Voisko joku vilkasta hjt logia Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 16:54:20, on 20.2.2008 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\Ati2evxx.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\System32\wltrysvc.exe C:\WINDOWS\System32\bcmwltry.exe C:\WINDOWS\system32\spoolsv.exe C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe C:\PROGRA~1\F-Secure\BackWeb\7681197\Program\SERVIC~1.EXE C:\Program Files\F-Secure\Anti-Virus\fsgk32st.exe C:\Program Files\F-Secure\BackWeb\7681197\program\fsbwsys.exe C:\Program Files\F-Secure\Anti-Virus\FSGK32.EXE C:\Program Files\F-Secure\Common\FSMA32.EXE C:\Program Files\F-Secure\Anti-Virus\fssm32.exe C:\Program Files\F-Secure\Common\FSMB32.EXE C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\Ati2evxx.exe C:\Program Files\F-Secure\Common\FCH32.EXE C:\Program Files\F-Secure\Common\FAMEH32.EXE C:\WINDOWS\Explorer.EXE C:\Program Files\F-Secure\Common\FNRB32.EXE C:\Program Files\F-Secure\FWES\Program\fsdfwd.exe C:\Program Files\F-Secure\Common\FIH32.EXE C:\Program Files\Synaptics\SynTP\SynTPLpr.exe C:\Program Files\Synaptics\SynTP\SynTPEnh.exe C:\WINDOWS\system32\WLTRAY.exe C:\WINDOWS\SOUNDMAN.EXE C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe C:\Program Files\Launch Manager\LaunchAp.exe C:\Program Files\Launch Manager\PowerKey.exe C:\Program Files\Launch Manager\HotkeyApp.exe C:\Program Files\Launch Manager\CtrlVol.exe C:\Program Files\Launch Manager\OSDCtrl.exe C:\Program Files\Launch Manager\Wbutton.exe C:\Program Files\Arcade\PCMService.exe C:\Program Files\F-Secure\Common\FSM32.EXE C:\Program Files\QuickTime\qttask.exe C:\Program Files\RF Wireless Mouse\cm20.exe C:\Program Files\Common Files\Real\Update_OB\realsched.exe C:\Program Files\Ahead\InCD\InCD.exe C:\Program Files\HP\HP Software Update\HPWuSchd2.exe C:\PROGRA~1\Nokia\NOKIAP~1\LAUNCH~1.EXE C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe C:\Program Files\HP\hpcoretech\hpcmpmgr.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\Winamp\winampa.exe C:\Program Files\F-Secure\Anti-Virus\fsav32.exe C:\WINDOWS\system32\ctfmon.exe C:\Program Files\acer\eRecovery\Monitor.exe C:\Program Files\Messenger\msmsgs.exe C:\Program Files\F-Secure\BackWeb\7681197\Program\F-Secure Automatic Update.exe C:\Program Files\Microsoft ActiveSync\WCESCOMM.EXE C:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe C:\Program Files\Common Files\PCSuite\Services\ServiceLayer.exe C:\Program Files\Winamp Remote\bin\OrbTray.exe C:\Program Files\F-Secure\FSGUI\fsguiexe.exe C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe C:\PROGRA~1\COMMON~1\Nokia\MPAPI\MPAPI3s.exe C:\WINDOWS\Twain_32\CA561A\SnapDetect.exe C:\PROGRA~1\Yahoo!\MESSEN~1\ymsgr_tray.exe C:\Program Files\HP\Digital Imaging\bin\hpqgalry.exe C:\Program Files\Internet Explorer\IEXPLORE.EXE C:\Program Files\Internet Explorer\IEXPLORE.EXE C:\Documents and Settings\LASZLO\Local Settings\Temporary Internet Files\Content.IE5\YTDU7M5W\HiJackThis_v2.0.2[1].exe R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://us.rd.yahoo.com/customize/ie/defaults/sb/msgr8/*http://www.yahoo.com/ext/search/search.html R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://us.rd.yahoo.com/customize/ie/defaults/sp/msgr8/*http://www.yahoo.com R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.fi/ R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.yahoo.com/ R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://us.rd.yahoo.com/customize/ie/defaults/su/msgr8/*http://www.yahoo.com R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://us.rd.yahoo.com/customize/ie/defaults/sb/msgr8/*http://www.yahoo.com/ext/search/search.html R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://us.rd.yahoo.com/customize/ie/defaults/sp/msgr8/*http://www.yahoo.com R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/ R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://us.rd.yahoo.com/customize/ie/defaults/su/msgr8/*http://www.yahoo.com R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Microsoft Internet Explorer - toimittaja Sonera Internet R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Linkit R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\PROGRA~1\YAHOO!\Companion\Installs\cpn0\yt.dll O2 - BHO: &Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\PROGRA~1\YAHOO!\Companion\Installs\cpn0\yt.dll O2 - BHO: Adobe PDF Reader -linkkiavustaja - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll O2 - BHO: Yahoo! IE Services Button - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file) O2 - BHO: ST - {9394EDE7-C8B5-483E-8773-474BF36AF6E4} - C:\Program Files\MSN Apps\ST\01.03.0000.1005\en-xu\stmain.dll O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll O2 - BHO: MSNToolBandBHO - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Apps\MSN Toolbar\MSN Toolbar\01.02.5000.1021\fi\msntb.dll O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\PROGRA~1\YAHOO!\Companion\Installs\cpn0\yt.dll O4 - HKLM\..\Run: [preload] C:\Windows\RUNXMLPL.exe O4 - HKLM\..\Run: [SynTPLpr] C:\Program Files\Synaptics\SynTP\SynTPLpr.exe O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe O4 - HKLM\..\Run: [Broadcom Wireless Manager UI] C:\WINDOWS\system32\WLTRAY O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe O4 - HKLM\..\Run: [LaunchAp] C:\Program Files\Launch Manager\LaunchAp.exe O4 - HKLM\..\Run: [PowerKey] "C:\Program Files\Launch Manager\PowerKey.exe" O4 - HKLM\..\Run: [LManager] C:\Program Files\Launch Manager\HotkeyApp.exe O4 - HKLM\..\Run: [CtrlVol] C:\Program Files\Launch Manager\CtrlVol.exe O4 - HKLM\..\Run: [LMgrOSD] C:\Program Files\Launch Manager\OSDCtrl.exe O4 - HKLM\..\Run: [Wbutton] "C:\Program Files\Launch Manager\Wbutton.exe" O4 - HKLM\..\Run: [PCMService] "C:\Program Files\Arcade\PCMService.exe" O4 - HKLM\..\Run: [eRecoveryService] C:\Windows\System32\Check.exe O4 - HKLM\..\Run: [F-Secure Manager] "C:\Program Files\F-Secure\Common\FSM32.EXE" /splash O4 - HKLM\..\Run: [F-Secure TNB] "C:\Program Files\F-Secure\TNB\TNBUtil.exe" /CHECKALL /WAITFORSW O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime O4 - HKLM\..\Run: [Start RF Wireless Mouse] C:\Program Files\RF Wireless Mouse\cm20.exe O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot O4 - HKLM\..\Run: [NeroCheck] C:\WINDOWS\system32\NeroCheck.exe O4 - HKLM\..\Run: [InCD] C:\Program Files\Ahead\InCD\InCD.exe O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe O4 - HKLM\..\Run: [PCSuiteTrayApplication] C:\PROGRA~1\Nokia\NOKIAP~1\LAUNCH~1.EXE -startup O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe" O4 - HKLM\..\Run: [HP Component Manager] "C:\Program Files\HP\hpcoretech\hpcmpmgr.exe" O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" O4 - HKLM\..\Run: [WinampAgent] C:\Program Files\Winamp\winampa.exe O4 - HKLM\..\Run: [Windows Internet Manager] svchost.exe O4 - HKLM\..\Run: [Windows Services Manager] svchost.exe O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background O4 - HKCU\..\Run: [H/PC Connection Agent] "C:\Program Files\Microsoft ActiveSync\WCESCOMM.EXE" O4 - HKCU\..\Run: [PcSync] C:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe /NoDialog O4 - HKCU\..\Run: [Yahoo! Pager] "C:\PROGRA~1\Yahoo!\MESSEN~1\YAHOOM~1.EXE" -quiet O4 - HKCU\..\Run: [Orb] "C:\Program Files\Winamp Remote\bin\OrbTray.exe" /background O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Paikallinen palve') O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Verkkopalve') O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM') O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user') O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe O4 - Global Startup: HP Image Zone -pikakäynnistys.