User Käyttäjä Salasana  
   
torstai 13.11.2025 / 06:35
Hae keskustelualueilta:        In English   Suomeksi   På svenska
afterdawn.com > keskustelu > yleistä keskustelua tietokoneista > virukset ja haittaohjelmat - hijackthis -logit > kone erittäin ''nykivä'' internetissä sekä videotiedostoja katsoessa. (hijackthis logi)
Näytä aiheet
 
Keskustelualueet
Keskustelualueet
Kone erittäin ''nykivä'' internetissä sekä videotiedostoja katsoessa. (HijackThis logi)
  Siirry:
 
Kirjoittaja Viesti
Sivu:12>
Newbie
_
29. huhtikuuta 2008 @ 15:26 _ Linkki tähän viestiin    Lähetä käyttäjälle yksityisviesti   
Eli kone toimii normaalisti esim. selatessa tietokoneen kansioita ja tehdessä töitä koneen eri ohjelmilla.

Ongelmat ilmenevät, kun koetan katsoa tietokoneelle ladattuja videoita tai selata internettiä. Videot näkyvät ''tasaisesti nykien'', eli vähän niinkuin kuva kuvalta. Tietokone ei yleisesti nyi, eli pystyn selailemaan esim. resurssien hallintaa nykivän videon käydessä taustalla täysin tasaisesti ilman minkäänlaista viivettä ja ylipäänsä täysin normaalisti. Paljon suurempi ja ikävämpi ongelma on internetin vihoittelu. Netti saattaa toimia hetken selaimen käynnistyksen jälkeen normaalisti, mutta hetken kuluttua sivustojen linkit alkavat näkyä nykivästi ja esim. osoiteriville kirjoitus tai sivuston ylös- ja alaspäin rullailu on samankaltaista nykivää etenemistä. Eli internet nykii tasaisesti koko ajan riippumatta sivustosta millä on. Tämä johtaa myös siihen, että nettivideot (www.youtube.com , www.nhl.com) näkyvät niinikään tasaisesti nykien. Tehtävienhallinnassa ei näy mitään prosessia, mikä voisi aiheuttaa tämän nykivyyden. Normaalit prosessit ovat käynnissä, suorittimen tehoa pitäisi olla kokoajan käytettävissä 95-100%.

Toivottavasti joltain löytyy vinkkiä vian korjaamiseksi. Erittäin ikävää etenkin tuo, etten pysty katsomaan mitään koosteita ym. internetistä. Mielestäni kone on muuten täysin virkeä, mutta yllämainituissa tilanteissa meno muuttuu nykiväksi. Formatointi lienee auttaisi varmasti, mutta toivon että sitä toimenpidettä ei tarvita. Se lienee se viimeisin keino.

=====================================================================


Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 15:20:09, on 29.4.2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16640)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\Program Files\Bluetooth\Bluetooth-ohjelmisto\bin\btwdins.exe
C:\WINDOWS\system32\HPZipm12.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\ThreadMaster\ThreadMast.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\WINDOWS\system32\LVCOMSX.EXE
C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\Program Files\HP\Digital Imaging\bin\hpqSTE08.exe
C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\HJ\Skanneri.exe.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://finnish.toggle.com/index.php?rvs=hompag
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = localhost
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Linkit
O2 - BHO: Adobe PDF Reader -linkkiavustaja - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {1E8A6170-7264-4D0F-BEAE-D42A53123C75} - C:\Program Files\Common Files\Symantec Shared\coShared\Browser\1.5\NppBho.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [LVCOMSX] C:\WINDOWS\system32\LVCOMSX.EXE
O4 - HKLM\..\Run: [Recguard] C:\WINDOWS\SMINST\RECGUARD.EXE
O4 - HKLM\..\Run: [Symantec PIF AlertEng] "C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe" /a /m "C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\AlertEng.dll"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe"
O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Paikallinen palve')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Verkkopalve')
O4 - HKUS\S-1-5-18\..\Run: [Picasa Media Detector] C:\Program Files\Picasa2\PicasaMediaDetector.exe (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [Picasa Media Detector] C:\Program Files\Picasa2\PicasaMediaDetector.exe (User 'Default user')
O4 - .DEFAULT User Startup: Pin.lnk = C:\hp\bin\CLOAKER.EXE (User 'Default user')
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O8 - Extra context menu item: Lähetä &Bluetooth-laitteeseen - C:\Program Files\Bluetooth\Bluetooth-ohjelmisto\btsendto_ie_ctx.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra button: @btrez.dll,-4015 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\Bluetooth\Bluetooth-ohjelmisto\btsendto_ie.htm
O9 - Extra 'Tools' menuitem: @btrez.dll,-4017 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\Bluetooth\Bluetooth-ohjelmisto\btsendto_ie.htm
O9 - Extra button: Yhteysohje - {E2D4D26B-0180-43a4-B05F-462D6D54C789} - C:\WINDOWS\PCHEALTH\HELPCTR\Vendors\CN=Hewlett-Packard,L=Cupertino,S=Ca,C=US\IEButton\support.htm
O9 - Extra 'Tools' menuitem: Yhteysohje - {E2D4D26B-0180-43a4-B05F-462D6D54C789} - C:\WINDOWS\PCHEALTH\HELPCTR\Vendors\CN=Hewlett-Packard,L=Cupertino,S=Ca,C=US\IEButton\support.htm
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {C4847596-972C-11D0-9567-00A0C9273C2A} (Crystal Report Viewer Control) - http://jasenpalvelut.hammasll.fi/viewer/...tivexviewer.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/sh...ash/swflash.cab
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: Automaattinen LiveUpdate-ajastustoiminto - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
O23 - Service: Automattinen LiveUpdate-ajastustoiminto - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: Bluetooth Service (btwdins) - Broadcom Corporation. - C:\Program Files\Bluetooth\Bluetooth-ohjelmisto\bin\btwdins.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: Symantec Lic NetConnect service (CLTNetCnService) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: COM Host (comHost) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\VAScanner\comHost.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPodService - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
O23 - Service: LiveUpdate Notice Service Ex (LiveUpdate Notice Ex) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: LiveUpdate Notice Service - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: ServiceLayer - Nokia. - C:\Program Files\PC Connectivity Solution\ServiceLayer.exe
O23 - Service: Symantec Core LC - Unknown owner - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
O23 - Service: Thread Master (ThreadMaster) - http://threadmaster.tripod.com - threadmaster@europe.com - C:\WINDOWS\system32\ThreadMaster\ThreadMast.exe

--
End of file - 8527 bytes
Hujo
Suspended permanently
_
29. huhtikuuta 2008 @ 16:12 _ Linkki tähän viestiin    Lähetä käyttäjälle yksityisviesti   
1.Lataa combofix.exe työpöydällesi yhdestä linkistä:
combofix1
combofix2

2. Tuplaklikkaa combofix.exe tiedostoa ja seuraa ohjeistuksia.
3. Kun työkalu on valmis, se tuottaa lokin. Lähetä tämä loki viesti ketjuusi.
Huom! Älä klikkaile combofixin ikkunaa käytön aikana. Tämä saattaa aiheuttaa ohjelman jumiutumisen.

=======

Lataa SDFix by AndyManchesta ja tallenna se työpöydällesi.

Käynnistä koneesi vikasietotilaan:

sammuta ja käynnistä
käynnistyksen yhteydessä hakkaa F8 nappia
valitse nuolinäppäimellä vikasietotila
paina enter ja enter
valitse käyttäjätilisi
paina kyllä

Jossakin koneissa hakataan F8:sin sijasta F5:tä

" Kun vikasietotilassa, pura tiedoston SDFix.zip sisältö (SDFix kansio) työpöydällesi. Työpöydälle pitäisi ilmestyä kansio nimeltä SDFix.
" Avaa SDFix-kansio ja tuplaklikkaa tiedostoa RunThis.bat käynnistääksesi ohjelman.
" Paina Y käynnistääksesi skriptin.
" Työkalu puhdistaa troijalaisen palvelut ja tekee myös joitakin korjauksia rekisteriin. Lopuksi se pyytää käynnistämään koneen uudelleen, "Press any key to Reboot".
" Paina mitä tahansa näppäintä ja kone käynnistyy uudelleen.
" Käynnistyminen kestää normaalia kauemmin sillä SDFix puhdistaa konetta.
" Kun kone on käynnistynyt ja työpöytä latautunut, SDFix kertoo että puhdistus on suoritettu, "Finished".
" Paina sitten mitä tahansa näppäintä sulkeaksesi skriptin ja ladataksesi pikakuvakkeet työpöydälle.
" Lopuksi avaa SDFix kansio (työpöydällä) ja kopioi & liitä tiedoston Report.txt sisältö viestiketjuusi uuden HijackThis:n lokin kera.


Voiko tietsikka koskaan toimia?
Newbie
_
29. huhtikuuta 2008 @ 21:37 _ Linkki tähän viestiin    Lähetä käyttäjälle yksityisviesti   
ComboFix 08-04-28.2 - HP_Omistaja 2008-04-29 20:26:10.4 - NTFSx86
Running from: C:\Documents and Settings\HP_Omistaja\Työpöytä\ComboFix.exe
* Created a new restore point
.

(((((((((((((((((((((((((((((((((((((( Muut poistot ))))))))))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\Program Files\AMV Converter\_desktop.ini
C:\Program Files\AMV Converter\skin\_desktop.ini
C:\Program Files\AMV Converter\skin\xpstyle\_desktop.ini

.
((((( Tiedostot, jotka on luotu seuraavalla aikavälillä: 2008-03-28 to 2008-04-29 )))))))))))))))))
.

2008-04-29 08:47 . 2008-04-29 08:47 <KANSIO> d-------- C:\Program Files\Opera
2008-04-27 01:12 . 2008-04-27 01:12 <KANSIO> d-------- C:\WINDOWS\system32\ThreadMaster
2008-04-26 23:34 . 2008-04-26 23:34 <KANSIO> d-------- C:\Documents and Settings\HP_Omistaja\Application Data\TVU Networks
2008-04-26 23:34 . 2008-04-26 23:34 <KANSIO> d-------- C:\Documents and Settings\All Users\Application Data\TVU Networks
2008-04-26 23:33 . 2008-04-26 23:33 <KANSIO> d-------- C:\Program Files\TVUPlayer
2008-04-26 23:33 . 2008-04-26 23:33 <KANSIO> d-------- C:\Documents and Settings\HP_Omistaja\LocalLow
2008-04-26 22:26 . 2008-04-26 23:18 45 --a------ C:\WINDOWS\msgtn.ini
2008-04-26 22:21 . 2008-04-26 22:25 <KANSIO> d-------- C:\Documents and Settings\HP_Omistaja\Application Data\ppstream
2008-04-26 22:21 . 2004-09-15 00:00 811,064 --a------ C:\WINDOWS\system32\imjp81k.dll
2008-04-18 11:31 . 2008-04-29 20:28 <KANSIO> d-a------ C:\Program Files\AMV Converter
2008-04-12 11:32 . 2008-04-12 11:32 0 --a------ C:\WINDOWS\MSDraw.ini
2008-04-11 13:51 . 2008-04-11 13:51 <KANSIO> d-------- C:\Documents and Settings\HP_Omistaja\Application Data\Grisoft
2008-04-11 13:51 . 2007-05-30 15:10 10,872 --a------ C:\WINDOWS\system32\drivers\AvgAsCln.sys
2008-04-06 02:39 . 2008-04-06 02:39 <KANSIO> d-------- C:\Program Files\Java
2008-04-06 02:39 . 2008-04-06 02:39 <KANSIO> d-------- C:\Program Files\Common Files\Java
2008-04-06 02:39 . 2008-02-22 02:33 69,632 --a------ C:\WINDOWS\system32\javacpl.cpl
2008-04-05 00:10 . 2008-04-05 00:10 <KANSIO> dr------- C:\Documents and Settings\LocalService\Suosikit
2008-04-05 00:10 . 2008-04-05 00:10 <KANSIO> d-------- C:\Documents and Settings\LocalService\Application Data\Talkback
2008-04-05 00:06 . 2008-04-05 00:07 <KANSIO> d-------- C:\Program Files\SpywareBlaster
2008-04-05 00:06 . 2005-08-25 18:18 118,784 --a------ C:\WINDOWS\system32\MSSTDFMT.DLL
2008-04-05 00:06 . 2005-08-25 18:19 115,920 --a------ C:\WINDOWS\system32\MSINET.OCX
2008-04-04 23:59 . 2008-04-06 03:08 <KANSIO> d-a------ C:\Documents and Settings\All Users\Application Data\TEMP
2008-04-04 23:06 . 2008-04-04 23:06 <KANSIO> d-------- C:\Program Files\Lavasoft
2008-04-04 23:06 . 2008-04-04 23:06 <KANSIO> d-------- C:\Documents and Settings\All Users\Application Data\Lavasoft
2008-04-04 15:53 . 2008-04-04 18:21 3,046 ---hs---- C:\WINDOWS\system32\nhpyfdyk.ini
2008-04-03 15:52 . 2008-04-04 15:52 2,926 ---hs---- C:\WINDOWS\system32\dmesjaus.ini
2008-04-02 15:16 . 2008-04-03 15:47 2,686 ---hs---- C:\WINDOWS\system32\uuphksvx.ini
2008-04-01 20:43 . 2008-04-04 16:43 <KANSIO> d-------- C:\Documents and Settings\HP_Omistaja\.housecall6.6
2008-03-31 21:16 . 2008-04-02 15:06 2,506 ---hs---- C:\WINDOWS\system32\wamcovdi.ini
2008-03-31 20:13 . 2008-03-31 20:13 <KANSIO> d-------- C:\Program Files\CCleaner
2008-03-31 18:57 . 2008-04-27 13:06 <KANSIO> d-------- C:\VundoFix Backups
2008-03-31 18:53 . 2008-04-29 15:20 <KANSIO> d-------- C:\Program Files\HJ
2008-03-31 10:16 . 2008-03-31 21:12 2,026 ---hs---- C:\WINDOWS\system32\yxkpujos.ini
2008-03-29 21:09 . 2008-03-31 10:10 1,374 ---hs---- C:\WINDOWS\system32\mjhoswfk.ini
2008-03-29 20:21 . 2008-03-29 20:57 1,134 ---hs---- C:\WINDOWS\system32\bqjfmvch.ini

.
(((((((((((((((((((((((((((((((((((( Find3M-raportti ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-04-29 17:22 --------- d-----w C:\Program Files\mIRC
2008-04-29 06:16 --------- d-----w C:\Documents and Settings\All Users\Application Data\Symantec
2008-04-29 05:47 --------- d-----w C:\Program Files\Common Files\Symantec Shared
2008-04-28 18:20 --------- d-----w C:\Documents and Settings\HP_Omistaja\Application Data\Skype
2008-04-28 14:55 --------- d-----w C:\Documents and Settings\HP_Omistaja\Application Data\skypePM
2008-04-28 11:42 --------- d-----w C:\Program Files\Warcraft III
2008-04-27 16:23 43,520 ----a-w C:\WINDOWS\system32\CmdLineExt03.dll
2008-04-27 13:15 --------- d-----w C:\Program Files\SopCast
2008-04-26 21:29 --------- d-----w C:\Program Files\Common Files\Wise Installation Wizard
2008-04-26 20:18 --------- d-----w C:\Program Files\MSN Messenger
2008-04-23 16:00 10,800 -c--a-w C:\Documents and Settings\HP_Omistaja\Application Data\wklnhst.dat
2008-04-22 18:09 --------- d-----w C:\Program Files\Ajokorttikoulu
2008-03-20 16:48 --------- d-----w C:\Documents and Settings\HP_Omistaja\Application Data\Command & Conquer 3 Tiberium Wars
2008-03-20 16:45 98,304 ----a-w C:\WINDOWS\system32CmdLineExt.dll
2008-03-20 15:54 --------- d-----w C:\Program Files\Electronic Arts
2008-03-20 14:32 --------- d-----w C:\Documents and Settings\All Users\Application Data\Rabio
2008-03-20 08:09 1,845,504 ----a-w C:\WINDOWS\system32\win32k.sys
2008-03-20 08:09 1,845,504 ----a-w C:\WINDOWS\system32\dllcache\win32k.sys
2008-03-13 16:29 --------- d--h--w C:\Program Files\InstallShield Installation Information
2008-03-11 12:15 --------- d-----w C:\Program Files\The Learning Company
2008-03-06 23:43 --------- d-----w C:\Documents and Settings\HP_Omistaja\Application Data\Winamp
2008-03-06 19:32 706 ----a-w C:\WINDOWS\system32\drivers\COH_Mon.inf
2008-03-06 19:32 23,904 ----a-w C:\WINDOWS\system32\drivers\COH_Mon.sys
2008-03-06 19:32 10,537 ----a-w C:\WINDOWS\system32\drivers\COH_Mon.cat
2008-03-06 08:59 --------- d-----w C:\Documents and Settings\HP_Omistaja\Application Data\Nokia Multimedia Player
2008-03-01 15:31 3,591,680 ----a-w C:\WINDOWS\system32\dllcache\mshtml.dll
2008-02-29 08:56 625,664 ----a-w C:\WINDOWS\system32\dllcache\iexplore.exe
2008-02-29 08:55 70,656 ----a-w C:\WINDOWS\system32\dllcache\ie4uinit.exe
2008-02-22 10:00 13,824 ------w C:\WINDOWS\system32\dllcache\ieudinit.exe
2008-02-20 06:51 282,624 ----a-w C:\WINDOWS\system32\gdi32.dll
2008-02-20 06:51 282,624 ----a-w C:\WINDOWS\system32\dllcache\gdi32.dll
2008-02-20 05:38 45,568 ----a-w C:\WINDOWS\system32\dnsrslvr.dll
2008-02-20 05:38 45,568 ----a-w C:\WINDOWS\system32\dllcache\dnsrslvr.dll
2008-02-20 05:38 148,992 ----a-w C:\WINDOWS\system32\dllcache\dnsapi.dll
2008-02-15 05:44 161,792 ----a-w C:\WINDOWS\system32\dllcache\ieakui.dll
2008-01-29 13:50 81,920 ------r C:\WINDOWS\bwUnin-6.1.4.68-8876480L.exe
2007-12-23 17:03 32 ----a-w C:\Documents and Settings\All Users\Application Data\ezsid.dat
.

