Koneesta löytyi virus. Hjt -logi.

Discussion in 'Virukset ja haittaohjelmat - HijackThis -logit' started by Laur1, Aug 12, 2007.

  1. Laur1

    Laur1 Member

    Joined:
    Mar 1, 2007
    Messages:
    11
    Likes Received:
    0
    Trophy Points:
    11
    Terve

    Koneestani löytyi virus, jonka luullakseni poistin. Tässä hjt -logi siltä varalta, että jotain on vielä pielessä.

    Kiitos mahdollisesta avusta etukäteen!

    Logfile of Trend Micro HijackThis v2.0.2
    Scan saved at 9:48:45 PM, on 08/12/2007
    Platform: Windows XP SP2 (WinNT 5.01.2600)
    MSIE: Internet Explorer v7.00 (7.00.6000.16473)
    Boot mode: Normal

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\system32\spoolsv.exe
    C:\WINDOWS\Explorer.EXE
    C:\Program Files\AntiVir PersonalEdition Classic\avgnt.exe
    C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
    C:\Program Files\ABIT\ABIT uGuru\uGuru.exe
    C:\WINDOWS\SnoopFreeUI.exe
    C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
    C:\WINDOWS\system32\ctfmon.exe
    C:\Program Files\ABIT\ABIT uGuru\uGuru_Event_Receiver.exe
    C:\Program Files\allSnap\allSnap.exe
    C:\Pelit\PokerOffice\bin\javaw.exe
    C:\Program Files\AntiVir PersonalEdition Classic\sched.exe
    C:\Program Files\AntiVir PersonalEdition Classic\avguard.exe
    C:\WINDOWS\System32\SnoopFreeSvc.exe
    C:\WINDOWS\system32\ZoneLabs\vsmon.exe
    C:\Program Files\AntiVir PersonalEdition Classic\avscan.exe
    C:\Kaspersky\mwavscan.com
    C:\Kaspersky\kavss.exe
    C:\Program Files\Internet Explorer\iexplore.exe
    C:\WINDOWS\system32\taskmgr.exe
    C:\Program Files\AntiVir PersonalEdition Classic\avcenter.exe
    C:\Program Files\HijackThis\HijackThis.exe
    C:\Program Files\Mozilla Firefox\firefox.exe

    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = about:blank
    R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
    R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Linkit
    O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
    O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
    O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
    O4 - HKLM\..\Run: [POEngine] "C:\Pelit\PokerOffice\POEngine.exe" C:\Pelit\PokerOffice
    O4 - HKLM\..\Run: [Zone Labs Client] C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
    O4 - HKLM\..\Run: [avgnt] "C:\Program Files\AntiVir PersonalEdition Classic\avgnt.exe" /min
    O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
    O4 - HKLM\..\Run: [ATICCC] "C:\Program Files\ATI Technologies\ATI.ACE\cli.exe" runtime
    O4 - HKLM\..\Run: [ABIT uGuru] C:\Program Files\ABIT\ABIT uGuru\uGuru.exe
    O4 - HKLM\..\Run: [SnoopFreeUI] SnoopFreeUI.exe
    O4 - HKLM\..\Run: [ZoneAlarm Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"
    O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
    O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Paikallinen palve')
    O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Verkkopalve')
    O4 - HKUS\S-1-5-21-1085031214-813497703-725345543-1012\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'postgres')
    O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
    O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
    O4 - Startup: allSnap.lnk = C:\Program Files\allSnap\allSnap.exe
    O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
    O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~3\Office10\EXCEL.EXE/3000
    O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
    O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
    O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe
    O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe
    O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
    O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
    O10 - Unknown file in Winsock LSP: c:\windows\system32\nwprovau.dll
    O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
    O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://download.bitdefender.com/resources/scan8/oscan8.cab
    O23 - Service: AntiVir PersonalEdition Classic Scheduler (AntiVirScheduler) - Avira GmbH - C:\Program Files\AntiVir PersonalEdition Classic\sched.exe
    O23 - Service: AntiVir PersonalEdition Classic Guard (AntiVirService) - Avira GmbH - C:\Program Files\AntiVir PersonalEdition Classic\avguard.exe
    O23 - Service: PostgreSQL Database Server 8.2 (pgsql-8.2) - PostgreSQL Global Development Group - C:\Program Files\PostgreSQ3L\8.2\bin\pg_ctl.exe
    O23 - Service: Snoop Free Service (SnoopFreeSvc) - Unknown owner - C:\WINDOWS\System32\SnoopFreeSvc.exe
    O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe

    --
    End of file - 5456 bytes
     
    Laur1, Aug 12, 2007
    #1
  2. Auttaja

    Auttaja Guest

    Moron! :)

    =========

    Avaa hijackthis merkkaa seuraavat rivi(t) ja paina fix checked, sulje muut ohjelmat siksi aikaa.

