Kone menee jumiin n.5min käytön jälkeen.

Kone menee totaalisesti jumiin n.5min käytön jälkeen. Mikään ei toimi eikä reagoi.

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 19:58:36, on 9.2.2009
Platform: Windows Vista (WinNT 6.00.1904)
MSIE: Internet Explorer v7.00 (7.00.6000.16643)
Boot mode: Normal

Running processes:
C:\Windows\system32\Dwm.exe
C:\Windows\system32\taskeng.exe
C:\Windows\Explorer.EXE
C:\Windows\System32\igfxtray.exe
C:\Windows\System32\hkcmd.exe
C:\Windows\System32\igfxpers.exe
C:\Windows\system32\igfxsrvc.exe
C:\Program Files\Synaptics\SynTP\SynTPStart.exe
C:\Program Files\Motorola\SMSERIAL\sm56hlpr.exe
C:\Windows\RtHDVCpl.exe
C:\Program Files\Intel\Intel Matrix Storage Manager\IAAnotif.exe
C:\Program Files\HP\QuickPlay\QPService.exe
C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\QLBCTRL.exe
C:\Program Files\Hewlett-Packard\HP QuickTouch\HPKBDAPP.exe
C:\Program Files\Windows Defender\MSASCui.exe
C:\Program Files\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe
C:\Program Files\Hewlett-Packard\HP Wireless Assistant\WiFiMsg.exe
C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Program Files\HP\HP Software Update\hpwuSchd2.exe
C:\Program Files\Adobe\Reader 8.0\Reader\reader_sl.exe
C:\Program Files\Microsoft IntelliPoint\ipoint.exe
C:\Program Files\Windows Sidebar\sidebar.exe
C:\Program Files\Windows Live\Messenger\msnmsgr.exe
C:\Program Files\Common Files\LightScribe\LightScribeControlPanel.exe
C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe
C:\Program Files\Hewlett-Packard\Shared\HpqToaster.exe
C:\Windows\system32\SearchFilterHost.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.elisa.fi/yksityisille/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=fi_fi&c=81&bd=Pavilion&pf=laptop
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=fi_fi&c=81&bd=Pavilion&pf=laptop
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O1 - Hosts: ::1 localhost
O2 - BHO: Adobe PDF Reader -linkkiavustaja - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: NCO 2.0 IE BHO - {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} - (no file)
O2 - BHO: Symantec Intrusion Prevention - {6D53EC84-6AAE-4787-AEEE-F4628F01010C} - C:\PROGRA~1\COMMON~1\SYMANT~1\IDS\IPSBHO.dll (file missing)
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Windows Liven kirjautumisapuohjelma - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
O3 - Toolbar: (no name) - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - (no file)
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O4 - HKLM\..\Run: [IgfxTray] C:\Windows\system32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\Windows\system32\hkcmd.exe
O4 - HKLM\..\Run: [Persistence] C:\Windows\system32\igfxpers.exe
O4 - HKLM\..\Run: [SynTPStart] C:\Program Files\Synaptics\SynTP\SynTPStart.exe
O4 - HKLM\..\Run: [SMSERIAL] C:\Program Files\Motorola\SMSERIAL\sm56hlpr.exe
O4 - HKLM\..\Run: [RtHDVCpl] RtHDVCpl.exe
O4 - HKLM\..\Run: [IAAnotif] C:\Program Files\Intel\Intel Matrix Storage Manager\iaanotif.exe
O4 - HKLM\..\Run: [QPService] "C:\Program Files\HP\QuickPlay\QPService.exe"
O4 - HKLM\..\Run: [QlbCtrl] %ProgramFiles%\Hewlett-Packard\HP Quick Launch Buttons\QlbCtrl.exe /Start
O4 - HKLM\..\Run: [OnScreenDisplay] C:\Program Files\Hewlett-Packard\HP QuickTouch\HPKBDAPP.exe
O4 - HKLM\..\Run: [UCam_Menu] "C:\Program Files\CyberLink\YouCam\MUITransfer\MUIStartMenu.exe" "C:\Program Files\CyberLink\YouCam" update "Software\CyberLink\YouCam\1.0"
O4 - HKLM\..\Run: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide
O4 - HKLM\..\Run: [HP Health Check Scheduler] [ProgramFilesFolder]Hewlett-Packard\HP Health Check\HPHC_Scheduler.exe
O4 - HKLM\..\Run: [hpWirelessAssistant] C:\Program Files\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe
O4 - HKLM\..\Run: [WAWifiMessage] C:\Program Files\Hewlett-Packard\HP Wireless Assistant\WiFiMsg.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe"
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\Hp\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [IntelliPoint] "C:\Program Files\Microsoft IntelliPoint\ipoint.exe"
O4 - HKCU\..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun
O4 - HKCU\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [LightScribe Control Panel] C:\Program Files\Common Files\LightScribe\LightScribeControlPanel.exe -hidden
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'Paikallinen palvelu')
O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'Paikallinen palvelu')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'Verkkopalvelu')
O4 - Global Startup: Bluetooth.lnk = ?
O8 - Extra context menu item: Lähetä kuva &Bluetooth-laitteeseen... - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm
O8 - Extra context menu item: Lähetä sivu &Bluetooth-laitteeseen... - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
O8 - Extra context menu item: Vie Microsoft E&xceliin - res://C:\PROGRA~1\MICROS~3\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O9 - Extra button: Oheistiedot - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\OFFICE11\REFIEBAR.DLL
O9 - Extra button: @btrez.dll,-4015 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
O9 - Extra 'Tools' menuitem: @btrez.dll,-12650 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
O13 - Gopher Prefix:
O23 - Service: Autodesk Licensing Service - Autodesk - C:\Program Files\Common Files\Autodesk Shared\Service\AdskScSrv.exe
O23 - Service: Com4Qlb - Hewlett-Packard Development Company, L.P. - C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\Com4Qlb.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: HP Health Check Service - Hewlett-Packard - c:\Program Files\Hewlett-Packard\HP Health Check\hphc_service.exe
O23 - Service: hpqwmiex - Hewlett-Packard Development Company, L.P. - C:\Program Files\Hewlett-Packard\Shared\hpqWmiEx.exe
O23 - Service: Intel(R) Matrix Storage Event Monitor (IAANTMON) - Intel Corporation - C:\Program Files\Intel\Intel Matrix Storage Manager\IAANTMon.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe
O23 - Service: QuickPlay Background Capture Service (QBCS) (QPCapSvc) - Unknown owner - C:\Program Files\HP\QuickPlay\Kernel\TV\QPCapSvc.exe
O23 - Service: QuickPlay Task Scheduler (QTS) (QPSched) - Unknown owner - C:\Program Files\HP\QuickPlay\Kernel\TV\QPSched.exe
O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - C:\Program Files\CyberLink\Shared Files\RichVideo.exe

--
End of file - 8819 bytes

 

scannaa hjt:llä merkkaa paina Fix checked

R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
O2 - BHO: NCO 2.0 IE BHO - {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} - (no file)
O2 - BHO: Symantec Intrusion Prevention - {6D53EC84-6AAE-4787-AEEE-F4628F01010C} - C:\PROGRA~1\COMMON~1\SYMANT~1\IDS\IPSBHO.dll (file missing)
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O3 - Toolbar: (no name) - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - (no file)
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe"
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\Hp\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"

===========

sammuta käynnistä

===========

Lataa Malwarebytes' Anti-Malware työpöydällesi.

1. Tuplaklikkaa mbam-setup.exe ja seuraa ohjeita asentaaksesi ohjelman.
2. Lopuksi varmistu, että seuraavat on valittu: Update Malwarebytes', Anti-Malwareja
Launch Malwarebytes' Anti-Malware ja sen jälkeen klikkaaFinish.
3. Jos päivitys löytyy. ohjelma lataa ja asentaa uusimman version.
4. Kun ohjelma on latautunut, valitse Perform full scan ja klikkaa Scan.
5. Kun skanni on valmis, klikkaa OK ja sitten Show Results nähdäksesi tulokset.
6. Varmistu, että kaikki on merkitty ja klikkaa Remove Selected.
7. Tämän jälkeen loki avautuu muistioon. Tallenna se paikkaan, josta löydät sen helposti. Loki
löytyy myös täältä: C:\Documents and Settings\Käyttäjänimi\Application
Data\Malwarebytes\Malwarebytes' Anti-Malware\Logs\log-päiväys.txt
8. Lähetä lokin sisältö seuraavassa viestissäsi

 

Moi. Sain noi hjt-tiedostot fixattua toisella yrittämisellä, mutta malwarea en saanut ajettua. Windowsin puolella ohjelma kerkis pyöriä n. 2min ja jumiin. Vikasietotilassa sain ajettua malwarea 27 min ja sit jumiin. Näyttää tarkistavan parhaillaan D:\boot\protect.german

Tarkistettuja kohteita 139338
Saastuneita 0

Olisko hyviä ehdotuksia? Tekis mieli formatoida koko kone, mutta omistaja ei oo tehny mitään tarvittavia palautuslevyjä. Formatoinnin sivussa menis myös winukka eikä siihen tullu koneen mukana asennuslevyä.

 

1.Lataa Combofix.exe työpöydällesi yhdestä linkistä:
Combofix1
Combofix2

Älä asenna palautus consolia
2. Tuplaklikkaa Combofix.exe tiedostoa ja seuraa ohjeistuksia.
3. Kun työkalu on valmis, se tuottaa lokin. Lähetä tämä loki viesti ketjuusi.
Huom! Älä klikkaile combofixin ikkunaa käytön aikana. Tämä saattaa aiheuttaa ohjelman jumiutumisen.

 

Voinko ajaa tuon combon vikasietotilassa? Näyttää taas jumiutuvan osioon 7 windowsissa.

 

Voit sen siellä ajaa

 

ComboFix 09-02-08.02 - Kai 2009-02-10 11:24:50.2 - NTFSx86 MINIMAL
Microsoft® Windows Vista™ Home Premium 6.0.6000.0.1252.1.1035.18.2038.1684 [GMT 2:00]
Sijainti: c:\users\Kai\Desktop\ComboFix.exe
AV: AVG Anti-Virus Free *On-access scanning enabled* (Outdated)
.

(((((((((((((((((((((((((((((((((((((( Muut poistot ))))))))))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\windows\system32\KBL.LOG
c:\windows\system32\x64

.
((((( Tiedostot, jotka on luotu seuraavalla aikavälillä: 2009-01-10 to 2009-02-10 )))))))))))))))))
.

2009-02-10 10:57 . 2009-02-10 10:57 <KANSIO> d-------- C:\ComboFix(0)
2009-02-10 09:07 . 2009-02-10 09:07 <KANSIO> d-------- c:\users\Kai\AppData\Roaming\Malwarebytes
2009-02-10 09:07 . 2009-01-14 16:11 38,496 --a------ c:\windows\System32\drivers\mbamswissarmy.sys
2009-02-10 09:07 . 2009-01-14 16:11 15,504 --a------ c:\windows\System32\drivers\mbam.sys
2009-02-10 09:06 . 2009-02-10 09:06 <KANSIO> d-------- c:\users\All Users\Malwarebytes
2009-02-10 09:06 . 2009-02-10 09:06 <KANSIO> d-------- c:\programdata\Malwarebytes
2009-02-10 09:06 . 2009-02-10 09:07 <KANSIO> d-------- c:\program files\Malwarebytes' Anti-Malware
2009-02-09 20:29 . 2009-02-10 21:06 <KANSIO> d-------- c:\windows\System32\drivers\Avg
2009-02-09 20:29 . 2009-02-10 21:06 <KANSIO> d-------- c:\users\All Users\avg8
2009-02-09 20:29 . 2009-02-10 21:06 <KANSIO> d-------- c:\programdata\avg8
2009-02-09 20:29 . 2009-02-09 20:29 <KANSIO> d-------- c:\program files\AVG
2009-02-09 20:29 . 2009-02-09 20:29 325,128 --a------ c:\windows\System32\drivers\avgldx86.sys
2009-02-09 20:29 . 2009-02-09 20:29 107,272 --a------ c:\windows\System32\drivers\avgtdix.sys
2009-02-09 20:29 . 2009-02-09 20:29 10,520 --a------ c:\windows\System32\avgrsstx.dll
2009-02-09 19:58 . 2009-02-09 19:58 <KANSIO> d-------- c:\program files\Trend Micro
2009-02-09 17:35 . 2009-02-09 17:35 <KANSIO> d-------- C:\Kaspersky
2009-02-09 17:25 . 2009-02-09 17:25 <KANSIO> d-------- C:\Bases
2009-02-09 17:24 . 2009-02-09 17:24 <KANSIO> d-------- C:\Downloads

.
(((((((((((((((((((((((((((((((((((( Find3M-raportti ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-02-09 16:57 --------- d-----w c:\program files\Common Files\Symantec Shared
2009-02-09 16:40 --------- dcsh--w c:\program files\Common Files\WindowsLiveInstaller
2009-02-09 16:40 --------- d-----w c:\program files\Microsoft Works
2009-02-09 16:40 --------- d-----w c:\program files\Google
2009-02-09 16:40 --------- d-----w c:\program files\Common Files\Adobe
2009-02-09 15:42 --------- d-----w c:\program files\Common Files\Autodesk Shared
2009-02-09 15:42 --------- d-----w c:\program files\AutoCAD Architecture 2009
2008-12-28 09:33 --------- d-----w c:\users\Kai\AppData\Roaming\Autodesk
2008-12-28 09:33 --------- d-----w c:\programdata\Autodesk
2007-11-28 03:09 174 --sha-w c:\program files\desktop.ini
2008-05-14 21:50 16,384 --sha-w c:\windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat
2008-05-14 21:50 32,768 --sha-w c:\windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat
2008-05-14 21:50 16,384 --sha-w c:\windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Cookies\index.dat
.

