Explorerin päivitys ei onnistu, HJT-logi

Discussion in 'Virukset ja haittaohjelmat - HijackThis -logit' started by Mintsu, Jan 3, 2010.

  1. Mintsu

    Mintsu Regular member

    Joined:
    Oct 1, 2006
    Messages:
    161
    Likes Received:
    0
    Trophy Points:
    26
    Oon yrittäny kaikki keksimäni temput (microsoftin ongelman korjaukset, Nortonin poistamiset käytöstä, yms),mutta Explorer ei vaan ala päivittymään 8-versioon. Lataus jatkuu aikansa ja sitte ruutuun pamahtaa seuraavanlainen ilmoitus:

    "Internet Explorerin asennusta ei suoritettu loppuun. Tietokone täytyy käynnistää uudelleen, jotta tehdyt muutokset voidaan peruuttaa."

    Laitan varalta tähän HJT-login, jos siitä kävis ilmi mistä johtuu..

    Logfile of Trend Micro HijackThis v2.0.2
    Scan saved at 15:56:45, on 3.1.2010
    Platform: Windows XP SP3 (WinNT 5.01.2600)
    MSIE: Internet Explorer v6.00 SP3 (6.00.2900.5512)
    Boot mode: Normal

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\Ati2evxx.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\system32\Ati2evxx.exe
    C:\WINDOWS\system32\svchost.exe
    C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
    C:\WINDOWS\system32\spoolsv.exe
    C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
    C:\Program Files\Bonjour\mDNSResponder.exe
    C:\Program Files\CyberLink\PowerCinema\Kernel\TV\CLCapSvc.exe
    C:\Program Files\CyberLink\PowerCinema\Kernel\CLML_NTService\CLMLServer.exe
    C:\Program Files\Java\jre6\bin\jqs.exe
    C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\HPZIPM12.EXE
    C:\WINDOWS\system32\svchost.exe
    C:\Program Files\CyberLink\PowerCinema\Kernel\TV\CLSched.exe
    C:\Program Files\Canon\CAL\CALMAIN.exe
    C:\WINDOWS\system32\wbem\wmiapsrv.exe
    C:\PROGRA~1\COMMON~1\SYMANT~1\CCPD-LC\symlcsvc.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\Ati2evxx.exe
    C:\WINDOWS\Explorer.EXE
    C:\Program Files\CyberLink\PowerCinema\PCMService.exe
    C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
    C:\HP\KBD\KBD.EXE
    C:\Program Files\PowerISO\PWRISOVM.EXE
    C:\Program Files\Common Files\Real\Update_OB\realsched.exe
    C:\Program Files\Welho\Welho Holvi\Welho_Holvi_2.exe
    C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
    C:\Program Files\Nokia\Nokia PC Suite 7\PCSuite.exe
    C:\Program Files\PC Connectivity Solution\ServiceLayer.exe
    C:\Program Files\PC Connectivity Solution\Transports\NclUSBSrv.exe
    C:\Program Files\PC Connectivity Solution\Transports\NclRSSrv.exe
    C:\Program Files\Mozilla Firefox\firefox.exe
    C:\Program Files\Welho\Welho Holvi\AGMailAgent.exe
    C:\WINDOWS\ALCXMNTR.EXE
    c:\windows\system\hpsysdrv.exe
    C:\Program Files\Java\jre6\bin\jusched.exe
    C:\Program Files\Microsoft Office\Office10\WINWORD.EXE
    C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.soneraplaza.fi
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
    R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = proxydial.inet.fi:800
    R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.fi;*.*.fi;*.*.*.fi;;*.local;<local>
    R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Linkit
    O2 - BHO: Adobe PDF Reader -linkkiavustaja - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
    O2 - BHO: AskBar BHO - {201f27d4-3704-41d6-89c1-aa35e39143ed} - (no file)
    O2 - BHO: NCO 2.0 IE BHO - {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} - C:\Program Files\Common Files\Symantec Shared\coShared\Browser\2.0\coIEPlg.dll
    O2 - BHO: Symantec Intrusion Prevention - {6D53EC84-6AAE-4787-AEEE-F4628F01010C} - C:\PROGRA~1\COMMON~1\SYMANT~1\IDS\IPSBHO.dll
    O2 - BHO: Windows Liven kirjautumisapuohjelma - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
    O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
    O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
    O3 - Toolbar: Show Norton Toolbar - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - C:\Program Files\Common Files\Symantec Shared\coShared\Browser\2.0\CoIEPlg.dll
    O3 - Toolbar: (no name) - {3041d03e-fd4b-44e0-b742-2d9b88305f98} - (no file)
    O4 - HKLM\..\Run: [PCMService] "C:\Program Files\CyberLink\PowerCinema\PCMService.exe"
    O4 - HKLM\..\Run: [Recguard] C:\WINDOWS\SMINST\RECGUARD.EXE
    O4 - HKLM\..\Run: [HPBootOp] "C:\Program Files\Hewlett-Packard\HP Boot Optimizer\HPBootOp.exe" /run
    O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
    O4 - HKLM\..\Run: [KBD] C:\HP\KBD\KBD.EXE
    O4 - HKLM\..\Run: [PWRISOVM.EXE] C:\Program Files\PowerISO\PWRISOVM.EXE
    O4 - HKLM\..\Run: [ccApp] C:\Program Files\Common Files\Symantec Shared\ccApp.exe
    O4 - HKLM\..\Run: [osCheck] "C:\Program Files\Norton Internet Security\osCheck.exe"
    O4 - HKLM\..\Run: [ISUSPM Startup] C:\PROGRA~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe -startup
    O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime Alternative\qttask.exe" -atboottime
    O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
    O4 - HKCU\..\Run: [Welho Holvi] "C:\Program Files\Welho\Welho Holvi\Welho_Holvi_2.exe" /delayed
    O4 - HKCU\..\Run: [PC Suite Tray] "C:\Program Files\Nokia\Nokia PC Suite 7\PCSuite.exe" -onlytray
    O4 - HKUS\S-1-5-21-1272536644-464686433-2415924820-1009\..\Run: [Polar Sync] (User 'Everton')
    O4 - HKUS\S-1-5-21-1272536644-464686433-2415924820-1009\..\Run: [TheLionCluster] C:\Program Files\The Lion\skinkers.exe (User 'Everton')
    O4 - HKUS\S-1-5-21-1272536644-464686433-2415924820-1009\..\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background (User 'Everton')
    O4 - .DEFAULT User Startup: Pin.lnk = C:\hp\bin\CLOAKER.EXE (User 'Default user')
    O9 - Extra button: Yhteysohje - {E2D4D26B-0180-43a4-B05F-462D6D54C789} - C:\WINDOWS\PCHEALTH\HELPCTR\Vendors\CN=Hewlett-Packard,L=Cupertino,S=Ca,C=US\IEButton\support.htm
    O9 - Extra 'Tools' menuitem: Yhteysohje - {E2D4D26B-0180-43a4-B05F-462D6D54C789} - C:\WINDOWS\PCHEALTH\HELPCTR\Vendors\CN=Hewlett-Packard,L=Cupertino,S=Ca,C=US\IEButton\support.htm
    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O14 - IERESET.INF: START_PAGE_URL=http://www.soneraplaza.fi
    O16 - DPF: {20A60F0D-9AFA-4515-A0FD-83BD84642501} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab56986.cab
    O16 - DPF: {22492231-AEF0-49FC-9180-CE8969AB1273} (F-Secure Online Scanner Launcher) - http://download.sp.f-secure.com/ols/f-secure-rtm/resources/fslauncher.cab
    O16 - DPF: {5C051655-FCD5-4969-9182-770EA5AA5565} (Solitaire Showdown Class) - http://messenger.zone.msn.com/binary/SolitaireShowdown.cab56986.cab
    O16 - DPF: {5ED80217-570B-4DA9-BF44-BE107C0EC166} (Windows Live Safety Center Base Module) - http://cdn.scan.onecare.live.com/resource/download/scanner/wlscbase8942.cab
    O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1157211675640
    O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (MSN Games - Installer) - http://messenger.zone.msn.com/binary/ZIntro.cab56649.cab
    O16 - DPF: {BD393C14-72AD-4790-A095-76522973D6B8} (CBreakshotControl Class) - http://messenger.zone.msn.com/binary/Bankshot.cab57213.cab
    O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
    O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
    O16 - DPF: {F5A7706B-B9C0-4C89-A715-7A0C6B05DD48} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineSweeper.cab56986.cab
    O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
    O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
    O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
    O23 - Service: Automaattinen LiveUpdate-ajastustoiminto - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
    O23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\AluSchedulerSvc.exe
    O23 - Service: ##Id_String1.6844F930_1628_4223_B5CC_5BB94B879762## (Bonjour Service) - Apple Computer, Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
    O23 - Service: Canon Camera Access Library 8 (CCALib8) - Canon Inc. - C:\Program Files\Canon\CAL\CALMAIN.exe
    O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
    O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
    O23 - Service: CyberLink Background Capture Service (CBCS) (CLCapSvc) - Unknown owner - C:\Program Files\CyberLink\PowerCinema\Kernel\TV\CLCapSvc.exe
    O23 - Service: CyberLink Task Scheduler (CTS) (CLSched) - Unknown owner - C:\Program Files\CyberLink\PowerCinema\Kernel\TV\CLSched.exe
    O23 - Service: Symantec Lic NetConnect service (CLTNetCnService) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
    O23 - Service: COM Host (comHost) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\VAScanner\comHost.exe
    O23 - Service: CyberLink Media Library Service - Cyberlink - C:\Program Files\CyberLink\PowerCinema\Kernel\CLML_NTService\CLMLServer.exe
    O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
    O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
    O23 - Service: LiveUpdate - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\LuComServer_3_4.EXE
    O23 - Service: LiveUpdate Notice - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
    O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\HPZIPM12.EXE
    O23 - Service: ServiceLayer - Nokia - C:\Program Files\PC Connectivity Solution\ServiceLayer.exe
    O23 - Service: Symantec Core LC - Unknown owner - C:\PROGRA~1\COMMON~1\SYMANT~1\CCPD-LC\symlcsvc.exe