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqthb08.exe O4 - Global Startup: SnapDetect.lnk = ? O8 - Extra context menu item: &Google Search - res://c:\program files\google\GoogleToolbar2.dll/cmsearch.html O8 - Extra context menu item: &Translate English Word - res://c:\program files\google\GoogleToolbar2.dll/cmwordtrans.html O8 - Extra context menu item: Backward Links - res://c:\program files\google\GoogleToolbar2.dll/cmbacklinks.html O8 - Extra context menu item: Cached Snapshot of Page - res://c:\program files\google\GoogleToolbar2.dll/cmcache.html O8 - Extra context menu item: Similar Pages - res://c:\program files\google\GoogleToolbar2.dll/cmsimilar.html O8 - Extra context menu item: Translate Page into English - res://c:\program files\google\GoogleToolbar2.dll/cmtrans.html O8 - Extra context menu item: Vie Microsoft E&xceliin - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000 O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll O9 - Extra button: Matkaviestimen suosikkien luominen - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - C:\Program Files\Microsoft ActiveSync\inetrepl.dll O9 - Extra button: (no name) - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\Program Files\Microsoft ActiveSync\inetrepl.dll O9 - Extra 'Tools' menuitem: Matkaviestimen suosikkien luominen... - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\Program Files\Microsoft ActiveSync\inetrepl.dll O9 - Extra button: Yahoo! Services - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O14 - IERESET.INF: START_PAGE_URL=http://www.soneraplaza.fi O16 - DPF: {00B71CFB-6864-4346-A978-C0A14556272C} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab31267.cab O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (Installation Support) - C:\Program Files\Yahoo!\Common\Yinsthelper.dll O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsClient.cab31267.cab O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/msnmessengersetupdownloader.cab O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL O23 - Service: Notebook Manager Service (anbmService) - OSA Technologies Inc. - C:\Acer\eManager\anbmServ.exe O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe O23 - Service: AVG Anti-Spyware Guard - Anti-Malware Development a.s. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe O23 - Service: F-Secure Automatic Update (BackWeb Plug-in - 7681197) - Unknown owner - C:\PROGRA~1\F-Secure\BackWeb\7681197\Program\SERVIC~1.EXE O23 - Service: F-Secure Gatekeeper Handler Starter - F-Secure Corp. - C:\Program Files\F-Secure\Anti-Virus\fsgk32st.exe O23 - Service: F-Secure Network Request Broker - F-Secure Corporation - C:\Program Files\F-Secure\Common\FNRB32.EXE O23 - Service: fsbwsys - F-Secure Corp. - C:\Program Files\F-Secure\BackWeb\7681197\program\fsbwsys.exe O23 - Service: F-Secure Anti-Virus Firewall Daemon (FSDFWD) - F-Secure Corporation - C:\Program Files\F-Secure\FWES\Program\fsdfwd.exe O23 - Service: F-Secure Management Agent (FSMA) - F-Secure Corporation - C:\Program Files\F-Secure\Common\FSMA32.EXE O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe O23 - Service: ServiceLayer - Nokia. - C:\Program Files\Common Files\PCSuite\Services\ServiceLayer.exe O23 - Service: Broadcom Wireless LAN Tray Service (wltrysvc) - Unknown owner - C:\WINDOWS\System32\wltrysvc.exe -- End of file - 13382 bytes
Lataa SDFix by AndyManchesta ja tallenna se työpöydällesi. Käynnistä koneesi vikasietotilaan: sammuta ja käynnistä käynnistyksen yhteydessä hakkaa F8 nappia valitse nuolinäppäimellä vikasietotila paina enter ja enter valitse käyttäjätilisi paina kyllä Jossakin koneissa hakataan F8:sin sijasta F5:tä " Kun vikasietotilassa, pura tiedoston SDFix.zip sisältö (SDFix kansio) työpöydällesi. Työpöydälle pitäisi ilmestyä kansio nimeltä SDFix. " Avaa SDFix-kansio ja tuplaklikkaa tiedostoa RunThis.bat käynnistääksesi ohjelman. " Paina Y käynnistääksesi skriptin. " Työkalu puhdistaa troijalaisen palvelut ja tekee myös joitakin korjauksia rekisteriin. Lopuksi se pyytää käynnistämään koneen uudelleen, "Press any key to Reboot". " Paina mitä tahansa näppäintä ja kone käynnistyy uudelleen. " Käynnistyminen kestää normaalia kauemmin sillä SDFix puhdistaa konetta. " Kun kone on käynnistynyt ja työpöytä latautunut, SDFix kertoo että puhdistus on suoritettu, "Finished". " Paina sitten mitä tahansa näppäintä sulkeaksesi skriptin ja ladataksesi pikakuvakkeet työpöydälle. " Lopuksi avaa SDFix kansio (työpöydällä) ja kopioi & liitä tiedoston Report.txt sisältö viestiketjuusi uuden HijackThis:n lokin kera.
SDfix raportti ja hjt-logi SDFix: Version 1.149 Run by LASZLO on pe 29.02.2008 at 18:30 Microsoft Windows XP [versio 5.1.2600] Running From: C:\Documents and Settings\LASZLO\Ty”p”yt„\SDFix Checking Services : Restoring Windows Registry Values Restoring Windows Default Hosts File Rebooting Checking Files : Trojan Files Found: C:\Program Files\Accoona\tbquiesce.exe - Deleted C:\WINDOWS\svchost.exe - Deleted Folder C:\Program Files\Accoona - Removed Removing Temp Files ADS Check : Final Check : catchme 0.3.1344.2 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2008-02-29 18:43:13 Windows 5.1.2600 Service Pack 2 FAT NTAPI scanning hidden processes ... scanning hidden services ... scanning hidden autostart entries ... scanning hidden files ... scan completed successfully hidden processes: 0 hidden services: 0 hidden files: 0 Remaining Services : Authorized Application Key Export: [HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list] "%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabledxpsp2res.dll,-22019" "C:\\Program Files\\F-Secure\\BackWeb\\7681197\\program\\F-Secure Automatic Update.exe"="C:\\Program Files\\F-Secure\\BackWeb\\7681197\\program\\F-Secure Automatic Update.exe:*:Enabled:F-Secure Automatic Update" "C:\\Program Files\\Messenger\\msmsgs.exe"="C:\\Program Files\\Messenger\\msmsgs.exe:*:Enabled:Windows Messenger" "C:\\Program Files\\Microsoft ActiveSync\\wcescomm.exe"="C:\\Program Files\\Microsoft ActiveSync\\wcescomm.exe:*:Enabled:ActiveSync Connection Manager" "C:\\Program Files\\Microsoft ActiveSync\\WCESMgr.exe"="C:\\Program Files\\Microsoft ActiveSync\\WCESMgr.exe:*:Enabled:ActiveSync Application" "C:\\Program Files\\MSN Messenger\\msnmsgr.exe"="C:\\Program Files\\MSN Messenger\\msnmsgr.exe:*:Enabled:Windows Live Messenger 8.1" "C:\\Program Files\\MSN Messenger\\livecall.exe"="C:\\Program Files\\MSN Messenger\\livecall.exe:*:Enabled:Windows Live Messenger 8.1 (Phone)" "C:\\Program Files\\Skype\\Phone\\Skype.exe"="C:\\Program Files\\Skype\\Phone\\Skype.exe:*:Enabled:Skype" "C:\\Program Files\\Yahoo!\\Messenger\\YahooMessenger.exe"="C:\\Program Files\\Yahoo!\\Messenger\\YahooMessenger.exe:*:Enabled:Yahoo! Messenger" "C:\\Program Files\\Yahoo!\\Messenger\\YServer.exe"="C:\\Program Files\\Yahoo!\\Messenger\\YServer.exe:*:Enabled:Yahoo! FT Server" "C:\\Program Files\\Winamp Remote\\bin\\Orb.exe"="C:\\Program Files\\Winamp Remote\\bin\\Orb.exe:*:Enabled:Orb" "C:\\Program Files\\Winamp Remote\\bin\\OrbTray.exe"="C:\\Program Files\\Winamp Remote\\bin\\OrbTray.exe:*:Enabled:OrbTray" "C:\\Program Files\\Winamp Remote\\bin\\OrbStreamerClient.exe"="C:\\Program Files\\Winamp Remote\\bin\\OrbStreamerClient.exe:*:Enabled:Orb Stream Client" [HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list] "%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabledxpsp2res.dll,-22019" "C:\\Program Files\\MSN Messenger\\msnmsgr.exe"="C:\\Program Files\\MSN Messenger\\msnmsgr.exe:*:Enabled:Windows Live Messenger 8.1" "C:\\Program Files\\MSN Messenger\\livecall.exe"="C:\\Program Files\\MSN Messenger\\livecall.exe:*:Enabled:Windows Live Messenger 8.1 (Phone)" Remaining Files : File Backups: - C:\DOCUME~1\LASZLO\Ty”p”yt„\SDFix\backups\backups.zip Files with Hidden Attributes : Wed 13 Apr 2005 1,024 ...HR --- "C:\WINDOWS\system32\NTICDMK7.dll" Wed 13 Apr 2005 1,024 ...HR --- "C:\WINDOWS\system32\NTIMPEG2.dll" Wed 13 Apr 2005 1,024 ...HR --- "C:\WINDOWS\system32\NTIMP3.dll" Wed 13 Apr 2005 1,024 ...HR --- "C:\WINDOWS\system32\NTIFCD3.dll" Wed 13 Apr 2005 1,024 ...HR --- "C:\WINDOWS\system32\NTIBUN4.dll" Wed 3 May 2006 163,328 ..SHR --- "C:\WINDOWS\system32\flvDX.dll" Tue 30 May 2006 4,348 ..SH. --- "C:\Documents and Settings\All Users\DRM\DRMv1.bak" Sun 21 Jan 2007 72,704 ..SHR --- "C:\Program Files\eRightSoft\SUPER\Setup.exe" Sun 26 Jun 2005 616,448 ..SHR --- "C:\Program Files\eRightSoft\SUPER\cygwin1.dll" Tue 21 Jun 2005 45,568 ..SHR --- "C:\Program Files\eRightSoft\SUPER\cygz.dll" Fri 27 Oct 2006 16,384 A.SHR --- "C:\Program Files\eRightSoft\SUPER\_Setup.dll" Wed 23 Jan 2008 0 A..H. --- "C:\WINDOWS\SoftwareDistribution\Download\f7db876e78b88fd8276fd7d29cb7e4eb\BIT153.tmp" Thu 15 Nov 2007 0 A..H. --- "C:\WINDOWS\SoftwareDistribution\Download\28daf2e1f8ef97b772dfdbad9c3d0bd9\BITF.tmp" Sun 18 Nov 2007 0 A.SH. --- "C:\Documents and Settings\All Users\DRM\Cache\Indiv01.tmp" Sat 1 Dec 2007 0 A.SH. --- "C:\Documents and Settings\All Users\DRM\Cache\Indiv02.tmp" Tue 4 Jun 2002 84,992 ...HR --- "C:\Program Files\eRightSoft\SUPER\mencoder\14_43260.dll" Tue 4 Jun 2002 44,032 ...HR --- "C:\Program Files\eRightSoft\SUPER\mencoder\28_83260.dll" Tue 10 Dec 2002 73,766 ...HR --- "C:\Program Files\eRightSoft\SUPER\mencoder\atrc3260.dll" Tue 10 Dec 2002 65,575 ...HR --- "C:\Program Files\eRightSoft\SUPER\mencoder\cook3260.dll" Sun 9 Jun 2002 36,864 ...HR --- "C:\Program Files\eRightSoft\SUPER\mencoder\ddnt3260.dll" Tue 4 Jun 2002 20,480 ...HR --- "C:\Program Files\eRightSoft\SUPER\mencoder\dnet3260.dll" Tue 10 Dec 2002 102,437 ...HR --- "C:\Program Files\eRightSoft\SUPER\mencoder\drv13260.dll" Tue 10 Dec 2002 176,165 ...HR --- "C:\Program Files\eRightSoft\SUPER\mencoder\drv23260.dll" Tue 10 Dec 2002 208,935 ...HR --- "C:\Program Files\eRightSoft\SUPER\mencoder\drv33260.dll" Tue 10 Dec 2002 217,127 ...HR --- "C:\Program Files\eRightSoft\SUPER\mencoder\drv43260.dll" Sun 9 Jun 2002 40,448 ...HR --- "C:\Program Files\eRightSoft\SUPER\mencoder\dspr3260.dll" Sun 4 Nov 2001 225,280 ...HR --- "C:\Program Files\eRightSoft\SUPER\mencoder\ivvideo.dll" Tue 10 Apr 2001 225,280 ...HR --- "C:\Program Files\eRightSoft\SUPER\mencoder\qtmlClient.dll" Fri 20 Feb 2004 232,960 ...HR --- "C:\Program Files\eRightSoft\SUPER\mencoder\raac.dll" Sun 9 Jun 2002 525,824 ...HR --- "C:\Program Files\eRightSoft\SUPER\mencoder\rnco3260.dll" Tue 10 Dec 2002 245,805 ...HR --- "C:\Program Files\eRightSoft\SUPER\mencoder\rnlt3260.dll" Tue 10 Dec 2002 45,093 ...HR --- "C:\Program Files\eRightSoft\SUPER\mencoder\rv103260.dll" Tue 10 Dec 2002 98,341 ...HR --- "C:\Program Files\eRightSoft\SUPER\mencoder\rv203260.dll" Tue 10 Dec 2002 94,247 ...HR --- "C:\Program Files\eRightSoft\SUPER\mencoder\rv303260.dll" Tue 10 Dec 2002 90,151 ...HR --- "C:\Program Files\eRightSoft\SUPER\mencoder\rv403260.dll" Tue 10 Dec 2002 102,439 ...HR --- "C:\Program Files\eRightSoft\SUPER\mencoder\sipr3260.dll" Sun 9 Jun 2002 49,152 ...HR --- "C:\Program Files\eRightSoft\SUPER\mencoder\tokr3260.dll" Sat 23 Apr 2005 511,424 A..H. --- "C:\Documents and Settings\LASZLO\Ty”p”yt„\Garmin_Mapsource_Finland_Topo-kartat\Garmin_Mapsource_Finland_Topo-kartat\Topo_cd_18\40Comupd.exe" Sat 23 Apr 2005 168,448 A..H. --- "C:\Documents and Settings\LASZLO\Ty”p”yt„\Garmin_Mapsource_Finland_Topo-kartat\Garmin_Mapsource_Finland_Topo-kartat\Topo_cd_18\Setup.exe" Sat 23 Apr 2005 118,784 A..H. --- "C:\Documents and Settings\LASZLO\Ty”p”yt„\Garmin_Mapsource_Finland_Topo-kartat\Garmin_Mapsource_Finland_Topo-kartat\Topo_cd_18\autorun.exe" Sat 23 Apr 2005 511,424 A..H. --- "C:\Documents and Settings\LASZLO\Ty”p”yt„\Garmin_Mapsource_Finland_Topo-kartat\Garmin_Mapsource_Finland_Topo-kartat\Topo_cd_17\40Comupd.exe" Sat 23 Apr 2005 168,448 A..H. --- "C:\Documents and Settings\LASZLO\Ty”p”yt„\Garmin_Mapsource_Finland_Topo-kartat\Garmin_Mapsource_Finland_Topo-kartat\Topo_cd_17\Setup.exe" Sat 23 Apr 2005 118,784 A..H. --- "C:\Documents and Settings\LASZLO\Ty”p”yt„\Garmin_Mapsource_Finland_Topo-kartat\Garmin_Mapsource_Finland_Topo-kartat\Topo_cd_17\autorun.exe" Sat 23 Apr 2005 1,162,240 A..H. --- "C:\Documents and Settings\LASZLO\Ty”p”yt„\Garmin_Mapsource_Finland_Topo-kartat\Garmin_Mapsource_Finland_Topo-kartat\Topo_cd_16\Setup.exe" Sat 23 Apr 2005 1,162,240 A..H. --- "C:\Documents and Settings\LASZLO\Ty”p”yt„\Garmin_Mapsource_Finland_Topo-kartat\Garmin_Mapsource_Finland_Topo-kartat\Topo_cd_16\Setup_original.exe" Sat 23 Apr 2005 28,672 A..H. --- "C:\Documents and Settings\LASZLO\Ty”p”yt„\Garmin_Mapsource_Finland_Topo-kartat\Garmin_Mapsource_Finland_Topo-kartat\Topo_cd_16\USBPort.dll" Sat 23 Apr 2005 511,424 A..H. --- "C:\Documents and Settings\LASZLO\Ty”p”yt„\Garmin_Mapsource_Finland_Topo-kartat\Garmin_Mapsource_Finland_Topo-kartat\Topo_cd_15\40Comupd.exe" Sat 23 Apr 2005 168,448 A..H. --- "C:\Documents and Settings\LASZLO\Ty”p”yt„\Garmin_Mapsource_Finland_Topo-kartat\Garmin_Mapsource_Finland_Topo-kartat\Topo_cd_15\Setup.exe" Sat 23 Apr 2005 118,784 A..H. --- "C:\Documents and Settings\LASZLO\Ty”p”yt„\Garmin_Mapsource_Finland_Topo-kartat\Garmin_Mapsource_Finland_Topo-kartat\Topo_cd_15\autorun.exe" Sat 23 Apr 2005 511,424 A..H. --- "C:\Documents and Settings\LASZLO\Ty”p”yt„\Garmin_Mapsource_Finland_Topo-kartat\Garmin_Mapsource_Finland_Topo-kartat\Topo_cd_14\40Comupd.exe" Sat 23 Apr 2005 168,448 A..H. --- "C:\Documents and Settings\LASZLO\Ty”p”yt„\Garmin_Mapsource_Finland_Topo-kartat\Garmin_Mapsource_Finland_Topo-kartat\Topo_cd_14\Setup.exe" Sat 23 Apr 2005 118,784 A..H. --- "C:\Documents and Settings\LASZLO\Ty”p”yt„\Garmin_Mapsource_Finland_Topo-kartat\Garmin_Mapsource_Finland_Topo-kartat\Topo_cd_14\autorun.exe" Sat 23 Apr 2005 511,424 A..H. --- "C:\Documents and Settings\LASZLO\Ty”p”yt„\Garmin_Mapsource_Finland_Topo-kartat\Garmin_Mapsource_Finland_Topo-kartat\Topo_9\40Comupd.exe" Sat 23 Apr 2005 168,448 A..H. --- "C:\Documents and Settings\LASZLO\Ty”p”yt„\Garmin_Mapsource_Finland_Topo-kartat\Garmin_Mapsource_Finland_Topo-kartat\Topo_9\Setup.exe" Sat 23 Apr 2005 118,784 A..H. --- "C:\Documents and Settings\LASZLO\Ty”p”yt„\Garmin_Mapsource_Finland_Topo-kartat\Garmin_Mapsource_Finland_Topo-kartat\Topo_9\autorun.exe" Sat 23 Apr 2005 511,424 A..H. --- "C:\Documents and Settings\LASZLO\Ty”p”yt„\Garmin_Mapsource_Finland_Topo-kartat\Garmin_Mapsource_Finland_Topo-kartat\Topo_8\40Comupd.exe" Sat 23 Apr 2005 168,448 A..H. --- "C:\Documents and Settings\LASZLO\Ty”p”yt„\Garmin_Mapsource_Finland_Topo-kartat\Garmin_Mapsource_Finland_Topo-kartat\Topo_8\Setup.exe" Sat 23 Apr 2005 118,784 A..H. --- "C:\Documents and Settings\LASZLO\Ty”p”yt„\Garmin_Mapsource_Finland_Topo-kartat\Garmin_Mapsource_Finland_Topo-kartat\Topo_8\autorun.exe" Sat 23 Apr 2005 511,424 A..H. --- "C:\Documents and Settings\LASZLO\Ty”p”yt„\Garmin_Mapsource_Finland_Topo-kartat\Garmin_Mapsource_Finland_Topo-kartat\Topo_7\40Comupd.exe" Sat 23 Apr 2005 168,448 A..H. --- "C:\Documents and Settings\LASZLO\Ty”p”yt„\Garmin_Mapsource_Finland_Topo-kartat\Garmin_Mapsource_Finland_Topo-kartat\Topo_7\Setup.exe" Sat 23 Apr 2005 118,784 A..H. --- "C:\Documents and Settings\LASZLO\Ty”p”yt„\Garmin_Mapsource_Finland_Topo-kartat\Garmin_Mapsource_Finland_Topo-kartat\Topo_7\autorun.exe" Sat 23 Apr 2005 511,424 A..H. --- "C:\Documents and Settings\LASZLO\Ty”p”yt„\Garmin_Mapsource_Finland_Topo-kartat\Garmin_Mapsource_Finland_Topo-kartat\Topo_6\40Comupd.exe" Sat 23 Apr 2005 168,448 A..H. --- "C:\Documents and Settings\LASZLO\Ty”p”yt„\Garmin_Mapsource_Finland_Topo-kartat\Garmin_Mapsource_Finland_Topo-kartat\Topo_6\Setup.exe" Sat 23 Apr 2005 118,784 A..H. --- "C:\Documents and Settings\LASZLO\Ty”p”yt„\Garmin_Mapsource_Finland_Topo-kartat\Garmin_Mapsource_Finland_Topo-kartat\Topo_6\autorun.exe" Sat 23 Apr 2005 511,424 A..H. --- "C:\Documents and Settings\LASZLO\Ty”p”yt„\Garmin_Mapsource_Finland_Topo-kartat\Garmin_Mapsource_Finland_Topo-kartat\Topo_5\40Comupd.exe" Sat 23 Apr 2005 168,448 A..H. --- "C:\Documents and Settings\LASZLO\Ty”p”yt„\Garmin_Mapsource_Finland_Topo-kartat\Garmin_Mapsource_Finland_Topo-kartat\Topo_5\Setup.exe" Sat 23 Apr 2005 118,784 A..H. --- "C:\Documents and Settings\LASZLO\Ty”p”yt„\Garmin_Mapsource_Finland_Topo-kartat\Garmin_Mapsource_Finland_Topo-kartat\Topo_5\autorun.exe" Sat 23 Apr 2005 511,424 A..H. --- "C:\Documents and Settings\LASZLO\Ty”p”yt„\Garmin_Mapsource_Finland_Topo-kartat\Garmin_Mapsource_Finland_Topo-kartat\Topo_4\40Comupd.exe" Sat 23 Apr 2005 168,448 A..H. --- "C:\Documents and Settings\LASZLO\Ty”p”yt„\Garmin_Mapsource_Finland_Topo-kartat\Garmin_Mapsource_Finland_Topo-kartat\Topo_4\Setup.exe" Sat 23 Apr 2005 118,784 A..H. --- "C:\Documents and Settings\LASZLO\Ty”p”yt„\Garmin_Mapsource_Finland_Topo-kartat\Garmin_Mapsource_Finland_Topo-kartat\Topo_4\autorun.exe" Sat 