Noniin sama juttu mutta kuvaamammalla otsikolla.
Tässä ois sitte se Hjt-loki =)

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 10:26:56, on 25.11.2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16544)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\PnkBstrA.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Windows Media Player\WMPNSCFG.exe
C:\Program Files\Logitech\SetPoint\SetPoint.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Common Files\Logitech\KHAL\KHALMNPR.EXE
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = "C:\Program Files\Outlook Express\msimn.exe"
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Microsoft Internet Explorer - toimittaja Elisa Internet
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.fi;<local>
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Linkit
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O2 - BHO: EpsonToolBandKicker Class - {E99421FB-68DD-40F0-B4AC-B7027CAE2F1A} - C:\Program Files\EPSON\EPSON Web-To-Page\EPSON Web-To-Page.dll
O3 - Toolbar: EPSON Web-To-Page - {EE5D279F-081B-4404-994D-C6B60AAEBA6D} - C:\Program Files\EPSON\EPSON Web-To-Page\EPSON Web-To-Page.dll
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe"
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [Logitech Hardware Abstraction Layer] KHALMNPR.EXE
O4 - HKLM\..\Run: [Cmaudio] RunDll32 cmicnfg.cpl,CMICtrlWnd
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
O4 - HKCU\..\Run: [LDM] C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [OM2_Monitor] "C:\Program Files\OLYMPUS\OLYMPUS Master 2\MMonitor.exe" -NoStart
O4 - HKCU\..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe
O4 - HKCU\..\Policies\Explorer\Run: [NTSpool] NTSpool.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Paikallinen palve')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Verkkopalve')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Startup: Adobe Gamma.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: Logitech Desktop Messenger.lnk = C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe
O4 - Global Startup: Logitech SetPoint.lnk = C:\Program Files\Logitech\SetPoint\SetPoint.exe
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Palvelut - {31D4C741-D7C0-4BE5-B05A-A705D772C4F9} - http://service.kolumbus.fi/ (file missing) (HKCU)
O9 - Extra button: SMS-viesti - {BF0B4CCD-C85B-4C0C-8AE7-0F8664E33FB2} - http://sms.kolumbus.fi/ (file missing) (HKCU)
O9 - Extra button: Tuki - {E600F531-77B0-4B26-9813-5CC61D30884F} - http://tuki.elisa.net/ (file missing) (HKCU)
O14 - IERESET.INF: START_PAGE_URL=http://elisa.net/
O16 - DPF: {00B71CFB-6864-4346-A978-C0A14556272C} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab31267.cab
O16 - DPF: {20A60F0D-9AFA-4515-A0FD-83BD84642501} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab56986.cab
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/Mes...nt.cab31267.cab
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (MSN Games - Installer) - http://messenger.zone.msn.com/binary/ZIntro.cab56649.cab
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/Mes...nt.cab56907.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/sh...ash/swflash.cab
O18 - Protocol: bwfile-8876480 - {9462A756-7B47-47BC-8C80-C34B9B80B32B} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\GAPlugProtocol-8876480.dll
O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft AB - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPodService - Unknown owner - C:\Program Files\iPod\bin\iPodService.exe (file missing)
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\system32\PnkBstrA.exe
O23 - Service: Sunbelt Personal Firewall 4 (SPF4) - Sunbelt Software - C:\Program Files\Sunbelt Software\Personal Firewall\kpf4ss.exe

--
End of file - 8361 bytes

moi

Lataa SDFix by AndyManchesta ja tallenna se työpöydällesi.

Käynnistä koneesi vikasietotilaan ja valitse tavallinen käyttäjätilisi:
*Käynnistä tietokone
*Kun kuulet koneen piippaavan, paina F8, kuitenkin ennen Windowsin logon esiintuloa
*Seuraavaksi pitäisi ilmestyä valikko
*Valitse valikosta vikasietotila.

* Kun vikasietotilassa, pura tiedoston SDFix.zip sisältö (SDFix kansio). Työpöydälle ilmestyy sdfix.exe. Tuplakilikkaa sitä, niin tiedosto purkaantuu ja asentaa itsensä siihen levyasemaan, minne on käyttöjärjestelmä on asennettu ja juureen ilmestyy kansio SDFix, ESIM c:\SDFix
* Avaa SDFix-kansio ja tuplaklikkaa tiedostoa RunThis.bat käynnistääksesi ohjelman.
* Paina Y käynnistääksesi skriptin.
* Työkalu puhdistaa troijalaisen palvelut ja tekee myös joitakin korjauksia rekisteriin. Lopuksi se pyytää käynnistämään koneen uudelleen, "Press any key to Reboot".
* Paina mitä tahansa näppäintä ja kone käynnistyy uudelleen.
* Käynnistyminen kestää normaalia kauemmin sillä SDFix puhdistaa konetta.
* Kun kone on käynnistynyt ja työpöytä latautunut, SDFix kertoo että puhdistus on suoritettu, "Finished".
* Paina sitten mitä tahansa näppäintä sulkeaksesi skriptin ja ladataksesi pikakuvakkeet työpöydälle.
* Lopuksi avaa SDFix kansio (työpöydällä) ja kopioi & liitä tiedoston Report.txt sisältö viestiketjuusi uuden HijackThis lokin kera.

Juu tässä olis noita raportteja. Ajoin jo eilen ton SDfixin mut hölmö ku olin se raportti meni sen SDfixin mukana ku poistin sen, mutta se kyllä löys jotai viiruksia. Tässä ny kumminki uus hjt ja sdfix raportti.


SDFix: Version 1.115

Run by Erkki Orlimo on ti 27.11.2007 at 17:17

Microsoft Windows XP [versio 5.1.2600]

Running From: C:\DOCUME~1\ERKKIO~1\TYPYT~1\SDFix

Safe Mode:
Checking Services:


Restoring Windows Registry Values
Restoring Windows Default Hosts File

Rebooting...


Normal Mode:
Checking Files:

No Trojan Files Found





Removing Temp Files...

ADS Check:

C:\WINDOWS
No streams found.

C:\WINDOWS\system32
No streams found.

C:\WINDOWS\system32\svchost.exe
No streams found.

C:\WINDOWS\system32\ntoskrnl.exe
No streams found.



Final Check:

catchme 0.3.1262.1 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2007-11-27 17:28:18
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

IPC error: 2 Määritettyä tiedostoa ei löydy.
scanning hidden services & system hive ...

scanning hidden registry entries ...

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\\x90\x2022\x20ac|\xff\xff\xff\xff"\x2022\x20ac|\xf9\x2022\xd3w\2]
"b049C053C7D38EE4AB9A00CB3B5D2472"="C?\Program Files\Common Files\Microsoft Shared\Web Folders\PUBPLACE.HTT"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\\x90\x2022\x20ac|\xff\xff\xff\xff"\x2022\x20ac|\xfe\xbb\xd3w\2]
"b049C053C7D38EE4AB9A00CB3B5D2472"="C?\Program Files\Common Files\Microsoft Shared\Web Folders\PUBPLACE.HTT"

scanning hidden files ...

