AfterDawn.com Mainosta sivuillamme
User Käyttäjä Salasana  
  Puuttuuko tunnus? Liity jäseneksi nyt!.
Salasana hukassa? Klikkaa tästä. 		 
  Etusivu   Uutiset   Oppaat   Ohjelmat   Sanasto   Laitevertailu   Profiilit   Keskustelu  
 Yksityisviestit     Luo uusi yksityisviesti     Kaikki uudet viestit     Ilman vastauksia olevat viestiketjut     Hae viestejä
maanantai 13.1.2025 / 16:33
Hae keskustelualueilta:        In English   Suomeksi   På svenska
afterdawn.com > keskustelu > yleistä keskustelua tietokoneista > virukset ja haittaohjelmat > mesevirus.... saanko apuu tähä noita pomppii jatkuvasti taas!
Näytä aiheet
 
Keskustelualueet
Keskustelualueet
mesevirus.... saanko apuu tähä noita pomppii jatkuvasti taas!
  Siirry:
 
Kirjoittaja Viesti
Sivu:12>
krizu7
Junior Member
_ 		17. syyskuuta 2008 @ 20:57 _ Linkki tähän viestiin    Lähetä käyttäjälle yksityisviesti   
noniin nyt tartteis taas apuu... mesen kautta on nyt käyny silleen että jotkut mun yhteystiedoista lähettelee sontaa tyyliin: Hello Krizu .....
I cant get my msn to stay connected for some reason!
I am always online here http://MalloryAbelnqrg.blogspot.com

Hope to hear from you

Kelly

tollasta paskaa.... ja sitten jotkut ihme tyypit lisäilee mua ja kirjottaa samaa skeidaa... muutamia osoitteita: karadonaldsonqvyb@hotmail.com
chaiyasan00952@live.com

miten ton viruksen saa pois jos se sellainen on auttakaaaa
[ + lainaa]
Hujo
Suspended permanently
_ 		17. syyskuuta 2008 @ 23:56 _ Linkki tähän viestiin    Lähetä käyttäjälle yksityisviesti   
Lataa TÄSTÄ HJTInstall.exe

* Tallenna HJTInstall.exe työpöydällesi.
* Tuplaklikkaa HJTInstall.exe-kuvaketta työpöydälläsi.
* Oletuksena se asentaa itsensä hakemistoon C:\Program Files\Trend Micro\HijackThis.
* Klikkaa Install.
* Asennusohjelma luo HijackThis-kuvakkeen työpöydälle.
* Kun asennus on valmis, se käynnistää HijackThisin.
* Klikkaa Do a system scan and save a logfile-painiketta. Ohjelma aloittaa skannauksen ja lokin pitäisi avautua Muistioon.
* Klikkaa ensin "Muokkaa > Valitse kaikki" sitten "Muokkaa > Kopioi" kopioidaksesi koko lokin sisällön.
* Liitä lokin sisältö seuraavaan vastaukseesi.
* ÄLÄ käytä Analyse This-nappulaa, sen löydöt ovat vaarallisia väärinymmärrettyinä.
* ÄLÄ fixaa HijackThis-ohjelmalla vielä mitään. Suurin osa sen löydöistä ovat joko harmittomia tai jopa tarpeellisia.

[ + lainaa]
Voiko tietsikka koskaan toimia?
krizu7
Junior Member
_ 		18. syyskuuta 2008 @ 17:57 _ Linkki tähän viestiin    Lähetä käyttäjälle yksityisviesti   
okei täs loki:

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 17:54:54, on 18.9.2008
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16705)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Windows Defender\MsMpEng.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\WINDOWS\system32\drivers\CDAC11BA.EXE
C:\Program Files\Microsoft SQL Server\MSSQL$PINNACLESYS\Binn\sqlservr.exe
C:\Program Files\CDBurnerXP\NMSAccessU.exe
C:\WINDOWS\system32\tcpsvcs.exe
C:\WINDOWS\System32\snmp.exe
c:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\Fast.exe
c:\program files\pinnacle\shared files\programs\mediaserver\pmshost.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\taskswitch.exe
C:\Program Files\Elisa\Avustaja\Elisa.exe
C:\Program Files\ScanSoft\PaperPort\pptd40nt.exe
C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\Program Files\QuickTime\qttask.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\Program Files\Vista Rainbar\Rainmeter.exe
C:\program files\steam\steam.exe
C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe
C:\Program Files\WinFlip\WinFlip.exe
C:\Program Files\Windows Live\Messenger\usnsvc.exe
C:\Program Files\internet explorer\iexplore.exe
C:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\infocard.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.fi/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\3.1.807.1746\swg.dll
O2 - BHO: Mega Manager IE Click Monitor - {bf00e119-21a3-4fd1-b178-3b8537e75c92} - C:\Program Files\Megaupload\Mega Manager\MegaIEMn.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll
O4 - HKLM\..\Run: [BackgroundSwitcher] C:\WINDOWS\system32\bgswitch.exe
O4 - HKLM\..\Run: [CoolSwitch] C:\WINDOWS\system32\taskswitch.exe
O4 - HKLM\..\Run: [Elisa Avustaja] "C:\Program Files\Elisa\Avustaja\Elisa.exe"
O4 - HKLM\..\Run: [PaperPort PTD] "C:\Program Files\ScanSoft\PaperPort\pptd40nt.exe"
O4 - HKLM\..\Run: [IndexSearch] "C:\Program Files\ScanSoft\PaperPort\IndexSearch.exe"
O4 - HKLM\..\Run: [PinnacleDriverCheck] C:\WINDOWS\system32\PSDrvCheck.exe -CheckReg
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe"
O4 - HKLM\..\Run: [SSBkgdUpdate] "C:\Program Files\Common Files\Scansoft Shared\SSBkgdUpdate\SSBkgdupdate.exe" -Embedding -boot
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [Vista Rainbar] C:\Program Files\Vista Rainbar\Rainmeter.exe
O4 - HKCU\..\Run: [Steam] "c:\program files\steam\steam.exe" -silent
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Verkkopalve')
O4 - HKUS\S-1-5-21-2725322363-1733914780-3910736086-1003\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe (User 'Omistaja')
O4 - HKUS\S-1-5-18\..\Run: [DWQueuedReporting] "C:\PROGRA~1\COMMON~1\MICROS~1\DW\dwtrig20.exe" -t (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [DWQueuedReporting] "C:\PROGRA~1\COMMON~1\MICROS~1\DW\dwtrig20.exe" -t (User 'Default user')
O4 - Startup: Microsoft Office OneNote 2003 Quick Launch.lnk = C:\Program Files\Microsoft Office\OFFICE11\ONENOTEM.EXE
O4 - Startup: WinFlip.lnk = C:\Program Files\WinFlip\WinFlip.exe
O8 - Extra context menu item: &Windows Live Search - res://C:\Program Files\Windows Live Toolbar\msntb.dll/search.htm
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~4\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: Latauslinkki käyttäen Mega Manageria... - C:\Program Files\Megaupload\Mega Manager\mm_file.htm
O8 - Extra context menu item: Open Picture in &Microsoft PhotoDraw - res://C:\PROGRA~1\MICROS~4\Office\1033\phdintl.dll/phdContext.htm
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~4\OFFICE11\REFIEBAR.DLL
O16 - DPF: {1E54D648-B804-468d-BC78-4AFFED8E262E} (System Requirements Lab) - http://www.srtest.com/srl_bin/sysreqlab3.cab
O16 - DPF: {20A60F0D-9AFA-4515-A0FD-83BD84642501} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab56986.cab
O16 - DPF: {5C051655-FCD5-4969-9182-770EA5AA5565} (Solitaire Showdown Class) - http://messenger.zone.msn.com/binary/Sol...wn.cab56986.cab
O16 - DPF: {5ED80217-570B-4DA9-BF44-BE107C0EC166} (Windows Live Safety Center Base Module) - http://cdn.scan.onecare.live.com/resourc...lscbase5036.cab
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupd...b?1170431845328
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (MSN Games - Installer) - http://messenger.zone.msn.com/binary/ZIntro.cab56649.cab
O16 - DPF: {BDBDE413-7B1C-4C68-A8FF-C5B2B4090876} (F-Secure Online Scanner 3.3) - http://support.f-secure.com/ols/fscax.cab
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/Mes...nt.cab56907.cab
O16 - DPF: {F5A7706B-B9C0-4C89-A715-7A0C6B05DD48} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineSweeper.cab56986.cab
O23 - Service: Lavasoft Ad-Aware Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: C-DillaCdaC11BA - Macrovision - C:\WINDOWS\system32\drivers\CDAC11BA.EXE
O23 - Service: Pinnacle Systems tvtv Spooler (EpgSpooler) - - c:\progra~1\pinnacle\mediac~1\epgspo~2.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPod-palvelu (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: NMSAccessU - Unknown owner - C:\Program Files\CDBurnerXP\NMSAccessU.exe
O23 - Service: Pinnacle Systems Media Service (PinnacleSys.MediaServer) - Pinnacle Systems - c:\program files\pinnacle\shared files\programs\mediaserver\pmshost.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: TuneUp Drive Defrag Service (TuneUp.Defrag) - TuneUp Software GmbH - C:\WINDOWS\System32\TuneUpDefragService.exe
O23 - Service: TuneUp WinStyler Theme Service (TUWinStylerThemeSvc) - Unknown owner - C:\Program Files\TuneUp WinStyler\WinStylerThemeSvc.exe (file missing)

--
End of file - 9151 bytes
[ + lainaa]
Hujo
Suspended permanently
_ 		18. syyskuuta 2008 @ 19:12 _ Linkki tähän viestiin    Lähetä käyttäjälle yksityisviesti   
1.Lataa combofix.exe työpöydällesi yhdestä linkistä:
combofix1
combofix2

2. Tuplaklikkaa combofix.exe tiedostoa ja seuraa ohjeistuksia.
3. Kun työkalu on valmis, se tuottaa lokin. Lähetä tämä loki viesti ketjuusi.
Huom! Älä klikkaile combofixin ikkunaa käytön aikana. Tämä saattaa aiheuttaa ohjelman jumiutumisen.

[ + lainaa]
Voiko tietsikka koskaan toimia?
krizu7
Junior Member
_ 		18. syyskuuta 2008 @ 19:55 _ Linkki tähän viestiin    Lähetä käyttäjälle yksityisviesti   
combofix loki...

ComboFix 08-09-16.05 - Kristian 2008-09-18 19:39:59.5 - NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1035.18.506 [GMT 3:00]
Sijainti: C:\Documents and Settings\Kristian\Omat tiedostot\viruspoisto\ComboFix.exe
* Uusi palautuspiste luotu

VAROITUS - PALAUTUSKONSOLIA EI OLE ASENNETTU !!
.
/wow section - STAGE 8
Pyydettyä toimintoa ei voi suorittaa tiedostolle, jonka käyttäjän yhdistämä osa on avoinna.


(((((((((((((((((((((((((((((((((((((( Muut poistot ))))))))))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\Documents and Settings\Kristian\Cookies\kristian@ad.yieldmanager[1].txt
C:\Documents and Settings\Kristian\Cookies\kristian@clicktorrent[2].txt
C:\Documents and Settings\Kristian\Cookies\kristian@specificclick[1].txt
C:\Documents and Settings\Kristian\Cookies\kristian@youtube[1].txt

.
((((( Tiedostot, jotka on luotu seuraavalla aikavälillä: 2008-08-18 to 2008-09-18 )))))))))))))))))
.

