 | 000,000,000 | -HSD | C] -- C:\RECYCLER
[2011.04.21 19:27:37 | 000,000,000 | RHSD | C] -- C:\cmdcons
[2011.04.21 19:20:04 | 000,000,000 | ---D | C] -- C:\WINDOWS\ERDNT
[2011.04.21 14:15:21 | 000,000,000 | ---D | C] -- C:\Program Files\Trend Micro
[2011.04.21 14:15:21 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Sipa\Käynnistä-valikko\Ohjelmat\HiJackThis
[2011.04.18 15:19:50 | 000,000,000 | ---D | C] -- C:\Documents and Settings\NetworkService\Application Data\McAfee
[2011.04.18 15:05:34 | 000,000,000 | RH-D | C] -- C:\Documents and Settings\Sipa\Recent
[2011.04.07 16:41:30 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Sipa\Työpöytä\album.php_tiedostot
[4 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]
[3 C:\Documents and Settings\Sipa\Omat tiedostot\*.tmp files -> C:\Documents and Settings\Sipa\Omat tiedostot\*.tmp -> ]
[1 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]
[1 C:\Documents and Settings\Sipa\Työpöytä\*.tmp files -> C:\Documents and Settings\Sipa\Työpöytä\*.tmp -> ]

[color=#E56717]========== Files - Modified Within 30 Days ==========[/color]

[2011.04.22 11:19:46 | 000,580,608 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\Sipa\Työpöytä\OTL.exe
[2011.04.22 11:13:48 | 000,000,006 | -H-- | M] () -- C:\WINDOWS\tasks\SA.DAT
[2011.04.22 11:13:46 | 000,002,048 | --S- | M] () -- C:\WINDOWS\bootstat.dat
[2011.04.21 20:58:05 | 004,550,656 | ---- | M] () -- C:\Documents and Settings\Sipa\ntuser.dat
[2011.04.21 20:58:05 | 000,000,188 | -HS- | M] () -- C:\Documents and Settings\Sipa\ntuser.ini
[2011.04.21 20:40:00 | 000,001,084 | ---- | M] () -- C:\WINDOWS\tasks\GoogleUpdateTaskUserS-1-5-21-1957994488-413027322-839522115-1004UA.job
[2011.04.21 19:50:45 | 034,161,834 | -H-- | M] () -- C:\Documents and Settings\Sipa\Local Settings\Application Data\IconCache.db
[2011.04.21 19:30:05 | 000,000,227 | ---- | M] () -- C:\WINDOWS\system.ini
[2011.04.21 19:30:00 | 000,000,027 | ---- | M] () -- C:\WINDOWS\System32\drivers\etc\hosts
[2011.04.21 19:27:40 | 000,000,327 | RHS- | M] () -- C:\boot.ini
[2011.04.21 14:25:34 | 000,002,445 | ---- | M] () -- C:\Documents and Settings\Sipa\Työpöytä\HiJackThis.lnk
[2011.04.21 12:40:00 | 000,001,032 | ---- | M] () -- C:\WINDOWS\tasks\GoogleUpdateTaskUserS-1-5-21-1957994488-413027322-839522115-1004Core.job
[2011.04.18 19:59:20 | 000,010,752 | ---- | M] () -- C:\Documents and Settings\Sipa\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2011.04.18 15:25:55 | 000,013,646 | ---- | M] () -- C:\WINDOWS\System32\wpa.dbl
[2011.04.18 15:15:50 | 000,000,742 | ---- | M] () -- C:\Documents and Settings\Sipa\Application Data\Microsoft\Internet Explorer\Quick Launch\Mozilla Firefox.lnk
[2011.04.18 15:15:50 | 000,000,724 | ---- | M] () -- C:\Documents and Settings\All Users\Työpöytä\Mozilla Firefox.lnk
[2011.04.16 17:09:09 | 000,002,387 | ---- | M] () -- C:\Documents and Settings\Sipa\Työpöytä\Microsoft Word.lnk
[2011.04.15 08:51:24 | 000,137,256 | ---- | M] () -- C:\WINDOWS\System32\FNTCACHE.DAT
[2011.04.15 00:21:56 | 000,001,374 | ---- | M] () -- C:\WINDOWS\imsins.BAK
[2011.04.07 16:41:31 | 000,143,206 | -H-- | M] () -- C:\Documents and Settings\Sipa\Työpöytä\album.php.htm
[2011.04.05 16:17:43 | 000,035,579 | -H-- | M] () -- C:\Documents and Settings\Sipa\Työpöytä\Terveyden edistäminen klk 2011.odt
[2011.04.05 10:52:54 | 000,027,384 | -H-- | M] () -- C:\Documents and Settings\Sipa\Työpöytä\AIKAS15 oikea.odt
[2011.04.02 17:26:43 | 000,027,647 | -H-- | M] () -- C:\Documents and Settings\Sipa\Työpöytä\AIKAS15.odt
[2011.03.27 14:40:37 | 000,002,277 | ---- | M] () -- C:\Documents and Settings\Sipa\Työpöytä\Google Chrome.lnk
[2011.03.27 14:40:37 | 000,002,255 | ---- | M] () -- C:\Documents and Settings\Sipa\Application Data\Microsoft\Internet Explorer\Quick Launch\Google Chrome.lnk
[2011.03.27 09:20:59 | 000,690,576 | ---- | M] () -- C:\WINDOWS\System32\PerfStringBackup.INI
[2011.03.27 09:20:59 | 000,311,740 | ---- | M] () -- C:\WINDOWS\System32\perfh009.dat
[2011.03.27 09:20:59 | 000,283,356 | ---- | M] () -- C:\WINDOWS\System32\perfh00B.dat
[2011.03.27 09:20:59 | 000,048,660 | ---- | M] () -- C:\WINDOWS\System32\perfc00B.dat
[2011.03.27 09:20:59 | 000,040,128 | ---- | M] () -- C:\WINDOWS\System32\perfc009.dat
[4 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]
[3 C:\Documents and Settings\Sipa\Omat tiedostot\*.tmp files -> C:\Documents and Settings\Sipa\Omat tiedostot\*.tmp -> ]
[1 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]
[1 C:\Documents and Settings\Sipa\Työpöytä\*.tmp files -> C:\Documents and Settings\Sipa\Työpöytä\*.tmp -> ]