    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = about:blank
    R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =


    Tässä ohje miten merkataan:
    [​IMG]


    ==========

    Skannaa koneesi Ewido Online Scannerilla

    * Lataa Ewido_micro.exe tästä.
    * Tallenna tiedosto esimerkiksi työpöydälle.
    * Tuplaklikkaa Ewido_micro.exeä työpöydälläsi.
    * Ewido alkaa samantien päivittämään tunnisteitaan. Tässä voi mennä hetki.
    * Kun päivitykset on ladattu, varmista että kaikki kohdat ovat rastitettuja ikkunan vasemmassa laidassa.
    * Klikkaa vasemmalla alhaalla olevaa Start Scan -nappia.
    * Scannaus alkaa. Tässä voi kestää jonkun aikaa, riippuen tiedostojen määrästä.
    * Kun skannaus on valmis ja löytyneitä kohteita on, niin varmista, että kaikkien kohteiden vasemmalla puolella olevissa kohdissa on rastit.
    * Klikkaa Save report -nappia ja tallenna raportti vaikka työpöydälle.
    * Klikkaa Remove Infections -nappia.
    * Kun vastaat aukeavaan ilmoitukseen ok, niin kaikki saastuneet tiedostot poistetaan.
    * Poiston jälkeen voit sammuttaa Ewido Online Scannerin painamalla yläkulmassa olevaa punaista rastia.
    * Käynnistä kone nyt uudelleen ja postita tallentamasi raportti viestiketjuusi
    ==========


    Loistava ohje tietokoneeen nopeuttamiseksi

    http://neko.1g.fi/ohje/hidastelua.html

    ==========

    Jos sinulla ei ole tätä java versiota (6.2): Vanha java saastuttaa helposti koneesi!

    Javan päivitys ja välimuistin tyhjennys:

    1. Klikkaa Käynnistä -> Ohjauspaneeli ja tupla-klikkaa Lisää tai poista sovellus Ohjauspaneelissa.
    2. Etsi listasta kaikki entiset Java versiosi. (J2SE Runtime Environment.... )
    Niissä pitäisi olla seuraava kuva vieressä: [​IMG]
    3. Valitse kaikki entiset Java versiosi ja valitse Poista.
    4. Asenna uusin Java päivitys seuraavasta linkistä..
    5. Käynnistä kone uudelleen asennuksen jälkeen:

    http://java.sun.com/javase/downloads/index.jsp
    tai http://www.filehippo.com/download_java_runtime/

    Rullaa alas kohteeseen Java Runtime Environment (JRE) 6u2

    Paina Download

    Ruksaa Accept, ota offline installation, tallenna vaikka työpöydälle ja asenna se.

    6. Käynnistyksen jälkeen, mene takaisin Ohjauspaneeliin ja avaa Java asetuksesi (Muita Ohjauspaneelin asetuksia -> Java kahvikuppi).

    7. General Settings -osion alla, vedä liukusäädintä (Disk Space) pienemmälle, ja klikkaa Delete Files -nappia.

    (Jotkut javapohjaiset ohjelmat saattavat tarvita enemmän levytilaa.
    Jos huomaat säädön pienentämisen jälkeen koneessa hitautta, siirrä liukusäädintä isommalle    ).

    8. Varmista että kaikki kaksi valintaa ovat rastitettuja:

    *Applications and Applets

    *Trace and Log Files


    Ja paina OK -nappia

    9. Klikkaa OK "Temporary Files Settings" -ikkunassasi.

    10. Klikkaa OK jättääksesi Java asetusikkunasi.

    ==========

    Lataa Deckard's System Scanner Työpöydällesi.

    Huomioi: Sinulla tulee olla Järjestelmänvalvojan oikeudet ajaaksesi ohjelman.

    [*]Sulje kaikki avoimet ikkunat ja ohjelmat.
    [*]Tupla Klikkaa Dss.exe tiedostoa ajaaksesi ohjelman, seuraa ohjeita.
    [*]Kun Scannaus on valmis 2 textitiedostoa pitäisi avautua, Main.txt ja extra.txt
    [*]Näppäile Kopioi ( CTRL+A -> CTRL + C ) ja liitä ( CTRL + V )
    [*]kopioi ja liitä Extra.txt & Main.txt sisältö seuraavaan vastaukseesi.

    ja ewido online skannerin raportti
     
    Last edited by a moderator: Aug 12, 2007
    Auttaja, Aug 12, 2007
    #2
  3. Laur1

    Laur1 Member

    Joined:
    Mar 1, 2007
    Messages:
    11
    Likes Received:
    0
    Trophy Points:
    11
    Ewido ei löytänyt mitään. Aiemmin tänään löytyi Trojan-Downloader.JS.Psyme.hz

    Tässä dss:n logit.

    Deckard's System Scanner v20070809.63
    Run by Lauri on 2007-08-12 at 23:05:39
    Computer is in Normal Mode.
    --------------------------------------------------------------------------------

    -- System Restore --------------------------------------------------------------

    Successfully created a Deckard's System Scanner Restore Point.


    -- Last 5 Restore Point(s) --
    60: 2007-08-12 20:05:54 UTC - RP638 - Deckard's System Scanner Restore Point
    59: 2007-08-12 20:04:53 UTC - RP637 - Removed J2SE Runtime Environment 5.0 Update 4
    58: 2007-08-12 20:03:38 UTC - RP636 - Removed J2SE Runtime Environment 5.0 Update 2
    57: 2007-08-12 19:49:09 UTC - RP635 - Poistettu QuickTime
    56: 2007-08-12 12:37:53 UTC - RP634 - Järjestelmän tarkistuspiste


    -- First Restore Point --
    1: 2007-05-15 12:01:39 UTC - RP579 - Järjestelmän tarkistuspiste


    Backed up registry hives.
    Performed disk cleanup.



