Käynnistä-valikkooni ilmestyi verkkoympäristö-kuvake, joka ei yleensä näy siellä ja avattuani verkkoympäristö sivun siellä oli 4 kpl outoja kansioita mm. kansio nimeltä Delade dokum palvelimella Yeah (Finnholm) jne. Poistin kansiot kertaalleen mutta nyt ne ilmestyivät uudestaan. Olis ihan kiva tietää tunkeeko joku hurri verkkooni vai mistä nää kansiot oikeen on kotosin...Jos joku osais auttaa..

-> Lataa Hijackthis: http://koti.mbnet.fi/pattaya1/HijackThis.exe
-> Tallenna hakemistoon C:\hjt
->Uudelleennimeä HijackThis.exe -> scanner.exe:ksi näin:
1. Klikkaa hiiren oikealla painikkeella HijackThis ikonia.



2. Valitse Uudelleennineä/ Rename.



3. Kirjoita scanner.exe


-> Käynnistä HijackThis ja klikkaa: do a system scan and save a logfile.
-> Lähetä ilmestynyt logisi tähän ketjuun

Logfile of HijackThis v1.99.1
Scan saved at 23:26:09, on 9.5.2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16441)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\RUNDLL32.EXE
E:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe
E:\Program Files\CyberLink\PowerDVD\PDVDServ.exe
C:\WINDOWS\SOUNDMAN.EXE
E:\Program Files\Java\jre1.6.0_01\bin\jusched.exe
E:\Program Files\F-Secure Internet Security\Common\FSM32.EXE
C:\WINDOWS\system32\ctfmon.exe
E:\Program Files\DAEMON Tools\daemon.exe
E:\Program Files\MSI\Core Center\CoreCenter.exe
E:\Program Files\F-Secure Internet Security\Anti-Virus\fsgk32st.exe
E:\Program Files\F-Secure Internet Security\Anti-Virus\FSGK32.EXE
E:\Program Files\F-Secure Internet Security\Common\FSMA32.EXE
C:\WINDOWS\system32\nvsvc32.exe
C:\Program Files\Cyberlink\Shared files\RichVideo.exe
E:\Program Files\F-Secure Internet Security\Common\FSMB32.EXE
C:\WINDOWS\system32\svchost.exe
E:\Program Files\F-Secure Internet Security\Common\FCH32.EXE
E:\Program Files\F-Secure Internet Security\Anti-Virus\fssm32.exe
E:\Program Files\F-Secure Internet Security\Common\FAMEH32.EXE
E:\Program Files\F-Secure Internet Security\Anti-Virus\fsqh.exe
E:\Program Files\F-Secure Internet Security\FSAUA\program\fsaua.exe
E:\Program Files\F-Secure Internet Security\FWES\Program\fsdfwd.exe
E:\Program Files\F-Secure Internet Security\FSAUA\program\fsus.exe
E:\Program Files\F-Secure Internet Security\Anti-Virus\fsav32.exe
E:\Program Files\F-Secure Internet Security\FSGUI\fsguidll.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\hjt\scanner.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.fi/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Linkit
O2 - BHO: Adobe PDF Reader -linkkiavustaja - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - E:\PROGRA~1\MICROS~1\Office12\GRA8E1~1.DLL
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - E:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O4 - HKLM\..\Run: [PtiuPbmd] Rundll32.exe ptipbm.dll,SetWriteBack
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [GrooveMonitor] "E:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe"
O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe
O4 - HKLM\..\Run: [RemoteControl] "E:\Program Files\CyberLink\PowerDVD\PDVDServ.exe"
O4 - HKLM\..\Run: [LanguageShortcut] "E:\Program Files\CyberLink\PowerDVD\Language\Language.exe"
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [SunJavaUpdateSched] "E:\Program Files\Java\jre1.6.0_01\bin\jusched.exe"
O4 - HKLM\..\Run: [F-Secure Manager] "E:\Program Files\F-Secure Internet Security\Common\FSM32.EXE" /splash
O4 - HKLM\..\Run: [F-Secure TNB] "E:\Program Files\F-Secure Internet Security\FSGUI\TNBUtil.exe" /CHECKALL /WAITFORSW
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [DAEMON Tools] "E:\Program Files\DAEMON Tools\daemon.exe" -lang 1033
O4 - Global Startup: Adobe Reader Speed Launch.lnk = E:\Program Files\Adobe\Reader 8.0\Reader\reader_sl.exe
O4 - Global Startup: Adobe Reader Synchronizer.lnk = E:\Program Files\Adobe\Reader 8.0\Reader\AdobeCollabSync.exe
O4 - Global Startup: CoreCenter.lnk = E:\Program Files\MSI\Core Center\CoreCenter.exe
O8 - Extra context menu item: V&ie Microsoft Exceliin - res://E:\PROGRA~1\MICROS~1\Office12\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - E:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - E:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O9 - Extra button: Lähetä OneNoteen - {2670000A-7350-4f3c-8081-5663EE0C6C49} - E:\PROGRA~1\MICROS~1\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: Läh&etä OneNoteen - {2670000A-7350-4f3c-8081-5663EE0C6C49} - E:\PROGRA~1\MICROS~1\Office12\ONBttnIE.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - E:\PROGRA~1\MICROS~1\Office12\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O10 - Unknown file in Winsock LSP: e:\program files\f-secure internet security\fsps\program\fslsp.dll
O10 - Unknown file in Winsock LSP: e:\program files\f-secure internet security\fsps\program\fslsp.dll
O10 - Unknown file in Winsock LSP: e:\program files\f-secure internet security\fsps\program\fslsp.dll
O10 - Unknown file in Winsock LSP: e:\program files\f-secure internet security\fsps\program\fslsp.dll
O10 - Unknown file in Winsock LSP: e:\program files\f-secure internet security\fsps\program\fslsp.dll
O10 - Unknown file in Winsock LSP: e:\program files\f-secure internet security\fsps\program\fslsp.dll
O10 - Unknown file in Winsock LSP: e:\program files\f-secure internet security\fsps\program\fslsp.dll
O10 - Unknown file in Winsock LSP: e:\program files\f-secure internet security\fsps\program\fslsp.dll
O10 - Unknown file in Winsock LSP: e:\program files\f-secure internet security\fsps\program\fslsp.dll
O10 - Unknown file in Winsock LSP: e:\program files\f-secure internet security\fsps\program\fslsp.dll
O10 - Unknown file in Winsock LSP: e:\program files\f-secure internet security\fsps\program\fslsp.dll
O10 - Unknown file in Winsock LSP: e:\program files\f-secure internet security\fsps\program\fslsp.dll
O11 - Options group: [INTERNATIONAL] International*
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupd...b?1178651981453
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/sh...ash/swflash.cab
O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - E:\PROGRA~1\MICROS~1\Office12\GR99D3~1.DLL
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Protocol: ms-help - {314111C7-A502-11D2-BBCA-00C04F8EC294} - C:\Program Files\Common Files\Microsoft Shared\Help\hxds.dll
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Filter hijack: text/xml - {807563E5-5146-11D5-A672-00B0D022E945} - C:\PROGRA~1\COMMON~1\MICROS~1\OFFICE12\MSOXMLMF.DLL
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
O23 - Service: FSGKHS (F-Secure Gatekeeper Handler Starter) - F-Secure Corporation - E:\Program Files\F-Secure Internet Security\Anti-Virus\fsgk32st.exe
O23 - Service: F-Secure Automatic Update Agent (FSAUA) - F-Secure Corporation - E:\Program Files\F-Secure Internet Security\FSAUA\program\fsaua.exe
O23 - Service: F-Secure Anti-Virus Firewall Daemon (FSDFWD) - F-Secure Corporation - E:\Program Files\F-Secure Internet Security\FWES\Program\fsdfwd.exe
O23 - Service: F-Secure Management Agent (FSMA) - F-Secure Corporation - E:\Program Files\F-Secure Internet Security\Common\FSMA32.EXE
O23 - Service: NBService - Nero AG - E:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe
O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - C:\Program Files\Cyberlink\Shared files\RichVideo.exe

Avaa Oma tietokone
-> Tee seuraava toimenpide kaikille Paikallisille levyille



==========

Lataa CCleaner ja asenna se:
Avaa "Options", sieltä "Language" ja valitse "Suomi (Finnish)"

Avaa "Virheet" kohta, paina "Etsi rekisterin virheitä", paina "Korjaa valitut rekisterin virheet..". Paina "Kyllä", kun ohjelma kysyy "Haluatko varmuuskopioida muutokset rekisteriin", tallenna tiedosto esim. työpöydälle.

Avaa "Puhdistaja", paina "Tutki" ja tämän jälkeen "Aja Ccleaner". Puhdista väliaikaistiedostot ja -kansiot ohjelmalla säännöllisesti.

=======0

Avaa HijackThis merkkaa seuraavat rivi(t) ja paina fix checked, sulje muut ohjelmat siksi aikaa

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)


Tässä ohje miten merkataan:



==========0

1,Lataa AVG Anti-Spyware 7.5 ja tallenna ohjelma työpöydällesi. Jos sinulla on jo kyseinen ohjelma siirry suoraan kohtaan 2!

[*]Kun olet ladannut ohjelman, kaksoisklikkaa asennuohjelman pikakuvaketta työpöydälläsi, asennus alkaa.
[*]Asennuksen jälkeen täytyy ohjelma käynnistää ja sen tunnisteet päivittää.

2. [*]Käynnistä AVG eAnti-Spyware.
[*]Klikkaa "Update" kuvaketta päävalikossa. Sen jälkeen klikkaa "Update now" painiketta.
[*]Sitten klikkaa "Start Update" kuvaketta jolloin päivitys alkaa.
[*]Paina hetken kuluttua uudestaan "Start Update" , jos päivitykset eivät heti onnistu
[*]Jos automaattipäivitys ei jostain syystä toimi, niin tunnisteet voi ladata manuaalisesti http://www.ewido.net/en/download/updates/ -linkin takaa.
[*]Kun päivitykset on ladattu, klikkaa "Scanner" kuvaketta ikkunan ylälaidassa. Valitse sitten "Settings" välilehti.
[*]Kun "Settings" valikko on auennut, klikkaa "Recommended actions" ja sitten valitse "Quarantine".
[*]Sitten "Reports" valikon alta:
[*]Laita täppi kohtaan "Automatically generate report after every scan"
[*]Ota täppi pois kohdasta"Only if threats were found"
[*]Sitten klikkaa "Shield" kuvaketta ikkunan ylälaidassa
[*]"Resident shield is", muuta tila active:sta inactive:ksi
[*]Sulje ohjelma, ÄLÄ skannaa vielä.

Käynnistä tietokone vikasietotilaan:
1. Käynnistä tietokone uudelleen.
2. Kun tietokone käynnistyy, paina F8-näppäintä.
3. Näyttöön tulee erilaisia käynnistysvaihtoehtoja.
4. Valitse näppäimistön nuolinäppäinten avulla Vikasietotila.
5. Paina ENTER-näppäintä.