[color=#E56717]========== Files Created - No Company Name ==========[/color]

[2011.04.21 19:27:40 | 000,000,211 | ---- | C] () -- C:\Boot.bak
[2011.04.21 19:27:38 | 000,260,352 | RHS- | C] () -- C:\cmldr
[2011.04.21 14:15:21 | 000,002,445 | ---- | C] () -- C:\Documents and Settings\Sipa\Työpöytä\HiJackThis.lnk
[2011.04.18 15:15:49 | 000,000,730 | ---- | C] () -- C:\Documents and Settings\All Users\Käynnistä-valikko\Ohjelmat\Mozilla Firefox.lnk
[2011.04.17 11:57:23 | 004,550,656 | ---- | C] () -- C:\Documents and Settings\Sipa\ntuser.dat
[2011.04.07 16:41:30 | 000,143,206 | -H-- | C] () -- C:\Documents and Settings\Sipa\Työpöytä\album.php.htm
[2011.04.05 15:02:02 | 000,035,579 | -H-- | C] () -- C:\Documents and Settings\Sipa\Työpöytä\Terveyden edistäminen klk 2011.odt
[2011.04.05 10:52:54 | 000,027,384 | -H-- | C] () -- C:\Documents and Settings\Sipa\Työpöytä\AIKAS15 oikea.odt
[2011.04.02 15:30:50 | 000,027,647 | -H-- | C] () -- C:\Documents and Settings\Sipa\Työpöytä\AIKAS15.odt
[2010.11.07 19:38:25 | 000,000,056 | -H-- | C] () -- C:\WINDOWS\System32\ezsidmv.dat
[2010.07.27 11:03:20 | 010,829,656 | ---- | C] () -- C:\WINDOWS\System32\LogiDPP.dll
[2010.07.27 11:03:20 | 000,102,744 | ---- | C] () -- C:\WINDOWS\System32\LogiDPPApp.exe
[2010.07.27 11:03:18 | 000,290,648 | ---- | C] () -- C:\WINDOWS\System32\DevManagerCore.dll
[2010.07.27 10:56:04 | 000,090,411 | ---- | C] () -- C:\WINDOWS\System32\lvcoinst.ini
[2010.07.20 11:05:30 | 000,010,752 | ---- | C] () -- C:\Documents and Settings\Sipa\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2010.07.05 22:23:41 | 001,774,720 | ---- | C] () -- C:\WINDOWS\System32\BootMan.exe
[2010.07.05 22:23:41 | 000,086,408 | ---- | C] () -- C:\WINDOWS\System32\setupempdrv03.exe
[2010.07.05 22:23:41 | 000,014,848 | ---- | C] () -- C:\WINDOWS\System32\EuEpmGdi.dll
[2010.07.05 22:23:41 | 000,013,192 | ---- | C] () -- C:\WINDOWS\System32\epmntdrv.sys
[2010.07.05 22:23:41 | 000,008,456 | ---- | C] () -- C:\WINDOWS\System32\EuGdiDrv.sys
[2010.05.07 19:46:36 | 000,014,168 | ---- | C] () -- C:\WINDOWS\System32\drivers\iKeyLFT2.dll
[2010.05.07 19:43:30 | 000,025,824 | ---- | C] () -- C:\WINDOWS\System32\drivers\LVPr2Mon.sys
[2009.09.13 15:48:18 | 000,000,000 | ---- | C] () -- C:\WINDOWS\nsreg.dat
[2009.09.06 18:44:17 | 000,690,576 | ---- | C] () -- C:\WINDOWS\System32\PerfStringBackup.INI
[2009.09.06 18:44:16 | 000,004,381 | ---- | C] () -- C:\WINDOWS\ODBCINST.INI
[2009.09.06 18:41:16 | 000,137,256 | ---- | C] () -- C:\WINDOWS\System32\FNTCACHE.DAT
[2009.09.06 12:27:48 | 000,000,413 | ---- | C] () -- C:\WINDOWS\ODBC.INI
[2009.09.06 12:13:47 | 000,024,840 | -H-- | C] () -- C:\Documents and Settings\Sipa\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
[2009.09.06 11:03:06 | 034,161,834 | -H-- | C] () -- C:\Documents and Settings\Sipa\Local Settings\Application Data\IconCache.db
[2009.09.06 11:01:53 | 000,147,456 | R--- | C] () -- C:\WINDOWS\System32\igfxCoIn_v4935.dll
[2009.09.06 10:57:33 | 000,019,926 | ---- | C] () -- C:\WINDOWS\Ascd_log.ini
[2009.09.06 10:57:16 | 000,019,609 | ---- | C] () -- C:\WINDOWS\Ascd_tmp.ini
[2009.09.06 10:57:14 | 000,005,810 | R--- | C] () -- C:\WINDOWS\System32\drivers\ASACPI.sys
[2009.09.06 10:57:02 | 000,012,536 | ---- | C] () -- C:\WINDOWS\System32\drivers\ASUSHWIO.SYS
[2009.09.06 10:51:56 | 000,002,048 | --S- | C] () -- C:\WINDOWS\bootstat.dat
[2009.09.06 10:50:37 | 000,000,000 | ---- | C] () -- C:\WINDOWS\control.ini