    -- HijackThis (run as Lauri.exe) -----------------------------------------------

    Logfile of Trend Micro HijackThis v2.0.2
    Scan saved at 11:07:37 PM, on 08/12/2007
    Platform: Windows XP SP2 (WinNT 5.01.2600)
    MSIE: Internet Explorer v7.00 (7.00.6000.16473)
    Boot mode: Normal

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\system32\spoolsv.exe
    C:\WINDOWS\Explorer.EXE
    C:\Program Files\AntiVir PersonalEdition Classic\avgnt.exe
    C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
    C:\Program Files\ABIT\ABIT uGuru\uGuru.exe
    C:\WINDOWS\SnoopFreeUI.exe
    C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
    C:\WINDOWS\system32\ctfmon.exe
    C:\Program Files\ABIT\ABIT uGuru\uGuru_Event_Receiver.exe
    C:\Program Files\allSnap\allSnap.exe
    C:\Pelit\PokerOffice\bin\javaw.exe
    C:\Program Files\AntiVir PersonalEdition Classic\sched.exe
    C:\Program Files\AntiVir PersonalEdition Classic\avguard.exe
    C:\WINDOWS\System32\SnoopFreeSvc.exe
    C:\WINDOWS\system32\ZoneLabs\vsmon.exe
    C:\WINDOWS\system32\taskmgr.exe
    C:\Program Files\Mozilla Firefox\firefox.exe
    C:\WINDOWS\system32\rundll32.exe
    C:\Documents and Settings\Lauri\Työpöytä\ewido_micro.exe
    C:\PROGRA~1\COMMON~1\INSTAL~1\Driver\11\INTEL3~1\IDriverT.exe
    C:\PROGRA~1\COMMON~1\INSTAL~1\Driver\11\INTEL3~1\IDriverT.exe
    C:\PROGRA~1\COMMON~1\INSTAL~1\Driver\11\INTEL3~1\IDriverT.exe
    C:\WINDOWS\system32\msiexec.exe
    C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
    C:\WINDOWS\system32\MsiExec.exe
    C:\Documents and Settings\Lauri\Työpöytä\dss.exe
    C:\PROGRA~1\HIJACK~1\Lauri.exe

    R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Linkit
    O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
    O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
    O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
    O4 - HKLM\..\Run: [POEngine] "C:\Pelit\PokerOffice\POEngine.exe" C:\Pelit\PokerOffice
    O4 - HKLM\..\Run: [Zone Labs Client] C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
    O4 - HKLM\..\Run: [avgnt] "C:\Program Files\AntiVir PersonalEdition Classic\avgnt.exe" /min
    O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
    O4 - HKLM\..\Run: [ATICCC] "C:\Program Files\ATI Technologies\ATI.ACE\cli.exe" runtime
    O4 - HKLM\..\Run: [ABIT uGuru] C:\Program Files\ABIT\ABIT uGuru\uGuru.exe
    O4 - HKLM\..\Run: [SnoopFreeUI] SnoopFreeUI.exe
    O4 - HKLM\..\Run: [ZoneAlarm Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"
    O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
    O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
    O4 - HKCU\..\Run: [Yahoo! Pager] "C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe" -quiet
    O4 - HKCU\..\RunOnce: [ypagerps] cmd.exe /C del "C:\Program Files\Yahoo!\Messenger\ypagerps.dll"
    O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Paikallinen palve')
    O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Verkkopalve')
    O4 - HKUS\S-1-5-21-1085031214-813497703-725345543-1012\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'postgres')
    O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
    O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
    O4 - Startup: allSnap.lnk = C:\Program Files\allSnap\allSnap.exe
    O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
    O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~3\Office10\EXCEL.EXE/3000
    O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\npjpi150_06.dll
    O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\npjpi150_06.dll
    O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe
    O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe
    O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
    O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
    O10 - Unknown file in Winsock LSP: c:\windows\system32\nwprovau.dll
    O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
    O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://download.bitdefender.com/resources/scan8/oscan8.cab
    O23 - Service: AntiVir PersonalEdition Classic Scheduler (AntiVirScheduler) - Avira GmbH - C:\Program Files\AntiVir PersonalEdition Classic\sched.exe
    O23 - Service: AntiVir PersonalEdition Classic Guard (AntiVirService) - Avira GmbH - C:\Program Files\AntiVir PersonalEdition Classic\avguard.exe
    O23 - Service: PostgreSQL Database Server 8.2 (pgsql-8.2) - PostgreSQL Global Development Group - C:\Program Files\PostgreSQ3L\8.2\bin\pg_ctl.exe
    O23 - Service: Snoop Free Service (SnoopFreeSvc) - Unknown owner - C:\WINDOWS\System32\SnoopFreeSvc.exe
    O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe

    --
    End of file - 5667 bytes

    -- HijackThis Fixed Entries (C:\PROGRA~1\HIJACK~1\backups\) --------------------

    backup-20070812-222427-158 R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
    backup-20070812-222427-194 R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
    backup-20070812-222427-232 R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
    backup-20070812-222427-452 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = about:blank

    -- File Associations -----------------------------------------------------------

    All associations okay.


    -- Drivers: 0-Boot, 1-System, 2-Auto, 3-Demand, 4-Disabled ---------------------

    R0 sfdrv01 (StarForce Protection Environment Driver (version 1.x)) - c:\windows\system32\drivers\sfdrv01.sys <Not Verified; Protection Technology; StarForce Protection System>
    R0 sfhlp02 (StarForce Protection Helper Driver (version 2.x)) - c:\windows\system32\drivers\sfhlp02.sys <Not Verified; Protection Technology; StarForce Protection System>
    R0 sfsync02 (StarForce Protection Synchronization Driver (version 2.x)) - c:\windows\system32\drivers\sfsync02.sys <Not Verified; Protection Technology; StarForce Protection System>
    R0 SnoopFree (SnoopFree Driver) - c:\windows\system32\drivers\snopfree.sys
    R0 uGuru - c:\windows\system32\drivers\uguru.sys <Not Verified; ABIT Computer Corporation; uGuru V2.0 device driver>
    R3 pfc (Padus ASPI Shell) - c:\windows\system32\drivers\pfc.sys <Not Verified; Padus, Inc.; Padus(R) ASPI Shell>