(((((((((((((((((((((((((((((( Rekisterin käynnistyskohteet )))))))))))))))))))))))))))))))))))))))))))))
.
.
*Huom* Tyhjiä arvoja ja laillisia oletusarvoja ei näytetä
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Sidebar"="c:\program files\Windows Sidebar\sidebar.exe" [2008-05-15 1232896]
"MsnMsgr"="c:\program files\Windows Live\Messenger\MsnMsgr.Exe" [2007-10-18 5724184]
"WindowsWelcomeCenter"="oobefldr.dll" [2006-11-02 c:\windows\System32\oobefldr.dll]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2007-09-19 141848]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2007-09-19 154136]
"Persistence"="c:\windows\system32\igfxpers.exe" [2007-09-19 129560]
"SynTPStart"="c:\program files\Synaptics\SynTP\SynTPStart.exe" [2007-09-15 102400]
"SMSERIAL"="c:\program files\Motorola\SMSERIAL\sm56hlpr.exe" [2007-01-17 634880]
"IAAnotif"="c:\program files\Intel\Intel Matrix Storage Manager\iaanotif.exe" [2007-07-25 174616]
"QPService"="c:\program files\HP\QuickPlay\QPService.exe" [2007-10-01 181544]
"QlbCtrl"="c:\program files\Hewlett-Packard\HP Quick Launch Buttons\QlbCtrl.exe" [2007-09-19 202032]
"OnScreenDisplay"="c:\program files\Hewlett-Packard\HP QuickTouch\HPKBDAPP.exe" [2007-09-04 554320]
"UCam_Menu"="c:\program files\CyberLink\YouCam\MUITransfer\MUIStartMenu.exe" [2007-08-17 218408]
"hpWirelessAssistant"="c:\program files\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe" [2007-09-13 480560]
"WAWifiMessage"="c:\program files\Hewlett-Packard\HP Wireless Assistant\WiFiMsg.exe" [2007-01-09 311296]
"SunJavaUpdateSched"="c:\program files\Java\jre1.6.0_02\bin\jusched.exe" [2007-07-12 132496]
"HP Software Update"="c:\program files\Hp\HP Software Update\HPWuSchd2.exe" [2005-02-16 49152]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2007-05-11 40048]
"IntelliPoint"="c:\program files\Microsoft IntelliPoint\ipoint.exe" [2007-05-19 849288]
"AVG8_TRAY"="c:\progra~1\AVG\AVG8\avgtray.exe" [2009-02-09 1601304]
"RtHDVCpl"="RtHDVCpl.exe" [2007-08-17 c:\windows\RtHDVCpl.exe]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce]
"GrpConv"="grpconv -o" [X]

c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
Bluetooth.lnk - c:\program files\WIDCOMM\Bluetooth Software\BTTray.exe [2007-09-05 727592]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"AppInit_DLLs"=avgrsstx.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"msacm.l3codecp"= l3codecp.acm

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"UacDisableNotify"=dword:00000001
"InternetSettingsDisableNotify"=dword:00000001
"AutoUpdateDisableNotify"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\DomainProfile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\FirewallRules]
"{AB811D15-C610-48A4-9697-6B7F0F613395}"= c:\program files\Cyberlink\PowerDirector\PDR.EXE:CyberLink PowerDirector
"{8AE1D2F2-2BE4-4F94-B404-A5B5E76A7271}"= c:\program files\HP\QuickPlay\QP.exe:Quick Play
"{87758C38-1E0A-46B1-BEA0-BDB0907F7764}"= c:\program files\HP\QuickPlay\QPService.exe:Quick Play Resident Program
"{A02BBAA5-088A-42ED-B5D4-C5B59EF8CE66}"= c:\program files\Windows Live\Messenger\livecall.exe:Windows Live Messenger (Phone)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\PublicProfile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\RestrictedServices\Static\System]
"DFSR-1"= RPort=5722|UDP:%SystemRoot%\system32\svchost.exe|Svc=DFSR:Allow inbound TCP traffic|

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\StandardProfile]
"EnableFirewall"= 0 (0x0)

S1 AvgLdx86;AVG Free AVI Loader Driver x86;c:\windows\System32\drivers\avgldx86.sys [2009-02-09 325128]
S1 AvgTdiX;AVG Free8 Network Redirector;c:\windows\System32\drivers\avgtdix.sys [2009-02-09 107272]
S2 avg8wd;AVG Free8 WatchDog;c:\progra~1\AVG\AVG8\avgwdsvc.exe [2009-02-09 298264]
S3 MBAMSwissArmy;MBAMSwissArmy;c:\windows\System32\drivers\mbamswissarmy.sys [2009-02-10 38496]

--- Muut muistissa olevat ajurit/palvelut ---

*NewlyCreated* - ECACHE

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
bthsvcs REG_MULTI_SZ BthServ

[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{10880D85-AAD9-4558-ABDC-2AB1552D831F}]
"c:\program files\Common Files\LightScribe\LSRunOnce.exe"
.
'Ajoitetut tehtävät'-kansion sisältö

2008-05-14 c:\windows\Tasks\HPCeeScheduleForKai.job
- c:\program files\Hewlett-Packard\SDP\Ceement\HPCEE.exe [2007-09-28 21:58]

2009-02-09 c:\windows\Tasks\Norton Internet Security - Suorita täysi järjestelmäntarkistus - Kai.job
- c:\program files\Norton Internet Security\Norton AntiVirus\Navw32.exe []
.
- - - - POISTETUT JÄMÄRIVIT - - - -

HKLM-Run-HP Health Check Scheduler - [ProgramFilesFolder]Hewlett-Packard\HP Health Check\HPHC_Scheduler.exe
HKLM-RunOnce-<NO NAME> - (no file)


.
------- Täydentävä tarkistus -------
.
uStart Page = hxxp://www.elisa.fi/yksityisille/
mStart Page = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=fi_fi&c=81&bd=Pavilion&pf=laptop
IE: Lähetä kuva &Bluetooth-laitteeseen... - c:\program files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm
IE: Lähetä sivu &Bluetooth-laitteeseen... - c:\program files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
IE: Vie Microsoft E&xceliin - c:\progra~1\MICROS~3\OFFICE11\EXCEL.EXE/3000
.

**************************************************************************

catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-02-10 11:28:25
Windows 6.0.6000 NTFS

tarkistaa piilotettuja prosesseja ...

tarkistaa piilotettuja käynnistysarvoja ...

tarkistaa piilotettuja tiedostoja ...

tarkistus on valmis
piilotetut tiedostot: 0

**************************************************************************
.
Valmistumisajankohta: 2009-02-10 11:30:26
ComboFix-quarantined-files.txt 2009-02-10 09:30:24

Ennen ajoa: 99,160,518,656 tavua vapaana
Ajon jälkeen: 99,246,424,064 tavua vapaana

150 --- E O F --- 2008-05-20 15:33:49

 

Otas

Luo poistolista:
• Avaa HiJackThis
• Klikkaa "Configure" valintaa oikealla alhaalla
• Klikkaa "Misc Tools"
• Klikkaa boxia joka sanoo "Uninstall Manager"
• Klikkaa valintaa "Save list"
• Kopioi ja liitä kyseinen lista muistiosta ketjuusi

===========

scannaa uusi hjt:n loki

 

Tässä savelist

2007 Office Systemin yhteensopivuuspaketti
Adobe Flash Player ActiveX
Adobe Reader 8.1.0 - Suomi
Adobe Shockwave Player
AutoCAD Architecture 2009
Autodesk Design Review 2009
AVG Free 8.0
CyberLink YouCam
DVD Suite
ESU for Microsoft Vista
Google Earth
Google Toolbar for Internet Explorer
Google Toolbar for Internet Explorer
Hauppauge MCE XP/Vista Software Encoder (2.0.25149)
Hewlett-Packard Active Check
Hewlett-Packard Asset Agent for Health Check
HijackThis 2.0.2
HP Customer Experience Enhancements
HP Doc Viewer
HP Easy Setup - Frontend
HP Help and Support
HP Integrated Module with Bluetooth wireless technology 6.0.1.5500
HP Quick Launch Buttons 6.30 E1
HP QuickPlay 3.6
HP QuickTouch 1.00 C4
HP Update
HP User Guides 0087
HP Wireless Assistant
Intel(R) Graphics Media Accelerator Driver
Intel® Matrix Storage Manager
Java(TM) 6 Update 2
LabelPrint
Malwarebytes' Anti-Malware
Microsoft Office PowerPoint Viewer 2007 (Finnish)
Microsoft Office Standard Edition 2003
Microsoft Silverlight
Microsoft Visual C++ 2005 Redistributable
Microsoft Works
Motorola SM56 Data Fax Modem
MSCU for Microsoft Vista
MSXML 4.0 SP2 (KB936181)
MSXML 4.0 SP2 (KB941833)
Power2Go
PowerDirector
QuickPlay SlingPlayer 0.4.4
Realtek 8169 PCI, 8168 and 8101E PCIe Ethernet Network Card Driver for Windows Vista
Realtek High Definition Audio Driver
RICOH R5C83x/84x Flash Media Controller Driver Ver.3.51.01
Synaptics Pointing Device Driver
Windows Live installer
Windows Live Messenger
Windows Liven kirjautumisavustaja


Ja tässä HJT

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 12:50:52, on 10.2.2009
Platform: Windows Vista (WinNT 6.00.1904)
MSIE: Internet Explorer v7.00 (7.00.6000.16643)
Boot mode: Normal

Running processes:
C:\Windows\system32\taskeng.exe
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Windows\System32\igfxtray.exe
C:\Windows\System32\hkcmd.exe
C:\Windows\System32\igfxpers.exe
C:\Program Files\Synaptics\SynTP\SynTPStart.exe
C:\Program Files\Motorola\SMSERIAL\sm56hlpr.exe
C:\Windows\RtHDVCpl.exe
C:\Program Files\Intel\Intel Matrix Storage Manager\IAAnotif.exe
C:\Windows\system32\igfxsrvc.exe
C:\Program Files\HP\QuickPlay\QPService.exe
C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\QLBCTRL.exe
C:\Program Files\Hewlett-Packard\HP QuickTouch\HPKBDAPP.exe
C:\Program Files\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe
C:\Program Files\Hewlett-Packard\HP Wireless Assistant\WiFiMsg.exe
C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe
C:\Program Files\HP\HP Software Update\hpwuSchd2.exe
C:\Program Files\Adobe\Reader 8.0\Reader\reader_sl.exe
C:\Program Files\Microsoft IntelliPoint\ipoint.exe
C:\Program Files\Windows Sidebar\sidebar.exe
C:\Program Files\Windows Live\Messenger\msnmsgr.exe
C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Program Files\Hewlett-Packard\Shared\HpqToaster.exe
C:\Windows\system32\SearchFilterHost.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.elisa.fi/yksityisille/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=fi_fi&c=81&bd=Pavilion&pf=laptop
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O1 - Hosts: ::1 localhost
O2 - BHO: Adobe PDF Reader -linkkiavustaja - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG8\avgssie.dll
O2 - BHO: NCO 2.0 IE BHO - {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} - (no file)
O2 - BHO: Symantec Intrusion Prevention - {6D53EC84-6AAE-4787-AEEE-F4628F01010C} - C:\PROGRA~1\COMMON~1\SYMANT~1\IDS\IPSBHO.dll (file missing)
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Windows Liven kirjautumisapuohjelma - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
O3 - Toolbar: (no name) - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - (no file)
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O4 - HKLM\..\Run: [IgfxTray] C:\Windows\system32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\Windows\system32\hkcmd.exe
O4 - HKLM\..\Run: [Persistence] C:\Windows\system32\igfxpers.exe
O4 - HKLM\..\Run: [SynTPStart] C:\Program Files\Synaptics\SynTP\SynTPStart.exe
O4 - HKLM\..\Run: [SMSERIAL] C:\Program Files\Motorola\SMSERIAL\sm56hlpr.exe
O4 - HKLM\..\Run: [RtHDVCpl] RtHDVCpl.exe
O4 - HKLM\..\Run: [IAAnotif] C:\Program Files\Intel\Intel Matrix Storage Manager\iaanotif.exe
O4 - HKLM\..\Run: [QPService] "C:\Program Files\HP\QuickPlay\QPService.exe"
O4 - HKLM\..\Run: [QlbCtrl] %ProgramFiles%\Hewlett-Packard\HP Quick Launch Buttons\QlbCtrl.exe /Start
O4 - HKLM\..\Run: [OnScreenDisplay] C:\Program Files\Hewlett-Packard\HP QuickTouch\HPKBDAPP.exe
O4 - HKLM\..\Run: [UCam_Menu] "C:\Program Files\CyberLink\YouCam\MUITransfer\MUIStartMenu.exe" "C:\Program Files\CyberLink\YouCam" update "Software\CyberLink\YouCam\1.0"
O4 - HKLM\..\Run: [hpWirelessAssistant] C:\Program Files\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe
O4 - HKLM\..\Run: [WAWifiMessage] C:\Program Files\Hewlett-Packard\HP Wireless Assistant\WiFiMsg.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe"
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\Hp\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [IntelliPoint] "C:\Program Files\Microsoft IntelliPoint\ipoint.exe"
O4 - HKLM\..\Run: [AVG8_TRAY] C:\PROGRA~1\AVG\AVG8\avgtray.exe
O4 - HKCU\..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun
O4 - HKCU\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background
O4 - Global Startup: Bluetooth.lnk = ?
O8 - Extra context menu item: Lähetä kuva &Bluetooth-laitteeseen... - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm
O8 - Extra context menu item: Lähetä sivu &Bluetooth-laitteeseen... - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
O8 - Extra context menu item: Vie Microsoft E&xceliin - res://C:\PROGRA~1\MICROS~3\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O9 - Extra button: Oheistiedot - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\OFFICE11\REFIEBAR.DLL
O9 - Extra button: @btrez.dll,-4015 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
O9 - Extra 'Tools' menuitem: @btrez.dll,-12650 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
O13 - Gopher Prefix:
O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG8\avgpp.dll
O20 - AppInit_DLLs: avgrsstx.dll
O23 - Service: Autodesk Licensing Service - Autodesk - C:\Program Files\Common Files\Autodesk Shared\Service\AdskScSrv.exe
O23 - Service: AVG Free8 WatchDog (avg8wd) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
O23 - Service: Com4Qlb - Hewlett-Packard Development Company, L.P. - C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\Com4Qlb.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: HP Health Check Service - Hewlett-Packard - c:\Program Files\Hewlett-Packard\HP Health Check\hphc_service.exe
O23 - Service: hpqwmiex - Hewlett-Packard Development Company, L.P. - C:\Program Files\Hewlett-Packard\Shared\hpqWmiEx.exe
O23 - Service: Intel(R) Matrix Storage Event Monitor (IAANTMON) - Intel Corporation - C:\Program Files\Intel\Intel Matrix Storage Manager\IAANTMon.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe
O23 - Service: QuickPlay Background Capture Service (QBCS) (QPCapSvc) - Unknown owner - C:\Program Files\HP\QuickPlay\Kernel\TV\QPCapSvc.exe
O23 - Service: QuickPlay Task Scheduler (QTS) (QPSched) - Unknown owner - C:\Program Files\HP\QuickPlay\Kernel\TV\QPSched.exe
O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - C:\Program Files\CyberLink\Shared Files\RichVideo.exe

--
End of file - 8151 bytes

 

Nyt tuon alla olevan lainauksen sisällön Kopioit / liität Tyhjään muistioon
käynnistä nappi >apuohjelmat > muistio

Tallenna se nimellä CFScript.txt työpöydälle

Sitten raahaa CFScript ComboFix.exeen kuten alla.



Laita tuleva loki tänne.

Sammutat ja käynnistät koneen

==============

Lataa JavaRa ja pura se työpöydällesi.

***Sulje kaikki päällä olevat Internet Explorerin ikkunat ennen jatkamista!***

* Tuplaklikkaa JavaRa.exeä käynnistääksesi ohjelma.
* Valitse English pudotusvalikosta valitaksesi kieleksi englannin ja klikkaa Select.
* Klikkaa Remove Older Versions poistaaksesi vanhat Java-versiot koneeltasi.
* Klikkaa Yes kun pyydetään. Kun JavaRa on valmis, se ilmoittaa, että lokitiedosto on luotu. Klikkaa OK.
* Lokitiedosto avautuu. Lähetä sen sisältö seuraavassa viestissäsi.
4. Asenna uusin Java päivitys seuraavasta linkistä..

Lataa täältä uusi java

Rullaa alas kohteeseen Java Runtime Environment (JRE) 6 Update 12
Paina Download
Laita Platform -kohtaan Windows
Ruksaa I agree to the Java SE Runtime Environment 6 License Agreement ja paina Continue
Paina Windows Offline Installationin alapuolella jre-6u4-windows-i586-p.exe

Tallenna tiedosto vaikka työpöydälle ja asenna se.

5. Käynnistä kone uudelleen asennuksen jälkeen.
6. Käynnistyksen jälkeen, mene takaisin Ohjauspaneeliin ja avaa Java asetuksesi (Muita Ohjauspaneelin asetuksia -> Java kahvikuppi).
7. General-välilehdellä klikkaa Settings. Vedä liukusäädintä (Disk Space) pienemmälle.

(Jotkut javapohjaiset ohjelmat saattavat tarvita enemmän levytilaa.
Jos huomaat säädön pienentämisen jälkeen koneessa hitautta, siirrä liukusäädintä isommalle).

