Kone on alkanut sekoileen oikein urakalla. Jatkuvasti tulee virhe ilmoituksia mistä ohjelmista milloinkin. Jäljet näytti johtavan W32/Sonebot-B madon jäljille??? http://www.sophos.com/virusinfo/analyses/w32sonebotb.html Koneelta löytyy linkissä mainittava wmiprvse.exe tiedosto, mutta poistaminen ei oikein näillä taidoilla onnistu Voisko joku auttaa!? Laitan hjt-login mukaan... Logfile of Trend Micro HijackThis v2.0.0 (BETA) Scan saved at 21:09:54, on 24.4.2007 Platform: Windows XP SP2 (WinNT 5.01.2600) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\Ati2evxx.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe C:\WINDOWS\system32\Ati2evxx.exe C:\WINDOWS\Explorer.EXE C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe C:\Program Files\Common Files\Symantec Shared\ccProxy.exe C:\Program Files\Symantec Client Security\Symantec Client Firewall\ISSVC.exe C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe C:\WINDOWS\system32\spoolsv.exe C:\Program Files\BUFFALO\Client Manager3\bwsvc\bwsvc.exe C:\Program Files\Symantec Client Security\Symantec AntiVirus\DefWatch.exe C:\Program Files\Common Files\LightScribe\LSSrvc.exe C:\WINDOWS\system32\svchost.exe C:\Program Files\Symantec Client Security\Symantec AntiVirus\Rtvscan.exe C:\Program Files\Symantec Client Security\Symantec Client Firewall\SymSPort.exe C:\WINDOWS\SOUNDMAN.EXE C:\Program Files\Common Files\Symantec Shared\ccApp.exe C:\PROGRA~1\SYMANT~1\SYMANT~2\VPTray.exe C:\Program Files\Google\Gmail Notifier\gnotify.exe C:\Program Files\ATI Technologies\ATI.ACE\cli.exe C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe C:\Program Files\Microsoft IntelliType Pro\itype.exe C:\Program Files\Microsoft IntelliPoint\ipoint.exe C:\Program Files\ScanSoft\OmniPageSE4.0\OpwareSE4.exe C:\Program Files\Macrogaming\SweetIM\SweetIM.exe C:\WINDOWS\system32\ctfmon.exe C:\Program Files\DAEMON Tools\daemon.exe C:\Program Files\utorrent.exe C:\Program Files\Skype\Phone\Skype.exe C:\Program Files\YourWare Solutions\FreeRAM XP Pro\FreeRAM XP Pro.exe C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\BUFFALO\Client Manager3\cm3_tray.exe C:\Program Files\Common Files\Ahead\Lib\NMIndexStoreSvr.exe C:\Program Files\MSN Messenger\MsnMsgr.Exe C:\Program Files\ATI Technologies\ATI.ACE\cli.exe C:\Program Files\ATI Technologies\ATI.ACE\cli.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\MSN Messenger\usnsvc.exe C:\Documents and Settings\Heikki\Työpöytä\HiJackThis_v2.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Linkit R3 - URLSearchHook: SweetIM For Internet Explorer - {BC4FFE41-DE9F-46fa-B455-AAD49B9F9938} - C:\Program Files\Macrogaming\SweetIMBarForIE\toolbar.dll O2 - BHO: Adobe PDF Reader -linkkiavustaja - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll O2 - BHO: SWEETIE - {1A0AADCD-3A72-4b5f-900F-E3BB5A838E2A} - C:\PROGRA~1\MACROG~1\SWEETI~1\toolbar.dll O2 - BHO: Canon Easy Web Print Helper - {68F9551E-0411-48E4-9AAF-4BC42A6A46BE} - C:\Program Files\Canon\Easy-WebPrint\EWPBrowseLoader.dll O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file) O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll O3 - Toolbar: Easy-WebPrint - {327C2873-E90D-4c37-AA9D-10AC9BABA46C} - C:\Program Files\Canon\Easy-WebPrint\Toolband.dll O3 - Toolbar: SweetIM For Internet Explorer - {BC4FFE41-DE9F-46fa-B455-AAD49B9F9938} - C:\Program Files\Macrogaming\SweetIMBarForIE\toolbar.dll O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe" O4 - HKLM\..\Run: [vptray] C:\PROGRA~1\SYMANT~1\SYMANT~2\VPTray.exe O4 - HKLM\..\Run: [{0228e555-4f9c-4e35-a3ec-b109a192b4c2}] C:\Program Files\Google\Gmail Notifier\gnotify.exe O4 - HKLM\..\Run: [ATICCC] "C:\Program Files\ATI Technologies\ATI.ACE\cli.exe" runtime -Delay O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe" O4 - HKLM\..\Run: [itype] "C:\Program Files\Microsoft IntelliType Pro\itype.exe" O4 - HKLM\..\Run: [IntelliPoint] "C:\Program Files\Microsoft IntelliPoint\ipoint.exe" O4 - HKLM\..\Run: [SSBkgdUpdate] "C:\Program Files\Common Files\Scansoft Shared\SSBkgdUpdate\SSBkgdupdate.exe" -Embedding -boot O4 - HKLM\..\Run: [OpwareSE4] "C:\Program Files\ScanSoft\OmniPageSE4.0\OpwareSE4.exe" O4 - HKLM\..\Run: [SweetIM] C:\Program Files\Macrogaming\SweetIM\SweetIM.exe O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [DAEMON Tools] "C:\Program Files\DAEMON Tools\daemon.exe" -lang 1033 O4 - HKCU\..\Run: [MsnMsgr] ~"C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background O4 - HKCU\..\Run: [µTorrent] "C:\Program Files\utorrent.exe" O4 - HKCU\..\Run: [Skype] "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized O4 - HKCU\..\Run: [FreeRAM XP] "C:\Program Files\YourWare Solutions\FreeRAM XP Pro\FreeRAM XP Pro.exe" -win O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe" O4 - HKCU\..\Run: [SweetIM] C:\Program Files\Macrogaming\SweetIM\SweetIM.exe O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Paikallinen palve') O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Verkkopalve') O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM') O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user') O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Reader 8.0\Reader\reader_sl.exe O4 - Global Startup: Adobe Reader Synchronizer.lnk = C:\Program Files\Adobe\Reader 8.0\Reader\AdobeCollabSync.exe O4 - Global Startup: ClientManager3.lnk = C:\Program Files\BUFFALO\Client Manager3\cm3_tray.exe O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000 O8 - Extra context menu item: Easy-WebPrint Add To Print List - res://C:\Program Files\Canon\Easy-WebPrint\Toolband.dll/RC_AddToList.html O8 - Extra context menu item: Easy-WebPrint High Speed Print - res://C:\Program Files\Canon\Easy-WebPrint\Toolband.dll/RC_HSPrint.html O8 - Extra context menu item: Easy-WebPrint Preview - res://C:\Program Files\Canon\Easy-WebPrint\Toolband.dll/RC_Preview.html O8 - Extra context menu item: Easy-WebPrint Print - res://C:\Program Files\Canon\Easy-WebPrint\Toolband.dll/RC_Print.html O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL O22 - SharedTaskScheduler: Browseui preloader - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - C:\WINDOWS\system32\browseui.dll O22 - SharedTaskScheduler: Component Categories cache daemon - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\WINDOWS\system32\browseui.dll O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe O23 - Service: Bwsvc - BUFFALO INC. - C:\Program Files\BUFFALO\Client Manager3\bwsvc\bwsvc.exe O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe O23 - Service: Symantec Network Proxy (ccProxy) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccProxy.exe O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe O23 - Service: Symantec AntiVirus Definition Watcher (DefWatch) - Symantec Corporation - C:\Program Files\Symantec Client Security\Symantec AntiVirus\DefWatch.exe O23 - Service: Loogisen levyn hallinnan valvontapalvelu (dmadmin) - Unknown owner - C:\WINDOWS\System32\dmadmin.exe O23 - Service: Tapahtumaloki (Eventlog) - Unknown owner - C:\WINDOWS\system32\services.exe O23 - Service: CD-levyjen kirjoittamisen IMAPI COM -palvelu (ImapiService) - Unknown owner - C:\WINDOWS\system32\imapi.exe O23 - Service: IS Service (ISSVC) - Symantec Corporation - C:\Program Files\Symantec Client Security\Symantec Client Firewall\ISSVC.exe O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE O23 - Service: NetMeeting etätyöpöydän jakaminen (mnmsrvc) - Unknown owner - C:\WINDOWS\system32\mnmsrvc.exe O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe O23 - Service: Plug and Play (PlugPlay) - Unknown owner - C:\WINDOWS\system32\services.exe O23 - Service: Etätyöpöydän ohjeen istunnonhallinta (RDSessMgr) - Unknown owner - C:\WINDOWS\system32\sessmgr.exe O23 - Service: SAVRoam (SavRoam) - symantec - C:\Program Files\Symantec Client Security\Symantec AntiVirus\SavRoam.exe O23 - Service: Älykortti (SCardSvr) - Unknown owner - C:\WINDOWS\System32\SCardSvr.exe O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe O23 - Service: Symantec AntiVirus - Symantec Corporation - C:\Program Files\Symantec Client Security\Symantec AntiVirus\Rtvscan.exe O23 - Service: Symantec SecurePort (SymSecurePort) - Symantec Corporation - C:\Program Files\Symantec Client Security\Symantec Client Firewall\SymSPort.exe O23 - Service: Resurssilokit ja -hälytykset (SysmonLog) - Unknown owner - C:\WINDOWS\system32\smlogsvc.exe O23 - Service: Aseman tilannevedos (VSS) - Unknown owner - C:\WINDOWS\System32\vssvc.exe O23 - Service: WMI resurssisovitin (WmiApSrv) - Unknown owner - C:\WINDOWS\system32\wbem\wmiapsrv.exe -- End of file - 10931 bytes
C:\WINDOWS\system32\wbem\wmiprvse.exe ja toisesta paikasta löytyy tällainen C:\WINDOWS\Prefetch\WMIPRVSE.EXE-28F301A9.pf Virheessä mainittiin tuo wmiprvse.exe ja googlea käyttämällä löysin tuon linkin.
