kone hidastunut, sammuilee, palomuuri käynnistettävä aina uudelleen...

Discussion in 'Virukset ja haittaohjelmat - HijackThis -logit' started by Nicorette, Feb 11, 2008.

  1. Nicorette

    Nicorette Member

    Joined:
    Jan 12, 2007
    Messages:
    18
    Likes Received:
    0
    Trophy Points:
    11
    elikkäs sammuu 20-60sekunnin päästä kun työpöytä on valmistunut ja tekee aina saman kolme kertaa ja sitten wörkkii, ja palomuuri ei käynnisty automaattisesti vaikka se on laitettu aukeamaan kylläkään tällä hetkellä ei ole kun windowsin oma palomuuri ku f-securen tiedostot on korruptoituneita ja vaikka mitä muuta paskaa esiintyy koneessa on jo kolmas kerta vuoden sisällä kun uudelleen joutunut ajamaan koko p***an

    ettäs aattelin kokeilla jos tästä olis apuu...

    Logfile of Trend Micro HijackThis v2.0.2
    Scan saved at 16:59:21, on 11.2.2008
    Platform: Windows XP SP2 (WinNT 5.01.2600)
    MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
    Boot mode: Normal

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
    C:\WINDOWS\Explorer.EXE
    C:\WINDOWS\system32\spoolsv.exe
    C:\Program Files\QuickTime\qttask.exe
    C:\Program Files\Analog Devices\SoundMAX\SMax4PNP.exe
    C:\Program Files\Analog Devices\SoundMAX\smax4.exe
    C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
    C:\WINDOWS\system32\ctfmon.exe
    C:\Program Files\MSN Messenger\MsnMsgr.Exe
    C:\Program Files\DNA\btdna.exe
    C:\Program Files\Messenger\msmsgs.exe
    C:\Program Files\TGTSoft\StyleXP\StyleXP.exe
    C:\Program Files\DAEMON Tools\daemon.exe
    C:\WINDOWS\system32\tcpsvcs.exe
    C:\WINDOWS\System32\snmp.exe
    C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\system32\dllhost.exe
    C:\WINDOWS\system32\dllhost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\Program Files\MSN Messenger\usnsvc.exe
    H:\Program Files\Bit Torrent\BitTorrent\bittorrent.exe
    C:\WINDOWS\system32\NOTEPAD.EXE
    C:\WINDOWS\system32\NOTEPAD.EXE
    D:\Program Files\Mozilla Firefox\firefox.exe
    C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

    R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Linkit
    O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
    O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
    O2 - BHO: TGTSoft Explorer Toolbar Changer - {C333CF63-767F-4831-94AC-E683D962C63C} - C:\Program Files\TGTSoft\StyleXP\TGT_BHO.dll
    O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
    O4 - HKLM\..\Run: [PRONoMgr.exe] C:\Program Files\Intel\NCS\PROSet\PRONoMgr.exe
    O4 - HKLM\..\Run: [Ptipbmf] rundll32.exe ptipbmf.dll,SetWriteCacheMode
    O4 - HKLM\..\Run: [F-Secure Manager] "e:\program files\Common\FSM32.EXE" /splash
    O4 - HKLM\..\Run: [iTunesHelper] "H:\i Tunes\iTunesHelper.exe"
    O4 - HKLM\..\Run: [SoundMAXPnP] C:\Program Files\Analog Devices\SoundMAX\SMax4PNP.exe
    O4 - HKLM\..\Run: [SoundMAX] "C:\Program Files\Analog Devices\SoundMAX\smax4.exe" /tray
    O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
    O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
    O4 - HKLM\..\Run: [NBKeyScan] "C:\Program Files\Nero\Nero8\Nero BackItUp\NBKeyScan.exe"
    O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
    O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
    O4 - HKCU\..\Run: [BitTorrent DNA] "C:\Program Files\DNA\btdna.exe"
    O4 - HKCU\..\Run: [drvsyskit] C:\WINDOWS\system32\drivers\hldrrr.exe
    O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
    O4 - HKCU\..\Run: [STYLEXP] C:\Program Files\TGTSoft\StyleXP\StyleXP.exe -Hide
    O4 - HKCU\..\Run: [DAEMON Tools] "C:\Program Files\DAEMON Tools\daemon.exe" -lang 1033
    O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Paikallinen palve')
    O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Verkkopalve')
    O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
    O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
    O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
    O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://www.update.microsoft.com/mic...ls/en/x86/client/muweb_site.cab?1202406414718
    O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
    O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
    O23 - Service: F-Secure BackWeb LAN Access - Unknown owner - e:\program files\BackWeb\7681197\Program\fsbwlan.exe
    O23 - Service: F-Secure Network Request Broker - F-Secure Corporation - e:\program files\Common\FNRB32.EXE
    O23 - Service: F-Secure Authentication Agent (FSAA) - F-Secure Corporation. All Rights Reserved. - e:\program files\Common\FSAA.EXE
    O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
    O23 - Service: iPod-palvelu (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
    O23 - Service: Intel NCS NetService (NetSvc) - Intel(R) Corporation - C:\Program Files\Intel\NCS\Sync\NetSvc.exe
    O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe

    kiitos jo etukäteen...
     
    Nicorette, Feb 11, 2008
    #1
  2. Hujo

    Hujo Guest

    Hujo, Feb 12, 2008
    #2
  3. Nicorette

    Nicorette Member

    Joined:
    Jan 12, 2007
    Messages:
    18
    Likes Received:
    0
    Trophy Points:
    11
    juu tulihan tota tekstiä vähän nolottaa kyl näyttää miten paljon..