[2009.09.06 10:49:58 | 000,000,488 | RH-- | C] () -- C:\WINDOWS\System32\logonui.exe.manifest
[2009.09.06 10:49:55 | 000,000,749 | RH-- | C] () -- C:\WINDOWS\System32\cdplayer.exe.manifest
[2009.09.06 10:48:38 | 000,021,672 | ---- | C] () -- C:\WINDOWS\System32\emptyregdb.dat
[2009.09.06 10:48:28 | 000,000,059 | ---- | C] () -- C:\WINDOWS\vbaddin.ini
[2009.09.06 10:48:28 | 000,000,036 | ---- | C] () -- C:\WINDOWS\vb.ini
[2009.09.06 10:47:48 | 000,026,181 | ---- | C] () -- C:\WINDOWS\System32\tslabels.ini
[2009.09.06 10:47:47 | 000,003,836 | ---- | C] () -- C:\WINDOWS\System32\msdtcprf.ini
[2004.09.15 15:00:00 | 013,107,200 | ---- | C] () -- C:\WINDOWS\System32\oembios.bin
[2004.09.15 15:00:00 | 001,015,477 | ---- | C] () -- C:\WINDOWS\System32\esentprf.ini
[2004.09.15 15:00:00 | 000,733,696 | ---- | C] () -- C:\WINDOWS\System32\qedwipes.dll
[2004.09.15 15:00:00 | 000,673,088 | ---- | C] () -- C:\WINDOWS\System32\mlang.dat
[2004.09.15 15:00:00 | 000,355,112 | ---- | C] () -- C:\WINDOWS\System32\msjetoledb40.dll
[2004.09.15 15:00:00 | 000,311,740 | ---- | C] () -- C:\WINDOWS\System32\perfh009.dat
[2004.09.15 15:00:00 | 000,283,356 | ---- | C] () -- C:\WINDOWS\System32\perfh00B.dat
[2004.09.15 15:00:00 | 000,272,128 | ---- | C] () -- C:\WINDOWS\System32\perfi009.dat
[2004.09.15 15:00:00 | 000,270,848 | ---- | C] () -- C:\WINDOWS\System32\sbe.dll
[2004.09.15 15:00:00 | 000,253,440 | ---- | C] () -- C:\WINDOWS\System32\compatui.dll
[2004.09.15 15:00:00 | 000,243,832 | ---- | C] () -- C:\WINDOWS\System32\perfi00B.dat
[2004.09.15 15:00:00 | 000,218,003 | ---- | C] () -- C:\WINDOWS\System32\dssec.dat
[2004.09.15 15:00:00 | 000,199,168 | ---- | C] () -- C:\WINDOWS\System32\ir32_32.dll
[2004.09.15 15:00:00 | 000,186,880 | ---- | C] () -- C:\WINDOWS\System32\encdec.dll
[2004.09.15 15:00:00 | 000,094,282 | ---- | C] () -- C:\WINDOWS\System32\msencode.dll
[2004.09.15 15:00:00 | 000,070,656 | ---- | C] () -- C:\WINDOWS\System32\amstream.dll
[2004.09.15 15:00:00 | 000,070,270 | ---- | C] () -- C:\WINDOWS\System32\edit.com
[2004.09.15 15:00:00 | 000,053,904 | ---- | C] () -- C:\WINDOWS\System32\dosx.exe
[2004.09.15 15:00:00 | 000,053,478 | ---- | C] () -- C:\WINDOWS\System32\tcpmon.ini
[2004.09.15 15:00:00 | 000,051,096 | ---- | C] () -- C:\WINDOWS\System32\command.com
[2004.09.15 15:00:00 | 000,048,660 | ---- | C] () -- C:\WINDOWS\System32\perfc00B.dat
[2004.09.15 15:00:00 | 000,046,258 | ---- | C] () -- C:\WINDOWS\System32\mib.bin
[2004.09.15 15:00:00 | 000,042,809 | ---- | C] () -- C:\WINDOWS\System32\key01.sys
[2004.09.15 15:00:00 | 000,042,537 | ---- | C] () -- C:\WINDOWS\System32\keyboard.sys
[2004.09.15 15:00:00 | 000,040,128 | ---- | C] () -- C:\WINDOWS\System32\perfc009.dat
[2004.09.15 15:00:00 | 000,039,322 | ---- | C] () -- C:\WINDOWS\System32\mem.exe
[2004.09.15 15:00:00 | 000,035,648 | ---- | C] () -- C:\WINDOWS\System32\ntio411.sys
[2004.09.15 15:00:00 | 000,035,424 | ---- | C] () -- C:\WINDOWS\System32\ntio412.sys
[2004.09.15 15:00:00 | 000,034,560 | ---- | C] () -- C:\WINDOWS\System32\ntio804.sys
[2004.09.15 15:00:00 | 000,034,560 | ---- | C] () -- C:\WINDOWS\System32\ntio404.sys
[2004.09.15 15:00:00 | 000,034,270 | ---- | C] () -- C:\WINDOWS\System32\perfd00B.dat
[2004.09.15 15:00:00 | 000,033,920 | ---- | C] () -- C:\WINDOWS\System32\ntio.sys
[2004.09.15 15:00:00 | 000,029,370 | ---- | C] () -- C:\WINDOWS\System32\ntdos411.sys
[2004.09.15 15:00:00 | 000,029,274 | ---- | C] () -- C:\WINDOWS\System32\ntdos412.sys