Nuo ovat ihan luvallisia, mutta jos olisi esim. C:\Windows\System32 -hakemistossa kuten antamasi linkki kertoi, kyseessä olisi pöpö. Joten tuosta tuskin on kyse. Voisitko kertoa millaisia virheilmoituksia tulee, mahd. tarkasti, sekä millä tavalla kone sekoilee urakalla?
juu.. kone on sammunut ja käynnistynyt itsestään jo pidemmän aikaa. Siitä se ilmoittaa jonkun laiteajuri vian, jota en ole saanut selvitetyä tarkalleen mistä johtuu. Epäilen Buffalon wlan-järjestelmää, koska sen asennuksen jälkeen ongelmat alkoi. Varma en ole. Nyt on firefox, evolution-sähköposti, live messenger, tämä wmiprvse.exe ja saattaa myös joitain muita ohjelmia listaan kuulua, jotka aiheuttaa virheen ja windows sammuttaa ohjelman. Kysyy sitten lähetetäänkö virheraportti. Tämän tarkempia tietoja ei tähän ole, kun nämäkin perustuu "hyvään" muistiini
Lokissa ei kyllä näyttäisi olevan mitään erikoista. Mutta voisit varmuudeksi ajaa AVGAS:n. Tallenna nämä ohjeet tekstitiedostoon tai tulosta nämä, muuten et pääse niihin käsiksi vikasietotilasta Lataa AVG Anti-Spyware 7.5 ja tallenna ohjelma työpöydällesi. [*]Kun olet ladannut ohjelman, kaksoisklikkaa asennuohjelman pikakuvaketta työpöydälläsi, asennus alkaa. [*]Asennuksen jälkeen täytyy ohjelma käynnistää ja sen tunnisteet päivittää. [*]Käynnistä AVG Anti-Spyware. [*]Klikkaa "Update" kuvaketta päävalikossa. Sen jälkeen klikkaa "Update now" painiketta. [*]Sitten klikkaa "Start Update" kuvaketta jolloin päivitys alkaa. [*]Kun päivitykset on ladattu, klikkaa "Scanner" kuvaketta ikkunan ylälaidassa. Valitse sitten "Settings" välilehti. [*]Kun "Settings" valikko on auennut, klikkaa "Recommended actions" ja sitten valitse "Quarantine". [*]Sitten "Reports" valikon alta: [*]Laita täppi kohtaan "Automatically generate report after every scan" [*]Ota täppi pois kohdasta"Only if threats were found" [*]Sitten klikkaa "Shield" kuvaketta ikkunan ylälaidassa [*]"Resident shield is", muuta tila active:sta inactive:ksi [*]Sulje ohjelma, ÄLÄ skannaa vielä. Käynnistä koneesi vikasietotilaan, Ohje! HUOM! Älä käytä muita ohjelmia AVG skannauksen aikana, tämä saattaa häiritä skannausta. [*]Kun vikasietotilassa, käynnistä AVG Anti-Spyware. [*]Klikkaa "Scanner" kuvaketta ikkunan ylälaidassa ja valitse "Scan" välilehti. Sitten klikkaa "Complete System Scan". [*]AVG aloittaa nyt tietokoneen skannaamisen, ole kärsivällinen sillä skannaus vie aikaa. Kun skannaus on valmis: TÄRKEÄÄ : Älä klikkaa "Save Scan Report" ennen kuin klikkaat "Apply all Actions" [*]Varmistu, että Set all elements to: näyttää Quarantine (1), jos ei, klikkaa linkkiä ja valitse Quarantine popup-valikosta. [*]Sinulta kysytään mitä tehdä jos infektioita löytyi, valitse silloin "Apply all actions" [*]Sitten klikkaa "Reports" kuvaketta ohjelma yläosasta. [*]Klikkaa "Save report as" painiketta ikkunan vasemmassa alalaidassa ja tallenna raportti työpöydälle. [*]Sulje ohjelma, käynnistä kone normaalisti ja lähetä AVG Anti-Spyware:n raportti viestikejuusi.
AVG:n päivityksessä hiukan ongelmia, mutta onnistui viimein.. --------------------------------------------------------- AVG Anti-Spyware - Scan Report --------------------------------------------------------- + Created at: 18:54:20 25.4.2007 + Scan result: C:\Program Files\Suunnistussimulaattori Demo\bin\OSimu.exe -> Backdoor.Sdbot : Cleaned with backup (quarantined). :mozilla.424:C:\Documents and Settings\Heikki\Application Data\Mozilla\Firefox\Profiles\tp0natqp.default\cookies-1.txt -> TrackingCookie.Adobe : Cleaned. :mozilla.424:C:\Documents and Settings\Heikki\Local Settings\Application Data\Mozilla\Firefox\Profiles\tp0natqp.default\cookies-1.txt -> TrackingCookie.Adobe : Cleaned. :mozilla.424:\Firefoxin varmuuskopionti\czxvwwtb.default\cookies-1.txt -> TrackingCookie.Adobe : Cleaned. :mozilla.359:C:\Documents and Settings\Heikki\Application Data\Mozilla\Firefox\Profiles\tp0natqp.default\cookies-1.txt -> TrackingCookie.Gemius : Cleaned. :mozilla.359:C:\Documents and Settings\Heikki\Local Settings\Application Data\Mozilla\Firefox\Profiles\tp0natqp.default\cookies-1.txt -> TrackingCookie.Gemius : Cleaned. :mozilla.359:\Firefoxin varmuuskopionti\czxvwwtb.default\cookies-1.txt -> TrackingCookie.Gemius : Cleaned. :mozilla.360:C:\Documents and Settings\Heikki\Application Data\Mozilla\Firefox\Profiles\tp0natqp.default\cookies-1.txt -> TrackingCookie.Gemius : Cleaned. :mozilla.360:C:\Documents and Settings\Heikki\Local Settings\Application Data\Mozilla\Firefox\Profiles\tp0natqp.default\cookies-1.txt -> TrackingCookie.Gemius : Cleaned. :mozilla.360:\Firefoxin varmuuskopionti\czxvwwtb.default\cookies-1.txt -> TrackingCookie.Gemius : Cleaned. :mozilla.288:C:\Documents and Settings\Heikki\Local Settings\Application Data\Mozilla\Firefox\Profiles\tp0natqp.default\cookies.txt -> TrackingCookie.Imrworldwide : Cleaned. :mozilla.288:\Firefoxin varmuuskopionti\czxvwwtb.default\cookies.txt -> TrackingCookie.Imrworldwide : Cleaned. :mozilla.89:C:\Documents and Settings\Heikki\Application Data\Mozilla\Firefox\Profiles\tp0natqp.default\cookies-1.txt -> TrackingCookie.Imrworldwide : Cleaned. :mozilla.89:C:\Documents and Settings\Heikki\Local Settings\Application Data\Mozilla\Firefox\Profiles\tp0natqp.default\cookies-1.txt -> TrackingCookie.Imrworldwide : Cleaned. :mozilla.89:\Firefoxin varmuuskopionti\czxvwwtb.default\cookies-1.txt -> TrackingCookie.Imrworldwide : Cleaned. :mozilla.90:C:\Documents and Settings\Heikki\Application Data\Mozilla\Firefox\Profiles\tp0natqp.default\cookies-1.txt -> TrackingCookie.Imrworldwide : Cleaned. :mozilla.90:C:\Documents and Settings\Heikki\Local Settings\Application Data\Mozilla\Firefox\Profiles\tp0natqp.default\cookies-1.txt -> TrackingCookie.Imrworldwide : Cleaned. :mozilla.90:\Firefoxin varmuuskopionti\czxvwwtb.default\cookies-1.txt -> TrackingCookie.Imrworldwide : Cleaned. :mozilla.291:C:\Documents and Settings\Heikki\Local Settings\Application Data\Mozilla\Firefox\Profiles\tp0natqp.default\cookies.txt -> TrackingCookie.Intelli-direct : Cleaned. :mozilla.291:\Firefoxin varmuuskopionti\czxvwwtb.default\cookies.txt -> TrackingCookie.Intelli-direct : Cleaned. :mozilla.420:C:\Documents and Settings\Heikki\Application Data\Mozilla\Firefox\Profiles\tp0natqp.default\cookies-1.txt -> TrackingCookie.Paypal : Cleaned. :mozilla.420:C:\Documents and Settings\Heikki\Local Settings\Application Data\Mozilla\Firefox\Profiles\tp0natqp.default\cookies-1.txt -> TrackingCookie.Paypal : Cleaned. :mozilla.420:\Firefoxin varmuuskopionti\czxvwwtb.default\cookies-1.txt -> TrackingCookie.Paypal : Cleaned. :mozilla.201:C:\Documents and Settings\Heikki\Local Settings\Application Data\Mozilla\Firefox\Profiles\tp0natqp.default\cookies.txt -> TrackingCookie.Revsci : Cleaned. :mozilla.201:\Firefoxin varmuuskopionti\czxvwwtb.default\cookies.txt -> TrackingCookie.Revsci : Cleaned. :mozilla.202:C:\Documents and Settings\Heikki\Local Settings\Application Data\Mozilla\Firefox\Profiles\tp0natqp.default\cookies.txt -> TrackingCookie.Revsci : Cleaned. :mozilla.202:\Firefoxin varmuuskopionti\czxvwwtb.default\cookies.txt -> TrackingCookie.Revsci : Cleaned. :mozilla.203:C:\Documents and Settings\Heikki\Local Settings\Application Data\Mozilla\Firefox\Profiles\tp0natqp.default\cookies.txt -> TrackingCookie.Revsci : Cleaned. :mozilla.203:\Firefoxin varmuuskopionti\czxvwwtb.default\cookies.txt -> TrackingCookie.Revsci : Cleaned. :mozilla.204:C:\Documents and Settings\Heikki\Local Settings\Application Data\Mozilla\Firefox\Profiles\tp0natqp.default\cookies.txt -> TrackingCookie.Revsci : Cleaned. :mozilla.204:\Firefoxin varmuuskopionti\czxvwwtb.default\cookies.txt -> TrackingCookie.Revsci : Cleaned. :mozilla.418:C:\Documents and Settings\Heikki\Application Data\Mozilla\Firefox\Profiles\tp0natqp.default\cookies-1.txt -> TrackingCookie.Revsci : Cleaned. :mozilla.418:C:\Documents and Settings\Heikki\Local Settings\Application Data\Mozilla\Firefox\Profiles\tp0natqp.default\cookies-1.txt -> TrackingCookie.Revsci : Cleaned. :mozilla.418:\Firefoxin varmuuskopionti\czxvwwtb.default\cookies-1.txt -> TrackingCookie.Revsci : Cleaned. :mozilla.419:C:\Documents and Settings\Heikki\Application Data\Mozilla\Firefox\Profiles\tp0natqp.default\cookies-1.txt -> TrackingCookie.Revsci : Cleaned. :mozilla.419:C:\Documents and Settings\Heikki\Local Settings\Application Data\Mozilla\Firefox\Profiles\tp0natqp.default\cookies-1.txt -> TrackingCookie.Revsci : Cleaned. :mozilla.419:\Firefoxin varmuuskopionti\czxvwwtb.default\cookies-1.txt -> TrackingCookie.Revsci : Cleaned. :mozilla.13:C:\Documents and Settings\Heikki\Application Data\Mozilla\Firefox\Profiles\tp0natqp.default\cookies.txt -> TrackingCookie.Statistik-gallup : Cleaned. :mozilla.15:C:\Documents and Settings\Heikki\Local Settings\Application Data\Mozilla\Firefox\Profiles\tp0natqp.default\cookies.txt -> TrackingCookie.Statistik-gallup : Cleaned. :mozilla.15:\Firefoxin varmuuskopionti\czxvwwtb.default\cookies.txt -> TrackingCookie.Statistik-gallup : Cleaned. :mozilla.22:C:\Documents and Settings\Heikki\Application Data\Mozilla\Firefox\Profiles\tp0natqp.default\cookies-1.txt -> TrackingCookie.Statistik-gallup : Cleaned. :mozilla.22:C:\Documents and Settings\Heikki\Local Settings\Application Data\Mozilla\Firefox\Profiles\tp0natqp.default\cookies-1.txt -> TrackingCookie.Statistik-gallup : Cleaned. :mozilla.22:\Firefoxin varmuuskopionti\czxvwwtb.default\cookies-1.txt -> TrackingCookie.Statistik-gallup : Cleaned. C:\Documents and Settings\Heikki\Cookies\heikki@statistik-gallup[1].txt -> TrackingCookie.Statistik-gallup : Cleaned. :mozilla.178:C:\Documents and Settings\Heikki\Local Settings\Application Data\Mozilla\Firefox\Profiles\tp0natqp.default\cookies.txt -> TrackingCookie.Toplist : Cleaned. :mozilla.178:\Firefoxin varmuuskopionti\czxvwwtb.default\cookies.txt -> TrackingCookie.Toplist : Cleaned. :mozilla.35:C:\Documents and Settings\Heikki\Application Data\Mozilla\Firefox\Profiles\tp0natqp.default\cookies.txt -> TrackingCookie.Webtrends : Cleaned. :mozilla.409:C:\Documents and Settings\Heikki\Application Data\Mozilla\Firefox\Profiles\tp0natqp.default\cookies-1.txt -> TrackingCookie.Webtrends : Cleaned. :mozilla.409:C:\Documents and Settings\Heikki\Local Settings\Application Data\Mozilla\Firefox\Profiles\tp0natqp.default\cookies-1.txt -> TrackingCookie.Webtrends : Cleaned. :mozilla.409:\Firefoxin varmuuskopionti\czxvwwtb.default\cookies-1.txt -> TrackingCookie.Webtrends : Cleaned. :mozilla.90:C:\Documents and Settings\Heikki\Local Settings\Application Data\Mozilla\Firefox\Profiles\tp0natqp.default\cookies.txt -> TrackingCookie.Webtrends : Cleaned. :mozilla.90:\Firefoxin varmuuskopionti\czxvwwtb.default\cookies.txt -> TrackingCookie.Webtrends : Cleaned. D:\Torrent\NEW.Microsoft.Windows.Vista.RTM.2099.Activation.Crack-CLoNY.zip/NEW.Microsoft.Windows.Vista.RTM.2099.Activation.Crack-CLoNY/2_Step/Vista RTM Crack.exe -> Trojan.Activcrk.a : Cleaned with backup (quarantined). D:\Torrent\NEW.Microsoft.Windows.Vista.RTM.2099.Activation.Crack-CLoNY\NEW.Microsoft.Windows.Vista.RTM.2099.Activation.Crack-CLoNY\2_Step\Vista RTM Crack.exe -> Trojan.Activcrk.a : Cleaned with backup (quarantined). D:\Torrent\NEW.Microsoft.Windows.Vista.RTM.2099.Activation.Crack-CLoNY.zip/NEW.Microsoft.Windows.Vista.RTM.2099.Activation.Crack-CLoNY/2_Step/timerstop.sys -> Trojan.ActivCrk.b : Cleaned with backup (quarantined). D:\Torrent\NEW.Microsoft.Windows.Vista.RTM.2099.Activation.Crack-CLoNY\NEW.Microsoft.Windows.Vista.RTM.2099.Activation.Crack-CLoNY\2_Step\timerstop.sys -> Trojan.ActivCrk.b : Cleaned with backup (quarantined). ::Report end
Laitoin vielä scannauksen päälle normaalitilassa ja sieltä löytyi vielä jotain pöpöjä, mutta sitten kone taas sammui. Käynnistin vikasietotilassa ja yritin useaan kertaan scannata siellä, mutta sielläkin sammuu ja käynnistää normaalitilassa. Hullummaksi menee!!!