    --
    End of file - 10456 bytes
     
    Mintsu, Jan 3, 2010
    #1
  2. kalminen

    kalminen Regular member

    Joined:
    May 4, 2007
    Messages:
    3,915
    Likes Received:
    0
    Trophy Points:
    46
    Fixaa HJT:lla pois =>

    O2 - BHO: AskBar BHO - {201f27d4-3704-41d6-89c1-aa35e39143ed} - (no file)
    O3 - Toolbar: (no name) - {3041d03e-fd4b-44e0-b742-2d9b88305f98} - (no file)

    Käynnistä kone uudelleen.

    --------------------------------------------------------------------------------------

    Latauksen jälkeen kaikki selaimet on oltava sammutettuina (ei alapalkkiin)

    Lataa työpöydälle:
    Päivitä IE7 => TÄÄLTÄ

    Ei kasia vielä.

    Onnistuiko ???
    :D
    .
     
    kalminen, Jan 4, 2010
    #2
  3. Mintsu

    Mintsu Regular member

    Joined:
    Oct 1, 2006
    Messages:
    161
    Likes Received:
    0
    Trophy Points:
    26
    Kokeilin tuon linkin kautta päivitystä, mutta ei onnistunut sekään. Laitoin kaikki selaimet pois päältä ja kytkin pois jopa Nortonin, mutta ihan sama herja seltä taas ilmesty, kohdassa "viimeistellään asennusta".
     
    Mintsu, Jan 4, 2010
    #3
  4. kalminen

    kalminen Regular member

    Joined:
    May 4, 2007
    Messages:
    3,915
    Likes Received:
    0
    Trophy Points:
    46
    kalminen, Jan 4, 2010
    #4
  5. Mintsu

    Mintsu Regular member

    Joined:
    Oct 1, 2006
    Messages:
    161
    Likes Received:
    0
    Trophy Points:
    26
    Jaaha, jostain ihmeen syystä se ei Mozillalla anna ollenkaan tallennus-vaihtoehtoa, mutta kokeillaas Explorerilla.. !

    ------------------

    Ei onnistunu silläkään, joten jatkan sun ohjeella eteenpäin :)
     
    Last edited: Jan 4, 2010
    Mintsu, Jan 4, 2010
    #5
  6. Mintsu

    Mintsu Regular member

    Joined:
    Oct 1, 2006
    Messages:
    161
    Likes Received:
    0
    Trophy Points:
    26
    Ei auttanu fixaus, sama herja tulee samassa kohtaa asennusta.
     
    Mintsu, Jan 4, 2010
    #6
  7. kalminen

    kalminen Regular member

    Joined:
    May 4, 2007
    Messages:
    3,915
    Likes Received:
    0
    Trophy Points:
    46
    Käynnistävalikon suorita laatikkoon => CMD ja painat OK

    Kirjoitat sinne regsvr32 /n /i /s inetcpl.cpl ja painat entter.

    Auttaako ???

    ---------------------------------------------------------------------------

    Ole hyvä ja lataa Combofix yhdestä alla olevista linkeistä:

    Linkki 1
    Linkki 2
    Linkki 3

    * TÄRKEÄÄ !!! Tallenna ComboFix.exe työpöydällesi

    * Sulje/ota pois päältä kaikki virustorjunta- ja haittaohjelmien poisto-ohjelmat, jotta ne eivät häiritse ComboFixin ajoa.

    * Tuplaklikkaa Combofix.exe ja noudata ohjeita.

    * Osana skannausta Combofix tarkistaa onko palautuskonsoli asennettuna. Nykypäivän haittaohjelmien takia on erittäin suositeltua olla asennettuna palautuskonsoli ennen haittaohjelmien poistoa. Windowsin palautuskonsoli mahdollistaa käynnistyksen erityiseen palautustilaan. Palautuskonsolin kautta voimme auttaa sinua helpommin mikäli haittaohjelmien poiston yhteydessä ilmenee ongelmia.

    * Seuraa ohjeita ja salli Combofixin ladata ja asentaa Microsoftin palautuskonsoli, ja kun pyydetään, hyväksy ohjelman takuuehdot asentaaksesi palautuskonsolin.

    **Huomaa: Jos palautuskonsoli on jo asennettuna, Combofix jatkaa eteenpäin.

    [​IMG]

    Kun Microsoftin palautuskonsoli on asennettu, sinun pitäisi nähdä seuraava viesti:

    [​IMG]

    Klikkaa Kyllä jatkaaksesi skannausta.

    Kun ComboFix on valmis, se luo raportin. Ole hyvä ja kopioi/liitä seuraavat raportit vastaukseesi:
    C:\ComboFix.txt
    Uusi HijackThis-loki


    Varoitus: ÄLÄ aja ComboFixia ilman valvontaa. Se ei ole lelu ja sitä ei tule käyttää rutiininomaisesti päivittäin.

    Jos tarvitset apua, katso yksityiskohtaisempi ohje:
    http://www.bleepingcomputer.com/combofix/fi/combofixin-kayttoohje

    Lähetä =>
    C:\ComboFix.txt
    Uusi HijackThis-loki
    .
     
    kalminen, Jan 5, 2010
    #7
  8. Mintsu

    Mintsu Regular member

    Joined:
    Oct 1, 2006
    Messages:
    161
    Likes Received:
    0
    Trophy Points:
    26
    Tässä ComboFix -raportti:

    ComboFix 10-01-04.01 - HP_Omistaja 05.01.2010 16:59:48.2.1 - x86
    Microsoft Windows XP Home Edition 5.1.2600.3.1252.358.1035.18.1534.1147 [GMT 2:00]
    Sijainti: c:\documents and settings\HP_Omistaja\Työpöytä\ComboFix.exe
    AV: Norton Internet Security *On-access scanning disabled* (Updated) {E10A9785-9598-4754-B552-92431C1C35F8}
    FW: Norton Internet Security *disabled* {7C21A4C9-F61F-4AC4-B722-A6E19C16F220}
    .

    (((((((((((((((((((((((((((((((((((((( Muut poistot ))))))))))))))))))))))))))))))))))))))))))))))))))))))))
    .

    C:\LOG.TXT
    C:\test.txt
    c:\windows\EventSystem.log
    J:\Autorun.inf

    .
    ((((( Tiedostot, jotka on luotu seuraavalla aikavälillä: 2009-12-05 to 2010-01-05 )))))))))))))))))
    .

    2010-01-02 15:52 . 2010-01-02 16:00 -------- d-----w- c:\program files\Windows Live Safety Center
    2009-12-19 10:03 . 2009-12-16 12:42 43008 ----a-w- c:\documents and settings\Everton\Application Data\Mozilla\Firefox\Profiles\hb0c6dod.default\extensions\{3112ca9c-de6d-4884-a869-9855de68056c}\components\googletoolbarloader.dll
    2009-12-19 10:03 . 2009-12-16 12:42 872960 ----a-w- c:\documents and settings\Everton\Application Data\Mozilla\Firefox\Profiles\hb0c6dod.default\extensions\{3112ca9c-de6d-4884-a869-9855de68056c}\components\frozen.dll
    2009-12-19 10:03 . 2009-12-16 12:42 340480 ----a-w- c:\documents and settings\Everton\Application Data\Mozilla\Firefox\Profiles\hb0c6dod.default\extensions\{3112ca9c-de6d-4884-a869-9855de68056c}\libraries\googletoolbar-ff2.dll
    2009-12-19 10:03 . 2009-12-16 12:41 346624 ----a-w- c:\documents and settings\Everton\Application Data\Mozilla\Firefox\Profiles\hb0c6dod.default\extensions\{3112ca9c-de6d-4884-a869-9855de68056c}\libraries\googletoolbar-ff3.dll
    2009-12-16 07:14 . 2009-12-16 07:14 -------- d-----w- c:\documents and settings\All Users\Application Data\Norton

