Kone on alkanut sekoileen oikein urakalla. Jatkuvasti tulee virhe ilmoituksia mistä ohjelmista milloinkin.
Jäljet näytti johtavan W32/Sonebot-B madon jäljille??? http://www.sophos.com/virusinfo/analyses/w32sonebotb.html
Koneelta löytyy linkissä mainittava wmiprvse.exe tiedosto, mutta poistaminen ei oikein näillä taidoilla onnistu :( Voisko joku auttaa!?
Laitan HjT-login mukaan...

Logfile of Trend Micro HijackThis v2.0.0 (BETA)
Scan saved at 21:09:54, on 24.4.2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\Program Files\Common Files\Symantec Shared\ccProxy.exe
C:\Program Files\Symantec Client Security\Symantec Client Firewall\ISSVC.exe
C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\BUFFALO\Client Manager3\bwsvc\bwsvc.exe
C:\Program Files\Symantec Client Security\Symantec AntiVirus\DefWatch.exe
C:\Program Files\Common Files\LightScribe\LSSrvc.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Symantec Client Security\Symantec AntiVirus\Rtvscan.exe
C:\Program Files\Symantec Client Security\Symantec Client Firewall\SymSPort.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\PROGRA~1\SYMANT~1\SYMANT~2\VPTray.exe
C:\Program Files\Google\Gmail Notifier\gnotify.exe
C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe
C:\Program Files\Microsoft IntelliType Pro\itype.exe
C:\Program Files\Microsoft IntelliPoint\ipoint.exe
C:\Program Files\ScanSoft\OmniPageSE4.0\OpwareSE4.exe
C:\Program Files\Macrogaming\SweetIM\SweetIM.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\DAEMON Tools\daemon.exe
C:\Program Files\utorrent.exe
C:\Program Files\Skype\Phone\Skype.exe
C:\Program Files\YourWare Solutions\FreeRAM XP Pro\FreeRAM XP Pro.exe
C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\BUFFALO\Client Manager3\cm3_tray.exe
C:\Program Files\Common Files\Ahead\Lib\NMIndexStoreSvr.exe
C:\Program Files\MSN Messenger\MsnMsgr.Exe
C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\MSN Messenger\usnsvc.exe
C:\Documents and Settings\Heikki\Työpöytä\HiJackThis_v2.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Linkit
R3 - URLSearchHook: SweetIM For Internet Explorer - {BC4FFE41-DE9F-46fa-B455-AAD49B9F9938} - C:\Program Files\Macrogaming\SweetIMBarForIE\toolbar.dll
O2 - BHO: Adobe PDF Reader -linkkiavustaja - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: SWEETIE - {1A0AADCD-3A72-4b5f-900F-E3BB5A838E2A} - C:\PROGRA~1\MACROG~1\SWEETI~1\toolbar.dll
O2 - BHO: Canon Easy Web Print Helper - {68F9551E-0411-48E4-9AAF-4BC42A6A46BE} - C:\Program Files\Canon\Easy-WebPrint\EWPBrowseLoader.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O3 - Toolbar: Easy-WebPrint - {327C2873-E90D-4c37-AA9D-10AC9BABA46C} - C:\Program Files\Canon\Easy-WebPrint\Toolband.dll
O3 - Toolbar: SweetIM For Internet Explorer - {BC4FFE41-DE9F-46fa-B455-AAD49B9F9938} - C:\Program Files\Macrogaming\SweetIMBarForIE\toolbar.dll
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [vptray] C:\PROGRA~1\SYMANT~1\SYMANT~2\VPTray.exe
O4 - HKLM\..\Run: [{0228e555-4f9c-4e35-a3ec-b109a192b4c2}] C:\Program Files\Google\Gmail Notifier\gnotify.exe
O4 - HKLM\..\Run: [ATICCC] "C:\Program Files\ATI Technologies\ATI.ACE\cli.exe" runtime -Delay
O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe"
O4 - HKLM\..\Run: [itype] "C:\Program Files\Microsoft IntelliType Pro\itype.exe"
O4 - HKLM\..\Run: [IntelliPoint] "C:\Program Files\Microsoft IntelliPoint\ipoint.exe"
O4 - HKLM\..\Run: [SSBkgdUpdate] "C:\Program Files\Common Files\Scansoft Shared\SSBkgdUpdate\SSBkgdupdate.exe" -Embedding -boot
O4 - HKLM\..\Run: [OpwareSE4] "C:\Program Files\ScanSoft\OmniPageSE4.0\OpwareSE4.exe"
O4 - HKLM\..\Run: [SweetIM] C:\Program Files\Macrogaming\SweetIM\SweetIM.exe
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [DAEMON Tools] "C:\Program Files\DAEMON Tools\daemon.exe" -lang 1033
O4 - HKCU\..\Run: [MsnMsgr] ~"C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [µTorrent] "C:\Program Files\utorrent.exe"
O4 - HKCU\..\Run: [Skype] "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized
O4 - HKCU\..\Run: [FreeRAM XP] "C:\Program Files\YourWare Solutions\FreeRAM XP Pro\FreeRAM XP Pro.exe" -win
O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe"
O4 - HKCU\..\Run: [SweetIM] C:\Program Files\Macrogaming\SweetIM\SweetIM.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Paikallinen palve')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Verkkopalve')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Reader 8.0\Reader\reader_sl.exe
O4 - Global Startup: Adobe Reader Synchronizer.lnk = C:\Program Files\Adobe\Reader 8.0\Reader\AdobeCollabSync.exe
O4 - Global Startup: ClientManager3.lnk = C:\Program Files\BUFFALO\Client Manager3\cm3_tray.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O8 - Extra context menu item: Easy-WebPrint Add To Print List - res://C:\Program Files\Canon\Easy-WebPrint\Toolband.dll/RC_AddToList.html
O8 - Extra context menu item: Easy-WebPrint High Speed Print - res://C:\Program Files\Canon\Easy-WebPrint\Toolband.dll/RC_HSPrint.html
O8 - Extra context menu item: Easy-WebPrint Preview - res://C:\Program Files\Canon\Easy-WebPrint\Toolband.dll/RC_Preview.html
O8 - Extra context menu item: Easy-WebPrint Print - res://C:\Program Files\Canon\Easy-WebPrint\Toolband.dll/RC_Print.html
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O22 - SharedTaskScheduler: Browseui preloader - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - C:\WINDOWS\system32\browseui.dll
O22 - SharedTaskScheduler: Component Categories cache daemon - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\WINDOWS\system32\browseui.dll
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: Bwsvc - BUFFALO INC. - C:\Program Files\BUFFALO\Client Manager3\bwsvc\bwsvc.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Network Proxy (ccProxy) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccProxy.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: Symantec AntiVirus Definition Watcher (DefWatch) - Symantec Corporation - C:\Program Files\Symantec Client Security\Symantec AntiVirus\DefWatch.exe
O23 - Service: Loogisen levyn hallinnan valvontapalvelu (dmadmin) - Unknown owner - C:\WINDOWS\System32\dmadmin.exe
O23 - Service: Tapahtumaloki (Eventlog) - Unknown owner - C:\WINDOWS\system32\services.exe
O23 - Service: CD-levyjen kirjoittamisen IMAPI COM -palvelu (ImapiService) - Unknown owner - C:\WINDOWS\system32\imapi.exe
O23 - Service: IS Service (ISSVC) - Symantec Corporation - C:\Program Files\Symantec Client Security\Symantec Client Firewall\ISSVC.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe
O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
O23 - Service: NetMeeting etätyöpöydän jakaminen (mnmsrvc) - Unknown owner - C:\WINDOWS\system32\mnmsrvc.exe
O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe
O23 - Service: Plug and Play (PlugPlay) - Unknown owner - C:\WINDOWS\system32\services.exe
O23 - Service: Etätyöpöydän ohjeen istunnonhallinta (RDSessMgr) - Unknown owner - C:\WINDOWS\system32\sessmgr.exe
O23 - Service: SAVRoam (SavRoam) - symantec - C:\Program Files\Symantec Client Security\Symantec AntiVirus\SavRoam.exe
O23 - Service: Älykortti (SCardSvr) - Unknown owner - C:\WINDOWS\System32\SCardSvr.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
O23 - Service: Symantec AntiVirus - Symantec Corporation - C:\Program Files\Symantec Client Security\Symantec AntiVirus\Rtvscan.exe
O23 - Service: Symantec SecurePort (SymSecurePort) - Symantec Corporation - C:\Program Files\Symantec Client Security\Symantec Client Firewall\SymSPort.exe
O23 - Service: Resurssilokit ja -hälytykset (SysmonLog) - Unknown owner - C:\WINDOWS\system32\smlogsvc.exe
O23 - Service: Aseman tilannevedos (VSS) - Unknown owner - C:\WINDOWS\System32\vssvc.exe
O23 - Service: WMI resurssisovitin (WmiApSrv) - Unknown owner - C:\WINDOWS\system32\wbem\wmiapsrv.exe

--
End of file - 10931 bytes

Mistä hakemistosta tarkalleen mainitsemasi wmiprvse.exe löytyy?

C:\WINDOWS\system32\wbem\wmiprvse.exe ja toisesta paikasta löytyy tällainen C:\WINDOWS\Prefetch\WMIPRVSE.EXE-28F301A9.pf
Virheessä mainittiin tuo wmiprvse.exe ja googlea käyttämällä löysin tuon linkin.

Nuo ovat ihan luvallisia, mutta jos olisi esim. C:\Windows\System32 -hakemistossa kuten antamasi linkki kertoi, kyseessä olisi pöpö. Joten tuosta tuskin on kyse.

Voisitko kertoa millaisia virheilmoituksia tulee, mahd. tarkasti, sekä millä tavalla kone sekoilee urakalla?

juu.. kone on sammunut ja käynnistynyt itsestään jo pidemmän aikaa. Siitä se ilmoittaa jonkun laiteajuri vian, jota en ole saanut selvitetyä tarkalleen mistä johtuu. Epäilen Buffalon wlan-järjestelmää, koska sen asennuksen jälkeen ongelmat alkoi. Varma en ole.
Nyt on Firefox, evolution-sähköposti, live messenger, tämä wmiprvse.exe ja saattaa myös joitain muita ohjelmia listaan kuulua, jotka aiheuttaa virheen ja windows sammuttaa ohjelman. Kysyy sitten lähetetäänkö virheraportti.
Tämän tarkempia tietoja ei tähän ole, kun nämäkin perustuu "hyvään" muistiini ;)

Lokissa ei kyllä näyttäisi olevan mitään erikoista. Mutta voisit varmuudeksi ajaa AVGAS:n.

Tallenna nämä ohjeet tekstitiedostoon tai tulosta nämä, muuten et pääse niihin käsiksi vikasietotilasta

Lataa AVG Anti-Spyware 7.5 ja tallenna ohjelma työpöydällesi.
[*]Kun olet ladannut ohjelman, kaksoisklikkaa asennuohjelman pikakuvaketta työpöydälläsi, asennus alkaa.
[*]Asennuksen jälkeen täytyy ohjelma käynnistää ja sen tunnisteet päivittää.
[*]Käynnistä AVG Anti-Spyware.
[*]Klikkaa "Update" kuvaketta päävalikossa. Sen jälkeen klikkaa "Update now" painiketta.

[*]Sitten klikkaa "Start Update" kuvaketta jolloin päivitys alkaa.