Olisi enemmän hyötyä, kun ottaisit tarkasti ylös, mitä "pöpöjä" löytyi... 1. Lataa SDFix by AndyManchesta ja tallenna se työpöydällesi. Käynnistä koneesi vikasietotilaan ja valitse tavallinen käyttäjätilisi:[*]Käynnistä tietokone [*]Kun kuulet koneen piippaavan, paina F8, kuitenkin ennen Windowsin logon esiintuloa [*]Seuraavaksi pitäisi ilmestyä valikko [*]Valitse valikosta vikasietotila. [*] Kun vikasietotilassa, pura tiedoston SDFix.zip sisältö (SDFix.exe) työpöydälle. Tuplakilikkaa työpöydälle ilmestynyttä sdfix.exe tiedostoa. Tiedosto purkaantuu ja asentaa itsensä siihen levyasemaan, minne on käyttöjärjestelmä on asennettu ja juureen ilmestyy kansio SDFix, ESIM C:\SDFix [*] Avaa SDFix-kansio ja tuplaklikkaa tiedostoa RunThis.bat käynnistääksesi ohjelman. [*] Paina Y käynnistääksesi skriptin. [*] Työkalu puhdistaa troijalaisen palvelut ja tekee myös joitakin korjauksia rekisteriin. Lopuksi se pyytää käynnistämään koneen uudelleen, "Press any key to Reboot". [*] Paina mitä tahansa näppäintä ja kone käynnistyy uudelleen. [*] Käynnistyminen kestää normaalia kauemmin sillä SDFix puhdistaa konetta. [*] Kun kone on käynnistynyt ja työpöytä latautunut, SDFix kertoo että puhdistus on suoritettu, "Finished". [*] Paina sitten mitä tahansa näppäintä sulkeaksesi skriptin ja ladataksesi pikakuvakkeet työpöydälle. [*] Lopuksi avaa SDFix kansio ja kopioi & liitä tiedoston Report.txt sisältö viestiketjuusi uuden HijackThis lokin kera. 2. Lataa Deckard's System Scanner Työpöydällesi. Huomioi: Sinulla tulee olla Järjestelmänvalvojan oikeudet ajaaksesi ohjelman. [*]Sulje kaikki avoimet ikkunat ja ohjelmat. [*]Tupla Klikkaa Dss.exe tiedostoa ajaaksesi ohjelman, seuraa ohjeita. [*]Kun Scannaus on valmis 2 textitiedostoa pitäisi avautua, Main.txt ja extra.txt [*]Näppäile Kopioi ( CTRL+A -> CTRL + C ) ja liitä ( CTRL + V ) [*]kopioi ja liitä main.txt ja extra.txt sisältö seuraavaan vastaukseesi.
SDFix: Version 1.79 Run by Heikki - to 26.04.2007 - 14:45:49,62 Microsoft Windows XP [versio 5.1.2600] Running From: C:\DOCUME~1\Heikki\TYPYT~1\SDFix\SDFix Safe Mode: Checking Services: Restoring Windows Registry Values Restoring Windows Default Hosts File Rebooting... Normal Mode: Checking Files: No Trojan Files Found... Removing Temp Files ADS Check: Checking if ADS is attached to system32 Folder C:\WINDOWS\system32 No streams found. Checking if ADS is attached to svchost.exe C:\WINDOWS\system32\svchost.exe No streams found. Final Check: Remaining Services: ------------------ Authorized Application Key Export: [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List] "%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabledxpsp2res.dll,-22019" "C:\\Program Files\\BUFFALO\\Client Manager3\\BWSVC\\bwsvc.exe"="C:\\Program Files\\BUFFALO\\Client Manager3\\BWSVC\\bwsvc.exe:*:Enabled:ClientMgr3" "C:\\Program Files\\BUFFALO\\Client Manager3\\AOSS\\aoss.exe"="C:\\Program Files\\BUFFALO\\Client Manager3\\AOSS\\aoss.exe:*:Enabled:Aoss" "C:\\Program Files\\MSN Messenger\\msnmsgr.exe"="C:\\Program Files\\MSN Messenger\\msnmsgr.exe:*:Enabled:Windows Live Messenger 8.1" "C:\\Program Files\\MSN Messenger\\livecall.exe"="C:\\Program Files\\MSN Messenger\\livecall.exe:*:Enabled:Windows Live Messenger 8.1 (Phone)" "C:\\Documents and Settings\\Heikki\\Työpöytä\\utorrent.exe"="C:\\Documents and Settings\\Heikki\\Työpöytä\\utorrent.exe:*:Enabled:µTorrent" "C:\\Program Files\\utorrent.exe"="C:\\Program Files\\utorrent.exe:*:Enabled:µTorrent" "C:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE"="C:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE:*:Enabled:Microsoft Office Outlook" "C:\\Program Files\\PPMate\\ppmate.exe"="C:\\Program Files\\PPMate\\ppmate.exe:*:EnabledPMate" "C:\\Program Files\\PPMate\\ppmnet.exe"="C:\\Program Files\\PPMate\\ppmnet.exe:*:EnabledPMate" "C:\\Program Files\\Skype\\Phone\\Skype.exe"="C:\\Program Files\\Skype\\Phone\\Skype.exe:*:Enabled:Skype" [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List] "%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabledxpsp2res.dll,-22019" "C:\\Program Files\\MSN Messenger\\msnmsgr.exe"="C:\\Program Files\\MSN Messenger\\msnmsgr.exe:*:Enabled:Windows Live Messenger 8.1" "C:\\Program Files\\MSN Messenger\\livecall.exe"="C:\\Program Files\\MSN Messenger\\livecall.exe:*:Enabled:Windows Live Messenger 8.1 (Phone)" Remaining Files: --------------- Checking For Files with Hidden Attributes: C:\Program Files\Canon\MP Navigator 3.0\uinstrsc.dll C:\Program Files\Canon\MP Navigator 3.0\Maint.exe C:\Documents and Settings\All Users\DRM\Cache\Indiv01.tmp Finished Logfile of HijackThis v1.99.1 Scan saved at 15:15:18, on 26.4.2007 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\Ati2evxx.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe C:\WINDOWS\system32\Ati2evxx.exe C:\WINDOWS\Explorer.EXE C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe C:\Program Files\Common Files\Symantec Shared\ccProxy.exe C:\Program Files\Symantec Client Security\Symantec Client Firewall\ISSVC.exe C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe C:\WINDOWS\system32\spoolsv.exe C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe C:\Program Files\BUFFALO\Client Manager3\bwsvc\bwsvc.exe C:\Program Files\Symantec Client Security\Symantec AntiVirus\DefWatch.exe C:\Program Files\Common Files\LightScribe\LSSrvc.exe C:\WINDOWS\system32\svchost.exe C:\Program Files\Symantec Client Security\Symantec AntiVirus\Rtvscan.exe C:\Program Files\Symantec Client Security\Symantec Client Firewall\SymSPort.exe C:\PROGRA~1\SYMANT~1\SYMANT~2\VPTray.exe C:\Program Files\Macrogaming\SweetIM\SweetIM.exe C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe C:\Program Files\ScanSoft\OmniPageSE4.0\OpwareSE4.exe C:\Program Files\Microsoft IntelliType Pro\itype.exe C:\Program Files\Microsoft IntelliPoint\ipoint.exe C:\Program Files\Common Files\Symantec Shared\ccApp.exe C:\WINDOWS\system32\ctfmon.exe C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe C:\Program Files\BUFFALO\Client Manager3\cm3_tray.exe C:\Program Files\Common Files\Ahead\Lib\NMIndexStoreSvr.exe C:\Program Files\MSN Messenger\usnsvc.exe C:\WINDOWS\notepad.exe C:\WINDOWS\notepad.exe C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\HijackThis\HijackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Linkit R3 - URLSearchHook: SweetIM For Internet Explorer - {BC4FFE41-DE9F-46fa-B455-AAD49B9F9938} - C:\Program Files\Macrogaming\SweetIMBarForIE\toolbar.dll O2 - BHO: Adobe PDF Reader -linkkiavustaja - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll O2 - BHO: SWEETIE - {1A0AADCD-3A72-4b5f-900F-E3BB5A838E2A} - C:\PROGRA~1\MACROG~1\SWEETI~1\toolbar.dll O2 - BHO: Canon Easy Web Print Helper - {68F9551E-0411-48E4-9AAF-4BC42A6A46BE} - C:\Program Files\Canon\Easy-WebPrint\EWPBrowseLoader.dll O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file) O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll O3 - Toolbar: Easy-WebPrint - {327C2873-E90D-4c37-AA9D-10AC9BABA46C} - C:\Program Files\Canon\Easy-WebPrint\Toolband.dll O3 - Toolbar: SweetIM For Internet Explorer - {BC4FFE41-DE9F-46fa-B455-AAD49B9F9938} - C:\Program Files\Macrogaming\SweetIMBarForIE\toolbar.dll O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized O4 - HKLM\..\Run: [{0228e555-4f9c-4e35-a3ec-b109a192b4c2}] C:\Program Files\Google\Gmail Notifier\gnotify.exe O4 - HKLM\..\Run: [vptray] C:\PROGRA~1\SYMANT~1\SYMANT~2\VPTray.exe O4 - HKLM\..\Run: [SweetIM] C:\Program Files\Macrogaming\SweetIM\SweetIM.exe O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe" O4 - HKLM\..\Run: [SSBkgdUpdate] "C:\Program Files\Common Files\Scansoft Shared\SSBkgdUpdate\SSBkgdupdate.exe" -Embedding -boot O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE O4 - HKLM\..\Run: [OpwareSE4] "C:\Program Files\ScanSoft\OmniPageSE4.0\OpwareSE4.exe" O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe O4 - HKLM\..\Run: [itype] "C:\Program Files\Microsoft IntelliType Pro\itype.exe" O4 - HKLM\..\Run: [IntelliPoint] "C:\Program Files\Microsoft IntelliPoint\ipoint.exe" O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe" O4 - HKLM\..\Run: [ATICCC] "C:\Program Files\ATI Technologies\ATI.ACE\cli.exe" runtime -Delay O4 - HKCU\..\Run: [µTorrent] "C:\Program Files\utorrent.exe" O4 - HKCU\..\Run: [Skype] "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized O4 - HKCU\..\Run: [MsnMsgr] ~"C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background O4 - HKCU\..\Run: [FreeRAM XP] "C:\Program Files\YourWare Solutions\FreeRAM XP Pro\FreeRAM XP Pro.exe" -win O4 - HKCU\..