    .
    (((((((((((((((((((((((((((((((((((( Find3M-raportti ))))))))))))))))))))))))))))))))))))))))))))))))))))))
    .
    2010-01-05 14:58 . 2005-01-02 03:15 -------- d-----w- c:\program files\Common Files\Symantec Shared
    2009-12-30 09:23 . 2005-01-02 03:15 -------- d-----w- c:\documents and settings\All Users\Application Data\Symantec
    2009-12-24 13:01 . 2009-11-18 12:56 -------- d-----w- c:\program files\PC Connectivity Solution
    2009-12-20 16:37 . 2006-09-03 14:21 -------- d-----w- c:\documents and settings\HP_Omistaja\Application Data\Azureus
    2009-12-20 11:37 . 2006-09-03 14:20 -------- d-----w- c:\program files\Azureus
    2009-12-20 08:21 . 2004-12-13 15:47 86024 ----a-w- c:\windows\system32\perfc00B.dat
    2009-12-20 08:21 . 2004-12-13 15:47 417544 ----a-w- c:\windows\system32\perfh00B.dat
    2009-12-04 19:54 . 2009-12-04 19:54 -------- d-----w- c:\program files\Codemasters
    2009-12-04 19:54 . 2005-01-02 03:03 -------- d--h--w- c:\program files\InstallShield Installation Information
    2009-12-04 19:54 . 2009-12-04 17:17 -------- d-----w- c:\documents and settings\HP_Omistaja\Application Data\DAEMON Tools Lite
    2009-12-04 17:17 . 2009-12-04 17:17 691696 ----a-w- c:\windows\system32\drivers\sptd.sys
    2009-12-04 17:17 . 2009-12-04 17:17 -------- d-----w- c:\documents and settings\All Users\Application Data\DAEMON Tools Lite
    2009-11-25 14:33 . 2009-09-18 14:31 -------- d-----w- c:\documents and settings\Everton\Application Data\HpUpdate
    2009-11-19 19:24 . 2009-03-05 17:46 411368 ----a-w- c:\windows\system32\deploytk.dll
    2009-11-19 19:24 . 2009-11-19 19:24 -------- d-----w- c:\program files\Java
    2009-11-19 05:57 . 2009-11-19 05:54 17217008 ----a-w- c:\documents and settings\HP_Omistaja\Application Data\Real\Update\setup\rp\RealPlayerSPGold.exe
    2009-11-19 05:54 . 2009-11-19 05:54 8406648 ----a-w- c:\documents and settings\HP_Omistaja\Application Data\Real\Update\setup\gtb_us\GOOGLE_TOOLBAR\GoogleToolbarInstaller.exe
    2009-11-19 05:53 . 2009-11-19 05:53 10309448 ----a-w- c:\documents and settings\HP_Omistaja\Application Data\Real\Update\setup\chr\ChromeInstaller.exe
    2009-11-19 05:51 . 2009-11-19 05:51 64000 ----a-w- c:\documents and settings\HP_Omistaja\Application Data\Real\Update\setup\RUP\inst_config\gcapi_dll.dll
    2009-11-19 05:51 . 2009-11-19 05:51 52288 ----a-w- c:\documents and settings\HP_Omistaja\Application Data\Real\Update\setup\RUP\inst_config\gtapi.dll
    2009-11-19 05:51 . 2009-11-19 05:51 50688 ----a-w- c:\documents and settings\HP_Omistaja\Application Data\Real\Update\setup\RUP\inst_config\fftbapi.dll
    2009-11-19 05:51 . 2009-11-19 05:51 114688 ----a-w- c:\documents and settings\HP_Omistaja\Application Data\Real\Update\setup\RUP\inst_config\compat.dll
    2009-11-18 15:08 . 2009-11-18 15:08 -------- d-----w- c:\program files\Common Files\xing shared
    2009-11-18 15:08 . 2007-01-13 19:35 -------- d-----w- c:\program files\Common Files\Real
    2009-11-18 15:08 . 2003-03-19 01:14 499712 ----a-w- c:\windows\system32\msvcp71.dll
    2009-11-18 15:08 . 2003-02-21 09:42 348160 ----a-w- c:\windows\system32\msvcr71.dll
    2009-11-18 13:07 . 2009-11-18 13:07 -------- d-----w- c:\documents and settings\All Users\Application Data\Welho
    2009-11-18 13:06 . 2009-11-18 13:06 -------- d-----w- c:\program files\Welho
    2009-11-18 12:58 . 2009-11-18 12:58 -------- d-----w- c:\program files\Common Files\PCSuite
    2009-11-18 12:58 . 2008-11-15 16:55 -------- d-----w- c:\program files\Common Files\Nokia
    2009-11-18 12:58 . 2008-11-15 16:54 -------- d-----w- c:\program files\Nokia
    2009-11-18 12:58 . 2008-11-15 16:58 -------- d-----w- c:\documents and settings\HP_Omistaja\Application Data\Nokia
    2009-11-18 12:54 . 2009-11-18 12:54 95232 ----a-w- c:\documents and settings\All Users\Application Data\Installations\{9249D7E7-33E7-4CC8-BB0B-3DF3C3CB2568}\Installer\CommonCustomActions\pcswpcsi.exe
    2009-11-18 12:54 . 2009-11-18 12:54 8192 ----a-w- c:\documents and settings\All Users\Application Data\Installations\{9249D7E7-33E7-4CC8-BB0B-3DF3C3CB2568}\Installer\CommonCustomActions\UninstCCD.exe
    2009-11-18 12:54 . 2009-11-18 12:54 61440 ----a-w- c:\documents and settings\All Users\Application Data\Installations\{9249D7E7-33E7-4CC8-BB0B-3DF3C3CB2568}\Installer\CommonCustomActions\UninstPCSFEMsi.exe
    2009-11-18 12:54 . 2009-11-18 12:54 10240 ----a-w- c:\documents and settings\All Users\Application Data\Installations\{9249D7E7-33E7-4CC8-BB0B-3DF3C3CB2568}\Installer\CommonCustomActions\UninstPCS.exe
    2009-11-18 12:54 . 2008-11-15 16:45 -------- d-----w- c:\documents and settings\All Users\Application Data\Installations
    2009-11-18 12:54 . 2009-11-18 12:55 34473536 ----a-w- c:\documents and settings\All Users\Application Data\Installations\{9249D7E7-33E7-4CC8-BB0B-3DF3C3CB2568}\Nokia_PC_Suite_7_1_40_1_fin.exe
    2009-11-17 11:06 . 2009-11-17 11:06 -------- d-----w- c:\documents and settings\HP_Omistaja\Application Data\Uniblue
    2009-11-16 14:54 . 2006-10-04 15:47 4572 ----a-w- c:\documents and settings\Everton\Application Data\wklnhst.dat
    2009-10-29 05:25 . 2004-09-15 04:00 667136 ----a-w- c:\windows\system32\wininet.dll
    2009-10-26 16:26 . 2006-09-01 16:05 71232 ----a-w- c:\documents and settings\HP_Omistaja\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
    2009-10-24 08:13 . 2006-09-17 17:03 71232 ----a-w- c:\documents and settings\Everton\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
    2009-10-23 17:22 . 2006-09-01 16:05 7342 ----a-w- c:\documents and settings\HP_Omistaja\Application Data\wklnhst.dat
    2009-10-21 05:40 . 2004-09-15 04:00 75776 ----a-w- c:\windows\system32\strmfilt.dll
    2009-10-21 05:40 . 2004-09-15 04:00 25088 ----a-w- c:\windows\system32\httpapi.dll
    2009-10-20 16:20 . 2004-09-15 04:00 265728 ----a-w- c:\windows\system32\drivers\http.sys
    2009-10-13 10:34 . 2004-09-15 04:00 270848 ----a-w- c:\windows\system32\oakley.dll
    2009-10-12 13:39 . 2004-09-15 04:00 79872 ----a-w- c:\windows\system32\raschap.dll
    2009-10-12 13:39 . 2004-09-15 04:00 150016 ----a-w- c:\windows\system32\rastls.dll
    2009-04-19 09:28 . 2007-06-24 21:18 394 ----a-w- c:\program files\X.ini
    2009-04-04 16:14 . 2009-04-04 16:14 2496707 ----a-w- c:\program files\vsoDivxToDVD_setup_v0.5.2b.exe
    2008-10-16 14:19 . 2007-04-05 21:08 96 ----a-w- c:\program files\lang.ini
    2008-10-16 14:19 . 2007-04-05 21:08 23 ----a-w- c:\program files\history.txt
    2008-10-16 14:19 . 2007-04-05 21:08 441 ----a-w- c:\program files\regfav.ini
    2008-09-21 12:08 . 2007-04-05 21:08 86 ----a-w- c:\program files\autoclean.ini
    2008-08-16 12:25 . 2008-08-16 12:25 9239213 ----a-w- c:\program files\AutoGordianKnot.2.45.Setup.exe
    2008-06-10 18:41 . 2008-06-10 18:41 1495112 ----a-w- c:\program files\install_flash_player.exe
    2008-02-06 10:54 . 2006-12-03 16:23 7766 ----a-w- c:\program files\CurrentCfg.tpr
    2008-02-06 10:54 . 2006-12-03 16:21 5158 ----a-w- c:\program files\TMPGEnc.ini
    2007-11-29 17:22 . 2007-11-29 17:20 13793865 ----a-w- c:\program files\acdsee-9-0-108-en-update.exe
    2007-11-29 17:20 . 2007-11-29 17:19 8608465 ----a-w- c:\program files\acdsee-10-0-238-en-update.exe
    2007-09-20 17:36 . 2007-09-20 17:08 51422520 ----a-w- c:\program files\iTunes742Setup.exe
    2007-07-08 00:37 . 2009-10-22 14:49 812344 ----a-w- c:\program files\HJTInstall.exe
    2007-07-06 20:06 . 2007-07-06 20:04 1014730 ----a-w- c:\program files\PowerISO37.exe
    2007-06-24 20:41 . 2007-06-24 20:40 5638544 ----a-w- c:\program files\DVDAuthorGUI_1.013.exe
    2007-06-24 19:22 . 2007-06-24 19:22 1987871 ----a-w- c:\program files\ProjectX-v0.90.04.00-20060330.zip
    2007-05-25 11:41 . 2007-06-12 21:14 343284 ----a-w- c:\program files\PlasmaEPG.tap
    2007-05-25 11:34 . 2007-06-12 21:14 25910 ----a-w- c:\program files\PlasmaEPG.lex
    2007-05-06 15:56 . 2007-05-06 15:56 86353 ----a-w- c:\program files\2665430270048562872RZfhFH.wbz
    2007-04-20 19:54 . 2007-04-20 19:54 0 ----a-w- c:\program files\QuickTimeInstaller.exe
    2007-04-17 21:42 . 2007-06-12 20:00 514 ----a-w- c:\program files\Install.txt
    2007-04-17 21:34 . 2007-06-12 20:00 625 ----a-w- c:\program files\Asennus.txt
    2007-04-07 14:44 . 2007-04-07 14:44 232592 ----a-w- c:\program files\l3codecx.exe
    2007-04-07 13:03 . 2007-04-07 13:03 2000324 ----a-w- c:\program files\cdex_151.exe
    2007-03-05 14:52 . 2007-03-05 14:53 288640 ----a-w- c:\program files\dxwebsetup.exe
    2007-02-25 13:29 . 2006-11-25 23:04 25754696 ----a-w- c:\program files\wmp11-windowsxp-x86-FI-FI.exe
    2007-02-25 13:18 . 2007-02-25 13:18 878896 ----a-w- c:\program files\WGAPluginInstall.exe
    2007-02-15 16:55 . 2007-02-15 16:53 513359 ----a-w- c:\program files\WingTip_SYNCFIX.rar
    2007-02-15 16:42 . 2007-02-15 16:42 1727591 ----a-w- c:\program files\on2_vp7_personal_edition.exe
    2007-01-24 17:51 . 2007-01-24 17:50 3513168 ----a-w- c:\program files\sp26752.exe
    2007-01-07 13:51 . 2007-01-07 13:51 6285558 ----a-w- c:\program files\divx-to-dvd-converter.exe
    2006-12-28 19:28 . 2006-12-28 19:26 16198952 ----a-w- c:\program files\Install_Messenger.exe
    2006-12-09 11:14 . 2006-12-09 11:12 12684992 ----a-w- c:\program files\winamp532_full_bundle_emusic-7plus.exe
    2006-11-30 18:17 . 2006-11-30 18:17 2987935 ----a-w- c:\program files\swf2avi.exe
    2006-11-30 18:11 . 2006-11-30 18:11 2388240 ----a-w- c:\program files\RivaFLVPlayerSetup.exe
    2006-11-30 06:46 . 2006-11-30 06:46 3513168 ----a-w- c:\program files\Näppis.exe
    2006-11-25 16:19 . 2006-11-25 16:19 3250296 ----a-w- c:\program files\Ifi-OrderClient-FI.exe
    2006-11-20 19:09 . 2007-02-11 09:17 6326784 ----a-w- c:\program files\DVRMSToolbox1103.msi
    2006-10-20 10:34 . 2007-04-05 21:08 3317 ----a-w- c:\program files\RegHist.txt
    2006-10-20 06:58 . 2007-04-05 21:08 7137 ----a-w- c:\program files\FlashPlayer9.reg
    2006-10-11 10:34 . 2007-04-05 21:08 2171 ----a-w- c:\program files\exclude.ini
    2006-09-19 08:14 . 2007-04-05 21:08 37376 ----a-w- c:\program files\Order.doc
    2006-06-26 08:52 . 2007-04-05 21:08 13507 ----a-w- c:\program files\license.rtf
    2006-06-23 22:50 . 2007-04-07 14:19 2434406 ----a-w- c:\program files\cdex_170b2_enu.exe
    2006-05-02 16:30 . 2006-09-17 11:41 179 ----a-w- c:\program files\Free-Codecs.txt
    2006-03-30 19:13 . 2007-06-24 19:23 787757 ----a-w- c:\program files\ProjectX-v0.90.04.00-20060330.jar
    2006-03-30 18:42 . 2007-06-24 19:23 124257 ----a-w- c:\program files\ProjectX_LanguagePack_0.90.4.00.zip
    2006-03-30 18:42 . 2007-06-24 19:23 825784 ----a-w- c:\program files\ProjectX_Source_eng_0.90.4.00.zip
    2006-03-30 15:51 . 2007-06-24 19:23 1629 ----a-w- c:\program files\ReadMe_Lang.txt
    2006-12-16 16:15 . 2006-12-16 16:15 22 --sha-w- c:\windows\SMINST\HPCD.sys
    .