C:\Documents and Settings\Erkki Orlimo\Local Settings\Application Data\Microsoft\Messenger\anazoman@hotmail.com\SharingMetadata\atte.hottola@gmail.com\DFSR\Staging\CS{6E897691-E91B-2825-07AB-FE7DEEDC0CD9}\01\10-{6E897691-E91B-2825-07AB-FE7DEEDC0CD9}-v1-{9E1DB167-C244-4426-87DF-16F50C0C6EC2}-v10-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.XPRESS 8 bytes hidden from API
C:\Documents and Settings\Erkki Orlimo\Local Settings\Application Data\Microsoft\Messenger\anazoman@hotmail.com\SharingMetadata\janinho_@hotmail.com\DFSR\Staging\CS{90045B2A-7BCB-BAE9-B633-E8549147FA3A}\01\13-{90045B2A-7BCB-BAE9-B633-E8549147FA3A}-v1-{9E1DB167-C244-4426-87DF-16F50C0C6EC2}-v13-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.XPRESS 8 bytes hidden from API
C:\Documents and Settings\Erkki Orlimo\Local Settings\Application Data\Microsoft\Messenger\anazoman@hotmail.com\SharingMetadata\janinho_@hotmail.com\DFSR\Staging\CS{90045B2A-7BCB-BAE9-B633-E8549147FA3A}\14\14-{9E1DB167-C244-4426-87DF-16F50C0C6EC2}-v14-{9E1DB167-C244-4426-87DF-16F50C0C6EC2}-v14-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.rdc.1 12648 bytes hidden from API
C:\Documents and Settings\Erkki Orlimo\Local Settings\Application Data\Microsoft\Messenger\anazoman@hotmail.com\SharingMetadata\janinho_@hotmail.com\DFSR\Staging\CS{90045B2A-7BCB-BAE9-B633-E8549147FA3A}\14\14-{9E1DB167-C244-4426-87DF-16F50C0C6EC2}-v14-{9E1DB167-C244-4426-87DF-16F50C0C6EC2}-v14-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.XPRESS 1400 bytes hidden from API
C:\Documents and Settings\Erkki Orlimo\Local Settings\Application Data\Microsoft\Messenger\anazoman@hotmail.com\SharingMetadata\janinho_@hotmail.com\DFSR\Staging\CS{90045B2A-7BCB-BAE9-B633-E8549147FA3A}\15\15-{9E1DB167-C244-4426-87DF-16F50C0C6EC2}-v15-{9E1DB167-C244-4426-87DF-16F50C0C6EC2}-v15-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.rdc.1 73218 bytes hidden from API
C:\Documents and Settings\Erkki Orlimo\Local Settings\Application Data\Microsoft\Messenger\anazoman@hotmail.com\SharingMetadata\janinho_@hotmail.com\DFSR\Staging\CS{90045B2A-7BCB-BAE9-B633-E8549147FA3A}\15\15-{9E1DB167-C244-4426-87DF-16F50C0C6EC2}-v15-{9E1DB167-C244-4426-87DF-16F50C0C6EC2}-v15-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.rdc.2 5142 bytes hidden from API
C:\Documents and Settings\Erkki Orlimo\Local Settings\Application Data\Microsoft\Messenger\anazoman@hotmail.com\SharingMetadata\janinho_@hotmail.com\DFSR\Staging\CS{90045B2A-7BCB-BAE9-B633-E8549147FA3A}\15\15-{9E1DB167-C244-4426-87DF-16F50C0C6EC2}-v15-{9E1DB167-C244-4426-87DF-16F50C0C6EC2}-v15-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.XPRESS 8224 bytes hidden from API
C:\Documents and Settings\Erkki Orlimo\Local Settings\Application Data\Microsoft\Messenger\anazoman@hotmail.com\SharingMetadata\janinho_@hotmail.com\DFSR\Staging\CS{90045B2A-7BCB-BAE9-B633-E8549147FA3A}\16\16-{9E1DB167-C244-4426-87DF-16F50C0C6EC2}-v16-{9E1DB167-C244-4426-87DF-16F50C0C6EC2}-v16-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.rdc.1 70212 bytes hidden from API
C:\Documents and Settings\Erkki Orlimo\Local Settings\Application Data\Microsoft\Messenger\anazoman@hotmail.com\SharingMetadata\janinho_@hotmail.com\DFSR\Staging\CS{90045B2A-7BCB-BAE9-B633-E8549147FA3A}\16\16-{9E1DB167-C244-4426-87DF-16F50C0C6EC2}-v16-{9E1DB167-C244-4426-87DF-16F50C0C6EC2}-v16-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.rdc.2 4908 bytes hidden from API
C:\Documents and Settings\Erkki Orlimo\Local Settings\Application Data\Microsoft\Messenger\anazoman@hotmail.com\SharingMetadata\janinho_@hotmail.com\DFSR\Staging\CS{90045B2A-7BCB-BAE9-B633-E8549147FA3A}\16\16-{9E1DB167-C244-4426-87DF-16F50C0C6EC2}-v16-{9E1DB167-C244-4426-87DF-16F50C0C6EC2}-v16-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.XPRESS 7840 bytes hidden from API
C:\Documents and Settings\Erkki Orlimo\Local Settings\Application Data\Microsoft\Messenger\anazoman@hotmail.com\SharingMetadata\janinho_@hotmail.com\DFSR\Staging\CS{90045B2A-7BCB-BAE9-B633-E8549147FA3A}\17\17-{9E1DB167-C244-4426-87DF-16F50C0C6EC2}-v17-{9E1DB167-C244-4426-87DF-16F50C0C6EC2}-v17-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.rdc.1 10776 bytes hidden from API
C:\Documents and Settings\Erkki Orlimo\Local Settings\Application Data\Microsoft\Messenger\anazoman@hotmail.com\SharingMetadata\janinho_@hotmail.com\DFSR\Staging\CS{90045B2A-7BCB-BAE9-B633-E8549147FA3A}\17\17-{9E1DB167-C244-4426-87DF-16F50C0C6EC2}-v17-{9E1DB167-C244-4426-87DF-16F50C0C6EC2}-v17-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.XPRESS 1192 bytes hidden from API
C:\Documents and Settings\Erkki Orlimo\Local Settings\Application Data\Microsoft\Messenger\anazoman@hotmail.com\SharingMetadata\janinho_@hotmail.com\DFSR\Staging\CS{90045B2A-7BCB-BAE9-B633-E8549147FA3A}\18\18-{9E1DB167-C244-4426-87DF-16F50C0C6EC2}-v18-{9E1DB167-C244-4426-87DF-16F50C0C6EC2}-v18-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.rdc.1 34428 bytes hidden from API
C:\Documents and Settings\Erkki Orlimo\Local Settings\Application Data\Microsoft\Messenger\anazoman@hotmail.com\SharingMetadata\janinho_@hotmail.com\DFSR\Staging\CS{90045B2A-7BCB-BAE9-B633-E8549147FA3A}\18\18-{9E1DB167-C244-4426-87DF-16F50C0C6EC2}-v18-{9E1DB167-C244-4426-87DF-16F50C0C6EC2}-v18-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.rdc.2 2604 bytes hidden from API
C:\Documents and Settings\Erkki Orlimo\Local Settings\Application Data\Microsoft\Messenger\anazoman@hotmail.com\SharingMetadata\janinho_@hotmail.com\DFSR\Staging\CS{90045B2A-7BCB-BAE9-B633-E8549147FA3A}\18\18-{9E1DB167-C244-4426-87DF-16F50C0C6EC2}-v18-{9E1DB167-C244-4426-87DF-16F50C0C6EC2}-v18-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.XPRESS 3760 bytes hidden from API
C:\Documents and Settings\Erkki Orlimo\Local Settings\Application Data\Microsoft\Messenger\anazoman@hotmail.com\SharingMetadata\janinho_@hotmail.com\DFSR\Staging\CS{90045B2A-7BCB-BAE9-B633-E8549147FA3A}\19\19-{9E1DB167-C244-4426-87DF-16F50C0C6EC2}-v19-{9E1DB167-C244-4426-87DF-16F50C0C6EC2}-v19-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.rdc.1 57234 bytes hidden from API
C:\Documents and Settings\Erkki Orlimo\Local Settings\Application Data\Microsoft\Messenger\anazoman@hotmail.com\SharingMetadata\janinho_@hotmail.com\DFSR\Staging\CS{90045B2A-7BCB-BAE9-B633-E8549147FA3A}\19\19-{9E1DB167-C244-4426-87DF-16F50C0C6EC2}-v19-{9E1DB167-C244-4426-87DF-16F50C0C6EC2}-v19-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.rdc.2 4260 bytes hidden from API
C:\Documents and Settings\Erkki Orlimo\Local Settings\Application Data\Microsoft\Messenger\anazoman@hotmail.com\SharingMetadata\janinho_@hotmail.com\DFSR\Staging\CS{90045B2A-7BCB-BAE9-B633-E8549147FA3A}\19\19-{9E1DB167-C244-4426-87DF-16F50C0C6EC2}-v19-{9E1DB167-C244-4426-87DF-16F50C0C6EC2}-v19-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.XPRESS 6360 bytes hidden from API
C:\Documents and Settings\Erkki Orlimo\Local Settings\Application Data\Microsoft\Messenger\anazoman@hotmail.com\SharingMetadata\janinho_@hotmail.com\DFSR\Staging\CS{90045B2A-7BCB-BAE9-B633-E8549147FA3A}\20\20-{9E1DB167-C244-4426-87DF-16F50C0C6EC2}-v20-{9E1DB167-C244-4426-87DF-16F50C0C6EC2}-v20-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.rdc.1 5934 bytes hidden from API
C:\Documents and Settings\Erkki Orlimo\Local Settings\Application Data\Microsoft\Messenger\anazoman@hotmail.com\SharingMetadata\janinho_@hotmail.com\DFSR\Staging\CS{90045B2A-7BCB-BAE9-B633-E8549147FA3A}\20\20-{9E1DB167-C244-4426-87DF-16F50C0C6EC2}-v20-{9E1DB167-C244-4426-87DF-16F50C0C6EC2}-v20-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.XPRESS 672 bytes hidden from API
C:\Documents and Settings\Erkki Orlimo\Local Settings\Application Data\Microsoft\Messenger\anazoman@hotmail.com\SharingMetadata\janinho_@hotmail.com\DFSR\Staging\CS{90045B2A-7BCB-BAE9-B633-E8549147FA3A}\22\22-{9E1DB167-C244-4426-87DF-16F50C0C6EC2}-v22-{9E1DB167-C244-4426-87DF-16F50C0C6EC2}-v22-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.rdc.1 28650 bytes hidden from API
C:\Documents and Settings\Erkki Orlimo\Local Settings\Application Data\Microsoft\Messenger\anazoman@hotmail.com\SharingMetadata\janinho_@hotmail.com\DFSR\Staging\CS{90045B2A-7BCB-BAE9-B633-E8549147FA3A}\22\22-{9E1DB167-C244-4426-87DF-16F50C0C6EC2}-v22-{9E1DB167-C244-4426-87DF-16F50C0C6EC2}-v22-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.rdc.2 2028 bytes hidden from API
C:\Documents and Settings\Erkki Orlimo\Local Settings\Application Data\Microsoft\Messenger\anazoman@hotmail.com\SharingMetadata\janinho_@hotmail.com\DFSR\Staging\CS{90045B2A-7BCB-BAE9-B633-E8549147FA3A}\22\22-{9E1DB167-C244-4426-87DF-16F50C0C6EC2}-v22-{9E1DB167-C244-4426-87DF-16F50C0C6EC2}-v22-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.XPRESS 3208 bytes hidden from API
C:\Documents and Settings\Erkki Orlimo\Local Settings\Application Data\Microsoft\Messenger\anazoman@hotmail.com\SharingMetadata\janinho_@hotmail.com\DFSR\Staging\CS{90045B2A-7BCB-BAE9-B633-E8549147FA3A}\23\23-{9E1DB167-C244-4426-87DF-16F50C0C6EC2}-v23-{9E1DB167-C244-4426-87DF-16F50C0C6EC2}-v23-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.rdc.1 47514 bytes hidden from API
C:\Documents and Settings\Erkki Orlimo\Local Settings\Application Data\Microsoft\Messenger\anazoman@hotmail.com\SharingMetadata\janinho_@hotmail.com\DFSR\Staging\CS{90045B2A-7BCB-BAE9-B633-E8549147FA3A}\23\23-{9E1DB167-C244-4426-87DF-16F50C0C6EC2}-v23-{9E1DB167-C244-4426-87DF-16F50C0C6EC2}-v23-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.rdc.2 3234 bytes hidden from API