((((((((((((((((((((((((((((( snapshot_2008-04-11_13.34.25,45 )))))))))))))))))))))))))))))))))))))))))
.
+ 2008-04-11 10:37:56 876,544 ----a-w C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\Microsoft.Build.Eng#\9710a3c0d11dd264c3a6b88977699e9b\Microsoft.Build.Engine.ni.dll
+ 2008-04-11 10:37:57 81,920 ----a-w C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\Microsoft.Build.Fra#\e2858a45971fb30b0c0523dbb52c1d4e\Microsoft.Build.Framework.ni.dll
+ 2008-04-11 10:38:01 1,695,744 ----a-w C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\Microsoft.Build.Tas#\63d69ffdf3c640d2d104a4b74e8115f8\Microsoft.Build.Tasks.ni.dll
+ 2008-04-11 10:38:01 167,936 ----a-w C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\Microsoft.Build.Uti#\11cb5418c06e30100616fbf205588489\Microsoft.Build.Utilities.ni.dll
+ 2008-04-11 10:38:05 1,740,800 ----a-w C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\Microsoft.VisualBas#\923bd55258380eae77353d36a5a1b08f\Microsoft.VisualBasic.ni.dll
+ 2008-04-11 10:38:07 1,011,712 ----a-w C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System.Configuration\eee9b48577689e92db5a7b5c5de98d9b\System.Configuration.ni.dll
+ 2008-04-11 10:38:09 1,798,144 ----a-w C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System.Deployment\c7dea4895e1fa33d65e448c03de48d26\System.Deployment.ni.dll
+ 2008-04-11 10:38:10 1,224,704 ----a-w C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System.DirectorySer#\914668b240550f529e54bb772c6fc881\System.DirectoryServices.ni.dll
+ 2008-04-11 10:38:12 512,000 ----a-w C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System.DirectorySer#\f11bc82c09955cb8438d3885a99c297d\System.DirectoryServices.Protocols.ni.dll
+ 2008-04-11 10:38:13 659,456 ----a-w C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System.EnterpriseSe#\646131eda5f21f4e6216733d49c22c56\System.EnterpriseServices.ni.dll
+ 2008-04-11 10:38:13 294,912 ----a-w C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System.EnterpriseSe#\646131eda5f21f4e6216733d49c22c56\System.EnterpriseServices.Wrapper.dll
+ 2008-04-11 10:38:14 733,184 ----a-w C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System.Security\2b5994269cc5b996231c9b21afea9a91\System.Security.ni.dll
+ 2008-04-11 10:38:15 233,472 ----a-w C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System.ServiceProce#\193ac978af569ad9ee45110b359961b9\System.ServiceProcess.ni.dll
+ 2008-04-11 10:38:16 679,936 ----a-w C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System.Transactions\12e0aa1030badf4524f897e3f57b037a\System.Transactions.ni.dll
+ 2008-04-11 10:38:35 2,342,912 ----a-w C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System.Web.Mobile\37d87b3cab1c66ec4430ebb2abeaa570\System.Web.Mobile.ni.dll
+ 2008-04-11 10:38:35 237,568 ----a-w C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System.Web.RegularE#\b5b81faf46fc63c20d5339b36edd02fa\System.Web.RegularExpressions.ni.dll
+ 2008-04-11 10:38:38 1,986,560 ----a-w C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System.Web.Services\38991368499e2109ea4099a0fe29c5a3\System.Web.Services.ni.dll
+ 2008-04-11 10:38:31 12,509,184 ----a-w C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System.Web\67cfb70213562afe2ca9b9066764af3a\System.Web.ni.dll
+ 2008-04-29 15:06:27 2,048 --s-a-w C:\WINDOWS\bootstat.dat
+ 2006-03-17 00:26:46 2,314 -c----w C:\WINDOWS\hphmdl10.dat
+ 2004-09-14 21:00:00 2,589 -c--a-w C:\WINDOWS\I386\RUNW32.BAT
+ 2004-09-14 21:00:00 175,104 ----a-w C:\WINDOWS\ime\chsime\applets\PINTLCSA.DLL
+ 2004-09-14 21:00:00 53,760 ----a-w C:\WINDOWS\ime\chsime\applets\PINTLCSD.DLL
+ 2004-09-14 21:00:00 97,792 ----a-w C:\WINDOWS\ime\CHTIME\Applets\CHTMBX.DLL
+ 2004-09-14 21:00:00 56,320 ----a-w C:\WINDOWS\ime\CHTIME\Applets\CHTSKDIC.DLL
+ 2004-09-14 21:00:00 173,568 ----a-w C:\WINDOWS\ime\CHTIME\Applets\CHTSKF.DLL
+ 2004-09-14 21:00:00 10,096,640 ----a-w C:\WINDOWS\ime\CHTIME\Applets\HWXCHT.DLL
+ 2004-09-14 21:00:00 13,463,552 ----a-w C:\WINDOWS\ime\imjp8_1\applets\hwxjpn.dll
+ 2004-09-14 21:00:00 471,102 ----a-w C:\WINDOWS\ime\imjp8_1\applets\imskdic.dll
+ 2004-09-14 21:00:00 315,452 ----a-w C:\WINDOWS\ime\imjp8_1\applets\imskf.dll
+ 2004-09-14 21:00:00 229,439 ----a-w C:\WINDOWS\ime\imjp8_1\applets\multibox.dll
+ 2004-09-14 21:00:00 143,422 ----a-w C:\WINDOWS\ime\imjp8_1\applets\softkey.dll
+ 2004-09-14 21:00:00 426,041 ----a-w C:\WINDOWS\ime\imjp8_1\applets\voicepad.dll
+ 2004-09-14 21:00:00 86,073 ----a-w C:\WINDOWS\ime\imjp8_1\applets\voicesub.dll
+ 2004-09-14 21:00:00 57,399 ----a-w C:\WINDOWS\ime\imjp8_1\cplexe.exe
+ 2004-09-14 21:00:00 368,696 ----a-w C:\WINDOWS\ime\imjp8_1\imjpcic.dll
+ 2004-09-14 21:00:00 716,856 ----a-w C:\WINDOWS\ime\imjp8_1\imjpcus.dll
+ 2004-09-14 21:00:00 57,398 ----a-w C:\WINDOWS\ime\imjp8_1\imjpdadm.exe
+ 2004-09-14 21:00:00 81,976 ----a-w C:\WINDOWS\ime\imjp8_1\imjpdct.dll
+ 2004-09-14 21:00:00 307,257 ----a-w C:\WINDOWS\ime\imjp8_1\imjpdct.exe
+ 2004-09-14 21:00:00 155,705 ----a-w C:\WINDOWS\ime\imjp8_1\imjpdsvr.exe
+ 2004-09-14 21:00:00 196,665 ----a-w C:\WINDOWS\ime\imjp8_1\imjpinst.exe
+ 2004-09-14 21:00:00 208,952 ----a-w C:\WINDOWS\ime\imjp8_1\imjpmig.exe
+ 2004-09-14 21:00:00 233,527 ----a-w C:\WINDOWS\ime\imjp8_1\imjprw.exe
+ 2004-09-14 21:00:00 45,109 ----a-w C:\WINDOWS\ime\imjp8_1\imjpuex.exe
+ 2004-09-14 21:00:00 262,200 ----a-w C:\WINDOWS\ime\imjp8_1\imjputy.exe
+ 2004-09-14 21:00:00 274,489 ----a-w C:\WINDOWS\ime\imjp8_1\imjputyc.dll
+ 2004-09-14 21:00:00 10,129,408 ----a-w C:\WINDOWS\ime\imkr6_1\applets\hwxkor.dll
+ 2004-09-14 21:00:00 86,016 ----a-w C:\WINDOWS\ime\imkr6_1\applets\imekrmbx.dll
+ 2004-09-14 21:00:00 36,864 ----a-w C:\WINDOWS\ime\imkr6_1\dicts\hanjadic.dll
+ 2004-09-14 21:00:00 106,496 ----a-w C:\WINDOWS\ime\imkr6_1\imekrcic.dll
+ 2004-09-14 21:00:00 44,032 ----a-w C:\WINDOWS\ime\imkr6_1\imekrmig.exe
+ 2004-09-14 21:00:00 59,904 ----a-w C:\WINDOWS\ime\imkr6_1\imkrinst.exe
+ 2004-09-14 21:00:00 102,463 ----a-w C:\WINDOWS\ime\shared\imepadsm.dll
+ 2004-09-14 21:00:00 311,359 ----a-w C:\WINDOWS\ime\shared\imepadsv.exe
+ 2004-09-14 21:00:00 102,456 ----a-w C:\WINDOWS\ime\shared\imlang.dll
+ 2004-09-14 21:00:00 15,872 ----a-w C:\WINDOWS\ime\shared\res\PADRS404.DLL
+ 2004-09-14 21:00:00 36,927 ----a-w C:\WINDOWS\ime\shared\res\padrs411.dll
+ 2004-09-14 21:00:00 14,336 ----a-w C:\WINDOWS\ime\shared\res\padrs412.dll
+ 2004-09-14 21:00:00 15,360 ----a-w C:\WINDOWS\ime\shared\res\padrs804.dll
+ 2004-09-14 21:00:00 19,456 ----a-w C:\WINDOWS\msagent\intl\agt0404.dll
+ 2004-09-14 21:00:00 19,456 ----a-w C:\WINDOWS\msagent\intl\agt0411.dll
+ 2004-09-14 21:00:00 19,456 ----a-w C:\WINDOWS\msagent\intl\agt0412.dll
+ 2004-09-14 21:00:00 19,456 ----a-w C:\WINDOWS\msagent\intl\agt0804.dll
+ 2004-09-15 04:00:00 2,000 -c--a-w C:\WINDOWS\system\KEYBOARD.DRV
+ 2004-09-15 04:00:00 2,032 -c--a-w C:\WINDOWS\system\MOUSE.DRV
+ 2004-09-15 04:00:00 1,744 -c--a-w C:\WINDOWS\system\SOUND.DRV
+ 2004-09-15 04:00:00 2,176 -c--a-w C:\WINDOWS\system\VGA.DRV
+ 2004-09-14 21:00:00 218,112 ----a-w C:\WINDOWS\system32\c_g18030.dll
+ 2004-09-14 21:00:00 6,656 ----a-w C:\WINDOWS\system32\c_is2022.dll
+ 2004-09-14 21:00:00 1,677,824 ----a-w C:\WINDOWS\system32\chsbrkr.dll
+ 2004-09-14 21:00:00 838,144 ----a-w C:\WINDOWS\system32\chtbrkr.dll
+ 2004-09-15 04:00:00 1,788 ----a-w C:\WINDOWS\system32\Dcache.bin
- 2004-09-15 04:00:00 19,456 -c--a-w C:\WINDOWS\system32\dllcache\agt0404.dll
+ 2004-09-14 21:00:00 19,456 ----a-w C:\WINDOWS\system32\dllcache\agt0404.dll
- 2004-09-15 04:00:00 19,456 -c--a-w C:\WINDOWS\system32\dllcache\agt0411.dll
+ 2004-09-14 21:00:00 19,456 ----a-w C:\WINDOWS\system32\dllcache\agt0411.dll
- 2004-09-15 04:00:00 19,456 -c--a-w C:\WINDOWS\system32\dllcache\agt0412.dll
+ 2004-09-14 21:00:00 19,456 ----a-w C:\WINDOWS\system32\dllcache\agt0412.dll
- 2004-09-15 04:00:00 19,456 -c--a-w C:\WINDOWS\system32\dllcache\agt0804.dll
+ 2004-09-14 21:00:00 19,456 ----a-w C:\WINDOWS\system32\dllcache\agt0804.dll
- 2004-09-15 04:00:00 218,112 -c--a-w C:\WINDOWS\system32\dllcache\c_g18030.dll
+ 2004-09-14 21:00:00 218,112 ----a-w C:\WINDOWS\system32\dllcache\c_g18030.dll
- 2004-09-15 04:00:00 6,656 -c--a-w C:\WINDOWS\system32\dllcache\c_is2022.dll
+ 2004-09-14 21:00:00 6,656 ----a-w C:\WINDOWS\system32\dllcache\c_is2022.dll
+ 2004-09-14 21:00:00 1,677,824 ----a-w C:\WINDOWS\system32\dllcache\chsbrkr.dll
+ 2004-09-14 21:00:00 838,144 ----a-w C:\WINDOWS\system32\dllcache\chtbrkr.dll
+ 2004-09-14 21:00:00 97,792 ----a-w C:\WINDOWS\system32\dllcache\chtmbx.dll
+ 2004-09-14 21:00:00 56,320 ----a-w C:\WINDOWS\system32\dllcache\chtskdic.dll
+ 2004-09-14 21:00:00 173,568 ----a-w C:\WINDOWS\system32\dllcache\chtskf.dll
+ 2004-09-14 21:00:00 198,656 ----a-w C:\WINDOWS\system32\dllcache\cintime.dll
+ 2004-09-14 21:00:00 480,256 ----a-w C:\WINDOWS\system32\dllcache\cintsetp.exe
+ 2004-09-14 21:00:00 57,399 ----a-w C:\WINDOWS\system32\dllcache\cplexe.exe
+ 2004-08-04 04:07:58 2,944 -c--a-w C:\WINDOWS\system32\dllcache\drmkaud.sys
- 2004-09-15 04:00:00 7,168 -c--a-w C:\WINDOWS\system32\dllcache\f3ahvoas.dll
+ 2004-09-14 21:00:00 7,168 ----a-w C:\WINDOWS\system32\dllcache\f3ahvoas.dll
+ 2004-09-14 21:00:00 36,864 ----a-w C:\WINDOWS\system32\dllcache\hanjadic.dll
+ 2004-09-14 21:00:00 10,096,640 ----a-w C:\WINDOWS\system32\dllcache\hwxcht.dll
+ 2004-09-14 21:00:00 13,463,552 ----a-w C:\WINDOWS\system32\dllcache\hwxjpn.dll
+ 2004-09-14 21:00:00 10,129,408 ----a-w C:\WINDOWS\system32\dllcache\hwxkor.dll
+ 2004-09-14 21:00:00 106,496 ----a-w C:\WINDOWS\system32\dllcache\imekrcic.dll
+ 2004-09-14 21:00:00 86,016 ----a-w C:\WINDOWS\system32\dllcache\imekrmbx.dll
+ 2004-09-14 21:00:00 44,032 ----a-w C:\WINDOWS\system32\dllcache\imekrmig.exe
+ 2004-09-14 21:00:00 102,463 ----a-w C:\WINDOWS\system32\dllcache\imepadsm.dll
+ 2004-09-14 21:00:00 311,359 ----a-w C:\WINDOWS\system32\dllcache\imepadsv.exe
+ 2004-09-14 21:00:00 811,064 ----a-w C:\WINDOWS\system32\dllcache\imjp81k.dll
+ 2004-09-14 21:00:00 368,696 ----a-w C:\WINDOWS\system32\dllcache\imjpcic.dll
+ 2004-09-14 21:00:00 716,856 ----a-w C:\WINDOWS\system32\dllcache\imjpcus.dll
+ 2004-09-14 21:00:00 57,398 ----a-w C:\WINDOWS\system32\dllcache\imjpdadm.exe
+ 2004-09-14 21:00:00 81,976 ----a-w C:\WINDOWS\system32\dllcache\imjpdct.dll
+ 2004-09-14 21:00:00 307,257 ----a-w C:\WINDOWS\system32\dllcache\imjpdct.exe
+ 2004-09-14 21:00:00 155,705 ----a-w C:\WINDOWS\system32\dllcache\imjpdsvr.exe
+ 2004-09-14 21:00:00 196,665 ----a-w C:\WINDOWS\system32\dllcache\imjpinst.exe
+ 2004-09-14 21:00:00 208,952 ----a-w C:\WINDOWS\system32\dllcache\imjpmig.exe
+ 2004-09-14 21:00:00 233,527 ----a-w C:\WINDOWS\system32\dllcache\imjprw.exe
+ 2004-09-14 21:00:00 45,109 ----a-w C:\WINDOWS\system32\dllcache\imjpuex.exe
+ 2004-09-14 21:00:00 262,200 ----a-w C:\WINDOWS\system32\dllcache\imjputy.exe
+ 2004-09-14 21:00:00 274,489 ----a-w C:\WINDOWS\system32\dllcache\imjputyc.dll
+ 2004-09-14 21:00:00 59,904 ----a-w C:\WINDOWS\system32\dllcache\imkrinst.exe
+ 2004-09-14 21:00:00 102,456 ----a-w C:\WINDOWS\system32\dllcache\imlang.dll
+ 2004-09-14 21:00:00 59,392 ----a-w C:\WINDOWS\system32\dllcache\imscinst.exe
+ 2004-09-14 21:00:00 471,102 ----a-w C:\WINDOWS\system32\dllcache\imskdic.dll
+ 2004-09-14 21:00:00 315,452 ----a-w C:\WINDOWS\system32\dllcache\imskf.dll
- 2004-09-15 04:00:00 6,144 -c--a-w C:\WINDOWS\system32\dllcache\kbd101.dll
+ 2004-09-14 21:00:00 6,144 ----a-w C:\WINDOWS\system32\dllcache\kbd101.dll
- 2004-09-15 04:00:00 6,144 -c--a-w C:\WINDOWS\system32\dllcache\kbd101a.dll
+ 2004-09-14 21:00:00 6,144 ----a-w C:\WINDOWS\system32\dllcache\kbd101a.dll
+ 2001-08-17 19:55:56 6,144 ----a-w C:\WINDOWS\system32\dllcache\kbd101b.dll
+ 2001-08-17 19:55:56 6,144 ----a-w C:\WINDOWS\system32\dllcache\kbd101c.dll
+ 2001-08-17 19:55:56 5,632 ----a-w C:\WINDOWS\system32\dllcache\kbd103.dll
+ 2001-08-17 19:55:56 6,144 ----a-w C:\WINDOWS\system32\dllcache\kbd106.dll
- 2004-09-15 04:00:00 6,144 -c--a-w C:\WINDOWS\system32\dllcache\kbd106n.dll
+ 2004-09-14 21:00:00 6,144 ----a-w C:\WINDOWS\system32\dllcache\kbd106n.dll
- 2004-09-15 04:00:00 6,144 -c--a-w C:\WINDOWS\system32\dllcache\kbdax2.dll
+ 2004-09-14 21:00:00 6,144 ----a-w C:\WINDOWS\system32\dllcache\kbdax2.dll
- 2004-09-15 04:00:00 7,168 -c--a-w C:\WINDOWS\system32\dllcache\kbdibm02.dll
+ 2004-09-14 21:00:00 7,168 ----a-w C:\WINDOWS\system32\dllcache\kbdibm02.dll
+ 2001-08-18 03:36:18 8,704 ----a-w C:\WINDOWS\system32\dllcache\kbdjpn.dll
+ 2001-08-18 03:36:18 8,192 ----a-w C:\WINDOWS\system32\dllcache\kbdkor.dll
- 2004-09-15 04:00:00 6,656 -c--a-w C:\WINDOWS\system32\dllcache\kbdlk41a.dll
+ 2004-09-14 21:00:00 6,656 ----a-w C:\WINDOWS\system32\dllcache\kbdlk41a.dll
- 2004-09-15 04:00:00 6,144 -c--a-w C:\WINDOWS\system32\dllcache\kbdlk41j.dll
+ 2004-09-14 21:00:00 6,144 ----a-w C:\WINDOWS\system32\dllcache\kbdlk41j.dll
- 2004-09-15 11:00:00 7,168 -c--a-w C:\WINDOWS\system32\dllcache\kbdnec.dll
+ 2004-09-14 21:00:00 7,168 ----a-w C:\WINDOWS\system32\dllcache\kbdnec.dll
- 2004-09-15 04:00:00 7,168 -c--a-w C:\WINDOWS\system32\dllcache\kbdnec95.dll
+ 2004-09-14 21:00:00 7,168 ----a-w C:\WINDOWS\system32\dllcache\kbdnec95.dll
- 2004-09-15 04:00:00 9,216 -c--a-w C:\WINDOWS\system32\dllcache\kbdnecat.dll
+ 2004-09-14 21:00:00 9,216 ----a-w C:\WINDOWS\system32\dllcache\kbdnecat.dll
- 2004-09-15 04:00:00 7,680 -c--a-w C:\WINDOWS\system32\dllcache\kbdnecnt.dll
+ 2004-09-14 21:00:00 7,680 ----a-w C:\WINDOWS\system32\dllcache\kbdnecnt.dll
+ 2004-09-15 04:00:00 2,000 -c--a-w C:\WINDOWS\system32\dllcache\keyboard.drv
+ 2004-09-14 21:00:00 70,656 ----a-w C:\WINDOWS\system32\dllcache\korwbrkr.dll
+ 2004-09-15 04:00:00 2,560 -c--a-w C:\WINDOWS\system32\dllcache\lz32.dll
+ 2004-09-15 04:00:00 2,032 -c--a-w C:\WINDOWS\system32\dllcache\mouse.drv
+ 2004-09-14 21:00:00 98,304 ----a-w C:\WINDOWS\system32\dllcache\msir3jp.dll
+ 2004-09-14 21:00:00 229,439 ----a-w C:\WINDOWS\system32\dllcache\multibox.dll
+ 2004-09-15 04:00:00 2,944 -c--a-w C:\WINDOWS\system32\dllcache\null.sys
+ 2004-09-14 21:00:00 15,872 ----a-w C:\WINDOWS\system32\dllcache\padrs404.dll
+ 2004-09-14 21:00:00 36,927 ----a-w C:\WINDOWS\system32\dllcache\padrs411.dll
+ 2004-09-14 21:00:00 14,336 ----a-w C:\WINDOWS\system32\dllcache\padrs412.dll
+ 2004-09-14 21:00:00 15,360 ----a-w C:\WINDOWS\system32\dllcache\padrs804.dll
+ 2004-09-14 21:00:00 175,104 ----a-w C:\WINDOWS\system32\dllcache\pintlcsa.dll
+ 2004-09-14 21:00:00 53,760 ----a-w C:\WINDOWS\system32\dllcache\pintlcsd.dll
+ 2004-09-14 21:00:00 70,144 ----a-w C:\WINDOWS\system32\dllcache\pintlphr.exe
+ 2004-09-14 21:00:00 67,584 ----a-w C:\WINDOWS\system32\dllcache\pmigrate.dll
+ 2004-09-14 21:00:00 143,422 ----a-w C:\WINDOWS\system32\dllcache\softkey.dll
+ 2004-09-15 04:00:00 1,744 -c--a-w C:\WINDOWS\system32\dllcache\sound.drv
+ 2004-09-14 21:00:00 44,032 ----a-w C:\WINDOWS\system32\dllcache\tintlphr.exe
+ 2004-09-14 21:00:00 455,168 ----a-w C:\WINDOWS\system32\dllcache\tintsetp.exe
+ 2004-09-14 21:00:00 10,240 ----a-w C:\WINDOWS\system32\dllcache\tmigrate.dll
+ 2004-09-14 21:00:00 76,288 ----a-w C:\WINDOWS\system32\dllcache\uniime.dll
+ 2004-09-15 04:00:00 2,176 -c--a-w C:\WINDOWS\system32\dllcache\vga.drv
+ 2004-09-15 04:00:00 2,864 -c--a-w C:\WINDOWS\system32\dllcache\winsock.dll
+ 2004-09-15 04:00:00 2,112 -c--a-w C:\WINDOWS\system32\dllcache\winspool.exe
+ 2004-09-14 21:00:00 426,041 ----a-w C:\WINDOWS\system32\dllcache\voicepad.dll
+ 2004-09-14 21:00:00 86,073 ----a-w C:\WINDOWS\system32\dllcache\voicesub.dll
+ 2004-09-15 04:00:00 2,736 -c--a-w C:\WINDOWS\system32\dllcache\wowdeb.exe
+ 2006-08-25 03:47:00 2,432 -c----w C:\WINDOWS\system32\drivers\cdr4_xp.sys
+ 2006-08-25 03:47:00 2,560 ------w C:\WINDOWS\system32\drivers\cdralw2k.sys
+ 2004-08-04 04:07:58 2,944 ----a-w C:\WINDOWS\system32\drivers\drmkaud.sys
+ 2004-09-15 04:00:00 2,944 ----a-w C:\WINDOWS\system32\drivers\null.sys
+ 2004-09-14 21:00:00 7,168 ----a-w C:\WINDOWS\system32\f3ahvoas.dll
- 2008-04-10 09:08:55 175,464 ----a-w C:\WINDOWS\system32\FNTCACHE.DAT
+ 2008-04-26 20:12:40 181,040 ----a-w C:\WINDOWS\system32\FNTCACHE.DAT
+ 2004-09-14 21:00:00 198,656 ----a-w C:\WINDOWS\system32\IME\CINTLGNT\CINTIME.DLL
+ 2004-09-14 21:00:00 480,256 ----a-w C:\WINDOWS\system32\IME\CINTLGNT\CINTSETP.EXE
+ 2004-09-14 21:00:00 59,392 ----a-w C:\WINDOWS\system32\IME\PINTLGNT\IMSCINST.EXE
+ 2004-09-14 21:00:00 70,144 ----a-w C:\WINDOWS\system32\IME\PINTLGNT\PINTLPHR.EXE
+ 2004-09-14 21:00:00 67,584 ----a-w C:\WINDOWS\system32\IME\PINTLGNT\PMIGRATE.DLL
+ 2004-09-14 21:00:00 44,032 ----a-w C:\WINDOWS\system32\IME\TINTLGNT\TINTLPHR.EXE
+ 2004-09-14 21:00:00 455,168 ----a-w C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE
+ 2004-09-14 21:00:00 10,240 ----a-w C:\WINDOWS\system32\IME\TINTLGNT\TMIGRATE.DLL
+ 2004-09-14 21:00:00 6,144 ----a-w C:\WINDOWS\system32\kbd101.dll
+ 2004-09-14 21:00:00 6,144 ----a-w C:\WINDOWS\system32\kbd101a.dll
+ 2001-08-17 19:55:56 6,144 ----a-w C:\WINDOWS\system32\kbd101b.dll
+ 2001-08-17 19:55:56 6,144 ----a-w C:\WINDOWS\system32\kbd101c.dll
+ 2001-08-17 19:55:56 5,632 ----a-w C:\WINDOWS\system32\kbd103.dll
+ 2001-08-17 19:55:56 6,144 ----a-w C:\WINDOWS\system32\kbd106.dll
+ 2004-09-14 21:00:00 6,144 ----a-w C:\WINDOWS\system32\kbd106n.dll
+ 2004-09-14 21:00:00 6,144 ----a-w C:\WINDOWS\system32\kbdax2.dll
+ 2004-09-14 21:00:00 7,168 ----a-w C:\WINDOWS\system32\kbdibm02.dll
+ 2001-08-18 03:36:18 8,704 ----a-w C:\WINDOWS\system32\kbdjpn.dll
+ 2001-08-18 03:36:18 8,192 ----a-w C:\WINDOWS\system32\kbdkor.dll
+ 2004-09-14 21:00:00 6,656 ----a-w C:\WINDOWS\system32\kbdlk41a.dll
+ 2004-09-14 21:00:00 6,144 ----a-w C:\WINDOWS\system32\kbdlk41j.dll
- 2004-09-15 11:00:00 7,168 ----a-w C:\WINDOWS\system32\kbdnec.dll
+ 2004-09-14 21:00:00 7,168 ----a-w C:\WINDOWS\system32\kbdnec.dll
+ 2004-09-14 21:00:00 7,168 ----a-w C:\WINDOWS\system32\kbdnec95.dll
+ 2004-09-14 21:00:00 9,216 ----a-w C:\WINDOWS\system32\kbdnecAT.dll
+ 2004-09-14 21:00:00 7,680 ----a-w C:\WINDOWS\system32\kbdnecNT.dll
+ 2004-09-15 04:00:00 2,000 ----a-w C:\WINDOWS\system32\keyboard.drv
+ 2004-09-14 21:00:00 70,656 ----a-w C:\WINDOWS\system32\korwbrkr.dll
+ 2004-09-15 04:00:00 2,560 ----a-w C:\WINDOWS\system32\lz32.dll
+ 2004-09-15 04:00:00 2,032 ----a-w C:\WINDOWS\system32\mouse.drv
+ 2004-09-14 21:00:00 98,304 ----a-w C:\WINDOWS\system32\msir3jp.dll
+ 2005-10-17 23:06:18 1,972 -c--a-w C:\WINDOWS\system32\pcintro\security.cmd
+ 2004-09-15 04:00:00 1,744 ----a-w C:\WINDOWS\system32\sound.drv
+ 2003-03-17 20:27:44 57,344 ----a-w C:\WINDOWS\system32\ThreadMaster\ThreadMast.exe
+ 2004-09-14 21:00:00 76,288 ----a-w C:\WINDOWS\system32\uniime.dll
+ 2004-09-15 04:00:00 2,176 ----a-w C:\WINDOWS\system32\vga.drv
+ 2004-09-15 04:00:00 2,864 ----a-w C:\WINDOWS\system32\winsock.dll
+ 2004-09-15 04:00:00 2,112 ----a-w C:\WINDOWS\system32\winspool.exe
+ 2006-10-18 09:32:38 807,032 ----a-w C:\WINDOWS\system32\wmv9dmod.dll
+ 2004-09-15 04:00:00 2,736 ----a-w C:\WINDOWS\system32\wowdeb.exe
+ 2006-08-05 19:10:33 2,829 -c--a-w C:\WINDOWS\War3Unin.pif
.
-- Snapshot reset to current date --
.
(((((((((((((((((((((((((((((( Rekisterin käynnistyskohteet )))))))))))))))))))))))))))))))))))))))))))))
.
.
REGEDIT4
*Huom* Tyhjiä arvoja ja laillisia oletusarvoja ei näytetä

