Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 23:34:41, on 20.12.2008 Platform: Windows Vista SP1 (WinNT 6.00.1905) MSIE: Internet Explorer v7.00 (7.00.6001.18000) Boot mode: Normal Running processes: C:\Windows\system32\taskeng.exe C:\Windows\system32\Dwm.exe C:\Windows\Explorer.EXE C:\Program Files\Windows Defender\MSASCui.exe C:\Program Files\Synaptics\SynTP\SynTPEnh.exe C:\Program Files\Hp\QuickPlay\QPService.exe C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\QLBCTRL.exe C:\Program Files\Hewlett-Packard\HP Wireless Assistant\WiFiMsg.exe C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe C:\Program Files\Winamp\winampa.exe C:\Program Files\Alwil Software\Avast4\ashDisp.exe C:\Program Files\Logitech\Video\LogiTray.exe C:\Program Files\Hp\HP Software Update\hpwuSchd2.exe C:\Program Files\Windows Sidebar\sidebar.exe C:\Program Files\Windows Live\Messenger\msnmsgr.exe C:\Program Files\Logitech\Desktop Messenger\8876480\Program\backWeb-8876480.exe C:\Windows\System32\rundll32.exe C:\Windows\system32\conime.exe C:\Windows\system32\wbem\unsecapp.exe C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Winamp\winamp.exe C:\Program Files\Last.fm\LastFM.exe C:\Windows\System32\rundll32.exe C:\Program Files\Picasa2\Picasa2.exe C:\Windows\system32\SearchFilterHost.exe C:\Program Files\Trend Micro\HijackThis\HijackThis.exe R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.bsplayer-search.com/startpage R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=FI_FI&c=73&bd=PRESARIO&pf=laptop R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=FI_FI&c=73&bd=PRESARIO&pf=laptop R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = localhost R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = O1 - Hosts: ::1 localhost O2 - BHO: Adobe PDF Reader -linkkiavustaja - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll O2 - BHO: BitComet ClickCapture - {39F7E362-828A-4B5A-BCAF-5B79BFDFEA60} - C:\Program Files\BitComet\tools\BitCometBHO_1.2.8.7.dll O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file) O2 - BHO: Windows Liven kirjautumisapuohjelma - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll O3 - Toolbar: BS.Player ControlBar - {2C688203-7EB3-4327-9995-1CB417BA23F9} - C:\Program Files\BS.Player ControlBar\BSToolbar.dll O4 - HKLM\..\Run: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe O4 - HKLM\..\Run: [QPService] "C:\Program Files\HP\QuickPlay\QPService.exe" O4 - HKLM\..\Run: [QlbCtrl] %ProgramFiles%\Hewlett-Packard\HP Quick Launch Buttons\QlbCtrl.exe /Start O4 - HKLM\..\Run: [HP Health Check Scheduler] C:\Program Files\Hewlett-Packard\HP Health Check\HPHC_Scheduler.exe O4 - HKLM\..\Run: [hpWirelessAssistant] %ProgramFiles%\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe O4 - HKLM\..\Run: [WAWifiMessage] %ProgramFiles%\Hewlett-Packard\HP Wireless Assistant\WiFiMsg.exe O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe" O4 - HKLM\..\Run: [WinampAgent] "C:\Program Files\Winamp\winampa.exe" O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" O4 - HKLM\..\Run: [NvSvc] RUNDLL32.EXE C:\Windows\system32\nvsvc.dll,nvsvcStart O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\Windows\system32\NvCpl.dll,NvStartup O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\Windows\system32\NvMcTray.dll,NvTaskbarInit O4 - HKLM\..\Run: [LogitechVideoRepair] C:\Program Files\Logitech\Video\ISStart.exe /RegAll O4 - HKLM\..\Run: [LogitechVideoTray] C:\Program Files\Logitech\Video\LogiTray.exe O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\Hp\HP Software Update\HPWuSchd2.exe O4 - HKLM\..\RunOnce: [Launcher] %WINDIR%\SMINST\launcher.exe O4 - HKCU\..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background O4 - HKCU\..\Run: [Steam] "c:\program files\steam\steam.exe" -silent O4 - HKCU\..\Run: [axistwo] "C:\ProgramData\infoelseelse.vmthe3" O4 - HKCU\..\Run: [Bat Wave Base Dale] "C:\ProgramData\Remote face more.vf9gybm" O4 - HKCU\..\Run: [LDM] C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BackWeb-8876480.exe O4 - HKCU\..\Run: [LogitechSoftwareUpdate] "C:\Program Files\Logitech\Video\ManifestEngine.exe" boot O4 - HKCU\..\Run: [Nokia.PCSync] "C:\Program Files\Nokia\Nokia PC Suite 6\PCSync2.exe" /NoDialog O4 - HKCU\..\Run: [PC Suite Tray] "C:\Program Files\Nokia\Nokia PC Suite 6\PCSuite.exe" -onlytray O4 - HKCU\..