\Run: [DAEMON Tools] "C:\Program Files\DAEMON Tools\daemon.exe" -lang 1033 O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe" O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Reader 8.0\Reader\reader_sl.exe O4 - Global Startup: Adobe Reader Synchronizer.lnk = C:\Program Files\Adobe\Reader 8.0\Reader\AdobeCollabSync.exe O4 - Global Startup: ClientManager3.lnk = C:\Program Files\BUFFALO\Client Manager3\cm3_tray.exe O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000 O8 - Extra context menu item: Easy-WebPrint Add To Print List - res://C:\Program Files\Canon\Easy-WebPrint\Toolband.dll/RC_AddToList.html O8 - Extra context menu item: Easy-WebPrint High Speed Print - res://C:\Program Files\Canon\Easy-WebPrint\Toolband.dll/RC_HSPrint.html O8 - Extra context menu item: Easy-WebPrint Preview - res://C:\Program Files\Canon\Easy-WebPrint\Toolband.dll/RC_Preview.html O8 - Extra context menu item: Easy-WebPrint Print - res://C:\Program Files\Canon\Easy-WebPrint\Toolband.dll/RC_Print.html O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL O18 - Protocol: ms-help - {314111C7-A502-11D2-BBCA-00C04F8EC294} - C:\Program Files\Common Files\Microsoft Shared\Help\hxds.dll O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL O18 - Filter hijack: text/xml - {807563E5-5146-11D5-A672-00B0D022E945} - C:\PROGRA~1\COMMON~1\MICROS~1\OFFICE12\MSOXMLMF.DLL O20 - Winlogon Notify: NavLogon - C:\WINDOWS\system32\NavLogon.dll O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe O23 - Service: AVG Anti-Spyware Guard - Anti-Malware Development a.s. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe O23 - Service: Bwsvc - BUFFALO INC. - C:\Program Files\BUFFALO\Client Manager3\bwsvc\bwsvc.exe O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe O23 - Service: Symantec Network Proxy (ccProxy) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccProxy.exe O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe O23 - Service: Symantec AntiVirus Definition Watcher (DefWatch) - Symantec Corporation - C:\Program Files\Symantec Client Security\Symantec AntiVirus\DefWatch.exe O23 - Service: IS Service (ISSVC) - Symantec Corporation - C:\Program Files\Symantec Client Security\Symantec Client Firewall\ISSVC.exe O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe O23 - Service: SAVRoam (SavRoam) - symantec - C:\Program Files\Symantec Client Security\Symantec AntiVirus\SavRoam.exe O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe O23 - Service: Symantec AntiVirus - Symantec Corporation - C:\Program Files\Symantec Client Security\Symantec AntiVirus\Rtvscan.exe O23 - Service: Symantec SecurePort (SymSecurePort) - Symantec Corporation - C:\Program Files\Symantec Client Security\Symantec Client Firewall\SymSPort.exe Deckard's System Scanner v20070423.42 Run by Heikki on 2007-04-26 at 15:08:25 Computer is in Normal Mode. -------------------------------------------------------------------------------- -- System Restore -------------------------------------------------------------- Successfully created a Deckard's System Scanner Restore Point. -- Last 3 Restore Point(s) -- 3: 2007-04-26 12:08:28 UTC - RP3 - Deckard's System Scanner Restore Point 2: 2007-04-26 12:02:33 UTC - RP2 - Deckard's System Scanner Restore Point 1: 2007-04-25 14:53:45 UTC - RP1 - Järjestelmän tarkistuspiste Performed disk cleanup. -- HijackThis (run as Heikki.exe) ---------------------------------------------- Logfile of HijackThis v1.99.1 Scan saved at 15:10:36, on 26.4.2007 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\Ati2evxx.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe C:\WINDOWS\system32\Ati2evxx.exe C:\WINDOWS\Explorer.EXE C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe C:\Program Files\Common Files\Symantec Shared\ccProxy.exe C:\Program Files\Symantec Client Security\Symantec Client Firewall\ISSVC.exe C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe C:\WINDOWS\system32\spoolsv.exe C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe C:\Program Files\BUFFALO\Client Manager3\bwsvc\bwsvc.exe C:\Program Files\Symantec Client Security\Symantec AntiVirus\DefWatch.exe C:\Program Files\Common Files\LightScribe\LSSrvc.exe C:\WINDOWS\system32\svchost.exe C:\Program Files\Symantec Client Security\Symantec AntiVirus\Rtvscan.exe C:\Program Files\Symantec Client Security\Symantec Client Firewall\SymSPort.exe C:\PROGRA~1\SYMANT~1\SYMANT~2\VPTray.exe C:\Program Files\Macrogaming\SweetIM\SweetIM.exe C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe C:\Program Files\ScanSoft\OmniPageSE4.0\OpwareSE4.exe C:\Program Files\Microsoft IntelliType Pro\itype.exe C:\Program Files\Microsoft IntelliPoint\ipoint.exe C:\Program Files\Common Files\Symantec Shared\ccApp.exe C:\WINDOWS\system32\ctfmon.exe C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe C:\Program Files\BUFFALO\Client Manager3\cm3_tray.exe C:\Program Files\Common Files\Ahead\Lib\NMIndexStoreSvr.exe C:\Program Files\MSN Messenger\usnsvc.exe C:\Documents and Settings\Heikki\Työpöytä\dss.exe C:\PROGRA~1\HIJACK~1\Heikki.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Linkit R3 - URLSearchHook: SweetIM For Internet Explorer - {BC4FFE41-DE9F-46fa-B455-AAD49B9F9938} - C:\Program Files\Macrogaming\SweetIMBarForIE\toolbar.dll O2 - BHO: Adobe PDF Reader -linkkiavustaja - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll O2 - BHO: SWEETIE - {1A0AADCD-3A72-4b5f-900F-E3BB5A838E2A} - C:\PROGRA~1\MACROG~1\SWEETI~1\toolbar.dll O2 - BHO: Canon Easy Web Print Helper - {68F9551E-0411-48E4-9AAF-4BC42A6A46BE} - C:\Program Files\Canon\Easy-WebPrint\EWPBrowseLoader.dll O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file) O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll O3 - Toolbar: Easy-WebPrint - {327C2873-E90D-4c37-AA9D-10AC9BABA46C} - C:\Program Files\Canon\Easy-WebPrint\Toolband.dll O3 - Toolbar: SweetIM For Internet Explorer - {BC4FFE41-DE9F-46fa-B455-AAD49B9F9938} - C:\Program Files\Macrogaming\SweetIMBarForIE\toolbar.dll O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized O4 - HKLM\..\Run: [{0228e555-4f9c-4e35-a3ec-b109a192b4c2}] C:\Program Files\Google\Gmail Notifier\gnotify.exe O4 - HKLM\..\Run: [vptray] C:\PROGRA~1\SYMANT~1\SYMANT~2\VPTray.exe O4 - HKLM\..\Run: [SweetIM] C:\Program Files\Macrogaming\SweetIM\SweetIM.exe O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe" O4 - HKLM\..\Run: [SSBkgdUpdate] "C:\Program Files\Common Files\Scansoft Shared\SSBkgdUpdate\SSBkgdupdate.exe" -Embedding -boot O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE O4 - HKLM\..\Run: [OpwareSE4] "C:\Program Files\ScanSoft\OmniPageSE4.0\OpwareSE4.exe" O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe O4 - HKLM\..\Run: [itype] "C:\Program Files\Microsoft IntelliType Pro\itype.exe" O4 - HKLM\..\Run: [IntelliPoint] "C:\Program Files\Microsoft IntelliPoint\ipoint.exe" O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe" O4 - HKLM\..\Run: [ATICCC] "C:\Program Files\ATI Technologies\ATI.ACE\cli.exe" runtime -Delay O4 - HKCU\..\Run: [µTorrent] "C:\Program Files\utorrent.exe" O4 - HKCU\..\Run: [Skype] "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized O4 - HKCU\..\Run: [MsnMsgr] ~"C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background O4 - HKCU\..\Run: [FreeRAM XP] "C:\Program Files\YourWare Solutions\FreeRAM XP Pro\FreeRAM XP Pro.exe" -win O4 - HKCU\..\Run: [DAEMON Tools] "C:\Program Files\DAEMON Tools\daemon.exe" -lang 1033 O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe" O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Reader 8.0\Reader\reader_sl.exe O4 - Global Startup: Adobe Reader Synchronizer.lnk = C:\Program Files\Adobe\Reader 8.0\Reader\AdobeCollabSync.exe O4 - Global Startup: ClientManager3.lnk = C:\Program Files\BUFFALO\Client Manager3\cm3_tray.exe O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000 O8 - Extra context menu item: Easy-WebPrint Add To Print List - res://C:\Program Files\Canon\Easy-WebPrint\Toolband.dll/RC_AddToList.html O8 - Extra context menu item: Easy-WebPrint High Speed Print - res://C:\Program Files\Canon\Easy-WebPrint\Toolband.dll/RC_HSPrint.html O8 - Extra context menu item: Easy-WebPrint Preview - res://C:\Program Files\Canon\Easy-WebPrint\Toolband.dll/RC_Preview.html O8 - Extra context menu item: Easy-WebPrint Print - res://C:\Program Files\Canon\Easy-WebPrint\Toolband.dll/RC_Print.html O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL O18 - Protocol: ms-help - {314111C7-A502-11D2-BBCA-00C04F8EC294} - C:\Program Files\Common Files\Microsoft Shared\Help\hxds.dll O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL O18 - Filter hijack: text/xml - {807563E5-5146-11D5-A672-00B0D022E945} - C:\PROGRA~1\COMMON~1\MICROS~1\OFFICE12\MSOXMLMF.DLL O20 - Winlogon Notify: NavLogon - C:\WINDOWS\system32\NavLogon.dll O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe O23 - Service: AVG Anti-Spyware Guard - Anti-Malware Development a.s. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe O23 - Service: Bwsvc - BUFFALO INC. - C:\Program Files\BUFFALO\Client Manager3\bwsvc\bwsvc.exe O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe O23 - Service: Symantec Network Proxy (ccProxy) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccProxy.exe O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe O23 - Service: Symantec AntiVirus Definition Watcher (DefWatch) - Symantec Corporation - C:\Program Files\Symantec Client Security\Symantec AntiVirus\DefWatch.exe O23 - Service: IS Service (ISSVC) - Symantec Corporation - C:\Program Files\Symantec Client Security\Symantec Client Firewall\ISSVC.exe O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe O23 - Service: SAVRoam (SavRoam) - symantec - C:\Program Files\Symantec Client Security\Symantec AntiVirus\SavRoam.exe O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe O23 - Service: Symantec AntiVirus - Symantec Corporation - C:\Program Files\Symantec Client Security\Symantec AntiVirus\Rtvscan.exe O23 - Service: Symantec SecurePort (SymSecurePort) - Symantec Corporation - C:\Program Files\Symantec Client Security\Symantec Client Firewall\SymSPort.exe -- File Associations ----------------------------------------------------------- All associations okay. -- Drivers: 0-Boot, 1-System, 2-Auto, 3-Demand, 4-Disabled --------------------- R1 BUFADPT - c:\windows\system32\bufadpt.sys <Not Verified; BUFFALO INC.; BUFFALO Wireless LAN; 1.0.2.1; 1.0.2.1 built by: WinDDK> R2 AegisP (AEGIS Protocol (IEEE 802.1x) v3.4.3.0) - c:\windows\system32\drivers\aegisp.sys <Not Verified; Meetinghouse Data Communications; AEGIS Client 3.4.3.0; 3.4.3.0; 3.4.3.0> R3 ALCXSENS (Service for WDM 3D Audio Driver) - c:\windows\system32\drivers\alcxsens.sys <Verified; Sensaura; ; ; 5.10.00.3513> S3 GMSIPCI - e:\install\gmsipci.sys (file missing) -- Services: 0-Boot, 1-System, 2-Auto, 3-Demand, 4-Disabled -------------------- R2 Bwsvc - c:\program files\buffalo\client manager3\bwsvc\bwsvc.exe -service <Not Verified; BUFFALO INC.; BUFFALO NETWORK SERVICE; 2, 0, 3, 2; 2, 0, 3, 2> R2 ISSVC (IS Service) - "c:\program files\symantec client security\symantec client firewall\issvc.exe" <Verified; Symantec Corporation; Internet Security; 8.7; 8.7.4.79> R2 Symantec AntiVirus - "c:\program files\symantec client security\symantec antivirus\rtvscan.exe" <Verified; Symantec Corporation; Symantec AntiVirus; 10.1.4.4000; 10.1.4.4000> R2 SymSecurePort (Symantec SecurePort) - "c:\program files\symantec client security\symantec client firewall\symsport.exe" <Verified; Symantec Corporation; Internet Security; 8.7; 8.7.4.79> S3 NBService - c:\program files\nero\nero 7\nero backitup\nbservice.exe S3 SavRoam - "c:\program files\symantec client security\symantec antivirus\savroam.exe" <Verified; symantec; Symantec SAVRoam; 10.1.4.4000; 10.1.4.4000> -- Files created between 2007-03-26 and 2007-04-26 ----------------------------- 2007-04-25 17:14:13 0 dr------- C:\Documents and Settings\Järjestelmänvalvoja\Omat tiedostot 2007-04-25 17:11:22 0 d--h----- C:\Documents and Settings\Järjestelmänvalvoja\Verkkoympäristö 2007-04-25 17:11:22 0 d-------- C:\Documents and Settings\Järjestelmänvalvoja\Työpöytä 2007-04-25 17:11:22 0 d--h----- C:\Documents and Settings\Järjestelmänvalvoja\Tulostinympäristö 2007-04-25 17:11:22 0 d-------- C:\Documents and Settings\Järjestelmänvalvoja\Suosikit 2007-04-25 17:11:22 0 dr-h----- C:\Documents and Settings\Järjestelmänvalvoja\SendTo 2007-04-25 17:11:22 0 d--h----- C:\Documents and Settings\Järjestelmänvalvoja\Recent 2007-04-25 17:11:22 524288 --ah----- C:\Documents and Settings\Järjestelmänvalvoja\NTUSER.DAT 2007-04-25 17:11:22 0 d--h----- C:\Documents and Settings\Järjestelmänvalvoja\Mallit 2007-04-25 17:11:22 0 d--h----- C:\Documents and Settings\Järjestelmänvalvoja\Local Settings 2007-04-25 17:11:22 0 dr------- C:\Documents and Settings\Järjestelmänvalvoja\Käynnistä-valikko 2007-04-25 17:11:22 0 d---s---- C:\Documents and Settings\Järjestelmänvalvoja\Cookies 2007-04-25 17:11:22 0 dr-h----- C:\Documents and Settings\Järjestelmänvalvoja\Application Data 2007-04-25 17:11:22 0 d---s---- C:\Documents and Settings\Järjestelmänvalvoja\Application Data\Microsoft 2007-04-25 17:04:10 0 d-------- C:\WINDOWS\pss 2007-04-25 16:56:56 3968 --a------ C:\WINDOWS\system32\drivers\AvgAsCln.sys <Not Verified; GRISOFT, s.r.o.; AVG7 Clean Driver; 1.0.0.14; 1.0.0.14> 2007-04-24 20:41:52 0 d-------- C:\SAV32CLI 2007-04-23 15:00:30 0 dr-h----- C:\Documents and Settings\Heikki\Recent 2007-04-22 19:01:59 0 d-------- C:\Program Files\Macrogaming 2007-04-21 15:51:01 0 d-------- C:\Program Files\MSXML 4.0 2007-04-21 09:56:37 192512 -----n--- C:\WINDOWS\system32\Apssnd.dll 2007-04-21 09:56:31 0 d-------- C:\Program Files\Alfa-ohjelmat 2007-04-21 09:48:35 0 d-------- C:\Documents and Settings\Heikki\Application Data\Help 2007-04-20 21:35:15 0 d-------- C:\Documents and Settings\Heikki\Application Data\ArcSoft 2007-04-20 20:32:16 0 d--h----- C:\Documents and Settings\All Users\Application Data\CanonBJ 2007-04-20 20:32:11 0 d--h----- C:\WINDOWS\system32\CanonIJ Uninstaller Information 2007-04-20 20:32:08 106496 --a------ C:\WINDOWS\system32\cnco160.dll <Verified; Canon Inc.; Canon ScanGear series.; 1.0; 1.0> 2007-04-20 20:32:07 135168 --a------ C:\WINDOWS\system32\CNCL160.DLL <Verified; Canon Inc.; Canon MP; ; 1.00> 2007-04-20 20:32:07 57344 --a------ C:\WINDOWS\system32\CNCI160.DLL <Verified; CANON INC.; WIA Scanner Driver; 1, 2, 1, 0; 2, 0, 0, 0> 2007-04-20 20:32:07 1134592 --a------ C:\WINDOWS\system32\CNCC160.DLL <Verified; CANON INC.; WIA Scanner Driver; 1, 2, 0, 0; 0, 2, 2, 0> 2007-04-20 20:32:05 0 d--h----- C:\Program Files\CanonBJ 2007-04-20 19:18:55 0 d-------- C:\Documents and Settings\Heikki\Application Data\Canon 2007-04-20 19:05:08 0 d-------- C:\Documents and Settings\All Users\Application Data\InstallShield 2007-04-20 19:05:06 0 d-------- C:\Documents and Settings\Heikki\Application Data\ScanSoft 2007-04-20 19:04:58 0 d-------- C:\Program Files\Common Files\ScanSoft Shared 2007-04-20 19:04:58 0 d-------- C:\Documents and Settings\All Users\Application Data\ScanSoft 2007-04-20 19:04:38 0 d-------- C:\Program Files\ScanSoft 2007-04-20 19:02:39 212480 --a------ C:\WINDOWS\PCDLIB32.DLL <Not Verified; Eastman Kodak; Kodak Photo CD Access Developer Toolkit; 3, 0, 0, 0; 3, 0, 0, 0> 2007-04-20 19:02:38 0 d-------- C:\Program Files\ArcSoft 2007-04-20 18:59:46 161792 --a------ C:\WINDOWS\system32\CNMLM83.DLL <Verified; CANON INC.; Canon IJ Printer Driver; 1.95.2.20; 1.95.2.20> 2007-04-20 18:57:10 0 d-------- C:\Program Files\Canon 2007-04-13 18:51:59 0 d-------- C:\Program Files\Suunnistussimulaattori Demo 2007-04-11 14:24:22 4096 --a------ C:\WINDOWS\system32\crash 2007-04-10 18:27:19 0 d-a------ C:\Documents and Settings\All Users\Application Data\TEMP 2007-04-08 20:56:12 0 d-------- C:\vanhat 2007-04-08 20:38:23 0 d-------- C:\Program Files\DOSBox-0.70 2007-04-08 15:21:26 0 d-------- C:\Documents and Settings\Heikki\Application Data\SopCast 2007-04-08 15:21:25 0 d-------- C:\Program Files\SopCast 2007-04-06 12:18:04 0 d-------- C:\Program Files\Microsoft IntelliPoint 2007-04-06 12:17:23 0 d-------- C:\Program Files\Microsoft IntelliPoint 5.5 2007-04-06 12:05:54 0 d-------- C:\Program Files\Microsoft IntelliType Pro 2007-04-03 20:30:45 0 d-------- C:\Documents and Settings\Heikki\Application Data\Uniblue 2007-04-03 20:04:13 0 d-------- C:\Program Files\Debugging Tools for Windows 2007-04-02 20:38:25 0 d-------- C:\Program Files\Windows Media Connect 2 2007-04-02 20:36:10 0 d-------- C:\WINDOWS\system32\drivers\UMDF 2007-04-01 18:21:14 0 d-------- C:\ppmaterecord <PPMATE~1> 2007-04-01 18:21:14 0 d-------- C:\Documents and Settings\Heikki\Application Data\ppStream 2007-04-01 18:16:08 0 d-------- C:\Documents and Settings\Heikki\Application Data\PPMate 2007-04-01 18:16:06 0 d-------- C:\Program Files\Common Files\Synacast 2007-04-01 18:16:03 0 d-------- C:\Program Files\PPMate 2007-04-01 17:48:26 0 d-------- C:\Documents and Settings\Heikki\Application Data\TVU Networks 2007-04-01 17:48:19 0 d-------- C:\Program Files\TVUPlayer 2007-03-28 19:26:00 0 d-------- C:\Program Files\Sanakirja 2007-03-28 17:59:28 306688 --a------ C:\WINDOWS\IsUninst.exe <Not Verified; InstallShield Software Corporation; InstallShield® unInstaller; 5, 51; 5, 51, 138, 0> 2007-03-28 17:59:27 0 d-------- C:\Documents and Settings\Heikki\WINDOWS 2007-03-27 17:04:34 0 d-------- C:\Ajurit -- Find3M Report --------------------------------------------------------------- 2007-04-26 15:07:56 0 d-------- C:\Documents and Settings\Heikki\Application Data\uTorrent 2007-04-26 15:07:50 0 d-------- C:\Documents and Settings\Heikki\Application Data\Skype 2007-04-26 14:40:38 40 --a------ C:\WINDOWS\system32\profile.dat 2007-04-22 18:58:42 0 d-------- C:\Documents and Settings\Heikki\Application Data\Macromedia 2007-04-21 09:57:29 43520 --a------ C:\WINDOWS\system32\CmdLineExt03.dll 2007-04-20 20:00:56 0 d-------- C:\Program Files\Common Files\Symantec Shared 2007-04-20 19:04:57 0 d-------- C:\Program Files\Common Files\InstallShield 2007-04-20 19:02:37 0 d--h----- C:\Program Files\InstallShield Installation Information 2007-04-15 16:38:59 0 d-------- C:\Program Files\MSN Messenger 2007-04-12 16:06:33 0 d-------- C:\Program Files\Java 2007-03-26 15:51:59 369396 --a------ C:\WINDOWS\system32\perfh00B.dat 2007-03-26 15:51:59 71834 --a------ C:\WINDOWS\system32\perfc00B.dat 2007-03-25 20:04:07 0 d-------- C:\Documents and Settings\Heikki\Application Data\Sun 2007-03-25 20:04:01 1289 --a------ C:\WINDOWS\mozver.dat 2007-03-25 20:02:56 0 d-------- C:\Program Files\Common Files\Java 2007-03-25 16:34:50 0 d-------- C:\Documents and Settings\Heikki\Application Data\Google 2007-03-25 16:33:51 0 d-------- C:\Program Files\Google 2007-03-17 20:37:17 0 d-------- C:\Documents and Settings\Heikki\Application Data\Lavasoft 2007-03-17 20:37:01 0 d-------- C:\Program Files\Lavasoft 2007-03-17 20:36:29 0 d-------- C:\Program Files\Common Files\Wise Installation Wizard 2007-03-16 16:33:18 0 d-------- C:\Program Files\TimeAdjuster 2007-03-14 22:31:55 0 d-------- C:\Program Files\GmRekGTP 2007-03-11 22:06:16 0 d-------- C:\Documents and Settings\Heikki\Application Data\Ahead 2007-03-11 22:04:49 0 d-------- C:\Documents and Settings\Heikki\Application Data\Real 2007-03-11 22:04:49 0 d-------- C:\Documents and