23 Apr 2005 511,424 A..H. --- "C:\Documents and Settings\LASZLO\Ty”p”yt„\Garmin_Mapsource_Finland_Topo-kartat\Garmin_Mapsource_Finland_Topo-kartat\Topo_3\40Comupd.exe" Sat 23 Apr 2005 168,448 A..H. --- "C:\Documents and Settings\LASZLO\Ty”p”yt„\Garmin_Mapsource_Finland_Topo-kartat\Garmin_Mapsource_Finland_Topo-kartat\Topo_3\Setup.exe" Sat 23 Apr 2005 118,784 A..H. --- "C:\Documents and Settings\LASZLO\Ty”p”yt„\Garmin_Mapsource_Finland_Topo-kartat\Garmin_Mapsource_Finland_Topo-kartat\Topo_3\autorun.exe" Sat 23 Apr 2005 511,424 A..H. --- "C:\Documents and Settings\LASZLO\Ty”p”yt„\Garmin_Mapsource_Finland_Topo-kartat\Garmin_Mapsource_Finland_Topo-kartat\Topo_2\40Comupd.exe" Sat 23 Apr 2005 168,448 A..H. --- "C:\Documents and Settings\LASZLO\Ty”p”yt„\Garmin_Mapsource_Finland_Topo-kartat\Garmin_Mapsource_Finland_Topo-kartat\Topo_2\Setup.exe" Sat 23 Apr 2005 118,784 A..H. --- "C:\Documents and Settings\LASZLO\Ty”p”yt„\Garmin_Mapsource_Finland_Topo-kartat\Garmin_Mapsource_Finland_Topo-kartat\Topo_2\autorun.exe" Sat 23 Apr 2005 511,424 A..H. --- "C:\Documents and Settings\LASZLO\Ty”p”yt„\Garmin_Mapsource_Finland_Topo-kartat\Garmin_Mapsource_Finland_Topo-kartat\Topo_13\40Comupd.exe" Sat 23 Apr 2005 168,448 A..H. --- "C:\Documents and Settings\LASZLO\Ty”p”yt„\Garmin_Mapsource_Finland_Topo-kartat\Garmin_Mapsource_Finland_Topo-kartat\Topo_13\Setup.exe" Sat 23 Apr 2005 118,784 A..H. --- "C:\Documents and Settings\LASZLO\Ty”p”yt„\Garmin_Mapsource_Finland_Topo-kartat\Garmin_Mapsource_Finland_Topo-kartat\Topo_13\autorun.exe" Sat 23 Apr 2005 511,424 A..H. --- "C:\Documents and Settings\LASZLO\Ty”p”yt„\Garmin_Mapsource_Finland_Topo-kartat\Garmin_Mapsource_Finland_Topo-kartat\Topo_12\40Comupd.exe" Sat 23 Apr 2005 168,448 A..H. --- "C:\Documents and Settings\LASZLO\Ty”p”yt„\Garmin_Mapsource_Finland_Topo-kartat\Garmin_Mapsource_Finland_Topo-kartat\Topo_12\Setup.exe" Sat 23 Apr 2005 118,784 A..H. --- "C:\Documents and Settings\LASZLO\Ty”p”yt„\Garmin_Mapsource_Finland_Topo-kartat\Garmin_Mapsource_Finland_Topo-kartat\Topo_12\autorun.exe" Sat 23 Apr 2005 511,424 A..H. --- "C:\Documents and Settings\LASZLO\Ty”p”yt„\Garmin_Mapsource_Finland_Topo-kartat\Garmin_Mapsource_Finland_Topo-kartat\Topo_11\40Comupd.exe" Sat 23 Apr 2005 168,448 A..H. --- "C:\Documents and Settings\LASZLO\Ty”p”yt„\Garmin_Mapsource_Finland_Topo-kartat\Garmin_Mapsource_Finland_Topo-kartat\Topo_11\Setup.exe" Sat 23 Apr 2005 118,784 A..H. --- "C:\Documents and Settings\LASZLO\Ty”p”yt„\Garmin_Mapsource_Finland_Topo-kartat\Garmin_Mapsource_Finland_Topo-kartat\Topo_11\autorun.exe" Sat 23 Apr 2005 417,792 A..H. --- "C:\Documents and Settings\LASZLO\Ty”p”yt„\Garmin_Mapsource_Finland_Topo-kartat\Garmin_Mapsource_Finland_Topo-kartat\Topo_cd_18\Spanish\MapSource_Lang.dll" Sat 23 Apr 2005 421,888 A..H. --- "C:\Documents and Settings\LASZLO\Ty”p”yt„\Garmin_Mapsource_Finland_Topo-kartat\Garmin_Mapsource_Finland_Topo-kartat\Topo_cd_18\Italian\MapSource_Lang.dll" Sat 23 Apr 2005 421,888 A..H. --- "C:\Documents and Settings\LASZLO\Ty”p”yt„\Garmin_Mapsource_Finland_Topo-kartat\Garmin_Mapsource_Finland_Topo-kartat\Topo_cd_18\German\MapSource_Lang.dll" Sat 23 Apr 2005 421,888 A..H. --- "C:\Documents and Settings\LASZLO\Ty”p”yt„\Garmin_Mapsource_Finland_Topo-kartat\Garmin_Mapsource_Finland_Topo-kartat\Topo_cd_18\French\MapSource_Lang.dll" Sat 23 Apr 2005 397,312 A..H. --- "C:\Documents and Settings\LASZLO\Ty”p”yt„\Garmin_Mapsource_Finland_Topo-kartat\Garmin_Mapsource_Finland_Topo-kartat\Topo_cd_18\English\MapSource_Lang.dll" Sat 23 Apr 2005 417,792 A..H. --- "C:\Documents and Settings\LASZLO\Ty”p”yt„\Garmin_Mapsource_Finland_Topo-kartat\Garmin_Mapsource_Finland_Topo-kartat\Topo_cd_17\Spanish\MapSource_Lang.dll" Sat 23 Apr 2005 421,888 A..H. --- "C:\Documents and Settings\LASZLO\Ty”p”yt„\Garmin_Mapsource_Finland_Topo-kartat\Garmin_Mapsource_Finland_Topo-kartat\Topo_cd_17\Italian\MapSource_Lang.dll" Sat 23 Apr 2005 421,888 A..H. --- "C:\Documents and Settings\LASZLO\Ty”p”yt„\Garmin_Mapsource_Finland_Topo-kartat\Garmin_Mapsource_Finland_Topo-kartat\Topo_cd_17\German\MapSource_Lang.dll" Sat 23 Apr 2005 421,888 A..H. --- "C:\Documents and Settings\LASZLO\Ty”p”yt„\Garmin_Mapsource_Finland_Topo-kartat\Garmin_Mapsource_Finland_Topo-kartat\Topo_cd_17\French\MapSource_Lang.dll" Sat 23 Apr 2005 397,312 A..H. --- "C:\Documents and Settings\LASZLO\Ty”p”yt„\Garmin_Mapsource_Finland_Topo-kartat\Garmin_Mapsource_Finland_Topo-kartat\Topo_cd_17\English\MapSource_Lang.dll" Sat 23 Apr 2005 511,424 A..H. --- "C:\Documents and Settings\LASZLO\Ty”p”yt„\Garmin_Mapsource_Finland_Topo-kartat\Garmin_Mapsource_Finland_Topo-kartat\Topo_cd_16\GPS_AT\40Comupd.exe" Sat 23 Apr 2005 168,448 A..H. --- "C:\Documents and Settings\LASZLO\Ty”p”yt„\Garmin_Mapsource_Finland_Topo-kartat\Garmin_Mapsource_Finland_Topo-kartat\Topo_cd_16\GPS_AT\Setup.exe" Sat 23 Apr 2005 118,784 A..H. --- "C:\Documents and Settings\LASZLO\Ty”p”yt„\Garmin_Mapsource_Finland_Topo-kartat\Garmin_Mapsource_Finland_Topo-kartat\Topo_cd_16\GPS_AT\autorun.exe" Sat 23 Apr 2005 417,792 A..H. --- "C:\Documents and Settings\LASZLO\Ty”p”yt„\Garmin_Mapsource_Finland_Topo-kartat\Garmin_Mapsource_Finland_Topo-kartat\Topo_cd_15\Spanish\MapSource_Lang.dll" Sat 23 Apr 2005 421,888 A..H. --- "C:\Documents and Settings\LASZLO\Ty”p”yt„\Garmin_Mapsource_Finland_Topo-kartat\Garmin_Mapsource_Finland_Topo-kartat\Topo_cd_15\Italian\MapSource_Lang.dll" Sat 23 Apr 2005 421,888 A..H. --- "C:\Documents and Settings\LASZLO\Ty”p”yt„\Garmin_Mapsource_Finland_Topo-kartat\Garmin_Mapsource_Finland_Topo-kartat\Topo_cd_15\German\MapSource_Lang.dll" Sat 23 Apr 2005 421,888 A..H. --- "C:\Documents and Settings\LASZLO\Ty”p”yt„\Garmin_Mapsource_Finland_Topo-kartat\Garmin_Mapsource_Finland_Topo-kartat\Topo_cd_15\French\MapSource_Lang.dll" Sat 23 Apr 2005 397,312 A..H. --- "C:\Documents and Settings\LASZLO\Ty”p”yt„\Garmin_Mapsource_Finland_Topo-kartat\Garmin_Mapsource_Finland_Topo-kartat\Topo_cd_15\English\MapSource_Lang.dll" Sat 23 Apr 2005 417,792 A..H. --- "C:\Documents and Settings\LASZLO\Ty”p”yt„\Garmin_Mapsource_Finland_Topo-kartat\Garmin_Mapsource_Finland_Topo-kartat\Topo_cd_14\Spanish\MapSource_Lang.dll" Sat 23 Apr 2005 421,888 A..H. --- "C:\Documents and Settings\LASZLO\Ty”p”yt„\Garmin_Mapsource_Finland_Topo-kartat\Garmin_Mapsource_Finland_Topo-kartat\Topo_cd_14\Italian\MapSource_Lang.dll" Sat 23 Apr 2005 421,888 A..H. --- "C:\Documents and Settings\LASZLO\Ty”p”yt„\Garmin_Mapsource_Finland_Topo-kartat\Garmin_Mapsource_Finland_Topo-kartat\Topo_cd_14\German\MapSource_Lang.dll" Sat 23 Apr 2005 421,888 A..H. --- "C:\Documents and Settings\LASZLO\Ty”p”yt„\Garmin_Mapsource_Finland_Topo-kartat\Garmin_Mapsource_Finland_Topo-kartat\Topo_cd_14\French\MapSource_Lang.dll" Sat 23 Apr 2005 397,312 A..H. --- "C:\Documents and Settings\LASZLO\Ty”p”yt„\Garmin_Mapsource_Finland_Topo-kartat\Garmin_Mapsource_Finland_Topo-kartat\Topo_cd_14\English\MapSource_Lang.dll" Sat 23 Apr 2005 417,792 A..H. --- "C:\Documents and Settings\LASZLO\Ty”p”yt„\Garmin_Mapsource_Finland_Topo-kartat\Garmin_Mapsource_Finland_Topo-kartat\Topo_9\Spanish\MapSource_Lang.dll" Sat 23 Apr 2005 421,888 A..H. --- "C:\Documents and Settings\LASZLO\Ty”p”yt„\Garmin_Mapsource_Finland_Topo-kartat\Garmin_Mapsource_Finland_Topo-kartat\Topo_9\Italian\MapSource_Lang.dll" Sat 23 Apr 2005 421,888 A..H. --- "C:\Documents and Settings\LASZLO\Ty”p”yt„\Garmin_Mapsource_Finland_Topo-kartat\Garmin_Mapsource_Finland_Topo-kartat\Topo_9\German\MapSource_Lang.dll" Sat 23 Apr 2005 421,888 A..H. --- "C:\Documents and Settings\LASZLO\Ty”p”yt„\Garmin_Mapsource_Finland_Topo-kartat\Garmin_Mapsource_Finland_Topo-kartat\Topo_9\French\MapSource_Lang.dll" Sat 23 Apr 2005 397,312 A..H. --- "C:\Documents and Settings\LASZLO\Ty”p”yt„\Garmin_Mapsource_Finland_Topo-kartat\Garmin_Mapsource_Finland_Topo-kartat\Topo_9\English\MapSource_Lang.dll" Sat 23 Apr 2005 417,792 A..H. --- "C:\Documents and Settings\LASZLO\Ty”p”yt„\Garmin_Mapsource_Finland_Topo-kartat\Garmin_Mapsource_Finland_Topo-kartat\Topo_8\Spanish\MapSource_Lang.dll" Sat 23 Apr 2005 421,888 A..H. --- "C:\Documents and