2008-09-15 18:44 . 2008-09-18 18:37 54,156 --ah----- C:\WINDOWS\QTFont.qfn
2008-09-15 18:44 . 2008-09-15 18:44 1,409 --a------ C:\WINDOWS\QTFont.for
2008-09-15 17:48 . 2008-09-15 17:48 <KANSIO> d-------- C:\Program Files\VALVe
2008-09-12 20:15 . 2008-09-12 20:15 <KANSIO> dr------- C:\Documents and Settings\Kristian\Application Data\Brother
2008-09-12 20:10 . 2008-09-12 20:10 <KANSIO> d-------- C:\Documents and Settings\Kristian\Application Data\ScanSoft
2008-09-12 18:59 . 2008-09-12 18:59 <KANSIO> d-------- C:\Documents and Settings\Kristian\Application Data\Windows Search
2008-09-12 18:43 . 2008-09-18 17:45 <KANSIO> d-------- C:\Program Files\Steam
2008-09-10 20:11 . 2008-09-10 20:11 <KANSIO> d-------- C:\Program Files\WMV9_VCM
2008-09-10 20:11 . 2008-09-10 20:11 <KANSIO> d-------- C:\Documents and Settings\Kristian\Application Data\MAGIX
2008-09-10 20:11 . 2008-09-10 20:11 <KANSIO> d-------- C:\Documents and Settings\All Users\Application Data\MAGIX
2008-09-10 20:10 . 2008-09-10 20:10 <KANSIO> d-------- C:\Documents and Settings\All Users\Application Data\Xara
2008-09-10 20:10 . 2007-04-27 10:43 120,200 --a------ C:\WINDOWS\system32\DLLDEV32i.dll
2008-09-10 19:25 . 2008-09-10 20:11 <KANSIO> d-------- C:\Program Files\Common Files\Xara
2008-09-10 19:02 . 2008-09-10 19:02 <KANSIO> d-------- C:\Program Files\SystemRequirementsLab
2008-09-09 19:08 . 2008-09-09 19:08 <KANSIO> d-------- C:\WINDOWS\system32\GroupPolicy
2008-09-09 19:08 . 2008-09-13 13:43 <KANSIO> d-------- C:\Program Files\Windows Desktop Search
2008-09-09 19:08 . 2008-03-07 20:02 192,000 -----c--- C:\WINDOWS\system32\dllcache\offfilt.dll
2008-09-09 19:08 . 2008-03-07 20:02 98,304 -----c--- C:\WINDOWS\system32\dllcache\nlhtml.dll
2008-09-09 19:08 . 2008-03-07 20:02 29,696 -----c--- C:\WINDOWS\system32\dllcache\mimefilt.dll
2008-09-09 19:08 . 2008-09-10 17:42 1,374 --a------ C:\WINDOWS\imsins.BAK
2008-09-08 19:18 . 2008-09-08 19:18 244 --ah----- C:\sqmnoopt11.sqm
2008-09-08 19:18 . 2008-09-08 19:18 232 --ah----- C:\sqmdata11.sqm
2008-09-04 20:27 . 2008-09-04 20:27 8,895,013 --a------ C:\WINDOWS\img1600x1200_8698-8941-42-43-54.SCR
2008-09-04 20:25 . 2008-09-04 20:25 5,404,875 --a------ C:\WINDOWS\img1600x1200_8945.SCR
2008-09-02 17:29 . 2008-09-02 17:29 <KANSIO> d-------- C:\Documents and Settings\Kristian\Application Data\Softplicity
2008-09-02 16:45 . 2008-09-02 17:05 <KANSIO> d-------- C:\Program Files\HooTech
2008-09-01 20:01 . 2008-09-01 20:01 50 --a------ C:\WINDOWS\MegaManager.INI
2008-09-01 19:14 . 2008-09-01 19:14 <KANSIO> d-------- C:\Documents and Settings\Kristian\Application Data\Megaupload
2008-09-01 19:14 . 2008-09-01 19:14 <KANSIO> d-------- C:\Documents and Settings\Kristian\Application Data\EmailNotifier
2008-09-01 19:14 . 2008-09-01 19:14 <KANSIO> d-------- C:\Documents and Settings\All Users\Application Data\Megaupload
2008-09-01 19:14 . 2008-09-01 19:14 <KANSIO> d-------- C:\Documents and Settings\All Users\Application Data\EmailNotifier
2008-09-01 19:13 . 2008-09-01 19:13 <KANSIO> d-------- C:\Program Files\Megaupload
2008-09-01 19:13 . 2008-09-01 19:13 <KANSIO> d-------- C:\Documents and Settings\Kristian\Application Data\InstallShield
2008-09-01 18:53 . 2008-09-01 18:53 704 --a------ C:\Crystal.dat
2008-08-31 20:04 . 2008-09-01 20:06 <KANSIO> d-------- C:\Program Files\ViStart
2008-08-31 19:14 . 2008-08-31 20:04 <KANSIO> d-------- C:\Program Files\Styler
2008-08-31 19:11 . 2008-08-31 20:04 <KANSIO> d-------- C:\VTPFiles
2008-08-31 19:11 . 2008-08-31 20:06 <KANSIO> d-------- C:\WINDOWS\system32\VITrans
2008-08-31 11:36 . 2008-09-10 20:46 <KANSIO> d-------- C:\Program Files\MessengerDiscovery
2008-08-30 23:34 . 2008-08-31 20:04 <KANSIO> d-------- C:\Program Files\San Andreas Mod Installer
2008-08-30 09:34 . 2007-09-06 00:22 289,144 --a------ C:\WINDOWS\system32\VCCLSID.exe
2008-08-30 09:34 . 2008-08-27 15:17 87,040 --a------ C:\WINDOWS\system32\VACFix.exe
2008-08-30 09:34 . 2008-05-18 21:40 82,944 --a------ C:\WINDOWS\system32\IEDFix.exe
2008-08-30 09:34 . 2008-08-18 12:19 82,432 --a------ C:\WINDOWS\system32\404Fix.exe
2008-08-30 09:34 . 2004-07-31 18:50 51,200 --a------ C:\WINDOWS\system32\dumphive.exe
2008-08-30 09:34 . 2007-10-04 00:36 25,600 --a------ C:\WINDOWS\system32\WS2Fix.exe
2008-08-30 09:34 . 2008-09-09 19:30 2,686 --a------ C:\WINDOWS\system32\tmp.reg
2008-08-29 19:24 . 2008-08-29 19:24 <KANSIO> d-------- C:\MBHH2002
2008-08-29 19:09 . 2008-08-29 19:09 <KANSIO> d-------- C:\Program Files\Thoosje
2008-08-28 21:56 . 2008-09-18 18:50 <KANSIO> d-------- C:\Program Files\WinFlip
2008-08-28 21:38 . 2008-09-04 18:26 <KANSIO> d-------- C:\Program Files\Vista Rainbar
2008-08-28 21:24 . 2008-08-28 21:31 <KANSIO> d-------- C:\Documents and Settings\Kristian\Application Data\ViStart
2008-08-28 19:00 . 2008-08-28 19:00 <KANSIO> d-------- C:\fsaua.data
2008-08-28 12:32 . 2008-08-21 23:41 87,552 --a------ C:\WINDOWS\system32\AntiXPVSTFix.exe
2008-08-27 18:53 . 2008-04-14 19:11 23,040 --a------ C:\WINDOWS\system32\AAP.DLL
2008-08-27 18:51 . 2008-04-14 19:11 988,672 --a------ C:\WINDOWS\system32\AAK.dll
2008-08-27 18:51 . 2008-04-14 19:11 680,448 --a------ C:\WINDOWS\system32\AAD.DLL
2008-08-27 18:51 . 2008-08-27 18:53 255 --a------ C:\WINDOWS\system32\ad_away.lic
2008-08-27 08:25 . 2008-08-27 08:25 <KANSIO> d-------- C:\WINDOWS\SQL9_KB948109_ENU
2008-08-26 19:37 . 2008-08-26 19:46 <KANSIO> d-------- C:\Program Files\DreamRender
2008-08-26 19:37 . 2006-12-07 15:01 20,480 --a------ C:\WINDOWS\system32\DreamSaver.scr
2008-08-26 18:37 . 2008-08-26 18:37 <KANSIO> d-------- C:\Program Files\CCleaner
2008-08-26 16:58 . 2008-08-26 16:58 579,072 --a--c--- C:\WINDOWS\system32\dllcache\user32.dll
2008-08-26 16:55 . 2008-08-26 16:55 <KANSIO> d-------- C:\WINDOWS\ERUNT
2008-08-26 14:30 . 2006-04-27 17:49 288,417 --a------ C:\WINDOWS\system32\SrchSTS.exe
2008-08-26 14:30 . 2008-08-14 21:52 82,432 --a------ C:\WINDOWS\system32\IEDFix.C.exe
2008-08-26 14:30 . 2003-06-05 21:13 53,248 --a------ C:\WINDOWS\system32\Process.exe
2008-08-25 19:01 . 2008-08-25 19:01 <KANSIO> d-------- C:\Documents and Settings\Jõrjestelmõnvalvoja
2008-08-25 14:39 . 2008-08-25 14:39 10,838 --ah----- C:\WINDOWS\Stereo.GID
2008-08-25 14:38 . 2008-08-25 14:38 <KANSIO> d-------- C:\Program Files\Stereogram
2008-08-25 14:38 . 2001-03-17 00:32 1,139,389 --a------ C:\WINDOWS\STEREO.HLP
2008-08-25 14:38 . 2001-03-15 23:36 997 --a------ C:\WINDOWS\Stereo.cnt
2008-08-25 14:33 . 2008-08-25 14:33 <KANSIO> d-------- C:\Temp\MB
2008-08-25 14:33 . 2008-08-25 14:33 <KANSIO> d-------- C:\Temp
2008-08-25 14:33 . 2008-08-25 14:33 <KANSIO> d-------- C:\Program Files\Drempels
2008-08-24 18:39 . 2008-08-24 18:40 135,936 --a------ C:\WINDOWS\system32\xmdfkirw.dll
2008-08-24 18:25 . 2005-02-07 15:44 <KANSIO> d--h----- C:\Documents and Settings\Järjestelmänvalvoja\Verkkoympäristö
2008-08-24 18:25 . 2005-02-07 15:44 <KANSIO> d--h----- C:\Documents and Settings\Järjestelmänvalvoja\Verkkoympäristö
2008-08-24 18:25 . 2007-12-24 20:16 <KANSIO> d-------- C:\Documents and Settings\Järjestelmänvalvoja\Työpöytä
2008-08-24 18:25 . 2007-12-24 20:16 <KANSIO> d-------- C:\Documents and Settings\Järjestelmänvalvoja\Työpöytä
2008-08-24 18:25 . 2005-02-07 15:44 <KANSIO> d--h----- C:\Documents and Settings\Järjestelmänvalvoja\Tulostinympäristö
2008-08-24 18:25 . 2005-02-07 15:44 <KANSIO> d--h----- C:\Documents and Settings\Järjestelmänvalvoja\Tulostinympäristö
2008-08-24 18:25 . 2005-02-07 13:53 <KANSIO> dr------- C:\Documents and Settings\Järjestelmänvalvoja\Suosikit
2008-08-24 18:25 . 2005-02-07 13:53 <KANSIO> dr------- C:\Documents and Settings\Järjestelmänvalvoja\Suosikit
2008-08-24 18:25 . 2005-02-07 13:53 <KANSIO> dr------- C:\Documents and Settings\Järjestelmänvalvoja\Omat tiedostot
2008-08-24 18:25 . 2005-02-07 13:53 <KANSIO> dr------- C:\Documents and Settings\Järjestelmänvalvoja\Omat tiedostot
2008-08-24 18:25 . 2005-02-07 13:48 <KANSIO> d--h----- C:\Documents and Settings\Järjestelmänvalvoja\Mallit
2008-08-24 18:25 . 2005-02-07 13:48 <KANSIO> d--h----- C:\Documents and Settings\Järjestelmänvalvoja\Mallit
2008-08-24 18:25 . 2005-02-07 15:44 <KANSIO> dr------- C:\Documents and Settings\Järjestelmänvalvoja\Käynnistä-valikko
2008-08-24 18:25 . 2005-02-07 15:44 <KANSIO> dr------- C:\Documents and Settings\Järjestelmänvalvoja\Käynnistä-valikko
2008-08-24 18:25 . 2008-08-31 20:05 <KANSIO> d-------- C:\Documents and Settings\Järjestelmänvalvoja
2008-08-24 18:12 . 2008-08-24 13:45 155,648 --a------ C:\WINDOWS\qalkfxor.dll
2008-08-24 17:27 . 2008-08-24 17:27 732,765 --a------ C:\WINDOWS\system32\CSRLT.EXE
2008-08-24 17:27 . 2008-08-24 17:27 732,765 --a------ C:\WINDOWS\MSBLT.EXE
2008-08-24 17:27 . 2008-08-24 18:16 0 --a------ C:\WINDOWS\system32\sc01.sc
2008-08-23 20:29 . 2008-08-23 20:29 <KANSIO> d-------- C:\Program Files\Trend Micro
2008-08-23 19:42 . 2008-08-26 08:16 <KANSIO> d-------- C:\Documents and Settings\Kristian\Application Data\Sony
2008-08-23 19:23 . 2008-08-26 08:16 <KANSIO> d-------- C:\Documents and Settings\All Users\Application Data\Sony
2008-08-23 18:11 . 2008-08-23 18:11 <KANSIO> d-------- C:\Program Files\TuneUp Utilities 2008
2008-08-23 18:11 . 2008-08-23 18:11 306,432 --a------ C:\WINDOWS\system32\TuneUpDefragService.exe
2008-08-23 18:11 . 2007-12-20 10:41 29,440 --a------ C:\WINDOWS\system32\uxtuneup.dll
2008-08-23 16:05 . 2008-08-23 19:22 <KANSIO> d-------- C:\Program Files\Sony
2008-08-22 20:02 . 2008-08-22 20:02 <KANSIO> d-------- C:\Program Files\FDRLab
2008-08-22 19:28 . 2008-08-17 15:01 38,472 --a------ C:\WINDOWS\system32\drivers\mbamswissarmy.sys
2008-08-21 19:05 . 2008-08-21 19:05 68,608 --a------ C:\NOTEPAD.EXE
2008-08-21 19:04 . 2008-08-21 19:04 <KANSIO> d-------- C:\Documents and Settings\Kristian\Application Data\Publish Providers
2008-08-21 18:49 . 2008-08-21 18:49 <KANSIO> d-------- C:\WINDOWS\system32\XPSViewer
2008-08-21 18:48 . 2008-08-21 18:48 <KANSIO> d-------- C:\Program Files\Reference Assemblies
2008-08-21 18:48 . 2006-06-29 13:07 14,048 --------- C:\WINDOWS\system32\spmsg2.dll
2008-08-21 18:46 . 2008-08-21 18:46 <KANSIO> d-------- C:\Program Files\TechSmith
2008-08-21 18:46 . 2008-08-21 18:46 <KANSIO> d-------- C:\Program Files\Common Files\TechSmith Shared
2008-08-21 18:46 . 2008-08-21 18:46 <KANSIO> d-------- C:\Documents and Settings\All Users\Application Data\TechSmith
2008-08-21 18:38 . 2008-08-21 19:09 <KANSIO> d-------- C:\Program Files\Sony Setup
2008-08-21 17:28 . 2008-08-21 19:03 <KANSIO> d-------- C:\Program Files\Asprate
2008-08-20 20:53 . 2001-04-18 11:32 205,848 --a------ C:\WINDOWS\system32\Threed32.ocx
2008-08-20 20:53 . 2004-03-09 00:00 124,688 --a------ C:\WINDOWS\system32\MSWINSCK.ocx
2008-08-20 20:53 . 2000-07-15 00:00 101,888 --a------ C:\WINDOWS\system32\VB6STKIT.DLL
2008-08-20 20:53 . 2001-08-27 15:12 19,490 --a------ C:\WINDOWS\system32\IPCFLT.VXD

.
(((((((((((((((((((((((((((((((((((( Find3M-raportti ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-09-18 16:32 --------- d---a-w C:\Documents and Settings\All Users\Application Data\TEMP
2008-09-16 14:55 24 ----a-w C:\Documents and Settings\Kristian\jagex_runescape_preferences.dat
2008-09-16 14:36 --------- d-----w C:\Documents and Settings\All Users\Application Data\WLInstaller
2008-09-15 16:09 --------- d-----w C:\Program Files\MTA San Andreas
2008-09-15 15:35 --------- d-----w C:\Documents and Settings\Kristian\Application Data\uTorrent
2008-09-12 16:23 16 ----a-w C:\hsd.dat
2008-09-12 16:03 --------- d-----w C:\Documents and Settings\Kristian\Application Data\wsInspector
2008-09-10 17:10 --------- d-----w C:\Program Files\Xara
2008-09-10 16:25 --------- d--h--w C:\Program Files\InstallShield Installation Information
2008-09-09 16:32 --------- d-----w C:\Documents and Settings\Kristian\Application Data\LimeWire
2008-09-08 16:50 --------- d-----w C:\Program Files\Tremulous
2008-09-02 12:15 --------- d-----w C:\Program Files\Frets on Fire
2008-09-02 05:18 --------- d-----w C:\Program Files\Messenger Plus! Live
2008-09-01 17:05 --------- d-----w C:\Program Files\Cheat Engine
2008-09-01 14:29 --------- d-----w C:\Program Files\Winamp
2008-08-31 17:43 --------- d-----w C:\Program Files\Windows Media Connect 2
2008-08-31 17:43 --------- d-----w C:\Program Files\IceAge
2008-08-30 07:30 --------- d-----w C:\Program Files\Lavasoft
2008-08-30 07:30 --------- d-----w C:\Program Files\Common Files\Wise Installation Wizard
2008-08-28 18:31 --------- d-----w C:\Documents and Settings\Kristian\Application Data\ViStart
2008-08-27 05:26 --------- d-----w C:\Program Files\Microsoft SQL Server
2008-08-26 05:12 --------- d-----w C:\Program Files\Microsoft.NET
2008-08-25 11:17 --------- d-----w C:\Program Files\Windows Live Safety Center
2008-08-24 17:58 2,864 ----a-w C:\WINDOWS\system32\winsock.dll
2008-08-24 15:16 --------- d-----w C:\Program Files\Google
2008-08-24 14:26 --------- d-----w C:\Program Files\MagicISO
2008-08-23 15:11 --------- d-----w C:\Documents and Settings\All Users\Application Data\TuneUp Software
2008-08-22 16:29 --------- d-----w C:\Program Files\Malwarebytes' Anti-Malware
2008-08-22 16:21 --------- d-----w C:\Documents and Settings\All Users\Application Data\WinZip
2008-08-19 16:17 --------- d-----w C:\Program Files\Charlie II
2008-08-17 15:53 --------- d-----w C:\Program Files\LimeWire
2008-08-17 12:01 17,144 ----a-w C:\WINDOWS\system32\drivers\mbam.sys
2008-08-15 20:24 --------- d-----w C:\Documents and Settings\Kristian\Application Data\gtk-2.0
2008-08-15 19:52 --------- d-----w C:\Program Files\Microsoft Picture It!
2008-08-15 18:38 --------- d-----w C:\Program Files\Fraps
2008-08-14 17:10 --------- d-----w C:\Program Files\GIMP-2.0
2008-08-11 11:58 --------- d-----w C:\Documents and Settings\Kristian\Application Data\The Labyrinth Plus! Edition
2008-08-11 11:52 --------- d-----w C:\Program Files\Microsoft Plus!
2008-08-10 14:31 --------- d-----w C:\Program Files\Temp
2008-08-07 07:22 --------- d-----w C:\Program Files\Microsoft ActiveSync
2008-08-06 17:58 86,016 ----a-w C:\WINDOWS\system32\OpenAL32.dll
2008-08-06 17:58 262,144 ----a-w C:\WINDOWS\system32\wrap_oal.dll
2008-08-06 15:51 --------- d-----w C:\Program Files\microsoft frontpage
2008-08-05 19:16 64,832 ----a-w C:\WINDOWS\BricoPackUninst.cmd
2008-08-05 19:16 6,120 ----a-w C:\WINDOWS\BricoPackFoldersDelete.cmd
2008-08-05 08:40 --------- d-----w C:\Documents and Settings\All Users\Application Data\Lavasoft
2008-08-02 13:56 --------- d-----w C:\Program Files\Rockstar Games
2008-07-31 07:24 --------- d-----w C:\Documents and Settings\Kristian\Application Data\Microsoft Web Folders
2008-07-29 15:31 --------- d-----w C:\Program Files\YouTube Downloader
2008-07-29 14:37 --------- d-----w C:\Program Files\Project64 1.6
2008-07-22 13:28 --------- d-----w C:\Documents and Settings\All Users\Application Data\Installations
2008-07-18 19:10 94,920 ----a-w C:\WINDOWS\system32\cdm.dll
2008-07-18 19:10 53,448 ----a-w C:\WINDOWS\system32\wuauclt.exe
2008-07-18 19:10 45,768 ----a-w C:\WINDOWS\system32\wups2.dll
2008-07-18 19:10 36,552 ----a-w C:\WINDOWS\system32\wups.dll
2008-07-18 19:09 563,912 ----a-w C:\WINDOWS\system32\wuapi.dll
2008-07-18 19:09 325,832 ----a-w C:\WINDOWS\system32\wucltui.dll
2008-07-18 19:09 205,000 ----a-w C:\WINDOWS\system32\wuweb.dll
2008-07-18 19:09 1,811,656 ----a-w C:\WINDOWS\system32\wuaueng.dll
2008-07-18 19:07 270,880 ----a-w C:\WINDOWS\system32\mucltui.dll
2008-07-18 19:07 210,976 ----a-w C:\WINDOWS\system32\muweb.dll
2008-07-18 18:39 586,752 ----a-w C:\WINDOWS\WLXPGSS.SCR
2008-07-07 20:28 253,952 ----a-w C:\WINDOWS\system32\es.dll
2008-06-24 16:44 74,240 ----a-w C:\WINDOWS\system32\mscms.dll
2008-06-24 15:12 295,936 ------w C:\WINDOWS\system32\wmpeffects.dll
2008-06-23 16:29 826,368 ----a-w C:\WINDOWS\system32\wininet.dll
2008-06-20 17:47 246,784 ----a-w C:\WINDOWS\system32\mswsock.dll
2008-03-06 18:15 689 ----a-w C:\Documents and Settings\Kristian\jdraw.v1.1.5.dat
.