Settings\Heikki\Application Data\Media Player Classic 2007-03-11 22:04:08 0 d-------- C:\Program Files\Real Alternative 2007-03-11 22:04:04 0 d-------- C:\Program Files\Media Player Classic 2007-03-11 20:11:04 0 d-------- C:\Program Files\Common Files\LightScribe 2007-03-11 11:30:56 0 d-------- C:\Program Files\Common Files\Ahead 2007-03-11 11:24:57 0 d-------- C:\Program Files\Nero 2007-03-10 22:28:33 0 d-------- C:\Program Files\TweakNow RegCleaner Std 2007-03-10 22:25:00 0 d-------- C:\Program Files\YourWare Solutions 2007-03-10 19:02:14 0 d-------- C:\Documents and Settings\Heikki\Application Data\Adobe 2007-03-10 19:00:17 0 d-------- C:\Program Files\Common Files\Adobe 2007-03-10 14:46:01 0 d-------- C:\Program Files\directx 2007-03-10 11:31:10 0 d-------- C:\Program Files\Microsoft Visual Studio 8 2007-03-10 00:14:11 0 d-------- C:\Program Files\CCleaner 2007-03-09 22:08:58 0 d-------- C:\Program Files\Evolution 2007-03-09 21:34:14 0 d-------- C:\Program Files\Microsoft Works 2007-03-09 21:33:44 0 d-------- C:\Program Files\Microsoft.NET 2007-03-09 21:20:39 0 d-------- C:\Program Files\Skype 2007-03-09 21:20:38 0 d-------- C:\Program Files\Common Files\Skype 2007-03-09 21:06:12 0 d-------- C:\Documents and Settings\Heikki\Application Data\ATI 2007-03-09 20:59:51 0 d-------- C:\Program Files\ATI Technologies 2007-03-09 19:47:25 177152 --a------ C:\Program Files\utorrent.exe 2007-03-09 17:38:31 0 d-------- C:\Documents and Settings\Heikki\Application Data\EuroTalk 2007-03-09 17:27:13 0 d-------- C:\Program Files\BadgerIT 2007-03-09 17:04:07 0 d-------- C:\Program Files\ImgBurn 2007-03-09 16:58:26 0 d-------- C:\Program Files\ffdshow 2007-03-09 16:47:21 0 d-------- C:\Program Files\Common Files\ODBC 2007-03-09 16:47:18 0 d-------- C:\Program Files\Common Files\SpeechEngines 2007-03-09 16:46:49 62 --ahs---- C:\Documents and Settings\Heikki\Application Data\desktop.ini 2007-03-09 16:07:25 0 d-------- C:\Program Files\Messenger 2007-03-09 15:50:53 0 d-------- C:\Program Files\DAEMON Tools 2007-03-09 15:40:24 0 d-------- C:\Documents and Settings\Heikki\Application Data\Talkback 2007-03-09 15:40:09 0 --a------ C:\WINDOWS\nsreg.dat 2007-03-09 15:40:06 0 d-------- C:\Documents and Settings\Heikki\Application Data\Mozilla 2007-03-09 15:29:26 0 d-------- C:\Program Files\Symantec 2007-03-09 15:29:03 0 d-------- C:\Program Files\Symantec Client Security 2007-03-09 15:13:13 0 d-------- C:\Program Files\BUFFALO 2007-03-09 15:06:44 0 d-------- C:\Documents and Settings\Heikki\Application Data\Identities 2007-03-09 14:58:32 0 d-------- C:\Program Files\microsoft frontpage 2007-03-09 14:58:10 0 -rahs---- C:\MSDOS.SYS 2007-03-09 14:58:10 0 -rahs---- C:\IO.SYS 2007-03-09 14:58:10 0 --a------ C:\CONFIG.SYS 2007-03-09 14:58:10 0 --a------ C:\AUTOEXEC.BAT 2007-03-09 14:56:54 0 d--h----- C:\Program Files\WindowsUpdate 2007-03-09 14:56:51 0 d-------- C:\Program Files\Online Services 2007-03-09 14:55:50 0 d-------- C:\Program Files\Common Files\MSSoap 2007-03-09 14:55:39 0 d-------- C:\Program Files\Movie Maker 2007-03-09 14:54:42 21672 --a------ C:\WINDOWS\system32\emptyregdb.dat 2007-03-09 14:54:13 0 d-------- C:\Program Files\MSN Gaming Zone 2007-03-09 14:54:01 0 d-------- C:\Program Files\Windows NT 2007-02-21 22:00:28 10752 --a------ C:\WINDOWS\system32\ff_vfw.dll -- Registry Dump --------------------------------------------------------------- [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects] {1A0AADCD-3A72-4b5f-900F-E3BB5A838E2A} C:\PROGRA~1\MACROG~1\SWEETI~1\toolbar.dll {68F9551E-0411-48E4-9AAF-4BC42A6A46BE} C:\Program Files\Canon\Easy-WebPrint\EWPBrowseLoader.dll {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll {9030D464-4C02-4ABF-8ECC-5164760863C6} C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run] "!AVG Anti-Spyware"="\"C:\\Program Files\\Grisoft\\AVG Anti-Spyware 7.5\\avgas.exe\" /minimized" "{0228e555-4f9c-4e35-a3ec-b109a192b4c2}"="C:\\Program Files\\Google\\Gmail Notifier\\gnotify.exe" "vptray"="C:\\PROGRA~1\\SYMANT~1\\SYMANT~2\\VPTray.exe" "SweetIM"="C:\\Program Files\\Macrogaming\\SweetIM\\SweetIM.exe" "SunJavaUpdateSched"="\"C:\\Program Files\\Java\\jre1.6.0_01\\bin\\jusched.exe\"" "SSBkgdUpdate"="\"C:\\Program Files\\Common Files\\Scansoft Shared\\SSBkgdUpdate\\SSBkgdupdate.exe\" -Embedding -boot" "SoundMan"="SOUNDMAN.EXE" "OpwareSE4"="\"C:\\Program Files\\ScanSoft\\OmniPageSE4.0\\OpwareSE4.exe\"" "NeroFilterCheck"="C:\\Program Files\\Common Files\\Ahead\\Lib\\NeroCheck.exe" "itype"="\"C:\\Program Files\\Microsoft IntelliType Pro\\itype.exe\"" "IntelliPoint"="\"C:\\Program Files\\Microsoft IntelliPoint\\ipoint.exe\"" "ccApp"="\"C:\\Program Files\\Common Files\\Symantec Shared\\ccApp.exe\"" "ATICCC"="\"C:\\Program Files\\ATI Technologies\\ATI.ACE\\cli.exe\" runtime -Delay" [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run] "µTorrent"="\"C:\\Program Files\\utorrent.exe\"" "Skype"="\"C:\\Program Files\\Skype\\Phone\\Skype.exe\" /nosplash /minimized" "MsnMsgr"="~\"C:\\Program Files\\MSN Messenger\\MsnMsgr.Exe\" /background" "FreeRAM XP"="\"C:\\Program Files\\YourWare Solutions\\FreeRAM XP Pro\\FreeRAM XP Pro.exe\" -win" "DAEMON Tools"="\"C:\\Program Files\\DAEMON Tools\\daemon.exe\" -lang 1033" "CTFMON.EXE"="C:\\WINDOWS\\system32\\ctfmon.exe" "BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="\"C:\\Program Files\\Common Files\\Ahead\\Lib\\NMBgMonitor.exe\"" [HKEY_USERS\.default\software\microsoft\windows\currentversion\run] "CTFMON.EXE"="C:\\WINDOWS\\system32\\CTFMON.EXE" [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\system] "DisableRegistryTools"=dword:00000000 [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shellexecutehooks] "{57B86673-276A-48B2-BAE7-C6DBB3020EB8}"="AVG Anti-Spyware 7.5" HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa Authentication Packages REG_MULTI_SZ msv1_0\0\0 Security Packages REG_MULTI_SZ kerberos\0msv1_0\0schannel\0wdigest\0\0 Notification Packages REG_MULTI_SZ scecli\0\0 [HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Svchost] HTTPFilter REG_MULTI_SZ HTTPFilter\0\0 LocalService REG_MULTI_SZ Alerter\0WebClient\0LmHosts\0RemoteRegistry\0upnphost\0SSDPSRV\0\0 NetworkService REG_MULTI_SZ DnsCache\0\0 DcomLaunch REG_MULTI_SZ DcomLaunch\0TermService\0\0 rpcss REG_MULTI_SZ RpcSs\0\0 imgsvc REG_MULTI_SZ StiSvc\0\0 termsvcs REG_MULTI_SZ TermService\0\0 WudfServiceGroup REG_MULTI_SZ WUDFSvc\0\0 [HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{22254897-ce42-11db-8ff4-806d6172696f}] Shell\AutoRun\command E:\Setup.exe -- End of Deckard's System Scanner: finished at 2007-04-26 at 15:11:22 --------- Deckard's System Scanner v20070423.42 Extra logfile - please post this as an attachment with your post. -------------------------------------------------------------------------------- -- System Information ---------------------------------------------------------- Microsoft Windows XP Professional (build 2600) SP 2.0 Architecture: X86; Language: Other (040B) - see http://preview.tinyurl.com/mhhp6 CPU 0: AMD Sempron(tm) 2600+ Percentage of Memory in Use: 44% Physical Memory (total/avail): 1023.48 MiB / 567.21 MiB Pagefile Memory (total/avail): 1693.7 MiB / 1318.3 MiB Virtual Memory (total/avail): 2047.88 MiB / 1954.27 MiB A: is Removable (No Media) C: is Fixed (NTFS) - 19.53 GiB total, 10.43 GiB free. D: is Fixed (NTFS) - 129.52 GiB total, 10.5 GiB free. E: is CDROM (No Media) F: is CDROM (No Media) -- Security Center ------------------------------------------------------------- AUOptions is scheduled to auto-install. Windows Internal Firewall is disabled. FirstRunDisabled is set. FirewallDisableNotify is set. FW: Symantec Client Firewall v8.7.4.79 (Symantec Corporation) AV: Symantec AntiVirus Corporate Edition v10.1.4.4000 (Symantec Corporation) -- Environment Variables ------------------------------------------------------- ALLUSERSPROFILE=C:\Documents and Settings\All Users APPDATA=C:\Documents and Settings\Heikki\Application Data CLIENTNAME=Console CommonProgramFiles=C:\Program Files\Common Files COMPUTERNAME=OSSI ComSpec=C:\WINDOWS\system32\cmd.exe FP_NO_HOST_CHECK=NO HOMEDRIVE=C: HOMEPATH=\Documents and Settings\Heikki LOGONSERVER=\\OSSI NewEnvironment1=C:\Program Files\ATI Technologies\ATI.ACE\ NUMBER_OF_PROCESSORS=1 OS=Windows_NT Path=C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem PATHEXT=.