    S3 gtermddo - c:\docume~1\lauri\locals~1\temp\gtermddo.sys (file missing)
    S3 Memctl - c:\program files\abit\abit uguru\memctl.sys
    S3 razerusb - c:\windows\system32\drivers\razerusb.sys <Not Verified; Razer Inc.; Razer USB Mouse Driver>
    S3 TFBULK (Topfield USB client driver) - c:\windows\system32\drivers\tfbulk.sys <Not Verified; Topfield Co., Ltd.; >
    S3 WinDriver6 - c:\windows\system32\drivers\windrvr6.sys <Not Verified; Jungo; WinDriver Device Driver>
    S3 Winflash - c:\program files\abit\abit uguru\winflash.sys


    -- Services: 0-Boot, 1-System, 2-Auto, 3-Demand, 4-Disabled --------------------

    R2 AntiVirScheduler (AntiVir PersonalEdition Classic Scheduler) - c:\program files\antivir personaledition classic\sched.exe <Not Verified; Avira GmbH; Scheduler>
    R2 pgsql-8.2 (PostgreSQL Database Server 8.2) - "c:\program files\postgresq3l\8.2\bin\pg_ctl.exe" runservice -n "pgsql-8.2" -d "c:\program files\postgresq3l\8.2\data\" <Not Verified; PostgreSQL Global Development Group; PostgreSQL>
    R2 SnoopFreeSvc (Snoop Free Service) - system32\snoopfreesvc.exe


    -- Device Manager: Disabled ----------------------------------------------------

    No disabled devices found.


    -- Scheduled Tasks -------------------------------------------------------------

    2007-06-19 03:00:00 362 --a------ C:\WINDOWS\Tasks\XoftSpySE.job


    -- Files created between 2007-07-12 and 2007-08-12 -----------------------------

    2007-08-12 22:38:17 0 d-------- C:\Program Files\SpywareBlaster
    2007-08-12 22:32:30 0 d-------- C:\hosts
    2007-08-12 21:06:22 0 dr-h----- C:\Documents and Settings\Lauri\Recent
    2007-08-12 20:30:54 0 d-------- C:\Program Files\CCleaner
    2007-08-09 11:49:27 0 d-------- C:\Program Files\PokerStove
    2007-08-08 17:14:00 0 d-a------ C:\Documents and Settings\All Users\Application Data\TEMP
    2007-07-19 23:37:25 0 d-------- C:\Program Files\Poker Evolver


    -- Find3M Report ---------------------------------------------------------------

    2007-08-12 23:05:24 0 d-------- C:\Program Files\Java
    2007-08-12 22:51:00 0 d-------- C:\Program Files\QuickTime
    2007-08-12 17:13:00 0 d-------- C:\Program Files\Poker Tracker V2
    2007-07-29 19:38:56 0 d-------- C:\Program Files\PokerAce Hud
    2007-07-20 12:12:12 375602 --a------ C:\WINDOWS\system32\perfh00B.dat
    2007-07-20 12:12:12 75610 --a------ C:\WINDOWS\system32\perfc00B.dat
    2007-06-15 00:15:01 0 d-------- C:\Program Files\TVAnts
    2007-06-15 00:04:51 0 d-------- C:\Program Files\PPMate
    2007-06-15 00:04:22 0 d-------- C:\Documents and Settings\Lauri\Application Data\PPMate
    2007-06-15 00:04:20 0 d-------- C:\Program Files\Common Files
    2007-06-15 00:04:20 0 d-------- C:\Program Files\Common Files\Synacast
    2007-06-15 00:03:37 0 d-------- C:\Documents and Settings\Lauri\Application Data\SopCast


    -- Registry Dump ---------------------------------------------------------------

    *Note* empty entries & legit default entries are not shown


    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "POEngine"="C:\Pelit\PokerOffice\POEngine.exe" [07/13/2005 05:17 PM]
    "Zone Labs Client"="C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe" [03/09/2007 12:02 AM]
    "avgnt"="C:\Program Files\AntiVir PersonalEdition Classic\avgnt.exe" [04/20/2007 09:12 PM]
    "ATIPTA"="C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe" [03/22/2005 09:05 PM]
    "ATICCC"="C:\Program Files\ATI Technologies\ATI.ACE\cli.exe" [08/31/2005 12:40 AM]
    "ABIT uGuru"="C:\Program Files\ABIT\ABIT uGuru\uGuru.exe" [05/21/2004 04:07 PM]
    "SnoopFreeUI"="SnoopFreeUI.exe" [02/21/2007 01:50 PM C:\WINDOWS\SnoopFreeUI.exe]
    "ZoneAlarm Client"="C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe" [03/09/2007 12:02 AM]
    "SunJavaUpdateSched"="C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe" [11/10/2005 02:03 PM]

    [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [09/15/2004 03:00 PM]
    "Yahoo! Pager"="C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe" [07/16/2007 03:17 PM]

    [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\runonce]
    "ypagerps"=cmd.exe /C del "C:\Program Files\Yahoo!\Messenger\ypagerps.dll"

    C:\Documents and Settings\Lauri\K„ynnist„-valikko\Ohjelmat\K„ynnistys\
    allSnap.lnk - C:\Program Files\allSnap\allSnap.exe [03/20/2004 12:02:14 AM]

    C:\Documents and Settings\All Users\K„ynnist„-valikko\Ohjelmat\K„ynnistys\
    Adobe Reader Speed Launch.lnk - C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe [09/23/2005 10:05:26 PM]