\Run: [Skype] "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'Paikallinen palvelu') O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'Paikallinen palvelu') O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'Verkkopalvelu') O4 - Global Startup: Logitech Desktop Messenger.lnk = C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LDMConf.exe O8 - Extra context menu item: &D&ownload &with BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddLink.htm O8 - Extra context menu item: &D&ownload all video with BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddVideo.htm O8 - Extra context menu item: &D&ownload all with BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddAllLink.htm O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\PROGRA~1\Java\JRE16~2.0_0\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\PROGRA~1\Java\JRE16~2.0_0\bin\ssv.dll O9 - Extra button: BitComet - {D18A0B52-D63C-4ed0-AFC6-C1E3DC1AF43A} - res://C:\Program Files\BitComet\tools\BitCometBHO_1.2.8.7.dll/206 (file missing) O13 - Gopher Prefix: O16 - DPF: {20A60F0D-9AFA-4515-A0FD-83BD84642501} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab56986.cab O16 - DPF: {67DABFBF-D0AB-41FA-9C46-CC0F21721616} (DivXBrowserPlugin Object) - http://download.divx.com/player/DivXBrowserPlugin.cab O16 - DPF: {BDBDE413-7B1C-4C68-A8FF-C5B2B4090876} (F-Secure Online Scanner 3.3) - http://support.f-secure.com/ols/fscax.cab O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab O16 - DPF: {D1548A26-B8F6-4E86-AE74-E7062CCC2E2A} (igLoader Content on Demand) - http://www.miniclip.com/igloader/igloader.CAB O16 - DPF: {F5A7706B-B9C0-4C89-A715-7A0C6B05DD48} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineSweeper.cab56986.cab O23 - Service: Lavasoft Ad-Aware Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe O23 - Service: Automaattinen LiveUpdate-ajastustoiminto - Unknown owner - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe (file missing) O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe O23 - Service: Com4Qlb - Hewlett-Packard Development Company, L.P. - C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\Com4Qlb.exe O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe O23 - Service: HP Health Check Service - Hewlett-Packard - C:\Program Files\Hewlett-Packard\HP Health Check\hphc_service.exe O23 - Service: hpqwmiex - Hewlett-Packard Development Company, L.P. - C:\Program Files\Hewlett-Packard\Shared\hpqwmiex.exe O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe O23 - Service: RoxMediaDB9 - Sonic Solutions - C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxMediaDB9.exe O23 - Service: ServiceLayer - Nokia. - C:\Program Files\PC Connectivity Solution\ServiceLayer.exe O23 - Service: Steam Client Service - Valve Corporation - C:\Program Files\Common Files\Steam\SteamService.exe O23 - Service: stllssvr - MicroVision Development, Inc. - C:\Program Files\Common Files\SureThing Shared\stllssvr.exe O23 - Service: Symantec Core LC - Unknown owner - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe O23 - Service: XAudioService - Conexant Systems, Inc. - C:\Windows\system32\DRIVERS\xaudio.exe -- End of file - 10341 bytes
Windows Defender Avaa Windows Defender. Klikkaa Tools ja General Settings. Selaa alas ja ota rasti pois Turn on real-time protection (recommended)-kohdasta. Tämän jälkeen klikkaa Save ja sulje Windows Defender. Älkä laita päälle ================ scannaa hjt:llä merkkaa paina Fix checked R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file) O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe" O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\Hp\HP Software Update\HPWuSchd2.exe O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" O4 - HKCU\..\Run: [Nokia.PCSync] "C:\Program Files\Nokia\Nokia PC Suite 6\PCSync2.exe" /NoDialog O23 - Service: Automaattinen LiveUpdate-ajastustoiminto - Unknown owner - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe (file missing) O23 - Service: Symantec Core LC - Unknown owner - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe ================== aja Nortonin poistotyökalu Poista kansiot vikasiedossa C:\Program Files\Symantec C:\Program Files\Common Files\Symantec Shared ================= 1.Lataa Combofix.exe työpöydällesi yhdestä linkistä: Combofix1 Combofix2 2. Tuplaklikkaa Combofix.exe tiedostoa ja seuraa ohjeistuksia. Älä asenna Palautuskonsolia Recovery Console Klikkaa EI 3. Kun työkalu on valmis, se tuottaa lokin. Lähetä tämä loki viesti ketjuusi. Huom! Älä klikkaile combofixin ikkunaa käytön aikana. Tämä saattaa aiheuttaa ohjelman jumiutumisen. ============== ja scannaa uusi hjt:n loki viimisenä