C:\Documents and Settings\Erkki Orlimo\Local Settings\Application Data\Microsoft\Messenger\anazoman@hotmail.com\SharingMetadata\janinho_@hotmail.com\DFSR\Staging\CS{90045B2A-7BCB-BAE9-B633-E8549147FA3A}\23\23-{9E1DB167-C244-4426-87DF-16F50C0C6EC2}-v23-{9E1DB167-C244-4426-87DF-16F50C0C6EC2}-v23-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.XPRESS 5240 bytes hidden from API
C:\Documents and Settings\Erkki Orlimo\Local Settings\Application Data\Microsoft\Messenger\anazoman@hotmail.com\SharingMetadata\janinho_@hotmail.com\DFSR\Staging\CS{90045B2A-7BCB-BAE9-B633-E8549147FA3A}\24\24-{9E1DB167-C244-4426-87DF-16F50C0C6EC2}-v24-{9E1DB167-C244-4426-87DF-16F50C0C6EC2}-v24-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.rdc.1 15186 bytes hidden from API
C:\Documents and Settings\Erkki Orlimo\Local Settings\Application Data\Microsoft\Messenger\anazoman@hotmail.com\SharingMetadata\janinho_@hotmail.com\DFSR\Staging\CS{90045B2A-7BCB-BAE9-B633-E8549147FA3A}\24\24-{9E1DB167-C244-4426-87DF-16F50C0C6EC2}-v24-{9E1DB167-C244-4426-87DF-16F50C0C6EC2}-v24-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.XPRESS 1656 bytes hidden from API
C:\Documents and Settings\Erkki Orlimo\Local Settings\Application Data\Microsoft\Messenger\anazoman@hotmail.com\SharingMetadata\janinho_@hotmail.com\DFSR\Staging\CS{90045B2A-7BCB-BAE9-B633-E8549147FA3A}\25\25-{9E1DB167-C244-4426-87DF-16F50C0C6EC2}-v25-{9E1DB167-C244-4426-87DF-16F50C0C6EC2}-v25-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.rdc.1 38604 bytes hidden from API
C:\Documents and Settings\Erkki Orlimo\Local Settings\Application Data\Microsoft\Messenger\anazoman@hotmail.com\SharingMetadata\janinho_@hotmail.com\DFSR\Staging\CS{90045B2A-7BCB-BAE9-B633-E8549147FA3A}\25\25-{9E1DB167-C244-4426-87DF-16F50C0C6EC2}-v25-{9E1DB167-C244-4426-87DF-16F50C0C6EC2}-v25-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.rdc.2 2712 bytes hidden from API
C:\Documents and Settings\Erkki Orlimo\Local Settings\Application Data\Microsoft\Messenger\anazoman@hotmail.com\SharingMetadata\janinho_@hotmail.com\DFSR\Staging\CS{90045B2A-7BCB-BAE9-B633-E8549147FA3A}\25\25-{9E1DB167-C244-4426-87DF-16F50C0C6EC2}-v25-{9E1DB167-C244-4426-87DF-16F50C0C6EC2}-v25-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.XPRESS 4320 bytes hidden from API
C:\Documents and Settings\Erkki Orlimo\Local Settings\Application Data\Microsoft\Messenger\anazoman@hotmail.com\SharingMetadata\janinho_@hotmail.com\DFSR\Staging\CS{90045B2A-7BCB-BAE9-B633-E8549147FA3A}\27\27-{9E1DB167-C244-4426-87DF-16F50C0C6EC2}-v27-{9E1DB167-C244-4426-87DF-16F50C0C6EC2}-v27-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.rdc.1 1776 bytes hidden from API
C:\Documents and Settings\Erkki Orlimo\Local Settings\Application Data\Microsoft\Messenger\anazoman@hotmail.com\SharingMetadata\janinho_@hotmail.com\DFSR\Staging\CS{90045B2A-7BCB-BAE9-B633-E8549147FA3A}\27\27-{9E1DB167-C244-4426-87DF-16F50C0C6EC2}-v27-{9E1DB167-C244-4426-87DF-16F50C0C6EC2}-v27-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.XPRESS 184 bytes hidden from API
C:\Documents and Settings\Erkki Orlimo\Local Settings\Application Data\Microsoft\Messenger\anazoman@hotmail.com\SharingMetadata\janinho_@hotmail.com\DFSR\Staging\CS{90045B2A-7BCB-BAE9-B633-E8549147FA3A}\28\28-{9E1DB167-C244-4426-87DF-16F50C0C6EC2}-v28-{9E1DB167-C244-4426-87DF-16F50C0C6EC2}-v28-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.rdc.1 117750 bytes hidden from API
C:\Documents and Settings\Erkki Orlimo\Local Settings\Application Data\Microsoft\Messenger\anazoman@hotmail.com\SharingMetadata\janinho_@hotmail.com\DFSR\Staging\CS{90045B2A-7BCB-BAE9-B633-E8549147FA3A}\28\28-{9E1DB167-C244-4426-87DF-16F50C0C6EC2}-v28-{9E1DB167-C244-4426-87DF-16F50C0C6EC2}-v28-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.rdc.2 8346 bytes hidden from API
C:\Documents and Settings\Erkki Orlimo\Local Settings\Application Data\Microsoft\Messenger\anazoman@hotmail.com\SharingMetadata\janinho_@hotmail.com\DFSR\Staging\CS{90045B2A-7BCB-BAE9-B633-E8549147FA3A}\28\28-{9E1DB167-C244-4426-87DF-16F50C0C6EC2}-v28-{9E1DB167-C244-4426-87DF-16F50C0C6EC2}-v28-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.XPRESS 13048 bytes hidden from API
C:\Documents and Settings\Erkki Orlimo\Local Settings\Application Data\Microsoft\Messenger\anazoman@hotmail.com\SharingMetadata\janinho_@hotmail.com\DFSR\Staging\CS{90045B2A-7BCB-BAE9-B633-E8549147FA3A}\29\29-{9E1DB167-C244-4426-87DF-16F50C0C6EC2}-v29-{9E1DB167-C244-4426-87DF-16F50C0C6EC2}-v29-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.rdc.1 12540 bytes hidden from API
C:\Documents and Settings\Erkki Orlimo\Local Settings\Application Data\Microsoft\Messenger\anazoman@hotmail.com\SharingMetadata\janinho_@hotmail.com\DFSR\Staging\CS{90045B2A-7BCB-BAE9-B633-E8549147FA3A}\29\29-{9E1DB167-C244-4426-87DF-16F50C0C6EC2}-v29-{9E1DB167-C244-4426-87DF-16F50C0C6EC2}-v29-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.XPRESS 1400 bytes hidden from API
C:\Documents and Settings\Erkki Orlimo\Local Settings\Application Data\Microsoft\Messenger\anazoman@hotmail.com\SharingMetadata\janinho_@hotmail.com\DFSR\Staging\CS{90045B2A-7BCB-BAE9-B633-E8549147FA3A}\30\30-{9E1DB167-C244-4426-87DF-16F50C0C6EC2}-v30-{9E1DB167-C244-4426-87DF-16F50C0C6EC2}-v30-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.rdc.1 78600 bytes hidden from API
C:\Documents and Settings\Erkki Orlimo\Local Settings\Application Data\Microsoft\Messenger\anazoman@hotmail.com\SharingMetadata\janinho_@hotmail.com\DFSR\Staging\CS{90045B2A-7BCB-BAE9-B633-E8549147FA3A}\30\30-{9E1DB167-C244-4426-87DF-16F50C0C6EC2}-v30-{9E1DB167-C244-4426-87DF-16F50C0C6EC2}-v30-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.rdc.2 5610 bytes hidden from API
C:\Documents and Settings\Erkki Orlimo\Local Settings\Application Data\Microsoft\Messenger\anazoman@hotmail.com\SharingMetadata\janinho_@hotmail.com\DFSR\Staging\CS{90045B2A-7BCB-BAE9-B633-E8549147FA3A}\30\30-{9E1DB167-C244-4426-87DF-16F50C0C6EC2}-v30-{9E1DB167-C244-4426-87DF-16F50C0C6EC2}-v30-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.XPRESS 8688 bytes hidden from API
C:\Documents and Settings\Erkki Orlimo\Local Settings\Application Data\Microsoft\Messenger\anazoman@hotmail.com\SharingMetadata\janinho_@hotmail.com\DFSR\Staging\CS{90045B2A-7BCB-BAE9-B633-E8549147FA3A}\31\31-{9E1DB167-C244-4426-87DF-16F50C0C6EC2}-v31-{9E1DB167-C244-4426-87DF-16F50C0C6EC2}-v31-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.rdc.1 66792 bytes hidden from API
C:\Documents and Settings\Erkki Orlimo\Local Settings\Application Data\Microsoft\Messenger\anazoman@hotmail.com\SharingMetadata\janinho_@hotmail.com\DFSR\Staging\CS{90045B2A-7BCB-BAE9-B633-E8549147FA3A}\31\31-{9E1DB167-C244-4426-87DF-16F50C0C6EC2}-v31-{9E1DB167-C244-4426-87DF-16F50C0C6EC2}-v31-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.rdc.2 4872 bytes hidden from API
C:\Documents and Settings\Erkki Orlimo\Local Settings\Application Data\Microsoft\Messenger\anazoman@hotmail.com\SharingMetadata\janinho_@hotmail.com\DFSR\Staging\CS{90045B2A-7BCB-BAE9-B633-E8549147FA3A}\31\31-{9E1DB167-C244-4426-87DF-16F50C0C6EC2}-v31-{9E1DB167-C244-4426-87DF-16F50C0C6EC2}-v31-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.XPRESS 7344 bytes hidden from API
C:\Documents and Settings\Erkki Orlimo\Local Settings\Application Data\Microsoft\Messenger\anazoman@hotmail.com\SharingMetadata\janinho_@hotmail.com\DFSR\Staging\CS{90045B2A-7BCB-BAE9-B633-E8549147FA3A}\32\32-{9E1DB167-C244-4426-87DF-16F50C0C6EC2}-v32-{9E1DB167-C244-4426-87DF-16F50C0C6EC2}-v32-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.rdc.1 36174 bytes hidden from API
C:\Documents and Settings\Erkki Orlimo\Local Settings\Application Data\Microsoft\Messenger\anazoman@hotmail.com\SharingMetadata\janinho_@hotmail.com\DFSR\Staging\CS{90045B2A-7BCB-BAE9-B633-E8549147FA3A}\32\32-{9E1DB167-C244-4426-87DF-16F50C0C6EC2}-v32-{9E1DB167-C244-4426-87DF-16F50C0C6EC2}-v32-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.rdc.2 2496 bytes hidden from API
C:\Documents and Settings\Erkki Orlimo\Local Settings\Application Data\Microsoft\Messenger\anazoman@hotmail.com\SharingMetadata\janinho_@hotmail.com\DFSR\Staging\CS{90045B2A-7BCB-BAE9-B633-E8549147FA3A}\32\32-{9E1DB167-C244-4426-87DF-16F50C0C6EC2}-v32-{9E1DB167-C244-4426-87DF-16F50C0C6EC2}-v32-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.XPRESS 4088 bytes hidden from API
C:\Documents and Settings\Erkki Orlimo\Local Settings\Application Data\Microsoft\Messenger\anazoman@hotmail.com\SharingMetadata\janinho_@hotmail.com\DFSR\Staging\CS{90045B2A-7BCB-BAE9-B633-E8549147FA3A}\33\33-{9E1DB167-C244-4426-87DF-16F50C0C6EC2}-v33-{9E1DB167-C244-4426-87DF-16F50C0C6EC2}-v33-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.rdc.1 1884 bytes hidden from API
C:\Documents and Settings\Erkki Orlimo\Local Settings\Application Data\Microsoft\Messenger\anazoman@hotmail.com\SharingMetadata\janinho_@hotmail.com\DFSR\Staging\CS{90045B2A-7BCB-BAE9-B633-E8549147FA3A}\33\33-{9E1DB167-C244-4426-87DF-16F50C0C6EC2}-v33-{9E1DB167-C244-4426-87DF-16F50C0C6EC2}-v33-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.XPRESS 208 bytes hidden from API