[*]Kun päivitykset on ladattu, klikkaa "Scanner" kuvaketta ikkunan ylälaidassa. Valitse sitten "Settings" välilehti.
[*]Kun "Settings" valikko on auennut, klikkaa "Recommended actions" ja sitten valitse "Quarantine".
[*]Sitten "Reports" valikon alta:

[*]Laita täppi kohtaan "Automatically generate report after every scan"
[*]Ota täppi pois kohdasta"Only if threats were found"

[*]Sitten klikkaa "Shield" kuvaketta ikkunan ylälaidassa
[*]"Resident shield is", muuta tila active:sta inactive:ksi
[*]Sulje ohjelma, ÄLÄ skannaa vielä.

Käynnistä koneesi vikasietotilaan, Ohje!

HUOM! Älä käytä muita ohjelmia AVG skannauksen aikana, tämä saattaa häiritä skannausta.

[*]Kun vikasietotilassa, käynnistä AVG Anti-Spyware.
[*]Klikkaa "Scanner" kuvaketta ikkunan ylälaidassa ja valitse "Scan" välilehti. Sitten klikkaa "Complete System Scan".
[*]AVG aloittaa nyt tietokoneen skannaamisen, ole kärsivällinen sillä skannaus vie aikaa.

Kun skannaus on valmis:
TÄRKEÄÄ : Älä klikkaa "Save Scan Report" ennen kuin klikkaat "Apply all Actions"
[*]Varmistu, että Set all elements to: näyttää Quarantine (1), jos ei, klikkaa linkkiä ja valitse Quarantine popup-valikosta.
[*]Sinulta kysytään mitä tehdä jos infektioita löytyi, valitse silloin "Apply all actions"


[*]Sitten klikkaa "Reports" kuvaketta ohjelma yläosasta.
[*]Klikkaa "Save report as" painiketta ikkunan vasemmassa alalaidassa ja tallenna raportti työpöydälle.
[*]Sulje ohjelma, käynnistä kone normaalisti ja lähetä AVG Anti-Spyware:n raportti viestikejuusi.

AVG:n päivityksessä hiukan ongelmia, mutta onnistui viimein..

---------------------------------------------------------
AVG Anti-Spyware - Scan Report
---------------------------------------------------------

+ Created at: 18:54:20 25.4.2007

+ Scan result:



C:\Program Files\Suunnistussimulaattori Demo\bin\OSimu.exe -> Backdoor.Sdbot : Cleaned with backup (quarantined).
:mozilla.424:C:\Documents and Settings\Heikki\Application Data\Mozilla\Firefox\Profiles\tp0natqp.default\cookies-1.txt -> TrackingCookie.Adobe : Cleaned.
:mozilla.424:C:\Documents and Settings\Heikki\Local Settings\Application Data\Mozilla\Firefox\Profiles\tp0natqp.default\cookies-1.txt -> TrackingCookie.Adobe : Cleaned.
:mozilla.424:D:\Firefoxin varmuuskopionti\czxvwwtb.default\cookies-1.txt -> TrackingCookie.Adobe : Cleaned.
:mozilla.359:C:\Documents and Settings\Heikki\Application Data\Mozilla\Firefox\Profiles\tp0natqp.default\cookies-1.txt -> TrackingCookie.Gemius : Cleaned.
:mozilla.359:C:\Documents and Settings\Heikki\Local Settings\Application Data\Mozilla\Firefox\Profiles\tp0natqp.default\cookies-1.txt -> TrackingCookie.Gemius : Cleaned.
:mozilla.359:D:\Firefoxin varmuuskopionti\czxvwwtb.default\cookies-1.txt -> TrackingCookie.Gemius : Cleaned.
:mozilla.360:C:\Documents and Settings\Heikki\Application Data\Mozilla\Firefox\Profiles\tp0natqp.default\cookies-1.txt -> TrackingCookie.Gemius : Cleaned.
:mozilla.360:C:\Documents and Settings\Heikki\Local Settings\Application Data\Mozilla\Firefox\Profiles\tp0natqp.default\cookies-1.txt -> TrackingCookie.Gemius : Cleaned.
:mozilla.360:D:\Firefoxin varmuuskopionti\czxvwwtb.default\cookies-1.txt -> TrackingCookie.Gemius : Cleaned.
:mozilla.288:C:\Documents and Settings\Heikki\Local Settings\Application Data\Mozilla\Firefox\Profiles\tp0natqp.default\cookies.txt -> TrackingCookie.Imrworldwide : Cleaned.
:mozilla.288:D:\Firefoxin varmuuskopionti\czxvwwtb.default\cookies.txt -> TrackingCookie.Imrworldwide : Cleaned.
:mozilla.89:C:\Documents and Settings\Heikki\Application Data\Mozilla\Firefox\Profiles\tp0natqp.default\cookies-1.txt -> TrackingCookie.Imrworldwide : Cleaned.
:mozilla.89:C:\Documents and Settings\Heikki\Local Settings\Application Data\Mozilla\Firefox\Profiles\tp0natqp.default\cookies-1.txt -> TrackingCookie.Imrworldwide : Cleaned.
:mozilla.89:D:\Firefoxin varmuuskopionti\czxvwwtb.default\cookies-1.txt -> TrackingCookie.Imrworldwide : Cleaned.
:mozilla.90:C:\Documents and Settings\Heikki\Application Data\Mozilla\Firefox\Profiles\tp0natqp.default\cookies-1.txt -> TrackingCookie.Imrworldwide : Cleaned.
:mozilla.90:C:\Documents and Settings\Heikki\Local Settings\Application Data\Mozilla\Firefox\Profiles\tp0natqp.default\cookies-1.txt -> TrackingCookie.Imrworldwide : Cleaned.
:mozilla.90:D:\Firefoxin varmuuskopionti\czxvwwtb.default\cookies-1.txt -> TrackingCookie.Imrworldwide : Cleaned.
:mozilla.291:C:\Documents and Settings\Heikki\Local Settings\Application Data\Mozilla\Firefox\Profiles\tp0natqp.default\cookies.txt -> TrackingCookie.Intelli-direct : Cleaned.
:mozilla.291:D:\Firefoxin varmuuskopionti\czxvwwtb.default\cookies.txt -> TrackingCookie.Intelli-direct : Cleaned.
:mozilla.420:C:\Documents and Settings\Heikki\Application Data\Mozilla\Firefox\Profiles\tp0natqp.default\cookies-1.txt -> TrackingCookie.Paypal : Cleaned.
:mozilla.420:C:\Documents and Settings\Heikki\Local Settings\Application Data\Mozilla\Firefox\Profiles\tp0natqp.default\cookies-1.txt -> TrackingCookie.Paypal : Cleaned.
:mozilla.420:D:\Firefoxin varmuuskopionti\czxvwwtb.default\cookies-1.txt -> TrackingCookie.Paypal : Cleaned.
:mozilla.201:C:\Documents and Settings\Heikki\Local Settings\Application Data\Mozilla\Firefox\Profiles\tp0natqp.default\cookies.txt -> TrackingCookie.Revsci : Cleaned.
:mozilla.201:D:\Firefoxin varmuuskopionti\czxvwwtb.default\cookies.txt -> TrackingCookie.Revsci : Cleaned.
:mozilla.202:C:\Documents and Settings\Heikki\Local Settings\Application Data\Mozilla\Firefox\Profiles\tp0natqp.default\cookies.txt -> TrackingCookie.Revsci : Cleaned.
:mozilla.202:D:\Firefoxin varmuuskopionti\czxvwwtb.default\cookies.txt -> TrackingCookie.Revsci : Cleaned.
:mozilla.203:C:\Documents and Settings\Heikki\Local Settings\Application Data\Mozilla\Firefox\Profiles\tp0natqp.default\cookies.txt -> TrackingCookie.Revsci : Cleaned.
:mozilla.203:D:\Firefoxin varmuuskopionti\czxvwwtb.default\cookies.txt -> TrackingCookie.Revsci : Cleaned.
:mozilla.204:C:\Documents and Settings\Heikki\Local Settings\Application Data\Mozilla\Firefox\Profiles\tp0natqp.default\cookies.txt -> TrackingCookie.Revsci : Cleaned.
:mozilla.204:D:\Firefoxin varmuuskopionti\czxvwwtb.default\cookies.txt -> TrackingCookie.Revsci : Cleaned.
:mozilla.418:C:\Documents and Settings\Heikki\Application Data\Mozilla\Firefox\Profiles\tp0natqp.default\cookies-1.txt -> TrackingCookie.Revsci : Cleaned.
:mozilla.418:C:\Documents and Settings\Heikki\Local Settings\Application Data\Mozilla\Firefox\Profiles\tp0natqp.default\cookies-1.txt -> TrackingCookie.Revsci : Cleaned.
:mozilla.418:D:\Firefoxin varmuuskopionti\czxvwwtb.default\cookies-1.txt -> TrackingCookie.Revsci : Cleaned.
:mozilla.419:C:\Documents and Settings\Heikki\Application Data\Mozilla\Firefox\Profiles\tp0natqp.default\cookies-1.txt -> TrackingCookie.Revsci : Cleaned.
:mozilla.419:C:\Documents and Settings\Heikki\Local Settings\Application Data\Mozilla\Firefox\Profiles\tp0natqp.default\cookies-1.txt -> TrackingCookie.Revsci : Cleaned.
:mozilla.419:D:\Firefoxin varmuuskopionti\czxvwwtb.default\cookies-1.txt -> TrackingCookie.Revsci : Cleaned.
:mozilla.13:C:\Documents and Settings\Heikki\Application Data\Mozilla\Firefox\Profiles\tp0natqp.default\cookies.txt -> TrackingCookie.Statistik-gallup : Cleaned.
:mozilla.15:C:\Documents and Settings\Heikki\Local Settings\Application Data\Mozilla\Firefox\Profiles\tp0natqp.default\cookies.txt -> TrackingCookie.Statistik-gallup : Cleaned.
:mozilla.15:D:\Firefoxin varmuuskopionti\czxvwwtb.default\cookies.txt -> TrackingCookie.Statistik-gallup : Cleaned.
:mozilla.22:C:\Documents and Settings\Heikki\Application Data\Mozilla\Firefox\Profiles\tp0natqp.default\cookies-1.txt -> TrackingCookie.Statistik-gallup : Cleaned.
:mozilla.22:C:\Documents and Settings\Heikki\Local Settings\Application Data\Mozilla\Firefox\Profiles\tp0natqp.default\cookies-1.txt -> TrackingCookie.Statistik-gallup : Cleaned.
:mozilla.22:D:\Firefoxin varmuuskopionti\czxvwwtb.default\cookies-1.txt -> TrackingCookie.Statistik-gallup : Cleaned.
C:\Documents and Settings\Heikki\Cookies\heikki@statistik-gallup[1].txt -> TrackingCookie.Statistik-gallup : Cleaned.
:mozilla.178:C:\Documents and Settings\Heikki\Local Settings\Application Data\Mozilla\Firefox\Profiles\tp0natqp.default\cookies.txt -> TrackingCookie.Toplist : Cleaned.
:mozilla.178:D:\Firefoxin varmuuskopionti\czxvwwtb.default\cookies.txt -> TrackingCookie.Toplist : Cleaned.
:mozilla.35:C:\Documents and Settings\Heikki\Application Data\Mozilla\Firefox\Profiles\tp0natqp.default\cookies.txt -> TrackingCookie.Webtrends : Cleaned.
:mozilla.409:C:\Documents and Settings\Heikki\Application Data\Mozilla\Firefox\Profiles\tp0natqp.default\cookies-1.txt -> TrackingCookie.Webtrends : Cleaned.
:mozilla.409:C:\Documents and Settings\Heikki\Local Settings\Application Data\Mozilla\Firefox\Profiles\tp0natqp.default\cookies-1.txt -> TrackingCookie.Webtrends : Cleaned.
:mozilla.409:D:\Firefoxin varmuuskopionti\czxvwwtb.default\cookies-1.txt -> TrackingCookie.Webtrends : Cleaned.
:mozilla.90:C:\Documents and Settings\Heikki\Local Settings\Application Data\Mozilla\Firefox\Profiles\tp0natqp.default\cookies.txt -> TrackingCookie.Webtrends : Cleaned.
:mozilla.90:D:\Firefoxin varmuuskopionti\czxvwwtb.default\cookies.txt -> TrackingCookie.Webtrends : Cleaned.
D:\Torrent\NEW.Microsoft.Windows.Vista.RTM.2099.Activation.Crack-CLoNY.zip/NEW.Microsoft.Windows.Vista.RTM.2099.Activation.Crack-CLoNY/2_Step/Vista RTM Crack.exe -> Trojan.Activcrk.a : Cleaned with backup (quarantined).
D:\Torrent\NEW.Microsoft.Windows.Vista.RTM.2099.Activation.Crack-CLoNY\NEW.Microsoft.Windows.Vista.RTM.2099.Activation.Crack-CLoNY\2_Step\Vista RTM Crack.exe -> Trojan.Activcrk.a : Cleaned with backup (quarantined).
D:\Torrent\NEW.Microsoft.Windows.Vista.RTM.2099.Activation.Crack-CLoNY.zip/NEW.Microsoft.Windows.Vista.RTM.2099.Activation.Crack-CLoNY/2_Step/timerstop.sys -> Trojan.ActivCrk.b : Cleaned with backup (quarantined).
D:\Torrent\NEW.Microsoft.Windows.Vista.RTM.2099.Activation.Crack-CLoNY\NEW.Microsoft.Windows.Vista.RTM.2099.Activation.Crack-CLoNY\2_Step\timerstop.sys -> Trojan.ActivCrk.b : Cleaned with backup (quarantined).