HUOM! Älä käytä muita ohjelmia AVG skannauksen aikana, tämä saattaa häiritä skannausta.
[*]Kun vikasietotilassa, käynnistä AVG Anti-Spyware.
[*]Klikkaa "Scanner" kuvaketta ikkunan ylälaidassa ja valitse "Scan" välilehti. Sitten klikkaa "Complete System Scan".
[*]AVG aloittaa nyt tietokoneen skannaamisen, ole kärsivällinen sillä skannaus vie aikaa.
Kun skannaus on valmis:
TÄRKEÄÄ : Älä klikkaa "Save Scan Report" ennen kuin klikkaat "Apply all Actions"
[*]Varmistu, että Set all elements to: näyttää Quarantine (1), jos ei, klikkaa linkkiä ja valitse Quarantine popup-valikosta.
[*]Sinulta kysytään mitä tehdä jos infektioita löytyi, valitse silloin "Apply all actions"


[*]Sitten klikkaa "Reports" kuvaketta ohjelma yläosasta.
[*]Klikkaa "Save report as" painiketta ikkunan vasemmassa alalaidassa ja tallenna raportti työpöydälle.
[*]Sulje ohjelma, käynnistä kone normaalisti ja lähetä AVG:n raportti viestiketjuusi.

=========

Lataa Deckard's System Scanner Työpöydällesi.

Huomioi: Sinulla tulee olla Järjestelmänvalvojan oikeudet ajaaksesi ohjelman.

[*]Sulje kaikki avoimet ikkunat ja ohjelmat.
[*]Tupla Klikkaa Dss.exe tiedostoa ajaaksesi ohjelman, seuraa ohjeita.
[*]Kun Scannaus on valmis 2 textitiedostoa pitäisi avautua, Main.txt ja extra.txt
[*]Näppäile Kopioi ( CTRL+A -> CTRL + C ) ja liitä ( CTRL + V )
[*]kopioi ja liitä Extra.txt & Main.txt sisältö seuraavaan vastaukseesi.

=========

Uusi hjtlogi

---------------------------------------------------------
AVG Anti-Spyware - Scan Report
---------------------------------------------------------

+ Created at: 13:34:08 10.5.2007

+ Scan result:



Nothing found.


::Report end


Deckard's System Scanner v20070426.43
Run by Omistaja on 2007-05-10 at 14:30:40
Computer is in Normal Mode.
--------------------------------------------------------------------------------

-- System Restore --------------------------------------------------------------

Successfully created a Deckard's System Scanner Restore Point.


-- Last 2 Restore Point(s) --
2: 2007-05-10 11:30:44 UTC - RP40 - Deckard's System Scanner Restore Point
1: 2007-05-09 19:27:25 UTC - RP39 - Software Distribution Service 2.0


Backed up registry hives.

Performed disk cleanup.


-- HijackThis (run as Omistaja.exe) --------------------------------------------

Logfile of HijackThis v1.99.1
Scan saved at 14:31:45, on 10.5.2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16441)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\RUNDLL32.EXE
E:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe
E:\Program Files\CyberLink\PowerDVD\PDVDServ.exe
C:\WINDOWS\SOUNDMAN.EXE
E:\Program Files\Java\jre1.6.0_01\bin\jusched.exe
E:\Program Files\F-Secure Internet Security\Common\FSM32.EXE
C:\WINDOWS\system32\ctfmon.exe
E:\Program Files\DAEMON Tools\daemon.exe
E:\Program Files\MSI\Core Center\CoreCenter.exe
E:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
E:\Program Files\F-Secure Internet Security\Anti-Virus\fsgk32st.exe
E:\Program Files\F-Secure Internet Security\Anti-Virus\FSGK32.EXE
E:\Program Files\F-Secure Internet Security\Common\FSMA32.EXE
C:\WINDOWS\system32\nvsvc32.exe
C:\Program Files\Cyberlink\Shared files\RichVideo.exe
C:\WINDOWS\system32\svchost.exe
E:\Program Files\F-Secure Internet Security\Common\FSMB32.EXE
E:\Program Files\F-Secure Internet Security\Common\FCH32.EXE
E:\Program Files\F-Secure Internet Security\Anti-Virus\fsqh.exe
E:\Program Files\F-Secure Internet Security\Common\FAMEH32.EXE
E:\Program Files\F-Secure Internet Security\Anti-Virus\fssm32.exe
E:\Program Files\F-Secure Internet Security\FSAUA\program\fsaua.exe
E:\Program Files\F-Secure Internet Security\FWES\Program\fsdfwd.exe
E:\Program Files\F-Secure Internet Security\Anti-Virus\fsav32.exe
E:\Program Files\F-Secure Internet Security\FSGUI\fsguidll.exe
C:\Documents and Settings\Omistaja\Työpöytä\dss.exe
C:\hjt\Omistaja.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.fi/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Linkit
O2 - BHO: Adobe PDF Reader -linkkiavustaja - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - E:\PROGRA~1\MICROS~1\Office12\GRA8E1~1.DLL
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - E:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O4 - HKLM\..\Run: [PtiuPbmd] Rundll32.exe ptipbm.dll,SetWriteBack
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [GrooveMonitor] "E:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe"
O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe
O4 - HKLM\..\Run: [RemoteControl] "E:\Program Files\CyberLink\PowerDVD\PDVDServ.exe"
O4 - HKLM\..\Run: [LanguageShortcut] "E:\Program Files\CyberLink\PowerDVD\Language\Language.exe"
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [SunJavaUpdateSched] "E:\Program Files\Java\jre1.6.0_01\bin\jusched.exe"
O4 - HKLM\..\Run: [F-Secure Manager] "E:\Program Files\F-Secure Internet Security\Common\FSM32.EXE" /splash
O4 - HKLM\..\Run: [F-Secure TNB] "E:\Program Files\F-Secure Internet Security\FSGUI\TNBUtil.exe" /CHECKALL /WAITFORSW
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [DAEMON Tools] "E:\Program Files\DAEMON Tools\daemon.exe" -lang 1033
O4 - Global Startup: Adobe Reader Speed Launch.lnk = E:\Program Files\Adobe\Reader 8.0\Reader\reader_sl.exe
O4 - Global Startup: Adobe Reader Synchronizer.lnk = E:\Program Files\Adobe\Reader 8.0\Reader\AdobeCollabSync.exe
O4 - Global Startup: CoreCenter.lnk = E:\Program Files\MSI\Core Center\CoreCenter.exe
O8 - Extra context menu item: V&ie Microsoft Exceliin - res://E:\PROGRA~1\MICROS~1\Office12\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - E:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - E:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O9 - Extra button: Lähetä OneNoteen - {2670000A-7350-4f3c-8081-5663EE0C6C49} - E:\PROGRA~1\MICROS~1\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: Läh&etä OneNoteen - {2670000A-7350-4f3c-8081-5663EE0C6C49} - E:\PROGRA~1\MICROS~1\Office12\ONBttnIE.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - E:\PROGRA~1\MICROS~1\Office12\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O10 - Unknown file in Winsock LSP: e:\program files\f-secure internet security\fsps\program\fslsp.dll
O10 - Unknown file in Winsock LSP: e:\program files\f-secure internet security\fsps\program\fslsp.dll
O10 - Unknown file in Winsock LSP: e:\program files\f-secure internet security\fsps\program\fslsp.dll
O10 - Unknown file in Winsock LSP: e:\program files\f-secure internet security\fsps\program\fslsp.dll
O10 - Unknown file in Winsock LSP: e:\program files\f-secure internet security\fsps\program\fslsp.dll
O10 - Unknown file in Winsock LSP: e:\program files\f-secure internet security\fsps\program\fslsp.dll
O10 - Unknown file in Winsock LSP: e:\program files\f-secure internet security\fsps\program\fslsp.dll
O10 - Unknown file in Winsock LSP: e:\program files\f-secure internet security\fsps\program\fslsp.dll
O10 - Unknown file in Winsock LSP: e:\program files\f-secure internet security\fsps\program\fslsp.dll
O10 - Unknown file in Winsock LSP: e:\program files\f-secure internet security\fsps\program\fslsp.dll
O10 - Unknown file in Winsock LSP: e:\program files\f-secure internet security\fsps\program\fslsp.dll
O10 - Unknown file in Winsock LSP: e:\program files\f-secure internet security\fsps\program\fslsp.dll
O11 - Options group: [INTERNATIONAL] International*
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupd...b?1178651981453
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/sh...ash/swflash.cab
O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - E:\PROGRA~1\MICROS~1\Office12\GR99D3~1.DLL
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Protocol: ms-help - {314111C7-A502-11D2-BBCA-00C04F8EC294} - C:\Program Files\Common Files\Microsoft Shared\Help\hxds.dll
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Filter hijack: text/xml - {807563E5-5146-11D5-A672-00B0D022E945} - C:\PROGRA~1\COMMON~1\MICROS~1\OFFICE12\MSOXMLMF.DLL
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
O23 - Service: AVG Anti-Spyware Guard - Anti-Malware Development a.s. - E:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: FSGKHS (F-Secure Gatekeeper Handler Starter) - F-Secure Corporation - E:\Program Files\F-Secure Internet Security\Anti-Virus\fsgk32st.exe
O23 - Service: F-Secure Automatic Update Agent (FSAUA) - F-Secure Corporation - E:\Program Files\F-Secure Internet Security\FSAUA\program\fsaua.exe
O23 - Service: F-Secure Anti-Virus Firewall Daemon (FSDFWD) - F-Secure Corporation - E:\Program Files\F-Secure Internet Security\FWES\Program\fsdfwd.exe
O23 - Service: F-Secure Management Agent (FSMA) - F-Secure Corporation - E:\Program Files\F-Secure Internet Security\Common\FSMA32.EXE
O23 - Service: NBService - Nero AG - E:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe
O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - C:\Program Files\Cyberlink\Shared files\RichVideo.exe


-- HijackThis Fixed Entries (C:\hjt\backups\) ----------------------------------

backup-20070510-115045-360 O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
backup-20070510-115045-778 R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
backup-20070510-115045-998 R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =

-- File Associations -----------------------------------------------------------

All associations okay.