Settings\LASZLO\Ty”p”yt„\Garmin_Mapsource_Finland_Topo-kartat\Garmin_Mapsource_Finland_Topo-kartat\Topo_8\Italian\MapSource_Lang.dll" Sat 23 Apr 2005 421,888 A..H. --- "C:\Documents and Settings\LASZLO\Ty”p”yt„\Garmin_Mapsource_Finland_Topo-kartat\Garmin_Mapsource_Finland_Topo-kartat\Topo_8\German\MapSource_Lang.dll" Sat 23 Apr 2005 421,888 A..H. --- "C:\Documents and Settings\LASZLO\Ty”p”yt„\Garmin_Mapsource_Finland_Topo-kartat\Garmin_Mapsource_Finland_Topo-kartat\Topo_8\French\MapSource_Lang.dll" Sat 23 Apr 2005 397,312 A..H. --- "C:\Documents and Settings\LASZLO\Ty”p”yt„\Garmin_Mapsource_Finland_Topo-kartat\Garmin_Mapsource_Finland_Topo-kartat\Topo_8\English\MapSource_Lang.dll" Sat 23 Apr 2005 385,024 A..H. --- "C:\Documents and Settings\LASZLO\Ty”p”yt„\Garmin_Mapsource_Finland_Topo-kartat\Garmin_Mapsource_Finland_Topo-kartat\Topo_7\Spanish\MapSource_Lang.dll" Sat 23 Apr 2005 393,216 A..H. --- "C:\Documents and Settings\LASZLO\Ty”p”yt„\Garmin_Mapsource_Finland_Topo-kartat\Garmin_Mapsource_Finland_Topo-kartat\Topo_7\Italian\MapSource_Lang.dll" Sat 23 Apr 2005 393,216 A..H. --- "C:\Documents and Settings\LASZLO\Ty”p”yt„\Garmin_Mapsource_Finland_Topo-kartat\Garmin_Mapsource_Finland_Topo-kartat\Topo_7\German\MapSource_Lang.dll" Sat 23 Apr 2005 389,120 A..H. --- "C:\Documents and Settings\LASZLO\Ty”p”yt„\Garmin_Mapsource_Finland_Topo-kartat\Garmin_Mapsource_Finland_Topo-kartat\Topo_7\French\MapSource_Lang.dll" Sat 23 Apr 2005 372,736 A..H. --- "C:\Documents and Settings\LASZLO\Ty”p”yt„\Garmin_Mapsource_Finland_Topo-kartat\Garmin_Mapsource_Finland_Topo-kartat\Topo_7\English\MapSource_Lang.dll" Sat 23 Apr 2005 385,024 A..H. --- "C:\Documents and Settings\LASZLO\Ty”p”yt„\Garmin_Mapsource_Finland_Topo-kartat\Garmin_Mapsource_Finland_Topo-kartat\Topo_6\Spanish\MapSource_Lang.dll" Sat 23 Apr 2005 393,216 A..H. --- "C:\Documents and Settings\LASZLO\Ty”p”yt„\Garmin_Mapsource_Finland_Topo-kartat\Garmin_Mapsource_Finland_Topo-kartat\Topo_6\Italian\MapSource_Lang.dll" Sat 23 Apr 2005 393,216 A..H. --- "C:\Documents and Settings\LASZLO\Ty”p”yt„\Garmin_Mapsource_Finland_Topo-kartat\Garmin_Mapsource_Finland_Topo-kartat\Topo_6\German\MapSource_Lang.dll" Sat 23 Apr 2005 389,120 A..H. --- "C:\Documents and Settings\LASZLO\Ty”p”yt„\Garmin_Mapsource_Finland_Topo-kartat\Garmin_Mapsource_Finland_Topo-kartat\Topo_6\French\MapSource_Lang.dll" Sat 23 Apr 2005 372,736 A..H. --- "C:\Documents and Settings\LASZLO\Ty”p”yt„\Garmin_Mapsource_Finland_Topo-kartat\Garmin_Mapsource_Finland_Topo-kartat\Topo_6\English\MapSource_Lang.dll" Sat 23 Apr 2005 385,024 A..H. --- "C:\Documents and Settings\LASZLO\Ty”p”yt„\Garmin_Mapsource_Finland_Topo-kartat\Garmin_Mapsource_Finland_Topo-kartat\Topo_5\Spanish\MapSource_Lang.dll" Sat 23 Apr 2005 393,216 A..H. --- "C:\Documents and Settings\LASZLO\Ty”p”yt„\Garmin_Mapsource_Finland_Topo-kartat\Garmin_Mapsource_Finland_Topo-kartat\Topo_5\Italian\MapSource_Lang.dll" Sat 23 Apr 2005 393,216 A..H. --- "C:\Documents and Settings\LASZLO\Ty”p”yt„\Garmin_Mapsource_Finland_Topo-kartat\Garmin_Mapsource_Finland_Topo-kartat\Topo_5\German\MapSource_Lang.dll" Sat 23 Apr 2005 389,120 A..H. --- "C:\Documents and Settings\LASZLO\Ty”p”yt„\Garmin_Mapsource_Finland_Topo-kartat\Garmin_Mapsource_Finland_Topo-kartat\Topo_5\French\MapSource_Lang.dll" Sat 23 Apr 2005 372,736 A..H. --- "C:\Documents and Settings\LASZLO\Ty”p”yt„\Garmin_Mapsource_Finland_Topo-kartat\Garmin_Mapsource_Finland_Topo-kartat\Topo_5\English\MapSource_Lang.dll" Sat 23 Apr 2005 385,024 A..H. --- "C:\Documents and Settings\LASZLO\Ty”p”yt„\Garmin_Mapsource_Finland_Topo-kartat\Garmin_Mapsource_Finland_Topo-kartat\Topo_4\Spanish\MapSource_Lang.dll" Sat 23 Apr 2005 393,216 A..H. --- "C:\Documents and Settings\LASZLO\Ty”p”yt„\Garmin_Mapsource_Finland_Topo-kartat\Garmin_Mapsource_Finland_Topo-kartat\Topo_4\Italian\MapSource_Lang.dll" Sat 23 Apr 2005 393,216 A..H. --- "C:\Documents and Settings\LASZLO\Ty”p”yt„\Garmin_Mapsource_Finland_Topo-kartat\Garmin_Mapsource_Finland_Topo-kartat\Topo_4\German\MapSource_Lang.dll" Sat 23 Apr 2005 389,120 A..H. --- "C:\Documents and Settings\LASZLO\Ty”p”yt„\Garmin_Mapsource_Finland_Topo-kartat\Garmin_Mapsource_Finland_Topo-kartat\Topo_4\French\MapSource_Lang.dll" Sat 23 Apr 2005 372,736 A..H. --- "C:\Documents and Settings\LASZLO\Ty”p”yt„\Garmin_Mapsource_Finland_Topo-kartat\Garmin_Mapsource_Finland_Topo-kartat\Topo_4\English\MapSource_Lang.dll" Sat 23 Apr 2005 385,024 A..H. --- "C:\Documents and Settings\LASZLO\Ty”p”yt„\Garmin_Mapsource_Finland_Topo-kartat\Garmin_Mapsource_Finland_Topo-kartat\Topo_3\Spanish\MapSource_Lang.dll" Sat 23 Apr 2005 393,216 A..H. --- "C:\Documents and Settings\LASZLO\Ty”p”yt„\Garmin_Mapsource_Finland_Topo-kartat\Garmin_Mapsource_Finland_Topo-kartat\Topo_3\Italian\MapSource_Lang.dll" Sat 23 Apr 2005 393,216 A..H. --- "C:\Documents and Settings\LASZLO\Ty”p”yt„\Garmin_Mapsource_Finland_Topo-kartat\Garmin_Mapsource_Finland_Topo-kartat\Topo_3\German\MapSource_Lang.dll" Sat 23 Apr 2005 389,120 A..H. --- "C:\Documents and Settings\LASZLO\Ty”p”yt„\Garmin_Mapsource_Finland_Topo-kartat\Garmin_Mapsource_Finland_Topo-kartat\Topo_3\French\MapSource_Lang.dll" Sat 23 Apr 2005 372,736 A..H. --- "C:\Documents and Settings\LASZLO\Ty”p”yt„\Garmin_Mapsource_Finland_Topo-kartat\Garmin_Mapsource_Finland_Topo-kartat\Topo_3\English\MapSource_Lang.dll" Sat 23 Apr 2005 385,024 A..H. --- "C:\Documents and Settings\LASZLO\Ty”p”yt„\Garmin_Mapsource_Finland_Topo-kartat\Garmin_Mapsource_Finland_Topo-kartat\Topo_2\Spanish\MapSource_Lang.dll" Sat 23 Apr 2005 393,216 A..H. --- "C:\Documents and Settings\LASZLO\Ty”p”yt„\Garmin_Mapsource_Finland_Topo-kartat\Garmin_Mapsource_Finland_Topo-kartat\Topo_2\Italian\MapSource_Lang.dll" Sat 23 Apr 2005 393,216 A..H. --- "C:\Documents and Settings\LASZLO\Ty”p”yt„\Garmin_Mapsource_Finland_Topo-kartat\Garmin_Mapsource_Finland_Topo-kartat\Topo_2\German\MapSource_Lang.dll" Sat 23 Apr 2005 389,120 A..H. --- "C:\Documents and Settings\LASZLO\Ty”p”yt„\Garmin_Mapsource_Finland_Topo-kartat\Garmin_Mapsource_Finland_Topo-kartat\Topo_2\French\MapSource_Lang.dll" Sat 23 Apr 2005 372,736 A..H. --- "C:\Documents and Settings\LASZLO\Ty”p”yt„\Garmin_Mapsource_Finland_Topo-kartat\Garmin_Mapsource_Finland_Topo-kartat\Topo_2\English\MapSource_Lang.dll" Sat 23 Apr 2005 417,792 A..H. --- "C:\Documents and Settings\LASZLO\Ty”p”yt„\Garmin_Mapsource_Finland_Topo-kartat\Garmin_Mapsource_Finland_Topo-kartat\Topo_13\Spanish\MapSource_Lang.dll" Sat 23 Apr 2005 421,888 A..H. --- "C:\Documents and Settings\LASZLO\Ty”p”yt„\Garmin_Mapsource_Finland_Topo-kartat\Garmin_Mapsource_Finland_Topo-kartat\Topo_13\Italian\MapSource_Lang.dll" Sat 23 Apr 2005 421,888 A..H. --- "C:\Documents and Settings\LASZLO\Ty”p”yt„\Garmin_Mapsource_Finland_Topo-kartat\Garmin_Mapsource_Finland_Topo-kartat\Topo_13\German\MapSource_Lang.dll" Sat 23 Apr 2005 421,888 A..H. --- "C:\Documents and Settings\LASZLO\Ty”p”yt„\Garmin_Mapsource_Finland_Topo-kartat\Garmin_Mapsource_Finland_Topo-kartat\Topo_13\French\MapSource_Lang.dll" Sat 23 Apr 2005 397,312 A..H. --- "C:\Documents and Settings\LASZLO\Ty”p”yt„\Garmin_Mapsource_Finland_Topo-kartat\Garmin_Mapsource_Finland_Topo-kartat\Topo_13\English\MapSource_Lang.dll" Sat 23 Apr 2005 417,792 A..H. --- "C:\Documents and Settings\LASZLO\Ty”p”yt„\Garmin_Mapsource_Finland_Topo-kartat\Garmin_Mapsource_Finland_Topo-kartat\Topo_12\Spanish\MapSource_Lang.dll" Sat 23 Apr 2005 421,888 A..H. --- "C:\Documents and Settings\LASZLO\Ty”p”yt„\Garmin_Mapsource_Finland_Topo-kartat\Garmin_Mapsource_Finland_Topo-kartat\Topo_12\Italian\MapSource_Lang.dll" Sat 23 Apr 2005 421,888 A..H. --- "C:\Documents and Settings\LASZLO\Ty”p”yt„\Garmin_Mapsource_Finland_Topo-kartat\Garmin_Mapsource_Finland_Topo-kartat\Topo_12\German\MapSource_Lang.dll" Sat 23 Apr 2005 421,888 A..H. --- "C:\Documents and Settings\LASZLO\Ty”p”yt„\Garmin_Mapsource_Finland_Topo-kartat\Garmin_Mapsource_Finland_Topo-kartat\Topo_12\French\MapSource_Lang.dll" Sat 23 Apr 2005 397,312 A..H. --- "C:\Documents and Settings\LASZLO\Ty”p”yt„\Garmin_Mapsource_Finland_Topo-kartat\Garmin_Mapsource_Finland_Topo-kartat\Topo_12\English\MapSource_Lang.dll" Sat 23 Apr 2005 417,792 A..H. --- "C:\Documents and