::Report end

Laitoin vielä scannauksen päälle normaalitilassa ja sieltä löytyi vielä jotain pöpöjä, mutta sitten kone taas sammui. Käynnistin vikasietotilassa ja yritin useaan kertaan scannata siellä, mutta sielläkin sammuu ja käynnistää normaalitilassa.
Hullummaksi menee!!!

Olisi enemmän hyötyä, kun ottaisit tarkasti ylös, mitä "pöpöjä" löytyi...

1.
Lataa SDFix by AndyManchesta ja tallenna se työpöydällesi.

Käynnistä koneesi vikasietotilaan ja valitse tavallinen käyttäjätilisi:[*]Käynnistä tietokone
[*]Kun kuulet koneen piippaavan, paina F8, kuitenkin ennen Windowsin logon esiintuloa
[*]Seuraavaksi pitäisi ilmestyä valikko
[*]Valitse valikosta vikasietotila.

[*] Kun vikasietotilassa, pura tiedoston SDFix.zip sisältö (SDFix.exe) työpöydälle. Tuplakilikkaa työpöydälle ilmestynyttä sdfix.exe tiedostoa. Tiedosto purkaantuu ja asentaa itsensä siihen levyasemaan, minne on käyttöjärjestelmä on asennettu ja juureen ilmestyy kansio SDFix, ESIM C:\SDFix
[*] Avaa SDFix-kansio ja tuplaklikkaa tiedostoa RunThis.bat käynnistääksesi ohjelman.
[*] Paina Y käynnistääksesi skriptin.
[*] Työkalu puhdistaa troijalaisen palvelut ja tekee myös joitakin korjauksia rekisteriin. Lopuksi se pyytää käynnistämään koneen uudelleen, "Press any key to Reboot".
[*] Paina mitä tahansa näppäintä ja kone käynnistyy uudelleen.
[*] Käynnistyminen kestää normaalia kauemmin sillä SDFix puhdistaa konetta.
[*] Kun kone on käynnistynyt ja työpöytä latautunut, SDFix kertoo että puhdistus on suoritettu, "Finished".
[*] Paina sitten mitä tahansa näppäintä sulkeaksesi skriptin ja ladataksesi pikakuvakkeet työpöydälle.
[*] Lopuksi avaa SDFix kansio ja kopioi & liitä tiedoston Report.txt sisältö viestiketjuusi uuden HijackThis lokin kera.


2.
Lataa Deckard's System Scanner Työpöydällesi.
Huomioi: Sinulla tulee olla Järjestelmänvalvojan oikeudet ajaaksesi ohjelman.

[*]Sulje kaikki avoimet ikkunat ja ohjelmat.
[*]Tupla Klikkaa Dss.exe tiedostoa ajaaksesi ohjelman, seuraa ohjeita.
[*]Kun Scannaus on valmis 2 textitiedostoa pitäisi avautua, Main.txt ja extra.txt
[*]Näppäile Kopioi ( CTRL+A -> CTRL + C ) ja liitä ( CTRL + V )
[*]kopioi ja liitä main.txt ja extra.txt sisältö seuraavaan vastaukseesi.

SDFix: Version 1.79

Run by Heikki - to 26.04.2007 - 14:45:49,62

Microsoft Windows XP [versio 5.1.2600]

Running From: C:\DOCUME~1\Heikki\TYPYT~1\SDFix\SDFix

Safe Mode:
Checking Services:






Restoring Windows Registry Values
Restoring Windows Default Hosts File


Rebooting...

Normal Mode:
Checking Files:

No Trojan Files Found...




Removing Temp Files

ADS Check:

Checking if ADS is attached to system32 Folder
C:\WINDOWS\system32
No streams found.

Checking if ADS is attached to svchost.exe
C:\WINDOWS\system32\svchost.exe
No streams found.



Final Check:

Remaining Services:
------------------



Authorized Application Key Export:

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"C:\\Program Files\\BUFFALO\\Client Manager3\\BWSVC\\bwsvc.exe"="C:\\Program Files\\BUFFALO\\Client Manager3\\BWSVC\\bwsvc.exe:*:Enabled:ClientMgr3"
"C:\\Program Files\\BUFFALO\\Client Manager3\\AOSS\\aoss.exe"="C:\\Program Files\\BUFFALO\\Client Manager3\\AOSS\\aoss.exe:*:Enabled:Aoss"
"C:\\Program Files\\MSN Messenger\\msnmsgr.exe"="C:\\Program Files\\MSN Messenger\\msnmsgr.exe:*:Enabled:Windows Live Messenger 8.1"
"C:\\Program Files\\MSN Messenger\\livecall.exe"="C:\\Program Files\\MSN Messenger\\livecall.exe:*:Enabled:Windows Live Messenger 8.1 (Phone)"
"C:\\Documents and Settings\\Heikki\\Työpöytä\\utorrent.exe"="C:\\Documents and Settings\\Heikki\\Työpöytä\\utorrent.exe:*:Enabled:µTorrent"
"C:\\Program Files\\utorrent.exe"="C:\\Program Files\\utorrent.exe:*:Enabled:µTorrent"
"C:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE"="C:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE:*:Enabled:Microsoft Office Outlook"
"C:\\Program Files\\PPMate\\ppmate.exe"="C:\\Program Files\\PPMate\\ppmate.exe:*:Enabled:PPMate"
"C:\\Program Files\\PPMate\\ppmnet.exe"="C:\\Program Files\\PPMate\\ppmnet.exe:*:Enabled:PPMate"
"C:\\Program Files\\Skype\\Phone\\Skype.exe"="C:\\Program Files\\Skype\\Phone\\Skype.exe:*:Enabled:Skype"


[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"C:\\Program Files\\MSN Messenger\\msnmsgr.exe"="C:\\Program Files\\MSN Messenger\\msnmsgr.exe:*:Enabled:Windows Live Messenger 8.1"
"C:\\Program Files\\MSN Messenger\\livecall.exe"="C:\\Program Files\\MSN Messenger\\livecall.exe:*:Enabled:Windows Live Messenger 8.1 (Phone)"


Remaining Files:
---------------


Checking For Files with Hidden Attributes:

C:\Program Files\Canon\MP Navigator 3.0\uinstrsc.dll
C:\Program Files\Canon\MP Navigator 3.0\Maint.exe
C:\Documents and Settings\All Users\DRM\Cache\Indiv01.tmp