ComboFix 08-12-20.03 - Juuli 2008-12-21 10:18:38.1 - NTFSx86 Microsoft® Windows Vista™ Home Premium 6.0.6001.1.1252.1.1035.18.958.343 [GMT 2:00] Sijainti: c:\users\Juuli\Downloads\ComboFix.exe * Uusi palautuspiste luotu . ((((( Tiedostot, jotka on luotu seuraavalla aikavälillä: 2008-11-21 to 2008-12-21 ))))))))))))))))) . 2008-12-21 01:51 . 2008-12-21 01:51 <KANSIO> d-------- c:\users\All Users\NortonInstaller 2008-12-21 01:51 . 2008-12-21 01:51 <KANSIO> d-------- c:\programdata\NortonInstaller 2008-12-21 00:40 . 2008-12-21 00:40 <KANSIO> d-------- c:\users\Juuli\AppData\Roaming\Ulead Systems 2008-12-21 00:22 . 2008-12-21 00:36 <KANSIO> d-------- c:\program files\Common Files\Ulead Systems 2008-12-21 00:20 . 2008-12-21 00:36 <KANSIO> d-------- c:\users\All Users\Ulead Systems 2008-12-21 00:20 . 2008-12-21 00:36 <KANSIO> d-------- c:\programdata\Ulead Systems 2008-12-21 00:20 . 2008-12-21 00:20 <KANSIO> d-------- c:\program files\Corel 2008-12-21 00:12 . 2008-12-21 00:12 <KANSIO> d-------- c:\windows\Downloaded Installations 2008-12-20 23:34 . 2008-12-20 23:34 <KANSIO> d-------- c:\program files\Trend Micro 2008-12-12 08:53 . 2008-10-22 03:22 2,048 --a------ c:\windows\System32\tzres.dll 2008-12-12 08:16 . 2008-11-01 03:21 4,240,384 --a------ c:\windows\System32\GameUXLegacyGDFs.dll 2008-12-12 08:16 . 2008-10-29 08:29 2,927,104 --a------ c:\windows\explorer.exe 2008-12-12 08:16 . 2008-10-21 07:25 296,960 --a------ c:\windows\System32\gdi32.dll 2008-12-12 08:16 . 2008-11-01 05:44 28,672 --a------ c:\windows\System32\Apphlpdm.dll 2008-12-12 08:15 . 2008-06-23 03:59 2,868,736 --a------ c:\windows\System32\mf.dll 2008-12-12 08:15 . 2008-06-23 03:59 996,352 --a------ c:\windows\System32\WMNetMgr.dll 2008-12-12 08:15 . 2008-10-16 06:47 827,392 --a------ c:\windows\System32\wininet.dll 2008-12-12 08:15 . 2008-06-23 03:58 94,720 --a------ c:\windows\System32\logagent.exe 2008-12-11 18:24 . 2008-12-11 18:26 <KANSIO> d-------- c:\users\Juuli\AppData\Roaming\TigerPlayer 2008-12-11 18:19 . 2008-12-11 18:19 <KANSIO> d-------- c:\users\All Users\Apple Computer 2008-12-11 18:19 . 2008-12-11 18:19 <KANSIO> d-------- c:\programdata\Apple Computer 2008-12-11 18:19 . 2008-12-11 18:23 <KANSIO> d-------- c:\program files\MpcStar 2008-12-10 18:30 . 2008-12-21 10:12 <KANSIO> d-------- c:\users\Juuli\AppData\Roaming\Skype 2008-12-10 18:30 . 2008-12-10 18:30 <KANSIO> d-------- c:\users\All Users\Skype 2008-12-10 18:30 . 2008-12-10 18:30 <KANSIO> d-------- c:\programdata\Skype 2008-12-10 18:30 . 2008-12-10 18:30 <KANSIO> d-------- c:\program files\Skype 2008-12-09 22:11 . 2008-12-09 22:11 <KANSIO> d-------- c:\program files\CCleaner 2008-12-09 15:43 . 2008-12-09 15:43 <KANSIO> d-------- c:\users\Juuli\AppData\Roaming\PC Suite 2008-12-09 15:43 . 2008-12-09 15:43 <KANSIO> d-------- c:\users\All Users\PC Suite 2008-12-09 15:43 . 2008-12-09 15:43 <KANSIO> d-------- c:\programdata\PC Suite 2008-12-09 15:43 . 2008-12-09 15:43 0 --ah----- c:\windows\System32\drivers\Msft_User_PCCSWpdDriver_01_05_00.Wdf 2008-12-09 15:42 . 2008-12-09 15:42 0 --ah----- c:\windows\System32\drivers\Msft_Kernel_ccdcmb_01005.Wdf 2008-12-09 15:37 . 2008-12-09 18:41 <KANSIO> d-------- c:\users\Juuli\AppData\Roaming\Nokia 2008-12-09 15:36 . 2008-12-09 15:36 <KANSIO> d-------- c:\program files\Common Files\PCSuite 2008-12-09 15:36 . 2008-12-09 15:36 <KANSIO> d-------- c:\program files\Common Files\Nokia 2008-12-09 15:35 . 2008-12-09 15:35 <KANSIO> d-------- c:\program files\DIFX 2008-12-09 15:35 . 2007-09-17 15:53 21,632 --a------ c:\windows\System32\drivers\pccsmcfd.sys 2008-12-09 15:33 . 2008-12-09 15:35 <KANSIO> d----c--- c:\windows\System32\DRVSTORE 2008-12-09 15:33 . 2008-12-09 15:33 <KANSIO> d-------- c:\program files\PC Connectivity Solution 2008-12-09 15:32 . 2008-12-09 15:33 <KANSIO> d-------- c:\users\Juuli\{75bad294-c379-458c-b8c8-3525a31072d8} 2008-12-09 15:29 . 2008-12-09 15:35 <KANSIO> d-------- c:\program files\Nokia 2008-12-09 15:29 . 2007-11-29 10:32 48,128 --a------ c:\windows\System32\nmwcdcls.dll 2008-12-09 15:28 . 2008-12-09 15:28 <KANSIO> d-------- c:\users\All Users\Installations 2008-12-09 15:28 . 2008-12-09 15:28 <KANSIO> d-------- c:\programdata\Installations 2008-12-08 19:47 . 2008-12-08 19:48 <KANSIO> d-------- c:\program files\Mopokorttikoulu 2008-12-03 14:56 . 2008-10-16 23:13 1,809,944 --a------ c:\windows\System32\wuaueng.dll 2008-12-03 14:56 . 2008-10-16 22:56 1,524,736 --a------ c:\windows\System32\wucltux.dll 2008-12-03 14:56 . 2008-10-16 23:12 561,688 --a------ c:\windows\System32\wuapi.dll 2008-12-03 14:56 . 2008-10-16 22:55 83,456 --a------ c:\windows\System32\wudriver.dll 2008-12-03 14:56 . 2008-10-16 23:09 51,224 --a------ c:\windows\System32\wuauclt.exe 2008-12-03 14:56 . 2008-10-16 23:09 43,544 --a------ c:\windows\System32\wups2.dll 2008-12-03 14:56 . 2008-10-16 23:08 34,328 --a------ c:\windows\System32\wups.dll 2008-12-03 14:55 . 2008-10-16 14:08 162,064 --a------ c:\windows\System32\wuwebv.dll 2008-12-03 14:55 . 2008-10-16 13:56 31,232 --a------ c:\windows\System32\wuapp.exe 2008-11-26 07:08 . 2008-10-21 07:25 1,645,568 --a------ c:\windows\System32\connect.dll 2008-11-26 07:08 . 2008-08-28 05:40 712,704 --a------ c:\windows\System32\WindowsCodecs.dll 2008-11-26 07:08 . 2008-08-28 05:40 425,472 --a------ c:\windows\System32\PhotoMetadataHandler.dll 2008-11-26 07:08 . 2008-08-28 05:40 347,136 --a------ c:\windows\System32\WindowsCodecsExt.dll 2008-11-26 07:08 . 2008-10-22 05:57 241,152 --a------ c:\windows\System32\PortableDeviceApi.dll . (((((((((((((((((((((((((((((((((((( Find3M-raportti )))))))))))))))))))))))))))))))))))))))))))))))))))))) . 