    File C:\Documents and Settings\Kone\Local Settings\Temp\ErrorSafeScannerSetup.exe tagged as not-a-virus:Downloader.Win32.WinFixer.t. No Action Taken.
    File C:\Documents and Settings\NiCoReTTe\Application Data\m\shared\-.Symantec.Norton.Internet.Security.2006.Multilanguage.-.Crak.zip infected by "Trojan-Downloader.Win32.Bagle.jp" Virus. Action Taken: File Deleted.
    File C:\Documents and Settings\NiCoReTTe\Application Data\m\shared\15 Slide Puzzle 1.5.zip infected by "Trojan-Downloader.Win32.Bagle.jp" Virus. Action Taken: File Deleted.
    File C:\Documents and Settings\NiCoReTTe\Application Data\m\shared\1DNest 3.3.zip infected by "Trojan-Downloader.Win32.Bagle.jp" Virus. Action Taken: File Deleted.
    File C:\Documents and Settings\NiCoReTTe\Application Data\m\shared\1st Screen Lock 7.3 Key.zip infected by "Trojan-Downloader.Win32.Bagle.jp" Virus. Action Taken: File Deleted.
    File C:\Documents and Settings\NiCoReTTe\Application Data\m\shared\3D Earth ScreenSaver 2.zip infected by "Trojan-Downloader.Win32.Bagle.jp" Virus. Action Taken: File Deleted.
    File C:\Documents and Settings\NiCoReTTe\Application Data\m\shared\3D Motion ScreenSaver 1.zip infected by "Trojan-Downloader.Win32.Bagle.jp" Virus. Action Taken: File Deleted.
    File C:\Documents and Settings\NiCoReTTe\Application Data\m\shared\642-691 Practice Exam Testing Engine Software 1.0.zip infected by "Trojan-Downloader.Win32.Bagle.jp" Virus. Action Taken: File Deleted.
    File C:\Documents and Settings\NiCoReTTe\Application Data\m\shared\A-Lex Enligsh Dictionary 1.65.zip infected by "Trojan-Downloader.Win32.Bagle.jp" Virus. Action Taken: File Deleted.
    File C:\Documents and Settings\NiCoReTTe\Application Data\m\shared\ABCWebWizard Website Design Software 1.0.zip infected by "Trojan-Downloader.Win32.Bagle.jp" Virus. Action Taken: File Deleted.
    File C:\Documents and Settings\NiCoReTTe\Application Data\m\shared\ABF Favorite Folders 1.31 [Crack].zip infected by "Trojan-Downloader.Win32.Bagle.jp" Virus. Action Taken: File Deleted.
    File C:\Documents and Settings\NiCoReTTe\Application Data\m\shared\Access Data Transfer Assistant 2000 3.zip infected by "Trojan-Downloader.Win32.Bagle.jp" Virus. Action Taken: File Deleted.
    File C:\Documents and Settings\NiCoReTTe\Application Data\m\shared\Account Pro 8.3.120.zip infected by "Trojan-Downloader.Win32.Bagle.jp" Virus. Action Taken: File Deleted.
    File C:\Documents and Settings\NiCoReTTe\Application Data\m\shared\Active Keyboard 3.11.zip infected by "Trojan-Downloader.Win32.Bagle.jp" Virus. Action Taken: File Deleted.
    File C:\Documents and Settings\NiCoReTTe\Application Data\m\shared\ActualDoc Professional 3.5.zip infected by "Trojan-Downloader.Win32.Bagle.jp" Virus. Action Taken: File Deleted.
    File C:\Documents and Settings\NiCoReTTe\Application Data\m\shared\Adobe Acrobat Professional and Standard Update 7.0.3.zip infected by "Trojan-Downloader.Win32.Bagle.jp" Virus. Action Taken: File Deleted.
    File C:\Documents and Settings\NiCoReTTe\Application Data\m\shared\Advanced HTTP Request Automaton 1.1.zip infected by "Trojan-Downloader.Win32.Bagle.jp" Virus. Action Taken: File Deleted.
    File C:\Documents and Settings\NiCoReTTe\Application Data\m\shared\Adware Killer 6.0.3 (KeyGen).zip infected by "Trojan-Downloader.Win32.Bagle.jp" Virus. Action Taken: File Deleted.
    File C:\Documents and Settings\NiCoReTTe\Application Data\m\shared\AGIS Mapping 1.72.zip infected by "Trojan-Downloader.Win32.Bagle.jp" Virus. Action Taken: File Deleted.
    File C:\Documents and Settings\NiCoReTTe\Application Data\m\shared\Aimersoft DVD to WMV Converter 1.0.21 [Key+Serial].zip infected by "Trojan-Downloader.Win32.Bagle.jp" Virus. Action Taken: File Deleted.
    File C:\Documents and Settings\NiCoReTTe\Application Data\m\shared\AllSubmitter 2.6.zip infected by "Trojan-Downloader.Win32.Bagle.jp" Virus. Action Taken: File Deleted.
    File C:\Documents and Settings\NiCoReTTe\Application Data\m\shared\Amor WMV to AVI MPEG VCD DVD Converter 2.3.9 (With Crack).zip infected by "Trojan-Downloader.Win32.Bagle.jp" Virus. Action Taken: File Deleted.
    File C:\Documents and Settings\NiCoReTTe\Application Data\m\shared\AmphiSoft Photo Detailer 1.1.zip infected by "Trojan-Downloader.Win32.Bagle.jp" Virus. Action Taken: File Deleted.
    File C:\Documents and Settings\NiCoReTTe\Application Data\m\shared\Arelis 4.1.zip infected by "Trojan-Downloader.Win32.Bagle.jp" Virus. Action Taken: File Deleted.
    File C:\Documents and Settings\NiCoReTTe\Application Data\m\shared\AsciiDataset 2004.3.zip infected by "Trojan-Downloader.Win32.Bagle.jp" Virus. Action Taken: File Deleted.
    File C:\Documents and Settings\NiCoReTTe\Application Data\m\shared\Ashampoo ClipFisher 1.01 [Key+Serial].zip infected by "Trojan-Downloader.Win32.Bagle.jp" Virus. Action Taken: File Deleted.
    File C:\Documents and Settings\NiCoReTTe\Application Data\m\shared\Auction Data Retriever 1.5.zip infected by "Trojan-Downloader.Win32.Bagle.jp" Virus. Action Taken: File Deleted.
    File C:\Documents and Settings\NiCoReTTe\Application Data\m\shared\Avarzia Future Download Manager 1.zip infected by "Trojan-Downloader.Win32.Bagle.jp" Virus. Action Taken: File Deleted.
    File C:\Documents and Settings\NiCoReTTe\Application Data\m\shared\AZZ Cardfile 4.0 Beta c KeyGen.zip infected by "Trojan-Downloader.Win32.Bagle.jp" Virus. Action Taken: File Deleted.
    File C:\Documents and Settings\NiCoReTTe\Application Data\m\shared\Baby FTP Server 1.24.zip infected by "Trojan-Downloader.Win32.Bagle.jp" Virus. Action Taken: File Deleted.
    File C:\Documents and Settings\NiCoReTTe\Application Data\m\shared\Babya Presenter Standard 3.0.zip infected by "Trojan-Downloader.Win32.Bagle.jp" Virus. Action Taken: File Deleted.
    File C:\Documents and Settings\NiCoReTTe\Application Data\m\shared\Baseball Scoreboard 1.0.zip infected by "Trojan-Downloader.Win32.Bagle.jp" Virus. Action Taken: File Deleted.
    File C:\Documents and Settings\NiCoReTTe\Application Data\m\shared\Battlefield 1942 - Benghazi map.zip infected by "Trojan-Downloader.Win32.Bagle.jp" Virus. Action Taken: File Deleted.
    File C:\Documents and Settings\NiCoReTTe\Application Data\m\shared\BirdWatch 1.zip infected by "Trojan-Downloader.Win32.Bagle.jp" Virus. Action Taken: File Deleted.
    File C:\Documents and Settings\NiCoReTTe\Application Data\m\shared\Brilliant Database SDK 5.1 RC1 (KeyGen).zip infected by "Trojan-Downloader.Win32.Bagle.jp" Virus. Action Taken: File Deleted.
    File C:\Documents and Settings\NiCoReTTe\Application Data\m\shared\Budget Calculator 1.0.zip infected by "Trojan-Downloader.Win32.Bagle.jp" Virus. Action Taken: File Deleted.
    File C:\Documents and Settings\NiCoReTTe\Application Data\m\shared\BusRunner 1.1.zip infected by "Trojan-Downloader.Win32.Bagle.jp" Virus. Action Taken: File Deleted.
    File C:\Documents and Settings\NiCoReTTe\Application Data\m\shared\Buzzsaw On-The-Fly Defragmenter 1.zip infected by "Trojan-Downloader.Win32.Bagle.jp" Virus. Action Taken: File Deleted.
    File C:\Documents and Settings\NiCoReTTe\Application Data\m\shared\CacheBoost Professional Edition 4.00.zip infected by "Trojan-Downloader.Win32.Bagle.jp" Virus. Action Taken: File Deleted.
    File C:\Documents and Settings\NiCoReTTe\Application Data\m\shared\Carl the Caveman Christmas Adventures 1.1.zip infected by "Trojan-Downloader.Win32.Bagle.jp" Virus. Action Taken: File Deleted.
    File C:\Documents and Settings\NiCoReTTe\Application Data\m\shared\CD ROM Drive Remote Disabler 2.zip infected by "Trojan-Downloader.Win32.Bagle.jp" Virus. Action Taken: File Deleted.
    File C:\Documents and Settings\NiCoReTTe\Application Data\m\shared\Chicken 1.0.zip infected by "Trojan-Downloader.Win32.Bagle.jp" Virus. Action Taken: File Deleted.
    File C:\Documents and Settings\NiCoReTTe\Application Data\m\shared\ColorPop 1.0 Key.zip infected by "Trojan-Downloader.Win32.Bagle.jp" Virus. Action Taken: File Deleted.
    File C:\Documents and Settings\NiCoReTTe\Application Data\m\shared\ColorSafe 1.5.zip infected by "Trojan-Downloader.Win32.Bagle.jp" Virus. Action Taken: File Deleted.
    File C:\Documents and Settings\NiCoReTTe\Application Data\m\shared\ConfigInspector 1.zip infected by "Trojan-Downloader.Win32.Bagle.jp" Virus. Action Taken: File Deleted.
    File C:\Documents and Settings\NiCoReTTe\Application Data\m\shared\Convert BMP to JPG 3.60.zip infected by "Trojan-Downloader.Win32.Bagle.jp" Virus. Action Taken: File Deleted.
    File C:\Documents and Settings\NiCoReTTe\Application Data\m\shared\Cosmic Voyage 3.5 KeyGen.zip infected by "Trojan-Downloader.Win32.Bagle.jp" Virus. Action Taken: File Deleted.
    File C:\Documents and Settings\NiCoReTTe\Application Data\m\shared\CS-Cart shopping cart software 1.3.4.zip infected by "Trojan-Downloader.Win32.Bagle.jp" Virus. Action Taken: File Deleted.
    File C:\Documents and Settings\NiCoReTTe\Application Data\m\shared\CSockSrvr Class 1.0.2.4.zip infected by "Trojan-Downloader.Win32.Bagle.jp" Virus. Action Taken: File Deleted.
    File C:\Documents and Settings\NiCoReTTe\Application Data\m\shared\CT Cookie Spy 1.zip infected by "Trojan-Downloader.Win32.Bagle.jp" Virus. Action Taken: File Deleted.
    File C:\Documents and Settings\NiCoReTTe\Application Data\m\shared\Data Tracker for Baseball 1.0.zip infected by "Trojan-Downloader.Win32.Bagle.jp" Virus. Action Taken: File Deleted.
    File C:\Documents and Settings\NiCoReTTe\Application Data\m\shared\Data-XRay 2.0.zip infected by "Trojan-Downloader.Win32.Bagle.jp" Virus. Action Taken: File Deleted.
    File C:\Documents and Settings\NiCoReTTe\Application Data\m\shared\DeadLine Calculator 1.0.zip infected by "Trojan-Downloader.Win32.Bagle.jp" Virus. Action Taken: File Deleted.
    File C:\Documents and Settings\NiCoReTTe\Application Data\m\shared\Describe 6.1.8.1148n EE.zip infected by "Trojan-Downloader.Win32.Bagle.jp" Virus. Action Taken: File Deleted.
    File C:\Documents and Settings\NiCoReTTe\Application Data\m\shared\DesktopCoral 1.07.zip infected by "Trojan-Downloader.Win32.Bagle.jp" Virus. Action Taken: File Deleted.
    File C:\Documents and Settings\NiCoReTTe\Application Data\m\shared\Diatonically Speaking 1.4.zip infected by "Trojan-Downloader.Win32.Bagle.jp" Virus. Action Taken: File Deleted.
    File C:\Documents and Settings\NiCoReTTe\Application Data\m\shared\Digital Funeral Planner 3.0.5 [Key].zip infected by "Trojan-Downloader.Win32.Bagle.jp" Virus. Action Taken: File Deleted.
    File C:\Documents and Settings\NiCoReTTe\Application Data\m\shared\Dragnifier 2.5.zip infected by "Trojan-Downloader.Win32.Bagle.jp" Virus. Action Taken: File Deleted.
    File C:\Documents and Settings\NiCoReTTe\Application Data\m\shared\eBoard 1.0 (Key+Serial).zip infected by "Trojan-Downloader.Win32.Bagle.jp" Virus. Action Taken: File Deleted.
    File C:\Documents and Settings\NiCoReTTe\Application Data\m\shared\Eclipse SDK 3.1.2.zip infected by "Trojan-Downloader.Win32.Bagle.jp" Virus. Action Taken: File Deleted.
    File C:\Documents and Settings\NiCoReTTe\Application Data\m\shared\Elf Girl Sim Date RPG 1.zip infected by "Trojan-Downloader.Win32.Bagle.jp" Virus. Action Taken: File Deleted.
    File C:\Documents and Settings\NiCoReTTe\Application Data\m\shared\eLife Coupler 3.5.zip infected by "Trojan-Downloader.Win32.Bagle.jp" Virus. Action Taken: File Deleted.
    File C:\Documents and Settings\NiCoReTTe\Application Data\m\shared\Elite Clock Screensaver 1.5.15.zip infected by "Trojan-Downloader.Win32.Bagle.jp" Virus. Action Taken: File Deleted.
    File C:\Documents and Settings\NiCoReTTe\Application Data\m\shared\Express Timesync 3.4 build 1207.zip infected by "Trojan-Downloader.Win32.Bagle.jp" Virus. Action Taken: File Deleted.
    File C:\Documents and Settings\NiCoReTTe\Application Data\m\shared\Fantastic Ocean 3D Screensaver 1.0 [Patch].zip infected by "Trojan-Downloader.Win32.Bagle.jp" Virus. Action Taken: File Deleted.
    File C:\Documents and Settings\NiCoReTTe\Application Data\m\shared\FantasyDVD Player Platinum 9.37 Build 708 (Key+Serial).zip infected by "Trojan-Downloader.Win32.Bagle.jp" Virus. Action Taken: File Deleted.
    File C:\Documents and Settings\NiCoReTTe\Application Data\m\shared\FavKeeper 1.1.zip infected by "Trojan-Downloader.Win32.Bagle.jp" Virus. Action Taken: File Deleted.
    File C:\Documents and Settings\NiCoReTTe\Application Data\m\shared\Firefly 1.0.24.zip infected by "Trojan-Downloader.Win32.Bagle.jp" Virus. Action Taken: File Deleted.
    File C:\Documents and Settings\NiCoReTTe\Application Data\m\shared\flat assembler 1.67.7.zip infected by "Trojan-Downloader.Win32.Bagle.jp" Virus. Action Taken: File Deleted.
    File C:\Documents and Settings\NiCoReTTe\Application Data\m\shared\FormArtist 3.5.zip infected by "Trojan-Downloader.Win32.Bagle.jp" Virus. Action Taken: File Deleted.
    File C:\Documents and Settings\NiCoReTTe\Application Data\m\shared\Genie Eyes-Only 1.0 Build 1.0.214.1.zip infected by "Trojan-Downloader.Win32.Bagle.jp" Virus. Action Taken: File Deleted.
    File C:\Documents and Settings\NiCoReTTe\Application Data\m\shared\Glaos 1.1.zip infected by "Trojan-Downloader.Win32.Bagle.jp" Virus. Action Taken: File Deleted.
    File C:\Documents and Settings\NiCoReTTe\Application Data\m\shared\Google Notebook 1.0.2.4.zip infected by "Trojan-Downloader.Win32.Bagle.jp" Virus. Action Taken: File Deleted.
    File C:\Documents and Settings\NiCoReTTe\Application Data\m\shared\Grandma's Little Real Estate Helper 1.0 [With Crack].zip infected by "Trojan-Downloader.Win32.Bagle.jp" Virus. Action Taken: File Deleted.
    File C:\Documents and Settings\NiCoReTTe\Application Data\m\shared\Guitar Chords Library 5.7.zip infected by "Trojan-Downloader.Win32.Bagle.jp" Virus. Action Taken: File Deleted.
    File C:\Documents and Settings\NiCoReTTe\Application Data\m\shared\HAL 7.zip infected by "Trojan-Downloader.Win32.Bagle.jp" Virus. Action Taken: File Deleted.
    File C:\Documents and Settings\NiCoReTTe\Application Data\m\shared\Heliocode Doc@Hand Document Server 1.0.2 Key.zip infected by "Trojan-Downloader.Win32.Bagle.jp" Virus. Action Taken: File Deleted.
    File C:\Documents and Settings\NiCoReTTe\Application Data\m\shared\Hidden & Dangerous 2 patch 1.03.zip infected by "Trojan-Downloader.Win32.Bagle.jp" Virus. Action Taken: File Deleted.
    File C:\Documents and Settings\NiCoReTTe\Application Data\m\shared\HiddenFinder 1.3.02 build 386.zip infected by "Trojan-Downloader.Win32.Bagle.jp" Virus. Action Taken: File Deleted.
    File C:\Documents and Settings\NiCoReTTe\Application Data\m\shared\HP0-803 Practice Exam Testing Engine Software 1.0 (Patch).zip infected by "Trojan-Downloader.Win32.Bagle.jp" Virus. Action Taken: File Deleted.
    File C:\Documents and Settings\NiCoReTTe\Application Data\m\shared\iAutoArtwork 2.64 [With Crack].zip infected by "Trojan-Downloader.Win32.Bagle.jp" Virus. Action Taken: File Deleted.
    File C:\Documents and Settings\NiCoReTTe\Application Data\m\shared\ICQ Snif 2.0.zip infected by "Trojan-Downloader.Win32.Bagle.jp" Virus. Action Taken: File Deleted.
    File C:\Documents and Settings\NiCoReTTe\Application Data\m\shared\IE5skinner 1.3.zip infected by "Trojan-Downloader.Win32.Bagle.jp" Virus. Action Taken: File Deleted.
    File C:\Documents and Settings\NiCoReTTe\Application Data\m\shared\Internet- The Browser 1.zip infected by "Trojan-Downloader.Win32.Bagle.jp" Virus. Action Taken: File Deleted.
    File C:\Documents and Settings\NiCoReTTe\Application Data\m\shared\IView Lite Inventory Manager 3.0 Serial.zip infected by "Trojan-Downloader.Win32.Bagle.jp" Virus. Action Taken: File Deleted.
    File C:\Documents and Settings\NiCoReTTe\Application Data\m\shared\JC WebAnswers 1.0.zip infected by "Trojan-Downloader.Win32.Bagle.jp" Virus. Action Taken: File Deleted.
    File C:\Documents and Settings\NiCoReTTe\Application Data\m\shared\JPEGtoASCII 1.0.0.zip infected by "Trojan-Downloader.Win32.Bagle.jp" Virus. Action Taken: File Deleted.
    File C:\Documents and Settings\NiCoReTTe\Application Data\m\shared\JustFTP 3.0.zip infected by "Trojan-Downloader.Win32.Bagle.jp" Virus. Action Taken: File Deleted.
    File C:\Documents and Settings\NiCoReTTe\Application Data\m\shared\Kaan Barbarian's Blade v03.11.03 patch.zip infected by "Trojan-Downloader.Win32.Bagle.jp" Virus. Action Taken: File Deleted.
    File C:\Documents and Settings\NiCoReTTe\Application Data\m\shared\Kaspersky.Antivirus.Personal.5.0.156.En.Español.Crack.Llave.De.Licencia.zip infected by "Trojan-Downloader.Win32.Bagle.jp" Virus. Action Taken: File Deleted.
    File C:\Documents and Settings\NiCoReTTe\Application Data\m\shared\Kaspersky.AVP.Anti-Virus.Personal.Pro.v4.5.0.58.+.KEY.[Español].[Spanish].zip infected by "Trojan-Downloader.Win32.Bagle.jp" Virus. Action Taken: File Deleted.
    File C:\Documents and Settings\NiCoReTTe\Application Data\m\shared\Kaspersky_2006.6.0.0297b.zip infected by "Trojan-Downloader.Win32.Bagle.jp" Virus. Action Taken: File Deleted.