((((((((((((((((((((((((((((( snapshot@2008-08-31_20.39.45.62 )))))))))))))))))))))))))))))))))))))))))
.
+ 2008-09-09 16:07:32 311,296 ----a-w C:\WINDOWS\assembly\GAC_MSIL\AspNetMMCExt.resources\2.0.0.0_fi_b03f5f7f11d50a3a\aspnetmmcext.resources.dll
+ 2008-09-09 16:07:36 53,248 ----a-w C:\WINDOWS\assembly\GAC_MSIL\Microsoft.Build.Engine.resources\2.0.0.0_fi_b03f5f7f11d50a3a\Microsoft.Build.Engine.resources.dll
+ 2008-09-09 16:07:36 135,168 ----a-w C:\WINDOWS\assembly\GAC_MSIL\Microsoft.Build.Tasks.resources\2.0.0.0_fi_b03f5f7f11d50a3a\Microsoft.Build.Tasks.resources.dll
+ 2008-09-09 16:07:37 9,728 ----a-w C:\WINDOWS\assembly\GAC_MSIL\Microsoft.Build.Utilities.resources\2.0.0.0_fi_b03f5f7f11d50a3a\Microsoft.Build.Utilities.Resources.dll
+ 2008-09-09 16:07:32 45,056 ----a-w C:\WINDOWS\assembly\GAC_MSIL\Microsoft.Jscript.resources\8.0.0.0_fi_b03f5f7f11d50a3a\Microsoft.JScript.resources.dll
+ 2008-09-09 16:07:46 8,704 ----a-w C:\WINDOWS\assembly\GAC_MSIL\microsoft.visualbasic.compatibility.data.resources\8.0.0.0_fi_b03f5f7f11d50a3a\Microsoft.VisualBasic.Compatibility.Data.resources.dll
+ 2008-09-09 16:07:46 9,216 ----a-w C:\WINDOWS\assembly\GAC_MSIL\microsoft.visualbasic.compatibility.resources\8.0.0.0_fi_b03f5f7f11d50a3a\Microsoft.VisualBasic.Compatibility.resources.dll
+ 2008-09-09 16:07:46 57,344 ----a-w C:\WINDOWS\assembly\GAC_MSIL\Microsoft.VisualBasic.resources\8.0.0.0_fi_b03f5f7f11d50a3a\Microsoft.VisualBasic.resources.dll
+ 2008-09-09 16:07:37 299,008 ----a-w C:\WINDOWS\assembly\GAC_MSIL\mscorlib.resources\2.0.0.0_fi_b77a5c561934e089\mscorlib.resources.dll
+ 2008-09-09 16:07:42 10,752 ----a-w C:\WINDOWS\assembly\GAC_MSIL\sysglobl.resources\2.0.0.0_fi_b03f5f7f11d50a3a\sysglobl.resources.dll
+ 2008-09-09 16:07:37 16,896 ----a-w C:\WINDOWS\assembly\GAC_MSIL\System.Configuration.Install.resources\2.0.0.0_fi_b03f5f7f11d50a3a\System.Configuration.Install.resources.dll
+ 2008-09-09 16:07:43 45,056 ----a-w C:\WINDOWS\assembly\GAC_MSIL\system.configuration.resources\2.0.0.0_fi_b03f5f7f11d50a3a\System.Configuration.resources.dll
+ 2008-09-09 16:07:38 110,592 ----a-w C:\WINDOWS\assembly\GAC_MSIL\System.Data.OracleClient.resources\2.0.0.0_fi_b77a5c561934e089\System.Data.OracleClient.resources.dll
+ 2008-09-09 16:07:43 323,584 ----a-w C:\WINDOWS\assembly\GAC_MSIL\System.Data.resources\2.0.0.0_fi_b77a5c561934e089\System.Data.resources.dll
+ 2008-09-09 16:07:38 36,864 ----a-w C:\WINDOWS\assembly\GAC_MSIL\System.Data.SqlXml.resources\2.0.0.0_fi_b77a5c561934e089\system.data.sqlxml.resources.dll
+ 2008-09-09 16:07:32 376,832 ----a-w C:\WINDOWS\assembly\GAC_MSIL\System.Deployment.resources\2.0.0.0_fi_b03f5f7f11d50a3a\System.Deployment.resources.dll
+ 2008-09-09 16:07:44 524,288 ----a-w C:\WINDOWS\assembly\GAC_MSIL\System.Design.resources\2.0.0.0_fi_b03f5f7f11d50a3a\System.Design.resources.dll
+ 2008-09-09 16:07:34 16,384 ----a-w C:\WINDOWS\assembly\GAC_MSIL\System.DirectoryServices.Protocols.resources\2.0.0.0_fi_b03f5f7f11d50a3a\System.DirectoryServices.Protocols.resources.dll
+ 2008-09-09 16:07:33 40,960 ----a-w C:\WINDOWS\assembly\GAC_MSIL\System.DirectoryServices.resources\2.0.0.0_fi_b03f5f7f11d50a3a\System.DirectoryServices.resources.dll
+ 2008-09-09 16:07:39 6,144 ----a-w C:\WINDOWS\assembly\GAC_MSIL\System.Drawing.Design.resources\2.0.0.0_fi_b03f5f7f11d50a3a\System.Drawing.Design.resources.dll
+ 2008-09-09 16:07:44 24,576 ----a-w C:\WINDOWS\assembly\GAC_MSIL\System.Drawing.resources\2.0.0.0_fi_b03f5f7f11d50a3a\System.Drawing.resources.dll
+ 2008-09-09 16:07:39 32,768 ----a-w C:\WINDOWS\assembly\GAC_MSIL\System.EnterpriseServices.resources\2.0.0.0_fi_b03f5f7f11d50a3a\System.EnterpriseServices.resources.dll
+ 2008-09-09 16:07:39 12,800 ----a-w C:\WINDOWS\assembly\GAC_MSIL\system.management.resources\2.0.0.0_fi_b03f5f7f11d50a3a\System.Management.resources.dll
+ 2008-09-09 16:07:45 57,344 ----a-w C:\WINDOWS\assembly\GAC_MSIL\System.Messaging.resources\2.0.0.0_fi_b03f5f7f11d50a3a\System.Messaging.resources.dll
+ 2008-09-09 16:07:45 200,704 ----a-w C:\WINDOWS\assembly\GAC_MSIL\System.resources\2.0.0.0_fi_b77a5c561934e089\system.resources.dll
+ 2008-09-09 16:07:40 19,968 ----a-w C:\WINDOWS\assembly\GAC_MSIL\System.Runtime.Remoting.resources\2.0.0.0_fi_b77a5c561934e089\System.Runtime.Remoting.resources.dll
+ 2008-09-09 16:07:40 11,264 ----a-w C:\WINDOWS\assembly\GAC_MSIL\System.Runtime.Serialization.Formatters.Soap.resources\2.0.0.0_fi_b03f5f7f11d50a3a\System.Runtime.Serialization.Formatters.Soap.resources.dll
+ 2008-09-09 16:07:33 28,672 ----a-w C:\WINDOWS\assembly\GAC_MSIL\System.Security.resources\2.0.0.0_fi_b03f5f7f11d50a3a\System.Security.resources.dll
+ 2008-09-09 16:07:41 40,960 ----a-w C:\WINDOWS\assembly\GAC_MSIL\System.ServiceProcess.resources\2.0.0.0_fi_b03f5f7f11d50a3a\System.ServiceProcess.resources.dll
+ 2008-09-09 16:07:41 15,872 ----a-w C:\WINDOWS\assembly\GAC_MSIL\System.Transactions.resources\2.0.0.0_fi_b77a5c561934e089\System.Transactions.resources.dll
+ 2008-09-09 16:07:46 36,864 ----a-w C:\WINDOWS\assembly\GAC_MSIL\System.Web.Mobile.resources\2.0.0.0_fi_b03f5f7f11d50a3a\System.Web.Mobile.resources.dll
+ 2008-09-09 16:07:34 577,536 ----a-w C:\WINDOWS\assembly\GAC_MSIL\System.Web.resources\2.0.0.0_fi_b03f5f7f11d50a3a\System.Web.resources.dll
+ 2008-09-09 16:07:34 77,824 ----a-w C:\WINDOWS\assembly\GAC_MSIL\System.Web.Services.resources\2.0.0.0_fi_b03f5f7f11d50a3a\System.Web.Services.resources.dll
+ 2008-09-09 16:07:42 413,696 ----a-w C:\WINDOWS\assembly\GAC_MSIL\System.Windows.Forms.resources\2.0.0.0_fi_b77a5c561934e089\System.Windows.Forms.resources.dll
+ 2008-09-09 16:07:35 155,648 ----a-w C:\WINDOWS\assembly\GAC_MSIL\System.XML.resources\2.0.0.0_fi_b77a5c561934e089\System.xml.resources.dll
+ 2008-07-03 06:47:04 267,568 ----a-w C:\WINDOWS\Downloaded Program Files\sysreqlab3.dll
+ 2008-09-12 15:43:22 27,648 ----a-r C:\WINDOWS\Installer\{048298C9-A4D3-490B-9FF9-AB023A9238F3}\Icon048298C91.exe
- 2008-08-14 11:43:40 593,920 ----a-r C:\WINDOWS\Installer\{90110409-6000-11D3-8CFE-0150048383C9}\accicons.exe
+ 2008-09-10 14:45:39 593,920 ----a-r C:\WINDOWS\Installer\{90110409-6000-11D3-8CFE-0150048383C9}\accicons.exe
- 2008-08-14 11:43:40 12,288 ----a-r C:\WINDOWS\Installer\{90110409-6000-11D3-8CFE-0150048383C9}\cagicon.exe
+ 2008-09-10 14:45:39 12,288 ----a-r C:\WINDOWS\Installer\{90110409-6000-11D3-8CFE-0150048383C9}\cagicon.exe
- 2008-08-14 11:43:40 86,016 ----a-r C:\WINDOWS\Installer\{90110409-6000-11D3-8CFE-0150048383C9}\inficon.exe
+ 2008-09-10 14:45:39 86,016 ----a-r C:\WINDOWS\Installer\{90110409-6000-11D3-8CFE-0150048383C9}\inficon.exe
- 2008-08-14 11:43:40 135,168 ----a-r C:\WINDOWS\Installer\{90110409-6000-11D3-8CFE-0150048383C9}\misc.exe
+ 2008-09-10 14:45:39 135,168 ----a-r C:\WINDOWS\Installer\{90110409-6000-11D3-8CFE-0150048383C9}\misc.exe
- 2008-08-14 11:43:40 11,264 ----a-r C:\WINDOWS\Installer\{90110409-6000-11D3-8CFE-0150048383C9}\mspicons.exe
+ 2008-09-10 14:45:39 11,264 ----a-r C:\WINDOWS\Installer\{90110409-6000-11D3-8CFE-0150048383C9}\mspicons.exe
- 2008-08-14 11:43:40 27,136 ----a-r C:\WINDOWS\Installer\{90110409-6000-11D3-8CFE-0150048383C9}\oisicon.exe
+ 2008-09-10 14:45:39 27,136 ----a-r C:\WINDOWS\Installer\{90110409-6000-11D3-8CFE-0150048383C9}\oisicon.exe
- 2008-08-14 11:43:40 4,096 ----a-r C:\WINDOWS\Installer\{90110409-6000-11D3-8CFE-0150048383C9}\opwicon.exe
+ 2008-09-10 14:45:39 4,096 ----a-r C:\WINDOWS\Installer\{90110409-6000-11D3-8CFE-0150048383C9}\opwicon.exe
- 2008-08-14 11:43:40 794,624 ----a-r C:\WINDOWS\Installer\{90110409-6000-11D3-8CFE-0150048383C9}\outicon.exe
+ 2008-09-10 14:45:39 794,624 ----a-r C:\WINDOWS\Installer\{90110409-6000-11D3-8CFE-0150048383C9}\outicon.exe
- 2008-08-14 11:43:40 249,856 ----a-r C:\WINDOWS\Installer\{90110409-6000-11D3-8CFE-0150048383C9}\pptico.exe
+ 2008-09-10 14:45:39 249,856 ----a-r C:\WINDOWS\Installer\{90110409-6000-11D3-8CFE-0150048383C9}\pptico.exe
- 2008-08-14 11:43:40 61,440 ----a-r C:\WINDOWS\Installer\{90110409-6000-11D3-8CFE-0150048383C9}\pubs.exe
+ 2008-09-10 14:45:39 61,440 ----a-r C:\WINDOWS\Installer\{90110409-6000-11D3-8CFE-0150048383C9}\pubs.exe
- 2008-08-14 11:43:40 23,040 ----a-r C:\WINDOWS\Installer\{90110409-6000-11D3-8CFE-0150048383C9}\unbndico.exe
+ 2008-09-10 14:45:39 23,040 ----a-r C:\WINDOWS\Installer\{90110409-6000-11D3-8CFE-0150048383C9}\unbndico.exe
- 2008-08-14 11:43:40 286,720 ----a-r C:\WINDOWS\Installer\{90110409-6000-11D3-8CFE-0150048383C9}\wordicon.exe
+ 2008-09-10 14:45:39 286,720 ----a-r C:\WINDOWS\Installer\{90110409-6000-11D3-8CFE-0150048383C9}\wordicon.exe
- 2008-08-14 11:43:40 409,600 ----a-r C:\WINDOWS\Installer\{90110409-6000-11D3-8CFE-0150048383C9}\xlicons.exe
+ 2008-09-10 14:45:39 409,600 ----a-r C:\WINDOWS\Installer\{90110409-6000-11D3-8CFE-0150048383C9}\xlicons.exe
- 2008-08-14 11:37:45 12,288 ----a-r C:\WINDOWS\Installer\{90170409-6000-11D3-8CFE-0150048383C9}\cagicon.exe
+ 2008-09-10 14:45:07 12,288 ----a-r C:\WINDOWS\Installer\{90170409-6000-11D3-8CFE-0150048383C9}\cagicon.exe
- 2008-08-14 11:37:45 282,624 ----a-r C:\WINDOWS\Installer\{90170409-6000-11D3-8CFE-0150048383C9}\fpicon.exe
+ 2008-09-10 14:45:07 282,624 ----a-r C:\WINDOWS\Installer\{90170409-6000-11D3-8CFE-0150048383C9}\fpicon.exe
- 2008-08-14 11:37:45 135,168 ----a-r C:\WINDOWS\Installer\{90170409-6000-11D3-8CFE-0150048383C9}\misc.exe
+ 2008-09-10 14:45:07 135,168 ----a-r C:\WINDOWS\Installer\{90170409-6000-11D3-8CFE-0150048383C9}\misc.exe
- 2008-08-14 11:37:46 27,136 ----a-r C:\WINDOWS\Installer\{90170409-6000-11D3-8CFE-0150048383C9}\oisicon.exe
+ 2008-09-10 14:45:07 27,136 ----a-r C:\WINDOWS\Installer\{90170409-6000-11D3-8CFE-0150048383C9}\oisicon.exe
- 2008-08-14 11:37:46 4,096 ----a-r C:\WINDOWS\Installer\{90170409-6000-11D3-8CFE-0150048383C9}\opwicon.exe
+ 2008-09-10 14:45:07 4,096 ----a-r C:\WINDOWS\Installer\{90170409-6000-11D3-8CFE-0150048383C9}\opwicon.exe
- 2008-08-14 11:38:14 135,168 ----a-r C:\WINDOWS\Installer\{903B0409-6000-11D3-8CFE-0150048383C9}\misc.exe
+ 2008-09-10 14:45:54 135,168 ----a-r C:\WINDOWS\Installer\{903B0409-6000-11D3-8CFE-0150048383C9}\misc.exe
- 2008-08-14 11:38:14 4,096 ----a-r C:\WINDOWS\Installer\{903B0409-6000-11D3-8CFE-0150048383C9}\opwicon.exe
+ 2008-09-10 14:45:54 4,096 ----a-r C:\WINDOWS\Installer\{903B0409-6000-11D3-8CFE-0150048383C9}\opwicon.exe
- 2008-08-14 11:38:14 147,456 ----a-r C:\WINDOWS\Installer\{903B0409-6000-11D3-8CFE-0150048383C9}\pj11icon.exe
+ 2008-09-10 14:45:54 147,456 ----a-r C:\WINDOWS\Installer\{903B0409-6000-11D3-8CFE-0150048383C9}\pj11icon.exe
- 2008-08-09 20:13:55 12,288 ----a-r C:\WINDOWS\Installer\{90510409-6000-11D3-8CFE-0150048383C9}\cagicon.exe
+ 2008-09-10 14:46:08 12,288 ----a-r C:\WINDOWS\Installer\{90510409-6000-11D3-8CFE-0150048383C9}\cagicon.exe
- 2008-08-09 20:13:55 135,168 ----a-r C:\WINDOWS\Installer\{90510409-6000-11D3-8CFE-0150048383C9}\misc.exe
+ 2008-09-10 14:46:08 135,168 ----a-r C:\WINDOWS\Installer\{90510409-6000-11D3-8CFE-0150048383C9}\misc.exe
- 2008-08-09 20:13:55 4,096 ----a-r C:\WINDOWS\Installer\{90510409-6000-11D3-8CFE-0150048383C9}\opwicon.exe
+ 2008-09-10 14:46:08 4,096 ----a-r C:\WINDOWS\Installer\{90510409-6000-11D3-8CFE-0150048383C9}\opwicon.exe
- 2008-08-09 20:13:55 176,128 ----a-r C:\WINDOWS\Installer\{90510409-6000-11D3-8CFE-0150048383C9}\visicon.exe