2008-12-21 08:12 --------- d-----w c:\program files\Steam 2008-12-20 22:39 --------- d--h--w c:\program files\InstallShield Installation Information 2008-12-20 18:24 13,025 ----a-w c:\users\Juuli\AppData\Roaming\nvModes.dat 2008-12-20 07:04 --------- d-----w c:\programdata\Spybot - Search & Destroy 2008-12-16 13:08 --------- d-----w c:\users\Juuli\AppData\Roaming\Winamp 2008-12-12 12:23 --------- d-----w c:\program files\Windows Mail 2008-12-06 08:20 --------- d-----w c:\program files\Common Files\Steam 2008-11-26 17:17 51,792 ----a-w c:\windows\system32\drivers\aswMonFlt.sys 2008-11-22 14:17 --------- d-----w c:\programdata\WLInstaller 2008-11-15 11:36 --------- d-----w c:\program files\BitComet 2008-11-12 12:19 --------- d-----w c:\program files\EA GAMES 2008-11-10 20:46 --------- d-----w c:\program files\Spybot - Search & Destroy 2008-11-05 18:03 192 ----a-w c:\users\Juuli\AppData\Roaming\wklnhst.dat 2008-11-05 17:55 --------- d-----w c:\users\Juuli\AppData\Roaming\Template 2008-11-01 03:44 541,696 ----a-w c:\windows\AppPatch\AcLayers.dll 2008-11-01 03:44 52,736 ----a-w c:\windows\AppPatch\iebrshim.dll 2008-11-01 03:44 460,288 ----a-w c:\windows\AppPatch\AcSpecfc.dll 2008-11-01 03:44 2,154,496 ----a-w c:\windows\AppPatch\AcGenral.dll 2008-11-01 03:44 173,056 ----a-w c:\windows\AppPatch\AcXtrnal.dll 2008-10-30 17:25 --------- d-----w c:\program files\Winamp 2008-10-30 16:21 --------- d-----w c:\program files\Hp 2008-10-30 14:43 --------- d-----w c:\users\Juuli\AppData\Roaming\Winamp(158) 2008-10-29 18:28 --------- d-----w c:\programdata\NVIDIA 2008-10-29 18:24 --------- d-----w c:\program files\Norton Security Scan 2008-10-25 11:20 0 ---ha-w c:\windows\system32\drivers\Msft_User_WpdMtpDr_01_00_00.Wdf 2008-10-24 20:10 --------- d-----w c:\programdata\Last.fm 2008-10-24 20:08 --------- d-----w c:\program files\Last.fm 2008-10-23 13:45 --------- d-----w c:\users\Juuli\AppData\Roaming\Talkback 2008-10-23 12:53 13,025 ----a-w c:\users\Tarja\AppData\Roaming\nvModes.dat 2008-10-23 09:17 --------- d-----w c:\users\Tarja\AppData\Roaming\Talkback 2008-10-19 09:27 81,920 ------r c:\windows\bwUnin-6.1.4.68-8876480L.exe 2008-10-09 17:18 0 ---h--w c:\users\All Users\PKP_DLdu.DAT 2008-10-09 17:18 0 ---h--w c:\programdata\PKP_DLdu.DAT 2008-09-30 14:43 1,286,152 ----a-w c:\windows\System32\msxml4.dll 2008-09-16 11:59 174 --sha-w c:\program files\desktop.ini 2008-06-28 19:37 16,384 --sha-w c:\windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat 2008-06-28 19:37 32,768 --sha-w c:\windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat 2008-06-28 19:37 16,384 --sha-w c:\windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Cookies\index.dat 2007-10-16 19:03 22 --sha-w c:\windows\SMINST\HPCD.sys . (((((((((((((((((((((((((((((( Rekisterin käynnistyskohteet ))))))))))))))))))))))))))))))))))))))))))))) . . *Huom* Tyhjiä arvoja ja laillisia oletusarvoja ei näytetä REGEDIT4 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "axistwo"="c:\programdata\infoelseelse.vmthe3" [X] "Bat Wave Base Dale"="c:\programdata\Remote face more.vf9gybm" [X] "Sidebar"="c:\program files\Windows Sidebar\sidebar.exe" [2008-01-19 1233920] "msnmsgr"="c:\program files\Windows Live\Messenger\MsnMsgr.Exe" [2007-10-18 5724184] "Steam"="c:\program files\steam\steam.exe" [2008-10-08 1410296] "LDM"="c:\program files\Logitech\Desktop Messenger\8876480\Program\BackWeb-8876480.exe" [2008-10-19 20480] "LogitechSoftwareUpdate"="c:\program files\Logitech\Video\ManifestEngine.exe" [2004-10-08 196608] "PC Suite Tray"="c:\program files\Nokia\Nokia PC Suite 6\PCSuite.exe" [2008-04-16 1079808] "Skype"="c:\program files\Skype\Phone\Skype.exe" [2006-07-14 20034600] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2007-01-13 827392] "QPService"="c:\program files\HP\QuickPlay\QPService.exe" [2007-03-28 176128] "QlbCtrl"="c:\program files\Hewlett-Packard\HP Quick Launch Buttons\QlbCtrl.exe" [2007-03-06 180224] "HP Health Check Scheduler"="c:\program files\Hewlett-Packard\HP Health Check\HPHC_Scheduler.exe" [2007-03-12 50696] "hpWirelessAssistant"="c:\program files\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe" [2007-03-01 472776] "WAWifiMessage"="c:\program files\Hewlett-Packard\HP Wireless Assistant\WiFiMsg.exe" [2007-01-10 317128] "SunJavaUpdateSched"="c:\program files\Java\jre1.6.0_07\bin\jusched.exe" [2008-06-10 144784] "WinampAgent"="c:\program files\Winamp\winampa.exe" [2008-08-04 36352] "avast!"