Finished

Logfile of HijackThis v1.99.1
Scan saved at 15:15:18, on 26.4.2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\Program Files\Common Files\Symantec Shared\ccProxy.exe
C:\Program Files\Symantec Client Security\Symantec Client Firewall\ISSVC.exe
C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\Program Files\BUFFALO\Client Manager3\bwsvc\bwsvc.exe
C:\Program Files\Symantec Client Security\Symantec AntiVirus\DefWatch.exe
C:\Program Files\Common Files\LightScribe\LSSrvc.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Symantec Client Security\Symantec AntiVirus\Rtvscan.exe
C:\Program Files\Symantec Client Security\Symantec Client Firewall\SymSPort.exe
C:\PROGRA~1\SYMANT~1\SYMANT~2\VPTray.exe
C:\Program Files\Macrogaming\SweetIM\SweetIM.exe
C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe
C:\Program Files\ScanSoft\OmniPageSE4.0\OpwareSE4.exe
C:\Program Files\Microsoft IntelliType Pro\itype.exe
C:\Program Files\Microsoft IntelliPoint\ipoint.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe
C:\Program Files\BUFFALO\Client Manager3\cm3_tray.exe
C:\Program Files\Common Files\Ahead\Lib\NMIndexStoreSvr.exe
C:\Program Files\MSN Messenger\usnsvc.exe
C:\WINDOWS\notepad.exe
C:\WINDOWS\notepad.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Linkit
R3 - URLSearchHook: SweetIM For Internet Explorer - {BC4FFE41-DE9F-46fa-B455-AAD49B9F9938} - C:\Program Files\Macrogaming\SweetIMBarForIE\toolbar.dll
O2 - BHO: Adobe PDF Reader -linkkiavustaja - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: SWEETIE - {1A0AADCD-3A72-4b5f-900F-E3BB5A838E2A} - C:\PROGRA~1\MACROG~1\SWEETI~1\toolbar.dll
O2 - BHO: Canon Easy Web Print Helper - {68F9551E-0411-48E4-9AAF-4BC42A6A46BE} - C:\Program Files\Canon\Easy-WebPrint\EWPBrowseLoader.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O3 - Toolbar: Easy-WebPrint - {327C2873-E90D-4c37-AA9D-10AC9BABA46C} - C:\Program Files\Canon\Easy-WebPrint\Toolband.dll
O3 - Toolbar: SweetIM For Internet Explorer - {BC4FFE41-DE9F-46fa-B455-AAD49B9F9938} - C:\Program Files\Macrogaming\SweetIMBarForIE\toolbar.dll
O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
O4 - HKLM\..\Run: [{0228e555-4f9c-4e35-a3ec-b109a192b4c2}] C:\Program Files\Google\Gmail Notifier\gnotify.exe
O4 - HKLM\..\Run: [vptray] C:\PROGRA~1\SYMANT~1\SYMANT~2\VPTray.exe
O4 - HKLM\..\Run: [SweetIM] C:\Program Files\Macrogaming\SweetIM\SweetIM.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe"
O4 - HKLM\..\Run: [SSBkgdUpdate] "C:\Program Files\Common Files\Scansoft Shared\SSBkgdUpdate\SSBkgdupdate.exe" -Embedding -boot
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [OpwareSE4] "C:\Program Files\ScanSoft\OmniPageSE4.0\OpwareSE4.exe"
O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe
O4 - HKLM\..\Run: [itype] "C:\Program Files\Microsoft IntelliType Pro\itype.exe"
O4 - HKLM\..\Run: [IntelliPoint] "C:\Program Files\Microsoft IntelliPoint\ipoint.exe"
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [ATICCC] "C:\Program Files\ATI Technologies\ATI.ACE\cli.exe" runtime -Delay
O4 - HKCU\..\Run: [µTorrent] "C:\Program Files\utorrent.exe"
O4 - HKCU\..\Run: [Skype] "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized
O4 - HKCU\..\Run: [MsnMsgr] ~"C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [FreeRAM XP] "C:\Program Files\YourWare Solutions\FreeRAM XP Pro\FreeRAM XP Pro.exe" -win
O4 - HKCU\..\Run: [DAEMON Tools] "C:\Program Files\DAEMON Tools\daemon.exe" -lang 1033
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe"
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Reader 8.0\Reader\reader_sl.exe
O4 - Global Startup: Adobe Reader Synchronizer.lnk = C:\Program Files\Adobe\Reader 8.0\Reader\AdobeCollabSync.exe
O4 - Global Startup: ClientManager3.lnk = C:\Program Files\BUFFALO\Client Manager3\cm3_tray.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O8 - Extra context menu item: Easy-WebPrint Add To Print List - res://C:\Program Files\Canon\Easy-WebPrint\Toolband.dll/RC_AddToList.html
O8 - Extra context menu item: Easy-WebPrint High Speed Print - res://C:\Program Files\Canon\Easy-WebPrint\Toolband.dll/RC_HSPrint.html
O8 - Extra context menu item: Easy-WebPrint Preview - res://C:\Program Files\Canon\Easy-WebPrint\Toolband.dll/RC_Preview.html
O8 - Extra context menu item: Easy-WebPrint Print - res://C:\Program Files\Canon\Easy-WebPrint\Toolband.dll/RC_Print.html
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Protocol: ms-help - {314111C7-A502-11D2-BBCA-00C04F8EC294} - C:\Program Files\Common Files\Microsoft Shared\Help\hxds.dll
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O18 - Filter hijack: text/xml - {807563E5-5146-11D5-A672-00B0D022E945} - C:\PROGRA~1\COMMON~1\MICROS~1\OFFICE12\MSOXMLMF.DLL
O20 - Winlogon Notify: NavLogon - C:\WINDOWS\system32\NavLogon.dll
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: AVG Anti-Spyware Guard - Anti-Malware Development a.s. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: Bwsvc - BUFFALO INC. - C:\Program Files\BUFFALO\Client Manager3\bwsvc\bwsvc.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Network Proxy (ccProxy) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccProxy.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: Symantec AntiVirus Definition Watcher (DefWatch) - Symantec Corporation - C:\Program Files\Symantec Client Security\Symantec AntiVirus\DefWatch.exe
O23 - Service: IS Service (ISSVC) - Symantec Corporation - C:\Program Files\Symantec Client Security\Symantec Client Firewall\ISSVC.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe
O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe
O23 - Service: SAVRoam (SavRoam) - symantec - C:\Program Files\Symantec Client Security\Symantec AntiVirus\SavRoam.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
O23 - Service: Symantec AntiVirus - Symantec Corporation - C:\Program Files\Symantec Client Security\Symantec AntiVirus\Rtvscan.exe
O23 - Service: Symantec SecurePort (SymSecurePort) - Symantec Corporation - C:\Program Files\Symantec Client Security\Symantec Client Firewall\SymSPort.exe



Deckard's System Scanner v20070423.42
Run by Heikki on 2007-04-26 at 15:08:25
Computer is in Normal Mode.
--------------------------------------------------------------------------------

-- System Restore --------------------------------------------------------------

Successfully created a Deckard's System Scanner Restore Point.


-- Last 3 Restore Point(s) --
3: 2007-04-26 12:08:28 UTC - RP3 - Deckard's System Scanner Restore Point
2: 2007-04-26 12:02:33 UTC - RP2 - Deckard's System Scanner Restore Point
1: 2007-04-25 14:53:45 UTC - RP1 - Järjestelmän tarkistuspiste


Performed disk cleanup.


-- HijackThis (run as Heikki.exe) ----------------------------------------------

Logfile of HijackThis v1.99.1
Scan saved at 15:10:36, on 26.4.2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\Program Files\Common Files\Symantec Shared\ccProxy.exe
C:\Program Files\Symantec Client Security\Symantec Client Firewall\ISSVC.exe
C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\Program Files\BUFFALO\Client Manager3\bwsvc\bwsvc.exe
C:\Program Files\Symantec Client Security\Symantec AntiVirus\DefWatch.exe
C:\Program Files\Common Files\LightScribe\LSSrvc.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Symantec Client Security\Symantec AntiVirus\Rtvscan.exe
C:\Program Files\Symantec Client Security\Symantec Client Firewall\SymSPort.exe
C:\PROGRA~1\SYMANT~1\SYMANT~2\VPTray.exe
C:\Program Files\Macrogaming\SweetIM\SweetIM.exe
C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe
C:\Program Files\ScanSoft\OmniPageSE4.0\OpwareSE4.exe
C:\Program Files\Microsoft IntelliType Pro\itype.exe
C:\Program Files\Microsoft IntelliPoint\ipoint.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe
C:\Program Files\BUFFALO\Client Manager3\cm3_tray.exe
C:\Program Files\Common Files\Ahead\Lib\NMIndexStoreSvr.exe
C:\Program Files\MSN Messenger\usnsvc.exe
C:\Documents and Settings\Heikki\Työpöytä\dss.exe
C:\PROGRA~1\HIJACK~1\Heikki.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Linkit
R3 - URLSearchHook: SweetIM For Internet Explorer - {BC4FFE41-DE9F-46fa-B455-AAD49B9F9938} - C:\Program Files\Macrogaming\SweetIMBarForIE\toolbar.dll
O2 - BHO: Adobe PDF Reader -linkkiavustaja - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: SWEETIE - {1A0AADCD-3A72-4b5f-900F-E3BB5A838E2A} - C:\PROGRA~1\MACROG~1\SWEETI~1\toolbar.dll
O2 - BHO: Canon Easy Web Print Helper - {68F9551E-0411-48E4-9AAF-4BC42A6A46BE} - C:\Program Files\Canon\Easy-WebPrint\EWPBrowseLoader.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O3 - Toolbar: Easy-WebPrint - {327C2873-E90D-4c37-AA9D-10AC9BABA46C} - C:\Program Files\Canon\Easy-WebPrint\Toolband.dll
O3 - Toolbar: SweetIM For Internet Explorer - {BC4FFE41-DE9F-46fa-B455-AAD49B9F9938} - C:\Program Files\Macrogaming\SweetIMBarForIE\toolbar.dll
O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
O4 - HKLM\..\Run: [{0228e555-4f9c-4e35-a3ec-b109a192b4c2}] C:\Program Files\Google\Gmail Notifier\gnotify.exe
O4 - HKLM\..\Run: [vptray] C:\PROGRA~1\SYMANT~1\SYMANT~2\VPTray.exe
O4 - HKLM\..\Run: [SweetIM] C:\Program Files\Macrogaming\SweetIM\SweetIM.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe"
O4 - HKLM\..\Run: [SSBkgdUpdate] "C:\Program Files\Common Files\Scansoft Shared\SSBkgdUpdate\SSBkgdupdate.exe" -Embedding -boot
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [OpwareSE4] "C:\Program Files\ScanSoft\OmniPageSE4.0\OpwareSE4.exe"
O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe
O4 - HKLM\..\Run: [itype] "C:\Program Files\Microsoft IntelliType Pro\itype.exe"
O4 - HKLM\..\Run: [IntelliPoint] "C:\Program Files\Microsoft IntelliPoint\ipoint.exe"
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [ATICCC] "C:\Program Files\ATI Technologies\ATI.ACE\cli.exe" runtime -Delay
O4 - HKCU\..\Run: [µTorrent] "C:\Program Files\utorrent.exe"
O4 - HKCU\..\Run: [Skype] "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized
O4 - HKCU\..\Run: [MsnMsgr] ~"C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [FreeRAM XP] "C:\Program Files\YourWare Solutions\FreeRAM XP Pro\FreeRAM XP Pro.exe" -win
O4 - HKCU\..\Run: [DAEMON Tools] "C:\Program Files\DAEMON Tools\daemon.exe" -lang 1033
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe"
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Reader 8.0\Reader\reader_sl.exe
O4 - Global Startup: Adobe Reader Synchronizer.lnk = C:\Program Files\Adobe\Reader 8.0\Reader\AdobeCollabSync.exe
O4 - Global Startup: ClientManager3.lnk = C:\Program Files\BUFFALO\Client Manager3\cm3_tray.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O8 - Extra context menu item: Easy-WebPrint Add To Print List - res://C:\Program Files\Canon\Easy-WebPrint\Toolband.dll/RC_AddToList.html
O8 - Extra context menu item: Easy-WebPrint High Speed Print - res://C:\Program Files\Canon\Easy-WebPrint\Toolband.dll/RC_HSPrint.html
O8 - Extra context menu item: Easy-WebPrint Preview - res://C:\Program Files\Canon\Easy-WebPrint\Toolband.dll/RC_Preview.html
O8 - Extra context menu item: Easy-WebPrint Print - res://C:\Program Files\Canon\Easy-WebPrint\Toolband.dll/RC_Print.html
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Protocol: ms-help - {314111C7-A502-11D2-BBCA-00C04F8EC294} - C:\Program Files\Common Files\Microsoft Shared\Help\hxds.dll
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O18 - Filter hijack: text/xml - {807563E5-5146-11D5-A672-00B0D022E945} - C:\PROGRA~1\COMMON~1\MICROS~1\OFFICE12\MSOXMLMF.DLL
O20 - Winlogon Notify: NavLogon - C:\WINDOWS\system32\NavLogon.dll
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: AVG Anti-Spyware Guard - Anti-Malware Development a.s. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: Bwsvc - BUFFALO INC. - C:\Program Files\BUFFALO\Client Manager3\bwsvc\bwsvc.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Network Proxy (ccProxy) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccProxy.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: Symantec AntiVirus Definition Watcher (DefWatch) - Symantec Corporation - C:\Program Files\Symantec Client Security\Symantec AntiVirus\DefWatch.exe
O23 - Service: IS Service (ISSVC) - Symantec Corporation - C:\Program Files\Symantec Client Security\Symantec Client Firewall\ISSVC.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe
O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe
O23 - Service: SAVRoam (SavRoam) - symantec - C:\Program Files\Symantec Client Security\Symantec AntiVirus\SavRoam.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
O23 - Service: Symantec AntiVirus - Symantec Corporation - C:\Program Files\Symantec Client Security\Symantec AntiVirus\Rtvscan.exe
O23 - Service: Symantec SecurePort (SymSecurePort) - Symantec Corporation - C:\Program Files\Symantec Client Security\Symantec Client Firewall\SymSPort.exe


-- File Associations -----------------------------------------------------------

All associations okay.