    File C:\Documents and Settings\NiCoReTTe\Application Data\m\shared\Keyroid 1.0.5.zip infected by "Trojan-Downloader.Win32.Bagle.jp" Virus. Action Taken: File Deleted.
    File C:\Documents and Settings\NiCoReTTe\Application Data\m\shared\King James Bible for Palm 3.51e015.zip infected by "Trojan-Downloader.Win32.Bagle.jp" Virus. Action Taken: File Deleted.
    File C:\Documents and Settings\NiCoReTTe\Application Data\m\shared\Kit Builders and Resellers Source Book 1.0.zip infected by "Trojan-Downloader.Win32.Bagle.jp" Virus. Action Taken: File Deleted.
    File C:\Documents and Settings\NiCoReTTe\Application Data\m\shared\Leemo 1.07.zip infected by "Trojan-Downloader.Win32.Bagle.jp" Virus. Action Taken: File Deleted.
    File C:\Documents and Settings\NiCoReTTe\Application Data\m\shared\Linear Regression 1.00 (Serial).zip infected by "Trojan-Downloader.Win32.Bagle.jp" Virus. Action Taken: File Deleted.
    File C:\Documents and Settings\NiCoReTTe\Application Data\m\shared\LingvoSoft Picture Dictionary 2007 German - Portuguese 1.1.18 (Key).zip infected by "Trojan-Downloader.Win32.Bagle.jp" Virus. Action Taken: File Deleted.
    File C:\Documents and Settings\NiCoReTTe\Application Data\m\shared\LingvoSoft Talking Picture Dictionary 2007 Vietnamese - Chinese Mandarin Traditional 1.1.20.zip infected by "Trojan-Downloader.Win32.Bagle.jp" Virus. Action Taken: File Deleted.
    File C:\Documents and Settings\NiCoReTTe\Application Data\m\shared\LockAnEXE 1.21.zip infected by "Trojan-Downloader.Win32.Bagle.jp" Virus. Action Taken: File Deleted.
    File C:\Documents and Settings\NiCoReTTe\Application Data\m\shared\Luxena dbExpress driver for Informix Pro 1.2.4 (With Crack).zip infected by "Trojan-Downloader.Win32.Bagle.jp" Virus. Action Taken: File Deleted.
    File C:\Documents and Settings\NiCoReTTe\Application Data\m\shared\Maintenance Parts Bin 7.4.7 (Serial).zip infected by "Trojan-Downloader.Win32.Bagle.jp" Virus. Action Taken: File Deleted.
    File C:\Documents and Settings\NiCoReTTe\Application Data\m\shared\Manual.de.McAfee.Firewall.Español.zip infected by "Trojan-Downloader.Win32.Bagle.jp" Virus. Action Taken: File Deleted.
    File C:\Documents and Settings\NiCoReTTe\Application Data\m\shared\McAfee.Personal.Firewall.Plus.v4.8.0.4-ROR.ShareReactor.zip infected by "Trojan-Downloader.Win32.Bagle.jp" Virus. Action Taken: File Deleted.
    File C:\Documents and Settings\NiCoReTTe\Application Data\m\shared\ME Weights 3.0.zip infected by "Trojan-Downloader.Win32.Bagle.jp" Virus. Action Taken: File Deleted.
    File C:\Documents and Settings\NiCoReTTe\Application Data\m\shared\Mellosoftron 3.4 (Key+Serial).zip infected by "Trojan-Downloader.Win32.Bagle.jp" Virus. Action Taken: File Deleted.
    File C:\Documents and Settings\NiCoReTTe\Application Data\m\shared\Message Exporter 1.1 (KeyGen).zip infected by "Trojan-Downloader.Win32.Bagle.jp" Virus. Action Taken: File Deleted.
    File C:\Documents and Settings\NiCoReTTe\Application Data\m\shared\MessagePoint Enterprise Edition 1.0 [Cracked].zip infected by "Trojan-Downloader.Win32.Bagle.jp" Virus. Action Taken: File Deleted.
    File C:\Documents and Settings\NiCoReTTe\Application Data\m\shared\MessengerLog Pro 6.26.zip infected by "Trojan-Downloader.Win32.Bagle.jp" Virus. Action Taken: File Deleted.
    File C:\Documents and Settings\NiCoReTTe\Application Data\m\shared\Microsoft Plus! PhotoStory LE 2.0.zip infected by "Trojan-Downloader.Win32.Bagle.jp" Virus. Action Taken: File Deleted.
    File C:\Documents and Settings\NiCoReTTe\Application Data\m\shared\MileMate 3.0.zip infected by "Trojan-Downloader.Win32.Bagle.jp" Virus. Action Taken: File Deleted.
    File C:\Documents and Settings\NiCoReTTe\Application Data\m\shared\MiM Lite B (Eng) 1.zip infected by "Trojan-Downloader.Win32.Bagle.jp" Virus. Action Taken: File Deleted.
    File C:\Documents and Settings\NiCoReTTe\Application Data\m\shared\miniWEBedit 1.1.9 [Serial].zip infected by "Trojan-Downloader.Win32.Bagle.jp" Virus. Action Taken: File Deleted.
    File C:\Documents and Settings\NiCoReTTe\Application Data\m\shared\miOOt Live Chat 3.0.1 (Key+Serial).zip infected by "Trojan-Downloader.Win32.Bagle.jp" Virus. Action Taken: File Deleted.
    File C:\Documents and Settings\NiCoReTTe\Application Data\m\shared\mIRC 6.21.zip infected by "Trojan-Downloader.Win32.Bagle.jp" Virus. Action Taken: File Deleted.
    File C:\Documents and Settings\NiCoReTTe\Application Data\m\shared\Missing Since January patch.zip infected by "Trojan-Downloader.Win32.Bagle.jp" Virus. Action Taken: File Deleted.
    File C:\Documents and Settings\NiCoReTTe\Application Data\m\shared\MLP-Map 1.0.zip infected by "Trojan-Downloader.Win32.Bagle.jp" Virus. Action Taken: File Deleted.
    File C:\Documents and Settings\NiCoReTTe\Application Data\m\shared\Mortgage Prelude 2.4.zip infected by "Trojan-Downloader.Win32.Bagle.jp" Virus. Action Taken: File Deleted.
    File C:\Documents and Settings\NiCoReTTe\Application Data\m\shared\MouseAround 1.zip infected by "Trojan-Downloader.Win32.Bagle.jp" Virus. Action Taken: File Deleted.
    File C:\Documents and Settings\NiCoReTTe\Application Data\m\shared\Multiquence 2.54 [Key].zip infected by "Trojan-Downloader.Win32.Bagle.jp" Virus. Action Taken: File Deleted.
    File C:\Documents and Settings\NiCoReTTe\Application Data\m\shared\MusiGenesis 1.2.5 [Key].zip infected by "Trojan-Downloader.Win32.Bagle.jp" Virus. Action Taken: File Deleted.
    File C:\Documents and Settings\NiCoReTTe\Application Data\m\shared\My Flexible Dictaphone 1.6 [KeyGen].zip infected by "Trojan-Downloader.Win32.Bagle.jp" Virus. Action Taken: File Deleted.
    File C:\Documents and Settings\NiCoReTTe\Application Data\m\shared\MySQL Developer 1.00 KeyGen.zip infected by "Trojan-Downloader.Win32.Bagle.jp" Virus. Action Taken: File Deleted.
    File C:\Documents and Settings\NiCoReTTe\Application Data\m\shared\NCN Chat 1.0.0829.zip infected by "Trojan-Downloader.Win32.Bagle.jp" Virus. Action Taken: File Deleted.
    File C:\Documents and Settings\NiCoReTTe\Application Data\m\shared\NetShell Suite 2.0.zip infected by "Trojan-Downloader.Win32.Bagle.jp" Virus. Action Taken: File Deleted.
    File C:\Documents and Settings\NiCoReTTe\Application Data\m\shared\NOD32_2007.en(vista.ready).zip infected by "Trojan-Downloader.Win32.Bagle.jp" Virus. Action Taken: File Deleted.
    File C:\Documents and Settings\NiCoReTTe\Application Data\m\shared\Nod32_v2.12.4.manual.plugin.(crack_de_por_vida)[español-spanish]by_Inaki84.zip infected by "Trojan-Downloader.Win32.Bagle.jp" Virus. Action Taken: File Deleted.
    File C:\Documents and Settings\NiCoReTTe\Application Data\m\shared\Nucleus Kernel Digital Media Recovery Software 4.02 [With Crack].zip infected by "Trojan-Downloader.Win32.Bagle.jp" Virus. Action Taken: File Deleted.
    File C:\Documents and Settings\NiCoReTTe\Application Data\m\shared\ODBscript.zip infected by "Trojan-Downloader.Win32.Bagle.jp" Virus. Action Taken: File Deleted.
    File C:\Documents and Settings\NiCoReTTe\Application Data\m\shared\Ogg Encoder Decoder v1.2.8b Patch.zip infected by "Trojan-Downloader.Win32.Bagle.jp" Virus. Action Taken: File Deleted.
    File C:\Documents and Settings\NiCoReTTe\Application Data\m\shared\OGphoto Autumn Screensaver 3.2.zip infected by "Trojan-Downloader.Win32.Bagle.jp" Virus. Action Taken: File Deleted.
    File C:\Documents and Settings\NiCoReTTe\Application Data\m\shared\OleClean 1.5.zip infected by "Trojan-Downloader.Win32.Bagle.jp" Virus. Action Taken: File Deleted.
    File C:\Documents and Settings\NiCoReTTe\Application Data\m\shared\Omniquad Set Me Up 3.6j.zip infected by "Trojan-Downloader.Win32.Bagle.jp" Virus. Action Taken: File Deleted.
    File C:\Documents and Settings\NiCoReTTe\Application Data\m\shared\Online Icon Set 2007.2 KeyGen.zip infected by "Trojan-Downloader.Win32.Bagle.jp" Virus. Action Taken: File Deleted.
    File C:\Documents and Settings\NiCoReTTe\Application Data\m\shared\Oracle2Excel 2006.zip infected by "Trojan-Downloader.Win32.Bagle.jp" Virus. Action Taken: File Deleted.
    File C:\Documents and Settings\NiCoReTTe\Application Data\m\shared\OrganizeMe 1.1.zip infected by "Trojan-Downloader.Win32.Bagle.jp" Virus. Action Taken: File Deleted.
    File C:\Documents and Settings\NiCoReTTe\Application Data\m\shared\Oriens JPEG2000 Professional 1.3.160.zip infected by "Trojan-Downloader.Win32.Bagle.jp" Virus. Action Taken: File Deleted.
    File C:\Documents and Settings\NiCoReTTe\Application Data\m\shared\Outline3D Offline Version 4.5 [Patch].zip infected by "Trojan-Downloader.Win32.Bagle.jp" Virus. Action Taken: File Deleted.
    File C:\Documents and Settings\NiCoReTTe\Application Data\m\shared\Paddle Battle 1.2.zip infected by "Trojan-Downloader.Win32.Bagle.jp" Virus. Action Taken: File Deleted.
    File C:\Documents and Settings\NiCoReTTe\Application Data\m\shared\Paloma 1.00.5612.zip infected by "Trojan-Downloader.Win32.Bagle.jp" Virus. Action Taken: File Deleted.
    File C:\Documents and Settings\NiCoReTTe\Application Data\m\shared\Panda_EnterpriSecure_with_TruPrevent_Technologies_3.06.10.zip infected by "Trojan-Downloader.Win32.Bagle.jp" Virus. Action Taken: File Deleted.
    File C:\Documents and Settings\NiCoReTTe\Application Data\m\shared\PathfinderIII 1.3 [Patch].zip infected by "Trojan-Downloader.Win32.Bagle.jp" Virus. Action Taken: File Deleted.
    File C:\Documents and Settings\NiCoReTTe\Application Data\m\shared\PC Alarm Clock 3.zip infected by "Trojan-Downloader.Win32.Bagle.jp" Virus. Action Taken: File Deleted.
    File C:\Documents and Settings\NiCoReTTe\Application Data\m\shared\PC Spy Keylogger 2.35 Key.zip infected by "Trojan-Downloader.Win32.Bagle.jp" Virus. Action Taken: File Deleted.
    File C:\Documents and Settings\NiCoReTTe\Application Data\m\shared\PC Tools AntiVirus 3.1 [KeyGen].zip infected by "Trojan-Downloader.Win32.Bagle.jp" Virus. Action Taken: File Deleted.
    File C:\Documents and Settings\NiCoReTTe\Application Data\m\shared\PDFDrucker 1.2.zip infected by "Trojan-Downloader.Win32.Bagle.jp" Virus. Action Taken: File Deleted.
    File C:\Documents and Settings\NiCoReTTe\Application Data\m\shared\PlacesBar Editor 1.0.zip infected by "Trojan-Downloader.Win32.Bagle.jp" Virus. Action Taken: File Deleted.
    File C:\Documents and Settings\NiCoReTTe\Application Data\m\shared\Plot2EMF 4.2.1012.zip infected by "Trojan-Downloader.Win32.Bagle.jp" Virus. Action Taken: File Deleted.
    File C:\Documents and Settings\NiCoReTTe\Application Data\m\shared\PNG Utilities Plugin 1.8.1.zip infected by "Trojan-Downloader.Win32.Bagle.jp" Virus. Action Taken: File Deleted.
    File C:\Documents and Settings\NiCoReTTe\Application Data\m\shared\PocketPC Battery Monitor 1.zip infected by "Trojan-Downloader.Win32.Bagle.jp" Virus. Action Taken: File Deleted.
    File C:\Documents and Settings\NiCoReTTe\Application Data\m\shared\PocketPC Themes 1.0.zip infected by "Trojan-Downloader.Win32.Bagle.jp" Virus. Action Taken: File Deleted.
    File C:\Documents and Settings\NiCoReTTe\Application Data\m\shared\Prescription Pad 2.7 (Key).zip infected by "Trojan-Downloader.Win32.Bagle.jp" Virus. Action Taken: File Deleted.
    File C:\Documents and Settings\NiCoReTTe\Application Data\m\shared\Print Wide HTML 1.0.0.zip infected by "Trojan-Downloader.Win32.Bagle.jp" Virus. Action Taken: File Deleted.
    File C:\Documents and Settings\NiCoReTTe\Application Data\m\shared\Proxel Lens Corrector 1.0.3.zip infected by "Trojan-Downloader.Win32.Bagle.jp" Virus. Action Taken: File Deleted.
    File C:\Documents and Settings\NiCoReTTe\Application Data\m\shared\QuickRecord 2.zip infected by "Trojan-Downloader.Win32.Bagle.jp" Virus. Action Taken: File Deleted.
    File C:\Documents and Settings\NiCoReTTe\Application Data\m\shared\RemoteComputer 8.21a.zip infected by "Trojan-Downloader.Win32.Bagle.jp" Virus. Action Taken: File Deleted.
    File C:\Documents and Settings\NiCoReTTe\Application Data\m\shared\Renju Master 1.01.zip infected by "Trojan-Downloader.Win32.Bagle.jp" Virus. Action Taken: File Deleted.
    File C:\Documents and Settings\NiCoReTTe\Application Data\m\shared\Rewind WordWeb 1.0.zip infected by "Trojan-Downloader.Win32.Bagle.jp" Virus. Action Taken: File Deleted.
    File C:\Documents and Settings\NiCoReTTe\Application Data\m\shared\Root Finder 1.zip infected by "Trojan-Downloader.Win32.Bagle.jp" Virus. Action Taken: File Deleted.
    File C:\Documents and Settings\NiCoReTTe\Application Data\m\shared\Rpv Business Reports 5.2.zip infected by "Trojan-Downloader.Win32.Bagle.jp" Virus. Action Taken: File Deleted.
    File C:\Documents and Settings\NiCoReTTe\Application Data\m\shared\Screen Booty 1.1 [Crack].zip infected by "Trojan-Downloader.Win32.Bagle.jp" Virus. Action Taken: File Deleted.
    File C:\Documents and Settings\NiCoReTTe\Application Data\m\shared\Secure IE 2004.zip infected by "Trojan-Downloader.Win32.Bagle.jp" Virus. Action Taken: File Deleted.
    File C:\Documents and Settings\NiCoReTTe\Application Data\m\shared\Selected Links 1.2.zip infected by "Trojan-Downloader.Win32.Bagle.jp" Virus. Action Taken: File Deleted.
    File C:\Documents and Settings\NiCoReTTe\Application Data\m\shared\Serial Data Player 1.5.zip infected by "Trojan-Downloader.Win32.Bagle.jp" Virus. Action Taken: File Deleted.
    File C:\Documents and Settings\NiCoReTTe\Application Data\m\shared\SheerPower 4GL 3.5.zip infected by "Trojan-Downloader.Win32.Bagle.jp" Virus. Action Taken: File Deleted.
    File C:\Documents and Settings\NiCoReTTe\Application Data\m\shared\SimpleDesktop 2.9r.zip infected by "Trojan-Downloader.Win32.Bagle.jp" Virus. Action Taken: File Deleted.
    File C:\Documents and Settings\NiCoReTTe\Application Data\m\shared\Site-Max Search 1.3.zip infected by "Trojan-Downloader.Win32.Bagle.jp" Virus. Action Taken: File Deleted.
    File C:\Documents and Settings\NiCoReTTe\Application Data\m\shared\Slawdog DOJO Media Player 2003.zip infected by "Trojan-Downloader.Win32.Bagle.jp" Virus. Action Taken: File Deleted.
    File C:\Documents and Settings\NiCoReTTe\Application Data\m\shared\Smartworks - Project Planner 4.8.zip infected by "Trojan-Downloader.Win32.Bagle.jp" Virus. Action Taken: File Deleted.
    File C:\Documents and Settings\NiCoReTTe\Application Data\m\shared\Smtp.NET 3.0.zip infected by "Trojan-Downloader.Win32.Bagle.jp" Virus. Action Taken: File Deleted.
    File C:\Documents and Settings\NiCoReTTe\Application Data\m\shared\Socket Server 32 2.1.zip infected by "Trojan-Downloader.Win32.Bagle.jp" Virus. Action Taken: File Deleted.
    File C:\Documents and Settings\NiCoReTTe\Application Data\m\shared\StudioSchool Pro 3.3.zip infected by "Trojan-Downloader.Win32.Bagle.jp" Virus. Action Taken: File Deleted.
    File C:\Documents and Settings\NiCoReTTe\Application Data\m\shared\SuDiX Core 4.zip infected by "Trojan-Downloader.Win32.Bagle.jp" Virus. Action Taken: File Deleted.
    File C:\Documents and Settings\NiCoReTTe\Application Data\m\shared\Super Webcam Recorder 2.zip infected by "Trojan-Downloader.Win32.Bagle.jp" Virus. Action Taken: File Deleted.
    File C:\Documents and Settings\NiCoReTTe\Application Data\m\shared\SureData ToolKit 4.6.10.zip infected by "Trojan-Downloader.Win32.Bagle.jp" Virus. Action Taken: File Deleted.
    File C:\Documents and Settings\NiCoReTTe\Application Data\m\shared\Symantec_Norton_PartitionMagic_v8.05.(Build.1371)_Multilanguage_Full_Cover_Bootable.zip infected by "Trojan-Downloader.Win32.Bagle.jp" Virus. Action Taken: File Deleted.
    File C:\Documents and Settings\NiCoReTTe\Application Data\m\shared\T-Boss 2.3 (Key+Serial).zip infected by "Trojan-Downloader.Win32.Bagle.jp" Virus. Action Taken: File Deleted.
    File C:\Documents and Settings\NiCoReTTe\Application Data\m\shared\TCP Properties Monitor 1.0.zip infected by "Trojan-Downloader.Win32.Bagle.jp" Virus. Action Taken: File Deleted.
    File C:\Documents and Settings\NiCoReTTe\Application Data\m\shared\Texturizer 1.92 (Crack).zip infected by "Trojan-Downloader.Win32.Bagle.jp" Virus. Action Taken: File Deleted.
    File C:\Documents and Settings\NiCoReTTe\Application Data\m\shared\The Great Puzzle 0100.zip infected by "Trojan-Downloader.Win32.Bagle.jp" Virus. Action Taken: File Deleted.
    File C:\Documents and Settings\NiCoReTTe\Application Data\m\shared\The Inquirer 1.0.zip infected by "Trojan-Downloader.Win32.Bagle.jp" Virus. Action Taken: File Deleted.
    File C:\Documents and Settings\NiCoReTTe\Application Data\m\shared\The Love Calculator 0.7.zip infected by "Trojan-Downloader.Win32.Bagle.jp" Virus. Action Taken: File Deleted.
    File C:\Documents and Settings\NiCoReTTe\Application Data\m\shared\TNJ True Backup 2.38.zip infected by "Trojan-Downloader.Win32.Bagle.jp" Virus. Action Taken: File Deleted.
    File C:\Documents and Settings\NiCoReTTe\Application Data\m\shared\Top Spin demo.zip infected by "Trojan-Downloader.Win32.Bagle.jp" Virus. Action Taken: File Deleted.