8. Klikkaa Delete Files -nappia. Varmista että kaikki kaksi valintaa ovat rastitettuja:
* Applications and Applets
* Trace and Log Files

Ja paina OK -nappia
Huomaa: Tämä poistaa kaikki ladatut sovellukset ja appletit VÄLIMUISTISTA.

9. Klikkaa OK "Temporary Files Settings" -ikkunassasi.
10. Välilehti Update: ota ruksi pois kohdasta Check for Updates automatically
Valitse Never check
11. Klikkaa Apply ja OK jättääksesi Java asetusikkunasi.

=============

Nuo ei ole lähteneet pois. Fixsaa hjt:llä pois
noiten rivien eteen pikkusta neliöö klikaten tulee väkänen sitten kun alla olevat on merkitty paina Fix checked

O2 - BHO: NCO 2.0 IE BHO - {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} - (no file)
O2 - BHO: Symantec Intrusion Prevention - {6D53EC84-6AAE-4787-AEEE-F4628F01010C} - C:\PROGRA~1\COMMON~1\SYMANT~1\IDS\IPSBHO.dll (file missing)
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O3 - Toolbar: (no name) - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - (no file)
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe"
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\Hp\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"

Täytyy olla järjestelmän valvojan oikeudet

 

Tässä tämä combo logi: Javan sain poistettua, mutta mitään raporttia ei tulostunut/ tallentunut mihinkään. Koitan nyt vielä asentaa uuden javan vikasietotilassa, ku tossa Windowsissa peliaikaa on n.2min. Vikasietotilassa välillä voi häärätä jopa 20 min.

ComboFix 09-02-08.02 - Kai 2009-02-10 13:27:52.3 - NTFSx86 MINIMAL
Microsoft® Windows Vista™ Home Premium 6.0.6000.0.1252.1.1035.18.2038.1668 [GMT 2:00]
Sijainti: c:\users\Kai\Desktop\ComboFix.exe
Käytetyt komentorivivalitsimet :: c:\users\Kai\Desktop\CFScript.txt
AV: AVG Anti-Virus Free *On-access scanning enabled* (Outdated)
.