[2004.09.15 15:00:00 | 000,029,146 | ---- | C] () -- C:\WINDOWS\System32\ntdos804.sys
[2004.09.15 15:00:00 | 000,029,146 | ---- | C] () -- C:\WINDOWS\System32\ntdos404.sys
[2004.09.15 15:00:00 | 000,028,626 | ---- | C] () -- C:\WINDOWS\System32\perfd009.dat
[2004.09.15 15:00:00 | 000,027,882 | ---- | C] () -- C:\WINDOWS\System32\ntdos.sys
[2004.09.15 15:00:00 | 000,027,097 | ---- | C] () -- C:\WINDOWS\System32\country.sys
[2004.09.15 15:00:00 | 000,020,730 | ---- | C] () -- C:\WINDOWS\System32\debug.exe
[2004.09.15 15:00:00 | 000,019,758 | ---- | C] () -- C:\WINDOWS\System32\graphics.com
[2004.09.15 15:00:00 | 000,015,536 | ---- | C] () -- C:\WINDOWS\System32\rsvp.ini
[2004.09.15 15:00:00 | 000,015,360 | ---- | C] () -- C:\WINDOWS\System32\tsd32.dll
[2004.09.15 15:00:00 | 000,014,766 | ---- | C] () -- C:\WINDOWS\System32\kb16.com
[2004.09.15 15:00:00 | 000,014,336 | ---- | C] () -- C:\WINDOWS\System32\msdmo.dll
[2004.09.15 15:00:00 | 000,013,727 | ---- | C] () -- C:\WINDOWS\System32\pschdprf.ini
[2004.09.15 15:00:00 | 000,013,312 | ---- | C] () -- C:\WINDOWS\System32\win87em.dll
[2004.09.15 15:00:00 | 000,012,706 | ---- | C] () -- C:\WINDOWS\System32\edlin.exe
[2004.09.15 15:00:00 | 000,012,562 | ---- | C] () -- C:\WINDOWS\System32\append.exe
[2004.09.15 15:00:00 | 000,011,717 | ---- | C] () -- C:\WINDOWS\System32\setver.exe
[2004.09.15 15:00:00 | 000,009,026 | ---- | C] () -- C:\WINDOWS\System32\ansi.sys
[2004.09.15 15:00:00 | 000,008,424 | ---- | C] () -- C:\WINDOWS\System32\exe2bin.exe
[2004.09.15 15:00:00 | 000,007,052 | ---- | C] () -- C:\WINDOWS\System32\nlsfunc.exe
[2004.09.15 15:00:00 | 000,005,746 | ---- | C] () -- C:\WINDOWS\System32\rasctrs.ini
[2004.09.15 15:00:00 | 000,004,848 | ---- | C] () -- C:\WINDOWS\System32\himem.sys
[2004.09.15 15:00:00 | 000,004,569 | ---- | C] () -- C:\WINDOWS\System32\secupd.dat
[2004.09.15 15:00:00 | 000,004,461 | ---- | C] () -- C:\WINDOWS\System32\oembios.dat
[2004.09.15 15:00:00 | 000,003,340 | ---- | C] () -- C:\WINDOWS\System32\redir.exe
[2004.09.15 15:00:00 | 000,003,041 | ---- | C] () -- C:\WINDOWS\System32\perfci.ini
[2004.09.15 15:00:00 | 000,002,920 | ---- | C] () -- C:\WINDOWS\System32\perfwci.ini
[2004.09.15 15:00:00 | 000,001,804 | ---- | C] () -- C:\WINDOWS\System32\dcache.bin
[2004.09.15 15:00:00 | 000,001,405 | ---- | C] () -- C:\WINDOWS\msdfmap.ini
[2004.09.15 15:00:00 | 000,001,258 | ---- | C] () -- C:\WINDOWS\System32\perffilt.ini
[2004.09.15 15:00:00 | 000,001,146 | ---- | C] () -- C:\WINDOWS\System32\loadfix.com
[2004.09.15 15:00:00 | 000,000,882 | ---- | C] () -- C:\WINDOWS\System32\share.exe
[2004.09.15 15:00:00 | 000,000,882 | ---- | C] () -- C:\WINDOWS\System32\fastopen.exe
[2004.09.15 15:00:00 | 000,000,817 | ---- | C] () -- C:\WINDOWS\System32\mscdexnt.exe
[2004.09.15 15:00:00 | 000,000,741 | ---- | C] () -- C:\WINDOWS\System32\noise.dat
[2004.09.15 15:00:00 | 000,000,507 | ---- | C] () -- C:\WINDOWS\win.ini
[2004.09.15 15:00:00 | 000,000,344 | ---- | C] () -- C:\WINDOWS\System32\prodspec.ini
[2004.09.15 15:00:00 | 000,000,227 | ---- | C] () -- C:\WINDOWS\system.ini
[2002.10.16 01:54:04 | 000,153,088 | ---- | C] () -- C:\WINDOWS\System32\unrar.dll
[2001.10.05 19:31:54 | 000,055,296 | ---- | C] () -- C:\WINDOWS\System32\dvdplay.exe
[2001.10.05 19:31:34 | 000,157,696 | ---- | C] () -- C:\WINDOWS\System32\paqsp.dll
[1999.01.22 18:46:58 | 000,065,536 | ---- | C] () -- C:\WINDOWS\System32\MSRTEDIT.DLL