    File C:\Documents and Settings\NiCoReTTe\Application Data\m\shared\TradeTrakker 2.74 (Serial).zip infected by "Trojan-Downloader.Win32.Bagle.jp" Virus. Action Taken: File Deleted.
    File C:\Documents and Settings\NiCoReTTe\Application Data\m\shared\Txt2PDF 3.0 Cracked.zip infected by "Trojan-Downloader.Win32.Bagle.jp" Virus. Action Taken: File Deleted.
    File C:\Documents and Settings\NiCoReTTe\Application Data\m\shared\Unreal Tournament 2003 - Battle Islands CTF map.zip infected by "Trojan-Downloader.Win32.Bagle.jp" Virus. Action Taken: File Deleted.
    File C:\Documents and Settings\NiCoReTTe\Application Data\m\shared\Unreal Tournament 2003 - Gael II deathmatch map.zip infected by "Trojan-Downloader.Win32.Bagle.jp" Virus. Action Taken: File Deleted.
    File C:\Documents and Settings\NiCoReTTe\Application Data\m\shared\Unreal Tournament 2003 - Outpost 33 Final CTF map.zip infected by "Trojan-Downloader.Win32.Bagle.jp" Virus. Action Taken: File Deleted.
    File C:\Documents and Settings\NiCoReTTe\Application Data\m\shared\Unreal Tournament 2004 NeoTokyo mod.zip infected by "Trojan-Downloader.Win32.Bagle.jp" Virus. Action Taken: File Deleted.
    File C:\Documents and Settings\NiCoReTTe\Application Data\m\shared\VideoCap ActiveX Control 2.2.zip infected by "Trojan-Downloader.Win32.Bagle.jp" Virus. Action Taken: File Deleted.
    File C:\Documents and Settings\NiCoReTTe\Application Data\m\shared\VMN Storage 3.72.zip infected by "Trojan-Downloader.Win32.Bagle.jp" Virus. Action Taken: File Deleted.
    File C:\Documents and Settings\NiCoReTTe\Application Data\m\shared\WBJB Now On 1.0.zip infected by "Trojan-Downloader.Win32.Bagle.jp" Virus. Action Taken: File Deleted.
    File C:\Documents and Settings\NiCoReTTe\Application Data\m\shared\White Pages Grabber 1.21 (Key+Serial).zip infected by "Trojan-Downloader.Win32.Bagle.jp" Virus. Action Taken: File Deleted.
    File C:\Documents and Settings\NiCoReTTe\Application Data\m\shared\WinSpy 3.1 Key.zip infected by "Trojan-Downloader.Win32.Bagle.jp" Virus. Action Taken: File Deleted.
    File C:\Documents and Settings\NiCoReTTe\Application Data\m\shared\WMSmart 1.2.4.zip infected by "Trojan-Downloader.Win32.Bagle.jp" Virus. Action Taken: File Deleted.
    File C:\Documents and Settings\NiCoReTTe\Application Data\m\shared\WordBanker English-Chinese(Traditional) 5.1.0 (Serial).zip infected by "Trojan-Downloader.Win32.Bagle.jp" Virus. Action Taken: File Deleted.
    File C:\Documents and Settings\NiCoReTTe\Application Data\m\shared\Zoom Function 0.95.zip infected by "Trojan-Downloader.Win32.Bagle.jp" Virus. Action Taken: File Deleted.
    File C:\Documents and Settings\NiCoReTTe\Application Data\m\shared\Zune Music Recovery 2.0.1.5.zip infected by "Trojan-Downloader.Win32.Bagle.jp" Virus. Action Taken: File Deleted.
    File C:\Documents and Settings\NiCoReTTe\Local Settings\Temp\NERO14399\Toolbar.exe tagged as not-a-virus:AdTool.Win32.MyWebSearch.bm. No Action Taken.
    File C:\Documents and Settings\NiCoReTTe\Työpöytä\väliaikaista\setupxv.exe tagged as not-a-virus:FraudTool.Win32.AntiSpyware.c. No Action Taken.
    File C:\System Volume Information\_restore{578D9108-E629-4564-9264-A9E01313D6AE}\RP226\A0076620.exe tagged as not-a-virus:AdWare.Win32.Gator.3202. No Action Taken.
    File C:\System Volume Information\_restore{578D9108-E629-4564-9264-A9E01313D6AE}\RP226\A0076773.exe tagged as not-a-virus:AdWare.Win32.WebSearch.r. No Action Taken.
    File C:\System Volume Information\_restore{8D41684B-F365-4A5A-B04B-C4BEAA140313}\RP24\A0004657.exe infected by "Email-Worm.Win32.Bagle.of" Virus. Action Taken: File Deleted.
    File C:\System Volume Information\_restore{8D41684B-F365-4A5A-B04B-C4BEAA140313}\RP24\A0004737.sys infected by "Trojan-Downloader.Win32.Bagle.hu" Virus. Action Taken: File Deleted.
    File C:\System Volume Information\_restore{8D41684B-F365-4A5A-B04B-C4BEAA140313}\RP24\A0004754.sys infected by "Trojan-Downloader.Win32.Bagle.hu" Virus. Action Taken: File Deleted.
    File C:\System Volume Information\_restore{8D41684B-F365-4A5A-B04B-C4BEAA140313}\RP24\A0004770.sys infected by "Trojan-Downloader.Win32.Bagle.hu" Virus. Action Taken: File Deleted.
    File C:\System Volume Information\_restore{8D41684B-F365-4A5A-B04B-C4BEAA140313}\RP26\A0005059.exe infected by "Trojan.NSIS.StartPage.c" Virus. Action Taken: File Deleted.
    File C:\System Volume Information\_restore{8D41684B-F365-4A5A-B04B-C4BEAA140313}\RP26\A0005301.exe infected by "Email-Worm.Win32.Bagle.of" Virus. Action Taken: File to be deleted on reboot.
    File C:\System Volume Information\_restore{8D41684B-F365-4A5A-B04B-C4BEAA140313}\RP26\A0005309.sys infected by "Trojan-Downloader.Win32.Bagle.hu" Virus. Action Taken: File to be deleted on reboot.
    File C:\System Volume Information\_restore{8D41684B-F365-4A5A-B04B-C4BEAA140313}\RP27\A0005330.sys infected by "Trojan-Downloader.Win32.Bagle.hu" Virus. Action Taken: File to be deleted on reboot.
    File C:\System Volume Information\_restore{8D41684B-F365-4A5A-B04B-C4BEAA140313}\RP27\A0005454.exe infected by "Email-Worm.Win32.Bagle.of" Virus. Action Taken: File to be deleted on reboot.
    File C:\System Volume Information\_restore{8D41684B-F365-4A5A-B04B-C4BEAA140313}\RP27\A0005468.exe infected by "Trojan-Downloader.Win32.Bagle.hi" Virus. Action Taken: File Deleted.
    File C:\System Volume Information\_restore{8D41684B-F365-4A5A-B04B-C4BEAA140313}\RP27\A0005475.sys infected by "Trojan-Downloader.Win32.Bagle.hu" Virus. Action Taken: File Deleted.
    File C:\System Volume Information\_restore{8D41684B-F365-4A5A-B04B-C4BEAA140313}\RP27\A0005480.dll tagged as not-a-virus:AdTool.Win32.WhenU.r. No Action Taken.
    File C:\System Volume Information\_restore{8D41684B-F365-4A5A-B04B-C4BEAA140313}\RP27\A0005481.exe tagged as not-a-virus:AdTool.Win32.WhenU.t. No Action Taken.
    File C:\System Volume Information\_restore{8D41684B-F365-4A5A-B04B-C4BEAA140313}\RP27\A0005483.exe infected by "Email-Worm.Win32.Bagle.of" Virus. Action Taken: File Deleted.
    File C:\System Volume Information\_restore{8D41684B-F365-4A5A-B04B-C4BEAA140313}\RP27\A0005541.exe infected by "Email-Worm.Win32.Bagle.of" Virus. Action Taken: File Deleted.
    File C:\System Volume Information\_restore{8D41684B-F365-4A5A-B04B-C4BEAA140313}\RP27\A0005551.exe infected by "Email-Worm.Win32.Bagle.of" Virus. Action Taken: File Deleted.
    File C:\System Volume Information\_restore{8D41684B-F365-4A5A-B04B-C4BEAA140313}\RP27\A0005564.sys infected by "Trojan-Downloader.Win32.Bagle.hu" Virus. Action Taken: File Deleted.
    File C:\System Volume Information\_restore{8D41684B-F365-4A5A-B04B-C4BEAA140313}\RP29\A0007557.sys infected by "Trojan-Downloader.Win32.Bagle.hu" Virus. Action Taken: File Deleted.
    File C:\System Volume Information\_restore{8D41684B-F365-4A5A-B04B-C4BEAA140313}\RP29\A0007559.exe infected by "Email-Worm.Win32.Bagle.of" Virus. Action Taken: File Deleted.
    File C:\System Volume Information\_restore{8D41684B-F365-4A5A-B04B-C4BEAA140313}\RP30\A0007892.exe infected by "Email-Worm.Win32.Bagle.of" Virus. Action Taken: File Deleted.
    File C:\System Volume Information\_restore{8D41684B-F365-4A5A-B04B-C4BEAA140313}\RP30\A0009904.sys infected by "Trojan-Downloader.Win32.Bagle.hu" Virus. Action Taken: File Deleted.
    File C:\System Volume Information\_restore{8D41684B-F365-4A5A-B04B-C4BEAA140313}\RP30\A0009907.exe infected by "Email-Worm.Win32.Bagle.of" Virus. Action Taken: File Deleted.
    File C:\System Volume Information\_restore{8D41684B-F365-4A5A-B04B-C4BEAA140313}\RP30\A0009928.exe infected by "Email-Worm.Win32.Bagle.of" Virus. Action Taken: File Deleted.
    File C:\System Volume Information\_restore{8D41684B-F365-4A5A-B04B-C4BEAA140313}\RP30\A0009937.sys infected by "Trojan-Downloader.Win32.Bagle.hu" Virus. Action Taken: File Deleted.
    File C:\System Volume Information\_restore{8D41684B-F365-4A5A-B04B-C4BEAA140313}\RP30\A0010011.sys infected by "Trojan-Downloader.Win32.Bagle.hu" Virus. Action Taken: File Deleted.
    File C:\System Volume Information\_restore{8D41684B-F365-4A5A-B04B-C4BEAA140313}\RP31\A0010151.sys infected by "Trojan-Downloader.Win32.Bagle.hu" Virus. Action Taken: File Deleted.
    File C:\System Volume Information\_restore{8D41684B-F365-4A5A-B04B-C4BEAA140313}\RP31\A0010170.sys infected by "Trojan-Downloader.Win32.Bagle.hu" Virus. Action Taken: File Deleted.
    File C:\System Volume Information\_restore{8D41684B-F365-4A5A-B04B-C4BEAA140313}\RP31\A0010176.exe infected by "Email-Worm.Win32.Bagle.of" Virus. Action Taken: File Deleted.
    File C:\System Volume Information\_restore{8D41684B-F365-4A5A-B04B-C4BEAA140313}\RP32\A0010272.exe infected by "Email-Worm.Win32.Bagle.of" Virus. Action Taken: File Deleted.
    File C:\System Volume Information\_restore{8D41684B-F365-4A5A-B04B-C4BEAA140313}\RP32\A0010273.exe infected by "Email-Worm.Win32.Bagle.of" Virus. Action Taken: File Deleted.
    File C:\System Volume Information\_restore{8D41684B-F365-4A5A-B04B-C4BEAA140313}\RP32\A0010334.exe infected by "Email-Worm.Win32.Bagle.of" Virus. Action Taken: File Deleted.
    File C:\System Volume Information\_restore{8D41684B-F365-4A5A-B04B-C4BEAA140313}\RP32\A0010335.exe infected by "Email-Worm.Win32.Bagle.of" Virus. Action Taken: File Deleted.
    File C:\System Volume Information\_restore{8D41684B-F365-4A5A-B04B-C4BEAA140313}\RP32\A0011157.exe infected by "Email-Worm.Win32.Bagle.of" Virus. Action Taken: File Deleted.
    File C:\System Volume Information\_restore{8D41684B-F365-4A5A-B04B-C4BEAA140313}\RP32\A0011158.exe infected by "Email-Worm.Win32.Bagle.of" Virus. Action Taken: File Deleted.
    File C:\System Volume Information\_restore{8D41684B-F365-4A5A-B04B-C4BEAA140313}\RP32\A0012169.sys infected by "Trojan-Downloader.Win32.Bagle.hu" Virus. Action Taken: File Deleted.
    File C:\System Volume Information\_restore{8D41684B-F365-4A5A-B04B-C4BEAA140313}\RP32\A0014307.sys infected by "Trojan-Downloader.Win32.Bagle.hu" Virus. Action Taken: File Deleted.
    File C:\System Volume Information\_restore{8D41684B-F365-4A5A-B04B-C4BEAA140313}\RP33\A0014468.exe infected by "Trojan-Downloader.Win32.Bagle.hi" Virus. Action Taken: File Deleted.
    File C:\System Volume Information\_restore{8D41684B-F365-4A5A-B04B-C4BEAA140313}\RP33\A0014469.exe infected by "Trojan-Downloader.Win32.Bagle.hi" Virus. Action Taken: File Deleted.
    File C:\System Volume Information\_restore{8D41684B-F365-4A5A-B04B-C4BEAA140313}\RP33\A0014470.exe infected by "Trojan-PSW.Win32.Agent.xd" Virus. Action Taken: File Deleted.
    File C:\System Volume Information\_restore{8D41684B-F365-4A5A-B04B-C4BEAA140313}\RP33\A0014471.exe infected by "Trojan-PSW.Win32.Agent.xd" Virus. Action Taken: File Deleted.
    File C:\System Volume Information\_restore{8D41684B-F365-4A5A-B04B-C4BEAA140313}\RP33\A0014472.exe infected by "Trojan-PSW.Win32.Agent.xd" Virus. Action Taken: File Deleted.
    File C:\System Volume Information\_restore{8D41684B-F365-4A5A-B04B-C4BEAA140313}\RP33\A0014473.exe infected by "Trojan-PSW.Win32.Agent.xd" Virus. Action Taken: File Deleted.
    File C:\System Volume Information\_restore{8D41684B-F365-4A5A-B04B-C4BEAA140313}\RP33\A0014474.exe infected by "Trojan-PSW.Win32.Agent.xd" Virus. Action Taken: File Deleted.
    File C:\System Volume Information\_restore{8D41684B-F365-4A5A-B04B-C4BEAA140313}\RP33\A0014475.exe infected by "Trojan-PSW.Win32.Agent.xd" Virus. Action Taken: File Deleted.
    File C:\System Volume Information\_restore{8D41684B-F365-4A5A-B04B-C4BEAA140313}\RP33\A0014476.exe infected by "Trojan-PSW.Win32.Agent.xd" Virus. Action Taken: File Deleted.
    File C:\System Volume Information\_restore{8D41684B-F365-4A5A-B04B-C4BEAA140313}\RP33\A0014477.exe infected by "Email-Worm.Win32.Bagle.of" Virus. Action Taken: File Deleted.
    File C:\System Volume Information\_restore{8D41684B-F365-4A5A-B04B-C4BEAA140313}\RP33\A0014478.exe infected by "Trojan-PSW.Win32.Agent.xd" Virus. Action Taken: File Deleted.
    File C:\System Volume Information\_restore{8D41684B-F365-4A5A-B04B-C4BEAA140313}\RP33\A0014479.exe infected by "Email-Worm.Win32.Bagle.of" Virus. Action Taken: File Deleted.
    File C:\System Volume Information\_restore{8D41684B-F365-4A5A-B04B-C4BEAA140313}\RP33\A0014480.exe infected by "Email-Worm.Win32.Bagle.of" Virus. Action Taken: File Deleted.
    File C:\System Volume Information\_restore{8D41684B-F365-4A5A-B04B-C4BEAA140313}\RP33\A0014481.exe infected by "Trojan-PSW.Win32.Agent.xd" Virus. Action Taken: File Deleted.
    File C:\System Volume Information\_restore{8D41684B-F365-4A5A-B04B-C4BEAA140313}\RP33\A0014482.exe infected by "Email-Worm.Win32.Bagle.of" Virus. Action Taken: File Deleted.
    File C:\System Volume Information\_restore{8D41684B-F365-4A5A-B04B-C4BEAA140313}\RP33\A0014483.exe infected by "Email-Worm.Win32.Bagle.of" Virus. Action Taken: File Deleted.
    File C:\System Volume Information\_restore{8D41684B-F365-4A5A-B04B-C4BEAA140313}\RP33\A0014484.exe infected by "Email-Worm.Win32.Bagle.of" Virus. Action Taken: File Deleted.
    File C:\System Volume Information\_restore{8D41684B-F365-4A5A-B04B-C4BEAA140313}\RP33\A0014485.exe infected by "Trojan-PSW.Win32.Agent.xd" Virus. Action Taken: File Deleted.
    File C:\System Volume Information\_restore{8D41684B-F365-4A5A-B04B-C4BEAA140313}\RP33\A0014486.exe infected by "Email-Worm.Win32.Bagle.of" Virus. Action Taken: File Deleted.
    File C:\System Volume Information\_restore{8D41684B-F365-4A5A-B04B-C4BEAA140313}\RP33\A0014487.exe infected by "Email-Worm.Win32.Bagle.of" Virus. Action Taken: File Deleted.
    File C:\System Volume Information\_restore{8D41684B-F365-4A5A-B04B-C4BEAA140313}\RP33\A0014488.exe infected by "Email-Worm.Win32.Bagle.of" Virus. Action Taken: File Deleted.
    File C:\System Volume Information\_restore{8D41684B-F365-4A5A-B04B-C4BEAA140313}\RP33\A0014489.exe infected by "Trojan-PSW.Win32.Agent.xd" Virus. Action Taken: File Deleted.
    File C:\System Volume Information\_restore{8D41684B-F365-4A5A-B04B-C4BEAA140313}\RP33\A0014490.exe infected by "Trojan-PSW.Win32.Agent.xd" Virus. Action Taken: File Deleted.
    File C:\System Volume Information\_restore{8D41684B-F365-4A5A-B04B-C4BEAA140313}\RP33\A0014491.exe infected by "Trojan-PSW.Win32.Agent.xd" Virus. Action Taken: File Deleted.
    File C:\System Volume Information\_restore{8D41684B-F365-4A5A-B04B-C4BEAA140313}\RP33\A0014492.exe infected by "Trojan-PSW.Win32.Agent.xd" Virus. Action Taken: File Deleted.
    File C:\System Volume Information\_restore{8D41684B-F365-4A5A-B04B-C4BEAA140313}\RP33\A0014493.exe infected by "Email-Worm.Win32.Bagle.of" Virus. Action Taken: File Deleted.
    File C:\System Volume Information\_restore{8D41684B-F365-4A5A-B04B-C4BEAA140313}\RP33\A0014494.exe infected by "Email-Worm.Win32.Bagle.of" Virus. Action Taken: File Deleted.
    File C:\System Volume Information\_restore{8D41684B-F365-4A5A-B04B-C4BEAA140313}\RP33\A0014495.exe infected by "Trojan-PSW.Win32.Agent.xd" Virus. Action Taken: File Deleted.
    File C:\System Volume Information\_restore{8D41684B-F365-4A5A-B04B-C4BEAA140313}\RP33\A0014496.exe infected by "Trojan-PSW.Win32.Agent.xd" Virus. Action Taken: File Deleted.
    File C:\System Volume Information\_restore{8D41684B-F365-4A5A-B04B-C4BEAA140313}\RP33\A0014497.exe infected by "Email-Worm.Win32.Bagle.of" Virus. Action Taken: File Deleted.
    File C:\System Volume Information\_restore{8D41684B-F365-4A5A-B04B-C4BEAA140313}\RP33\A0014498.exe infected by "Email-Worm.Win32.Bagle.of" Virus. Action Taken: File Deleted.
    File C:\System Volume Information\_restore{8D41684B-F365-4A5A-B04B-C4BEAA140313}\RP33\A0014499.exe infected by "Email-Worm.Win32.Bagle.of" Virus. Action Taken: File Deleted.
    File C:\System Volume Information\_restore{8D41684B-F365-4A5A-B04B-C4BEAA140313}\RP33\A0014500.exe infected by "Trojan-PSW.Win32.Agent.xd" Virus. Action Taken: File Deleted.
    File C:\System Volume Information\_restore{8D41684B-F365-4A5A-B04B-C4BEAA140313}\RP33\A0014501.exe infected by "Email-Worm.Win32.Bagle.of" Virus. Action Taken: File Deleted.
    File C:\System Volume Information\_restore{8D41684B-F365-4A5A-B04B-C4BEAA140313}\RP33\A0014502.exe infected by "Trojan-PSW.Win32.Agent.xd" Virus. Action Taken: File Deleted.
    File C:\System Volume Information\_restore{8D41684B-F365-4A5A-B04B-C4BEAA140313}\RP33\A0014503.exe infected by "Trojan-PSW.Win32.Agent.xd" Virus. Action Taken: File Deleted.
    File C:\System Volume Information\_restore{8D41684B-F365-4A5A-B04B-C4BEAA140313}\RP33\A0014504.exe infected by "Trojan.Win32.Pakes.bwy" Virus. Action Taken: File Deleted.
    File C:\System Volume Information\_restore{8D41684B-F365-4A5A-B04B-C4BEAA140313}\RP33\A0014505.exe infected by "Trojan-PSW.Win32.Agent.xd" Virus. Action Taken: File Deleted.
    File C:\System Volume Information\_restore{8D41684B-F365-4A5A-B04B-C4BEAA140313}\RP33\A0014506.exe infected by "Trojan-PSW.Win32.Agent.xd" Virus. Action Taken: File Deleted.
    File C:\System Volume Information\_restore{8D41684B-F365-4A5A-B04B-C4BEAA140313}\RP33\A0014507.exe infected by "Trojan-PSW.Win32.Agent.xd" Virus. Action Taken: File Deleted.