-- Drivers: 0-Boot, 1-System, 2-Auto, 3-Demand, 4-Disabled ---------------------

R1 BUFADPT - c:\windows\system32\bufadpt.sys <Not Verified; BUFFALO INC.; BUFFALO Wireless LAN; 1.0.2.1; 1.0.2.1 built by: WinDDK>
R2 AegisP (AEGIS Protocol (IEEE 802.1x) v3.4.3.0) - c:\windows\system32\drivers\aegisp.sys <Not Verified; Meetinghouse Data Communications; AEGIS Client 3.4.3.0; 3.4.3.0; 3.4.3.0>
R3 ALCXSENS (Service for WDM 3D Audio Driver) - c:\windows\system32\drivers\alcxsens.sys <Verified; Sensaura; ; ; 5.10.00.3513>

S3 GMSIPCI - e:\install\gmsipci.sys (file missing)


-- Services: 0-Boot, 1-System, 2-Auto, 3-Demand, 4-Disabled --------------------

R2 Bwsvc - c:\program files\buffalo\client manager3\bwsvc\bwsvc.exe -service <Not Verified; BUFFALO INC.; BUFFALO NETWORK SERVICE; 2, 0, 3, 2; 2, 0, 3, 2>
R2 ISSVC (IS Service) - "c:\program files\symantec client security\symantec client firewall\issvc.exe" <Verified; Symantec Corporation; Internet Security; 8.7; 8.7.4.79>
R2 Symantec AntiVirus - "c:\program files\symantec client security\symantec antivirus\rtvscan.exe" <Verified; Symantec Corporation; Symantec AntiVirus; 10.1.4.4000; 10.1.4.4000>
R2 SymSecurePort (Symantec SecurePort) - "c:\program files\symantec client security\symantec client firewall\symsport.exe" <Verified; Symantec Corporation; Internet Security; 8.7; 8.7.4.79>

S3 NBService - c:\program files\nero\nero 7\nero backitup\nbservice.exe
S3 SavRoam - "c:\program files\symantec client security\symantec antivirus\savroam.exe" <Verified; symantec; Symantec SAVRoam; 10.1.4.4000; 10.1.4.4000>


-- Files created between 2007-03-26 and 2007-04-26 -----------------------------

2007-04-25 17:14:13 0 dr------- C:\Documents and Settings\Järjestelmänvalvoja\Omat tiedostot
2007-04-25 17:11:22 0 d--h----- C:\Documents and Settings\Järjestelmänvalvoja\Verkkoympäristö
2007-04-25 17:11:22 0 d-------- C:\Documents and Settings\Järjestelmänvalvoja\Työpöytä
2007-04-25 17:11:22 0 d--h----- C:\Documents and Settings\Järjestelmänvalvoja\Tulostinympäristö
2007-04-25 17:11:22 0 d-------- C:\Documents and Settings\Järjestelmänvalvoja\Suosikit
2007-04-25 17:11:22 0 dr-h----- C:\Documents and Settings\Järjestelmänvalvoja\SendTo
2007-04-25 17:11:22 0 d--h----- C:\Documents and Settings\Järjestelmänvalvoja\Recent
2007-04-25 17:11:22 524288 --ah----- C:\Documents and Settings\Järjestelmänvalvoja\NTUSER.DAT
2007-04-25 17:11:22 0 d--h----- C:\Documents and Settings\Järjestelmänvalvoja\Mallit
2007-04-25 17:11:22 0 d--h----- C:\Documents and Settings\Järjestelmänvalvoja\Local Settings
2007-04-25 17:11:22 0 dr------- C:\Documents and Settings\Järjestelmänvalvoja\Käynnistä-valikko
2007-04-25 17:11:22 0 d---s---- C:\Documents and Settings\Järjestelmänvalvoja\Cookies
2007-04-25 17:11:22 0 dr-h----- C:\Documents and Settings\Järjestelmänvalvoja\Application Data
2007-04-25 17:11:22 0 d---s---- C:\Documents and Settings\Järjestelmänvalvoja\Application Data\Microsoft
2007-04-25 17:04:10 0 d-------- C:\WINDOWS\pss
2007-04-25 16:56:56 3968 --a------ C:\WINDOWS\system32\drivers\AvgAsCln.sys <Not Verified; GRISOFT, s.r.o.; AVG7 Clean Driver; 1.0.0.14; 1.0.0.14>
2007-04-24 20:41:52 0 d-------- C:\SAV32CLI
2007-04-23 15:00:30 0 dr-h----- C:\Documents and Settings\Heikki\Recent
2007-04-22 19:01:59 0 d-------- C:\Program Files\Macrogaming
2007-04-21 15:51:01 0 d-------- C:\Program Files\MSXML 4.0
2007-04-21 09:56:37 192512 -----n--- C:\WINDOWS\system32\Apssnd.dll
2007-04-21 09:56:31 0 d-------- C:\Program Files\Alfa-ohjelmat
2007-04-21 09:48:35 0 d-------- C:\Documents and Settings\Heikki\Application Data\Help
2007-04-20 21:35:15 0 d-------- C:\Documents and Settings\Heikki\Application Data\ArcSoft
2007-04-20 20:32:16 0 d--h----- C:\Documents and Settings\All Users\Application Data\CanonBJ
2007-04-20 20:32:11 0 d--h----- C:\WINDOWS\system32\CanonIJ Uninstaller Information
2007-04-20 20:32:08 106496 --a------ C:\WINDOWS\system32\cnco160.dll <Verified; Canon Inc.; Canon ScanGear series.; 1.0; 1.0>
2007-04-20 20:32:07 135168 --a------ C:\WINDOWS\system32\CNCL160.DLL <Verified; Canon Inc.; Canon MP; ; 1.00>
2007-04-20 20:32:07 57344 --a------ C:\WINDOWS\system32\CNCI160.DLL <Verified; CANON INC.; WIA Scanner Driver; 1, 2, 1, 0; 2, 0, 0, 0>
2007-04-20 20:32:07 1134592 --a------ C:\WINDOWS\system32\CNCC160.DLL <Verified; CANON INC.; WIA Scanner Driver; 1, 2, 0, 0; 0, 2, 2, 0>
2007-04-20 20:32:05 0 d--h----- C:\Program Files\CanonBJ
2007-04-20 19:18:55 0 d-------- C:\Documents and Settings\Heikki\Application Data\Canon
2007-04-20 19:05:08 0 d-------- C:\Documents and Settings\All Users\Application Data\InstallShield
2007-04-20 19:05:06 0 d-------- C:\Documents and Settings\Heikki\Application Data\ScanSoft
2007-04-20 19:04:58 0 d-------- C:\Program Files\Common Files\ScanSoft Shared
2007-04-20 19:04:58 0 d-------- C:\Documents and Settings\All Users\Application Data\ScanSoft
2007-04-20 19:04:38 0 d-------- C:\Program Files\ScanSoft
2007-04-20 19:02:39 212480 --a------ C:\WINDOWS\PCDLIB32.DLL <Not Verified; Eastman Kodak; Kodak Photo CD Access Developer Toolkit; 3, 0, 0, 0; 3, 0, 0, 0>
2007-04-20 19:02:38 0 d-------- C:\Program Files\ArcSoft
2007-04-20 18:59:46 161792 --a------ C:\WINDOWS\system32\CNMLM83.DLL <Verified; CANON INC.; Canon IJ Printer Driver; 1.95.2.20; 1.95.2.20>
2007-04-20 18:57:10 0 d-------- C:\Program Files\Canon
2007-04-13 18:51:59 0 d-------- C:\Program Files\Suunnistussimulaattori Demo
2007-04-11 14:24:22 4096 --a------ C:\WINDOWS\system32\crash
2007-04-10 18:27:19 0 d-a------ C:\Documents and Settings\All Users\Application Data\TEMP
2007-04-08 20:56:12 0 d-------- C:\vanhat
2007-04-08 20:38:23 0 d-------- C:\Program Files\DOSBox-0.70
2007-04-08 15:21:26 0 d-------- C:\Documents and Settings\Heikki\Application Data\SopCast
2007-04-08 15:21:25 0 d-------- C:\Program Files\SopCast
2007-04-06 12:18:04 0 d-------- C:\Program Files\Microsoft IntelliPoint
2007-04-06 12:17:23 0 d-------- C:\Program Files\Microsoft IntelliPoint 5.5
2007-04-06 12:05:54 0 d-------- C:\Program Files\Microsoft IntelliType Pro
2007-04-03 20:30:45 0 d-------- C:\Documents and Settings\Heikki\Application Data\Uniblue
2007-04-03 20:04:13 0 d-------- C:\Program Files\Debugging Tools for Windows
2007-04-02 20:38:25 0 d-------- C:\Program Files\Windows Media Connect 2
2007-04-02 20:36:10 0 d-------- C:\WINDOWS\system32\drivers\UMDF
2007-04-01 18:21:14 0 d-------- C:\ppmaterecord <PPMATE~1>
2007-04-01 18:21:14 0 d-------- C:\Documents and Settings\Heikki\Application Data\ppStream
2007-04-01 18:16:08 0 d-------- C:\Documents and Settings\Heikki\Application Data\PPMate
2007-04-01 18:16:06 0 d-------- C:\Program Files\Common Files\Synacast
2007-04-01 18:16:03 0 d-------- C:\Program Files\PPMate
2007-04-01 17:48:26 0 d-------- C:\Documents and Settings\Heikki\Application Data\TVU Networks
2007-04-01 17:48:19 0 d-------- C:\Program Files\TVUPlayer
2007-03-28 19:26:00 0 d-------- C:\Program Files\Sanakirja
2007-03-28 17:59:28 306688 --a------ C:\WINDOWS\IsUninst.exe <Not Verified; InstallShield Software Corporation; InstallShield® unInstaller; 5, 51; 5, 51, 138, 0>
2007-03-28 17:59:27 0 d-------- C:\Documents and Settings\Heikki\WINDOWS
2007-03-27 17:04:34 0 d-------- C:\Ajurit