[color=#E56717]========== LOP Check ==========[/color]

[2010.07.11 17:58:02 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Babylon
[2009.09.26 09:24:24 | 000,000,000 | -H-D | M] -- C:\Documents and Settings\All Users\Application Data\CanonBJ
[2010.09.22 17:07:06 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\DAEMON Tools Net
[2011.01.01 14:25:47 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Emotum
[2011.01.01 14:25:44 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Saunalahti
[2010.07.11 17:58:02 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Sipa\Application Data\Babylon
[2010.09.15 20:45:45 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Sipa\Application Data\Canon
[2010.09.22 17:07:44 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Sipa\Application Data\DAEMON Tools Net
[2011.03.01 15:18:28 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Sipa\Application Data\ImgBurn
[2010.07.19 19:08:37 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Sipa\Application Data\IObit
[2010.09.22 17:16:34 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Sipa\Application Data\Leadertech
[2010.07.05 12:12:11 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Sipa\Application Data\OpenOffice.org
[2010.08.02 17:17:52 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Sipa\Application Data\Printer Info Cache
[2011.02.07 02:25:15 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Sipa\Application Data\StreamTorrent
[2011.04.18 19:59:26 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Sipa\Application Data\uTorrent

[color=#E56717]========== Purity Check ==========[/color]



< End of report >


Extras.Txt:


OTL Extras logfile created on: 22.4.2011 11:21:21 - Run 1
OTL by OldTimer - Version 3.2.22.3 Folder = C:\Documents and Settings\Sipa\Työpöytä
Windows XP Home Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18702)
Locale: 0000040B | Country: Suomi | Language: FIN | Date Format: d.M.yyyy

3,00 Gb Total Physical Memory | 3,00 Gb Available Physical Memory | 85,00% Memory free
5,00 Gb Paging File | 5,00 Gb Available in Paging File | 91,00% Paging File free
Paging file location(s): C:\pagefile.sys 2046 4092 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 97,65 Gb Total Space | 59,22 Gb Free Space | 60,64% Space Free | Partition Type: NTFS
Drive E: | 244,14 Gb Total Space | 237,51 Gb Free Space | 97,28% Space Free | Partition Type: NTFS
Drive F: | 254,36 Gb Total Space | 252,01 Gb Free Space | 99,07% Space Free | Partition Type: NTFS

Computer Name: COREDUO | User Name: Sipa | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: All users
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: Off | File Age = 30 Days

[color=#E56717]========== Extra Registry (SafeList) ==========[/color]


[color=#E56717]========== File Associations ==========[/color]

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.cpl [@ = cplfile] -- rundll32.exe shell32.dll,Control_RunDLL "%1",%*
.url [@ = InternetShortcut] -- rundll32.exe ieframe.dll,OpenURL %l

[HKEY_USERS\S-1-5-21-1957994488-413027322-839522115-1004\SOFTWARE\Classes\<extension>]
.html [@ = FirefoxHTML] -- C:\Program Files\Mozilla Firefox\firefox.exe (Mozilla Corporation)

[color=#E56717]========== Shell Spawning ==========[/color]

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
cplfile [cplopen] -- rundll32.exe shell32.dll,Control_RunDLL "%1",%*
exefile [open] -- "%1" %*
htmlfile [edit] -- "E:\Program Files\Microsoft Office\Office\msohtmed.exe" %1 (Microsoft Corporation)
InternetShortcut [open] -- rundll32.exe ieframe.dll,OpenURL %l
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [AddToPlaylistVLC] -- "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file --playlist-enqueue "%1" ()
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Directory [PlayWithVLC] -- "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file --no-playlist-enqueue "%1" ()
Folder [open] -- %SystemRoot%\Explorer.exe /idlist,%I,%L (Microsoft Corporation)
Folder [explore] -- %SystemRoot%\Explorer.exe /e,/idlist,%I,%L (Microsoft Corporation)
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)

[color=#E56717]========== Security Center Settings ==========[/color]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"FirstRunDisabled" = 1
"AntiVirusDisableNotify" = 0
"FirewallDisableNotify" = 0
"UpdatesDisableNotify" = 0
"AntiVirusOverride" = 1
"FirewallOverride" = 0

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\AhnlabAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ComputerAssociatesAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\KasperskyAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SophosAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TinyFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ZoneLabsFirewall]

[color=#E56717]========== System Restore Settings ==========[/color]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore]
"DisableSR" = 1

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Sr]
"Start" = 4

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SrService]
"Start" = 2

[color=#E56717]========== Firewall Settings ==========[/color]

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile]

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\StandardProfile]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"EnableFirewall" = 1
"DoNotAllowExceptions" = 0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List]

[color=#E56717]========== Authorized Applications List ==========[/color]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]
"C:\Program Files\Java\jre6\bin\java.exe" = C:\Program Files\Java\jre6\bin\java.exe:*:Enabled:Java(TM) Platform SE binary -- (Sun Microsystems, Inc.)
"C:\Program Files\uTorrent\uTorrent.exe" = C:\Program Files\uTorrent\uTorrent.exe:*:Enabled:µTorrent -- (BitTorrent, Inc.)
"C:\Program Files\SopCast\adv\SopAdver.exe" = C:\Program Files\SopCast\adv\SopAdver.exe:*:Enabled:SopCast Adver -- (www.sopcast.com)
"C:\Program Files\SopCast\SopCast.exe" = C:\Program Files\SopCast\SopCast.exe:*:Enabled:SopCast Main Application -- (www.sopcast.com)
"C:\Program Files\Mozilla Firefox\firefox.exe" = C:\Program Files\Mozilla Firefox\firefox.exe:*:Enabled:Firefox -- (Mozilla Corporation)
"E:\Program Files\Logitech\Vid\Vid.exe" = E:\Program Files\Logitech\Vid\Vid.exe:*:Enabled:Logitech Vid HD -- (Logitech Inc.)