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ccApp"="C:\Program Files\Common Files\Symantec Shared\ccApp.exe" [2007-01-10 00:59 115816]
"LVCOMSX"="C:\WINDOWS\system32\LVCOMSX.EXE" [2005-07-19 18:32 221184]
"Recguard"="C:\WINDOWS\SMINST\RECGUARD.EXE" [2005-07-22 23:14 237568]
"Symantec PIF AlertEng"="C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe" [2008-01-29 18:38 583048]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe" [2008-02-22 04:25 144784]
"!AVG Anti-Spyware"="C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" [2007-06-11 12:25 6731312]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"Picasa Media Detector"="C:\Program Files\Picasa2\PicasaMediaDetector.exe" [2007-10-24 00:18 443968]
"Nokia.PCSync"="C:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe" [2007-11-07 18:35 1294336]

C:\Documents and Settings\All Users\K?ynnist?-valikko\Ohjelmat\K?ynnistys\
HP Digital Imaging Monitor.lnk - C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe [2006-02-19 05:21:22 288472]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run-]
"ctfmon.exe"=C:\WINDOWS\system32\ctfmon.exe
"PC Suite Tray"="C:\Program Files\Nokia\Nokia PC Suite 6\PCSuite.exe" -onlytray
"LogitechSoftwareUpdate"="C:\Program Files\Logitech\Video\ManifestEngine.exe" boot
"LDM"=C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BackWeb-8876480.exe

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-]
"TkBellExe"="C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
"DAEMON Tools"="C:\Program Files\DAEMON Tools\daemon.exe" -lang 1033
"QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" -atboottime
"WinampAgent"="C:\Program Files\Winamp\winampa.exe"
"Reminder"="C:\Windows\Creator\Remind_XP.exe"
"HPHUPD08"=c:\Program Files\HP\Digital Imaging\{33D6CC28-9F75-4d1b-A11D-98895B3A3729}\hphupd08.exe
"HP Software Update"=C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
"NeroCheck"=C:\WINDOWS\system32\NeroCheck.exe
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe"
"HPBootOp"="C:\Program Files\Hewlett-Packard\HP Boot Optimizer\HPBootOp.exe" /run
"UnlockerAssistant"="C:\Program Files\Unlocker\UnlockerAssistant.exe"
"LogitechVideoTray"=C:\Program Files\Logitech\Video\LogiTray.exe
"HydraVisionDesktopManager"=C:\Program Files\ATI Technologies\ATI HYDRAVISION\HydraDM.exe
"Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
"Symantec PIF AlertEng"="C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe" /a /m "C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\AlertEng.dll"

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusDisableNotify"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqtra08.exe"=
"C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqste08.exe"=
"C:\\Program Files\\HP\\Digital Imaging\\bin\\hpofxm08.exe"=
"C:\\Program Files\\HP\\Digital Imaging\\bin\\hposfx08.exe"=
"C:\\Program Files\\HP\\Digital Imaging\\bin\\hposid01.exe"=
"C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqscnvw.exe"=
"C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqkygrp.exe"=
"C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqCopy.exe"=
"C:\\Program Files\\HP\\Digital Imaging\\bin\\hpfccopy.exe"=
"C:\\Program Files\\HP\\Digital Imaging\\bin\\hpzwiz01.exe"=
"C:\\Program Files\\HP\\Digital Imaging\\Unload\\HpqPhUnl.exe"=
"C:\\Program Files\\HP\\Digital Imaging\\Unload\\HpqDIA.exe"=
"C:\\Program Files\\HP\\Digital Imaging\\bin\\hpoews01.exe"=
"C:\\Program Files\\Mozilla Firefox\\firefox.exe"=
"C:\\Program Files\\iTunes\\iTunes.exe"=
"C:\\Program Files\\mIRC\\mirc.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"C:\\Program Files\\MSN Messenger\\msnmsgr.exe"=
"C:\\Program Files\\MSN Messenger\\livecall.exe"=
"C:\\Program Files\\Messenger\\msmsgs.exe"=
"C:\\Program Files\\Skype\\Phone\\Skype.exe"=

R2 Automaattinen LiveUpdate-ajastustoiminto;Automaattinen LiveUpdate-ajastustoiminto;"C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe" [2007-09-26 12:53]
R2 ThreadMaster;Thread Master;C:\WINDOWS\system32\ThreadMaster\ThreadMast.exe [2003-03-17 23:27]
S2 Automattinen LiveUpdate-ajastustoiminto;Automattinen LiveUpdate-ajastustoiminto;"C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe" [2007-09-26 12:53]

*Newly Created Service* - COMHOST
.
'Ajoitetut tehtävät'-kansion sisältö
"2008-04-29 17:00:00 C:\WINDOWS\Tasks\1-Click Maintenance.job"
- C:\Program Files\TuneUp Utilities 2008\OneClickStarter.exe
.
**************************************************************************

catchme 0.3.1353 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-04-29 20:28:26
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...


**************************************************************************
.
Completion time: 2008-04-29 20:31:12
ComboFix-quarantined-files.txt 2008-04-29 17:30:09
ComboFix2.txt 2008-04-11 10:45:01
ComboFix3.txt 2008-04-11 10:34:46
ComboFix4.txt 2008-04-05 22:37:11

Pre-Run: 24,843,829,248 tavua vapaana
Post-Run: 24,864,927,744 tavua vapaana

415 --- E O F --- 2008-04-26 21:52:55


======================================================================
======================================================================



SDFix: Version 1.177
Run by HP_Omistaja on ti 29.04.2008 at 20:45

Microsoft Windows XP [versio 5.1.2600]
Running From: C:\DOCUME~1\HP_OMI~1\TYPYT~1\SDFix

Checking Services :


Restoring Windows Registry Values
Restoring Windows Default Hosts File

Rebooting


Checking Files :

No Trojan Files Found






Removing Temp Files

ADS Check :



Final Check :

catchme 0.3.1353.2 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-04-29 20:57:48
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden services & system hive ...

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg]
"s0"=dword:b44b7492
"s1"=dword:67c5c2ca
"s2"=dword:12475a13
"h0"=dword:00000001

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4]
"p0"="C:\Program Files\DAEMON Tools\"
"h0"=dword:00000000
"khjeh"=hex:43,5d,c9,37,ef,90,2f,dc,46,aa,72,8c,9b,e4,89,c5,ee,25,bf,14,6f,..

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001]
"a0"=hex:20,01,00,00,c2,c3,48,c8,eb,56,61,08,86,e9,f1,00,e2,57,fe,65,74,..
"khjeh"=hex:a0,57,e8,bd,5c,a7,8a,4a,36,85,1e,43,6e,08,06,7c,8f,93,2d,85,4f,..

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40]
"khjeh"=hex:a5,92,a3,e4,f3,ba,bb,36,9e,93,f1,f1,a7,af,35,23,f2,74,ec,69,94,..
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4]
"p0"="C:\Program Files\DAEMON Tools\"
"h0"=dword:00000000
"khjeh"=hex:43,5d,c9,37,ef,90,2f,dc,46,aa,72,8c,9b,e4,89,c5,ee,25,bf,14,6f,..

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001]
"a0"=hex:20,01,00,00,c2,c3,48,c8,eb,56,61,08,86,e9,f1,00,e2,57,fe,65,74,..
"khjeh"=hex:a0,57,e8,bd,5c,a7,8a,4a,36,85,1e,43,6e,08,06,7c,8f,93,2d,85,4f,..

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40]
"khjeh"=hex:a5,92,a3,e4,f3,ba,bb,36,9e,93,f1,f1,a7,af,35,23,f2,74,ec,69,94,..

scanning hidden registry entries ...

scanning hidden files ...


scan completed successfully
hidden processes: 0
hidden services: 0
hidden files: 7


Remaining Services :




Authorized Application Key Export:

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
"%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqtra08.exe"="C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqtra08.exe:*:Enabled:hpqtra08.exe"
"C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqste08.exe"="C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqste08.exe:*:Enabled:hpqste08.exe"
"C:\\Program Files\\HP\\Digital Imaging\\bin\\hpofxm08.exe"="C:\\Program Files\\HP\\Digital Imaging\\bin\\hpofxm08.exe:*:Enabled:hpofxm08.exe"
"C:\\Program Files\\HP\\Digital Imaging\\bin\\hposfx08.exe"="C:\\Program Files\\HP\\Digital Imaging\\bin\\hposfx08.exe:*:Enabled:hposfx08.exe"
"C:\\Program Files\\HP\\Digital Imaging\\bin\\hposid01.exe"="C:\\Program Files\\HP\\Digital Imaging\\bin\\hposid01.exe:*:Enabled:hposid01.exe"
"C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqscnvw.exe"="C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqscnvw.exe:*:Enabled:hpqscnvw.exe"
"C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqkygrp.exe"="C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqkygrp.exe:*:Enabled:hpqkygrp.exe"
"C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqCopy.exe"="C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqCopy.exe:*:Enabled:hpqcopy.exe"
"C:\\Program Files\\HP\\Digital Imaging\\bin\\hpfccopy.exe"="C:\\Program Files\\HP\\Digital Imaging\\bin\\hpfccopy.exe:*:Enabled:hpfccopy.exe"
"C:\\Program Files\\HP\\Digital Imaging\\bin\\hpzwiz01.exe"="C:\\Program Files\\HP\\Digital Imaging\\bin\\hpzwiz01.exe:*:Enabled:hpzwiz01.exe"
"C:\\Program Files\\HP\\Digital Imaging\\Unload\\HpqPhUnl.exe"="C:\\Program Files\\HP\\Digital Imaging\\Unload\\HpqPhUnl.exe:*:Enabled:hpqphunl.exe"
"C:\\Program Files\\HP\\Digital Imaging\\Unload\\HpqDIA.exe"="C:\\Program Files\\HP\\Digital Imaging\\Unload\\HpqDIA.exe:*:Enabled:hpqdia.exe"
"C:\\Program Files\\HP\\Digital Imaging\\bin\\hpoews01.exe"="C:\\Program Files\\HP\\Digital Imaging\\bin\\hpoews01.exe:*:Enabled:hpoews01.exe"
"C:\\Program Files\\Mozilla Firefox\\firefox.exe"="C:\\Program Files\\Mozilla Firefox\\firefox.exe:*:Enabled:Firefox"
"C:\\Program Files\\iTunes\\iTunes.exe"="C:\\Program Files\\iTunes\\iTunes.exe:*:Enabled:iTunes"
"C:\\Program Files\\mIRC\\mirc.exe"="C:\\Program Files\\mIRC\\mirc.exe:*:Enabled:mIRC"
"%windir%\\Network Diagnostic\\xpnetdiag.exe"="%windir%\\Network Diagnostic\\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"
"C:\\Program Files\\MSN Messenger\\msnmsgr.exe"="C:\\Program Files\\MSN Messenger\\msnmsgr.exe:*:Enabled:Windows Live Messenger 8.1"
"C:\\Program Files\\MSN Messenger\\livecall.exe"="C:\\Program Files\\MSN Messenger\\livecall.exe:*:Enabled:Windows Live Messenger 8.1 (Phone)"
"C:\\Program Files\\Messenger\\msmsgs.exe"="C:\\Program Files\\Messenger\\msmsgs.exe:*:Enabled:Windows Messenger"
"C:\\Program Files\\Skype\\Phone\\Skype.exe"="C:\\Program Files\\Skype\\Phone\\Skype.exe:*:Enabled:Skype"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
"%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"C:\\Program Files\\MSN Messenger\\msncall.exe"="C:\\Program Files\\MSN Messenger\\msncall.exe:*:Enabled:Windows Live Messenger 8.0 (Phone)"
"%windir%\\Network Diagnostic\\xpnetdiag.exe"="%windir%\\Network Diagnostic\\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"
"C:\\Program Files\\MSN Messenger\\msnmsgr.exe"="C:\\Program Files\\MSN Messenger\\msnmsgr.exe:*:Enabled:Windows Live Messenger 8.1"
"C:\\Program Files\\MSN Messenger\\livecall.exe"="C:\\Program Files\\MSN Messenger\\livecall.exe:*:Enabled:Windows Live Messenger 8.1 (Phone)"

Remaining Files :


File Backups: - C:\DOCUME~1\HP_OMI~1\TYPYT~1\SDFix\backups\backups.zip

Files with Hidden Attributes :

Fri 22 Jul 2005 32,768 A..H. --- "C:\Program Files\AMV Converter\AmvTransform.dll"
Mon 6 Mar 2006 77,824 A..H. --- "C:\Program Files\AMV Converter\AMV_EncDLL.dll"
Tue 27 Dec 2005 40,960 A..H. --- "C:\Program Files\AMV Converter\net.dll"
Wed 8 Mar 2006 106,496 A..H. --- "C:\Program Files\AMV Converter\transdll.dll"
Wed 14 Nov 2007 6,219,320 A..H. --- "C:\Program Files\Picasa2\setup.exe"
Tue 6 Jan 2004 188,416 A..H. --- "C:\Program Files\Rockstar Games\GTA San Andreas\eax.dll"
Fri 3 Feb 2006 15,806,464 A..H. --- "C:\Program Files\Rockstar Games\GTA San Andreas\gta_sa.exe"
Sat 15 Nov 2003 36,864 A..H. --- "C:\Program Files\Rockstar Games\GTA San Andreas\ogg.dll"
Sun 16 Nov 2003 1,060,864 A..H. --- "C:\Program Files\Rockstar Games\GTA San Andreas\vorbis.dll"
Sun 16 Nov 2003 65,536 A..H. --- "C:\Program Files\Rockstar Games\GTA San Andreas\vorbisFile.dll"
Thu 20 Mar 2008 444 ...HR --- "C:\Documents and Settings\HP_Omistaja\Application Data\SecuROM\UserData\securom_v7_01.bak"

Finished!