="c:\progra~1\ALWILS~1\Avast4\ashDisp.exe" [2008-11-26 81000] "Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-01-11 39792] "NvSvc"="c:\windows\system32\nvsvc.dll" [2007-02-26 90191] "NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2007-02-26 7770112] "NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2007-02-26 81920] "LogitechVideoRepair"="c:\program files\Logitech\Video\ISStart.exe" [2004-10-08 458752] "LogitechVideoTray"="c:\program files\Logitech\Video\LogiTray.exe" [2004-10-08 217088] "HP Software Update"="c:\program files\Hp\HP Software Update\HPWuSchd2.exe" [2007-05-08 54840] "Ulead AutoDetector v2"="c:\program files\Common Files\Ulead Systems\AutoDetector\monitor.exe" [2007-08-02 95504] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce] "Launcher"="c:\windows\SMINST\launcher.exe" [2006-11-07 44128] c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\ Logitech Desktop Messenger.lnk - c:\program files\Logitech\Desktop Messenger\8876480\Program\LDMConf.exe [2008-10-19 450560] [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system] "EnableUIADesktopToggle"= 0 (0x0) [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32] "vidc.tscc"= c:\progra~1\MpcStar\Codecs\tscc\tsccvid.dll [HKEY_LOCAL_MACHINE\software\microsoft\security center] "UacDisableNotify"=dword:00000001 "InternetSettingsDisableNotify"=dword:00000001 "AutoUpdateDisableNotify"=dword:00000001 [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring] "DisableMonitoring"=dword:00000001 [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus] "DisableMonitoring"=dword:00000001 [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall] "DisableMonitoring"=dword:00000001 [HKLM\~\services\sharedaccess\parameters\firewallpolicy\FirewallRules] "{2A0D55CF-8F7C-491F-8B79-F61B0F7A5A83}"= c:\program files\HP\QuickPlay\QP.exe:Quick Play "{C112B015-8303-4137-8A30-2C64733A7074}"= c:\program files\HP\QuickPlay\QPService.exe:Quick Play Resident Program "{0400F50D-641F-4CFB-9317-B2274AC67A27}"= UDP:c:\program files\LimeWire\LimeWire.exe:LimeWire "{CA35EBB7-AFC7-4AD7-AE17-C6CE3D75F507}"= TCP:c:\program files\LimeWire\LimeWire.exe:LimeWire "TCP Query User{2E75AB4B-F7D9-4E3B-A77A-AE8793777BD5}c:\\program files\\internet explorer\\iexplore.exe"= UDP:c:\program files\internet explorer\iexplore.exe:Internet Explorer "UDP Query User{B51D4EEC-5898-4931-99DB-29222DD48404}c:\\program files\\internet explorer\\iexplore.exe"= TCP:c:\program files\internet explorer\iexplore.exe:Internet Explorer "{AC198D78-7CA7-4A1F-A4D7-A32B4461BFF6}"= c:\program files\Windows Live\Messenger\livecall.exe:Windows Live Messenger (Phone) "TCP Query User{CC4CD4C6-E7E9-4758-A209-68B0815E53D0}c:\\program files\\hamachi\\hamachi.exe"= UDP:c:\program files\hamachi\hamachi.exe:Hamachi Client "UDP Query User{95855144-0774-48D8-AC8C-CCC486073BFC}c:\\program files\\hamachi\\hamachi.exe"= TCP:c:\program files\hamachi\hamachi.exe:Hamachi Client "TCP Query User{C58B2CB3-EF60-40A8-8D9C-275D05BDBF8C}c:\\program files\\dc++\\dcplusplus.exe"= UDP:c:\program files\dc++\dcplusplus.exeC++ "UDP Query User{86296481-2A7B-4C73-98F9-0E6B256734EA}c:\\program files\\dc++\\dcplusplus.exe"= TCP:c:\program files\dc++\dcplusplus.exeC++ "TCP Query User{A9AEAA79-F382-49E8-A487-4451BB78E2F6}c:\\program files\\revconnect\\dcplusplus.exe"= UDP:c:\program files\revconnect\dcplusplus.exeC++ "UDP Query User{9C452259-FDD9-459D-994A-5CA16EDF5639}c:\\program files\\revconnect\\dcplusplus.exe"= TCP:c:\program files\revconnect\dcplusplus.exeC++ "{C3A51923-8A03-46C7-A408-239A724D824D}"= c:\program files\Windows Live\Messenger\livecall.exe:Windows Live Messenger (Phone) "{C0197954-1EEE-455B-88F7-E005C39F4865}"= c:\program files\Windows Live\Messenger\livecall.exe:Windows Live Messenger (Phone) "{3DBB4153-B593-43B9-B5BF-54C7E7C65041}"= c:\program files\Windows Live\Messenger\livecall.exe:Windows Live Messenger (Phone) "TCP Query User{3DAC57B8-6C13-45BD-BA37-AF810E7E27B8}c:\\program files\\counter-strike 1.6 v31\\hl.exe"= UDP:c:\program files\counter-strike 1.6 v31\hl.exe:Half-Life Launcher "UDP Query User{48C464A2-041C-4CE5-945F-2FC183CF9C4E}c:\\program files\\counter-strike 1.6 v31\\hl.exe"= TCP:c:\program files\counter-strike 1.6 v31\hl.exe:Half-Life Launcher "TCP Query User{8CC7BE0C-5BC1-408E-A5CC-BBBBF81A15FD}c:\\program files\\counter-strike 1.6 v31\\hl.exe"= UDP:c:\program files\counter-strike 1.6 v31\hl.exe:Half-Life Launcher "UDP Query User{EE1D5DAF-D960-4497-9927-49D0D21C1C39}c:\\program files\\counter-strike 1.6 v31\\hl.exe"= TCP:c:\program files\counter-strike 1.6 v31\hl.exe:Half-Life Launcher "TCP Query User{2F733D6C-7156-469C-9509-C23F1641F585}c:\\program files\\limewire\\limewire.exe"= UDP:c:\program files\limewire\limewire.exe:LimeWire "UDP Query User{AF7E78DE-A336-4A54-B948-45FE2436D717}c:\\program files\\limewire\\limewire.exe"= TCP:c:\program files\limewire\limewire.exe:LimeWire "TCP Query User{9A121569-AD7F-46F8-8A3B-8E756B954791}c:\\program files\\steam\\steamapps\\kaara\\counter-strike\\hl.exe"= UDP:c:\program files\steam\steamapps\kaara\counter-strike\hl.exe:Half-Life Launcher "UDP Query User{AC2AB89F-1ED3-4CA7-89FB-1E02023F2726}c:\\program files\\steam\\steamapps\\kaara\\counter-strike\\hl.exe"= TCP:c:\program