-- Drivers: 0-Boot, 1-System, 2-Auto, 3-Demand, 4-Disabled ---------------------

R0 FSFW (F-Secure Firewall Driver) - c:\windows\system32\drivers\fsdfw.sys <Not Verified; F-Secure Corporation; F-Secure Anti-Virus Internet Shield>
R1 F-Secure HIPS - e:\program files\f-secure internet security\hips\fshs.sys <Not Verified; F-Secure Corporation; F-Secure HIPS Driver>
R3 F-Secure Gatekeeper - e:\program files\f-secure internet security\anti-virus\minifilter\fsgk.sys
R3 PCAlertDriver - e:\program files\msi\core center\ntglm7x.sys <Not Verified; MICRO-STAR INT'L CO., LTD.; MSI PCAlert 4>
R3 RushTopDevice - e:\program files\msi\core center\rushtop.sys <Not Verified; MICRO-STAR INT'L CO., LTD.; MSI CoreCenter>

S0 NVStrap - c:\windows\system32\drivers\nvstrap.sys
S3 GMSIPCI - d:\install\gmsipci.sys (file missing)
S3 RivaTuner32 - e:\program files\rivatuner v2.01\rivatuner32.sys
S4 F-Secure Filter (F-Secure File System Filter) - e:\program files\f-secure internet security\anti-virus\win2k\fsfilter.sys
S4 F-Secure Recognizer (F-Secure File System Recognizer) - e:\program files\f-secure internet security\anti-virus\win2k\fsrec.sys


-- Services: 0-Boot, 1-System, 2-Auto, 3-Demand, 4-Disabled --------------------

R2 F-Secure Gatekeeper Handler Starter (FSGKHS) - "e:\program files\f-secure internet security\anti-virus\fsgk32st.exe" <Not Verified; F-Secure Corporation; F-Secure Corp. Startup service>
R2 FSMA (F-Secure Management Agent) - "e:\program files\f-secure internet security\common\fsma32.exe" <Not Verified; F-Secure Corporation; F-Secure Management Agent>
R3 FSAUA (F-Secure Automatic Update Agent) - "e:\program files\f-secure internet security\fsaua\program\fsaua.exe" <Not Verified; F-Secure Corporation; F-Secure Automatic Update Agent>
R3 FSDFWD (F-Secure Anti-Virus Firewall Daemon) - "e:\program files\f-secure internet security\fwes\program\fsdfwd.exe" <Not Verified; F-Secure Corporation; F-Secure Anti-Virus Internet Shield>