    File C:\System Volume Information\_restore{8D41684B-F365-4A5A-B04B-C4BEAA140313}\RP33\A0014508.exe infected by "Trojan-PSW.Win32.Agent.xd" Virus. Action Taken: File Deleted.
    File C:\System Volume Information\_restore{8D41684B-F365-4A5A-B04B-C4BEAA140313}\RP33\A0014509.exe infected by "Trojan-PSW.Win32.Agent.xd" Virus. Action Taken: File Deleted.
    File C:\System Volume Information\_restore{8D41684B-F365-4A5A-B04B-C4BEAA140313}\RP33\A0014510.exe infected by "Trojan-PSW.Win32.Agent.xd" Virus. Action Taken: File Deleted.
    File C:\System Volume Information\_restore{8D41684B-F365-4A5A-B04B-C4BEAA140313}\RP33\A0014511.exe infected by "Email-Worm.Win32.Bagle.of" Virus. Action Taken: File Deleted.
    File C:\System Volume Information\_restore{8D41684B-F365-4A5A-B04B-C4BEAA140313}\RP33\A0014512.exe infected by "Email-Worm.Win32.Bagle.of" Virus. Action Taken: File Deleted.
    File C:\System Volume Information\_restore{8D41684B-F365-4A5A-B04B-C4BEAA140313}\RP33\A0014513.exe infected by "Email-Worm.Win32.Bagle.of" Virus. Action Taken: File Deleted.
    File C:\System Volume Information\_restore{8D41684B-F365-4A5A-B04B-C4BEAA140313}\RP33\A0014514.exe infected by "Email-Worm.Win32.Bagle.of" Virus. Action Taken: File Deleted.
    File C:\System Volume Information\_restore{8D41684B-F365-4A5A-B04B-C4BEAA140313}\RP33\A0014515.exe infected by "Email-Worm.Win32.Bagle.of" Virus. Action Taken: File Deleted.
    File C:\System Volume Information\_restore{8D41684B-F365-4A5A-B04B-C4BEAA140313}\RP33\A0014516.exe infected by "Email-Worm.Win32.Bagle.of" Virus. Action Taken: File Deleted.
    File C:\System Volume Information\_restore{8D41684B-F365-4A5A-B04B-C4BEAA140313}\RP33\A0014517.exe infected by "Email-Worm.Win32.Bagle.of" Virus. Action Taken: File Deleted.
    File C:\System Volume Information\_restore{8D41684B-F365-4A5A-B04B-C4BEAA140313}\RP33\A0014518.exe infected by "Trojan-PSW.Win32.Agent.xd" Virus. Action Taken: File Deleted.
    File C:\System Volume Information\_restore{8D41684B-F365-4A5A-B04B-C4BEAA140313}\RP33\A0014519.exe infected by "Email-Worm.Win32.Bagle.of" Virus. Action Taken: File Deleted.
    File C:\System Volume Information\_restore{8D41684B-F365-4A5A-B04B-C4BEAA140313}\RP33\A0014520.exe infected by "Trojan-PSW.Win32.Agent.xd" Virus. Action Taken: File Deleted.
    File C:\System Volume Information\_restore{8D41684B-F365-4A5A-B04B-C4BEAA140313}\RP33\A0014521.exe infected by "Trojan-PSW.Win32.Agent.xd" Virus. Action Taken: File Deleted.
    File C:\System Volume Information\_restore{8D41684B-F365-4A5A-B04B-C4BEAA140313}\RP33\A0014522.exe infected by "Trojan-PSW.Win32.Agent.xd" Virus. Action Taken: File Deleted.
    File C:\System Volume Information\_restore{8D41684B-F365-4A5A-B04B-C4BEAA140313}\RP33\A0014523.exe infected by "Trojan-PSW.Win32.Agent.xd" Virus. Action Taken: File Deleted.
    File C:\System Volume Information\_restore{8D41684B-F365-4A5A-B04B-C4BEAA140313}\RP33\A0014524.exe infected by "Trojan-PSW.Win32.Agent.xd" Virus. Action Taken: File Deleted.
    File C:\System Volume Information\_restore{8D41684B-F365-4A5A-B04B-C4BEAA140313}\RP33\A0014525.exe infected by "Email-Worm.Win32.Bagle.of" Virus. Action Taken: File Deleted.
    File C:\System Volume Information\_restore{8D41684B-F365-4A5A-B04B-C4BEAA140313}\RP33\A0014526.exe infected by "Trojan-PSW.Win32.Agent.xd" Virus. Action Taken: File Deleted.
    File C:\System Volume Information\_restore{8D41684B-F365-4A5A-B04B-C4BEAA140313}\RP33\A0014527.exe infected by "Trojan-PSW.Win32.Agent.xd" Virus. Action Taken: File Deleted.
    File C:\System Volume Information\_restore{8D41684B-F365-4A5A-B04B-C4BEAA140313}\RP33\A0014528.exe infected by "Email-Worm.Win32.Bagle.of" Virus. Action Taken: File Deleted.
    File C:\System Volume Information\_restore{8D41684B-F365-4A5A-B04B-C4BEAA140313}\RP33\A0014529.exe infected by "Trojan-PSW.Win32.Agent.xd" Virus. Action Taken: File Deleted.
    File C:\System Volume Information\_restore{8D41684B-F365-4A5A-B04B-C4BEAA140313}\RP33\A0014530.exe infected by "Trojan-PSW.Win32.Agent.xd" Virus. Action Taken: File Deleted.
    File C:\System Volume Information\_restore{8D41684B-F365-4A5A-B04B-C4BEAA140313}\RP33\A0014531.exe infected by "Trojan-PSW.Win32.Agent.xd" Virus. Action Taken: File Deleted.
    File C:\System Volume Information\_restore{8D41684B-F365-4A5A-B04B-C4BEAA140313}\RP33\A0014532.exe infected by "Email-Worm.Win32.Bagle.of" Virus. Action Taken: File Deleted.
    File C:\System Volume Information\_restore{8D41684B-F365-4A5A-B04B-C4BEAA140313}\RP33\A0014533.exe infected by "Trojan-PSW.Win32.Agent.xd" Virus. Action Taken: File Deleted.
    File C:\System Volume Information\_restore{8D41684B-F365-4A5A-B04B-C4BEAA140313}\RP33\A0014534.exe infected by "Trojan-PSW.Win32.Agent.xd" Virus. Action Taken: File Deleted.
    File C:\System Volume Information\_restore{8D41684B-F365-4A5A-B04B-C4BEAA140313}\RP33\A0014535.exe infected by "Email-Worm.Win32.Bagle.of" Virus. Action Taken: File Deleted.
    File C:\System Volume Information\_restore{8D41684B-F365-4A5A-B04B-C4BEAA140313}\RP33\A0014536.exe infected by "Trojan-PSW.Win32.Agent.xd" Virus. Action Taken: File Deleted.
    File C:\System Volume Information\_restore{8D41684B-F365-4A5A-B04B-C4BEAA140313}\RP33\A0014537.exe infected by "Email-Worm.Win32.Bagle.of" Virus. Action Taken: File Deleted.
    File C:\System Volume Information\_restore{8D41684B-F365-4A5A-B04B-C4BEAA140313}\RP33\A0014538.exe infected by "Trojan-PSW.Win32.Agent.xd" Virus. Action Taken: File Deleted.
    File C:\System Volume Information\_restore{8D41684B-F365-4A5A-B04B-C4BEAA140313}\RP33\A0014539.exe infected by "Email-Worm.Win32.Bagle.of" Virus. Action Taken: File Deleted.
    File C:\System Volume Information\_restore{8D41684B-F365-4A5A-B04B-C4BEAA140313}\RP33\A0014540.exe infected by "Email-Worm.Win32.Bagle.of" Virus. Action Taken: File Deleted.
    File C:\System Volume Information\_restore{8D41684B-F365-4A5A-B04B-C4BEAA140313}\RP33\A0014541.exe infected by "Email-Worm.Win32.Bagle.of" Virus. Action Taken: File Deleted.
    File C:\System Volume Information\_restore{8D41684B-F365-4A5A-B04B-C4BEAA140313}\RP33\A0014542.exe infected by "Trojan-PSW.Win32.Agent.xd" Virus. Action Taken: File Deleted.
    File C:\System Volume Information\_restore{8D41684B-F365-4A5A-B04B-C4BEAA140313}\RP33\A0014543.exe infected by "Trojan-PSW.Win32.Agent.xd" Virus. Action Taken: File Deleted.
    File C:\System Volume Information\_restore{8D41684B-F365-4A5A-B04B-C4BEAA140313}\RP33\A0014544.sys infected by "Trojan-Downloader.Win32.Bagle.hu" Virus. Action Taken: File Deleted.
    File C:\System Volume Information\_restore{8D41684B-F365-4A5A-B04B-C4BEAA140313}\RP33\A0014545.exe infected by "Email-Worm.Win32.Bagle.of" Virus. Action Taken: File Deleted.
    File C:\System Volume Information\_restore{8D41684B-F365-4A5A-B04B-C4BEAA140313}\RP33\A0015156.exe infected by "Trojan-Downloader.Win32.Bagle.hi" Virus. Action Taken: File Deleted.
    File C:\System Volume Information\_restore{8D41684B-F365-4A5A-B04B-C4BEAA140313}\RP34\A0015316.rbf tagged as not-a-virus:FraudTool.Win32.AntiSpyware.b. No Action Taken.
    File C:\System Volume Information\_restore{8D41684B-F365-4A5A-B04B-C4BEAA140313}\RP6\A0001396.sys infected by "Trojan-Downloader.Win32.Bagle.hu" Virus. Action Taken: File Deleted.
    File C:\System Volume Information\_restore{8D41684B-F365-4A5A-B04B-C4BEAA140313}\RP6\A0001445.exe infected by "Trojan-Downloader.Win32.Bagle.hi" Virus. Action Taken: File Deleted.
    File C:\System Volume Information\_restore{8D41684B-F365-4A5A-B04B-C4BEAA140313}\RP6\A0001447.sys infected by "Trojan-Downloader.Win32.Bagle.hu" Virus. Action Taken: File Deleted.
    File C:\System Volume Information\_restore{8D41684B-F365-4A5A-B04B-C4BEAA140313}\RP7\A0001547.sys infected by "Trojan-Downloader.Win32.Bagle.hu" Virus. Action Taken: File Deleted.
    File C:\System Volume Information\_restore{8D41684B-F365-4A5A-B04B-C4BEAA140313}\RP7\A0001572.sys infected by "Trojan-Downloader.Win32.Bagle.hu" Virus. Action Taken: File Deleted.
    File C:\System Volume Information\_restore{8D41684B-F365-4A5A-B04B-C4BEAA140313}\RP7\A0001591.sys infected by "Trojan-Downloader.Win32.Bagle.hu" Virus. Action Taken: File Deleted.
    File C:\System Volume Information\_restore{8D41684B-F365-4A5A-B04B-C4BEAA140313}\RP8\A0001634.sys infected by "Trojan-Downloader.Win32.Bagle.hu" Virus. Action Taken: File Deleted.
    File C:\System Volume Information\_restore{8D41684B-F365-4A5A-B04B-C4BEAA140313}\RP9\A0001820.sys infected by "Trojan-Downloader.Win32.Bagle.hu" Virus. Action Taken: File Deleted.
    File C:\System Volume Information\_restore{8D41684B-F365-4A5A-B04B-C4BEAA140313}\RP9\A0001834.sys infected by "Trojan-Downloader.Win32.Bagle.hu" Virus. Action Taken: File Deleted.
    File C:\System Volume Information\_restore{DD21BD16-4E1A-4571-84F2-4369C3EBF8E1}\RP1\A0000011.exe infected by "Trojan-Downloader.Win32.Adload.fy" Virus. Action Taken: File Deleted.
    File C:\System Volume Information\_restore{DD21BD16-4E1A-4571-84F2-4369C3EBF8E1}\RP14\A0012373.exe tagged as not-a-virus:AdTool.Win32.WhenU.a. No Action Taken.
    File C:\System Volume Information\_restore{DD21BD16-4E1A-4571-84F2-4369C3EBF8E1}\RP14\A0012374.exe tagged as not-a-virus:AdTool.Win32.WhenU.a. No Action Taken.
    File C:\System Volume Information\_restore{DD21BD16-4E1A-4571-84F2-4369C3EBF8E1}\RP14\A0012375.exe tagged as not-a-virus:AdTool.Win32.WhenU.a. No Action Taken.
    File C:\System Volume Information\_restore{DD21BD16-4E1A-4571-84F2-4369C3EBF8E1}\RP15\A0013413.exe tagged as not-a-virus:AdWare.Win32.Mostofate.r. No Action Taken.
    File C:\System Volume Information\_restore{DD21BD16-4E1A-4571-84F2-4369C3EBF8E1}\RP15\A0013414.exe tagged as not-a-virus:AdWare.Win32.Mostofate.r. No Action Taken.
    File C:\WINDOWS\system32\drivers\down\132593.exe infected by "Email-Worm.Win32.Bagle.of" Virus. Action Taken: File Deleted.
    File C:\WINDOWS\system32\drivers\down\142796.exe infected by "Email-Worm.Win32.Bagle.of" Virus. Action Taken: File Deleted.
    File C:\WINDOWS\system32\drivers\down\14613343.exe infected by "Email-Worm.Win32.Bagle.of" Virus. Action Taken: File Deleted.
    File C:\WINDOWS\system32\drivers\down\146312.exe infected by "Email-Worm.Win32.Bagle.of" Virus. Action Taken: File Deleted.
    File C:\WINDOWS\system32\drivers\down\14643671.exe infected by "Email-Worm.Win32.Bagle.of" Virus. Action Taken: File Deleted.
    File C:\WINDOWS\system32\drivers\down\146677203.exe infected by "Email-Worm.Win32.Bagle.of" Virus. Action Taken: File Deleted.
    File C:\WINDOWS\system32\drivers\down\14828718.exe infected by "Email-Worm.Win32.Bagle.of" Virus. Action Taken: File Deleted.
    File C:\WINDOWS\system32\drivers\down\14830906.exe infected by "Email-Worm.Win32.Bagle.of" Virus. Action Taken: File Deleted.
    File C:\WINDOWS\system32\drivers\down\148468.exe infected by "Email-Worm.Win32.Bagle.of" Virus. Action Taken: File Deleted.
    File C:\WINDOWS\system32\drivers\down\153531.exe infected by "Email-Worm.Win32.Bagle.of" Virus. Action Taken: File Deleted.
    File C:\WINDOWS\system32\drivers\down\169703.exe infected by "Email-Worm.Win32.Bagle.of" Virus. Action Taken: File Deleted.
    File C:\WINDOWS\system32\drivers\down\29225265.exe infected by "Email-Worm.Win32.Bagle.of" Virus. Action Taken: File Deleted.
    File C:\WINDOWS\system32\drivers\down\29389593.exe infected by "Email-Worm.Win32.Bagle.of" Virus. Action Taken: File Deleted.
    File C:\WINDOWS\system32\drivers\down\29391562.exe infected by "Email-Worm.Win32.Bagle.of" Virus. Action Taken: File Deleted.
    File C:\WINDOWS\system32\drivers\down\29446187.exe infected by "Email-Worm.Win32.Bagle.of" Virus. Action Taken: File Deleted.
    File C:\WINDOWS\system32\drivers\down\356162671.exe infected by "Email-Worm.Win32.Bagle.of" Virus. Action Taken: File Deleted.
    File C:\WINDOWS\system32\drivers\down\356173078.exe infected by "Email-Worm.Win32.Bagle.of" Virus. Action Taken: File Deleted.
    File C:\WINDOWS\system32\drivers\down\370767468.exe infected by "Email-Worm.Win32.Bagle.of" Virus. Action Taken: File Deleted.
    File C:\WINDOWS\system32\drivers\down\385262250.exe infected by "Email-Worm.Win32.Bagle.of" Virus. Action Taken: File Deleted.
    File C:\WINDOWS\system32\drivers\down\43801843.exe infected by "Email-Worm.Win32.Bagle.of" Virus. Action Taken: File Deleted.
    File C:\WINDOWS\system32\drivers\down\56937.exe infected by "Email-Worm.Win32.Bagle.of" Virus. Action Taken: File Deleted.
    File C:\WINDOWS\system32\drivers\down\59890.exe infected by "Email-Worm.Win32.Bagle.of" Virus. Action Taken: File Deleted.
    File C:\WINDOWS\system32\drivers\down\63218.exe infected by "Email-Worm.Win32.Bagle.of" Virus. Action Taken: File Deleted.
    File C:\WINDOWS\system32\drivers\down\67000.exe infected by "Email-Worm.Win32.Bagle.of" Virus. Action Taken: File Deleted.
    File C:\WINDOWS\system32\drivers\down\67609.exe infected by "Email-Worm.Win32.Bagle.of" Virus. Action Taken: File Deleted.
    File C:\WINDOWS\system32\drivers\down\68890.exe infected by "Email-Worm.Win32.Bagle.of" Virus. Action Taken: File Deleted.
    File C:\WINDOWS\system32\drivers\down\71281.exe infected by "Email-Worm.Win32.Bagle.of" Virus. Action Taken: File Deleted.
    File C:\WINDOWS\system32\drivers\down\76906.exe infected by "Email-Worm.Win32.Bagle.of" Virus. Action Taken: File Deleted.
    File D:\Documents and Settings\Kone\Local Settings\Temp\NeroDemo12550\Toolbar.exe tagged as not-a-virus:AdTool.Win32.MyWebSearch.bm. No Action Taken.
    File D:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\OPERST6V\upgrade[1].cab tagged as not-a-virus:AdWare.Win32.NewDotNet.l. No Action Taken.
    File D:\Program Files\NewDotNet\nncore.dll tagged as not-a-virus:AdWare.Win32.NewDotNet.l. No Action Taken.
    File D:\System Volume Information\_restore{578D9108-E629-4564-9264-A9E01313D6AE}\RP226\A0077037.exe tagged as not-a-virus:AdWare.Win32.SaveNow.ag. No Action Taken.
    File D:\System Volume Information\_restore{578D9108-E629-4564-9264-A9E01313D6AE}\RP226\A0078209.scr infected by "Trojan-Downloader.Win32.Banload.eky" Virus. Action Taken: File to be deleted on reboot.
    File D:\System Volume Information\_restore{578D9108-E629-4564-9264-A9E01313D6AE}\RP266\A0087386.exe tagged as not-a-virus:AdWare.Win32.OneStep.c. No Action Taken.
    File D:\System Volume Information\_restore{8D41684B-F365-4A5A-B04B-C4BEAA140313}\RP33\A0014464.exe infected by "Backdoor.Win32.Pakes" Virus. Action Taken: File to be renamed on reboot.
    File D:\System Volume Information\_restore{8D41684B-F365-4A5A-B04B-C4BEAA140313}\RP33\A0014465.exe tagged as not-a-virus:AdTool.Win32.WhenU.a. No Action Taken.
    File D:\System Volume Information\_restore{8D41684B-F365-4A5A-B04B-C4BEAA140313}\RP33\A0014467.exe infected by "Backdoor.Win32.Pakes" Virus. Action Taken: File to be renamed on reboot.
    File D:\WINDOWS\system32\drivers\hldrrr.exe infected by "Trojan-Downloader.Win32.Bagle.hi" Virus. Action Taken: File to be deleted on reboot.
    File D:\WINDOWS\system32\drivers\srosa.sys infected by "Trojan-Downloader.Win32.Bagle.hu" Virus. Action Taken: File to be deleted on reboot.
    File D:\WINDOWS\system32\wintems.exe infected by "Trojan-Downloader.Win32.Bagle.ho" Virus. Action Taken: File to be deleted on reboot.
    File D:\WINDOWS\Temp\NN_7.tmp\upgrade.exe tagged as not-a-virus:AdWare.Win32.NewDotNet.l. No Action Taken.
    File H:\ohjelmat\sälää\kansiot\tekstinmuokkaus\ss2r2.exe tagged as not-a-virus:AdWare.Win32.SaveNow.ag. No Action Taken.
    File H:\System Volume Information\_restore{578D9108-E629-4564-9264-A9E01313D6AE}\RP229\A0078767.EXE infected by "Trojan.Win32.Inject.ba" Virus. Action Taken: File to be deleted on reboot.
    File H:\System Volume Information\_restore{578D9108-E629-4564-9264-A9E01313D6AE}\RP266\A0087325.exe infected by "Trojan-Downloader.Win32.Bagle.hi" Virus. Action Taken: File to be deleted on reboot.
    File H:\System Volume Information\_restore{8D41684B-F365-4A5A-B04B-C4BEAA140313}\RP17\A0003281.exe infected by "Trojan-Downloader.Win32.Bagle.hi" Virus. Action Taken: File Deleted.
    File H:\System Volume Information\_restore{8D41684B-F365-4A5A-B04B-C4BEAA140313}\RP33\A0014463.exe infected by "Trojan-Downloader.Win32.Bagle.hi" Virus. Action Taken: File Deleted.
    File H:\System Volume Information\_restore{8D41684B-F365-4A5A-B04B-C4BEAA140313}\RP7\A0001507.exe infected by "Trojan-Downloader.Win32.Bagle.hi" Virus. Action Taken: File Deleted.
    File H:\torrent\vasta tulleet\paskalava\Style XP 3.19 [Serial].zip infected by "Trojan-Downloader.Win32.Bagle.hi" Virus. Action Taken: File Deleted.
    File H:\torrent\vasta tulleet\paskalava\tiedostot\Toolbar Icon Set 2007.2 Key+Serial.zip infected by "Trojan-Downloader.Win32.Bagle.hi" Virus. Action Taken: File Deleted.
    File H:\torrent\vasta tulleet\paskalava\Uusi kansio\Style XP 3.19 [Serial].zip infected by "Trojan-Downloader.Win32.Bagle.hh" Virus. Action Taken: File Deleted.
     