(((((((((((((((((((((((((((((((((((((( Muut poistot ))))))))))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\Bases
c:\bases\base161c.avc
c:\bases\base162.avc
c:\bases\base162c.avc
c:\bases\base163.avc
c:\bases\base163c.avc
c:\bases\base164.avc
c:\bases\base164c.avc
c:\bases\base165.avc
c:\bases\base165c.avc
c:\bases\base166.avc
c:\bases\base166c.avc
c:\bases\base167.avc
c:\bases\base167c.avc
c:\bases\base168c.avc
c:\bases\base169c.avc
c:\bases\base170c.avc
c:\bases\base171c.avc
c:\bases\base172c.avc
c:\bases\base173c.avc
c:\bases\base174c.avc
c:\bases\base175c.avc
c:\bases\base176c.avc
c:\bases\base177c.avc
c:\bases\base178c.avc
c:\bases\base179c.avc
c:\bases\base180c.avc
c:\bases\base181c.avc
c:\bases\base182c.avc
c:\bases\base183c.avc
c:\bases\base184c.avc
c:\bases\base185c.avc
c:\bases\base186c.avc
c:\bases\base187c.avc
c:\bases\base188c.avc
c:\bases\base189c.avc
c:\bases\base190c.avc
c:\bases\base191c.avc
c:\bases\base192c.avc
c:\bases\base193c.avc
c:\bases\base194c.avc
c:\bases\base195c.avc
c:\bases\base196c.avc
c:\bases\base197c.avc
c:\bases\base198c.avc
c:\bases\base199c.avc
c:\bases\base200c.avc
c:\bases\base201c.avc
c:\bases\base202c.avc
c:\bases\base203c.avc
c:\bases\base204c.avc
c:\bases\base205c.avc
c:\bases\base206c.avc
c:\bases\base207c.avc
c:\bases\base208c.avc
c:\bases\base209c.avc
c:\bases\base210c.avc
c:\bases\base211c.avc
c:\bases\base212c.avc
c:\bases\base213c.avc
c:\bases\base214c.avc
c:\bases\base215c.avc
c:\bases\base216c.avc
c:\bases\base217c.avc
c:\bases\base218c.avc
c:\bases\base219c.avc
c:\bases\base220c.avc
c:\bases\base221c.avc
c:\bases\base222c.avc
c:\bases\base223c.avc
c:\bases\base224c.avc
c:\bases\base225c.avc
c:\bases\base226c.avc
c:\bases\base227c.avc
c:\bases\base228c.avc
c:\bases\base229c.avc
c:\bases\base230c.avc
c:\bases\base231c.avc
c:\bases\base232c.avc
c:\bases\base233c.avc
c:\bases\base234c.avc
c:\bases\base235c.avc
c:\bases\base236c.avc
c:\bases\base237c.avc
c:\bases\base238c.avc
c:\bases\base239c.avc
c:\bases\base240c.avc
c:\bases\base241c.avc
c:\bases\base242c.avc
c:\bases\base243c.avc
c:\bases\base244c.avc
c:\bases\base245c.avc
c:\bases\base246c.avc
c:\bases\base247c.avc
c:\bases\base248c.avc
c:\bases\base249c.avc
c:\bases\base250c.avc
c:\bases\base251c.avc
c:\bases\base252c.avc
c:\bases\base253c.avc
c:\bases\base254c.avc
c:\bases\base255c.avc
c:\bases\base256c.avc
c:\bases\base257c.avc
c:\bases\base258c.avc
c:\bases\base259c.avc
c:\bases\base260c.avc
c:\bases\base261c.avc
c:\bases\base262c.avc
c:\bases\base263c.avc
c:\bases\base264c.avc
c:\bases\base265c.avc
c:\bases\base266c.avc
c:\bases\base267c.avc
c:\bases\base268c.avc
c:\bases\base269c.avc
c:\bases\base270c.avc
c:\bases\base271c.avc
c:\bases\base272c.avc
c:\bases\base273c.avc
c:\bases\base274c.avc
c:\bases\base275c.avc
c:\bases\base276c.avc
c:\bases\base277c.avc
c:\bases\base278c.avc
c:\bases\base279c.avc
c:\bases\base280c.avc
c:\bases\base281c.avc
c:\bases\base282c.avc
c:\bases\base283c.avc
c:\bases\base284c.avc
c:\bases\base285c.avc
c:\bases\base286c.avc
c:\bases\base287c.avc
c:\bases\base288c.avc
c:\bases\base289c.avc
c:\bases\base290c.avc
c:\bases\base291c.avc
c:\bases\base292c.avc
c:\bases\base293c.avc
c:\bases\base294c.avc
c:\bases\base295c.avc
c:\bases\base296c.avc
c:\bases\base297c.avc
c:\bases\base298c.avc
c:\bases\base299c.avc
c:\bases\base300c.avc
c:\bases\base301c.avc
c:\bases\base302c.avc
c:\bases\base303c.avc
c:\bases\base304c.avc
c:\bases\base305c.avc
c:\bases\base306c.avc
c:\bases\base307c.avc
c:\bases\base308c.avc
c:\bases\base309c.avc
c:\bases\base310c.avc
c:\bases\base311c.avc
c:\bases\base312c.avc
c:\bases\base313c.avc
c:\bases\base314c.avc
c:\bases\base315c.avc
c:\bases\base316c.avc
c:\bases\base317c.avc
c:\bases\base318c.avc
c:\bases\base319c.avc
c:\bases\base320c.avc
c:\bases\base321c.avc
c:\bases\base322c.avc
c:\bases\base323c.avc
c:\bases\base324c.avc
c:\bases\base325c.avc
c:\bases\base326c.avc
c:\bases\base327c.avc
c:\bases\base328c.avc
c:\bases\base329c.avc
c:\bases\base330c.avc
c:\bases\base331c.avc
c:\bases\base332c.avc
c:\bases\base333c.avc
c:\bases\base334c.avc
c:\bases\base335c.avc
c:\bases\base336c.avc
c:\bases\base337c.avc
c:\bases\base338c.avc
c:\bases\base339c.avc
c:\bases\base340c.avc
c:\bases\base341c.avc
c:\bases\base342c.avc
c:\bases\base343c.avc
c:\bases\base344c.avc
c:\bases\base345c.avc
c:\bases\base346c.avc
c:\bases\base347c.avc
c:\bases\base348c.avc
c:\bases\base349c.avc
c:\bases\base350c.avc
c:\bases\base351c.avc
c:\bases\base352c.avc
c:\bases\base353c.avc
c:\bases\base354c.avc
c:\bases\base355c.avc
c:\bases\base356c.avc
c:\bases\base357c.avc
c:\bases\base358c.avc
c:\bases\base359c.avc
c:\bases\base360c.avc
c:\bases\base361c.avc
c:\bases\base362c.avc
c:\bases\base363c.avc
c:\bases\base364c.avc
c:\bases\base365c.avc
c:\bases\base366c.avc
c:\bases\base367c.avc
c:\bases\base368c.avc
c:\bases\base369c.avc
c:\bases\base370c.avc
c:\bases\base371c.avc
c:\bases\base372c.avc
c:\bases\base373c.avc
c:\bases\base374c.avc
c:\bases\base375c.avc
c:\bases\base376c.avc
c:\bases\base377c.avc
c:\bases\base378c.avc
c:\bases\base379c.avc
c:\bases\base380c.avc
c:\bases\base381c.avc
c:\bases\base382c.avc
c:\bases\base383c.avc
c:\bases\base384c.avc
c:\bases\base385c.avc
c:\bases\base386c.avc
c:\bases\base387c.avc
c:\bases\base388c.avc
c:\bases\base389c.avc
c:\bases\base390c.avc
c:\bases\base391c.avc
c:\bases\base392c.avc
c:\bases\base393c.avc
c:\bases\base394c.avc
c:\bases\base395c.avc
c:\bases\base396c.avc
c:\bases\base397c.avc
c:\bases\base398c.avc
c:\bases\base399c.avc
c:\bases\base400c.avc
c:\bases\base401c.avc
c:\bases\base402c.avc
c:\bases\base403c.avc
c:\bases\base404c.avc
c:\bases\base405c.avc
c:\bases\base406c.avc
c:\bases\base407c.avc
c:\bases\base408c.avc
c:\bases\base409c.avc
c:\bases\base410c.avc
c:\bases\base411c.avc
c:\bases\base412c.avc
c:\bases\base413c.avc
c:\bases\base414c.avc
c:\bases\base415c.avc
c:\bases\base416c.avc
c:\bases\base417c.avc
c:\bases\base418c.avc
c:\bases\base419c.avc
c:\bases\base420c.avc
c:\bases\base421c.avc
c:\bases\base422c.avc
c:\bases\base423c.avc
c:\bases\base424c.avc
c:\bases\base425c.avc
c:\bases\base426c.avc
c:\bases\base427c.avc
c:\bases\base428c.avc
c:\bases\base429c.avc
c:\bases\base430c.avc
c:\bases\base431c.avc
c:\bases\base432c.avc
c:\bases\base433c.avc
c:\bases\base434c.avc
c:\bases\base435c.avc
c:\bases\base436c.avc
c:\bases\base437c.avc
c:\bases\base438c.avc
c:\bases\base439c.avc
c:\bases\base440c.avc
c:\bases\base441c.avc
c:\bases\base442c.avc
c:\bases\base443c.avc
c:\bases\base444c.avc
c:\bases\base445c.avc
c:\bases\base446c.avc
c:\bases\base447c.avc
c:\bases\base448c.avc
c:\bases\base449c.avc
c:\bases\base450c.avc
c:\bases\base451c.avc
c:\bases\base452c.avc
c:\bases\base453c.avc
c:\bases\base454c.avc
c:\bases\base455c.avc
c:\bases\base456c.avc
c:\bases\base457c.avc
c:\bases\base458c.avc
c:\bases\base459c.avc
c:\bases\base460c.avc
c:\bases\base461c.avc
c:\bases\base462c.avc
c:\bases\base463c.avc
c:\bases\base464c.avc
c:\bases\base465c.avc
c:\bases\base466c.avc
c:\bases\base467c.avc
c:\bases\base468c.avc
c:\bases\base469c.avc
c:\bases\base470c.avc
c:\bases\base471c.avc
c:\bases\base472c.avc
c:\bases\base473c.avc
c:\bases\base474c.avc
c:\bases\base475c.avc
c:\bases\base476c.avc
c:\bases\base477c.avc
c:\bases\base478c.avc
c:\bases\base479c.avc
c:\bases\base480c.avc
c:\bases\base481c.avc
c:\bases\base482c.avc
c:\bases\base483c.avc
c:\bases\base484c.avc
c:\bases\base485c.avc
c:\bases\base486c.avc
c:\bases\base487c.avc
c:\bases\base488c.avc
c:\bases\base489c.avc
c:\bases\base490c.avc
c:\bases\base491c.avc
c:\bases\base492c.avc
c:\bases\base493c.avc
c:\bases\base494c.avc
c:\bases\base495c.avc
c:\bases\base496c.avc
c:\bases\base497c.avc
c:\bases\base498c.avc
c:\bases\base499c.avc
c:\bases\base500c.avc
c:\bases\base501c.avc
c:\bases\base502c.avc
c:\bases\base503c.avc
c:\bases\base504c.avc
c:\bases\base505c.avc
c:\bases\base506c.avc
c:\bases\base507c.avc
c:\bases\base508c.avc
c:\bases\base509c.avc
c:\bases\base510c.avc
c:\bases\base511c.avc
c:\bases\base512c.avc
c:\bases\base513c.avc
c:\bases\base514c.avc
c:\bases\base515c.avc
c:\bases\base516c.avc
c:\bases\base517c.avc
c:\bases\base518c.avc
c:\bases\base519c.avc
c:\bases\base520c.avc
c:\bases\base521c.avc
c:\bases\base522c.avc
c:\bases\base523c.avc
c:\bases\base524c.avc
c:\bases\base525c.avc
c:\bases\base526c.avc
c:\bases\base527c.avc
c:\bases\base528c.avc
c:\bases\base529c.avc
c:\bases\base530c.avc
c:\bases\base531c.avc
c:\bases\base532c.avc
c:\bases\base533c.avc
c:\bases\base534c.avc
c:\bases\base535c.avc
c:\bases\base536c.avc
c:\bases\base537c.avc
c:\bases\base538c.avc
c:\bases\base539c.avc
c:\bases\base540c.avc
c:\bases\base541c.avc
c:\bases\base542c.avc
c:\bases\base543c.avc
c:\bases\base544c.avc
c:\bases\base545c.avc
c:\bases\base546c.avc
c:\bases\base547c.avc
c:\bases\base548c.avc
c:\bases\base549c.avc
c:\bases\base550c.avc
c:\bases\base551c.avc
c:\bases\base552c.avc
c:\bases\base553c.avc
c:\bases\base554c.avc
c:\bases\base555c.avc
c:\bases\base556c.avc
c:\bases\base557c.avc
c:\bases\base558c.avc
c:\bases\base559c.avc
c:\bases\base560c.avc
c:\bases\base561c.avc
c:\bases\base562c.avc
c:\bases\base563c.avc
c:\bases\base564c.avc
c:\bases\base565c.avc
c:\bases\base566c.avc
c:\bases\base567c.avc
c:\bases\base568c.avc
c:\bases\base569c.avc
c:\bases\base570c.avc
c:\bases\base571c.avc
c:\bases\base572c.avc
c:\bases\base573c.avc
c:\bases\base574c.avc
c:\bases\base575c.avc
c:\bases\base576c.avc
c:\bases\base577c.avc
c:\bases\base578c.avc
c:\bases\base579c.avc
c:\bases\base580c.avc
c:\bases\base581c.avc
c:\bases\base582c.avc
c:\bases\base583c.avc
c:\bases\base584c.avc
c:\bases\base585c.avc
c:\bases\base586c.avc
c:\bases\base587c.avc
c:\bases\base588c.avc
c:\bases\base589c.avc
c:\bases\base590c.avc
c:\bases\base591c.avc
c:\bases\base592c.avc
c:\bases\base593c.avc
c:\bases\base594c.avc
c:\bases\base595c.avc
c:\bases\base596c.avc
c:\bases\base597c.avc
c:\bases\base598c.avc
c:\bases\base599c.avc
c:\bases\base600c.avc
c:\bases\base601c.avc
c:\bases\base602c.avc
c:\bases\base603c.avc
c:\bases\base604c.avc
c:\bases\base605c.avc
c:\bases\base606c.avc
c:\bases\base607c.avc
c:\bases\base608c.avc
c:\bases\base609c.avc
c:\bases\base610c.avc
c:\bases\base611c.avc
c:\bases\base612c.avc
c:\bases\base613c.avc
c:\bases\base999.avc
c:\bases\ca001.avc
c:\bases\ca002.avc
c:\bases\ca003.avc
c:\bases\chuka.avc
c:\bases\daily-ec.avc
c:\bases\daily-ex.avc
c:\bases\daily.avc
c:\bases\dailyc.avc
c:\bases\eicar.avc
c:\bases\ext001.avc
c:\bases\ext001c.avc
c:\bases\ext002.avc
c:\bases\ext002c.avc
c:\bases\ext003.avc
c:\bases\ext003c.avc
c:\bases\ext004.avc
c:\bases\ext004c.avc
c:\bases\ext005.avc
c:\bases\ext005c.avc
c:\bases\ext006.avc
c:\bases\ext006c.avc
c:\bases\ext007.avc
c:\bases\ext007c.avc
c:\bases\ext008.avc
c:\bases\ext008c.avc
c:\bases\ext009.avc
c:\bases\ext009c.avc
c:\bases\ext010c.avc
c:\bases\ext011c.avc
c:\bases\ext012c.avc
c:\bases\ext013c.avc
c:\bases\ext014c.avc
c:\bases\ext015c.avc
c:\bases\ext016c.avc
c:\bases\ext017c.avc
c:\bases\ext018c.avc
c:\bases\ext019c.avc
c:\bases\ext020c.avc
c:\bases\ext021c.avc
c:\bases\ext022c.avc
c:\bases\ext023c.avc
c:\bases\ext024c.avc
c:\bases\ext025c.avc
c:\bases\ext026c.avc
c:\bases\ext027c.avc
c:\bases\ext028c.avc
c:\bases\ext029c.avc
c:\bases\ext030c.avc
c:\bases\ext031c.avc
c:\bases\ext032c.avc
c:\bases\ext033c.avc
c:\bases\ext034c.avc
c:\bases\ext035c.avc
c:\bases\ext036c.avc
c:\bases\ext037c.avc
c:\bases\ext038c.avc
c:\bases\ext039c.avc
c:\bases\ext040c.avc
c:\bases\ext041c.avc
c:\bases\ext042c.avc
c:\bases\ext043c.avc
c:\bases\ext044c.avc
c:\bases\ext045c.avc
c:\bases\ext046c.avc
c:\bases\ext047c.avc
c:\bases\ext048c.avc
c:\bases\ext049c.avc
c:\bases\ext050c.avc
c:\bases\ext051c.avc
c:\bases\ext052c.avc
c:\bases\ext053c.avc
c:\bases\ext054c.avc
c:\bases\ext055c.avc
c:\bases\ext056c.avc
c:\bases\ext057c.avc
c:\bases\ext058c.avc
c:\bases\ext059c.avc
c:\bases\ext060c.avc
c:\bases\ext061c.avc
c:\bases\ext062c.avc
c:\bases\ext063c.avc
c:\bases\ext064c.avc
c:\bases\ext065c.avc
c:\bases\ext066c.avc
c:\bases\ext067c.avc
c:\bases\ext068c.avc
c:\bases\ext069c.avc
c:\bases\ext070c.avc
c:\bases\ext071c.avc
c:\bases\ext072c.avc
c:\bases\ext073c.avc
c:\bases\ext074c.avc
c:\bases\ext075c.avc
c:\bases\ext076c.avc
c:\bases\ext077c.avc
c:\bases\ext078c.avc
c:\bases\ext999.avc
c:\bases\fa.avc
c:\bases\fa001.avc
c:\bases\gen001.avc
c:\bases\gen002.avc
c:\bases\gen003.avc
c:\bases\gen004.avc
c:\bases\gen005.avc
c:\bases\gen999.avc
c:\bases\kernel.avc
c:\bases\krn001.avc
c:\bases\krn002.avc
c:\bases\krn003.avc
c:\bases\krn004.avc
c:\bases\krn005.avc
c:\bases\krndos.avc
c:\bases\krnengn.avc
c:\bases\krnexe.avc
c:\bases\krnexe32.avc
c:\bases\krngen.avc
c:\bases\krnjava.avc
c:\bases\krnmacro.avc
c:\bases\krnun001.avc
c:\bases\krnun002.avc
c:\bases\krnun003.avc
c:\bases\krnun004.avc
c:\bases\mail.avc
c:\bases\ocr.avc
c:\bases\smart.avc
c:\bases\unp000.avc
c:\bases\unp001.avc
c:\bases\unp002.avc
c:\bases\unp003.avc
c:\bases\unp004.avc
c:\bases\unp005.avc
c:\bases\unp006.avc
c:\bases\unp007.avc
c:\bases\unp008.avc
c:\bases\unp009.avc
c:\bases\unp010.avc
c:\bases\unp011.avc
c:\bases\unp012.avc
c:\bases\unp013.avc
c:\bases\unp014.avc
c:\bases\unp015.avc
c:\bases\unp016.avc
c:\bases\unp017.avc
c:\bases\unp018.avc
c:\bases\unp019.avc
c:\bases\unp020.avc
c:\bases\unp021.avc
c:\bases\unp022.avc
c:\bases\unp023.avc
c:\bases\unp024.avc
c:\bases\unp025.avc
c:\bases\unp026.avc
c:\bases\unp027.avc
c:\bases\unp028.avc
c:\bases\unp029.avc
c:\bases\unp030.avc
c:\bases\unp031.avc
c:\bases\unp032.avc
c:\bases\unp033.avc
c:\bases\unp034.avc
c:\bases\unp035.avc
c:\bases\unp036.avc
c:\bases\unp037.avc
c:\bases\unp038.avc
c:\bases\unp039.avc
c:\bases\unp040.avc
c:\bases\unp041.avc
c:\bases\unp042.avc
C:\Kaspersky
c:\kaspersky\0004960D.key
c:\kaspersky\0005DA77.key
c:\kaspersky\0006C9D5.key
c:\kaspersky\00184596.key
c:\kaspersky\00184597.key
c:\kaspersky\01FA0F93.key
c:\kaspersky\101_45095.klc
c:\kaspersky\102_4060.klc
c:\kaspersky\102_45097.klc
c:\kaspersky\125_45027.klc
c:\kaspersky\7_45097.klc
c:\kaspersky\advware.avc
c:\kaspersky\avp.klb
c:\kaspersky\avp.set
c:\kaspersky\avp.vnd
c:\kaspersky\avp0406.avc
c:\kaspersky\backdoor.avc
c:\kaspersky\base001.avc
c:\kaspersky\base001c.avc
c:\kaspersky\base002.avc
c:\kaspersky\base002c.avc
c:\kaspersky\base003.avc
c:\kaspersky\base003c.avc
c:\kaspersky\base004.avc
c:\kaspersky\base004c.avc
c:\kaspersky\base005.avc
c:\kaspersky\base005c.avc
c:\kaspersky\base006.avc
c:\kaspersky\base006c.avc
c:\kaspersky\base007.avc
c:\kaspersky\base007c.avc
c:\kaspersky\base008.avc
c:\kaspersky\base008c.avc
c:\kaspersky\base009.avc
c:\kaspersky\base009c.avc
c:\kaspersky\base010.avc
c:\kaspersky\base010c.avc
c:\kaspersky\base011.avc
c:\kaspersky\base011c.avc
c:\kaspersky\base012.avc
c:\kaspersky\base012c.avc
c:\kaspersky\base013.avc
c:\kaspersky\base013c.avc
c:\kaspersky\base014.avc
c:\kaspersky\base014c.avc
c:\kaspersky\base015.avc
c:\kaspersky\base015c.avc
c:\kaspersky\base016.avc
c:\kaspersky\base016c.avc
c:\kaspersky\base017.avc
c:\kaspersky\base017c.avc
c:\kaspersky\base018.avc
c:\kaspersky\base018c.avc
c:\kaspersky\base019.avc
c:\kaspersky\base019c.avc
c:\kaspersky\base020.avc
c:\kaspersky\base020c.avc
c:\kaspersky\base021.avc
c:\kaspersky\base021c.avc
c:\kaspersky\base022.avc
c:\kaspersky\base022c.avc
c:\kaspersky\base023.avc
c:\kaspersky\base023c.avc
c:\kaspersky\base024.avc
c:\kaspersky\base024c.avc
c:\kaspersky\base025.avc
c:\kaspersky\base025c.avc
c:\kaspersky\base026.avc
c:\kaspersky\base026c.avc
c:\kaspersky\base027.avc
c:\kaspersky\base027c.avc
c:\kaspersky\base028.avc
c:\kaspersky\base028c.avc
c:\kaspersky\base029.avc
c:\kaspersky\base029c.avc
c:\kaspersky\base030.avc
c:\kaspersky\base030c.avc
c:\kaspersky\base031.avc
c:\kaspersky\base031c.avc
c:\kaspersky\base032.avc
c:\kaspersky\base032c.avc
c:\kaspersky\base033.avc
c:\kaspersky\base033c.avc
c:\kaspersky\base034.avc
c:\kaspersky\base034c.avc
c:\kaspersky\base035.avc
c:\kaspersky\base035c.avc
c:\kaspersky\base036.avc
c:\kaspersky\base036c.avc
c:\kaspersky\base037.avc
c:\kaspersky\base037c.avc
c:\kaspersky\base038.avc
c:\kaspersky\base038c.avc
c:\kaspersky\base039.avc
c:\kaspersky\base039c.avc
c:\kaspersky\base040.avc
c:\kaspersky\base040c.avc
c:\kaspersky\base041.avc
c:\kaspersky\base041c.avc
c:\kaspersky\base042.avc
c:\kaspersky\base042c.avc
c:\kaspersky\base043.avc
c:\kaspersky\base043c.avc
c:\kaspersky\base044.avc
c:\kaspersky\base044c.avc
c:\kaspersky\base045.avc
c:\kaspersky\base045c.avc
c:\kaspersky\base046.avc
c:\kaspersky\base046c.avc
c:\kaspersky\base047.avc
c:\kaspersky\base047c.avc
c:\kaspersky\base048.avc
c:\kaspersky\base048c.avc
c:\kaspersky\base049.avc
c:\kaspersky\base049c.avc
c:\kaspersky\base050.avc
c:\kaspersky\base050c.avc
c:\kaspersky\base051.avc
c:\kaspersky\base051c.avc
c:\kaspersky\base052.avc
c:\kaspersky\base052c.avc
c:\kaspersky\base053.avc
c:\kaspersky\base053c.avc
c:\kaspersky\base054.avc
c:\kaspersky\base054c.avc
c:\kaspersky\base055.avc
c:\kaspersky\base055c.avc
c:\kaspersky\base056.avc
c:\kaspersky\base056c.avc
c:\kaspersky\base057.avc
c:\kaspersky\base057c.avc
c:\kaspersky\base058.avc
c:\kaspersky\base058c.avc
c:\kaspersky\base059.avc
c:\kaspersky\base059c.avc
c:\kaspersky\base060.avc
c:\kaspersky\base060c.avc
c:\kaspersky\base061.avc
c:\kaspersky\base061c.avc
c:\kaspersky\base062.avc
c:\kaspersky\base062c.avc
c:\kaspersky\base063.avc
c:\kaspersky\base063c.avc
c:\kaspersky\base064.avc
c:\kaspersky\base064c.avc
c:\kaspersky\base065.avc
c:\kaspersky\base065c.avc
c:\kaspersky\base066.avc
c:\kaspersky\base066c.avc
c:\kaspersky\base067.avc
c:\kaspersky\base067c.avc
c:\kaspersky\base068.avc
c:\kaspersky\base068c.avc
c:\kaspersky\base069.avc
c:\kaspersky\base069c.avc
c:\kaspersky\base070.avc
c:\kaspersky\base070c.avc
c:\kaspersky\base071.avc
c:\kaspersky\base071c.avc
c:\kaspersky\base072.avc
c:\kaspersky\base072c.avc
c:\kaspersky\base073.avc
c:\kaspersky\base073c.avc
c:\kaspersky\base074.avc
c:\kaspersky\base074c.avc
c:\kaspersky\base075.avc
c:\kaspersky\base075c.avc
c:\kaspersky\base076.avc
c:\kaspersky\base076c.avc
c:\kaspersky\base077.avc
c:\kaspersky\base077c.avc
c:\kaspersky\base078.avc
c:\kaspersky\base078c.avc
c:\kaspersky\base079.avc
c:\kaspersky\base079c.avc
c:\kaspersky\base080.avc
c:\kaspersky\base080c.avc
c:\kaspersky\base081.avc
c:\kaspersky\base081c.avc
c:\kaspersky\base082.avc
c:\kaspersky\base082c.avc
c:\kaspersky\base083.avc
c:\kaspersky\base083c.avc
c:\kaspersky\base084.avc
c:\kaspersky\base084c.avc
c:\kaspersky\base085.avc
c:\kaspersky\base085c.avc
c:\kaspersky\base086.avc
c:\kaspersky\base086c.avc
c:\kaspersky\base087.avc
c:\kaspersky\base087c.avc
c:\kaspersky\base088.avc
c:\kaspersky\base088c.avc
c:\kaspersky\base089.avc
c:\kaspersky\base089c.avc
c:\kaspersky\base090.avc
c:\kaspersky\base090c.avc
c:\kaspersky\base091.avc
c:\kaspersky\base091c.avc
c:\kaspersky\base092.avc
c:\kaspersky\base092c.avc
c:\kaspersky\base093.avc
c:\kaspersky\base093c.avc
c:\kaspersky\base094.avc
c:\kaspersky\base094c.avc
c:\kaspersky\base095.avc
c:\kaspersky\base095c.avc
c:\kaspersky\base096.avc
c:\kaspersky\base096c.avc
c:\kaspersky\base097.avc
c:\kaspersky\base097c.avc
c:\kaspersky\base098.avc
c:\kaspersky\base098c.avc
c:\kaspersky\base099.avc
c:\kaspersky\base099c.avc
c:\kaspersky\base100.avc
c:\kaspersky\base100c.avc
c:\kaspersky\base101.avc
c:\kaspersky\base101c.avc
c:\kaspersky\base102.avc
c:\kaspersky\base102c.avc
c:\kaspersky\base103.avc
c:\kaspersky\base103c.avc
c:\kaspersky\base104.avc
c:\kaspersky\base104c.avc
c:\kaspersky\base105.avc
c:\kaspersky\base105c.avc
c:\kaspersky\base106.avc
c:\kaspersky\base106c.avc
c:\kaspersky\base107.avc
c:\kaspersky\base107c.avc
c:\kaspersky\base108.avc
c:\kaspersky\base108c.avc
c:\kaspersky\base109.avc
c:\kaspersky\base109c.avc
c:\kaspersky\base110.avc
c:\kaspersky\base110c.avc
c:\kaspersky\base111.avc
c:\kaspersky\base111c.avc
c:\kaspersky\base112.avc
c:\kaspersky\base112c.avc
c:\kaspersky\base113.avc
c:\kaspersky\base113c.avc
c:\kaspersky\base114.avc
c:\kaspersky\base114c.avc
c:\kaspersky\base115.avc
c:\kaspersky\base115c.avc
c:\kaspersky\base116.avc
c:\kaspersky\base116c.avc
c:\kaspersky\base117.avc
c:\kaspersky\base117c.avc
c:\kaspersky\base118.avc