-- Find3M Report ---------------------------------------------------------------

2007-04-26 15:07:56 0 d-------- C:\Documents and Settings\Heikki\Application Data\uTorrent
2007-04-26 15:07:50 0 d-------- C:\Documents and Settings\Heikki\Application Data\Skype
2007-04-26 14:40:38 40 --a------ C:\WINDOWS\system32\profile.dat
2007-04-22 18:58:42 0 d-------- C:\Documents and Settings\Heikki\Application Data\Macromedia
2007-04-21 09:57:29 43520 --a------ C:\WINDOWS\system32\CmdLineExt03.dll
2007-04-20 20:00:56 0 d-------- C:\Program Files\Common Files\Symantec Shared
2007-04-20 19:04:57 0 d-------- C:\Program Files\Common Files\InstallShield
2007-04-20 19:02:37 0 d--h----- C:\Program Files\InstallShield Installation Information
2007-04-15 16:38:59 0 d-------- C:\Program Files\MSN Messenger
2007-04-12 16:06:33 0 d-------- C:\Program Files\Java
2007-03-26 15:51:59 369396 --a------ C:\WINDOWS\system32\perfh00B.dat
2007-03-26 15:51:59 71834 --a------ C:\WINDOWS\system32\perfc00B.dat
2007-03-25 20:04:07 0 d-------- C:\Documents and Settings\Heikki\Application Data\Sun
2007-03-25 20:04:01 1289 --a------ C:\WINDOWS\mozver.dat
2007-03-25 20:02:56 0 d-------- C:\Program Files\Common Files\Java
2007-03-25 16:34:50 0 d-------- C:\Documents and Settings\Heikki\Application Data\Google
2007-03-25 16:33:51 0 d-------- C:\Program Files\Google
2007-03-17 20:37:17 0 d-------- C:\Documents and Settings\Heikki\Application Data\Lavasoft
2007-03-17 20:37:01 0 d-------- C:\Program Files\Lavasoft
2007-03-17 20:36:29 0 d-------- C:\Program Files\Common Files\Wise Installation Wizard
2007-03-16 16:33:18 0 d-------- C:\Program Files\TimeAdjuster
2007-03-14 22:31:55 0 d-------- C:\Program Files\GmRekGTP
2007-03-11 22:06:16 0 d-------- C:\Documents and Settings\Heikki\Application Data\Ahead
2007-03-11 22:04:49 0 d-------- C:\Documents and Settings\Heikki\Application Data\Real
2007-03-11 22:04:49 0 d-------- C:\Documents and Settings\Heikki\Application Data\Media Player Classic
2007-03-11 22:04:08 0 d-------- C:\Program Files\Real Alternative
2007-03-11 22:04:04 0 d-------- C:\Program Files\Media Player Classic
2007-03-11 20:11:04 0 d-------- C:\Program Files\Common Files\LightScribe
2007-03-11 11:30:56 0 d-------- C:\Program Files\Common Files\Ahead
2007-03-11 11:24:57 0 d-------- C:\Program Files\Nero
2007-03-10 22:28:33 0 d-------- C:\Program Files\TweakNow RegCleaner Std
2007-03-10 22:25:00 0 d-------- C:\Program Files\YourWare Solutions
2007-03-10 19:02:14 0 d-------- C:\Documents and Settings\Heikki\Application Data\Adobe
2007-03-10 19:00:17 0 d-------- C:\Program Files\Common Files\Adobe
2007-03-10 14:46:01 0 d-------- C:\Program Files\directx
2007-03-10 11:31:10 0 d-------- C:\Program Files\Microsoft Visual Studio 8
2007-03-10 00:14:11 0 d-------- C:\Program Files\CCleaner
2007-03-09 22:08:58 0 d-------- C:\Program Files\Evolution
2007-03-09 21:34:14 0 d-------- C:\Program Files\Microsoft Works
2007-03-09 21:33:44 0 d-------- C:\Program Files\Microsoft.NET
2007-03-09 21:20:39 0 d-------- C:\Program Files\Skype
2007-03-09 21:20:38 0 d-------- C:\Program Files\Common Files\Skype
2007-03-09 21:06:12 0 d-------- C:\Documents and Settings\Heikki\Application Data\ATI
2007-03-09 20:59:51 0 d-------- C:\Program Files\ATI Technologies
2007-03-09 19:47:25 177152 --a------ C:\Program Files\utorrent.exe
2007-03-09 17:38:31 0 d-------- C:\Documents and Settings\Heikki\Application Data\EuroTalk
2007-03-09 17:27:13 0 d-------- C:\Program Files\BadgerIT
2007-03-09 17:04:07 0 d-------- C:\Program Files\ImgBurn
2007-03-09 16:58:26 0 d-------- C:\Program Files\ffdshow
2007-03-09 16:47:21 0 d-------- C:\Program Files\Common Files\ODBC
2007-03-09 16:47:18 0 d-------- C:\Program Files\Common Files\SpeechEngines
2007-03-09 16:46:49 62 --ahs---- C:\Documents and Settings\Heikki\Application Data\desktop.ini
2007-03-09 16:07:25 0 d-------- C:\Program Files\Messenger
2007-03-09 15:50:53 0 d-------- C:\Program Files\DAEMON Tools
2007-03-09 15:40:24 0 d-------- C:\Documents and Settings\Heikki\Application Data\Talkback
2007-03-09 15:40:09 0 --a------ C:\WINDOWS\nsreg.dat
2007-03-09 15:40:06 0 d-------- C:\Documents and Settings\Heikki\Application Data\Mozilla
2007-03-09 15:29:26 0 d-------- C:\Program Files\Symantec
2007-03-09 15:29:03 0 d-------- C:\Program Files\Symantec Client Security
2007-03-09 15:13:13 0 d-------- C:\Program Files\BUFFALO
2007-03-09 15:06:44 0 d-------- C:\Documents and Settings\Heikki\Application Data\Identities
2007-03-09 14:58:32 0 d-------- C:\Program Files\microsoft frontpage
2007-03-09 14:58:10 0 -rahs---- C:\MSDOS.SYS
2007-03-09 14:58:10 0 -rahs---- C:\IO.SYS
2007-03-09 14:58:10 0 --a------ C:\CONFIG.SYS
2007-03-09 14:58:10 0 --a------ C:\AUTOEXEC.BAT
2007-03-09 14:56:54 0 d--h----- C:\Program Files\WindowsUpdate
2007-03-09 14:56:51 0 d-------- C:\Program Files\Online Services
2007-03-09 14:55:50 0 d-------- C:\Program Files\Common Files\MSSoap
2007-03-09 14:55:39 0 d-------- C:\Program Files\Movie Maker
2007-03-09 14:54:42 21672 --a------ C:\WINDOWS\system32\emptyregdb.dat
2007-03-09 14:54:13 0 d-------- C:\Program Files\MSN Gaming Zone
2007-03-09 14:54:01 0 d-------- C:\Program Files\Windows NT
2007-02-21 22:00:28 10752 --a------ C:\WINDOWS\system32\ff_vfw.dll


-- Registry Dump ---------------------------------------------------------------

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects]
{1A0AADCD-3A72-4b5f-900F-E3BB5A838E2A} C:\PROGRA~1\MACROG~1\SWEETI~1\toolbar.dll
{68F9551E-0411-48E4-9AAF-4BC42A6A46BE} C:\Program Files\Canon\Easy-WebPrint\EWPBrowseLoader.dll
{761497BB-D6F0-462C-B6EB-D4DAF1D92D43} C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
{9030D464-4C02-4ABF-8ECC-5164760863C6} C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run]
"!AVG Anti-Spyware"="\"C:\\Program Files\\Grisoft\\AVG Anti-Spyware 7.5\\avgas.exe\" /minimized"
"{0228e555-4f9c-4e35-a3ec-b109a192b4c2}"="C:\\Program Files\\Google\\Gmail Notifier\\gnotify.exe"
"vptray"="C:\\PROGRA~1\\SYMANT~1\\SYMANT~2\\VPTray.exe"
"SweetIM"="C:\\Program Files\\Macrogaming\\SweetIM\\SweetIM.exe"
"SunJavaUpdateSched"="\"C:\\Program Files\\Java\\jre1.6.0_01\\bin\\jusched.exe\""
"SSBkgdUpdate"="\"C:\\Program Files\\Common Files\\Scansoft Shared\\SSBkgdUpdate\\SSBkgdupdate.exe\" -Embedding -boot"
"SoundMan"="SOUNDMAN.EXE"
"OpwareSE4"="\"C:\\Program Files\\ScanSoft\\OmniPageSE4.0\\OpwareSE4.exe\""
"NeroFilterCheck"="C:\\Program Files\\Common Files\\Ahead\\Lib\\NeroCheck.exe"
"itype"="\"C:\\Program Files\\Microsoft IntelliType Pro\\itype.exe\""
"IntelliPoint"="\"C:\\Program Files\\Microsoft IntelliPoint\\ipoint.exe\""
"ccApp"="\"C:\\Program Files\\Common Files\\Symantec Shared\\ccApp.exe\""
"ATICCC"="\"C:\\Program Files\\ATI Technologies\\ATI.ACE\\cli.exe\" runtime -Delay"

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run]
"µTorrent"="\"C:\\Program Files\\utorrent.exe\""
"Skype"="\"C:\\Program Files\\Skype\\Phone\\Skype.exe\" /nosplash /minimized"
"MsnMsgr"="~\"C:\\Program Files\\MSN Messenger\\MsnMsgr.Exe\" /background"
"FreeRAM XP"="\"C:\\Program Files\\YourWare Solutions\\FreeRAM XP Pro\\FreeRAM XP Pro.exe\" -win"
"DAEMON Tools"="\"C:\\Program Files\\DAEMON Tools\\daemon.exe\" -lang 1033"
"CTFMON.EXE"="C:\\WINDOWS\\system32\\ctfmon.exe"
"BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="\"C:\\Program Files\\Common Files\\Ahead\\Lib\\NMBgMonitor.exe\""

[HKEY_USERS\.default\software\microsoft\windows\currentversion\run]
"CTFMON.EXE"="C:\\WINDOWS\\system32\\CTFMON.EXE"

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\system]
"DisableRegistryTools"=dword:00000000

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shellexecutehooks]
"{57B86673-276A-48B2-BAE7-C6DBB3020EB8}"="AVG Anti-Spyware 7.5"

HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa
Authentication Packages REG_MULTI_SZ msv1_0\0\0
Security Packages REG_MULTI_SZ kerberos\0msv1_0\0schannel\0wdigest\0\0
Notification Packages REG_MULTI_SZ scecli\0\0


[HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Svchost]
HTTPFilter REG_MULTI_SZ HTTPFilter\0\0
LocalService REG_MULTI_SZ Alerter\0WebClient\0LmHosts\0RemoteRegistry\0upnphost\0SSDPSRV\0\0
NetworkService REG_MULTI_SZ DnsCache\0\0
DcomLaunch REG_MULTI_SZ DcomLaunch\0TermService\0\0
rpcss REG_MULTI_SZ RpcSs\0\0
imgsvc REG_MULTI_SZ StiSvc\0\0
termsvcs REG_MULTI_SZ TermService\0\0
WudfServiceGroup REG_MULTI_SZ WUDFSvc\0\0


[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{22254897-ce42-11db-8ff4-806d6172696f}]
Shell\AutoRun\command E:\Setup.exe


-- End of Deckard's System Scanner: finished at 2007-04-26 at 15:11:22 ---------

Deckard's System Scanner v20070423.42
Extra logfile - please post this as an attachment with your post.
--------------------------------------------------------------------------------

-- System Information ----------------------------------------------------------

Microsoft Windows XP Professional (build 2600) SP 2.0
Architecture: X86; Language: Other (040B) - see http://preview.tinyurl.com/mhhp6

CPU 0: AMD Sempron(tm) 2600+
Percentage of Memory in Use: 44%
Physical Memory (total/avail): 1023.48 MiB / 567.21 MiB
Pagefile Memory (total/avail): 1693.7 MiB / 1318.3 MiB
Virtual Memory (total/avail): 2047.88 MiB / 1954.27 MiB

A: is Removable (No Media)
C: is Fixed (NTFS) - 19.53 GiB total, 10.43 GiB free.
D: is Fixed (NTFS) - 129.52 GiB total, 10.5 GiB free.
E: is CDROM (No Media)
F: is CDROM (No Media)


-- Security Center -------------------------------------------------------------

AUOptions is scheduled to auto-install.
Windows Internal Firewall is disabled.

FirstRunDisabled is set.
FirewallDisableNotify is set.