    Nicorette, Feb 14, 2008
    #3
  4. Hujo

    Hujo Guest

    Lataa SmitfraudFix (c) S!Ri
    Pura sisältö (kansio nimeltä SmitfraudFix) työpöydällesi:

    Avaa SmitfraudFix kansio ja tupla-klikkaa smitfraudfix.cmd
    Valitse optio #1 - Search kirjoittamalla 1 ja painamalla "Enter"; tekstitiedosto avautuu, joka listaa tarttuneet tiedostot (jos olemassa).
    Postita tämän tekstitiedoston sisältö viestiketjuusi.

    Huomaa : process.exe filun tunnistaa jotkut Anti-virus ohjelmat (AntiVir, Dr.Web, Kaspersky) "Haittakaluna"; se ei ole virus, vaan ohjelma joka pysäyttää prosesseja. A/V ohjelmat eivät pysty tunnistamaan hyvän ja pahan käytön tälläisten ohjelmian väliltä, silloin ne saattavat varoittaa käyttäjää.

    =============

    Lataa SDFix by AndyManchesta ja tallenna se työpöydällesi.

    Käynnistä koneesi vikasietotilaan:

    sammuta ja käynnistä
    käynnistyksen yhteydessä hakkaa F8 nappia
    valitse nuolinäppäimellä vikasietotila
    paina enter ja enter
    valitse käyttäjätilisi
    paina kyllä

    Jossakin koneissa hakataan F8:sin sijasta F5:tä

    " Kun vikasietotilassa, pura tiedoston SDFix.zip sisältö (SDFix kansio) työpöydällesi. Työpöydälle pitäisi ilmestyä kansio nimeltä SDFix.
    " Avaa SDFix-kansio ja tuplaklikkaa tiedostoa RunThis.bat käynnistääksesi ohjelman.
    " Paina Y käynnistääksesi skriptin.
    " Työkalu puhdistaa troijalaisen palvelut ja tekee myös joitakin korjauksia rekisteriin. Lopuksi se pyytää käynnistämään koneen uudelleen, "Press any key to Reboot".
    " Paina mitä tahansa näppäintä ja kone käynnistyy uudelleen.
    " Käynnistyminen kestää normaalia kauemmin sillä SDFix puhdistaa konetta.
    " Kun kone on käynnistynyt ja työpöytä latautunut, SDFix kertoo että puhdistus on suoritettu, "Finished".
    " Paina sitten mitä tahansa näppäintä sulkeaksesi skriptin ja ladataksesi pikakuvakkeet työpöydälle.
    " Lopuksi avaa SDFix kansio (työpöydällä) ja kopioi & liitä tiedoston Report.txt sisältö viestiketjuusi uuden HijackThis:n lokin kera.

    ========

    Ohje AVG:n Anti-Spyware 7.5:n käyttöön
    Huom! Tässä ohjeessa sammutetaan tuo reaaliaikasuojaus (Shield). Näin vältetään tilanteet joissa suojaus estäisi esim HijackThis:n työkalun toimintaa.

    Tallenna nämä ohjeet tekstitiedostoon tai tulosta nämä, muuten et pääse niihin käsiksi vikasietotilasta

    Lataa AVG:n Anti-Spyware 7.5:n
    ja tallenna ohjelma työpöydällesi.
    o Kun olet ladannut ohjelman, kaksoisklikkaa asennuohjelman pikakuvaketta työpöydälläsi, asennus alkaa.
    o Asennuksen jälkeen täytyy ohjelma käynnistää ja sen tunnisteet päivittää.
    o Käynnistä AVG:n Anti-Spyware.
    o Klikkaa "Update" kuvaketta päävalikossa. Sen jälkeen klikkaa "Update now" painiketta.

    o Sitten klikkaa "Start Update" kuvaketta jolloin päivitys alkaa.

    o Kun päivitykset on ladattu, klikkaa "Scanner" kuvaketta ikkunan ylälaidassa. Valitse sitten "Settings" välilehti.
    o Kun "Settings" valikko on auennut, klikkaa "Recommended actions" ja sitten valitse "Quarantine".

    o Sitten "Reports" valikon alta:
    o Laita täppi kohtaan "Automatically generate report after every scan"
    o Ota täppi pois kohdasta"Only if threats were found"

    o Sitten klikkaa "Shield" kuvaketta ikkunan ylälaidassa
    o "Resident shield is", muuta tila active:sta inactive:ksi
    o Sulje ohjelma, ÄLÄ skannaa vielä.

    Käynnistä koneesi vikasietotilaan,
    sammuta ja käynnistä
    käynnistyksen yhteydessä naputtele F8
    valitse nuoli näppäimellä vikasietotila
    paina enter ja enter

    Toisissa koneissa paukutetaan F8:sin sijasta F5:tä

    HUOM! Älä käytä muita ohjelmia AVG:n skannauksen aikana, tämä saattaa häiritä skannausta.
    o Kun vikasietotilassa, käynnistä AVG:n Anti-Spyware.
    o Klikkaa "Scanner" kuvaketta ikkunan ylälaidassa ja valitse "Scan" välilehti. Sitten klikkaa "Complete System Scan".
    o Ewido aloittaa nyt tietokoneen skannaamisen, ole kärsivällinen sillä skannaus vie aikaa.

    Kun skannaus on valmis:
    TÄRKEÄÄ : Älä klikkaa "Save Scan Report" ennen kuin klikkaat "Apply all Actions"
    o Varmistu, että Set all elements to: näyttää Quarantine (1), jos ei, klikkaa linkkiä ja valitse Quarantine popup-valikosta.
    o Sinulta kysytään mitä tehdä jos infektioita löytyi, valitse silloin "Apply all actions"
    [​IMG]
    o Sitten klikkaa "Reports" kuvaketta ohjelma yläosasta.
    o Klikkaa "Save report as" painiketta ikkunan vasemmassa alalaidassa ja tallenna raportti työpöydälle.
    o Sulje ohjelma, käynnistä kone normaalisti ja lähetä AVG:n raportti viestikejuusi.

    =============

    1.Lataa combofix.exe työpöydällesi jommastakummasta linkistä:
    combofix1
    combofix2

    2. Tuplaklikkaa combofix.exe tiedostoa ja seuraa ohjeistuksia.
    3. Kun työkalu on valmis, se tuottaa lokin. Lähetä tämä loki viesti ketjuusi.
    Huom! Älä klikkaile combofixin ikkunaa käytön aikana. Tämä saattaa aiheuttaa ohjelman jumiutumisen.
     
    Last edited by a moderator: Feb 14, 2008
    Hujo, Feb 14, 2008
    #4
  5. Nicorette

    Nicorette Member

    Joined:
    Jan 12, 2007
    Messages:
    18
    Likes Received:
    0
    Trophy Points:
    11
    SmitFraudFix v2.288

    Scan done at 20:35:02,39, to 14.02.2008
    Run from C:\Documents and Settings\NiCoReTTe\Ty”p”yt„\SmitfraudFix
    OS: Microsoft Windows XP [versio 5.1.2600] - Windows_NT
    The filesystem type is NTFS
    Fix run in normal mode

    »»»»»»»»»»»»»»»»»»»»»»»» Process

    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
    C:\WINDOWS\Explorer.EXE
    C:\WINDOWS\system32\spoolsv.exe
    C:\Program Files\QuickTime\qttask.exe
    H:\i Tunes\iTunesHelper.exe
    C:\Program Files\Analog Devices\SoundMAX\SMax4PNP.exe
    C:\Program Files\Analog Devices\SoundMAX\smax4.exe
    C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
    C:\WINDOWS\system32\ctfmon.exe
    C:\Program Files\MSN Messenger\MsnMsgr.Exe
    C:\Program Files\DNA\btdna.exe
    C:\Program Files\Messenger\msmsgs.exe
    C:\Program Files\DAEMON Tools\daemon.exe
    C:\Program Files\WinZip\WZQKPICK.EXE
    C:\Program Files\COMODO\Firewall\cmdagent.exe
    C:\WINDOWS\system32\tcpsvcs.exe
    C:\WINDOWS\system32\msiexec.exe
    C:\WINDOWS\System32\snmp.exe
    C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\system32\dllhost.exe
    C:\Program Files\iPod\bin\iPodService.exe
    C:\WINDOWS\system32\dllhost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\Program Files\COMODO\Firewall\cfpconfg.exe
    C:\Program Files\Mozilla Firefox 3 Beta 3\firefox.exe
    C:\WINDOWS\system32\cmd.exe

    »»»»»»»»»»»»»»»»»»»»»»»» hosts


    »»»»»»»»»»»»»»»»»»»»»»»» C:\


    »»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS


    »»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\system


    »»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\Web


    »»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\system32


    »»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\system32\LogFiles


    »»»»»»»»»»»»»»»»»»»»»»»» C:\Documents and Settings\NiCoReTTe


    »»»»»»»»»»»»»»»»»»»»»»»» C:\Documents and Settings\NiCoReTTe\Application Data


    »»»»»»»»»»»»»»»»»»»»»»»» Start Menu


    »»»»»»»»»»»»»»»»»»»»»»»»


    »»»»»»»»»»»»»»»»»»»»»»»» Desktop


    »»»»»»»»»»»»»»»»»»»»»»»» C:\Program Files


    »»»»»»»»»»»»»»»»»»»»»»»» Corrupted keys


    »»»»»»»»»»»»»»»»»»»»»»»» Desktop Components

    [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Desktop\Components\0]
    "Source"="About:Home"
    "SubscribedURL"="About:Home"
    "FriendlyName"="Nykyinen kotisivu"


    »»»»»»»»»»»»»»»»»»»»»»»» IEDFix
    !!!Attention, following keys are not inevitably infected!!!

    IEDFix
    Credits: Malware Analysis & Diagnostic
    Code: S!Ri


    »»»»»»»»»»»»»»»»»»»»»»»» VACFix
    !!!Attention, following keys are not inevitably infected!!!

    VACFix
    Credits: Malware Analysis & Diagnostic
    Code: S!Ri


    »»»»»»»»»»»»»»»»»»»»»»»» Sharedtaskscheduler
    !!!Attention, following keys are not inevitably infected!!!

    SrchSTS.exe by S!Ri
    Search SharedTaskScheduler's .dll


    »»»»»»»»»»»»»»»»»»»»»»»» AppInit_DLLs
    !!!Attention, following keys are not inevitably infected!!!

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
    "AppInit_DLLs"=" C:\\WINDOWS\\system32\\guard32.dll"
    "LoadAppInit_DLLs"=dword:00000001


    »»»»»»»»»»»»»»»»»»»»»»»» Winlogon.System
    !!!Attention, following keys are not inevitably infected!!!

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon]
    "System"=""


    »»»»»»»»»»»»»»»»»»»»»»»» Rustock



    »»»»»»»»»»»»»»»»»»»»»»»» DNS

    Description: Intel(R) PRO/1000 CT Network Connection - Paketinajoituksen miniportti
    DNS Server Search Order: 192.168.0.254

    HKLM\SYSTEM\CCS\Services\Tcpip\..\{846574C3-AB94-4E62-A35A-AD1D739D533A}: DhcpNameServer=192.168.0.254
    HKLM\SYSTEM\CS1\Services\Tcpip\..\{846574C3-AB94-4E62-A35A-AD1D739D533A}: DhcpNameServer=192.168.0.254
    HKLM\SYSTEM\CS2\Services\Tcpip\..\{846574C3-AB94-4E62-A35A-AD1D739D533A}: DhcpNameServer=192.168.0.254
    HKLM\SYSTEM\CCS\Services\Tcpip\Parameters: DhcpNameServer=192.168.0.254
    HKLM\SYSTEM\CS1\Services\Tcpip\Parameters: DhcpNameServer=192.168.0.254
    HKLM\SYSTEM\CS2\Services\Tcpip\Parameters: DhcpNameServer=192.168.0.254


    »»»»»»»»»»»»»»»»»»»»»»»» Scanning for wininet.dll infection


    »»»»»»»»»»»»»»»»»»»»»»»» End

     
    Nicorette, Feb 14, 2008
    #5
  6. Hujo

    Hujo Guest

    Printtaa ohjeet ulos

    Käynnistä koneesi vikasietotilaan ja valitse tavallinen käyttäjätilisi.

    Vikasietotilaan:

    sammuta ja käynnistä
    käynnistyksen yhteydessä hakkaa F8 nappia
    valitse nuolinäppäimellä vikasietotila
    paina enter ja enter
    valitse käyttäjätilisi
    paina kyllä

    Jossakin koneissa hakataan F8:sin sijasta F5:tä

    Kun vikasietotilassa, avaa SmitfraudFix kansio ja tupla-klikkaa smitfraudfix.cmd
    Valitse optio #2 - Clean kirjoittamalla 2 ja painamalla "Enter" poistaaksesi tarttuneet tiedostot.

    Sinulta kysytään: "Registry cleaning - Do you want to clean the registry ?"; vastaa "Yes" kirjoittamalla Y ja paina "Enter" poistaaksesi työpöydän taustakuvan ja puhdistaaksesi tarttuneet rekisteriavaimet.

    Työkalu tarkistaa jos wininet.dll on tarttunut. Sinua saatetaan pyytää korvaamaan tarttunut .dll (jos löytyy); vastaa "Yes" kirjoittamalla Y ja painamalla "Enter".

    Työkalun saattaa tarvita käynnistää kone uudelleen; jos ei tee niin, käynnistä normaaliin Windowsiin.
    Tekstitiedosto ilmestyy, puhdistusprosessin jäljiltä; kopioi & liitä tämän raportin tulokset vastaukseesi.
    Raportti löytyy paikalliselta levyltäsi, useimmiten C:\rapport.txt.

    Varoitus : Ajamalla optio 2:n EI-tarttuneessa tietokoneessa, poistaa sinun työpöytäsi taustakuvan.

    ==========

    sitten vain listaa alas päin
     
    Hujo, Feb 14, 2008
    #6
  7. Nicorette

    Nicorette Member

    Joined:
    Jan 12, 2007
    Messages:
    18
    Likes Received:
    0
    Trophy Points:
    11
    HijackThis:

    Logfile of Trend Micro HijackThis v2.0.2
    Scan saved at 23:21:50, on 14.2.2008
    Platform: Windows XP SP2 (WinNT 5.01.2600)
    MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
    Boot mode: Normal

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
    C:\WINDOWS\system32\spoolsv.exe
    C:\Program Files\QuickTime\qttask.exe
    H:\i Tunes\iTunesHelper.exe
    C:\Program Files\Analog Devices\SoundMAX\SMax4PNP.exe
    C:\Program Files\Analog Devices\SoundMAX\smax4.exe
    C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
    C:\Program Files\COMODO\Firewall\cfp.exe
    C:\WINDOWS\system32\ctfmon.exe
    C:\Program Files\MSN Messenger\MsnMsgr.Exe
    C:\Program Files\DNA\btdna.exe
    C:\Program Files\TGTSoft\StyleXP\StyleXP.exe
    C:\Program Files\DAEMON Tools\daemon.exe
    C:\Program Files\WinZip\WZQKPICK.EXE
    C:\Program Files\COMODO\Firewall\cmdagent.exe
    C:\WINDOWS\system32\tcpsvcs.exe
    C:\WINDOWS\system32\msiexec.exe
    C:\WINDOWS\System32\snmp.exe
    C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\system32\dllhost.exe
    C:\Program Files\iPod\bin\iPodService.exe
    C:\WINDOWS\system32\dllhost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\explorer.exe
    C:\WINDOWS\NOTEPAD.EXE
    C:\Program Files\Mozilla Firefox 3 Beta 3\firefox.exe
    C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

    R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Linkit
    O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
    O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
    O2 - BHO: TGTSoft Explorer Toolbar Changer - {C333CF63-767F-4831-94AC-E683D962C63C} - C:\Program Files\TGTSoft\StyleXP\TGT_BHO.dll
    O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
    O4 - HKLM\..\Run: [Ptipbmf] rundll32.exe ptipbmf.dll,SetWriteCacheMode
    O4 - HKLM\..\Run: [iTunesHelper] "H:\i Tunes\iTunesHelper.exe"
    O4 - HKLM\..\Run: [SoundMAXPnP] C:\Program Files\Analog Devices\SoundMAX\SMax4PNP.exe
    O4 - HKLM\..\Run: [SoundMAX] "C:\Program Files\Analog Devices\SoundMAX\smax4.exe" /tray
    O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
    O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
    O4 - HKLM\..\Run: [COMODO Firewall Pro] "C:\Program Files\COMODO\Firewall\cfp.exe" -h
    O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
    O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
    O4 - HKCU\..\Run: [BitTorrent DNA] "C:\Program Files\DNA\btdna.exe"
    O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
    O4 - HKCU\..\Run: [STYLEXP] C:\Program Files\TGTSoft\StyleXP\StyleXP.exe -Hide
    O4 - HKCU\..\Run: [DAEMON Tools] "C:\Program Files\DAEMON Tools\daemon.exe" -lang 1033
    O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Paikallinen palve')
    O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Verkkopalve')
    O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
    O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
    O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
    O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
    O4 - Global Startup: WinZip Quick Pick.lnk = C:\Program Files\WinZip\WZQKPICK.EXE
    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://www.update.microsoft.com/mic...ls/en/x86/client/muweb_site.cab?1202406414718
    O20 - AppInit_DLLs: C:\WINDOWS\system32\guard32.dll
    O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
    O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
    O23 - Service: COMODO Firewall Pro Helper Service (cmdAgent) - COMODO - C:\Program Files\COMODO\Firewall\cmdagent.exe
    O23 - Service: F-Secure BackWeb LAN Access - Unknown owner - e:\program files\BackWeb\7681197\Program\fsbwlan.exe
    O23 - Service: F-Secure Network Request Broker - F-Secure Corporation - e:\program files\Common\FNRB32.EXE
    O23 - Service: F-Secure Authentication Agent (FSAA) - F-Secure Corporation. All Rights Reserved. - e:\program files\Common\FSAA.EXE
    O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
    O23 - Service: iPod-palvelu (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
    O23 - Service: Intel NCS NetService (NetSvc) - Intel(R) Corporation - C:\Program Files\Intel\NCS\Sync\NetSvc.exe
    O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe

    --
    End of file - 5492 bytes

    SFF:

    SmitFraudFix v2.288

    Scan done at 23:15:22,06, to 14.02.2008
    Run from C:\Documents and Settings\NiCoReTTe\Ty”p”yt„\SmitfraudFix
    OS: Microsoft Windows XP [versio 5.1.2600] - Windows_NT
    The filesystem type is NTFS
    Fix run in normal mode

    »»»»»»»»»»»»»»»»»»»»»»»» SharedTaskScheduler Before SmitFraudFix
    !!!Attention, following keys are not inevitably infected!!!