Settings\LASZLO\Ty”p”yt„\Garmin_Mapsource_Finland_Topo-kartat\Garmin_Mapsource_Finland_Topo-kartat\Topo_11\Spanish\MapSource_Lang.dll" Sat 23 Apr 2005 421,888 A..H. --- "C:\Documents and Settings\LASZLO\Ty”p”yt„\Garmin_Mapsource_Finland_Topo-kartat\Garmin_Mapsource_Finland_Topo-kartat\Topo_11\Italian\MapSource_Lang.dll" Sat 23 Apr 2005 421,888 A..H. --- "C:\Documents and Settings\LASZLO\Ty”p”yt„\Garmin_Mapsource_Finland_Topo-kartat\Garmin_Mapsource_Finland_Topo-kartat\Topo_11\German\MapSource_Lang.dll" Sat 23 Apr 2005 421,888 A..H. --- "C:\Documents and Settings\LASZLO\Ty”p”yt„\Garmin_Mapsource_Finland_Topo-kartat\Garmin_Mapsource_Finland_Topo-kartat\Topo_11\French\MapSource_Lang.dll" Sat 23 Apr 2005 397,312 A..H. --- "C:\Documents and Settings\LASZLO\Ty”p”yt„\Garmin_Mapsource_Finland_Topo-kartat\Garmin_Mapsource_Finland_Topo-kartat\Topo_11\English\MapSource_Lang.dll" Sat 23 Apr 2005 417,792 A..H. --- "C:\Documents and Settings\LASZLO\Ty”p”yt„\Garmin_Mapsource_Finland_Topo-kartat\Garmin_Mapsource_Finland_Topo-kartat\Topo_cd_16\GPS_AT\Spanish\MapSource_Lang.dll" Sat 23 Apr 2005 421,888 A..H. --- "C:\Documents and Settings\LASZLO\Ty”p”yt„\Garmin_Mapsource_Finland_Topo-kartat\Garmin_Mapsource_Finland_Topo-kartat\Topo_cd_16\GPS_AT\Italian\MapSource_Lang.dll" Sat 23 Apr 2005 421,888 A..H. --- "C:\Documents and Settings\LASZLO\Ty”p”yt„\Garmin_Mapsource_Finland_Topo-kartat\Garmin_Mapsource_Finland_Topo-kartat\Topo_cd_16\GPS_AT\German\MapSource_Lang.dll" Sat 23 Apr 2005 421,888 A..H. --- "C:\Documents and Settings\LASZLO\Ty”p”yt„\Garmin_Mapsource_Finland_Topo-kartat\Garmin_Mapsource_Finland_Topo-kartat\Topo_cd_16\GPS_AT\French\MapSource_Lang.dll" Sat 23 Apr 2005 397,312 A..H. --- "C:\Documents and Settings\LASZLO\Ty”p”yt„\Garmin_Mapsource_Finland_Topo-kartat\Garmin_Mapsource_Finland_Topo-kartat\Topo_cd_16\GPS_AT\English\MapSource_Lang.dll" Finished! Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 18:53:38, on 29.2.2008 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\Ati2evxx.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\System32\wltrysvc.exe C:\WINDOWS\System32\bcmwltry.exe C:\WINDOWS\system32\spoolsv.exe C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe C:\PROGRA~1\F-Secure\BackWeb\7681197\Program\SERVIC~1.EXE C:\Program Files\F-Secure\Anti-Virus\fsgk32st.exe C:\Program Files\F-Secure\BackWeb\7681197\program\fsbwsys.exe C:\Program Files\F-Secure\Anti-Virus\FSGK32.EXE C:\Program Files\F-Secure\Common\FSMA32.EXE C:\Program Files\F-Secure\Anti-Virus\fssm32.exe C:\Program Files\F-Secure\Common\FSMB32.EXE C:\WINDOWS\system32\svchost.exe C:\Program Files\F-Secure\Common\FCH32.EXE C:\Program Files\F-Secure\Common\FAMEH32.EXE C:\Program Files\F-Secure\Common\FNRB32.EXE C:\Program Files\F-Secure\FWES\Program\fsdfwd.exe C:\Program Files\F-Secure\Common\FIH32.EXE C:\WINDOWS\System32\svchost.exe C:\Program Files\F-Secure\Anti-Virus\fsav32.exe C:\WINDOWS\system32\Ati2evxx.exe C:\WINDOWS\Explorer.EXE C:\Program Files\Synaptics\SynTP\SynTPLpr.exe C:\Program Files\Synaptics\SynTP\SynTPEnh.exe C:\WINDOWS\system32\WLTRAY.exe C:\WINDOWS\SOUNDMAN.EXE C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe C:\Program Files\Launch Manager\LaunchAp.exe C:\Program Files\Launch Manager\PowerKey.exe C:\Program Files\Launch Manager\HotkeyApp.exe C:\Program Files\Launch Manager\CtrlVol.exe C:\Program Files\Launch Manager\OSDCtrl.exe C:\Program Files\Launch Manager\Wbutton.exe C:\Program Files\F-Secure\BackWeb\7681197\Program\F-Secure Automatic Update.exe C:\Program Files\Arcade\PCMService.exe C:\Program Files\F-Secure\Common\FSM32.EXE C:\Program Files\QuickTime\qttask.exe C:\Program Files\RF Wireless Mouse\cm20.exe C:\Program Files\Common Files\Real\Update_OB\realsched.exe C:\Program Files\F-Secure\FSGUI\fsguiexe.exe C:\Program Files\Ahead\InCD\InCD.exe C:\Program Files\HP\HP Software Update\HPWuSchd2.exe C:\PROGRA~1\Nokia\NOKIAP~1\LAUNCH~1.EXE C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe C:\Program Files\HP\hpcoretech\hpcmpmgr.exe C:\Program Files\Common Files\PCSuite\Services\ServiceLayer.exe C:\Program Files\acer\eRecovery\Monitor.exe C:\Program Files\Winamp\winampa.exe C:\WINDOWS\system32\ctfmon.exe C:\Program Files\Messenger\msmsgs.exe C:\Program Files\Microsoft ActiveSync\WCESCOMM.EXE C:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe C:\Program Files\Winamp Remote\bin\OrbTray.exe C:\PROGRA~1\COMMON~1\Nokia\MPAPI\MPAPI3s.exe C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe C:\WINDOWS\Twain_32\CA561A\SnapDetect.exe C:\PROGRA~1\Yahoo!\MESSEN~1\ymsgr_tray.exe C:\Program Files\HP\Digital Imaging\bin\hpqgalry.exe C:\WINDOWS\system32\wuauclt.exe C:\Documents and Settings\LASZLO\Työpöytä\HiJackThis_v2.0.2.exe R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://us.rd.yahoo.com/customize/ie/defaults/sb/msgr8/*http://www.yahoo.com/ext/search/search.html R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://us.rd.yahoo.com/customize/ie/defaults/sp/msgr8/*http://www.yahoo.com R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.fi/ R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.yahoo.com/ R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://us.rd.yahoo.com/customize/ie/defaults/su/msgr8/*http://www.yahoo.com R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://us.rd.yahoo.com/customize/ie/defaults/sb/msgr8/*http://www.yahoo.com/ext/search/search.html R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://us.rd.yahoo.com/customize/ie/defaults/sp/msgr8/*http://www.yahoo.com R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/ R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://us.rd.yahoo.com/customize/ie/defaults/su/msgr8/*http://www.yahoo.com R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Microsoft Internet Explorer - toimittaja Sonera Internet R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Linkit R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\PROGRA~1\YAHOO!\Companion\Installs\cpn0\yt.dll O2 - BHO: &Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\PROGRA~1\YAHOO!\Companion\Installs\cpn0\yt.dll O2 - BHO: Adobe PDF Reader -linkkiavustaja - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll O2 - BHO: Yahoo! IE Services Button - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file) O2 - BHO: ST - {9394EDE7-C8B5-483E-8773-474BF36AF6E4} - C:\Program Files\MSN Apps\ST\01.03.0000.1005\en-xu\stmain.dll O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll O2 - BHO: MSNToolBandBHO - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Apps\MSN Toolbar\MSN Toolbar\01.02.5000.1021\fi\msntb.dll O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\PROGRA~1\YAHOO!\Companion\Installs\cpn0\yt.dll O4 - HKLM\..\Run: [preload] C:\Windows\RUNXMLPL.exe O4 - HKLM\..\Run: [SynTPLpr] C:\Program Files\Synaptics\SynTP\SynTPLpr.exe O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe O4 - HKLM\..\Run: [Broadcom Wireless Manager UI] C:\WINDOWS\system32\WLTRAY O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe O4 - HKLM\..\Run: [LaunchAp] C:\Program Files\Launch Manager\LaunchAp.exe O4 - HKLM\..\Run: [PowerKey] "C:\Program Files\Launch Manager\PowerKey.exe" O4 - HKLM\..\Run: [LManager] C:\Program Files\Launch Manager\HotkeyApp.exe O4 - HKLM\..\Run: [CtrlVol] C:\Program Files\Launch Manager\CtrlVol.exe O4 - HKLM\..\Run: [LMgrOSD] C:\Program Files\Launch Manager\OSDCtrl.exe O4 - HKLM\..\Run: [Wbutton] "C:\Program Files\Launch Manager\Wbutton.exe" O4 - HKLM\..\Run: [PCMService] "C:\Program Files\Arcade\PCMService.exe" O4 - HKLM\..\Run: [eRecoveryService] C:\Windows\System32\Check.exe O4 - HKLM\..\Run: [F-Secure Manager] "C:\Program Files\F-Secure\Common\FSM32.EXE" /splash O4 - HKLM\..\Run: [F-Secure TNB] "C:\Program Files\F-Secure\TNB\TNBUtil.exe" /CHECKALL /WAITFORSW O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime O4 - HKLM\..\Run: [Start RF Wireless Mouse] C:\Program Files\RF Wireless Mouse\cm20.exe O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot O4 - HKLM\..\Run: [NeroCheck] C:\WINDOWS\system32\NeroCheck.exe O4 - HKLM\..\Run: [InCD] C:\Program Files\Ahead\InCD\InCD.exe O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe O4 - HKLM\..