S3 NBService - e:\program files\nero\nero 7\nero backitup\nbservice.exe


-- Files created between 2007-04-10 and 2007-05-10 -----------------------------

2007-05-10 11:49:00 0 dr-h----- C:\Documents and Settings\Omistaja\Recent
2007-05-09 23:25:02 0 d-------- C:\hjt
2007-05-09 16:14:04 0 d-------- C:\Documents and Settings\Omistaja\Application Data\Macromedia
2007-05-09 13:12:51 29472 --a------ C:\WINDOWS\system32\drivers\fsndis5.sys <Not Verified; F-Secure Corporation; F-Secure Anti-Virus Internet Shield>
2007-05-09 13:12:51 50080 --a------ C:\WINDOWS\system32\drivers\fsdfw.sys <Not Verified; F-Secure Corporation; F-Secure Anti-Virus Internet Shield>
2007-05-09 13:12:42 0 d-------- C:\Documents and Settings\All Users\Application Data\F-Secure
2007-05-09 11:48:17 0 d-------- C:\Documents and Settings\Omistaja\Application Data\ispnews
2007-05-09 11:45:33 0 d-------- C:\WINDOWS\rnapxs
2007-05-09 01:59:11 0 d-------- C:\Program Files\MSXML 6.0
2007-05-09 01:52:40 0 d-------- C:\WINDOWS\system32\XPSViewer
2007-05-09 01:51:54 0 d-------- C:\Program Files\Reference Assemblies
2007-05-09 01:45:33 0 d-------- C:\WINDOWS\system32\URTTEMP
2007-05-09 01:06:55 0 d-------- C:\Documents and Settings\Omistaja\Application Data\WinRAR
2007-05-09 01:05:02 0 d-------- C:\WINDOWS\Sun
2007-05-09 00:46:38 0 d-------- C:\Program Files\MSXML 4.0
2007-05-09 00:40:40 0 d-------- C:\Documents and Settings\Omistaja\Application Data\Sun
2007-05-09 00:39:14 0 d-------- C:\Program Files\Common Files\Java
2007-05-08 23:47:25 49152 --a------ C:\WINDOWS\system32\ChCfg.exe
2007-05-08 23:45:57 0 d-------- C:\Program Files\Realtek AC97
2007-05-08 23:16:18 18359 -----n--- C:\WINDOWS\system32\Ntaccess.sys <Not Verified; Your Corporation; Your Product Name>
2007-05-08 23:16:18 6912 -----n--- C:\WINDOWS\system32\drivers\FlashSys.sys
2007-05-08 23:16:15 0 d-------- C:\Program Files\MSI
2007-05-08 23:15:54 0 d-------- C:\WINDOWS\system32\PreInstall
2007-05-08 23:15:11 0 d--hs---- C:\WINDOWS\Installer
2007-05-08 23:15:10 0 d-------- C:\Program Files\Common Files\ODBC
2007-05-08 23:15:07 0 d-------- C:\Program Files\Common Files\SpeechEngines
2007-05-08 23:15:06 0 dr------- C:\Program Files
2007-05-08 23:14:56 0 d-------- C:\Documents and Settings\Omistaja\Application Data\CyberLink
2007-05-08 23:14:42 0 d--h----- C:\Documents and Settings\Default User\Verkkoympäristö
2007-05-08 23:14:42 0 d-------- C:\Documents and Settings\Default User\Työpöytä
2007-05-08 23:14:42 0 d--h----- C:\Documents and Settings\Default User\Tulostinympäristö
2007-05-08 23:14:42 0 d-------- C:\Documents and Settings\Default User\Suosikit
2007-05-08 23:14:42 0 dr-h----- C:\Documents and Settings\Default User\SendTo
2007-05-08 23:14:42 0 d--h----- C:\Documents and Settings\Default User\Recent
2007-05-08 23:14:42 0 d--h----- C:\Documents and Settings\Default User\Mallit
2007-05-08 23:14:42 0 dr-h----- C:\Documents and Settings\Default User\Local Settings
2007-05-08 23:14:42 0 dr------- C:\Documents and Settings\Default User\Käynnistä-valikko
2007-05-08 23:14:42 0 d---s---- C:\Documents and Settings\Default User\Cookies
2007-05-08 23:14:42 0 d-------- C:\Documents and Settings\All Users\Työpöytä
2007-05-08 23:14:42 0 dr------- C:\Documents and Settings\All Users\Tiedostot
2007-05-08 23:14:42 0 d-------- C:\Documents and Settings\All Users\Suosikit
2007-05-08 23:14:42 0 d--h----- C:\Documents and Settings\All Users\Mallit
2007-05-08 23:14:42 0 dr------- C:\Documents and Settings\All Users\Käynnistä-valikko
2007-05-08 23:14:37 0 d-------- C:\Documents and Settings\All Users\Application Data\CyberLink
2007-05-08 23:13:02 0 d-------- C:\WINDOWS\system32\CatRoot2
2007-05-08 23:13:02 0 d-------- C:\WINDOWS\system32\CatRoot
2007-05-08 23:12:57 0 dr-h----- C:\Documents and Settings\Default User\Application Data
2007-05-08 23:12:57 0 d---s---- C:\Documents and Settings\Default User\Application Data\Microsoft
2007-05-08 23:12:57 0 dr-h----- C:\Documents and Settings\All Users\Application Data
2007-05-08 23:12:57 0 d---s---- C:\Documents and Settings\All Users\Application Data\Microsoft
2007-05-08 23:12:51 0 d-------- C:\Program Files\Cyberlink
2007-05-08 23:12:34 0 d--hs---- C:\System Volume Information
2007-05-08 23:12:34 0 d-------- C:\Documents and Settings
2007-05-08 23:08:34 0 d-------- C:\Documents and Settings\Omistaja\Application Data\Ahead
2007-05-08 23:06:33 0 d-------- C:\WINDOWS
2007-05-08 23:06:33 0 d-------- C:\WINDOWS\WinSxS
2007-05-08 23:06:33 0 dr------- C:\WINDOWS\Web
2007-05-08 23:06:33 0 d-------- C:\WINDOWS\twain_32
2007-05-08 23:06:33 0 d-------- C:\WINDOWS\system32
2007-05-08 23:06:33 0 d-------- C:\WINDOWS\system32\wins
2007-05-08 23:06:33 0 d-------- C:\WINDOWS\system32\wbem
2007-05-08 23:06:33 0 d-------- C:\WINDOWS\system32\usmt
2007-05-08 23:06:33 0 d-------- C:\WINDOWS\system32\spool
2007-05-08 23:06:33 0 d-------- C:\WINDOWS\system32\ShellExt
2007-05-08 23:06:33 0 d-------- C:\WINDOWS\system32\Setup
2007-05-08 23:06:33 0 d-------- C:\WINDOWS\system32\ras
2007-05-08 23:06:33 0 d-------- C:\WINDOWS\system32\oobe
2007-05-08 23:06:33 0 d-------- C:\WINDOWS\system32\npp
2007-05-08 23:06:33 0 d-------- C:\WINDOWS\system32\mui
2007-05-08 23:06:33 0 d-------- C:\WINDOWS\system32\inetsrv
2007-05-08 23:06:33 0 d-------- C:\WINDOWS\system32\IME
2007-05-08 23:06:33 0 d-------- C:\WINDOWS\system32\icsxml
2007-05-08 23:06:33 0 d-------- C:\WINDOWS\system32\ias
2007-05-08 23:06:33 0 d-------- C:\WINDOWS\system32\export
2007-05-08 23:06:33 0 d-------- C:\WINDOWS\system32\drivers
2007-05-08 23:06:33 0 d-------- C:\WINDOWS\system32\drivers\etc
2007-05-08 23:06:33 0 d-------- C:\WINDOWS\system32\drivers\disdn
2007-05-08 23:06:33 0 dr-hs--c- C:\WINDOWS\system32\dllcache
2007-05-08 23:06:33 0 d-------- C:\WINDOWS\system32\dhcp
2007-05-08 23:06:33 0 d-------- C:\WINDOWS\system32\config
2007-05-08 23:06:33 0 d-------- C:\WINDOWS\system32\3com_dmi
2007-05-08 23:06:33 0 d-------- C:\WINDOWS\system32\3076
2007-05-08 23:06:33 0 d-------- C:\WINDOWS\system32\2052
2007-05-08 23:06:33 0 d-------- C:\WINDOWS\system32\1054
2007-05-08 23:06:33 0 d-------- C:\WINDOWS\system32\1042
2007-05-08 23:06:33 0 d-------- C:\WINDOWS\system32\1041
2007-05-08 23:06:33 0 d-------- C:\WINDOWS\system32\1037
2007-05-08 23:06:33 0 d-------- C:\WINDOWS\system32\1035
2007-05-08 23:06:33 0 d-------- C:\WINDOWS\system32\1033
2007-05-08 23:06:33 0 d-------- C:\WINDOWS\system32\1031
2007-05-08 23:06:33 0 d-------- C:\WINDOWS\system32\1028
2007-05-08 23:06:33 0 d-------- C:\WINDOWS\system32\1025
2007-05-08 23:06:33 0 d-------- C:\WINDOWS\system
2007-05-08 23:06:33 0 d-------- C:\WINDOWS\security
2007-05-08 23:06:33 0 d-------- C:\WINDOWS\Resources
2007-05-08 23:06:33 0 d-------- C:\WINDOWS\repair
2007-05-08 23:06:33 0 d-------- C:\WINDOWS\Provisioning
2007-05-08 23:06:33 0 d-------- C:\WINDOWS\PeerNet
2007-05-08 23:06:33 0 d-------- C:\WINDOWS\pchealth
2007-05-08 23:06:33 0 d-------- C:\WINDOWS\mui
2007-05-08 23:06:33 0 d-------- C:\WINDOWS\msapps
2007-05-08 23:06:33 0 d-------- C:\WINDOWS\msagent
2007-05-08 23:06:33 0 d-------- C:\WINDOWS\Media
2007-05-08 23:06:33 0 d-------- C:\WINDOWS\java
2007-05-08 23:06:33 0 d--h----- C:\WINDOWS\inf
2007-05-08 23:06:33 0 d-------- C:\WINDOWS\ime
2007-05-08 23:06:33 0 d-------- C:\WINDOWS\Help
2007-05-08 23:06:33 0 dr--s---- C:\WINDOWS\Fonts
2007-05-08 23:06:33 0 d-------- C:\WINDOWS\Driver Cache
2007-05-08 23:06:33 0 d-------- C:\WINDOWS\Debug
2007-05-08 23:06:33 0 d-------- C:\WINDOWS\Cursors
2007-05-08 23:06:33 0 d-------- C:\WINDOWS\Connection Wizard
2007-05-08 23:06:33 0 d-------- C:\WINDOWS\Config
2007-05-08 23:06:33 0 d-------- C:\WINDOWS\AppPatch
2007-05-08 23:06:33 0 d-------- C:\WINDOWS\addins
2007-05-08 23:06:14 0 d-------- C:\Program Files\Common Files\Ahead
2007-05-08 23:06:14 0 d-------- C:\Documents and Settings\All Users\Application Data\Nero
2007-05-08 22:56:05 0 d-------- C:\Documents and Settings\Omistaja\Contacts
2007-05-08 22:55:35 0 d------c- C:\WINDOWS\system32\DRVSTORE
2007-05-08 22:55:03 0 d-------- C:\Program Files\MSN Messenger
2007-05-08 22:50:04 0 d-------- C:\Program Files\Microsoft Works
2007-05-08 22:49:40 0 d-------- C:\Program Files\MSBuild
2007-05-08 22:44:52 0 d-------- C:\WINDOWS\SHELLNEW
2007-05-08 22:43:38 0 d-------- C:\Documents and Settings\All Users\Application Data\Microsoft Help
2007-05-08 22:39:27 0 d-------- C:\Program Files\Windows Media Connect 2
2007-05-08 22:38:06 0 d-------- C:\WINDOWS\system32\LogFiles
2007-05-08 22:38:06 0 d-------- C:\WINDOWS\system32\drivers\UMDF
2007-05-08 22:33:28 0 d-------- C:\Documents and Settings\Omistaja\Application Data\Adobe
2007-05-08 22:31:51 0 d-------- C:\WINDOWS\system32\fi-fi
2007-05-08 22:28:36 0 d-------- C:\WINDOWS\network diagnostic
2007-05-08 22:28:28 0 d--h----- C:\WINDOWS\$hf_mig$
2007-05-08 22:21:12 0 d-------- C:\Documents and Settings\All Users\Application Data\Windows Genuine Advantage
2007-05-08 22:18:33 0 d--hs---- C:\Documents and Settings\Omistaja\UserData
2007-05-08 22:16:19 6784 --a------ C:\WINDOWS\nvoclock.sys <Not Verified; NVidia Corp.; NVidia System Utility Driver>
2007-05-08 22:16:19 273408 --a------ C:\WINDOWS\NVGfxOgl.dll
2007-05-08 22:16:19 1622016 --a------ C:\WINDOWS\NVBenchMarks.dll <Not Verified; NVIDIA; NVIDIA nTune>
2007-05-08 22:16:18 380928 --a------ C:\WINDOWS\nvsulib.dll <Not Verified; NVIDIA; NVIDIA nTune>
2007-05-08 22:16:18 368640 --a------ C:\WINDOWS\ntuneoem.dll <Not Verified; NVIDIA; NVIDIA nTune>
2007-05-08 22:16:18 45056 --a------ C:\WINDOWS\NTuneGpu.dll <Not Verified; NVIDIA; NVIDIA nTune>
2007-05-08 22:16:18 28672 --a------ C:\WINDOWS\AutoTuneScript.dll <Not Verified; NVIDIA; NVIDIA nTune>
2007-05-08 22:12:34 0 d-------- C:\Documents and Settings\Omistaja\Application Data\Talkback
2007-05-08 22:12:29 0 --a------ C:\WINDOWS\nsreg.dat
2007-05-08 22:12:27 0 d-------- C:\Documents and Settings\Omistaja\Application Data\Thunderbird
2007-05-08 22:12:27 0 d-------- C:\Documents and Settings\Omistaja\Application Data\Mozilla
2007-05-08 22:09:26 0 d-------- C:\Documents and Settings\All Users\Application Data\Adobe
2007-05-08 22:09:14 0 d-------- C:\Program Files\Common Files\Adobe
2007-05-08 22:08:03 10752 --a------ C:\WINDOWS\system32\ff_vfw.dll
2007-05-08 22:08:02 60273 --a------ C:\WINDOWS\system32\pthreadGC2.dll <Not Verified; Open Source Software community project; >
2007-05-08 21:56:55 682232 --a------ C:\WINDOWS\system32\drivers\sptd.sys
2007-05-08 21:26:07 4224 --a------ C:\WINDOWS\system32\drivers\NVStrap.sys
2007-05-08 21:22:58 0 d-------- C:\Documents and Settings\All Users\Application Data\NVIDIA
2007-05-08 21:22:18 8 --a------ C:\WINDOWS\system32\nvModes.dat
2007-05-08 21:21:58 0 d-------- C:\Documents and Settings\All Users\Application Data\nView_Profiles
2007-05-08 21:19:47 0 d-------- C:\WINDOWS\nview
2007-05-08 21:13:49 147456 --a------ C:\WINDOWS\system32\RtlCPAPI.dll <Not Verified; ; RtlCPAPI Module>
2007-05-08 21:13:49 4025984 --a------ C:\WINDOWS\system32\drivers\alcxwdm.sys <Not Verified; Realtek Semiconductor Corp.; Windows (R) WDM driver for Realtek AC'97 Audio(HRTF data Copyright 1994 by MIT Media Lab)>
2007-05-08 21:13:48 577536 --a------ C:\WINDOWS\soundman.exe <Not Verified; Realtek Semiconductor Corp.; Realtek Sound Manager>
2007-05-08 21:13:45 10528768 --a------ C:\WINDOWS\system32\RTLCPL.exe <Not Verified; Realtek Semiconductor Corp.; Realtek Audio Sound Effect Manager>
2007-05-08 21:13:29 315392 --a------ C:\WINDOWS\alcupd.exe <Not Verified; Realtek Semiconductor Corp.; Realtek AC'97 Update driver Tool>
2007-05-08 21:13:27 217088 --a------ C:\WINDOWS\Alcrmv.exe <Not Verified; Realtek Semiconductor Corp.; Realtek AC'97 Removing driver Tool>
2007-05-08 21:13:08 0 d--h----- C:\Program Files\InstallShield Installation Information
2007-05-08 21:12:30 0 d-------- C:\Program Files\VIA
2007-05-08 21:12:12 0 d-------- C:\Program Files\Common Files\InstallShield
2007-05-08 21:08:49 24576 -ra------ C:\WINDOWS\system32\ptipbm.dll <Not Verified; Promise Technology,Inc.; pmscache Dynamic Link Library>
2007-05-08 21:08:47 64256 -ra------ C:\WINDOWS\system32\drivers\ulsata.sys <Not Verified; Promise Technology, Inc.; Promise UlSata Series Driver>
2007-05-08 21:04:32 306688 --a------ C:\WINDOWS\IsUninst.exe <Not Verified; InstallShield Software Corporation; InstallShield® unInstaller>
2007-05-08 21:03:55 0 d-------- C:\WINDOWS\system32\ReinstallBackups
2007-05-08 20:59:57 0 d-------- C:\Documents and Settings\Omistaja\Application Data\F-Secure
2007-05-08 20:58:48 0 d-------- C:\WINDOWS\system32\SoftwareDistribution
2007-05-08 20:49:39 0 d-------- C:\Documents and Settings\All Users\Application Data\fssg
2007-05-08 20:30:36 0 d-------- C:\Documents and Settings\Omistaja\Application Data\Identities
2007-05-08 20:30:32 0 dr------- C:\Documents and Settings\Omistaja\Omat tiedostot
2007-05-08 20:30:24 0 d--h----- C:\Documents and Settings\Omistaja\Verkkoympäristö
2007-05-08 20:30:24 0 d-------- C:\Documents and Settings\Omistaja\Työpöytä
2007-05-08 20:30:24 0 d--h----- C:\Documents and Settings\Omistaja\Tulostinympäristö
2007-05-08 20:30:24 0 dr------- C:\Documents and Settings\Omistaja\Suosikit
2007-05-08 20:30:24 0 dr-h----- C:\Documents and Settings\Omistaja\SendTo
2007-05-08 20:30:24 1835008 --ah----- C:\Documents and Settings\Omistaja\NTUSER.DAT
2007-05-08 20:30:24 0 d--h----- C:\Documents and Settings\Omistaja\Mallit
2007-05-08 20:30:24 0 d--h----- C:\Documents and Settings\Omistaja\Local Settings
2007-05-08 20:30:24 0 dr------- C:\Documents and Settings\Omistaja\Käynnistä-valikko
2007-05-08 20:30:24 0 d--hs---- C:\Documents and Settings\Omistaja\Cookies
2007-05-08 20:30:24 0 dr-h----- C:\Documents and Settings\Omistaja\Application Data
2007-05-08 20:29:30 0 d-------- C:\WINDOWS\SoftwareDistribution
2007-05-08 20:29:29 0 d-------- C:\WINDOWS\Prefetch
2007-05-08 20:29:28 0 d---s---- C:\WINDOWS\system32\Microsoft
2007-05-08 20:29:27 229376 --ah----- C:\Documents and Settings\LocalService\NTUSER.DAT
2007-05-08 20:29:27 0 d--h----- C:\Documents and Settings\LocalService\Local Settings
2007-05-08 20:29:27 0 d--hs---- C:\Documents and Settings\LocalService\Cookies
2007-05-08 20:29:27 0 d-------- C:\Documents and Settings\LocalService\Application Data
2007-05-08 20:29:27 0 d---s---- C:\Documents and Settings\LocalService\Application Data\Microsoft
2007-05-08 20:29:08 229376 --ah----- C:\Documents and Settings\NetworkService\NTUSER.DAT
2007-05-08 20:29:08 0 d--h----- C:\Documents and Settings\NetworkService\Local Settings
2007-05-08 20:29:08 0 d---s---- C:\Documents and Settings\NetworkService\Cookies
2007-05-08 20:29:08 0 d-------- C:\Documents and Settings\NetworkService\Application Data
2007-05-08 20:29:08 0 d---s---- C:\Documents and Settings\NetworkService\Application Data\Microsoft
2007-05-08 20:26:31 0 d-------- C:\WINDOWS\system32\xircom
2007-05-08 20:26:31 0 d-------- C:\Program Files\microsoft frontpage
2007-05-08 20:26:28 229376 ---h----- C:\Documents and Settings\Default User\NTUSER.DAT
2007-05-08 20:26:17 0 -rahs---- C:\MSDOS.SYS
2007-05-08 20:26:17 0 -rahs---- C:\IO.SYS
2007-05-08 20:26:17 0 --a------ C:\CONFIG.SYS
2007-05-08 20:26:17 0 --a------ C:\AUTOEXEC.BAT
2007-05-08 20:25:26 0 d--hs---- C:\Documents and Settings\All Users\DRM
2007-05-08 20:25:17 0 dr------- C:\WINDOWS\Offline Web Pages
2007-05-08 20:25:17 0 d---s---- C:\WINDOWS\Downloaded Program Files
2007-05-08 20:25:07 0 d--h----- C:\Program Files\WindowsUpdate
2007-05-08 20:25:04 0 d-------- C:\Program Files\Online Services
2007-05-08 20:24:50 0 d-------- C:\WINDOWS\system32\DirectX
2007-05-08 20:24:21 0 d---s---- C:\WINDOWS\Tasks
2007-05-08 20:24:20 0 d-------- C:\Program Files\Common Files\MSSoap
2007-05-08 20:24:17 0 d-------- C:\WINDOWS\system32\Macromed
2007-05-08 20:24:17 0 d-------- C:\WINDOWS\srchasst
2007-05-08 20:24:10 0 d-------- C:\Program Files\Movie Maker
2007-05-08 20:24:04 0 d-------- C:\WINDOWS\system32\Restore
2007-05-08 20:23:50 21672 --a------ C:\WINDOWS\system32\emptyregdb.dat
2007-05-08 20:23:35 0 d-------- C:\WINDOWS\Registration
2007-05-08 20:23:05 0 d-------- C:\Program Files\Messenger
2007-05-08 20:23:02 0 d-------- C:\Program Files\MSN Gaming Zone
2007-05-08 20:22:41 0 d-------- C:\Program Files\Windows NT
2007-05-08 20:22:39 0 d-------- C:\WINDOWS\system32\MsDtc
2007-05-08 20:22:37 0 d-------- C:\WINDOWS\system32\Com