    SrchSTS.exe by S!Ri
    Search SharedTaskScheduler's .dll

    »»»»»»»»»»»»»»»»»»»»»»»» Killing process


    »»»»»»»»»»»»»»»»»»»»»»»» hosts


    127.0.0.1 localhost

    »»»»»»»»»»»»»»»»»»»»»»»» VACFix

    VACFix
    Credits: Malware Analysis & Diagnostic
    Code: S!Ri


    »»»»»»»»»»»»»»»»»»»»»»»» Winsock2 Fix

    S!Ri's WS2Fix: LSP not Found.


    »»»»»»»»»»»»»»»»»»»»»»»» Generic Renos Fix

    GenericRenosFix by S!Ri


    »»»»»»»»»»»»»»»»»»»»»»»» Deleting infected files


    »»»»»»»»»»»»»»»»»»»»»»»» IEDFix

    IEDFix
    Credits: Malware Analysis & Diagnostic
    Code: S!Ri


    »»»»»»»»»»»»»»»»»»»»»»»» DNS

    Description: Intel(R) PRO/1000 CT Network Connection - Paketinajoituksen miniportti
    DNS Server Search Order: 192.168.0.254

    HKLM\SYSTEM\CCS\Services\Tcpip\..\{846574C3-AB94-4E62-A35A-AD1D739D533A}: DhcpNameServer=192.168.0.254
    HKLM\SYSTEM\CS1\Services\Tcpip\..\{846574C3-AB94-4E62-A35A-AD1D739D533A}: DhcpNameServer=192.168.0.254
    HKLM\SYSTEM\CS2\Services\Tcpip\..\{846574C3-AB94-4E62-A35A-AD1D739D533A}: DhcpNameServer=192.168.0.254
    HKLM\SYSTEM\CCS\Services\Tcpip\Parameters: DhcpNameServer=192.168.0.254
    HKLM\SYSTEM\CS1\Services\Tcpip\Parameters: DhcpNameServer=192.168.0.254
    HKLM\SYSTEM\CS2\Services\Tcpip\Parameters: DhcpNameServer=192.168.0.254


    »»»»»»»»»»»»»»»»»»»»»»»» Deleting Temp Files


    »»»»»»»»»»»»»»»»»»»»»»»» Winlogon.System
    !!!Attention, following keys are not inevitably infected!!!

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon]
    "System"=""


    »»»»»»»»»»»»»»»»»»»»»»»» Registry Cleaning

    Registry Cleaning done.

    »»»»»»»»»»»»»»»»»»»»»»»» SharedTaskScheduler After SmitFraudFix
    !!!Attention, following keys are not inevitably infected!!!

    SrchSTS.exe by S!Ri
    Search SharedTaskScheduler's .dll


    »»»»»»»»»»»»»»»»»»»»»»»» End
     
    Nicorette, Feb 14, 2008
    #7
  8. Hujo

    Hujo Guest

    ok ... onkos toi AVG:n Anti-Spyware 7.5:n menty tuolla vikasiedossa lävitse.
     
    Hujo, Feb 14, 2008
    #8
  9. Nicorette

    Nicorette Member

    Joined:
    Jan 12, 2007
    Messages:
    18
    Likes Received:
    0
    Trophy Points:
    11
    tässäpä tän AVG:n tulokset

    ---------------------------------------------------------
    AVG Anti-Spyware - Scan Report
    ---------------------------------------------------------

    + Created at: 0:53:21 15.2.2008

    + Scan result:



    D:\System Volume Information\_restore{8D41684B-F365-4A5A-B04B-C4BEAA140313}\RP34\A0016326.exe -> Downloader.Bagle.ho : Cleaned with backup (quarantined).
    C:\Documents and Settings\NiCoReTTe\Cookies\nicorette@advertising[2].txt -> TrackingCookie.Advertising : Cleaned.
    C:\Documents and Settings\NiCoReTTe\Cookies\nicorette@atdmt[2].txt -> TrackingCookie.Atdmt : Cleaned.
    C:\Documents and Settings\NiCoReTTe\Cookies\nicorette@statistik-gallup[1].txt -> TrackingCookie.Statistik-gallup : Cleaned.


    ::Report end

     
    Nicorette, Feb 14, 2008
    #9
  10. Hujo

    Hujo Guest

    Nyt ei nolota enään vai ;)

    1. Klikkaa käynnistä > Oma tietokone oikean puoleisella hiiren napilla
    2. Valitse ominaisuudet
    3. Valitse järjestelmän palauttaminen välilehti
    4. Ruksi eteen ¤ poista järjestelmän palauttaminen kaikissa asemissa
    5. Paina Käytä
    6. Paina ok
    7. Sammuta ja käynnistä
    8. Ota ruksi pois ¤ poista järjestelmän palauttaminen kaikissa asemissa
    9. Käytä ja OK

    =============

    scannaa uusi hjt:n loki
     
    Last edited by a moderator: Feb 14, 2008
    Hujo, Feb 14, 2008
    #10
  11. Nicorette

    Nicorette Member

    Joined:
    Jan 12, 2007
    Messages:
    18
    Likes Received:
    0
    Trophy Points:
    11
    Logfile of Trend Micro HijackThis v2.0.2
    Scan saved at 8:40:09, on 15.2.2008
    Platform: Windows XP SP2 (WinNT 5.01.2600)
    MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
    Boot mode: Normal

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
    C:\WINDOWS\Explorer.EXE
    C:\WINDOWS\system32\spoolsv.exe
    C:\Program Files\QuickTime\qttask.exe
    H:\i Tunes\iTunesHelper.exe
    C:\Program Files\Analog Devices\SoundMAX\SMax4PNP.exe
    C:\Program Files\Analog Devices\SoundMAX\smax4.exe
    C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
    C:\Program Files\COMODO\Firewall\cfp.exe
    E:\program files\Common\FSM32.EXE
    E:\program files\FSGUI\TNBUtil.exe
    C:\WINDOWS\system32\ctfmon.exe
    C:\Program Files\MSN Messenger\MsnMsgr.Exe
    C:\Program Files\DNA\btdna.exe
    C:\Program Files\Messenger\msmsgs.exe
    C:\Program Files\TGTSoft\StyleXP\StyleXP.exe
    C:\Program Files\DAEMON Tools\daemon.exe
    C:\Program Files\WinZip\WZQKPICK.EXE
    C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
    C:\Program Files\COMODO\Firewall\cmdagent.exe
    e:\program files\Anti-Virus\fsgk32st.exe
    e:\program files\Anti-Virus\FSGK32.EXE
    C:\WINDOWS\system32\tcpsvcs.exe
    C:\WINDOWS\System32\snmp.exe
    C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\system32\dllhost.exe
    C:\Program Files\iPod\bin\iPodService.exe
    C:\WINDOWS\system32\dllhost.exe
    e:\program files\Anti-Virus\fssm32.exe
    C:\WINDOWS\system32\wscntfy.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\system32\wuauclt.exe
    C:\WINDOWS\system32\wuauclt.exe
    C:\Program Files\Mozilla Firefox 3 Beta 3\firefox.exe
    C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

    R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Linkit
    O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
    O2 - BHO: TGTSoft Explorer Toolbar Changer - {C333CF63-767F-4831-94AC-E683D962C63C} - C:\Program Files\TGTSoft\StyleXP\TGT_BHO.dll
    O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
    O4 - HKLM\..\Run: [Ptipbmf] rundll32.exe ptipbmf.dll,SetWriteCacheMode
    O4 - HKLM\..\Run: [iTunesHelper] "H:\i Tunes\iTunesHelper.exe"
    O4 - HKLM\..\Run: [SoundMAXPnP] C:\Program Files\Analog Devices\SoundMAX\SMax4PNP.exe
    O4 - HKLM\..\Run: [SoundMAX] "C:\Program Files\Analog Devices\SoundMAX\smax4.exe" /tray
    O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
    O4 - HKLM\..\Run: [COMODO Firewall Pro] "C:\Program Files\COMODO\Firewall\cfp.exe" -h
    O4 - HKLM\..\Run: [F-Secure Manager] "e:\program files\Common\FSM32.EXE" /splash
    O4 - HKLM\..\Run: [F-Secure TNB] "e:\program files\FSGUI\TNBUtil.exe" /CHECKALL /WAITFORSW
    O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
    O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
    O4 - HKCU\..\Run: [BitTorrent DNA] "C:\Program Files\DNA\btdna.exe"
    O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
    O4 - HKCU\..\Run: [STYLEXP] C:\Program Files\TGTSoft\StyleXP\StyleXP.exe -Hide
    O4 - HKCU\..\Run: [DAEMON Tools] "C:\Program Files\DAEMON Tools\daemon.exe" -lang 1033
    O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Paikallinen palve')
    O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Verkkopalve')
    O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
    O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
    O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
    O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
    O4 - Global Startup: WinZip Quick Pick.lnk = C:\Program Files\WinZip\WZQKPICK.EXE
    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://www.update.microsoft.com/mic...ls/en/x86/client/muweb_site.cab?1202406414718
    O20 - AppInit_DLLs: C:\WINDOWS\system32\guard32.dll
    O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
    O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
    O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
    O23 - Service: COMODO Firewall Pro Helper Service (cmdAgent) - COMODO - C:\Program Files\COMODO\Firewall\cmdagent.exe
    O23 - Service: F-Secure BackWeb LAN Access - Unknown owner - e:\program files\BackWeb\7681197\Program\fsbwlan.exe
    O23 - Service: FSGKHS (F-Secure Gatekeeper Handler Starter) - F-Secure Corporation - e:\program files\Anti-Virus\fsgk32st.exe
    O23 - Service: F-Secure Network Request Broker - F-Secure Corporation - e:\program files\Common\FNRB32.EXE
    O23 - Service: F-Secure Automatic Update Agent (FSAUA) - F-Secure Corporation - e:\program files\FSAUA\program\fsaua.exe
    O23 - Service: F-Secure Anti-Virus Firewall Daemon (FSDFWD) - F-Secure Corporation - e:\program files\FWES\Program\fsdfwd.exe
    O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
    O23 - Service: iPod-palvelu (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
    O23 - Service: Intel NCS NetService (NetSvc) - Intel(R) Corporation - C:\Program Files\Intel\NCS\Sync\NetSvc.exe
    O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe

    --
    End of file - 6206 bytes
     
    Nicorette, Feb 15, 2008
    #11
  12. Hujo

    Hujo Guest

    Lataa tuolta http://www.ccleaner.com/download/builds.aspx
    CCleaner v2.03.532- Standard Build, ÄLÄ aseenna Yahoo toolbaria!

    laita asetukset näin:
    Valinnat --> Lisäasetukset --> Ota ruksi pois kohdasta Poista vain yli 48 tuntia vanhat tilapäistiedostot.

    aja Puhdistaja > tutki nappi > aja ccleaner nappi oikea alakulma
    aja Virheet > etsi rekisteri virheitä nappi > Korjaa rekisteri virheet. nappi

    ==========

    Lataa: RegSeeker.zip työpöydälle:

    Pura zip C:\RegSeeker\ kansioon. Sieltä käynnistät RegSeeker.exe ohjelman.
    Oikeasa yläkulmassa on Languages.... linkki, josta valitset Suomenkielen.
    Vasemmasta alakulmasta ruksit Luo vrmuuskopio ja sitten linkki Puhdista rekisteri
    Ruksit kaikkiin muihin kohtiin paitsi "Käyttökelvottomat.." sitten "OK" (odotat hetken).
    Ruutuun ilmestyy lista epäkelvoista rekisterimerkinnöistä, jotka alapalkista Valitse kohdasta
    klikkaat Valitse kaikki jolloin valitut saavat keltaisen pohjavärin.
    Alapalkin Toiminnot linkistä klikkaat Poista valitut kohteet
    Ponnahdusikkunaan "Kaikki valitut kohteet poistetaan ? vastaat "OK".
    Seuraavaan Ponnahdusikkunaan "Varmuuskopiot" vastaat "OK".
    Klikaa vasemmalta Lopeta RegSeeker ja käynnistä koneesi uudelleen.

    ========

    laita tuo combofix loki ja uusi hjt:n loki
     
    Hujo, Feb 15, 2008
    #12
  13. Nicorette

    Nicorette Member

    Joined:
    Jan 12, 2007
    Messages:
    18
    Likes Received:
    0
    Trophy Points:
    11
    ComboFix 08-02-15.1 - NiCoReTTe 2008-02-17 22:05:21.2 - NTFSx86
    Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1035.18.671 [GMT 2:00]
    Running from: C:\Documents and Settings\NiCoReTTe\Työpöytä\ComboFix.exe

    WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
    .
    The following files were disabled during the run:
    C:\WINDOWS\system32\guard32.dll


    ((((( Tiedostot, jotka on luotu seuraavalla aikavälillä: 2008-01-17 to 2008-02-17 )))))))))))))))))
    .

    2008-02-17 21:50 . 2008-02-17 21:50 <KANSIO> d-------- C:\RegSeeker
    2008-02-17 21:41 . 2008-02-17 21:43 <KANSIO> d-------- C:\Program Files\CCleaner
    2008-02-15 02:29 . 2008-02-15 02:29 <KANSIO> d-------- C:\Program Files\MSXML 4.0
    2008-02-15 01:44 . 2008-02-15 01:44 <KANSIO> d-------- C:\Documents and Settings\All Users.WINDOWS\Application Data\F-Secure
    2008-02-15 01:39 . 2008-02-15 01:41 <KANSIO> d-------- C:\Documents and Settings\All Users.WINDOWS\Application Data\fssg
    2008-02-15 01:33 . 2005-06-28 10:21 22,752 --a------ C:\WINDOWS\system32\spupdsvc.exe
    2008-02-14 23:32 . 2008-02-14 23:32 <KANSIO> d-------- C:\Documents and Settings\NiCoReTTe\Application Data\Grisoft
    2008-02-14 23:32 . 2008-02-14 23:32 <KANSIO> d-------- C:\Documents and Settings\All Users.WINDOWS\Application Data\Grisoft
    2008-02-14 23:32 . 2007-05-30 14:10 10,872 --a------ C:\WINDOWS\system32\drivers\AvgAsCln.sys
    2008-02-14 20:35 . 2008-02-14 23:15 2,590 --a------ C:\WINDOWS\system32\tmp.reg
    2008-02-14 20:07 . 2008-02-14 20:17 <KANSIO> d-------- C:\escheck
    2008-02-14 19:12 . 2008-02-14 19:12 0 --a------ C:\23990098.$$$
    2008-02-13 22:56 . 2008-02-17 22:03 <KANSIO> d-------- C:\Program Files\Mozilla Firefox 3 Beta 3
    2008-02-13 22:36 . 2008-02-13 22:55 <KANSIO> d-------- C:\Downloads
    2008-02-13 22:36 . 2008-02-13 22:54 <KANSIO> d-------- C:\Bases
    2008-02-13 22:35 . 2008-02-13 23:16 <KANSIO> d-------- C:\kaspersky
    2008-02-12 22:15 . 2008-02-12 22:25 <KANSIO> d-------- C:\Uusi kansio
    2008-02-12 07:54 . 2008-02-12 07:54 <KANSIO> d-------- C:\Program Files\COMODO
    2008-02-12 07:54 . 2008-02-12 07:54 <KANSIO> d-------- C:\Documents and Settings\NiCoReTTe\Application Data\Comodo
    2008-02-12 07:54 . 2008-02-12 07:58 <KANSIO> d-------- C:\Documents and Settings\All Users.WINDOWS\Application Data\comodo
    2008-02-12 07:54 . 2008-02-13 22:18 139,008 --a------ C:\WINDOWS\system32\guard32.dll.vir
    2008-02-12 07:54 . 2008-02-13 22:18 83,704 --a------ C:\WINDOWS\system32\drivers\cmdGuard.sys
    2008-02-12 07:54 . 2008-02-13 22:18 23,800 --a------ C:\WINDOWS\system32\drivers\cmdhlp.sys
    2008-02-12 07:51 . 2008-02-12 07:52 15,079,680 --a------ C:\Program Files\CFP_Setup_3.0.16.295_XP_Vista_x32.exe
    2008-02-11 21:22 . 2005-06-30 23:01 <KANSIO> d-------- C:\Program Files\F.Secure Anti.Virus Client Security v5.56.Build.11160.Final+crack=
    2008-02-11 17:31 . 2008-02-11 17:31 <KANSIO> d-------- C:\Program Files\Opera 9.5 beta
    2008-02-11 16:36 . 2007-07-30 19:19 271,224 --a------ C:\WINDOWS\system32\mucltui.dll
    2008-02-11 16:36 . 2007-07-30 19:18 30,072 --a------ C:\WINDOWS\system32\mucltui.dll.mui
    2008-02-10 23:00 . 2008-02-10 23:00 0 --a------ C:\WINDOWS\Irremote.ini
    2008-02-10 22:39 . 2008-02-10 22:39 <KANSIO> d-------- C:\Documents and Settings\NiCoReTTe\Application Data\Nero
    2008-02-10 22:37 . 2008-02-10 22:37 <KANSIO> d-------- C:\Program Files\Nero
    2008-02-10 22:37 . 2008-02-15 18:48 <KANSIO> d-------- C:\Program Files\Common Files\Nero
    2008-02-10 22:37 . 2008-02-15 18:45 <KANSIO> d-------- C:\Documents and Settings\All Users.WINDOWS\Application Data\Nero
    2008-02-10 20:11 . 2008-02-10 20:11 335 --a------ C:\WINDOWS\mozregistry.dat
    2008-02-10 16:17 . 2008-02-10 16:17 <KANSIO> d-------- C:\Documents and Settings\NiCoReTTe\Application Data\Vso
    2008-02-10 15:46 . 2008-02-10 15:47 <KANSIO> d-------- C:\Program Files\DAEMON Tools
    2008-02-07 19:21 . 2008-02-17 22:01 <KANSIO> d-------- C:\WINDOWS\system32\NtmsData
    2008-02-05 19:33 . 2008-02-05 19:33 244 --ah----- C:\sqmnoopt03.sqm
    2008-02-05 19:33 . 2008-02-05 19:33 232 --ah----- C:\sqmdata03.sqm
    2008-02-03 17:08 . 2008-02-03 17:08 244 --ah----- C:\sqmnoopt02.sqm
    2008-02-03 17:08 . 2008-02-03 17:08 232 --ah----- C:\sqmdata02.sqm
    2008-01-27 19:51 . 2008-01-27 19:51 <KANSIO> d-------- C:\Documents and Settings\All Users.WINDOWS\Application Data\SBT
    2008-01-27 19:50 . 2008-01-27 19:50 <KANSIO> d-------- C:\Program Files\Snapshot Viewer
    2008-01-27 19:46 . 2008-01-27 19:46 <KANSIO> d-------- C:\Program Files\Common Files\Wise Installation Wizard
    2008-01-27 19:46 . 2008-01-27 19:47 <KANSIO> d-------- C:\Documents and Settings\All Users.WINDOWS\Application Data\Lavasoft
    2008-01-27 18:55 . 2008-01-27 18:55 <KANSIO> d-------- C:\WINDOWS\system32\Samsung_USB_Drivers
    2008-01-27 18:55 . 2008-01-27 18:55 <KANSIO> d-------- C:\WINDOWS\system32\Samsung PC Studio Codecs
    2008-01-27 18:55 . 2008-01-27 18:55 <KANSIO> d-------- C:\Program Files\Samsung
    2008-01-27 18:55 . 2006-03-21 15:49 2,729,472 --a------ C:\WINDOWS\system32\fun_avcodec.dll
    2008-01-27 18:55 . 2006-04-18 16:32 684,032 --a------ C:\WINDOWS\system32\fun_mp4_enc.dll
    2008-01-27 18:55 . 2006-04-25 16:29 675,840 --a------ C:\WINDOWS\system32\FunDecFilter.ax
    2008-01-27 18:55 . 2006-04-25 16:30 532,480 --a------ C:\WINDOWS\system32\FunEncFilter.ax
    2008-01-27 18:55 . 2003-02-21 18:42 348,160 --a------ C:\WINDOWS\system32\msvcr71.dll
    2008-01-27 18:55 . 2006-04-24 13:46 77,824 --a------ C:\WINDOWS\system32\fun_mp4_dec.dll
    2008-01-27 18:55 . 2005-08-28 20:51 766 --a------ C:\WINDOWS\system32\Uninstall.ico
    2008-01-27 18:10 . 2008-01-27 19:46 <KANSIO> d-------- C:\Program Files\Lavasoft
    2008-01-27 17:51 . 2008-01-27 17:51 <KANSIO> d-------- C:\Program Files\Promise
    2008-01-27 17:51 . 2003-01-27 15:05 45,056 --a------ C:\WINDOWS\system32\ptistp.dll
    2008-01-27 17:50 . 2008-02-11 16:51 <KANSIO> d-------- C:\Program Files\Trend Micro
    2008-01-27 17:50 . 2008-01-27 17:50 <KANSIO> d-------- C:\Documents and Settings\NiCoReTTe\WINDOWS
    2008-01-27 17:50 . 2008-01-27 17:50 127 --a------ C:\WINDOWS\_delis43.ini
    2008-01-27 17:49 . 2008-01-27 17:49 <KANSIO> d-------- C:\Program Files\ASUS
    2008-01-27 17:42 . 2008-01-27 17:42 <KANSIO> d-------- C:\WINDOWS\Internet Logs
    2008-01-27 17:42 . 2008-01-27 17:42 <KANSIO> d-------- C:\Program Files\Zone Labs
    2008-01-27 17:35 . 2007-02-28 18:02 2,138,624 --a------ C:\WINDOWS\system32\ntoskrnl.exe
    2008-01-27 17:35 . 2007-02-28 18:02 2,138,624 --a--c--- C:\WINDOWS\system32\dllcache\ntkrnlmp.exe
    2008-01-27 16:58 . 2008-01-27 19:52 413 --a------ C:\WINDOWS\ODBC.INI
    2008-01-27 16:51 . 2008-01-27 16:51 <KANSIO> d-------- C:\Documents and Settings\NiCoReTTe\Application Data\Microsoft Web Folders