[color=#E56717]========== HKEY_LOCAL_MACHINE Uninstall List ==========[/color]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{0000040B-78E1-11D2-B60F-006097C998E7}" = Microsoft Office 2000 Premium
"{00BA866C-F2A2-4BB9-A308-3DFA695B6F7C}" = Java DB 10.5.3.0
"{08610298-29AE-445B-B37D-EFBE05802967}" = LWS Pictures And Video
"{138A4072-9E64-46BD-B5F9-DB2BB395391F}" = LWS VideoEffects
"{15634701-BACE-4449-8B25-1567DA8C9FD3}" = CameraHelperMsi
"{1651216E-E7AD-4250-92A1-FB8ED61391C9}" = LWS Help_main
"{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
"{20D4A895-748C-4D88-871C-FDB1695B0169}" = Platform
"{21DF0294-6B9D-4741-AB6F-B2ABFBD2387E}" = LWS YouTube Plugin
"{26A24AE4-039D-4CA4-87B4-2F83216012FF}" = Java(TM) 6 Update 24
"{32A3A4F4-B792-11D6-A78A-00B0D0160210}" = Java(TM) SE Development Kit 6 Update 21
"{350C940b-3D7C-4EE8-BAA9-00BCB3D54227}" = WebFldrs XP
"{3EE9BCAE-E9A9-45E5-9B1C-83A4D357E05C}" = erLT
"{45A66726-69BC-466B-A7A4-12FCBA4883D7}" = HiJackThis
"{464157E0-100C-4747-A5EC-50AA534C031C}" = Saunalahti Software Update Service
"{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater
"{4FBCEA31-5D18-4212-9231-DE7CF1BE7DBB}" = Logitech Vid
"{505AFDC0-5E72-4928-8368-5DEA385E3647}" = CorelDRAW Graphics Suite 12
"{5EE7D259-D137-4438-9A5F-42F432EC0421}" = VC80CRTRedist - 8.0.50727.4053
"{69FDFBB6-351D-4B8C-89D8-867DC9D0A2A4}" = Windows Media Player Firefox Plugin
"{6F76EC3C-34B1-436E-97FB-48C58D7BEDCD}" = LWS Gallery
"{71E66D3F-A009-44AB-8784-75E2819BA4BA}" = LWS Motion Detection
"{770657D0-A123-3C07-8E44-1C83EC895118}" = Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053
"{837b34e3-7c30-493c-8f6a-2b0f04e2912c}" = Microsoft Visual C++ 2005 Redistributable
"{83C8FA3C-F4EA-46C4-8392-D3CE353738D6}" = LWS Launcher
"{86CE85E6-DBAC-3FFD-B977-E4B79F83C909}" = Microsoft Visual C++ 2008 Redistributable - KB2467174 - x86 9.0.30729.5570
"{8937D274-C281-42E4-8CDB-A0B2DF979189}" = LWS Webcam Software
"{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}" = Microsoft Silverlight
"{90120000-00B2-0409-0000-0000000FF1CE}" = Microsoft Save as PDF or XPS Add-in for 2007 Microsoft Office programs
"{9DAEA76B-E50F-4272-A595-0124E826553D}" = LWS WLM Plugin
"{a0fe116e-9a8a-466f-aee0-625cb7c207e3}" = Microsoft Visual C++ 2005 Redistributable - KB2467175
"{AC76BA86-7AD7-1035-7B44-A94000000001}" = Adobe Reader 9.4.0 - Suomi
"{B194272D-1F92-46DF-99EB-8D5CE91CB4EC}" = Adobe AIR
"{B22806DA-C1BF-43AE-8B23-BF0BF2B6AC1E}" = Saunalahti Avustaja
"{B7050CBDB2504B34BC2A9CA0A692CC29}" = DivX Web Player
"{BE7CD87D-BC9E-4350-9A8E-2EF4A65A2437}" = OpenOffice.org 3.1
"{C9BED750-1211-4480-B1A5-718A3BE15525}" = REALTEK GbE & FE Ethernet PCI-E NIC Driver
"{D40EB009-0499-459c-A8AF-C9C110766215}" = Logitech Webcam Software
"{E633D396-5188-4E9D-8F6B-BFB8BF3467E8}" = Skype? 5.0
"{EED027B7-0DB6-404B-8F45-6DFEE34A0441}" = LWS Video Mask Maker
"{F2B5A2A7-2DF9-4361-8BD5-362714528B51}" = NHL® 09
"{FF167195-9EE4-46C0-8CD7-FBA3457E88AB}" = LWS Facebook
"AC3Filter_is1" = AC3Filter 1.63b
"Adobe AIR" = Adobe AIR
"Adobe Flash Player ActiveX" = Adobe Flash Player 10 ActiveX
"Adobe Flash Player Plugin" = Adobe Flash Player 10 Plugin
"Adobe Photoshop 6.0" = Adobe Photoshop 6.0
"Adobe Shockwave Player" = Adobe Shockwave Player 11.5
"Adobe SVG Viewer" = Adobe SVG Viewer
"Advanced SystemCare 3_is1" = Advanced SystemCare 3
"Avira AntiVir Desktop" = Avira AntiVir Personal - Free Antivirus
"Babylon" = Babylon
"DivX Setup.divx.com" = DivX Setup
"EASEUS Partition Master Home Edition_is1" = EASEUS Partition Master 6.0.1 Home Edition
"HDMI" = Intel(R) Graphics Media Accelerator Driver
"IDNMitigationAPIs" = Microsoft Internationalized Domain Names Mitigation APIs
"ie8" = Windows Internet Explorer 8
"ImgBurn" = ImgBurn
"InstallShield_{20D4A895-748C-4D88-871C-FDB1695B0169}" = VIA Ohjelmistoalustan laitehallinta
"McAfee Security Scan" = McAfee Security Scan Plus
"Mozilla Firefox 4.0 (x86 fi)" = Mozilla Firefox 4.0 (x86 fi)
"MSCompPackV1" = Microsoft Compression Client Pack 1.0 for Windows XP
"NLSDownlevelMapping" = Microsoft National Language Support Downlevel APIs
"SopCast" = SopCast 3.2.8
"Tappio" = Tappio-kirjanpito
"uTorrent" = µTorrent
"Veetle TV" = Veetle TV 0.9.18
"Windows Media Format Runtime" = Windows Media Format 11 runtime
"Windows Media Player" = Windows Media Player 11
"Windows XP Service Pack" = Windows XP Service Pack 3
"WinRAR archiver" = WinRAR archiver
"VLC media player" = VLC media player 1.1.4
"WMFDist11" = Windows Media Format 11 runtime
"wmp11" = Windows Media Player 11
"VobSub" = VobSub v2.23 (Remove Only)
"Wudf01000" = Microsoft User-Mode Driver Framework Feature Pack 1.0