\Run: [PCSuiteTrayApplication] C:\PROGRA~1\Nokia\NOKIAP~1\LAUNCH~1.EXE -startup O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe" O4 - HKLM\..\Run: [HP Component Manager] "C:\Program Files\HP\hpcoretech\hpcmpmgr.exe" O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" O4 - HKLM\..\Run: [WinampAgent] C:\Program Files\Winamp\winampa.exe O4 - HKLM\..\Run: [Windows Services Manager] svchost.exe O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background O4 - HKCU\..\Run: [H/PC Connection Agent] "C:\Program Files\Microsoft ActiveSync\WCESCOMM.EXE" O4 - HKCU\..\Run: [PcSync] C:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe /NoDialog O4 - HKCU\..\Run: [Yahoo! Pager] "C:\PROGRA~1\Yahoo!\MESSEN~1\YAHOOM~1.EXE" -quiet O4 - HKCU\..\Run: [Orb] "C:\Program Files\Winamp Remote\bin\OrbTray.exe" /background O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Paikallinen palve') O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Verkkopalve') O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM') O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user') O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe O4 - Global Startup: HP Image Zone -pikakäynnistys.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqthb08.exe O4 - Global Startup: SnapDetect.lnk = ? O8 - Extra context menu item: &Google Search - res://c:\program files\google\GoogleToolbar2.dll/cmsearch.html O8 - Extra context menu item: &Translate English Word - res://c:\program files\google\GoogleToolbar2.dll/cmwordtrans.html O8 - Extra context menu item: Backward Links - res://c:\program files\google\GoogleToolbar2.dll/cmbacklinks.html O8 - Extra context menu item: Cached Snapshot of Page - res://c:\program files\google\GoogleToolbar2.dll/cmcache.html O8 - Extra context menu item: Similar Pages - res://c:\program files\google\GoogleToolbar2.dll/cmsimilar.html O8 - Extra context menu item: Translate Page into English - res://c:\program files\google\GoogleToolbar2.dll/cmtrans.html O8 - Extra context menu item: Vie Microsoft E&xceliin - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000 O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll O9 - Extra button: Matkaviestimen suosikkien luominen - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - C:\Program Files\Microsoft ActiveSync\inetrepl.dll O9 - Extra button: (no name) - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\Program Files\Microsoft ActiveSync\inetrepl.dll O9 - Extra 'Tools' menuitem: Matkaviestimen suosikkien luominen... - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\Program Files\Microsoft ActiveSync\inetrepl.dll O9 - Extra button: Yahoo! Services - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O14 - IERESET.INF: START_PAGE_URL=http://www.soneraplaza.fi O16 - DPF: {00B71CFB-6864-4346-A978-C0A14556272C} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab31267.cab O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (Installation Support) - C:\Program Files\Yahoo!\Common\Yinsthelper.dll O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsClient.cab31267.cab O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/msnmessengersetupdownloader.cab O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL O23 - Service: Notebook Manager Service (anbmService) - OSA Technologies Inc. - C:\Acer\eManager\anbmServ.exe O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe O23 - Service: AVG Anti-Spyware Guard - Anti-Malware Development a.s. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe O23 - Service: F-Secure Automatic Update (BackWeb Plug-in - 7681197) - Unknown owner - C:\PROGRA~1\F-Secure\BackWeb\7681197\Program\SERVIC~1.EXE O23 - Service: F-Secure Gatekeeper Handler Starter - F-Secure Corp. - C:\Program Files\F-Secure\Anti-Virus\fsgk32st.exe O23 - Service: F-Secure Network Request Broker - F-Secure Corporation - C:\Program Files\F-Secure\Common\FNRB32.EXE O23 - Service: fsbwsys - F-Secure Corp. - C:\Program Files\F-Secure\BackWeb\7681197\program\fsbwsys.exe O23 - Service: F-Secure Anti-Virus Firewall Daemon (FSDFWD) - F-Secure Corporation - C:\Program Files\F-Secure\FWES\Program\fsdfwd.exe O23 - Service: F-Secure Management Agent (FSMA) - F-Secure Corporation - C:\Program Files\F-Secure\Common\FSMA32.EXE O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe O23 - Service: ServiceLayer - Nokia. - C:\Program Files\Common Files\PCSuite\Services\ServiceLayer.exe O23 - Service: Broadcom Wireless LAN Tray Service (wltrysvc) - Unknown owner - C:\WINDOWS\System32\wltrysvc.exe -- End of file - 13204 bytes
1.Lataa combofix.exe työpöydällesi yhdestä linkistä: combofix1 combofix2 2. Tuplaklikkaa combofix.exe tiedostoa ja seuraa ohjeistuksia. 3. Kun työkalu on valmis, se tuottaa lokin. Lähetä tämä loki viesti ketjuusi. Huom! Älä klikkaile combofixin ikkunaa käytön aikana. Tämä saattaa aiheuttaa ohjelman jumiutumisen.
Compofix raportti ComboFix 08-03-01 - LASZLO 2008-03-01 8:23:23.1 - FAT32x86 Running from: C:\Documents and Settings\LASZLO\Työpöytä\ComboFix.exe * Created a new restore point WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !! . ((((( Tiedostot, jotka on luotu seuraavalla aikavälillä: 2008-02-01 to 2008-03-01 ))))))))))))))))) . 2008-02-29 18:26 . 2008-02-29 18:26 <KANSIO> d-------- C:\WINDOWS\ERUNT 2008-02-28 22:23 . 2008-02-28 22:23 <KANSIO> d--hs---- C:\FOUND.004 2008-02-22 20:01 . 2008-02-22 20:01 268 --ah----- C:\sqmdata14.sqm 2008-02-22 20:01 . 2008-02-22 20:01 244 --ah----- C:\sqmnoopt14.sqm 2008-02-02 13:27 . 2008-02-02 13:27 <KANSIO> d-------- C:\Program Files\vanBasco's Karaoke Player . (((((((((((((((((((((((((((((((((((( Find3M-raportti )))))))))))))))))))))))))))))))))))))))))))))))))))))) . 2008-02-28 19:06 102,400 ----a-w C:\WINDOWS\DUMPf504.tmp 2008-01-20 09:31 --------- d-----w C:\Documents and Settings\Tanja\Application Data\Yahoo! 2008-01-12 09:58 --------- d-----w C:\Program Files\Winamp Remote 2008-01-12 09:58 --------- d-----w C:\Documents and Settings\All Users\Application Data\OrbNetworks 2008-01-07 16:56 --------- d-----w C:\Documents and Settings\LASZLO\Application Data\Yahoo! 2008-01-06 13:41 --------- d-----w C:\Documents and Settings\All Users\Application Data\Yahoo! 2008-01-06 11:47 32 ----a-w C:\Documents and Settings\All Users\Application Data\ezsid.dat 2008-01-06 11:47 --------- d-----w C:\Documents and Settings\LASZLO\Application Data\skypePM 2008-01-06 11:46 --------- d-----w C:\Program Files\Skype 2008-01-06 11:46 --------- d-----w C:\Program Files\Common Files\Skype 2007-12-18 09:51 179,584 ----a-w C:\WINDOWS\system32\dllcache\mrxdav.sys 2007-12-07 14:37 3,080,192 ----a-w C:\WINDOWS\system32\dllcache\mshtml.dll 2007-12-06 13:07 18,432 ----a-w C:\WINDOWS\system32\dllcache\iedw.exe 2007-12-04 18:41 550,912 ----a-w C:\WINDOWS\system32\dllcache\oleaut32.dll 2007-12-04 18:41 550,912 ------w C:\WINDOWS\system32\oleaut32.dll 2006-08-13 15:15 32,080 ----a-w C:\Documents and Settings\Tanja\Application Data\GDIPFONTCACHEV1.DAT 2006-01-31 19:09 32,080 ----a-w C:\Documents and Settings\LASZLO\Application Data\GDIPFONTCACHEV1.DAT 2006-05-03 10:06 163,328 --sh--r C:\WINDOWS\system32\flvDX.dll . (((((((((((((((((((((((((((((( Rekisterin käynnistyskohteet ))))))))))))))))))))))))))))))))))))))))))))) . . REGEDIT4 *Huom* Tyhjiä arvoja ja laillisia oletusarvoja ei näytetä [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="C:\WINDOWS\system32\ctfmon.exe" [2004-09-15 16:00 15360] "MSMSGS"="C:\Program Files\Messenger\msmsgs.exe" [2004-10-13 18:24 1694208] "H/PC Connection Agent"="C:\Program Files\Microsoft ActiveSync\WCESCOMM.EXE" [2005-01-19 15:16 405583] "PcSync"="C:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe" [2006-04-11 17:52 1409024] "Yahoo! Pager"="C:\PROGRA~1\Yahoo!