    (((((((((((((((((((((((((((((( Rekisterin käynnistyskohteet )))))))))))))))))))))))))))))))))))))))))))))
    .
    .
    *Huom* Tyhjiä arvoja ja laillisia oletusarvoja ei näytetä
    REGEDIT4

    [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "Welho Holvi"="c:\program files\Welho\Welho Holvi\Welho_Holvi_2.exe" [2009-07-13 8766856]
    "PC Suite Tray"="c:\program files\Nokia\Nokia PC Suite 7\PCSuite.exe" [2009-11-11 1451520]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "PCMService"="c:\program files\CyberLink\PowerCinema\PCMService.exe" [2006-02-08 147456]
    "Recguard"="c:\windows\SMINST\RECGUARD.EXE" [2005-07-22 237568]
    "HPBootOp"="c:\program files\Hewlett-Packard\HP Boot Optimizer\HPBootOp.exe" [2005-11-10 249856]
    "HP Software Update"="c:\program files\HP\HP Software Update\HPWuSchd2.exe" [2007-05-08 54840]
    "KBD"="c:\hp\KBD\KBD.EXE" [2005-02-02 61440]
    "PWRISOVM.EXE"="c:\program files\PowerISO\PWRISOVM.EXE" [2007-04-09 200704]
    "ccApp"="c:\program files\Common Files\Symantec Shared\ccApp.exe" [2008-10-17 51048]
    "osCheck"="c:\program files\Norton Internet Security\osCheck.exe" [2007-08-24 714608]
    "ISUSPM Startup"="c:\progra~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe" [2004-07-27 221184]
    "QuickTime Task"="c:\program files\QuickTime Alternative\qttask.exe" [2007-10-19 286720]
    "TkBellExe"="c:\program files\Common Files\Real\Update_OB\realsched.exe" [2009-11-18 198160]

    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]
    @="Driver"

    [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]
    "DisableMonitoring"=dword:00000001

    [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
    "DisableMonitoring"=dword:00000001

    [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
    "DisableMonitoring"=dword:00000001

    [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
    "EnableFirewall"= 0 (0x0)

    [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
    "%windir%\\system32\\sessmgr.exe"=
    "c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqtra08.exe"=
    "c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqste08.exe"=
    "c:\\Program Files\\HP\\Digital Imaging\\bin\\hpofxm08.exe"=
    "c:\\Program Files\\HP\\Digital Imaging\\bin\\hposfx08.exe"=
    "c:\\Program Files\\HP\\Digital Imaging\\bin\\hposid01.exe"=
    "c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqscnvw.exe"=
    "c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqkygrp.exe"=
    "c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqCopy.exe"=
    "c:\\Program Files\\HP\\Digital Imaging\\bin\\hpfccopy.exe"=
    "c:\\Program Files\\HP\\Digital Imaging\\bin\\hpzwiz01.exe"=
    "c:\\Program Files\\HP\\Digital Imaging\\Unload\\HpqPhUnl.exe"=
    "c:\\Program Files\\HP\\Digital Imaging\\Unload\\HpqDIA.exe"=
    "c:\\Program Files\\HP\\Digital Imaging\\bin\\hpoews01.exe"=
    "c:\\Program Files\\CyberLink\\PowerCinema\\PowerCinema.exe"=
    "c:\\Program Files\\CyberLink\\PowerCinema\\PCMService.exe"=
    "c:\\Program Files\\Messenger\\msmsgs.exe"=
    "%windir%\\Network Diagnostic\\xpnetdiag.exe"=
    "c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
    "c:\\Program Files\\Windows Live\\Messenger\\wlcsdk.exe"=
    "c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=