-- Find3M Report ---------------------------------------------------------------

2007-05-09 13:12:58 417942 --a------ C:\WINDOWS\system32\perfh00B.dat
2007-05-09 13:12:58 86868 --a------ C:\WINDOWS\system32\perfc00B.dat
2007-05-08 23:14:42 62 --ahs---- C:\Documents and Settings\Omistaja\Application Data\desktop.ini
2007-03-22 20:25:02 124928 -----n--- C:\WINDOWS\system32\prntvpt.dll <Not Verified; Microsoft Corporation; Microsoft® Windows® Operating System>


-- Registry Dump ---------------------------------------------------------------

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects]
{72853161-30C5-4D22-B7F9-0BBC1D38A37E} E:\PROGRA~1\MICROS~1\Office12\GRA8E1~1.DLL
{761497BB-D6F0-462C-B6EB-D4DAF1D92D43} E:\Program Files\Java\jre1.6.0_01\bin\ssv.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run]
"PtiuPbmd"="Rundll32.exe ptipbm.dll,SetWriteBack"
"NvCplDaemon"="RUNDLL32.EXE C:\\WINDOWS\\system32\\NvCpl.dll,NvStartup"
"nwiz"="nwiz.exe /install"
"NvMediaCenter"="RUNDLL32.EXE C:\\WINDOWS\\system32\\NvMcTray.dll,NvTaskbarInit"
"GrooveMonitor"="\"E:\\Program Files\\Microsoft Office\\Office12\\GrooveMonitor.exe\""
"NeroFilterCheck"="C:\\Program Files\\Common Files\\Ahead\\Lib\\NeroCheck.exe"
"RemoteControl"="\"E:\\Program Files\\CyberLink\\PowerDVD\\PDVDServ.exe\""
"LanguageShortcut"="\"E:\\Program Files\\CyberLink\\PowerDVD\\Language\\Language.exe\""
"SoundMan"="SOUNDMAN.EXE"
"SunJavaUpdateSched"="\"E:\\Program Files\\Java\\jre1.6.0_01\\bin\\jusched.exe\""
"F-Secure Manager"="\"E:\\Program Files\\F-Secure Internet Security\\Common\\FSM32.EXE\" /splash"
"F-Secure TNB"="\"E:\\Program Files\\F-Secure Internet Security\\FSGUI\\TNBUtil.exe\" /CHECKALL /WAITFORSW"

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run]
"CTFMON.EXE"="C:\\WINDOWS\\system32\\ctfmon.exe"
"DAEMON Tools"="\"E:\\Program Files\\DAEMON Tools\\daemon.exe\" -lang 1033"

[HKEY_USERS\.default\software\microsoft\windows\currentversion\run]
"CTFMON.EXE"="C:\\WINDOWS\\system32\\CTFMON.EXE"

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\system]
"DisableRegistryTools"=dword:00000000

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shellexecutehooks]
"{B5A7F190-DDA6-4420-B3BA-52453494E6CD}"="Groove GFS Stub Execution Hook"
"{57B86673-276A-48B2-BAE7-C6DBB3020EB8}"="AVG Anti-Spyware 7.5"

HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa
Authentication Packages REG_MULTI_SZ msv1_0\0\0
Security Packages REG_MULTI_SZ kerberos\0msv1_0\0schannel\0wdigest\0\0
Notification Packages REG_MULTI_SZ scecli\0\0


[HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Svchost]
HTTPFilter REG_MULTI_SZ HTTPFilter\0\0
LocalService REG_MULTI_SZ Alerter\0WebClient\0LmHosts\0RemoteRegistry\0upnphost\0SSDPSRV\0\0
NetworkService REG_MULTI_SZ DnsCache\0\0
DcomLaunch REG_MULTI_SZ DcomLaunch\0TermService\0\0
rpcss REG_MULTI_SZ RpcSs\0\0
imgsvc REG_MULTI_SZ StiSvc\0\0
termsvcs REG_MULTI_SZ TermService\0\0
WudfServiceGroup REG_MULTI_SZ WUDFSvc\0\0



-- End of Deckard's System Scanner: finished at 2007-05-10 at 14:32:34 ---------
-----------------------------------------------------------------------------------------------------------------------------------------------
Deckard's System Scanner v20070426.43
Extra logfile - please post this as an attachment with your post.
--------------------------------------------------------------------------------

-- System Information ----------------------------------------------------------

Microsoft Windows XP Home Edition (build 2600) SP 2.0
Architecture: X86; Language: Other (040B) - see http://preview.tinyurl.com/mhhp6

CPU 0: AMD Athlon(tm) 64 Processor 3000+
Percentage of Memory in Use: 42%
Physical Memory (total/avail): 1023.48 MiB / 584.29 MiB
Pagefile Memory (total/avail): 2460.05 MiB / 2077.62 MiB
Virtual Memory (total/avail): 2047.88 MiB / 1954.87 MiB

A: is Removable (No Media)
C: is Fixed (NTFS) - 20.02 GiB total, 14.09 GiB free.
D: is CDROM (No Media)
E: is Fixed (NTFS) - 129.03 GiB total, 123.42 GiB free.
F: is Fixed (NTFS) - 122.07 GiB total, 41.85 GiB free.
G: is Fixed (NTFS) - 111.69 GiB total, 21.61 GiB free.
R: is CDROM (No Media)


-- Security Center -------------------------------------------------------------

AUOptions is scheduled to auto-install.
Windows Internal Firewall is disabled.

FirstRunDisabled is set.

FW: F-Secure Internet Security 2007 7.01 v7.01 (F-Secure Corporation)
AV: F-Secure Internet Security 2007 7.01 v7.01 (F-Secure Corporation)


-- Environment Variables -------------------------------------------------------

ALLUSERSPROFILE=C:\Documents and Settings\All Users
APPDATA=C:\Documents and Settings\Omistaja\Application Data
CLIENTNAME=Console
CommonProgramFiles=C:\Program Files\Common Files
COMPUTERNAME=TIETOKONE
ComSpec=C:\WINDOWS\system32\cmd.exe
FP_NO_HOST_CHECK=NO
HOMEDRIVE=C:
HOMEPATH=\Documents and Settings\Omistaja
LOGONSERVER=\\TIETOKONE
NUMBER_OF_PROCESSORS=1
OS=Windows_NT
Path=C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\Program Files\Common Files\Ahead\Lib\
PATHEXT=.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH
PROCESSOR_ARCHITECTURE=x86
PROCESSOR_IDENTIFIER=x86 Family 15 Model 12 Stepping 0, AuthenticAMD
PROCESSOR_LEVEL=15
PROCESSOR_REVISION=0c00
ProgramFiles=C:\Program Files
PROMPT=$P$G
SESSIONNAME=Console
SystemDrive=C:
SystemRoot=C:\WINDOWS
TEMP=C:\DOCUME~1\Omistaja\LOCALS~1\Temp
TMP=C:\DOCUME~1\Omistaja\LOCALS~1\Temp
USERDOMAIN=TIETOKONE
USERNAME=Omistaja
USERPROFILE=C:\Documents and Settings\Omistaja
windir=C:\WINDOWS


-- User Profiles ---------------------------------------------------------------

Omistaja (admin)