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH PROCESSOR_ARCHITECTURE=x86 PROCESSOR_IDENTIFIER=x86 Family 6 Model 8 Stepping 1, AuthenticAMD PROCESSOR_LEVEL=6 PROCESSOR_REVISION=0801 ProgramFiles=C:\Program Files PROMPT=$P$G SESSIONNAME=Console SystemDrive=C: SystemRoot=C:\WINDOWS TEMP=C:\DOCUME~1\Heikki\LOCALS~1\Temp TMP=C:\DOCUME~1\Heikki\LOCALS~1\Temp USERDOMAIN=OSSI USERNAME=Heikki USERPROFILE=C:\Documents and Settings\Heikki windir=C:\WINDOWS -- User Profiles --------------------------------------------------------------- Heikki (admin) Järjestelmänvalvoja (new local, admin) -- Add/Remove Programs --------------------------------------------------------- --> C:\Program Files\Nero\Nero 7\nero\uninstall\UNNERO.exe /UNINSTALL --> C:\WINDOWS\UNNeroBackItUp.exe /UNINSTALL --> C:\WINDOWS\UNNeroMediaHome.exe /UNINSTALL --> C:\WINDOWS\UNNeroShowTime.exe /UNINSTALL --> C:\WINDOWS\UNNeroVision.exe /UNINSTALL --> C:\WINDOWS\UNRecode.exe /UNINSTALL --> rundll32.exe setupapi.dll,InstallHinfSection DefaultUninstall 132 C:\WINDOWS\INF\PCHealth.inf Ad-Aware SE Personal --> MsiExec.exe /X{78CC3BAB-DE2A-4FB4-8FBB-E4DADDC26747} Adobe Flash Player 9 ActiveX --> C:\WINDOWS\system32\Macromed\Flash\FlashUtil9b.exe -uninstallDelete Adobe Reader 8 - Suomi --> MsiExec.exe /I{AC76BA86-7AD7-1035-7B44-A80000000000} Adobe Shockwave Player --> C:\WINDOWS\system32\Macromed\SHOCKW~1\UNWISE.EXE C:\WINDOWS\system32\Macromed\SHOCKW~1\Install.log Agent Hugo --> D:\Pelien asennustiedostot\Agent Hugo\Setup.exe -uninst ArcSoft PhotoStudio 5.5 --> RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{85309D89-7BE9-4094-BB17-24999C6118FC}\SETUP.EXE" -l0x9 Asterix Mega Madness Mini Game --> RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\engine\6\INTEL3~1\ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{116FABB5-3D74-4BCC-A263-70C3681A1CD8}\setup.exe" ATI - Software Uninstall Utility --> C:\Program Files\ATI Technologies\UninstallAll\AtiCimUn.exe ATI Catalyst Control Center --> MsiExec.exe /I{EA9FAF16-0E5C-42C4-9742-9AF8D5F6D69B} ATI Display Driver --> rundll32 C:\WINDOWS\system32\atiiiexx.dll,_InfEngUnInstallINFFile_RunDLL@16 -force_restart -flags:0x2010001 -inf_classISPLAY -clean AVG Anti-Spyware 7.5 --> C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\Uninstall.exe BUFFALO Client Manager 3 --> C:\WINDOWS\UN800114.EXE /U Canon MP Navigator 3.0 --> "C:\Program Files\Canon\MP Navigator 3.0\Maint.exe" /UninstallRemove C:\Program Files\Canon\MP Navigator 3.0\uninst.ini Canon MP160 --> "C:\WINDOWS\system32\CanonIJ Uninstaller Information\{1199FAD5-9546-44f3-81CF-FFDB8040B7BF}_Canon_MP160\DelDrv.exe" /U:{1199FAD5-9546-44f3-81CF-FFDB8040B7BF}_Canon_MP160 /L0x000b Canon Utilities Easy-PhotoPrint --> C:\Program Files\Canon\Easy-PhotoPrint\uninst.exe uninst.ini CCleaner (remove only) --> "C:\Program Files\CCleaner\uninst.exe" Debugging Tools for Windows --> MsiExec.exe /I{5C741A01-05D6-4306-BA6A-DC8401285AE8} Easy-WebPrint --> C:\WINDOWS\IsUninst.exe -f"C:\Program Files\Canon\Easy-WebPrint\Uninst.isu" Evolution --> MsiExec.exe /I{CD1286C6-4305-47BD-A0C0-B41716D70307} ffdshow [rev 1006] [2007-03-07] --> "C:\Program Files\ffdshow\unins000.exe" Google Earth --> RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\11\50\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{3DE5E7D4-7B88-403C-A3FD-2017A8240C5B}\setup.exe" -l0x9 -removeonly Google Gmail Notifier --> "C:\Program Files\Google\Gmail Notifier\UninstallGmail.exe" GT Reittikartta Suomi Plus --> MsiExec.exe /I{A6E958B1-976E-4B77-84B9-B650437ED930} ImgBurn (Remove Only) --> "C:\Program Files\ImgBurn\uninstall.exe" ImgBurn DVDVideo Shell Ext --> MsiExec.exe /I{E9B02A93-6279-491A-984E-7EA6DEDE3293} J2SE Runtime Environment 5.0 Update 11 --> MsiExec.exe /I{3248F0A8-6813-11D6-A77B-00B0D0150110} Java(TM) SE Runtime Environment 6 Update 1 --> MsiExec.exe /I{3248F0A8-6813-11D6-A77B-00B0D0160010} Kielioppi Oppikirja englanti --> RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\09\01\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{64175EFE-3DDC-46BE-BC9B-54BEFF19AB20}\setup.exe" -l0xb LiveUpdate 3.0 (Symantec Corporation) --> "C:\Program Files\Symantec\LiveUpdate\LSETUP.EXE" /U Macrogaming SweetIM 2.0 --> MsiExec.exe /X{D9BBFA60-4514-4F08-A78F-91957F957495} Microsoft Compression Client Pack 1.0 for Windows XP --> "C:\WINDOWS\$NtUninstallMSCompPackV1$\spuninst\spuninst.exe" Microsoft Office Access MUI (English) 2007 --> MsiExec.exe /X{90120000-0015-0409-0000-0000000FF1CE} Microsoft Office Access Setup Metadata MUI (English) 2007 --> MsiExec.exe /X{90120000-0117-0409-0000-0000000FF1CE} Microsoft Office Excel 2007 --> "C:\Program Files\Common Files\Microsoft Shared\OFFICE12\Office Setup Controller\setup.exe" /uninstall EXCEL /dll OSETUP.DLL Microsoft Office Excel 2007 --> MsiExec.exe /X{90120000-0016-0000-0000-0000000FF1CE} Microsoft Office Excel MUI (English) 2007 --> MsiExec.exe /X{90120000-0016-0409-0000-0000000FF1CE} Microsoft Office Groove MUI (English) 2007 --> MsiExec.exe /X{90120000-00BA-0409-0000-0000000FF1CE} Microsoft Office Groove Setup Metadata MUI (English) 2007 --> MsiExec.exe /X{90120000-0114-0409-0000-0000000FF1CE} Microsoft Office InfoPath MUI (English) 2007 --> MsiExec.exe /X{90120000-0044-0409-0000-0000000FF1CE} Microsoft Office Language Pack 2007 - English --> "C:\Program Files\Common Files\Microsoft Shared\OFFICE12\Office Setup Controller\setup.exe" /uninstall OMUI.EN-US /dll OSETUP.DLL Microsoft Office O MUI (English) 2007 --> MsiExec.exe /X{90120000-0100-0409-0000-0000000FF1CE} Microsoft Office OneNote MUI (English) 2007 --> MsiExec.exe /X{90120000-00A1-0409-0000-0000000FF1CE} Microsoft Office Outlook 2007 --> "C:\Program Files\Common Files\Microsoft Shared\OFFICE12\Office Setup Controller\setup.exe" /uninstall OUTLOOK /dll OSETUP.DLL Microsoft Office Outlook 2007 --> MsiExec.exe /X{90120000-001A-0000-0000-0000000FF1CE} Microsoft Office Outlook MUI (English) 2007 --> MsiExec.exe /X{90120000-001A-0409-0000-0000000FF1CE} Microsoft Office PowerPoint 2007 --> "C:\Program Files\Common Files\Microsoft Shared\OFFICE12\Office Setup Controller\setup.exe" /uninstall POWERPOINT /dll OSETUP.DLL Microsoft Office PowerPoint 2007 --> MsiExec.exe /X{90120000-0018-0000-0000-0000000FF1CE} Microsoft Office PowerPoint MUI (English) 2007 --> MsiExec.exe /X{90120000-0018-0409-0000-0000000FF1CE} Microsoft Office Proof (English) 2007 --> MsiExec.exe /X{90120000-001F-0409-0000-0000000FF1CE} Microsoft Office Proof (French) 2007 --> MsiExec.exe /X{90120000-001F-040C-0000-0000000FF1CE} Microsoft Office Proof (Spanish) 2007 --> MsiExec.exe /X{90120000-001F-0C0A-0000-0000000FF1CE} Microsoft Office Proofing (English) 2007 --> MsiExec.exe /X{90120000-002C-0409-0000-0000000FF1CE} Microsoft Office Publisher MUI (English) 2007 --> MsiExec.exe /X{90120000-0019-0409-0000-0000000FF1CE} Microsoft Office Shared MUI (English) 2007 --> MsiExec.exe /X{90120000-006E-0409-0000-0000000FF1CE} Microsoft Office Shared Setup Metadata MUI (English) 2007 --> MsiExec.exe /X{90120000-0115-0409-0000-0000000FF1CE} Microsoft Office SharePoint Designer MUI (English) 2007 --> MsiExec.exe /X{90120000-0017-0409-0000-0000000FF1CE} Microsoft Office Word 2007 --> "C:\Program Files\Common Files\Microsoft Shared\OFFICE12\Office Setup Controller\setup.exe" /uninstall WORD /dll OSETUP.DLL Microsoft Office Word 2007 --> MsiExec.exe /X{90120000-001B-0000-0000-0000000FF1CE} Microsoft Office Word MUI (English) 2007 --> MsiExec.exe /X{90120000-001B-0409-0000-0000000FF1CE} Microsoft Office X MUI (English) 2007 --> MsiExec.exe /X{90120000-0101-0409-0000-0000000FF1CE} Microsoft User-Mode Driver Framework Feature Pack 1.0 --> "C:\WINDOWS\$NtUninstallWudf01000$\spuninst\spuninst.exe" Mozilla Firefox (2.0.0.2) --> C:\Program Files\Mozilla Firefox\uninstall\helper.exe Mozilla Firefox (2.0.0.3) --> C:\PROGRA~1\Mozilla Firefox\uninstall\helper.exe Nero 7 Premium --> MsiExec.exe /I{37BA50EE-C851-4394-93DD-A0A611891035} NVIDIA Drivers --> C:\WINDOWS\system32\NVUNINST.EXE UninstallGUI PPMate Network TV 2.1.0.42 --> C:\Program Files\PPMate\uninst.exe Rayman3 --> MsiExec.exe /X{BAF5914B-5730-4373-B038-9F436AC6A0D6} Real Alternative 1.51 --> "C:\Program Files\Real Alternative\unins000.exe" Realtek AC'97 Audio --> RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\engine\6\INTEL3~1\ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{FB08F381-6533-4108-B7DD-039E11FBC27E}\setup.exe" REMOVE ScanSoft OmniPage SE 4.0 --> MsiExec.exe /I{C1E693A4-B1D5-4DCD-B68D-2087835B7184} Skype 3.0 --> "C:\Program Files\Skype\Phone\unins000.exe" Skype Plugin Manager --> MsiExec.exe /I{3D5E5C0A-5B36-4F98-99A7-287F7DBDCE03} SopCast 1.1.1 --> C:\Program Files\SopCast\uninst.exe Suojauspäivitys Windows XP:lle (KB923789) --> C:\WINDOWS\system32\MacroMed\Flash\genuinst.exe C:\WINDOWS\system32\MacroMed\Flash\KB923789.inf Suunnistussimulaattorin esittelyversio 0.999 --> "C:\Program Files\Suunnistussimulaattori Demo\unins000.exe" SweetIM For Internet Explorer 3.0b --> MsiExec.exe /X{F6D63A65-BD23-46F3-B9A3-87F442423481} Symantec Client Security --> MsiExec.exe /I{C20729A4-C8C2-4DE3-94BE-5E3A2E9EFB63} Time Adjuster STANDARD 3.1 --> "C:\Program Files\TimeAdjuster\Uninstall.exe" TrackMania United DVD Patch 2006-12-15 --> "D:\Pelien asennustiedostot\TrackMania United\unins000.exe" TweakNow RegCleaner Standard --> "C:\Program Files\TweakNow RegCleaner Std\unins000.exe" TVUPlayer 2.3.2.32 --> C:\Program Files\TVUPlayer\uninst.exe WheelRacer 2.07 --> "D:\Pelien asennustiedostot\ActionWheelRacer\unins000.exe" Windows Live Messenger --> MsiExec.exe /I{DF6FEB75-A0D1-44E5-A754-0072D4967734} Windows Live Sign-in Assistant --> MsiExec.exe /I{49672EC2-171B-47B4-8CE7-50D7806360D7} Windows Media Format 11 runtime --> "C:\WINDOWS\$NtUninstallWMFDist11$\spuninst\spuninst.exe" WinRAR-pakkausohjelma --> C:\Program Files\WinRAR\uninstall.exe -- End of Deckard's System Scanner: finished at 2007-04-26 at 15:11:22 ---------
Lokeissa ei löytynyt mitään erikoista. Näiden perusteella koneesi näyttäisi olevan puhdas. Edellisen Javan (5.0 Update 11) voisit poistaa (eli Käynnistä -> Ohjauspaneeli -> Lisää tai poista sovellus -> J2SE Runtime Environment 5.0 Update 11 -> Poista). Kertoisitko vielä tarkasti minkälaisia ilmoituksia saat?
