Kone erittäin ''nykivä'' internetissä sekä videotiedostoja katsoessa. (HijackThis logi)

Discussion in 'Virukset ja haittaohjelmat - HijackThis -logit' started by Gybetius, Apr 29, 2008.

Page 1 of 2
  1. Gybetius

    Gybetius Member

    Joined:
    Mar 31, 2008
    Messages:
    19
    Likes Received:
    0
    Trophy Points:
    11
    Eli kone toimii normaalisti esim. selatessa tietokoneen kansioita ja tehdessä töitä koneen eri ohjelmilla.

    Ongelmat ilmenevät, kun koetan katsoa tietokoneelle ladattuja videoita tai selata internettiä. Videot näkyvät ''tasaisesti nykien'', eli vähän niinkuin kuva kuvalta. Tietokone ei yleisesti nyi, eli pystyn selailemaan esim. resurssien hallintaa nykivän videon käydessä taustalla täysin tasaisesti ilman minkäänlaista viivettä ja ylipäänsä täysin normaalisti. Paljon suurempi ja ikävämpi ongelma on internetin vihoittelu. Netti saattaa toimia hetken selaimen käynnistyksen jälkeen normaalisti, mutta hetken kuluttua sivustojen linkit alkavat näkyä nykivästi ja esim. osoiteriville kirjoitus tai sivuston ylös- ja alaspäin rullailu on samankaltaista nykivää etenemistä. Eli internet nykii tasaisesti koko ajan riippumatta sivustosta millä on. Tämä johtaa myös siihen, että nettivideot (www.youtube.com , www.nhl.com) näkyvät niinikään tasaisesti nykien. Tehtävienhallinnassa ei näy mitään prosessia, mikä voisi aiheuttaa tämän nykivyyden. Normaalit prosessit ovat käynnissä, suorittimen tehoa pitäisi olla kokoajan käytettävissä 95-100%.

    Toivottavasti joltain löytyy vinkkiä vian korjaamiseksi. Erittäin ikävää etenkin tuo, etten pysty katsomaan mitään koosteita ym. internetistä. Mielestäni kone on muuten täysin virkeä, mutta yllämainituissa tilanteissa meno muuttuu nykiväksi. Formatointi lienee auttaisi varmasti, mutta toivon että sitä toimenpidettä ei tarvita. Se lienee se viimeisin keino.

    =====================================================================


    Logfile of Trend Micro HijackThis v2.0.2
    Scan saved at 15:20:09, on 29.4.2008
    Platform: Windows XP SP2 (WinNT 5.01.2600)
    MSIE: Internet Explorer v7.00 (7.00.6000.16640)
    Boot mode: Normal

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\Ati2evxx.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\system32\Ati2evxx.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\Explorer.EXE
    C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
    C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
    C:\WINDOWS\system32\spoolsv.exe
    C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
    C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
    C:\Program Files\Bluetooth\Bluetooth-ohjelmisto\bin\btwdins.exe
    C:\WINDOWS\system32\HPZipm12.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\system32\ThreadMaster\ThreadMast.exe
    C:\Program Files\Common Files\Symantec Shared\ccApp.exe
    C:\WINDOWS\system32\LVCOMSX.EXE
    C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe
    C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe
    C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
    C:\Program Files\HP\Digital Imaging\bin\hpqSTE08.exe
    C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
    C:\Program Files\Mozilla Firefox\firefox.exe
    C:\Program Files\HJ\Skanneri.exe.exe

    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://finnish.toggle.com/index.php?rvs=hompag
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
    R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = localhost
    R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Linkit
    O2 - BHO: Adobe PDF Reader -linkkiavustaja - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
    O2 - BHO: (no name) - {1E8A6170-7264-4D0F-BEAE-D42A53123C75} - C:\Program Files\Common Files\Symantec Shared\coShared\Browser\1.5\NppBho.dll
    O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
    O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
    O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
    O4 - HKLM\..\Run: [LVCOMSX] C:\WINDOWS\system32\LVCOMSX.EXE
    O4 - HKLM\..\Run: [Recguard] C:\WINDOWS\SMINST\RECGUARD.EXE
    O4 - HKLM\..\Run: [Symantec PIF AlertEng] "C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe" /a /m "C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\AlertEng.dll"
    O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe"
    O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
    O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Paikallinen palve')
    O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Verkkopalve')
    O4 - HKUS\S-1-5-18\..\Run: [Picasa Media Detector] C:\Program Files\Picasa2\PicasaMediaDetector.exe (User 'SYSTEM')
    O4 - HKUS\.DEFAULT\..\Run: [Picasa Media Detector] C:\Program Files\Picasa2\PicasaMediaDetector.exe (User 'Default user')
    O4 - .DEFAULT User Startup: Pin.lnk = C:\hp\bin\CLOAKER.EXE (User 'Default user')
    O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
    O8 - Extra context menu item: Lähetä &Bluetooth-laitteeseen - C:\Program Files\Bluetooth\Bluetooth-ohjelmisto\btsendto_ie_ctx.htm
    O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
    O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
    O9 - Extra button: @btrez.dll,-4015 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\Bluetooth\Bluetooth-ohjelmisto\btsendto_ie.htm
    O9 - Extra 'Tools' menuitem: @btrez.dll,-4017 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\Bluetooth\Bluetooth-ohjelmisto\btsendto_ie.htm
    O9 - Extra button: Yhteysohje - {E2D4D26B-0180-43a4-B05F-462D6D54C789} - C:\WINDOWS\PCHEALTH\HELPCTR\Vendors\CN=Hewlett-Packard,L=Cupertino,S=Ca,C=US\IEButton\support.htm
    O9 - Extra 'Tools' menuitem: Yhteysohje - {E2D4D26B-0180-43a4-B05F-462D6D54C789} - C:\WINDOWS\PCHEALTH\HELPCTR\Vendors\CN=Hewlett-Packard,L=Cupertino,S=Ca,C=US\IEButton\support.htm
    O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
    O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O16 - DPF: {C4847596-972C-11D0-9567-00A0C9273C2A} (Crystal Report Viewer Control) - http://jasenpalvelut.hammasll.fi/viewer/activeXViewer/activexviewer.cab
    O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
    O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
    O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
    O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
    O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
    O23 - Service: Automaattinen LiveUpdate-ajastustoiminto - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
    O23 - Service: Automattinen LiveUpdate-ajastustoiminto - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
    O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
    O23 - Service: Bluetooth Service (btwdins) - Broadcom Corporation. - C:\Program Files\Bluetooth\Bluetooth-ohjelmisto\bin\btwdins.exe
    O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
    O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
    O23 - Service: Symantec Lic NetConnect service (CLTNetCnService) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
    O23 - Service: COM Host (comHost) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\VAScanner\comHost.exe
    O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
    O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
    O23 - Service: iPodService - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
    O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
    O23 - Service: LiveUpdate Notice Service Ex (LiveUpdate Notice Ex) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
    O23 - Service: LiveUpdate Notice Service - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe
    O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
    O23 - Service: ServiceLayer - Nokia. - C:\Program Files\PC Connectivity Solution\ServiceLayer.exe
    O23 - Service: Symantec Core LC - Unknown owner - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
    O23 - Service: Thread Master (ThreadMaster) - http://threadmaster.tripod.com - threadmaster@europe.com - C:\WINDOWS\system32\ThreadMaster\ThreadMast.exe

    --
    End of file - 8527 bytes
     
    Gybetius, Apr 29, 2008
    #1
  2. Hujo

    Hujo Guest


    1.Lataa combofix.exe työpöydällesi yhdestä linkistä:
    combofix1
    combofix2

    2. Tuplaklikkaa combofix.exe tiedostoa ja seuraa ohjeistuksia.
    3. Kun työkalu on valmis, se tuottaa lokin. Lähetä tämä loki viesti ketjuusi.
    Huom! Älä klikkaile combofixin ikkunaa käytön aikana. Tämä saattaa aiheuttaa ohjelman jumiutumisen.

    =======

    Lataa SDFix by AndyManchesta ja tallenna se työpöydällesi.

    Käynnistä koneesi vikasietotilaan:

    sammuta ja käynnistä
    käynnistyksen yhteydessä hakkaa F8 nappia
    valitse nuolinäppäimellä vikasietotila
    paina enter ja enter
    valitse käyttäjätilisi
    paina kyllä

    Jossakin koneissa hakataan F8:sin sijasta F5:tä

    " Kun vikasietotilassa, pura tiedoston SDFix.zip sisältö (SDFix kansio) työpöydällesi. Työpöydälle pitäisi ilmestyä kansio nimeltä SDFix.
    " Avaa SDFix-kansio ja tuplaklikkaa tiedostoa RunThis.bat käynnistääksesi ohjelman.
    " Paina Y käynnistääksesi skriptin.
    " Työkalu puhdistaa troijalaisen palvelut ja tekee myös joitakin korjauksia rekisteriin. Lopuksi se pyytää käynnistämään koneen uudelleen, "Press any key to Reboot".
    " Paina mitä tahansa näppäintä ja kone käynnistyy uudelleen.
    " Käynnistyminen kestää normaalia kauemmin sillä SDFix puhdistaa konetta.
    " Kun kone on käynnistynyt ja työpöytä latautunut, SDFix kertoo että puhdistus on suoritettu, "Finished".
    " Paina sitten mitä tahansa näppäintä sulkeaksesi skriptin ja ladataksesi pikakuvakkeet työpöydälle.
    " Lopuksi avaa SDFix kansio (työpöydällä) ja kopioi & liitä tiedoston Report.txt sisältö viestiketjuusi uuden HijackThis:n lokin kera.
     
    Hujo, Apr 29, 2008
    #2
  3. Gybetius

    Gybetius Member

    Joined:
    Mar 31, 2008
    Messages:
    19
    Likes Received:
    0
    Trophy Points:
    11
    ComboFix 08-04-28.2 - HP_Omistaja 2008-04-29 20:26:10.4 - NTFSx86
    Running from: C:\Documents and Settings\HP_Omistaja\Työpöytä\ComboFix.exe
    * Created a new restore point
    .

    (((((((((((((((((((((((((((((((((((((( Muut poistot ))))))))))))))))))))))))))))))))))))))))))))))))))))))))
    .

    C:\Program Files\AMV Converter\_desktop.ini
    C:\Program Files\AMV Converter\skin\_desktop.ini
    C:\Program Files\AMV Converter\skin\xpstyle\_desktop.ini

    .
    ((((( Tiedostot, jotka on luotu seuraavalla aikavälillä: 2008-03-28 to 2008-04-29 )))))))))))))))))
    .

    2008-04-29 08:47 . 2008-04-29 08:47 <KANSIO> d-------- C:\Program Files\Opera
    2008-04-27 01:12 . 2008-04-27 01:12 <KANSIO> d-------- C:\WINDOWS\system32\ThreadMaster
    2008-04-26 23:34 . 2008-04-26 23:34 <KANSIO> d-------- C:\Documents and Settings\HP_Omistaja\Application Data\TVU Networks
    2008-04-26 23:34 . 2008-04-26 23:34 <KANSIO> d-------- C:\Documents and Settings\All Users\Application Data\TVU Networks
    2008-04-26 23:33 . 2008-04-26 23:33 <KANSIO> d-------- C:\Program Files\TVUPlayer
    2008-04-26 23:33 . 2008-04-26 23:33 <KANSIO> d-------- C:\Documents and Settings\HP_Omistaja\LocalLow
    2008-04-26 22:26 . 2008-04-26 23:18 45 --a------ C:\WINDOWS\msgtn.ini
    2008-04-26 22:21 . 2008-04-26 22:25 <KANSIO> d-------- C:\Documents and Settings\HP_Omistaja\Application Data\ppstream
    2008-04-26 22:21 . 2004-09-15 00:00 811,064 --a------ C:\WINDOWS\system32\imjp81k.dll
    2008-04-18 11:31 . 2008-04-29 20:28 <KANSIO> d-a------ C:\Program Files\AMV Converter
    2008-04-12 11:32 . 2008-04-12 11:32 0 --a------ C:\WINDOWS\MSDraw.ini
    2008-04-11 13:51 . 2008-04-11 13:51 <KANSIO> d-------- C:\Documents and Settings\HP_Omistaja\Application Data\Grisoft
    2008-04-11 13:51 . 2007-05-30 15:10 10,872 --a------ C:\WINDOWS\system32\drivers\AvgAsCln.sys
    2008-04-06 02:39 . 2008-04-06 02:39 <KANSIO> d-------- C:\Program Files\Java
    2008-04-06 02:39 . 2008-04-06 02:39 <KANSIO> d-------- C:\Program Files\Common Files\Java
    2008-04-06 02:39 . 2008-02-22 02:33 69,632 --a------ C:\WINDOWS\system32\javacpl.cpl
    2008-04-05 00:10 . 2008-04-05 00:10 <KANSIO> dr------- C:\Documents and Settings\LocalService\Suosikit
    2008-04-05 00:10 . 2008-04-05 00:10 <KANSIO> d-------- C:\Documents and Settings\LocalService\Application Data\Talkback
    2008-04-05 00:06 . 2008-04-05 00:07 <KANSIO> d-------- C:\Program Files\SpywareBlaster
    2008-04-05 00:06 . 2005-08-25 18:18 118,784 --a------ C:\WINDOWS\system32\MSSTDFMT.DLL
    2008-04-05 00:06 . 2005-08-25 18:19 115,920 --a------ C:\WINDOWS\system32\MSINET.OCX
    2008-04-04 23:59 . 2008-04-06 03:08 <KANSIO> d-a------ C:\Documents and Settings\All Users\Application Data\TEMP
    2008-04-04 23:06 . 2008-04-04 23:06 <KANSIO> d-------- C:\Program Files\Lavasoft
    2008-04-04 23:06 . 2008-04-04 23:06 <KANSIO> d-------- C:\Documents and Settings\All Users\Application Data\Lavasoft
    2008-04-04 15:53 . 2008-04-04 18:21 3,046 ---hs---- C:\WINDOWS\system32\nhpyfdyk.ini
    2008-04-03 15:52 . 2008-04-04 15:52 2,926 ---hs---- C:\WINDOWS\system32\dmesjaus.ini
    2008-04-02 15:16 . 2008-04-03 15:47 2,686 ---hs---- C:\WINDOWS\system32\uuphksvx.ini
    2008-04-01 20:43 . 2008-04-04 16:43 <KANSIO> d-------- C:\Documents and Settings\HP_Omistaja\.housecall6.6
    2008-03-31 21:16 . 2008-04-02 15:06 2,506 ---hs---- C:\WINDOWS\system32\wamcovdi.ini
    2008-03-31 20:13 . 2008-03-31 20:13 <KANSIO> d-------- C:\Program Files\CCleaner
    2008-03-31 18:57 . 2008-04-27 13:06 <KANSIO> d-------- C:\VundoFix Backups
    2008-03-31 18:53 . 2008-04-29 15:20 <KANSIO> d-------- C:\Program Files\HJ
    2008-03-31 10:16 . 2008-03-31 21:12 2,026 ---hs---- C:\WINDOWS\system32\yxkpujos.ini
    2008-03-29 21:09 . 2008-03-31 10:10 1,374 ---hs---- C:\WINDOWS\system32\mjhoswfk.ini
    2008-03-29 20:21 . 2008-03-29 20:57 1,134 ---hs---- C:\WINDOWS\system32\bqjfmvch.ini

    .
    (((((((((((((((((((((((((((((((((((( Find3M-raportti ))))))))))))))))))))))))))))))))))))))))))))))))))))))
    .
    2008-04-29 17:22 --------- d-----w C:\Program Files\mIRC
    2008-04-29 06:16 --------- d-----w C:\Documents and Settings\All Users\Application Data\Symantec
    2008-04-29 05:47 --------- d-----w C:\Program Files\Common Files\Symantec Shared
    2008-04-28 18:20 --------- d-----w C:\Documents and Settings\HP_Omistaja\Application Data\Skype
    2008-04-28 14:55 --------- d-----w C:\Documents and Settings\HP_Omistaja\Application Data\skypePM
    2008-04-28 11:42 --------- d-----w C:\Program Files\Warcraft III
    2008-04-27 16:23 43,520 ----a-w C:\WINDOWS\system32\CmdLineExt03.dll
    2008-04-27 13:15 --------- d-----w C:\Program Files\SopCast
    2008-04-26 21:29 --------- d-----w C:\Program Files\Common Files\Wise Installation Wizard
    2008-04-26 20:18 --------- d-----w C:\Program Files\MSN Messenger
    2008-04-23 16:00 10,800 -c--a-w C:\Documents and Settings\HP_Omistaja\Application Data\wklnhst.dat
    2008-04-22 18:09 --------- d-----w C:\Program Files\Ajokorttikoulu
    2008-03-20 16:48 --------- d-----w C:\Documents and Settings\HP_Omistaja\Application Data\Command & Conquer 3 Tiberium Wars
    2008-03-20 16:45 98,304 ----a-w C:\WINDOWS\system32CmdLineExt.dll
    2008-03-20 15:54 --------- d-----w C:\Program Files\Electronic Arts
    2008-03-20 14:32 --------- d-----w C:\Documents and Settings\All Users\Application Data\Rabio
    2008-03-20 08:09 1,845,504 ----a-w C:\WINDOWS\system32\win32k.sys
    2008-03-20 08:09 1,845,504 ----a-w C:\WINDOWS\system32\dllcache\win32k.sys
    2008-03-13 16:29 --------- d--h--w C:\Program Files\InstallShield Installation Information
    2008-03-11 12:15 --------- d-----w C:\Program Files\The Learning Company
    2008-03-06 23:43 --------- d-----w C:\Documents and Settings\HP_Omistaja\Application Data\Winamp
    2008-03-06 19:32 706 ----a-w C:\WINDOWS\system32\drivers\COH_Mon.inf
    2008-03-06 19:32 23,904 ----a-w C:\WINDOWS\system32\drivers\COH_Mon.sys
    2008-03-06 19:32 10,537 ----a-w C:\WINDOWS\system32\drivers\COH_Mon.cat
    2008-03-06 08:59 --------- d-----w C:\Documents and Settings\HP_Omistaja\Application Data\Nokia Multimedia Player
    2008-03-01 15:31 3,591,680 ----a-w C:\WINDOWS\system32\dllcache\mshtml.dll
    2008-02-29 08:56 625,664 ----a-w C:\WINDOWS\system32\dllcache\iexplore.exe
    2008-02-29 08:55 70,656 ----a-w C:\WINDOWS\system32\dllcache\ie4uinit.exe
    2008-02-22 10:00 13,824 ------w C:\WINDOWS\system32\dllcache\ieudinit.exe
    2008-02-20 06:51 282,624 ----a-w C:\WINDOWS\system32\gdi32.dll
    2008-02-20 06:51 282,624 ----a-w C:\WINDOWS\system32\dllcache\gdi32.dll
    2008-02-20 05:38 45,568 ----a-w C:\WINDOWS\system32\dnsrslvr.dll
    2008-02-20 05:38 45,568 ----a-w C:\WINDOWS\system32\dllcache\dnsrslvr.dll
    2008-02-20 05:38 148,992 ----a-w C:\WINDOWS\system32\dllcache\dnsapi.dll
    2008-02-15 05:44 161,792 ----a-w C:\WINDOWS\system32\dllcache\ieakui.dll
    2008-01-29 13:50 81,920 ------r C:\WINDOWS\bwUnin-6.1.4.68-8876480L.exe
    2007-12-23 17:03 32 ----a-w C:\Documents and Settings\All Users\Application Data\ezsid.dat
    .