    [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer]
    "LinkResolveIgnoreLinkInfo"=0 (0x0)
    "NoResolveSearch"=1 (0x1)

    [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]
    "NoTrayItemsDisplay"=00000000
    "LinkResolveIgnoreLinkInfo"=0 (0x0)

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
    "SandraTheSrv"=3 (0x3)
    "SandraDataSrv"=3 (0x3)
    "iPodService"=3 (0x3)
    "IDriverT"=3 (0x3)
    "ATI Smart"=2 (0x2)
    "Ati HotKey Poller"=2 (0x2)

    [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-]
    "InCD"=C:\Program Files\Ahead\InCD\InCD.exe
    "iTunesHelper"="C:\Program Files\iTunes\iTunesHelper.exe"
    "NeroCheck"=C:\WINDOWS\system32\NeroCheck.exe
    "QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" -atboottime
    "type32"="C:\Program Files\Microsoft IntelliType Pro\type32.exe"


    [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\F]
    AutoRun\command- F:\LaunchU3.exe -a




    -- Hosts -----------------------------------------------------------------------

    127.0.0.1 ad.a8.net
    127.0.0.1 asy.a8ww.net
    127.0.0.1 www.aaa-livedoor.net #[Trojan-PSW.Win32.Maran.ei]
    127.0.0.1 www.abcsearcher.com #[Spamdexing][Microsoft.Strider]
    127.0.0.1 abc-search.info
    127.0.0.1 abloga.info #[Spamdexing]
    127.0.0.1 www.abx4.com #[Adware.ABXToolbar]
    127.0.0.1 www.acezip.net #[Win32/Adware.180Solutions]
    127.0.0.1 phpadsnew.abac.com
    127.0.0.1 a.abnad.net

    16032 more entries in hosts file.


    -- End of Deckard's System Scanner: finished at 2007-08-12 at 23:10:15 ---------

    Deckard's System Scanner v20070809.63
    Extra logfile - please post this as an attachment with your post.
    --------------------------------------------------------------------------------

    -- System Information ----------------------------------------------------------

    Microsoft Windows XP Home Edition (build 2600) SP 2.0
    Architecture: X86; Language: Other (040B) - see http://preview.tinyurl.com/mhhp6

    CPU 0: Intel(R) Pentium(R) 4 CPU 3.00GHz
    CPU 1: Intel(R) Pentium(R) 4 CPU 3.00GHz
    Percentage of Memory in Use: 32%
    Physical Memory (total/avail): 2047.48 MiB / 1388.56 MiB
    Pagefile Memory (total/avail): 3429.91 MiB / 2808.06 MiB
    Virtual Memory (total/avail): 2047.88 MiB / 1960.73 MiB

    A: is Removable (No Media)
    C: is Fixed (NTFS) - 189.91 GiB total, 97.83 GiB free.
    D: is CDROM (UDF)
    E: is CDROM (No Media)


    -- Security Center -------------------------------------------------------------

    AUOptions is set to notify before download.
    Windows Internal Firewall is disabled.

    FirstRunDisabled is set.