C:\Documents and Settings\Erkki Orlimo\Local Settings\Application Data\Microsoft\Messenger\anazoman@hotmail.com\SharingMetadata\janinho_@hotmail.com\DFSR\Staging\CS{90045B2A-7BCB-BAE9-B633-E8549147FA3A}\34\34-{9E1DB167-C244-4426-87DF-16F50C0C6EC2}-v34-{9E1DB167-C244-4426-87DF-16F50C0C6EC2}-v34-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.rdc.1 22512 bytes hidden from API
C:\Documents and Settings\Erkki Orlimo\Local Settings\Application Data\Microsoft\Messenger\anazoman@hotmail.com\SharingMetadata\janinho_@hotmail.com\DFSR\Staging\CS{90045B2A-7BCB-BAE9-B633-E8549147FA3A}\34\34-{9E1DB167-C244-4426-87DF-16F50C0C6EC2}-v34-{9E1DB167-C244-4426-87DF-16F50C0C6EC2}-v34-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.rdc.2 1596 bytes hidden from API
C:\Documents and Settings\Erkki Orlimo\Local Settings\Application Data\Microsoft\Messenger\anazoman@hotmail.com\SharingMetadata\janinho_@hotmail.com\DFSR\Staging\CS{90045B2A-7BCB-BAE9-B633-E8549147FA3A}\34\34-{9E1DB167-C244-4426-87DF-16F50C0C6EC2}-v34-{9E1DB167-C244-4426-87DF-16F50C0C6EC2}-v34-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.XPRESS 2520 bytes hidden from API
C:\Documents and Settings\Erkki Orlimo\Local Settings\Application Data\Microsoft\Messenger\anazoman@hotmail.com\SharingMetadata\janinho_@hotmail.com\DFSR\Staging\CS{90045B2A-7BCB-BAE9-B633-E8549147FA3A}\35\35-{9E1DB167-C244-4426-87DF-16F50C0C6EC2}-v35-{9E1DB167-C244-4426-87DF-16F50C0C6EC2}-v35-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.rdc.1 19218 bytes hidden from API
C:\Documents and Settings\Erkki Orlimo\Local Settings\Application Data\Microsoft\Messenger\anazoman@hotmail.com\SharingMetadata\janinho_@hotmail.com\DFSR\Staging\CS{90045B2A-7BCB-BAE9-B633-E8549147FA3A}\35\35-{9E1DB167-C244-4426-87DF-16F50C0C6EC2}-v35-{9E1DB167-C244-4426-87DF-16F50C0C6EC2}-v35-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.rdc.2 1452 bytes hidden from API
C:\Documents and Settings\Erkki Orlimo\Local Settings\Application Data\Microsoft\Messenger\anazoman@hotmail.com\SharingMetadata\janinho_@hotmail.com\DFSR\Staging\CS{90045B2A-7BCB-BAE9-B633-E8549147FA3A}\35\35-{9E1DB167-C244-4426-87DF-16F50C0C6EC2}-v35-{9E1DB167-C244-4426-87DF-16F50C0C6EC2}-v35-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.XPRESS 2136 bytes hidden from API
C:\Documents and Settings\Erkki Orlimo\Local Settings\Application Data\Microsoft\Messenger\anazoman@hotmail.com\SharingMetadata\janinho_@hotmail.com\DFSR\Staging\CS{90045B2A-7BCB-BAE9-B633-E8549147FA3A}\36\36-{9E1DB167-C244-4426-87DF-16F50C0C6EC2}-v36-{9E1DB167-C244-4426-87DF-16F50C0C6EC2}-v36-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.rdc.1 30396 bytes hidden from API
C:\Documents and Settings\Erkki Orlimo\Local Settings\Application Data\Microsoft\Messenger\anazoman@hotmail.com\SharingMetadata\janinho_@hotmail.com\DFSR\Staging\CS{90045B2A-7BCB-BAE9-B633-E8549147FA3A}\36\36-{9E1DB167-C244-4426-87DF-16F50C0C6EC2}-v36-{9E1DB167-C244-4426-87DF-16F50C0C6EC2}-v36-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.rdc.2 2082 bytes hidden from API
C:\Documents and Settings\Erkki Orlimo\Local Settings\Application Data\Microsoft\Messenger\anazoman@hotmail.com\SharingMetadata\janinho_@hotmail.com\DFSR\Staging\CS{90045B2A-7BCB-BAE9-B633-E8549147FA3A}\36\36-{9E1DB167-C244-4426-87DF-16F50C0C6EC2}-v36-{9E1DB167-C244-4426-87DF-16F50C0C6EC2}-v36-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.XPRESS 3400 bytes hidden from API
C:\Documents and Settings\Erkki Orlimo\Local Settings\Application Data\Microsoft\Messenger\anazoman@hotmail.com\SharingMetadata\janinho_@hotmail.com\DFSR\Staging\CS{90045B2A-7BCB-BAE9-B633-E8549147FA3A}\37\37-{9E1DB167-C244-4426-87DF-16F50C0C6EC2}-v37-{9E1DB167-C244-4426-87DF-16F50C0C6EC2}-v37-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.rdc.1 41682 bytes hidden from API
C:\Documents and Settings\Erkki Orlimo\Local Settings\Application Data\Microsoft\Messenger\anazoman@hotmail.com\SharingMetadata\janinho_@hotmail.com\DFSR\Staging\CS{90045B2A-7BCB-BAE9-B633-E8549147FA3A}\37\37-{9E1DB167-C244-4426-87DF-16F50C0C6EC2}-v37-{9E1DB167-C244-4426-87DF-16F50C0C6EC2}-v37-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.rdc.2 3018 bytes hidden from API
C:\Documents and Settings\Erkki Orlimo\Local Settings\Application Data\Microsoft\Messenger\anazoman@hotmail.com\SharingMetadata\janinho_@hotmail.com\DFSR\Staging\CS{90045B2A-7BCB-BAE9-B633-E8549147FA3A}\37\37-{9E1DB167-C244-4426-87DF-16F50C0C6EC2}-v37-{9E1DB167-C244-4426-87DF-16F50C0C6EC2}-v37-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.XPRESS 4736 bytes hidden from API
C:\Documents and Settings\Erkki Orlimo\Local Settings\Application Data\Microsoft\Messenger\anazoman@hotmail.com\SharingMetadata\janinho_@hotmail.com\DFSR\Staging\CS{90045B2A-7BCB-BAE9-B633-E8549147FA3A}\38\38-{9E1DB167-C244-4426-87DF-16F50C0C6EC2}-v38-{9E1DB167-C244-4426-87DF-16F50C0C6EC2}-v38-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.rdc.1 43050 bytes hidden from API
C:\Documents and Settings\Erkki Orlimo\Local Settings\Application Data\Microsoft\Messenger\anazoman@hotmail.com\SharingMetadata\janinho_@hotmail.com\DFSR\Staging\CS{90045B2A-7BCB-BAE9-B633-E8549147FA3A}\38\38-{9E1DB167-C244-4426-87DF-16F50C0C6EC2}-v38-{9E1DB167-C244-4426-87DF-16F50C0C6EC2}-v38-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.rdc.2 3036 bytes hidden from API
C:\Documents and Settings\Erkki Orlimo\Local Settings\Application Data\Microsoft\Messenger\anazoman@hotmail.com\SharingMetadata\janinho_@hotmail.com\DFSR\Staging\CS{90045B2A-7BCB-BAE9-B633-E8549147FA3A}\38\38-{9E1DB167-C244-4426-87DF-16F50C0C6EC2}-v38-{9E1DB167-C244-4426-87DF-16F50C0C6EC2}-v38-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.XPRESS 4792 bytes hidden from API
C:\Documents and Settings\Erkki Orlimo\Local Settings\Application Data\Microsoft\Messenger\anazoman@hotmail.com\SharingMetadata\janinho_@hotmail.com\DFSR\Staging\CS{90045B2A-7BCB-BAE9-B633-E8549147FA3A}\39\39-{9E1DB167-C244-4426-87DF-16F50C0C6EC2}-v39-{9E1DB167-C244-4426-87DF-16F50C0C6EC2}-v39-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.rdc.1 52500 bytes hidden from API
C:\Documents and Settings\Erkki Orlimo\Local Settings\Application Data\Microsoft\Messenger\anazoman@hotmail.com\SharingMetadata\janinho_@hotmail.com\DFSR\Staging\CS{90045B2A-7BCB-BAE9-B633-E8549147FA3A}\39\39-{9E1DB167-C244-4426-87DF-16F50C0C6EC2}-v39-{9E1DB167-C244-4426-87DF-16F50C0C6EC2}-v39-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.rdc.2 3774 bytes hidden from API
C:\Documents and Settings\Erkki Orlimo\Local Settings\Application Data\Microsoft\Messenger\anazoman@hotmail.com\SharingMetadata\janinho_@hotmail.com\DFSR\Staging\CS{90045B2A-7BCB-BAE9-B633-E8549147FA3A}\39\39-{9E1DB167-C244-4426-87DF-16F50C0C6EC2}-v39-{9E1DB167-C244-4426-87DF-16F50C0C6EC2}-v39-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.XPRESS 5856 bytes hidden from API
C:\Documents and Settings\Erkki Orlimo\Local Settings\Application Data\Microsoft\Messenger\anazoman@hotmail.com\SharingMetadata\janinho_@hotmail.com\DFSR\Staging\CS{90045B2A-7BCB-BAE9-B633-E8549147FA3A}\40\40-{9E1DB167-C244-4426-87DF-16F50C0C6EC2}-v40-{9E1DB167-C244-4426-87DF-16F50C0C6EC2}-v40-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.rdc.1 32232 bytes hidden from API
C:\Documents and Settings\Erkki Orlimo\Local Settings\Application Data\Microsoft\Messenger\anazoman@hotmail.com\SharingMetadata\janinho_@hotmail.com\DFSR\Staging\CS{90045B2A-7BCB-BAE9-B633-E8549147FA3A}\40\40-{9E1DB167-C244-4426-87DF-16F50C0C6EC2}-v40-{9E1DB167-C244-4426-87DF-16F50C0C6EC2}-v40-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.rdc.2 2334 bytes hidden from API
C:\Documents and Settings\Erkki Orlimo\Local Settings\Application Data\Microsoft\Messenger\anazoman@hotmail.com\SharingMetadata\janinho_@hotmail.com\DFSR\Staging\CS{90045B2A-7BCB-BAE9-B633-E8549147FA3A}\40\40-{9E1DB167-C244-4426-87DF-16F50C0C6EC2}-v40-{9E1DB167-C244-4426-87DF-16F50C0C6EC2}-v40-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.XPRESS 3576 bytes hidden from API
C:\Documents and Settings\Erkki Orlimo\Local Settings\Application Data\Microsoft\Messenger\anazoman@hotmail.com\SharingMetadata\janinho_@hotmail.com\DFSR\Staging\CS{90045B2A-7BCB-BAE9-B633-E8549147FA3A}\41\41-{9E1DB167-C244-4426-87DF-16F50C0C6EC2}-v41-{9E1DB167-C244-4426-87DF-16F50C0C6EC2}-v41-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.rdc.1 8418 bytes hidden from API
C:\Documents and Settings\Erkki Orlimo\Local Settings\Application Data\Microsoft\Messenger\anazoman@hotmail.com\SharingMetadata\janinho_@hotmail.com\DFSR\Staging\CS{90045B2A-7BCB-BAE9-B633-E8549147FA3A}\41\41-{9E1DB167-C244-4426-87DF-16F50C0C6EC2}-v41-{9E1DB167-C244-4426-87DF-16F50C0C6EC2}-v41-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.XPRESS 944 bytes hidden from API
C:\Documents and Settings\Erkki Orlimo\Local Settings\Application Data\Microsoft\Messenger\anazoman@hotmail.com\SharingMetadata\mazaahti@hotmail.com\DFSR\Staging\CS{204558A0-F97E-FA25-C023-2907FF5817FE}\01\12-{204558A0-F97E-FA25-C023-2907FF5817FE}-v1-{9E1DB167-C244-4426-87DF-16F50C0C6EC2}-v12-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.XPRESS 8 bytes hidden from API
C:\Documents and Settings\Erkki Orlimo\Local Settings\Application Data\Microsoft\Messenger\anazoman@hotmail.com\SharingMetadata\nico_laristo@hotmail.com\DFSR\Staging\CS{4DA097E8-FB1D-926C-C565-57ACB2B7D91C}\01\44-{4DA097E8-FB1D-926C-C565-57ACB2B7D91C}-v1-{9E1DB167-C244-4426-87DF-16F50C0C6EC2}-v44-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.XPRESS 8 bytes hidden from API