-- Add/Remove Programs ---------------------------------------------------------

--> "E:\Program Files\F-Secure Internet Security\Uninstall\fsuninst.exe" /UninstRegKey:"F-Secure Anti-Spyware Scanner"
--> "E:\Program Files\F-Secure Internet Security\Uninstall\fsuninst.exe" /UninstRegKey:"F-Secure Anti-Spyware"
--> "E:\Program Files\F-Secure Internet Security\Uninstall\fsuninst.exe" /UninstRegKey:"F-Secure Anti-Virus Client Security Installer"
--> "E:\Program Files\F-Secure Internet Security\Uninstall\fsuninst.exe" /UninstRegKey:"F-Secure Anti-Virus"
--> "E:\Program Files\F-Secure Internet Security\Uninstall\fsuninst.exe" /UninstRegKey:"F-Secure Automatic Update Agent"
--> "E:\Program Files\F-Secure Internet Security\Uninstall\fsuninst.exe" /UninstRegKey:"F-Secure DAAS"
--> "E:\Program Files\F-Secure Internet Security\Uninstall\fsuninst.exe" /UninstRegKey:"F-Secure Diagnostics"
--> "E:\Program Files\F-Secure Internet Security\Uninstall\fsuninst.exe" /UninstRegKey:"F-Secure E-mail Scanning"
--> "E:\Program Files\F-Secure Internet Security\Uninstall\fsuninst.exe" /UninstRegKey:"F-Secure FWES"
--> "E:\Program Files\F-Secure Internet Security\Uninstall\fsuninst.exe" /UninstRegKey:"F-Secure GateKeeper Interface"
--> "E:\Program Files\F-Secure Internet Security\Uninstall\fsuninst.exe" /UninstRegKey:"F-Secure Gemini"
--> "E:\Program Files\F-Secure Internet Security\Uninstall\fsuninst.exe" /UninstRegKey:"F-Secure GUI"
--> "E:\Program Files\F-Secure Internet Security\Uninstall\fsuninst.exe" /UninstRegKey:"F-Secure Help"
--> "E:\Program Files\F-Secure Internet Security\Uninstall\fsuninst.exe" /UninstRegKey:"F-Secure HIPS"
--> "E:\Program Files\F-Secure Internet Security\Uninstall\fsuninst.exe" /UninstRegKey:"F-Secure Internet Shield"
--> "E:\Program Files\F-Secure Internet Security\Uninstall\fsuninst.exe" /UninstRegKey:"F-Secure Localization API"
--> "E:\Program Files\F-Secure Internet Security\Uninstall\fsuninst.exe" /UninstRegKey:"F-Secure Management Agent"
--> "E:\Program Files\F-Secure Internet Security\Uninstall\fsuninst.exe" /UninstRegKey:"F-Secure Pegasus Engine"
--> "E:\Program Files\F-Secure Internet Security\Uninstall\fsuninst.exe" /UninstRegKey:"F-Secure Protocol Scanner"
--> "E:\Program Files\F-Secure Internet Security\Uninstall\fsuninst.exe" /UninstRegKey:"F-Secure Spam Control"
--> "E:\Program Files\F-Secure Internet Security\Uninstall\fsuninst.exe" /UninstRegKey:"F-Secure Spam Scanner"
--> "E:\Program Files\F-Secure Internet Security\Uninstall\fsuninst.exe" /UninstRegKey:"F-Secure TNB"
--> "E:\Program Files\F-Secure Internet Security\Uninstall\fsuninst.exe" /UninstRegKey:"F-Secure Uninstall"
--> "E:\Program Files\F-Secure Internet Security\Uninstall\fsuninst.exe" /UninstRegKey:"News Service"
--> C:\WINDOWS\UNNeroBackItUp.exe /UNINSTALL
--> C:\WINDOWS\UNNeroMediaHome.exe /UNINSTALL
--> C:\WINDOWS\UNNeroShowTime.exe /UNINSTALL
--> C:\WINDOWS\UNNeroVision.exe /UNINSTALL
--> C:\WINDOWS\UNRecode.exe /UNINSTALL
--> E:\Program Files\Nero\Nero 7\\nero\uninstall\UNNERO.exe /UNINSTALL
--> rundll32.exe setupapi.dll,InstallHinfSection DefaultUninstall 132 C:\WINDOWS\INF\PCHealth.inf
Adobe Flash Player 9 ActiveX --> C:\WINDOWS\system32\Macromed\Flash\FlashUtil9c.exe -uninstallUnlock
Adobe Reader 8 - Suomi --> MsiExec.exe /I{AC76BA86-7AD7-1035-7B44-A80000000000}
AVG Anti-Spyware 7.5 --> E:\Program Files\Grisoft\AVG Anti-Spyware 7.5\Uninstall.exe
CCleaner (remove only) --> "E:\Program Files\CCleaner\uninst.exe"
Core Center --> C:\WINDOWS\IsUninst.exe -f"E:\Program Files\MSI\Core Center\Uninst.isu"
F-Secure Internet Security 2007 --> "E:\Program Files\F-Secure Internet Security\FSGUI\SetupGUIMngr.exe" /tUnInstall
ffdshow [rev 1133] [2007-05-04] --> "E:\Program Files\ffdshow\unins000.exe"
HijackThis 1.99.1 --> C:\hjt\HijackThis.exe /uninstall
Hotfix-päivitys Windows XP:lle (KB914440) --> "C:\WINDOWS\$NtUninstallKB914440$\spuninst\spuninst.exe"
Hotfix for Windows Media Format 11 SDK (KB929399) --> "C:\WINDOWS\$NtUninstallKB929399$\spuninst\spuninst.exe"
J2SE Runtime Environment 5.0 Update 9 --> MsiExec.exe /I{3248F0A8-6813-11D6-A77B-00B0D0150090}
Java(TM) SE Runtime Environment 6 Update 1 --> MsiExec.exe /I{3248F0A8-6813-11D6-A77B-00B0D0160010}
Microsoft Base Smart Card Cryptographic Service Provider Package --> "C:\WINDOWS\$NtUninstallbasecsp$\spuninst\spuninst.exe"
Microsoft Compression Client Pack 1.0 for Windows XP --> "C:\WINDOWS\$NtUninstallMSCompPackV1$\spuninst\spuninst.exe"
Microsoft Office Access MUI (Finnish) 2007 --> MsiExec.exe /X{90120000-0015-040B-0000-0000000FF1CE}
Microsoft Office Enterprise 2007 --> "C:\Program Files\Common Files\Microsoft Shared\OFFICE12\Office Setup Controller\setup.exe" /uninstall ENTERPRISE /dll OSETUP.DLL
Microsoft Office Enterprise 2007 --> MsiExec.exe /X{90120000-0030-0000-0000-0000000FF1CE}
Microsoft Office Excel MUI (Finnish) 2007 --> MsiExec.exe /X{90120000-0016-040B-0000-0000000FF1CE}
Microsoft Office Groove MUI (Finnish) 2007 --> MsiExec.exe /X{90120000-00BA-040B-0000-0000000FF1CE}
Microsoft Office InfoPath MUI (Finnish) 2007 --> MsiExec.exe /X{90120000-0044-040B-0000-0000000FF1CE}
Microsoft Office OneNote MUI (Finnish) 2007 --> MsiExec.exe /X{90120000-00A1-040B-0000-0000000FF1CE}
Microsoft Office Outlook MUI (Finnish) 2007 --> MsiExec.exe /X{90120000-001A-040B-0000-0000000FF1CE}
Microsoft Office PowerPoint MUI (Finnish) 2007 --> MsiExec.exe /X{90120000-0018-040B-0000-0000000FF1CE}
Microsoft Office Proof (English) 2007 --> MsiExec.exe /X{90120000-001F-0409-0000-0000000FF1CE}
Microsoft Office Proof (Finnish) 2007 --> MsiExec.exe /X{90120000-001F-040B-0000-0000000FF1CE}
Microsoft Office Proof (German) 2007 --> MsiExec.exe /X{90120000-001F-0407-0000-0000000FF1CE}
Microsoft Office Proof (Swedish) 2007 --> MsiExec.exe /X{90120000-001F-041D-0000-0000000FF1CE}
Microsoft Office Proofing (Finnish) 2007 --> MsiExec.exe /X{90120000-002C-040B-0000-0000000FF1CE}
Microsoft Office Publisher MUI (Finnish) 2007 --> MsiExec.exe /X{90120000-0019-040B-0000-0000000FF1CE}
Microsoft Office Shared MUI (Finnish) 2007 --> MsiExec.exe /X{90120000-006E-040B-0000-0000000FF1CE}
Microsoft Office Word MUI (Finnish) 2007 --> MsiExec.exe /X{90120000-001B-040B-0000-0000000FF1CE}
Microsoft User-Mode Driver Framework Feature Pack 1.0 --> "C:\WINDOWS\$NtUninstallWudf01000$\spuninst\spuninst.exe"
Mozilla Thunderbird (2.0.0.0) --> E:\Program Files\Mozilla Thunderbird\uninstall\helper.exe
MSI Live Update 3 --> C:\WINDOWS\IsUninst.exe -f"C:\Program Files\MSI\Live Update 3\Uninst.isu"
MSXML 6.0 Parser --> MsiExec.exe /I{A43BF6A5-D5F0-4AAA-BF41-65995063EC44}
Nero 7 Ultra Edition --> MsiExec.exe /I{4F2CE68F-EDBB-4592-BF07-5AC930A51035}
neroxml --> MsiExec.exe /I{56C049BE-79E9-4502-BEA7-9754A3E60F9B}
NVIDIA Drivers --> C:\WINDOWS\system32\nvudisp.exe UninstallGUI
Päivitys Windows XP:lle (KB894391) --> "C:\WINDOWS\$NtUninstallKB894391$\spuninst\spuninst.exe"
Päivitys Windows XP:lle (KB898461) --> "C:\WINDOWS\$NtUninstallKB898461$\spuninst\spuninst.exe"
Päivitys Windows XP:lle (KB900485) --> "C:\WINDOWS\$NtUninstallKB900485$\spuninst\spuninst.exe"
Päivitys Windows XP:lle (KB904942) --> "C:\WINDOWS\$NtUninstallKB904942$\spuninst\spuninst.exe"
Päivitys Windows XP:lle (KB908531) --> "C:\WINDOWS\$NtUninstallKB908531$\spuninst\spuninst.exe"
Päivitys Windows XP:lle (KB910437) --> "C:\WINDOWS\$NtUninstallKB910437$\spuninst\spuninst.exe"
Päivitys Windows XP:lle (KB911280) --> "C:\WINDOWS\$NtUninstallKB911280$\spuninst\spuninst.exe"
Päivitys Windows XP:lle (KB916595) --> "C:\WINDOWS\$NtUninstallKB916595$\spuninst\spuninst.exe"
Päivitys Windows XP:lle (KB920342) --> "C:\WINDOWS\$NtUninstallKB920342$\spuninst\spuninst.exe"
Päivitys Windows XP:lle (KB920872) --> "C:\WINDOWS\$NtUninstallKB920872$\spuninst\spuninst.exe"
Päivitys Windows XP:lle (KB922582) --> "C:\WINDOWS\$NtUninstallKB922582$\spuninst\spuninst.exe"
Päivitys Windows XP:lle (KB925720) --> "C:\WINDOWS\$NtUninstallKB925720$\spuninst\spuninst.exe"
Päivitys Windows XP:lle (KB925876) --> "C:\WINDOWS\$NtUninstallKB925876$\spuninst\spuninst.exe"
Päivitys Windows XP:lle (KB930916) --> "C:\WINDOWS\$NtUninstallKB930916$\spuninst\spuninst.exe"
Päivitys Windows XP:lle (KB931836) --> "C:\WINDOWS\$NtUninstallKB931836$\spuninst\spuninst.exe"
PowerDVD --> "C:\Program Files\InstallShield Installation Information\{6811CAA0-BF12-11D4-9EA1-0050BAE317E1}\Setup.exe" -l0x000409 /z-uninstall
Realtek AC'97 Audio --> RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\11\50\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{FB08F381-6533-4108-B7DD-039E11FBC27E}\Setup.exe" -l0xb -removeonly
RivaTuner v2.01 --> "E:\Program Files\RivaTuner v2.01\uninstall.exe"
Security Update for Excel 2007 (KB934670) --> msiexec /package {90120000-0030-0000-0000-0000000FF1CE} /uninstall {CD098537-8857-4065-B4B6-AC023CB2C48E}
Security Update for Office 2007 (KB934062) --> msiexec /package {90120000-0030-0000-0000-0000000FF1CE} /uninstall {305D509B-F194-4638-9F0F-D9E4C05F9D33}
Suojauspäivitys Windows XP:lle (KB890046) --> "C:\WINDOWS\$NtUninstallKB890046$\spuninst\spuninst.exe"
Suojauspäivitys Windows XP:lle (KB893756) --> "C:\WINDOWS\$NtUninstallKB893756$\spuninst\spuninst.exe"
Suojauspäivitys Windows XP:lle (KB896358) --> "C:\WINDOWS\$NtUninstallKB896358$\spuninst\spuninst.exe"
Suojauspäivitys Windows XP:lle (KB896423) --> "C:\WINDOWS\$NtUninstallKB896423$\spuninst\spuninst.exe"
Suojauspäivitys Windows XP:lle (KB896428) --> "C:\WINDOWS\$NtUninstallKB896428$\spuninst\spuninst.exe"
Suojauspäivitys Windows XP:lle (KB899587) --> "C:\WINDOWS\$NtUninstallKB899587$\spuninst\spuninst.exe"
Suojauspäivitys Windows XP:lle (KB899591) --> "C:\WINDOWS\$NtUninstallKB899591$\spuninst\spuninst.exe"
Suojauspäivitys Windows XP:lle (KB900725) --> "C:\WINDOWS\$NtUninstallKB900725$\spuninst\spuninst.exe"
Suojauspäivitys Windows XP:lle (KB901017) --> "C:\WINDOWS\$NtUninstallKB901017$\spuninst\spuninst.exe"
Suojauspäivitys Windows XP:lle (KB901214) --> "C:\WINDOWS\$NtUninstallKB901214$\spuninst\spuninst.exe"
Suojauspäivitys Windows XP:lle (KB902400) --> "C:\WINDOWS\$NtUninstallKB902400$\spuninst\spuninst.exe"
Suojauspäivitys Windows XP:lle (KB904706) --> "C:\WINDOWS\$NtUninstallKB904706$\spuninst\spuninst.exe"
Suojauspäivitys Windows XP:lle (KB905414) --> "C:\WINDOWS\$NtUninstallKB905414$\spuninst\spuninst.exe"
Suojauspäivitys Windows XP:lle (KB905749) --> "C:\WINDOWS\$NtUninstallKB905749$\spuninst\spuninst.exe"
Suojauspäivitys Windows XP:lle (KB908519) --> "C:\WINDOWS\$NtUninstallKB908519$\spuninst\spuninst.exe"
Suojauspäivitys Windows XP:lle (KB911562) --> "C:\WINDOWS\$NtUninstallKB911562$\spuninst\spuninst.exe"
Suojauspäivitys Windows XP:lle (KB911927) --> "C:\WINDOWS\$NtUninstallKB911927$\spuninst\spuninst.exe"
Suojauspäivitys Windows XP:lle (KB913580) --> "C:\WINDOWS\$NtUninstallKB913580$\spuninst\spuninst.exe"
Suojauspäivitys Windows XP:lle (KB914388) --> "C:\WINDOWS\$NtUninstallKB914388$\spuninst\spuninst.exe"
Suojauspäivitys Windows XP:lle (KB914389) --> "C:\WINDOWS\$NtUninstallKB914389$\spuninst\spuninst.exe"
Suojauspäivitys Windows XP:lle (KB917422) --> "C:\WINDOWS\$NtUninstallKB917422$\spuninst\spuninst.exe"
Suojauspäivitys Windows XP:lle (KB917953) --> "C:\WINDOWS\$NtUninstallKB917953$\spuninst\spuninst.exe"
Suojauspäivitys Windows XP:lle (KB918118) --> "C:\WINDOWS\$NtUninstallKB918118$\spuninst\spuninst.exe"
Suojauspäivitys Windows XP:lle (KB918439) --> "C:\WINDOWS\$NtUninstallKB918439$\spuninst\spuninst.exe"
Suojauspäivitys Windows XP:lle (KB919007) --> "C:\WINDOWS\$NtUninstallKB919007$\spuninst\spuninst.exe"
Suojauspäivitys Windows XP:lle (KB920213) --> "C:\WINDOWS\$NtUninstallKB920213$\spuninst\spuninst.exe"
Suojauspäivitys Windows XP:lle (KB920670) --> "C:\WINDOWS\$NtUninstallKB920670$\spuninst\spuninst.exe"
Suojauspäivitys Windows XP:lle (KB920683) --> "C:\WINDOWS\$NtUninstallKB920683$\spuninst\spuninst.exe"
Suojauspäivitys Windows XP:lle (KB920685) --> "C:\WINDOWS\$NtUninstallKB920685$\spuninst\spuninst.exe"
Suojauspäivitys Windows XP:lle (KB922819) --> "C:\WINDOWS\$NtUninstallKB922819$\spuninst\spuninst.exe"
Suojauspäivitys Windows XP:lle (KB923191) --> "C:\WINDOWS\$NtUninstallKB923191$\spuninst\spuninst.exe"
Suojauspäivitys Windows XP:lle (KB923414) --> "C:\WINDOWS\$NtUninstallKB923414$\spuninst\spuninst.exe"
Suojauspäivitys Windows XP:lle (KB923694) --> "C:\WINDOWS\$NtUninstallKB923694$\spuninst\spuninst.exe"
Suojauspäivitys Windows XP:lle (KB923789) --> C:\WINDOWS\system32\MacroMed\Flash\genuinst.exe C:\WINDOWS\system32\MacroMed\Flash\KB923789.inf
Suojauspäivitys Windows XP:lle (KB923980) --> "C:\WINDOWS\$NtUninstallKB923980$\spuninst\spuninst.exe"
Suojauspäivitys Windows XP:lle (KB924191) --> "C:\WINDOWS\$NtUninstallKB924191$\spuninst\spuninst.exe"
Suojauspäivitys Windows XP:lle (KB924270) --> "C:\WINDOWS\$NtUninstallKB924270$\spuninst\spuninst.exe"
Suojauspäivitys Windows XP:lle (KB924667) --> "C:\WINDOWS\$NtUninstallKB924667$\spuninst\spuninst.exe"
Suojauspäivitys Windows XP:lle (KB925902) --> "C:\WINDOWS\$NtUninstallKB925902$\spuninst\spuninst.exe"
Suojauspäivitys Windows XP:lle (KB926255) --> "C:\WINDOWS\$NtUninstallKB926255$\spuninst\spuninst.exe"
Suojauspäivitys Windows XP:lle (KB926436) --> "C:\WINDOWS\$NtUninstallKB926436$\spuninst\spuninst.exe"
Suojauspäivitys Windows XP:lle (KB927779) --> "C:\WINDOWS\$NtUninstallKB927779$\spuninst\spuninst.exe"
Suojauspäivitys Windows XP:lle (KB927802) --> "C:\WINDOWS\$NtUninstallKB927802$\spuninst\spuninst.exe"
Suojauspäivitys Windows XP:lle (KB928255) --> "C:\WINDOWS\$NtUninstallKB928255$\spuninst\spuninst.exe"
Suojauspäivitys Windows XP:lle (KB928843) --> "C:\WINDOWS\$NtUninstallKB928843$\spuninst\spuninst.exe"
Suojauspäivitys Windows XP:lle (KB930178) --> "C:\WINDOWS\$NtUninstallKB930178$\spuninst\spuninst.exe"
Suojauspäivitys Windows XP:lle (KB931261) --> "C:\WINDOWS\$NtUninstallKB931261$\spuninst\spuninst.exe"
Suojauspäivitys Windows XP:lle (KB931784) --> "C:\WINDOWS\$NtUninstallKB931784$\spuninst\spuninst.exe"
Suojauspäivitys Windows XP:lle (KB932168) --> "C:\WINDOWS\$NtUninstallKB932168$\spuninst\spuninst.exe"
Update for Office 2007 (KB932080) --> msiexec /package {90120000-0030-0000-0000-0000000FF1CE} /uninstall {EDC9CA29-6BC1-471C-828C-7A36109005D7}
Update for Office 2007 (KB933688) --> msiexec /package {90120000-0030-0000-0000-0000000FF1CE} /uninstall {F6E692F1-63C2-4760-94C6-C689DCD053F1}
Update for Office 2007 (KB934393) --> msiexec /package {90120000-0030-0000-0000-0000000FF1CE} /uninstall {92FBAD46-E7F6-49FA-89B5-C39FC5BFAD15}
Update for Outlook 2007 Junk Email Filter (KB934655) --> msiexec /package {90120000-0030-0000-0000-0000000FF1CE} /uninstall {F7185592-E40D-476E-9BC4-38DF96EE176B}
Update for Word 2007 (KB934173) --> msiexec /package {90120000-0030-0000-0000-0000000FF1CE} /uninstall {C6A89125-5473-45E3-B413-ED8186437475}
VIA Ohjelmistoalustan laitehallinta --> C:\PROGRA~1\COMMON~1\INSTAL~1\Driver\7\INTEL3~1\IDriver.exe /M{20D4A895-748C-4D88-871C-FDB1695B0169}
Windows Communication Foundation --> MsiExec.exe /X{491DD792-AD81-429C-9EB4-86DD3D22E333}
Windows Imaging Component --> "C:\WINDOWS\$NtUninstallWIC$\spuninst\spuninst.exe"
Windows Live Messenger --> MsiExec.exe /I{DF6FEB75-A0D1-44E5-A754-0072D4967734}
Windows Media Format 11 runtime --> "C:\WINDOWS\$NtUninstallWMFDist11$\spuninst\spuninst.exe"
Windows Presentation Foundation --> MsiExec.exe /X{BAF78226-3200-4DB4-BE33-4D922A799840}
Windows Presentation Foundation Language Pack (FIN) --> MsiExec.exe /X{935FADCB-C25B-4F62-B9B4-F22C40431642}
Windows Workflow Foundation --> MsiExec.exe /I{7D1B85BD-AA07-48B8-808D-67A4067FC6BD}
Windows Workflow Foundation FI Language Pack --> MsiExec.exe /I{8E5D0B52-BB72-46C6-8AB8-2B041D959594}
WinRAR archiver --> E:\Program Files\WinRAR\uninstall.exe
XML Paper Specification Shared Components Language Pack 1.0 --> "C:\WINDOWS\$NtUninstallXPSEPSCLP$\spuninst\spuninst.exe"
XML Paper Specification Shared Components Pack 1.0 -->