+ 2008-09-10 14:46:08 176,128 ----a-r C:\WINDOWS\Installer\{90510409-6000-11D3-8CFE-0150048383C9}\visicon.exe
- 2008-08-14 11:37:52 57,344 ----a-r C:\WINDOWS\Installer\{90A10409-6000-11D3-8CFE-0150048383C9}\joticon.exe
+ 2008-09-10 14:45:20 57,344 ----a-r C:\WINDOWS\Installer\{90A10409-6000-11D3-8CFE-0150048383C9}\joticon.exe
- 2008-08-14 11:37:53 135,168 ----a-r C:\WINDOWS\Installer\{90A10409-6000-11D3-8CFE-0150048383C9}\misc.exe
+ 2008-09-10 14:45:20 135,168 ----a-r C:\WINDOWS\Installer\{90A10409-6000-11D3-8CFE-0150048383C9}\misc.exe
- 2008-08-14 11:37:53 4,096 ----a-r C:\WINDOWS\Installer\{90A10409-6000-11D3-8CFE-0150048383C9}\opwicon.exe
+ 2008-09-10 14:45:20 4,096 ----a-r C:\WINDOWS\Installer\{90A10409-6000-11D3-8CFE-0150048383C9}\opwicon.exe
- 2008-08-30 08:03:18 29,926 ----a-r C:\WINDOWS\Installer\{A9174A72-1B46-445B-B3CF-90ED2C63D83B}\MsblIco.Exe
+ 2008-09-16 14:37:45 29,926 ----a-r C:\WINDOWS\Installer\{A9174A72-1B46-445B-B3CF-90ED2C63D83B}\MsblIco.Exe
+ 2005-12-20 15:11:36 20,992 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\1035\alinkui.dll
+ 2005-12-20 15:11:38 146,432 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\1035\cscompui.dll
+ 2005-12-20 15:11:38 5,120 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\1035\CvtResUI.dll
+ 2005-12-20 15:11:44 196,608 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\1035\vbc7ui.dll
+ 2005-12-20 15:11:34 208,896 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\1035\Vsavb7rtUI.dll
+ 2005-12-20 15:11:34 8,192 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\fi\aspnet_compiler.resources.dll
+ 2005-12-20 15:11:34 74,240 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\fi\aspnet_rc.dll
+ 2005-12-20 15:11:34 5,632 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\fi\aspnet_regbrowsers.resources.dll
+ 2005-12-20 15:11:34 36,864 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\fi\aspnet_regsql.resources.dll
+ 2005-12-20 15:11:34 311,296 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\fi\aspnetmmcext.resources.dll
+ 2005-12-20 15:11:42 36,864 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\fi\caspol.resources.dll
+ 2005-12-20 15:11:44 4,096 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\fi\InstallUtil.resources.dll
+ 2005-12-20 15:11:40 7,168 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\fi\JSC.resources.dll
+ 2005-12-20 15:11:44 53,248 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\fi\Microsoft.Build.Engine.resources.dll
+ 2005-12-20 15:11:44 135,168 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\fi\Microsoft.Build.Tasks.resources.dll
+ 2005-12-20 15:11:44 9,728 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\fi\Microsoft.Build.Utilities.Resources.dll
+ 2005-12-20 15:11:40 45,056 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\fi\Microsoft.JScript.resources.dll
+ 2005-12-20 15:11:46 57,344 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\fi\Microsoft.VisualBasic.resources.dll
+ 2005-12-20 15:11:44 12,800 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\fi\MSBuild.resources.dll
+ 2005-12-20 15:11:44 299,008 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\fi\mscorlib.resources.dll
+ 2005-12-20 15:11:44 374,272 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\fi\mscorrc.dll
+ 2005-12-20 15:11:44 11,264 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\fi\Regasm.Resources.dll
+ 2005-12-20 15:11:44 86,016 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\fi\ShFusRes.dll
+ 2005-12-20 15:11:44 10,752 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\fi\sysglobl.resources.dll
+ 2005-12-20 15:11:44 16,896 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\fi\System.Configuration.Install.resources.dll
+ 2005-12-20 15:11:44 45,056 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\fi\System.Configuration.resources.dll
+ 2005-12-20 15:11:44 110,592 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\fi\System.Data.OracleClient.resources.dll
+ 2005-12-20 15:11:44 323,584 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\fi\System.Data.resources.dll
+ 2005-12-20 15:11:44 36,864 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\fi\system.data.sqlxml.resources.dll
+ 2005-12-20 15:11:38 376,832 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\fi\System.Deployment.resources.dll
+ 2005-12-20 15:11:44 524,288 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\fi\System.Design.resources.dll
+ 2005-12-20 15:11:44 16,384 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\fi\System.DirectoryServices.Protocols.resources.dll
+ 2005-12-20 15:11:44 40,960 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\fi\System.DirectoryServices.resources.dll
+ 2005-12-20 15:11:44 6,144 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\fi\System.Drawing.Design.resources.dll
+ 2005-12-20 15:11:44 24,576 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\fi\System.Drawing.resources.dll
+ 2005-12-20 15:11:44 32,768 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\fi\System.EnterpriseServices.resources.dll
+ 2005-12-20 15:11:44 12,800 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\fi\System.Management.resources.dll
+ 2005-12-20 15:11:44 57,344 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\fi\System.Messaging.resources.dll
+ 2005-12-20 15:11:44 200,704 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\fi\system.resources.dll
+ 2005-12-20 15:11:44 19,968 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\fi\System.Runtime.Remoting.resources.dll
+ 2005-12-20 15:11:44 11,264 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\fi\System.Runtime.Serialization.Formatters.Soap.resources.dll
+ 2005-12-20 15:11:44 28,672 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\fi\System.Security.resources.dll
+ 2005-12-20 15:11:44 40,960 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\fi\System.ServiceProcess.resources.dll
+ 2005-12-20 15:11:44 15,872 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\fi\System.Transactions.resources.dll
+ 2005-12-20 15:11:44 36,864 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\fi\System.Web.Mobile.resources.dll
+ 2005-12-20 15:11:44 577,536 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\fi\System.Web.resources.dll
+ 2005-12-20 15:11:44 77,824 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\fi\System.Web.Services.resources.dll
+ 2005-12-20 15:11:44 413,696 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\fi\System.Windows.Forms.resources.dll
+ 2005-12-20 15:11:44 155,648 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\fi\System.xml.resources.dll
+ 2005-12-20 15:11:46 8,704 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\GAC\FI\Microsoft.VisualBasic.Compatibility.Data.resources.dll
+ 2005-12-20 15:11:46 9,216 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\GAC\FI\Microsoft.VisualBasic.Compatibility.resources.dll
+ 2005-12-09 07:45:40 609,472 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\Microsoft .NET Framework 2.0 Language Pack - FIN\install.exe
+ 2005-12-09 07:45:40 81,408 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\Microsoft .NET Framework 2.0 Language Pack - FIN\install.res.1035.dll
+ 2005-12-09 09:26:10 245,408 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\Microsoft .NET Framework 2.0 Language Pack - FIN\unicows.dll
+ 2005-12-20 15:11:44 22,528 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\MUI\040B\mscorsecr.dll
- 2008-08-31 17:06:26 611,672 ----a-w C:\WINDOWS\system32\FNTCACHE.DAT
+ 2008-09-11 14:32:13 664,208 ----a-w C:\WINDOWS\system32\FNTCACHE.DAT
- 2006-03-22 14:20:18 491,520 ------w C:\WINDOWS\system32\mgxoschk.dll
+ 2008-04-15 13:14:24 700,416 ----a-w C:\WINDOWS\system32\mgxoschk.dll
- 2008-04-14 16:11:39 29,696 ----a-w C:\WINDOWS\system32\mimefilt.dll
+ 2008-03-07 17:02:08 29,696 ----a-w C:\WINDOWS\system32\mimefilt.dll
- 2008-08-05 18:11:01 15,888,504 ----a-w C:\WINDOWS\system32\MRT.exe
+ 2008-08-26 20:28:12 16,208,504 ----a-w C:\WINDOWS\system32\MRT.exe
- 2003-04-18 14:29:26 44,544 ----a-w C:\WINDOWS\system32\MSXML4a.dll
+ 2003-04-18 13:29:26 44,544 ----a-w C:\WINDOWS\system32\MSXML4a.dll
- 2003-04-18 14:29:26 82,432 ----a-w C:\WINDOWS\system32\msxml4r.dll
+ 2003-04-18 13:29:26 82,432 ----a-w C:\WINDOWS\system32\msxml4r.dll
+ 2005-12-20 15:11:44 6,656 ----a-w C:\WINDOWS\system32\mui\040B\mscorees.dll
- 2008-04-14 16:11:42 98,304 ----a-w C:\WINDOWS\system32\nlhtml.dll
+ 2008-03-07 17:02:08 98,304 ----a-w C:\WINDOWS\system32\nlhtml.dll
- 2008-04-14 16:11:45 192,000 ----a-w C:\WINDOWS\system32\offfilt.dll
+ 2008-03-07 17:02:08 192,000 ----a-w C:\WINDOWS\system32\offfilt.dll
- 2008-08-27 14:57:02 99,804 ----a-w C:\WINDOWS\system32\perfc009.dat
+ 2008-09-12 16:02:43 99,804 ----a-w C:\WINDOWS\system32\perfc009.dat
- 2008-08-27 14:57:02 114,222 ----a-w C:\WINDOWS\system32\perfc00B.dat
+ 2008-09-12 16:02:43 114,222 ----a-w C:\WINDOWS\system32\perfc00B.dat
- 2008-08-27 14:57:02 512,560 ----a-w C:\WINDOWS\system32\perfh009.dat
+ 2008-09-12 16:02:43 512,560 ----a-w C:\WINDOWS\system32\perfh009.dat
- 2008-08-27 14:57:02 488,624 ----a-w C:\WINDOWS\system32\perfh00B.dat
+ 2008-09-12 16:02:43 488,624 ----a-w C:\WINDOWS\system32\perfh00B.dat
+ 2003-06-22 23:44:36 1,415,680 ----a-w C:\WINDOWS\system32\wmv9vcm.dll
+ 2008-09-18 14:11:20 16,384 ----atw C:\WINDOWS\Temp\Perflib_Perfdata_154.dat
+ 2008-09-18 14:11:24 16,384 ----atw C:\WINDOWS\Temp\Perflib_Perfdata_380.dat
+ 2008-09-18 14:11:10 16,384 ----atw C:\WINDOWS\Temp\Perflib_Perfdata_7b4.dat
+ 2008-04-15 17:49:33 1,724,416 ----a-w C:\WINDOWS\WinSxS\x86_Microsoft.Windows.GdiPlus_6595b64144ccf1df_1.0.2600.5581_x-ww_dfbc4fc4\GdiPlus.dll
.
-- Snapshot reset to current date --
.
(((((((((((((((((((((((((((((( Rekisterin käynnistyskohteet )))))))))))))))))))))))))))))))))))))))))))))
.
.
*Huom* Tyhjiä arvoja ja laillisia oletusarvoja ei näytetä
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2008-04-14 15360]
"swg"="C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2007-11-14 68856]
"Vista Rainbar"="C:\Program Files\Vista Rainbar\Rainmeter.exe" [2006-01-21 118784]
"Steam"="c:\program files\steam\steam.exe" [2008-09-13 1271032]
"MsnMsgr"="C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" [2008-09-16 5724184]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"BackgroundSwitcher"="C:\WINDOWS\system32\bgswitch.exe" [2001-10-19 19520]
"CoolSwitch"="C:\WINDOWS\system32\taskswitch.exe" [2001-10-19 45632]
"Elisa Avustaja"="C:\Program Files\Elisa\Avustaja\Elisa.exe" [2007-10-22 189768]
"PaperPort PTD"="C:\Program Files\ScanSoft\PaperPort\pptd40nt.exe" [2007-01-29 30248]
"IndexSearch"="C:\Program Files\ScanSoft\PaperPort\IndexSearch.exe" [2007-01-29 46632]
"PinnacleDriverCheck"="C:\WINDOWS\system32\PSDrvCheck.exe" [2003-11-10 406016]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe" [2008-06-10 144784]
"SSBkgdUpdate"="C:\Program Files\Common Files\Scansoft Shared\SSBkgdUpdate\SSBkgdupdate.exe" [2006-10-25 210472]
"avast!"="C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe" [2008-07-19 78008]
"QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2008-01-10 385024]
"SoundMan"="SOUNDMAN.EXE" [2004-12-22 C:\WINDOWS\SOUNDMAN.EXE]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"DWQueuedReporting"="C:\PROGRA~1\COMMON~1\MICROS~1\DW\dwtrig20.exe" [2007-03-22 39264]