======================================================================
======================================================================


Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 21:29:36, on 29.4.2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16640)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\Program Files\Bluetooth\Bluetooth-ohjelmisto\bin\btwdins.exe
C:\WINDOWS\system32\HPZipm12.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\ThreadMaster\ThreadMast.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\WINDOWS\system32\LVCOMSX.EXE
C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe
C:\WINDOWS\system32\NOTEPAD.EXE
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
C:\Program Files\HP\Digital Imaging\bin\hpqSTE08.exe
C:\WINDOWS\system32\NOTEPAD.EXE
C:\WINDOWS\system32\NOTEPAD.EXE
C:\WINDOWS\system32\NOTEPAD.EXE
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\HJ\Skanneri.exe.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://finnish.toggle.com/index.php?rvs=hompag
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = localhost
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Linkit
O2 - BHO: Adobe PDF Reader -linkkiavustaja - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {1E8A6170-7264-4D0F-BEAE-D42A53123C75} - C:\Program Files\Common Files\Symantec Shared\coShared\Browser\1.5\NppBho.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [LVCOMSX] C:\WINDOWS\system32\LVCOMSX.EXE
O4 - HKLM\..\Run: [Recguard] C:\WINDOWS\SMINST\RECGUARD.EXE
O4 - HKLM\..\Run: [Symantec PIF AlertEng] "C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe" /a /m "C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\AlertEng.dll"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe"
O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Paikallinen palve')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Verkkopalve')
O4 - HKUS\S-1-5-18\..\Run: [Picasa Media Detector] C:\Program Files\Picasa2\PicasaMediaDetector.exe (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [Picasa Media Detector] C:\Program Files\Picasa2\PicasaMediaDetector.exe (User 'Default user')
O4 - .DEFAULT User Startup: Pin.lnk = C:\hp\bin\CLOAKER.EXE (User 'Default user')
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O8 - Extra context menu item: Lähetä &Bluetooth-laitteeseen - C:\Program Files\Bluetooth\Bluetooth-ohjelmisto\btsendto_ie_ctx.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra button: @btrez.dll,-4015 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\Bluetooth\Bluetooth-ohjelmisto\btsendto_ie.htm
O9 - Extra 'Tools' menuitem: @btrez.dll,-4017 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\Bluetooth\Bluetooth-ohjelmisto\btsendto_ie.htm
O9 - Extra button: Yhteysohje - {E2D4D26B-0180-43a4-B05F-462D6D54C789} - C:\WINDOWS\PCHEALTH\HELPCTR\Vendors\CN=Hewlett-Packard,L=Cupertino,S=Ca,C=US\IEButton\support.htm
O9 - Extra 'Tools' menuitem: Yhteysohje - {E2D4D26B-0180-43a4-B05F-462D6D54C789} - C:\WINDOWS\PCHEALTH\HELPCTR\Vendors\CN=Hewlett-Packard,L=Cupertino,S=Ca,C=US\IEButton\support.htm
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {C4847596-972C-11D0-9567-00A0C9273C2A} (Crystal Report Viewer Control) - http://jasenpalvelut.hammasll.fi/viewer/...tivexviewer.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/sh...ash/swflash.cab
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: Automaattinen LiveUpdate-ajastustoiminto - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
O23 - Service: Automattinen LiveUpdate-ajastustoiminto - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: Bluetooth Service (btwdins) - Broadcom Corporation. - C:\Program Files\Bluetooth\Bluetooth-ohjelmisto\bin\btwdins.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: Symantec Lic NetConnect service (CLTNetCnService) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: COM Host (comHost) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\VAScanner\comHost.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPodService - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
O23 - Service: LiveUpdate Notice Service Ex (LiveUpdate Notice Ex) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: LiveUpdate Notice Service - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: ServiceLayer - Nokia. - C:\Program Files\PC Connectivity Solution\ServiceLayer.exe
O23 - Service: Symantec Core LC - Unknown owner - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
O23 - Service: Thread Master (ThreadMaster) - http://threadmaster.tripod.com - threadmaster@europe.com - C:\WINDOWS\system32\ThreadMaster\ThreadMast.exe

--
End of file - 8659 bytes
Hujo
Suspended permanently
_
30. huhtikuuta 2008 @ 08:02 _ Linkki tähän viestiin    Lähetä käyttäjälle yksityisviesti   
Escan
Ohjeet tuolla sivulla.
http://koti.mbnet.fi/pattaya1/escanmwav.htm
lataa tuosta
http://www.spywareinfo.dk/download/mwav.exe
päivitä tuosta
http://koti.mbnet.fi/pattaya1/lataus/Mwav.bat
laita täpit merkkauksien mukaan
http://koti.mbnet.fi/pattaya1/eScan6.jpg

scannaa

jos ala luukkuun tulee jotain niin kopioi se näin:
Käytä komentoa Ctrl+A.
Kopioi rivit komennolla Ctrl+C.
Liitä rivit komennolla Ctrl+V.

Laita virus log tänne.


Voiko tietsikka koskaan toimia?
Newbie
_
30. huhtikuuta 2008 @ 15:34 _ Linkki tähän viestiin    Lähetä käyttäjälle yksityisviesti   
Virus Log Information

File C:\Documents and Settings\HP_Omistaja\.housecall6.6\Quarantine\css4[1].bac_a01636 infected by "Packed.Win32.Monder.gen" Virus. Action Taken: File Renamed.
File C:\Documents and Settings\HP_Omistaja\.housecall6.6\Quarantine\ddccy.dll.bac_a02620 tagged as not-a-virus:AdWare.Win32.Virtumonde.lrz. No Action Taken.
File C:\Documents and Settings\HP_Omistaja\.housecall6.6\Quarantine\fonfnjrh.dll.bac_a01636 infected by "Packed.Win32.Monder.gen" Virus. Action Taken: File Renamed.
File C:\Documents and Settings\HP_Omistaja\.housecall6.6\Quarantine\fxrnjihy.dll.bac_a01636 infected by "Packed.Win32.Monder.gen" Virus. Action Taken: File Renamed.
File C:\Documents and Settings\HP_Omistaja\.housecall6.6\Quarantine\fymdclew.dll.bad.bac_a02620 infected by "Packed.Win32.Monder.gen" Virus. Action Taken: File Renamed.
File C:\Documents and Settings\HP_Omistaja\.housecall6.6\Quarantine\idvocmaw.dll.bac_a02620 infected by "Packed.Win32.Monder.gen" Virus. Action Taken: File Renamed.
File C:\Documents and Settings\HP_Omistaja\.housecall6.6\Quarantine\ikiyjsbe.dll.bad.bac_a02620 infected by "Packed.Win32.Monder.gen" Virus. Action Taken: File Renamed.
File C:\Documents and Settings\HP_Omistaja\.housecall6.6\Quarantine\jccocjbr.dll.bac_a02620 tagged as not-a-virus:AdWare.Win32.Virtumonde.lwv. No Action Taken.
File C:\Documents and Settings\HP_Omistaja\.housecall6.6\Quarantine\khfcyyx.dll.bac_a01636 tagged as not-a-virus:AdWare.Win32.Virtumonde.ksn. No Action Taken.
File C:\Documents and Settings\HP_Omistaja\.housecall6.6\Quarantine\kydfyphn.dll.bac_a01636 infected by "Packed.Win32.Monder.gen" Virus. Action Taken: File Renamed.
File C:\Documents and Settings\HP_Omistaja\.housecall6.6\Quarantine\mllmk.dll.bac_a01636 infected by "Packed.Win32.Monder.gen" Virus. Action Taken: File Renamed.
File C:\Documents and Settings\HP_Omistaja\.housecall6.6\Quarantine\oexyrego.dll.bac_a01636 tagged as not-a-virus:AdWare.Win32.Virtumonde.lxl. No Action Taken.
File C:\Documents and Settings\HP_Omistaja\.housecall6.6\Quarantine\rqrponm.dll.bac_a01636 tagged as not-a-virus:AdWare.Win32.Virtumonde.ksn. No Action Taken.
File C:\Documents and Settings\HP_Omistaja\.housecall6.6\Quarantine\spvavobp.dll.bac_a01636 infected by "Packed.Win32.Monder.gen" Virus. Action Taken: File Renamed.
File C:\Documents and Settings\HP_Omistaja\.housecall6.6\Quarantine\sucpljtb.dll.bac_a01636 infected by "Packed.Win32.Monder.gen" Virus. Action Taken: File Renamed.
File C:\Documents and Settings\HP_Omistaja\.housecall6.6\Quarantine\upgrade[1].cab.bac_a01636 tagged as not-a-virus:AdWare.Win32.OneStep.f. No Action Taken.
File C:\Documents and Settings\HP_Omistaja\.housecall6.6\Quarantine\wkwonefh.dll.bac_a01636 infected by "Packed.Win32.Monder.gen" Virus. Action Taken: File Renamed.
File C:\Documents and Settings\HP_Omistaja\Application Data\SecuROM\UserData\???????????p????????? infected by "BkCln.Unknown" Virus. Action Taken: File Renamed.
File C:\Documents and Settings\HP_Omistaja\Application Data\SecuROM\UserData\???????????p????????? infected by "BkCln.Unknown" Virus. Action Taken: File Renamed.
Hujo
Suspended permanently
_
30. huhtikuuta 2008 @ 15:47 _ Linkki tähän viestiin    Lähetä käyttäjälle yksityisviesti   
Lataa TÄSTÄ VundoFix.exe työpöydällesi.

Tupla-klikkaa VundoFix.exe ajaaksesi sen.
Klikkaa Scan for Vundo valintaa.
Kun skannaus on valmis, klikkaa Remove Vundo valintaa.
Sinulta kysytään haluatko poistaa filut - klikkaa YES.
Kun olet klikannut yes, työpöytäsi tyhjenee kun se alkaa poistamaan Vundoa.
Kun se on valmis, fiksi ilmoittaa käynnistäväsi koneesi uudelleen, klikkaa OK.
Postita C:\vundofix.txt lokin sekä tuoreen HijackThis lokin sisältö.

Huomaa: Se on mahdollista että VundoFix löysi tiedoston jota se ei pystynyt poistamaan.
Tässä tilanteessa, VundoFix ajaa itsensä rebootissa, seuraa vain yläpuolelle olevia ohjeita alkaen kohdasta "Klikkaa Scan for Vundo valintaa." kun VundoFix ilmaantuu uudelleenkäynnistyksen yhteydessä.


Voiko tietsikka koskaan toimia?
Newbie
_
30. huhtikuuta 2008 @ 17:01 _ Linkki tähän viestiin    Lähetä käyttäjälle yksityisviesti   
VundoFix V7.0.3

Scan started at 16:04:46 30.4.2008

Listing files found while scanning....

No infected files were found.


=========================================================================
=========================================================================


Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 17:00:46, on 30.4.2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16640)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\Program Files\Bluetooth\Bluetooth-ohjelmisto\bin\btwdins.exe
C:\WINDOWS\system32\HPZipm12.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\ThreadMaster\ThreadMast.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\WINDOWS\system32\LVCOMSX.EXE
C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\Program Files\HP\Digital Imaging\bin\hpqSTE08.exe
C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
C:\Kaspersky\mwavscan.com
C:\Kaspersky\kavss.exe
C:\Documents and Settings\HP_Omistaja\Työpöytä\VundoFix.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Logitech\Video\AlbumDB2.exe
C:\Program Files\Logitech\Video\FxSvr2.exe
C:\Program Files\HJ\Skanneri.exe.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://finnish.toggle.com/index.php?rvs=hompag
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = localhost
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Linkit
O2 - BHO: Adobe PDF Reader -linkkiavustaja - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {1E8A6170-7264-4D0F-BEAE-D42A53123C75} - C:\Program Files\Common Files\Symantec Shared\coShared\Browser\1.5\NppBho.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [LVCOMSX] C:\WINDOWS\system32\LVCOMSX.EXE
O4 - HKLM\..\Run: [Recguard] C:\WINDOWS\SMINST\RECGUARD.EXE
O4 - HKLM\..\Run: [Symantec PIF AlertEng] "C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe" /a /m "C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\AlertEng.dll"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe"
O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Paikallinen palve')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Verkkopalve')
O4 - HKUS\S-1-5-18\..\Run: [Picasa Media Detector] C:\Program Files\Picasa2\PicasaMediaDetector.exe (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [Picasa Media Detector] C:\Program Files\Picasa2\PicasaMediaDetector.exe (User 'Default user')
O4 - .DEFAULT User Startup: Pin.lnk = C:\hp\bin\CLOAKER.EXE (User 'Default user')
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O8 - Extra context menu item: Lähetä &Bluetooth-laitteeseen - C:\Program Files\Bluetooth\Bluetooth-ohjelmisto\btsendto_ie_ctx.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra button: @btrez.dll,-4015 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\Bluetooth\Bluetooth-ohjelmisto\btsendto_ie.htm
O9 - Extra 'Tools' menuitem: @btrez.dll,-4017 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\Bluetooth\Bluetooth-ohjelmisto\btsendto_ie.htm
O9 - Extra button: Yhteysohje - {E2D4D26B-0180-43a4-B05F-462D6D54C789} - C:\WINDOWS\PCHEALTH\HELPCTR\Vendors\CN=Hewlett-Packard,L=Cupertino,S=Ca,C=US\IEButton\support.htm
O9 - Extra 'Tools' menuitem: Yhteysohje - {E2D4D26B-0180-43a4-B05F-462D6D54C789} - C:\WINDOWS\PCHEALTH\HELPCTR\Vendors\CN=Hewlett-Packard,L=Cupertino,S=Ca,C=US\IEButton\support.htm
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {C4847596-972C-11D0-9567-00A0C9273C2A} (Crystal Report Viewer Control) - http://jasenpalvelut.hammasll.fi/viewer/...tivexviewer.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/sh...ash/swflash.cab
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: Automaattinen LiveUpdate-ajastustoiminto - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
O23 - Service: Automattinen LiveUpdate-ajastustoiminto - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: Bluetooth Service (btwdins) - Broadcom Corporation. - C:\Program Files\Bluetooth\Bluetooth-ohjelmisto\bin\btwdins.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: Symantec Lic NetConnect service (CLTNetCnService) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: COM Host (comHost) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\VAScanner\comHost.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPodService - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
O23 - Service: LiveUpdate Notice Service Ex (LiveUpdate Notice Ex) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: LiveUpdate Notice Service - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: ServiceLayer - Nokia. - C:\Program Files\PC Connectivity Solution\ServiceLayer.exe
O23 - Service: Symantec Core LC - Unknown owner - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
O23 - Service: Thread Master (ThreadMaster) - http://threadmaster.tripod.com - threadmaster@europe.com - C:\WINDOWS\system32\ThreadMaster\ThreadMast.exe

--
End of file - 8729 bytes
Hujo
Suspended permanently
_
30. huhtikuuta 2008 @ 18:17 _ Linkki tähän viestiin    Lähetä käyttäjälle yksityisviesti   
Vieläkös nypyttelee..

Voiko tietsikka koskaan toimia?
Newbie
_
30. huhtikuuta 2008 @ 18:41 _ Linkki tähän viestiin    Lähetä käyttäjälle yksityisviesti   
Joo, mielestäni toimintaan ei ole tullut juurikaan muutoksia. Nytkin esim. tätä viestiä kirjotellessa teksti pureutui foorumille ''pätkimällä''.

Mikähän tässä sitten voisi olla... jonkun aikaa videon tai netin käynnistymisen jälkeen saattaa toimia moitteettomasti, mutta sitten alkaa tasainen nykiminen. Netti on Soneran 1Mt/512kt. Muutenhan tämän kanssa selviää, mutta videoiden katselu on mahdotonta. Esim. tietokonepelit ja kiekko.tk toimii moitteettomasti mitä ihmettelen eniten. Nykiminen näyttäisi esiintyvän nimenomaan nettisivustojen ja videoiden katselun yhteydessä. En kyllä muista että olisin vastaavaan törmännyt aiemmin. En ehkä osaa antaa siksi myöskään riittävän hyviä tietoja sinulle.
Hujo
Suspended permanently
_
30. huhtikuuta 2008 @ 22:21 _ Linkki tähän viestiin    Lähetä käyttäjälle yksityisviesti   
Lataa Deckard's System Scanner
Työpöydällesi.

Huomioi: Sinulla tulee olla Järjestelmänvalvojan oikeudet ajaaksesi ohjelman.

[*]Sulje kaikki avoimet ikkunat ja ohjelmat.
[*]Tupla Klikkaa Dss.exe tiedostoa ajaaksesi ohjelman, seuraa ohjeita.
[*]Kun Scannaus on valmis 2 textitiedostoa pitäisi avautua, Main.txt ja extra.txt
[*]Näppäile Kopioi ( CTRL+A -> CTRL + C ) ja liitä ( CTRL + V )
[*]kopioi ja liitä main.txt ja extra.txt sisältö seuraavaan vastaukseesi.


Voiko tietsikka koskaan toimia?
Newbie
_
30. huhtikuuta 2008 @ 23:12 _ Linkki tähän viestiin    Lähetä käyttäjälle yksityisviesti   
Deckard's System Scanner v20071014.68
Run by HP_Omistaja on 2008-04-30 22:57:45
Computer is in Normal Mode.
--------------------------------------------------------------------------------

-- System Restore --------------------------------------------------------------

Successfully created a Deckard's System Scanner Restore Point.


-- Last 5 Restore Point(s) --
105: 2008-04-30 19:57:54 UTC - RP568 - Deckard's System Scanner Restore Point
104: 2008-04-29 17:25:35 UTC - RP567 - ComboFix created restore point
103: 2008-04-29 05:47:16 UTC - RP566 - Asennettu Opera 9.27
102: 2008-04-28 19:49:15 UTC - RP565 - Järjestelmän tarkistuspiste
101: 2008-04-26 21:51:43 UTC - RP564 - Software Distribution Service 3.0


-- First Restore Point --
1: 2008-04-02 12:11:07 UTC - RP464 - Järjestelmän tarkistuspiste


Backed up registry hives.
Performed disk cleanup.



-- HijackThis (run as HP_Omistaja.exe) -----------------------------------------

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 22:59:37, on 30.4.2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16640)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\Program Files\Bluetooth\Bluetooth-ohjelmisto\bin\btwdins.exe
C:\WINDOWS\system32\HPZipm12.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\ThreadMaster\ThreadMast.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\WINDOWS\system32\LVCOMSX.EXE
C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\Program Files\HP\Digital Imaging\bin\hpqSTE08.exe
C:\Documents and Settings\HP_Omistaja\Työpöytä\dss.exe
C:\PROGRA~1\HJ\HP_Omistaja.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://finnish.toggle.com/index.php?rvs=hompag
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = localhost
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Linkit
O2 - BHO: Adobe PDF Reader -linkkiavustaja - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {1E8A6170-7264-4D0F-BEAE-D42A53123C75} - C:\Program Files\Common Files\Symantec Shared\coShared\Browser\1.5\NppBho.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [LVCOMSX] C:\WINDOWS\system32\LVCOMSX.EXE
O4 - HKLM\..\Run: [Recguard] C:\WINDOWS\SMINST\RECGUARD.EXE
O4 - HKLM\..\Run: [Symantec PIF AlertEng] "C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe" /a /m "C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\AlertEng.dll"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe"
O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Paikallinen palve')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Verkkopalve')
O4 - HKUS\S-1-5-18\..\Run: [Picasa Media Detector] C:\Program Files\Picasa2\PicasaMediaDetector.exe (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [Picasa Media Detector] C:\Program Files\Picasa2\PicasaMediaDetector.exe (User 'Default user')
O4 - .DEFAULT User Startup: Pin.lnk = C:\hp\bin\CLOAKER.EXE (User 'Default user')
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O8 - Extra context menu item: Lähetä &Bluetooth-laitteeseen - C:\Program Files\Bluetooth\Bluetooth-ohjelmisto\btsendto_ie_ctx.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra button: @btrez.dll,-4015 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\Bluetooth\Bluetooth-ohjelmisto\btsendto_ie.htm
O9 - Extra 'Tools' menuitem: @btrez.dll,-4017 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\Bluetooth\Bluetooth-ohjelmisto\btsendto_ie.htm
O9 - Extra button: Yhteysohje - {E2D4D26B-0180-43a4-B05F-462D6D54C789} - C:\WINDOWS\PCHEALTH\HELPCTR\Vendors\CN=Hewlett-Packard,L=Cupertino,S=Ca,C=US\IEButton\support.htm
O9 - Extra 'Tools' menuitem: Yhteysohje - {E2D4D26B-0180-43a4-B05F-462D6D54C789} - C:\WINDOWS\PCHEALTH\HELPCTR\Vendors\CN=Hewlett-Packard,L=Cupertino,S=Ca,C=US\IEButton\support.htm
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {C4847596-972C-11D0-9567-00A0C9273C2A} (Crystal Report Viewer Control) - http://jasenpalvelut.hammasll.fi/viewer/...tivexviewer.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/sh...ash/swflash.cab
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: Automaattinen LiveUpdate-ajastustoiminto - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
O23 - Service: Automattinen LiveUpdate-ajastustoiminto - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: Bluetooth Service (btwdins) - Broadcom Corporation. - C:\Program Files\Bluetooth\Bluetooth-ohjelmisto\bin\btwdins.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: Symantec Lic NetConnect service (CLTNetCnService) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: COM Host (comHost) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\VAScanner\comHost.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPodService - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
O23 - Service: LiveUpdate Notice Service Ex (LiveUpdate Notice Ex) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: LiveUpdate Notice Service - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: ServiceLayer - Nokia. - C:\Program Files\PC Connectivity Solution\ServiceLayer.exe
O23 - Service: Symantec Core LC - Unknown owner - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
O23 - Service: Thread Master (ThreadMaster) - http://threadmaster.tripod.com - threadmaster@europe.com - C:\WINDOWS\system32\ThreadMaster\ThreadMast.exe

--
End of file - 8463 bytes

-- File Associations -----------------------------------------------------------

All associations okay.