Nyt ei enää ole tullut päivään muita virheilmoituksia, kuin tästä koneen sammumisesta tuleva ilmoitus. Kone sammuu edelleen aina kun laitan AVG:n scannaamaan. Tulee ikkuna: Järjestelmä palautunut vakavasta virheestä. Virheen allekirjoitus BCCode : 1000008e BCP1 : C0000005 BCP2 : 8060D118 BCP3 : AFE64B70 BCP4 : 00000000 OSVer : 5_1_2600 SP : 2_0 Product : 256_1 Virheraportin sisältö C:\DOCUME~1\Heikki\LOCALS~1\Temp\WERdfcf.dir00\Mini042707-01.dmp C:\DOCUME~1\Heikki\LOCALS~1\Temp\WERdfcf.dir00\sysdata.xml Kun lähettää virheraportin microsoftille, tulee tälläinen ratkaisu: Problem caused by Device Driver You received this message because a device driver installed on your computer caused the Windows operating system to stop unexpectedly. This type of error is referred to as a "stop error." A stop error requires you to restart your computer. More information Problem report summary Problem type Windows stop error (a message appears on a blue screen with error code information) Solution available? No What does this problem mean? Windows has encountered a problem it cannot recover from and it needs to be restarted Cause Unknown Computer symptoms A message appears on a blue screen with error code information (for example: 0x0000001E, KMODE_EXCEPTION_NOT_HANDLED) Additional steps for you to take Please continue to send problem reports so analysts at Microsoft can study and try to correct the problem as quickly as possible Linkki ratkaisuun: http://wer.microsoft.com/Responses/....2.0?SGD=1f631db7-04ea-4807-869f-b7ecfbf8b559
En valitettavasti osaa auttaa tuon ongelman kanssa. Koneesi ollessa puhdas, voisit kenties kysyä apua esim. Ajuri- ja softaongelmat -osiosta. Nyt kun kuitenkin olet puhdas, seuraavaksi pari vinkkiä kuinka pienennetään saastumisriskiä. Kaikista on saatavilla joko suomenkielinen versio sekä/tai suomenkielinen opas. -> Taistele vastaan!!-> Malware Complaints Sivusto antaa haittaohjelmien uhreille mahdollisuuden kertoa tarinansa ja tehdä valituksen asiasta. Taistellaan yhdessä haittaohjelmien tekijöitä vastaan! -> Tyhjennä järjestelmänpalautus -> Ohjeet Tyhjennä järjestelmänpalautuskansio ja luo uusi palautuspiste. Tämä puhdistaa palautuskansion mahdollisista haittaohjelmajäännöksistä. -> Käytä CCleaneria -> CCleaner Lataa ja asenna CCleaner. Puhdista väliaikaistiedostot ja -kansiot ohjelmalla säännöllisesti. -> Käytä Ad-Awarea -> Ad-Aware Lataa ja asenna Ad-Aware. Päivitä se ja skannaa konettasi sillä säännöllisesti. Opas saatavilla suomeksi! Nimimerkki Ad-Awaren opas -> Käytä AVG Anti-Spywarea -> AVG Anti-Spyware Lataa ja asenna AVG Anti-Spyware. Päivitä se ja skannaa konettasi sillä säännöllisesti Opas saatavilla suomeksi! (Ewido ulkoasulla) Nimimerkki Axelin opas -> Asenna SpywareBlaster -> SpywareBlaster SpywareBlaster estää haittaohjelmia asentumasta koneellesi. Ei kuluta muistia! Opas saatavilla suomeksi! Nimimerkki Ad-Awaren opas -> Asenna MVPS Hosts tiedosto -> MVPS Hosts Estää koneesi yhteyden haitallisiin sivustoihin. Opas saatavilla suomeksi! Nimimerkki Axelin opas -> Vaihda selaimesi Firefoxiin -> Firefox Firefox on nopeampi, turvallisempi ja parempi selain kuin Internet Explorer. -> Pidä järjestelmäsi ajantasalla. -> Windows Update Vieraile Windows Updatessa säännöllisesti. -> Pidä palomuuri ja virustorjunta ajantasalla Päivitä ja skannaa koneesi säännöllisesti virustorjuntaohjelmallasi. Pysy puhtaana
Täytyy vielä jatkaa. Nyt löytyi muistista vika. Kun scannasin AVG:n normaalitilassa löytyi edelleen tämä Backdoor.Sdbot ja Trojan.ActivCrk.b. Mistä ne aina ilmestyy? Tässä AVG:n raportti: --------------------------------------------------------- AVG Anti-Spyware - Scan Report --------------------------------------------------------- + Created at: 20:20:40 28.4.2007 + Scan result: C:\System Volume Information\_restore{2AD7B065-5882-49D5-8DC8-FB45A29B5015}\RP1\A0000013.exe -> Backdoor.Sdbot : Cleaned with backup (quarantined). :mozilla.77:C:\Documents and Settings\Heikki\Application Data\Mozilla\Firefox\Profiles\tp0natqp.default\cookies.txt -> TrackingCookie.Adbrite : Cleaned. :mozilla.78:C:\Documents and Settings\Heikki\Application Data\Mozilla\Firefox\Profiles\tp0natqp.default\cookies.txt -> TrackingCookie.Adbrite : Cleaned. :mozilla.79:C:\Documents and Settings\Heikki\Application Data\Mozilla\Firefox\Profiles\tp0natqp.default\cookies.txt -> TrackingCookie.Adbrite : Cleaned. :mozilla.44:C:\Documents and Settings\Heikki\Application Data\Mozilla\Firefox\Profiles\tp0natqp.default\cookies.txt -> TrackingCookie.Adtech : Cleaned. :mozilla.45:C:\Documents and Settings\Heikki\Application Data\Mozilla\Firefox\Profiles\tp0natqp.default\cookies.txt -> TrackingCookie.Adtech : Cleaned. :mozilla.62:C:\Documents and Settings\Heikki\Application Data\Mozilla\Firefox\Profiles\tp0natqp.default\cookies.txt -> TrackingCookie.Advertising : Cleaned. C:\Documents and Settings\Heikki\Cookies\heikki@atdmt[1].txt -> TrackingCookie.Atdmt : Cleaned. :mozilla.20:C:\Documents and Settings\Heikki\Application Data\Mozilla\Firefox\Profiles\tp0natqp.default\cookies.txt -> TrackingCookie.Doubleclick : Cleaned. :mozilla.53:C:\Documents and Settings\Heikki\Application Data\Mozilla\Firefox\Profiles\tp0natqp.default\cookies.txt -> TrackingCookie.Statcounter : Cleaned. :mozilla.57:C:\Documents and Settings\Heikki\Application Data\Mozilla\Firefox\Profiles\tp0natqp.default\cookies.txt -> TrackingCookie.Statcounter : Cleaned. :mozilla.10:C:\Documents and Settings\Heikki\Application Data\Mozilla\Firefox\Profiles\tp0natqp.default\cookies.txt -> TrackingCookie.Statistik-gallup : Cleaned. C:\Documents and Settings\Heikki\Cookies\heikki@statistik-gallup[1].txt -> TrackingCookie.Statistik-gallup : Cleaned. :mozilla.25:C:\Documents and Settings\Heikki\Application Data\Mozilla\Firefox\Profiles\tp0natqp.default\cookies.txt -> TrackingCookie.Tradedoubler : Cleaned. :mozilla.27:C:\Documents and Settings\Heikki\Application Data\Mozilla\Firefox\Profiles\tp0natqp.default\cookies.txt -> TrackingCookie.Tradedoubler : Cleaned. :mozilla.65:C:\Documents and Settings\Heikki\Application Data\Mozilla\Firefox\Profiles\tp0natqp.default\cookies.txt -> TrackingCookie.Webtrends : Cleaned. D:\System Volume Information\_restore{2AD7B065-5882-49D5-8DC8-FB45A29B5015}\RP1\A0000014.sys -> Trojan.ActivCrk.b : Cleaned with backup (quarantined). ::Report end
1. Klikkaa käynnistä > Oma tietokone oikean puoleisella hiiren napilla 2. Valitse ominaisuudet 3. Valitse järjestelmän palauttaminen välilehti 4. Ruksi eteen ¤ poista järjestelmän palauttaminen kaikissa asemissa 5. Paina Käytä 6. Paina ok 7. Sammuta ja käynnistä 8. Ota ruksi pois ¤ poista järjestelmän palauttaminen kaikissa asemissa 9. Käytä ja OK
Kiitos Hujo! Sweetie tuli kans poistettua. Nyt lähti mesestä hauskat lisä jutut pois... mitä haittaa muuten tuosta Sweetiestä on?