    ((((((((((((((((((((((((((((( snapshot_2008-04-11_13.34.25,45 )))))))))))))))))))))))))))))))))))))))))
    .
    + 2008-04-11 10:37:56 876,544 ----a-w C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\Microsoft.Build.Eng#\9710a3c0d11dd264c3a6b88977699e9b\Microsoft.Build.Engine.ni.dll
    + 2008-04-11 10:37:57 81,920 ----a-w C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\Microsoft.Build.Fra#\e2858a45971fb30b0c0523dbb52c1d4e\Microsoft.Build.Framework.ni.dll
    + 2008-04-11 10:38:01 1,695,744 ----a-w C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\Microsoft.Build.Tas#\63d69ffdf3c640d2d104a4b74e8115f8\Microsoft.Build.Tasks.ni.dll
    + 2008-04-11 10:38:01 167,936 ----a-w C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\Microsoft.Build.Uti#\11cb5418c06e30100616fbf205588489\Microsoft.Build.Utilities.ni.dll
    + 2008-04-11 10:38:05 1,740,800 ----a-w C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\Microsoft.VisualBas#\923bd55258380eae77353d36a5a1b08f\Microsoft.VisualBasic.ni.dll
    + 2008-04-11 10:38:07 1,011,712 ----a-w C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System.Configuration\eee9b48577689e92db5a7b5c5de98d9b\System.Configuration.ni.dll
    + 2008-04-11 10:38:09 1,798,144 ----a-w C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System.Deployment\c7dea4895e1fa33d65e448c03de48d26\System.Deployment.ni.dll
    + 2008-04-11 10:38:10 1,224,704 ----a-w C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System.DirectorySer#\914668b240550f529e54bb772c6fc881\System.DirectoryServices.ni.dll
    + 2008-04-11 10:38:12 512,000 ----a-w C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System.DirectorySer#\f11bc82c09955cb8438d3885a99c297d\System.DirectoryServices.Protocols.ni.dll
    + 2008-04-11 10:38:13 659,456 ----a-w C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System.EnterpriseSe#\646131eda5f21f4e6216733d49c22c56\System.EnterpriseServices.ni.dll
    + 2008-04-11 10:38:13 294,912 ----a-w C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System.EnterpriseSe#\646131eda5f21f4e6216733d49c22c56\System.EnterpriseServices.Wrapper.dll
    + 2008-04-11 10:38:14 733,184 ----a-w C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System.Security\2b5994269cc5b996231c9b21afea9a91\System.Security.ni.dll
    + 2008-04-11 10:38:15 233,472 ----a-w C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System.ServiceProce#\193ac978af569ad9ee45110b359961b9\System.ServiceProcess.ni.dll
    + 2008-04-11 10:38:16 679,936 ----a-w C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System.Transactions\12e0aa1030badf4524f897e3f57b037a\System.Transactions.ni.dll
    + 2008-04-11 10:38:35 2,342,912 ----a-w C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System.Web.Mobile\37d87b3cab1c66ec4430ebb2abeaa570\System.Web.Mobile.ni.dll
    + 2008-04-11 10:38:35 237,568 ----a-w C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System.Web.RegularE#\b5b81faf46fc63c20d5339b36edd02fa\System.Web.RegularExpressions.ni.dll
    + 2008-04-11 10:38:38 1,986,560 ----a-w C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System.Web.Services\38991368499e2109ea4099a0fe29c5a3\System.Web.Services.ni.dll
    + 2008-04-11 10:38:31 12,509,184 ----a-w C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System.Web\67cfb70213562afe2ca9b9066764af3a\System.Web.ni.dll
    + 2008-04-29 15:06:27 2,048 --s-a-w C:\WINDOWS\bootstat.dat
    + 2006-03-17 00:26:46 2,314 -c----w C:\WINDOWS\hphmdl10.dat
    + 2004-09-14 21:00:00 2,589 -c--a-w C:\WINDOWS\I386\RUNW32.BAT
    + 2004-09-14 21:00:00 175,104 ----a-w C:\WINDOWS\ime\chsime\applets\PINTLCSA.DLL
    + 2004-09-14 21:00:00 53,760 ----a-w C:\WINDOWS\ime\chsime\applets\PINTLCSD.DLL
    + 2004-09-14 21:00:00 97,792 ----a-w C:\WINDOWS\ime\CHTIME\Applets\CHTMBX.DLL
    + 2004-09-14 21:00:00 56,320 ----a-w C:\WINDOWS\ime\CHTIME\Applets\CHTSKDIC.DLL
    + 2004-09-14 21:00:00 173,568 ----a-w C:\WINDOWS\ime\CHTIME\Applets\CHTSKF.DLL
    + 2004-09-14 21:00:00 10,096,640 ----a-w C:\WINDOWS\ime\CHTIME\Applets\HWXCHT.DLL
    + 2004-09-14 21:00:00 13,463,552 ----a-w C:\WINDOWS\ime\imjp8_1\applets\hwxjpn.dll
    + 2004-09-14 21:00:00 471,102 ----a-w C:\WINDOWS\ime\imjp8_1\applets\imskdic.dll
    + 2004-09-14 21:00:00 315,452 ----a-w C:\WINDOWS\ime\imjp8_1\applets\imskf.dll
    + 2004-09-14 21:00:00 229,439 ----a-w C:\WINDOWS\ime\imjp8_1\applets\multibox.dll
    + 2004-09-14 21:00:00 143,422 ----a-w C:\WINDOWS\ime\imjp8_1\applets\softkey.dll
    + 2004-09-14 21:00:00 426,041 ----a-w C:\WINDOWS\ime\imjp8_1\applets\voicepad.dll
    + 2004-09-14 21:00:00 86,073 ----a-w C:\WINDOWS\ime\imjp8_1\applets\voicesub.dll
    + 2004-09-14 21:00:00 57,399 ----a-w C:\WINDOWS\ime\imjp8_1\cplexe.exe
    + 2004-09-14 21:00:00 368,696 ----a-w C:\WINDOWS\ime\imjp8_1\imjpcic.dll
    + 2004-09-14 21:00:00 716,856 ----a-w C:\WINDOWS\ime\imjp8_1\imjpcus.dll
    + 2004-09-14 21:00:00 57,398 ----a-w C:\WINDOWS\ime\imjp8_1\imjpdadm.exe
    + 2004-09-14 21:00:00 81,976 ----a-w C:\WINDOWS\ime\imjp8_1\imjpdct.dll
    + 2004-09-14 21:00:00 307,257 ----a-w C:\WINDOWS\ime\imjp8_1\imjpdct.exe
    + 2004-09-14 21:00:00 155,705 ----a-w C:\WINDOWS\ime\imjp8_1\imjpdsvr.exe
    + 2004-09-14 21:00:00 196,665 ----a-w C:\WINDOWS\ime\imjp8_1\imjpinst.exe
    + 2004-09-14 21:00:00 208,952 ----a-w C:\WINDOWS\ime\imjp8_1\imjpmig.exe
    + 2004-09-14 21:00:00 233,527 ----a-w C:\WINDOWS\ime\imjp8_1\imjprw.exe
    + 2004-09-14 21:00:00 45,109 ----a-w C:\WINDOWS\ime\imjp8_1\imjpuex.exe
    + 2004-09-14 21:00:00 262,200 ----a-w C:\WINDOWS\ime\imjp8_1\imjputy.exe
    + 2004-09-14 21:00:00 274,489 ----a-w C:\WINDOWS\ime\imjp8_1\imjputyc.dll
    + 2004-09-14 21:00:00 10,129,408 ----a-w C:\WINDOWS\ime\imkr6_1\applets\hwxkor.dll
    + 2004-09-14 21:00:00 86,016 ----a-w C:\WINDOWS\ime\imkr6_1\applets\imekrmbx.dll
    + 2004-09-14 21:00:00 36,864 ----a-w C:\WINDOWS\ime\imkr6_1\dicts\hanjadic.dll
    + 2004-09-14 21:00:00 106,496 ----a-w C:\WINDOWS\ime\imkr6_1\imekrcic.dll
    + 2004-09-14 21:00:00 44,032 ----a-w C:\WINDOWS\ime\imkr6_1\imekrmig.exe
    + 2004-09-14 21:00:00 59,904 ----a-w C:\WINDOWS\ime\imkr6_1\imkrinst.exe
    + 2004-09-14 21:00:00 102,463 ----a-w C:\WINDOWS\ime\shared\imepadsm.dll
    + 2004-09-14 21:00:00 311,359 ----a-w C:\WINDOWS\ime\shared\imepadsv.exe
    + 2004-09-14 21:00:00 102,456 ----a-w C:\WINDOWS\ime\shared\imlang.dll
    + 2004-09-14 21:00:00 15,872 ----a-w C:\WINDOWS\ime\shared\res\PADRS404.DLL
    + 2004-09-14 21:00:00 36,927 ----a-w C:\WINDOWS\ime\shared\res\padrs411.dll
    + 2004-09-14 21:00:00 14,336 ----a-w C:\WINDOWS\ime\shared\res\padrs412.dll
    + 2004-09-14 21:00:00 15,360 ----a-w C:\WINDOWS\ime\shared\res\padrs804.dll
    + 2004-09-14 21:00:00 19,456 ----a-w C:\WINDOWS\msagent\intl\agt0404.dll
    + 2004-09-14 21:00:00 19,456 ----a-w C:\WINDOWS\msagent\intl\agt0411.dll
    + 2004-09-14 21:00:00 19,456 ----a-w C:\WINDOWS\msagent\intl\agt0412.dll
    + 2004-09-14 21:00:00 19,456 ----a-w C:\WINDOWS\msagent\intl\agt0804.dll
    + 2004-09-15 04:00:00 2,000 -c--a-w C:\WINDOWS\system\KEYBOARD.DRV
    + 2004-09-15 04:00:00 2,032 -c--a-w C:\WINDOWS\system\MOUSE.DRV
    + 2004-09-15 04:00:00 1,744 -c--a-w C:\WINDOWS\system\SOUND.DRV
    + 2004-09-15 04:00:00 2,176 -c--a-w C:\WINDOWS\system\VGA.DRV
    + 2004-09-14 21:00:00 218,112 ----a-w C:\WINDOWS\system32\c_g18030.dll
    + 2004-09-14 21:00:00 6,656 ----a-w C:\WINDOWS\system32\c_is2022.dll
    + 2004-09-14 21:00:00 1,677,824 ----a-w C:\WINDOWS\system32\chsbrkr.dll
    + 2004-09-14 21:00:00 838,144 ----a-w C:\WINDOWS\system32\chtbrkr.dll
    + 2004-09-15 04:00:00 1,788 ----a-w C:\WINDOWS\system32\Dcache.bin
    - 2004-09-15 04:00:00 19,456 -c--a-w C:\WINDOWS\system32\dllcache\agt0404.dll
    + 2004-09-14 21:00:00 19,456 ----a-w C:\WINDOWS\system32\dllcache\agt0404.dll
    - 2004-09-15 04:00:00 19,456 -c--a-w C:\WINDOWS\system32\dllcache\agt0411.dll
    + 2004-09-14 21:00:00 19,456 ----a-w C:\WINDOWS\system32\dllcache\agt0411.dll
    - 2004-09-15 04:00:00 19,456 -c--a-w C:\WINDOWS\system32\dllcache\agt0412.dll
    + 2004-09-14 21:00:00 19,456 ----a-w C:\WINDOWS\system32\dllcache\agt0412.dll
    - 2004-09-15 04:00:00 19,456 -c--a-w C:\WINDOWS\system32\dllcache\agt0804.dll
    + 2004-09-14 21:00:00 19,456 ----a-w C:\WINDOWS\system32\dllcache\agt0804.dll
    - 2004-09-15 04:00:00 218,112 -c--a-w C:\WINDOWS\system32\dllcache\c_g18030.dll
    + 2004-09-14 21:00:00 218,112 ----a-w C:\WINDOWS\system32\dllcache\c_g18030.dll
    - 2004-09-15 04:00:00 6,656 -c--a-w C:\WINDOWS\system32\dllcache\c_is2022.dll
    + 2004-09-14 21:00:00 6,656 ----a-w C:\WINDOWS\system32\dllcache\c_is2022.dll
    + 2004-09-14 21:00:00 1,677,824 ----a-w C:\WINDOWS\system32\dllcache\chsbrkr.dll
    + 2004-09-14 21:00:00 838,144 ----a-w C:\WINDOWS\system32\dllcache\chtbrkr.dll
    + 2004-09-14 21:00:00 97,792 ----a-w C:\WINDOWS\system32\dllcache\chtmbx.dll
    + 2004-09-14 21:00:00 56,320 ----a-w C:\WINDOWS\system32\dllcache\chtskdic.dll
    + 2004-09-14 21:00:00 173,568 ----a-w C:\WINDOWS\system32\dllcache\chtskf.dll
    + 2004-09-14 21:00:00 198,656 ----a-w C:\WINDOWS\system32\dllcache\cintime.dll
    + 2004-09-14 21:00:00 480,256 ----a-w C:\WINDOWS\system32\dllcache\cintsetp.exe
    + 2004-09-14 21:00:00 57,399 ----a-w C:\WINDOWS\system32\dllcache\cplexe.exe
    + 2004-08-04 04:07:58 2,944 -c--a-w C:\WINDOWS\system32\dllcache\drmkaud.sys
    - 2004-09-15 04:00:00 7,168 -c--a-w C:\WINDOWS\system32\dllcache\f3ahvoas.dll
    + 2004-09-14 21:00:00 7,168 ----a-w C:\WINDOWS\system32\dllcache\f3ahvoas.dll
    + 2004-09-14 21:00:00 36,864 ----a-w C:\WINDOWS\system32\dllcache\hanjadic.dll
    + 2004-09-14 21:00:00 10,096,640 ----a-w C:\WINDOWS\system32\dllcache\hwxcht.dll
    + 2004-09-14 21:00:00 13,463,552 ----a-w C:\WINDOWS\system32\dllcache\hwxjpn.dll
    + 2004-09-14 21:00:00 10,129,408 ----a-w C:\WINDOWS\system32\dllcache\hwxkor.dll
    + 2004-09-14 21:00:00 106,496 ----a-w C:\WINDOWS\system32\dllcache\imekrcic.dll
    + 2004-09-14 21:00:00 86,016 ----a-w C:\WINDOWS\system32\dllcache\imekrmbx.dll
    + 2004-09-14 21:00:00 44,032 ----a-w C:\WINDOWS\system32\dllcache\imekrmig.exe
    + 2004-09-14 21:00:00 102,463 ----a-w C:\WINDOWS\system32\dllcache\imepadsm.dll
    + 2004-09-14 21:00:00 311,359 ----a-w C:\WINDOWS\system32\dllcache\imepadsv.exe
    + 2004-09-14 21:00:00 811,064 ----a-w C:\WINDOWS\system32\dllcache\imjp81k.dll
    + 2004-09-14 21:00:00 368,696 ----a-w C:\WINDOWS\system32\dllcache\imjpcic.dll
    + 2004-09-14 21:00:00 716,856 ----a-w C:\WINDOWS\system32\dllcache\imjpcus.dll
    + 2004-09-14 21:00:00 57,398 ----a-w C:\WINDOWS\system32\dllcache\imjpdadm.exe
    + 2004-09-14 21:00:00 81,976 ----a-w C:\WINDOWS\system32\dllcache\imjpdct.dll
    + 2004-09-14 21:00:00 307,257 ----a-w C:\WINDOWS\system32\dllcache\imjpdct.exe
    + 2004-09-14 21:00:00 155,705 ----a-w C:\WINDOWS\system32\dllcache\imjpdsvr.exe
    + 2004-09-14 21:00:00 196,665 ----a-w C:\WINDOWS\system32\dllcache\imjpinst.exe
    + 2004-09-14 21:00:00 208,952 ----a-w C:\WINDOWS\system32\dllcache\imjpmig.exe
    + 2004-09-14 21:00:00 233,527 ----a-w C:\WINDOWS\system32\dllcache\imjprw.exe
    + 2004-09-14 21:00:00 45,109 ----a-w C:\WINDOWS\system32\dllcache\imjpuex.exe
    + 2004-09-14 21:00:00 262,200 ----a-w C:\WINDOWS\system32\dllcache\imjputy.exe
    + 2004-09-14 21:00:00 274,489 ----a-w C:\WINDOWS\system32\dllcache\imjputyc.dll
    + 2004-09-14 21:00:00 59,904 ----a-w C:\WINDOWS\system32\dllcache\imkrinst.exe
    + 2004-09-14 21:00:00 102,456 ----a-w C:\WINDOWS\system32\dllcache\imlang.dll
    + 2004-09-14 21:00:00 59,392 ----a-w C:\WINDOWS\system32\dllcache\imscinst.exe
    + 2004-09-14 21:00:00 471,102 ----a-w C:\WINDOWS\system32\dllcache\imskdic.dll
    + 2004-09-14 21:00:00 315,452 ----a-w C:\WINDOWS\system32\dllcache\imskf.dll
    - 2004-09-15 04:00:00 6,144 -c--a-w C:\WINDOWS\system32\dllcache\kbd101.dll
    + 2004-09-14 21:00:00 6,144 ----a-w C:\WINDOWS\system32\dllcache\kbd101.dll
    - 2004-09-15 04:00:00 6,144 -c--a-w C:\WINDOWS\system32\dllcache\kbd101a.dll
    + 2004-09-14 21:00:00 6,144 ----a-w C:\WINDOWS\system32\dllcache\kbd101a.dll
    + 2001-08-17 19:55:56 6,144 ----a-w C:\WINDOWS\system32\dllcache\kbd101b.dll
    + 2001-08-17 19:55:56 6,144 ----a-w C:\WINDOWS\system32\dllcache\kbd101c.dll
    + 2001-08-17 19:55:56 5,632 ----a-w C:\WINDOWS\system32\dllcache\kbd103.dll
    + 2001-08-17 19:55:56 6,144 ----a-w C:\WINDOWS\system32\dllcache\kbd106.dll
    - 2004-09-15 04:00:00 6,144 -c--a-w C:\WINDOWS\system32\dllcache\kbd106n.dll
    + 2004-09-14 21:00:00 6,144 ----a-w C:\WINDOWS\system32\dllcache\kbd106n.dll
    - 2004-09-15 04:00:00 6,144 -c--a-w C:\WINDOWS\system32\dllcache\kbdax2.dll
    + 2004-09-14 21:00:00 6,144 ----a-w C:\WINDOWS\system32\dllcache\kbdax2.dll
    - 2004-09-15 04:00:00 7,168 -c--a-w C:\WINDOWS\system32\dllcache\kbdibm02.dll
    + 2004-09-14 21:00:00 7,168 ----a-w C:\WINDOWS\system32\dllcache\kbdibm02.dll
    + 2001-08-18 03:36:18 8,704 ----a-w C:\WINDOWS\system32\dllcache\kbdjpn.dll
    + 2001-08-18 03:36:18 8,192 ----a-w C:\WINDOWS\system32\dllcache\kbdkor.dll
    - 2004-09-15 04:00:00 6,656 -c--a-w C:\WINDOWS\system32\dllcache\kbdlk41a.dll
    + 2004-09-14 21:00:00 6,656 ----a-w C:\WINDOWS\system32\dllcache\kbdlk41a.dll
    - 2004-09-15 04:00:00 6,144 -c--a-w C:\WINDOWS\system32\dllcache\kbdlk41j.dll
    + 2004-09-14 21:00:00 6,144 ----a-w C:\WINDOWS\system32\dllcache\kbdlk41j.dll
    - 2004-09-15 11:00:00 7,168 -c--a-w C:\WINDOWS\system32\dllcache\kbdnec.dll
    + 2004-09-14 21:00:00 7,168 ----a-w C:\WINDOWS\system32\dllcache\kbdnec.dll
    - 2004-09-15 04:00:00 7,168 -c--a-w C:\WINDOWS\system32\dllcache\kbdnec95.dll
    + 2004-09-14 21:00:00 7,168 ----a-w C:\WINDOWS\system32\dllcache\kbdnec95.dll
    - 2004-09-15 04:00:00 9,216 -c--a-w C:\WINDOWS\system32\dllcache\kbdnecat.dll
    + 2004-09-14 21:00:00 9,216 ----a-w C:\WINDOWS\system32\dllcache\kbdnecat.dll
    - 2004-09-15 04:00:00 7,680 -c--a-w C:\WINDOWS\system32\dllcache\kbdnecnt.dll
    + 2004-09-14 21:00:00 7,680 ----a-w C:\WINDOWS\system32\dllcache\kbdnecnt.dll
    + 2004-09-15 04:00:00 2,000 -c--a-w C:\WINDOWS\system32\dllcache\keyboard.drv
    + 2004-09-14 21:00:00 70,656 ----a-w C:\WINDOWS\system32\dllcache\korwbrkr.dll
    + 2004-09-15 04:00:00 2,560 -c--a-w C:\WINDOWS\system32\dllcache\lz32.dll
    + 2004-09-15 04:00:00 2,032 -c--a-w C:\WINDOWS\system32\dllcache\mouse.drv
    + 2004-09-14 21:00:00 98,304 ----a-w C:\WINDOWS\system32\dllcache\msir3jp.dll
    + 2004-09-14 21:00:00 229,439 ----a-w C:\WINDOWS\system32\dllcache\multibox.dll
    + 2004-09-15 04:00:00 2,944 -c--a-w C:\WINDOWS\system32\dllcache\null.sys
    + 2004-09-14 21:00:00 15,872 ----a-w C:\WINDOWS\system32\dllcache\padrs404.dll
    + 2004-09-14 21:00:00 36,927 ----a-w C:\WINDOWS\system32\dllcache\padrs411.dll
    + 2004-09-14 21:00:00 14,336 ----a-w C:\WINDOWS\system32\dllcache\padrs412.dll
    + 2004-09-14 21:00:00 15,360 ----a-w C:\WINDOWS\system32\dllcache\padrs804.dll
    + 2004-09-14 21:00:00 175,104 ----a-w C:\WINDOWS\system32\dllcache\pintlcsa.dll
    + 2004-09-14 21:00:00 53,760 ----a-w C:\WINDOWS\system32\dllcache\pintlcsd.dll
    + 2004-09-14 21:00:00 70,144 ----a-w C:\WINDOWS\system32\dllcache\pintlphr.exe
    + 2004-09-14 21:00:00 67,584 ----a-w C:\WINDOWS\system32\dllcache\pmigrate.dll
    + 2004-09-14 21:00:00 143,422 ----a-w C:\WINDOWS\system32\dllcache\softkey.dll
    + 2004-09-15 04:00:00 1,744 -c--a-w C:\WINDOWS\system32\dllcache\sound.drv
    + 2004-09-14 21:00:00 44,032 ----a-w C:\WINDOWS\system32\dllcache\tintlphr.exe
    + 2004-09-14 21:00:00 455,168 ----a-w C:\WINDOWS\system32\dllcache\tintsetp.exe
    + 2004-09-14 21:00:00 10,240 ----a-w C:\WINDOWS\system32\dllcache\tmigrate.dll
    + 2004-09-14 21:00:00 76,288 ----a-w C:\WINDOWS\system32\dllcache\uniime.dll
    + 2004-09-15 04:00:00 2,176 -c--a-w C:\WINDOWS\system32\dllcache\vga.drv
    + 2004-09-15 04:00:00 2,864 -c--a-w C:\WINDOWS\system32\dllcache\winsock.dll
    + 2004-09-15 04:00:00 2,112 -c--a-w C:\WINDOWS\system32\dllcache\winspool.exe
    + 2004-09-14 21:00:00 426,041 ----a-w C:\WINDOWS\system32\dllcache\voicepad.dll
    + 2004-09-14 21:00:00 86,073 ----a-w C:\WINDOWS\system32\dllcache\voicesub.dll
    + 2004-09-15 04:00:00 2,736 -c--a-w C:\WINDOWS\system32\dllcache\wowdeb.exe
    + 2006-08-25 03:47:00 2,432 -c----w C:\WINDOWS\system32\drivers\cdr4_xp.sys
    + 2006-08-25 03:47:00 2,560 ------w C:\WINDOWS\system32\drivers\cdralw2k.sys
    + 2004-08-04 04:07:58 2,944 ----a-w C:\WINDOWS\system32\drivers\drmkaud.sys
    + 2004-09-15 04:00:00 2,944 ----a-w C:\WINDOWS\system32\drivers\null.sys
    + 2004-09-14 21:00:00 7,168 ----a-w C:\WINDOWS\system32\f3ahvoas.dll
    - 2008-04-10 09:08:55 175,464 ----a-w C:\WINDOWS\system32\FNTCACHE.DAT
    + 2008-04-26 20:12:40 181,040 ----a-w C:\WINDOWS\system32\FNTCACHE.DAT
    + 2004-09-14 21:00:00 198,656 ----a-w C:\WINDOWS\system32\IME\CINTLGNT\CINTIME.DLL
    + 2004-09-14 21:00:00 480,256 ----a-w C:\WINDOWS\system32\IME\CINTLGNT\CINTSETP.EXE
    + 2004-09-14 21:00:00 59,392 ----a-w C:\WINDOWS\system32\IME\PINTLGNT\IMSCINST.EXE
    + 2004-09-14 21:00:00 70,144 ----a-w C:\WINDOWS\system32\IME\PINTLGNT\PINTLPHR.EXE
    + 2004-09-14 21:00:00 67,584 ----a-w C:\WINDOWS\system32\IME\PINTLGNT\PMIGRATE.DLL
    + 2004-09-14 21:00:00 44,032 ----a-w C:\WINDOWS\system32\IME\TINTLGNT\TINTLPHR.EXE
    + 2004-09-14 21:00:00 455,168 ----a-w C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE
    + 2004-09-14 21:00:00 10,240 ----a-w C:\WINDOWS\system32\IME\TINTLGNT\TMIGRATE.DLL
    + 2004-09-14 21:00:00 6,144 ----a-w C:\WINDOWS\system32\kbd101.dll
    + 2004-09-14 21:00:00 6,144 ----a-w C:\WINDOWS\system32\kbd101a.dll
    + 2001-08-17 19:55:56 6,144 ----a-w C:\WINDOWS\system32\kbd101b.dll
    + 2001-08-17 19:55:56 6,144 ----a-w C:\WINDOWS\system32\kbd101c.dll
    + 2001-08-17 19:55:56 5,632 ----a-w C:\WINDOWS\system32\kbd103.dll
    + 2001-08-17 19:55:56 6,144 ----a-w C:\WINDOWS\system32\kbd106.dll
    + 2004-09-14 21:00:00 6,144 ----a-w C:\WINDOWS\system32\kbd106n.dll
    + 2004-09-14 21:00:00 6,144 ----a-w C:\WINDOWS\system32\kbdax2.dll
    + 2004-09-14 21:00:00 7,168 ----a-w C:\WINDOWS\system32\kbdibm02.dll
    + 2001-08-18 03:36:18 8,704 ----a-w C:\WINDOWS\system32\kbdjpn.dll
    + 2001-08-18 03:36:18 8,192 ----a-w C:\WINDOWS\system32\kbdkor.dll
    + 2004-09-14 21:00:00 6,656 ----a-w C:\WINDOWS\system32\kbdlk41a.dll
    + 2004-09-14 21:00:00 6,144 ----a-w C:\WINDOWS\system32\kbdlk41j.dll
    - 2004-09-15 11:00:00 7,168 ----a-w C:\WINDOWS\system32\kbdnec.dll
    + 2004-09-14 21:00:00 7,168 ----a-w C:\WINDOWS\system32\kbdnec.dll
    + 2004-09-14 21:00:00 7,168 ----a-w C:\WINDOWS\system32\kbdnec95.dll
    + 2004-09-14 21:00:00 9,216 ----a-w C:\WINDOWS\system32\kbdnecAT.dll
    + 2004-09-14 21:00:00 7,680 ----a-w C:\WINDOWS\system32\kbdnecNT.dll
    + 2004-09-15 04:00:00 2,000 ----a-w C:\WINDOWS\system32\keyboard.drv
    + 2004-09-14 21:00:00 70,656 ----a-w C:\WINDOWS\system32\korwbrkr.dll
    + 2004-09-15 04:00:00 2,560 ----a-w C:\WINDOWS\system32\lz32.dll
    + 2004-09-15 04:00:00 2,032 ----a-w C:\WINDOWS\system32\mouse.drv
    + 2004-09-14 21:00:00 98,304 ----a-w C:\WINDOWS\system32\msir3jp.dll
    + 2005-10-17 23:06:18 1,972 -c--a-w C:\WINDOWS\system32\pcintro\security.cmd
    + 2004-09-15 04:00:00 1,744 ----a-w C:\WINDOWS\system32\sound.drv
    + 2003-03-17 20:27:44 57,344 ----a-w C:\WINDOWS\system32\ThreadMaster\ThreadMast.exe
    + 2004-09-14 21:00:00 76,288 ----a-w C:\WINDOWS\system32\uniime.dll
    + 2004-09-15 04:00:00 2,176 ----a-w C:\WINDOWS\system32\vga.drv
    + 2004-09-15 04:00:00 2,864 ----a-w C:\WINDOWS\system32\winsock.dll
    + 2004-09-15 04:00:00 2,112 ----a-w C:\WINDOWS\system32\winspool.exe
    + 2006-10-18 09:32:38 807,032 ----a-w C:\WINDOWS\system32\wmv9dmod.dll
    + 2004-09-15 04:00:00 2,736 ----a-w C:\WINDOWS\system32\wowdeb.exe
    + 2006-08-05 19:10:33 2,829 -c--a-w C:\WINDOWS\War3Unin.pif
    .
    -- Snapshot reset to current date --
    .
    (((((((((((((((((((((((((((((( Rekisterin käynnistyskohteet )))))))))))))))))))))))))))))))))))))))))))))
    .
    .
    REGEDIT4
    *Huom* Tyhjiä arvoja ja laillisia oletusarvoja ei näytetä