-- Drivers: 0-Boot, 1-System, 2-Auto, 3-Demand, 4-Disabled ---------------------

R2 BTSERIAL (Bluetooth Serial Driver) - c:\windows\system32\drivers\btserial.sys <Not Verified; Broadcom Corporation.; Bluetooth Software 4.0.1.2900>
R2 BTSLBCSP (Bluetooth Port Client Driver) - c:\windows\system32\drivers\btslbcsp.sys <Not Verified; Broadcom Corporation.; Bluetooth Software 4.0.1.2900>

S1 intelppm (Intel-suoritinohjain) - c:\windows\system32\drivers\intelppm.sys (file missing)
S3 catchme - c:\docume~1\hp_omi~1\locals~1\temp\catchme.sys (file missing)
S3 ENTECH - c:\windows\system32\drivers\entech.sys <Not Verified; EnTech Taiwan; PowerStrip>


-- Services: 0-Boot, 1-System, 2-Auto, 3-Demand, 4-Disabled --------------------

R2 ThreadMaster (Thread Master) - c:\windows\system32\threadmaster\threadmast.exe <Not Verified; http://threadmaster.tripod.com - threadmaster@europe.com; ThreadMaster>

S3 ServiceLayer - "c:\program files\pc connectivity solution\servicelayer.exe" <Not Verified; Nokia.; PC Connectivity Solution>


-- Device Manager: Disabled ----------------------------------------------------

Class GUID: {EEC5AD98-8080-425F-922A-DABF3DE3F69A}
Description: Nokia Windows Portable Device Driver
Device ID: ROOT\WPD\0000
Manufacturer: Nokia
Name: Nokia 6270
PNP Device ID: ROOT\WPD\0000
Service: WUDFRd

Class GUID: {EEC5AD98-8080-425F-922A-DABF3DE3F69A}
Description: Nokia 3500c
Device ID: ROOT\WPD\0001
Manufacturer: Nokia
Name: Nokia 3500c
PNP Device ID: ROOT\WPD\0001
Service: WUDFRd


-- Scheduled Tasks -------------------------------------------------------------

2008-04-30 22:43:50 498 --a------ C:\WINDOWS\Tasks\1-Click Maintenance.job


-- Files created between 2008-03-30 and 2008-04-30 -----------------------------

2008-04-30 22:35:24 0 d-------- C:\Documents and Settings\Järjestelmänvalvoja\Application Data\Talkback
2008-04-30 22:35:12 0 d-------- C:\Documents and Settings\Järjestelmänvalvoja\Application Data\Mozilla
2008-04-30 22:32:46 0 d-------- C:\Documents and Settings\Järjestelmänvalvoja\WINDOWS
2008-04-30 22:32:46 0 d--h----- C:\Documents and Settings\Järjestelmänvalvoja\Verkkoympäristö
2008-04-30 22:32:46 0 d-------- C:\Documents and Settings\Järjestelmänvalvoja\Työpöytä
2008-04-30 22:32:46 0 d--h----- C:\Documents and Settings\Järjestelmänvalvoja\Tulostinympäristö
2008-04-30 22:32:46 0 dr------- C:\Documents and Settings\Järjestelmänvalvoja\Suosikit
2008-04-30 22:32:46 0 dr-h----- C:\Documents and Settings\Järjestelmänvalvoja\SendTo
2008-04-30 22:32:46 0 dr-h----- C:\Documents and Settings\Järjestelmänvalvoja\Recent
2008-04-30 22:32:46 0 dr------- C:\Documents and Settings\Järjestelmänvalvoja\Omat tiedostot
2008-04-30 22:32:46 786432 --ah----- C:\Documents and Settings\Järjestelmänvalvoja\NTUSER.DAT
2008-04-30 22:32:46 0 d--h----- C:\Documents and Settings\Järjestelmänvalvoja\Mallit
2008-04-30 22:32:46 0 d--h----- C:\Documents and Settings\Järjestelmänvalvoja\Local Settings
2008-04-30 22:32:46 0 dr------- C:\Documents and Settings\Järjestelmänvalvoja\Käynnistä-valikko
2008-04-30 22:32:46 0 d--hs---- C:\Documents and Settings\Järjestelmänvalvoja\Cookies
2008-04-30 22:32:46 0 dr-h----- C:\Documents and Settings\Järjestelmänvalvoja\Application Data
2008-04-30 22:32:46 0 d---s---- C:\Documents and Settings\Järjestelmänvalvoja\Application Data\Microsoft
2008-04-30 22:32:46 0 d-------- C:\Documents and Settings\Järjestelmänvalvoja\Application Data\Identities
2008-04-30 08:38:28 0 d-------- C:\Downloads
2008-04-30 08:38:28 0 d-------- C:\Bases
2008-04-30 08:37:24 0 d-------- C:\Kaspersky
2008-04-29 20:40:13 0 d-------- C:\WINDOWS\ERUNT
2008-04-29 08:47:18 0 d-------- C:\Program Files\Opera
2008-04-29 00:37:36 0 dr-h----- C:\Documents and Settings\HP_Omistaja\Recent
2008-04-27 01:12:06 0 d-------- C:\WINDOWS\system32\ThreadMaster
2008-04-27 00:52:20 0 d-------- C:\WINDOWS\pss
2008-04-26 23:34:47 0 d-------- C:\Documents and Settings\HP_Omistaja\Application Data\TVU Networks
2008-04-26 23:34:47 0 d-------- C:\Documents and Settings\All Users\Application Data\TVU Networks
2008-04-26 23:33:42 0 d-------- C:\Documents and Settings\HP_Omistaja\LocalLow
2008-04-26 23:33:38 0 d-------- C:\Program Files\TVUPlayer
2008-04-26 22:21:01 0 d-------- C:\Documents and Settings\HP_Omistaja\Application Data\ppstream
2008-04-18 11:31:21 0 d-a------ C:\Program Files\AMV Converter
2008-04-11 13:51:15 0 d-------- C:\Documents and Settings\HP_Omistaja\Application Data\Grisoft
2008-04-06 02:39:04 0 d-------- C:\Program Files\Java
2008-04-06 02:39:00 0 d-------- C:\Program Files\Common Files\Java
2008-04-06 01:16:52 68096 --a------ C:\WINDOWS\zip.exe
2008-04-06 01:16:52 49152 --a------ C:\WINDOWS\VFind.exe
2008-04-06 01:16:52 136704 --a------ C:\WINDOWS\swsc.exe <Not Verified; SteelWerX; SteelWerX Service Controller>
2008-04-06 01:16:52 161792 --a------ C:\WINDOWS\swreg.exe <Not Verified; SteelWerX; SteelWerX Registry Editor>
2008-04-06 01:16:52 98816 --a------ C:\WINDOWS\sed.exe
2008-04-06 01:16:52 80412 --a------ C:\WINDOWS\grep.exe
2008-04-06 01:16:52 73728 --a------ C:\WINDOWS\fdsv.exe <Not Verified; Smallfrogs Studio; >
2008-04-06 01:16:51 212480 --a------ C:\WINDOWS\swxcacls.exe <Not Verified; SteelWerX; SteelWerX Extended Configurator ACLists>
2008-04-05 00:10:17 0 dr------- C:\Documents and Settings\LocalService\Suosikit
2008-04-05 00:10:13 0 d-------- C:\Documents and Settings\LocalService\Application Data\Talkback
2008-04-05 00:06:38 118784 --a------ C:\WINDOWS\system32\MSSTDFMT.DLL <Not Verified; Microsoft Corporation; MSSTDFMT Object Library>
2008-04-05 00:06:37 0 d-------- C:\Program Files\SpywareBlaster
2008-04-04 23:59:29 0 d-a------ C:\Documents and Settings\All Users\Application Data\TEMP
2008-04-04 23:06:10 0 d-------- C:\Program Files\Lavasoft
2008-04-04 23:06:10 0 d-------- C:\Documents and Settings\All Users\Application Data\Lavasoft
2008-04-01 20:43:22 0 d-------- C:\Documents and Settings\HP_Omistaja\.housecall6.6
2008-03-31 20:13:30 0 d-------- C:\Program Files\CCleaner
2008-03-31 18:57:36 0 d-------- C:\VundoFix Backups
2008-03-31 18:53:51 0 d-------- C:\Program Files\HJ


-- Find3M Report ---------------------------------------------------------------

2008-04-30 22:59:45 0 d-------- C:\Program Files\Common Files\Symantec Shared
2008-04-30 22:30:53 0 d-------- C:\Program Files\mIRC
2008-04-30 22:21:37 0 d-------- C:\Program Files\Warcraft III
2008-04-30 08:32:06 43520 --a------ C:\WINDOWS\system32\CmdLineExt03.dll
2008-04-28 21:20:09 0 d-------- C:\Documents and Settings\HP_Omistaja\Application Data\Skype
2008-04-28 17:55:29 0 d-------- C:\Documents and Settings\HP_Omistaja\Application Data\skypePM
2008-04-27 16:15:41 0 d-------- C:\Program Files\SopCast
2008-04-27 00:29:00 0 d-------- C:\Program Files\Common Files\Wise Installation Wizard
2008-04-26 23:18:07 0 d-------- C:\Program Files\MSN Messenger
2008-04-23 19:00:55 10800 --a----c- C:\Documents and Settings\HP_Omistaja\Application Data\wklnhst.dat
2008-04-22 21:09:17 0 d-------- C:\Program Files\Ajokorttikoulu
2008-04-17 18:23:27 0 d-------- C:\Documents and Settings\HP_Omistaja\Application Data\Help
2008-04-11 11:38:02 383124 --a------ C:\WINDOWS\system32\perfh00B.dat
2008-04-11 11:38:02 78520 --a------ C:\WINDOWS\system32\perfc00B.dat
2008-04-06 02:39:00 0 d-------- C:\Program Files\Common Files
2008-03-20 19:48:49 0 d-------- C:\Documents and Settings\HP_Omistaja\Application Data\Command & Conquer 3 Tiberium Wars
2008-03-20 19:45:56 98304 --a------ C:\WINDOWS\system32CmdLineExt.dll <Not Verified; Sony DADC Austria AG.; >
2008-03-20 18:54:59 0 d-------- C:\Program Files\Electronic Arts
2008-03-13 21:48:32 5066 --a----c- C:\WINDOWS\mozver.dat
2008-03-13 19:29:24 0 d--h----- C:\Program Files\InstallShield Installation Information
2008-03-11 15:15:30 0 d-------- C:\Program Files\The Learning Company
2008-03-07 02:43:34 0 d-------- C:\Documents and Settings\HP_Omistaja\Application Data\Winamp
2008-03-06 11:59:58 0 d-------- C:\Documents and Settings\HP_Omistaja\Application Data\Nokia Multimedia Player


-- Registry Dump ---------------------------------------------------------------

*Note* empty entries & legit default entries are not shown


[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ccApp"="C:\Program Files\Common Files\Symantec Shared\ccApp.exe" [10.01.2007 00:59]
"LVCOMSX"="C:\WINDOWS\system32\LVCOMSX.EXE" [19.07.2005 18:32]
"Recguard"="C:\WINDOWS\SMINST\RECGUARD.EXE" [22.07.2005 23:14]
"Symantec PIF AlertEng"="C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe" [29.01.2008 18:38]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe" [22.02.2008 04:25]
"!AVG Anti-Spyware"="C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" [11.06.2007 12:25]

[HKEY_USERS\.default\software\microsoft\windows\currentversion\run]
"Picasa Media Detector"=C:\Program Files\Picasa2\PicasaMediaDetector.exe
"Nokia.PCSync"="C:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe" /NoDialog

C:\Documents and Settings\All Users\K?ynnist?-valikko\Ohjelmat\K?ynnistys\
HP Digital Imaging Monitor.lnk - C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe [19.2.2006 5:21:22]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"HideLegacyLogonScripts"=0 (0x0)
"HideLogoffScripts"=0 (0x0)
"RunLogonScriptSync"=1 (0x1)
"RunStartupScriptSync"=1 (0x1)
"HideStartupScripts"=0 (0x0)

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\system]
"HideLegacyLogonScripts"=0 (0x0)
"HideLogoffScripts"=0 (0x0)
"RunLogonScriptSync"=1 (0x1)
"RunStartupScriptSync"=1 (0x1)
"HideStartupScripts"=0 (0x0)
"DisableRegistryTools"=0 (0x0)

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\aawservice]
@="Service"

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run-]
"ctfmon.exe"=C:\WINDOWS\system32\ctfmon.exe
"PC Suite Tray"="C:\Program Files\Nokia\Nokia PC Suite 6\PCSuite.exe" -onlytray
"LogitechSoftwareUpdate"="C:\Program Files\Logitech\Video\ManifestEngine.exe" boot
"LDM"=C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BackWeb-8876480.exe

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-]
"TkBellExe"="C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
"DAEMON Tools"="C:\Program Files\DAEMON Tools\daemon.exe" -lang 1033
"QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" -atboottime
"WinampAgent"="C:\Program Files\Winamp\winampa.exe"
"Reminder"="C:\Windows\Creator\Remind_XP.exe"
"HPHUPD08"=c:\Program Files\HP\Digital Imaging\{33D6CC28-9F75-4d1b-A11D-98895B3A3729}\hphupd08.exe
"HP Software Update"=C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
"NeroCheck"=C:\WINDOWS\system32\NeroCheck.exe
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe"
"HPBootOp"="C:\Program Files\Hewlett-Packard\HP Boot Optimizer\HPBootOp.exe" /run
"UnlockerAssistant"="C:\Program Files\Unlocker\UnlockerAssistant.exe"
"LogitechVideoTray"=C:\Program Files\Logitech\Video\LogiTray.exe
"HydraVisionDesktopManager"=C:\Program Files\ATI Technologies\ATI HYDRAVISION\HydraDM.exe
"Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
"Symantec PIF AlertEng"="C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe" /a /m "C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\AlertEng.dll"

*Newly Created Service* - COMHOST



-- End of Deckard's System Scanner: finished at 2008-04-30 23:00:25 ------------


======================================================================
======================================================================


Deckard's System Scanner v20071014.68
Extra logfile - please post this as an attachment with your post.
--------------------------------------------------------------------------------

-- System Information ----------------------------------------------------------

Microsoft Windows XP Home Edition (build 2600) SP 2.0
Architecture: X86; Language: Other (040B) - see http://preview.tinyurl.com/mhhp6

CPU 0: AMD Sempron(tm) Processor 3200+
Percentage of Memory in Use: 20%
Physical Memory (total/avail): 2558.48 MiB / 2046.56 MiB
Pagefile Memory (total/avail): 3073.47 MiB / 2656.68 MiB
Virtual Memory (total/avail): 2047.88 MiB / 1920.79 MiB

C: is Fixed (NTFS) - 69.37 GiB total, 22.82 GiB free.
D: is Fixed (FAT32) - 5.14 GiB total, 0.69 GiB free.
E: is CDROM (No Media)
F: is Fixed (NTFS) - 37.27 GiB total, 16.42 GiB free.
G: is CDROM (No Media)

\\.\PHYSICALDRIVE1 - HDS728080PLAT20 - 74.53 GiB - 2 partitions
\PARTITION0 (bootable) - Asennettava tiedostojärjestelmä - 69.37 GiB - C:
\PARTITION1 - Unknown - 5.15 GiB - D:

\\.\PHYSICALDRIVE0 - ST340810A - 37.27 GiB - 1 partition
\PARTITION0 (bootable) - Asennettava tiedostojärjestelmä - 37.27 GiB - F:



-- Security Center -------------------------------------------------------------

AUOptions is scheduled to auto-install.
Windows Internal Firewall is disabled.

FirstRunDisabled is set.

FW: Norton 360 v2007 (SYMANTEC Corporation)
AV: Norton 360 v2007 (SYMANTEC Corperation)

[HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"C:\\Program Files\\MSN Messenger\\msncall.exe"="C:\\Program Files\\MSN Messenger\\msncall.exe:*:Enabled:Windows Live Messenger 8.0 (Phone)"
"%windir%\\Network Diagnostic\\xpnetdiag.exe"="%windir%\\Network Diagnostic\\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"
"C:\\Program Files\\MSN Messenger\\msnmsgr.exe"="C:\\Program Files\\MSN Messenger\\msnmsgr.exe:*:Enabled:Windows Live Messenger 8.1"
"C:\\Program Files\\MSN Messenger\\livecall.exe"="C:\\Program Files\\MSN Messenger\\livecall.exe:*:Enabled:Windows Live Messenger 8.1 (Phone)"

[HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqtra08.exe"="C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqtra08.exe:*:Enabled:hpqtra08.exe"
"C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqste08.exe"="C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqste08.exe:*:Enabled:hpqste08.exe"
"C:\\Program Files\\HP\\Digital Imaging\\bin\\hpofxm08.exe"="C:\\Program Files\\HP\\Digital Imaging\\bin\\hpofxm08.exe:*:Enabled:hpofxm08.exe"
"C:\\Program Files\\HP\\Digital Imaging\\bin\\hposfx08.exe"="C:\\Program Files\\HP\\Digital Imaging\\bin\\hposfx08.exe:*:Enabled:hposfx08.exe"
"C:\\Program Files\\HP\\Digital Imaging\\bin\\hposid01.exe"="C:\\Program Files\\HP\\Digital Imaging\\bin\\hposid01.exe:*:Enabled:hposid01.exe"
"C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqscnvw.exe"="C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqscnvw.exe:*:Enabled:hpqscnvw.exe"
"C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqkygrp.exe"="C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqkygrp.exe:*:Enabled:hpqkygrp.exe"
"C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqCopy.exe"="C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqCopy.exe:*:Enabled:hpqcopy.exe"
"C:\\Program Files\\HP\\Digital Imaging\\bin\\hpfccopy.exe"="C:\\Program Files\\HP\\Digital Imaging\\bin\\hpfccopy.exe:*:Enabled:hpfccopy.exe"
"C:\\Program Files\\HP\\Digital Imaging\\bin\\hpzwiz01.exe"="C:\\Program Files\\HP\\Digital Imaging\\bin\\hpzwiz01.exe:*:Enabled:hpzwiz01.exe"
"C:\\Program Files\\HP\\Digital Imaging\\Unload\\HpqPhUnl.exe"="C:\\Program Files\\HP\\Digital Imaging\\Unload\\HpqPhUnl.exe:*:Enabled:hpqphunl.exe"
"C:\\Program Files\\HP\\Digital Imaging\\Unload\\HpqDIA.exe"="C:\\Program Files\\HP\\Digital Imaging\\Unload\\HpqDIA.exe:*:Enabled:hpqdia.exe"
"C:\\Program Files\\HP\\Digital Imaging\\bin\\hpoews01.exe"="C:\\Program Files\\HP\\Digital Imaging\\bin\\hpoews01.exe:*:Enabled:hpoews01.exe"
"C:\\Program Files\\Mozilla Firefox\\firefox.exe"="C:\\Program Files\\Mozilla Firefox\\firefox.exe:*:Enabled:Firefox"
"C:\\Program Files\\iTunes\\iTunes.exe"="C:\\Program Files\\iTunes\\iTunes.exe:*:Enabled:iTunes"
"C:\\Program Files\\mIRC\\mirc.exe"="C:\\Program Files\\mIRC\\mirc.exe:*:Enabled:mIRC"
"%windir%\\Network Diagnostic\\xpnetdiag.exe"="%windir%\\Network Diagnostic\\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"
"C:\\Program Files\\MSN Messenger\\msnmsgr.exe"="C:\\Program Files\\MSN Messenger\\msnmsgr.exe:*:Enabled:Windows Live Messenger 8.1"
"C:\\Program Files\\MSN Messenger\\livecall.exe"="C:\\Program Files\\MSN Messenger\\livecall.exe:*:Enabled:Windows Live Messenger 8.1 (Phone)"
"C:\\Program Files\\Messenger\\msmsgs.exe"="C:\\Program Files\\Messenger\\msmsgs.exe:*:Enabled:Windows Messenger"
"C:\\Program Files\\Skype\\Phone\\Skype.exe"="C:\\Program Files\\Skype\\Phone\\Skype.exe:*:Enabled:Skype"