C:\Documents and Settings\Kristian\K?ynnist?-valikko\Ohjelmat\K?ynnistys\
Microsoft Office OneNote 2003 Quick Launch.lnk - C:\Program Files\Microsoft Office\OFFICE11\ONENOTEM.EXE [2007-04-19 64864]
WinFlip.lnk - C:\Program Files\WinFlip\WinFlip.exe [2008-05-30 483328]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon]
"UIHost"="C:\\WINDOWS\\system32\\logonui.exe"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders]
SecurityProviders msapsspc.dllschannel.dlldigest.dllmsnsspc.dll

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusOverride"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"C:\\WINDOWS\\system32\\mshta.exe"=
"C:\\WINDOWS\\system32\\java.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"C:\\Program Files\\Elisa\\Avustaja\\Elisa.exe"=
"C:\\Program Files\\iTunes\\iTunes.exe"=
"C:\\Program Files\\LimeWire\\LimeWire.exe"=
"C:\\Documents and Settings\\Kristian\\Omat tiedostot\\CS\\hl.exe"=
"C:\\Program Files\\Codemasters\\Worms 4 Mayhem\\WORMS 4 MAYHEM.EXE"=
"C:\\Program Files\\Xider\\EsR DEMO\\ESR DEMO.exe"=
"C:\\Program Files\\ActionWheelRacer\\wheelracer.exe"=
"C:\\MBHH2003\\Huvi\\BVolley\\volley.exe"=
"C:\\Program Files\\Silent Grove Studios\\Dawnspire\\Dawnspire.exe"=
"C:\\Program Files\\Messenger\\msmsgs.exe"=
"C:\\Program Files\\Java\\jre1.6.0_05\\bin\\javaw.exe"=
"C:\\Documents and Settings\\Kristian\\Omat tiedostot\\CS\\hlds.exe"=
"C:\\Program Files\\uTorrent\\uTorrent.exe"=
"C:\\Program Files\\VALVe\\Counter-Strike Source\\hl2.exe"=
"C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"C:\\Program Files\\Windows Live\\Messenger\\livecall.exe"=
"C:\\WINDOWS\\pchealth\\helpctr\\binaries\\helpctr.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"3587:TCP"= 3587:TCP:Windowsin vertaisjärjestelmäryhmittely
"3540:UDP"= 3540:UDP:PNRP (Peer Name Resolution Protocol)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\IcmpSettings]
"AllowInboundEchoRequest"= 1 (0x1)

R1 aswSP;avast! Self Protection;C:\WINDOWS\system32\drivers\aswSP.sys [2008-07-19 78416]
R2 aswFsBlk;aswFsBlk;C:\WINDOWS\system32\DRIVERS\aswFsBlk.sys [2008-07-19 20560]
R2 NMSAccessU;NMSAccessU;C:\Program Files\CDBurnerXP\NMSAccessU.exe [2007-10-12 71096]
R2 UxTuneUp;TuneUp Theme Extension;C:\WINDOWS\System32\svchost.exe [2008-04-14 14336]
R2 zumbus;Zune Bus Enumerator Driver;C:\WINDOWS\system32\DRIVERS\zumbus.sys [2007-11-15 40832]
R3 3xHybrid;Pinnacle PCTV 300i Stereo DVB-T;C:\WINDOWS\system32\DRIVERS\3xHybrid.sys [2004-09-03 698368]
S3 MSSQL$SONY_MEDIAMGR2;SQL Server (SONY_MEDIAMGR2);c:\Program Files\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\sqlservr.exe [2008-02-26 29183504]
S3 p2pgasvc;Vertaisverkon ryhmätodennus;C:\WINDOWS\system32\svchost.exe [2008-04-14 14336]
S3 p2pimsvc;Vertaisverkon käyttäjätietojen hallinta;C:\WINDOWS\system32\svchost.exe [2008-04-14 14336]
S3 p2psvc;Vertaisverkko;C:\WINDOWS\system32\svchost.exe [2008-04-14 14336]
S3 PNRPSvc;Vertaiskoneen nimenselvitysprotokolla;C:\WINDOWS\system32\svchost.exe [2008-04-14 14336]
S3 TuneUp.Defrag;TuneUp Drive Defrag Service;C:\WINDOWS\System32\TuneUpDefragService.exe [2008-08-23 306432]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
p2psvc REG_MULTI_SZ p2psvc p2pimsvc p2pgasvc PNRPSvc

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost - NetSvcs
UxTuneUp
.
'Ajoitetut tehtävät'-kansion sisältö
.
- - - - POISTETUT JÄMÄRIVIT - - - -

WebBrowser-{A057A204-BACC-4D26-C39E-35F1D2A32EC8} - (no file)


.
------- Täydentävä tarkistus -------
.
R0 -: HKCU-Main,Start Page = hxxp://www.google.fi/
O8 -: &Windows Live Search - C:\Program Files\Windows Live Toolbar\msntb.dll/search.htm
O8 -: E&xport to Microsoft Excel - C:\PROGRA~1\MICROS~4\OFFICE11\EXCEL.EXE/3000
O8 -: Latauslinkki käyttäen Mega Manageria... - C:\Program Files\Megaupload\Mega Manager\mm_file.htm
O8 -: Open Picture in &Microsoft PhotoDraw - C:\PROGRA~1\MICROS~4\Office\1033\phdintl.dll/phdContext.htm

O16 -: {1E54D648-B804-468d-BC78-4AFFED8E262E} - hxxp://www.srtest.com/srl_bin/sysreqlab3.cab
C:\WINDOWS\Downloaded Program Files\SysReqLab3.osd
C:\WINDOWS\Downloaded Program Files\sysreqlab3.dll
.

**************************************************************************

catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-09-18 19:45:25
Windows 5.1.2600 Service Pack 3 NTFS

tarkistaa piilotettuja prosesseja ...

tarkistaa piilotettuja käynnistysarvoja ...

tarkistaa piilotettuja tiedostoja ...

tarkistus on valmis
piilotetut tiedostot: 0

**************************************************************************
.
Valmistumisajankohta: 2008-09-18 19:50:39
ComboFix-quarantined-files.txt 2008-09-18 16:50:36
ComboFix2.txt 2008-08-31 17:40:09
ComboFix3.txt 2008-08-30 08:40:41

Pre-Run: 79,408,570,368 tavua vapaana
Post-Run: 79,601,307,648 tavua vapaana

503 --- E O F --- 2008-09-10 14:48:07

mitäs seuraavaks?
[ + lainaa]
Hujo
Suspended permanently
_ 		18. syyskuuta 2008 @ 20:03 _ Linkki tähän viestiin    Lähetä käyttäjälle yksityisviesti   
Lataa SDFix by AndyManchesta ja tallenna se työpöydällesi.

Käynnistä koneesi vikasietotilaan:

sammuta ja käynnistä
käynnistyksen yhteydessä hakkaa F8 nappia
valitse nuolinäppäimellä vikasietotila
paina enter ja enter
valitse käyttäjätilisi
paina kyllä

Jossakin koneissa hakataan F8:sin sijasta F5:tä

" Kun vikasietotilassa, pura tiedoston SDFix.zip sisältö (SDFix kansio) työpöydällesi. Työpöydälle pitäisi ilmestyä kansio nimeltä SDFix.
" Avaa SDFix-kansio ja tuplaklikkaa tiedostoa RunThis.bat käynnistääksesi ohjelman.
" Paina Y käynnistääksesi skriptin.
" Työkalu puhdistaa troijalaisen palvelut ja tekee myös joitakin korjauksia rekisteriin. Lopuksi se pyytää käynnistämään koneen uudelleen, "Press any key to Reboot".
" Paina mitä tahansa näppäintä ja kone käynnistyy uudelleen.
" Käynnistyminen kestää normaalia kauemmin sillä SDFix puhdistaa konetta.
" Kun kone on käynnistynyt ja työpöytä latautunut, SDFix kertoo että puhdistus on suoritettu, "Finished".
" Paina sitten mitä tahansa näppäintä sulkeaksesi skriptin ja ladataksesi pikakuvakkeet työpöydälle.
" Lopuksi avaa SDFix kansio (työpöydällä) ja kopioi & liitä tiedoston Report.txt sisältö viestiketjuusi uuden HijackThis:n lokin kera.

[ + lainaa]
Voiko tietsikka koskaan toimia?
krizu7
Junior Member
_ 		20. syyskuuta 2008 @ 11:28 _ Linkki tähän viestiin    Lähetä käyttäjälle yksityisviesti   
SDFix loki:

SDFix: Version 1.227
Run by Kristian on la 20.09.2008 at 10:58

Microsoft Windows XP [versio 5.1.2600]
Running From: C:\Documents and Settings\Kristian\Omat tiedostot\viruspoisto\SDFix

Checking Services :


Restoring Default Security Values
Restoring Default Hosts File

Rebooting


Checking Files :

Trojan Files Found:

C:\WINDOWS\qalkfxor.dll - Deleted





Removing Temp Files

ADS Check :



Final Check :

catchme 0.3.1361.2 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-09-20 11:05:24
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes ...

scanning hidden services & system hive ...

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04]
"h0"=dword:00000000
"ujdew"=hex:2a,5c,d0,23,3f,62,5f,bf,8b,2d,a4,9d,14,98,83,95,c6,f9,32,46,a8,..
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4]
"p0"="C:\Program Files\DAEMON Tools\"
"h0"=dword:00000001
"khjeh"=hex:6e,d1,1c,e5,d8,35,0a,6e,f3,7d,82,6e,38,82,37,a4,24,27,e7,a1,42,..

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001]
"a0"=hex:20,01,00,00,f4,55,49,29,75,72,2a,3d,14,92,c9,08,08,f5,a9,66,9a,..
"khjeh"=hex:4a,b6,fa,a4,db,2f,bb,9a,f2,36,29,ae,81,ef,0e,d0,ce,fa,fe,79,17,..

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40]
"khjeh"=hex:c4,2a,2c,cf,6a,18,cf,ee,dd,e5,be,af,56,85,9e,1f,af,db,9c,8f,8b,..

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf41]
"khjeh"=hex:a1,06,71,a1,75,00,0c,33,9c,21,00,24,c3,a6,15,00,73,7c,28,8f,a6,..
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04]
"h0"=dword:00000000
"ujdew"=hex:2a,5c,d0,23,3f,62,5f,bf,8b,2d,a4,9d,14,98,83,95,c6,f9,32,46,a8,..
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4]
"p0"="C:\Program Files\DAEMON Tools\"
"h0"=dword:00000001
"khjeh"=hex:6e,d1,1c,e5,d8,35,0a,6e,f3,7d,82,6e,38,82,37,a4,24,27,e7,a1,42,..

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001]
"a0"=hex:20,01,00,00,f4,55,49,29,75,72,2a,3d,14,92,c9,08,08,f5,a9,66,9a,..
"khjeh"=hex:4a,b6,fa,a4,db,2f,bb,9a,f2,36,29,ae,81,ef,0e,d0,ce,fa,fe,79,17,..

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40]
"khjeh"=hex:9c,e4,24,71,c7,cb,51,94,51,16,5b,e5,aa,77,10,e8,1f,3d,6d,59,f0,..

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf41]
"khjeh"=hex:a1,06,71,a1,75,00,0c,33,9c,21,00,24,c3,a6,15,00,73,7c,28,8f,a6,..
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg]
"s1"=dword:2df9c43f
"s2"=dword:110480d0
"h0"=dword:00000002

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04]
"h0"=dword:00000000
"ujdew"=hex:2a,5c,d0,23,3f,62,5f,bf,8b,2d,a4,9d,14,98,83,95,c6,f9,32,46,a8,..

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4]
"p0"="C:\Program Files\DAEMON Tools\"
"h0"=dword:00000001
"khjeh"=hex:6e,d1,1c,e5,d8,35,0a,6e,f3,7d,82,6e,38,82,37,a4,24,27,e7,a1,42,..

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001]
"a0"=hex:20,01,00,00,f4,55,49,29,75,72,2a,3d,14,92,c9,08,08,f5,a9,66,9a,..
"khjeh"=hex:4a,b6,fa,a4,db,2f,bb,9a,f2,36,29,ae,81,ef,0e,d0,ce,fa,fe,79,17,..

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40]
"khjeh"=hex:9c,e4,24,71,c7,cb,51,94,51,16,5b,e5,aa,77,10,e8,1f,3d,6d,59,f0,..

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf41]
"khjeh"=hex:a1,06,71,a1,75,00,0c,33,9c,21,00,24,c3,a6,15,00,73,7c,28,8f,a6,..

scanning hidden registry entries ...

scanning hidden files ...

scan completed successfully
hidden processes: 0
hidden services: 0
hidden files: 0


Remaining Services :




Authorized Application Key Export:

