Menin tossa eilen lataamaan jonkun virus ohjelman epähuomiossa ja nyt se antaa kokoajan jotain alertteja viruksista ja pyytää lataamaan jotain virusturvaohjelmia. En voi edes poistaa koko ohjelmaa, koska en löydä edes sitä.
-> Lataa Hijackthis: http://koti.mbnet.fi/pattaya1/HijackThis.exe -> Tallenna hakemistoon C:\hjt ->Uudelleennimeä HijackThis.exe -> scanner.exe:ksi näin: 1. Klikkaa hiiren oikealla painikkeella HijackThis ikonia. 2. Valitse Uudelleennineä/ Rename. 3. Kirjoita scanner.exe -> Käynnistä HijackThis ja klikkaa: do a system scan and save a logfile. -> Lähetä ilmestynyt logisi tähän ketjuun
sain sitä ohjelmaa jotenkin putsattua spybotilla, mutta tässä logi Logfile of HijackThis v1.99.1 Scan saved at 18:57:59, on 16.7.2007 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\Ati2evxx.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\Ati2evxx.exe C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\Explorer.EXE C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe C:\PROGRA~1\backweb\4476822\Program\SERVIC~1.EXE C:\WINDOWS\system32\drivers\CDAC11BA.EXE C:\WINDOWS\System32\CTsvcCDA.exe C:\Program Files\Anti-Virus\fsgk32st.exe C:\Program Files\Anti-Virus\FSGK32.EXE C:\Program Files\backweb\4476822\program\fsbwsys.exe C:\Program Files\Anti-Virus\fssm32.exe C:\Program Files\Common\FSMA32.EXE C:\Program Files\Common\FSMB32.EXE C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe C:\WINDOWS\system32\PnkBstrA.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\backweb\4476822\Program\fspex.exe C:\Program Files\Common\FCH32.EXE C:\WINDOWS\system32\UAService7.exe C:\Program Files\Anti-Virus\fsqh.exe C:\Program Files\Common\FAMEH32.EXE C:\WINDOWS\System32\MsPMSPSv.exe C:\Program Files\Anti-Virus\fsrw.exe C:\Program Files\FSPC\fspc.exe C:\Program Files\Anti-Virus\fsav32.exe C:\Program Files\FWES\Program\fsdfwd.exe C:\Program Files\Creative\SBAudigy2\DVDAudio\CTDVDDet.EXE C:\WINDOWS\system32\CTHELPER.EXE C:\Program Files\Common\FSM32.EXE C:\Program Files\Logitech\MouseWare\system\em_exec.exe C:\PROGRA~1\ANTI-S~1\fsaw.exe C:\Program Files\Logitech\G-series Software\LCDMon.exe C:\Program Files\FSGUI\ispnews.exe C:\WINDOWS\system32\ctfmon.exe C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe C:\Program Files\Logitech\G-series Software\Applets\LCDMedia.exe C:\Program Files\Logitech\G-series Software\Applets\LCDClock.exe C:\Program Files\Common Files\Microsoft Shared\Works Shared\wkcalrem.exe C:\Program Files\FSGUI\fsguidll.exe C:\Program Files\Internet Explorer\iexplore.exe C:\Program Files\Internet Explorer\iexplore.exe C:\scanner.exe R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://plaza.fi/ R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://red.clientapps.yahoo.com/customize/ycomp_wave/defaults/su/*http://www.yahoo.com R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = proxy.dial.inet.fi:800 R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = localhost;<local> R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Linkit O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~2\SDHelper.dll O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar3.dll O2 - BHO: (no name) - {E26CEADA-67B0-4543-BE8B-307F00265118} - \iesplg.dll (file missing) O3 - Toolbar: (no name) - {E0E899AB-F487-11D5-8D29-0050BA6940E3} - (no file) O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar3.dll O3 - Toolbar: (no name) - {29C5A3B6-9A8D-4FA0-B5AD-3E20F4AA5C00} - (no file) O4 - HKLM\..\Run: [CTSysVol] C:\Program Files\Creative\SBAudigy2\Surround Mixer\CTSysVol.exe O4 - HKLM\..\Run: [CTDVDDet] C:\Program Files\Creative\SBAudigy2\DVDAudio\CTDVDDet.EXE O4 - HKLM\..\Run: [CTHelper] CTHELPER.EXE O4 - HKLM\..\Run: [AsioReg] REGSVR32.EXE /S CTASIO.DLL O4 - HKLM\..\Run: [SBDrvDet] C:\Program Files\Creative\SB Drive Det\SBDrvDet.exe /r O4 - HKLM\..\Run: [UpdReg] C:\WINDOWS\UpdReg.EXE O4 - HKLM\..\Run: [CTStartup] "C:\Program Files\Creative\Splash Screen\CTEaxSpl.EXE" /run O4 - HKLM\..\Run: [Microsoft Works Update Detection] C:\Program Files\Common Files\Microsoft Shared\Works Shared\WkUFind.exe O4 - HKLM\..\Run: [Logitech Utility] Logi_MwX.Exe O4 - HKLM\..\Run: [F-Secure Manager] "C:\Program Files\Common\FSM32.EXE" /splash O4 - HKLM\..\Run: [F-Secure TNB] "C:\Program Files\TNB\TNBUtil.exe" /CHECKALL /WAITFORSW O4 - HKLM\..\Run: [F-Secure Startup Wizard] "C:\Program Files\FSGUI\FSSW.EXE" /reboot O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime O4 - HKLM\..\Run: [Launch LGDCore] "C:\Program Files\Logitech\G-series Software\LGDCore.exe" /SHOWHIDE O4 - HKLM\..\Run: [Launch LCDMon] "C:\Program Files\Logitech\G-series Software\LCDMon.exe" O4 - HKLM\..\Run: [News Service] "C:\Program Files\FSGUI\ispnews.exe" O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [LDM] C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe O4 - HKCU\..\Run: [StartCCC] C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe O4 - HKCU\..\Run: [Steam] "e:\sampo 2\steam\steam.exe" -silent O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy2\TeaTimer.exe O4 - HKCU\..\RunOnce: [SpybotDeletingB774] command /c del "C:\Program Files\Video ActiveX Access\iesplg.dll_tobedeleted_old" O4 - HKCU\..\RunOnce: [SpybotDeletingD1165] cmd /c del "C:\Program Files\Video ActiveX Access\iesplg.dll_tobedeleted_old" O4 - HKCU\..\RunOnce: [SpybotDeletingD7958] cmd /c del "C:\Program Files\Video ActiveX Access\imsmain.exe_tobedeleted_old" O4 - HKCU\..\RunOnce: [CTStartup] "C:\Program Files\Creative\Splash Screen\CTEaxSpl.EXE" /play O4 - Startup: Delta Force-Black Hawk Down Team Sabre Registration.lnk = C:\Documents and Settings\SAMPO LIEHUNEN\Local Settings\Temp\{A9CFCD12-81F5-4DDD-B8E7-4A431351084A}\{6164D2E7-986B-42F5-B3A6-64D5E53FB889}\NOVG.EXE O4 - Startup: Joint Operations Typhoon Rising Registration.lnk = C:\Documents and Settings\SAMPO LIEHUNEN\Local Settings\Temp\{93ACF26A-0C69-4F13-8197-3843D07A33D9}\{0325F1C1-883A-41AB-8981-B27359ABDFAF}\NOVG.EXE O4 - Startup: PowerReg Scheduler V3.exe O4 - Startup: PowerReg Scheduler.exe O4 - Global Startup: F-Secure 2006.lnk = C:\Program Files\backweb\4476822\Program\fspex.exe O4 - Global Startup: Logitech Desktop Messenger.lnk = C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE O4 - Global Startup: Microsoft Works Calendar Reminders.lnk = ? O4 - Global Startup: WinZip Quick Pick.lnk = C:\Program Files\WinZip\WZQKPICK.EXE O8 - Extra context menu item: &Estä tämä kohoikkuna - C:\Program Files\Anti-Spyware\blockpopups.htm O8 - Extra context menu item: &Google Search - res://c:\program files\google\GoogleToolbar3.dll/cmsearch.html O8 - Extra context menu item: &Translate English Word - res://c:\program files\google\GoogleToolbar3.dll/cmwordtrans.html O8 - Extra context menu item: Backward Links - res://c:\program files\google\GoogleToolbar3.dll/cmbacklinks.html O8 - Extra context menu item: Cached Snapshot of Page - res://c:\program files\google\GoogleToolbar3.dll/cmcache.html O8 - Extra context menu item: Similar Pages - res://c:\program files\google\GoogleToolbar3.dll/cmsimilar.html O8 - Extra context menu item: Translate Page into English - res://c:\program files\google\GoogleToolbar3.dll/cmtrans.html O9 - Extra button: Web-suodatin - {200DB664-75B5-47c0-8B45-A44ACCF73C00} - C:\Program Files\FSPC\fspcmsie.dll O9 - Extra button: (no name) - {200DB664-75B5-47c0-8B45-A44ACCF73F01} - C:\Program Files\FSPC\fspcmsie.dll O9 - Extra 'Tools' menuitem: Web-suodatin - {200DB664-75B5-47c0-8B45-A44ACCF73F01} - C:\Program Files\FSPC\fspcmsie.dll O9 - Extra button: (no name) - {200DB664-75B5-47c0-8B45-A44ACCF73F02} - C:\Program Files\FSPC\fspcmsie.dll O9 - Extra 'Tools' menuitem: &Keskeytä Web-sivujen suodatus - {200DB664-75B5-47c0-8B45-A44ACCF73F02} - C:\Program Files\FSPC\fspcmsie.dll O9 - Extra button: (no name) - {200DB664-75B5-47c0-8B45-A44ACCF73F03} - C:\Program Files\FSPC\fspcmsie.dll O9 - Extra 'Tools' menuitem: &Kiellä tämä Web-sivusto - {200DB664-75B5-47c0-8B45-A44ACCF73F03} - C:\Program Files\FSPC\fspcmsie.dll O9 - Extra button: (no name) - {200DB664-75B5-47c0-8B45-A44ACCF73F04} - C:\Program Files\FSPC\fspcmsie.dll O9 - Extra 'Tools' menuitem: &Salli tämä Web-sivusto - {200DB664-75B5-47c0-8B45-A44ACCF73F04} - C:\Program Files\FSPC\fspcmsie.dll O9 - Extra button: IE-suojaus - {300DB664-75B5-47c0-8B45-A44ACCF73C00} - C:\Program Files\Anti-Spyware\ieshield.dll O9 - Extra 'Tools' menuitem: IE-suojaus... - {300DB664-75B5-47c0-8B45-A44ACCF73C00} - C:\Program Files\Anti-Spyware\ieshield.dll O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~2\SDHelper.dll O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~2\SDHelper.dll O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing) O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing) O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O10 - Broken Internet access because of LSP provider 'winsflt.dll' missing O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll O16 - DPF: {0CBF7EDC-17EC-442C-8AE9-5E804707B6CA} (NeffyClient Class) - http://dist.cdnetworks.co.jp/cdndist/neffy/Neffy.cab O16 - DPF: {15AD6789-CDB4-47E1-A9DA-992EE8E6BAD6} - http://static.windupdates.com/cab/CDT/ie/bridge-c18.cab O16 - DPF: {31B7EB4E-8B4B-11D1-A789-00A0CC6651A8} (Cult3D ActiveX Player) - http://www.cult3d.com/download/cult.cab O16 - DPF: {39B0684F-D7BF-4743-B050-FDC3F48F7E3B} (FilePlanet Download Control Class) - http://www.fileplanet.com/fpdlmgr/cabs/FPDC_1_0_0_44.cab O16 - DPF: {68BCE50A-DC9B-4519-A118-6FDA19DB450D} (Info Class) - http://support.vugames.com/betasubmission/sysinfo/Si.cab O16 - DPF: {70BA88C8-DAE8-4CE9-92BB-979C4A75F53B} (GSDACtl Class) - http://launch.gamespyarcade.com/software/launch/alaunch.cab O16 - DPF: {917623D1-D8E5-11D2-BE8B-00104B06BDE3} (CamImage Class) - http://62.197.172.28:8088/activex/AxisCamControl.cab O16 - DPF: {F58E1CEF-A068-4C15-BA5E-587CAF3EE8C6} (MSN Chat Control 4.5) - http://fdl.msn.com/public/chat/msnchat45.cab O16 - DPF: {FE5D6722-826F-11D5-A24E-0060B0F1A5AE} (Tukati Launcher) - http://http.gamezone.tukati.com/tukati/1.7.20.20/tukati.cab O18 - Protocol: bwfile-8876480 - {9462A756-7B47-47BC-8C80-C34B9B80B32B} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\GAPlugProtocol-8876480.dll O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft AB - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe O23 - Service: F-Secure 2006 (BackWeb Plug-in - 4476822) - F-Secure Internet Security 2005 - C:\PROGRA~1\backweb\4476822\Program\SERVIC~1.EXE O23 - Service: C-DillaCdaC11BA - Macrovision - C:\WINDOWS\system32\drivers\CDAC11BA.EXE O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\System32\CTsvcCDA.exe O23 - Service: F-Secure Gatekeeper Handler Starter - F-Secure Corporation - C:\Program Files\Anti-Virus\fsgk32st.exe O23 - Service: fsbwsys - F-Secure Corp. - C:\Program Files\backweb\4476822\program\fsbwsys.exe O23 - Service: F-Secure Anti-Virus Firewall Daemon (FSDFWD) - F-Secure Corporation - C:\Program Files\FWES\Program\fsdfwd.exe O23 - Service: F-Secure HTTP Server (fshttps) - F-Secure Corporation - C:\Program Files\FSPC\fshttps\fshttps.exe O23 - Service: FSMA - F-Secure Corporation - C:\Program Files\Common\FSMA32.EXE O23 - Service: iPod-palvelu (iPodService) - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\system32\PnkBstrA.exe O23 - Service: SecuROM User Access Service (V7) (UserAccess7) - Unknown owner - C:\WINDOWS\system32\UAService7.exe O23 - Service: Webcam Corp. Service Starter - Unknown owner - E:\Sampo 3\NetCam Center SCE\dogsvc.exe (file missing)
smittihän se siell Lataa SmitfraudFix (by S!Ri) työpöydällesi. Tuplaklikkaa tiedostoa SmitfraudFix.exe Valitse optio #1 - Search kirjoittamalla 1 ja painamalla "Enter"; tekstitiedosto avautuu, joka listaa tarttuneet tiedostot (jos olemassa). Postita tämän tekstitiedoston sisältö viestiketjuusi. **Jos työkalu ei käynnisty työpöydältä niin siirrä SmitfraudFix.exe suoraan järjestelmäaseman juureen (yleensä C:). Kokeile sitten käynnistää ohjelma uudestaan sieltä. Huomaa : process.exe filun tunnistaa jotkut Anti-virus ohjelmat (AntiVir, Dr.Web, Kaspersky) "Haittakaluna"; se ei ole virus, vaan ohjelma joka pysäyttää prosesseja. A/V ohjelmat eivät pysty tunnistamaan hyvän ja pahan käytön tälläisten ohjelmian väliltä, silloin ne saattavat varoittaa käyttäjää. http://www.beyondlogic.org/consulting/processutil/processutil.htm ========== Printtaa ohjeet ulos tai tallenna nämä tekstitiedostoon. Käynnistä koneesi vikasietotilaan ja valitse tavallinen käyttäjätilisi. Kun vikasietotilassa, tuplaklikkaa tiedostoa SmitfraudFix.exe Valitse optio #2 - Clean kirjoittamalla 2 ja painamalla "Enter" poistaaksesi tarttuneet tiedostot. Sinulta kysytään: "Registry cleaning - Do you want to clean the registry ?"; vastaa "Yes" kirjoittamalla Y ja paina "Enter" poistaaksesi työpöydän taustakuvan ja puhdistaaksesi tarttuneet rekisteriavaimet. Työkalu tarkistaa jos wininet.dll on tarttunut. Sinua saatetaan pyytää korvaamaan tarttunut .dll (jos löytyy); vastaa "Yes" kirjoittamalla Y ja painamalla "Enter". Työkalun saattaa tarvita käynnistää kone uudelleen; jos ei tee niin, käynnistä normaaliin Windowsiin. Tekstitiedosto ilmestyy, puhdistusprosessin jäljiltä; kopioi & liitä tämän raportin tulokset vastaukseesi. Raportti löytyy paikalliselta levyltäsi, useimmiten C:\rapport.txt. ========== Laita molempien kohtien lokit, myös uusi HJTlogi
SmitFraudFix v2.204 Scan done at 20:01:31,01, ma 16.07.2007 Run from C:\Documents and Settings\SAMPO LIEHUNEN\Ty”p”yt„\SmitfraudFix OS: Microsoft Windows XP [versio 5.1.2600] - Windows_NT The filesystem type is NTFS Fix run in normal mode »»»»»»»»»»»»»»»»»»»»»»»» Process C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\Ati2evxx.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\Ati2evxx.exe C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\Explorer.EXE C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe C:\PROGRA~1\backweb\4476822\Program\SERVIC~1.EXE C:\WINDOWS\system32\drivers\CDAC11BA.EXE C:\WINDOWS\System32\CTsvcCDA.exe C:\Program Files\Anti-Virus\fsgk32st.exe C:\Program Files\Anti-Virus\FSGK32.EXE C:\Program Files\backweb\4476822\program\fsbwsys.exe C:\Program Files\Anti-Virus\fssm32.exe C:\Program Files\Common\FSMA32.EXE C:\Program Files\Common\FSMB32.EXE C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe C:\WINDOWS\system32\PnkBstrA.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\backweb\4476822\Program\fspex.exe C:\Program Files\Common\FCH32.EXE C:\WINDOWS\system32\UAService7.exe C:\Program Files\Anti-Virus\fsqh.exe C:\Program Files\Common\FAMEH32.EXE C:\WINDOWS\System32\MsPMSPSv.exe C:\Program Files\Anti-Virus\fsrw.exe C:\Program Files\FSPC\fspc.exe C:\Program Files\Anti-Virus\fsav32.exe C:\Program Files\FWES\Program\fsdfwd.exe C:\Program Files\Creative\SBAudigy2\DVDAudio\CTDVDDet.EXE C:\WINDOWS\system32\CTHELPER.EXE C:\Program Files\Common\FSM32.EXE C:\Program Files\Logitech\MouseWare\system\em_exec.exe C:\PROGRA~1\ANTI-S~1\fsaw.exe C:\Program Files\Logitech\G-series Software\LCDMon.exe C:\Program Files\FSGUI\ispnews.exe C:\WINDOWS\system32\ctfmon.exe C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe C:\Program Files\Logitech\G-series Software\Applets\LCDMedia.exe C:\Program Files\Logitech\G-series Software\Applets\LCDClock.exe C:\Program Files\Common Files\Microsoft Shared\Works Shared\wkcalrem.exe C:\Program Files\FSGUI\fsguidll.exe C:\Program Files\Internet Explorer\iexplore.exe C:\WINDOWS\system32\cmd.exe »»»»»»»»»»»»»»»»»»»»»»»» hosts »»»»»»»»»»»»»»»»»»»»»»»» C:\ »»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS »»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\system »»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\Web »»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\system32 »»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\system32\LogFiles »»»»»»»»»»»»»»»»»»»»»»»» C:\Documents and Settings\SAMPO LIEHUNEN »»»»»»»»»»»»»»»»»»»»»»»» C:\Documents and Settings\SAMPO LIEHUNEN\Application Data »»»»»»»»»»»»»»»»»»»»»»»» Start Menu C:\DOCUME~1\ALLUSE~1\KYNNIS~1\Online Security Guide.url FOUND ! C:\DOCUME~1\ALLUSE~1\KYNNIS~1\Security Troubleshooting.url FOUND ! »»»»»»»»»»»»»»»»»»»»»»»» C:\DOCUME~1\SAMPOL~1\Suosikit C:\DOCUME~1\SAMPOL~1\Suosikit\Online Security Test.url FOUND ! »»»»»»»»»»»»»»»»»»»»»»»» Desktop C:\DOCUME~1\ALLUSE~1\TYPYT~1\Online Security Guide.url FOUND ! C:\DOCUME~1\ALLUSE~1\TYPYT~1\Security Troubleshooting.url FOUND ! »»»»»»»»»»»»»»»»»»»»»»»» C:\Program Files »»»»»»»»»»»»»»»»»»»»»»»» Corrupted keys »»»»»»»»»»»»»»»»»»»»»»»» Desktop Components [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Desktop\Components\0] "Source"="About:Home" "SubscribedURL"="About:Home" "FriendlyName"="Nykyinen kotisivu" »»»»»»»»»»»»»»»»»»»»»»»» Sharedtaskscheduler !!!Attention, following keys are not inevitably infected!!! SrchSTS.exe by S!Ri Search SharedTaskScheduler's .dll [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler] "{33b8d257-07f6-4c06-8605-94bc21728635}"="discommodiousness" [HKEY_CLASSES_ROOT\CLSID\{33b8d257-07f6-4c06-8605-94bc21728635}\InProcServer32] @="C:\WINDOWS\system32\onljweo.dll" [HKEY_LOCAL_MACHINE\Software\Classes\CLSID\{33b8d257-07f6-4c06-8605-94bc21728635}\InProcServer32] @="C:\WINDOWS\system32\onljweo.dll" »»»»»»»»»»»»»»»»»»»»»»»» AppInit_DLLs !!!Attention, following keys are not inevitably infected!!! [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows] "AppInit_DLLs"="" »»»»»»»»»»»»»»»»»»»»»»»» Winlogon.System !!!Attention, following keys are not inevitably infected!!! [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon] "System"="" »»»»»»»»»»»»»»»»»»»»»»»» Rustock »»»»»»»»»»»»»»»»»»»»»»»» DNS Description: VIA Compatable Fast Ethernet Adapter - Paketinajoituksen miniportti DNS Server Search Order: 193.210.18.18 DNS Server Search Order: 193.210.19.19 HKLM\SYSTEM\CCS\Services\Tcpip\..