    .
    (((((((((((((((((((((((((((((((((((( Find3M-raportti ))))))))))))))))))))))))))))))))))))))))))))))))))))))
    .
    2008-02-17 19:59 --------- d-----w C:\Documents and Settings\NiCoReTTe\Application Data\DNA
    2008-02-15 00:15 --------- d-----w C:\Documents and Settings\NiCoReTTe\Application Data\BitTorrent
    2008-02-12 20:41 --------- d-----w C:\Documents and Settings\NiCoReTTe\Application Data\m
    2008-02-10 14:17 --------- d-----w C:\Documents and Settings\NiCoReTTe\Application Data\Vso
    2008-02-10 13:41 685,816 ----a-w C:\WINDOWS\system32\drivers\sptd.sys
    2008-01-27 16:55 --------- d--h--w C:\Program Files\InstallShield Installation Information
    2008-01-27 16:49 --------- d-----w C:\Program Files\Common Files\InstallShield
    2008-01-09 17:35 --------- d-----w C:\Program Files\Common Files\Adobe
    2008-01-08 15:09 --------- d-----w C:\Documents and Settings\All Users.WINDOWS\Application Data\DVD Shrink
    2008-01-04 21:06 --------- d-----w C:\Program Files\ATI Technologies
    2008-01-03 17:21 --------- d-----w C:\Documents and Settings\NiCoReTTe\Application Data\vlc
    2008-01-03 16:48 --------- d-----w C:\Program Files\TGTSoft
    2008-01-03 15:49 --------- d-----w C:\Program Files\DNA
    2008-01-03 15:18 --------- d-----w C:\Documents and Settings\NiCoReTTe\Application Data\eMule
    2008-01-03 15:16 --------- d-----w C:\Program Files\MSN Messenger
    2008-01-03 14:43 --------- d-----w C:\Program Files\Analog Devices
    2008-01-03 14:23 --------- d-----w C:\Documents and Settings\NiCoReTTe\Application Data\Apple Computer
    2008-01-03 14:17 81,920 ------r C:\WINDOWS\bwUnin-6.1.4.55-7681197L.exe
    2008-01-03 14:02 --------- d-----w C:\Program Files\Intel
    2008-01-03 13:55 --------- d-----w C:\Program Files\QuickTime
    2008-01-03 13:55 --------- d-----w C:\Program Files\iPod
    2008-01-03 13:55 --------- d-----w C:\Documents and Settings\All Users.WINDOWS\Application Data\Apple Computer
    2008-01-03 13:54 --------- d-----w C:\Program Files\Apple Software Update
    2008-01-02 17:31 --------- d-----w C:\Program Files\microsoft frontpage
    2007-12-18 09:51 179,584 ----a-w C:\WINDOWS\system32\drivers\mrxdav.sys
    2007-12-14 09:32 12,632 ----a-w C:\WINDOWS\system32\lsdelete.exe
    2007-12-13 17:09 972,072 ----a-w C:\WINDOWS\UNNeroMediaHome.exe
    2007-12-07 02:14 824,832 ----a-w C:\WINDOWS\system32\wininet.dll
    2007-12-04 18:41 550,912 ----a-w C:\WINDOWS\system32\oleaut32.dll
    2007-12-04 07:59 972,072 ----a-w C:\WINDOWS\UNRecode.exe
    2007-12-03 16:04 95,600 ----a-w C:\WINDOWS\system32\NeroCo.dll
    2004-11-05 11:31 1,597,440 ----a-w C:\Documents and Settings\Kone\Application Data\SecureTraveler.exe
    .

    (((((((((((((((((((((((((((((( Rekisterin käynnistyskohteet )))))))))))))))))))))))))))))))))))))))))))))
    .
    .
    REGEDIT4
    *Huom* Tyhjiä arvoja ja laillisia oletusarvoja ei näytetä

    [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "CTFMON.EXE"="C:\WINDOWS\system32\ctfmon.exe" [2004-09-15 14:00 15360]
    "MsnMsgr"="C:\Program Files\MSN Messenger\MsnMsgr.exe" [2007-01-19 12:55 5674352]
    "BitTorrent DNA"="C:\Program Files\DNA\btdna.exe" [2008-02-12 07:48 287040]
    "MSMSGS"="C:\Program Files\Messenger\msmsgs.exe" [2004-10-13 18:24 1694208]
    "STYLEXP"="C:\Program Files\TGTSoft\StyleXP\StyleXP.exe" [2005-08-18 15:15 1359872]
    "IndxStoreSvr_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="C:\Program Files\Common Files\Nero\Lib\NMIndexStoreSvr.exe" [2007-12-13 19:10 1688872]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2007-02-16 10:54 282624]
    "Ptipbmf"="ptipbmf.dll" [2003-06-20 09:06 118784 C:\WINDOWS\system32\ptipbmf.dll]
    "iTunesHelper"="H:\i Tunes\iTunesHelper.exe" [2007-03-14 19:05 257088]
    "SoundMAXPnP"="C:\Program Files\Analog Devices\SoundMAX\SMax4PNP.exe" [2003-05-29 16:28 790528]
    "SoundMAX"="C:\Program Files\Analog Devices\SoundMAX\smax4.exe" [2003-05-30 09:42 585728]
    "ATIPTA"="C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe" [2003-06-05 12:35 335872]
    "COMODO Firewall Pro"="C:\Program Files\COMODO\Firewall\cfp.exe" [2008-02-13 22:03 1500928]
    "F-Secure Manager"="e:\program files\Common\FSM32.exe" [2008-02-15 01:42 172081]
    "F-Secure TNB"="e:\program files\FSGUI\TNBUtil.exe" [2008-02-15 01:43 724992]
    "NeroFilterCheck"="C:\Program Files\Common Files\Nero\Lib\NeroCheck.exe" [2007-03-01 14:57 153136]
    "NBKeyScan"="C:\Program Files\Nero\Nero8\Nero BackItUp\NBKeyScan.exe" [2007-12-03 14:21 2213160]

    [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
    "CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2004-09-15 14:00 15360]

    C:\Documents and Settings\All Users.WINDOWS\K„ynnist„-valikko\Ohjelmat\K„ynnistys\
    Adobe Gamma Loader.lnk - C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [2008-01-09 19:36:07 113664]
    Microsoft Office.lnk - C:\Program Files\Microsoft Office\Office\OSA9.EXE [2000-01-21 09:15:54 65588]
    WinZip Quick Pick.lnk - C:\Program Files\WinZip\WZQKPICK.EXE [2008-02-11 21:31:13 118784]

    [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
    "EnableLUA"= 0 (0x0)

    [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
    "AppInit_DLLs"= C:\WINDOWS\system32\guard32.dll

    R1 cmdGuard;COMODO Firewall Pro Sandbox Driver;C:\WINDOWS\system32\DRIVERS\cmdguard.sys [2008-02-13 22:18]
    R1 cmdHlp;COMODO Firewall Pro Helper Driver;C:\WINDOWS\system32\DRIVERS\cmdhlp.sys [2008-02-13 22:18]
    R1 F-Secure HIPS;F-Secure HIPS;e:\program files\HIPS\fshs.sys [2008-02-15 01:43]
    S4 PCC_PFW;PC-Cillin Personal Firewall;C:\WINDOWS\system32\Drivers\PCC_PFW.sys []

    .
    'Ajoitetut tehtävät'-kansion sisältö
    "2008-01-21 12:23:00 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job"
    - C:\Program Files\Apple Software Update\SoftwareUpdate.exe
    .
    **************************************************************************

    catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
    Rootkit scan 2008-02-17 22:07:44
    Windows 5.1.2600 Service Pack 2 NTFS

    scanning hidden processes ...

    scanning hidden autostart entries ...

    scanning hidden files ...

    scan completed successfully
    hidden files: 0

    **************************************************************************
    .
    --------------------- DLLs Loaded Under Running Processes ---------------------

    PROCESS: C:\WINDOWS\system32\winlogon.exe
    -> C:\WINDOWS\system32\guard32.dll

    PROCESS: C:\WINDOWS\system32\lsass.exe [5.01.2600.2180]
    -> C:\WINDOWS\system32\guard32.dll
    .
    Completion time: 2008-02-17 22:08:47
    ComboFix-quarantined-files.txt 2008-02-17 20:08:42
    ComboFix2.txt 2008-02-14 23:29:36
    .
    2008-02-15 18:02:25 --- E O F ---


    Logfile of Trend Micro HijackThis v2.0.2
    Scan saved at 22:12:38, on 17.2.2008
    Platform: Windows XP SP2 (WinNT 5.01.2600)
    MSIE: Internet Explorer v7.00 (7.00.6000.16608)
    Boot mode: Normal

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
    C:\WINDOWS\system32\spoolsv.exe
    C:\Program Files\QuickTime\qttask.exe
    H:\i Tunes\iTunesHelper.exe
    C:\Program Files\Analog Devices\SoundMAX\SMax4PNP.exe
    C:\Program Files\Analog Devices\SoundMAX\smax4.exe
    C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
    C:\Program Files\COMODO\Firewall\cfp.exe
    E:\program files\Common\FSM32.EXE
    C:\WINDOWS\system32\ctfmon.exe
    C:\Program Files\MSN Messenger\MsnMsgr.Exe
    C:\Program Files\DNA\btdna.exe
    C:\Program Files\Messenger\msmsgs.exe
    C:\Program Files\Common Files\Nero\Lib\NMIndexStoreSvr.exe
    C:\Program Files\WinZip\WZQKPICK.EXE
    C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
    C:\Program Files\COMODO\Firewall\cmdagent.exe
    C:\WINDOWS\system32\tcpsvcs.exe
    C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe
    C:\WINDOWS\System32\snmp.exe
    C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\system32\dllhost.exe
    C:\Program Files\iPod\bin\iPodService.exe
    C:\Program Files\Common Files\Nero\Lib\NMIndexingService.exe
    C:\WINDOWS\system32\dllhost.exe
    C:\WINDOWS\system32\wscntfy.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\system32\wuauclt.exe
    C:\WINDOWS\explorer.exe
    C:\Program Files\Mozilla Firefox 3 Beta 3\firefox.exe
    C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
    R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
    R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Linkit
    R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file)
    O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
    O2 - BHO: CoTGT_BHO Class - {C333CF63-767F-4831-94AC-E683D962C63C} - C:\Program Files\TGTSoft\StyleXP\TGT_BHO.dll
    O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
    O4 - HKLM\..\Run: [Ptipbmf] rundll32.exe ptipbmf.dll,SetWriteCacheMode
    O4 - HKLM\..\Run: [iTunesHelper] "H:\i Tunes\iTunesHelper.exe"
    O4 - HKLM\..\Run: [SoundMAXPnP] C:\Program Files\Analog Devices\SoundMAX\SMax4PNP.exe
    O4 - HKLM\..\Run: [SoundMAX] "C:\Program Files\Analog Devices\SoundMAX\smax4.exe" /tray
    O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
    O4 - HKLM\..\Run: [COMODO Firewall Pro] "C:\Program Files\COMODO\Firewall\cfp.exe" -h
    O4 - HKLM\..\Run: [F-Secure Manager] "e:\program files\Common\FSM32.EXE" /splash
    O4 - HKLM\..\Run: [F-Secure TNB] "e:\program files\FSGUI\TNBUtil.exe" /CHECKALL /WAITFORSW
    O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Common Files\Nero\Lib\NeroCheck.exe
    O4 - HKLM\..\Run: [NBKeyScan] "C:\Program Files\Nero\Nero8\Nero BackItUp\NBKeyScan.exe"
    O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
    O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
    O4 - HKCU\..\Run: [BitTorrent DNA] "C:\Program Files\DNA\btdna.exe"
    O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
    O4 - HKCU\..\Run: [STYLEXP] C:\Program Files\TGTSoft\StyleXP\StyleXP.exe -Hide
    O4 - HKCU\..\Run: [IndxStoreSvr_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Common Files\Nero\Lib\NMIndexStoreSvr.exe" ASO-616B5711-6DAE-4795-A05F-39A1E5104020
    O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Paikallinen palve')
    O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Verkkopalve')
    O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
    O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
    O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
    O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
    O4 - Global Startup: WinZip Quick Pick.lnk = C:\Program Files\WinZip\WZQKPICK.EXE
    O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
    O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://www.update.microsoft.com/mic...ls/en/x86/client/muweb_site.cab?1202406414718
    O20 - AppInit_DLLs: C:\WINDOWS\system32\guard32.dll
    O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
    O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
    O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
    O23 - Service: COMODO Firewall Pro Helper Service (cmdAgent) - COMODO - C:\Program Files\COMODO\Firewall\cmdagent.exe
    O23 - Service: F-Secure Automatic Update Agent (FSAUA) - F-Secure Corporation - e:\program files\FSAUA\program\fsaua.exe
    O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
    O23 - Service: iPod-palvelu (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
    O23 - Service: Nero BackItUp Scheduler 3 - Nero AG - C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe
    O23 - Service: Intel NCS NetService (NetSvc) - Intel(R) Corporation - C:\Program Files\Intel\NCS\Sync\NetSvc.exe
    O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Nero\Lib\NMIndexingService.exe
    O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe

    --
    End of file - 6963 bytes
     
    Nicorette, Feb 17, 2008
    #13
  14. Nicorette

    Nicorette Member

    Joined:
    Jan 12, 2007
    Messages:
    18
    Likes Received:
    0
    Trophy Points:
    11
    joo o epähuomiossa ton yahoon asensin mut poistin kyl heti ku huomasin :D...
     
    Nicorette, Feb 17, 2008
    #14
  15. Hujo

    Hujo Guest

    Jokos kone pysyy päällä kerrasta
     
    Hujo, Feb 17, 2008
    #15
  16. Nicorette

    Nicorette Member

    Joined:
    Jan 12, 2007
    Messages:
    18
    Likes Received:
    0
    Trophy Points:
    11
    juuh kyllä nyt pysyy.. kiitosta tästä :D
     
    Nicorette, Feb 18, 2008
    #16

Share This Page