    R2 LiveUpdate Notice;LiveUpdate Notice;c:\program files\Common Files\Symantec Shared\CCSVCHST.EXE [24.8.2007 23:07 149352]
    R3 EraserUtilRebootDrv;EraserUtilRebootDrv;c:\program files\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys [27.8.2009 8:20 102448]
    S0 sptd;sptd;c:\windows\system32\drivers\sptd.sys [4.12.2009 19:17 691696]
    S2 Automaattinen LiveUpdate-ajastustoiminto;Automaattinen LiveUpdate-ajastustoiminto;c:\program files\Symantec\LiveUpdate\AluSchedulerSvc.exe [23.8.2007 14:35 243064]
    S3 COH_Mon;COH_Mon;c:\windows\system32\drivers\COH_Mon.sys [29.5.2007 14:55 23888]
    S3 stusb2ir;USB 2.0 IrDA Bridge;c:\windows\system32\drivers\stusb2ir.sys [1.12.2007 23:03 40856]
    S3 TFBULK;Topfield USB client driver;c:\windows\system32\drivers\TfBulk.sys [26.8.2003 7:11 41996]
    S4 ASKService;ASKService;c:\program files\AskBarDis\bar\bin\AskService.exe --> c:\program files\AskBarDis\bar\bin\AskService.exe [?]
    S4 ASKUpgrade;ASKUpgrade;c:\program files\AskBarDis\bar\bin\ASKUpgrade.exe --> c:\program files\AskBarDis\bar\bin\ASKUpgrade.exe [?]

    --- Muut muistissa olevat ajurit/palvelut ---

    *NewlyCreated* - COMHOST
    .
    'Ajoitetut tehtävät'-kansion sisältö

    2009-12-31 c:\windows\Tasks\AppleSoftwareUpdate.job
    - c:\program files\Apple Software Update\SoftwareUpdate.exe [2007-08-29 11:57]

    2010-01-04 c:\windows\Tasks\Norton Internet Security - Suorita täysi järjestelmäntarkistus - Everton.job
    - c:\program files\Norton Internet Security\Norton AntiVirus\Navw32.exe [2007-08-26 17:19]
    .
    .
    ------- Täydentävä tarkistus -------
    .
    uStart Page = hxxp://www.google.com/
    uInternet Settings,ProxyOverride = *.fi;*.*.fi;*.*.*.fi;;*.local;<local>
    uInternet Settings,ProxyServer = proxydial.inet.fi:800
    FF - ProfilePath - c:\documents and settings\HP_Omistaja\Application Data\Mozilla\Firefox\Profiles\70s58afo.default\
    FF - prefs.js: browser.search.defaulturl - hxxp://www.google.com/search?lr=&ie=UTF-8&oe=UTF-8&q=
    FF - prefs.js: browser.search.selectedEngine - Google
    FF - prefs.js: keyword.URL - hxxp://toolbar.ask.com/toolbarv/askRedirect?o=10615&gct=&gc=1&q=
    FF - plugin: c:\program files\Mozilla Firefox\plugins\np-mswmp.dll
    FF - plugin: c:\program files\QuickTime Alternative\Plugins\npqtplugin.dll
    FF - plugin: c:\program files\QuickTime Alternative\Plugins\npqtplugin2.dll
    FF - plugin: c:\program files\QuickTime Alternative\Plugins\npqtplugin3.dll
    FF - plugin: c:\program files\QuickTime Alternative\Plugins\npqtplugin4.dll
    FF - plugin: c:\program files\QuickTime Alternative\Plugins\npqtplugin5.dll
    FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\
    .

    **************************************************************************

    catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
    Rootkit scan 2010-01-05 17:05
    Windows 5.1.2600 Service Pack 3 NTFS

    tarkistaa piilotettuja prosesseja ...

    tarkistaa piilotettuja käynnistysarvoja ...

    tarkistaa piilotettuja tiedostoja ...

    tarkistus on valmis
    piilotetut tiedostot: 0

    **************************************************************************
    .
    --------------------- LUKITUT REKISTERIAVAIMET ---------------------

    [HKEY_USERS\.Default\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders\HP\EN]
    @DACL=(02 0000)
    "OnLineServicesDirName"="Online Services"

    [HKEY_USERS\.Default\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders\HP\FR]
    @DACL=(02 0000)
    "OnLineServicesDirName"="Services en ligne"

    [HKEY_USERS\.Default\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders\HP\MX]
    @DACL=(02 0000)
    "OnLineServicesDirName"="Servicios en línea"

    [HKEY_USERS\.Default\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders\HP\NL]
    @DACL=(02 0000)
    "OnLineServicesDirName"="Online Services"

    [HKEY_USERS\.Default\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders\HP\NW]
    @DACL=(02 0000)
    "OnLineServicesDirName"="Online tjenster"

    [HKEY_USERS\.Default\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders\HP\SP]
    @DACL=(02 0000)
    "OnLineServicesDirName"="Servicios en línea"

    [HKEY_USERS\.Default\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders\HP\SW]
    @DACL=(02 0000)
    "OnLineServicesDirName"="Online tjänster"

    [HKEY_USERS\.Default\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders\HP\UK]
    @DACL=(02 0000)
    "OnLineServicesDirName"="Online services"

    [HKEY_USERS\.Default\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders\HP\US]
    @DACL=(02 0000)
    "OnLineServicesDirName"="Online Services"

    [HKEY_USERS\S-1-5-21-1272536644-464686433-2415924820-1008\Software\ACD Systems\ACDSee\90\ADE]
    @DACL=(02 0000)

    [HKEY_USERS\S-1-5-21-1272536644-464686433-2415924820-1008\Software\ACD Systems\ACDSee\90\Columns]
    @DACL=(02 0000)
    "ColCount"=dword:00000007
    "SortFieldTag"=dword:00000004
    "Sort00"=dword:00000000
    "Column00Tag"=dword:00000004
    "Column00Group"=dword:00000001
    "Column00Width"=dword:00000064
    "Sort01"=dword:00000001
    "Column01Tag"=dword:00000009
    "Column01Group"=dword:00000001
    "Column01Width"=dword:00000064
    "Sort02"=dword:00000002
    "Column02Tag"=dword:00000028
    "Column02Group"=dword:00000003
    "Column02Width"=dword:00000064
    "Sort03"=dword:00000003
    "Column03Tag"=dword:0000000a
    "Column03Group"=dword:00000001
    "Column03Width"=dword:00000064
    "Sort04"=dword:00000004
    "Column04Tag"=dword:0000002b
    "Column04Group"=dword:00000003
    "Column04Width"=dword:00000064
    "Sort05"=dword:00000005
    "Column05Tag"=dword:00000013
    "Column05Group"=dword:00000002
    "Column05Width"=dword:00000064
    "Sort06"=dword:00000006
    "Column06Tag"=dword:00000015
    "Column06Group"=dword:00000002
    "Column06Width"=dword:00000064

    [HKEY_USERS\S-1-5-21-1272536644-464686433-2415924820-1008\Software\ACD Systems\ACDSee\90\Editors]
    @DACL=(02 0000)
    @="ACDSee"

    [HKEY_USERS\S-1-5-21-1272536644-464686433-2415924820-1008\Software\ACD Systems\ACDSee\90\en]
    @DACL=(02 0000)

    [HKEY_USERS\S-1-5-21-1272536644-464686433-2415924820-1008\Software\ACD Systems\ACDSee\90\QuickView]
    @DACL=(02 0000)

    [HKEY_USERS\S-1-5-21-1272536644-464686433-2415924820-1008\Software\ACD Systems\ACDSee\90\TPColumns]
    @DACL=(02 0000)
    "Column00Width"=dword:00000064
    "Column01Width"=dword:00000064
    "Column02Width"=dword:00000064
    "Column03Width"=dword:00000064
    "Column04Width"=dword:00000064
    "Column05Width"=dword:00000064
    "Column06Width"=dword:00000064

    [HKEY_USERS\S-1-5-21-1272536644-464686433-2415924820-1008\Software\Google\NavClient]
    @DACL=(02 0000)
    @SACL=

    [HKEY_USERS\S-1-5-21-1272536644-464686433-2415924820-1008\Software\Microsoft\MediaPlayer\Preferences\EqualizerSettings]
    @DACL=(02 0000)

    [HKEY_USERS\S-1-5-21-1272536644-464686433-2415924820-1008\Software\Microsoft\MediaPlayer\Preferences\HME]
    @DACL=(02 0000)
    "LocalLibraryID"="{994CA114-33AD-4F2B-AB99-C03D9382466D}"

    [HKEY_USERS\S-1-5-21-1272536644-464686433-2415924820-1008\Software\Microsoft\MediaPlayer\Preferences\ProxySettings]
    @DACL=(02 0000)

    [HKEY_USERS\S-1-5-21-1272536644-464686433-2415924820-1008\Software\Microsoft\MediaPlayer\Preferences\VideoSettings]
    @DACL=(02 0000)

    [HKEY_USERS\S-1-5-21-1272536644-464686433-2415924820-1008\Software\Microsoft\MediaPlayer\Preferences\{7aa92cfa-39c3-11db-9ab0-806d6172696f}]
    @DACL=(02 0000)
    "CDReadRate"=hex:c8,ac,e1,40