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
"%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"C:\\Program Files\\Pinnacle\\MediaCenter\\PMC.exe"="C:\\Program Files\\Pinnacle\\MediaCenter\\PMC.exe:LocalSubNet:Enabled:Pmc.exe"
"C:\\Program Files\\Pinnacle\\MediaCenter\\PmcSettings.exe"="C:\\Program Files\\Pinnacle\\MediaCenter\\PmcSettings.exe:LocalSubNet:Enabled:pmcsettings.exe"
"C:\\Program Files\\Pinnacle\\Shared Files\\Programs\\MediaManager\\PMSManager.exe"="C:\\Program Files\\Pinnacle\\Shared Files\\Programs\\MediaManager\\PMSManager.exe:LocalSubNet:Enabled:PMSManager.exe"
"C:\\Program Files\\Pinnacle\\MediaCenter\\tvtvWizard.exe"="C:\\Program Files\\Pinnacle\\MediaCenter\\tvtvWizard.exe:LocalSubNet:Enabled:tvtvWizard.exe"
"C:\\Program Files\\Pinnacle\\Shared Files\\Programs\\MediaServer\\PMSInstallInit.exe"="C:\\Program Files\\Pinnacle\\Shared Files\\Programs\\MediaServer\\PMSInstallInit.exe:LocalSubNet:Enabled:PMSInstallInit.exe"
"C:\\WINDOWS\\system32\\mshta.exe"="C:\\WINDOWS\\system32\\mshta.exe:*:Enabled:Microsoft (R) HTML Application host"
"C:\\WINDOWS\\system32\\java.exe"="C:\\WINDOWS\\system32\\java.exe:*:Disabled:Java(TM) 2 Platform Standard Edition binary"
"%windir%\\Network Diagnostic\\xpnetdiag.exe"="%windir%\\Network Diagnostic\\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"
"C:\\Program Files\\Elisa\\Avustaja\\Elisa.exe"="C:\\Program Files\\Elisa\\Avustaja\\Elisa.exe:*:Enabled:Avustaja"
"C:\\Program Files\\iTunes\\iTunes.exe"="C:\\Program Files\\iTunes\\iTunes.exe:*:Enabled:iTunes"
"C:\\Program Files\\LimeWire\\LimeWire.exe"="C:\\Program Files\\LimeWire\\LimeWire.exe:*:Enabled:LimeWire"
"C:\\Documents and Settings\\Kristian\\Omat tiedostot\\CS\\hl.exe"="C:\\Documents and Settings\\Kristian\\Omat tiedostot\\CS\\hl.exe:*:Enabled:Half-Life Launcher"
"C:\\Program Files\\Codemasters\\Worms 4 Mayhem\\WORMS 4 MAYHEM.EXE"="C:\\Program Files\\Codemasters\\Worms 4 Mayhem\\WORMS 4 MAYHEM.EXE:*:Enabled:Worms 4 Mayhem"
"C:\\Program Files\\Pinnacle\\MediaCenter\\EpgSpoolerSrv.exe"="C:\\Program Files\\Pinnacle\\MediaCenter\\EpgSpoolerSrv.exe:LocalSubNet:Disabled:EpgSpoolerSrv.exe"
"C:\\Program Files\\Xider\\EsR DEMO\\ESR DEMO.exe"="C:\\Program Files\\Xider\\EsR DEMO\\ESR DEMO.exe:*:Disabled:ESR DEMO"
"C:\\Program Files\\ActionWheelRacer\\wheelracer.exe"="C:\\Program Files\\ActionWheelRacer\\wheelracer.exe:*:Disabled:wheelracer"
"C:\\MBHH2003\\Huvi\\BVolley\\volley.exe"="C:\\MBHH2003\\Huvi\\BVolley\\volley.exe:*:Disabled:volley"
"C:\\Program Files\\Silent Grove Studios\\Dawnspire\\Dawnspire.exe"="C:\\Program Files\\Silent Grove Studios\\Dawnspire\\Dawnspire.exe:*:Enabled:Dawnspire"
"C:\\Program Files\\Messenger\\msmsgs.exe"="C:\\Program Files\\Messenger\\msmsgs.exe:*:Enabled:Windows Messenger"
"C:\\Program Files\\Java\\jre1.6.0_05\\bin\\javaw.exe"="C:\\Program Files\\Java\\jre1.6.0_05\\bin\\javaw.exe:*:Enabled:Java(TM) Platform SE binary"
"C:\\Documents and Settings\\Kristian\\Omat tiedostot\\CS\\hlds.exe"="C:\\Documents and Settings\\Kristian\\Omat tiedostot\\CS\\hlds.exe:*:Enabled:HLDS Launcher"
"C:\\Program Files\\uTorrent\\uTorrent.exe"="C:\\Program Files\\uTorrent\\uTorrent.exe:*:Enabled:æTorrent"
"C:\\Program Files\\Pinnacle\\Shared Files\\Programs\\MediaCenterService\\PMC.Service.Main.exe"="C:\\Program Files\\Pinnacle\\Shared Files\\Programs\\MediaCenterService\\PMC.Service.Main.exe:LocalSubNet:Disabled:PMCService"
"C:\\Program Files\\VALVe\\Counter-Strike Source\\hl2.exe"="C:\\Program Files\\VALVe\\Counter-Strike Source\\hl2.exe:*:Enabled:hl2"
"C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"="C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe:*:Enabled:Windows Live Messenger"
"C:\\Program Files\\Windows Live\\Messenger\\livecall.exe"="C:\\Program Files\\Windows Live\\Messenger\\livecall.exe:*:Enabled:Windows Live Messenger (Phone)"
"C:\\WINDOWS\\pchealth\\helpctr\\binaries\\helpctr.exe"="C:\\WINDOWS\\pchealth\\helpctr\\binaries\\helpctr.exe:*:Enabled:Et?tuki - Windows Messenger ja ??niyhteys"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
"%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"%windir%\\Network Diagnostic\\xpnetdiag.exe"="%windir%\\Network Diagnostic\\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"
"C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"="C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe:*:Enabled:Windows Live Messenger"
"C:\\Program Files\\Windows Live\\Messenger\\livecall.exe"="C:\\Program Files\\Windows Live\\Messenger\\livecall.exe:*:Enabled:Windows Live Messenger (Phone)"

Remaining Files :


File Backups: - C:\DOCUME~1\Kristian\OMATTI~1\VIRUSP~1\SDFix\backups\backups.zip

Files with Hidden Attributes :

Fri 11 Mar 2005 325 ..SH. --- "C:\BOOT.BAK"
Mon 12 Oct 1998 233,472 A..H. --- "C:\Program Files\eGames\Blast Thru Special Edition\WCSUP.DLL"
Fri 17 Jul 1998 1,315,072 A..H. --- "C:\Program Files\eGames\Moonshot\wcsup.dll"
Tue 28 Sep 1999 794,112 A..H. --- "C:\Program Files\eGames\Nebula Fighter Special Edition\WCSUP.DLL"
Sun 6 Feb 2000 69,632 A..H. --- "C:\Program Files\eGames\Tile Blazer Special Edition\WCSUP.DLL"
Wed 19 Sep 2007 70,144 ..SHR --- "C:\Program Files\Xider\EsR DEMO\Setup.exe"
Mon 23 Jul 2007 0 A.SH. --- "C:\Documents and Settings\All Users\DRM\Cache\Indiv01.tmp"
Thu 10 Apr 2008 0 A..H. --- "C:\WINDOWS\SoftwareDistribution\Download\a7b63628b39fd8bdb7e535e34d0ea696\BIT3.tmp"
Mon 8 Sep 2008 165,232 A..H. --- "C:\Documents and Settings\Kristian\Application Data\Microsoft\Virtual PC\VPCKeyboard.dll"
Fri 2 Nov 2007 28,672 A..H. --- "C:\Documents and Settings\Kristian\Omat tiedostot\aq\AQ Elite [Lore3403]\AxInterop.ShockwaveFlashObjects.dll"
Fri 2 Nov 2007 32,768 A..H. --- "C:\Documents and Settings\Kristian\Omat tiedostot\aq\AQ Elite [Lore3403]\Interop.ShockwaveFlashObjects.dll"

Finished!



Ja uusi HJT loki:

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 11:24:51, on 20.9.2008
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16705)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Windows Defender\MsMpEng.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\taskswitch.exe
C:\Program Files\Elisa\Avustaja\Elisa.exe
C:\Program Files\ScanSoft\PaperPort\pptd40nt.exe
C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\QuickTime\qttask.exe
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\system32\drivers\CDAC11BA.EXE
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\Program Files\Vista Rainbar\Rainmeter.exe
C:\program files\steam\steam.exe
C:\Program Files\WinFlip\WinFlip.exe
C:\Program Files\Microsoft SQL Server\MSSQL$PINNACLESYS\Binn\sqlservr.exe
C:\Program Files\CDBurnerXP\NMSAccessU.exe
C:\WINDOWS\system32\tcpsvcs.exe
C:\WINDOWS\System32\snmp.exe
c:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe
C:\WINDOWS\system32\svchost.exe
c:\program files\pinnacle\shared files\programs\mediaserver\pmshost.exe
C:\WINDOWS\system32\Fast.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Windows Live\Messenger\msnmsgr.exe
C:\Program Files\Windows Live\Messenger\usnsvc.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.fi/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\3.1.807.1746\swg.dll
O2 - BHO: Mega Manager IE Click Monitor - {bf00e119-21a3-4fd1-b178-3b8537e75c92} - C:\Program Files\Megaupload\Mega Manager\MegaIEMn.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll
O4 - HKLM\..\Run: [BackgroundSwitcher] C:\WINDOWS\system32\bgswitch.exe
O4 - HKLM\..\Run: [CoolSwitch] C:\WINDOWS\system32\taskswitch.exe
O4 - HKLM\..\Run: [Elisa Avustaja] "C:\Program Files\Elisa\Avustaja\Elisa.exe"
O4 - HKLM\..\Run: [PaperPort PTD] "C:\Program Files\ScanSoft\PaperPort\pptd40nt.exe"
O4 - HKLM\..\Run: [IndexSearch] "C:\Program Files\ScanSoft\PaperPort\IndexSearch.exe"
O4 - HKLM\..\Run: [PinnacleDriverCheck] C:\WINDOWS\system32\PSDrvCheck.exe -CheckReg
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe"
O4 - HKLM\..\Run: [SSBkgdUpdate] "C:\Program Files\Common Files\Scansoft Shared\SSBkgdUpdate\SSBkgdupdate.exe" -Embedding -boot
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [Vista Rainbar] C:\Program Files\Vista Rainbar\Rainmeter.exe
O4 - HKCU\..\Run: [Steam] "c:\program files\steam\steam.exe" -silent
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Verkkopalve')
O4 - HKUS\S-1-5-18\..\Run: [DWQueuedReporting] "C:\PROGRA~1\COMMON~1\MICROS~1\DW\dwtrig20.exe" -t (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [DWQueuedReporting] "C:\PROGRA~1\COMMON~1\MICROS~1\DW\dwtrig20.exe" -t (User 'Default user')
O4 - Startup: Microsoft Office OneNote 2003 Quick Launch.lnk = C:\Program Files\Microsoft Office\OFFICE11\ONENOTEM.EXE
O4 - Startup: WinFlip.lnk = C:\Program Files\WinFlip\WinFlip.exe
O8 - Extra context menu item: &Windows Live Search - res://C:\Program Files\Windows Live Toolbar\msntb.dll/search.htm
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~4\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: Latauslinkki käyttäen Mega Manageria... - C:\Program Files\Megaupload\Mega Manager\mm_file.htm
O8 - Extra context menu item: Open Picture in &Microsoft PhotoDraw - res://C:\PROGRA~1\MICROS~4\Office\1033\phdintl.dll/phdContext.htm
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~4\OFFICE11\REFIEBAR.DLL
O16 - DPF: {1E54D648-B804-468d-BC78-4AFFED8E262E} (System Requirements Lab) - http://www.srtest.com/srl_bin/sysreqlab3.cab
O16 - DPF: {20A60F0D-9AFA-4515-A0FD-83BD84642501} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab56986.cab
O16 - DPF: {5C051655-FCD5-4969-9182-770EA5AA5565} (Solitaire Showdown Class) - http://messenger.zone.msn.com/binary/Sol...wn.cab56986.cab
O16 - DPF: {5ED80217-570B-4DA9-BF44-BE107C0EC166} (Windows Live Safety Center Base Module) - http://cdn.scan.onecare.live.com/resourc...lscbase5036.cab
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupd...b?1170431845328
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (MSN Games - Installer) - http://messenger.zone.msn.com/binary/ZIntro.cab56649.cab
O16 - DPF: {BDBDE413-7B1C-4C68-A8FF-C5B2B4090876} (F-Secure Online Scanner 3.3) - http://support.f-secure.com/ols/fscax.cab
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/Mes...nt.cab56907.cab
O16 - DPF: {F5A7706B-B9C0-4C89-A715-7A0C6B05DD48} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineSweeper.cab56986.cab
O23 - Service: Lavasoft Ad-Aware Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: C-DillaCdaC11BA - Macrovision - C:\WINDOWS\system32\drivers\CDAC11BA.EXE
O23 - Service: Pinnacle Systems tvtv Spooler (EpgSpooler) - - c:\progra~1\pinnacle\mediac~1\epgspo~2.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPod-palvelu (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: NMSAccessU - Unknown owner - C:\Program Files\CDBurnerXP\NMSAccessU.exe
O23 - Service: Pinnacle Systems Media Service (PinnacleSys.MediaServer) - Pinnacle Systems - c:\program files\pinnacle\shared files\programs\mediaserver\pmshost.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: TuneUp Drive Defrag Service (TuneUp.Defrag) - TuneUp Software GmbH - C:\WINDOWS\System32\TuneUpDefragService.exe
O23 - Service: TuneUp WinStyler Theme Service (TUWinStylerThemeSvc) - Unknown owner - C:\Program Files\TuneUp WinStyler\WinStylerThemeSvc.exe (file missing)

--
End of file - 8825 bytes


mitäs seuraavaks?
[ + lainaa]

Viestiä on muokattu lähettämisen jälkeen. Viimeisin muokkaus 20. syyskuuta 2008 @ 11:33
krizu7
Junior Member
_ 		20. syyskuuta 2008 @ 20:13 _ Linkki tähän viestiin    Lähetä käyttäjälle yksityisviesti   
ohjetta pliiis
[ + lainaa]
Hujo
Suspended permanently
_ 		21. syyskuuta 2008 @ 04:32 _ Linkki tähän viestiin    Lähetä käyttäjälle yksityisviesti   
vaihda meseen salasana.

==================

Lataa Malwarebytes' Anti-Malware työpöydällesi.

1. Tuplaklikkaa mbam-setup.exe ja seuraa ohjeita asentaaksesi ohjelman.
2. Lopuksi varmistu, että seuraavat on valittu: Update Malwarebytes', Anti-Malwareja
Launch Malwarebytes' Anti-Malware ja sen jälkeen klikkaaFinish.
3. Jos päivitys löytyy. ohjelma lataa ja asentaa uusimman version.
4. Kun ohjelma on latautunut, valitse Perform full scan ja klikkaa Scan.
5. Kun skanni on valmis, klikkaa OK ja sitten Show Results nähdäksesi tulokset.
6. Varmistu, että kaikki on merkitty ja klikkaa Remove Selected.
7. Tämän jälkeen loki avautuu muistioon. Tallenna se paikkaan, josta löydät sen helposti. Loki
löytyy myös täältä: C:\Documents and Settings\Käyttäjänimi\Application
Data\Malwarebytes\Malwarebytes' Anti-Malware\Logs\log-päiväys.txt
8. Lähetä lokin sisältö seuraavassa viestissäsi



[ + lainaa]
Voiko tietsikka koskaan toimia?
krizu7
Junior Member
_ 		21. syyskuuta 2008 @ 12:26 _ Linkki tähän viestiin    Lähetä käyttäjälle yksityisviesti   
salis vaihdettu.

anti-malware loki:

Malwarebytes' Anti-Malware 1.28
Tietokantaversio: 1184
Windows 5.1.2600 Service Pack 3

21.9.2008 12:16:46
mbam-log-2008-09-21 (12-16-46).txt

Tarkistustyyppi: Täysi tarkistus (C:\|)
Tarkistetut kohteet: 295159
Kulunut aika: 1 hour(s), 46 minute(s), 0 second(s)

Saastuneita muistiprosesseja: 0
Saastuneita muistimoduuleja: 0
Saastuneita rekisteriavaimia: 0
Saastuneita rekisteriarvoja: 0
Saastuneita rekisterikohteita: 1
Saastuneita hakemistoja: 0
Saastuneita tiedostoja: 65

Saastuneita muistiprosesseja:
(Haitallisia kohteita ei löydetty)

Saastuneita muistimoduuleja:
(Haitallisia kohteita ei löydetty)

Saastuneita rekisteriavaimia:
(Haitallisia kohteita ei löydetty)

Saastuneita rekisteriarvoja:
(Haitallisia kohteita ei löydetty)

Saastuneita rekisterikohteita:
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SecurityProviders (Broken.SecurityProviders) -> Bad: (msapsspc.dllschannel.dlldigest.dllmsnsspc.dll) Good: (msapsspc.dll, schannel.dll, digest.dll, msnsspc.dll) -> Quarantined and deleted successfully.