-- Environment Variables -------------------------------------------------------

ALLUSERSPROFILE=C:\Documents and Settings\All Users
APPDATA=C:\Documents and Settings\HP_Omistaja\Application Data
CLASSPATH=.;C:\Program Files\Java\jre1.5.0_05\lib\ext\QTJava.zip
CommonProgramFiles=C:\Program Files\Common Files
COMPUTERNAME=HANNU1
ComSpec=C:\WINDOWS\system32\cmd.exe
FP_NO_HOST_CHECK=NO
HOMEDRIVE=C:
HOMEPATH=\Documents and Settings\HP_Omistaja
LOGONSERVER=\\HANNU1
NUMBER_OF_PROCESSORS=1
OS=Windows_NT
Path=C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\system32\wbem;C:\Program Files\PC Connectivity Solution;c:\Python22;C:\Program Files\ATI Technologies\ATI Control Panel;C:\Program Files\QuickTime\QTSystem
PATHEXT=.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH
PROCESSOR_ARCHITECTURE=x86
PROCESSOR_IDENTIFIER=x86 Family 15 Model 47 Stepping 2, AuthenticAMD
PROCESSOR_LEVEL=15
PROCESSOR_REVISION=2f02
ProgramFiles=C:\Program Files
PROMPT=$P$G
QTJAVA=C:\Program Files\Java\jre1.5.0_05\lib\ext\QTJava.zip
SESSIONNAME=Console
SonicCentral=c:\Program Files\Common Files\Sonic Shared\Sonic Central\
SystemDrive=C:
SystemRoot=C:\WINDOWS
TEMP=C:\DOCUME~1\HP_OMI~1\LOCALS~1\Temp
TMP=C:\DOCUME~1\HP_OMI~1\LOCALS~1\Temp
USERDOMAIN=HANNU1
USERNAME=HP_Omistaja
USERPROFILE=C:\Documents and Settings\HP_Omistaja
windir=C:\WINDOWS
__COMPAT_LAYER=EnableNXShowUI


-- User Profiles ---------------------------------------------------------------

HP_Omistaja (admin)
Järjestelmänvalvoja (new local, admin)


-- Add/Remove Programs ---------------------------------------------------------

--> C:\Program Files\Common Files\Real\Update_OB\r1puninst.exe RealNetworks|RealPlayer|6.0
--> c:\WINDOWS\system32\\MSIEXEC.EXE /x {075473F5-846A-448B-BCB3-104AA1760205}
--> c:\WINDOWS\system32\\MSIEXEC.EXE /x {AB708C9B-97C8-4AC9-899B-DBF226AC9382}
--> c:\WINDOWS\system32\\MSIEXEC.EXE /x {B12665F4-4E93-4AB4-B7FC-37053B524629}
--> rundll32.exe setupapi.dll,InstallHinfSection DefaultUninstall 132 C:\WINDOWS\INF\PCHealth.inf
2006 FIFA World Cup (TM) --> C:\Program Files\EA SPORTS\2006 FIFA World Cup (TM)\EAUninstall.exe
3DMark06 --> RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\10\01\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{7F3AD00A-1819-4B15-BB7D-08B3586336D7}\setup.exe" -l0x9 -removeonly
Ad-Aware 2007 --> MsiExec.exe /I{DED53B0B-B67C-4244-AE6A-D6FD3C28D1EF}
Adobe Flash Player ActiveX --> C:\WINDOWS\system32\Macromed\Flash\uninstall_activeX.exe
Adobe Flash Player Plugin --> C:\WINDOWS\system32\Macromed\Flash\uninstall_plugin.exe
Adobe Reader 8.1.2 - Suomi --> MsiExec.exe /I{AC76BA86-7AD7-1035-7B44-A81200000003}
Adobe Shockwave Player --> C:\WINDOWS\system32\Macromed\SHOCKW~1\UNWISE.EXE C:\WINDOWS\system32\Macromed\SHOCKW~1\Install.log
Ahead Nero Burning ROM --> C:\Program Files\Ahead\nero\uninstall\UNNERO.exe /UNINSTALL
Ajokorttikoulu --> C:\Program Files\Ajokorttikoulu\Uninstall.exe
Alfa-Aihepiirisanasto englanti 3 --> RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\09\01\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{1FC639A9-C702-479C-89F9-3FB7ECF37CE3}\setup.exe" -l0xb
Alfa-Aihepiirisanasto ruotsi 3 --> RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\09\01\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{0E60AF0B-EF94-4030-AB56-5872075C4288}\setup.exe" -l0xb
Alfa-English 4 Youngsters --> RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\09\01\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{FDD0D4BB-288E-4BC5-8586-B18005996BFB}\setup.exe" -l0xb
Alfa-svenska för ungdomar --> RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\09\01\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{1D0631B0-BA74-46DD-9A44-541BBF955E3B}\setup.exe" -l0xb
Alkupolku Eskari --> C:\Program Files\Common Files\Knowledge Adventure\Uninstall\UNAPLA.exe
AppCore --> MsiExec.exe /I{EFB5B3B5-A280-4E25-BE1C-634EEFE32C1B}
ATI-ohjauspaneeli --> RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\engine\6\INTEL3~1\ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{0BEDBD4E-2D34-47B5-9973-57E62B29307C}\setup.exe"
ATI-ohjelmiston poisto-ohjelma --> C:\Program Files\ATI Technologies\UninstallAll\AtiCimUn.exe
ATI Display Driver --> rundll32 C:\WINDOWS\system32\atiiiexx.dll,_InfEngUnInstallINFFile_RunDLL@16 -force_restart -flags:0x2010001 -inf_class:DISPLAY -clean
ATI HYDRAVISION --> RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\engine\6\INTEL3~1\ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{083F79E4-6FE9-46FB-A6C6-4F8862742947}\setup.exe"
Audacity 1.2.6 --> "C:\Program Files\Audacity\unins000.exe"
AV --> MsiExec.exe /I{F4DB525F-A986-4249-B98B-42A8066251CA}
AVG Anti-Spyware 7.5 --> C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\Uninstall.exe
Bluetooth-ohjelmisto --> MsiExec.exe /X{3F4EC965-28EF-45C3-B063-04B25D4E9679}
Caillou(R) Magic Playhouse(TM) --> C:\Program Files\The Learning Company\Caillou(R) Magic Playhouse(TM)\uninstall.exe
ccCommon --> MsiExec.exe /I{3CCAD2EF-CFF2-4637-82AA-AABF370282D3}
CCleaner (remove only) --> "C:\Program Files\CCleaner\uninst.exe"
Codec Pack - All In 1 6.0.3.0 --> C:\WINDOWS\iun6002.exe "C:\Program Files\Codec Pack - All In 1\irunin.ini"
Command & Conquer 3 --> MsiExec.exe /I{B0C30E93-D3D9-4F04-A2AC-54749B573275}
GearDrvs --> MsiExec.exe /I{228F6876-A313-40A3-91C0-C3CBE6997D09}
GTA San Andreas --> RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\10\50\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{D417C96A-FCC7-4590-A1BB-FAF73F5BC98E}\setup.exe" -l0x9 -removeonly
High Definition Audio - KB888111 --> "C:\WINDOWS\$NtUninstallKB888111WXPSP2$\spuninst\spuninst.exe"
HijackThis 2.0.2 --> "C:\Program Files\HJ\HijackThis.exe" /uninstall
Hotfix-päivitys Windows XP:lle (KB893357) --> "C:\WINDOWS\$NtUninstallKB893357$\spuninst\spuninst.exe"
Hotfix-päivitys Windows XP:lle (KB906569) --> "C:\WINDOWS\$NtUninstallKB906569$\spuninst\spuninst.exe"
Hotfix-päivitys Windows XP:lle (KB914440) --> "C:\WINDOWS\$NtUninstallKB914440$\spuninst\spuninst.exe"
Hotfix for Windows Media Format 11 SDK (KB929399) --> "C:\WINDOWS\$NtUninstallKB929399$\spuninst\spuninst.exe"
HP Boot Optimizer --> C:\Program Files\Hewlett-Packard\HP Boot Optimizer\HPBootOp.exe /uninstall
HP Customer Participation Program 7.0 --> C:\Program Files\HP\Digital Imaging\ExtCapUninstall\hpzscr01.exe -datfile hpqhsc01.dat
HP Deskjet Printer Preload --> MsiExec.exe /I{2C5D07FB-31A2-4F2D-9FDA-0B24ACD42BD0}
HP Document Viewer 5.3 --> C:\Program Files\HP\Digital Imaging\DocumentViewer\hpzscr01.exe -datfile hpqbud04.dat
HP DVD Play 1.0 --> RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{45D707E9-F3C4-11D9-A373-0050BAE317E1}\Setup.exe" -uninstall
HP Imaging Device Functions 7.0 --> C:\Program Files\HP\Digital Imaging\DeviceManagement\hpzscr01.exe -datfile hpqbud01.dat
HP Photosmart -kamerat 5.0 --> C:\Program Files\HP\Digital Imaging\{C83A12B9-B31B-461A-BBD4-CE9B988094F1}\setup\hpzscr01.exe -datfile hpiscr01.dat
HP Photosmart 330,380,420,470,7800,8000,8200 Series --> C:\Program Files\HP\Digital Imaging\{33D6CC28-9F75-4d1b-A11D-98895B3A3729}\setup\hpzscr01.exe -d MsiRollbackUninstaller -datfile hphscr08.dat
HP Photosmart and Deskjet 7.0 Software (fin) --> C:\Program Files\HP\Digital Imaging\{9D404F8F-05A1-4734-9550-6EC2FEE916B8}\setup\hpzscr01.exe -datfile hphscr10.dat -showdisconnect -forcereboot
HP Photosmart Essential --> MsiExec.exe /X{6994491D-D491-48F1-AE1F-E179C1FFFC2F}
HP Photosmart Premier Software 6.0 --> C:\Program Files\HP\Digital Imaging\uninstall\hpzscr01.exe -datfile hpqscr01.dat
HP PSC & OfficeJet 5.3.A --> "C:\Program Files\HP\Digital Imaging\{3E386744-10FA-44b2-98C9-DF7A270DECB3}\setup\hpzscr01.exe" -datfile hposcr06.dat
HP PSC & OfficeJet 5.3.B --> "C:\Program Files\HP\Digital Imaging\{5B79CFD1-6845-4158-9D7D-6BE89DF2C135}\setup\hpzscr01.exe" -datfile hposcr07.dat
HP Software Update --> MsiExec.exe /X{BB85ED9C-AFC9-43BD-B8DC-258C3C7DF72E}
HP Solution Center 7.0 --> C:\Program Files\HP\Digital Imaging\eSupport\hpzscr01.exe -datfile hpqbud05.dat
Ifi Tilausohjelma 3.5 --> C:\Program Files\Ifi\OrderClient35\Uninstall.exe
iTunes --> C:\PROGRA~1\COMMON~1\INSTAL~1\Driver\11\INTEL3~1\IDriver.exe /M{54C0D94A-F467-4ABC-9D02-6E58748668D4} /l1035
Java(TM) 6 Update 5 --> MsiExec.exe /I{3248F0A8-6813-11D6-A77B-00B0D0160050}
Kielioppi Harjoituskirja englanti 3 --> RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\09\01\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{B630744C-69CC-4B41-8673-208FE5C182B1}\setup.exe" -l0xb
Kielioppi Harjoituskirja ruotsi 3 --> RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\09\01\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{727D57B9-6A01-47D0-8ABB-A4AFDD6D9F41}\setup.exe" -l0xb
Kielioppi Oppikirja englanti --> RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\09\01\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{64175EFE-3DDC-46BE-BC9B-54BEFF19AB20}\setup.exe" -l0xb
Kielioppi Oppikirja ruotsi --> RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\09\01\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{2E01420B-5BD6-4515-8742-3E7B40050F9A}\setup.exe" -l0xb
LiveUpdate 3.2 (Symantec Corporation) --> "C:\Program Files\Symantec\LiveUpdate\LSETUP.EXE" /U
LiveUpdate Notice (Symantec Corporation) --> MsiExec.exe /X{DBA4DB9D-EE51-4944-A419-98AB1F1249C8}
Logitech Desktop Messenger --> RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{900B1197-53F5-4F46-A882-2CFFFE2EEDCB}\Setup.exe" -l0xb UNINSTALL
Logitech Gaming Software --> RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\0701\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{B9242864-2841-4ADE-86E0-8F90F91B04DD}\setup.exe" -l0xb
Logitech Print Service --> C:\PROGRA~1\Logitech\PRINTS~1\UNWISE.EXE C:\PROGRA~1\Logitech\PRINTS~1\INSTALL.LOG
Logitech QuickCam Software --> RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\09\01\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{C43048A9-742C-4DAD-90D2-E3B53C9DB825}\setup.exe" -l0x9
Logitech® Camera -ohjain --> "C:\Program Files\Common Files\Logitech\QCDRV\BIN\SETUP.EXE" UNINSTALL REMOVEPROMPT
Macromedia Flash Player 8 --> MsiExec.exe /X{6815FCDD-401D-481E-BA88-31B4754C2B46}
Mafia --> c:\program files\Mafia\patch.exe
Mafia Game --> C:\WINDOWS\system32\MafiaSetup.exe
Max Payne 2 --> RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\0701\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{EFE1AB94-5466-4B6E-BE31-FF4C115FD25D}\Setup.exe" -l0x9
Microsoft Compression Client Pack 1.0 for Windows XP --> "C:\WINDOWS\$NtUninstallMSCompPackV1$\spuninst\spuninst.exe"
Microsoft User-Mode Driver Framework Feature Pack 1.5 --> "C:\WINDOWS\$NtUninstallWudf01005$\spuninst\spuninst.exe"
Microsoft Visual C++ 2005 Redistributable --> MsiExec.exe /X{A49F249F-0C91-497F-86DF-B2585E8E76B7}
Microsoft Works --> MsiExec.exe /I{2EF8368A-5670-45C0-82F1-D7B00F7E7AB8}
mIRC --> "C:\Program Files\mIRC\mirc.exe" -uninstall
Mopokorttikoulu --> C:\WINDOWS\Mopokorttikoulu Uninstaller.exe
Mozilla Firefox (2.0.0.14) --> C:\Program Files\Mozilla Firefox\uninstall\helper.exe
MSVC80_x86 --> MsiExec.exe /I{212748BB-0DA5-46DE-82A1-403736DC9F27}
Need for Speed? Most Wanted --> C:\Program Files\EA GAMES\Need for Speed Most Wanted\EAUninstall.exe
NetZero For Riverdeep --> MsiExec.exe /X{86C1A488-24AD-42F0-BCEF-FDB11FC2BEFA}
NetZero Internet and Voice Offer --> MsiExec.exe /X{8BBA35B6-E1A9-4FE0-892B-8F7980584D52}
NHL 99 --> C:\WINDOWS\UNIN040B.EXE -f"C:\Program Files\EA SPORTS\NHL 99\DeIsL1.isu" -c"C:\Program Files\EA SPORTS\NHL 99\eauninst.dll
Nokia Connectivity Cable Driver --> MsiExec.exe /X{0A3D3C54-2EC0-4D67-B265-FF17926E6D67}
Nokia PC Suite --> C:\Documents and Settings\All Users\Application Data\Installations\{29466F9C-7C6A-419C-B301-F440FAF78760}\Nokia_PC_Suite_rel_6_85_14_1_fin.exe
Nokia PC Suite --> MsiExec.exe /I{29466F9C-7C6A-419C-B301-F440FAF78760}
Norton 360 --> MsiExec.exe /I{21829177-4DED-4209-AD08-490B3AC9C01A}
Norton 360 --> MsiExec.exe /I{2D617065-1C52-4240-B5BC-C0AE12157777}
Norton 360 --> MsiExec.exe /I{63A6E9A9-A190-46D4-9430-2DB28654AFD8}
Norton 360 (Symantec Corporation) --> "C:\Program Files\Common Files\Symantec Shared\SymSetup\{2D617065-1C52-4240-B5BC-C0AE12157777}_1_0_0_184\{2D617065-1C52-4240-B5BC-C0AE12157777}.exe" /X
Norton 360 Help --> MsiExec.exe /I{1CA941F1-5006-487E-9FD4-09F812A7D6B8}
Norton Confidential Browser Component --> MsiExec.exe /I{4843B611-8FCB-4428-8C23-31D0A5EAE164}
Norton Confidential Web Authentification Component --> MsiExec.exe /I{3074EB89-1BCA-4AEF-AFF4-EFB4634C1923}
Norton Confidential Web Protection Component --> MsiExec.exe /I{D353CC51-430D-4C6F-9B7E-52003DA1E05A}
Opera 9.27 --> MsiExec.exe /X{503D6E3E-1A48-44F5-BB7C-EB3B593FAED0}
PC Connectivity Solution --> MsiExec.exe /I{BA084E7C-8ABA-4670-BDE8-B85E689A5C1B}
Picasa 2 --> "C:\Program Files\Picasa2\Uninstall.exe"
Päivitys Windows XP:lle (KB898461) --> "C:\WINDOWS\$NtUninstallKB898461$\spuninst\spuninst.exe"
Päivitys Windows XP:lle (KB900485) --> "C:\WINDOWS\$NtUninstallKB900485$\spuninst\spuninst.exe"
Päivitys Windows XP:lle (KB904942) --> "C:\WINDOWS\$NtUninstallKB904942$\spuninst\spuninst.exe"
Päivitys Windows XP:lle (KB908531) --> "C:\WINDOWS\$NtUninstallKB908531$\spuninst\spuninst.exe"
Päivitys Windows XP:lle (KB910437) --> "C:\WINDOWS\$NtUninstallKB910437$\spuninst\spuninst.exe"
Päivitys Windows XP:lle (KB911280) --> "C:\WINDOWS\$NtUninstallKB911280$\spuninst\spuninst.exe"
Päivitys Windows XP:lle (KB916595) --> "C:\WINDOWS\$NtUninstallKB916595$\spuninst\spuninst.exe"
Päivitys Windows XP:lle (KB920872) --> "C:\WINDOWS\$NtUninstallKB920872$\spuninst\spuninst.exe"
Päivitys Windows XP:lle (KB922582) --> "C:\WINDOWS\$NtUninstallKB922582$\spuninst\spuninst.exe"
Päivitys Windows XP:lle (KB927891) --> "C:\WINDOWS\$NtUninstallKB927891$\spuninst\spuninst.exe"
Päivitys Windows XP:lle (KB929338) --> "C:\WINDOWS\$NtUninstallKB929338$\spuninst\spuninst.exe"
Päivitys Windows XP:lle (KB930916) --> "C:\WINDOWS\$NtUninstallKB930916$\spuninst\spuninst.exe"
Päivitys Windows XP:lle (KB931836) --> "C:\WINDOWS\$NtUninstallKB931836$\spuninst\spuninst.exe"
Päivitys Windows XP:lle (KB933360) --> "C:\WINDOWS\$NtUninstallKB933360$\spuninst\spuninst.exe"
Päivitys Windows XP:lle (KB938828) --> "C:\WINDOWS\$NtUninstallKB938828$\spuninst\spuninst.exe"
Päivitys Windows XP:lle (KB942763) --> "C:\WINDOWS\$NtUninstallKB942763$\spuninst\spuninst.exe"
PS2 --> C:\WINDOWS\system32\ps2.exe uninstall
Python 2.2 pywin32 extensions (build 203) --> "C:\Python22\Removepywin32.exe" -u "C:\Python22\pywin32-wininst.log"
Python 2.2.3 --> C:\Python22\UNWISE.EXE C:\Python22\INSTALL.LOG
QuickTime --> C:\PROGRA~1\COMMON~1\INSTAL~1\Driver\11\INTEL3~1\IDriver.exe /M{C21D5524-A970-42FA-AC8A-59B8C7CDCA31} /l1035
Reader Rabbit Math Ages 4-6 --> C:\Program Files\The Learning Company\Reader Rabbit Math Ages 4-6\uninstal.exe
RealPlayer --> C:\Program Files\Common Files\Real\Update_OB\r1puninst.exe RealNetworks|RealPlayer|6.0
Skype? 3.6 --> MsiExec.exe /X{5C82DAE5-6EB0-4374-9254-BE3319BA4E82}
Sonic Express Labeler --> MsiExec.exe /X{6675CA7F-E51B-4F6A-99D4-F8F0124C6EAA}
Sonic MyDVD Plus --> MsiExec.exe /X{21657574-BD54-48A2-9450-EB03B2C7FC29}
Sonic RecordNow Audio --> MsiExec.exe /X{AB708C9B-97C8-4AC9-899B-DBF226AC9382}
Sonic RecordNow Copy --> MsiExec.exe /X{B12665F4-4E93-4AB4-B7FC-37053B524629}
Sonic RecordNow Data --> MsiExec.exe /X{075473F5-846A-448B-BCB3-104AA1760205}
Sonic Update Manager --> MsiExec.exe /X{30465B6C-B53F-49A1-9EBA-A3F187AD502E}
SopCast 2.0.4 --> C:\Program Files\SopCast\uninst.exe
SPBBC 32bit --> MsiExec.exe /I{77772678-817F-4401-9301-ED1D01A8DA56}
SpywareBlaster 4.0 --> "C:\Program Files\SpywareBlaster\unins000.exe"
Suojauspäivitys ohjelmistolle Windows XP (KB923689) --> "C:\WINDOWS\$NtUninstallKB923689$\spuninst\spuninst.exe"
Suojauspäivitys ohjelmistolle Windows XP (KB941569) --> "C:\WINDOWS\$NtUninstallKB941569$\spuninst\spuninst.exe"
Suojauspäivitys Windows XP:lle (KB890046) --> "C:\WINDOWS\$NtUninstallKB890046$\spuninst\spuninst.exe"
Suojauspäivitys Windows XP:lle (KB893756) --> "C:\WINDOWS\$NtUninstallKB893756$\spuninst\spuninst.exe"
Suojauspäivitys Windows XP:lle (KB896358) --> "C:\WINDOWS\$NtUninstallKB896358$\spuninst\spuninst.exe"
Suojauspäivitys Windows XP:lle (KB896422) --> "C:\WINDOWS\$NtUninstallKB896422$\spuninst\spuninst.exe"
Suojauspäivitys Windows XP:lle (KB896423) --> "C:\WINDOWS\$NtUninstallKB896423$\spuninst\spuninst.exe"
Suojauspäivitys Windows XP:lle (KB896424) --> "C:\WINDOWS\$NtUninstallKB896424$\spuninst\spuninst.exe"
Suojauspäivitys Windows XP:lle (KB896428) --> "C:\WINDOWS\$NtUninstallKB896428$\spuninst\spuninst.exe"
Suojauspäivitys Windows XP:lle (KB899587) --> "C:\WINDOWS\$NtUninstallKB899587$\spuninst\spuninst.exe"
Suojauspäivitys Windows XP:lle (KB899591) --> "C:\WINDOWS\$NtUninstallKB899591$\spuninst\spuninst.exe"
Suojauspäivitys Windows XP:lle (KB900725) --> "C:\WINDOWS\$NtUninstallKB900725$\spuninst\spuninst.exe"
Suojauspäivitys Windows XP:lle (KB901017) --> "C:\WINDOWS\$NtUninstallKB901017$\spuninst\spuninst.exe"
Suojauspäivitys Windows XP:lle (KB901190) --> "C:\WINDOWS\$NtUninstallKB901190$\spuninst\spuninst.exe"
Suojauspäivitys Windows XP:lle (KB901214) --> "C:\WINDOWS\$NtUninstallKB901214$\spuninst\spuninst.exe"
Suojauspäivitys Windows XP:lle (KB902400) --> "C:\WINDOWS\$NtUninstallKB902400$\spuninst\spuninst.exe"
Suojauspäivitys Windows XP:lle (KB904706) --> "C:\WINDOWS\$NtUninstallKB904706$\spuninst\spuninst.exe"
Suojauspäivitys Windows XP:lle (KB905414) --> "C:\WINDOWS\$NtUninstallKB905414$\spuninst\spuninst.exe"
Suojauspäivitys Windows XP:lle (KB905749) --> "C:\WINDOWS\$NtUninstallKB905749$\spuninst\spuninst.exe"
Suojauspäivitys Windows XP:lle (KB905915) --> "C:\WINDOWS\$NtUninstallKB905915$\spuninst\spuninst.exe"
Suojauspäivitys Windows XP:lle (KB908519) --> "C:\WINDOWS\$NtUninstallKB908519$\spuninst\spuninst.exe"
Suojauspäivitys Windows XP:lle (KB911562) --> "C:\WINDOWS\$NtUninstallKB911562$\spuninst\spuninst.exe"
Suojauspäivitys Windows XP:lle (KB911567) --> "C:\WINDOWS\$NtUninstallKB911567$\spuninst\spuninst.exe"
Suojauspäivitys Windows XP:lle (KB911927) --> "C:\WINDOWS\$NtUninstallKB911927$\spuninst\spuninst.exe"
Suojauspäivitys Windows XP:lle (KB912919) --> "C:\WINDOWS\$NtUninstallKB912919$\spuninst\spuninst.exe"
Suojauspäivitys Windows XP:lle (KB913580) --> "C:\WINDOWS\$NtUninstallKB913580$\spuninst\spuninst.exe"
Suojauspäivitys Windows XP:lle (KB914388) --> "C:\WINDOWS\$NtUninstallKB914388$\spuninst\spuninst.exe"
Suojauspäivitys Windows XP:lle (KB914389) --> "C:\WINDOWS\$NtUninstallKB914389$\spuninst\spuninst.exe"
Suojauspäivitys Windows XP:lle (KB916281) --> "C:\WINDOWS\$NtUninstallKB916281$\spuninst\spuninst.exe"
Suojauspäivitys Windows XP:lle (KB917159) --> "C:\WINDOWS\$NtUninstallKB917159$\spuninst\spuninst.exe"
Suojauspäivitys Windows XP:lle (KB917344) --> "C:\WINDOWS\$NtUninstallKB917344$\spuninst\spuninst.exe"
Suojauspäivitys Windows XP:lle (KB917422) --> "C:\WINDOWS\$NtUninstallKB917422$\spuninst\spuninst.exe"
Suojauspäivitys Windows XP:lle (KB917953) --> "C:\WINDOWS\$NtUninstallKB917953$\spuninst\spuninst.exe"
Suojauspäivitys Windows XP:lle (KB918118) --> "C:\WINDOWS\$NtUninstallKB918118$\spuninst\spuninst.exe"
Suojauspäivitys Windows XP:lle (KB918439) --> "C:\WINDOWS\$NtUninstallKB918439$\spuninst\spuninst.exe"
Suojauspäivitys Windows XP:lle (KB918899) --> "C:\WINDOWS\$NtUninstallKB918899$\spuninst\spuninst.exe"
Suojauspäivitys Windows XP:lle (KB919007) --> "C:\WINDOWS\$NtUninstallKB919007$\spuninst\spuninst.exe"
Suojauspäivitys Windows XP:lle (KB920213) --> "C:\WINDOWS\$NtUninstallKB920213$\spuninst\spuninst.exe"
Suojauspäivitys Windows XP:lle (KB920214) --> "C:\WINDOWS\$NtUninstallKB920214$\spuninst\spuninst.exe"
Suojauspäivitys Windows XP:lle (KB920670) --> "C:\WINDOWS\$NtUninstallKB920670$\spuninst\spuninst.exe"
Suojauspäivitys Windows XP:lle (KB920683) --> "C:\WINDOWS\$NtUninstallKB920683$\spuninst\spuninst.exe"
Suojauspäivitys Windows XP:lle (KB920685) --> "C:\WINDOWS\$NtUninstallKB920685$\spuninst\spuninst.exe"
Suojauspäivitys Windows XP:lle (KB921398) --> "C:\WINDOWS\$NtUninstallKB921398$\spuninst\spuninst.exe"
Suojauspäivitys Windows XP:lle (KB921503) --> "C:\WINDOWS\$NtUninstallKB921503$\spuninst\spuninst.exe"
Suojauspäivitys Windows XP:lle (KB921883) --> "C:\WINDOWS\$NtUninstallKB921883$\spuninst\spuninst.exe"
Suojauspäivitys Windows XP:lle (KB922616) --> "C:\WINDOWS\$NtUninstallKB922616$\spuninst\spuninst.exe"
Suojauspäivitys Windows XP:lle (KB922760) --> "C:\WINDOWS\$NtUninstallKB922760$\spuninst\spuninst.exe"
Suojauspäivitys Windows XP:lle (KB922819) --> "C:\WINDOWS\$NtUninstallKB922819$\spuninst\spuninst.exe"
Suojauspäivitys Windows XP:lle (KB923191) --> "C:\WINDOWS\$NtUninstallKB923191$\spuninst\spuninst.exe"
Suojauspäivitys Windows XP:lle (KB923414) --> "C:\WINDOWS\$NtUninstallKB923414$\spuninst\spuninst.exe"
Suojauspäivitys Windows XP:lle (KB923694) --> "C:\WINDOWS\$NtUninstallKB923694$\spuninst\spuninst.exe"
Suojauspäivitys Windows XP:lle (KB923980) --> "C:\WINDOWS\$NtUninstallKB923980$\spuninst\spuninst.exe"
Suojauspäivitys Windows XP:lle (KB924191) --> "C:\WINDOWS\$NtUninstallKB924191$\spuninst\spuninst.exe"
Suojauspäivitys Windows XP:lle (KB924270) --> "C:\WINDOWS\$NtUninstallKB924270$\spuninst\spuninst.exe"
Suojauspäivitys Windows XP:lle (KB924496) --> "C:\WINDOWS\$NtUninstallKB924496$\spuninst\spuninst.exe"
Suojauspäivitys Windows XP:lle (KB924667) --> "C:\WINDOWS\$NtUninstallKB924667$\spuninst\spuninst.exe"
Suojauspäivitys Windows XP:lle (KB925486) --> "C:\WINDOWS\$NtUninstallKB925486$\spuninst\spuninst.exe"
Suojauspäivitys Windows XP:lle (KB925902) --> "C:\WINDOWS\$NtUninstallKB925902$\spuninst\spuninst.exe"
Suojauspäivitys Windows XP:lle (KB926255) --> "C:\WINDOWS\$NtUninstallKB926255$\spuninst\spuninst.exe"
Suojauspäivitys Windows XP:lle (KB926436) --> "C:\WINDOWS\$NtUninstallKB926436$\spuninst\spuninst.exe"
Suojauspäivitys Windows XP:lle (KB927779) --> "C:\WINDOWS\$NtUninstallKB927779$\spuninst\spuninst.exe"
Suojauspäivitys Windows XP:lle (KB927802) --> "C:\WINDOWS\$NtUninstallKB927802$\spuninst\spuninst.exe"
Suojauspäivitys Windows XP:lle (KB928255) --> "C:\WINDOWS\$NtUninstallKB928255$\spuninst\spuninst.exe"
Suojauspäivitys Windows XP:lle (KB928843) --> "C:\WINDOWS\$NtUninstallKB928843$\spuninst\spuninst.exe"
Suojauspäivitys Windows XP:lle (KB929123) --> "C:\WINDOWS\$NtUninstallKB929123$\spuninst\spuninst.exe"
Suojauspäivitys Windows XP:lle (KB930178) --> "C:\WINDOWS\$NtUninstallKB930178$\spuninst\spuninst.exe"
Suojauspäivitys Windows XP:lle (KB931261) --> "C:\WINDOWS\$NtUninstallKB931261$\spuninst\spuninst.exe"
Suojauspäivitys Windows XP:lle (KB931784) --> "C:\WINDOWS\$NtUninstallKB931784$\spuninst\spuninst.exe"
Suojauspäivitys Windows XP:lle (KB932168) --> "C:\WINDOWS\$NtUninstallKB932168$\spuninst\spuninst.exe"
Suojauspäivitys Windows XP:lle (KB933729) --> "C:\WINDOWS\$NtUninstallKB933729$\spuninst\spuninst.exe"
Suojauspäivitys Windows XP:lle (KB935839) --> "C:\WINDOWS\$NtUninstallKB935839$\spuninst\spuninst.exe"
Suojauspäivitys Windows XP:lle (KB935840) --> "C:\WINDOWS\$NtUninstallKB935840$\spuninst\spuninst.exe"
Suojauspäivitys Windows XP:lle (KB936021) --> "C:\WINDOWS\$NtUninstallKB936021$\spuninst\spuninst.exe"
Suojauspäivitys Windows XP:lle (KB938829) --> "C:\WINDOWS\$NtUninstallKB938829$\spuninst\spuninst.exe"
Suojauspäivitys Windows XP:lle (KB941202) --> "C:\WINDOWS\$NtUninstallKB941202$\spuninst\spuninst.exe"
Suojauspäivitys Windows XP:lle (KB941568) --> "C:\WINDOWS\$NtUninstallKB941568$\spuninst\spuninst.exe"
Suojauspäivitys Windows XP:lle (KB941644) --> "C:\WINDOWS\$NtUninstallKB941644$\spuninst\spuninst.exe"
Suojauspäivitys Windows XP:lle (KB941693) --> "C:\WINDOWS\$NtUninstallKB941693$\spuninst\spuninst.exe"
Suojauspäivitys Windows XP:lle (KB943055) --> "C:\WINDOWS\$NtUninstallKB943055$\spuninst\spuninst.exe"
Suojauspäivitys Windows XP:lle (KB943460) --> "C:\WINDOWS\$NtUninstallKB943460$\spuninst\spuninst.exe"
Suojauspäivitys Windows XP:lle (KB943485) --> "C:\WINDOWS\$NtUninstallKB943485$\spuninst\spuninst.exe"
Suojauspäivitys Windows XP:lle (KB944653) --> "C:\WINDOWS\$NtUninstallKB944653$\spuninst\spuninst.exe"
Suojauspäivitys Windows XP:lle (KB945553) --> "C:\WINDOWS\$NtUninstallKB945553$\spuninst\spuninst.exe"
Suojauspäivitys Windows XP:lle (KB946026) --> "C:\WINDOWS\$NtUninstallKB946026$\spuninst\spuninst.exe"
Suojauspäivitys Windows XP:lle (KB948590) --> "C:\WINDOWS\$NtUninstallKB948590$\spuninst\spuninst.exe"
Suojauspäivitys Windows XP:lle (KB948881) --> "C:\WINDOWS\$NtUninstallKB948881$\spuninst\spuninst.exe"
SuppSoft --> MsiExec.exe /I{022DA2C3-81C7-4003-A6BC-1BB147B20097}
Symantec Technical Support Controls --> MsiExec.exe /I{92B1B3CC-EC78-45B8-96D0-8B3F11495864}
SymNet --> MsiExec.exe /I{2DA85B02-13C0-4E6D-9A76-22E6B3DD0CB2}
TVUPlayer 2.3.6.1 --> C:\Program Files\TVUPlayer\uninst.exe
Unlocker 1.8.5 --> C:\Program Files\Unlocker\uninst.exe
Warcraft III: All Products --> C:\WINDOWS\War3Unin.exe C:\WINDOWS\War3Unin.dat
Winamp --> "C:\Program Files\Winamp\UninstWA.exe"
Windows Live Messenger --> MsiExec.exe /I{DF6FEB75-A0D1-44E5-A754-0072D4967734}
Windows Media Format 11 runtime --> "C:\WINDOWS\$NtUninstallWMFDist11$\spuninst\spuninst.exe"
Windowsin ohjainpaketti - Nokia Modem (08/03/2007 6.84.0.2) --> C:\PROGRA~1\DIFX\270581355A767BF1\dpinst.exe /u C:\WINDOWS\system32\DRVSTORE\nokbtmdm_1EB5F2E6F54A6BEDE9F436D1BA5D830FC71739BE\nokbtmdm.inf
Windowsin ohjainpaketti - Nokia Modem (10/12/2007 3.6) --> C:\PROGRA~1\DIFX\270581355A767BF1\dpinst.exe /u C:\WINDOWS\system32\DRVSTORE\nokia_blue_0A5D98F754C6588B2E3DDE89DDEF097075ADFFB7\nokia_bluetooth.inf
WinRAR archiver --> C:\Program Files\WinRAR\uninstall.exe