files\steam\steamapps\kaara\counter-strike\hl.exe:Half-Life Launcher "TCP Query User{43C7E299-ACFC-443C-AB25-445B80EE1011}c:\\program files\\steam\\steamapps\\tema\\counter-strike\\hl.exe"= UDP:c:\program files\steam\steamapps\tema\counter-strike\hl.exe:Half-Life Launcher "UDP Query User{3104413C-D358-4153-8D44-39A1A731B3B5}c:\\program files\\steam\\steamapps\\tema\\counter-strike\\hl.exe"= TCP:c:\program files\steam\steamapps\tema\counter-strike\hl.exe:Half-Life Launcher "TCP Query User{BA34960B-7EFA-445E-9AD8-3D8DC3C62D85}c:\\program files\\steam\\steamapps\\tema\\counter-strike\\hl.exe"= UDP:c:\program files\steam\steamapps\tema\counter-strike\hl.exe:Half-Life Launcher "UDP Query User{554958DC-939A-4F40-9B64-E45D30A92FE3}c:\\program files\\steam\\steamapps\\tema\\counter-strike\\hl.exe"= TCP:c:\program files\steam\steamapps\tema\counter-strike\hl.exe:Half-Life Launcher "TCP Query User{542C49D1-FFA7-410A-8E18-A41E8116CFDA}c:\\program files\\revconnect\\dcplusplus.exe"= UDP:c:\program files\revconnect\dcplusplus.exeC++ "UDP Query User{A6D62A3E-CAE8-4905-9499-00C99B4FADC1}c:\\program files\\revconnect\\dcplusplus.exe"= TCP:c:\program files\revconnect\dcplusplus.exeC++ "TCP Query User{40491683-55CC-43F5-8026-81494DB2B670}c:\\program files\\bitcomet\\bitcomet.exe"= UDP:c:\program files\bitcomet\bitcomet.exe:BitComet - a BitTorrent Client "UDP Query User{69E590DB-0889-4FD2-84B9-29FD0BAD746E}c:\\program files\\bitcomet\\bitcomet.exe"= TCP:c:\program files\bitcomet\bitcomet.exe:BitComet - a BitTorrent Client "TCP Query User{9EEA83D9-AB59-4DD8-9FB0-ABE02DEB0FE3}c:\\program files\\logitech\\desktop messenger\\8876480\\program\\backweb-8876480.exe"= UDP:c:\program files\logitech\desktop messenger\8876480\program\backweb-8876480.exe:Logitech Desktop Messenger "UDP Query User{346E7FB6-6BB7-464B-9827-BBC32C490A2C}c:\\program files\\logitech\\desktop messenger\\8876480\\program\\backweb-8876480.exe"= TCP:c:\program files\logitech\desktop messenger\8876480\program\backweb-8876480.exe:Logitech Desktop Messenger "TCP Query User{E553B671-AF2A-4BAC-9529-880B9949C7F9}c:\\program files\\logitech\\desktop messenger\\8876480\\program\\backweb-8876480.exe"= UDP:c:\program files\logitech\desktop messenger\8876480\program\backweb-8876480.exe:Logitech Desktop Messenger "UDP Query User{D5D2FE94-D476-4648-88CA-6A03061358E6}c:\\program files\\logitech\\desktop messenger\\8876480\\program\\backweb-8876480.exe"= TCP:c:\program files\logitech\desktop messenger\8876480\program\backweb-8876480.exe:Logitech Desktop Messenger "{8C74C430-5594-42ED-8183-8F0C426EDFB8}"= c:\program files\Windows Live\Messenger\livecall.exe:Windows Live Messenger (Phone) "{C0477F97-8299-4361-8946-B5763FA6AE1E}"= Disabled:UDP:c:\program files\Skype\Phone\Skype.exe:Skype "{C50906C2-606D-4198-BFCD-65C090B4D191}"= Disabled:TCP:c:\program files\Skype\Phone\Skype.exe:Skype "{9397F628-F179-4751-A9C5-EE49F3E03EA5}"= UDP:c:\users\Juuli\AppData\Local\Temp\WZSE0.TMP\SymNRT.exe:Norton Removal Tool "{C6FD3437-843E-4D08-86F9-353D926FFC31}"= TCP:c:\users\Juuli\AppData\Local\Temp\WZSE0.TMP\SymNRT.exe:Norton Removal Tool R1 aswSP;avast! Self Protection;c:\windows\system32\drivers\aswSP.sys [2008-12-11 111184] R2 aswFsBlk;aswFsBlk;c:\windows\system32\DRIVERS\aswFsBlk.sys [2008-12-11 20560] R2 aswMonFlt;aswMonFlt;c:\windows\system32\DRIVERS\aswMonFlt.sys [2008-02-15 51792] S2 Automaattinen LiveUpdate-ajastustoiminto;Automaattinen LiveUpdate-ajastustoiminto;"c:\program files\Symantec\LiveUpdate\ALUSchedulerSvc.exe" [] *Newly Created Service* - PROCEXP90 . 'Ajoitetut tehtävät'-kansion sisältö 2008-12-08 c:\windows\Tasks\Norton Internet Security - Suorita täyd. järj.tarkistus - Tarja.job - c:\program files\Norton Internet Security\Norton AntiVirus\Navw32.exe [] . ************************************************************************** catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2008-12-21 10:23:03 Windows 6.0.6001 Service Pack 1 NTFS tarkistaa piilotettuja prosesseja ... tarkistaa piilotettuja käynnistysarvoja ... tarkistaa piilotettuja tiedostoja ... tarkistus on valmis piilotetut tiedostot: 0 ************************************************************************** . --------------------- Prosesseihin ladatut DLLt --------------------- - - - - - - - > 'Explorer.exe'(3908) c:\users\Juuli\AppData\Local\Temp\IadHide4.dll . Valmistumisajankohta: 2008-12-21 10:33:19 ComboFix-quarantined-files.txt 2008-12-21 08:33:05 Ennen ajoa: 52 803 723 264 tavua vapaana Ajon jälkeen: 52,943,781,888 tavua vapaana 231 --- E O F --- 2008-12-19 11:21:59 Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 10:37:16, on 21.12.2008 Platform: Windows Vista SP1 (WinNT 6.00.1905) MSIE: Internet Explorer v7.00 (7.00.6001.18000) Boot mode: Normal Running processes: C:\Windows\system32\taskeng.exe C:\Windows\system32\Dwm.exe C:\Program Files\Synaptics\SynTP\SynTPEnh.exe