Saastuneita hakemistoja:
(Haitallisia kohteita ei löydetty)

Saastuneita tiedostoja:
C:\WINDOWS\system32\xmdfkirw.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\Documents and Settings\Omistaja\Local Settings\Temp\111e_appcompat.txt (Trojan.Extension.Exploit) -> Quarantined and deleted successfully.
C:\Documents and Settings\Omistaja\Local Settings\Temp\1a0d_appcompat.txt (Trojan.Extension.Exploit) -> Quarantined and deleted successfully.
C:\Documents and Settings\Omistaja\Local Settings\Temp\1dd_appcompat.txt (Trojan.Extension.Exploit) -> Quarantined and deleted successfully.
C:\Documents and Settings\Omistaja\Local Settings\Temp\217b_appcompat.txt (Trojan.Extension.Exploit) -> Quarantined and deleted successfully.
C:\Documents and Settings\Omistaja\Local Settings\Temp\2a56_appcompat.txt (Trojan.Extension.Exploit) -> Quarantined and deleted successfully.
C:\Documents and Settings\Omistaja\Local Settings\Temp\2b61_appcompat.txt (Trojan.Extension.Exploit) -> Quarantined and deleted successfully.
C:\Documents and Settings\Omistaja\Local Settings\Temp\2bc5_appcompat.txt (Trojan.Extension.Exploit) -> Quarantined and deleted successfully.
C:\Documents and Settings\Omistaja\Local Settings\Temp\2d84_appcompat.txt (Trojan.Extension.Exploit) -> Quarantined and deleted successfully.
C:\Documents and Settings\Omistaja\Local Settings\Temp\31b7_appcompat.txt (Trojan.Extension.Exploit) -> Quarantined and deleted successfully.
C:\Documents and Settings\Omistaja\Local Settings\Temp\4e82_appcompat.txt (Trojan.Extension.Exploit) -> Quarantined and deleted successfully.
C:\Documents and Settings\Omistaja\Local Settings\Temp\4eb8_appcompat.txt (Trojan.Extension.Exploit) -> Quarantined and deleted successfully.
C:\Documents and Settings\Omistaja\Local Settings\Temp\560a_appcompat.txt (Trojan.Extension.Exploit) -> Quarantined and deleted successfully.
C:\Documents and Settings\Omistaja\Local Settings\Temp\6119_appcompat.txt (Trojan.Extension.Exploit) -> Quarantined and deleted successfully.
C:\Documents and Settings\Omistaja\Local Settings\Temp\634c_appcompat.txt (Trojan.Extension.Exploit) -> Quarantined and deleted successfully.
C:\Documents and Settings\Omistaja\Local Settings\Temp\6550_appcompat.txt (Trojan.Extension.Exploit) -> Quarantined and deleted successfully.
C:\Documents and Settings\Omistaja\Local Settings\Temp\6893_appcompat.txt (Trojan.Extension.Exploit) -> Quarantined and deleted successfully.
C:\Documents and Settings\Omistaja\Local Settings\Temp\693b_appcompat.txt (Trojan.Extension.Exploit) -> Quarantined and deleted successfully.
C:\Documents and Settings\Omistaja\Local Settings\Temp\6a97_appcompat.txt (Trojan.Extension.Exploit) -> Quarantined and deleted successfully.
C:\Documents and Settings\Omistaja\Local Settings\Temp\7774_appcompat.txt (Trojan.Extension.Exploit) -> Quarantined and deleted successfully.
C:\Documents and Settings\Omistaja\Local Settings\Temp\79ef_appcompat.txt (Trojan.Extension.Exploit) -> Quarantined and deleted successfully.
C:\Documents and Settings\Omistaja\Local Settings\Temp\7edd_appcompat.txt (Trojan.Extension.Exploit) -> Quarantined and deleted successfully.
C:\Documents and Settings\Omistaja\Local Settings\Temp\7f56_appcompat.txt (Trojan.Extension.Exploit) -> Quarantined and deleted successfully.
C:\Documents and Settings\Omistaja\Local Settings\Temp\8e24_appcompat.txt (Trojan.Extension.Exploit) -> Quarantined and deleted successfully.
C:\Documents and Settings\Omistaja\Local Settings\Temp\90c0_appcompat.txt (Trojan.Extension.Exploit) -> Quarantined and deleted successfully.
C:\Documents and Settings\Omistaja\Local Settings\Temp\9250_appcompat.txt (Trojan.Extension.Exploit) -> Quarantined and deleted successfully.
C:\Documents and Settings\Omistaja\Local Settings\Temp\a238_appcompat.txt (Trojan.Extension.Exploit) -> Quarantined and deleted successfully.
C:\Documents and Settings\Omistaja\Local Settings\Temp\ad23_appcompat.txt (Trojan.Extension.Exploit) -> Quarantined and deleted successfully.
C:\Documents and Settings\Omistaja\Local Settings\Temp\b09e_appcompat.txt (Trojan.Extension.Exploit) -> Quarantined and deleted successfully.
C:\Documents and Settings\Omistaja\Local Settings\Temp\baf7_appcompat.txt (Trojan.Extension.Exploit) -> Quarantined and deleted successfully.
C:\Documents and Settings\Omistaja\Local Settings\Temp\c9dd_appcompat.txt (Trojan.Extension.Exploit) -> Quarantined and deleted successfully.
C:\Documents and Settings\Omistaja\Local Settings\Temp\calog.txt (Trojan.Extension.Exploit) -> Quarantined and deleted successfully.
C:\Documents and Settings\Omistaja\Local Settings\Temp\cda7_appcompat.txt (Trojan.Extension.Exploit) -> Quarantined and deleted successfully.
C:\Documents and Settings\Omistaja\Local Settings\Temp\d599_appcompat.txt (Trojan.Extension.Exploit) -> Quarantined and deleted successfully.
C:\Documents and Settings\Omistaja\Local Settings\Temp\e38e_appcompat.txt (Trojan.Extension.Exploit) -> Quarantined and deleted successfully.
C:\Documents and Settings\Omistaja\Local Settings\Temp\f045_appcompat.txt (Trojan.Extension.Exploit) -> Quarantined and deleted successfully.
C:\Documents and Settings\Omistaja\Local Settings\Temp\f123_appcompat.txt (Trojan.Extension.Exploit) -> Quarantined and deleted successfully.
C:\Documents and Settings\Omistaja\Local Settings\Temp\f2bb_appcompat.txt (Trojan.Extension.Exploit) -> Quarantined and deleted successfully.
C:\Documents and Settings\Omistaja\Local Settings\Temp\f3e8_appcompat.txt (Trojan.Extension.Exploit) -> Quarantined and deleted successfully.
C:\Documents and Settings\Omistaja\Local Settings\Temp\fa79_appcompat.txt (Trojan.Extension.Exploit) -> Quarantined and deleted successfully.
C:\Documents and Settings\Omistaja\Local Settings\Temp\fe84_appcompat.txt (Trojan.Extension.Exploit) -> Quarantined and deleted successfully.
C:\Documents and Settings\Omistaja\Local Settings\Temp\hpiMSI_Camera.txt (Trojan.Extension.Exploit) -> Quarantined and deleted successfully.
C:\Documents and Settings\Omistaja\Local Settings\Temp\hpi_UI_LOG.txt (Trojan.Extension.Exploit) -> Quarantined and deleted successfully.
C:\Documents and Settings\Omistaja\Local Settings\Temp\hpoMSI_AiOSW_LOG.txt (Trojan.Extension.Exploit) -> Quarantined and deleted successfully.
C:\Documents and Settings\Omistaja\Local Settings\Temp\hpoMSI_AiO_Scan_LOG.txt (Trojan.Extension.Exploit) -> Quarantined and deleted successfully.
C:\Documents and Settings\Omistaja\Local Settings\Temp\hpoMSI_DocProc_LOG.txt (Trojan.Extension.Exploit) -> Quarantined and deleted successfully.
C:\Documents and Settings\Omistaja\Local Settings\Temp\hpoMSI_fax_LOG.txt (Trojan.Extension.Exploit) -> Quarantined and deleted successfully.
C:\Documents and Settings\Omistaja\Local Settings\Temp\hpoMSI_overland_LOG.txt (Trojan.Extension.Exploit) -> Quarantined and deleted successfully.
C:\Documents and Settings\Omistaja\Local Settings\Temp\hpoMSI_PrintScreen_LOG.txt (Trojan.Extension.Exploit) -> Quarantined and deleted successfully.
C:\Documents and Settings\Omistaja\Local Settings\Temp\hpoMSI_QuickProjects_LOG.txt (Trojan.Extension.Exploit) -> Quarantined and deleted successfully.
C:\Documents and Settings\Omistaja\Local Settings\Temp\hpoMSI_Readme_LOG.txt (Trojan.Extension.Exploit) -> Quarantined and deleted successfully.
C:\Documents and Settings\Omistaja\Local Settings\Temp\hpoMSI_Scan_LOG.txt (Trojan.Extension.Exploit) -> Quarantined and deleted successfully.
C:\Documents and Settings\Omistaja\Local Settings\Temp\hpoMSI_SkinsHP1_LOG.txt (Trojan.Extension.Exploit) -> Quarantined and deleted successfully.
C:\Documents and Settings\Omistaja\Local Settings\Temp\hpzFxFIN_Log.txt (Trojan.Extension.Exploit) -> Quarantined and deleted successfully.
C:\Documents and Settings\Omistaja\Local Settings\Temp\Install-log.txt (Trojan.Extension.Exploit) -> Quarantined and deleted successfully.
C:\Documents and Settings\Omistaja\Local Settings\Temp\Microsoft Office Excel Viewer 2003 Setup(0001).txt (Trojan.Extension.Exploit) -> Quarantined and deleted successfully.
C:\Documents and Settings\Omistaja\Local Settings\Temp\Microsoft Office Excel Viewer 2003 Setup(0001)_Task(0001).txt (Trojan.Extension.Exploit) -> Quarantined and deleted successfully.
C:\Documents and Settings\Omistaja\Local Settings\Temp\Microsoft Office Word Viewer 2003 Setup(0001).txt (Trojan.Extension.Exploit) -> Quarantined and deleted successfully.
C:\Documents and Settings\Omistaja\Local Settings\Temp\Microsoft Office Word Viewer 2003 Setup(0001)_Task(0001).txt (Trojan.Extension.Exploit) -> Quarantined and deleted successfully.
C:\Documents and Settings\Omistaja\Local Settings\Temp\SCSILog0.txt (Trojan.Extension.Exploit) -> Quarantined and deleted successfully.
C:\Documents and Settings\Omistaja\Local Settings\Temp\SCSILog1.txt (Trojan.Extension.Exploit) -> Quarantined and deleted successfully.
C:\Documents and Settings\Omistaja\Local Settings\Temp\browser.bmp (Trojan.Extension.Exploit) -> Quarantined and deleted successfully.
C:\Documents and Settings\Omistaja\Local Settings\Temp\internet.bmp (Trojan.Extension.Exploit) -> Quarantined and deleted successfully.
C:\Documents and Settings\Omistaja\Local Settings\Temp\internet_bw.bmp (Trojan.Extension.Exploit) -> Quarantined and deleted successfully.
C:\Documents and Settings\Omistaja\Local Settings\Temp\internet_down.bmp (Trojan.Extension.Exploit) -> Quarantined and deleted successfully.

mitäs nyt?
[ + lainaa]

Viestiä on muokattu lähettämisen jälkeen. Viimeisin muokkaus 21. syyskuuta 2008 @ 12:30
Hujo
Suspended permanently
_ 		21. syyskuuta 2008 @ 12:46 _ Linkki tähän viestiin    Lähetä käyttäjälle yksityisviesti   
scannaa hjt:llä merkkaa paina Fix checked

O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe"
O4 - HKLM\..\Run: [SSBkgdUpdate] "C:\Program Files\Common Files\Scansoft Shared\SSBkgdUpdate\SSBkgdupdate.exe" -Embedding -boot
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime

===============

Lataa Tästä Ccleaner
CCleaner v 2.11.636.- Standard Build, ÄLÄ aseenna Yahoo toolbaria!
Asennuksessa poista merkki/rasti kohdasta "asenna Yahoo! toolbar/työkalupalkki".
Asennuksen jälkeen aukaise CCleaner.
Valitse vasemmalta pystyrivistä Options.
Valitse viereisestä pystyrivistä Settings.
Language kohtaan valitse Suomi.

Puhdistaja
Valitse vasemmalta pystyrivistä Puhdistaja.
Paina alhaalta Tutki.
Nyt CCleaner tutkii, mitä voidaan poistaa (tempit, cookiessit jne.).
Kun tutkiminen on valmis, paina Aja CCleaner.
Nyt CCleaner poistaa löydetyt tempit, cookiessit jne.

Rekisterin virheiden korjaus
Valitse vasemmalta pystyrivistä Rekisteri.
Paina alhaalta Etsi rekisterin virheitä.
Kun etsintä on valmis ja olet varma, että haluat korjata ne rivit jotka ovat merkattuja, niin paina Korjaa valitut rekisterin virheet.
Sinulta kysytään "haluatko varmuuskopioida muutokset rekisteriin", paina Kyllä. Tallenna varmuuskopio vaikka "Omat tiedostot" -kansioon.
Klikkaa uudesta aukeavasta ikkunasta Korjaa kaikki valitut virheet.
Saat vielä varmistus kysymyksen, paina Ok.
Kun virheet on korjattu, paina Sulje.
Nyt voit sulkea CCleanerin painamalla oikealta ylhäältä punaista rastia.

[ + lainaa]
Voiko tietsikka koskaan toimia?
krizu7
Junior Member
_ 		21. syyskuuta 2008 @ 13:12 _ Linkki tähän viestiin    Lähetä käyttäjälle yksityisviesti   
tehty, entäs nyt?
[ + lainaa]
Hujo
Suspended permanently
_ 		21. syyskuuta 2008 @ 13:57 _ Linkki tähän viestiin    Lähetä käyttäjälle yksityisviesti   
mites kone toimii
[ + lainaa]
Voiko tietsikka koskaan toimia?
krizu7
Junior Member
_ 		21. syyskuuta 2008 @ 14:07 _ Linkki tähän viestiin    Lähetä käyttäjälle yksityisviesti   
viel pari kertaa on tullu tota... :(
[ + lainaa]
Hujo
Suspended permanently
_ 		21. syyskuuta 2008 @ 14:29 _ Linkki tähän viestiin    Lähetä käyttäjälle yksityisviesti   
ota ja poista tuo Toolbar: &Google lisää poista sovelutuksesta

Poista vikasiedossa

c:\program files\google\googletoolbar2.dll

=====

scannaa hjt:llä merkkaa paina Fix checked

O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll

=======

Lataa Atribunen ATF Cleaner

Ohjeet;

Tupla-klikkaa ATF-Cleaner.exe käynnistääksesi ohjelman.Main:n alla valitse: Select All
Klikkaa Empty Selected valintaa.
Jos käytät FireFoxia selaimenasi Klikkaa Firefox yläpuolelta ja valitse: Select All
Klikkaa Empty Selected valintaa.
HUOMIO: Jos haluaisit pitää tallennetut salasanasi, klikkaa No kun se sitä kysyy.
Jos käytät Operaa selaimenasiKlikkaa Opera yläpuolelta ja valitse: Select All
Klikkaa Empty Selected valintaa taas.
HUOMIO: Jos haluaisit pitää tallennetut salasanasi, klikkaa No kun se sitä kysyy.
Klikkaa Exit päävalikosta sulkeaksesi ohjelman.
Teknistä tukea tulee jos tupla-klikkaat sähköpostiosoitetta joka sijaitsee jokaisen menun alapuolella kyseisessä työkalussa. (Huomatkaa että se tuki on sitten englanniksi)



[ + lainaa]
Voiko tietsikka koskaan toimia?
krizu7
Junior Member
_ 		21. syyskuuta 2008 @ 14:31 _ Linkki tähän viestiin    Lähetä käyttäjälle yksityisviesti   
miks toi toolbar pitää poistaa?? ja voiko sen asentaa myöhemmi? ja entä jos käytän internet explorerii?
[ + lainaa]

Viestiä on muokattu lähettämisen jälkeen. Viimeisin muokkaus 21. syyskuuta 2008 @ 14:42
Hujo
Suspended permanently
_ 		21. syyskuuta 2008 @ 15:06 _ Linkki tähän viestiin    Lähetä käyttäjälle yksityisviesti   
sulla on googlen haku siinä ie7
samaten firefoxsissa on googlen haku

tuossa toolbaarissa on infektio
[ + lainaa]
Voiko tietsikka koskaan toimia?

Viestiä on muokattu lähettämisen jälkeen. Viimeisin muokkaus 21. syyskuuta 2008 @ 15:10
krizu7
Junior Member
_ 		21. syyskuuta 2008 @ 15:10 _ Linkki tähän viestiin    Lähetä käyttäjälle yksityisviesti   
mutta voiko sen asentaa myöhemmin viel? siis toolbarin
[ + lainaa]
Hujo
Suspended permanently
_ 		21. syyskuuta 2008 @ 15:20 _ Linkki tähän viestiin    Lähetä käyttäjälle yksityisviesti   
Malware, detected as Troj/BHO-DC - NOTE: The CLSID in question is ALSO used by the Google Toolbar, although NOT for the BHO but for the Toolbar itself, see here

=======

kyllä jättäsin tuon työkalupalkin asentamatta asentamatta.
http://www.google.com/tools/firefox/tool...l/fi/index.html

=======

Lataa OTMoveIt
OTMoveIt ja tallenna se työpöydällesi.