scan completed successfully
hidden processes: 0
hidden services: 0
hidden files: 74


Remaining Services:
------------------



Authorized Application Key Export:

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
"%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"C:\\Program Files\\GameSpy Arcade\\Aphex.exe"="C:\\Program Files\\GameSpy Arcade\\Aphex.exe:*:Enabled:GameSpy Arcade"
"C:\\Program Files\\Codemasters\\Worms 4 Mayhem\\WORMS 4 MAYHEM.EXE"="C:\\Program Files\\Codemasters\\Worms 4 Mayhem\\WORMS 4 MAYHEM.EXE:*:Enabled:Worms 4 Mayhem"
"C:\\Program Files\\The All-Seeing Eye\\eye.exe"="C:\\Program Files\\The All-Seeing Eye\\eye.exe:*:Enabled:Yahoo! All-Seeing Eye"
"C:\\Program Files\\Wolfenstein - Enemy Territory\\ET.exe"="C:\\Program Files\\Wolfenstein - Enemy Territory\\ET.exe:*:Enabled:ET"
"C:\\Program Files\\Mozilla Firefox\\firefox.exe"="C:\\Program Files\\Mozilla Firefox\\firefox.exe:*:Enabled:Firefox"
"C:\\Program Files\\Messenger\\msmsgs.exe"="C:\\Program Files\\Messenger\\msmsgs.exe:*:Enabled:Windows Messenger"
"C:\\Program Files\\DC++\\DCPlusPlus.exe"="C:\\Program Files\\DC++\\DCPlusPlus.exe:*:Enabled:DC++"
"C:\\Program Files\\Internet Explorer\\IEXPLORE.EXE"="C:\\Program Files\\Internet Explorer\\IEXPLORE.EXE:*:Enabled:Internet Explorer"
"C:\\Program Files\\iTunes\\iTunes.exe"="C:\\Program Files\\iTunes\\iTunes.exe:*:Enabled:iTunes"
"C:\\Program Files\\mIRC\\mirc.exe"="C:\\Program Files\\mIRC\\mirc.exe:*:Enabled:mIRC"
"C:\\Program Files\\Skype\\Phone\\Skype.exe"="C:\\Program Files\\Skype\\Phone\\Skype.exe:*:Enabled:Skype"
"C:\\Program Files\\LimeWire\\LimeWire.exe"="C:\\Program Files\\LimeWire\\LimeWire.exe:*:Enabled:LimeWire"
"C:\\Program Files\\Logitech\\Desktop Messenger\\8876480\\Program\\LogitechDesktopMessenger.exe"="C:\\Program Files\\Logitech\\Desktop Messenger\\8876480\\Program\\LogitechDesktopMessenger.exe:*:Enabled:Logitech Desktop Messenger"
"C:\\Documents and Settings\\Erkki Orlimo\\Ty?p?yt?\\utorrent.exe"="C:\\Documents and Settings\\Erkki Orlimo\\Ty?p?yt?\\utorrent.exe:*:Enabled:æTorrent"
"%windir%\\Network Diagnostic\\xpnetdiag.exe"="%windir%\\Network Diagnostic\\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"
"C:\\Program Files\\uTorrent\\utorrent.exe"="C:\\Program Files\\uTorrent\\utorrent.exe:*:Enabled:æTorrent"
"C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"="C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe:*:Enabled:Windows Live Messenger"
"C:\\Program Files\\Windows Live\\Messenger\\livecall.exe"="C:\\Program Files\\Windows Live\\Messenger\\livecall.exe:*:Enabled:Windows Live Messenger (Phone)"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
"%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"C:\\Program Files\\Logitech\\Desktop Messenger\\8876480\\Program\\LogitechDesktopMessenger.exe"="C:\\Program Files\\Logitech\\Desktop Messenger\\8876480\\Program\\LogitechDesktopMessenger.exe:*:Enabled:Logitech Desktop Messenger"
"%windir%\\Network Diagnostic\\xpnetdiag.exe"="%windir%\\Network Diagnostic\\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"
"C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"="C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe:*:Enabled:Windows Live Messenger"
"C:\\Program Files\\Windows Live\\Messenger\\livecall.exe"="C:\\Program Files\\Windows Live\\Messenger\\livecall.exe:*:Enabled:Windows Live Messenger (Phone)"

Remaining Files:
---------------


Files with Hidden Attributes:

Sat 28 Jan 2006 4,348 A.SH. --- "C:\Documents and Settings\All Users\DRM\DRMv1.bak"
Wed 1 Aug 2007 189 A..H. --- "C:\Program Files\InterActual\InterActual Player\iti2.tmp"
Mon 30 Jul 2007 0 A.SH. --- "C:\Documents and Settings\All Users\DRM\Cache\Indiv02.tmp"
Tue 3 Oct 2006 50,280 ...H. --- "C:\Program Files\Common Files\Adobe\ESD\DLMCleanup.exe"

Finished!

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 17:54:59, on 27.11.2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16544)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\PnkBstrA.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Sunbelt Software\Personal Firewall\kpf4ss.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Sunbelt Software\Personal Firewall\kpf4gui.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\Program Files\Sunbelt Software\Personal Firewall\kpf4gui.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe
C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Windows Media Player\WMPNSCFG.exe
C:\Program Files\Logitech\SetPoint\SetPoint.exe
C:\Program Files\Common Files\Logitech\KHAL\KHALMNPR.EXE
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL =

http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL =

http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page =

http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page =

http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = "C:\Program Files\Outlook

Express\msimn.exe"
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Microsoft Internet Explorer -

toimittaja Elisa Internet
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.fi;<local>
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Linkit
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program

Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Windows Liven kirjautumisapuohjelma - {9030D464-4C02-4ABF-8ECC-5164760863C6} -

C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: EpsonToolBandKicker Class - {E99421FB-68DD-40F0-B4AC-B7027CAE2F1A} -

C:\Program Files\EPSON\EPSON Web-To-Page\EPSON Web-To-Page.dll
O3 - Toolbar: EPSON Web-To-Page - {EE5D279F-081B-4404-994D-C6B60AAEBA6D} - C:\Program

Files\EPSON\EPSON Web-To-Page\EPSON Web-To-Page.dll
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [Logitech Hardware Abstraction Layer] KHALMNPR.EXE
O4 - HKLM\..\Run: [Cmaudio] RunDll32 cmicnfg.cpl,CMICtrlWnd
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE

C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe"

/minimized
O4 - HKCU\..\Run: [LDM] C:\Program Files\Logitech\Desktop

Messenger\8876480\Program\LogitechDesktopMessenger.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [OM2_Monitor] "C:\Program Files\OLYMPUS\OLYMPUS Master 2\MMonitor.exe"

-NoStart
O4 - HKCU\..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Paikallinen

palve')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User

'Verkkopalve')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default

user')
O4 - Startup: Adobe Gamma.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma

Loader.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat

7.0\Reader\reader_sl.exe
O4 - Global Startup: Logitech Desktop Messenger.lnk = C:\Program Files\Logitech\Desktop

Messenger\8876480\Program\LogitechDesktopMessenger.exe
O4 - Global Startup: Logitech SetPoint.lnk = C:\Program Files\Logitech\SetPoint\SetPoint.exe
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network

Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} -

C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Palvelut - {31D4C741-D7C0-4BE5-B05A-A705D772C4F9} - http://service.kolumbus.fi/

(file missing) (HKCU)
O9 - Extra button: SMS-viesti - {BF0B4CCD-C85B-4C0C-8AE7-0F8664E33FB2} -

http://sms.kolumbus.fi/ (file missing) (HKCU)
O9 - Extra button: Tuki - {E600F531-77B0-4B26-9813-5CC61D30884F} - http://tuki.elisa.net/ (file

missing) (HKCU)
O14 - IERESET.INF: START_PAGE_URL=http://elisa.net/
O16 - DPF: {00B71CFB-6864-4346-A978-C0A14556272C} (Checkers Class) -

http://messenger.zone.msn.com/binary/msgrchkr.cab31267.cab
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) -

http://www.kaspersky.com/kos/english/kavwebscan_unicode.cab
O16 - DPF: {20A60F0D-9AFA-4515-A0FD-83BD84642501} (Checkers Class) -

http://messenger.zone.msn.com/binary/msgrchkr.cab56986.cab
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) -

http://messenger.zone.msn.com/binary/Mes...nt.cab31267.cab
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (MSN Games - Installer) -

http://messenger.zone.msn.com/binary/ZIntro.cab56649.cab
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) -

http://messenger.zone.msn.com/binary/Mes...nt.cab56907.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) -

http://fpdownload2.macromedia.com/get/sh...ash/swflash.cab
O18 - Protocol: bwfile-8876480 - {9462A756-7B47-47BC-8C80-C34B9B80B32B} - C:\Program

Files\Logitech\Desktop Messenger\8876480\Program\GAPlugProtocol-8876480.dll
O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft AB - C:\Program

Files\Lavasoft\Ad-Aware 2007\aawservice.exe
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems

Shared\Service\Adobelmsvc.exe
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil

Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil

Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil

Software\Avast4\ashWebSv.exe
O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware

7.5\guard.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program

Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPodService - Unknown owner - C:\Program Files\iPod\bin\iPodService.exe (file missing)
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation -

C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\system32\PnkBstrA.exe
O23 - Service: Sunbelt Personal Firewall 4 (SPF4) - Sunbelt Software - C:\Program Files\Sunbelt

Software\Personal Firewall\kpf4ss.exe

--
End of file - 8385 bytes

kerro jo näistä löytyy viel jotaki. Kiitos! =)

moi
sdfixis tapahtu joku virhe :(
seuraava kehiin :D


1. Lataa combofix.exe työpöydällesi jommastakummasta linkistä:
combofix.exe
combofix.exe

2. Tuplaklikkaa combofix.exe tiedostoa ja seuraa ohjeistuksia.
3. Kun työkalu on valmis, se tuottaa lokin. (C:\ComboFix.txt) Lähetä tämä loki viesti ketjuusi.
Huom! Älä klikkaile combofixin ikkunaa käytön aikana. Tämä saattaa aiheuttaa ohjelman jumiutumisen.