c:\kaspersky\base118c.avc
c:\kaspersky\base119.avc
c:\kaspersky\base119c.avc
c:\kaspersky\base120.avc
c:\kaspersky\base120c.avc
c:\kaspersky\base121.avc
c:\kaspersky\base121c.avc
c:\kaspersky\base122.avc
c:\kaspersky\base122c.avc
c:\kaspersky\base123.avc
c:\kaspersky\base123c.avc
c:\kaspersky\base124.avc
c:\kaspersky\base124c.avc
c:\kaspersky\base125.avc
c:\kaspersky\base125c.avc
c:\kaspersky\base126.avc
c:\kaspersky\base126c.avc
c:\kaspersky\base127.avc
c:\kaspersky\base127c.avc
c:\kaspersky\base128.avc
c:\kaspersky\base128c.avc
c:\kaspersky\base129.avc
c:\kaspersky\base129c.avc
c:\kaspersky\base130.avc
c:\kaspersky\base130c.avc
c:\kaspersky\base131.avc
c:\kaspersky\base131c.avc
c:\kaspersky\base132.avc
c:\kaspersky\base132c.avc
c:\kaspersky\base133.avc
c:\kaspersky\base133c.avc
c:\kaspersky\base134.avc
c:\kaspersky\base134c.avc
c:\kaspersky\base135.avc
c:\kaspersky\base135c.avc
c:\kaspersky\base136.avc
c:\kaspersky\base136c.avc
c:\kaspersky\base137.avc
c:\kaspersky\base137c.avc
c:\kaspersky\base138.avc
c:\kaspersky\base138c.avc
c:\kaspersky\base139.avc
c:\kaspersky\base139c.avc
c:\kaspersky\base140.avc
c:\kaspersky\base140c.avc
c:\kaspersky\base141.avc
c:\kaspersky\base141c.avc
c:\kaspersky\base142.avc
c:\kaspersky\base142c.avc
c:\kaspersky\base143.avc
c:\kaspersky\base143c.avc
c:\kaspersky\base144.avc
c:\kaspersky\base144c.avc
c:\kaspersky\base145.avc
c:\kaspersky\base145c.avc
c:\kaspersky\base146.avc
c:\kaspersky\base146c.avc
c:\kaspersky\base147.avc
c:\kaspersky\base147c.avc
c:\kaspersky\base148.avc
c:\kaspersky\base148c.avc
c:\kaspersky\base149.avc
c:\kaspersky\base149c.avc
c:\kaspersky\base150.avc
c:\kaspersky\base150c.avc
c:\kaspersky\base151.avc
c:\kaspersky\base151c.avc
c:\kaspersky\base152.avc
c:\kaspersky\base152c.avc
c:\kaspersky\base153.avc
c:\kaspersky\base153c.avc
c:\kaspersky\base154.avc
c:\kaspersky\base154c.avc
c:\kaspersky\base155.avc
c:\kaspersky\base155c.avc
c:\kaspersky\base156.avc
c:\kaspersky\base156c.avc
c:\kaspersky\base157.avc
c:\kaspersky\base157c.avc
c:\kaspersky\base158.avc
c:\kaspersky\base158c.avc
c:\kaspersky\base159.avc
c:\kaspersky\base159c.avc
c:\kaspersky\base160.avc
c:\kaspersky\base160c.avc
c:\kaspersky\base161.avc
c:\kaspersky\base161c.avc
c:\kaspersky\base162.avc
c:\kaspersky\base162c.avc
c:\kaspersky\base163.avc
c:\kaspersky\base163c.avc
c:\kaspersky\base164.avc
c:\kaspersky\base164c.avc
c:\kaspersky\base165.avc
c:\kaspersky\base165c.avc
c:\kaspersky\base166.avc
c:\kaspersky\base166c.avc
c:\kaspersky\base167.avc
c:\kaspersky\base167c.avc
c:\kaspersky\base168c.avc
c:\kaspersky\base169c.avc
c:\kaspersky\base170c.avc
c:\kaspersky\base171c.avc
c:\kaspersky\base172c.avc
c:\kaspersky\base173c.avc
c:\kaspersky\base174c.avc
c:\kaspersky\base175c.avc
c:\kaspersky\base176c.avc
c:\kaspersky\base177c.avc
c:\kaspersky\base178c.avc
c:\kaspersky\base179c.avc
c:\kaspersky\base180c.avc
c:\kaspersky\base181c.avc
c:\kaspersky\base182c.avc
c:\kaspersky\base183c.avc
c:\kaspersky\base184c.avc
c:\kaspersky\base185c.avc
c:\kaspersky\base186c.avc
c:\kaspersky\base187c.avc
c:\kaspersky\base188c.avc
c:\kaspersky\base189c.avc
c:\kaspersky\base190c.avc
c:\kaspersky\base191c.avc
c:\kaspersky\base192c.avc
c:\kaspersky\base193c.avc
c:\kaspersky\base194c.avc
c:\kaspersky\base195c.avc
c:\kaspersky\base196c.avc
c:\kaspersky\base197c.avc
c:\kaspersky\base198c.avc
c:\kaspersky\base199c.avc
c:\kaspersky\base200c.avc
c:\kaspersky\base201c.avc
c:\kaspersky\base202c.avc
c:\kaspersky\base203c.avc
c:\kaspersky\base204c.avc
c:\kaspersky\base205c.avc
c:\kaspersky\base206c.avc
c:\kaspersky\base207c.avc
c:\kaspersky\base208c.avc
c:\kaspersky\base209c.avc
c:\kaspersky\base210c.avc
c:\kaspersky\base211c.avc
c:\kaspersky\base212c.avc
c:\kaspersky\base213c.avc
c:\kaspersky\base214c.avc
c:\kaspersky\base215c.avc
c:\kaspersky\base216c.avc
c:\kaspersky\base217c.avc
c:\kaspersky\base218c.avc
c:\kaspersky\base219c.avc
c:\kaspersky\base220c.avc
c:\kaspersky\base221c.avc
c:\kaspersky\base222c.avc
c:\kaspersky\base223c.avc
c:\kaspersky\base224c.avc
c:\kaspersky\base225c.avc
c:\kaspersky\base226c.avc
c:\kaspersky\base227c.avc
c:\kaspersky\base228c.avc
c:\kaspersky\base229c.avc
c:\kaspersky\base230c.avc
c:\kaspersky\base231c.avc
c:\kaspersky\base232c.avc
c:\kaspersky\base233c.avc
c:\kaspersky\base234c.avc
c:\kaspersky\base235c.avc
c:\kaspersky\base236c.avc
c:\kaspersky\base237c.avc
c:\kaspersky\base238c.avc
c:\kaspersky\base239c.avc
c:\kaspersky\base240c.avc
c:\kaspersky\base241c.avc
c:\kaspersky\base242c.avc
c:\kaspersky\base243c.avc
c:\kaspersky\base244c.avc
c:\kaspersky\base245c.avc
c:\kaspersky\base246c.avc
c:\kaspersky\base247c.avc
c:\kaspersky\base248c.avc
c:\kaspersky\base249c.avc
c:\kaspersky\base250c.avc
c:\kaspersky\base251c.avc
c:\kaspersky\base252c.avc
c:\kaspersky\base253c.avc
c:\kaspersky\base254c.avc
c:\kaspersky\base255c.avc
c:\kaspersky\base256c.avc
c:\kaspersky\base257c.avc
c:\kaspersky\base258c.avc
c:\kaspersky\base259c.avc
c:\kaspersky\base260c.avc
c:\kaspersky\base261c.avc
c:\kaspersky\base262c.avc
c:\kaspersky\base263c.avc
c:\kaspersky\base264c.avc
c:\kaspersky\base265c.avc
c:\kaspersky\base266c.avc
c:\kaspersky\base267c.avc
c:\kaspersky\base268c.avc
c:\kaspersky\base269c.avc
c:\kaspersky\base270c.avc
c:\kaspersky\base271c.avc
c:\kaspersky\base272c.avc
c:\kaspersky\base273c.avc
c:\kaspersky\base274c.avc
c:\kaspersky\base275c.avc
c:\kaspersky\base276c.avc
c:\kaspersky\base277c.avc
c:\kaspersky\base278c.avc
c:\kaspersky\base279c.avc
c:\kaspersky\base280c.avc
c:\kaspersky\base281c.avc
c:\kaspersky\base282c.avc
c:\kaspersky\base283c.avc
c:\kaspersky\base284c.avc
c:\kaspersky\base285c.avc
c:\kaspersky\base286c.avc
c:\kaspersky\base287c.avc
c:\kaspersky\base288c.avc
c:\kaspersky\base289c.avc
c:\kaspersky\base290c.avc
c:\kaspersky\base291c.avc
c:\kaspersky\base292c.avc
c:\kaspersky\base293c.avc
c:\kaspersky\base294c.avc
c:\kaspersky\base295c.avc
c:\kaspersky\base296c.avc
c:\kaspersky\base297c.avc
c:\kaspersky\base298c.avc
c:\kaspersky\base299c.avc
c:\kaspersky\base300c.avc
c:\kaspersky\base301c.avc
c:\kaspersky\base302c.avc
c:\kaspersky\base303c.avc
c:\kaspersky\base304c.avc
c:\kaspersky\base305c.avc
c:\kaspersky\base306c.avc
c:\kaspersky\base307c.avc
c:\kaspersky\base308c.avc
c:\kaspersky\base309c.avc
c:\kaspersky\base310c.avc
c:\kaspersky\base311c.avc
c:\kaspersky\base312c.avc
c:\kaspersky\base313c.avc
c:\kaspersky\base314c.avc
c:\kaspersky\base315c.avc
c:\kaspersky\base316c.avc
c:\kaspersky\base317c.avc
c:\kaspersky\base318c.avc
c:\kaspersky\base319c.avc
c:\kaspersky\base320c.avc
c:\kaspersky\base321c.avc
c:\kaspersky\base322c.avc
c:\kaspersky\base323c.avc
c:\kaspersky\base324c.avc
c:\kaspersky\base325c.avc
c:\kaspersky\base326c.avc
c:\kaspersky\base327c.avc
c:\kaspersky\base328c.avc
c:\kaspersky\base329c.avc
c:\kaspersky\base330c.avc
c:\kaspersky\base331c.avc
c:\kaspersky\base332c.avc
c:\kaspersky\base333c.avc
c:\kaspersky\base334c.avc
c:\kaspersky\base335c.avc
c:\kaspersky\base336c.avc
c:\kaspersky\base337c.avc
c:\kaspersky\base338c.avc
c:\kaspersky\base339c.avc
c:\kaspersky\base340c.avc
c:\kaspersky\base341c.avc
c:\kaspersky\base342c.avc
c:\kaspersky\base343c.avc
c:\kaspersky\base344c.avc
c:\kaspersky\base345c.avc
c:\kaspersky\base346c.avc
c:\kaspersky\base347c.avc
c:\kaspersky\base348c.avc
c:\kaspersky\base349c.avc
c:\kaspersky\base350c.avc
c:\kaspersky\base351c.avc
c:\kaspersky\base352c.avc
c:\kaspersky\base353c.avc
c:\kaspersky\base354c.avc
c:\kaspersky\base355c.avc
c:\kaspersky\base356c.avc
c:\kaspersky\base357c.avc
c:\kaspersky\base358c.avc
c:\kaspersky\base359c.avc
c:\kaspersky\base360c.avc
c:\kaspersky\base361c.avc
c:\kaspersky\base362c.avc
c:\kaspersky\base363c.avc
c:\kaspersky\base364c.avc
c:\kaspersky\base365c.avc
c:\kaspersky\base366c.avc
c:\kaspersky\base367c.avc
c:\kaspersky\base368c.avc
c:\kaspersky\base369c.avc
c:\kaspersky\base370c.avc
c:\kaspersky\base371c.avc
c:\kaspersky\base372c.avc
c:\kaspersky\base373c.avc
c:\kaspersky\base374c.avc
c:\kaspersky\base375c.avc
c:\kaspersky\base376c.avc
c:\kaspersky\base377c.avc
c:\kaspersky\base378c.avc
c:\kaspersky\base379c.avc
c:\kaspersky\base380c.avc
c:\kaspersky\base381c.avc
c:\kaspersky\base382c.avc
c:\kaspersky\base383c.avc
c:\kaspersky\base384c.avc
c:\kaspersky\base385c.avc
c:\kaspersky\base386c.avc
c:\kaspersky\base387c.avc
c:\kaspersky\base388c.avc
c:\kaspersky\base389c.avc
c:\kaspersky\base390c.avc
c:\kaspersky\base391c.avc
c:\kaspersky\base392c.avc
c:\kaspersky\base393c.avc
c:\kaspersky\base394c.avc
c:\kaspersky\base395c.avc
c:\kaspersky\base396c.avc
c:\kaspersky\base397c.avc
c:\kaspersky\base398c.avc
c:\kaspersky\base399c.avc
c:\kaspersky\base400c.avc
c:\kaspersky\base401c.avc
c:\kaspersky\base402c.avc
c:\kaspersky\base403c.avc
c:\kaspersky\base404c.avc
c:\kaspersky\base405c.avc
c:\kaspersky\base406c.avc
c:\kaspersky\base407c.avc
c:\kaspersky\base408c.avc
c:\kaspersky\base409c.avc
c:\kaspersky\base410c.avc
c:\kaspersky\base411c.avc
c:\kaspersky\base412c.avc
c:\kaspersky\base413c.avc
c:\kaspersky\base414c.avc
c:\kaspersky\base415c.avc
c:\kaspersky\base416c.avc
c:\kaspersky\base417c.avc
c:\kaspersky\base418c.avc
c:\kaspersky\base419c.avc
c:\kaspersky\base420c.avc
c:\kaspersky\base421c.avc
c:\kaspersky\base422c.avc
c:\kaspersky\base423c.avc
c:\kaspersky\base424c.avc
c:\kaspersky\base425c.avc
c:\kaspersky\base426c.avc
c:\kaspersky\base427c.avc
c:\kaspersky\base428c.avc
c:\kaspersky\base429c.avc
c:\kaspersky\base430c.avc
c:\kaspersky\base431c.avc
c:\kaspersky\base432c.avc
c:\kaspersky\base433c.avc
c:\kaspersky\base434c.avc
c:\kaspersky\base435c.avc
c:\kaspersky\base436c.avc
c:\kaspersky\base437c.avc
c:\kaspersky\base438c.avc
c:\kaspersky\base439c.avc
c:\kaspersky\base440c.avc
c:\kaspersky\base441c.avc
c:\kaspersky\base442c.avc
c:\kaspersky\base443c.avc
c:\kaspersky\base444c.avc
c:\kaspersky\base445c.avc
c:\kaspersky\base446c.avc
c:\kaspersky\base447c.avc
c:\kaspersky\base448c.avc
c:\kaspersky\base449c.avc
c:\kaspersky\base450c.avc
c:\kaspersky\base451c.avc
c:\kaspersky\base452c.avc
c:\kaspersky\base453c.avc
c:\kaspersky\base454c.avc
c:\kaspersky\base455c.avc
c:\kaspersky\base456c.avc
c:\kaspersky\base457c.avc
c:\kaspersky\base458c.avc
c:\kaspersky\base459c.avc
c:\kaspersky\base460c.avc
c:\kaspersky\base461c.avc
c:\kaspersky\base462c.avc
c:\kaspersky\base463c.avc
c:\kaspersky\base464c.avc
c:\kaspersky\base465c.avc
c:\kaspersky\base466c.avc
c:\kaspersky\base467c.avc
c:\kaspersky\base468c.avc
c:\kaspersky\base469c.avc
c:\kaspersky\base470c.avc
c:\kaspersky\base471c.avc
c:\kaspersky\base472c.avc
c:\kaspersky\base473c.avc
c:\kaspersky\base474c.avc
c:\kaspersky\base475c.avc
c:\kaspersky\base476c.avc
c:\kaspersky\base477c.avc
c:\kaspersky\base478c.avc
c:\kaspersky\base479c.avc
c:\kaspersky\base480c.avc
c:\kaspersky\base481c.avc
c:\kaspersky\base482c.avc
c:\kaspersky\base483c.avc
c:\kaspersky\base484c.avc
c:\kaspersky\base485c.avc
c:\kaspersky\base486c.avc
c:\kaspersky\base487c.avc
c:\kaspersky\base488c.avc
c:\kaspersky\base489c.avc
c:\kaspersky\base490c.avc
c:\kaspersky\base491c.avc
c:\kaspersky\base492c.avc
c:\kaspersky\base493c.avc
c:\kaspersky\base494c.avc
c:\kaspersky\base495c.avc
c:\kaspersky\base496c.avc
c:\kaspersky\base497c.avc
c:\kaspersky\base498c.avc
c:\kaspersky\base499c.avc
c:\kaspersky\base500c.avc
c:\kaspersky\base501c.avc
c:\kaspersky\base502c.avc
c:\kaspersky\base503c.avc
c:\kaspersky\base504c.avc
c:\kaspersky\base505c.avc
c:\kaspersky\base506c.avc
c:\kaspersky\base507c.avc
c:\kaspersky\base508c.avc
c:\kaspersky\base509c.avc
c:\kaspersky\base510c.avc
c:\kaspersky\base511c.avc
c:\kaspersky\base512c.avc
c:\kaspersky\base513c.avc
c:\kaspersky\base514c.avc
c:\kaspersky\base515c.avc
c:\kaspersky\base516c.avc
c:\kaspersky\base517c.avc
c:\kaspersky\base518c.avc
c:\kaspersky\base519c.avc
c:\kaspersky\base520c.avc
c:\kaspersky\base521c.avc
c:\kaspersky\base522c.avc
c:\kaspersky\base523c.avc
c:\kaspersky\base524c.avc
c:\kaspersky\base525c.avc
c:\kaspersky\base526c.avc
c:\kaspersky\base527c.avc
c:\kaspersky\base528c.avc
c:\kaspersky\base529c.avc
c:\kaspersky\base530c.avc
c:\kaspersky\base531c.avc
c:\kaspersky\base532c.avc
c:\kaspersky\base533c.avc
c:\kaspersky\base534c.avc
c:\kaspersky\base535c.avc
c:\kaspersky\base536c.avc
c:\kaspersky\base537c.avc
c:\kaspersky\base538c.avc
c:\kaspersky\base539c.avc
c:\kaspersky\base540c.avc
c:\kaspersky\base541c.avc
c:\kaspersky\base542c.avc
c:\kaspersky\base543c.avc
c:\kaspersky\base544c.avc
c:\kaspersky\base545c.avc
c:\kaspersky\base546c.avc
c:\kaspersky\base547c.avc
c:\kaspersky\base548c.avc
c:\kaspersky\base549c.avc
c:\kaspersky\base550c.avc
c:\kaspersky\base551c.avc
c:\kaspersky\base552c.avc
c:\kaspersky\base553c.avc
c:\kaspersky\base554c.avc
c:\kaspersky\base555c.avc
c:\kaspersky\base556c.avc
c:\kaspersky\base557c.avc
c:\kaspersky\base558c.avc
c:\kaspersky\base559c.avc
c:\kaspersky\base560c.avc
c:\kaspersky\base561c.avc
c:\kaspersky\base562c.avc
c:\kaspersky\base563c.avc
c:\kaspersky\base564c.avc
c:\kaspersky\base565c.avc
c:\kaspersky\base566c.avc
c:\kaspersky\base567c.avc
c:\kaspersky\base568c.avc
c:\kaspersky\base569c.avc
c:\kaspersky\base570c.avc
c:\kaspersky\base571c.avc
c:\kaspersky\base572c.avc
c:\kaspersky\base573c.avc
c:\kaspersky\base574c.avc
c:\kaspersky\base575c.avc
c:\kaspersky\base576c.avc
c:\kaspersky\base577c.avc
c:\kaspersky\base578c.avc
c:\kaspersky\base579c.avc
c:\kaspersky\base580c.avc
c:\kaspersky\base581c.avc
c:\kaspersky\base582c.avc
c:\kaspersky\base583c.avc
c:\kaspersky\base584c.avc
c:\kaspersky\base585c.avc
c:\kaspersky\base586c.avc
c:\kaspersky\base587c.avc
c:\kaspersky\base588c.avc
c:\kaspersky\base589c.avc
c:\kaspersky\base590c.avc
c:\kaspersky\base591c.avc
c:\kaspersky\base592c.avc
c:\kaspersky\base593c.avc
c:\kaspersky\base594c.avc
c:\kaspersky\base595c.avc
c:\kaspersky\base596c.avc
c:\kaspersky\base597c.avc
c:\kaspersky\base598c.avc
c:\kaspersky\base599c.avc
c:\kaspersky\base600c.avc
c:\kaspersky\base601c.avc
c:\kaspersky\base602c.avc
c:\kaspersky\base603c.avc
c:\kaspersky\base604c.avc
c:\kaspersky\base605c.avc
c:\kaspersky\base606c.avc
c:\kaspersky\base607c.avc
c:\kaspersky\base608c.avc
c:\kaspersky\base609c.avc
c:\kaspersky\base610c.avc
c:\kaspersky\base611c.avc
c:\kaspersky\base612c.avc
c:\kaspersky\base613c.avc
c:\kaspersky\base999.avc
c:\kaspersky\bitmap1.bmp
c:\kaspersky\ca.avc
c:\kaspersky\ca001.avc
c:\kaspersky\ca002.avc
c:\kaspersky\ca003.avc
c:\kaspersky\chuka.avc
c:\kaspersky\config.lan
c:\kaspersky\daily-ec.avc
c:\kaspersky\daily-ex.avc
c:\kaspersky\daily.avc
c:\kaspersky\dailyc.avc
c:\kaspersky\eicar.avc
c:\kaspersky\ext001.avc
c:\kaspersky\ext001c.avc
c:\kaspersky\ext002.avc
c:\kaspersky\ext002c.avc
c:\kaspersky\ext003.avc
c:\kaspersky\ext003c.avc
c:\kaspersky\ext004.avc
c:\kaspersky\ext004c.avc
c:\kaspersky\ext005.avc
c:\kaspersky\ext005c.avc
c:\kaspersky\ext006.avc
c:\kaspersky\ext006c.avc
c:\kaspersky\ext007.avc
c:\kaspersky\ext007c.avc
c:\kaspersky\ext008.avc
c:\kaspersky\ext008c.avc
c:\kaspersky\ext009.avc
c:\kaspersky\ext009c.avc
c:\kaspersky\ext010c.avc
c:\kaspersky\ext011c.avc
c:\kaspersky\ext012c.avc
c:\kaspersky\ext013c.avc
c:\kaspersky\ext014c.avc
c:\kaspersky\ext015c.avc
c:\kaspersky\ext016c.avc
c:\kaspersky\ext017c.avc
c:\kaspersky\ext018c.avc
c:\kaspersky\ext019c.avc
c:\kaspersky\ext020c.avc
c:\kaspersky\ext021c.avc
c:\kaspersky\ext022c.avc
c:\kaspersky\ext023c.avc
c:\kaspersky\ext024c.avc
c:\kaspersky\ext025c.avc
c:\kaspersky\ext026c.avc
c:\kaspersky\ext027c.avc
c:\kaspersky\ext028c.avc
c:\kaspersky\ext029c.avc
c:\kaspersky\ext030c.avc
c:\kaspersky\ext031c.avc
c:\kaspersky\ext032c.avc
c:\kaspersky\ext033c.avc
c:\kaspersky\ext034c.avc
c:\kaspersky\ext035c.avc
c:\kaspersky\ext036c.avc
c:\kaspersky\ext037c.avc
c:\kaspersky\ext038c.avc
c:\kaspersky\ext039c.avc
c:\kaspersky\ext040c.avc
c:\kaspersky\ext041c.avc
c:\kaspersky\ext042c.avc
c:\kaspersky\ext043c.avc
c:\kaspersky\ext044c.avc
c:\kaspersky\ext045c.avc
c:\kaspersky\ext046c.avc
c:\kaspersky\ext047c.avc
c:\kaspersky\ext048c.avc
c:\kaspersky\ext049c.avc
c:\kaspersky\ext050c.avc
c:\kaspersky\ext051c.avc
c:\kaspersky\ext052c.avc
c:\kaspersky\ext053c.avc
c:\kaspersky\ext054c.avc
c:\kaspersky\ext055c.avc
c:\kaspersky\ext056c.avc
c:\kaspersky\ext057c.avc
c:\kaspersky\ext058c.avc
c:\kaspersky\ext059c.avc
c:\kaspersky\ext060c.avc
c:\kaspersky\ext061c.avc
c:\kaspersky\ext062c.avc
c:\kaspersky\ext063c.avc
c:\kaspersky\ext064c.avc
c:\kaspersky\ext065c.avc
c:\kaspersky\ext066c.avc
c:\kaspersky\ext067c.avc
c:\kaspersky\ext068c.avc
c:\kaspersky\ext069c.avc
c:\kaspersky\ext070c.avc
c:\kaspersky\ext071c.avc
c:\kaspersky\ext072c.avc
c:\kaspersky\ext073c.avc
c:\kaspersky\ext074c.avc
c:\kaspersky\ext075c.avc
c:\kaspersky\ext076c.avc
c:\kaspersky\ext077c.avc
c:\kaspersky\ext078c.avc
c:\kaspersky\ext999.avc
c:\kaspersky\extr-cab.avc
c:\kaspersky\extract.avc
c:\kaspersky\fa.avc
c:\kaspersky\fa001.avc
c:\kaspersky\gen001.avc
c:\kaspersky\gen002.avc
c:\kaspersky\gen003.avc
c:\kaspersky\gen004.avc
c:\kaspersky\gen005.avc
c:\kaspersky\gen999.avc
c:\kaspersky\generic.avc
c:\kaspersky\kernel.avc
c:\kaspersky\keyid.dat
c:\kaspersky\krn001.avc
c:\kaspersky\krn002.avc
c:\kaspersky\krn003.avc
c:\kaspersky\krn004.avc
c:\kaspersky\krn005.avc
c:\kaspersky\krndos.avc
c:\kaspersky\krnengn.avc
c:\kaspersky\krnexe.avc
c:\kaspersky\krnexe32.avc
c:\kaspersky\krngen.avc
c:\kaspersky\krnjava.avc
c:\kaspersky\krnmacro.avc
c:\kaspersky\krnun001.avc
c:\kaspersky\krnun002.avc
c:\kaspersky\krnun003.avc
c:\kaspersky\krnun004.avc
c:\kaspersky\krnunp.avc
c:\kaspersky\macro.avc
c:\kaspersky\mail.avc
c:\kaspersky\main.avi
c:\kaspersky\malware.avc
c:\kaspersky\MicroWorld Toolkit Utility.txt
c:\kaspersky\mwav.log
c:\kaspersky\mwXface.log
c:\kaspersky\newexe.avc
c:\kaspersky\newexeg.avc
c:\kaspersky\ocr.avc
c:\kaspersky\pornware.avc
c:\kaspersky\product.bmp
c:\kaspersky\riskware.avc
c:\kaspersky\script.avc
c:\kaspersky\smart.avc
c:\kaspersky\trojan.avc
c:\kaspersky\unp000.avc
c:\kaspersky\unp001.avc
c:\kaspersky\unp002.avc
c:\kaspersky\unp003.avc
c:\kaspersky\unp004.avc
c:\kaspersky\unp005.avc
c:\kaspersky\unp006.avc
c:\kaspersky\unp007.avc
c:\kaspersky\unp008.avc
c:\kaspersky\unp009.avc
c:\kaspersky\unp010.avc
c:\kaspersky\unp011.avc
c:\kaspersky\unp012.avc
c:\kaspersky\unp013.avc
c:\kaspersky\unp014.avc
c:\kaspersky\unp015.avc
c:\kaspersky\unp016.avc
c:\kaspersky\unp017.avc
c:\kaspersky\unp018.avc
c:\kaspersky\unp019.avc
c:\kaspersky\unp020.avc
c:\kaspersky\unp021.avc
c:\kaspersky\unp022.avc
c:\kaspersky\unp023.avc
c:\kaspersky\unp024.avc
c:\kaspersky\unp025.avc
c:\kaspersky\unp026.avc
c:\kaspersky\unp027.avc
c:\kaspersky\unp028.avc
c:\kaspersky\unp029.avc
c:\kaspersky\unp030.avc
c:\kaspersky\unp031.avc
c:\kaspersky\unp032.avc
c:\kaspersky\unp033.avc
c:\kaspersky\unp034.avc
c:\kaspersky\unp035.avc
c:\kaspersky\unp036.avc
c:\kaspersky\unp037.avc
c:\kaspersky\unp038.avc
c:\kaspersky\unp039.avc
c:\kaspersky\unp040.avc
c:\kaspersky\unp041.avc
c:\kaspersky\unp042.avc
c:\kaspersky\unpack.avc
c:\kaspersky\up040702.avc
c:\kaspersky\up040709.avc
c:\kaspersky\up040716.avc
c:\kaspersky\up040723.avc
c:\kaspersky\up040730.avc
c:\kaspersky\up040806.avc
c:\kaspersky\up040813.avc
c:\kaspersky\up040820.avc
c:\kaspersky\up040827.avc
c:\kaspersky\up040903.avc
c:\kaspersky\virus.avi
c:\kaspersky\worm.avc
c:\kaspersky\x-files.avc
c:\program files\Common Files\Symantec Shared
c:\program files\Common Files\Symantec Shared\CCPD-LC\symlcrst.dll
c:\program files\Common Files\Symantec Shared\Support Controls\ssCmdTar.ini
c:\program files\Common Files\Symantec Shared\Support Controls\ssctlbr.dll
c:\program files\Common Files\Symantec Shared\Support Controls\ssctlln.dll
c:\program files\Common Files\Symantec Shared\Support Controls\ssctlwmi.dll
c:\program files\Common Files\Symantec Shared\Support Controls\sshelper.exe
c:\program files\Common Files\Symantec Shared\Support Controls\SymAData.dll
c:\program files\Common Files\Symantec Shared\Support Controls\SymSupCC.dll
c:\program files\Common Files\Symantec Shared\Support Controls\tgctlcm.dll
c:\program files\Common Files\Symantec Shared\Support Controls\tgctlsi.dll
c:\program files\Common Files\Symantec Shared\Support Controls\tgctlsr.dll
c:\program files\Common Files\Symantec Shared\Support Controls\tgctlss.dll