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "ccApp"="C:\Program Files\Common Files\Symantec Shared\ccApp.exe" [2007-01-10 00:59 115816]
    "LVCOMSX"="C:\WINDOWS\system32\LVCOMSX.EXE" [2005-07-19 18:32 221184]
    "Recguard"="C:\WINDOWS\SMINST\RECGUARD.EXE" [2005-07-22 23:14 237568]
    "Symantec PIF AlertEng"="C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe" [2008-01-29 18:38 583048]
    "SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe" [2008-02-22 04:25 144784]
    "!AVG Anti-Spyware"="C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" [2007-06-11 12:25 6731312]

    [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
    "Picasa Media Detector"="C:\Program Files\Picasa2\PicasaMediaDetector.exe" [2007-10-24 00:18 443968]
    "Nokia.PCSync"="C:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe" [2007-11-07 18:35 1294336]

    C:\Documents and Settings\All Users\K„ynnist„-valikko\Ohjelmat\K„ynnistys\
    HP Digital Imaging Monitor.lnk - C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe [2006-02-19 05:21:22 288472]

    [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run-]
    "ctfmon.exe"=C:\WINDOWS\system32\ctfmon.exe
    "PC Suite Tray"="C:\Program Files\Nokia\Nokia PC Suite 6\PCSuite.exe" -onlytray
    "LogitechSoftwareUpdate"="C:\Program Files\Logitech\Video\ManifestEngine.exe" boot
    "LDM"=C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BackWeb-8876480.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-]
    "TkBellExe"="C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
    "DAEMON Tools"="C:\Program Files\DAEMON Tools\daemon.exe" -lang 1033
    "QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" -atboottime
    "WinampAgent"="C:\Program Files\Winamp\winampa.exe"
    "Reminder"="C:\Windows\Creator\Remind_XP.exe"
    "HPHUPD08"=c:\Program Files\HP\Digital Imaging\{33D6CC28-9F75-4d1b-A11D-98895B3A3729}\hphupd08.exe
    "HP Software Update"=C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
    "NeroCheck"=C:\WINDOWS\system32\NeroCheck.exe
    "SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe"
    "HPBootOp"="C:\Program Files\Hewlett-Packard\HP Boot Optimizer\HPBootOp.exe" /run
    "UnlockerAssistant"="C:\Program Files\Unlocker\UnlockerAssistant.exe"
    "LogitechVideoTray"=C:\Program Files\Logitech\Video\LogiTray.exe
    "HydraVisionDesktopManager"=C:\Program Files\ATI Technologies\ATI HYDRAVISION\HydraDM.exe
    "Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
    "Symantec PIF AlertEng"="C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe" /a /m "C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\AlertEng.dll"

    [HKEY_LOCAL_MACHINE\software\microsoft\security center]
    "AntiVirusDisableNotify"=dword:00000001

    [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]
    "DisableMonitoring"=dword:00000001

    [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
    "DisableMonitoring"=dword:00000001

    [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
    "DisableMonitoring"=dword:00000001

    [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
    "EnableFirewall"= 0 (0x0)

    [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
    "%windir%\\system32\\sessmgr.exe"=
    "C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqtra08.exe"=
    "C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqste08.exe"=
    "C:\\Program Files\\HP\\Digital Imaging\\bin\\hpofxm08.exe"=
    "C:\\Program Files\\HP\\Digital Imaging\\bin\\hposfx08.exe"=
    "C:\\Program Files\\HP\\Digital Imaging\\bin\\hposid01.exe"=
    "C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqscnvw.exe"=
    "C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqkygrp.exe"=
    "C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqCopy.exe"=
    "C:\\Program Files\\HP\\Digital Imaging\\bin\\hpfccopy.exe"=
    "C:\\Program Files\\HP\\Digital Imaging\\bin\\hpzwiz01.exe"=
    "C:\\Program Files\\HP\\Digital Imaging\\Unload\\HpqPhUnl.exe"=
    "C:\\Program Files\\HP\\Digital Imaging\\Unload\\HpqDIA.exe"=
    "C:\\Program Files\\HP\\Digital Imaging\\bin\\hpoews01.exe"=
    "C:\\Program Files\\Mozilla Firefox\\firefox.exe"=
    "C:\\Program Files\\iTunes\\iTunes.exe"=
    "C:\\Program Files\\mIRC\\mirc.exe"=
    "%windir%\\Network Diagnostic\\xpnetdiag.exe"=
    "C:\\Program Files\\MSN Messenger\\msnmsgr.exe"=
    "C:\\Program Files\\MSN Messenger\\livecall.exe"=
    "C:\\Program Files\\Messenger\\msmsgs.exe"=
    "C:\\Program Files\\Skype\\Phone\\Skype.exe"=

    R2 Automaattinen LiveUpdate-ajastustoiminto;Automaattinen LiveUpdate-ajastustoiminto;"C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe" [2007-09-26 12:53]
    R2 ThreadMaster;Thread Master;C:\WINDOWS\system32\ThreadMaster\ThreadMast.exe [2003-03-17 23:27]
    S2 Automattinen LiveUpdate-ajastustoiminto;Automattinen LiveUpdate-ajastustoiminto;"C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe" [2007-09-26 12:53]

    *Newly Created Service* - COMHOST
    .
    'Ajoitetut tehtävät'-kansion sisältö
    "2008-04-29 17:00:00 C:\WINDOWS\Tasks\1-Click Maintenance.job"
    - C:\Program Files\TuneUp Utilities 2008\OneClickStarter.exe
    .
    **************************************************************************

    catchme 0.3.1353 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
    Rootkit scan 2008-04-29 20:28:26
    Windows 5.1.2600 Service Pack 2 NTFS

    scanning hidden processes ...

    scanning hidden autostart entries ...

    scanning hidden files ...


    **************************************************************************
    .
    Completion time: 2008-04-29 20:31:12
    ComboFix-quarantined-files.txt 2008-04-29 17:30:09
    ComboFix2.txt 2008-04-11 10:45:01
    ComboFix3.txt 2008-04-11 10:34:46
    ComboFix4.txt 2008-04-05 22:37:11

    Pre-Run: 24,843,829,248 tavua vapaana
    Post-Run: 24,864,927,744 tavua vapaana

    415 --- E O F --- 2008-04-26 21:52:55


    ======================================================================
    ======================================================================



    SDFix: Version 1.177
    Run by HP_Omistaja on ti 29.04.2008 at 20:45

    Microsoft Windows XP [versio 5.1.2600]
    Running From: C:\DOCUME~1\HP_OMI~1\TYPYT~1\SDFix

    Checking Services :


    Restoring Windows Registry Values
    Restoring Windows Default Hosts File

    Rebooting


    Checking Files :

    No Trojan Files Found






    Removing Temp Files

    ADS Check :



    Final Check :

    catchme 0.3.1353.2 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
    Rootkit scan 2008-04-29 20:57:48
    Windows 5.1.2600 Service Pack 2 NTFS

    scanning hidden processes ...

    scanning hidden services & system hive ...

    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg]
    "s0"=dword:b44b7492
    "s1"=dword:67c5c2ca
    "s2"=dword:12475a13
    "h0"=dword:00000001

    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4]
    "p0"="C:\Program Files\DAEMON Tools\"
    "h0"=dword:00000000
    "khjeh"=hex:43,5d,c9,37,ef,90,2f,dc,46,aa,72,8c,9b,e4,89,c5,ee,25,bf,14,6f,..

    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001]
    "a0"=hex:20,01,00,00,c2,c3,48,c8,eb,56,61,08,86,e9,f1,00,e2,57,fe,65,74,..
    "khjeh"=hex:a0,57,e8,bd,5c,a7,8a,4a,36,85,1e,43,6e,08,06,7c,8f,93,2d,85,4f,..

    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40]
    "khjeh"=hex:a5,92,a3,e4,f3,ba,bb,36,9e,93,f1,f1,a7,af,35,23,f2,74,ec,69,94,..
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4]
    "p0"="C:\Program Files\DAEMON Tools\"
    "h0"=dword:00000000
    "khjeh"=hex:43,5d,c9,37,ef,90,2f,dc,46,aa,72,8c,9b,e4,89,c5,ee,25,bf,14,6f,..

    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001]
    "a0"=hex:20,01,00,00,c2,c3,48,c8,eb,56,61,08,86,e9,f1,00,e2,57,fe,65,74,..
    "khjeh"=hex:a0,57,e8,bd,5c,a7,8a,4a,36,85,1e,43,6e,08,06,7c,8f,93,2d,85,4f,..

    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40]
    "khjeh"=hex:a5,92,a3,e4,f3,ba,bb,36,9e,93,f1,f1,a7,af,35,23,f2,74,ec,69,94,..

    scanning hidden registry entries ...

    scanning hidden files ...


    scan completed successfully
    hidden processes: 0
    hidden services: 0
    hidden files: 7


    Remaining Services :




    Authorized Application Key Export:

    [HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
    "%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:mad:xpsp2res.dll,-22019"
    "C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqtra08.exe"="C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqtra08.exe:*:Enabled:hpqtra08.exe"
    "C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqste08.exe"="C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqste08.exe:*:Enabled:hpqste08.exe"
    "C:\\Program Files\\HP\\Digital Imaging\\bin\\hpofxm08.exe"="C:\\Program Files\\HP\\Digital Imaging\\bin\\hpofxm08.exe:*:Enabled:hpofxm08.exe"
    "C:\\Program Files\\HP\\Digital Imaging\\bin\\hposfx08.exe"="C:\\Program Files\\HP\\Digital Imaging\\bin\\hposfx08.exe:*:Enabled:hposfx08.exe"
    "C:\\Program Files\\HP\\Digital Imaging\\bin\\hposid01.exe"="C:\\Program Files\\HP\\Digital Imaging\\bin\\hposid01.exe:*:Enabled:hposid01.exe"
    "C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqscnvw.exe"="C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqscnvw.exe:*:Enabled:hpqscnvw.exe"
    "C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqkygrp.exe"="C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqkygrp.exe:*:Enabled:hpqkygrp.exe"
    "C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqCopy.exe"="C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqCopy.exe:*:Enabled:hpqcopy.exe"
    "C:\\Program Files\\HP\\Digital Imaging\\bin\\hpfccopy.exe"="C:\\Program Files\\HP\\Digital Imaging\\bin\\hpfccopy.exe:*:Enabled:hpfccopy.exe"
    "C:\\Program Files\\HP\\Digital Imaging\\bin\\hpzwiz01.exe"="C:\\Program Files\\HP\\Digital Imaging\\bin\\hpzwiz01.exe:*:Enabled:hpzwiz01.exe"
    "C:\\Program Files\\HP\\Digital Imaging\\Unload\\HpqPhUnl.exe"="C:\\Program Files\\HP\\Digital Imaging\\Unload\\HpqPhUnl.exe:*:Enabled:hpqphunl.exe"
    "C:\\Program Files\\HP\\Digital Imaging\\Unload\\HpqDIA.exe"="C:\\Program Files\\HP\\Digital Imaging\\Unload\\HpqDIA.exe:*:Enabled:hpqdia.exe"
    "C:\\Program Files\\HP\\Digital Imaging\\bin\\hpoews01.exe"="C:\\Program Files\\HP\\Digital Imaging\\bin\\hpoews01.exe:*:Enabled:hpoews01.exe"
    "C:\\Program Files\\Mozilla Firefox\\firefox.exe"="C:\\Program Files\\Mozilla Firefox\\firefox.exe:*:Enabled:Firefox"
    "C:\\Program Files\\iTunes\\iTunes.exe"="C:\\Program Files\\iTunes\\iTunes.exe:*:Enabled:iTunes"
    "C:\\Program Files\\mIRC\\mirc.exe"="C:\\Program Files\\mIRC\\mirc.exe:*:Enabled:mIRC"
    "%windir%\\Network Diagnostic\\xpnetdiag.exe"="%windir%\\Network Diagnostic\\xpnetdiag.exe:*:Enabled:mad:xpsp3res.dll,-20000"
    "C:\\Program Files\\MSN Messenger\\msnmsgr.exe"="C:\\Program Files\\MSN Messenger\\msnmsgr.exe:*:Enabled:Windows Live Messenger 8.1"
    "C:\\Program Files\\MSN Messenger\\livecall.exe"="C:\\Program Files\\MSN Messenger\\livecall.exe:*:Enabled:Windows Live Messenger 8.1 (Phone)"
    "C:\\Program Files\\Messenger\\msmsgs.exe"="C:\\Program Files\\Messenger\\msmsgs.exe:*:Enabled:Windows Messenger"
    "C:\\Program Files\\Skype\\Phone\\Skype.exe"="C:\\Program Files\\Skype\\Phone\\Skype.exe:*:Enabled:Skype"

    [HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
    "%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:mad:xpsp2res.dll,-22019"
    "C:\\Program Files\\MSN Messenger\\msncall.exe"="C:\\Program Files\\MSN Messenger\\msncall.exe:*:Enabled:Windows Live Messenger 8.0 (Phone)"
    "%windir%\\Network Diagnostic\\xpnetdiag.exe"="%windir%\\Network Diagnostic\\xpnetdiag.exe:*:Enabled:mad:xpsp3res.dll,-20000"
    "C:\\Program Files\\MSN Messenger\\msnmsgr.exe"="C:\\Program Files\\MSN Messenger\\msnmsgr.exe:*:Enabled:Windows Live Messenger 8.1"
    "C:\\Program Files\\MSN Messenger\\livecall.exe"="C:\\Program Files\\MSN Messenger\\livecall.exe:*:Enabled:Windows Live Messenger 8.1 (Phone)"

    Remaining Files :


    File Backups: - C:\DOCUME~1\HP_OMI~1\TYPYT~1\SDFix\backups\backups.zip

    Files with Hidden Attributes :

    Fri 22 Jul 2005 32,768 A..H. --- "C:\Program Files\AMV Converter\AmvTransform.dll"
    Mon 6 Mar 2006 77,824 A..H. --- "C:\Program Files\AMV Converter\AMV_EncDLL.dll"
    Tue 27 Dec 2005 40,960 A..H. --- "C:\Program Files\AMV Converter\net.dll"
    Wed 8 Mar 2006 106,496 A..H. --- "C:\Program Files\AMV Converter\transdll.dll"
    Wed 14 Nov 2007 6,219,320 A..H. --- "C:\Program Files\Picasa2\setup.exe"
    Tue 6 Jan 2004 188,416 A..H. --- "C:\Program Files\Rockstar Games\GTA San Andreas\eax.dll"
    Fri 3 Feb 2006 15,806,464 A..H. --- "C:\Program Files\Rockstar Games\GTA San Andreas\gta_sa.exe"
    Sat 15 Nov 2003 36,864 A..H. --- "C:\Program Files\Rockstar Games\GTA San Andreas\ogg.dll"
    Sun 16 Nov 2003 1,060,864 A..H. --- "C:\Program Files\Rockstar Games\GTA San Andreas\vorbis.dll"
    Sun 16 Nov 2003 65,536 A..H. --- "C:\Program Files\Rockstar Games\GTA San Andreas\vorbisFile.dll"
    Thu 20 Mar 2008 444 ...HR --- "C:\Documents and Settings\HP_Omistaja\Application Data\SecuROM\UserData\securom_v7_01.bak"

    Finished!