\{0D465DCB-D5B2-4032-B8C1-4E8AD0A963CC}: DhcpNameServer=193.210.18.18 193.210.19.19 HKLM\SYSTEM\CCS\Services\Tcpip\..\{1713239D-C2C7-411D-ACA6-1439851EB3F2}: DhcpNameServer=193.210.18.18 193.210.19.19 HKLM\SYSTEM\CS1\Services\Tcpip\..\{0D465DCB-D5B2-4032-B8C1-4E8AD0A963CC}: DhcpNameServer=193.210.18.18 193.210.19.19 HKLM\SYSTEM\CS1\Services\Tcpip\..\{1713239D-C2C7-411D-ACA6-1439851EB3F2}: DhcpNameServer=193.210.18.18 193.210.19.19 HKLM\SYSTEM\CS3\Services\Tcpip\..\{0D465DCB-D5B2-4032-B8C1-4E8AD0A963CC}: DhcpNameServer=193.210.18.18 193.210.19.19 HKLM\SYSTEM\CS3\Services\Tcpip\..\{1713239D-C2C7-411D-ACA6-1439851EB3F2}: DhcpNameServer=193.210.18.18 193.210.19.19 HKLM\SYSTEM\CCS\Services\Tcpip\Parameters: DhcpNameServer=193.210.18.18 193.210.19.19 HKLM\SYSTEM\CS1\Services\Tcpip\Parameters: DhcpNameServer=193.210.18.18 193.210.19.19 HKLM\SYSTEM\CS3\Services\Tcpip\Parameters: DhcpNameServer=193.210.18.18 193.210.19.19 »»»»»»»»»»»»»»»»»»»»»»»» Scanning for wininet.dll infection »»»»»»»»»»»»»»»»»»»»»»»» End SmitFraudFix v2.204 Scan done at 20:14:25,20, ma 16.07.2007 Run from C:\Documents and Settings\SAMPO LIEHUNEN\Ty”p”yt„\SmitfraudFix OS: Microsoft Windows XP [versio 5.1.2600] - Windows_NT The filesystem type is NTFS Fix run in safe mode »»»»»»»»»»»»»»»»»»»»»»»» SharedTaskScheduler Before SmitFraudFix !!!Attention, following keys are not inevitably infected!!! SrchSTS.exe by S!Ri Search SharedTaskScheduler's .dll [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler] "{33b8d257-07f6-4c06-8605-94bc21728635}"="discommodiousness" [HKEY_CLASSES_ROOT\CLSID\{33b8d257-07f6-4c06-8605-94bc21728635}\InProcServer32] @="C:\WINDOWS\system32\onljweo.dll" [HKEY_LOCAL_MACHINE\Software\Classes\CLSID\{33b8d257-07f6-4c06-8605-94bc21728635}\InProcServer32] @="C:\WINDOWS\system32\onljweo.dll" »»»»»»»»»»»»»»»»»»»»»»»» Killing process »»»»»»»»»»»»»»»»»»»»»»»» hosts 127.0.0.1 localhost »»»»»»»»»»»»»»»»»»»»»»»» Generic Renos Fix GenericRenosFix by S!Ri C:\WINDOWS\system32\onljweo.dll -> Hoax.Win32.Renos.gen.o C:\WINDOWS\system32\onljweo.dll -> Deleted »»»»»»»»»»»»»»»»»»»»»»»» Deleting infected files C:\DOCUME~1\ALLUSE~1\KYNNIS~1\Online Security Guide.url Deleted C:\DOCUME~1\ALLUSE~1\KYNNIS~1\Security Troubleshooting.url Deleted C:\DOCUME~1\ALLUSE~1\TYPYT~1\Online Security Guide.url Deleted C:\DOCUME~1\ALLUSE~1\TYPYT~1\Security Troubleshooting.url Deleted C:\DOCUME~1\SAMPOL~1\Suosikit\Online Security Test.url Deleted »»»»»»»»»»»»»»»»»»»»»»»» DNS HKLM\SYSTEM\CCS\Services\Tcpip\..\{0D465DCB-D5B2-4032-B8C1-4E8AD0A963CC}: DhcpNameServer=193.210.18.18 193.210.19.19 HKLM\SYSTEM\CCS\Services\Tcpip\..\{1713239D-C2C7-411D-ACA6-1439851EB3F2}: DhcpNameServer=193.210.18.18 193.210.19.19 HKLM\SYSTEM\CS1\Services\Tcpip\..\{0D465DCB-D5B2-4032-B8C1-4E8AD0A963CC}: DhcpNameServer=193.210.18.18 193.210.19.19 HKLM\SYSTEM\CS1\Services\Tcpip\..\{1713239D-C2C7-411D-ACA6-1439851EB3F2}: DhcpNameServer=193.210.18.18 193.210.19.19 HKLM\SYSTEM\CS3\Services\Tcpip\..\{0D465DCB-D5B2-4032-B8C1-4E8AD0A963CC}: DhcpNameServer=193.210.18.18 193.210.19.19 HKLM\SYSTEM\CS3\Services\Tcpip\..\{1713239D-C2C7-411D-ACA6-1439851EB3F2}: DhcpNameServer=193.210.18.18 193.210.19.19 HKLM\SYSTEM\CCS\Services\Tcpip\Parameters: DhcpNameServer=193.210.18.18 193.210.19.19 HKLM\SYSTEM\CS1\Services\Tcpip\Parameters: DhcpNameServer=193.210.18.18 193.210.19.19 HKLM\SYSTEM\CS3\Services\Tcpip\Parameters: DhcpNameServer=193.210.18.18 193.210.19.19 »»»»»»»»»»»»»»»»»»»»»»»» Deleting Temp Files »»»»»»»»»»»»»»»»»»»»»»»» Winlogon.System !!!Attention, following keys are not inevitably infected!!! [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon] "System"="" »»»»»»»»»»»»»»»»»»»»»»»» Registry Cleaning Registry Cleaning done. »»»»»»»»»»»»»»»»»»»»»»»» SharedTaskScheduler After SmitFraudFix !!!Attention, following keys are not inevitably infected!!! SrchSTS.exe by S!Ri Search SharedTaskScheduler's .dll »»»»»»»»»»»»»»»»»»»»»»»» End Logfile of HijackThis v1.99.1 Scan saved at 20:22:45, on 16.7.2007 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\Ati2evxx.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\Ati2evxx.exe C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\Explorer.EXE C:\Program Files\Creative\SBAudigy2\Surround Mixer\CTSysVol.exe C:\Program Files\Creative\SBAudigy2\DVDAudio\CTDVDDet.EXE C:\WINDOWS\system32\CTHELPER.EXE C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe C:\PROGRA~1\backweb\4476822\Program\SERVIC~1.EXE C:\WINDOWS\system32\drivers\CDAC11BA.EXE C:\WINDOWS\System32\CTsvcCDA.exe C:\Program Files\Anti-Virus\fsgk32st.exe C:\Program Files\Anti-Virus\FSGK32.EXE C:\Program Files\backweb\4476822\program\fsbwsys.exe C:\Program Files\Anti-Virus\fssm32.exe C:\Program Files\Common\FSMA32.EXE C:\Program Files\Common\FSMB32.EXE C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe C:\WINDOWS\system32\PnkBstrA.exe C:\Program Files\backweb\4476822\Program\fspex.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\Common\FCH32.EXE C:\Program Files\Anti-Virus\fsqh.exe C:\Program Files\Common\FAMEH32.EXE C:\WINDOWS\system32\UAService7.exe C:\Program Files\Anti-Virus\fsrw.exe C:\Program Files\FSPC\fspc.exe C:\WINDOWS\System32\MsPMSPSv.exe C:\Program Files\Common\FSM32.EXE C:\Program Files\Anti-Virus\fsav32.exe C:\Program Files\QuickTime\qttask.exe C:\Program Files\Logitech\G-series Software\LGDCore.exe C:\Program Files\Logitech\G-series Software\LCDMon.exe C:\Program Files\Logitech\MouseWare\system\em_exec.exe C:\Program Files\FSGUI\ispnews.exe C:\WINDOWS\system32\ctfmon.exe C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe C:\Program Files\Logitech\G-series Software\Applets\LCDMedia.exe E:\sampo 2\steam\steam.exe C:\Program Files\Logitech\G-series Software\Applets\LCDClock.exe C:\Program Files\FWES\Program\fsdfwd.exe C:\Program Files\Common Files\Microsoft Shared\Works Shared\wkcalrem.exe C:\Program Files\WinZip\WZQKPICK.EXE C:\PROGRA~1\ANTI-S~1\fsaw.exe C:\WINDOWS\system32\wuauclt.exe C:\Program Files\FSGUI\fsguidll.exe C:\Program Files\Internet Explorer\iexplore.exe C:\WINDOWS\system32\NOTEPAD.EXE C:\WINDOWS\system32\NOTEPAD.EXE C:\scanner.exe R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = proxy.dial.inet.fi:800 R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = localhost;<local> R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Linkit O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~2\SDHelper.dll O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar3.dll O2 - BHO: (no name) - {E26CEADA-67B0-4543-BE8B-307F00265118} - (no file) O3 - Toolbar: (no name) - {E0E899AB-F487-11D5-8D29-0050BA6940E3} - (no file) O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar3.dll O3 - Toolbar: (no name) - {29C5A3B6-9A8D-4FA0-B5AD-3E20F4AA5C00} - (no file) O4 - HKLM\..\Run: [CTSysVol] C:\Program Files\Creative\SBAudigy2\Surround Mixer\CTSysVol.exe O4 - HKLM\..\Run: [CTDVDDet] C:\Program Files\Creative\SBAudigy2\DVDAudio\CTDVDDet.EXE O4 - HKLM\..\Run: [CTHelper] CTHELPER.EXE O4 - HKLM\..\Run: [AsioReg] REGSVR32.EXE /S CTASIO.DLL O4 - HKLM\..\Run: [SBDrvDet] C:\Program Files\Creative\SB Drive Det\SBDrvDet.exe /r O4 - HKLM\..\Run: [UpdReg] C:\WINDOWS\UpdReg.EXE O4 - HKLM\..\Run: [CTStartup] "C:\Program Files\Creative\Splash Screen\CTEaxSpl.EXE" /run O4 - HKLM\..\Run: [Microsoft Works Update Detection] C:\Program Files\Common Files\Microsoft Shared\Works Shared\WkUFind.exe O4 - HKLM\..\Run: [Logitech Utility] Logi_MwX.Exe O4 - HKLM\..\Run: [F-Secure Manager] "C:\Program Files\Common\FSM32.EXE" /splash O4 - HKLM\..\Run: [F-Secure TNB] "C:\Program Files\TNB\TNBUtil.exe" /CHECKALL /WAITFORSW O4 - HKLM\..\Run: [F-Secure Startup Wizard] "C:\Program Files\FSGUI\FSSW.EXE" /reboot O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime O4 - HKLM\..\Run: [Launch LGDCore] "C:\Program Files\Logitech\G-series Software\LGDCore.exe" /SHOWHIDE O4 - HKLM\..\Run: [Launch LCDMon] "C:\Program Files\Logitech\G-series Software\LCDMon.exe" O4 - HKLM\..\Run: [News Service] "C:\Program Files\FSGUI\ispnews.exe" O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [LDM] C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe O4 - HKCU\..\Run: [StartCCC] C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe O4 - HKCU\..\Run: [Steam] "e:\sampo 2\steam\steam.exe" -silent O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy2\TeaTimer.exe O4 - Startup: Delta Force-Black Hawk Down Team Sabre Registration.lnk = C:\Documents and Settings\SAMPO LIEHUNEN\Local Settings\Temp\{A9CFCD12-81F5-4DDD-B8E7-4A431351084A}\{6164D2E7-986B-42F5-B3A6-64D5E53FB889}\NOVG.EXE O4 - Startup: Joint Operations Typhoon Rising Registration.lnk = C:\Documents and Settings\SAMPO LIEHUNEN\Local Settings\Temp\{93ACF26A-0C69-4F13-8197-3843D07A33D9}\{0325F1C1-883A-41AB-8981-B27359ABDFAF}\NOVG.EXE O4 - Startup: PowerReg Scheduler V3.exe O4 - Startup: PowerReg Scheduler.exe O4 - Global Startup: F-Secure 2006.lnk = C:\Program Files\backweb\4476822\Program\fspex.exe O4 - Global Startup: Logitech Desktop Messenger.lnk = C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE O4 - Global Startup: Microsoft Works Calendar Reminders.lnk = ? O4 - Global Startup: WinZip Quick Pick.lnk = C:\Program Files\WinZip\WZQKPICK.EXE O8 - Extra context menu item: &Estä tämä kohoikkuna - C:\Program Files\Anti-Spyware\blockpopups.htm O8 - Extra context menu item: &Google Search - res://c:\program files\google\GoogleToolbar3.dll/cmsearch.html O8 - Extra context menu item: &Translate English Word - res://c:\program files\google\GoogleToolbar3.dll/cmwordtrans.html O8 - Extra context menu item: Backward Links - res://c:\program files\google\GoogleToolbar3.dll/cmbacklinks.html O8 - Extra context menu item: Cached Snapshot of Page - res://c:\program files\google\GoogleToolbar3.dll/cmcache.html O8 - Extra context menu item: Similar Pages - res://c:\program files\google\GoogleToolbar3.dll/cmsimilar.html O8 - Extra context menu item: Translate Page into English - res://c:\program files\google\GoogleToolbar3.dll/cmtrans.html O9 - Extra button: Web-suodatin - {200DB664-75B5-47c0-8B45-A44ACCF73C00} - C:\Program Files\FSPC\fspcmsie.dll O9 - Extra button: (no name) - {200DB664-75B5-47c0-8B45-A44ACCF73F01} - C:\Program Files\FSPC\fspcmsie.dll O9 - Extra 'Tools' menuitem: Web-suodatin - {200DB664-75B5-47c0-8B45-A44ACCF73F01} - C:\Program Files\FSPC\fspcmsie.dll O9 - Extra button: (no name) - {200DB664-75B5-47c0-8B45-A44ACCF73F02} - C:\Program Files\FSPC\fspcmsie.dll O9 - Extra 'Tools' menuitem: &Keskeytä Web-sivujen suodatus - {200DB664-75B5-47c0-8B45-A44ACCF73F02} - C:\Program Files\FSPC\fspcmsie.dll O9 - Extra button: (no name) - {200DB664-75B5-47c0-8B45-A44ACCF73F03} - C:\Program Files\FSPC\fspcmsie.dll O9 - Extra 'Tools' menuitem: &Kiellä tämä Web-sivusto - {200DB664-75B5-47c0-8B45-A44ACCF73F03} - C:\Program Files\FSPC\fspcmsie.dll O9 - Extra button: (no name) - {200DB664-75B5-47c0-8B45-A44ACCF73F04} - C:\Program Files\FSPC\fspcmsie.dll O9 - Extra 'Tools' menuitem: &Salli tämä Web-sivusto - {200DB664-75B5-47c0-8B45-A44ACCF73F04} - C:\Program Files\FSPC\fspcmsie.dll O9 - Extra button: IE-suojaus - {300DB664-75B5-47c0-8B45-A44ACCF73C00} - C:\Program Files\Anti-Spyware\ieshield.dll O9 - Extra 'Tools' menuitem: IE-suojaus... - {300DB664-75B5-47c0-8B45-A44ACCF73C00} - C:\Program Files\Anti-Spyware\ieshield.dll O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~2\SDHelper.dll O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~2\SDHelper.dll O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing) O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing) O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O10 - Broken Internet access because of LSP provider 'winsflt.dll' missing O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll O16 - DPF: {0CBF7EDC-17EC-442C-8AE9-5E804707B6CA} (NeffyClient Class) - http://dist.cdnetworks.co.jp/cdndist/neffy/Neffy.cab O16 - DPF: {15AD6789-CDB4-47E1-A9DA-992EE8E6BAD6} - http://static.windupdates.com/cab/CDT/ie/bridge-c18.cab O16 - DPF: {31B7EB4E-8B4B-11D1-A789-00A0CC6651A8} (Cult3D ActiveX Player) - http://www.cult3d.com/download/cult.cab O16 - DPF: {39B0684F-D7BF-4743-B050-FDC3F48F7E3B} (FilePlanet Download Control Class) - http://www.fileplanet.com/fpdlmgr/cabs/FPDC_1_0_0_44.cab O16 - DPF: {68BCE50A-DC9B-4519-A118-6FDA19DB450D} (Info Class) - http://support.vugames.com/betasubmission/sysinfo/Si.cab O16 - DPF: {70BA88C8-DAE8-4CE9-92BB-979C4A75F53B} (GSDACtl Class) - http://launch.gamespyarcade.com/software/launch/alaunch.cab O16 - DPF: {917623D1-D8E5-11D2-BE8B-00104B06BDE3} (CamImage Class) - http://62.197.172.28:8088/activex/AxisCamControl.cab O16 - DPF: {F58E1CEF-A068-4C15-BA5E-587CAF3EE8C6} (MSN Chat Control 4.5) - http://fdl.msn.com/public/chat/msnchat45.cab O16 - DPF: {FE5D6722-826F-11D5-A24E-0060B0F1A5AE} (Tukati Launcher) - http://http.gamezone.tukati.com/tukati/1.7.20.20/tukati.cab O18 - Protocol: bwfile-8876480 - {9462A756-7B47-47BC-8C80-C34B9B80B32B} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\GAPlugProtocol-8876480.dll O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft AB - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe O23 - Service: F-Secure 2006 (BackWeb Plug-in - 4476822) - F-Secure Internet Security 2005 - C:\PROGRA~1\backweb\4476822\Program\SERVIC~1.EXE O23 - Service: C-DillaCdaC11BA - Macrovision - C:\WINDOWS\system32\drivers\CDAC11BA.EXE O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\System32\CTsvcCDA.exe O23 - Service: F-Secure Gatekeeper Handler Starter - F-Secure Corporation - C:\Program Files\Anti-Virus\fsgk32st.exe O23 - Service: fsbwsys - F-Secure Corp. - C:\Program Files\backweb\4476822\program\fsbwsys.exe O23 - Service: F-Secure Anti-Virus Firewall Daemon (FSDFWD) - F-Secure Corporation - C:\Program Files\FWES\Program\fsdfwd.exe O23 - Service: F-Secure HTTP Server (fshttps) - F-Secure Corporation - C:\Program Files\FSPC\fshttps\fshttps.exe O23 - Service: FSMA - F-Secure Corporation - C:\Program Files\Common\FSMA32.EXE O23 - Service: iPod-palvelu (iPodService) - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\system32\PnkBstrA.exe O23 - Service: SecuROM User Access Service (V7) (UserAccess7) - Unknown owner - C:\WINDOWS\system32\UAService7.exe O23 - Service: Webcam Corp. Service Starter - Unknown owner - E:\Sampo 3\NetCam Center SCE\dogsvc.exe (file missing)
roskaa viel 1. Lataa combofix.exe työpöydällesi jommastakummasta linkistä: http://www.techsupportforum.com/sectools/sUBs/ComboFix.exe http://download.bleepingcomputer.com/sUBs/ComboFix.exe 2. Tuplaklikkaa combofix.exe tiedostoa ja seuraa ohjeistuksia. 3. Kun työkalu on valmis, se tuottaa lokin. (C:\ComboFix.txt) Lähetä tämä loki viesti ketjuusi. Huom! Älä klikkaile combofixin ikkunaa käytön aikana. Tämä saattaa aiheuttaa ohjelman jumiutumisen.