\MESSEN~1\YAHOOM~1.exe" [2007-08-30 17:43 4670704] "Orb"="C:\Program Files\Winamp Remote\bin\OrbTray.exe" [2008-01-07 22:02 495616] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "preload"="C:\Windows\RUNXMLPL.exe" [2004-04-20 16:49 40960] "SynTPLpr"="C:\Program Files\Synaptics\SynTP\SynTPLpr.exe" [2004-10-05 16:25 98394] "SynTPEnh"="C:\Program Files\Synaptics\SynTP\SynTPEnh.exe" [2004-10-05 16:24 688218] "Broadcom Wireless Manager UI"="C:\WINDOWS\system32\WLTRAY" [ ] "SoundMan"="SOUNDMAN.EXE" [2005-02-23 18:13 77824 C:\WINDOWS\SOUNDMAN.EXE] "ATIPTA"="C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe" [2005-04-05 21:05 339968] "LaunchAp"="C:\Program Files\Launch Manager\LaunchAp.exe" [2005-03-30 15:29 32768] "PowerKey"="C:\Program Files\Launch Manager\PowerKey.exe" [2002-08-30 15:02 94208] "LManager"="C:\Program Files\Launch Manager\HotkeyApp.exe" [2005-03-29 11:08 61440] "CtrlVol"="C:\Program Files\Launch Manager\CtrlVol.exe" [2004-01-28 17:48 184320] "LMgrOSD"="C:\Program Files\Launch Manager\OSDCtrl.exe" [2004-10-11 10:47 245760] "Wbutton"="C:\Program Files\Launch Manager\Wbutton.exe" [2005-03-03 17:39 77824] "PCMService"="C:\Program Files\Arcade\PCMService.exe" [2005-03-09 18:59 49152] "eRecoveryService"="C:\Windows\System32\Check.exe" [2005-03-23 10:01 245760] "F-Secure Manager"="C:\Program Files\F-Secure\Common\FSM32.exe" [2004-09-09 11:03 118832] "F-Secure TNB"="C:\Program Files\F-Secure\TNB\TNBUtil.exe" [2004-05-27 10:57 684032] "QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2005-07-18 21:07 77824] "Start RF Wireless Mouse"="C:\Program Files\RF Wireless Mouse\cm20.exe" [2004-03-06 10:08 73728] "TkBellExe"="C:\Program Files\Common Files\Real\Update_OB\realsched.exe" [2006-02-28 17:51 180269] "NeroCheck"="C:\WINDOWS\system32\NeroCheck.exe" [2001-07-09 10:50 155648] "InCD"="C:\Program Files\Ahead\InCD\InCD.exe" [2002-09-12 19:13 1101824] "HP Software Update"="C:\Program Files\HP\HP Software Update\HPWuSchd2.exe" [2005-02-16 23:11 49152] "PCSuiteTrayApplication"="C:\PROGRA~1\Nokia\NOKIAP~1\LAUNCH~1.exe" [2006-04-26 08:29 237568] "SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe" [2007-09-25 01:11 132496] "HP Component Manager"="C:\Program Files\HP\hpcoretech\hpcmpmgr.exe" [2004-05-12 15:18 241664] "Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2007-10-10 19:51 39792] "WinampAgent"="C:\Program Files\Winamp\winampa.exe" [2007-12-20 17:16 37376] "Windows Services Manager"="svchost.exe" [2004-09-15 16:00 14336 C:\WINDOWS\system32\svchost.exe] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2004-09-15 16:00 15360] [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile] "EnableFirewall"= 0 (0x0) [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "%windir%\\system32\\sessmgr.exe"= "C:\\Program Files\\F-Secure\\BackWeb\\7681197\\program\\F-Secure Automatic Update.exe"= "C:\\Program Files\\Messenger\\msmsgs.exe"= "C:\\Program Files\\Microsoft ActiveSync\\wcescomm.exe"= "C:\\Program Files\\Microsoft ActiveSync\\WCESMgr.exe"= "C:\\Program Files\\MSN Messenger\\msnmsgr.exe"= "C:\\Program Files\\MSN Messenger\\livecall.exe"= "C:\\Program Files\\Skype\\Phone\\Skype.exe"= "C:\\Program Files\\Yahoo!\\Messenger\\YahooMessenger.exe"= "C:\\Program Files\\Yahoo!\\Messenger\\YServer.exe"= "C:\\Program Files\\Winamp Remote\\bin\\Orb.exe"= "C:\\Program Files\\Winamp Remote\\bin\\OrbTray.exe"= "C:\\Program Files\\Winamp Remote\\bin\\OrbStreamerClient.exe"= R0 BsStor;InCD Storage Helper Driver;C:\WINDOWS\system32\DRIVERS\bsstor.sys [2002-06-06 01:07] R0 FSFW;F-Secure Firewall Driver;C:\WINDOWS\system32\drivers\fsdfw.sys [2004-09-17 16:52] R1 Hotkey;Hotkey;C:\WINDOWS\system32\drivers\Hotkey.sys [2003-04-28 11:27] R2 BackWeb Plug-in - 7681197;F-Secure Automatic Update;C:\PROGRA~1\F-Secure\BackWeb\7681197\Program\SERVIC~1.EXE [2005-07-14 14:32] R2 BsUDF;InCD UDF Driver;C:\WINDOWS\system32\drivers\BsUDF.sys [2002-09-13 14:35] R2 F-Secure Filter;F-Secure File System Filter;C:\Program Files\F-Secure\Anti-Virus\Win2K\FSfilter.sys [2004-09-10 18:14] R2 F-Secure Gatekeeper;F-Secure Gatekeeper;C:\Program Files\F-Secure\Anti-Virus\Win2K\FSgk.sys [2004-09-10 18:14] R2 F-Secure Recognizer;F-Secure File System Recognizer;C:\Program Files\F-Secure\Anti-Virus\Win2K\FSrec.sys [2003-02-06 14:32] R3 HSFHWATI;HSFHWATI;C:\WINDOWS\system32\DRIVERS\HSFHWATI.sys [2004-12-15 15:18] R3 int15.sys;int15.sys;C:\Program Files\acer\eRecovery\int15.sys [2005-01-13 14:46] R3 POWERKEY;POWERKEY;C:\Program Files\Launch Manager\POWERKEY.sys [2000-12-19 18:29] S1 Wbutton;Wbutton;C:\WINDOWS\system32\drivers\Wbutton.sys [] S3 k600bus;Sony Ericsson 600i driver (WDM);C:\WINDOWS\system32\DRIVERS\k600bus.sys [2005-05-11 14:12] S3 k600mdfl;Sony Ericsson 600i USB WMC Modem Filter;C:\WINDOWS\system32\DRIVERS\k600mdfl.sys [2005-05-11 14:12] S3 k600mdm;Sony Ericsson 600i USB WMC Modem Drivers;C:\WINDOWS\system32\DRIVERS\k600mdm.sys [2005-05-11 14:12] S3 k600mgmt;Sony Ericsson 600i USB WMC Device Management Drivers;C:\WINDOWS\system32\DRIVERS\k600mgmt.sys [2005-05-11 14:12] S3 k600obex;Sony Ericsson 600i USB WMC OBEX Interface Drivers;C:\WINDOWS\system32\DRIVERS\k600obex.sys [2005-05-11 14:12] [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{08160ece-232c-11dc-a949-000ae4e0eb10}] \Shell\AutoRun\command - F:\AutoRun.exe [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{14d826b2-a42b-11dc-a9f4-cf70bdd52b4f}] \Shell\AutoRun\command - F:\AutoRun.exe [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{14d826b4-a42b-11dc-a9f4-000ae4e0eb10}] \Shell\AutoRun\command - F:\AutoRun.exe [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{14d826b5-a42b-11dc-a9f4-000ae4e0eb10}] \Shell\AutoRun\command - F:\AutoRun.exe [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{33a8d8c6-2ad6-11dc-a956-000ae4e0eb10}] \Shell\AutoRun\command - F:\AutoRun.exe [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{8e67c4b4-a666-11dc-a9f5-000ae4e0eb10}] \Shell\AutoRun\command - F:\AutoRun.exe [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{e0dd8bad-ddb8-11da-a802-000ae4e0eb10}] \Shell\AutoRun\command - H:\SetupCN.exe . ************************************************************************** catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2008-03-01 08:29:48 Windows 5.1.2600 Service Pack 2 FAT NTAPI scanning hidden processes ... scanning hidden autostart entries ... scanning hidden files ... scan completed successfully hidden files: 0 ************************************************************************** . --------------------- DLLs Loaded Under Running Processes --------------------- PROCESS: C:\WINDOWS\explorer.exe [6.00.2900.3156] -> C:\Program Files\RF Wireless Mouse\NoEdge.dll . ------------------------ Other Running Processes ------------------------ . C:\WINDOWS\system32\Ati2evxx.exe C:\WINDOWS\System32\wltrysvc.exe C:\WINDOWS\System32\bcmwltry.exe C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe C:\Program Files\F-Secure\Anti-Virus\fsgk32st.exe C:\Program Files\F-Secure\BackWeb\7681197\program\fsbwsys.exe C:\Program Files\F-Secure\Anti-Virus\FSGK32.EXE C:\Program Files\F-Secure\Common\FSMA32.EXE C:\Program Files\F-Secure\Anti-Virus\fssm32.exe C:\Program Files\F-Secure\Common\FSMB32.EXE C:\Program Files\F-Secure\Common\FCH32.EXE C:\Program Files\F-Secure\Common\FAMEH32.EXE C:\Program Files\F-Secure\Common\FNRB32.EXE C:\Program Files\F-Secure\FWES\Program\fsdfwd.exe C:\Program Files\F-Secure\Common\FIH32.EXE C:\Program Files\F-Secure\Anti-Virus\fsav32.exe C:\WINDOWS\system32\Ati2evxx.exe C:\Program Files\F-Secure\BackWeb\7681197\Program\F-Secure Automatic Update.exe C:\WINDOWS\system32\WLTRAY.exe C:\Program Files\F-Secure\FSGUI\fsguiexe.exe C:\Program Files\acer\eRecovery\Monitor.exe C:\Program Files\Common Files\PCSuite\Services\ServiceLayer.exe C:\PROGRA~1\COMMON~1\Nokia\MPAPI\MPAPI3s.exe . ************************************************************************** . Completion time: 2008-03-01 8:32:51 - machine was rebooted ComboFix-quarantined-files.txt 2008-03-01 06:32:46 . 2008-02-14 22:43:24 --- E O F ---
Escan Ohjeet tuolla sivulla. http://koti.mbnet.fi/pattaya1/escanmwav.htm lataa tuosta http://www.spywareinfo.dk/download/mwav.exe päivitä tuosta http://koti.mbnet.fi/pattaya1/lataus/Mwav.bat laita täpit merkkauksien mukaan http://koti.mbnet.fi/pattaya1/eScan6.jpg scannaa jos ala luukkuun tulee jotain niin kopioi se näin: Käytä komentoa Ctrl+A. Kopioi rivit komennolla Ctrl+C. Liitä rivit komennolla Ctrl+V. Laita virus log tänne.