    [HKEY_USERS\S-1-5-21-1272536644-464686433-2415924820-1008\Software\Microsoft\Windows\CurrentVersion\Explorer\Streams\Desktop]
    @DACL=(02 0000)
    @SACL=
    "Toolbars"=hex:11,00,00,00,00,00,00,00
    "TaskbarWinXP"=hex:0c,00,00,00,08,00,00,00,02,00,00,00,00,00,00,00,aa,4f,28,68,
    48,6a,d0,11,8c,78,00,c0,4f,d9,18,b4,18,02,00,00,60,0d,00,00,00,00,00,00,16,\
    "Upgrade"=dword:00000001

    [HKEY_USERS\S-1-5-21-1272536644-464686433-2415924820-1008\Software\Microsoft\Windows\Shell\Bags\1]
    @DACL=(02 0000)
    @SACL=

    [HKEY_LOCAL_MACHINE\software\Classes\adc\Shell]
    @DACL=(02 0000)

    [HKEY_LOCAL_MACHINE\software\Classes\CLSID\{2871FC9B-5E34-4AAE-9E9C-EBD1652D5C92}\InprocServer32]
    @DACL=(02 0000)

    [HKEY_LOCAL_MACHINE\software\Classes\dchub\Shell]
    @DACL=(02 0000)

    [HKEY_LOCAL_MACHINE\software\Cygnus Solutions\Cygwin]
    @Class="cygnus"
    @DACL=(02 0000)

    [HKEY_LOCAL_MACHINE\software\Hewlett-Packard\cpc\PCINTRO\Browser]
    @DACL=(02 0000)
    @SACL=
    "IE"="0"
    "Netscape"="0"

    [HKEY_LOCAL_MACHINE\software\Hewlett-Packard\cpc\PCINTRO\BWOPT]
    @DACL=(02 0000)
    @SACL=
    "bwsupport"="1"
    "bwoffers"="0"

    [HKEY_LOCAL_MACHINE\software\Hewlett-Packard\cpc\PCINTRO\HPSU]
    @DACL=(02 0000)
    @SACL=
    "OptInPath"="c:\\hp\\bin\\cloaker.exe"
    "OptInCmdLine"="c:\\hp\\drivers\\hpsu\\HPSU_optin.bat"
    "OptOutPath"="c:\\hp\\bin\\cloaker.exe"
    "OptOutCmdLine"="c:\\hp\\drivers\\hpsu\\HPSU_optout.bat"
    "hpsulaunch"="1"

    [HKEY_LOCAL_MACHINE\software\Hewlett-Packard\cpc\PCINTRO\NIS]
    @DACL=(02 0000)
    @SACL=
    "NISRun"="0"
    "NISPath"="c:\\windows\\system32\\pcintro\\autorun.exe"
    "NISCmdLine"="security.cmd"

    [HKEY_LOCAL_MACHINE\software\Microsoft\Advanced INF Setup\IEHomePageInfo\RegBackup]
    @DACL=(02 0000)
    @SACL=

    [HKEY_LOCAL_MACHINE\software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_ADDON_MANAGEMENT]
    @DACL=(02 0000)
    @SACL=
    "WMPlayer.exe"=dword:00000001

    [HKEY_LOCAL_MACHINE\software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_HTTP_USERNAME_PASSWORD_DISABLE]
    @DACL=(02 0000)
    @SACL=
    "WMPlayer.exe"=dword:00000001

    [HKEY_LOCAL_MACHINE\software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_RESTRICT_ACTIVEXINSTALL]
    @DACL=(02 0000)
    @SACL=
    "WMPlayer.exe"=dword:00000001

    [HKEY_LOCAL_MACHINE\software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_RESTRICT_FILEDOWNLOAD]
    @DACL=(02 0000)
    @SACL=
    "WMPlayer.exe"=dword:00000001

    [HKEY_LOCAL_MACHINE\software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_SECURITYBAND]
    @DACL=(02 0000)
    @SACL=
    "WMPlayer.exe"=dword:00000001

    [HKEY_LOCAL_MACHINE\software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_UNC_SAVEDFILECHECK]
    @DACL=(02 0000)
    @SACL=
    "WMPlayer.exe"=dword:00000001

    [HKEY_LOCAL_MACHINE\software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_VALIDATE_NAVIGATE_URL]
    @DACL=(02 0000)
    @SACL=
    "WMPlayer.exe"=dword:00000001

    [HKEY_LOCAL_MACHINE\software\Microsoft\MediaPlayer\10.0]
    @DACL=(02 0000)
    @SACL=

    [HKEY_LOCAL_MACHINE\software\Microsoft\MediaPlayer\7.0]
    @DACL=(02 0000)

    [HKEY_LOCAL_MACHINE\software\Microsoft\MediaPlayer\services]
    @DACL=(02 0000)
    @SACL=
    "NoServices"=dword:00000000

    [HKEY_LOCAL_MACHINE\software\Microsoft\MediaPlayer\Settings]
    @DACL=(02 0000)
    @SACL=

    [HKEY_LOCAL_MACHINE\software\Microsoft\Windows\CurrentVersion\Installer\UserData\LocalSystem\Components\�•€|ÿÿÿÿ"•€|þ»Ów*]
    "b049C053C7D38EE4AB9A00CB3B5D2472"="C?\\Program Files\\Common Files\\Microsoft Shared\\Web Folders\\PUBPLACE.HTT"

    [HKEY_LOCAL_MACHINE\software\Microsoft\Windows\CurrentVersion\Setup\OptionalComponents\SwFlash]
    @DACL=(02 0000)
    @SACL=
    "Installed"="1"

    [HKEY_LOCAL_MACHINE\software\Nullsoft\Winamp]
    @DACL=(02 0000)

    [HKEY_LOCAL_MACHINE\software\Realtek\AlcMonitor]
    @DACL=(02 0000)
    @SACL=

    [HKEY_LOCAL_MACHINE\System\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\Answer]
    @DACL=(02 0000)
    "1"="ATA<cr>"

    [HKEY_LOCAL_MACHINE\System\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\Hangup]
    @DACL=(02 0000)
    "1"="ATH<cr>"

    [HKEY_LOCAL_MACHINE\System\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\Init]
    @DACL=(02 0000)
    "1"="ATQ0E0V1<cr>"
    "2"="AT&C1&D2<cr>"

    [HKEY_LOCAL_MACHINE\System\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\Monitor]
    @DACL=(02 0000)
    "1"="ATS0=0<cr>"
    "2"="None"

    [HKEY_LOCAL_MACHINE\System\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\Settings]
    @DACL=(02 0000)
    "Prefix"="AT"
    "Terminator"="<cr>"
    "DialPrefix"="D"
    "Pulse"="P"
    "Tone"="T"
    "FlowControl_Off"=""
    "FlowControl_Hard"=""
    "FlowControl_Soft"=""
    .
    --------------------- Prosesseihin ladatut DLLt ---------------------

    - - - - - - - > 'winlogon.exe'(712)
    c:\windows\system32\Ati2evxx.dll
    .
    Valmistumisajankohta: 2010-01-05 17:07:21
    ComboFix-quarantined-files.txt 2010-01-05 15:07
    ComboFix2.txt 2009-10-27 15:27

    Ennen ajoa: 143 883 984 896 tavua vapaana
    Ajon jälkeen: 144 288 677 888 tavua vapaana

    - - End Of File - - 9CEAD6BCBA4365D505AC16F09092FB1F


    Tässä HJT -logi:

    Logfile of Trend Micro HijackThis v2.0.2
    Scan saved at 17:13:37, on 5.1.2010
    Platform: Windows XP SP3 (WinNT 5.01.2600)
    MSIE: Internet Explorer v6.00 SP3 (6.00.2900.5512)
    Boot mode: Normal