.
((((( Tiedostot, jotka on luotu seuraavalla aikavälillä: 2009-01-10 to 2009-02-10 )))))))))))))))))
.

Tiedostoja ei ole luotu tällä aikavälillä

.
(((((((((((((((((((((((((((((((((((( Find3M-raportti ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-02-10 19:06 --------- d-----w c:\programdata\avg8
2009-02-10 07:07 --------- d-----w c:\users\Kai\AppData\Roaming\Malwarebytes
2009-02-10 07:07 --------- d-----w c:\program files\Malwarebytes' Anti-Malware
2009-02-10 07:06 --------- d-----w c:\programdata\Malwarebytes
2009-02-09 18:29 325,128 ----a-w c:\windows\system32\drivers\avgldx86.sys
2009-02-09 18:29 107,272 ----a-w c:\windows\system32\drivers\avgtdix.sys
2009-02-09 18:29 10,520 ----a-w c:\windows\System32\avgrsstx.dll
2009-02-09 18:29 --------- d-----w c:\program files\AVG
2009-02-09 17:58 --------- d-----w c:\program files\Trend Micro
2009-02-09 16:40 --------- dcsh--w c:\program files\Common Files\WindowsLiveInstaller
2009-02-09 16:40 --------- d-----w c:\program files\Microsoft Works
2009-02-09 16:40 --------- d-----w c:\program files\Google
2009-02-09 16:40 --------- d-----w c:\program files\Common Files\Adobe
2009-02-09 15:42 --------- d-----w c:\program files\Common Files\Autodesk Shared
2009-02-09 15:42 --------- d-----w c:\program files\AutoCAD Architecture 2009
2009-01-14 14:11 38,496 ----a-w c:\windows\system32\drivers\mbamswissarmy.sys
2009-01-14 14:11 15,504 ----a-w c:\windows\system32\drivers\mbam.sys
2008-12-28 09:33 --------- d-----w c:\users\Kai\AppData\Roaming\Autodesk
2008-12-28 09:33 --------- d-----w c:\programdata\Autodesk
2007-11-28 03:09 174 --sha-w c:\program files\desktop.ini
2008-05-14 21:50 16,384 --sha-w c:\windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat
2008-05-14 21:50 32,768 --sha-w c:\windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat
2008-05-14 21:50 16,384 --sha-w c:\windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Cookies\index.dat
.