"SAMPO LIEHUNEN" - 2007-07-16 21:18:20 - ComboFix 07-07-13.8 - Service Pack 2 NTFS ((((((((((((((((((((((((( Files Created from 2007-06-16 to 2007-07-16 ))))))))))))))))))))))))))))))) 2007-07-16 21:17 51,200 --a------ C:\WINDOWS\nircmd.exe 2007-07-16 21:17 1,168,935 --a------ C:\ComboFix.exe 2007-07-16 20:01 3,304 --a------ C:\WINDOWS\system32\tmp.reg 2007-07-16 20:00 53,248 --a------ C:\WINDOWS\system32\Process.exe 2007-07-16 20:00 51,200 --a------ C:\WINDOWS\system32\dumphive.exe 2007-07-16 20:00 288,417 --a------ C:\WINDOWS\system32\SrchSTS.exe 2007-07-16 19:59 885,013 --a------ C:\SmitfraudFix.exe 2007-07-16 18:56 218,112 --a------ C:\scanner.exe 2007-07-16 18:14 11,264 --a------ C:\WINDOWS\system32\iesplg.dll 2007-07-16 17:56 <KANSIO> d-------- C:\Program Files\Spybot - Search & Destroy2 2007-07-15 22:22 <KANSIO> d-------- C:\DOCUME~1\ALLUSE~1\APPLIC~1\Lavasoft 2007-07-13 22:31 53,248 --a------ C:\WINDOWS\system32\apache.dll (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) 2007-07-16 17:18:11 -------- d-----w C:\Program Files\Anti-Virus 2007-07-16 17:11:03 288 ----a-w C:\WINDOWS\system32\DVCStateBkp-{00000000-00000000-0000000B-00001102-00000004-10021102}.dat 2007-07-16 17:11:03 288 ----a-w C:\WINDOWS\system32\DVCState-{00000000-00000000-0000000B-00001102-00000004-10021102}.dat 2007-07-15 20:02:19 10,646 --sha-w C:\WINDOWS\system32\KGyGaAvL.sys 2007-07-15 19:22:58 -------- d-----w C:\Program Files\Lavasoft 2007-07-15 19:22:14 -------- d-----w C:\Program Files\Common Files\Wise Installation Wizard 2007-07-11 11:07:55 79,230 ----a-w C:\WINDOWS\system32\perfc00B.dat 2007-07-11 11:07:55 384,308 ----a-w C:\WINDOWS\system32\perfh00B.dat 2007-07-10 11:39:55 -------- d-----w C:\Program Files\Anti-Spyware 2007-07-07 12:38:41 -------- d-----w C:\Program Files\LimeWire 2007-07-03 19:40:15 -------- d--h--w C:\Program Files\InstallShield Installation Information 2007-06-26 20:10:26 -------- d-----w C:\Program Files\Game spy 2007-06-25 18:26:14 63,040 ----a-w C:\WINDOWS\system32\PnkBstrA.exe 2007-06-25 18:26:14 22,584 ----a-w C:\WINDOWS\system32\drivers\PnkBstrK.sys 2007-06-25 18:26:07 99,904 ----a-w C:\WINDOWS\system32\PnkBstrB.exe 2007-06-04 12:18:48 9,344 ----a-w C:\WINDOWS\system32\drivers\NSDriver.sys 2007-06-04 12:18:22 -------- d-----w C:\Program Files\NCSoft 2007-06-04 12:17:45 -------- d-----w C:\DOCUME~1\SAMPOL~1\APPLIC~1\InstallShield 2007-06-04 12:17:02 8,320 ----a-w C:\WINDOWS\system32\drivers\AWRTRD.sys 2007-06-04 12:14:56 6,272 ----a-w C:\WINDOWS\system32\drivers\AWRTPD.sys 2007-06-04 12:06:25 -------- d-----w C:\DOCUME~1\SAMPOL~1\APPLIC~1\GetRightToGo 2007-05-22 15:45:37 -------- d-----w C:\Program Files\Neffy 2007-05-16 15:14:02 683,520 ----a-w C:\WINDOWS\system32\inetcomm.dll 2007-04-28 13:48:39 86,016 ----a-w C:\WINDOWS\system32\OpenAL32.dll 2007-04-28 13:48:39 262,144 ----a-w C:\WINDOWS\system32\wrap_oal.dll 2007-04-25 14:22:38 144,896 ----a-w C:\WINDOWS\system32\schannel.dll 2007-04-18 16:14:18 2,854,400 ----a-w C:\WINDOWS\system32\msi.dll 2007-04-16 19:47:36 33,624 ----a-w C:\WINDOWS\system32\wups.dll 2007-04-16 19:45:54 1,710,936 ----a-w C:\WINDOWS\system32\wuaueng.dll 2007-04-16 19:45:48 549,720 ----a-w C:\WINDOWS\system32\wuapi.dll 2007-04-16 19:45:42 325,976 ----a-w C:\WINDOWS\system32\wucltui.dll 2007-04-16 19:45:36 203,096 ----a-w C:\WINDOWS\system32\wuweb.dll 2007-04-16 19:45:28 92,504 ----a-w C:\WINDOWS\system32\cdm.dll 2007-04-16 19:45:20 53,080 ----a-w C:\WINDOWS\system32\wuauclt.exe 2007-04-16 19:45:20 43,352 ----a-w C:\WINDOWS\system32\wups2.dll 2006-10-21 16:21:07 1,525 ----a-w C:\Program Files\install.ini 2006-10-21 16:20:04 229,376 ----a-w C:\Program Files\fsisu.dll 2006-10-21 16:20:02 135,168 ----a-w C:\Program Files\fsisuNT.dll 2006-10-21 14:27:59 16,990 ----a-w C:\Program Files\config.xml.P00000444 2006-10-21 13:48:05 4,443 ----a-w C:\Program Files\fssg.xml.P00000444 2006-10-21 13:48:00 16,986 ----a-w C:\Program Files\config.xml.P00000444.fssg 2005-05-31 01:26:02 106,496 ----a-w C:\Program Files\fsuninst.FIN 2005-05-31 01:25:58 126,976 ----a-w C:\Program Files\fsuninst.ENG 2005-05-31 01:21:20 360,448 ----a-w C:\Program Files\fsuninst.exe 2005-05-31 01:16:54 151,552 ----a-w C:\Program Files\fsdeph.dll 2005-04-28 14:00:36 94,258 ----a-w C:\Program Files\fsld32.dll 2005-03-13 20:12:49 55,896 ----a-w C:\DOCUME~1\SAMPOL~1\APPLIC~1\GDIPFONTCACHEV1.DAT 2005-01-11 12:46:48 3,758,356 ----a-w C:\Program Files\tugzip32.exe 2005-01-07 21:33:10 186,683,855 ----a-w C:\Program Files\3DMark03.exe 2005-01-07 21:14:53 5,528,436 ----a-w C:\Program Files\3DMark03_Patch340.exe 2004-12-29 12:14:17 144,042 ----a-w C:\Program Files\CoreVorbis_1.0_20040823.exe 2004-12-29 12:05:57 144,528 ----a-w C:\Program Files\osoggsplitter03302004.exe 2004-12-28 21:43:19 7,071,334 ----a-w C:\Program Files\vlc-0.8.1-win32.exe 2004-11-30 13:59:22 1,331,581 ----a-w C:\Program Files\scummvm-0.6.1b-win32.exe 2004-11-20 21:33:31 297,149,776 ----a-w C:\Program Files\3DMark05_v100_installer.exe 2004-08-15 15:13:10 8,046,472 ----a-w C:\Program Files\DivX52XP2K.exe 2004-08-13 18:33:13 30,247,476 ----a-w C:\Program Files\wxp-w2k-catalyst-8-03-040610a-016126c.exe 2004-08-05 21:04:52 1,009,842 ----a-w C:\Program Files\wrar320fi.exe 2005-04-28 14:06:01 205 --sh--r C:\WINDOWS\system32\nulware.exe ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) *Note* empty entries & legit default entries are not shown [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}] 2003-11-03 15:17 54248 --a------ C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{53707962-6F74-2D53-2644-206D7942484F}] 2007-07-10 21:47 1098576 --a------ C:\PROGRA~1\SPYBOT~2\SDHelper.dll [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{AA58ED58-01DD-4d91-8333-CF10577473F7}] 2006-02-14 20:05 1191424 -ra------ c:\program files\google\googletoolbar3.dll [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{E26CEADA-67B0-4543-BE8B-307F00265118}] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "CTSysVol"="C:\Program Files\Creative\SBAudigy2\Surround Mixer\CTSysVol.exe" [2002-10-29 09:18] "CTDVDDet"="C:\Program Files\Creative\SBAudigy2\DVDAudio\CTDVDDet.EXE" [2002-09-30 01:00] "CTHelper"="CTHELPER.EXE" [2002-12-19 09:59 C:\WINDOWS\system32\CTHELPER.EXE] "AsioReg"="REGSVR32.exe" [2004-09-14 16:12 C:\WINDOWS\system32\regsvr32.exe] "SBDrvDet"="C:\Program Files\Creative\SB Drive Det\SBDrvDet.exe" [2002-12-03 18:06] "CTStartup"="C:\Program Files\Creative\Splash Screen\CTEaxSpl.exe" [2002-09-13 01:04] "Microsoft Works Update Detection"="C:\Program Files\Common Files\Microsoft Shared\Works Shared\WkUFind.exe" [2001-08-17 06:41] "Logitech Utility"="Logi_MwX.Exe" [2003-03-04 12:50 C:\WINDOWS\LOGI_MWX.EXE] "F-Secure Manager"="C:\Program Files\Common\FSM32.exe" [2005-10-26 04:51] "F-Secure TNB"="C:\Program Files\TNB\TNBUtil.exe" [2005-07-18 17:51] "F-Secure Startup Wizard"="C:\Program Files\FSGUI\FSSW.exe" [2005-10-18 11:29] "QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2005-02-10 15:10] "Launch LGDCore"="C:\Program Files\Logitech\G-series Software\LGDCore.exe" [2005-11-02 18:56] "Launch LCDMon"="C:\Program Files\Logitech\G-series Software\LCDMon.exe" [2005-11-02 18:42] "News Service"="C:\Program Files\FSGUI\ispnews.exe" [2005-05-31 15:45] [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="C:\WINDOWS\system32\ctfmon.exe" [2004-09-14 16:12] "LDM"="C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe" [2007-02-23 13:38] "@"="" [] "StartCCC"="C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2006-11-10 13:35] "Steam"="e:\sampo 2\steam\steam.exe" [2007-06-28 02:36] "SpybotSD TeaTimer"="C:\Program Files\Spybot - Search & Destroy2\TeaTimer.exe" [2007-07-10 21:47] [HKEY_USERS\.default\software\microsoft\windows\currentversion\run] "Schmaili"=C:\PELIT\smaili\Schmaili.exe [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer] @= "SED-S2"=48931442489314420100000001000000 [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer] "SED-S2"=48931442489314420100000001000000 [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\minimal\aawservice] [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{0fa1d828-8261-11d9-ac03-000c6e193233}] AutoRun\command- F:\setup.exe [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{1aea9902-6a4c-11d9-abd9-000c6e193233}] AutoRun\command- D:\Autorun.exe [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{a56c1c72-a868-11d9-ac50-000c6e193233}] AutoRun\command- G:\setup.exe [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{b6327829-9751-11d7-a399-806d6172696f}] AutoRun\command- D:\FarCryAutoCD.exe [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{e654e6d0-77b5-11d9-abef-000c6e193233}] AutoRun\command- F:\Launch.exe HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\ccc-core-static msiexec /fums {3CBBEE47-C8F4-316A-92FF-ED7E3DFAE41E} /qb ************************************************************************** catchme 0.3.915 W2K/XP/Vista - rootkit detector by Gmer, http://www.gmer.net Rootkit scan 2007-07-16 21:23:02 Windows 5.1.2600 Service Pack 2 NTFS scanning hidden processes ... scanning hidden autostart entries ... HKLM\Software\Microsoft\Windows\CurrentVersion\Run CTStartup = "C:\Program Files\Creative\Splash Screen\CTEaxSpl.EXE" /run?Z?6~d???*?6~?????????0??????h?@?x?????7~D??????sx??s?|??????y??w????@@@????|D@@?????>??w?????97?H??????|???|???????|L(?s?97??????/?s????????D???????????????????,????????????+?s@@@?D???`|?w??????@ scanning hidden files ... scan completed successfully hidden files: 0 ************************************************************************** Completion time: 2007-07-16 21:23:53 --- E O F ---
Avaa Notepad ja kopioi/liitä allaolevassa lainausboxissa oleva teksti sinne: Tallenna se nimellä CFScript. (Tarkista että on juuri noin kirjoitettu) Sitten raahaa CFScript ComboFix.exeen kuten alla. Käynnistä tietokone uudelleen pyydettäessä ja lähetä combofix.txt-tiedoston sisältö tänne. ======== Avaa hijackthis merkkaa seuraavat rivi(t) ja paina fix checked, sulje muut ohjelmat siksi aikaa. O2 - BHO: (no name) - {E26CEADA-67B0-4543-BE8B-307F00265118} - (no file) O3 - Toolbar: (no name) - {29C5A3B6-9A8D-4FA0-B5AD-3E20F4AA5C00} - (no file) O4 - Startup: Delta Force-Black Hawk Down Team Sabre Registration.lnk = C:\Documents and Settings\SAMPO LIEHUNEN\Local Settings\Temp\{A9CFCD12-81F5-4DDD-B8E7-4A431351084A}\{6164D2E7-986B-42F5-B3A6-64 D5E53FB889}\NOVG.EXE O4 - Startup: Joint Operations Typhoon Rising Registration.lnk = C:\Documents and Settings\SAMPO LIEHUNEN\Local Settings\Temp\{93ACF26A-0C69-4F13-8197-3843D07A33D9}\{0325F1C1-883A-41AB-8981-B2 7359ABDFAF}\NOVG.EXE O4 - Startup: PowerReg Scheduler V3.exe O4 - Startup: PowerReg Scheduler.exe O16 - DPF: {15AD6789-CDB4-47E1-A9DA-992EE8E6BAD6} - http://static.windupdates.com/cab/CDT/ie/bridge-c18.cab ======= myös uusi hjtlogi Tässä ohje miten merkataan:
"SAMPO LIEHUNEN" - 2007-07-16 22:13:17 - ComboFix 07-07-13.8 - Service Pack 2 NTFS Command switches used :: C:\CFScript.txt ((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) C:\WINDOWS\system32\iesplg.dll ((((((((((((((((((((((((( Files Created from 2007-06-16 to 2007-07-16 ))))))))))))))))))))))))))))))) 2007-07-16 21:17 51,200 --a------ C:\WINDOWS\nircmd.exe 2007-07-16 21:17 1,168,935 --a------ C:\ComboFix.exe 2007-07-16 20:01 3,304 --a------ C:\WINDOWS\system32\tmp.reg 2007-07-16 20:00 53,248 --a------ C:\WINDOWS\system32\Process.exe 2007-07-16 20:00 51,200 --a------ C:\WINDOWS\system32\dumphive.exe 2007-07-16 20:00 288,417 --a------ C:\WINDOWS\system32\SrchSTS.exe 2007-07-16 19:59 885,013 --a------ C:\SmitfraudFix.exe 2007-07-16 18:56 218,112 --a------ C:\scanner.exe 2007-07-16 17:56 <KANSIO> d-------- C:\Program Files\Spybot - Search & Destroy2 2007-07-15 22:22 <KANSIO> d-------- C:\DOCUME~1\ALLUSE~1\APPLIC~1\Lavasoft 2007-07-13 22:31 53,248 --a------ C:\WINDOWS\system32\apache.dll (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) 2007-07-16 17:18:11 -------- d-----w C:\Program Files\Anti-Virus 2007-07-16 17:11:03 288 ----a-w C:\WINDOWS\system32\DVCStateBkp-{00000000-00000000-0000000B-00001102-00000004-10021102}.dat 2007-07-16 17:11:03 288 ----a-w C:\WINDOWS\system32\DVCState-{00000000-00000000-0000000B-00001102-00000004-10021102}.dat 2007-07-15 20:02:19 10,646 --sha-w C:\WINDOWS\system32\KGyGaAvL.sys 2007-07-15 19:22:58 -------- d-----w C:\Program Files\Lavasoft 2007-07-15 19:22:14 -------- d-----w C:\Program Files\Common Files\Wise Installation Wizard 2007-07-11 11:07:55 79,230 ----a-w C:\WINDOWS\system32\perfc00B.dat 2007-07-11 11:07:55 384,308 ----a-w C:\WINDOWS\system32\perfh00B.dat 2007-07-10 11:39:55 -------- d-----w C:\Program Files\Anti-Spyware 2007-07-07 12:38:41 -------- d-----w C:\Program Files\LimeWire 2007-07-03 19:40:15 -------- d--h--w C:\Program Files\InstallShield Installation Information 2007-06-26 20:10:26 -------- d-----w C:\Program Files\Game spy 2007-06-25 18:26:14 63,040 ----a-w C:\WINDOWS\system32\PnkBstrA.exe 2007-06-25 18:26:14 22,584 ----a-w C:\WINDOWS\system32\drivers\PnkBstrK.sys 2007-06-25 18:26:07 99,904 ----a-w C:\WINDOWS\system32\PnkBstrB.exe 2007-06-04 12:18:48 9,344 ----a-w C:\WINDOWS\system32\drivers\NSDriver.sys 2007-06-04 12:18:22 -------- d-----w C:\Program Files\NCSoft 2007-06-04 12:17:45 -------- d-----w C:\DOCUME~1\SAMPOL~1\APPLIC~1\InstallShield 2007-06-04 12:17:02 8,320 ----a-w C:\WINDOWS\system32\drivers\AWRTRD.sys 2007-06-04 12:14:56 6,272 ----a-w C:\WINDOWS\system32\drivers\AWRTPD.sys 2007-06-04 12:06:25 -------- d-----w C:\DOCUME~1\SAMPOL~1\APPLIC~1\GetRightToGo 2007-05-22 15:45:37 -------- d-----w C:\Program Files\Neffy 2007-05-16 15:14:02 683,520 ----a-w C:\WINDOWS\system32\inetcomm.dll 2007-04-28 13:48:39 86,016 ----a-w C:\WINDOWS\system32\OpenAL32.dll 2007-04-28 13:48:39 262,144 ----a-w C:\WINDOWS\system32\wrap_oal.dll 2007-04-25 14:22:38 144,896 ----a-w C:\WINDOWS\system32\schannel.dll 2007-04-18 16:14:18 2,854,400 ----a-w C:\WINDOWS\system32\msi.dll 2007-04-16 19:47:36 33,624 ----a-w C:\WINDOWS\system32\wups.dll 2007-04-16 19:45:54 1,710,936 ----a-w C:\WINDOWS\system32\wuaueng.dll 2007-04-16 19:45:48 549,720 ----a-w C:\WINDOWS\system32\wuapi.dll 2007-04-16 19:45:42 325,976 ----a-w C:\WINDOWS\system32\wucltui.dll 2007-04-16 19:45:36 203,096 ----a-w C:\WINDOWS\system32\wuweb.dll 2007-04-16 19:45:28 92,504 ----a-w C:\WINDOWS\system32\cdm.dll 2007-04-16 19:45:20 53,080 ----a-w C:\WINDOWS\system32\wuauclt.exe 2007-04-16 19:45:20 43,352 ----a-w C:\WINDOWS\system32\wups2.dll 2006-10-21 16:21:07 1,525 ----a-w C:\Program Files\install.ini 2006-10-21 16:20:04 229,376 ----a-w C:\Program Files\fsisu.dll 2006-10-21 16:20:02 135,168 ----a-w C:\Program Files\fsisuNT.dll 2006-10-21 14:27:59 