[color=#E56717]========== HKEY_USERS Uninstall List ==========[/color]

[HKEY_USERS\S-1-5-21-1957994488-413027322-839522115-1004\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"Google Chrome" = Google Chrome

[color=#E56717]========== Last 10 Event Log Errors ==========[/color]

[ Application Events ]
Error - 18.4.2011 7:46:52 | Computer Name = COREDUO | Source = VSS | ID = 12289
Description = Aseman tilannevedospalvelun virhe: Odottamaton virhe CreateFileW(\\?\Volume{a13cd0f5-9afa-11de-83ed-806d6172696f},0xc0000000,0x00000003,...).
hr = 0x80070005.

Error - 18.4.2011 7:47:19 | Computer Name = COREDUO | Source = VSS | ID = 5013
Description = Aseman tilannevedospalvelun virhe: Tilannevedoksen tallentaja RemovableStorageManager
kutsui toimintoa OpenNtmsSessionW, joka epäonnistui, tila: 0x80070015 (muunnettu:
0x800423f3).

Error - 18.4.2011 7:47:32 | Computer Name = COREDUO | Source = VSS | ID = 12289
Description = Aseman tilannevedospalvelun virhe: Odottamaton virhe CreateFileW(\\?\Volume{a13cd0f5-9afa-11de-83ed-806d6172696f},0xc0000000,0x00000003,...).
hr = 0x80070005.

Error - 18.4.2011 7:47:57 | Computer Name = COREDUO | Source = VSS | ID = 5013
Description = Aseman tilannevedospalvelun virhe: Tilannevedoksen tallentaja RemovableStorageManager
kutsui toimintoa OpenNtmsSessionW, joka epäonnistui, tila: 0x80070015 (muunnettu:
0x800423f3).

Error - 18.4.2011 7:50:41 | Computer Name = COREDUO | Source = VSS | ID = 12289
Description = Aseman tilannevedospalvelun virhe: Odottamaton virhe CreateFileW(\\?\Volume{a13cd0f5-9afa-11de-83ed-806d6172696f},0xc0000000,0x00000003,...).
hr = 0x80070005.

Error - 18.4.2011 7:51:09 | Computer Name = COREDUO | Source = VSS | ID = 5013
Description = Aseman tilannevedospalvelun virhe: Tilannevedoksen tallentaja RemovableStorageManager
kutsui toimintoa OpenNtmsSessionW, joka epäonnistui, tila: 0x80070015 (muunnettu:
0x800423f3).

Error - 18.4.2011 8:14:56 | Computer Name = COREDUO | Source = VSS | ID = 12289
Description = Aseman tilannevedospalvelun virhe: Odottamaton virhe CreateFileW(\\?\Volume{a13cd0f5-9afa-11de-83ed-806d6172696f},0xc0000000,0x00000003,...).
hr = 0x80070005.

Error - 18.4.2011 8:15:23 | Computer Name = COREDUO | Source = VSS | ID = 5013
Description = Aseman tilannevedospalvelun virhe: Tilannevedoksen tallentaja RemovableStorageManager
kutsui toimintoa OpenNtmsSessionW, joka epäonnistui, tila: 0x80070015 (muunnettu:
0x800423f3).

Error - 18.4.2011 8:30:09 | Computer Name = COREDUO | Source = VSS | ID = 12289
Description = Aseman tilannevedospalvelun virhe: Odottamaton virhe CreateFileW(\\?\Volume{a13cd0f5-9afa-11de-83ed-806d6172696f},0xc0000000,0x00000003,...).
hr = 0x80070005.

Error - 18.4.2011 8:30:37 | Computer Name = COREDUO | Source = VSS | ID = 5013
Description = Aseman tilannevedospalvelun virhe: Tilannevedoksen tallentaja RemovableStorageManager
kutsui toimintoa OpenNtmsSessionW, joka epäonnistui, tila: 0x80070015 (muunnettu:
0x800423f3).