    FW: ZoneAlarm Firewall v7.0.337.000 (Check Point, LTD.)
    AV: Avira AntiVir PersonalEdition Classic v0.0.0.0 (Avira GmbH) Disabled
    AV: Avira AntiVir PersonalEdition Classic v0.0.0.0 (Avira GmbH)
    AV: Avira AntiVir PersonalEdition Classic v0.0.0.0 (Avira GmbH)
    AV: Avira AntiVir PersonalEdition Classic v0.0.0.0 (Avira GmbH)
    AV: Avira AntiVir PersonalEdition Classic v0.0.0.0 (Avira GmbH)
    AV: Avira AntiVir PersonalEdition Classic v0.0.0.0 (Avira GmbH)
    AV: Avira AntiVir PersonalEdition Classic v0.0.0.0 (Avira GmbH)
    AV: Avira AntiVir PersonalEdition Classic v0.0.0.0 (Avira GmbH)
    AV: Avira AntiVir PersonalEdition Classic v0.0.0.0 (Avira GmbH) Disabled
    AV: Avira AntiVir PersonalEdition Classic v0.0.0.0 (Avira GmbH)
    AV: Avira AntiVir PersonalEdition Classic v0.0.0.0 (Avira GmbH)
    AV: Avira AntiVir PersonalEdition Classic v0.0.0.0 (Avira GmbH)
    AV: Avira AntiVir PersonalEdition Classic v0.0.0.0 (Avira GmbH)
    AV: Avira AntiVir PersonalEdition Classic v0.0.0.0 (Avira GmbH)
    AV: Avira AntiVir PersonalEdition Classic v0.0.0.0 (Avira GmbH)
    AV: Avira AntiVir PersonalEdition Classic v0.0.0.0 (Avira GmbH)
    AV: Avira AntiVir PersonalEdition Classic v0.0.0.0 (Avira GmbH)
    AV: Avira AntiVir PersonalEdition Classic v0.0.0.0 (Avira GmbH)
    AV: Avira AntiVir PersonalEdition Classic v0.0.0.0 (Avira GmbH)
    AV: Avira AntiVir PersonalEdition Classic v0.0.0.0 (Avira GmbH)
    AV: Avira AntiVir PersonalEdition Classic v0.0.0.0 (Avira GmbH) Disabled
    AV: Avira AntiVir PersonalEdition Classic v0.0.0.0 (Avira GmbH)
    AV: Avira AntiVir PersonalEdition Classic v0.0.0.0 (Avira GmbH)
    AV: Avira AntiVir PersonalEdition Classic v0.0.0.0 (Avira GmbH)
    AV: Avira AntiVir PersonalEdition Classic v0.0.0.0 (Avira GmbH)
    AV: Avira AntiVir PersonalEdition Classic v0.0.0.0 (Avira GmbH)
    AV: Avira AntiVir PersonalEdition Classic v0.0.0.0 (Avira GmbH)
    AV: Avira AntiVir PersonalEdition Classic v0.0.0.0 (Avira GmbH)
    AV: Avira AntiVir PersonalEdition Classic v0.0.0.0 (Avira GmbH) Disabled
    AV: Avira AntiVir PersonalEdition Classic v0.0.0.0 (Avira GmbH)
    AV: Avira AntiVir PersonalEdition Classic v0.0.0.0 (Avira GmbH)
    AV: Avira AntiVir PersonalEdition Classic v0.0.0.0 (Avira GmbH)
    AV: Avira AntiVir PersonalEdition Classic v0.0.0.0 (Avira GmbH)
    AV: Avira AntiVir PersonalEdition Classic v0.0.0.0 (Avira GmbH)
    AV: Avira AntiVir PersonalEdition Classic v0.0.0.0 (Avira GmbH)
    AV: Avira AntiVir PersonalEdition Classic v0.0.0.0 (Avira GmbH)
    AV: Avira AntiVir PersonalEdition Classic v0.0.0.0 (Avira GmbH)
    AV: Avira AntiVir PersonalEdition Classic v0.0.0.0 (Avira GmbH)
    AV: Avira AntiVir PersonalEdition Classic v0.0.0.0 (Avira GmbH)
    AV: Avira AntiVir PersonalEdition Classic v0.0.0.0 (Avira GmbH)
    AV: Avira AntiVir PersonalEdition Classic v0.0.0.0 (Avira GmbH)
    AV: Avira AntiVir PersonalEdition Classic v0.0.0.0 (Avira GmbH)
    AV: Avira AntiVir PersonalEdition Classic v0.0.0.0 (Avira GmbH)
    AV: Avira AntiVir PersonalEdition Classic v0.0.0.0 (Avira GmbH)
    AV: Avira AntiVir PersonalEdition Classic v0.0.0.0 (Avira GmbH)
    AV: Avira AntiVir PersonalEdition Classic v0.0.0.0 (Avira GmbH)
    AV: Avira AntiVir PersonalEdition Classic v0.0.0.0 (Avira GmbH)
    AV: Avira AntiVir PersonalEdition Classic v0.0.0.0 (Avira GmbH)
    AV: Avira AntiVir PersonalEdition Classic v0.0.0.0 (Avira GmbH)
    AV: Avira AntiVir PersonalEdition Classic v0.0.0.0 (Avira GmbH)
    AV: Avira AntiVir PersonalEdition Classic v0.0.0.0 (Avira GmbH)
    AV: Avira AntiVir PersonalEdition Classic v0.0.0.0 (Avira GmbH)
    AV: Avira AntiVir PersonalEdition Classic v0.0.0.0 (Avira GmbH)
    AV: Avira AntiVir PersonalEdition Classic v0.0.0.0 (Avira GmbH)
    AV: Avira AntiVir PersonalEdition Classic v0.0.0.0 (Avira GmbH)
    AV: Avira AntiVir PersonalEdition Classic v0.0.0.0 (Avira GmbH)
    AV: Avira AntiVir PersonalEdition Classic v0.0.0.0 (Avira GmbH)
    AV: Avira AntiVir PersonalEdition Classic v0.0.0.0 (Avira GmbH) Disabled
    AV: Avira AntiVir PersonalEdition Classic v0.0.0.0 (Avira GmbH)
    AV: Avira AntiVir PersonalEdition Classic v0.0.0.0 (Avira GmbH)
    AV: Avira AntiVir PersonalEdition Classic v0.0.0.0 (Avira GmbH)