Tuplaklikkaa OTMoveIt.exe.
Klikkaa CleanUp!.
Valitse Yes kun kysytään "Begin cleanup Process?".
Jos pyydetään, että saako koneen käynnistää uudeelleen, valitse Yes.OTMoveIt poistaa itsensä kun se on valmis, jos näin ei käy poista se itse.

HUOM: Jos palomuurisi tai joku muu tietoturvaohjelma varoittaa, että OTMoveIt yrittää päästä nettin, niin anna sen päästä sinne.

=============
tyhjennä
Malwarebytes' Anti-Malware karanteeni ja roskat

=============

scannaa uusi hjt:n loki

[ + lainaa]
Voiko tietsikka koskaan toimia?
krizu7
Junior Member
_ 		21. syyskuuta 2008 @ 16:42 _ Linkki tähän viestiin    Lähetä käyttäjälle yksityisviesti   
loki

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 16:41:21, on 21.9.2008
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16705)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Windows Defender\MsMpEng.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\taskswitch.exe
C:\Program Files\Elisa\Avustaja\Elisa.exe
C:\Program Files\ScanSoft\PaperPort\pptd40nt.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Vista Rainbar\Rainmeter.exe
C:\program files\steam\steam.exe
C:\Program Files\WinFlip\WinFlip.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\WINDOWS\system32\drivers\CDAC11BA.EXE
C:\Program Files\Microsoft SQL Server\MSSQL$PINNACLESYS\Binn\sqlservr.exe
C:\Program Files\CDBurnerXP\NMSAccessU.exe
C:\WINDOWS\system32\tcpsvcs.exe
C:\WINDOWS\System32\snmp.exe
c:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\Fast.exe
c:\program files\pinnacle\shared files\programs\mediaserver\pmshost.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\Program Files\Windows Live\Messenger\msnmsgr.exe
C:\Program Files\Windows Live\Messenger\usnsvc.exe
C:\Program Files\internet explorer\iexplore.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.fi/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
O2 - BHO: Mega Manager IE Click Monitor - {bf00e119-21a3-4fd1-b178-3b8537e75c92} - C:\Program Files\Megaupload\Mega Manager\MegaIEMn.dll
O4 - HKLM\..\Run: [BackgroundSwitcher] C:\WINDOWS\system32\bgswitch.exe
O4 - HKLM\..\Run: [CoolSwitch] C:\WINDOWS\system32\taskswitch.exe
O4 - HKLM\..\Run: [Elisa Avustaja] "C:\Program Files\Elisa\Avustaja\Elisa.exe"
O4 - HKLM\..\Run: [PaperPort PTD] "C:\Program Files\ScanSoft\PaperPort\pptd40nt.exe"
O4 - HKLM\..\Run: [IndexSearch] "C:\Program Files\ScanSoft\PaperPort\IndexSearch.exe"
O4 - HKLM\..\Run: [PinnacleDriverCheck] C:\WINDOWS\system32\PSDrvCheck.exe -CheckReg
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [Vista Rainbar] C:\Program Files\Vista Rainbar\Rainmeter.exe
O4 - HKCU\..\Run: [Steam] "c:\program files\steam\steam.exe" -silent
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Verkkopalve')
O4 - HKUS\S-1-5-18\..\Run: [DWQueuedReporting] "C:\PROGRA~1\COMMON~1\MICROS~1\DW\dwtrig20.exe" -t (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [DWQueuedReporting] "C:\PROGRA~1\COMMON~1\MICROS~1\DW\dwtrig20.exe" -t (User 'Default user')
O4 - Startup: Microsoft Office OneNote 2003 Quick Launch.lnk = C:\Program Files\Microsoft Office\OFFICE11\ONENOTEM.EXE
O4 - Startup: WinFlip.lnk = C:\Program Files\WinFlip\WinFlip.exe
O8 - Extra context menu item: &Windows Live Search - res://C:\Program Files\Windows Live Toolbar\msntb.dll/search.htm
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~4\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: Latauslinkki käyttäen Mega Manageria... - C:\Program Files\Megaupload\Mega Manager\mm_file.htm
O8 - Extra context menu item: Open Picture in &Microsoft PhotoDraw - res://C:\PROGRA~1\MICROS~4\Office\1033\phdintl.dll/phdContext.htm
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~4\OFFICE11\REFIEBAR.DLL
O16 - DPF: {1E54D648-B804-468d-BC78-4AFFED8E262E} (System Requirements Lab) - http://www.srtest.com/srl_bin/sysreqlab3.cab
O16 - DPF: {20A60F0D-9AFA-4515-A0FD-83BD84642501} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab56986.cab
O16 - DPF: {5C051655-FCD5-4969-9182-770EA5AA5565} (Solitaire Showdown Class) - http://messenger.zone.msn.com/binary/Sol...wn.cab56986.cab
O16 - DPF: {5ED80217-570B-4DA9-BF44-BE107C0EC166} (Windows Live Safety Center Base Module) - http://cdn.scan.onecare.live.com/resourc...lscbase5036.cab
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupd...b?1170431845328
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (MSN Games - Installer) - http://messenger.zone.msn.com/binary/ZIntro.cab56649.cab
O16 - DPF: {BDBDE413-7B1C-4C68-A8FF-C5B2B4090876} (F-Secure Online Scanner 3.3) - http://support.f-secure.com/ols/fscax.cab
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/Mes...nt.cab56907.cab
O16 - DPF: {F5A7706B-B9C0-4C89-A715-7A0C6B05DD48} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineSweeper.cab56986.cab
O23 - Service: Lavasoft Ad-Aware Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: C-DillaCdaC11BA - Macrovision - C:\WINDOWS\system32\drivers\CDAC11BA.EXE
O23 - Service: Pinnacle Systems tvtv Spooler (EpgSpooler) - - c:\progra~1\pinnacle\mediac~1\epgspo~2.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPod-palvelu (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: NMSAccessU - Unknown owner - C:\Program Files\CDBurnerXP\NMSAccessU.exe
O23 - Service: Pinnacle Systems Media Service (PinnacleSys.MediaServer) - Pinnacle Systems - c:\program files\pinnacle\shared files\programs\mediaserver\pmshost.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: TuneUp Drive Defrag Service (TuneUp.Defrag) - TuneUp Software GmbH - C:\WINDOWS\System32\TuneUpDefragService.exe
O23 - Service: TuneUp WinStyler Theme Service (TUWinStylerThemeSvc) - Unknown owner - C:\Program Files\TuneUp WinStyler\WinStylerThemeSvc.exe (file missing)

--
End of file - 7692 bytes


jo nyt ei enää ne hypi :D kiitokset taas loistavasta avusta :)
[ + lainaa]
Hujo
Suspended permanently
_ 		21. syyskuuta 2008 @ 16:49 _ Linkki tähän viestiin    Lähetä käyttäjälle yksityisviesti   
eli se oli örvelö siin toolbaarissa kun tuli tossa katteltua vielä
noista muista paikoista niin taas ei olisi ollut.



[ + lainaa]
Voiko tietsikka koskaan toimia?
krizu7
Junior Member
_ 		21. syyskuuta 2008 @ 16:54 _ Linkki tähän viestiin    Lähetä käyttäjälle yksityisviesti   
joo, siinä se taisi olla
[ + lainaa]
krizu7
Junior Member
_ 		22. syyskuuta 2008 @ 12:03 _ Linkki tähän viestiin    Lähetä käyttäjälle yksityisviesti   
Ei helvetti! Noita paskoja tulee vieläkin!
[ + lainaa]
krizu7
Junior Member
_ 		22. syyskuuta 2008 @ 12:39 _ Linkki tähän viestiin    Lähetä käyttäjälle yksityisviesti   
apua tartteis taas...
[ + lainaa]
Mainos
_ 		__
 
_
krizu7
Junior Member
_ 		22. syyskuuta 2008 @ 12:50 _ Linkki tähän viestiin    Lähetä käyttäjälle yksityisviesti   
noh tässä uusi hjt loki... ja tuo alko senkin jälkeen kun olin poistanu google toolbarin... nyt asensin live toolbarin sen jälkee tuo oli taas tullu............

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 12:48:29, on 22.9.2008
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16705)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\taskswitch.exe
C:\Program Files\Elisa\Avustaja\Elisa.exe
C:\Program Files\ScanSoft\PaperPort\pptd40nt.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\WINDOWS\system32\drivers\CDAC11BA.EXE
C:\Program Files\COMODO\Firewall\cmdagent.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\Program Files\COMODO\SafeSurf\cssurf.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Vista Rainbar\Rainmeter.exe
C:\Program Files\COMODO\Firewall\cfp.exe
C:\program files\steam\steam.exe
C:\Program Files\Microsoft SQL Server\MSSQL$PINNACLESYS\Binn\sqlservr.exe
C:\Program Files\WinFlip\WinFlip.exe
C:\Program Files\CDBurnerXP\NMSAccessU.exe
C:\WINDOWS\system32\tcpsvcs.exe
C:\WINDOWS\System32\snmp.exe
c:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe
C:\WINDOWS\system32\svchost.exe
c:\program files\pinnacle\shared files\programs\mediaserver\pmshost.exe
C:\WINDOWS\system32\Fast.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Windows Live\Messenger\msnmsgr.exe
C:\Program Files\Windows Live\Messenger\usnsvc.exe
C:\WINDOWS\system32\msiexec.exe
C:\Program Files\Windows Live\installer\WLSetupSvc.exe
C:\Program Files\internet explorer\iexplore.exe
C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
O2 - BHO: Windows Live Toolbar Helper - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
O2 - BHO: Mega Manager IE Click Monitor - {bf00e119-21a3-4fd1-b178-3b8537e75c92} - C:\Program Files\Megaupload\Mega Manager\MegaIEMn.dll
O3 - Toolbar: Windows Live Toolbar - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
O4 - HKLM\..\Run: [BackgroundSwitcher] C:\WINDOWS\system32\bgswitch.exe
O4 - HKLM\..\Run: [CoolSwitch] C:\WINDOWS\system32\taskswitch.exe
O4 - HKLM\..\Run: [Elisa Avustaja] "C:\Program Files\Elisa\Avustaja\Elisa.exe"
O4 - HKLM\..\Run: [PaperPort PTD] "C:\Program Files\ScanSoft\PaperPort\pptd40nt.exe"
O4 - HKLM\..\Run: [IndexSearch] "C:\Program Files\ScanSoft\PaperPort\IndexSearch.exe"
O4 - HKLM\..\Run: [PinnacleDriverCheck] C:\WINDOWS\system32\PSDrvCheck.exe -CheckReg
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [COMODO SafeSurf] "C:\Program Files\COMODO\SafeSurf\cssurf.exe" -s
O4 - HKLM\..\Run: [COMODO Firewall Pro] "C:\Program Files\COMODO\Firewall\cfp.exe" -h
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [Vista Rainbar] C:\Program Files\Vista Rainbar\Rainmeter.exe
O4 - HKCU\..\Run: [Steam] "c:\program files\steam\steam.exe" -silent
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Verkkopalve')
O4 - HKUS\S-1-5-18\..\Run: [DWQueuedReporting] "C:\PROGRA~1\COMMON~1\MICROS~1\DW\dwtrig20.exe" -t (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [DWQueuedReporting] "C:\PROGRA~1\COMMON~1\MICROS~1\DW\dwtrig20.exe" -t (User 'Default user')
O4 - Startup: Microsoft Office OneNote 2003 Quick Launch.lnk = C:\Program Files\Microsoft Office\OFFICE11\ONENOTEM.EXE
O4 - Startup: WinFlip.lnk = C:\Program Files\WinFlip\WinFlip.exe
O8 - Extra context menu item: &Windows Live Search - res://C:\Program Files\Windows Live Toolbar\msntb.dll/search.htm
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~4\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: Latauslinkki käyttäen Mega Manageria... - C:\Program Files\Megaupload\Mega Manager\mm_file.htm
O8 - Extra context menu item: Open Picture in &Microsoft PhotoDraw - res://C:\PROGRA~1\MICROS~4\Office\1033\phdintl.dll/phdContext.htm
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~4\OFFICE11\REFIEBAR.DLL
O16 - DPF: {1E54D648-B804-468d-BC78-4AFFED8E262E} (System Requirements Lab) - http://www.srtest.com/srl_bin/sysreqlab3.cab
O16 - DPF: {20A60F0D-9AFA-4515-A0FD-83BD84642501} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab56986.cab
O16 - DPF: {5C051655-FCD5-4969-9182-770EA5AA5565} (Solitaire Showdown Class) - http://messenger.zone.msn.com/binary/Sol...wn.cab56986.cab
O16 - DPF: {5ED80217-570B-4DA9-BF44-BE107C0EC166} (Windows Live Safety Center Base Module) - http://cdn.scan.onecare.live.com/resourc...lscbase5036.cab
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupd...b?1170431845328
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (MSN Games - Installer) - http://messenger.zone.msn.com/binary/ZIntro.cab56649.cab
O16 - DPF: {BDBDE413-7B1C-4C68-A8FF-C5B2B4090876} (F-Secure Online Scanner 3.3) - http://support.f-secure.com/ols/fscax.cab
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/Mes...nt.cab56907.cab
O16 - DPF: {F5A7706B-B9C0-4C89-A715-7A0C6B05DD48} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineSweeper.cab56986.cab
O20 - AppInit_DLLs: C:\WINDOWS\system32\guard32.dll C:\WINDOWS\system32\cssdll32.dll
O23 - Service: Lavasoft Ad-Aware Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: C-DillaCdaC11BA - Macrovision - C:\WINDOWS\system32\drivers\CDAC11BA.EXE
O23 - Service: COMODO Firewall Pro Helper Service (cmdAgent) - Unknown owner - C:\Program Files\COMODO\Firewall\cmdagent.exe
O23 - Service: Pinnacle Systems tvtv Spooler (EpgSpooler) - - c:\progra~1\pinnacle\mediac~1\epgspo~2.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPod-palvelu (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: NMSAccessU - Unknown owner - C:\Program Files\CDBurnerXP\NMSAccessU.exe
O23 - Service: Pinnacle Systems Media Service (PinnacleSys.MediaServer) - Pinnacle Systems - c:\program files\pinnacle\shared files\programs\mediaserver\pmshost.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: TuneUp Drive Defrag Service (TuneUp.Defrag) - TuneUp Software GmbH - C:\WINDOWS\System32\TuneUpDefragService.exe
O23 - Service: TuneUp WinStyler Theme Service (TUWinStylerThemeSvc) - Unknown owner - C:\Program Files\TuneUp WinStyler\WinStylerThemeSvc.exe (file missing)

--
End of file - 8621 bytes
[ + lainaa]
 
Sivu:12>
afterdawn.com > keskustelu > yleistä keskustelua tietokoneista > virukset ja haittaohjelmat > mesevirus.... saanko apuu tähä noita pomppii jatkuvasti taas!
 

Apua ongelmiin: AfterDawnin keskustelualueet | AfterDawnin Vastaukset
Uutiset: IT-alan uutiset | Uutisia puhelimista
Musiikkia: MP3Lizard.com
Tuotearviot: Laitevertailu | Vertaa puhelimia | Vertaa kännykkäliittymiä
Pelit: Pelitiedostot, pelidemot ja trailerit
Ohjelmat: download.fi | AfterDawnin ohjelma-alueet
International: AfterDawn in English | Software downloads | Free, legal MP3s | AfterDawn på svenska
RSS -syötteet: AfterDawnin uutiset | Uusimmat ohjelmapäivitykset | Keskustelualueiden viestit
Tietoja: Tietoa AfterDawn Oy:stä | Mainosta sivuillamme | Sivuston käyttöehdot ja tietoja yksityisyydensuojasta
Ota yhteyttä: Lähetä palautetta | Ota yhteyttä mainosmyyntiimme
 
  © 1999-2025 AfterDawn Oy