-- End of Deckard's System Scanner: finished at 2007-05-10 at 14:32:34 ---------
-----------------------------------------------------------------------------------------------------------------------------------------------
Logfile of HijackThis v1.99.1
Scan saved at 14:42:07, on 10.5.2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16441)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\RUNDLL32.EXE
E:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe
E:\Program Files\CyberLink\PowerDVD\PDVDServ.exe
C:\WINDOWS\SOUNDMAN.EXE
E:\Program Files\Java\jre1.6.0_01\bin\jusched.exe
E:\Program Files\F-Secure Internet Security\Common\FSM32.EXE
C:\WINDOWS\system32\ctfmon.exe
E:\Program Files\DAEMON Tools\daemon.exe
E:\Program Files\MSI\Core Center\CoreCenter.exe
E:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
E:\Program Files\F-Secure Internet Security\Anti-Virus\fsgk32st.exe
E:\Program Files\F-Secure Internet Security\Anti-Virus\FSGK32.EXE
E:\Program Files\F-Secure Internet Security\Common\FSMA32.EXE
C:\WINDOWS\system32\nvsvc32.exe
C:\Program Files\Cyberlink\Shared files\RichVideo.exe
C:\WINDOWS\system32\svchost.exe
E:\Program Files\F-Secure Internet Security\Common\FSMB32.EXE
E:\Program Files\F-Secure Internet Security\Common\FCH32.EXE
E:\Program Files\F-Secure Internet Security\Anti-Virus\fsqh.exe
E:\Program Files\F-Secure Internet Security\Common\FAMEH32.EXE
E:\Program Files\F-Secure Internet Security\Anti-Virus\fssm32.exe
E:\Program Files\F-Secure Internet Security\FSAUA\program\fsaua.exe
E:\Program Files\F-Secure Internet Security\FWES\Program\fsdfwd.exe
E:\Program Files\F-Secure Internet Security\Anti-Virus\fsav32.exe
E:\Program Files\F-Secure Internet Security\FSGUI\fsguidll.exe
E:\Program Files\Microsoft Office\Office12\WINWORD.EXE
C:\Program Files\Internet Explorer\iexplore.exe
E:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe
C:\hjt\scanner.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.fi/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Linkit
O2 - BHO: Adobe PDF Reader -linkkiavustaja - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - E:\PROGRA~1\MICROS~1\Office12\GRA8E1~1.DLL
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - E:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O4 - HKLM\..\Run: [PtiuPbmd] Rundll32.exe ptipbm.dll,SetWriteBack
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [GrooveMonitor] "E:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe"
O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe
O4 - HKLM\..\Run: [RemoteControl] "E:\Program Files\CyberLink\PowerDVD\PDVDServ.exe"
O4 - HKLM\..\Run: [LanguageShortcut] "E:\Program Files\CyberLink\PowerDVD\Language\Language.exe"
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [SunJavaUpdateSched] "E:\Program Files\Java\jre1.6.0_01\bin\jusched.exe"
O4 - HKLM\..\Run: [F-Secure Manager] "E:\Program Files\F-Secure Internet Security\Common\FSM32.EXE" /splash
O4 - HKLM\..\Run: [F-Secure TNB] "E:\Program Files\F-Secure Internet Security\FSGUI\TNBUtil.exe" /CHECKALL /WAITFORSW
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [DAEMON Tools] "E:\Program Files\DAEMON Tools\daemon.exe" -lang 1033
O4 - Global Startup: Adobe Reader Speed Launch.lnk = E:\Program Files\Adobe\Reader 8.0\Reader\reader_sl.exe
O4 - Global Startup: Adobe Reader Synchronizer.lnk = E:\Program Files\Adobe\Reader 8.0\Reader\AdobeCollabSync.exe
O4 - Global Startup: CoreCenter.lnk = E:\Program Files\MSI\Core Center\CoreCenter.exe
O8 - Extra context menu item: V&ie Microsoft Exceliin - res://E:\PROGRA~1\MICROS~1\Office12\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - E:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - E:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O9 - Extra button: Lähetä OneNoteen - {2670000A-7350-4f3c-8081-5663EE0C6C49} - E:\PROGRA~1\MICROS~1\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: Läh&etä OneNoteen - {2670000A-7350-4f3c-8081-5663EE0C6C49} - E:\PROGRA~1\MICROS~1\Office12\ONBttnIE.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - E:\PROGRA~1\MICROS~1\Office12\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O10 - Unknown file in Winsock LSP: e:\program files\f-secure internet security\fsps\program\fslsp.dll
O10 - Unknown file in Winsock LSP: e:\program files\f-secure internet security\fsps\program\fslsp.dll
O10 - Unknown file in Winsock LSP: e:\program files\f-secure internet security\fsps\program\fslsp.dll
O10 - Unknown file in Winsock LSP: e:\program files\f-secure internet security\fsps\program\fslsp.dll
O10 - Unknown file in Winsock LSP: e:\program files\f-secure internet security\fsps\program\fslsp.dll
O10 - Unknown file in Winsock LSP: e:\program files\f-secure internet security\fsps\program\fslsp.dll
O10 - Unknown file in Winsock LSP: e:\program files\f-secure internet security\fsps\program\fslsp.dll
O10 - Unknown file in Winsock LSP: e:\program files\f-secure internet security\fsps\program\fslsp.dll
O10 - Unknown file in Winsock LSP: e:\program files\f-secure internet security\fsps\program\fslsp.dll
O10 - Unknown file in Winsock LSP: e:\program files\f-secure internet security\fsps\program\fslsp.dll
O10 - Unknown file in Winsock LSP: e:\program files\f-secure internet security\fsps\program\fslsp.dll
O10 - Unknown file in Winsock LSP: e:\program files\f-secure internet security\fsps\program\fslsp.dll
O11 - Options group: [INTERNATIONAL] International*
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupd...b?1178651981453
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/sh...ash/swflash.cab
O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - E:\PROGRA~1\MICROS~1\Office12\GR99D3~1.DLL
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Protocol: ms-help - {314111C7-A502-11D2-BBCA-00C04F8EC294} - C:\Program Files\Common Files\Microsoft Shared\Help\hxds.dll
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Filter hijack: text/xml - {807563E5-5146-11D5-A672-00B0D022E945} - C:\PROGRA~1\COMMON~1\MICROS~1\OFFICE12\MSOXMLMF.DLL
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
O23 - Service: AVG Anti-Spyware Guard - Anti-Malware Development a.s. - E:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: FSGKHS (F-Secure Gatekeeper Handler Starter) - F-Secure Corporation - E:\Program Files\F-Secure Internet Security\Anti-Virus\fsgk32st.exe
O23 - Service: F-Secure Automatic Update Agent (FSAUA) - F-Secure Corporation - E:\Program Files\F-Secure Internet Security\FSAUA\program\fsaua.exe
O23 - Service: F-Secure Anti-Virus Firewall Daemon (FSDFWD) - F-Secure Corporation - E:\Program Files\F-Secure Internet Security\FWES\Program\fsdfwd.exe
O23 - Service: F-Secure Management Agent (FSMA) - F-Secure Corporation - E:\Program Files\F-Secure Internet Security\Common\FSMA32.EXE
O23 - Service: NBService - Nero AG - E:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe
O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - C:\Program Files\Cyberlink\Shared files\RichVideo.exe