16,990 ----a-w C:\Program Files\config.xml.P00000444 2006-10-21 13:48:05 4,443 ----a-w C:\Program Files\fssg.xml.P00000444 2006-10-21 13:48:00 16,986 ----a-w C:\Program Files\config.xml.P00000444.fssg 2005-05-31 01:26:02 106,496 ----a-w C:\Program Files\fsuninst.FIN 2005-05-31 01:25:58 126,976 ----a-w C:\Program Files\fsuninst.ENG 2005-05-31 01:21:20 360,448 ----a-w C:\Program Files\fsuninst.exe 2005-05-31 01:16:54 151,552 ----a-w C:\Program Files\fsdeph.dll 2005-04-28 14:00:36 94,258 ----a-w C:\Program Files\fsld32.dll 2005-03-13 20:12:49 55,896 ----a-w C:\DOCUME~1\SAMPOL~1\APPLIC~1\GDIPFONTCACHEV1.DAT 2005-01-11 12:46:48 3,758,356 ----a-w C:\Program Files\tugzip32.exe 2005-01-07 21:33:10 186,683,855 ----a-w C:\Program Files\3DMark03.exe 2005-01-07 21:14:53 5,528,436 ----a-w C:\Program Files\3DMark03_Patch340.exe 2004-12-29 12:14:17 144,042 ----a-w C:\Program Files\CoreVorbis_1.0_20040823.exe 2004-12-29 12:05:57 144,528 ----a-w C:\Program Files\osoggsplitter03302004.exe 2004-12-28 21:43:19 7,071,334 ----a-w C:\Program Files\vlc-0.8.1-win32.exe 2004-11-30 13:59:22 1,331,581 ----a-w C:\Program Files\scummvm-0.6.1b-win32.exe 2004-11-20 21:33:31 297,149,776 ----a-w C:\Program Files\3DMark05_v100_installer.exe 2004-08-15 15:13:10 8,046,472 ----a-w C:\Program Files\DivX52XP2K.exe 2004-08-13 18:33:13 30,247,476 ----a-w C:\Program Files\wxp-w2k-catalyst-8-03-040610a-016126c.exe 2004-08-05 21:04:52 1,009,842 ----a-w C:\Program Files\wrar320fi.exe 2005-04-28 14:06:01 205 --sh--r C:\WINDOWS\system32\nulware.exe ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) *Note* empty entries & legit default entries are not shown [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}] 2003-11-03 15:17 54248 --a------ C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{53707962-6F74-2D53-2644-206D7942484F}] 2007-07-10 21:47 1098576 --a------ C:\PROGRA~1\SPYBOT~2\SDHelper.dll [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{AA58ED58-01DD-4d91-8333-CF10577473F7}] 2006-02-14 20:05 1191424 -ra------ c:\program files\google\googletoolbar3.dll [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{E26CEADA-67B0-4543-BE8B-307F00265118}] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "CTSysVol"="C:\Program Files\Creative\SBAudigy2\Surround Mixer\CTSysVol.exe" [2002-10-29 09:18] "CTDVDDet"="C:\Program Files\Creative\SBAudigy2\DVDAudio\CTDVDDet.EXE" [2002-09-30 01:00] "CTHelper"="CTHELPER.EXE" [2002-12-19 09:59 C:\WINDOWS\system32\CTHELPER.EXE] "AsioReg"="REGSVR32.exe" [2004-09-14 16:12 C:\WINDOWS\system32\regsvr32.exe] "SBDrvDet"="C:\Program Files\Creative\SB Drive Det\SBDrvDet.exe" [2002-12-03 18:06] "CTStartup"="C:\Program Files\Creative\Splash Screen\CTEaxSpl.exe" [2002-09-13 01:04] "Microsoft Works Update Detection"="C:\Program Files\Common Files\Microsoft Shared\Works Shared\WkUFind.exe" [2001-08-17 06:41] "Logitech Utility"="Logi_MwX.Exe" [2003-03-04 12:50 C:\WINDOWS\LOGI_MWX.EXE] "F-Secure Manager"="C:\Program Files\Common\FSM32.exe" [2005-10-26 04:51] "F-Secure TNB"="C:\Program Files\TNB\TNBUtil.exe" [2005-07-18 17:51] "F-Secure Startup Wizard"="C:\Program Files\FSGUI\FSSW.exe" [2005-10-18 11:29] "QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2005-02-10 15:10] "Launch LGDCore"="C:\Program Files\Logitech\G-series Software\LGDCore.exe" [2005-11-02 18:56] "Launch LCDMon"="C:\Program Files\Logitech\G-series Software\LCDMon.exe" [2005-11-02 18:42] "News Service"="C:\Program Files\FSGUI\ispnews.exe" [2005-05-31 15:45] [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="C:\WINDOWS\system32\ctfmon.exe" [2004-09-14 16:12] "LDM"="C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe" [2007-02-23 13:38] "@"="" [] "StartCCC"="C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2006-11-10 13:35] "Steam"="e:\sampo 2\steam\steam.exe" [2007-06-28 02:36] "SpybotSD TeaTimer"="C:\Program Files\Spybot - Search & Destroy2\TeaTimer.exe" [2007-07-10 21:47] [HKEY_USERS\.default\software\microsoft\windows\currentversion\run] "Schmaili"=C:\PELIT\smaili\Schmaili.exe [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer] @= "SED-S2"=48931442489314420100000001000000 [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer] "SED-S2"=48931442489314420100000001000000 [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\minimal\aawservice] [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{b6327829-9751-11d7-a399-806d6172696f}] AutoRun\command- D:\FarCryAutoCD.exe [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{e654e6d0-77b5-11d9-abef-000c6e193233}] AutoRun\command- F:\Launch.exe *Newly Created Service* - CATCHME HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\ccc-core-static msiexec /fums {3CBBEE47-C8F4-316A-92FF-ED7E3DFAE41E} /qb ************************************************************************** catchme 0.3.915 W2K/XP/Vista - rootkit detector by Gmer, http://www.gmer.net Rootkit scan 2007-07-16 22:15:04 Windows 5.1.2600 Service Pack 2 NTFS scanning hidden processes ... scanning hidden autostart entries ... HKLM\Software\Microsoft\Windows\CurrentVersion\Run CTStartup = "C:\Program Files\Creative\Splash Screen\CTEaxSpl.EXE" /run?Z?6~d???*?6~?????????0??????h?@?x?????7~D??????sx??s?|??????y??w????@@@????|D@@?????>??w?????97?H??????|???|???????|L(?s?97??????/?s????????D???????????????????,????????????+?s@@@?D???`|?w??????@ scanning hidden files ... scan completed successfully hidden files: 0 ************************************************************************** Completion time: 2007-07-16 22:16:05 C:\ComboFix-quarantined-files.txt ... 2007-07-16 22:15 --- E O F --- Logfile of HijackThis v1.99.1 Scan saved at 22:26:35, on 16.7.2007 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\Ati2evxx.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\Ati2evxx.exe C:\WINDOWS\system32\spoolsv.exe C:\Program Files\Creative\SBAudigy2\DVDAudio\CTDVDDet.EXE C:\WINDOWS\system32\CTHELPER.EXE C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe C:\PROGRA~1\backweb\4476822\Program\SERVIC~1.EXE C:\WINDOWS\system32\drivers\CDAC11BA.EXE C:\WINDOWS\System32\CTsvcCDA.exe C:\Program Files\Anti-Virus\fsgk32st.exe C:\Program Files\Anti-Virus\FSGK32.EXE C:\Program Files\backweb\4476822\program\fsbwsys.exe C:\Program Files\Anti-Virus\fssm32.exe C:\Program Files\Common\FSMA32.EXE C:\Program Files\Common\FSMB32.EXE C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe C:\WINDOWS\system32\PnkBstrA.exe C:\Program Files\backweb\4476822\Program\fspex.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\Common\FCH32.EXE C:\Program Files\Anti-Virus\fsqh.exe C:\Program Files\Common\FAMEH32.EXE C:\WINDOWS\system32\UAService7.exe C:\Program Files\Anti-Virus\fsrw.exe C:\Program Files\FSPC\fspc.exe C:\WINDOWS\System32\MsPMSPSv.exe C:\Program Files\Common\FSM32.EXE C:\Program Files\Anti-Virus\fsav32.exe C:\Program Files\QuickTime\qttask.exe C:\Program Files\Logitech\G-series Software\LCDMon.exe C:\Program Files\Logitech\MouseWare\system\em_exec.exe C:\Program Files\FSGUI\ispnews.exe C:\WINDOWS\system32\ctfmon.exe C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe C:\Program Files\Logitech\G-series Software\Applets\LCDMedia.exe C:\Program Files\Logitech\G-series Software\Applets\LCDClock.exe C:\Program Files\FWES\Program\fsdfwd.exe C:\Program Files\Common Files\Microsoft Shared\Works Shared\wkcalrem.exe C:\PROGRA~1\ANTI-S~1\fsaw.exe C:\Program Files\FSGUI\fsguidll.exe C:\WINDOWS\explorer.exe C:\Program Files\Internet Explorer\iexplore.exe C:\scanner.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://plaza.fi/ R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = proxy.dial.inet.fi:800 R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = localhost;<local> R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Linkit O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~2\SDHelper.dll O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar3.dll O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar3.dll O4 - HKLM\..\Run: [CTSysVol] C:\Program Files\Creative\SBAudigy2\Surround Mixer\CTSysVol.exe O4 - HKLM\..\Run: [CTDVDDet] C:\Program Files\Creative\SBAudigy2\DVDAudio\CTDVDDet.EXE O4 - HKLM\..\Run: [CTHelper] CTHELPER.EXE O4 - HKLM\..\Run: [AsioReg] REGSVR32.EXE /S CTASIO.DLL O4 - HKLM\..\Run: [SBDrvDet] C:\Program Files\Creative\SB Drive Det\SBDrvDet.exe /r O4 - HKLM\..\Run: [CTStartup] "C:\Program Files\Creative\Splash Screen\CTEaxSpl.EXE" /run O4 - HKLM\..\Run: [Microsoft Works Update Detection] C:\Program Files\Common Files\Microsoft Shared\Works Shared\WkUFind.exe O4 - HKLM\..\Run: [Logitech Utility] Logi_MwX.Exe O4 - HKLM\..\Run: [F-Secure Manager] "C:\Program Files\Common\FSM32.EXE" /splash O4 - HKLM\..\Run: [F-Secure TNB] "C:\Program Files\TNB\TNBUtil.exe" /CHECKALL /WAITFORSW O4 - HKLM\..\Run: [F-Secure Startup Wizard] "C:\Program Files\FSGUI\FSSW.EXE" /reboot O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime O4 - HKLM\..\Run: [Launch LGDCore] "C:\Program Files\Logitech\G-series Software\LGDCore.exe" /SHOWHIDE O4 - HKLM\..\Run: [Launch LCDMon] "C:\Program Files\Logitech\G-series Software\LCDMon.exe" O4 - HKLM\..\Run: [News Service] "C:\Program Files\FSGUI\ispnews.exe" O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [LDM] C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe O4 - HKCU\..\Run: [StartCCC] C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe O4 - HKCU\..\Run: [Steam] "e:\sampo 2\steam\steam.exe" -silent O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy2\TeaTimer.exe O4 - Global Startup: F-Secure 2006.lnk = C:\Program Files\backweb\4476822\Program\fspex.exe O4 - Global Startup: Logitech Desktop Messenger.lnk = C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE O4 - Global Startup: Microsoft Works Calendar Reminders.lnk = ? O4 - Global Startup: WinZip Quick Pick.lnk = C:\Program Files\WinZip\WZQKPICK.EXE O8 - Extra context menu item: &Estä tämä kohoikkuna - C:\Program Files\Anti-Spyware\blockpopups.htm O8 - Extra context menu item: &Google Search - res://c:\program files\google\GoogleToolbar3.dll/cmsearch.html O8 - Extra context menu item: &Translate English Word - res://c:\program files\google\GoogleToolbar3.dll/cmwordtrans.html O8 - Extra context menu item: Backward Links - res://c:\program files\google\GoogleToolbar3.dll/cmbacklinks.html O8 - Extra context menu item: Cached Snapshot of Page - res://c:\program files\google\GoogleToolbar3.dll/cmcache.html O8 - Extra context menu item: Similar Pages - res://c:\program files\google\GoogleToolbar3.dll/cmsimilar.html O8 - Extra context menu item: Translate Page into English - res://c:\program files\google\GoogleToolbar3.dll/cmtrans.html O9 - Extra button: Web-suodatin - {200DB664-75B5-47c0-8B45-A44ACCF73C00} - C:\Program Files\FSPC\fspcmsie.dll O9 - Extra button: (no name) - {200DB664-75B5-47c0-8B45-A44ACCF73F01} - C:\Program Files\FSPC\fspcmsie.dll O9 - Extra 'Tools' menuitem: Web-suodatin - {200DB664-75B5-47c0-8B45-A44ACCF73F01} - C:\Program Files\FSPC\fspcmsie.dll O9 - Extra button: (no name) - {200DB664-75B5-47c0-8B45-A44ACCF73F02} - C:\Program Files\FSPC\fspcmsie.dll O9 - Extra 'Tools' menuitem: &Keskeytä Web-sivujen suodatus - {200DB664-75B5-47c0-8B45-A44ACCF73F02} - C:\Program Files\FSPC\fspcmsie.dll O9 - Extra button: (no name) - {200DB664-75B5-47c0-8B45-A44ACCF73F03} - C:\Program Files\FSPC\fspcmsie.dll O9 - Extra 'Tools' menuitem: &Kiellä tämä Web-sivusto - {200DB664-75B5-47c0-8B45-A44ACCF73F03} - C:\Program Files\FSPC\fspcmsie.dll O9 - Extra button: (no name) - {200DB664-75B5-47c0-8B45-A44ACCF73F04} - C:\Program Files\FSPC\fspcmsie.dll O9 - Extra 'Tools' menuitem: &Salli tämä Web-sivusto - {200DB664-75B5-47c0-8B45-A44ACCF73F04} - C:\Program Files\FSPC\fspcmsie.dll O9 - Extra button: IE-suojaus - {300DB664-75B5-47c0-8B45-A44ACCF73C00} - C:\Program Files\Anti-Spyware\ieshield.dll O9 - Extra 'Tools' menuitem: IE-suojaus... - {300DB664-75B5-47c0-8B45-A44ACCF73C00} - C:\Program Files\Anti-Spyware\ieshield.dll O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~2\SDHelper.dll O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~2\SDHelper.dll O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing) O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing) O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O10 - Broken Internet access because of LSP provider 'winsflt.dll' missing O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll O16 - DPF: {0CBF7EDC-17EC-442C-8AE9-5E804707B6CA} (NeffyClient Class) - http://dist.cdnetworks.co.jp/cdndist/neffy/Neffy.cab O16 - DPF: {31B7EB4E-8B4B-11D1-A789-00A0CC6651A8} (Cult3D ActiveX Player) - http://www.cult3d.com/download/cult.cab O16 - DPF: {39B0684F-D7BF-4743-B050-FDC3F48F7E3B} (FilePlanet Download Control Class) - http://www.fileplanet.com/fpdlmgr/cabs/FPDC_1_0_0_44.cab O16 - DPF: {68BCE50A-DC9B-4519-A118-6FDA19DB450D} (Info Class) - http://support.vugames.com/betasubmission/sysinfo/Si.cab O16 - DPF: {70BA88C8-DAE8-4CE9-92BB-979C4A75F53B} (GSDACtl Class) - http://launch.gamespyarcade.com/software/launch/alaunch.cab O16 - DPF: {917623D1-D8E5-11D2-BE8B-00104B06BDE3} (CamImage Class) - http://62.197.172.28:8088/activex/AxisCamControl.cab O16 - DPF: {F58E1CEF-A068-4C15-BA5E-587CAF3EE8C6} (MSN Chat Control 4.5) - http://fdl.msn.com/public/chat/msnchat45.cab O16 - DPF: {FE5D6722-826F-11D5-A24E-0060B0F1A5AE} (Tukati Launcher) - http://http.gamezone.tukati.com/tukati/1.7.20.20/tukati.cab O18 - Protocol: bwfile-8876480 - {9462A756-7B47-47BC-8C80-C34B9B80B32B} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\GAPlugProtocol-8876480.dll O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft AB - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe O23 - Service: F-Secure 2006 (BackWeb Plug-in - 4476822) - F-Secure Internet Security 2005 - C:\PROGRA~1\backweb\4476822\Program\SERVIC~1.EXE O23 - Service: C-DillaCdaC11BA - Macrovision - C:\WINDOWS\system32\drivers\CDAC11BA.EXE O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\System32\CTsvcCDA.exe O23 - Service: F-Secure Gatekeeper Handler Starter - F-Secure Corporation - C:\Program Files\Anti-Virus\fsgk32st.exe O23 - Service: fsbwsys - F-Secure Corp. - C:\Program Files\backweb\4476822\program\fsbwsys.exe O23 - Service: F-Secure Anti-Virus Firewall Daemon (FSDFWD) - F-Secure Corporation - C:\Program Files\FWES\Program\fsdfwd.exe O23 - Service: F-Secure HTTP Server (fshttps) - F-Secure Corporation - C:\Program Files\FSPC\fshttps\fshttps.exe O23 - Service: FSMA - F-Secure Corporation - C:\Program Files\Common\FSMA32.EXE O23 - Service: iPod-palvelu (iPodService) - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\system32\PnkBstrA.exe O23 - Service: SecuROM User Access Service (V7) (UserAccess7) - Unknown owner - C:\WINDOWS\system32\UAService7.exe O23 - Service: Webcam Corp. Service Starter - Unknown owner - E:\Sampo 3\NetCam Center SCE\dogsvc.exe (file missing)