C:\Program Files\Hp\QuickPlay\QPService.exe C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\QLBCTRL.exe C:\Program Files\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe C:\Program Files\Hewlett-Packard\HP Wireless Assistant\WiFiMsg.exe C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe C:\Program Files\Winamp\winampa.exe C:\Program Files\Alwil Software\Avast4\ashDisp.exe C:\Program Files\Logitech\Video\LogiTray.exe C:\Program Files\Hp\HP Software Update\hpwuSchd2.exe C:\Program Files\Common Files\Ulead Systems\AutoDetector\Monitor.exe C:\Program Files\Windows Sidebar\sidebar.exe C:\Program Files\Logitech\Desktop Messenger\8876480\Program\backWeb-8876480.exe C:\Program Files\Nokia\Nokia PC Suite 6\PCSuite.exe C:\Program Files\Skype\Phone\Skype.exe C:\Windows\System32\rundll32.exe C:\Windows\system32\wbem\unsecapp.exe C:\Program Files\Hewlett-Packard\Shared\HpqToaster.exe C:\Windows\system32\conime.exe C:\Windows\Explorer.exe C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Trend Micro\HijackThis\HijackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.bsplayer-search.com/startpage R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=FI_FI&c=73&bd=PRESARIO&pf=laptop R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = localhost R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = O1 - Hosts: ::1 localhost O2 - BHO: Adobe PDF Reader -linkkiavustaja - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll O2 - BHO: BitComet ClickCapture - {39F7E362-828A-4B5A-BCAF-5B79BFDFEA60} - C:\Program Files\BitComet\tools\BitCometBHO_1.2.8.7.dll O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file) O2 - BHO: Windows Liven kirjautumisapuohjelma - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll O3 - Toolbar: BS.Player ControlBar - {2C688203-7EB3-4327-9995-1CB417BA23F9} - C:\Program Files\BS.Player ControlBar\BSToolbar.dll O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe O4 - HKLM\..\Run: [QPService] "C:\Program Files\HP\QuickPlay\QPService.exe" O4 - HKLM\..\Run: [QlbCtrl] %ProgramFiles%\Hewlett-Packard\HP Quick Launch Buttons\QlbCtrl.exe /Start O4 - HKLM\..\Run: [HP Health Check Scheduler] C:\Program Files\Hewlett-Packard\HP Health Check\HPHC_Scheduler.exe O4 - HKLM\..\Run: [hpWirelessAssistant] %ProgramFiles%\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe O4 - HKLM\..\Run: [WAWifiMessage] %ProgramFiles%\Hewlett-Packard\HP Wireless Assistant\WiFiMsg.exe O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe" O4 - HKLM\..\Run: [WinampAgent] "C:\Program Files\Winamp\winampa.exe" O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" O4 - HKLM\..\Run: [NvSvc] RUNDLL32.EXE C:\Windows\system32\nvsvc.dll,nvsvcStart O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\Windows\system32\NvCpl.dll,NvStartup O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\Windows\system32\NvMcTray.dll,NvTaskbarInit O4 - HKLM\..\Run: [LogitechVideoRepair] C:\Program Files\Logitech\Video\ISStart.exe /RegAll O4 - HKLM\..\Run: [LogitechVideoTray] C:\Program Files\Logitech\Video\LogiTray.exe O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\Hp\HP Software Update\HPWuSchd2.exe O4 - HKLM\..\Run: [Ulead AutoDetector v2] C:\Program Files\Common Files\Ulead Systems\AutoDetector\monitor.exe O4 - HKLM\..\RunOnce: [Launcher] %WINDIR%\SMINST\launcher.exe O4 - HKCU\..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background O4 - HKCU\..\Run: [Steam] "c:\program files\steam\steam.exe" -silent O4 - HKCU\..\Run: [axistwo] "C:\ProgramData\infoelseelse.vmthe3" O4 - HKCU\..\Run: [Bat Wave Base Dale] "C:\ProgramData\Remote face more.vf9gybm" O4 - HKCU\..\Run: [LDM] C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BackWeb-8876480.exe O4 - HKCU\..\Run: [LogitechSoftwareUpdate] "C:\Program Files\Logitech\Video\ManifestEngine.exe" boot O4 - HKCU\..\Run: [PC Suite Tray] "C:\Program Files\Nokia\Nokia PC Suite 6\PCSuite.exe" -onlytray O4 - HKCU\..\Run: [Skype] "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized O4 - Global Startup: Logitech Desktop Messenger.lnk = C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LDMConf.exe O8 - Extra context menu item: &D&ownload &with BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddLink.htm O8 - Extra context menu item: &D&ownload all video with BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddVideo.htm O8 - Extra context menu item: &D&ownload all with BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddAllLink.htm O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\PROGRA~1\Java\JRE16~2.0_0\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\PROGRA~1\Java\JRE16~2.0_0\bin\ssv.dll O9 - Extra button: BitComet - {D18A0B52-D63C-4ed0-AFC6-C1E3DC1AF43A} - res://C:\Program Files\BitComet\tools\BitCometBHO_1.2.8.7.dll/206 (file missing) O13 - Gopher Prefix: O16 - DPF: {20A60F0D-9AFA-4515-A0FD-83BD84642501} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab56986.cab O16 - DPF: {67DABFBF-D0AB-41FA-9C46-CC0F21721616} (DivXBrowserPlugin Object) - http://download.divx.com/player/DivXBrowserPlugin.cab O16 - DPF: {BDBDE413-7B1C-4C68-A8FF-C5B2B4090876} (F-Secure Online Scanner 3.3) - http://support.f-secure.com/ols/fscax.cab O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab O16 - DPF: {D1548A26-B8F6-4E86-AE74-E7062CCC2E2A} (igLoader Content on Demand) - http://www.miniclip.com/igloader/igloader.CAB O16 - DPF: {F5A7706B-B9C0-4C89-A715-7A0C6B05DD48} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineSweeper.cab56986.cab O23 - Service: Lavasoft Ad-Aware Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe O23 - Service: Automaattinen LiveUpdate-ajastustoiminto - Unknown owner - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe (file missing) O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe O23 - Service: Com4Qlb - Hewlett-Packard Development Company, L.P. - C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\Com4Qlb.exe O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe O23 - Service: HP Health Check Service - Hewlett-Packard - C:\Program Files\Hewlett-Packard\HP Health Check\hphc_service.exe O23 - Service: hpqwmiex - Hewlett-Packard Development Company, L.P. - C:\Program Files\Hewlett-Packard\Shared\hpqwmiex.exe O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe O23 - Service: RoxMediaDB9 - Sonic Solutions - C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxMediaDB9.exe O23 - Service: ServiceLayer - Nokia. - C:\Program Files\PC Connectivity Solution\ServiceLayer.exe O23 - Service: Steam Client Service - Valve Corporation - C:\Program Files\Common Files\Steam\SteamService.exe O23 - Service: stllssvr - MicroVision Development, Inc. - C:\Program Files\Common Files\SureThing Shared\stllssvr.exe O23 - Service: XAudioService - Conexant Systems, Inc. - C:\Windows\system32\DRIVERS\xaudio.exe -- End of file - 9484 bytes
Scannaa koneesi Kaspersky Online Scannerin Ohjelman käynnistyessä kysytään sallitaanko ActiveX -komponentin asentamisen Kasperskyltä, klikkaa Kyllä. " Ohjelma käynnistyy ja aloittaa viimeisimpien tunnistetiedostojen lataamisen. " Kun skanneri on asennettu ja tunnistetiedot ladattu, klikkaa Next. " Klikkaa nyt asetuksia, Scan Settings " Tarkista asetuksista, että seuraavat ovat valittuina: o Scan using the following Anti-Virus database: + Extended (Jos valittavissa, muuten valitse Standard) o Scan Options: + Scan Archives + Scan Mail Bases " Klikkaa OK " Nyt valitse "select a target to scan" otsikon alta Oma Tietokone, My Computer " Skannaus vie aikaa, joten ole kärsivällinen. Kun skannaus on valmis saat ilmoituksen, jos koneesi on saastunut. " Klikkaa nyt Save as Text-painiketta. " Tallenna tiedosto työpöydällesi. " Mikäli haluat jatkaa asian käsittelyä foorumissa niin kopioi tiedoston sisältö viestiisi. ===================== Lataa JavaRa ja pura se työpöydällesi. ***Sulje kaikki päällä olevat Internet Explorerin ikkunat ennen jatkamista!*** * Tuplaklikkaa JavaRa.exeä käynnistääksesi ohjelma. * Valitse English pudotusvalikosta valitaksesi kieleksi englannin ja klikkaa Select. * Klikkaa Remove Older Versions poistaaksesi vanhat Java-versiot koneeltasi. * Klikkaa Yes kun pyydetään. Kun JavaRa on valmis, se ilmoittaa, että lokitiedosto on luotu. Klikkaa OK. * Lokitiedosto avautuu. Lähetä sen sisältö seuraavassa viestissäsi. 4. Asenna uusin Java päivitys seuraavasta linkistä.. Lataa täältä uusi java Rullaa alas kohteeseen Java Runtime Environment (JRE) 6 Update 11 Paina Download Laita Platform -kohtaan Windows Ruksaa I agree to the Java SE Runtime Environment 6 License Agreement ja paina Continue Paina Windows Offline Installationin alapuolella jre-6u4-windows-i586-p.exe Tallenna tiedosto vaikka työpöydälle ja asenna se. 5. Käynnistä kone uudelleen asennuksen jälkeen. 6. Käynnistyksen jälkeen, mene takaisin Ohjauspaneeliin ja avaa Java asetuksesi (Muita Ohjauspaneelin asetuksia -> Java kahvikuppi). 7. General-välilehdellä klikkaa Settings. Vedä liukusäädintä (Disk Space) pienemmälle. (Jotkut javapohjaiset ohjelmat saattavat tarvita enemmän levytilaa. Jos huomaat säädön pienentämisen jälkeen koneessa hitautta, siirrä liukusäädintä isommalle). 8. Klikkaa Delete Files -nappia. Varmista että kaikki kaksi valintaa ovat rastitettuja: * Applications and Applets * Trace and Log Files Ja paina OK -nappia Huomaa: Tämä poistaa kaikki ladatut sovellukset ja appletit VÄLIMUISTISTA. 9. Klikkaa OK "Temporary Files Settings" -ikkunassasi. 10. Välilehti Update: ota ruksi pois kohdasta Check for Updates automatically Valitse Never check 11. Klikkaa Apply ja OK jättääksesi Java asetusikkunasi.
Keskustelua ei tarvitse varmaankaan enää jatkaa, koska sisko nyt ei ole hirveän innostunut näköjään tuosta koneensa siivoamisesta. Kiitos avusta.