(((((((((((((((((((((((((((((( Rekisterin käynnistyskohteet )))))))))))))))))))))))))))))))))))))))))))))
.
.
*Huom* Tyhjiä arvoja ja laillisia oletusarvoja ei näytetä
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Sidebar"="c:\program files\Windows Sidebar\sidebar.exe" [2008-05-15 1232896]
"MsnMsgr"="c:\program files\Windows Live\Messenger\MsnMsgr.Exe" [2007-10-18 5724184]
"WindowsWelcomeCenter"="oobefldr.dll" [2006-11-02 c:\windows\System32\oobefldr.dll]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2007-09-19 141848]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2007-09-19 154136]
"Persistence"="c:\windows\system32\igfxpers.exe" [2007-09-19 129560]
"SynTPStart"="c:\program files\Synaptics\SynTP\SynTPStart.exe" [2007-09-15 102400]
"SMSERIAL"="c:\program files\Motorola\SMSERIAL\sm56hlpr.exe" [2007-01-17 634880]
"IAAnotif"="c:\program files\Intel\Intel Matrix Storage Manager\iaanotif.exe" [2007-07-25 174616]
"QPService"="c:\program files\HP\QuickPlay\QPService.exe" [2007-10-01 181544]
"QlbCtrl"="c:\program files\Hewlett-Packard\HP Quick Launch Buttons\QlbCtrl.exe" [2007-09-19 202032]
"OnScreenDisplay"="c:\program files\Hewlett-Packard\HP QuickTouch\HPKBDAPP.exe" [2007-09-04 554320]
"UCam_Menu"="c:\program files\CyberLink\YouCam\MUITransfer\MUIStartMenu.exe" [2007-08-17 218408]
"hpWirelessAssistant"="c:\program files\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe" [2007-09-13 480560]
"WAWifiMessage"="c:\program files\Hewlett-Packard\HP Wireless Assistant\WiFiMsg.exe" [2007-01-09 311296]
"SunJavaUpdateSched"="c:\program files\Java\jre1.6.0_02\bin\jusched.exe" [2007-07-12 132496]
"HP Software Update"="c:\program files\Hp\HP Software Update\HPWuSchd2.exe" [2005-02-16 49152]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2007-05-11 40048]
"IntelliPoint"="c:\program files\Microsoft IntelliPoint\ipoint.exe" [2007-05-19 849288]
"AVG8_TRAY"="c:\progra~1\AVG\AVG8\avgtray.exe" [2009-02-09 1601304]
"RtHDVCpl"="RtHDVCpl.exe" [2007-08-17 c:\windows\RtHDVCpl.exe]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce]
"GrpConv"="grpconv -o" [X]

c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
Bluetooth.lnk - c:\program files\WIDCOMM\Bluetooth Software\BTTray.exe [2007-09-05 727592]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"AppInit_DLLs"=avgrsstx.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"msacm.l3codecp"= l3codecp.acm

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"UacDisableNotify"=dword:00000001
"InternetSettingsDisableNotify"=dword:00000001
"AutoUpdateDisableNotify"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\DomainProfile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\FirewallRules]
"{AB811D15-C610-48A4-9697-6B7F0F613395}"= c:\program files\Cyberlink\PowerDirector\PDR.EXE:CyberLink PowerDirector
"{8AE1D2F2-2BE4-4F94-B404-A5B5E76A7271}"= c:\program files\HP\QuickPlay\QP.exe:Quick Play
"{87758C38-1E0A-46B1-BEA0-BDB0907F7764}"= c:\program files\HP\QuickPlay\QPService.exe:Quick Play Resident Program
"{A02BBAA5-088A-42ED-B5D4-C5B59EF8CE66}"= c:\program files\Windows Live\Messenger\livecall.exe:Windows Live Messenger (Phone)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\PublicProfile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\RestrictedServices\Static\System]
"DFSR-1"= RPort=5722|UDP:%SystemRoot%\system32\svchost.exe|Svc=DFSR:Allow inbound TCP traffic|

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\StandardProfile]
"EnableFirewall"= 0 (0x0)

S1 AvgLdx86;AVG Free AVI Loader Driver x86;c:\windows\System32\drivers\avgldx86.sys [2009-02-09 325128]
S1 AvgTdiX;AVG Free8 Network Redirector;c:\windows\System32\drivers\avgtdix.sys [2009-02-09 107272]
S2 avg8wd;AVG Free8 WatchDog;c:\progra~1\AVG\AVG8\avgwdsvc.exe [2009-02-09 298264]
S3 MBAMSwissArmy;MBAMSwissArmy;c:\windows\System32\drivers\mbamswissarmy.sys [2009-02-10 38496]

--- Muut muistissa olevat ajurit/palvelut ---

*NewlyCreated* - ECACHE

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
bthsvcs REG_MULTI_SZ BthServ

[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{10880D85-AAD9-4558-ABDC-2AB1552D831F}]
"c:\program files\Common Files\LightScribe\LSRunOnce.exe"
.
'Ajoitetut tehtävät'-kansion sisältö

2008-05-14 c:\windows\Tasks\HPCeeScheduleForKai.job
- c:\program files\Hewlett-Packard\SDP\Ceement\HPCEE.exe [2007-09-28 21:58]

2009-02-09 c:\windows\Tasks\Norton Internet Security - Suorita täysi järjestelmäntarkistus - Kai.job
- c:\program files\Norton Internet Security\Norton AntiVirus\Navw32.exe []
.
- - - - POISTETUT JÄMÄRIVIT - - - -

HKLM-RunOnce-<NO NAME> - (no file)


.
------- Täydentävä tarkistus -------
.
uStart Page = hxxp://www.elisa.fi/yksityisille/
mStart Page = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=fi_fi&c=81&bd=Pavilion&pf=laptop
IE: Lähetä kuva &Bluetooth-laitteeseen... - c:\program files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm
IE: Lähetä sivu &Bluetooth-laitteeseen... - c:\program files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
IE: Vie Microsoft E&xceliin - c:\progra~1\MICROS~3\OFFICE11\EXCEL.EXE/3000
.

**************************************************************************

catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-02-10 13:32:27
Windows 6.0.6000 NTFS

tarkistaa piilotettuja prosesseja ...

tarkistaa piilotettuja käynnistysarvoja ...

tarkistaa piilotettuja tiedostoja ...

tarkistus on valmis
piilotetut tiedostot: 0

**************************************************************************
.
Valmistumisajankohta: 2009-02-10 13:33:36
ComboFix-quarantined-files.txt 2009-02-10 11:33:34
ComboFix2.txt 2009-02-10 09:30:27

Ennen ajoa: Järjestelmä ei löydä sanomaa numerolle 0x2379 ohjelman Application sanomatiedostossa.
Ajon jälkeen: 99,975,319,552 tavua vapaana

1786 --- E O F --- 2008-05-20 15:33:49

 

Laitoin noi hjt korjaukset uudestaan tässä logi

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 13:54:54, on 10.2.2009
Platform: Windows Vista (WinNT 6.00.1904)
MSIE: Internet Explorer v7.00 (7.00.6000.16643)
Boot mode: Normal

Running processes:
C:\Windows\system32\Dwm.exe
C:\Windows\system32\taskeng.exe
C:\Windows\Explorer.EXE
C:\Windows\System32\igfxtray.exe
C:\Windows\System32\hkcmd.exe
C:\Windows\System32\igfxpers.exe
C:\Program Files\Synaptics\SynTP\SynTPStart.exe
C:\Program Files\Motorola\SMSERIAL\sm56hlpr.exe
C:\Windows\RtHDVCpl.exe
C:\Program Files\Intel\Intel Matrix Storage Manager\IAAnotif.exe
C:\Windows\system32\igfxsrvc.exe
C:\Program Files\HP\QuickPlay\QPService.exe
C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\QLBCTRL.exe
C:\Program Files\Hewlett-Packard\HP QuickTouch\HPKBDAPP.exe
C:\Program Files\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe
C:\Program Files\Hewlett-Packard\HP Wireless Assistant\WiFiMsg.exe
C:\Program Files\Microsoft IntelliPoint\ipoint.exe
C:\Program Files\Windows Sidebar\sidebar.exe
C:\Program Files\Windows Live\Messenger\msnmsgr.exe
C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Program Files\Hewlett-Packard\Shared\HpqToaster.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
C:\Windows\system32\SearchFilterHost.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.elisa.fi/yksityisille/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=fi_fi&c=81&bd=Pavilion&pf=laptop
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O1 - Hosts: ::1 localhost
O2 - BHO: Adobe PDF Reader -linkkiavustaja - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG8\avgssie.dll
O2 - BHO: Windows Liven kirjautumisapuohjelma - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O4 - HKLM\..\Run: [IgfxTray] C:\Windows\system32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\Windows\system32\hkcmd.exe
O4 - HKLM\..\Run: [Persistence] C:\Windows\system32\igfxpers.exe
O4 - HKLM\..\Run: [SynTPStart] C:\Program Files\Synaptics\SynTP\SynTPStart.exe
O4 - HKLM\..\Run: [SMSERIAL] C:\Program Files\Motorola\SMSERIAL\sm56hlpr.exe
O4 - HKLM\..\Run: [RtHDVCpl] RtHDVCpl.exe
O4 - HKLM\..\Run: [IAAnotif] C:\Program Files\Intel\Intel Matrix Storage Manager\iaanotif.exe
O4 - HKLM\..\Run: [QPService] "C:\Program Files\HP\QuickPlay\QPService.exe"
O4 - HKLM\..\Run: [QlbCtrl] %ProgramFiles%\Hewlett-Packard\HP Quick Launch Buttons\QlbCtrl.exe /Start
O4 - HKLM\..\Run: [OnScreenDisplay] C:\Program Files\Hewlett-Packard\HP QuickTouch\HPKBDAPP.exe
O4 - HKLM\..\Run: [UCam_Menu] "C:\Program Files\CyberLink\YouCam\MUITransfer\MUIStartMenu.exe" "C:\Program Files\CyberLink\YouCam" update "Software\CyberLink\YouCam\1.0"
O4 - HKLM\..\Run: [hpWirelessAssistant] C:\Program Files\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe
O4 - HKLM\..\Run: [WAWifiMessage] C:\Program Files\Hewlett-Packard\HP Wireless Assistant\WiFiMsg.exe
O4 - HKLM\..\Run: [IntelliPoint] "C:\Program Files\Microsoft IntelliPoint\ipoint.exe"
O4 - HKLM\..\Run: [AVG8_TRAY] C:\PROGRA~1\AVG\AVG8\avgtray.exe
O4 - HKCU\..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun
O4 - HKCU\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background
O4 - Global Startup: Bluetooth.lnk = ?
O8 - Extra context menu item: Lähetä kuva &Bluetooth-laitteeseen... - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm
O8 - Extra context menu item: Lähetä sivu &Bluetooth-laitteeseen... - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
O8 - Extra context menu item: Vie Microsoft E&xceliin - res://C:\PROGRA~1\MICROS~3\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: Oheistiedot - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\OFFICE11\REFIEBAR.DLL
O9 - Extra button: @btrez.dll,-4015 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
O9 - Extra 'Tools' menuitem: @btrez.dll,-12650 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
O13 - Gopher Prefix:
O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG8\avgpp.dll
O20 - AppInit_DLLs: avgrsstx.dll
O23 - Service: Autodesk Licensing Service - Autodesk - C:\Program Files\Common Files\Autodesk Shared\Service\AdskScSrv.exe
O23 - Service: AVG Free8 WatchDog (avg8wd) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
O23 - Service: Com4Qlb - Hewlett-Packard Development Company, L.P. - C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\Com4Qlb.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: HP Health Check Service - Hewlett-Packard - c:\Program Files\Hewlett-Packard\HP Health Check\hphc_service.exe
O23 - Service: hpqwmiex - Hewlett-Packard Development Company, L.P. - C:\Program Files\Hewlett-Packard\Shared\hpqWmiEx.exe
O23 - Service: Intel(R) Matrix Storage Event Monitor (IAANTMON) - Intel Corporation - C:\Program Files\Intel\Intel Matrix Storage Manager\IAANTMon.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe
O23 - Service: QuickPlay Background Capture Service (QBCS) (QPCapSvc) - Unknown owner - C:\Program Files\HP\QuickPlay\Kernel\TV\QPCapSvc.exe
O23 - Service: QuickPlay Task Scheduler (QTS) (QPSched) - Unknown owner - C:\Program Files\HP\QuickPlay\Kernel\TV\QPSched.exe
O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - C:\Program Files\CyberLink\Shared Files\RichVideo.exe

--
End of file - 7079 bytes

 

Nyt tuon alla olevan lainauksen sisällön Kopioit / liität Tyhjään muistioon
käynnistä nappi >apuohjelmat > muistio

Tallenna se nimellä CFScript.txt työpöydälle

Sitten raahaa CFScript ComboFix.exeen kuten alla.



Laita tuleva loki tänne.

Sammutat ja käynnistät koneen

 

Tässä ComboFix logi. Ohjelmaa ajaessani vikasietotilassa ensin tuli ilmoitus Execute processes remotely lakkasi toimimasta, sit win koitti korjata ongelmaa ei onnistunu ni se suljettiin. Vähänajan päästä tuli ilmoitus Resusrssienhallinta lakkasi toimimasta korjataan ongelmaa...

ComboFix 09-02-08.02 - Kai 2009-02-10 15:58:13.3 - NTFSx86 MINIMAL
Microsoft® Windows Vista™ Home Premium 6.0.6000.0.1252.1.1035.18.2038.1670 [GMT 2:00]
Sijainti: c:\users\Kai\Desktop\ComboFix.exe
Käytetyt komentorivivalitsimet :: c:\users\Kai\Desktop\CFScript.txt
AV: AVG Anti-Virus Free *On-access scanning enabled* (Outdated)
.