    AV: Avira AntiVir PersonalEdition Classic v0.0.0.0 (Avira GmbH)
    AV: Avira AntiVir PersonalEdition Classic v0.0.0.0 (Avira GmbH)
    AV: Avira AntiVir PersonalEdition Classic v0.0.0.0 (Avira GmbH)
    AV: Avira AntiVir PersonalEdition Classic v0.0.0.0 (Avira GmbH) Disabled
    AV: Avira AntiVir PersonalEdition Classic v0.0.0.0 (Avira GmbH)
    AV: Avira AntiVir PersonalEdition Classic v0.0.0.0 (Avira GmbH)
    AV: Avira AntiVir PersonalEdition Classic v0.0.0.0 (Avira GmbH)
    AV: Avira AntiVir PersonalEdition Classic v0.0.0.0 (Avira GmbH)
    AV: Avira AntiVir PersonalEdition Classic v0.0.0.0 (Avira GmbH)
    AV: Avira AntiVir PersonalEdition Classic v0.0.0.0 (Avira GmbH)
    AV: Avira AntiVir PersonalEdition Classic v0.0.0.0 (Avira GmbH)
    AV: Avira AntiVir PersonalEdition Classic v 6.38.1.19
    (Avira GmbH) Disabled
    AV: Avira AntiVir PersonalEdition Classic v0.0.0.0 (Avira GmbH)
    AV: Avira AntiVir PersonalEdition Classic v0.0.0.0 (Avira GmbH) Disabled
    AV: Avira AntiVir PersonalEdition Classic v0.0.0.0 (Avira GmbH)
    AV: Avira AntiVir PersonalEdition Classic v0.0.0.0 (Avira GmbH)
    AV: Avira AntiVir PersonalEdition Classic v0.0.0.0 (Avira GmbH)
    AV: Avira AntiVir PersonalEdition Classic v0.0.0.0 (Avira GmbH)
    AV: Avira AntiVir PersonalEdition Classic v0.0.0.0 (Avira GmbH)
    AV: Avira AntiVir PersonalEdition Classic v0.0.0.0 (Avira GmbH)
    AV: Avira AntiVir PersonalEdition Classic v0.0.0.0 (Avira GmbH)
    AV: Avira AntiVir PersonalEdition Classic v0.0.0.0 (Avira GmbH)
    AV: Avira AntiVir PersonalEdition Classic v0.0.0.0 (Avira GmbH)
    AV: Avira AntiVir PersonalEdition Classic v0.0.0.0 (Avira GmbH)
    AV: Avira AntiVir PersonalEdition Classic v0.0.0.0 (Avira GmbH)
    AV: Avira AntiVir PersonalEdition Classic v0.0.0.0 (Avira GmbH)
    AV: Avira AntiVir PersonalEdition Classic v0.0.0.0 (Avira GmbH) Disabled
    AV: Avira AntiVir PersonalEdition Classic v0.0.0.0 (Avira GmbH)
    AV: Avira AntiVir PersonalEdition Classic v0.0.0.0 (Avira GmbH)
    AV: Avira AntiVir PersonalEdition Classic v0.0.0.0 (Avira GmbH)
    AV: Avira AntiVir PersonalEdition Classic v0.0.0.0 (Avira GmbH)
    AV: Avira AntiVir PersonalEdition Classic v0.0.0.0 (Avira GmbH)
    AV: Avira AntiVir PersonalEdition Classic v0.0.0.0 (Avira GmbH)
    AV: Avira AntiVir PersonalEdition Classic v0.0.0.0 (Avira GmbH)
    AV: Avira AntiVir PersonalEdition Classic v0.0.0.0 (Avira GmbH)
    AV: Avira AntiVir PersonalEdition Classic v0.0.0.0 (Avira GmbH)
    AV: Avira AntiVir PersonalEdition Classic v0.0.0.0 (Avira GmbH)
    AV: Avira AntiVir PersonalEdition Classic v0.0.0.0 (Avira GmbH)
    AV: Avira AntiVir PersonalEdition Classic v0.0.0.0 (Avira GmbH)
    AV: Avira AntiVir PersonalEdition Classic v0.0.0.0 (Avira GmbH)
    AV: Avira AntiVir PersonalEdition Classic v0.0.0.0 (Avira GmbH) Disabled
    AV: Avira AntiVir PersonalEdition Classic v0.0.0.0 (Avira GmbH)
    AV: Avira AntiVir PersonalEdition Classic v0.0.0.0 (Avira GmbH)
    AV: Avira AntiVir PersonalEdition Classic v0.0.0.0 (Avira GmbH)
    AV: Avira AntiVir PersonalEdition Classic v0.0.0.0 (Avira GmbH)
    AV: Avira AntiVir PersonalEdition Classic v0.0.0.0 (Avira GmbH)
    AV: Avira AntiVir PersonalEdition Classic v0.0.0.0 (Avira GmbH)
    AV: Avira AntiVir PersonalEdition Classic v0.0.0.0 (Avira GmbH)
    AV: Avira AntiVir PersonalEdition Classic v0.0.0.0 (Avira GmbH)
    AV: ZoneAlarm Security Suite Antivirus v7.0.337.000 (Check Point, LTD.)
    AV: Avira AntiVir PersonalEdition Classic v0.0.0.0 (Avira GmbH)
    AV: Avira AntiVir PersonalEdition Classic v0.0.0.0 (Avira GmbH)
    AV: Avira AntiVir PersonalEdition Classic v0.0.0.0 (Avira GmbH)
    AV: Avira AntiVir PersonalEdition Classic v0.0.0.0 (Avira GmbH)
    AV: Avira AntiVir PersonalEdition Classic v0.0.0.0 (Avira GmbH)
    AV: Avira AntiVir PersonalEdition Classic v0.0.0.0 (Avira GmbH)
    AV: Avira AntiVir PersonalEdition Classic v0.0.0.0 (Avira GmbH)
    AV: Avira AntiVir PersonalEdition Classic v 6.38.1.19
    (Avira GmbH)
    AV: Avira AntiVir PersonalEdition Classic v0.0.0.0 (Avira GmbH)
    AV: Avira AntiVir PersonalEdition Classic v0.0.0.0 (Avira GmbH)
    AV: Avira AntiVir PersonalEdition Classic v0.0.0.0 (Avira GmbH)