-- Application Event Log -------------------------------------------------------

Event Record #/Type3589 / Success
Event Submitted/Written: 04/30/2008 08:44:35 PM
Event ID/Source: 12001 / usnjsvc
Event Description:
The Messenger Sharing USN Journal Reader service started successfully.

Event Record #/Type3430 / Success
Event Submitted/Written: 04/29/2008 06:28:36 PM
Event ID/Source: 12001 / usnjsvc
Event Description:
The Messenger Sharing USN Journal Reader service started successfully.

Event Record #/Type3397 / Success
Event Submitted/Written: 04/29/2008 05:07:57 PM
Event ID/Source: 12001 / usnjsvc
Event Description:
The Messenger Sharing USN Journal Reader service started successfully.

Event Record #/Type3364 / Success
Event Submitted/Written: 04/29/2008 03:45:39 PM
Event ID/Source: 12001 / usnjsvc
Event Description:
The Messenger Sharing USN Journal Reader service started successfully.

Event Record #/Type3313 / Success
Event Submitted/Written: 04/29/2008 11:14:22 AM
Event ID/Source: 12001 / usnjsvc
Event Description:
The Messenger Sharing USN Journal Reader service started successfully.



-- Security Event Log ----------------------------------------------------------

No Errors/Warnings found.


-- System Event Log ------------------------------------------------------------

Event Record #/Type82765 / Warning
Event Submitted/Written: 04/30/2008 10:54:58 PM
Event ID/Source: 4226 / Tcpip
Event Description:
TCP/IP saavutti yhtäaikaisille TCP-yhteysyrityksille asetetun suojausrajoituksen.

Event Record #/Type82738 / Error
Event Submitted/Written: 04/30/2008 10:39:23 PM
Event ID/Source: 7000 / Service Control Manager
Event Description:
Palvelua Automattinen LiveUpdate-ajastustoiminto ei voi käynnistää. Virhekoodi on
%%1053

Event Record #/Type82737 / Error
Event Submitted/Written: 04/30/2008 10:39:23 PM
Event ID/Source: 7009 / Service Control Manager
Event Description:
Aikakatkaisu (30000 ms) odottaa palvelun Automattinen LiveUpdate-ajastustoiminto yhdistymistä.

Event Record #/Type82733 / Error
Event Submitted/Written: 04/30/2008 10:37:15 PM
Event ID/Source: 10005 / DCOM
Event Description:
DCOM vastaanotti virheen "%%1084" yrittäessään käynnistää palvelun EventSystem argumenteilla ""
suorittaakseen palvelinosan:
{1BE1F766-5536-11D1-B726-00C04FB926AF}

Event Record #/Type82730 / Error
Event Submitted/Written: 04/30/2008 10:34:06 PM
Event ID/Source: 7026 / Service Control Manager
Event Description:
Seuraava käynnistys- tai järjestelmäkäynnistysohjain ei latautunut:
AmdK8
eeCtrl
Fips
SPBBCDrv
SRTSPX
SYMTDI



-- End of Deckard's System Scanner: finished at 2008-04-30 23:00:25 ------------
Hujo
Suspended permanently
_
30. huhtikuuta 2008 @ 23:36 _ Linkki tähän viestiin    Lähetä käyttäjälle yksityisviesti   
Lataa Malwarebytes' Anti-Malware työpöydällesi.

1. Tuplaklikkaa mbam-setup.exe ja seuraa ohjeita asentaaksesi ohjelman.
2. Lopuksi varmistu, että seuraavat on valittu: Update Malwarebytes', Anti-Malwareja
Launch Malwarebytes' Anti-Malware ja sen jälkeen klikkaaFinish.
3. Jos päivitys löytyy. ohjelma lataa ja asentaa uusimman version.
4. Kun ohjelma on latautunut, valitse Perform full scan ja klikkaa Scan.
5. Kun skanni on valmis, klikkaa OK ja sitten Show Results nähdäksesi tulokset.
6. Varmistu, että kaikki on merkitty ja klikkaa Remove Selected.
7. Tämän jälkeen loki avautuu muistioon. Tallenna se paikkaan, josta löydät sen helposti. Loki
löytyy myös täältä: C:\Documents and Settings\Käyttäjänimi\Application
Data\Malwarebytes\Malwarebytes' Anti-Malware\Logs\log-päiväys.txt
8. Lähetä lokin sisältö seuraavassa viestissäsi.