((((( Tiedostot, jotka on luotu seuraavalla aikavälillä: 2009-01-10 to 2009-02-10 )))))))))))))))))
.

Tiedostoja ei ole luotu tällä aikavälillä

.
(((((((((((((((((((((((((((((((((((( Find3M-raportti ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-02-10 19:06 --------- d-----w c:\programdata\avg8
2009-02-10 11:45 410,984 ----a-w c:\windows\System32\deploytk.dll
2009-02-10 11:44 --------- d-----w c:\program files\Java
2009-02-10 07:07 --------- d-----w c:\users\Kai\AppData\Roaming\Malwarebytes
2009-02-10 07:07 --------- d-----w c:\program files\Malwarebytes' Anti-Malware
2009-02-10 07:06 --------- d-----w c:\programdata\Malwarebytes
2009-02-09 18:29 325,128 ----a-w c:\windows\system32\drivers\avgldx86.sys
2009-02-09 18:29 107,272 ----a-w c:\windows\system32\drivers\avgtdix.sys
2009-02-09 18:29 10,520 ----a-w c:\windows\System32\avgrsstx.dll
2009-02-09 18:29 --------- d-----w c:\program files\AVG
2009-02-09 17:58 --------- d-----w c:\program files\Trend Micro
2009-02-09 16:40 --------- dcsh--w c:\program files\Common Files\WindowsLiveInstaller
2009-02-09 16:40 --------- d-----w c:\program files\Microsoft Works
2009-02-09 16:40 --------- d-----w c:\program files\Google
2009-02-09 16:40 --------- d-----w c:\program files\Common Files\Adobe
2009-02-09 15:42 --------- d-----w c:\program files\Common Files\Autodesk Shared
2009-02-09 15:42 --------- d-----w c:\program files\AutoCAD Architecture 2009
2009-01-14 14:11 38,496 ----a-w c:\windows\system32\drivers\mbamswissarmy.sys
2009-01-14 14:11 15,504 ----a-w c:\windows\system32\drivers\mbam.sys
2008-12-28 09:33 --------- d-----w c:\users\Kai\AppData\Roaming\Autodesk
2008-12-28 09:33 --------- d-----w c:\programdata\Autodesk
2007-11-28 03:09 174 --sha-w c:\program files\desktop.ini
2008-05-14 21:50 16,384 --sha-w c:\windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat
2008-05-14 21:50 32,768 --sha-w c:\windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat
2008-05-14 21:50 16,384 --sha-w c:\windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Cookies\index.dat
.

(((((((((((((((((((((((((((((( Rekisterin käynnistyskohteet )))))))))))))))))))))))))))))))))))))))))))))
.
.
*Huom* Tyhjiä arvoja ja laillisia oletusarvoja ei näytetä
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Sidebar"="c:\program files\Windows Sidebar\sidebar.exe" [2008-05-15 1232896]
"MsnMsgr"="c:\program files\Windows Live\Messenger\MsnMsgr.Exe" [2007-10-18 5724184]
"WindowsWelcomeCenter"="oobefldr.dll" [2006-11-02 c:\windows\System32\oobefldr.dll]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2007-09-19 141848]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2007-09-19 154136]
"Persistence"="c:\windows\system32\igfxpers.exe" [2007-09-19 129560]
"SynTPStart"="c:\program files\Synaptics\SynTP\SynTPStart.exe" [2007-09-15 102400]
"SMSERIAL"="c:\program files\Motorola\SMSERIAL\sm56hlpr.exe" [2007-01-17 634880]
"IAAnotif"="c:\program files\Intel\Intel Matrix Storage Manager\iaanotif.exe" [2007-07-25 174616]
"QPService"="c:\program files\HP\QuickPlay\QPService.exe" [2007-10-01 181544]
"QlbCtrl"="c:\program files\Hewlett-Packard\HP Quick Launch Buttons\QlbCtrl.exe" [2007-09-19 202032]
"OnScreenDisplay"="c:\program files\Hewlett-Packard\HP QuickTouch\HPKBDAPP.exe" [2007-09-04 554320]
"UCam_Menu"="c:\program files\CyberLink\YouCam\MUITransfer\MUIStartMenu.exe" [2007-08-17 218408]
"hpWirelessAssistant"="c:\program files\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe" [2007-09-13 480560]
"WAWifiMessage"="c:\program files\Hewlett-Packard\HP Wireless Assistant\WiFiMsg.exe" [2007-01-09 311296]
"IntelliPoint"="c:\program files\Microsoft IntelliPoint\ipoint.exe" [2007-05-19 849288]
"AVG8_TRAY"="c:\progra~1\AVG\AVG8\avgtray.exe" [2009-02-09 1601304]
"RtHDVCpl"="RtHDVCpl.exe" [2007-08-17 c:\windows\RtHDVCpl.exe]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce]
"GrpConv"="grpconv -o" [X]

c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
Bluetooth.lnk - c:\program files\WIDCOMM\Bluetooth Software\BTTray.exe [2007-09-05 727592]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"AppInit_DLLs"=avgrsstx.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"msacm.l3codecp"= l3codecp.acm

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"UacDisableNotify"=dword:00000001
"InternetSettingsDisableNotify"=dword:00000001
"AutoUpdateDisableNotify"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\DomainProfile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\FirewallRules]
"{AB811D15-C610-48A4-9697-6B7F0F613395}"= c:\program files\Cyberlink\PowerDirector\PDR.EXE:CyberLink PowerDirector
"{8AE1D2F2-2BE4-4F94-B404-A5B5E76A7271}"= c:\program files\HP\QuickPlay\QP.exe:Quick Play
"{87758C38-1E0A-46B1-BEA0-BDB0907F7764}"= c:\program files\HP\QuickPlay\QPService.exe:Quick Play Resident Program
"{A02BBAA5-088A-42ED-B5D4-C5B59EF8CE66}"= c:\program files\Windows Live\Messenger\livecall.exe:Windows Live Messenger (Phone)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\PublicProfile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\RestrictedServices\Static\System]
"DFSR-1"= RPort=5722|UDP:%SystemRoot%\system32\svchost.exe|Svc=DFSR:Allow inbound TCP traffic|

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\StandardProfile]
"EnableFirewall"= 0 (0x0)

S1 AvgLdx86;AVG Free AVI Loader Driver x86;c:\windows\System32\drivers\avgldx86.sys [2009-02-09 325128]
S1 AvgTdiX;AVG Free8 Network Redirector;c:\windows\System32\drivers\avgtdix.sys [2009-02-09 107272]
S2 avg8wd;AVG Free8 WatchDog;c:\progra~1\AVG\AVG8\avgwdsvc.exe [2009-02-09 298264]
S3 MBAMSwissArmy;MBAMSwissArmy;c:\windows\System32\drivers\mbamswissarmy.sys [2009-02-10 38496]

--- Muut muistissa olevat ajurit/palvelut ---

*NewlyCreated* - ECACHE

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
bthsvcs REG_MULTI_SZ BthServ

[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{10880D85-AAD9-4558-ABDC-2AB1552D831F}]
"c:\program files\Common Files\LightScribe\LSRunOnce.exe"
.
'Ajoitetut tehtävät'-kansion sisältö

2008-05-14 c:\windows\Tasks\HPCeeScheduleForKai.job
- c:\program files\Hewlett-Packard\SDP\Ceement\HPCEE.exe [2007-09-28 21:58]

2009-02-09 c:\windows\Tasks\Norton Internet Security - Suorita täysi järjestelmäntarkistus - Kai.job
- c:\program files\Norton Internet Security\Norton AntiVirus\Navw32.exe []
.
- - - - POISTETUT JÄMÄRIVIT - - - -

HKLM-RunOnce-<NO NAME> - (no file)


.
------- Täydentävä tarkistus -------
.
uStart Page = hxxp://www.elisa.fi/yksityisille/
mStart Page = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=fi_fi&c=81&bd=Pavilion&pf=laptop
IE: Lähetä kuva &Bluetooth-laitteeseen... - c:\program files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm
IE: Lähetä sivu &Bluetooth-laitteeseen... - c:\program files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
IE: Vie Microsoft E&xceliin - c:\progra~1\MICROS~3\OFFICE11\EXCEL.EXE/3000
.

**************************************************************************

catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-02-10 16:01:33
Windows 6.0.6000 NTFS

tarkistaa piilotettuja prosesseja ...

tarkistaa piilotettuja käynnistysarvoja ...

tarkistaa piilotettuja tiedostoja ...

tarkistus on valmis
piilotetut tiedostot: 0

**************************************************************************
.
Valmistumisajankohta: 2009-02-10 16:03:34
ComboFix-quarantined-files.txt 2009-02-10 14:03:31
ComboFix2.txt 2009-02-10 11:33:37
ComboFix3.txt 2009-02-10 09:30:27

Ennen ajoa: Järjestelmä ei löydä sanomaa numerolle 0x2379 ohjelman Application sanomatiedostossa.
Ajon jälkeen: 99,627,700,224 tavua vapaana

133 --- E O F --- 2008-05-20 15:33:49

 

Tulee myös tällainen virheilmoitus:

Sisäänkirjautuminen ei voinut luoda suojausasetusten valintaikkunaa.

Virhe - Suojausasetukset

 

c:\windows\Tasks\Norton Internet Security

Löytyykö tuolta kansiosta punasella merkitty poista
c:\windows\Tasks

=============

sammuta käynnistä

scannaa uusi hjt:n loki

 

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 16:35:20, on 10.2.2009
Platform: Windows Vista (WinNT 6.00.1904)
MSIE: Internet Explorer v7.00 (7.00.6000.16643)
Boot mode: Normal

Running processes:
C:\Windows\system32\taskeng.exe
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Windows\System32\igfxtray.exe
C:\Windows\System32\hkcmd.exe
C:\Windows\System32\igfxpers.exe
C:\Program Files\Synaptics\SynTP\SynTPStart.exe
C:\Program Files\Motorola\SMSERIAL\sm56hlpr.exe
C:\Windows\RtHDVCpl.exe
C:\Program Files\Intel\Intel Matrix Storage Manager\IAAnotif.exe
C:\Program Files\HP\QuickPlay\QPService.exe
C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\QLBCTRL.exe
C:\Program Files\Hewlett-Packard\HP QuickTouch\HPKBDAPP.exe
C:\Windows\system32\igfxsrvc.exe
C:\Program Files\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe
C:\Program Files\Hewlett-Packard\HP Wireless Assistant\WiFiMsg.exe
C:\Program Files\Microsoft IntelliPoint\ipoint.exe
C:\Program Files\Windows Sidebar\sidebar.exe
C:\Program Files\Windows Live\Messenger\msnmsgr.exe
C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Program Files\Hewlett-Packard\Shared\HpqToaster.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.elisa.fi/yksityisille/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=fi_fi&c=81&bd=Pavilion&pf=laptop
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O1 - Hosts: ::1 localhost
O2 - BHO: Adobe PDF Reader -linkkiavustaja - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG8\avgssie.dll
O2 - BHO: Windows Liven kirjautumisapuohjelma - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O4 - HKLM\..\Run: [IgfxTray] C:\Windows\system32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\Windows\system32\hkcmd.exe
O4 - HKLM\..\Run: [Persistence] C:\Windows\system32\igfxpers.exe
O4 - HKLM\..\Run: [SynTPStart] C:\Program Files\Synaptics\SynTP\SynTPStart.exe
O4 - HKLM\..\Run: [SMSERIAL] C:\Program Files\Motorola\SMSERIAL\sm56hlpr.exe
O4 - HKLM\..\Run: [RtHDVCpl] RtHDVCpl.exe
O4 - HKLM\..\Run: [IAAnotif] C:\Program Files\Intel\Intel Matrix Storage Manager\iaanotif.exe
O4 - HKLM\..\Run: [QPService] "C:\Program Files\HP\QuickPlay\QPService.exe"
O4 - HKLM\..\Run: [QlbCtrl] %ProgramFiles%\Hewlett-Packard\HP Quick Launch Buttons\QlbCtrl.exe /Start
O4 - HKLM\..\Run: [OnScreenDisplay] C:\Program Files\Hewlett-Packard\HP QuickTouch\HPKBDAPP.exe
O4 - HKLM\..\Run: [UCam_Menu] "C:\Program Files\CyberLink\YouCam\MUITransfer\MUIStartMenu.exe" "C:\Program Files\CyberLink\YouCam" update "Software\CyberLink\YouCam\1.0"
O4 - HKLM\..\Run: [hpWirelessAssistant] C:\Program Files\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe
O4 - HKLM\..\Run: [WAWifiMessage] C:\Program Files\Hewlett-Packard\HP Wireless Assistant\WiFiMsg.exe
O4 - HKLM\..\Run: [IntelliPoint] "C:\Program Files\Microsoft IntelliPoint\ipoint.exe"
O4 - HKLM\..\Run: [AVG8_TRAY] C:\PROGRA~1\AVG\AVG8\avgtray.exe
O4 - HKCU\..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun
O4 - HKCU\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background
O4 - Global Startup: Bluetooth.lnk = ?
O8 - Extra context menu item: Lähetä kuva &Bluetooth-laitteeseen... - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm
O8 - Extra context menu item: Lähetä sivu &Bluetooth-laitteeseen... - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
O8 - Extra context menu item: Vie Microsoft E&xceliin - res://C:\PROGRA~1\MICROS~3\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: Oheistiedot - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\OFFICE11\REFIEBAR.DLL
O9 - Extra button: @btrez.dll,-4015 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
O9 - Extra 'Tools' menuitem: @btrez.dll,-12650 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
O13 - Gopher Prefix:
O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG8\avgpp.dll
O20 - AppInit_DLLs: avgrsstx.dll
O23 - Service: Autodesk Licensing Service - Autodesk - C:\Program Files\Common Files\Autodesk Shared\Service\AdskScSrv.exe
O23 - Service: AVG Free8 WatchDog (avg8wd) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
O23 - Service: Com4Qlb - Hewlett-Packard Development Company, L.P. - C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\Com4Qlb.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: HP Health Check Service - Hewlett-Packard - c:\Program Files\Hewlett-Packard\HP Health Check\hphc_service.exe
O23 - Service: hpqwmiex - Hewlett-Packard Development Company, L.P. - C:\Program Files\Hewlett-Packard\Shared\hpqWmiEx.exe
O23 - Service: Intel(R) Matrix Storage Event Monitor (IAANTMON) - Intel Corporation - C:\Program Files\Intel\Intel Matrix Storage Manager\IAANTMon.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe
O23 - Service: QuickPlay Background Capture Service (QBCS) (QPCapSvc) - Unknown owner - C:\Program Files\HP\QuickPlay\Kernel\TV\QPCapSvc.exe
O23 - Service: QuickPlay Task Scheduler (QTS) (QPSched) - Unknown owner - C:\Program Files\HP\QuickPlay\Kernel\TV\QPSched.exe
O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - C:\Program Files\CyberLink\Shared Files\RichVideo.exe

--
End of file - 7037 bytes

 

Mikäs on koneen toiminta

===============

Kirjoita suoritaluukkuun

ComboFix /u

klikkaa OK

=======

 

n. 3min pystyy käyttämään ja sitten mikään ohjelma ei vastaa eikä kone reagoi mihinkään. Osoitin näyttää vaan miettivän jotain. Ctrl-Alt-Del ei myöskään reagoi. Tossa kun kone käynnistyy niin siinä aukeaa tämä hallinta ikkuna, siellä näyttäis olevan vielä symantechin joku =)¤¤# hallintaikkuna, vaikka poistin Nortonin poistotyökalulla.

 

paljos siinä koneessa on keskusmuistia