Lähetä C:\ComboFix.txt + uusi hjt-loki(ota automaattinen rivitys pois)

Oukkidoukki tässä nyt siis Combofix.txt ja jälleen uus hjtloki :p


ComboFix 07-11-19.4 - Erkki Orlimo 2007-11-27 19:51:39.1 - NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1035.18.556 [GMT 2:00]
Running from: C:\Documents and Settings\Erkki Orlimo\Työpöytä\ComboFix.exe
* Created a new restore point
.

(((((((((((((((((((((((((((((((((((((( Muut poistot ))))))))))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\WINDOWS\system32\stera.job
C:\WINDOWS\system32\stera.log

.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))

.
-------\LEGACY_FOPN
-------\LEGACY_VSPF
-------\LEGACY_VSPF_HK


((((( Tiedostot, jotka on luotu seuraavalla aikav?lill?: 2007-10-27 to 2007-11-27 )))))))))))))))))
.

2007-11-26 19:14 <KANSIO> d-------- C:\WINDOWS\ERUNT
2007-11-26 15:39 <KANSIO> d-------- C:\WINDOWS\system32\Kaspersky Lab
2007-11-26 15:39 <KANSIO> d-------- C:\Documents and Settings\All Users\Application Data\Kaspersky Lab
2007-11-24 18:26 <KANSIO> d-------- C:\Program Files\Trend Micro
2007-11-22 22:01 <KANSIO> d-------- C:\Documents and Settings\Erkki Orlimo\Application Data\Grisoft
2007-11-22 22:01 <KANSIO> d-------- C:\Documents and Settings\All Users\Application Data\Grisoft
2007-11-22 22:01 10,872 --a------ C:\WINDOWS\system32\drivers\AvgAsCln.sys
2007-11-22 20:14 <KANSIO> d--hs---- C:\found.000
2007-11-21 17:01 271,224 --a------ C:\WINDOWS\system32\mucltui.dll
2007-11-21 17:01 207,736 --a------ C:\WINDOWS\system32\muweb.dll
2007-11-21 17:01 30,072 --a------ C:\WINDOWS\system32\mucltui.dll.mui
2007-11-20 21:01 <KANSIO> d-------- C:\Program Files\Windows Live
2007-11-20 20:50 <KANSIO> d--hsc--- C:\Program Files\Common Files\WindowsLiveInstaller
2007-11-20 20:49 <KANSIO> d-------- C:\Documents and Settings\All Users\Application Data\WLInstaller
2007-11-11 18:50 <KANSIO> d-------- C:\Documents and Settings\Erkki Orlimo\Application Data\dvdcss
2007-10-31 15:49 <KANSIO> d-------- C:\Documents and Settings\Erkki Orlimo\Application Data\TypingMaster7
2007-10-31 15:48 <KANSIO> dr------- C:\Program Files\TypingMaster

.
(((((((((((((((((((((((((((((((((((( Find3M-raportti ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2007-11-27 16:04 --------- d-----w C:\Documents and Settings\Erkki Orlimo\Application Data\foobar2000
2007-11-27 15:14 2,718 ----a-w C:\WINDOWS\system32\drivers\fwdrv.err
2007-11-27 15:09 --------- d-----w C:\Program Files\Java
2007-11-24 15:32 --------- d--h--w C:\Program Files\InstallShield Installation Information
2007-11-24 15:32 --------- d-----w C:\Program Files\epson
2007-11-22 19:29 --------- d-----w C:\Program Files\mIRC
2007-11-21 19:20 --------- d-----w C:\Documents and Settings\Erkki Orlimo\Application Data\Azureus
2007-11-09 15:59 22,328 ----a-w C:\WINDOWS\system32\drivers\PnkBstrK.sys
2007-11-09 15:59 103,736 ----a-w C:\WINDOWS\system32\PnkBstrB.exe
2007-10-26 20:35 --------- d-----w C:\Documents and Settings\Erkki Orlimo\Application Data\fretsonfire
2007-10-26 20:33 --------- d-----w C:\Program Files\Frets on Fire
2007-10-25 17:05 94,416 ----a-w C:\WINDOWS\system32\drivers\aswmon2.sys
2007-10-25 17:05 93,264 ----a-w C:\WINDOWS\system32\drivers\aswmon.sys
2007-10-25 17:03 23,152 ----a-w C:\WINDOWS\system32\drivers\aswRdr.sys
2007-10-25 17:01 42,912 ----a-w C:\WINDOWS\system32\drivers\aswTdi.sys
2007-10-25 16:58 26,624 ----a-w C:\WINDOWS\system32\drivers\aavmker4.sys
2007-10-25 16:44 8,464,384 ----a-w C:\WINDOWS\system32\dllcache\shell32.dll
2007-10-25 16:43 --------- d-----w C:\Program Files\Webteh
2007-10-25 16:24 815,480 ----a-w C:\WINDOWS\system32\aswBoot.exe
2007-10-25 16:14 95,608 ----a-w C:\WINDOWS\system32\AvastSS.scr
2007-10-18 09:31 51,224 ----a-w C:\WINDOWS\system32\sirenacm.dll
2007-10-07 18:05 --------- d-----w C:\Documents and Settings\Erkki Orlimo\Application Data\Media Player Classic
2007-10-07 17:06 --------- d-----w C:\Program Files\K-Lite Codec Pack
2007-10-05 17:26 --------- d-----w C:\Program Files\Azureus
2007-05-27 08:14 6,625,976 ----a-w C:\Program Files\FirefoxGoogleToolbarSetup.exe
2006-10-07 07:34 6,130,888 ----a-w C:\Program Files\mIRC.rar
2006-01-06 18:01 1,014,477 ----a-w C:\Program Files\wrar351.exe
.

(((((((((((((((((((((((((((((( Rekisterin k?ynnistyskohteet )))))))))))))))))))))))))))))))))))))))))))))
.
.
*Huom* Tyhji? arvoja ja laillisia oletusarvoja ei n?ytet?

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"LDM"="C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe" [2007-02-14 19:58]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2005-06-16 12:34]
"OM2_Monitor"="C:\Program Files\OLYMPUS\OLYMPUS Master 2\MMonitor.exe" [2007-05-23 09:40]
"WMPNSCFG"="C:\Program Files\Windows Media Player\WMPNSCFG.exe" [2006-11-15 09:40]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NeroFilterCheck"="C:\WINDOWS\system32\NeroCheck.exe" [2005-06-16 12:34]
"iTunesHelper"="C:\Program Files\iTunes\iTunesHelper.exe" []
"Logitech Hardware Abstraction Layer"="KHALMNPR.EXE" [2004-12-10 11:45 C:\WINDOWS\KHALMNPR.Exe]
"Cmaudio"="RunDll32 cmicnfg.cpl" []
"QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2006-09-01 15:57]
"SoundMan"="SOUNDMAN.EXE" [2006-11-17 04:42 C:\WINDOWS\soundman.exe]
"NvCplDaemon"="RUNDLL32.exe" [2005-06-16 12:35 C:\WINDOWS\system32\rundll32.exe]
"nwiz"="nwiz.exe" [2006-10-22 11:22 C:\WINDOWS\system32\nwiz.exe]
"NvMediaCenter"="RUNDLL32.exe" [2005-06-16 12:35 C:\WINDOWS\system32\rundll32.exe]
"avast!"="C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe" [2007-10-25 18:20]
"!AVG Anti-Spyware"="C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" [2007-06-11 11:25]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2005-06-16 12:34]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\system]
"DisableRegistryTools"= 0 (0x0)

R1 fwdrv;Firewall Driver;C:\WINDOWS\system32\drivers\fwdrv.sys
R1 khips;Kerio HIPS Driver;C:\WINDOWS\system32\drivers\khips.sys
R2 SPF4;Sunbelt Personal Firewall 4;"C:\Program Files\Sunbelt Software\Personal Firewall\kpf4ss.exe"
S3 SCREAMINGBDRIVER;Screaming Bee Audio;C:\WINDOWS\system32\drivers\screamingbdriver.sys

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{a7ed78fa-8179-11dc-a619-000fead3e56d}]
\Shell\AutoRun\command - E:\Autorun.exe /run
\Shell\Shell00\Command - E:\Autorun.exe /run
\Shell\Shell01\Command - E:\Autorun.exe /action
\Shell\Shell02\Command - E:\Autorun.exe /uninstall

.
'Ajoitetut teht?v?t'-kansion sis?lt?
"2007-11-23 15:15:00 C:\WINDOWS\Tasks\1-Click Maintenance.job"
- C:\Program Files\TuneUp Utilities 2006\SystemOptimizer.exe
"2007-10-22 05:36:11 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job"
- C:\Program Files\Apple Software Update\SoftwareUpdate.exe
.
**************************************************************************

catchme 0.3.1262 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2007-11-27 20:01:22
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
Completion time: 2007-11-27 20:05:17 - machine was rebooted
.
--- E O F ---


Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 20:10:11, on 27.11.2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16544)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\PnkBstrA.exe
C:\Program Files\Sunbelt Software\Personal Firewall\kpf4ss.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Sunbelt Software\Personal Firewall\kpf4gui.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\Program Files\Sunbelt Software\Personal Firewall\kpf4gui.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe
C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Windows Media Player\WMPNSCFG.exe
C:\Program Files\Logitech\SetPoint\SetPoint.exe
C:\Program Files\Common Files\Logitech\KHAL\KHALMNPR.EXE
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = "C:\Program Files\Outlook Express\msimn.exe"
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.fi;<local>
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Linkit
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Windows Liven kirjautumisapuohjelma - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: EpsonToolBandKicker Class - {E99421FB-68DD-40F0-B4AC-B7027CAE2F1A} - C:\Program Files\EPSON\EPSON Web-To-Page\EPSON Web-To-Page.dll
O3 - Toolbar: EPSON Web-To-Page - {EE5D279F-081B-4404-994D-C6B60AAEBA6D} - C:\Program Files\EPSON\EPSON Web-To-Page\EPSON Web-To-Page.dll
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [Logitech Hardware Abstraction Layer] KHALMNPR.EXE
O4 - HKLM\..\Run: [Cmaudio] RunDll32 cmicnfg.cpl,CMICtrlWnd
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
O4 - HKCU\..\Run: [LDM] C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [OM2_Monitor] "C:\Program Files\OLYMPUS\OLYMPUS Master 2\MMonitor.exe" -NoStart
O4 - HKCU\..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Paikallinen palve')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Verkkopalve')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Startup: Adobe Gamma.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: Logitech Desktop Messenger.lnk = C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe
O4 - Global Startup: Logitech SetPoint.lnk = C:\Program Files\Logitech\SetPoint\SetPoint.exe
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Palvelut - {31D4C741-D7C0-4BE5-B05A-A705D772C4F9} - http://service.kolumbus.fi/ (file missing) (HKCU)
O9 - Extra button: SMS-viesti - {BF0B4CCD-C85B-4C0C-8AE7-0F8664E33FB2} - http://sms.kolumbus.fi/ (file missing) (HKCU)
O9 - Extra button: Tuki - {E600F531-77B0-4B26-9813-5CC61D30884F} - http://tuki.elisa.net/ (file missing) (HKCU)
O14 - IERESET.INF: START_PAGE_URL=http://elisa.net/
O16 - DPF: {00B71CFB-6864-4346-A978-C0A14556272C} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab31267.cab
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/kos/english/kavwebscan_unicode.cab
O16 - DPF: {20A60F0D-9AFA-4515-A0FD-83BD84642501} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab56986.cab
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/Mes...nt.cab31267.cab
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (MSN Games - Installer) - http://messenger.zone.msn.com/binary/ZIntro.cab56649.cab
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/Mes...nt.cab56907.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/sh...ash/swflash.cab
O18 - Protocol: bwfile-8876480 - {9462A756-7B47-47BC-8C80-C34B9B80B32B} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\GAPlugProtocol-8876480.dll
O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft AB - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPodService - Unknown owner - C:\Program Files\iPod\bin\iPodService.exe (file missing)
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\system32\PnkBstrA.exe
O23 - Service: Sunbelt Personal Firewall 4 (SPF4) - Sunbelt Software - C:\Program Files\Sunbelt Software\Personal Firewall\kpf4ss.exe

--
End of file - 8261 bytes

ja sitten...


Tee uusi hjt-scannaus Do a System scan only
Sulje kaikki muut ikkunat ja selaimen.Merkkaa nämä rivit ja paina Fix checked

O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)

jos et käytä logitekin messengerii niin fixxa seuraavat
O4 - HKCU\..\Run: [LDM] C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe
O18 - Protocol: bwfile-8876480 - {9462A756-7B47-47BC-8C80-C34B9B80B32B} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\GAPlugProtocol-8876480.dll


Lataa CCleaner tästä[list]
[*]Asennuksessa poista merkki/rasti kohdasta "asenna Yahoo! toolbar/työkalupalkki".
[*]Asennuksen jälkeen aukaise CCleaner.
[*]Valitse vasemmalta pystyrivistä Options.
[list][*]Valitse viereisestä pystyrivistä Settings.
[*]Language kohtaan valitse Suomi.[/list][/list]
Puhdistaja[list]
[*]Valitse vasemmalta pystyrivistä Puhdistaja.
[list][*]Paina alhaalta Tutki.
Nyt CCleaner tutkii, mitä voidaan poistaa (tempit, cookiessit jne.).
[*]Kun tutkiminen on valmis, paina Aja CCleaner.
Nyt CCleaner poistaa löydetyt tempit, cookiessit jne.[/list][/list]
Rekisterin virheiden korjaus[list]
[*]Valitse vasemmalta pystyrivistä Virheet.
[list][*]Paina alhaalta Etsi rekisterin virheitä.
[*]Kun etsintä on valmis ja olet varma, että haluat korjata ne rivit jotka ovat merkattuja, niin paina Korjaa valitut rekisterin virheet.
[*]Sinulta kysytään "haluatko varmuuskopioida muutokset rekisteriin", paina Kyllä. Tallenna varmuuskopio vaikka "Omat tiedostot" -kansioon.
[*]Klikkaa uudesta aukeavasta ikkunasta Korjaa kaikki valitut virheet.
[*]Saat vielä varmistus kysymyksen, paina Ok.
[*]Kun virheet on korjattu, paina Sulje.[/list]
[*]Nyt voit suljea CCleanerin painamalla oikealta ylhäältä punaista rastia.[/list]

ja lopputarkistus....


Tarkista koneesi F-Securen online skannerilla

Huom, skanneri toimii vain Internet Explorer selaimella

* Lue sivun ohjeet huolella läpi
* Klikkaa Start scanning
* Mikäli saat Internet Explorer -suojausvaroituksen, klikkaa Asenna
* Klikkaa Accept
* Klikkaa Custom Scan
* Säädä asetukset seuraavasti

o "Virus Scan Option" kohdasta valitse Scan whole system
o "Other Scan Option" kohdasta valitse Scan All Files
o Valitse Scan whole system for rootkits
o Valitse Scan whole system for spyware
o Laita ruksi kohtaan Scan inside archives
o Varmista että Use advanced heuristics on valittuna

* Klikkaa Start
* Skannaus käynnistyy kun tarvittavat tiedostot/päivitykset on ladattu
* Odota kärsivällisesti
* Kun sakannaus on suoritettu, klikkaa Automatic cleaning
* Klikkaa Show Report
* Raportti aukeaa selaimessa, kopioi teksti kokonaan
* Liitä kopioitu teksti esim. muistioon tai Wordiin ja tallenna työpöydälle
* Voit sulkea skannerin
* Lähetä raportti viestiketjuusi

Noniin tässä ois nyt näitä aika myöhässä kyl mutta ompa nyt sitte ainaki

Scanning Report
Thursday, November 29, 2007 21:30:54 - 06:45:15

Computer name: ORLIMO
Scanning type: Scan system for viruses, rootkits, spyware
Target: C:\
Result: 4 malware found
Tracking Cookie (spyware)

* System (Disinfected)
* System
* System
* System

Statistics
Scanned:

* Files: 238084
* System: 4686
* Not scanned: 632

Actions:

* Disinfected: 1
* Renamed: 0
* Deleted: 0
* None: 3
* Submitted: 0

Files not scanned:

* ?Q
x
)
68000SYSTEMBUILDER.DAT C:\HIBERFIL.SYS
* C:\PAGEFILE.SYS
* C:\PRODLOG.TXT
* C:\WINDOWS\TEMP\PERFLIB_PERFDATA_608.DAT
* C:\WINDOWS\TEMP\_AVAST4_\WEBSHLOCK.TXT
* C:\WINDOWS\SYSTEM32\BIOS1.ROM
* C:\WINDOWS\SYSTEM32\CONFIG\DEFAULT
* C:\WINDOWS\SYSTEM32\CONFIG\DEFAULT.LOG
* C:\WINDOWS\SYSTEM32\CONFIG\SAM
* C:\WINDOWS\SYSTEM32\CONFIG\SAM.LOG
* C:\WINDOWS\SYSTEM32\CONFIG\SECURITY
* C:\WINDOWS\SYSTEM32\CONFIG\SECURITY.LOG
* C:\WINDOWS\SYSTEM32\CONFIG\SOFTWARE
* C:\WINDOWS\SYSTEM32\CONFIG\SOFTWARE.LOG
* C:\WINDOWS\SYSTEM32\CONFIG\SYSTEM
* C:\WINDOWS\SYSTEM32\CONFIG\SYSTEM.LOG
* C:\WINDOWS\SYSTEM32\CATROOT2\EDB.LOG
* C:\WINDOWS\SYSTEM32\CATROOT2\TMP.EDB
* C:\WINDOWS\SOFTWAREDISTRIBUTION\EVENTCACHE\{69577758-BB5C-42AD-834E-9F8F8B5893AC}.BIN
* bios1.rom
* C:\WINDOWS\.JAGEX_CACHE_32\RUNESCAPE\MAIN_FILE_CACHE.DAT2
* C:\WINDOWS\.JAGEX_CACHE_32\RUNESCAPE\MAIN_FILE_CACHE.IDX13
* C:\WINDOWS\.JAGEX_CACHE_32\RUNESCAPE\MAIN_FILE_CACHE.IDX5
* C:\WINDOWS\.JAGEX_CACHE_32\RUNESCAPE\MAIN_FILE_CACHE.IDX7
* C:\Program Files\ohjelmat\Varma_Vol_1\Varma_Vol_1.rar\Varma_Vol_1\Varma_Vol_1.avi
* C:\PROGRAM FILES\LOGITECH\DESKTOP MESSENGER\8876480\USERS\ERKKI ORLIMO\DATA\CHANDIR.DAT
* C:\PROGRAM FILES\LOGITECH\DESKTOP MESSENGER\8876480\USERS\ERKKI ORLIMO\DATA\L0000002.FCS
* C:\PROGRAM FILES\LOGITECH\DESKTOP MESSENGER\8876480\USERS\ERKKI ORLIMO\DATA\PRS.DAT
* C:\PROGRAM FILES\LOGITECH\DESKTOP MESSENGER\8876480\USERS\ERKKI ORLIMO\DATA\STORYDB.DAT
* C:\PROGRAM FILES\CODEMASTERS\WORMS 4 MAYHEM\DATA\MAPS\AITEST.HMP
* C:\PROGRAM FILES\CODEMASTERS\WORMS 4 MAYHEM\DATA\MAPS\ARABIATEST.HMP
* C:\PROGRAM FILES\CODEMASTERS\WORMS 4 MAYHEM\DATA\MAPS\BUILDINGSITESABOTEURS.HMP
* C:\PROGRAM FILES\CODEMASTERS\WORMS 4 MAYHEM\DATA\MAPS\CARPETCAPERS.HMP
* C:\PROGRAM FILES\CODEMASTERS\WORMS 4 MAYHEM\DATA\MAPS\CHALLENGEACCURACY.HMP
* C:\PROGRAM FILES\CODEMASTERS\WORMS 4 MAYHEM\DATA\MAPS\CHALLENGECRATE.HMP
* C:\PROGRAM FILES\CODEMASTERS\WORMS 4 MAYHEM\DATA\MAPS\CHALLENGEJETPACK.HMP
* C:\PROGRAM FILES\CODEMASTERS\WORMS 4 MAYHEM\DATA\MAPS\CHALLENGENAVIGATION.HMP
* C:\PROGRAM FILES\CODEMASTERS\WORMS 4 MAYHEM\DATA\MAPS\CHALLENGEREDBULL.HMP
* C:\PROGRAM FILES\CODEMASTERS\WORMS 4 MAYHEM\DATA\MAPS\CHALLENGESHEEP.HMP
* C:\PROGRAM FILES\CODEMASTERS\WORMS 4 MAYHEM\DATA\MAPS\CHALLENGESHOTGUN.HMP
* C:\PROGRAM FILES\CODEMASTERS\WORMS 4 MAYHEM\DATA\MAPS\CHALLENGESNIPER.HMP
* C:\PROGRAM FILES\CODEMASTERS\WORMS 4 MAYHEM\DATA\MAPS\CHESHTEST.HMP
* C:\PROGRAM FILES\CODEMASTERS\WORMS 4 MAYHEM\DATA\MAPS\CUSTOMTEST.HMP
* C:\PROGRAM FILES\CODEMASTERS\WORMS 4 MAYHEM\DATA\MAPS\DEATHMATCH10.HMP
* C:\PROGRAM FILES\CODEMASTERS\WORMS 4 MAYHEM\DATA\MAPS\DEATHMATCH2.HMP
* C:\PROGRAM FILES\CODEMASTERS\WORMS 4 MAYHEM\DATA\MAPS\DEATHMATCH3.HMP
* C:\PROGRAM FILES\CODEMASTERS\WORMS 4 MAYHEM\DATA\MAPS\DEATHMATCH4.HMP
* C:\PROGRAM FILES\CODEMASTERS\WORMS 4 MAYHEM\DATA\MAPS\DEATHMATCH5.HMP
* C:\PROGRAM FILES\CODEMASTERS\WORMS 4 MAYHEM\DATA\MAPS\DEATHMATCH6.HMP
* C:\PROGRAM FILES\CODEMASTERS\WORMS 4 MAYHEM\DATA\MAPS\DEATHMATCH7.HMP
* C:\PROGRAM FILES\CODEMASTERS\WORMS 4 MAYHEM\DATA\MAPS\DEATHMATCH8.HMP
* C:\PROGRAM FILES\CODEMASTERS\WORMS 4 MAYHEM\DATA\MAPS\DEATHMATCH9.HMP
* C:\PROGRAM FILES\CODEMASTERS\WORMS 4 MAYHEM\DATA\MAPS\DEMO_MISSION.HMP
* C:\PROGRAM FILES\CODEMASTERS\WORMS 4 MAYHEM\DATA\MAPS\DEMO_MULTIPLAYER.HMP
* C:\PROGRAM FILES\CODEMASTERS\WORMS 4 MAYHEM\DATA\MAPS\DEMO_ONLINE.HMP
* C:\PROGRAM FILES\CODEMASTERS\WORMS 4 MAYHEM\DATA\MAPS\DESTRUCTANDSERVE.HMP
* C:\PROGRAM FILES\CODEMASTERS\WORMS 4 MAYHEM\DATA\MAPS\DINERMIGHT.HMP
* C:\PROGRAM FILES\CODEMASTERS\WORMS 4 MAYHEM\DATA\MAPS\DOOMCANYON.HMP
* C:\PROGRAM FILES\CODEMASTERS\WORMS 4 MAYHEM\DATA\MAPS\ESCAPEFROMTREEREX.HMP
* C:\PROGRAM FILES\CODEMASTERS\WORMS 4 MAYHEM\DATA\MAPS\FASTFOODDINO.HMP
* C:\PROGRAM FILES\?