    ======================================================================
    ======================================================================


    Logfile of Trend Micro HijackThis v2.0.2
    Scan saved at 21:29:36, on 29.4.2008
    Platform: Windows XP SP2 (WinNT 5.01.2600)
    MSIE: Internet Explorer v7.00 (7.00.6000.16640)
    Boot mode: Normal

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\Ati2evxx.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\system32\Ati2evxx.exe
    C:\WINDOWS\Explorer.EXE
    C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
    C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
    C:\WINDOWS\system32\spoolsv.exe
    C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
    C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
    C:\Program Files\Bluetooth\Bluetooth-ohjelmisto\bin\btwdins.exe
    C:\WINDOWS\system32\HPZipm12.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\system32\ThreadMaster\ThreadMast.exe
    C:\Program Files\Common Files\Symantec Shared\ccApp.exe
    C:\WINDOWS\system32\LVCOMSX.EXE
    C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe
    C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe
    C:\WINDOWS\system32\NOTEPAD.EXE
    C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
    C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
    C:\Program Files\HP\Digital Imaging\bin\hpqSTE08.exe
    C:\WINDOWS\system32\NOTEPAD.EXE
    C:\WINDOWS\system32\NOTEPAD.EXE
    C:\WINDOWS\system32\NOTEPAD.EXE
    C:\Program Files\Mozilla Firefox\firefox.exe
    C:\Program Files\HJ\Skanneri.exe.exe

    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://finnish.toggle.com/index.php?rvs=hompag
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
    R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = localhost
    R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Linkit
    O2 - BHO: Adobe PDF Reader -linkkiavustaja - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
    O2 - BHO: (no name) - {1E8A6170-7264-4D0F-BEAE-D42A53123C75} - C:\Program Files\Common Files\Symantec Shared\coShared\Browser\1.5\NppBho.dll
    O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
    O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
    O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
    O4 - HKLM\..\Run: [LVCOMSX] C:\WINDOWS\system32\LVCOMSX.EXE
    O4 - HKLM\..\Run: [Recguard] C:\WINDOWS\SMINST\RECGUARD.EXE
    O4 - HKLM\..\Run: [Symantec PIF AlertEng] "C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe" /a /m "C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\AlertEng.dll"
    O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe"
    O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
    O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Paikallinen palve')
    O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Verkkopalve')
    O4 - HKUS\S-1-5-18\..\Run: [Picasa Media Detector] C:\Program Files\Picasa2\PicasaMediaDetector.exe (User 'SYSTEM')
    O4 - HKUS\.DEFAULT\..\Run: [Picasa Media Detector] C:\Program Files\Picasa2\PicasaMediaDetector.exe (User 'Default user')
    O4 - .DEFAULT User Startup: Pin.lnk = C:\hp\bin\CLOAKER.EXE (User 'Default user')
    O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
    O8 - Extra context menu item: Lähetä &Bluetooth-laitteeseen - C:\Program Files\Bluetooth\Bluetooth-ohjelmisto\btsendto_ie_ctx.htm
    O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
    O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
    O9 - Extra button: @btrez.dll,-4015 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\Bluetooth\Bluetooth-ohjelmisto\btsendto_ie.htm
    O9 - Extra 'Tools' menuitem: @btrez.dll,-4017 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\Bluetooth\Bluetooth-ohjelmisto\btsendto_ie.htm
    O9 - Extra button: Yhteysohje - {E2D4D26B-0180-43a4-B05F-462D6D54C789} - C:\WINDOWS\PCHEALTH\HELPCTR\Vendors\CN=Hewlett-Packard,L=Cupertino,S=Ca,C=US\IEButton\support.htm
    O9 - Extra 'Tools' menuitem: Yhteysohje - {E2D4D26B-0180-43a4-B05F-462D6D54C789} - C:\WINDOWS\PCHEALTH\HELPCTR\Vendors\CN=Hewlett-Packard,L=Cupertino,S=Ca,C=US\IEButton\support.htm
    O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
    O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O16 - DPF: {C4847596-972C-11D0-9567-00A0C9273C2A} (Crystal Report Viewer Control) - http://jasenpalvelut.hammasll.fi/viewer/activeXViewer/activexviewer.cab
    O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
    O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
    O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
    O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
    O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
    O23 - Service: Automaattinen LiveUpdate-ajastustoiminto - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
    O23 - Service: Automattinen LiveUpdate-ajastustoiminto - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
    O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
    O23 - Service: Bluetooth Service (btwdins) - Broadcom Corporation. - C:\Program Files\Bluetooth\Bluetooth-ohjelmisto\bin\btwdins.exe
    O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
    O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
    O23 - Service: Symantec Lic NetConnect service (CLTNetCnService) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
    O23 - Service: COM Host (comHost) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\VAScanner\comHost.exe
    O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
    O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
    O23 - Service: iPodService - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
    O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
    O23 - Service: LiveUpdate Notice Service Ex (LiveUpdate Notice Ex) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
    O23 - Service: LiveUpdate Notice Service - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe
    O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
    O23 - Service: ServiceLayer - Nokia. - C:\Program Files\PC Connectivity Solution\ServiceLayer.exe
    O23 - Service: Symantec Core LC - Unknown owner - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
    O23 - Service: Thread Master (ThreadMaster) - http://threadmaster.tripod.com - threadmaster@europe.com - C:\WINDOWS\system32\ThreadMaster\ThreadMast.exe

    --
    End of file - 8659 bytes
     
    Gybetius, Apr 29, 2008
    #3
  4. Hujo

    Hujo Guest

    Hujo, Apr 30, 2008
    #4
  5. Gybetius

    Gybetius Member

    Joined:
    Mar 31, 2008
    Messages:
    19
    Likes Received:
    0
    Trophy Points:
    11
    Virus Log Information

    File C:\Documents and Settings\HP_Omistaja\.housecall6.6\Quarantine\css4[1].bac_a01636 infected by "Packed.Win32.Monder.gen" Virus. Action Taken: File Renamed.
    File C:\Documents and Settings\HP_Omistaja\.housecall6.6\Quarantine\ddccy.dll.bac_a02620 tagged as not-a-virus:AdWare.Win32.Virtumonde.lrz. No Action Taken.
    File C:\Documents and Settings\HP_Omistaja\.housecall6.6\Quarantine\fonfnjrh.dll.bac_a01636 infected by "Packed.Win32.Monder.gen" Virus. Action Taken: File Renamed.
    File C:\Documents and Settings\HP_Omistaja\.housecall6.6\Quarantine\fxrnjihy.dll.bac_a01636 infected by "Packed.Win32.Monder.gen" Virus. Action Taken: File Renamed.
    File C:\Documents and Settings\HP_Omistaja\.housecall6.6\Quarantine\fymdclew.dll.bad.bac_a02620 infected by "Packed.Win32.Monder.gen" Virus. Action Taken: File Renamed.
    File C:\Documents and Settings\HP_Omistaja\.housecall6.6\Quarantine\idvocmaw.dll.bac_a02620 infected by "Packed.Win32.Monder.gen" Virus. Action Taken: File Renamed.
    File C:\Documents and Settings\HP_Omistaja\.housecall6.6\Quarantine\ikiyjsbe.dll.bad.bac_a02620 infected by "Packed.Win32.Monder.gen" Virus. Action Taken: File Renamed.
    File C:\Documents and Settings\HP_Omistaja\.housecall6.6\Quarantine\jccocjbr.dll.bac_a02620 tagged as not-a-virus:AdWare.Win32.Virtumonde.lwv. No Action Taken.
    File C:\Documents and Settings\HP_Omistaja\.housecall6.6\Quarantine\khfcyyx.dll.bac_a01636 tagged as not-a-virus:AdWare.Win32.Virtumonde.ksn. No Action Taken.
    File C:\Documents and Settings\HP_Omistaja\.housecall6.6\Quarantine\kydfyphn.dll.bac_a01636 infected by "Packed.Win32.Monder.gen" Virus. Action Taken: File Renamed.
    File C:\Documents and Settings\HP_Omistaja\.housecall6.6\Quarantine\mllmk.dll.bac_a01636 infected by "Packed.Win32.Monder.gen" Virus. Action Taken: File Renamed.
    File C:\Documents and Settings\HP_Omistaja\.housecall6.6\Quarantine\oexyrego.dll.bac_a01636 tagged as not-a-virus:AdWare.Win32.Virtumonde.lxl. No Action Taken.
    File C:\Documents and Settings\HP_Omistaja\.housecall6.6\Quarantine\rqrponm.dll.bac_a01636 tagged as not-a-virus:AdWare.Win32.Virtumonde.ksn. No Action Taken.
    File C:\Documents and Settings\HP_Omistaja\.housecall6.6\Quarantine\spvavobp.dll.bac_a01636 infected by "Packed.Win32.Monder.gen" Virus. Action Taken: File Renamed.
    File C:\Documents and Settings\HP_Omistaja\.housecall6.6\Quarantine\sucpljtb.dll.bac_a01636 infected by "Packed.Win32.Monder.gen" Virus. Action Taken: File Renamed.
    File C:\Documents and Settings\HP_Omistaja\.housecall6.6\Quarantine\upgrade[1].cab.bac_a01636 tagged as not-a-virus:AdWare.Win32.OneStep.f. No Action Taken.
    File C:\Documents and Settings\HP_Omistaja\.housecall6.6\Quarantine\wkwonefh.dll.bac_a01636 infected by "Packed.Win32.Monder.gen" Virus. Action Taken: File Renamed.
    File C:\Documents and Settings\HP_Omistaja\Application Data\SecuROM\UserData\???????????p????????? infected by "BkCln.Unknown" Virus. Action Taken: File Renamed.
    File C:\Documents and Settings\HP_Omistaja\Application Data\SecuROM\UserData\???????????p????????? infected by "BkCln.Unknown" Virus. Action Taken: File Renamed.
     
    Gybetius, Apr 30, 2008
    #5
  6. Hujo

    Hujo Guest

    Lataa TÄSTÄ VundoFix.exe työpöydällesi.

    Tupla-klikkaa VundoFix.exe ajaaksesi sen.
    Klikkaa Scan for Vundo valintaa.
    Kun skannaus on valmis, klikkaa Remove Vundo valintaa.
    Sinulta kysytään haluatko poistaa filut - klikkaa YES.
    Kun olet klikannut yes, työpöytäsi tyhjenee kun se alkaa poistamaan Vundoa.
    Kun se on valmis, fiksi ilmoittaa käynnistäväsi koneesi uudelleen, klikkaa OK.
    Postita C:\vundofix.txt lokin sekä tuoreen HijackThis lokin sisältö.

    Huomaa: Se on mahdollista että VundoFix löysi tiedoston jota se ei pystynyt poistamaan.
    Tässä tilanteessa, VundoFix ajaa itsensä rebootissa, seuraa vain yläpuolelle olevia ohjeita alkaen kohdasta "Klikkaa Scan for Vundo valintaa." kun VundoFix ilmaantuu uudelleenkäynnistyksen yhteydessä.
     
    Hujo, Apr 30, 2008
    #6
  7. Gybetius

    Gybetius Member

    Joined:
    Mar 31, 2008
    Messages:
    19
    Likes Received:
    0
    Trophy Points:
    11

    VundoFix V7.0.3

    Scan started at 16:04:46 30.4.2008

    Listing files found while scanning....

    No infected files were found.


    =========================================================================
    =========================================================================


    Logfile of Trend Micro HijackThis v2.0.2
    Scan saved at 17:00:46, on 30.4.2008
    Platform: Windows XP SP2 (WinNT 5.01.2600)
    MSIE: Internet Explorer v7.00 (7.00.6000.16640)
    Boot mode: Normal

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\Ati2evxx.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\system32\Ati2evxx.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\Explorer.EXE
    C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
    C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
    C:\WINDOWS\system32\spoolsv.exe
    C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
    C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
    C:\Program Files\Bluetooth\Bluetooth-ohjelmisto\bin\btwdins.exe
    C:\WINDOWS\system32\HPZipm12.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\system32\ThreadMaster\ThreadMast.exe
    C:\Program Files\Common Files\Symantec Shared\ccApp.exe
    C:\WINDOWS\system32\LVCOMSX.EXE
    C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe
    C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe
    C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
    C:\Program Files\HP\Digital Imaging\bin\hpqSTE08.exe
    C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
    C:\Kaspersky\mwavscan.com
    C:\Kaspersky\kavss.exe
    C:\Documents and Settings\HP_Omistaja\Työpöytä\VundoFix.exe
    C:\Program Files\Mozilla Firefox\firefox.exe
    C:\Program Files\Logitech\Video\AlbumDB2.exe
    C:\Program Files\Logitech\Video\FxSvr2.exe
    C:\Program Files\HJ\Skanneri.exe.exe

    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://finnish.toggle.com/index.php?rvs=hompag
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
    R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = localhost
    R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Linkit
    O2 - BHO: Adobe PDF Reader -linkkiavustaja - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
    O2 - BHO: (no name) - {1E8A6170-7264-4D0F-BEAE-D42A53123C75} - C:\Program Files\Common Files\Symantec Shared\coShared\Browser\1.5\NppBho.dll
    O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
    O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
    O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
    O4 - HKLM\..\Run: [LVCOMSX] C:\WINDOWS\system32\LVCOMSX.EXE
    O4 - HKLM\..\Run: [Recguard] C:\WINDOWS\SMINST\RECGUARD.EXE
    O4 - HKLM\..\Run: [Symantec PIF AlertEng] "C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe" /a /m "C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\AlertEng.dll"
    O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe"
    O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
    O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Paikallinen palve')
    O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Verkkopalve')
    O4 - HKUS\S-1-5-18\..\Run: [Picasa Media Detector] C:\Program Files\Picasa2\PicasaMediaDetector.exe (User 'SYSTEM')
    O4 - HKUS\.DEFAULT\..\Run: [Picasa Media Detector] C:\Program Files\Picasa2\PicasaMediaDetector.exe (User 'Default user')
    O4 - .DEFAULT User Startup: Pin.lnk = C:\hp\bin\CLOAKER.EXE (User 'Default user')
    O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
    O8 - Extra context menu item: Lähetä &Bluetooth-laitteeseen - C:\Program Files\Bluetooth\Bluetooth-ohjelmisto\btsendto_ie_ctx.htm
    O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
    O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
    O9 - Extra button: @btrez.dll,-4015 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\Bluetooth\Bluetooth-ohjelmisto\btsendto_ie.htm
    O9 - Extra 'Tools' menuitem: @btrez.dll,-4017 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\Bluetooth\Bluetooth-ohjelmisto\btsendto_ie.htm
    O9 - Extra button: Yhteysohje - {E2D4D26B-0180-43a4-B05F-462D6D54C789} - C:\WINDOWS\PCHEALTH\HELPCTR\Vendors\CN=Hewlett-Packard,L=Cupertino,S=Ca,C=US\IEButton\support.htm
    O9 - Extra 'Tools' menuitem: Yhteysohje - {E2D4D26B-0180-43a4-B05F-462D6D54C789} - C:\WINDOWS\PCHEALTH\HELPCTR\Vendors\CN=Hewlett-Packard,L=Cupertino,S=Ca,C=US\IEButton\support.htm
    O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
    O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O16 - DPF: {C4847596-972C-11D0-9567-00A0C9273C2A} (Crystal Report Viewer Control) - http://jasenpalvelut.hammasll.fi/viewer/activeXViewer/activexviewer.cab
    O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
    O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
    O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
    O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
    O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
    O23 - Service: Automaattinen LiveUpdate-ajastustoiminto - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
    O23 - Service: Automattinen LiveUpdate-ajastustoiminto - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
    O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
    O23 - Service: Bluetooth Service (btwdins) - Broadcom Corporation. - C:\Program Files\Bluetooth\Bluetooth-ohjelmisto\bin\btwdins.exe
    O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
    O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
    O23 - Service: Symantec Lic NetConnect service (CLTNetCnService) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
    O23 - Service: COM Host (comHost) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\VAScanner\comHost.exe
    O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
    O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
    O23 - Service: iPodService - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
    O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
    O23 - Service: LiveUpdate Notice Service Ex (LiveUpdate Notice Ex) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
    O23 - Service: LiveUpdate Notice Service - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe
    O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
    O23 - Service: ServiceLayer - Nokia. - C:\Program Files\PC Connectivity Solution\ServiceLayer.exe
    O23 - Service: Symantec Core LC - Unknown owner - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
    O23 - Service: Thread Master (ThreadMaster) - http://threadmaster.tripod.com - threadmaster@europe.com - C:\WINDOWS\system32\ThreadMaster\ThreadMast.exe

    --
    End of file - 8729 bytes
     
    Gybetius, Apr 30, 2008
    #7
  8. Hujo

    Hujo Guest

    Vieläkös nypyttelee..
     
    Hujo, Apr 30, 2008
    #8
  9. Gybetius

    Gybetius Member

    Joined:
    Mar 31, 2008
    Messages:
    19
    Likes Received:
    0
    Trophy Points:
    11
    Joo, mielestäni toimintaan ei ole tullut juurikaan muutoksia. Nytkin esim. tätä viestiä kirjotellessa teksti pureutui foorumille ''pätkimällä''.

    Mikähän tässä sitten voisi olla... jonkun aikaa videon tai netin käynnistymisen jälkeen saattaa toimia moitteettomasti, mutta sitten alkaa tasainen nykiminen. Netti on Soneran 1Mt/512kt. Muutenhan tämän kanssa selviää, mutta videoiden katselu on mahdotonta. Esim. tietokonepelit ja kiekko.tk toimii moitteettomasti mitä ihmettelen eniten. Nykiminen näyttäisi esiintyvän nimenomaan nettisivustojen ja videoiden katselun yhteydessä. En kyllä muista että olisin vastaavaan törmännyt aiemmin. En ehkä osaa antaa siksi myöskään riittävän hyviä tietoja sinulle.
     
    Gybetius, Apr 30, 2008
    #9
  10. Hujo

    Hujo Guest

    Lataa Deckard's System Scanner
    Työpöydällesi.

    Huomioi: Sinulla tulee olla Järjestelmänvalvojan oikeudet ajaaksesi ohjelman.

    [*]Sulje kaikki avoimet ikkunat ja ohjelmat.
    [*]Tupla Klikkaa Dss.exe tiedostoa ajaaksesi ohjelman, seuraa ohjeita.
    [*]Kun Scannaus on valmis 2 textitiedostoa pitäisi avautua, Main.txt ja extra.txt
    [*]Näppäile Kopioi ( CTRL+A -> CTRL + C ) ja liitä ( CTRL + V )
    [*]kopioi ja liitä main.txt ja extra.txt sisältö seuraavaan vastaukseesi.
     
    Hujo, Apr 30, 2008
    #10
  11. Gybetius

    Gybetius Member

    Joined:
    Mar 31, 2008
    Messages:
    19
    Likes Received:
    0
    Trophy Points:
    11
    Deckard's System Scanner v20071014.68
    Run by HP_Omistaja on 2008-04-30 22:57:45
    Computer is in Normal Mode.
    --------------------------------------------------------------------------------

    -- System Restore --------------------------------------------------------------

    Successfully created a Deckard's System Scanner Restore Point.


    -- Last 5 Restore Point(s) --
    105: 2008-04-30 19:57:54 UTC - RP568 - Deckard's System Scanner Restore Point
    104: 2008-04-29 17:25:35 UTC - RP567 - ComboFix created restore point
    103: 2008-04-29 05:47:16 UTC - RP566 - Asennettu Opera 9.27
    102: 2008-04-28 19:49:15 UTC - RP565 - Järjestelmän tarkistuspiste
    101: 2008-04-26 21:51:43 UTC - RP564 - Software Distribution Service 3.0


    -- First Restore Point --
    1: 2008-04-02 12:11:07 UTC - RP464 - Järjestelmän tarkistuspiste


    Backed up registry hives.
    Performed disk cleanup.