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\Ati2evxx.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\system32\Ati2evxx.exe
    C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
    C:\WINDOWS\system32\spoolsv.exe
    C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
    C:\Program Files\Bonjour\mDNSResponder.exe
    C:\Program Files\CyberLink\PowerCinema\Kernel\TV\CLCapSvc.exe
    C:\Program Files\CyberLink\PowerCinema\Kernel\CLML_NTService\CLMLServer.exe
    C:\Program Files\Java\jre6\bin\jqs.exe
    C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\HPZIPM12.EXE
    C:\WINDOWS\system32\svchost.exe
    C:\Program Files\CyberLink\PowerCinema\Kernel\TV\CLSched.exe
    C:\Program Files\Canon\CAL\CALMAIN.exe
    C:\WINDOWS\system32\wbem\wmiapsrv.exe
    C:\WINDOWS\system32\notepad.exe
    C:\WINDOWS\explorer.exe
    C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
    C:\Program Files\Internet Explorer\iexplore.exe
    C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
    R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = proxydial.inet.fi:800
    R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.fi;*.*.fi;*.*.*.fi;;*.local;<local>
    R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Linkit
    O2 - BHO: Adobe PDF Reader -linkkiavustaja - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
    O2 - BHO: NCO 2.0 IE BHO - {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} - C:\Program Files\Common Files\Symantec Shared\coShared\Browser\2.0\coIEPlg.dll
    O2 - BHO: Symantec Intrusion Prevention - {6D53EC84-6AAE-4787-AEEE-F4628F01010C} - C:\PROGRA~1\COMMON~1\SYMANT~1\IDS\IPSBHO.dll
    O2 - BHO: Windows Liven kirjautumisapuohjelma - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
    O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
    O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
    O3 - Toolbar: Show Norton Toolbar - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - C:\Program Files\Common Files\Symantec Shared\coShared\Browser\2.0\CoIEPlg.dll
    O4 - HKLM\..\Run: [PCMService] "C:\Program Files\CyberLink\PowerCinema\PCMService.exe"
    O4 - HKLM\..\Run: [Recguard] C:\WINDOWS\SMINST\RECGUARD.EXE
    O4 - HKLM\..\Run: [HPBootOp] "C:\Program Files\Hewlett-Packard\HP Boot Optimizer\HPBootOp.exe" /run
    O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
    O4 - HKLM\..\Run: [KBD] C:\HP\KBD\KBD.EXE
    O4 - HKLM\..\Run: [PWRISOVM.EXE] C:\Program Files\PowerISO\PWRISOVM.EXE
    O4 - HKLM\..\Run: [ccApp] C:\Program Files\Common Files\Symantec Shared\ccApp.exe
    O4 - HKLM\..\Run: [osCheck] "C:\Program Files\Norton Internet Security\osCheck.exe"
    O4 - HKLM\..\Run: [ISUSPM Startup] C:\PROGRA~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe -startup
    O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime Alternative\qttask.exe" -atboottime
    O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
    O4 - HKCU\..\Run: [Welho Holvi] "C:\Program Files\Welho\Welho Holvi\Welho_Holvi_2.exe" /delayed
    O4 - HKCU\..\Run: [PC Suite Tray] "C:\Program Files\Nokia\Nokia PC Suite 7\PCSuite.exe" -onlytray
    O4 - .DEFAULT User Startup: Pin.lnk = C:\hp\bin\CLOAKER.EXE (User 'Default user')
    O9 - Extra button: Yhteysohje - {E2D4D26B-0180-43a4-B05F-462D6D54C789} - C:\WINDOWS\PCHEALTH\HELPCTR\Vendors\CN=Hewlett-Packard,L=Cupertino,S=Ca,C=US\IEButton\support.htm
    O9 - Extra 'Tools' menuitem: Yhteysohje - {E2D4D26B-0180-43a4-B05F-462D6D54C789} - C:\WINDOWS\PCHEALTH\HELPCTR\Vendors\CN=Hewlett-Packard,L=Cupertino,S=Ca,C=US\IEButton\support.htm
    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O14 - IERESET.INF: START_PAGE_URL=http://www.soneraplaza.fi
    O16 - DPF: {20A60F0D-9AFA-4515-A0FD-83BD84642501} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab56986.cab
    O16 - DPF: {22492231-AEF0-49FC-9180-CE8969AB1273} (F-Secure Online Scanner Launcher) - http://download.sp.f-secure.com/ols/f-secure-rtm/resources/fslauncher.cab
    O16 - DPF: {5C051655-FCD5-4969-9182-770EA5AA5565} (Solitaire Showdown Class) - http://messenger.zone.msn.com/binary/SolitaireShowdown.cab56986.cab
    O16 - DPF: {5ED80217-570B-4DA9-BF44-BE107C0EC166} (Windows Live Safety Center Base Module) - http://cdn.scan.onecare.live.com/resource/download/scanner/wlscbase8942.cab
    O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1157211675640
    O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (MSN Games - Installer) - http://messenger.zone.msn.com/binary/ZIntro.cab56649.cab
    O16 - DPF: {BD393C14-72AD-4790-A095-76522973D6B8} (CBreakshotControl Class) - http://messenger.zone.msn.com/binary/Bankshot.cab57213.cab
    O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
    O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
    O16 - DPF: {F5A7706B-B9C0-4C89-A715-7A0C6B05DD48} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineSweeper.cab56986.cab
    O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
    O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
    O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
    O23 - Service: Automaattinen LiveUpdate-ajastustoiminto - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
    O23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\AluSchedulerSvc.exe
    O23 - Service: ##Id_String1.6844F930_1628_4223_B5CC_5BB94B879762## (Bonjour Service) - Apple Computer, Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
    O23 - Service: Canon Camera Access Library 8 (CCALib8) - Canon Inc. - C:\Program Files\Canon\CAL\CALMAIN.exe
    O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
    O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
    O23 - Service: CyberLink Background Capture Service (CBCS) (CLCapSvc) - Unknown owner - C:\Program Files\CyberLink\PowerCinema\Kernel\TV\CLCapSvc.exe
    O23 - Service: CyberLink Task Scheduler (CTS) (CLSched) - Unknown owner - C:\Program Files\CyberLink\PowerCinema\Kernel\TV\CLSched.exe
    O23 - Service: Symantec Lic NetConnect service (CLTNetCnService) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
    O23 - Service: COM Host (comHost) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\VAScanner\comHost.exe
    O23 - Service: CyberLink Media Library Service - Cyberlink - C:\Program Files\CyberLink\PowerCinema\Kernel\CLML_NTService\CLMLServer.exe
    O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
    O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
    O23 - Service: LiveUpdate - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\LuComServer_3_4.EXE
    O23 - Service: LiveUpdate Notice - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
    O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\HPZIPM12.EXE
    O23 - Service: ServiceLayer - Nokia - C:\Program Files\PC Connectivity Solution\ServiceLayer.exe
    O23 - Service: Symantec Core LC - Unknown owner - C:\PROGRA~1\COMMON~1\SYMANT~1\CCPD-LC\symlcsvc.exe

    --
    End of file - 9107 bytes
     
    Mintsu, Jan 5, 2010
    #8
  9. kalminen

    kalminen Regular member

    Joined:
    May 4, 2007
    Messages:
    3,915
    Likes Received:
    0
    Trophy Points:
    46
    Varmistetaan virusten osalta tämä !!!

    Lataa Atribunen ATF Cleaner

    Tupla-klikkaa ATF-Cleaner.exe käynnistääksesi ohjelman. Main:n alla valitse: Select All
    Klikkaa Empty Selected valintaa.

    Jos käytät FireFoxia selaimenasi Klikkaa Firefox yläpuolelta ja valitse: Select All
    Klikkaa Empty Selected valintaa.
    HUOMIO: Jos haluaisit pitää tallennetut salasanasi, klikkaa No kun se sitä kysyy.

    Jos käytät Operaa selaimenasi Klikkaa Opera yläpuolelta ja valitse: Select All
    Klikkaa Empty Selected valintaa taas.
    HUOMIO: Jos haluaisit pitää tallennetut salasanasi, klikkaa No kun se sitä kysyy.

    Klikkaa Exit päävalikosta sulkeaksesi ohjelman.

    ----------------------------------------------

    Skannaa koneesi Kaspersky Online Skannerilla

    * Lue läpi vaatimukset ja yksityisyyssäännökset ja klikkaa Accept.
    * Skannerin ja virustietokannan lataus alkaa. Sinulta kysytään sallitko Kasperskyltä tulevan ohjelman asentamisen. Klikkaa Aja/Run.
    * Kun lataus on valmis, klikkaa Settings.
    * Varmistu, että seuraavat kohdat on valittu. Jos ne eivät ole, valitse ne ja klikkaa Save: Spyware, Adware, Dialers, and other potentially dangerous programs
    Archives
    Mail databases

    * Klikkaa Oma Tietokone, My Computer Scan-kohdan alapuolelta.
    * Kun tarkistus on valmis, tulokset näytetään. Klikkaa View Scan Report.
    * Näet listan saastuneista kohteista. Klikkaa Save Report As....
    * Tallenna tiedosto työpöydällesi. Muuta Tiedostotyyppi/Files of type muotoon Tekstitiedosto/Text file(.txt) ennen kuin klikkaat Save.