Options
Scanning engines:

* F-Secure Libra: 2.4.2, 2007-11-28
* F-Secure AVP: 7.0.171, 2007-11-29
* F-Secure Orion: 1.2.37, 2007-11-29
* F-Secure Blacklight: 1.0.64
* F-Secure Draco: 1.0.35, 2007-11-21
* F-Secure Pegasus: 1.19.0, 2007-10-26

Scanning options:

* Scan all files
* Scan inside archives
* Use Advanced heuristics

Copyright © 1998-2006 Product support |Send virus sample to F-Secure
F-Secure assumes no responsibility for material created or published by third parties that F-Secure World Wide Web pages have a link to. Unless you have clearly stated otherwise, by submitting material to any of our servers, for example by E-mail or via our F-Secure's CGI E-mail, you agree that the material you make available may be published in the F-Secure World Wide Pages or hard-copy publications. You will reach F-Secure public web site by clicking on underlined links. While doing this, your access will be logged to our private access statistics with your domain name.This information will not be given to any third party. You agree not to take action against us in relation to material that you submit. Unless you have clearly stated otherwise, by submitting material you warrant that F-Secure may incorporate any concepts described in it in the F-Secure products/publications without liability.




Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 14:45:50, on 30.11.2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16544)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\PnkBstrA.exe
C:\Program Files\Sunbelt Software\Personal Firewall\kpf4ss.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Sunbelt Software\Personal Firewall\kpf4gui.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\Program Files\Sunbelt Software\Personal Firewall\kpf4gui.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\SOUNDMAN.EXE
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Windows Media Player\WMPNSCFG.exe
C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe
C:\Program Files\Logitech\SetPoint\SetPoint.exe
C:\Program Files\Common Files\Logitech\KHAL\KHALMNPR.EXE
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = "C:\Program Files\Outlook Express\msimn.exe"
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.fi;<local>
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Linkit
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O2 - BHO: Windows Liven kirjautumisapuohjelma - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: EpsonToolBandKicker Class - {E99421FB-68DD-40F0-B4AC-B7027CAE2F1A} - C:\Program Files\EPSON\EPSON Web-To-Page\EPSON Web-To-Page.dll
O3 - Toolbar: EPSON Web-To-Page - {EE5D279F-081B-4404-994D-C6B60AAEBA6D} - C:\Program Files\EPSON\EPSON Web-To-Page\EPSON Web-To-Page.dll
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [Logitech Hardware Abstraction Layer] KHALMNPR.EXE
O4 - HKLM\..\Run: [Cmaudio] RunDll32 cmicnfg.cpl,CMICtrlWnd
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [OM2_Monitor] "C:\Program Files\OLYMPUS\OLYMPUS Master 2\MMonitor.exe" -NoStart
O4 - HKCU\..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Paikallinen palve')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Verkkopalve')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Startup: Adobe Gamma.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: Logitech Desktop Messenger.lnk = C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe
O4 - Global Startup: Logitech SetPoint.lnk = C:\Program Files\Logitech\SetPoint\SetPoint.exe
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Palvelut - {31D4C741-D7C0-4BE5-B05A-A705D772C4F9} - http://service.kolumbus.fi/ (file missing) (HKCU)
O9 - Extra button: SMS-viesti - {BF0B4CCD-C85B-4C0C-8AE7-0F8664E33FB2} - http://sms.kolumbus.fi/ (file missing) (HKCU)
O9 - Extra button: Tuki - {E600F531-77B0-4B26-9813-5CC61D30884F} - http://tuki.elisa.net/ (file missing) (HKCU)
O14 - IERESET.INF: START_PAGE_URL=http://elisa.net/
O16 - DPF: {00B71CFB-6864-4346-A978-C0A14556272C} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab31267.cab
O16 - DPF: {0B79F48A-E8D6-11DB-9283-E25056D89593} (F-Secure Online Scanner 3.1) - http://support.f-secure.com/ols/fscax.cab
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/kos/english/kavwebscan_unicode.cab
O16 - DPF: {20A60F0D-9AFA-4515-A0FD-83BD84642501} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab56986.cab
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} - http://messenger.zone.msn.com/binary/Mes...nt.cab31267.cab
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (MSN Games - Installer) - http://messenger.zone.msn.com/binary/ZIntro.cab56649.cab
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/Mes...nt.cab56907.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/sh...ash/swflash.cab
O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft AB - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPodService - Unknown owner - C:\Program Files\iPod\bin\iPodService.exe (file missing)
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\system32\PnkBstrA.exe
O23 - Service: Sunbelt Personal Firewall 4 (SPF4) - Sunbelt Software - C:\Program Files\Sunbelt Software\Personal Firewall\kpf4ss.exe

--
End of file - 8444 bytes

moi
Lokit on OK
vielä ongelmia???

Moi ei oo enää mitään ongelmia.

Kiitos kauheesti ja hyvät joulut 8)!

ok
hyviä jouluja

tämä vielä

Putsaa järjestelmän palautus:
1. Klikkaa oikealla käynnistävalikon My Computer- tai oma tietokone-kuvaketta
2. Valitse Properties/ominaisuudet
3. Valitse System Restore/järjestelmän palauttaminen välilehti
4. Valitse "Turn off System Restore"/poista järjestelmän palauttaminen kaikissa asemissa
5. Paina Apply/käytä
6. Paina OK
7. Käynnistä kone uudelleen
8. Palauta asetukset takaisin

ja muutama lisä vinkki ;)

Pysy Puhtaana !

Käytä Firefox
Firefox on nopeampi turvallisempi selain kuin Internet Explorer
Lataa Firefox

Asenna Hosts-tiedosto
Hosts-tiedosto estää haitalliset internet-osoitteet
Lataa Hosts-tiedosto
Opas!

Asenna AVG Anti-Spyware
AVG Anti-Spyware poistaa haittaohjelmia ja puhdistaa myös rekisteriä
Lataa AVG Anti-Spyware
Opas!

Asenna Ccleaner
Ccleaner puhdistaa väliaikaistiedostot ja rekisteriä
Lataa Ccleaner
Opas!

Asenna SpywareBlaster
SpywareBlaster estää haittaohjelmien asentumista koneelle
Lataa SpywareBlaster
Opas!

Tyhjennä järjestelmänpalautuskansio ja luo uusi palautuspiste.
Tämä puhdistaa palautuskansion mahdollisista haittaohjelmajäännöksistä.
Opas!

Pidä järjestelmäsi ajantasalla
Windows Update

Pidä ohjelmistosi ajantasalla. -> Secunia Software Inspector
Secunia Software Inspector tutkii sinun järjestälmäsi ja ohjelmistosi puuttuvien turvallisuuspäivityksien osalta. Tavallinen tutkinta kestää normaalisti 5-40 sekuntia, kun läpikotainen (thorough system inspection) voi kestää useita minuutteja.


Pidä palomuuri ja virustorjunta ajantasalla
Päivitä ja skannaa koneesi säännöllisesti virustorjuntaohjelmallasi.

Taistele vastaan!!--> Malware Complaints
Sivusto antaa haittaohjelmien uhreille mahdollisuuden kertoa tarinansa ja tehdä valituksen asiasta. Taistellaan yhdessä haittaohjelmien tekijöitä vastaan!