    -- HijackThis (run as HP_Omistaja.exe) -----------------------------------------

    Logfile of Trend Micro HijackThis v2.0.2
    Scan saved at 22:59:37, on 30.4.2008
    Platform: Windows XP SP2 (WinNT 5.01.2600)
    MSIE: Internet Explorer v7.00 (7.00.6000.16640)
    Boot mode: Normal

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\Ati2evxx.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\system32\svchost.exe
    C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
    C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
    C:\WINDOWS\system32\spoolsv.exe
    C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
    C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
    C:\Program Files\Bluetooth\Bluetooth-ohjelmisto\bin\btwdins.exe
    C:\WINDOWS\system32\HPZipm12.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\system32\ThreadMaster\ThreadMast.exe
    C:\WINDOWS\system32\Ati2evxx.exe
    C:\WINDOWS\Explorer.EXE
    C:\Program Files\Common Files\Symantec Shared\ccApp.exe
    C:\WINDOWS\system32\LVCOMSX.EXE
    C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe
    C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe
    C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
    C:\Program Files\HP\Digital Imaging\bin\hpqSTE08.exe
    C:\Documents and Settings\HP_Omistaja\Työpöytä\dss.exe
    C:\PROGRA~1\HJ\HP_Omistaja.exe

    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://finnish.toggle.com/index.php?rvs=hompag
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
    R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = localhost
    R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Linkit
    O2 - BHO: Adobe PDF Reader -linkkiavustaja - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
    O2 - BHO: (no name) - {1E8A6170-7264-4D0F-BEAE-D42A53123C75} - C:\Program Files\Common Files\Symantec Shared\coShared\Browser\1.5\NppBho.dll
    O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
    O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
    O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
    O4 - HKLM\..\Run: [LVCOMSX] C:\WINDOWS\system32\LVCOMSX.EXE
    O4 - HKLM\..\Run: [Recguard] C:\WINDOWS\SMINST\RECGUARD.EXE
    O4 - HKLM\..\Run: [Symantec PIF AlertEng] "C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe" /a /m "C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\AlertEng.dll"
    O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe"
    O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
    O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Paikallinen palve')
    O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Verkkopalve')
    O4 - HKUS\S-1-5-18\..\Run: [Picasa Media Detector] C:\Program Files\Picasa2\PicasaMediaDetector.exe (User 'SYSTEM')
    O4 - HKUS\.DEFAULT\..\Run: [Picasa Media Detector] C:\Program Files\Picasa2\PicasaMediaDetector.exe (User 'Default user')
    O4 - .DEFAULT User Startup: Pin.lnk = C:\hp\bin\CLOAKER.EXE (User 'Default user')
    O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
    O8 - Extra context menu item: Lähetä &Bluetooth-laitteeseen - C:\Program Files\Bluetooth\Bluetooth-ohjelmisto\btsendto_ie_ctx.htm
    O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
    O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
    O9 - Extra button: @btrez.dll,-4015 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\Bluetooth\Bluetooth-ohjelmisto\btsendto_ie.htm
    O9 - Extra 'Tools' menuitem: @btrez.dll,-4017 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\Bluetooth\Bluetooth-ohjelmisto\btsendto_ie.htm
    O9 - Extra button: Yhteysohje - {E2D4D26B-0180-43a4-B05F-462D6D54C789} - C:\WINDOWS\PCHEALTH\HELPCTR\Vendors\CN=Hewlett-Packard,L=Cupertino,S=Ca,C=US\IEButton\support.htm
    O9 - Extra 'Tools' menuitem: Yhteysohje - {E2D4D26B-0180-43a4-B05F-462D6D54C789} - C:\WINDOWS\PCHEALTH\HELPCTR\Vendors\CN=Hewlett-Packard,L=Cupertino,S=Ca,C=US\IEButton\support.htm
    O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
    O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O16 - DPF: {C4847596-972C-11D0-9567-00A0C9273C2A} (Crystal Report Viewer Control) - http://jasenpalvelut.hammasll.fi/viewer/activeXViewer/activexviewer.cab
    O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
    O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
    O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
    O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
    O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
    O23 - Service: Automaattinen LiveUpdate-ajastustoiminto - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
    O23 - Service: Automattinen LiveUpdate-ajastustoiminto - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
    O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
    O23 - Service: Bluetooth Service (btwdins) - Broadcom Corporation. - C:\Program Files\Bluetooth\Bluetooth-ohjelmisto\bin\btwdins.exe
    O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
    O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
    O23 - Service: Symantec Lic NetConnect service (CLTNetCnService) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
    O23 - Service: COM Host (comHost) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\VAScanner\comHost.exe
    O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
    O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
    O23 - Service: iPodService - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
    O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
    O23 - Service: LiveUpdate Notice Service Ex (LiveUpdate Notice Ex) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
    O23 - Service: LiveUpdate Notice Service - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe
    O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
    O23 - Service: ServiceLayer - Nokia. - C:\Program Files\PC Connectivity Solution\ServiceLayer.exe
    O23 - Service: Symantec Core LC - Unknown owner - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
    O23 - Service: Thread Master (ThreadMaster) - http://threadmaster.tripod.com - threadmaster@europe.com - C:\WINDOWS\system32\ThreadMaster\ThreadMast.exe

    --
    End of file - 8463 bytes

    -- File Associations -----------------------------------------------------------

    All associations okay.


    -- Drivers: 0-Boot, 1-System, 2-Auto, 3-Demand, 4-Disabled ---------------------

    R2 BTSERIAL (Bluetooth Serial Driver) - c:\windows\system32\drivers\btserial.sys <Not Verified; Broadcom Corporation.; Bluetooth Software 4.0.1.2900>
    R2 BTSLBCSP (Bluetooth Port Client Driver) - c:\windows\system32\drivers\btslbcsp.sys <Not Verified; Broadcom Corporation.; Bluetooth Software 4.0.1.2900>

    S1 intelppm (Intel-suoritinohjain) - c:\windows\system32\drivers\intelppm.sys (file missing)
    S3 catchme - c:\docume~1\hp_omi~1\locals~1\temp\catchme.sys (file missing)
    S3 ENTECH - c:\windows\system32\drivers\entech.sys <Not Verified; EnTech Taiwan; PowerStrip>


    -- Services: 0-Boot, 1-System, 2-Auto, 3-Demand, 4-Disabled --------------------

    R2 ThreadMaster (Thread Master) - c:\windows\system32\threadmaster\threadmast.exe <Not Verified; http://threadmaster.tripod.com - threadmaster@europe.com; ThreadMaster>

    S3 ServiceLayer - "c:\program files\pc connectivity solution\servicelayer.exe" <Not Verified; Nokia.; PC Connectivity Solution>


    -- Device Manager: Disabled ----------------------------------------------------

    Class GUID: {EEC5AD98-8080-425F-922A-DABF3DE3F69A}
    Description: Nokia Windows Portable Device Driver
    Device ID: ROOT\WPD\0000
    Manufacturer: Nokia
    Name: Nokia 6270
    PNP Device ID: ROOT\WPD\0000
    Service: WUDFRd

    Class GUID: {EEC5AD98-8080-425F-922A-DABF3DE3F69A}
    Description: Nokia 3500c
    Device ID: ROOT\WPD\0001
    Manufacturer: Nokia
    Name: Nokia 3500c
    PNP Device ID: ROOT\WPD\0001
    Service: WUDFRd


    -- Scheduled Tasks -------------------------------------------------------------

    2008-04-30 22:43:50 498 --a------ C:\WINDOWS\Tasks\1-Click Maintenance.job


    -- Files created between 2008-03-30 and 2008-04-30 -----------------------------

    2008-04-30 22:35:24 0 d-------- C:\Documents and Settings\Järjestelmänvalvoja\Application Data\Talkback
    2008-04-30 22:35:12 0 d-------- C:\Documents and Settings\Järjestelmänvalvoja\Application Data\Mozilla
    2008-04-30 22:32:46 0 d-------- C:\Documents and Settings\Järjestelmänvalvoja\WINDOWS
    2008-04-30 22:32:46 0 d--h----- C:\Documents and Settings\Järjestelmänvalvoja\Verkkoympäristö
    2008-04-30 22:32:46 0 d-------- C:\Documents and Settings\Järjestelmänvalvoja\Työpöytä
    2008-04-30 22:32:46 0 d--h----- C:\Documents and Settings\Järjestelmänvalvoja\Tulostinympäristö
    2008-04-30 22:32:46 0 dr------- C:\Documents and Settings\Järjestelmänvalvoja\Suosikit
    2008-04-30 22:32:46 0 dr-h----- C:\Documents and Settings\Järjestelmänvalvoja\SendTo
    2008-04-30 22:32:46 0 dr-h----- C:\Documents and Settings\Järjestelmänvalvoja\Recent
    2008-04-30 22:32:46 0 dr------- C:\Documents and Settings\Järjestelmänvalvoja\Omat tiedostot
    2008-04-30 22:32:46 786432 --ah----- C:\Documents and Settings\Järjestelmänvalvoja\NTUSER.DAT
    2008-04-30 22:32:46 0 d--h----- C:\Documents and Settings\Järjestelmänvalvoja\Mallit
    2008-04-30 22:32:46 0 d--h----- C:\Documents and Settings\Järjestelmänvalvoja\Local Settings
    2008-04-30 22:32:46 0 dr------- C:\Documents and Settings\Järjestelmänvalvoja\Käynnistä-valikko
    2008-04-30 22:32:46 0 d--hs---- C:\Documents and Settings\Järjestelmänvalvoja\Cookies
    2008-04-30 22:32:46 0 dr-h----- C:\Documents and Settings\Järjestelmänvalvoja\Application Data
    2008-04-30 22:32:46 0 d---s---- C:\Documents and Settings\Järjestelmänvalvoja\Application Data\Microsoft
    2008-04-30 22:32:46 0 d-------- C:\Documents and Settings\Järjestelmänvalvoja\Application Data\Identities
    2008-04-30 08:38:28 0 d-------- C:\Downloads
    2008-04-30 08:38:28 0 d-------- C:\Bases
    2008-04-30 08:37:24 0 d-------- C:\Kaspersky
    2008-04-29 20:40:13 0 d-------- C:\WINDOWS\ERUNT
    2008-04-29 08:47:18 0 d-------- C:\Program Files\Opera
    2008-04-29 00:37:36 0 dr-h----- C:\Documents and Settings\HP_Omistaja\Recent
    2008-04-27 01:12:06 0 d-------- C:\WINDOWS\system32\ThreadMaster
    2008-04-27 00:52:20 0 d-------- C:\WINDOWS\pss
    2008-04-26 23:34:47 0 d-------- C:\Documents and Settings\HP_Omistaja\Application Data\TVU Networks
    2008-04-26 23:34:47 0 d-------- C:\Documents and Settings\All Users\Application Data\TVU Networks
    2008-04-26 23:33:42 0 d-------- C:\Documents and Settings\HP_Omistaja\LocalLow
    2008-04-26 23:33:38 0 d-------- C:\Program Files\TVUPlayer
    2008-04-26 22:21:01 0 d-------- C:\Documents and Settings\HP_Omistaja\Application Data\ppstream
    2008-04-18 11:31:21 0 d-a------ C:\Program Files\AMV Converter
    2008-04-11 13:51:15 0 d-------- C:\Documents and Settings\HP_Omistaja\Application Data\Grisoft
    2008-04-06 02:39:04 0 d-------- C:\Program Files\Java
    2008-04-06 02:39:00 0 d-------- C:\Program Files\Common Files\Java
    2008-04-06 01:16:52 68096 --a------ C:\WINDOWS\zip.exe
    2008-04-06 01:16:52 49152 --a------ C:\WINDOWS\VFind.exe
    2008-04-06 01:16:52 136704 --a------ C:\WINDOWS\swsc.exe <Not Verified; SteelWerX; SteelWerX Service Controller>
    2008-04-06 01:16:52 161792 --a------ C:\WINDOWS\swreg.exe <Not Verified; SteelWerX; SteelWerX Registry Editor>
    2008-04-06 01:16:52 98816 --a------ C:\WINDOWS\sed.exe
    2008-04-06 01:16:52 80412 --a------ C:\WINDOWS\grep.exe
    2008-04-06 01:16:52 73728 --a------ C:\WINDOWS\fdsv.exe <Not Verified; Smallfrogs Studio; >
    2008-04-06 01:16:51 212480 --a------ C:\WINDOWS\swxcacls.exe <Not Verified; SteelWerX; SteelWerX Extended Configurator ACLists>
    2008-04-05 00:10:17 0 dr------- C:\Documents and Settings\LocalService\Suosikit
    2008-04-05 00:10:13 0 d-------- C:\Documents and Settings\LocalService\Application Data\Talkback
    2008-04-05 00:06:38 118784 --a------ C:\WINDOWS\system32\MSSTDFMT.DLL <Not Verified; Microsoft Corporation; MSSTDFMT Object Library>
    2008-04-05 00:06:37 0 d-------- C:\Program Files\SpywareBlaster
    2008-04-04 23:59:29 0 d-a------ C:\Documents and Settings\All Users\Application Data\TEMP
    2008-04-04 23:06:10 0 d-------- C:\Program Files\Lavasoft
    2008-04-04 23:06:10 0 d-------- C:\Documents and Settings\All Users\Application Data\Lavasoft
    2008-04-01 20:43:22 0 d-------- C:\Documents and Settings\HP_Omistaja\.housecall6.6
    2008-03-31 20:13:30 0 d-------- C:\Program Files\CCleaner
    2008-03-31 18:57:36 0 d-------- C:\VundoFix Backups
    2008-03-31 18:53:51 0 d-------- C:\Program Files\HJ


    -- Find3M Report ---------------------------------------------------------------

    2008-04-30 22:59:45 0 d-------- C:\Program Files\Common Files\Symantec Shared
    2008-04-30 22:30:53 0 d-------- C:\Program Files\mIRC
    2008-04-30 22:21:37 0 d-------- C:\Program Files\Warcraft III
    2008-04-30 08:32:06 43520 --a------ C:\WINDOWS\system32\CmdLineExt03.dll
    2008-04-28 21:20:09 0 d-------- C:\Documents and Settings\HP_Omistaja\Application Data\Skype
    2008-04-28 17:55:29 0 d-------- C:\Documents and Settings\HP_Omistaja\Application Data\skypePM
    2008-04-27 16:15:41 0 d-------- C:\Program Files\SopCast
    2008-04-27 00:29:00 0 d-------- C:\Program Files\Common Files\Wise Installation Wizard
    2008-04-26 23:18:07 0 d-------- C:\Program Files\MSN Messenger
    2008-04-23 19:00:55 10800 --a----c- C:\Documents and Settings\HP_Omistaja\Application Data\wklnhst.dat
    2008-04-22 21:09:17 0 d-------- C:\Program Files\Ajokorttikoulu
    2008-04-17 18:23:27 0 d-------- C:\Documents and Settings\HP_Omistaja\Application Data\Help
    2008-04-11 11:38:02 383124 --a------ C:\WINDOWS\system32\perfh00B.dat
    2008-04-11 11:38:02 78520 --a------ C:\WINDOWS\system32\perfc00B.dat
    2008-04-06 02:39:00 0 d-------- C:\Program Files\Common Files
    2008-03-20 19:48:49 0 d-------- C:\Documents and Settings\HP_Omistaja\Application Data\Command & Conquer 3 Tiberium Wars
    2008-03-20 19:45:56 98304 --a------ C:\WINDOWS\system32CmdLineExt.dll <Not Verified; Sony DADC Austria AG.; >
    2008-03-20 18:54:59 0 d-------- C:\Program Files\Electronic Arts
    2008-03-13 21:48:32 5066 --a----c- C:\WINDOWS\mozver.dat
    2008-03-13 19:29:24 0 d--h----- C:\Program Files\InstallShield Installation Information
    2008-03-11 15:15:30 0 d-------- C:\Program Files\The Learning Company
    2008-03-07 02:43:34 0 d-------- C:\Documents and Settings\HP_Omistaja\Application Data\Winamp
    2008-03-06 11:59:58 0 d-------- C:\Documents and Settings\HP_Omistaja\Application Data\Nokia Multimedia Player


    -- Registry Dump ---------------------------------------------------------------

    *Note* empty entries & legit default entries are not shown


    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "ccApp"="C:\Program Files\Common Files\Symantec Shared\ccApp.exe" [10.01.2007 00:59]
    "LVCOMSX"="C:\WINDOWS\system32\LVCOMSX.EXE" [19.07.2005 18:32]
    "Recguard"="C:\WINDOWS\SMINST\RECGUARD.EXE" [22.07.2005 23:14]
    "Symantec PIF AlertEng"="C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe" [29.01.2008 18:38]
    "SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe" [22.02.2008 04:25]
    "!AVG Anti-Spyware"="C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" [11.06.2007 12:25]

    [HKEY_USERS\.default\software\microsoft\windows\currentversion\run]
    "Picasa Media Detector"=C:\Program Files\Picasa2\PicasaMediaDetector.exe
    "Nokia.PCSync"="C:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe" /NoDialog

    C:\Documents and Settings\All Users\K„ynnist„-valikko\Ohjelmat\K„ynnistys\
    HP Digital Imaging Monitor.lnk - C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe [19.2.2006 5:21:22]

    [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
    "HideLegacyLogonScripts"=0 (0x0)
    "HideLogoffScripts"=0 (0x0)
    "RunLogonScriptSync"=1 (0x1)
    "RunStartupScriptSync"=1 (0x1)
    "HideStartupScripts"=0 (0x0)

    [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\system]
    "HideLegacyLogonScripts"=0 (0x0)
    "HideLogoffScripts"=0 (0x0)
    "RunLogonScriptSync"=1 (0x1)
    "RunStartupScriptSync"=1 (0x1)
    "HideStartupScripts"=0 (0x0)
    "DisableRegistryTools"=0 (0x0)

    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\aawservice]
    @="Service"

    [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run-]
    "ctfmon.exe"=C:\WINDOWS\system32\ctfmon.exe
    "PC Suite Tray"="C:\Program Files\Nokia\Nokia PC Suite 6\PCSuite.exe" -onlytray
    "LogitechSoftwareUpdate"="C:\Program Files\Logitech\Video\ManifestEngine.exe" boot
    "LDM"=C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BackWeb-8876480.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-]
    "TkBellExe"="C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
    "DAEMON Tools"="C:\Program Files\DAEMON Tools\daemon.exe" -lang 1033
    "QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" -atboottime
    "WinampAgent"="C:\Program Files\Winamp\winampa.exe"
    "Reminder"="C:\Windows\Creator\Remind_XP.exe"
    "HPHUPD08"=c:\Program Files\HP\Digital Imaging\{33D6CC28-9F75-4d1b-A11D-98895B3A3729}\hphupd08.exe
    "HP Software Update"=C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
    "NeroCheck"=C:\WINDOWS\system32\NeroCheck.exe
    "SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe"
    "HPBootOp"="C:\Program Files\Hewlett-Packard\HP Boot Optimizer\HPBootOp.exe" /run
    "UnlockerAssistant"="C:\Program Files\Unlocker\UnlockerAssistant.exe"
    "LogitechVideoTray"=C:\Program Files\Logitech\Video\LogiTray.exe
    "HydraVisionDesktopManager"=C:\Program Files\ATI Technologies\ATI HYDRAVISION\HydraDM.exe
    "Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
    "Symantec PIF AlertEng"="C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe" /a /m "C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\AlertEng.dll"

    *Newly Created Service* - COMHOST



    -- End of Deckard's System Scanner: finished at 2008-04-30 23:00:25 ------------


    ======================================================================
    ======================================================================


    Deckard's System Scanner v20071014.68
    Extra logfile - please post this as an attachment with your post.
    --------------------------------------------------------------------------------

    -- System Information ----------------------------------------------------------

    Microsoft Windows XP Home Edition (build 2600) SP 2.0
    Architecture: X86; Language: Other (040B) - see http://preview.tinyurl.com/mhhp6

    CPU 0: AMD Sempron(tm) Processor 3200+
    Percentage of Memory in Use: 20%
    Physical Memory (total/avail): 2558.48 MiB / 2046.56 MiB
    Pagefile Memory (total/avail): 3073.47 MiB / 2656.68 MiB
    Virtual Memory (total/avail): 2047.88 MiB / 1920.79 MiB

    C: is Fixed (NTFS) - 69.37 GiB total, 22.82 GiB free.
    D: is Fixed (FAT32) - 5.14 GiB total, 0.69 GiB free.
    E: is CDROM (No Media)
    F: is Fixed (NTFS) - 37.27 GiB total, 16.42 GiB free.
    G: is CDROM (No Media)

    \\.\PHYSICALDRIVE1 - HDS728080PLAT20 - 74.53 GiB - 2 partitions
    \PARTITION0 (bootable) - Asennettava tiedostojärjestelmä - 69.37 GiB - C:
    \PARTITION1 - Unknown - 5.15 GiB - D:

    \\.\PHYSICALDRIVE0 - ST340810A - 37.27 GiB - 1 partition
    \PARTITION0 (bootable) - Asennettava tiedostojärjestelmä - 37.27 GiB - F:



    -- Security Center -------------------------------------------------------------

    AUOptions is scheduled to auto-install.
    Windows Internal Firewall is disabled.

    FirstRunDisabled is set.