Hyvältä alkaa näyttää Tarkista koneesi F-Securen online skannerilla Huom, skanneri toimii vain Internet Explorer selaimella * Lue sivun ohjeet huolella läpi * Klikkaa Start scanning * Mikäli saat Internet Explorer -suojausvaroituksen, klikkaa Asenna * Klikkaa Accept * Klikkaa Custom Scan * Säädä asetukset seuraavasti o "Virus Scan Option" kohdasta valitse Scan whole system o "Other Scan Option" kohdasta valitse Scan All Files o Valitse Scan whole system for rootkits o Valitse Scan whole system for spyware o Laita ruksi kohtaan Scan inside archives o Varmista että Use advanced heuristics on valittuna * Klikkaa Start * Skannaus käynnistyy kun tarvittavat tiedostot/päivitykset on ladattu * Odota kärsivällisesti * Kun sakannaus on suoritettu, klikkaa Automatic cleaning * Klikkaa Show Report * Raportti aukeaa selaimessa, kopioi teksti kokonaan * Liitä kopioitu teksti esim. muistioon tai Wordiin ja tallenna työpöydälle * Voit sulkea skannerin * Lähetä raportti viestiketjuusi ========== Tämä jos tunnet tietokoneesi olevan hitaan puoleinen, etkä ole eheyttänyt pitkään aikaan: Avaa Oma tietokone -> Tee seuraava toimenpide kaikille Paikallisille levyille ========== Lataa CCleaner ja asenna se: Avaa "Options", sieltä "Language" ja valitse "Suomi (Finnish)" Avaa "Virheet" kohta, paina "Etsi rekisterin virheitä", paina "Korjaa valitut rekisterin virheet..". Paina "Kyllä", kun ohjelma kysyy "Haluatko varmuuskopioida muutokset rekisteriin", tallenna tiedosto esim. työpöydälle. Avaa "Puhdistaja", paina "Tutki" ja tämän jälkeen "Aja Ccleaner". Puhdista väliaikaistiedostot ja -kansiot ohjelmalla säännöllisesti. ========== Jos sinulla ei ole tätä java versiota (6.2): Vanha java saastuttaa helposti koneesi! Javan päivitys ja välimuistin tyhjennys: 1. Klikkaa Käynnistä -> Ohjauspaneeli ja tupla-klikkaa Lisää tai poista sovellus Ohjauspaneelissa. 2. Etsi listasta kaikki entiset Java versiosi. (J2SE Runtime Environment.... ) Niissä pitäisi olla seuraava kuva vieressä: 3. Valitse kaikki entiset Java versiosi ja valitse Poista. 4. Asenna uusin Java päivitys seuraavasta linkistä.. 5. Käynnistä kone uudelleen asennuksen jälkeen: http://java.sun.com/javase/downloads/index.jsp tai http://www.filehippo.com/download_java_runtime/ Rullaa alas kohteeseen Java Runtime Environment (JRE) 6u2 Paina Download Ruksaa Accept, ota offline installation, tallenna vaikka työpöydälle ja asenna se. 6. Käynnistyksen jälkeen, mene takaisin Ohjauspaneeliin ja avaa Java asetuksesi (Muita Ohjauspaneelin asetuksia -> Java kahvikuppi). 7. General Settings -osion alla, vedä liukusäädintä (Disk Space) pienemmälle, ja klikkaa Delete Files -nappia. (Jotkut javapohjaiset ohjelmat saattavat tarvita enemmän levytilaa. Jos huomaat säädön pienentämisen jälkeen koneessa hitautta, siirrä liukusäädintä isommalle). 8. Varmista että kaikki kaksi valintaa ovat rastitettuja: *Applications and Applets *Trace and Log Files Ja paina OK -nappia 9. Klikkaa OK "Temporary Files Settings" -ikkunassasi. 10. Klikkaa OK jättääksesi Java asetusikkunasi. ========== Lataa Deckard's System Scanner Työpöydällesi. Huomioi: Sinulla tulee olla Järjestelmänvalvojan oikeudet ajaaksesi ohjelman. [*]Sulje kaikki avoimet ikkunat ja ohjelmat. [*]Tupla Klikkaa Dss.exe tiedostoa ajaaksesi ohjelman, seuraa ohjeita. [*]Kun Scannaus on valmis 2 textitiedostoa pitäisi avautua, Main.txt ja extra.txt [*]Näppäile Kopioi ( CTRL+A -> CTRL + C ) ja liitä ( CTRL + V ) [*]kopioi ja liitä Extra.txt & Main.txt sisältö seuraavaan vastaukseesi. myös F-securen raportti
Scanning Report Monday, July 16, 2007 22:50:56 - 11:13:46 Computer name: SAMPO Scanning type: Scan system for viruses, rootkits, spyware Target: C:\ E:\ -------------------------------------------------------------------------------- Result: 8 malware found Password-protected-EXE (virus) C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Recovery\ZlobVideoActiveXObject1.zip (Submitted) QQPass.gen4 (virus) C:\pelit 2\BitComet\Downloads\Crack Search [www.pctorrent.com]\Cracks\B\A\Battlefield_1942_CD_Keygen.zip\Keygen.exe W32/Agent.CYZ (virus) C:\Six_Steam.rar\SiX.exe E:\Six_Steam.rar\SiX.exe W32/DLoader.AKWR (virus) C:\WINDOWS\Downloaded Program Files\gsda.dll (Submitted) W32/Suspicious_F.gen (virus) C:\pelit 2\BitComet\Downloads\Crack Search [www.pctorrent.com]\Cracks\Z\I\Zip_Password_Cracker_Pro_v1.1b.zip\Zip_Cracker - keygen.exe C:\pelit 2\BitComet\Downloads\Crack Search [www.pctorrent.com]\Cracks\Z\I\Zip_Password_Cracker_Pro_v1.1b\Zip_Cracker - keygen.exe W32/Viking.EQ (virus) E:\Sampo 2\Postal 2\ApocalypseWeekend\System\reloaded.exe (Disinfected & Submitted) -------------------------------------------------------------------------------- Statistics Scanned: Files: 544596 System: 5757 Not scanned: 280 Actions: Disinfected: 1 Renamed: 0 Deleted: 0 None: 7 Submitted: 3 Files not scanned: x??AGEFILE.SYS C:\WINDOWS\SYSTEM32\BIOS1.ROM C:\WINDOWS\SYSTEM32\DRIVERS\ATAPI.SYS C:\WINDOWS\SYSTEM32\CONFIG\DEFAULT C:\WINDOWS\SYSTEM32\CONFIG\SAM C:\WINDOWS\SYSTEM32\CONFIG\SECURITY C:\WINDOWS\SYSTEM32\CONFIG\SYSTEM C:\WINDOWS\SYSTEM32\CATROOT2\EDB.LOG C:\WINDOWS\SYSTEM32\CATROOT2\TMP.EDB C:\PROGRAM FILES\LOGITECH\DESKTOP MESSENGER\8876480\USERS\SAMPO LIEHUNEN\DATA\CHANDIR.DAT C:\PROGRAM FILES\LOGITECH\DESKTOP MESSENGER\8876480\USERS\SAMPO LIEHUNEN\DATA\L0000086.FCS C:\PROGRAM FILES\LOGITECH\DESKTOP MESSENGER\8876480\USERS\SAMPO LIEHUNEN\DATA\PRS.DAT C:\PROGRAM FILES\LOGITECH\DESKTOP MESSENGER\8876480\USERS\SAMPO LIEHUNEN\DATA\STORYDB.DAT C:\PROGRAM FILES\HALF-LIFE 2\STEAMAPPS\ASKA98\SOURCESDK\BIN\HLMV.RF C:\PROGRAM FILES\HALF-LIFE 2\STEAMAPPS\ASKA98\COUNTER-STRIKE SOURCE\CSTRIKE\SOUND\ADMIN_PLUGIN\GOODLUCK.MP3 C:\PROGRAM FILES\HALF-LIFE 2\STEAMAPPS\ASKA98\COUNTER-STRIKE SOURCE\CSTRIKE\SOUND\ADMIN_PLUGIN\WAITINGFORSUSPECT.MP3 C:\PROGRAM FILES\COMMON\ADMIN.PUB C:\PROGRAM FILES\COMMON\POLICY.IPF C:\PROGRAM FILES\BACKWEB\4476822\USERS\DEFAULT\DATA\CHANDIR.DAT C:\PROGRAM FILES\BACKWEB\4476822\USERS\DEFAULT\DATA\L0000124.FCS C:\PROGRAM FILES\BACKWEB\4476822\USERS\DEFAULT\DATA\PRS.DAT C:\PROGRAM FILES\BACKWEB\4476822\USERS\DEFAULT\DATA\STORYDB.DAT C:\PELIT 2\THE SIMS 2\TSBIN\SIMS2.EXE C:\PELIT 2\THE SIMS 2\THESIMS2\SIMS2.EXE C:\PELIT 2\THE SIMS 2\THE.SIMS.2.V1.0.ENG.MONEY.BACKUPCD\SIMS2.EXE heightmapdataw.editor_data C:\PELIT 2\BITCOMET\DOWNLOADS\CRACK SEARCH [WWW.PCTORRENT.COM]\CRACKS\W\E\WEBCAM_WATCHER_V3.1\CRACK\WEBCAMS1.DEF bfvietnam.exe bfvietnam.org Mod.dll C:\PELIT 2\BITCOMET\DOWNLOADS\CRACK SEARCH [WWW.PCTORRENT.COM]\CRACKS\B\A\BATTLEFIELD_VIETNAM_BY_UNKNOWN\BFVIETNAM.EXE C:\PELIT 2\BITCOMET\DOWNLOADS\CRACK SEARCH [WWW.PCTORRENT.COM]\CRACKS\B\A\BATTLEFIELD_VIETNAM_BY_UNKNOWN\BFVIETNAM.ORG C:\PELIT 2\BITCOMET\DOWNLOADS\CRACK SEARCH [WWW.PCTORRENT.COM]\CRACKS\B\A\BATTLEFIELD_VIETNAM_BY_UNKNOWN\MOD.DLL C:\PELIT\BF VIETNAM\BF_VIETNAM_PATCH_V1.01.EXE C:\DOCUMENTS AND SETTINGS\SAMPO LIEHUNEN\NTUSER.DAT C:\DOCUMENTS AND SETTINGS\SAMPO LIEHUNEN\OMAT TIEDOSTOT\SIIVOUSPOJAT_-_KALLE,_ELAINTEN_YSTAVA.MP3 C:\DOCUMENTS AND SETTINGS\SAMPO LIEHUNEN\OMAT TIEDOSTOT\MY GAMES\HALO TRIAL\SAVEGAMES\NEW001\SAVEGAME.BIN C:\DOCUMENTS AND SETTINGS\SAMPO LIEHUNEN\LOCAL SETTINGS\TEMP\PERFLIB_PERFDATA_BB0.DAT C:\DOCUMENTS AND SETTINGS\SAMPO LIEHUNEN\LOCAL SETTINGS\APPLICATION DATA\MICROSOFT\WINDOWS\USRCLASS.DAT C:\DOCUMENTS AND SETTINGS\SAMPO LIEHUNEN\LOCAL SETTINGS\APPLICATION DATA\MICROSOFT\SPEECH\FILES\MSASR\SP_DC81D649E28E4FBD94D14D05F7C756E9.DAT C:\DOCUMENTS AND SETTINGS\SAMPO LIEHUNEN\APPLICATION DATA\ISPNEWS\ISPN.INI C:\DOCUMENTS AND SETTINGS\NETWORKSERVICE\NTUSER.DAT C:\DOCUMENTS AND SETTINGS\NETWORKSERVICE\LOCAL SETTINGS\APPLICATION DATA\MICROSOFT\WINDOWS\USRCLASS.DAT C:\DOCUMENTS AND SETTINGS\LOCALSERVICE\NTUSER.DAT C:\DOCUMENTS AND SETTINGS\LOCALSERVICE\LOCAL SETTINGS\APPLICATION DATA\MICROSOFT\WINDOWS\USRCLASS.DAT C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Recovery\CoolWWWSearch.zip\sbRecovery.reg C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Recovery\CoolWWWSearch1.zip\sbRecovery.reg C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Recovery\CoolWWWSearch2.zip\sbRecovery.reg C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Recovery\CoolWWWSearch3.zip\sbRecovery.reg C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Recovery\EGive.zip\data17 C:\DI큝3 C:\PAGEFILE.SYS C:\WINDOWS\SYSTEM32\BIOS1.ROM C:\WINDOWS\SYSTEM32\DRIVERS\ATAPI.SYS C:\WINDOWS\SYSTEM32\CONFIG\DEFAULT C:\WINDOWS\SYSTEM32\CONFIG\SAM C:\WINDOWS\SYSTEM32\CONFIG\SECURITY C:\WINDOWS\SYSTEM32\CONFIG\SYSTEM C:\WINDOWS\SYSTEM32\CATROOT2\EDB.LOG C:\WINDOWS\SYSTEM32\CATROOT2\TMP.EDB C:\PROGRAM FILES\LOGITECH\DESKTOP MESSENG?8 -------------------------------------------------------------------------------- Options Scanning engines: F-Secure Libra: 2.4.2, 2007-07-16 F-Secure AVP: 7.0.171, 2007-07-16 F-Secure Orion: 1.2.37, 2007-07-16 F-Secure Blacklight: 1.0.64 F-Secure Draco: 1.0.35, 0260-23-12 F-Secure Pegasus: 1.19.0, 2007-06-12 Scanning options: Scan all files Scan inside archives Use Advanced heuristics -------------------------------------------------------------------------------- Copyright © 1998-2006 Product support |Send virus sample to F-Secure F-Secure assumes no responsibility for material created or published by third parties that F-Secure World Wide Web pages have a link to. Unless you have clearly stated otherwise, by submitting material to any of our servers, for example by E-mail or via our F-Secure's CGI E-mail, you agree that the material you make available may be published in the F-Secure World Wide Pages or hard-copy publications. You will reach F-Secure public web site by clicking on underlined links. While doing this, your access will be logged to our private access statistics with your domain name.This information will not be given to any third party. You agree not to take action against us in relation to material that you submit. Unless you have clearly stated otherwise, by submitting material you warrant that F-Secure may incorporate any concepts described in it in the F-Secure products/publications without liability. Deckard's System Scanner v20070711.54 Run by SAMPO LIEHUNEN on 2007-07-17 at 13:17:37 Computer is in Normal Mode. -------------------------------------------------------------------------------- -- HijackThis (run as SAMPO LIEHUNEN.exe) -------------------------------------- Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 13:17:38, on 17.7.2007 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\Ati2evxx.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\Ati2evxx.exe C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\Explorer.EXE C:\Program Files\Creative\SBAudigy2\DVDAudio\CTDVDDet.EXE C:\WINDOWS\system32\CTHELPER.EXE C:\Program Files\Common\FSM32.EXE C:\Program Files\Logitech\G-series Software\LCDMon.exe C:\WINDOWS\system32\ctfmon.exe C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe C:\Program Files\Logitech\MouseWare\system\em_exec.exe C:\Program Files\Logitech\G-series Software\Applets\LCDMedia.exe C:\Program Files\Logitech\G-series Software\Applets\LCDClock.exe C:\Program Files\Common Files\Microsoft Shared\Works Shared\wkcalrem.exe C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe C:\PROGRA~1\backweb\4476822\Program\SERVIC~1.EXE C:\WINDOWS\system32\drivers\CDAC11BA.EXE C:\WINDOWS\System32\CTsvcCDA.exe C:\Program Files\Anti-Virus\fsgk32st.exe C:\Program Files\Anti-Virus\FSGK32.EXE C:\Program Files\backweb\4476822\program\fsbwsys.exe C:\Program Files\Anti-Virus\fssm32.exe C:\Program Files\Common\FSMA32.EXE C:\Program Files\Common\FSMB32.EXE C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe C:\WINDOWS\system32\PnkBstrA.exe C:\Program Files\backweb\4476822\Program\fspex.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\Common\FCH32.EXE C:\WINDOWS\system32\UAService7.exe C:\WINDOWS\System32\MsPMSPSv.exe C:\Program Files\Common\FAMEH32.EXE C:\Program Files\Anti-Virus\fsqh.exe C:\Program Files\Anti-Virus\fsrw.exe C:\Program Files\FSPC\fspc.exe C:\Program Files\Anti-Virus\fsav32.exe C:\Program Files\FWES\Program\fsdfwd.exe C:\PROGRA~1\ANTI-S~1\fsaw.exe C:\Program Files\FSGUI\fsguidll.exe C:\dss.exe C:\PROGRA~1\TRENDM~1\HIJACK~1\SAMPOL~1.EXE R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://plaza.fi/ R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = proxy.dial.inet.fi:800 R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = localhost;<local> R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Linkit O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar3.dll O2 - BHO: (no name) - {E26CEADA-67B0-4543-BE8B-307F00265118} - (no file) O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar3.dll O4 - HKLM\..\Run: [CTSysVol] C:\Program Files\Creative\SBAudigy2\Surround Mixer\CTSysVol.exe O4 - HKLM\..\Run: [CTDVDDet] C:\Program Files\Creative\SBAudigy2\DVDAudio\CTDVDDet.EXE O4 - HKLM\..\Run: [CTHelper] CTHELPER.EXE O4 - HKLM\..\Run: [AsioReg] REGSVR32.EXE /S CTASIO.DLL O4 - HKLM\..\Run: [SBDrvDet] C:\Program Files\Creative\SB Drive Det\SBDrvDet.exe /r O4 - HKLM\..\Run: [CTStartup] "C:\Program Files\Creative\Splash Screen\CTEaxSpl.EXE" /run O4 - HKLM\..\Run: [Microsoft Works Update Detection] C:\Program Files\Common Files\Microsoft Shared\Works Shared\WkUFind.exe O4 - HKLM\..\Run: [Logitech Utility] Logi_MwX.Exe O4 - HKLM\..\Run: [F-Secure Manager] "C:\Program Files\Common\FSM32.EXE" /splash O4 - HKLM\..\Run: [F-Secure TNB] "C:\Program Files\TNB\TNBUtil.exe" /CHECKALL /WAITFORSW O4 - HKLM\..\Run: [F-Secure Startup Wizard] "C:\Program Files\FSGUI\FSSW.EXE" /reboot O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime O4 - HKLM\..\Run: [Launch LGDCore] "C:\Program Files\Logitech\G-series Software\LGDCore.exe" /SHOWHIDE O4 - HKLM\..\Run: [Launch LCDMon] "C:\Program Files\Logitech\G-series Software\LCDMon.exe" O4 - HKLM\..\Run: [News Service] "C:\Program Files\FSGUI\ispnews.exe" O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe" O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [LDM] C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe O4 - HKCU\..\Run: [StartCCC] C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe O4 - HKCU\..