[ System Events ]
Error - 18.4.2011 9:12:19 | Computer Name = COREDUO | Source = Service Control Manager | ID = 7023
Description = Palvelu Sovellusten hallinta lopetettiin virheen takia. Virhe: %%126

Error - 18.4.2011 9:12:19 | Computer Name = COREDUO | Source = Service Control Manager | ID = 7023
Description = Palvelu Sovellusten hallinta lopetettiin virheen takia. Virhe: %%126

Error - 18.4.2011 9:12:19 | Computer Name = COREDUO | Source = Service Control Manager | ID = 7023
Description = Palvelu Sovellusten hallinta lopetettiin virheen takia. Virhe: %%126

Error - 18.4.2011 9:12:19 | Computer Name = COREDUO | Source = Service Control Manager | ID = 7023
Description = Palvelu Sovellusten hallinta lopetettiin virheen takia. Virhe: %%126

Error - 18.4.2011 9:12:19 | Computer Name = COREDUO | Source = Service Control Manager | ID = 7023
Description = Palvelu Sovellusten hallinta lopetettiin virheen takia. Virhe: %%126

Error - 18.4.2011 9:12:19 | Computer Name = COREDUO | Source = Service Control Manager | ID = 7023
Description = Palvelu Sovellusten hallinta lopetettiin virheen takia. Virhe: %%126

Error - 18.4.2011 9:12:19 | Computer Name = COREDUO | Source = Service Control Manager | ID = 7023
Description = Palvelu Sovellusten hallinta lopetettiin virheen takia. Virhe: %%126

Error - 21.4.2011 12:14:06 | Computer Name = COREDUO | Source = Service Control Manager | ID = 7034
Description = Palvelu Process Monitor lopetti yllättäen toimintansa. Se on tehnyt
näin jo 1 kertaa.

Error - 21.4.2011 12:28:09 | Computer Name = COREDUO | Source = Service Control Manager | ID = 7034
Description = Palvelu Process Monitor lopetti yllättäen toimintansa. Se on tehnyt
näin jo 1 kertaa.

Error - 22.4.2011 4:18:33 | Computer Name = COREDUO | Source = Service Control Manager | ID = 7034
Description = Palvelu Process Monitor lopetti yllättäen toimintansa. Se on tehnyt
näin jo 1 kertaa.


< End of report >
Poistin adv- kansion kokonaan, katotaan korjaako ongelman. Aika outoa sinänsä, koska tätä ei ole ennen tapahtunut ja sopcast on streaming softa, jota olen käyttänyt jo toista vuotta. Tämä virus ei alunperin tullut edes sopcastin kautta, vaan nettisivulta, jossa streamasin divxn kautta. No, mutta tuo combofixi taisi löytää siis jotain epäilyttävää.
Mainos
_
__
 
_
AfterDawn Addict
_
22. huhtikuuta 2011 @ 17:46 _ Linkki tähän viestiin    Lähetä käyttäjälle yksityisviesti   
.
Jo vain !!!
ComboFix löyti poisti ja korjasi


((((((((((((((((((((( Muut poistot ))))))))))))))))))

c:\windows\Tasks\{35DC3473-A719-4d14-B7C1-FD326CA84A0C}.job
.
Saastunut kopio tiedostosta c:\windows\system32\drivers\volsnap.sys löytyi ja poistettiin
Puhdas kopio palautettiin paikasta - Kitty had a snack :p


*.job => ajastettu toiminto (kännistellyt jotain sopimatonta)

Tämä => c:\windows\system32\drivers\volsnap.sys kuuluu Winukan käyttiksen
tiedostoihin, mutta virus oli sen saastuttanut.
ComboFix poisti sen ja korvasi terveellä.

XP:ssä tervekin tiedosto voi saastua,

Tämän => SopCast.exe voi tarkistuttaa Jotissa onko puhas.

-----------------------------------------------------

Kopioi alla olevasta laatikosta kaikki muistiin. (Ctrl+C)


:OTL

FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}:6.0.20
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA}:6.0.21
FF - prefs.js..extensions.enabledItems: {e4a8a97b-f2ed-450b-b12d-ee082ba24781}:0.8.20100408.6
FF - prefs.js..extensions.enabledItems: {d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}:1.3.3
FF - prefs.js..extensions.enabledItems: {8D03DB51-DA47-46a9-8F14-53ABE84263F5}:1.0
O2 - BHO: (AVG Safe Search) - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - Reg Error: Value error. File not found
O3 - HKU\S-1-5-21-1957994488-413027322-839522115-1004\..\Toolbar\ShellBrowser: (no name) - {CCC7A320-B3CA-4199-B1A6-9F516DD69829} - No CLSID value found.
:commands
[EMPTYTEMP]
[EMPTYFLASH]

Käynnistä OTL.EXE ohjelma. (Vista / 7 tee hiiren kakkosnapilla ja JV:nä)
Liitä muistista texti OTL:n valkoiseen laatikkoon (Custom Scans/Fixes)
Paina sitten Run Fix nappia
Lopuksi se pyytää koneen ReStarttia => OK
Logi aukeaa muistioon josta kopioit sen viestiisi.
Tällä kertaa ei tule enään Extra.txt logia.

*********************************************************************


Mikä siellä koneella on tilanne 

Toimiiko ???
:)


:)

(:)
afterdawn.com > keskustelu > yleistä keskustelua tietokoneista > virukset ja haittaohjelmat - hijackthis -logit > apua todella tarvitaan,
 

Apua ongelmiin: AfterDawnin keskustelualueet | AfterDawnin Vastaukset
Uutiset: IT-alan uutiset | Uutisia puhelimista
Musiikkia: MP3Lizard.com
Tuotearviot: Laitevertailu | Vertaa puhelimia | Vertaa kännykkäliittymiä
Pelit: Pelitiedostot, pelidemot ja trailerit
Ohjelmat: download.fi | AfterDawnin ohjelma-alueet
International: AfterDawn in English | Software downloads | Free, legal MP3s | AfterDawn på svenska
RSS -syötteet: AfterDawnin uutiset | Uusimmat ohjelmapäivitykset | Keskustelualueiden viestit
Tietoja: Tietoa AfterDawn Oy:stä | Mainosta sivuillamme | Sivuston käyttöehdot ja tietoja yksityisyydensuojasta
Ota yhteyttä: Lähetä palautetta | Ota yhteyttä mainosmyyntiimme
 
  © 1999-2025 AfterDawn Oy