    FW: Norton 360 v2007 (SYMANTEC Corporation)
    AV: Norton 360 v2007 (SYMANTEC Corperation)

    [HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List]
    "%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:mad:xpsp2res.dll,-22019"
    "C:\\Program Files\\MSN Messenger\\msncall.exe"="C:\\Program Files\\MSN Messenger\\msncall.exe:*:Enabled:Windows Live Messenger 8.0 (Phone)"
    "%windir%\\Network Diagnostic\\xpnetdiag.exe"="%windir%\\Network Diagnostic\\xpnetdiag.exe:*:Enabled:mad:xpsp3res.dll,-20000"
    "C:\\Program Files\\MSN Messenger\\msnmsgr.exe"="C:\\Program Files\\MSN Messenger\\msnmsgr.exe:*:Enabled:Windows Live Messenger 8.1"
    "C:\\Program Files\\MSN Messenger\\livecall.exe"="C:\\Program Files\\MSN Messenger\\livecall.exe:*:Enabled:Windows Live Messenger 8.1 (Phone)"

    [HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]
    "%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:mad:xpsp2res.dll,-22019"
    "C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqtra08.exe"="C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqtra08.exe:*:Enabled:hpqtra08.exe"
    "C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqste08.exe"="C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqste08.exe:*:Enabled:hpqste08.exe"
    "C:\\Program Files\\HP\\Digital Imaging\\bin\\hpofxm08.exe"="C:\\Program Files\\HP\\Digital Imaging\\bin\\hpofxm08.exe:*:Enabled:hpofxm08.exe"
    "C:\\Program Files\\HP\\Digital Imaging\\bin\\hposfx08.exe"="C:\\Program Files\\HP\\Digital Imaging\\bin\\hposfx08.exe:*:Enabled:hposfx08.exe"
    "C:\\Program Files\\HP\\Digital Imaging\\bin\\hposid01.exe"="C:\\Program Files\\HP\\Digital Imaging\\bin\\hposid01.exe:*:Enabled:hposid01.exe"
    "C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqscnvw.exe"="C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqscnvw.exe:*:Enabled:hpqscnvw.exe"
    "C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqkygrp.exe"="C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqkygrp.exe:*:Enabled:hpqkygrp.exe"
    "C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqCopy.exe"="C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqCopy.exe:*:Enabled:hpqcopy.exe"
    "C:\\Program Files\\HP\\Digital Imaging\\bin\\hpfccopy.exe"="C:\\Program Files\\HP\\Digital Imaging\\bin\\hpfccopy.exe:*:Enabled:hpfccopy.exe"
    "C:\\Program Files\\HP\\Digital Imaging\\bin\\hpzwiz01.exe"="C:\\Program Files\\HP\\Digital Imaging\\bin\\hpzwiz01.exe:*:Enabled:hpzwiz01.exe"
    "C:\\Program Files\\HP\\Digital Imaging\\Unload\\HpqPhUnl.exe"="C:\\Program Files\\HP\\Digital Imaging\\Unload\\HpqPhUnl.exe:*:Enabled:hpqphunl.exe"
    "C:\\Program Files\\HP\\Digital Imaging\\Unload\\HpqDIA.exe"="C:\\Program Files\\HP\\Digital Imaging\\Unload\\HpqDIA.exe:*:Enabled:hpqdia.exe"
    "C:\\Program Files\\HP\\Digital Imaging\\bin\\hpoews01.exe"="C:\\Program Files\\HP\\Digital Imaging\\bin\\hpoews01.exe:*:Enabled:hpoews01.exe"
    "C:\\Program Files\\Mozilla Firefox\\firefox.exe"="C:\\Program Files\\Mozilla Firefox\\firefox.exe:*:Enabled:Firefox"
    "C:\\Program Files\\iTunes\\iTunes.exe"="C:\\Program Files\\iTunes\\iTunes.exe:*:Enabled:iTunes"
    "C:\\Program Files\\mIRC\\mirc.exe"="C:\\Program Files\\mIRC\\mirc.exe:*:Enabled:mIRC"
    "%windir%\\Network Diagnostic\\xpnetdiag.exe"="%windir%\\Network Diagnostic\\xpnetdiag.exe:*:Enabled:mad:xpsp3res.dll,-20000"
    "C:\\Program Files\\MSN Messenger\\msnmsgr.exe"="C:\\Program Files\\MSN Messenger\\msnmsgr.exe:*:Enabled:Windows Live Messenger 8.1"
    "C:\\Program Files\\MSN Messenger\\livecall.exe"="C:\\Program Files\\MSN Messenger\\livecall.exe:*:Enabled:Windows Live Messenger 8.1 (Phone)"
    "C:\\Program Files\\Messenger\\msmsgs.exe"="C:\\Program Files\\Messenger\\msmsgs.exe:*:Enabled:Windows Messenger"
    "C:\\Program Files\\Skype\\Phone\\Skype.exe"="C:\\Program Files\\Skype\\Phone\\Skype.exe:*:Enabled:Skype"


    -- Environment Variables -------------------------------------------------------

    ALLUSERSPROFILE=C:\Documents and Settings\All Users
    APPDATA=C:\Documents and Settings\HP_Omistaja\Application Data
    CLASSPATH=.;C:\Program Files\Java\jre1.5.0_05\lib\ext\QTJava.zip
    CommonProgramFiles=C:\Program Files\Common Files
    COMPUTERNAME=HANNU1
    ComSpec=C:\WINDOWS\system32\cmd.exe
    FP_NO_HOST_CHECK=NO
    HOMEDRIVE=C:
    HOMEPATH=\Documents and Settings\HP_Omistaja
    LOGONSERVER=\\HANNU1
    NUMBER_OF_PROCESSORS=1
    OS=Windows_NT
    Path=C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\system32\wbem;C:\Program Files\PC Connectivity Solution;c:\Python22;C:\Program Files\ATI Technologies\ATI Control Panel;C:\Program Files\QuickTime\QTSystem
    PATHEXT=.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH
    PROCESSOR_ARCHITECTURE=x86
    PROCESSOR_IDENTIFIER=x86 Family 15 Model 47 Stepping 2, AuthenticAMD
    PROCESSOR_LEVEL=15
    PROCESSOR_REVISION=2f02
    ProgramFiles=C:\Program Files
    PROMPT=$P$G
    QTJAVA=C:\Program Files\Java\jre1.5.0_05\lib\ext\QTJava.zip
    SESSIONNAME=Console
    SonicCentral=c:\Program Files\Common Files\Sonic Shared\Sonic Central\
    SystemDrive=C:
    SystemRoot=C:\WINDOWS
    TEMP=C:\DOCUME~1\HP_OMI~1\LOCALS~1\Temp
    TMP=C:\DOCUME~1\HP_OMI~1\LOCALS~1\Temp
    USERDOMAIN=HANNU1
    USERNAME=HP_Omistaja
    USERPROFILE=C:\Documents and Settings\HP_Omistaja
    windir=C:\WINDOWS
    __COMPAT_LAYER=EnableNXShowUI


    -- User Profiles ---------------------------------------------------------------

    HP_Omistaja (admin)
    Järjestelmänvalvoja (new local, admin)