\Run: [Steam] "e:\sampo 2\steam\steam.exe" -silent O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Paikallinen palve') O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Verkkopalve') O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM') O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user') O4 - Global Startup: F-Secure 2006.lnk = C:\Program Files\backweb\4476822\Program\fspex.exe O4 - Global Startup: Logitech Desktop Messenger.lnk = C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE O4 - Global Startup: Microsoft Works Calendar Reminders.lnk = ? O4 - Global Startup: WinZip Quick Pick.lnk = C:\Program Files\WinZip\WZQKPICK.EXE O8 - Extra context menu item: &Estä tämä kohoikkuna - C:\Program Files\Anti-Spyware\blockpopups.htm O8 - Extra context menu item: &Google Search - res://c:\program files\google\GoogleToolbar3.dll/cmsearch.html O8 - Extra context menu item: &Translate English Word - res://c:\program files\google\GoogleToolbar3.dll/cmwordtrans.html O8 - Extra context menu item: Backward Links - res://c:\program files\google\GoogleToolbar3.dll/cmbacklinks.html O8 - Extra context menu item: Cached Snapshot of Page - res://c:\program files\google\GoogleToolbar3.dll/cmcache.html O8 - Extra context menu item: Similar Pages - res://c:\program files\google\GoogleToolbar3.dll/cmsimilar.html O8 - Extra context menu item: Translate Page into English - res://c:\program files\google\GoogleToolbar3.dll/cmtrans.html O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll O9 - Extra button: Web-suodatin - {200DB664-75B5-47c0-8B45-A44ACCF73C00} - C:\Program Files\FSPC\fspcmsie.dll O9 - Extra button: (no name) - {200DB664-75B5-47c0-8B45-A44ACCF73F01} - C:\Program Files\FSPC\fspcmsie.dll O9 - Extra 'Tools' menuitem: Web-suodatin - {200DB664-75B5-47c0-8B45-A44ACCF73F01} - C:\Program Files\FSPC\fspcmsie.dll O9 - Extra button: (no name) - {200DB664-75B5-47c0-8B45-A44ACCF73F02} - C:\Program Files\FSPC\fspcmsie.dll O9 - Extra 'Tools' menuitem: &Keskeytä Web-sivujen suodatus - {200DB664-75B5-47c0-8B45-A44ACCF73F02} - C:\Program Files\FSPC\fspcmsie.dll O9 - Extra button: (no name) - {200DB664-75B5-47c0-8B45-A44ACCF73F03} - C:\Program Files\FSPC\fspcmsie.dll O9 - Extra 'Tools' menuitem: &Kiellä tämä Web-sivusto - {200DB664-75B5-47c0-8B45-A44ACCF73F03} - C:\Program Files\FSPC\fspcmsie.dll O9 - Extra button: (no name) - {200DB664-75B5-47c0-8B45-A44ACCF73F04} - C:\Program Files\FSPC\fspcmsie.dll O9 - Extra 'Tools' menuitem: &Salli tämä Web-sivusto - {200DB664-75B5-47c0-8B45-A44ACCF73F04} - C:\Program Files\FSPC\fspcmsie.dll O9 - Extra button: IE-suojaus - {300DB664-75B5-47c0-8B45-A44ACCF73C00} - C:\Program Files\Anti-Spyware\ieshield.dll O9 - Extra 'Tools' menuitem: IE-suojaus... - {300DB664-75B5-47c0-8B45-A44ACCF73C00} - C:\Program Files\Anti-Spyware\ieshield.dll O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll O16 - DPF: {0B79F48A-E8D6-11DB-9283-E25056D89593} (F-Secure Online Scanner 3.1) - http://support.f-secure.com/ols/fscax.cab O16 - DPF: {0CBF7EDC-17EC-442C-8AE9-5E804707B6CA} - http://dist.cdnetworks.co.jp/cdndist/neffy/Neffy.cab O16 - DPF: {15AD6789-CDB4-47E1-A9DA-992EE8E6BAD6} - O16 - DPF: {31B7EB4E-8B4B-11D1-A789-00A0CC6651A8} (Cult3D ActiveX Player) - http://www.cult3d.com/download/cult.cab O16 - DPF: {39B0684F-D7BF-4743-B050-FDC3F48F7E3B} - http://www.fileplanet.com/fpdlmgr/cabs/FPDC_1_0_0_44.cab O16 - DPF: {68BCE50A-DC9B-4519-A118-6FDA19DB450D} - http://support.vugames.com/betasubmission/sysinfo/Si.cab O16 - DPF: {70BA88C8-DAE8-4CE9-92BB-979C4A75F53B} - http://launch.gamespyarcade.com/software/launch/alaunch.cab O16 - DPF: {917623D1-D8E5-11D2-BE8B-00104B06BDE3} - http://62.197.172.28:8088/activex/AxisCamControl.cab O16 - DPF: {CAFEEFAC-0015-0000-0001-ABCDEFFEDCBA} (Java Plug-in 1.5.0_01) - O16 - DPF: {F58E1CEF-A068-4C15-BA5E-587CAF3EE8C6} - http://fdl.msn.com/public/chat/msnchat45.cab O16 - DPF: {FE5D6722-826F-11D5-A24E-0060B0F1A5AE} (Tukati Launcher) - http://http.gamezone.tukati.com/tukati/1.7.20.20/tukati.cab O18 - Protocol: bwfile-8876480 - {9462A756-7B47-47BC-8C80-C34B9B80B32B} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\GAPlugProtocol-8876480.dll O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft AB - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe O23 - Service: F-Secure 2006 (BackWeb Plug-in - 4476822) - F-Secure Internet Security 2005 - C:\PROGRA~1\backweb\4476822\Program\SERVIC~1.EXE O23 - Service: C-DillaCdaC11BA - Macrovision - C:\WINDOWS\system32\drivers\CDAC11BA.EXE O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\System32\CTsvcCDA.exe O23 - Service: F-Secure Gatekeeper Handler Starter - F-Secure Corporation - C:\Program Files\Anti-Virus\fsgk32st.exe O23 - Service: fsbwsys - F-Secure Corp. - C:\Program Files\backweb\4476822\program\fsbwsys.exe O23 - Service: F-Secure Anti-Virus Firewall Daemon (FSDFWD) - F-Secure Corporation - C:\Program Files\FWES\Program\fsdfwd.exe O23 - Service: F-Secure HTTP Server (fshttps) - F-Secure Corporation - C:\Program Files\FSPC\fshttps\fshttps.exe O23 - Service: FSMA - F-Secure Corporation - C:\Program Files\Common\FSMA32.EXE O23 - Service: iPod-palvelu (iPodService) - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\system32\PnkBstrA.exe O23 - Service: SecuROM User Access Service (V7) (UserAccess7) - Unknown owner - C:\WINDOWS\system32\UAService7.exe O23 - Service: Webcam Corp. Service Starter - Unknown owner - E:\Sampo 3\NetCam Center SCE\dogsvc.exe (file missing) -- End of file - 11605 bytes -- Files created between 2007-06-17 and 2007-07-17 ----------------------------- 2007-07-17 13:12:52 0 dr-h----- C:\Documents and Settings\SAMPO LIEHUNEN\Recent 2007-07-17 13:06:50 0 d-------- C:\Program Files\Trend Micro 2007-07-17 12:51:10 0 d-------- C:\Program Files\Java 2007-07-17 12:51:08 0 d-------- C:\Program Files\Common Files\Java 2007-07-16 23:12:00 502308 --a------ C:\dss.exe 2007-07-16 22:56:00 0 d-------- C:\Program Files\CCleaner 2007-07-16 22:25:37 0 d-------- C:\backups 2007-07-16 21:17:15 1168935 --a------ C:\ComboFix.exe 2007-07-16 20:01:37 3304 --a------ C:\WINDOWS\system32\tmp.reg 2007-07-16 20:00:45 288417 --a------ C:\WINDOWS\system32\SrchSTS.exe <Not Verified; S!Ri; SrchSTS> 2007-07-16 20:00:45 53248 --a------ C:\WINDOWS\system32\Process.exe <Not Verified; http://www.beyondlogic.org; Command Line Process Utility> 2007-07-16 20:00:45 51200 --a------ C:\WINDOWS\system32\dumphive.exe 2007-07-16 19:59:54 885013 --a------ C:\SmitfraudFix.exe <SMITFR~1.EXE> 2007-07-16 18:56:47 218112 --a------ C:\HiJackThis.exe <HIJACK~1.EXE> <Not Verified; Soeperman Enterprises Ltd.; HijackThis> 2007-07-16 17:56:29 0 d-------- C:\Program Files\Spybot - Search & Destroy2 2007-07-15 22:22:57 0 d-------- C:\Documents and Settings\All Users\Application Data\Lavasoft 2007-07-13 22:31:08 53248 --a------ C:\WINDOWS\system32\apache.dll -- Find3M Report --------------------------------------------------------------- 2007-07-17 12:43:55 0 d-------- C:\Program Files\Anti-Virus 2007-07-17 12:42:11 288 --a------ C:\WINDOWS\system32\DVCStateBkp-{00000000-00000000-0000000B-00001102-00000004-10021102}.dat 2007-07-17 12:42:11 288 --a------ C:\WINDOWS\system32\DVCState-{00000000-00000000-0000000B-00001102-00000004-10021102}.dat 2007-07-15 23:02:19 10646 --ahs---- C:\WINDOWS\system32\KGyGaAvL.sys 2007-07-15 22:22:58 0 d-------- C:\Program Files\Lavasoft 2007-07-15 22:22:14 0 d-------- C:\Program Files\Common Files\Wise Installation Wizard 2007-07-11 14:07:55 384308 --a------ C:\WINDOWS\system32\perfh00B.dat 2007-07-11 14:07:55 79230 --a------ C:\WINDOWS\system32\perfc00B.dat 2007-07-10 14:39:55 0 d-------- C:\Program Files\Anti-Spyware 2007-07-07 15:38:41 0 d-------- C:\Program Files\LimeWire 2007-07-03 22:40:15 0 d--h----- C:\Program Files\InstallShield Installation Information 2007-06-26 23:10:26 0 d-------- C:\Program Files\Game spy 2007-06-04 15:18:22 0 d-------- C:\Program Files\NCSoft 2007-06-04 15:17:45 0 d-------- C:\Documents and Settings\SAMPO LIEHUNEN\Application Data\InstallShield 2007-06-04 15:06:25 0 d-------- C:\Documents and Settings\SAMPO LIEHUNEN\Application Data\GetRightToGo 2007-05-22 18:45:37 0 d-------- C:\Program Files\Neffy 2007-04-28 16:48:39 262144 --a------ C:\WINDOWS\system32\wrap_oal.dll <Not Verified; Creative Labs; Creative Labs OpenAL32> 2007-04-28 16:48:39 86016 --a------ C:\WINDOWS\system32\OpenAL32.dll <Not Verified; Portions (C) Creative Labs Inc. and NVIDIA Corp.; Standard OpenAL(TM) Library> -- Registry Dump --------------------------------------------------------------- [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects] {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll {AA58ED58-01DD-4d91-8333-CF10577473F7} c:\program files\google\googletoolbar3.dll [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run] "CTSysVol"="C:\\Program Files\\Creative\\SBAudigy2\\Surround Mixer\\CTSysVol.exe" "CTDVDDet"="C:\\Program Files\\Creative\\SBAudigy2\\DVDAudio\\CTDVDDet.EXE" "CTHelper"="CTHELPER.EXE" "AsioReg"="REGSVR32.EXE /S CTASIO.DLL" "SBDrvDet"="C:\\Program Files\\Creative\\SB Drive Det\\SBDrvDet.exe /r" "CTStartup"="\"C:\\Program Files\\Creative\\Splash Screen\\CTEaxSpl.EXE\" /run" "Microsoft Works Update Detection"="C:\\Program Files\\Common Files\\Microsoft Shared\\Works Shared\\WkUFind.exe" "Logitech Utility"="Logi_MwX.Exe" "F-Secure Manager"="\"C:\\Program Files\\Common\\FSM32.EXE\" /splash" "F-Secure TNB"="\"C:\\Program Files\\TNB\\TNBUtil.exe\" /CHECKALL /WAITFORSW" "F-Secure Startup Wizard"="\"C:\\Program Files\\FSGUI\\FSSW.EXE\" /reboot" "QuickTime Task"="\"C:\\Program Files\\QuickTime\\qttask.exe\" -atboottime" "Launch LGDCore"="\"C:\\Program Files\\Logitech\\G-series Software\\LGDCore.exe\" /SHOWHIDE" "Launch LCDMon"="\"C:\\Program Files\\Logitech\\G-series Software\\LCDMon.exe\"" "News Service"="\"C:\\Program Files\\FSGUI\\ispnews.exe\"" "SunJavaUpdateSched"="\"C:\\Program Files\\Java\\jre1.6.0_02\\bin\\jusched.exe\"" [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run] "CTFMON.EXE"="C:\\WINDOWS\\system32\\ctfmon.exe" "LDM"="C:\\Program Files\\Logitech\\Desktop Messenger\\8876480\\Program\\LogitechDesktopMessenger.exe" "StartCCC"="C:\\Program Files\\ATI Technologies\\ATI.ACE\\Core-Static\\CLIStart.exe" Deckard's System Scanner v20070711.54 Extra logfile - please post this as an attachment with your post. -------------------------------------------------------------------------------- -- System Information ---------------------------------------------------------- Microsoft Windows XP Home Edition (build 2600) SP 2.0 Architecture: X86; Language: Other (040B) - see http://preview.tinyurl.com/mhhp6 CPU 0: AMD Athlon(TM) XP 2700+ Percentage of Memory in Use: 45% Physical Memory (total/avail): 1023.53 MiB / 554.17 MiB Pagefile Memory (total/avail): 1693.9 MiB / 1350.12 MiB Virtual Memory (total/avail): 2047.88 MiB / 1957.38 MiB A: is Removable (No Media) C: is Fixed (NTFS) - 76.68 GiB total, 28.26 GiB free. D: is CDROM (UDF) E: is Fixed (NTFS) - 153.38 GiB total, 18.78 GiB free. F: is CDROM (UDF) G: is CDROM (UDF) H: is CDROM (No Media) -- Security Center ------------------------------------------------------------- AUOptions is scheduled to auto-install. Windows Internal Firewall is enabled. FW: F-Secure Internet Security 2006 6.12 v6.12 (F-Secure Corporation) AV: F-Secure Internet Security 2006 6.12 v6.12 (F-Secure Corporation) [HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List] [HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List] "C:\\pelit 2\\BitComet\\BitComet.exe"="C:\\pelit 2\\BitComet\\BitComet.exe:*:Enabled:BitComet - a BitTorrent Client" "E:\\Sampo 2\\Battlefield 2\\BF2.exe"="E:\\Sampo 2\\Battlefield 2\\BF2.exe:*:Enabled:BF2" "C:\\Program Files\\Logitech\\Desktop Messenger\\8876480\\Program\\LogitechDesktopMessenger.exe"="C:\\Program Files\\Logitech\\Desktop Messenger\\8876480\\Program\\LogitechDesktopMessenger.exe:*isabled:Logitech Desktop Messenger" "C:\\Program Files\\backweb\\4476822\\Program\\fspex.exe"="C:\\Program Files\\backweb\\4476822\\Program\\fspex.exe:*:Enabled:F-Secure 2006" -- Environment Variables ------------------------------------------------------- ALLUSERSPROFILE=C:\Documents and Settings\All Users APPDATA=C:\Documents and Settings\SAMPO LIEHUNEN\Application Data CLIENTNAME=Console CommonProgramFiles=C:\Program Files\Common Files COMPUTERNAME=SAMPO ComSpec=C:\WINDOWS\system32\cmd.exe FP_NO_HOST_CHECK=NO HOMEDRIVE=C: HOMEPATH=\Documents and Settings\SAMPO LIEHUNEN LOGONSERVER=\\SAMPO NUMBER_OF_PROCESSORS=1 OS=Windows_NT Path=C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\system32\wbem;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\Program Files\ATI Technologies\ATI.ACE\Core-Static PATHEXT=.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH PROCESSOR_ARCHITECTURE=x86 PROCESSOR_IDENTIFIER=x86 Family 6 Model 8 Stepping 1, AuthenticAMD PROCESSOR_LEVEL=6 PROCESSOR_REVISION=0801 ProgramFiles=C:\Program Files PROMPT=$P$G SESSIONNAME=Console sourcesdk=c:\program files\half-life 2\steamapps\aska98\sourcesdk SystemDrive=C: SystemRoot=C:\WINDOWS TEMP=C:\DOCUME~1\SAMPOL~1\LOCALS~1\Temp TMP=C:\DOCUME~1\SAMPOL~1\LOCALS~1\Temp USERDOMAIN=SAMPO USERNAME=SAMPO LIEHUNEN USERPROFILE=C:\Documents and Settings\SAMPO LIEHUNEN VProject=c:\program files\half-life 2\steamapps\SourceMods\code war windir=C:\WINDOWS -- User Profiles --------------------------------------------------------------- SAMPO LIEHUNEN (admin) -- Add/Remove Programs --------------------------------------------------------- --> "C:\Program Files\Creative\SBAudigy2\Program\Ctzapxx.EXE" /U /S --> "C:\Program Files\fsuninst.exe" /UninstRegKey:"F-Secure Anti-Spyware Scanner" --> "C:\Program Files\fsuninst.exe" /UninstRegKey:"F-Secure Anti-Spyware" --> "C:\Program Files\fsuninst.exe" /UninstRegKey:"F-Secure Anti-Virus Client Security Installer" --> "C:\Program Files\fsuninst.exe" /UninstRegKey:"F-Secure Anti-Virus" --> "C:\Program Files\fsuninst.exe" /UninstRegKey:"F-Secure DAAS" --> "C:\Program Files\fsuninst.exe" /UninstRegKey:"F-Secure Diagnostics" --> "C:\Program Files\fsuninst.exe" /UninstRegKey:"F-Secure E-mail Scanning" --> "C:\Program Files\fsuninst.exe" /UninstRegKey:"F-Secure FWES" --> "C:\Program Files\fsuninst.exe" /UninstRegKey:"F-Secure GUI" --> "C:\Program Files\fsuninst.exe" /UninstRegKey:"F-Secure Help" --> "C:\Program Files\fsuninst.exe" /UninstRegKey:"F-Secure Internet Shield" --> "C:\Program Files\fsuninst.exe" /UninstRegKey:"F-Secure Management Agent" --> "C:\Program Files\fsuninst.exe" /UninstRegKey:"F-Secure Spam Control" --> "C:\Program Files\fsuninst.exe" /UninstRegKey:"F-Secure Spam Scanner" --> "C:\Program Files\fsuninst.exe" /UninstRegKey:"F-Secure TNB" --> "C:\Program Files\fsuninst.exe" /UninstRegKey:"F-Secure Web Filter" --> "C:\Program Files\fsuninst.exe" /UninstRegKey:"News Service" --> C:\WINDOWS\st6unst.exe -n "C:\Program Files\Areena 5\ST6UNST.LOG" --> MsiExec.exe /X{27579b3c-5470-4496-be6c-0c872674f19f} --> MsiExec.exe /X{E9F81423-211E-46B6-9AE0-38568BC5CF6F} --> RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{169F8893-C1C5-4847-972C-EA1E008112AC}\setup.exe" -l0x9 --> RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{169F8893-C1C5-4847-972C-EA1E008112AC}\setup.exe" -l0x9 /remove --> RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{236FADD8-58FD-11D6-A285-00A0CC51B2FE}\setup.exe" -l0x9 --> RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{236FADD8-58FD-11D6-A285-00A0CC51B2FE}\setup.exe" -l0x9 /remove --> RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{435E969D-867E-4364-8E74-3DC8A69C5BDB}\setup.exe" -l0x9 --> RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{435E969D-867E-4364-8E74-3DC8A69C5BDB}\setup.exe" -l0x9 /remove --> RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{5210ED6D-52A9-11D6-A285-00A0CC51B2FE}\setup.exe" -l0x9 --> RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{5210ED6D-52A9-11D6-A285-00A0CC51B2FE}\setup.exe" -l0x9 /remove --> RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{5933921D-4253-40B6-B4D9-B7D680F1B6EC}\setup.exe" -l0x9 /remove --> RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{7201B853-5833-11D6-A285-00A0CC51B2FE}\setup.exe" -l0x9 --> RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{7201B853-5833-11D6-A285-00A0CC51B2FE}\setup.exe" -l0x9 /remove --> RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{77ACE67A-0D21-4CEF-8A97-ED20A61B978B}\setup.exe" -l0x9 --> RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{77ACE67A-0D21-4CEF-8A97-ED20A61B978B}\setup.exe" -l0x9 /remove --> RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{7A900EAB-DA37-4554-AF19-9C337476D05D}\setup.exe" -l0x9 --> RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{7A900EAB-DA37-4554-AF19-9C337476D05D}\setup.exe" -l0x9 /remove --> RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{8EF5F498-7FB5-11D6-9963-00A0C92C4EC3}\setup.exe" -l0x9 --> RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{8EF5F498-7FB5-11D6-9963-00A0C92C4EC3}\setup.exe" -l0x9 /remove --> RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{9154ED7C-926E-49CC-B677-0CF3C5267457}\setup.exe" -l0x9 --> RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{9154ED7C-926E-49CC-B677-0CF3C5267457}\setup.exe" -l0x9 /remove --> RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{9A4D2983-4662-4387-BE3D-4CFC2FA9C100}\setup.exe" -l0x9 --> RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{9A4D2983-4662-4387-BE3D-4CFC2FA9C100}\setup.exe" -l0x9 /remove --> RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{A1185190-514F-11D6-A285-00A0CC51B2FE}\setup.exe" -l0x9 --> RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{A1185190-514F-11D6-A285-00A0CC51B2FE}\setup.exe" -l0x9 /remove --> RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{AC157741-3285-4D6A-B934-9174587A3493}\setup.exe" -l0x9 --> RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{AC157741-3285-4D6A-B934-9174587A3493}\setup.exe" -l0x9 /remove --> RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{B5BAAFAE-3561-463D-8E3F-91761A57ADB8}\setup.exe" -l0x9 --> RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{B5BAAFAE-3561-463D-8E3F-91761A57ADB8}\setup.exe" -l0x9 /remove --> RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{C6866B7D-ACFD-4C49-B77B-3B2F8CF54B96}\setup.exe" -l0x9 --> RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{C6866B7D-ACFD-4C49-B77B-3B2F8CF54B96}\setup.exe" -l0x9 /remove --> RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{DEBD7BF3-5856-11D6-A285-00A0CC51B2FE}\setup.exe" -l0x9 --> RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{DEBD7BF3-5856-11D6-A285-00A0CC51B2FE}\setup.exe" -l0x9 /remove --> RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{EE6699B3-E5AD-4E59-8F2B-207DF630670C}\setup.exe" -l0x9 --> RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{EE6699B3-E5AD-4E59-8F2B-207DF630670C}\setup.exe" -l0x9 /remove --> RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{FD549B7B-3532-4160-80D4-3E3DD39A9AE5}\setup.exe" -l0x9 --> RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{FD549B7B-3532-4160-80D4-3E3DD39A9AE5}\setup.exe" -l0x9 /remove --> RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{FD851F7E-F887-405D-9E1C-488811113EF3}\setup.exe" -l0x9 --> RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{FD851F7E-F887-405D-9E1C-488811113EF3}\setup.exe" -l0x9 /remove --> rundll32.exe setupapi.dll,InstallHinfSection DefaultUninstall 132 C:\WINDOWS\INF\PCHealth.inf !xSpeed --> E:\Sampo 3\Xspeed 5.0\uninstal.exe !xSpeed.net 2.0 --> E:\Sampo 3\X speed\uninstal.exe AceGain LiveUpdate 1.0 --> C:\WINDOWS\iun6002.exe "C:\Program Files\AceGain\LiveUpdate\irunin.ini" Ad-Aware 2007 --> MsiExec.exe /X{E31C348B-63A9-4CBF-8D7F-D932ABB63244} Ad-aware 6 Plus --> C:\PROGRA~1\Lavasoft\AD-AWA~1\UNWISE.EXE C:\PROGRA~1\Lavasoft\AD-AWA~1\INSTALL.LOG Adobe Acrobat 5.0 --> C:\WINDOWS\ISUNINST.EXE -f"C:\Program Files\Common Files\Adobe\Acrobat 5.0\NT\Uninst.isu" -c"C:\Program Files\Common Files\Adobe\Acrobat 5.0\NT\Uninst.dll" Adobe Acrobat Reader 3.02 --> C:\WINDOWS\uninst.exe -fc:\pelit\DeIsL4.isu Adobe Flash Player 9 ActiveX --> C:\WINDOWS\system32\Macromed\Flash\FlashUtil9b.exe -uninstallDelete Adobe Photoshop Album 2.0 Starter Edition --> MsiExec.exe /I{11B569C2-4BF6-4ED0-9D17-A4273943CB24} Adobe Reader 6.0.1 --> MsiExec.exe /I{AC76BA86-7AD7-1033-7B44-A00000000001} Adobe Shockwave Player --> C:\WINDOWS\system32\Macromed\SHOCKW~2\UNWISE.EXE C:\WINDOWS\system32\Macromed\SHOCKW~2\Install.log AnyDVD --> "C:\Program Files\SlySoft\AnyDVD\AnyDVD-uninst.exe" /D="C:\Program Files\SlySoft\AnyDVD" AsusUpdate --> C:\WINDOWS\IsUninst.exe -f"C:\Program Files\ASUS\AsusUpdate\Uninst.isu" ATI - Software Uninstall Utility --> C:\Program Files\ATI Technologies\UninstallAll\AtiCimUn.exe ATI Catalyst Control Center --> RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\09\01\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{055EE59D-217B-43A7-ABFF-507B966405D8}\setup.exe" -l0x0 ATI Display Driver --> rundll32 C:\WINDOWS\system32\atiiiexx.dll,_InfEngUnInstallINFFile_RunDLL@16 -force_restart -flags:0x2010001 -inf_classISPLAY -clean Battlefield 1942 --> RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{698D7E61-E4BF-4CA6-8A09-CF6BDBFDEF65}\setup.exe" -l0x9 Battlefield 1942 Secret Weapons of WWII Demo --> RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{909354DE-C180-4B00-B61F-9A6D805E5796}\Setup.exe" -l0x9 Battlefield 2(TM) --> RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\10\50\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{04858915-9F49-4B2A-AED4-DC49A7DE6A7B}\setup.exe" -l0x9 -removeonly Battlefield 2: Special Forces --> RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\10\50\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{50D4CB89-AF34-4978-96DC-C3034062E901}\setup.exe" -l0x9 -removeonly Battlefield 2142 --> RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\10\50\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{ED50ECE9-EC54-4C05-B5ED-EE4741A9F2EC}\setup.exe" -l0xb -removeonly Battlefield Vietnam(TM) --> RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{E35B3C63-E958-4E31-A178-95D22024109A}\setup.exe" -l0x9 BitComet 0.56 --> C:\pelit 2\BitComet\uninst.exe BOILING POINT --> RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\0701\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{58AC967F-CE64-4065-AF54-FA66BAF31FE8}\SETUP.EXE" -l0x9 BSPlayer --> "C:\Program Files\Webteh\BSplayer\uninstall.exe" Call of Duty(R) 2 --> C:\PROGRA~1\COMMON~1\INSTAL~1\Driver\9\INTEL3~1\IDriver.exe /M{D0A05794-48C2-4424-A15A-9F20FCFDD374} /l2057 CCleaner (remove only) --> "C:\Program Files\CCleaner\uninst.exe" Cheating-Death 4.29.2 --> C:\pelit\Half-life\SteamApps\sampo.liehunen@pp.inet.fi\counter-strike\cstrike\Cheating-Death\UninstCD.exe Color Schemer Studio --> E:\csc\unins000.exe Command & Conquer Generals --> C:\PROGRA~1\COMMON~1\INSTAL~1\Driver\7\INTEL3~1\IDriver.exe /M{06F80017-8F98-4C94-B868-52358569FC32} Condition Zero Deleted Scenes --> "E:\sampo 2\steam\steam.exe" steam://uninstall/100 CoreVorbis Audio Decoder (remove only) --> "C:\WINDOWS\system32\CoreVorbis-uninstall.exe" Counter-Strike: Source --> "E:\Sampo 2\steam\steam.exe" steam://uninstall/240 Craxtion4 --> RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\10\00\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{B16ACC3B-A84E-46B2-B6B4-0E088A94A944}\setup.exe" -l0x9 -removeonly Creative MediaSource --> RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{56F3E1FF-54FE-4384-A153-6CCABA097814}\SETUP.EXE" -l0x9 /remove DefilerPak 1.19 (Remove Only) --> "C:\Program Files\DefilerPak\UnDefile.exe" Delta Force Black Hawk Down Demo --> C:\WINDOWS\IsUninst.exe -fc:\pelit\Uninst.isu Die Hard: Nakatomi Plaza --> C:\PELIT\UNWISE.EXE C:\PELIT\install.log DivX --> C:\Program Files\DivX\DivXCodecUninstall.exe /CODEC DivX Player --> C:\Program Files\DivX\DivXPlayerUninstall.exe /PLAYER Doom 3 --> C:\PROGRA~1\COMMON~1\INSTAL~1\Driver\9\INTEL3~1\IDriver.exe /M{FB6908C2-2138-4D6E-9CAF-11D7AE6C3909} /l2057 /x DOOM 3: Resurrection of Evil --> C:\PROGRA~1\COMMON~1\INSTAL~1\Driver\9\INTEL3~1\IDriver.exe /M{04347DFD-87B6-4E30-B14D-5DF2888AD8F5} /l2057 Dungeon Runners --> C:\Program Files\InstallShield Installation Information\{B561886F-9D2F-4ECF-A48D-F528030BABC6}\setup.exe -runfromtemp -l0x0009 -removeonly DVD Decrypter (Remove Only) --> "C:\Program Files\DVD Decrypter\uninstall.exe" EAX Unified --> C:\WINDOWS\IsUninst.exe -f"C:\Program Files\Creative\EAX Unified\Uninst.isu" Elasto Mania --> C:\PROGRA~1\ELASTO~1\UNWISE.EXE C:\PROGRA~1\ELASTO~1\INSTALL.LOG EPSON-tulostinohjelma --> C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\EPUPDATE.EXE /r EPSON PhotoQuicker3.5 --> RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{65F5B7AF-3363-11D7-BB6B-00018021113F}\SETUP.EXE" -l0x9 uninst EPSON Print CD --> RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{FF477885-5EA8-40D0-ADF3-D4C1B86FAEA4}\SETUP.EXE" -l0x9 -SYSTEM EPSON PRINT Image Framer Tool2.1 --> RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{23B59ED4-C360-11D7-875B-0090CC005647}\SETUP.EXE" -l0x9 anything ESPR800 Ohjelmiston käyttöopas --> C:\Program Files\EPSON\TPMANUAL\ESPR800\PQU_G\DOCUNINS.EXE ESPR800 Pikaopas --> C:\Program Files\EPSON\TPMANUAL\ESPR800\REF_G\DOCUNINS.EXE F-Secure Internet Security 2006 --> C:\PROGRA~1\Common\fsbwih.exe /uninstall Far Cry --> C:\PROGRA~1\COMMON~1\INSTAL~1\Driver\9\INTEL3~1\IDriver.exe /M{D6DBDC2A-E72C-4284-B6AD-6B3B61B4DABC} /l2057 FlatOut --> MsiExec.exe /I{A57D86AF-DE8E-4B26-972E-A1A28FFF7742} FTP Explorer --> MsiExec.exe /I{CF690C1A-8C14-40FA-877E-77372A579E61} GameSpy Arcade --> C:\PROGRA~1\GAMESP~1\UNWISE.EXE C:\PROGRA~1\GAMESP~1\INSTALL.LOG Google Toolbar for Internet Explorer --> regsvr32 /u /s "c:\program files\google\googletoolbar3.dll" Google Video Viewer 1.0 (based on VLC 0.8.2 Player) --> C:\Program Files\GoogleVideoViewer\VLC\uninstall.exe Grand Theft Auto Vice City --> RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\0701\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{4B35F00C-E63D-40DC-9839-DF15A33EAC46}\Setup.exe" -l0x9 GSpot Codec Information Appliance --> C:\Program Files\GSpot\Uninstall.exe GTA San Andreas --> RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\10\50\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{D417C96A-FCC7-4590-A1BB-FAF73F5BC98E}\setup.exe" -l0x9 -removeonly GtkRadiant-1.3.8-ET --> RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{36BC3F0C-8777-4DB2-B2F4-7FA5250F34BA}\Setup.exe" Guild Wars --> "E:\Sampo 2\Guild wars\Gw.exe" -uninstall Half-Life 2 --> "E:\sampo 2\steam\steam.exe" steam://uninstall/220 Half-Life(R) 2 --> MsiExec.exe /I{D45EC259-4A19-4656-B588-C2C360DD18EA} HijackThis 1.99.1 --> C:\HijackThis.exe /uninstall Hotfix-päivitys Windows XP:lle (KB914440) --> "C:\WINDOWS\$NtUninstallKB914440$\spuninst\spuninst.exe" Image Resizer Powertoy for Windows XP --> MsiExec.exe /I{1CB92574-96F2-467B-B793-5CEB35C40C29} iTunes --> C:\Program Files\Common Files\InstallShield\Driver\8\Intel 32\IDriver.exe /M{3CB41017-F5CA-4C56-934C-ED02156251E6} Java(TM) 6 Update 2 --> MsiExec.exe /I{3248F0A8-6813-11D6-A77B-00B0D0160020} jv16 PowerTools 1.4.1 --> "C:\jeal\jv16 PowerTools\unins000.exe" Logitech Desktop Messenger --> RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{900B1197-53F5-4F46-A882-2CFFFE2EEDCB}\setup.exe" -l0xb UNINSTALL Logitech G-series Keyboard Software --> MsiExec.exe /X{2FB418AB-562D-43B4-BA0D-9282AAD8C207} Logitech MouseWare 9.76 --> RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{5809E7CF-4DCF-11D4-9875-00105ACE7734}\setup.exe" -l0xb -l000b UNINSTALL Macromedia Extension Manager --> RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{A5BA14E0-7384-11D4-BAE7-00409631A2C8}\setup.exe" -l0x9 mmUninstall MakeTorrent v2.1 --> "C:\pelit 2\make torrent\uninstall.exe" MAX-FX Tools --> RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{7299E7F8-6921-4588-9A83-9BB7B867706F}\setup.exe" Microsoft Data Access Components KB870669 --> C:\WINDOWS\muninst.exe C:\WINDOWS\INF\KB870669.inf Microsoft Office Excel Viewer 2003 --> MsiExec.exe /I{9084040B-6000-11D3-8CFE-0150048383C9} Microsoft Picture It! Photo 2002 --> MsiExec.exe /I{C769A271-7E1C-48F9-B331-474600DD4C06} Microsoft Windows Journal Viewer --> MsiExec.exe /X{43DCF766-6838-4F9A-8C91-D92DA586DFA7} Microsoft Windows Media Video 9 VCM --> RunDll32 advpack.dll,LaunchINFSection C:\WINDOWS\INF\wmv9vcm.inf, Uninstall Microsoft Windows XP -käyttöjärjestelmän ohjatun CD-levylle tallentamisen HighMAT-laajennus --> MsiExec.exe /X{FCE65C4E-B0E8-4FBD-AD16-EDCBE6CD591F} Microsoft Visual C++ 2005 Redistributable --> MsiExec.exe /X{A49F249F-0C91-497F-86DF-B2585E8E76B7} Microsoft Word 2002 --> MsiExec.exe /I{911B040B-6000-11D3-8CFE-0050048383C9} mIRC --> "C:\irc\pirc\pirc\NetGamersIRC.exe" -uninstall Mobility --> C:\WINDOWS\IsUninst.exe -f"C:\Program Files\Glamus\Mobility\Uninst.isu" MSN Messenger 7.0 --> MsiExec.exe /I{ABEB838C-A1A7-4C5D-B7E1-8B4314600816} MSXML4 Parser --> MsiExec.exe /I{01501EBA-EC35-4F9F-8889-3BE346E5DA13} Nero OEM --> C:\Program Files\Ahead\nero\uninstall\UNNERO.exe /UNINSTALL Nokia Connectivity Cable DKU-2 Drivers --> C:\PROGRA~1\COMMON~1\INSTAL~1\Driver\7\INTEL3~1\IDriver.exe /M{3ECED7D1-E469-4BC6-8A93-5CB0FFE5EBF5} /l1035 Paint Shop Pro 7 Anniversary Edition --> MsiExec.exe /I{D6DE02C7-1F47-11D4-9515-00105AE4B89A} PIF DESIGNER2.1 --> RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{23B59B9F-C360-11D7-875B-0090CC005647}\SETUP.EXE" -l0x9 anything Pivot Stickfigure Animator --> MsiExec.exe /I{BEAD39CD-901D-4267-8B8B-EAA83CB4B70D} PlayNC Launcher --> C:\Program