Ok. Siinä olis taas vähän listaa?

ääh, ei noista oikein auennu mitään varmaa

Lataa Dr.Web CureIt työpöydälle:
ftp://ftp.drweb.com/pub/drweb/cureit/drweb-cureit.exe

[*]Tuplaklikkaa drweb-cureit.exe ja anna sen tehdä express scan
[*]Se skannaa käynnissä olevat ohjelmat ja jos jotain löytyy, klikkaa yes kun se kysyy haluatko poistaa sen. Tämä on vain lyhyt scan.
[*]Kun scan on valmis, merkkaa asemat, jotka haluat scannata.
[*]Valitse kaikki asemat. Punainen piste osoittaa, mitkä asemat on valittu.
[*]Klikaa vihreää nuolta oikealla ja scan alkaa.
[*]Klikkaa 'Yes to all', jos kysytään haluatko poistaa/siirtää tiedoston.
[*]Kun scan on valmis, katso voitko klikata next-kuvaketta löytyneiden tiedostojen vieressä:

[*]Jos asia on niin, klikkaa sitä ja sitten klikkaa next-kuvaketta oikealla alhaalla ja valitse Move incurable kuten alla olevalla kuvassa:


Tämä siirtää sen %userprofile%\DoctorWeb\quarantine-hakemistoon.
[*]Tämän jälkeen klikkaa Dr.Web CureIt-valikossa file ja valitse save report list
[*]Tallenna raportti työpöydälle. Raportin nimi on DrWeb.csv
[*]Sulje Dr.Web Cureit.
[*]Käynnistä kone uudelleen !! Tämä siksi, että käytössä olevat tiedostot poistetaan/siirretään käynnistyksen yhteydessä.
[*]Käynnistyksen jälkeen liitä Dr.Web-lokin, jonka tallensit aiemmin, sisältö seuraavaan vastaukseesi.

Dr.Web Cure It skannaus - No Viruses found, joten ei lokia.


Olen asentanut windowsin puhtaasti uudelleen viimeksi 8.5.2007 joten tuntuisikin aika ihmeelliseltä että tää kone olis oikein saastunut. Nää verkkoympäristökansiot ilmestyivät siis 1. kerran jo ennen uudelleenasennusta. Ja uudelleenasennuksen jälkeen ne ilmestyivät samana päivänä mutta eivät heti asennuksen jälkeen?!? Voisikohan tässä olla jokin hässä esim. laajakaistapalveluntarjoajan osalta siten, että olen jossain samassa ?työryhmässä? muiden tietokoneiden kanssa? Koska aikaisemmin ei ole ollut mitään verkkoympäristökuvakettakaan käynnistä-valikossa ja nytkin se tuli sinne vasta asennuksen jälkeen?ei siis heti. Itse saan tästä sen verran tolkkua että Microsoft Windows Networkin alla on useita työryhmiä näkyvissä..työryhmässä Mshome on useita tietokoneita( kaikki nimeltään jotenkin suomenruotsalaisia..joten tuntuis että aivan tästä lähialueelta?!?...Tässä työryhmässä on tietokone/palvelin nimeltään Yeah (Finnholm), jonka 4 kansiota näkyy siis verkkoympäristö kuvakketta klikatessa( ovatko ehkä jotenkin jaossa?). Lisäksi tän tietokoneen tulostin näkyy minulla.. Voisinkohan ehkä jotenkin poistaa tän microsoft windows network-systeemin ilman että oma nettiyhteys lakkaa toimimasta. Itselläni ei siis oo mitään kotiverkkoakaan tai muuta sellasta. langattomia laitteitakaan mulla ei ole. mut anyway , kiitti sulle ku viitit autella!

Edit. edelliseen . Kokeilin poistaa ne kansiot ja otin verkkoyhteydet asetuksista täpin pois kohdasta tiedostojen ja tulostimien jakaminen microsoft-verkoissa. Käynnistin sitten myllyn uudestaan ja verkkoympäristö kuvake oli hävinnyt käynnistä-valikosta...Lisäksi muita tietokoneita ei löytynyt enää Mshome-verkosta ..joten hmm. kai täs vaan pitää seurata tilannetta. Olis kiva vaan tietää kuuluko täs mun verkossa olla muka muita koneita tolleen...

ok, puhtaaltahan näyttää, googlaamalla löytyy tuosta kansiosta lisäasiaa ;)

Pysy puhtaana

-> Tyhjennä järjestelmänpalautus Ohjeet
Tyhjennä järjestelmänpalautuskansio ja luo uusi palautuspiste. Tämä puhdistaa palautuskansion mahdollisista haittaohjelmajäännöksistä.

-> Käytä CCleaneria -> CCleaner
Lataa ja asenna CCleaner. Puhdista väliaikaistiedostot ja -kansiot ohjelmalla säännöllisesti.

-> Asenna SpywareBlaster -> SpywareBlaster
SpywareBlaster estää haittaohjelmia asentumasta koneellesi. Ei kuluta muistia!
Opas saatavilla suomeksi! Nimimerkki Ad-Awaren opas

-> Asenna MVPS Hosts tiedosto -> MVPS Hosts
Estää koneesi yhteyden haitallisiin sivustoihin.
Opas saatavilla suomeksi! Nimimerkki Axelin opas

-> Vaihda selaimesi Firefoxiin -> Firefox
Firefox on nopeampi, turvallisempi ja parempi selain kuin Internet Explorer.

-> Pidä järjestelmäsi ajantasalla. -> Windows Update
Vieraile Windows Updatessa säännöllisesti.

-> Pidä palomuuri ja virustorjunta ajantasalla
Päivitä ja skannaa koneesi säännöllisesti virustorjuntaohjelmallasi.
ja hyvä myös escan http://koti.mbnet.fi/pattaya1/escanmwav.htm

->Pidä ohjelmistosi ajantasalla. -> Secunia Software Inspector
Secunia Software Inspector tutkii sinun järjestälmäsi ja ohjelmistosi puuttuvien turvallisuuspäivityksien osalta. Tavallinen tutkinta kestää normaalisti 5-40 sekuntia, kun läpikotainen (thorough system inspection) voi kestää useita minuutteja.

->Seuraa säännöllisesti viestintäviraston tietoja uusista haavoittuvuuksista -> CERT-FI

Todennäköisesti palveluntarjoajasi verkossa on muita koneita joilla ei ole suojaukset kohdallaan ja tiedostojen jako on avoin kaikille. Koneesi löytää ne koneet automaattisesti ja lisää verkkoympäristöösi.