    -- Add/Remove Programs ---------------------------------------------------------

    --> C:\Program Files\Common Files\Real\Update_OB\r1puninst.exe RealNetworks|RealPlayer|6.0
    --> c:\WINDOWS\system32\\MSIEXEC.EXE /x {075473F5-846A-448B-BCB3-104AA1760205}
    --> c:\WINDOWS\system32\\MSIEXEC.EXE /x {AB708C9B-97C8-4AC9-899B-DBF226AC9382}
    --> c:\WINDOWS\system32\\MSIEXEC.EXE /x {B12665F4-4E93-4AB4-B7FC-37053B524629}
    --> rundll32.exe setupapi.dll,InstallHinfSection DefaultUninstall 132 C:\WINDOWS\INF\PCHealth.inf
    2006 FIFA World Cup (TM) --> C:\Program Files\EA SPORTS\2006 FIFA World Cup (TM)\EAUninstall.exe
    3DMark06 --> RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\10\01\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{7F3AD00A-1819-4B15-BB7D-08B3586336D7}\setup.exe" -l0x9 -removeonly
    Ad-Aware 2007 --> MsiExec.exe /I{DED53B0B-B67C-4244-AE6A-D6FD3C28D1EF}
    Adobe Flash Player ActiveX --> C:\WINDOWS\system32\Macromed\Flash\uninstall_activeX.exe
    Adobe Flash Player Plugin --> C:\WINDOWS\system32\Macromed\Flash\uninstall_plugin.exe
    Adobe Reader 8.1.2 - Suomi --> MsiExec.exe /I{AC76BA86-7AD7-1035-7B44-A81200000003}
    Adobe Shockwave Player --> C:\WINDOWS\system32\Macromed\SHOCKW~1\UNWISE.EXE C:\WINDOWS\system32\Macromed\SHOCKW~1\Install.log
    Ahead Nero Burning ROM --> C:\Program Files\Ahead\nero\uninstall\UNNERO.exe /UNINSTALL
    Ajokorttikoulu --> C:\Program Files\Ajokorttikoulu\Uninstall.exe
    Alfa-Aihepiirisanasto englanti 3 --> RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\09\01\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{1FC639A9-C702-479C-89F9-3FB7ECF37CE3}\setup.exe" -l0xb
    Alfa-Aihepiirisanasto ruotsi 3 --> RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\09\01\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{0E60AF0B-EF94-4030-AB56-5872075C4288}\setup.exe" -l0xb
    Alfa-English 4 Youngsters --> RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\09\01\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{FDD0D4BB-288E-4BC5-8586-B18005996BFB}\setup.exe" -l0xb
    Alfa-svenska för ungdomar --> RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\09\01\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{1D0631B0-BA74-46DD-9A44-541BBF955E3B}\setup.exe" -l0xb
    Alkupolku Eskari --> C:\Program Files\Common Files\Knowledge Adventure\Uninstall\UNAPLA.exe
    AppCore --> MsiExec.exe /I{EFB5B3B5-A280-4E25-BE1C-634EEFE32C1B}
    ATI-ohjauspaneeli --> RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\engine\6\INTEL3~1\ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{0BEDBD4E-2D34-47B5-9973-57E62B29307C}\setup.exe"
    ATI-ohjelmiston poisto-ohjelma --> C:\Program Files\ATI Technologies\UninstallAll\AtiCimUn.exe
    ATI Display Driver --> rundll32 C:\WINDOWS\system32\atiiiexx.dll,_InfEngUnInstallINFFile_RunDLL@16 -force_restart -flags:0x2010001 -inf_class:DISPLAY -clean
    ATI HYDRAVISION --> RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\engine\6\INTEL3~1\ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{083F79E4-6FE9-46FB-A6C6-4F8862742947}\setup.exe"
    Audacity 1.2.6 --> "C:\Program Files\Audacity\unins000.exe"
    AV --> MsiExec.exe /I{F4DB525F-A986-4249-B98B-42A8066251CA}
    AVG Anti-Spyware 7.5 --> C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\Uninstall.exe
    Bluetooth-ohjelmisto --> MsiExec.exe /X{3F4EC965-28EF-45C3-B063-04B25D4E9679}
    Caillou(R) Magic Playhouse(TM) --> C:\Program Files\The Learning Company\Caillou(R) Magic Playhouse(TM)\uninstall.exe
    ccCommon --> MsiExec.exe /I{3CCAD2EF-CFF2-4637-82AA-AABF370282D3}
    CCleaner (remove only) --> "C:\Program Files\CCleaner\uninst.exe"
    Codec Pack - All In 1 6.0.3.0 --> C:\WINDOWS\iun6002.exe "C:\Program Files\Codec Pack - All In 1\irunin.ini"
    Command & Conquer 3 --> MsiExec.exe /I{B0C30E93-D3D9-4F04-A2AC-54749B573275}
    GearDrvs --> MsiExec.exe /I{228F6876-A313-40A3-91C0-C3CBE6997D09}
    GTA San Andreas --> RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\10\50\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{D417C96A-FCC7-4590-A1BB-FAF73F5BC98E}\setup.exe" -l0x9 -removeonly
    High Definition Audio - KB888111 --> "C:\WINDOWS\$NtUninstallKB888111WXPSP2$\spuninst\spuninst.exe"
    HijackThis 2.0.2 --> "C:\Program Files\HJ\HijackThis.exe" /uninstall
    Hotfix-päivitys Windows XP:lle (KB893357) --> "C:\WINDOWS\$NtUninstallKB893357$\spuninst\spuninst.exe"
    Hotfix-päivitys Windows XP:lle (KB906569) --> "C:\WINDOWS\$NtUninstallKB906569$\spuninst\spuninst.exe"
    Hotfix-päivitys Windows XP:lle (KB914440) --> "C:\WINDOWS\$NtUninstallKB914440$\spuninst\spuninst.exe"
    Hotfix for Windows Media Format 11 SDK (KB929399) --> "C:\WINDOWS\$NtUninstallKB929399$\spuninst\spuninst.exe"
    HP Boot Optimizer --> C:\Program Files\Hewlett-Packard\HP Boot Optimizer\HPBootOp.exe /uninstall
    HP Customer Participation Program 7.0 --> C:\Program Files\HP\Digital Imaging\ExtCapUninstall\hpzscr01.exe -datfile hpqhsc01.dat
    HP Deskjet Printer Preload --> MsiExec.exe /I{2C5D07FB-31A2-4F2D-9FDA-0B24ACD42BD0}
    HP Document Viewer 5.3 --> C:\Program Files\HP\Digital Imaging\DocumentViewer\hpzscr01.exe -datfile hpqbud04.dat
    HP DVD Play 1.0 --> RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{45D707E9-F3C4-11D9-A373-0050BAE317E1}\Setup.exe" -uninstall
    HP Imaging Device Functions 7.0 --> C:\Program Files\HP\Digital Imaging\DeviceManagement\hpzscr01.exe -datfile hpqbud01.dat
    HP Photosmart -kamerat 5.0 --> C:\Program Files\HP\Digital Imaging\{C83A12B9-B31B-461A-BBD4-CE9B988094F1}\setup\hpzscr01.exe -datfile hpiscr01.dat
    HP Photosmart 330,380,420,470,7800,8000,8200 Series --> C:\Program Files\HP\Digital Imaging\{33D6CC28-9F75-4d1b-A11D-98895B3A3729}\setup\hpzscr01.exe -d MsiRollbackUninstaller -datfile hphscr08.dat
    HP Photosmart and Deskjet 7.0 Software (fin) --> C:\Program Files\HP\Digital Imaging\{9D404F8F-05A1-4734-9550-6EC2FEE916B8}\setup\hpzscr01.exe -datfile hphscr10.dat -showdisconnect -forcereboot
    HP Photosmart Essential --> MsiExec.exe /X{6994491D-D491-48F1-AE1F-E179C1FFFC2F}
    HP Photosmart Premier Software 6.0 --> C:\Program Files\HP\Digital Imaging\uninstall\hpzscr01.exe -datfile hpqscr01.dat
    HP PSC & OfficeJet 5.3.A --> "C:\Program Files\HP\Digital Imaging\{3E386744-10FA-44b2-98C9-DF7A270DECB3}\setup\hpzscr01.exe" -datfile hposcr06.dat
    HP PSC & OfficeJet 5.3.B --> "C:\Program Files\HP\Digital Imaging\{5B79CFD1-6845-4158-9D7D-6BE89DF2C135}\setup\hpzscr01.exe" -datfile hposcr07.dat
    HP Software Update --> MsiExec.exe /X{BB85ED9C-AFC9-43BD-B8DC-258C3C7DF72E}
    HP Solution Center 7.0 --> C:\Program Files\HP\Digital Imaging\eSupport\hpzscr01.exe -datfile hpqbud05.dat
    Ifi Tilausohjelma 3.5 --> C:\Program Files\Ifi\OrderClient35\Uninstall.exe
    iTunes --> C:\PROGRA~1\COMMON~1\INSTAL~1\Driver\11\INTEL3~1\IDriver.exe /M{54C0D94A-F467-4ABC-9D02-6E58748668D4} /l1035
    Java(TM) 6 Update 5 --> MsiExec.exe /I{3248F0A8-6813-11D6-A77B-00B0D0160050}
    Kielioppi Harjoituskirja englanti 3 --> RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\09\01\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{B630744C-69CC-4B41-8673-208FE5C182B1}\setup.exe" -l0xb
    Kielioppi Harjoituskirja ruotsi 3 --> RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\09\01\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{727D57B9-6A01-47D0-8ABB-A4AFDD6D9F41}\setup.exe" -l0xb
    Kielioppi Oppikirja englanti --> RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\09\01\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{64175EFE-3DDC-46BE-BC9B-54BEFF19AB20}\setup.exe" -l0xb
    Kielioppi Oppikirja ruotsi --> RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\09\01\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{2E01420B-5BD6-4515-8742-3E7B40050F9A}\setup.exe" -l0xb
    LiveUpdate 3.2 (Symantec Corporation) --> "C:\Program Files\Symantec\LiveUpdate\LSETUP.EXE" /U
    LiveUpdate Notice (Symantec Corporation) --> MsiExec.exe /X{DBA4DB9D-EE51-4944-A419-98AB1F1249C8}
    Logitech Desktop Messenger --> RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{900B1197-53F5-4F46-A882-2CFFFE2EEDCB}\Setup.exe" -l0xb UNINSTALL
    Logitech Gaming Software --> RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\0701\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{B9242864-2841-4ADE-86E0-8F90F91B04DD}\setup.exe" -l0xb
    Logitech Print Service --> C:\PROGRA~1\Logitech\PRINTS~1\UNWISE.EXE C:\PROGRA~1\Logitech\PRINTS~1\INSTALL.LOG
    Logitech QuickCam Software --> RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\09\01\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{C43048A9-742C-4DAD-90D2-E3B53C9DB825}\setup.exe" -l0x9
    Logitech® Camera -ohjain --> "C:\Program Files\Common Files\Logitech\QCDRV\BIN\SETUP.EXE" UNINSTALL REMOVEPROMPT
    Macromedia Flash Player 8 --> MsiExec.exe /X{6815FCDD-401D-481E-BA88-31B4754C2B46}
    Mafia --> c:\program files\Mafia\patch.exe
    Mafia Game --> C:\WINDOWS\system32\MafiaSetup.exe
    Max Payne 2 --> RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\0701\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{EFE1AB94-5466-4B6E-BE31-FF4C115FD25D}\Setup.exe" -l0x9
    Microsoft Compression Client Pack 1.0 for Windows XP --> "C:\WINDOWS\$NtUninstallMSCompPackV1$\spuninst\spuninst.exe"
    Microsoft User-Mode Driver Framework Feature Pack 1.5 --> "C:\WINDOWS\$NtUninstallWudf01005$\spuninst\spuninst.exe"
    Microsoft Visual C++ 2005 Redistributable --> MsiExec.exe /X{A49F249F-0C91-497F-86DF-B2585E8E76B7}
    Microsoft Works --> MsiExec.exe /I{2EF8368A-5670-45C0-82F1-D7B00F7E7AB8}
    mIRC --> "C:\Program Files\mIRC\mirc.exe" -uninstall
    Mopokorttikoulu --> C:\WINDOWS\Mopokorttikoulu Uninstaller.exe
    Mozilla Firefox (2.0.0.14) --> C:\Program Files\Mozilla Firefox\uninstall\helper.exe
    MSVC80_x86 --> MsiExec.exe /I{212748BB-0DA5-46DE-82A1-403736DC9F27}
    Need for Speed™ Most Wanted --> C:\Program Files\EA GAMES\Need for Speed Most Wanted\EAUninstall.exe
    NetZero For Riverdeep --> MsiExec.exe /X{86C1A488-24AD-42F0-BCEF-FDB11FC2BEFA}
    NetZero Internet and Voice Offer --> MsiExec.exe /X{8BBA35B6-E1A9-4FE0-892B-8F7980584D52}
    NHL 99 --> C:\WINDOWS\UNIN040B.EXE -f"C:\Program Files\EA SPORTS\NHL 99\DeIsL1.isu" -c"C:\Program Files\EA SPORTS\NHL 99\eauninst.dll
    Nokia Connectivity Cable Driver --> MsiExec.exe /X{0A3D3C54-2EC0-4D67-B265-FF17926E6D67}
    Nokia PC Suite --> C:\Documents and Settings\All Users\Application Data\Installations\{29466F9C-7C6A-419C-B301-F440FAF78760}\Nokia_PC_Suite_rel_6_85_14_1_fin.exe
    Nokia PC Suite --> MsiExec.exe /I{29466F9C-7C6A-419C-B301-F440FAF78760}
    Norton 360 --> MsiExec.exe /I{21829177-4DED-4209-AD08-490B3AC9C01A}
    Norton 360 --> MsiExec.exe /I{2D617065-1C52-4240-B5BC-C0AE12157777}
    Norton 360 --> MsiExec.exe /I{63A6E9A9-A190-46D4-9430-2DB28654AFD8}
    Norton 360 (Symantec Corporation) --> "C:\Program Files\Common Files\Symantec Shared\SymSetup\{2D617065-1C52-4240-B5BC-C0AE12157777}_1_0_0_184\{2D617065-1C52-4240-B5BC-C0AE12157777}.exe" /X
    Norton 360 Help --> MsiExec.exe /I{1CA941F1-5006-487E-9FD4-09F812A7D6B8}
    Norton Confidential Browser Component --> MsiExec.exe /I{4843B611-8FCB-4428-8C23-31D0A5EAE164}
    Norton Confidential Web Authentification Component --> MsiExec.exe /I{3074EB89-1BCA-4AEF-AFF4-EFB4634C1923}
    Norton Confidential Web Protection Component --> MsiExec.exe /I{D353CC51-430D-4C6F-9B7E-52003DA1E05A}
    Opera 9.27 --> MsiExec.exe /X{503D6E3E-1A48-44F5-BB7C-EB3B593FAED0}
    PC Connectivity Solution --> MsiExec.exe /I{BA084E7C-8ABA-4670-BDE8-B85E689A5C1B}
    Picasa 2 --> "C:\Program Files\Picasa2\Uninstall.exe"
    Päivitys Windows XP:lle (KB898461) --> "C:\WINDOWS\$NtUninstallKB898461$\spuninst\spuninst.exe"
    Päivitys Windows XP:lle (KB900485) --> "C:\WINDOWS\$NtUninstallKB900485$\spuninst\spuninst.exe"
    Päivitys Windows XP:lle (KB904942) --> "C:\WINDOWS\$NtUninstallKB904942$\spuninst\spuninst.exe"
    Päivitys Windows XP:lle (KB908531) --> "C:\WINDOWS\$NtUninstallKB908531$\spuninst\spuninst.exe"
    Päivitys Windows XP:lle (KB910437) --> "C:\WINDOWS\$NtUninstallKB910437$\spuninst\spuninst.exe"
    Päivitys Windows XP:lle (KB911280) --> "C:\WINDOWS\$NtUninstallKB911280$\spuninst\spuninst.exe"
    Päivitys Windows XP:lle (KB916595) --> "C:\WINDOWS\$NtUninstallKB916595$\spuninst\spuninst.exe"
    Päivitys Windows XP:lle (KB920872) --> "C:\WINDOWS\$NtUninstallKB920872$\spuninst\spuninst.exe"
    Päivitys Windows XP:lle (KB922582) --> "C:\WINDOWS\$NtUninstallKB922582$\spuninst\spuninst.exe"
    Päivitys Windows XP:lle (KB927891) --> "C:\WINDOWS\$NtUninstallKB927891$\spuninst\spuninst.exe"
    Päivitys Windows XP:lle (KB929338) --> "C:\WINDOWS\$NtUninstallKB929338$\spuninst\spuninst.exe"
    Päivitys Windows XP:lle (KB930916) --> "C:\WINDOWS\$NtUninstallKB930916$\spuninst\spuninst.exe"
    Päivitys Windows XP:lle (KB931836) --> "C:\WINDOWS\$NtUninstallKB931836$\spuninst\spuninst.exe"
    Päivitys Windows XP:lle (KB933360) --> "C:\WINDOWS\$NtUninstallKB933360$\spuninst\spuninst.exe"
    Päivitys Windows XP:lle (KB938828) --> "C:\WINDOWS\$NtUninstallKB938828$\spuninst\spuninst.exe"
    Päivitys Windows XP:lle (KB942763) --> "C:\WINDOWS\$NtUninstallKB942763$\spuninst\spuninst.exe"
    PS2 --> C:\WINDOWS\system32\ps2.exe uninstall
    Python 2.2 pywin32 extensions (build 203) --> "C:\Python22\Removepywin32.exe" -u "C:\Python22\pywin32-wininst.log"
    Python 2.2.3 --> C:\Python22\UNWISE.EXE C:\Python22\INSTALL.LOG
    QuickTime --> C:\PROGRA~1\COMMON~1\INSTAL~1\Driver\11\INTEL3~1\IDriver.exe /M{C21D5524-A970-42FA-AC8A-59B8C7CDCA31} /l1035
    Reader Rabbit Math Ages 4-6 --> C:\Program Files\The Learning Company\Reader Rabbit Math Ages 4-6\uninstal.exe
    RealPlayer --> C:\Program Files\Common Files\Real\Update_OB\r1puninst.exe RealNetworks|RealPlayer|6.0
    Skype™ 3.6 --> MsiExec.exe /X{5C82DAE5-6EB0-4374-9254-BE3319BA4E82}
    Sonic Express Labeler --> MsiExec.exe /X{6675CA7F-E51B-4F6A-99D4-F8F0124C6EAA}
    Sonic MyDVD Plus --> MsiExec.exe /X{21657574-BD54-48A2-9450-EB03B2C7FC29}
    Sonic RecordNow Audio --> MsiExec.exe /X{AB708C9B-97C8-4AC9-899B-DBF226AC9382}
    Sonic RecordNow Copy --> MsiExec.exe /X{B12665F4-4E93-4AB4-B7FC-37053B524629}
    Sonic RecordNow Data --> MsiExec.exe /X{075473F5-846A-448B-BCB3-104AA1760205}
    Sonic Update Manager --> MsiExec.exe /X{30465B6C-B53F-49A1-9EBA-A3F187AD502E}
    SopCast 2.0.4 --> C:\Program Files\SopCast\uninst.exe
    SPBBC 32bit --> MsiExec.exe /I{77772678-817F-4401-9301-ED1D01A8DA56}
    SpywareBlaster 4.0 --> "C:\Program Files\SpywareBlaster\unins000.exe"
    Suojauspäivitys ohjelmistolle Windows XP (KB923689) --> "C:\WINDOWS\$NtUninstallKB923689$\spuninst\spuninst.exe"
    Suojauspäivitys ohjelmistolle Windows XP (KB941569) --> "C:\WINDOWS\$NtUninstallKB941569$\spuninst\spuninst.exe"
    Suojauspäivitys Windows XP:lle (KB890046) --> "C:\WINDOWS\$NtUninstallKB890046$\spuninst\spuninst.exe"
    Suojauspäivitys Windows XP:lle (KB893756) --> "C:\WINDOWS\$NtUninstallKB893756$\spuninst\spuninst.exe"
    Suojauspäivitys Windows XP:lle (KB896358) --> "C:\WINDOWS\$NtUninstallKB896358$\spuninst\spuninst.exe"
    Suojauspäivitys Windows XP:lle (KB896422) --> "C:\WINDOWS\$NtUninstallKB896422$\spuninst\spuninst.exe"
    Suojauspäivitys Windows XP:lle (KB896423) --> "C:\WINDOWS\$NtUninstallKB896423$\spuninst\spuninst.exe"
    Suojauspäivitys Windows XP:lle (KB896424) --> "C:\WINDOWS\$NtUninstallKB896424$\spuninst\spuninst.exe"
    Suojauspäivitys Windows XP:lle (KB896428) --> "C:\WINDOWS\$NtUninstallKB896428$\spuninst\spuninst.exe"
    Suojauspäivitys Windows XP:lle (KB899587) --> "C:\WINDOWS\$NtUninstallKB899587$\spuninst\spuninst.exe"
    Suojauspäivitys Windows XP:lle (KB899591) --> "C:\WINDOWS\$NtUninstallKB899591$\spuninst\spuninst.exe"
    Suojauspäivitys Windows XP:lle (KB900725) --> "C:\WINDOWS\$NtUninstallKB900725$\spuninst\spuninst.exe"
    Suojauspäivitys Windows XP:lle (KB901017) --> "C:\WINDOWS\$NtUninstallKB901017$\spuninst\spuninst.exe"
    Suojauspäivitys Windows XP:lle (KB901190) --> "C:\WINDOWS\$NtUninstallKB901190$\spuninst\spuninst.exe"
    Suojauspäivitys Windows XP:lle (KB901214) --> "C:\WINDOWS\$NtUninstallKB901214$\spuninst\spuninst.exe"
    Suojauspäivitys Windows XP:lle (KB902400) --> "C:\WINDOWS\$NtUninstallKB902400$\spuninst\spuninst.exe"
    Suojauspäivitys Windows XP:lle (KB904706) --> "C:\WINDOWS\$NtUninstallKB904706$\spuninst\spuninst.exe"
    Suojauspäivitys Windows XP:lle (KB905414) --> "C:\WINDOWS\$NtUninstallKB905414$\spuninst\spuninst.exe"
    Suojauspäivitys Windows XP:lle (KB905749) --> "C:\WINDOWS\$NtUninstallKB905749$\spuninst\spuninst.exe"
    Suojauspäivitys Windows XP:lle (KB905915) --> "C:\WINDOWS\$NtUninstallKB905915$\spuninst\spuninst.exe"
    Suojauspäivitys Windows XP:lle (KB908519) --> "C:\WINDOWS\$NtUninstallKB908519$\spuninst\spuninst.exe"
    Suojauspäivitys Windows XP:lle (KB911562) --> "C:\WINDOWS\$NtUninstallKB911562$\spuninst\spuninst.exe"
    Suojauspäivitys Windows XP:lle (KB911567) --> "C:\WINDOWS\$NtUninstallKB911567$\spuninst\spuninst.exe"
    Suojauspäivitys Windows XP:lle (KB911927) --> "C:\WINDOWS\$NtUninstallKB911927$\spuninst\spuninst.exe"
    Suojauspäivitys Windows XP:lle (KB912919) --> "C:\WINDOWS\$NtUninstallKB912919$\spuninst\spuninst.exe"
    Suojauspäivitys Windows XP:lle (KB913580) --> "C:\WINDOWS\$NtUninstallKB913580$\spuninst\spuninst.exe"
    Suojauspäivitys Windows XP:lle (KB914388) --> "C:\WINDOWS\$NtUninstallKB914388$\spuninst\spuninst.exe"
    Suojauspäivitys Windows XP:lle (KB914389) --> "C:\WINDOWS\$NtUninstallKB914389$\spuninst\spuninst.exe"
    Suojauspäivitys Windows XP:lle (KB916281) --> "C:\WINDOWS\$NtUninstallKB916281$\spuninst\spuninst.exe"
    Suojauspäivitys Windows XP:lle (KB917159) --> "C:\WINDOWS\$NtUninstallKB917159$\spuninst\spuninst.exe"
    Suojauspäivitys Windows XP:lle (KB917344) --> "C:\WINDOWS\$NtUninstallKB917344$\spuninst\spuninst.exe"
    Suojauspäivitys Windows XP:lle (KB917422) --> "C:\WINDOWS\$NtUninstallKB917422$\spuninst\spuninst.exe"
    Suojauspäivitys Windows XP:lle (KB917953) --> "C:\WINDOWS\$NtUninstallKB917953$\spuninst\spuninst.exe"
    Suojauspäivitys Windows XP:lle (KB918118) --> "C:\WINDOWS\$NtUninstallKB918118$\spuninst\spuninst.exe"
    Suojauspäivitys Windows XP:lle (KB918439) --> "C:\WINDOWS\$NtUninstallKB918439$\spuninst\spuninst.exe"
    Suojauspäivitys Windows XP:lle (KB918899) --> "C:\WINDOWS\$NtUninstallKB918899$\spuninst\spuninst.exe"
    Suojauspäivitys Windows XP:lle (KB919007) --> "C:\WINDOWS\$NtUninstallKB919007$\spuninst\spuninst.exe"
    Suojauspäivitys Windows XP:lle (KB920213) --> "C:\WINDOWS\$NtUninstallKB920213$\spuninst\spuninst.exe"
    Suojauspäivitys Windows XP:lle (KB920214) --> "C:\WINDOWS\$NtUninstallKB920214$\spuninst\spuninst.exe"
    Suojauspäivitys Windows XP:lle (KB920670) --> "C:\WINDOWS\$NtUninstallKB920670$\spuninst\spuninst.exe"
    Suojauspäivitys Windows XP:lle (KB920683) --> "C:\WINDOWS\$NtUninstallKB920683$\spuninst\spuninst.exe"
    Suojauspäivitys Windows XP:lle (KB920685) --> "C:\WINDOWS\$NtUninstallKB920685$\spuninst\spuninst.exe"
    Suojauspäivitys Windows XP:lle (KB921398) --> "C:\WINDOWS\$NtUninstallKB921398$\spuninst\spuninst.exe"
    Suojauspäivitys Windows XP:lle (KB921503) --> "C:\WINDOWS\$NtUninstallKB921503$\spuninst\spuninst.exe"
    Suojauspäivitys Windows XP:lle (KB921883) --> "C:\WINDOWS\$NtUninstallKB921883$\spuninst\spuninst.exe"
    Suojauspäivitys Windows XP:lle (KB922616) --> "C:\WINDOWS\$NtUninstallKB922616$\spuninst\spuninst.exe"
    Suojauspäivitys Windows XP:lle (KB922760) --> "C:\WINDOWS\$NtUninstallKB922760$\spuninst\spuninst.exe"
    Suojauspäivitys Windows XP:lle (KB922819) --> "C:\WINDOWS\$NtUninstallKB922819$\spuninst\spuninst.exe"
    Suojauspäivitys Windows XP:lle (KB923191) --> "C:\WINDOWS\$NtUninstallKB923191$\spuninst\spuninst.exe"
    Suojauspäivitys Windows XP:lle (KB923414) --> "C:\WINDOWS\$NtUninstallKB923414$\spuninst\spuninst.exe"
    Suojauspäivitys Windows XP:lle (KB923694) --> "C:\WINDOWS\$NtUninstallKB923694$\spuninst\spuninst.exe"
    Suojauspäivitys Windows XP:lle (KB923980) --> "C:\WINDOWS\$NtUninstallKB923980$\spuninst\spuninst.exe"
    Suojauspäivitys Windows XP:lle (KB924191) --> "C:\WINDOWS\$NtUninstallKB924191$\spuninst\spuninst.exe"
    Suojauspäivitys Windows XP:lle (KB924270) --> "C:\WINDOWS\$NtUninstallKB924270$\spuninst\spuninst.exe"
    Suojauspäivitys Windows XP:lle (KB924496) --> "C:\WINDOWS\$NtUninstallKB924496$\spuninst\spuninst.exe"
    Suojauspäivitys Windows XP:lle (KB924667) --> "C:\WINDOWS\$NtUninstallKB924667$\spuninst\spuninst.exe"
    Suojauspäivitys Windows XP:lle (KB925486) --> "C:\WINDOWS\$NtUninstallKB925486$\spuninst\spuninst.exe"
    Suojauspäivitys Windows XP:lle (KB925902) --> "C:\WINDOWS\$NtUninstallKB925902$\spuninst\spuninst.exe"
    Suojauspäivitys Windows XP:lle (KB926255) --> "C:\WINDOWS\$NtUninstallKB926255$\spuninst\spuninst.exe"
    Suojauspäivitys Windows XP:lle (KB926436) --> "C:\WINDOWS\$NtUninstallKB926436$\spuninst\spuninst.exe"
    Suojauspäivitys Windows XP:lle (KB927779) --> "C:\WINDOWS\$NtUninstallKB927779$\spuninst\spuninst.exe"
    Suojauspäivitys Windows XP:lle (KB927802) --> "C:\WINDOWS\$NtUninstallKB927802$\spuninst\spuninst.exe"
    Suojauspäivitys Windows XP:lle (KB928255) --> "C:\WINDOWS\$NtUninstallKB928255$\spuninst\spuninst.exe"
    Suojauspäivitys Windows XP:lle (KB928843) --> "C:\WINDOWS\$NtUninstallKB928843$\spuninst\spuninst.exe"
    Suojauspäivitys Windows XP:lle (KB929123) --> "C:\WINDOWS\$NtUninstallKB929123$\spuninst\spuninst.exe"
    Suojauspäivitys Windows XP:lle (KB930178) --> "C:\WINDOWS\$NtUninstallKB930178$\spuninst\spuninst.exe"
    Suojauspäivitys Windows XP:lle (KB931261) --> "C:\WINDOWS\$NtUninstallKB931261$\spuninst\spuninst.exe"
    Suojauspäivitys Windows XP:lle (KB931784) --> "C:\WINDOWS\$NtUninstallKB931784$\spuninst\spuninst.exe"
    Suojauspäivitys Windows XP:lle (KB932168) --> "C:\WINDOWS\$NtUninstallKB932168$\spuninst\spuninst.exe"
    Suojauspäivitys Windows XP:lle (KB933729) --> "C:\WINDOWS\$NtUninstallKB933729$\spuninst\spuninst.exe"
    Suojauspäivitys Windows XP:lle (KB935839) --> "C:\WINDOWS\$NtUninstallKB935839$\spuninst\spuninst.exe"
    Suojauspäivitys Windows XP:lle (KB935840) --> "C:\WINDOWS\$NtUninstallKB935840$\spuninst\spuninst.exe"
    Suojauspäivitys Windows XP:lle (KB936021) --> "C:\WINDOWS\$NtUninstallKB936021$\spuninst\spuninst.exe"
    Suojauspäivitys Windows XP:lle (KB938829) --> "C:\WINDOWS\$NtUninstallKB938829$\spuninst\spuninst.exe"
    Suojauspäivitys Windows XP:lle (KB941202) --> "C:\WINDOWS\$NtUninstallKB941202$\spuninst\spuninst.exe"
    Suojauspäivitys Windows XP:lle (KB941568) --> "C:\WINDOWS\$NtUninstallKB941568$\spuninst\spuninst.exe"
    Suojauspäivitys Windows XP:lle (KB941644) --> "C:\WINDOWS\$NtUninstallKB941644$\spuninst\spuninst.exe"
    Suojauspäivitys Windows XP:lle (KB941693) --> "C:\WINDOWS\$NtUninstallKB941693$\spuninst\spuninst.exe"
    Suojauspäivitys Windows XP:lle (KB943055) --> "C:\WINDOWS\$NtUninstallKB943055$\spuninst\spuninst.exe"
    Suojauspäivitys Windows XP:lle (KB943460) --> "C:\WINDOWS\$NtUninstallKB943460$\spuninst\spuninst.exe"
    Suojauspäivitys Windows XP:lle (KB943485) --> "C:\WINDOWS\$NtUninstallKB943485$\spuninst\spuninst.exe"
    Suojauspäivitys Windows XP:lle (KB944653) --> "C:\WINDOWS\$NtUninstallKB944653$\spuninst\spuninst.exe"
    Suojauspäivitys Windows XP:lle (KB945553) --> "C:\WINDOWS\$NtUninstallKB945553$\spuninst\spuninst.exe"
    Suojauspäivitys Windows XP:lle (KB946026) --> "C:\WINDOWS\$NtUninstallKB946026$\spuninst\spuninst.exe"
    Suojauspäivitys Windows XP:lle (KB948590) --> "C:\WINDOWS\$NtUninstallKB948590$\spuninst\spuninst.exe"
    Suojauspäivitys Windows XP:lle (KB948881) --> "C:\WINDOWS\$NtUninstallKB948881$\spuninst\spuninst.exe"
    SuppSoft --> MsiExec.exe /I{022DA2C3-81C7-4003-A6BC-1BB147B20097}
    Symantec Technical Support Controls --> MsiExec.exe /I{92B1B3CC-EC78-45B8-96D0-8B3F11495864}
    SymNet --> MsiExec.exe /I{2DA85B02-13C0-4E6D-9A76-22E6B3DD0CB2}
    TVUPlayer 2.3.6.1 --> C:\Program Files\TVUPlayer\uninst.exe
    Unlocker 1.8.5 --> C:\Program Files\Unlocker\uninst.exe
    Warcraft III: All Products --> C:\WINDOWS\War3Unin.exe C:\WINDOWS\War3Unin.dat
    Winamp --> "C:\Program Files\Winamp\UninstWA.exe"
    Windows Live Messenger --> MsiExec.exe /I{DF6FEB75-A0D1-44E5-A754-0072D4967734}
    Windows Media Format 11 runtime --> "C:\WINDOWS\$NtUninstallWMFDist11$\spuninst\spuninst.exe"
    Windowsin ohjainpaketti - Nokia Modem (08/03/2007 6.84.0.2) --> C:\PROGRA~1\DIFX\270581355A767BF1\dpinst.exe /u C:\WINDOWS\system32\DRVSTORE\nokbtmdm_1EB5F2E6F54A6BEDE9F436D1BA5D830FC71739BE\nokbtmdm.inf
    Windowsin ohjainpaketti - Nokia Modem (10/12/2007 3.6) --> C:\PROGRA~1\DIFX\270581355A767BF1\dpinst.exe /u C:\WINDOWS\system32\DRVSTORE\nokia_blue_0A5D98F754C6588B2E3DDE89DDEF097075ADFFB7\nokia_bluetooth.inf
    WinRAR archiver --> C:\Program Files\WinRAR\uninstall.exe


    -- Application Event Log -------------------------------------------------------

    Event Record #/Type3589 / Success
    Event Submitted/Written: 04/30/2008 08:44:35 PM
    Event ID/Source: 12001 / usnjsvc
    Event Description:
    The Messenger Sharing USN Journal Reader service started successfully.

    Event Record #/Type3430 / Success
    Event Submitted/Written: 04/29/2008 06:28:36 PM
    Event ID/Source: 12001 / usnjsvc
    Event Description:
    The Messenger Sharing USN Journal Reader service started successfully.

    Event Record #/Type3397 / Success
    Event Submitted/Written: 04/29/2008 05:07:57 PM
    Event ID/Source: 12001 / usnjsvc
    Event Description:
    The Messenger Sharing USN Journal Reader service started successfully.

    Event Record #/Type3364 / Success
    Event Submitted/Written: 04/29/2008 03:45:39 PM
    Event ID/Source: 12001 / usnjsvc
    Event Description:
    The Messenger Sharing USN Journal Reader service started successfully.

    Event Record #/Type3313 / Success
    Event Submitted/Written: 04/29/2008 11:14:22 AM
    Event ID/Source: 12001 / usnjsvc
    Event Description:
    The Messenger Sharing USN Journal Reader service started successfully.



    -- Security Event Log ----------------------------------------------------------

    No Errors/Warnings found.