===============

Lataa: RegSeeker.zip työpöydälle:

Pura zip C:\RegSeeker\ kansioon. Sieltä käynnistät RegSeeker.exe ohjelman.
Oikeasa yläkulmassa on Languages.... linkki, josta valitset Suomenkielen.
Vasemmasta alakulmasta ruksit Luo vrmuuskopio ja sitten linkki Puhdista rekisteri
Ruksit kaikkiin muihin kohtiin paitsi "Käyttökelvottomat.." sitten "OK" (odotat hetken).
Ruutuun ilmestyy lista epäkelvoista rekisterimerkinnöistä, jotka alapalkista Valitse kohdasta
klikkaat Valitse kaikki jolloin valitut saavat keltaisen pohjavärin.
Alapalkin Toiminnot linkistä klikkaat Poista valitut kohteet
Ponnahdusikkunaan "Kaikki valitut kohteet poistetaan ? vastaat "OK".
Seuraavaan Ponnahdusikkunaan "Varmuuskopiot" vastaat "OK".
Klikaa vasemmalta Lopeta RegSeeker ja käynnistä koneesi uudelleen.


Voiko tietsikka koskaan toimia?
Newbie
_
1. toukokuuta 2008 @ 19:18 _ Linkki tähän viestiin    Lähetä käyttäjälle yksityisviesti   
Olikin sitten ihan jämäkkä scannaus. Jotain n.7h meni aikaa ja löysi 21 epäilyttävää tiedostoa jotka sai käsittääkseni poistettua.


Malwarebytes' Anti-Malware 1.11
Database version: 704

Scan type: Full Scan (C:\|D:\|E:\|F:\|G:\|)
Objects scanned: 148705
Time elapsed: 7 hour(s), 17 minute(s), 58 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 9
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 2
Files Infected: 18

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
HKEY_CLASSES_ROOT\AppID\{f663b917-591f-4172-8d87-3d7d729007ca} (Adware.Batco) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Interface\{d279bc2b-a85b-4559-8fd9-ddc55f5d402d} (Adware.Batco) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Typelib\{b80a3586-caa5-41c8-89bf-e617f0b6cfbf} (Adware.Batco) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\Software\BATCO (Adware.Batco) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Batco (Adware.Batco) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\AppID\bat.DLL (Adware.Batco) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\Software\Microsoft\affri (Malware.Trace) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\affri (Malware.Trace) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\MS Juan (Malware.Trace) -> Quarantined and deleted successfully.

Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
C:\Documents and Settings\All Users\Application Data\Rabio\Search Enhancer (Adware.SearchEnhancer) -> Quarantined and deleted successfully.
C:\Documents and Settings\All Users\Application Data\Rabio (Adware.Rabio) -> Quarantined and deleted successfully.

Files Infected:
C:\System Volume Information\_restore{7BD41464-2CC7-4899-A278-DFE2F6B620D8}\RP522\A0193753.exe (Adware.Batco) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{7BD41464-2CC7-4899-A278-DFE2F6B620D8}\RP522\A0193754.dll (Adware.Batco) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{7BD41464-2CC7-4899-A278-DFE2F6B620D8}\RP524\A0196857.exe (Adware.Batco) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{7BD41464-2CC7-4899-A278-DFE2F6B620D8}\RP530\A0201362.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{7BD41464-2CC7-4899-A278-DFE2F6B620D8}\RP531\A0202380.exe (Adware.Rabio) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{7BD41464-2CC7-4899-A278-DFE2F6B620D8}\RP531\A0202383.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{7BD41464-2CC7-4899-A278-DFE2F6B620D8}\RP532\A0204433.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{7BD41464-2CC7-4899-A278-DFE2F6B620D8}\RP532\A0204434.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{7BD41464-2CC7-4899-A278-DFE2F6B620D8}\RP534\A0209653.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{7BD41464-2CC7-4899-A278-DFE2F6B620D8}\RP534\A0209654.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{7BD41464-2CC7-4899-A278-DFE2F6B620D8}\RP535\A0209657.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{7BD41464-2CC7-4899-A278-DFE2F6B620D8}\RP537\A0211753.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{7BD41464-2CC7-4899-A278-DFE2F6B620D8}\RP537\A0211757.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{7BD41464-2CC7-4899-A278-DFE2F6B620D8}\RP539\A0212843.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{7BD41464-2CC7-4899-A278-DFE2F6B620D8}\RP540\A0215886.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{7BD41464-2CC7-4899-A278-DFE2F6B620D8}\RP540\A0215890.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{7BD41464-2CC7-4899-A278-DFE2F6B620D8}\RP540\A0215891.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{7BD41464-2CC7-4899-A278-DFE2F6B620D8}\RP540\A0215893.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
Hujo
Suspended permanently
_
2. toukokuuta 2008 @ 02:01 _ Linkki tähän viestiin    Lähetä käyttäjälle yksityisviesti   
1. Klikkaa käynnistä > Oma tietokone oikean puoleisella hiiren napilla
2. Valitse ominaisuudet
3. Valitse järjestelmän palauttaminen välilehti
4. Ruksi eteen ¤ poista järjestelmän palauttaminen kaikissa asemissa
5. Paina Käytä
6. Paina ok
7. Sammuta ja käynnistä
8. Ota ruksi pois ¤ poista järjestelmän palauttaminen kaikissa asemissa
9. Käytä ja OK


Voiko tietsikka koskaan toimia?
Newbie
_
2. toukokuuta 2008 @ 02:32 _ Linkki tähän viestiin    Lähetä käyttäjälle yksityisviesti   
Tehty. Voisin lisätä, että ilmeisesti erehdyin aluksi ongelman suhteen... tietokonepelit näyttäisivät nykivän täsmälleen samalla tavalla kuin videot ja netti.

Viestiä on muokattu lähettämisen jälkeen. Viimeisin muokkaus 2. toukokuuta 2008 @ 03:11

Hujo
Suspended permanently
_
2. toukokuuta 2008 @ 13:21 _ Linkki tähän viestiin    Lähetä käyttäjälle yksityisviesti   
lataa tuolta
EVEREST Free Edition 2.20

kato siintä keskusmuisti ja sen käyttö aste

Voiko tietsikka koskaan toimia?
Newbie
_
2. toukokuuta 2008 @ 13:32 _ Linkki tähän viestiin    Lähetä käyttäjälle yksityisviesti   
Keskusmuistia:

Yhteensä 2558MB
Käytössä 520MB
Vapaana 2037MB
Käyttöaste: 20%
Hujo
Suspended permanently
_
2. toukokuuta 2008 @ 13:52 _ Linkki tähän viestiin    Lähetä käyttäjälle yksityisviesti   
Ok....

Tyhjennä tuo karanteeni
C:\Documents and Settings\HP_Omistaja\.housecall6.6\Quarantine

==========

Poista lisää poista sovelutuksesta

AVG Anti-Spyware 7.5

==========

Lataa SmitfraudFix (c) S!Ri
Pura sisältö (kansio nimeltä SmitfraudFix) työpöydällesi:

Avaa SmitfraudFix kansio ja tupla-klikkaa smitfraudfix.cmd
Valitse optio #1 - Search kirjoittamalla 1 ja painamalla "Enter"; tekstitiedosto avautuu, joka listaa tarttuneet tiedostot (jos olemassa).
Postita ponnahtava rapport ? muistion sisältö viestiketjuusi.
Löytyy myös C:\rapport.txt

Huomaa : process.exe filun tunnistaa jotkut Anti-virus ohjelmat
(AntiVir, Dr.Web, Kaspersky) "Haittakaluna"; se ei ole virus, vaan ohjelma joka pysäyttää prosesseja.
A/V ohjelmat eivät pysty tunnistamaan hyvän ja pahan käytön tälläisten ohjelmian väliltä,
silloin ne saattavat varoittaa käyttäjää.





Voiko tietsikka koskaan toimia?
Newbie
_
2. toukokuuta 2008 @ 14:16 _ Linkki tähän viestiin    Lähetä käyttäjälle yksityisviesti   
SmitFraudFix v2.319

Scan done at 14:11:54,87, pe 02.05.2008
Run from C:\Documents and Settings\HP_Omistaja\Ty?p?yt?\SmitfraudFix
OS: Microsoft Windows XP [versio 5.1.2600] - Windows_NT
The filesystem type is NTFS
Fix run in normal mode

»»»»»»»»»»»»»»»»»»»»»»»» Process

C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
C:\Program Files\Bluetooth\Bluetooth-ohjelmisto\bin\btwdins.exe
C:\WINDOWS\system32\HPZipm12.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\ThreadMaster\ThreadMast.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\WINDOWS\system32\LVCOMSX.EXE
C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\HP\Digital Imaging\bin\hpqSTE08.exe
C:\Program Files\Common Files\Symantec Shared\VAScanner\comHost.exe
C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
C:\Program Files\Symantec\LiveUpdate\AUPDATE.EXE
C:\Program Files\Symantec\LiveUpdate\LuCallbackProxy.exe
C:\Program Files\Symantec\LiveUpdate\LuCallbackProxy.exe
C:\Program Files\Symantec\LiveUpdate\LuCallbackProxy.exe
C:\Program Files\Symantec\LiveUpdate\LuCallbackProxy.exe
C:\Program Files\Symantec\LiveUpdate\LuCallbackProxy.exe
C:\Program Files\Symantec\LiveUpdate\LuCallbackProxy.exe
C:\Program Files\Symantec\LiveUpdate\LuCallbackProxy.exe
C:\Program Files\Symantec\LiveUpdate\LuCallbackProxy.exe
C:\Program Files\Symantec\LiveUpdate\LuCallbackProxy.exe
C:\Program Files\Symantec\LiveUpdate\LuCallbackProxy.exe
C:\WINDOWS\system32\cmd.exe

»»»»»»»»»»»»»»»»»»»»»»»» hosts


»»»»»»»»»»»»»»»»»»»»»»»» C:\


»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS


»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\system


»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\Web


»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\system32


»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\system32\LogFiles


»»»»»»»»»»»»»»»»»»»»»»»» C:\Documents and Settings\HP_Omistaja


»»»»»»»»»»»»»»»»»»»»»»»» C:\Documents and Settings\HP_Omistaja\Application Data


»»»»»»»»»»»»»»»»»»»»»»»» Start Menu


»»»»»»»»»»»»»»»»»»»»»»»» C:\DOCUME~1\HP_OMI~1\Suosikit


»»»»»»»»»»»»»»»»»»»»»»»» Desktop


»»»»»»»»»»»»»»»»»»»»»»»» C:\Program Files


»»»»»»»»»»»»»»»»»»»»»»»» Corrupted keys


»»»»»»»»»»»»»»»»»»»»»»»» Desktop Components

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Desktop\Components\0]
"Source"="About:Home"
"SubscribedURL"="About:Home"
"FriendlyName"="Nykyinen kotisivu"


»»»»»»»»»»»»»»»»»»»»»»»» IEDFix
!!!Attention, following keys are not inevitably infected!!!

IEDFix
Credits: Malware Analysis & Diagnostic
Code: S!Ri


»»»»»»»»»»»»»»»»»»»»»»»» VACFix
!!!Attention, following keys are not inevitably infected!!!

VACFix
Credits: Malware Analysis & Diagnostic
Code: S!Ri


»»»»»»»»»»»»»»»»»»»»»»»» 404Fix
!!!Attention, following keys are not inevitably infected!!!

404Fix
Credits: Malware Analysis & Diagnostic
Code: S!Ri


»»»»»»»»»»»»»»»»»»»»»»»» Sharedtaskscheduler
!!!Attention, following keys are not inevitably infected!!!

SrchSTS.exe by S!Ri
Search SharedTaskScheduler's .dll


»»»»»»»»»»»»»»»»»»»»»»»» AppInit_DLLs
!!!Attention, following keys are not inevitably infected!!!

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
"AppInit_DLLs"=""


»»»»»»»»»»»»»»»»»»»»»»»» Winlogon
!!!Attention, following keys are not inevitably infected!!!

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon]
"Userinit"="C:\\WINDOWS\\system32\\userinit.exe,"
"System"=""


»»»»»»»»»»»»»»»»»»»»»»»» Rustock



»»»»»»»»»»»»»»»»»»»»»»»» DNS

Description: Realtek RTL8139/810x Family Fast Ethernet NIC - Paketinajoituksen miniportti
DNS Server Search Order: 16.92.3.242
DNS Server Search Order: 16.92.3.243
DNS Server Search Order: 16.81.3.243
DNS Server Search Order: 16.114.3.243

Description: Realtek RTL8139/810x Family Fast Ethernet NIC - Paketinajoituksen miniportti
DNS Server Search Order: 192.168.0.254

HKLM\SYSTEM\CCS\Services\Tcpip\..\{A213E28B-96CF-4BCB-863B-B3C4EE32CB43}: DhcpNameServer=16.92.3.242 16.92.3.243 16.81.3.243 16.114.3.243
HKLM\SYSTEM\CCS\Services\Tcpip\..\{B7F85E39-40BB-49AC-8A88-B93D6425CA15}: DhcpNameServer=192.168.0.254
HKLM\SYSTEM\CS1\Services\Tcpip\..\{A213E28B-96CF-4BCB-863B-B3C4EE32CB43}: DhcpNameServer=16.92.3.242 16.92.3.243 16.81.3.243 16.114.3.243
HKLM\SYSTEM\CS1\Services\Tcpip\..\{B7F85E39-40BB-49AC-8A88-B93D6425CA15}: DhcpNameServer=192.168.0.254
HKLM\SYSTEM\CS3\Services\Tcpip\..\{A213E28B-96CF-4BCB-863B-B3C4EE32CB43}: DhcpNameServer=16.92.3.242 16.92.3.243 16.81.3.243 16.114.3.243
HKLM\SYSTEM\CS3\Services\Tcpip\..\{B7F85E39-40BB-49AC-8A88-B93D6425CA15}: DhcpNameServer=192.168.0.254
HKLM\SYSTEM\CCS\Services\Tcpip\Parameters: DhcpNameServer=192.168.0.254
HKLM\SYSTEM\CS1\Services\Tcpip\Parameters: DhcpNameServer=192.168.0.254
HKLM\SYSTEM\CS3\Services\Tcpip\Parameters: DhcpNameServer=192.168.0.254


»»»»»»»»»»»»»»»»»»»»»»»» Scanning for wininet.dll infection


»»»»»»»»»»»»»»»»»»»»»»»» End
Hujo
Suspended permanently
_
2. toukokuuta 2008 @ 14:42 _ Linkki tähän viestiin    Lähetä käyttäjälle yksityisviesti   
Lataa Dr.Web CureIt työpöydälle:

Tuplaklikkaa drweb-cureit.exe ja anna sen tehdä express scan
Se skannaa käynnissä olevat ohjelmat ja jos jotain löytyy, klikkaa yes kun se kysyy haluatko poistaa sen. Tämä on vain lyhyt scan.
Kun scan on valmis, Klikkaa Custom scan merkkaa asemat, jotka haluat scannata.
Valitse kaikki asemat. Punainen piste osoittaa, mitkä asemat on valittu.
Klikaa vihreää nuolta oikealla ja scan alkaa.
Klikkaa 'Yes to all', jos kysytään haluatko poistaa/siirtää tiedoston.
Kun scan on valmis, katso voitko klikata next-kuvaketta löytyneiden tiedostojen vieressä:

Jos asia on niin, klikkaa sitä ja sitten klikkaa next-kuvaketta oikealla alhaalla ja valitse Move incurable kuten alla olevalla kuvassa:


Tämä siirtää sen %userprofile%\DoctorWeb\quarantine-hakemistoon.
Tämän jälkeen klikkaa Dr.Web CureIt-valikossa file ja valitse save report list
Tallenna raportti työpöydälle. Raportin nimi on DrWeb.csv
Sulje Dr.Web Cureit.
Käynnistä kone uudelleen !! Tämä siksi, että käytössä olevat tiedostot poistetaan/siirretään käynnistyksen yhteydessä.
Käynnistyksen jälkeen liitä Dr.Web-lokin, jonka tallensit aiemmin, sisältö seuraavaan vastaukseesi.

Voiko tietsikka koskaan toimia?
Newbie
_
2. toukokuuta 2008 @ 17:22 _ Linkki tähän viestiin    Lähetä käyttäjälle yksityisviesti   
DrWeb.csv:n sisältö

mirc.chm\ctcp_events.htm;C:\Program Files\mIRC\mirc.chm;IRC.Generic.32;;
mirc.chm;C:\Program Files\mIRC;Archive contains infected objects;Moved.;
mirc.exe;C:\Program Files\mIRC;Program.mIRC.621;Moved.;
A0000168.exe;C:\System Volume Information\_restore{7BD41464-2CC7-4899-A278-DFE2F6B620D8}\RP3;Tool.Prockill;Moved.;
A0000169.exe;C:\System Volume Information\_restore{7BD41464-2CC7-4899-A278-DFE2F6B620D8}\RP3;Tool.Prockill;Moved.;
A0000170.exe;C:\System Volume Information\_restore{7BD41464-2CC7-4899-A278-DFE2F6B620D8}\RP3;Tool.ShutDown.11;Moved.;
A0000171.exe;C:\System Volume Information\_restore{7BD41464-2CC7-4899-A278-DFE2F6B620D8}\RP3;Tool.ProcessKill;Moved.;
sb6adts.htc\Script.0;C:\WINDOWS\pchealth\helpctr\Vendors\CN=Hewlett-Packard,L=Cupertino,S=Ca,C=US\Scripts\sb6adts.htc;Probably SCRIPT.Virus;;
sb6adts.htc;C:\WINDOWS\pchealth\helpctr\Vendors\CN=Hewlett-Packard,L=Cupertino,S=Ca,C=US\Scripts;Archive contains infected objects;Moved.;

Viestiä on muokattu lähettämisen jälkeen. Viimeisin muokkaus 3. toukokuuta 2008 @ 02:42

Hujo
Suspended permanently
_
4. toukokuuta 2008 @ 12:03 _ Linkki tähän viestiin    Lähetä käyttäjälle yksityisviesti   
1. Klikkaa käynnistä > Oma tietokone oikean puoleisella hiiren napilla
2. Valitse ominaisuudet
3. Valitse järjestelmän palauttaminen välilehti
4. Ruksi eteen ¤ poista järjestelmän palauttaminen kaikissa asemissa
5. Paina Käytä
6. Paina ok
7. Sammuta ja käynnistä
8. Ota ruksi pois ¤ poista järjestelmän palauttaminen kaikissa asemissa
9. Käytä ja OK


Voiko tietsikka koskaan toimia?
Newbie
_
5. toukokuuta 2008 @ 09:56 _ Linkki tähän viestiin    Lähetä käyttäjälle yksityisviesti   
Tehty.
Hujo
Suspended permanently
_
5. toukokuuta 2008 @ 18:51 _ Linkki tähän viestiin    Lähetä käyttäjälle yksityisviesti   
ajas tuo combofix uudelleen

==================

Lataa OTMoveIt
OTMoveIt ja tallenna se työpöydällesi.

Tuplaklikkaa OTMoveIt.exe.
Klikkaa CleanUp!.
Valitse Yes kun kysytään "Begin cleanup Process?".
Jos pyydetään, että saako koneen käynnistää uudeelleen, valitse Yes.OTMoveIt poistaa itsensä kun se on valmis, jos näin ei käy poista se itse.

HUOM: Jos palomuurisi tai joku muu tietoturvaohjelma varoittaa, että OTMoveIt yrittää päästä nettin, niin anna sen päästä sinne


Voiko tietsikka koskaan toimia?
Mainos
_
__
 
_
Newbie
_
6. toukokuuta 2008 @ 21:52 _ Linkki tähän viestiin    Lähetä käyttäjälle yksityisviesti   
Tehty.
 
Sivu:12>
afterdawn.com > keskustelu > yleistä keskustelua tietokoneista > virukset ja haittaohjelmat - hijackthis -logit > kone erittäin ''nykivä'' internetissä sekä videotiedostoja katsoessa. (hijackthis logi)
 

Apua ongelmiin: AfterDawnin keskustelualueet | AfterDawnin Vastaukset
Uutiset: IT-alan uutiset | Uutisia puhelimista
Musiikkia: MP3Lizard.com
Tuotearviot: Laitevertailu | Vertaa puhelimia | Vertaa kännykkäliittymiä
Pelit: Pelitiedostot, pelidemot ja trailerit
Ohjelmat: download.fi | AfterDawnin ohjelma-alueet
International: AfterDawn in English | Software downloads | Free, legal MP3s | AfterDawn på svenska
RSS -syötteet: AfterDawnin uutiset | Uusimmat ohjelmapäivitykset | Keskustelualueiden viestit
Tietoja: Tietoa AfterDawn Oy:stä | Mainosta sivuillamme | Sivuston käyttöehdot ja tietoja yksityisyydensuojasta
Ota yhteyttä: Lähetä palautetta | Ota yhteyttä mainosmyyntiimme
 
  © 1999-2025 AfterDawn Oy