FW: Symantec Client Firewall v8.7.4.79 (Symantec Corporation)
AV: Symantec AntiVirus Corporate Edition v10.1.4.4000 (Symantec Corporation)


-- Environment Variables -------------------------------------------------------

ALLUSERSPROFILE=C:\Documents and Settings\All Users
APPDATA=C:\Documents and Settings\Heikki\Application Data
CLIENTNAME=Console
CommonProgramFiles=C:\Program Files\Common Files
COMPUTERNAME=OSSI
ComSpec=C:\WINDOWS\system32\cmd.exe
FP_NO_HOST_CHECK=NO
HOMEDRIVE=C:
HOMEPATH=\Documents and Settings\Heikki
LOGONSERVER=\\OSSI
NewEnvironment1=C:\Program Files\ATI Technologies\ATI.ACE\
NUMBER_OF_PROCESSORS=1
OS=Windows_NT
Path=C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem
PATHEXT=.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH
PROCESSOR_ARCHITECTURE=x86
PROCESSOR_IDENTIFIER=x86 Family 6 Model 8 Stepping 1, AuthenticAMD
PROCESSOR_LEVEL=6
PROCESSOR_REVISION=0801
ProgramFiles=C:\Program Files
PROMPT=$P$G
SESSIONNAME=Console
SystemDrive=C:
SystemRoot=C:\WINDOWS
TEMP=C:\DOCUME~1\Heikki\LOCALS~1\Temp
TMP=C:\DOCUME~1\Heikki\LOCALS~1\Temp
USERDOMAIN=OSSI
USERNAME=Heikki
USERPROFILE=C:\Documents and Settings\Heikki
windir=C:\WINDOWS


-- User Profiles ---------------------------------------------------------------

Heikki (admin)
Järjestelmänvalvoja (new local, admin)


-- Add/Remove Programs ---------------------------------------------------------

--> C:\Program Files\Nero\Nero 7\nero\uninstall\UNNERO.exe /UNINSTALL
--> C:\WINDOWS\UNNeroBackItUp.exe /UNINSTALL
--> C:\WINDOWS\UNNeroMediaHome.exe /UNINSTALL
--> C:\WINDOWS\UNNeroShowTime.exe /UNINSTALL
--> C:\WINDOWS\UNNeroVision.exe /UNINSTALL
--> C:\WINDOWS\UNRecode.exe /UNINSTALL
--> rundll32.exe setupapi.dll,InstallHinfSection DefaultUninstall 132 C:\WINDOWS\INF\PCHealth.inf
Ad-Aware SE Personal --> MsiExec.exe /X{78CC3BAB-DE2A-4FB4-8FBB-E4DADDC26747}
Adobe Flash Player 9 ActiveX --> C:\WINDOWS\system32\Macromed\Flash\FlashUtil9b.exe -uninstallDelete
Adobe Reader 8 - Suomi --> MsiExec.exe /I{AC76BA86-7AD7-1035-7B44-A80000000000}
Adobe Shockwave Player --> C:\WINDOWS\system32\Macromed\SHOCKW~1\UNWISE.EXE C:\WINDOWS\system32\Macromed\SHOCKW~1\Install.log
Agent Hugo --> D:\Pelien asennustiedostot\Agent Hugo\Setup.exe -uninst
ArcSoft PhotoStudio 5.5 --> RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{85309D89-7BE9-4094-BB17-24999C6118FC}\SETUP.EXE" -l0x9
Asterix Mega Madness Mini Game --> RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\engine\6\INTEL3~1\ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{116FABB5-3D74-4BCC-A263-70C3681A1CD8}\setup.exe"
ATI - Software Uninstall Utility --> C:\Program Files\ATI Technologies\UninstallAll\AtiCimUn.exe
ATI Catalyst Control Center --> MsiExec.exe /I{EA9FAF16-0E5C-42C4-9742-9AF8D5F6D69B}
ATI Display Driver --> rundll32 C:\WINDOWS\system32\atiiiexx.dll,_InfEngUnInstallINFFile_RunDLL@16 -force_restart -flags:0x2010001 -inf_class:DISPLAY -clean
AVG Anti-Spyware 7.5 --> C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\Uninstall.exe
BUFFALO Client Manager 3 --> C:\WINDOWS\UN800114.EXE /U
Canon MP Navigator 3.0 --> "C:\Program Files\Canon\MP Navigator 3.0\Maint.exe" /UninstallRemove C:\Program Files\Canon\MP Navigator 3.0\uninst.ini
Canon MP160 --> "C:\WINDOWS\system32\CanonIJ Uninstaller Information\{1199FAD5-9546-44f3-81CF-FFDB8040B7BF}_Canon_MP160\DelDrv.exe" /U:{1199FAD5-9546-44f3-81CF-FFDB8040B7BF}_Canon_MP160 /L0x000b
Canon Utilities Easy-PhotoPrint --> C:\Program Files\Canon\Easy-PhotoPrint\uninst.exe uninst.ini
CCleaner (remove only) --> "C:\Program Files\CCleaner\uninst.exe"
Debugging Tools for Windows --> MsiExec.exe /I{5C741A01-05D6-4306-BA6A-DC8401285AE8}
Easy-WebPrint --> C:\WINDOWS\IsUninst.exe -f"C:\Program Files\Canon\Easy-WebPrint\Uninst.isu"
Evolution --> MsiExec.exe /I{CD1286C6-4305-47BD-A0C0-B41716D70307}
ffdshow [rev 1006] [2007-03-07] --> "C:\Program Files\ffdshow\unins000.exe"
Google Earth --> RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\11\50\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{3DE5E7D4-7B88-403C-A3FD-2017A8240C5B}\setup.exe" -l0x9 -removeonly
Google Gmail Notifier --> "C:\Program Files\Google\Gmail Notifier\UninstallGmail.exe"
GT Reittikartta Suomi Plus --> MsiExec.exe /I{A6E958B1-976E-4B77-84B9-B650437ED930}
ImgBurn (Remove Only) --> "C:\Program Files\ImgBurn\uninstall.exe"
ImgBurn DVDVideo Shell Ext --> MsiExec.exe /I{E9B02A93-6279-491A-984E-7EA6DEDE3293}
J2SE Runtime Environment 5.0 Update 11 --> MsiExec.exe /I{3248F0A8-6813-11D6-A77B-00B0D0150110}
Java(TM) SE Runtime Environment 6 Update 1 --> MsiExec.exe /I{3248F0A8-6813-11D6-A77B-00B0D0160010}
Kielioppi Oppikirja englanti --> RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\09\01\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{64175EFE-3DDC-46BE-BC9B-54BEFF19AB20}\setup.exe" -l0xb
LiveUpdate 3.0 (Symantec Corporation) --> "C:\Program Files\Symantec\LiveUpdate\LSETUP.EXE" /U
Macrogaming SweetIM 2.0 --> MsiExec.exe /X{D9BBFA60-4514-4F08-A78F-91957F957495}
Microsoft Compression Client Pack 1.0 for Windows XP --> "C:\WINDOWS\$NtUninstallMSCompPackV1$\spuninst\spuninst.exe"
Microsoft Office Access MUI (English) 2007 --> MsiExec.exe /X{90120000-0015-0409-0000-0000000FF1CE}
Microsoft Office Access Setup Metadata MUI (English) 2007 --> MsiExec.exe /X{90120000-0117-0409-0000-0000000FF1CE}
Microsoft Office Excel 2007 --> "C:\Program Files\Common Files\Microsoft Shared\OFFICE12\Office Setup Controller\setup.exe" /uninstall EXCEL /dll OSETUP.DLL
Microsoft Office Excel 2007 --> MsiExec.exe /X{90120000-0016-0000-0000-0000000FF1CE}
Microsoft Office Excel MUI (English) 2007 --> MsiExec.exe /X{90120000-0016-0409-0000-0000000FF1CE}
Microsoft Office Groove MUI (English) 2007 --> MsiExec.exe /X{90120000-00BA-0409-0000-0000000FF1CE}
Microsoft Office Groove Setup Metadata MUI (English) 2007 --> MsiExec.exe /X{90120000-0114-0409-0000-0000000FF1CE}
Microsoft Office InfoPath MUI (English) 2007 --> MsiExec.exe /X{90120000-0044-0409-0000-0000000FF1CE}
Microsoft Office Language Pack 2007 - English --> "C:\Program Files\Common Files\Microsoft Shared\OFFICE12\Office Setup Controller\setup.exe" /uninstall OMUI.EN-US /dll OSETUP.DLL
Microsoft Office O MUI (English) 2007 --> MsiExec.exe /X{90120000-0100-0409-0000-0000000FF1CE}
Microsoft Office OneNote MUI (English) 2007 --> MsiExec.exe /X{90120000-00A1-0409-0000-0000000FF1CE}
Microsoft Office Outlook 2007 --> "C:\Program Files\Common Files\Microsoft Shared\OFFICE12\Office Setup Controller\setup.exe" /uninstall OUTLOOK /dll OSETUP.DLL
Microsoft Office Outlook 2007 --> MsiExec.exe /X{90120000-001A-0000-0000-0000000FF1CE}
Microsoft Office Outlook MUI (English) 2007 --> MsiExec.exe /X{90120000-001A-0409-0000-0000000FF1CE}
Microsoft Office PowerPoint 2007 --> "C:\Program Files\Common Files\Microsoft Shared\OFFICE12\Office Setup Controller\setup.exe" /uninstall POWERPOINT /dll OSETUP.DLL
Microsoft Office PowerPoint 2007 --> MsiExec.exe /X{90120000-0018-0000-0000-0000000FF1CE}
Microsoft Office PowerPoint MUI (English) 2007 --> MsiExec.exe /X{90120000-0018-0409-0000-0000000FF1CE}
Microsoft Office Proof (English) 2007 --> MsiExec.exe /X{90120000-001F-0409-0000-0000000FF1CE}
Microsoft Office Proof (French) 2007 --> MsiExec.exe /X{90120000-001F-040C-0000-0000000FF1CE}
Microsoft Office Proof (Spanish) 2007 --> MsiExec.exe /X{90120000-001F-0C0A-0000-0000000FF1CE}
Microsoft Office Proofing (English) 2007 --> MsiExec.exe /X{90120000-002C-0409-0000-0000000FF1CE}
Microsoft Office Publisher MUI (English) 2007 --> MsiExec.exe /X{90120000-0019-0409-0000-0000000FF1CE}
Microsoft Office Shared MUI (English) 2007 --> MsiExec.exe /X{90120000-006E-0409-0000-0000000FF1CE}
Microsoft Office Shared Setup Metadata MUI (English) 2007 --> MsiExec.exe /X{90120000-0115-0409-0000-0000000FF1CE}
Microsoft Office SharePoint Designer MUI (English) 2007 --> MsiExec.exe /X{90120000-0017-0409-0000-0000000FF1CE}
Microsoft Office Word 2007 --> "C:\Program Files\Common Files\Microsoft Shared\OFFICE12\Office Setup Controller\setup.exe" /uninstall WORD /dll OSETUP.DLL
Microsoft Office Word 2007 --> MsiExec.exe /X{90120000-001B-0000-0000-0000000FF1CE}
Microsoft Office Word MUI (English) 2007 --> MsiExec.exe /X{90120000-001B-0409-0000-0000000FF1CE}
Microsoft Office X MUI (English) 2007 --> MsiExec.exe /X{90120000-0101-0409-0000-0000000FF1CE}
Microsoft User-Mode Driver Framework Feature Pack 1.0 --> "C:\WINDOWS\$NtUninstallWudf01000$\spuninst\spuninst.exe"
Mozilla Firefox (2.0.0.2) --> C:\Program Files\Mozilla Firefox\uninstall\helper.exe
Mozilla Firefox (2.0.0.3) --> C:\PROGRA~1\Mozilla Firefox\uninstall\helper.exe
Nero 7 Premium --> MsiExec.exe /I{37BA50EE-C851-4394-93DD-A0A611891035}
NVIDIA Drivers --> C:\WINDOWS\system32\NVUNINST.EXE UninstallGUI
PPMate Network TV 2.1.0.42 --> C:\Program Files\PPMate\uninst.exe
Rayman3 --> MsiExec.exe /X{BAF5914B-5730-4373-B038-9F436AC6A0D6}
Real Alternative 1.51 --> "C:\Program Files\Real Alternative\unins000.exe"
Realtek AC'97 Audio --> RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\engine\6\INTEL3~1\ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{FB08F381-6533-4108-B7DD-039E11FBC27E}\setup.exe" REMOVE
ScanSoft OmniPage SE 4.0 --> MsiExec.exe /I{C1E693A4-B1D5-4DCD-B68D-2087835B7184}
Skype 3.0 --> "C:\Program Files\Skype\Phone\unins000.exe"
Skype Plugin Manager --> MsiExec.exe /I{3D5E5C0A-5B36-4F98-99A7-287F7DBDCE03}
SopCast 1.1.1 --> C:\Program Files\SopCast\uninst.exe
Suojauspäivitys Windows XP:lle (KB923789) --> C:\WINDOWS\system32\MacroMed\Flash\genuinst.exe C:\WINDOWS\system32\MacroMed\Flash\KB923789.inf
Suunnistussimulaattorin esittelyversio 0.999 --> "C:\Program Files\Suunnistussimulaattori Demo\unins000.exe"
SweetIM For Internet Explorer 3.0b --> MsiExec.exe /X{F6D63A65-BD23-46F3-B9A3-87F442423481}
Symantec Client Security --> MsiExec.exe /I{C20729A4-C8C2-4DE3-94BE-5E3A2E9EFB63}
Time Adjuster STANDARD 3.1 --> "C:\Program Files\TimeAdjuster\Uninstall.exe"
TrackMania United DVD Patch 2006-12-15 --> "D:\Pelien asennustiedostot\TrackMania United\unins000.exe"
TweakNow RegCleaner Standard --> "C:\Program Files\TweakNow RegCleaner Std\unins000.exe"
TVUPlayer 2.3.2.32 --> C:\Program Files\TVUPlayer\uninst.exe
WheelRacer 2.07 --> "D:\Pelien asennustiedostot\ActionWheelRacer\unins000.exe"
Windows Live Messenger --> MsiExec.exe /I{DF6FEB75-A0D1-44E5-A754-0072D4967734}
Windows Live Sign-in Assistant --> MsiExec.exe /I{49672EC2-171B-47B4-8CE7-50D7806360D7}
Windows Media Format 11 runtime --> "C:\WINDOWS\$NtUninstallWMFDist11$\spuninst\spuninst.exe"
WinRAR-pakkausohjelma --> C:\Program Files\WinRAR\uninstall.exe