Files\InstallShield Installation Information\{5F8E2CBB-949D-4175-AC98-5ADE7F6C9697}\setup.exe -runfromtemp -l0x0009 -removeonly POD-Bot 2.5 --> C:\WINDOWS\unvise32.exe C:\PELIT\HALF-LIFE\STEAMAPPS\SAMPO.LIEHUNEN@PP.INET.FI\COUNTER-STRIKE\CSTRIKE\BOTIT\cstrike\poduninst.log Päivitys Windows XP:lle (KB894391) --> "C:\WINDOWS\$NtUninstallKB894391$\spuninst\spuninst.exe" Päivitys Windows XP:lle (KB896727) --> "C:\WINDOWS\$NtUninstallKB896727$\spuninst\spuninst.exe" Päivitys Windows XP:lle (KB898461) --> "C:\WINDOWS\$NtUninstallKB898461$\spuninst\spuninst.exe" Päivitys Windows XP:lle (KB900485) --> "C:\WINDOWS\$NtUninstallKB900485$\spuninst\spuninst.exe" Päivitys Windows XP:lle (KB904942) --> "C:\WINDOWS\$NtUninstallKB904942$\spuninst\spuninst.exe" Päivitys Windows XP:lle (KB910437) --> "C:\WINDOWS\$NtUninstallKB910437$\spuninst\spuninst.exe" Päivitys Windows XP:lle (KB911280) --> "C:\WINDOWS\$NtUninstallKB911280$\spuninst\spuninst.exe" Päivitys Windows XP:lle (KB916595) --> "C:\WINDOWS\$NtUninstallKB916595$\spuninst\spuninst.exe" Päivitys Windows XP:lle (KB920872) --> "C:\WINDOWS\$NtUninstallKB920872$\spuninst\spuninst.exe" Päivitys Windows XP:lle (KB922582) --> "C:\WINDOWS\$NtUninstallKB922582$\spuninst\spuninst.exe" Päivitys Windows XP:lle (KB927891) --> "C:\WINDOWS\$NtUninstallKB927891$\spuninst\spuninst.exe" Päivitys Windows XP:lle (KB929338) --> "C:\WINDOWS\$NtUninstallKB929338$\spuninst\spuninst.exe" Päivitys Windows XP:lle (KB930916) --> "C:\WINDOWS\$NtUninstallKB930916$\spuninst\spuninst.exe" Päivitys Windows XP:lle (KB931836) --> "C:\WINDOWS\$NtUninstallKB931836$\spuninst\spuninst.exe" Postal 2 --> C:\WINDOWS\unvise32.exe e:\sampo 2\postal 2\uninstal.log Postal 2 Apocalypse Weekend Expansion Pack --> C:\WINDOWS\unvise32.exe e:\sampo 2\postal 2\ApocalypseWeekend\uninstal.log PowerDVD --> RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{6811CAA0-BF12-11D4-9EA1-0050BAE317E1}\Setup.exe" -uninstall Project Reality v0.6.0.9 --> "E:\Sampo 2\Battlefield 2\unins000.exe" QuickTime --> C:\WINDOWS\unvise32qt.exe C:\WINDOWS\system32\QuickTime\Uninstall.log S.T.A.L.K.E.R. - Shadow of Chernobyl [v1.0003] --> "E:\Sampo 2\S.T.A.L.K.E.R. - Shadow of Chernobyl\unins000.exe" SafeCast Shared Components --> C:\Program Files\Common Files\Macrovision Shared\SafeCast\Install\CDAC13BA.EXE /uninstall ScanToWeb --> RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{EBAE381B-60A6-4863-AA9F-FCAB755BC9E5}\SETUP.EXE" ADDREMOVEDLG Shockwave --> C:\WINDOWS\system32\Macromed\SHOCKW~1\UNWISE.EXE C:\WINDOWS\system32\Macromed\SHOCKW~1\Install.log SmartFTP Client --> MsiExec.exe /I{11C762F9-95EA-486A-A8E7-683A50C231C1} SmartFTP Client 2.0 --> MsiExec.exe /I{C169D3BB-9A27-43F5-9979-09A0D65FE95C} SmartFTP Client 2.0 Setup Files (remove only) --> "C:\Program Files\SmartFTP Client 2.0 Setup Files\uninst-sftp.exe" Soldat 1.3 --> c:\Soldat\unins000.exe Sound Blaster Audigy 2 --> RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{42095863-98D1-4A49-BDF8-638DE8A5F316}\SETUP.EXE" -l0x9 Source SDK Base --> "E:\Sampo 2\steam\steam.exe" steam://uninstall/215 SpeechRedist --> MsiExec.exe /X{8795CBED-55E2-4693-9F14-84EC446935BE} Steam --> MsiExec.exe /X{048298C9-A4D3-490B-9FF9-AB023A9238F3} Suojauspäivitys ohjelmistolle Windows XP (KB923689) --> "C:\WINDOWS\$NtUninstallKB923689$\spuninst\spuninst.exe" Suojauspäivitys Windows XP:lle (KB883939) --> "C:\WINDOWS\$NtUninstallKB883939$\spuninst\spuninst.exe" Suojauspäivitys Windows XP:lle (KB890046) --> "C:\WINDOWS\$NtUninstallKB890046$\spuninst\spuninst.exe" Suojauspäivitys Windows XP:lle (KB893756) --> "C:\WINDOWS\$NtUninstallKB893756$\spuninst\spuninst.exe" Suojauspäivitys Windows XP:lle (KB896358) --> "C:\WINDOWS\$NtUninstallKB896358$\spuninst\spuninst.exe" Suojauspäivitys Windows XP:lle (KB896422) --> "C:\WINDOWS\$NtUninstallKB896422$\spuninst\spuninst.exe" Suojauspäivitys Windows XP:lle (KB896423) --> "C:\WINDOWS\$NtUninstallKB896423$\spuninst\spuninst.exe" Suojauspäivitys Windows XP:lle (KB896424) --> "C:\WINDOWS\$NtUninstallKB896424$\spuninst\spuninst.exe" Suojauspäivitys Windows XP:lle (KB896428) --> "C:\WINDOWS\$NtUninstallKB896428$\spuninst\spuninst.exe" Suojauspäivitys Windows XP:lle (KB896688) --> "C:\WINDOWS\$NtUninstallKB896688$\spuninst\spuninst.exe" Suojauspäivitys Windows XP:lle (KB899587) --> "C:\WINDOWS\$NtUninstallKB899587$\spuninst\spuninst.exe" Suojauspäivitys Windows XP:lle (KB899588) --> "C:\WINDOWS\$NtUninstallKB899588$\spuninst\spuninst.exe" Suojauspäivitys Windows XP:lle (KB899591) --> "C:\WINDOWS\$NtUninstallKB899591$\spuninst\spuninst.exe" Suojauspäivitys Windows XP:lle (KB900725) --> "C:\WINDOWS\$NtUninstallKB900725$\spuninst\spuninst.exe" Suojauspäivitys Windows XP:lle (KB901017) --> "C:\WINDOWS\$NtUninstallKB901017$\spuninst\spuninst.exe" Suojauspäivitys Windows XP:lle (KB901214) --> "C:\WINDOWS\$NtUninstallKB901214$\spuninst\spuninst.exe" Suojauspäivitys Windows XP:lle (KB902400) --> "C:\WINDOWS\$NtUninstallKB902400$\spuninst\spuninst.exe" Suojauspäivitys Windows XP:lle (KB903235) --> "C:\WINDOWS\$NtUninstallKB903235$\spuninst\spuninst.exe" Suojauspäivitys Windows XP:lle (KB904706) --> "C:\WINDOWS\$NtUninstallKB904706$\spuninst\spuninst.exe" Suojauspäivitys Windows XP:lle (KB905414) --> "C:\WINDOWS\$NtUninstallKB905414$\spuninst\spuninst.exe" Suojauspäivitys Windows XP:lle (KB905749) --> "C:\WINDOWS\$NtUninstallKB905749$\spuninst\spuninst.exe" Suojauspäivitys Windows XP:lle (KB905915) --> "C:\WINDOWS\$NtUninstallKB905915$\spuninst\spuninst.exe" Suojauspäivitys Windows XP:lle (KB908519) --> "C:\WINDOWS\$NtUninstallKB908519$\spuninst\spuninst.exe" Suojauspäivitys Windows XP:lle (KB908531) --> "C:\WINDOWS\$NtUninstallKB908531$\spuninst\spuninst.exe" Suojauspäivitys Windows XP:lle (KB911562) --> "C:\WINDOWS\$NtUninstallKB911562$\spuninst\spuninst.exe" Suojauspäivitys Windows XP:lle (KB911567) --> "C:\WINDOWS\$NtUninstallKB911567$\spuninst\spuninst.exe" Suojauspäivitys Windows XP:lle (KB911927) --> "C:\WINDOWS\$NtUninstallKB911927$\spuninst\spuninst.exe" Suojauspäivitys Windows XP:lle (KB912812) --> "C:\WINDOWS\$NtUninstallKB912812$\spuninst\spuninst.exe" Suojauspäivitys Windows XP:lle (KB912919) --> "C:\WINDOWS\$NtUninstallKB912919$\spuninst\spuninst.exe" Suojauspäivitys Windows XP:lle (KB913446) --> "C:\WINDOWS\$NtUninstallKB913446$\spuninst\spuninst.exe" Suojauspäivitys Windows XP:lle (KB913580) --> "C:\WINDOWS\$NtUninstallKB913580$\spuninst\spuninst.exe" Suojauspäivitys Windows XP:lle (KB914388) --> "C:\WINDOWS\$NtUninstallKB914388$\spuninst\spuninst.exe" Suojauspäivitys Windows XP:lle (KB914389) --> "C:\WINDOWS\$NtUninstallKB914389$\spuninst\spuninst.exe" Suojauspäivitys Windows XP:lle (KB916281) --> "C:\WINDOWS\$NtUninstallKB916281$\spuninst\spuninst.exe" Suojauspäivitys Windows XP:lle (KB917159) --> "C:\WINDOWS\$NtUninstallKB917159$\spuninst\spuninst.exe" Suojauspäivitys Windows XP:lle (KB917344) --> "C:\WINDOWS\$NtUninstallKB917344$\spuninst\spuninst.exe" Suojauspäivitys Windows XP:lle (KB917422) --> "C:\WINDOWS\$NtUninstallKB917422$\spuninst\spuninst.exe" Suojauspäivitys Windows XP:lle (KB917953) --> "C:\WINDOWS\$NtUninstallKB917953$\spuninst\spuninst.exe" Suojauspäivitys Windows XP:lle (KB918118) --> "C:\WINDOWS\$NtUninstallKB918118$\spuninst\spuninst.exe" Suojauspäivitys Windows XP:lle (KB918439) --> "C:\WINDOWS\$NtUninstallKB918439$\spuninst\spuninst.exe" Suojauspäivitys Windows XP:lle (KB918899) --> "C:\WINDOWS\$NtUninstallKB918899$\spuninst\spuninst.exe" Suojauspäivitys Windows XP:lle (KB919007) --> "C:\WINDOWS\$NtUninstallKB919007$\spuninst\spuninst.exe" Suojauspäivitys Windows XP:lle (KB920213) --> "C:\WINDOWS\$NtUninstallKB920213$\spuninst\spuninst.exe" Suojauspäivitys Windows XP:lle (KB920214) --> "C:\WINDOWS\$NtUninstallKB920214$\spuninst\spuninst.exe" Suojauspäivitys Windows XP:lle (KB920670) --> "C:\WINDOWS\$NtUninstallKB920670$\spuninst\spuninst.exe" Suojauspäivitys Windows XP:lle (KB920683) --> "C:\WINDOWS\$NtUninstallKB920683$\spuninst\spuninst.exe" Suojauspäivitys Windows XP:lle (KB920685) --> "C:\WINDOWS\$NtUninstallKB920685$\spuninst\spuninst.exe" Suojauspäivitys Windows XP:lle (KB921398) --> "C:\WINDOWS\$NtUninstallKB921398$\spuninst\spuninst.exe" Suojauspäivitys Windows XP:lle (KB921883) --> "C:\WINDOWS\$NtUninstallKB921883$\spuninst\spuninst.exe" Suojauspäivitys Windows XP:lle (KB922616) --> "C:\WINDOWS\$NtUninstallKB922616$\spuninst\spuninst.exe" Suojauspäivitys Windows XP:lle (KB922760) --> "C:\WINDOWS\$NtUninstallKB922760$\spuninst\spuninst.exe" Suojauspäivitys Windows XP:lle (KB922819) --> "C:\WINDOWS\$NtUninstallKB922819$\spuninst\spuninst.exe" Suojauspäivitys Windows XP:lle (KB923191) --> "C:\WINDOWS\$NtUninstallKB923191$\spuninst\spuninst.exe" Suojauspäivitys Windows XP:lle (KB923414) --> "C:\WINDOWS\$NtUninstallKB923414$\spuninst\spuninst.exe" Suojauspäivitys Windows XP:lle (KB923694) --> "C:\WINDOWS\$NtUninstallKB923694$\spuninst\spuninst.exe" Suojauspäivitys Windows XP:lle (KB923980) --> "C:\WINDOWS\$NtUninstallKB923980$\spuninst\spuninst.exe" Suojauspäivitys Windows XP:lle (KB924191) --> "C:\WINDOWS\$NtUninstallKB924191$\spuninst\spuninst.exe" Suojauspäivitys Windows XP:lle (KB924270) --> "C:\WINDOWS\$NtUninstallKB924270$\spuninst\spuninst.exe" Suojauspäivitys Windows XP:lle (KB924496) --> "C:\WINDOWS\$NtUninstallKB924496$\spuninst\spuninst.exe" Suojauspäivitys Windows XP:lle (KB924667) --> "C:\WINDOWS\$NtUninstallKB924667$\spuninst\spuninst.exe" Suojauspäivitys Windows XP:lle (KB925454) --> "C:\WINDOWS\$NtUninstallKB925454$\spuninst\spuninst.exe" Suojauspäivitys Windows XP:lle (KB925486) --> "C:\WINDOWS\$NtUninstallKB925486$\spuninst\spuninst.exe" Suojauspäivitys Windows XP:lle (KB925902) --> "C:\WINDOWS\$NtUninstallKB925902$\spuninst\spuninst.exe" Suojauspäivitys Windows XP:lle (KB926255) --> "C:\WINDOWS\$NtUninstallKB926255$\spuninst\spuninst.exe" Suojauspäivitys Windows XP:lle (KB926436) --> "C:\WINDOWS\$NtUninstallKB926436$\spuninst\spuninst.exe" Suojauspäivitys Windows XP:lle (KB927779) --> "C:\WINDOWS\$NtUninstallKB927779$\spuninst\spuninst.exe" Suojauspäivitys Windows XP:lle (KB927802) --> "C:\WINDOWS\$NtUninstallKB927802$\spuninst\spuninst.exe" Suojauspäivitys Windows XP:lle (KB928090) --> "C:\WINDOWS\$NtUninstallKB928090$\spuninst\spuninst.exe" Suojauspäivitys Windows XP:lle (KB928255) --> "C:\WINDOWS\$NtUninstallKB928255$\spuninst\spuninst.exe" Suojauspäivitys Windows XP:lle (KB928843) --> "C:\WINDOWS\$NtUninstallKB928843$\spuninst\spuninst.exe" Suojauspäivitys Windows XP:lle (KB929123) --> "C:\WINDOWS\$NtUninstallKB929123$\spuninst\spuninst.exe" Suojauspäivitys Windows XP:lle (KB929969) --> "C:\WINDOWS\$NtUninstallKB929969$\spuninst\spuninst.exe" Suojauspäivitys Windows XP:lle (KB930178) --> "C:\WINDOWS\$NtUninstallKB930178$\spuninst\spuninst.exe" Suojauspäivitys Windows XP:lle (KB931261) --> "C:\WINDOWS\$NtUninstallKB931261$\spuninst\spuninst.exe" Suojauspäivitys Windows XP:lle (KB931768) --> "C:\WINDOWS\$NtUninstallKB931768$\spuninst\spuninst.exe" Suojauspäivitys Windows XP:lle (KB931784) --> "C:\WINDOWS\$NtUninstallKB931784$\spuninst\spuninst.exe" Suojauspäivitys Windows XP:lle (KB932168) --> "C:\WINDOWS\$NtUninstallKB932168$\spuninst\spuninst.exe" Suojauspäivitys Windows XP:lle (KB933566) --> "C:\WINDOWS\$NtUninstallKB933566$\spuninst\spuninst.exe" Suojauspäivitys Windows XP:lle (KB935839) --> "C:\WINDOWS\$NtUninstallKB935839$\spuninst\spuninst.exe" Suojauspäivitys Windows XP:lle (KB935840) --> "C:\WINDOWS\$NtUninstallKB935840$\spuninst\spuninst.exe" Tactical Ops --> C:\WINDOWS\IsUninst.exe -f"e:\sampo 2\Tactical ops\Uninst.isu" -c"e:\sampo 2\tactical ops\Uninst.dll" TeamSpeak 2 RC2 --> "C:\Program Files\Teamspeak2_RC2\unins000.exe" The Sims 2 --> C:\pelit 2\The sims 2\EAUninstall.exe Unreal Tournament 2004 --> E:\sampo 2\UT 2004\System\Setup.exe uninstall "UT2004" Ventrilo Client --> MsiExec.exe /I{789289CA-F73A-4A16-A331-54D498CE069F} WinRAR-pakkausohjelma --> C:\Program Files\WinRAR\uninstall.exe WinZip --> "C:\Program Files\WinZip\WINZIP32.EXE" /uninstall Wise Registry Cleaner 1.7 --> "C:\jeal\Helppo rekisterin siivooja MB\Wise Registry Cleaner\unins000.exe" Wolfenstein - Enemy Territory --> E:\SAMPO2~1\WOLFEN~1\Uninstall\Unwise.exe /u E:\SAMPO2~1\WOLFEN~1\Uninstall\Install.log Worms Armageddon --> C:\WINDOWS\IsUninst.exe -fc:\pelit\Uninst.isu ZD1211 802.11g Wireless LAN - USB --> RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{581CE7EA-A30D-11D6-8496-000000120101}\setup.exe" -l0x9 -- End of Deckard's System Scanner: finished at 2007-07-17 at 13:03:47 ---------
C:\pelit 2\BitComet\Downloads\Crack Search [www.pctorrent.com]\Cracks\B\A\Battlefield_1942_CD_Keygen.zip\Keygen.exe C:\Six_Steam.rar\SiX.exe E:\Six_Steam.rar\SiX.exe C:\WINDOWS\Downloaded Program Files\gsda.dll (Submitted) C:\pelit 2\BitComet\Downloads\Crack Search [www.pctorrent.com]\Cracks\Z\I\Zip_Password_Cracker_Pro_v1.1b.zip\Zip_Cracker - keygen.exe C:\pelit 2\BitComet\Downloads\Crack Search [www.pctorrent.com]\Cracks\Z\I\Zip_Password_Cracker_Pro_v1.1b\Zip_Cracker - keygen.exe E:\Sampo 2\Postal 2\ApocalypseWeekend\System\reloaded.exe (Disinfected & Submitted) Noita kannattaa varmaan poistella ======= Pysy puhtaana -> Tyhjennä järjestelmänpalautus Ohjeet Tyhjennä järjestelmänpalautuskansio ja luo uusi palautuspiste. Tämä puhdistaa palautuskansion mahdollisista haittaohjelmajäännöksistä. -> Käytä CCleaneria -> CCleaner Lataa ja asenna CCleaner. Puhdista väliaikaistiedostot ja -kansiot ohjelmalla säännöllisesti. -> Asenna SpywareBlaster -> SpywareBlaster SpywareBlaster estää haittaohjelmia asentumasta koneellesi. Ei kuluta muistia! Opas saatavilla suomeksi! Nimimerkki Ad-Awaren opas -> Asenna MVPS Hosts tiedosto -> MVPS Hosts Estää koneesi yhteyden haitallisiin sivustoihin. Opas saatavilla suomeksi! Nimimerkki Axelin opas -> Vaihda selaimesi Firefoxiin -> Firefox Firefox on nopeampi, turvallisempi ja parempi selain kuin Internet Explorer. -> Pidä järjestelmäsi ajantasalla. -> Windows Update Vieraile Windows Updatessa säännöllisesti. -> Pidä palomuuri ja virustorjunta ajantasalla Päivitä ja skannaa koneesi säännöllisesti virustorjuntaohjelmallasi. ja hyvä myös escan http://koti.mbnet.fi/pattaya1/escanmwav.htm ->Pidä ohjelmistosi ajantasalla. -> Secunia Software Inspector Secunia Software Inspector tutkii sinun järjestälmäsi ja ohjelmistosi puuttuvien turvallisuuspäivityksien osalta. Tavallinen tutkinta kestää normaalisti 5-40 sekuntia, kun läpikotainen (thorough system inspection) voi kestää useita minuutteja. ->Seuraa säännöllisesti viestintäviraston tietoja uusista haavoittuvuuksista -> CERT-FI Jos tulevaisuudessa tulee haittaohjelmien kanssa ongelmia, älä epäröi laittaa Hijackthis-logia tarkistettavaksi!