    -- System Event Log ------------------------------------------------------------

    Event Record #/Type82765 / Warning
    Event Submitted/Written: 04/30/2008 10:54:58 PM
    Event ID/Source: 4226 / Tcpip
    Event Description:
    TCP/IP saavutti yhtäaikaisille TCP-yhteysyrityksille asetetun suojausrajoituksen.

    Event Record #/Type82738 / Error
    Event Submitted/Written: 04/30/2008 10:39:23 PM
    Event ID/Source: 7000 / Service Control Manager
    Event Description:
    Palvelua Automattinen LiveUpdate-ajastustoiminto ei voi käynnistää. Virhekoodi on
    %%1053

    Event Record #/Type82737 / Error
    Event Submitted/Written: 04/30/2008 10:39:23 PM
    Event ID/Source: 7009 / Service Control Manager
    Event Description:
    Aikakatkaisu (30000 ms) odottaa palvelun Automattinen LiveUpdate-ajastustoiminto yhdistymistä.

    Event Record #/Type82733 / Error
    Event Submitted/Written: 04/30/2008 10:37:15 PM
    Event ID/Source: 10005 / DCOM
    Event Description:
    DCOM vastaanotti virheen "%%1084" yrittäessään käynnistää palvelun EventSystem argumenteilla ""
    suorittaakseen palvelinosan:
    {1BE1F766-5536-11D1-B726-00C04FB926AF}

    Event Record #/Type82730 / Error
    Event Submitted/Written: 04/30/2008 10:34:06 PM
    Event ID/Source: 7026 / Service Control Manager
    Event Description:
    Seuraava käynnistys- tai järjestelmäkäynnistysohjain ei latautunut:
    AmdK8
    eeCtrl
    Fips
    SPBBCDrv
    SRTSPX
    SYMTDI



    -- End of Deckard's System Scanner: finished at 2008-04-30 23:00:25 ------------
     
    Gybetius, Apr 30, 2008
    #11
  12. Hujo

    Hujo Guest

    Lataa Malwarebytes' Anti-Malware työpöydällesi.

    1. Tuplaklikkaa mbam-setup.exe ja seuraa ohjeita asentaaksesi ohjelman.
    2. Lopuksi varmistu, että seuraavat on valittu: Update Malwarebytes', Anti-Malwareja
    Launch Malwarebytes' Anti-Malware ja sen jälkeen klikkaaFinish.
    3. Jos päivitys löytyy. ohjelma lataa ja asentaa uusimman version.
    4. Kun ohjelma on latautunut, valitse Perform full scan ja klikkaa Scan.
    5. Kun skanni on valmis, klikkaa OK ja sitten Show Results nähdäksesi tulokset.
    6. Varmistu, että kaikki on merkitty ja klikkaa Remove Selected.
    7. Tämän jälkeen loki avautuu muistioon. Tallenna se paikkaan, josta löydät sen helposti. Loki
    löytyy myös täältä: C:\Documents and Settings\Käyttäjänimi\Application
    Data\Malwarebytes\Malwarebytes' Anti-Malware\Logs\log-päiväys.txt
    8. Lähetä lokin sisältö seuraavassa viestissäsi.

    ===============

    Lataa: RegSeeker.zip työpöydälle:

    Pura zip C:\RegSeeker\ kansioon. Sieltä käynnistät RegSeeker.exe ohjelman.
    Oikeasa yläkulmassa on Languages.... linkki, josta valitset Suomenkielen.
    Vasemmasta alakulmasta ruksit Luo vrmuuskopio ja sitten linkki Puhdista rekisteri
    Ruksit kaikkiin muihin kohtiin paitsi "Käyttökelvottomat.." sitten "OK" (odotat hetken).
    Ruutuun ilmestyy lista epäkelvoista rekisterimerkinnöistä, jotka alapalkista Valitse kohdasta
    klikkaat Valitse kaikki jolloin valitut saavat keltaisen pohjavärin.
    Alapalkin Toiminnot linkistä klikkaat Poista valitut kohteet
    Ponnahdusikkunaan "Kaikki valitut kohteet poistetaan ? vastaat "OK".
    Seuraavaan Ponnahdusikkunaan "Varmuuskopiot" vastaat "OK".
    Klikaa vasemmalta Lopeta RegSeeker ja käynnistä koneesi uudelleen.
     
    Hujo, Apr 30, 2008
    #12
  13. Gybetius

    Gybetius Member

    Joined:
    Mar 31, 2008
    Messages:
    19
    Likes Received:
    0
    Trophy Points:
    11
    Olikin sitten ihan jämäkkä scannaus. Jotain n.7h meni aikaa ja löysi 21 epäilyttävää tiedostoa jotka sai käsittääkseni poistettua.


    Malwarebytes' Anti-Malware 1.11
    Database version: 704

    Scan type: Full Scan (C:\|D:\|E:\|F:\|G:\|)
    Objects scanned: 148705
    Time elapsed: 7 hour(s), 17 minute(s), 58 second(s)

    Memory Processes Infected: 0
    Memory Modules Infected: 0
    Registry Keys Infected: 9
    Registry Values Infected: 0
    Registry Data Items Infected: 0
    Folders Infected: 2
    Files Infected: 18

    Memory Processes Infected:
    (No malicious items detected)

    Memory Modules Infected:
    (No malicious items detected)

    Registry Keys Infected:
    HKEY_CLASSES_ROOT\AppID\{f663b917-591f-4172-8d87-3d7d729007ca} (Adware.Batco) -> Quarantined and deleted successfully.
    HKEY_CLASSES_ROOT\Interface\{d279bc2b-a85b-4559-8fd9-ddc55f5d402d} (Adware.Batco) -> Quarantined and deleted successfully.
    HKEY_CLASSES_ROOT\Typelib\{b80a3586-caa5-41c8-89bf-e617f0b6cfbf} (Adware.Batco) -> Quarantined and deleted successfully.
    HKEY_CURRENT_USER\Software\BATCO (Adware.Batco) -> Quarantined and deleted successfully.
    HKEY_LOCAL_MACHINE\SOFTWARE\Batco (Adware.Batco) -> Quarantined and deleted successfully.
    HKEY_CLASSES_ROOT\AppID\bat.DLL (Adware.Batco) -> Quarantined and deleted successfully.
    HKEY_CURRENT_USER\Software\Microsoft\affri (Malware.Trace) -> Quarantined and deleted successfully.
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\affri (Malware.Trace) -> Quarantined and deleted successfully.
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\MS Juan (Malware.Trace) -> Quarantined and deleted successfully.

    Registry Values Infected:
    (No malicious items detected)

    Registry Data Items Infected:
    (No malicious items detected)

    Folders Infected:
    C:\Documents and Settings\All Users\Application Data\Rabio\Search Enhancer (Adware.SearchEnhancer) -> Quarantined and deleted successfully.
    C:\Documents and Settings\All Users\Application Data\Rabio (Adware.Rabio) -> Quarantined and deleted successfully.

    Files Infected:
    C:\System Volume Information\_restore{7BD41464-2CC7-4899-A278-DFE2F6B620D8}\RP522\A0193753.exe (Adware.Batco) -> Quarantined and deleted successfully.
    C:\System Volume Information\_restore{7BD41464-2CC7-4899-A278-DFE2F6B620D8}\RP522\A0193754.dll (Adware.Batco) -> Quarantined and deleted successfully.
    C:\System Volume Information\_restore{7BD41464-2CC7-4899-A278-DFE2F6B620D8}\RP524\A0196857.exe (Adware.Batco) -> Quarantined and deleted successfully.
    C:\System Volume Information\_restore{7BD41464-2CC7-4899-A278-DFE2F6B620D8}\RP530\A0201362.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
    C:\System Volume Information\_restore{7BD41464-2CC7-4899-A278-DFE2F6B620D8}\RP531\A0202380.exe (Adware.Rabio) -> Quarantined and deleted successfully.
    C:\System Volume Information\_restore{7BD41464-2CC7-4899-A278-DFE2F6B620D8}\RP531\A0202383.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
    C:\System Volume Information\_restore{7BD41464-2CC7-4899-A278-DFE2F6B620D8}\RP532\A0204433.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
    C:\System Volume Information\_restore{7BD41464-2CC7-4899-A278-DFE2F6B620D8}\RP532\A0204434.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
    C:\System Volume Information\_restore{7BD41464-2CC7-4899-A278-DFE2F6B620D8}\RP534\A0209653.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
    C:\System Volume Information\_restore{7BD41464-2CC7-4899-A278-DFE2F6B620D8}\RP534\A0209654.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
    C:\System Volume Information\_restore{7BD41464-2CC7-4899-A278-DFE2F6B620D8}\RP535\A0209657.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
    C:\System Volume Information\_restore{7BD41464-2CC7-4899-A278-DFE2F6B620D8}\RP537\A0211753.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
    C:\System Volume Information\_restore{7BD41464-2CC7-4899-A278-DFE2F6B620D8}\RP537\A0211757.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
    C:\System Volume Information\_restore{7BD41464-2CC7-4899-A278-DFE2F6B620D8}\RP539\A0212843.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
    C:\System Volume Information\_restore{7BD41464-2CC7-4899-A278-DFE2F6B620D8}\RP540\A0215886.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
    C:\System Volume Information\_restore{7BD41464-2CC7-4899-A278-DFE2F6B620D8}\RP540\A0215890.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
    C:\System Volume Information\_restore{7BD41464-2CC7-4899-A278-DFE2F6B620D8}\RP540\A0215891.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
    C:\System Volume Information\_restore{7BD41464-2CC7-4899-A278-DFE2F6B620D8}\RP540\A0215893.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
     
    Gybetius, May 1, 2008
    #13
  14. Hujo

    Hujo Guest

    1. Klikkaa käynnistä > Oma tietokone oikean puoleisella hiiren napilla
    2. Valitse ominaisuudet
    3. Valitse järjestelmän palauttaminen välilehti
    4. Ruksi eteen ¤ poista järjestelmän palauttaminen kaikissa asemissa
    5. Paina Käytä
    6. Paina ok
    7. Sammuta ja käynnistä
    8. Ota ruksi pois ¤ poista järjestelmän palauttaminen kaikissa asemissa
    9. Käytä ja OK
     
    Hujo, May 1, 2008
    #14
  15. Gybetius

    Gybetius Member

    Joined:
    Mar 31, 2008
    Messages:
    19
    Likes Received:
    0
    Trophy Points:
    11
    Tehty. Voisin lisätä, että ilmeisesti erehdyin aluksi ongelman suhteen... tietokonepelit näyttäisivät nykivän täsmälleen samalla tavalla kuin videot ja netti.
     
    Last edited: May 1, 2008
    Gybetius, May 1, 2008
    #15
  16. Hujo

    Hujo Guest

    Hujo, May 2, 2008
    #16
  17. Gybetius

    Gybetius Member

    Joined:
    Mar 31, 2008
    Messages:
    19
    Likes Received:
    0
    Trophy Points:
    11
    Keskusmuistia:

    Yhteensä 2558MB
    Käytössä 520MB
    Vapaana 2037MB
    Käyttöaste: 20%
     
    Gybetius, May 2, 2008
    #17
  18. Hujo

    Hujo Guest

    Ok....

    Tyhjennä tuo karanteeni
    C:\Documents and Settings\HP_Omistaja\.housecall6.6\Quarantine

    ==========

    Poista lisää poista sovelutuksesta

    AVG Anti-Spyware 7.5

    ==========

    Lataa SmitfraudFix (c) S!Ri
    Pura sisältö (kansio nimeltä SmitfraudFix) työpöydällesi:

    Avaa SmitfraudFix kansio ja tupla-klikkaa smitfraudfix.cmd
    Valitse optio #1 - Search kirjoittamalla 1 ja painamalla "Enter"; tekstitiedosto avautuu, joka listaa tarttuneet tiedostot (jos olemassa).
    Postita ponnahtava rapport – muistion sisältö viestiketjuusi.
    Löytyy myös C:\rapport.txt

    Huomaa : process.exe filun tunnistaa jotkut Anti-virus ohjelmat
    (AntiVir, Dr.Web, Kaspersky) "Haittakaluna"; se ei ole virus, vaan ohjelma joka pysäyttää prosesseja.
    A/V ohjelmat eivät pysty tunnistamaan hyvän ja pahan käytön tälläisten ohjelmian väliltä,
    silloin ne saattavat varoittaa käyttäjää.


     
    Hujo, May 2, 2008
    #18
  19. Gybetius

    Gybetius Member

    Joined:
    Mar 31, 2008
    Messages:
    19
    Likes Received:
    0
    Trophy Points:
    11
    SmitFraudFix v2.319

    Scan done at 14:11:54,87, pe 02.05.2008
    Run from C:\Documents and Settings\HP_Omistaja\Ty”p”yt„\SmitfraudFix
    OS: Microsoft Windows XP [versio 5.1.2600] - Windows_NT
    The filesystem type is NTFS
    Fix run in normal mode

    »»»»»»»»»»»»»»»»»»»»»»»» Process

    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\Ati2evxx.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\system32\Ati2evxx.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\Explorer.EXE
    C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
    C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
    C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
    C:\WINDOWS\system32\spoolsv.exe
    C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
    C:\Program Files\Bluetooth\Bluetooth-ohjelmisto\bin\btwdins.exe
    C:\WINDOWS\system32\HPZipm12.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\system32\ThreadMaster\ThreadMast.exe
    C:\Program Files\Common Files\Symantec Shared\ccApp.exe
    C:\WINDOWS\system32\LVCOMSX.EXE
    C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe
    C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
    C:\WINDOWS\system32\wuauclt.exe
    C:\Program Files\Mozilla Firefox\firefox.exe
    C:\Program Files\HP\Digital Imaging\bin\hpqSTE08.exe
    C:\Program Files\Common Files\Symantec Shared\VAScanner\comHost.exe
    C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
    C:\Program Files\Symantec\LiveUpdate\AUPDATE.EXE
    C:\Program Files\Symantec\LiveUpdate\LuCallbackProxy.exe
    C:\Program Files\Symantec\LiveUpdate\LuCallbackProxy.exe
    C:\Program Files\Symantec\LiveUpdate\LuCallbackProxy.exe
    C:\Program Files\Symantec\LiveUpdate\LuCallbackProxy.exe
    C:\Program Files\Symantec\LiveUpdate\LuCallbackProxy.exe
    C:\Program Files\Symantec\LiveUpdate\LuCallbackProxy.exe
    C:\Program Files\Symantec\LiveUpdate\LuCallbackProxy.exe
    C:\Program Files\Symantec\LiveUpdate\LuCallbackProxy.exe
    C:\Program Files\Symantec\LiveUpdate\LuCallbackProxy.exe
    C:\Program Files\Symantec\LiveUpdate\LuCallbackProxy.exe
    C:\WINDOWS\system32\cmd.exe

    »»»»»»»»»»»»»»»»»»»»»»»» hosts


    »»»»»»»»»»»»»»»»»»»»»»»» C:\


    »»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS


    »»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\system


    »»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\Web


    »»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\system32


    »»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\system32\LogFiles


    »»»»»»»»»»»»»»»»»»»»»»»» C:\Documents and Settings\HP_Omistaja


    »»»»»»»»»»»»»»»»»»»»»»»» C:\Documents and Settings\HP_Omistaja\Application Data


    »»»»»»»»»»»»»»»»»»»»»»»» Start Menu


    »»»»»»»»»»»»»»»»»»»»»»»» C:\DOCUME~1\HP_OMI~1\Suosikit


    »»»»»»»»»»»»»»»»»»»»»»»» Desktop


    »»»»»»»»»»»»»»»»»»»»»»»» C:\Program Files


    »»»»»»»»»»»»»»»»»»»»»»»» Corrupted keys


    »»»»»»»»»»»»»»»»»»»»»»»» Desktop Components

    [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Desktop\Components\0]
    "Source"="About:Home"
    "SubscribedURL"="About:Home"
    "FriendlyName"="Nykyinen kotisivu"


    »»»»»»»»»»»»»»»»»»»»»»»» IEDFix
    !!!Attention, following keys are not inevitably infected!!!

    IEDFix
    Credits: Malware Analysis & Diagnostic
    Code: S!Ri


    »»»»»»»»»»»»»»»»»»»»»»»» VACFix
    !!!Attention, following keys are not inevitably infected!!!

    VACFix
    Credits: Malware Analysis & Diagnostic
    Code: S!Ri


    »»»»»»»»»»»»»»»»»»»»»»»» 404Fix
    !!!Attention, following keys are not inevitably infected!!!

    404Fix
    Credits: Malware Analysis & Diagnostic
    Code: S!Ri


    »»»»»»»»»»»»»»»»»»»»»»»» Sharedtaskscheduler
    !!!Attention, following keys are not inevitably infected!!!

    SrchSTS.exe by S!Ri
    Search SharedTaskScheduler's .dll


    »»»»»»»»»»»»»»»»»»»»»»»» AppInit_DLLs
    !!!Attention, following keys are not inevitably infected!!!

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
    "AppInit_DLLs"=""


    »»»»»»»»»»»»»»»»»»»»»»»» Winlogon
    !!!Attention, following keys are not inevitably infected!!!

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon]
    "Userinit"="C:\\WINDOWS\\system32\\userinit.exe,"
    "System"=""


    »»»»»»»»»»»»»»»»»»»»»»»» Rustock



    »»»»»»»»»»»»»»»»»»»»»»»» DNS

    Description: Realtek RTL8139/810x Family Fast Ethernet NIC - Paketinajoituksen miniportti
    DNS Server Search Order: 16.92.3.242
    DNS Server Search Order: 16.92.3.243
    DNS Server Search Order: 16.81.3.243
    DNS Server Search Order: 16.114.3.243

    Description: Realtek RTL8139/810x Family Fast Ethernet NIC - Paketinajoituksen miniportti
    DNS Server Search Order: 192.168.0.254

    HKLM\SYSTEM\CCS\Services\Tcpip\..\{A213E28B-96CF-4BCB-863B-B3C4EE32CB43}: DhcpNameServer=16.92.3.242 16.92.3.243 16.81.3.243 16.114.3.243
    HKLM\SYSTEM\CCS\Services\Tcpip\..\{B7F85E39-40BB-49AC-8A88-B93D6425CA15}: DhcpNameServer=192.168.0.254
    HKLM\SYSTEM\CS1\Services\Tcpip\..\{A213E28B-96CF-4BCB-863B-B3C4EE32CB43}: DhcpNameServer=16.92.3.242 16.92.3.243 16.81.3.243 16.114.3.243
    HKLM\SYSTEM\CS1\Services\Tcpip\..\{B7F85E39-40BB-49AC-8A88-B93D6425CA15}: DhcpNameServer=192.168.0.254
    HKLM\SYSTEM\CS3\Services\Tcpip\..\{A213E28B-96CF-4BCB-863B-B3C4EE32CB43}: DhcpNameServer=16.92.3.242 16.92.3.243 16.81.3.243 16.114.3.243
    HKLM\SYSTEM\CS3\Services\Tcpip\..\{B7F85E39-40BB-49AC-8A88-B93D6425CA15}: DhcpNameServer=192.168.0.254
    HKLM\SYSTEM\CCS\Services\Tcpip\Parameters: DhcpNameServer=192.168.0.254
    HKLM\SYSTEM\CS1\Services\Tcpip\Parameters: DhcpNameServer=192.168.0.254
    HKLM\SYSTEM\CS3\Services\Tcpip\Parameters: DhcpNameServer=192.168.0.254


    »»»»»»»»»»»»»»»»»»»»»»»» Scanning for wininet.dll infection


    »»»»»»»»»»»»»»»»»»»»»»»» End

     
    Gybetius, May 2, 2008
    #19
  20. Hujo

    Hujo Guest

    Lataa Dr.Web CureIt työpöydälle:

    Tuplaklikkaa drweb-cureit.exe ja anna sen tehdä express scan
    Se skannaa käynnissä olevat ohjelmat ja jos jotain löytyy, klikkaa yes kun se kysyy haluatko poistaa sen. Tämä on vain lyhyt scan.
    Kun scan on valmis, Klikkaa Custom scan merkkaa asemat, jotka haluat scannata.
    Valitse kaikki asemat. Punainen piste osoittaa, mitkä asemat on valittu.
    Klikaa vihreää nuolta oikealla ja scan alkaa.
    Klikkaa 'Yes to all', jos kysytään haluatko poistaa/siirtää tiedoston.
    Kun scan on valmis, katso voitko klikata next-kuvaketta löytyneiden tiedostojen vieressä: [​IMG]
    Jos asia on niin, klikkaa sitä ja sitten klikkaa next-kuvaketta oikealla alhaalla ja valitse Move incurable kuten alla olevalla kuvassa:
    [​IMG]
    Tämä siirtää sen %userprofile%\DoctorWeb\quarantine-hakemistoon.
    Tämän jälkeen klikkaa Dr.Web CureIt-valikossa file ja valitse save report list
    Tallenna raportti työpöydälle. Raportin nimi on DrWeb.csv
    Sulje Dr.Web Cureit.
    Käynnistä kone uudelleen !! Tämä siksi, että käytössä olevat tiedostot poistetaan/siirretään käynnistyksen yhteydessä.
    Käynnistyksen jälkeen liitä Dr.Web-lokin, jonka tallensit aiemmin, sisältö seuraavaan vastaukseesi.
     
    Hujo, May 2, 2008
    #20
Page 1 of 2

Share This Page