-- End of Deckard's System Scanner: finished at 2007-04-26 at 15:11:22 ---------

Lokeissa ei löytynyt mitään erikoista. Näiden perusteella koneesi näyttäisi olevan puhdas.

Edellisen Javan (5.0 Update 11) voisit poistaa (eli Käynnistä -> Ohjauspaneeli -> Lisää tai poista sovellus -> J2SE Runtime Environment 5.0 Update 11 -> Poista).

Kertoisitko vielä tarkasti minkälaisia ilmoituksia saat?

Nyt ei enää ole tullut päivään muita virheilmoituksia, kuin tästä koneen sammumisesta tuleva ilmoitus. Kone sammuu edelleen aina kun laitan AVG:n scannaamaan.

Tulee ikkuna:

Järjestelmä palautunut vakavasta virheestä.

Virheen allekirjoitus
BCCode : 1000008e BCP1 : C0000005 BCP2 : 8060D118 BCP3 : AFE64B70
BCP4 : 00000000 OSVer : 5_1_2600 SP : 2_0 Product : 256_1

Virheraportin sisältö
C:\DOCUME~1\Heikki\LOCALS~1\Temp\WERdfcf.dir00\Mini042707-01.dmp
C:\DOCUME~1\Heikki\LOCALS~1\Temp\WERdfcf.dir00\sysdata.xml

Kun lähettää virheraportin microsoftille, tulee tälläinen ratkaisu:

Problem caused by Device Driver

You received this message because a device driver installed on your computer caused the Windows operating system to stop unexpectedly. This type of error is referred to as a "stop error." A stop error requires you to restart your computer.

More information

Problem report summary

Problem type


Windows stop error (a message appears on a blue screen with error code information)

Solution available?


No

What does this problem mean?


Windows has encountered a problem it cannot recover from and it needs to be restarted

Cause


Unknown

Computer symptoms


A message appears on a blue screen with error code information (for example: 0x0000001E, KMODE_EXCEPTION_NOT_HANDLED)

Additional steps for you to take


Please continue to send problem reports so analysts at Microsoft can study and try to correct the problem as quickly as possible



Linkki ratkaisuun: http://wer.microsoft.com/Responses/Respo...9f-b7ecfbf8b559

En valitettavasti osaa auttaa tuon ongelman kanssa. Koneesi ollessa puhdas, voisit kenties kysyä apua esim. Ajuri- ja softaongelmat -osiosta.

Nyt kun kuitenkin olet puhdas, seuraavaksi pari vinkkiä kuinka pienennetään saastumisriskiä. Kaikista on saatavilla joko suomenkielinen versio sekä/tai suomenkielinen opas.

-> Taistele vastaan!!-> Malware Complaints
Sivusto antaa haittaohjelmien uhreille mahdollisuuden kertoa tarinansa ja tehdä valituksen asiasta. Taistellaan yhdessä haittaohjelmien tekijöitä vastaan!

-> Tyhjennä järjestelmänpalautus -> Ohjeet
Tyhjennä järjestelmänpalautuskansio ja luo uusi palautuspiste. Tämä puhdistaa palautuskansion mahdollisista haittaohjelmajäännöksistä.

-> Käytä CCleaneria -> CCleaner
Lataa ja asenna CCleaner. Puhdista väliaikaistiedostot ja -kansiot ohjelmalla säännöllisesti.

-> Käytä Ad-Awarea -> Ad-Aware
Lataa ja asenna Ad-Aware. Päivitä se ja skannaa konettasi sillä säännöllisesti.
Opas saatavilla suomeksi! Nimimerkki Ad-Awaren opas

-> Käytä AVG Anti-Spywarea -> AVG Anti-Spyware
Lataa ja asenna AVG Anti-Spyware. Päivitä se ja skannaa konettasi sillä säännöllisesti
Opas saatavilla suomeksi! (Ewido ulkoasulla) Nimimerkki Axelin opas

-> Asenna SpywareBlaster -> SpywareBlaster
SpywareBlaster estää haittaohjelmia asentumasta koneellesi. Ei kuluta muistia!
Opas saatavilla suomeksi! Nimimerkki Ad-Awaren opas

-> Asenna MVPS Hosts tiedosto -> MVPS Hosts
Estää koneesi yhteyden haitallisiin sivustoihin.
Opas saatavilla suomeksi! Nimimerkki Axelin opas

-> Vaihda selaimesi Firefoxiin -> Firefox
Firefox on nopeampi, turvallisempi ja parempi selain kuin Internet Explorer.

-> Pidä järjestelmäsi ajantasalla. -> Windows Update
Vieraile Windows Updatessa säännöllisesti.

-> Pidä palomuuri ja virustorjunta ajantasalla
Päivitä ja skannaa koneesi säännöllisesti virustorjuntaohjelmallasi.

Pysy puhtaana ;)

Kiitos!
Luulen että vika onkin muistikammassa!? Täytyy kysellä toisella alueella!

Täytyy vielä jatkaa.
Nyt löytyi muistista vika. Kun scannasin AVG:n normaalitilassa löytyi edelleen tämä Backdoor.Sdbot ja Trojan.ActivCrk.b. Mistä ne aina ilmestyy?
Tässä AVG:n raportti:
---------------------------------------------------------
AVG Anti-Spyware - Scan Report
---------------------------------------------------------

+ Created at: 20:20:40 28.4.2007

+ Scan result:



C:\System Volume Information\_restore{2AD7B065-5882-49D5-8DC8-FB45A29B5015}\RP1\A0000013.exe -> Backdoor.Sdbot : Cleaned with backup (quarantined).
:mozilla.77:C:\Documents and Settings\Heikki\Application Data\Mozilla\Firefox\Profiles\tp0natqp.default\cookies.txt -> TrackingCookie.Adbrite : Cleaned.
:mozilla.78:C:\Documents and Settings\Heikki\Application Data\Mozilla\Firefox\Profiles\tp0natqp.default\cookies.txt -> TrackingCookie.Adbrite : Cleaned.
:mozilla.79:C:\Documents and Settings\Heikki\Application Data\Mozilla\Firefox\Profiles\tp0natqp.default\cookies.txt -> TrackingCookie.Adbrite : Cleaned.
:mozilla.44:C:\Documents and Settings\Heikki\Application Data\Mozilla\Firefox\Profiles\tp0natqp.default\cookies.txt -> TrackingCookie.Adtech : Cleaned.
:mozilla.45:C:\Documents and Settings\Heikki\Application Data\Mozilla\Firefox\Profiles\tp0natqp.default\cookies.txt -> TrackingCookie.Adtech : Cleaned.
:mozilla.62:C:\Documents and Settings\Heikki\Application Data\Mozilla\Firefox\Profiles\tp0natqp.default\cookies.txt -> TrackingCookie.Advertising : Cleaned.
C:\Documents and Settings\Heikki\Cookies\heikki@atdmt[1].txt -> TrackingCookie.Atdmt : Cleaned.
:mozilla.20:C:\Documents and Settings\Heikki\Application Data\Mozilla\Firefox\Profiles\tp0natqp.default\cookies.txt -> TrackingCookie.Doubleclick : Cleaned.
:mozilla.53:C:\Documents and Settings\Heikki\Application Data\Mozilla\Firefox\Profiles\tp0natqp.default\cookies.txt -> TrackingCookie.Statcounter : Cleaned.
:mozilla.57:C:\Documents and Settings\Heikki\Application Data\Mozilla\Firefox\Profiles\tp0natqp.default\cookies.txt -> TrackingCookie.Statcounter : Cleaned.
:mozilla.10:C:\Documents and Settings\Heikki\Application Data\Mozilla\Firefox\Profiles\tp0natqp.default\cookies.txt -> TrackingCookie.Statistik-gallup : Cleaned.
C:\Documents and Settings\Heikki\Cookies\heikki@statistik-gallup[1].txt -> TrackingCookie.Statistik-gallup : Cleaned.
:mozilla.25:C:\Documents and Settings\Heikki\Application Data\Mozilla\Firefox\Profiles\tp0natqp.default\cookies.txt -> TrackingCookie.Tradedoubler : Cleaned.
:mozilla.27:C:\Documents and Settings\Heikki\Application Data\Mozilla\Firefox\Profiles\tp0natqp.default\cookies.txt -> TrackingCookie.Tradedoubler : Cleaned.
:mozilla.65:C:\Documents and Settings\Heikki\Application Data\Mozilla\Firefox\Profiles\tp0natqp.default\cookies.txt -> TrackingCookie.Webtrends : Cleaned.
D:\System Volume Information\_restore{2AD7B065-5882-49D5-8DC8-FB45A29B5015}\RP1\A0000014.sys -> Trojan.ActivCrk.b : Cleaned with backup (quarantined).


::Report end

1. Klikkaa käynnistä > Oma tietokone oikean puoleisella hiiren napilla
2. Valitse ominaisuudet
3. Valitse järjestelmän palauttaminen välilehti
4. Ruksi eteen ¤ poista järjestelmän palauttaminen kaikissa asemissa
5. Paina Käytä
6. Paina ok
7. Sammuta ja käynnistä
8. Ota ruksi pois ¤ poista järjestelmän palauttaminen kaikissa asemissa
9. Käytä ja OK

Kiitos Hujo! Sweetie tuli kans poistettua. Nyt lähti mesestä hauskat lisä jutut pois... mitä haittaa muuten tuosta Sweetiestä on?

Taitaa sisältää kaikkea epätoivottua, google saattaa kertoa lisää :)