    * Kopioi ja liitä tiedoston sisältö seuraavaan vastaukseesi
    * uuden HijackThis-lokin kera

    .
     
    kalminen, Jan 5, 2010
    #9
  10. Mintsu

    Mintsu Regular member

    Joined:
    Oct 1, 2006
    Messages:
    161
    Likes Received:
    0
    Trophy Points:
    26
    Kaspersky ei löytäny mitään epäilyttävää ja sen antama raporttiki oli siis tyhjä :)

    Tässä vielä HJT -logi, vaikka ei siinä nyt varmaan mitään uutta sitten olekkaan ;)

    Logfile of Trend Micro HijackThis v2.0.2
    Scan saved at 18:47:35, on 7.1.2010
    Platform: Windows XP SP3 (WinNT 5.01.2600)
    MSIE: Internet Explorer v6.00 SP3 (6.00.2900.5512)
    Boot mode: Normal

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\Ati2evxx.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\system32\Ati2evxx.exe
    C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
    C:\WINDOWS\system32\spoolsv.exe
    C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
    C:\Program Files\Bonjour\mDNSResponder.exe
    C:\Program Files\CyberLink\PowerCinema\Kernel\TV\CLCapSvc.exe
    C:\Program Files\CyberLink\PowerCinema\Kernel\CLML_NTService\CLMLServer.exe
    C:\Program Files\Java\jre6\bin\jqs.exe
    C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\HPZIPM12.EXE
    C:\WINDOWS\system32\svchost.exe
    C:\Program Files\CyberLink\PowerCinema\Kernel\TV\CLSched.exe
    C:\Program Files\Canon\CAL\CALMAIN.exe
    C:\WINDOWS\system32\wbem\wmiapsrv.exe
    C:\WINDOWS\Explorer.EXE
    C:\Program Files\CyberLink\PowerCinema\PCMService.exe
    C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
    C:\HP\KBD\KBD.EXE
    C:\Program Files\PowerISO\PWRISOVM.EXE
    C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
    C:\Program Files\Common Files\Real\Update_OB\realsched.exe
    C:\Program Files\Welho\Welho Holvi\Welho_Holvi_2.exe
    C:\Program Files\Nokia\Nokia PC Suite 7\PCSuite.exe
    C:\PROGRA~1\COMMON~1\SYMANT~1\CCPD-LC\symlcsvc.exe
    C:\Program Files\PC Connectivity Solution\ServiceLayer.exe
    C:\Program Files\Welho\Welho Holvi\AGMailAgent.exe
    C:\Program Files\Mozilla Firefox\firefox.exe
    C:\WINDOWS\ALCXMNTR.EXE
    c:\windows\system\hpsysdrv.exe
    C:\Program Files\Java\jre6\bin\jusched.exe
    C:\Program Files\Java\jre6\bin\java.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\Ati2evxx.exe
    C:\Program Files\PC Connectivity Solution\Transports\NclUSBSrv.exe
    C:\Program Files\PC Connectivity Solution\Transports\NclRSSrv.exe
    C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
    R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = proxydial.inet.fi:800
    R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.fi;*.*.fi;*.*.*.fi;;*.local;<local>
    R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Linkit
    O2 - BHO: Adobe PDF Reader -linkkiavustaja - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
    O2 - BHO: NCO 2.0 IE BHO - {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} - C:\Program Files\Common Files\Symantec Shared\coShared\Browser\2.0\coIEPlg.dll
    O2 - BHO: Symantec Intrusion Prevention - {6D53EC84-6AAE-4787-AEEE-F4628F01010C} - C:\PROGRA~1\COMMON~1\SYMANT~1\IDS\IPSBHO.dll
    O2 - BHO: Windows Liven kirjautumisapuohjelma - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
    O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
    O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
    O3 - Toolbar: Show Norton Toolbar - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - C:\Program Files\Common Files\Symantec Shared\coShared\Browser\2.0\CoIEPlg.dll
    O4 - HKLM\..\Run: [PCMService] "C:\Program Files\CyberLink\PowerCinema\PCMService.exe"
    O4 - HKLM\..\Run: [Recguard] C:\WINDOWS\SMINST\RECGUARD.EXE
    O4 - HKLM\..\Run: [HPBootOp] "C:\Program Files\Hewlett-Packard\HP Boot Optimizer\HPBootOp.exe" /run
    O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
    O4 - HKLM\..\Run: [KBD] C:\HP\KBD\KBD.EXE
    O4 - HKLM\..\Run: [PWRISOVM.EXE] C:\Program Files\PowerISO\PWRISOVM.EXE
    O4 - HKLM\..\Run: [ccApp] C:\Program Files\Common Files\Symantec Shared\ccApp.exe
    O4 - HKLM\..\Run: [osCheck] "C:\Program Files\Norton Internet Security\osCheck.exe"
    O4 - HKLM\..\Run: [ISUSPM Startup] C:\PROGRA~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe -startup
    O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime Alternative\qttask.exe" -atboottime
    O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
    O4 - HKCU\..\Run: [Welho Holvi] "C:\Program Files\Welho\Welho Holvi\Welho_Holvi_2.exe" /delayed
    O4 - HKCU\..\Run: [PC Suite Tray] "C:\Program Files\Nokia\Nokia PC Suite 7\PCSuite.exe" -onlytray
    O4 - HKUS\S-1-5-21-1272536644-464686433-2415924820-1009\..\Run: [Polar Sync] (User 'Everton')
    O4 - HKUS\S-1-5-21-1272536644-464686433-2415924820-1009\..\Run: [TheLionCluster] C:\Program Files\The Lion\skinkers.exe (User 'Everton')
    O4 - HKUS\S-1-5-21-1272536644-464686433-2415924820-1009\..\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background (User 'Everton')
    O4 - .DEFAULT User Startup: Pin.lnk = C:\hp\bin\CLOAKER.EXE (User 'Default user')
    O9 - Extra button: Yhteysohje - {E2D4D26B-0180-43a4-B05F-462D6D54C789} - C:\WINDOWS\PCHEALTH\HELPCTR\Vendors\CN=Hewlett-Packard,L=Cupertino,S=Ca,C=US\IEButton\support.htm
    O9 - Extra 'Tools' menuitem: Yhteysohje - {E2D4D26B-0180-43a4-B05F-462D6D54C789} - C:\WINDOWS\PCHEALTH\HELPCTR\Vendors\CN=Hewlett-Packard,L=Cupertino,S=Ca,C=US\IEButton\support.htm
    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O14 - IERESET.INF: START_PAGE_URL=http://www.soneraplaza.fi
    O16 - DPF: {20A60F0D-9AFA-4515-A0FD-83BD84642501} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab56986.cab
    O16 - DPF: {22492231-AEF0-49FC-9180-CE8969AB1273} (F-Secure Online Scanner Launcher) - http://download.sp.f-secure.com/ols/f-secure-rtm/resources/fslauncher.cab
    O16 - DPF: {5C051655-FCD5-4969-9182-770EA5AA5565} (Solitaire Showdown Class) - http://messenger.zone.msn.com/binary/SolitaireShowdown.cab56986.cab
    O16 - DPF: {5ED80217-570B-4DA9-BF44-BE107C0EC166} (Windows Live Safety Center Base Module) - http://cdn.scan.onecare.live.com/resource/download/scanner/wlscbase8942.cab
    O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1157211675640
    O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (MSN Games - Installer) - http://messenger.zone.msn.com/binary/ZIntro.cab56649.cab
    O16 - DPF: {BD393C14-72AD-4790-A095-76522973D6B8} (CBreakshotControl Class) - http://messenger.zone.msn.com/binary/Bankshot.cab57213.cab
    O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
    O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
    O16 - DPF: {F5A7706B-B9C0-4C89-A715-7A0C6B05DD48} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineSweeper.cab56986.cab
    O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
    O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
    O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
    O23 - Service: Automaattinen LiveUpdate-ajastustoiminto - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
    O23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\AluSchedulerSvc.exe
    O23 - Service: ##Id_String1.6844F930_1628_4223_B5CC_5BB94B879762## (Bonjour Service) - Apple Computer, Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
    O23 - Service: Canon Camera Access Library 8 (CCALib8) - Canon Inc. - C:\Program Files\Canon\CAL\CALMAIN.exe
    O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
    O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
    O23 - Service: CyberLink Background Capture Service (CBCS) (CLCapSvc) - Unknown owner - C:\Program Files\CyberLink\PowerCinema\Kernel\TV\CLCapSvc.exe
    O23 - Service: CyberLink Task Scheduler (CTS) (CLSched) - Unknown owner - C:\Program Files\CyberLink\PowerCinema\Kernel\TV\CLSched.exe
    O23 - Service: Symantec Lic NetConnect service (CLTNetCnService) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
    O23 - Service: COM Host (comHost) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\VAScanner\comHost.exe
    O23 - Service: CyberLink Media Library Service - Cyberlink - C:\Program Files\CyberLink\PowerCinema\Kernel\CLML_NTService\CLMLServer.exe
    O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
    O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
    O23 - Service: LiveUpdate - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\LuComServer_3_4.EXE
    O23 - Service: LiveUpdate Notice - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
    O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\HPZIPM12.EXE
    O23 - Service: ServiceLayer - Nokia - C:\Program Files\PC Connectivity Solution\ServiceLayer.exe
    O23 - Service: Symantec Core LC - Unknown owner - C:\PROGRA~1\COMMON~1\SYMANT~1\CCPD-LC\symlcsvc.exe

    --
    End of file - 10307 bytes
     
    Mintsu, Jan 7, 2010
    #10
  11. kalminen

    kalminen Regular member

    Joined:
    May 4, 2007
    Messages:
    3,915
    Likes Received:
    0
    Trophy Points:
    46
    Minä en sitten osaa enempää sanoa asiaan.
    Laita viestiä tuonne Windows ongelmat alueelle.
    :D
    .
     
    kalminen, Jan 7, 2010
    #11
  12. Mintsu

    Mintsu Regular member

    Joined:
    Oct 1, 2006
    Messages:
    161
    Likes Received:
    0
    Trophy Points:
    26
    Ok, kiitos, jatketaan siellä :D
     
    Mintsu, Jan 7, 2010
    #12

Share This Page