    AV: Avira AntiVir PersonalEdition Classic v0.0.0.0 (Avira GmbH) Disabled
    AV: Avira AntiVir PersonalEdition Classic v0.0.0.0 (Avira GmbH)
    AV: Avira AntiVir PersonalEdition Classic v0.0.0.0 (Avira GmbH)
    AV: Avira AntiVir PersonalEdition Classic v0.0.0.0 (Avira GmbH) Disabled
    AV: Avira AntiVir PersonalEdition Classic v0.0.0.0 (Avira GmbH)
    AV: Avira AntiVir PersonalEdition Classic v0.0.0.0 (Avira GmbH) Disabled
    AV: Avira AntiVir PersonalEdition Classic v0.0.0.0 (Avira GmbH)
    AV: Avira AntiVir PersonalEdition Classic v0.0.0.0 (Avira GmbH)
    AV: Avira AntiVir PersonalEdition Classic v0.0.0.0 (Avira GmbH)
    AV: Avira AntiVir PersonalEdition v 6.39.0.231
    (Avira GmbH)
    AV: Avira AntiVir PersonalEdition Classic v0.0.0.0 (Avira GmbH)
    AV: Avira AntiVir PersonalEdition Classic v0.0.0.0 (Avira GmbH)
    AV: Avira AntiVir PersonalEdition Classic v0.0.0.0 (Avira GmbH)
    AV: Avira AntiVir PersonalEdition Classic v0.0.0.0 (Avira GmbH)
    AV: Avira AntiVir PersonalEdition Classic v0.0.0.0 (Avira GmbH)
    AV: Avira AntiVir PersonalEdition Classic v0.0.0.0 (Avira GmbH)
    AV: Avira AntiVir PersonalEdition Classic v0.0.0.0 (Avira GmbH) Disabled
    AV: Avira AntiVir PersonalEdition Classic v0.0.0.0 (Avira GmbH)
    AV: Avira AntiVir PersonalEdition Classic v0.0.0.0 (Avira GmbH)
    AV: Avira AntiVir PersonalEdition Classic v0.0.0.0 (Avira GmbH)
    AV: Avira AntiVir PersonalEdition Classic v0.0.0.0 (Avira GmbH)
    AV: Avira AntiVir PersonalEdition Classic v0.0.0.0 (Avira GmbH)
    AV: Avira AntiVir PersonalEdition Classic v0.0.0.0 (Avira GmbH)
    AV: Avira AntiVir PersonalEdition Classic v0.0.0.0 (Avira GmbH)
    AV: Avira AntiVir PersonalEdition Classic v0.0.0.0 (Avira GmbH)
    AV: Avira AntiVir PersonalEdition Classic v0.0.0.0 (Avira GmbH)
    AV: Avira AntiVir PersonalEdition Classic v0.0.0.0 (Avira GmbH)
    AV: Avira AntiVir PersonalEdition Classic v0.0.0.0 (Avira GmbH)
    AV: Avira AntiVir PersonalEdition Classic v0.0.0.0 (Avira GmbH)
    AV: Avira AntiVir PersonalEdition Classic v0.0.0.0 (Avira GmbH)
    AV: Avira AntiVir PersonalEdition Classic v0.0.0.0 (Avira GmbH) Disabled
    AV: Avira AntiVir PersonalEdition Classic v0.0.0.0 (Avira GmbH)
    AV: Avira AntiVir PersonalEdition Classic v0.0.0.0 (Avira GmbH)
    AV: Avira AntiVir PersonalEdition Classic v0.0.0.0 (Avira GmbH)
    AV: Avira AntiVir PersonalEdition Classic v0.0.0.0 (Avira GmbH)
    AV: Avira AntiVir PersonalEdition Classic v0.0.0.0 (Avira GmbH) Disabled
    AV: Avira AntiVir PersonalEdition Classic v0.0.0.0 (Avira GmbH)
    AV: Avira AntiVir PersonalEdition Classic v0.0.0.0 (Avira GmbH)
    AV: Avira AntiVir PersonalEdition Classic v0.0.0.0 (Avira GmbH)
    AV: Avira AntiVir PersonalEdition Classic v0.0.0.0 (Avira GmbH)
    AV: Avira AntiVir PersonalEdition Classic v0.0.0.0 (Avira GmbH)
    AV: Avira AntiVir PersonalEdition Classic v0.0.0.0 (Avira GmbH)
    AV: Avira AntiVir PersonalEdition Classic v0.0.0.0 (Avira GmbH)
    AV: Avira AntiVir PersonalEdition Classic v0.0.0.0 (Avira GmbH)
    AV: Avira AntiVir PersonalEdition Classic v0.0.0.0 (Avira GmbH) Disabled
    AV: Avira AntiVir PersonalEdition Classic v0.0.0.0 (Avira GmbH)
    AV: Avira AntiVir PersonalEdition Classic v0.0.0.0 (Avira GmbH)
    AV: Avira AntiVir PersonalEdition Classic v0.0.0.0 (Avira GmbH) Disabled
    AV: Avira AntiVir PersonalEdition Classic v0.0.0.0 (Avira GmbH)
    AV: Avira AntiVir PersonalEdition Classic v0.0.0.0 (Avira GmbH)
    AV: Avira AntiVir PersonalEdition Classic v0.0.0.0 (Avira GmbH)
    AV: Avira AntiVir PersonalEdition Classic v0.0.0.0 (Avira GmbH)
    AV: Avira AntiVir PersonalEdition Classic v0.0.0.0 (Avira GmbH)
    AV: Avira AntiVir PersonalEdition Classic v0.0.0.0 (Avira GmbH)
    AV: Avira AntiVir PersonalEdition Classic v0.0.0.0 (Avira GmbH)
    AV: Avira AntiVir PersonalEdition Classic v0.0.0.0 (Avira GmbH) Disabled
    AV: Avira AntiVir PersonalEdition Classic v0.0.0.0 (Avira GmbH)
    AV: Avira AntiVir PersonalEdition Classic v0.0.0.0 (Avira GmbH)
    AV: Avira AntiVir PersonalEdition Classic v0.0.0.0 (Avira GmbH)
    AV: Avira AntiVir PersonalEdition Classic v0.0.0.0 (Avira GmbH)
    AV: Avira AntiVir PersonalEdition Classic v0.0.0.0 (Avira GmbH)
    AV: Avira AntiVir PersonalEdition Classic v0.0.0.0 (Avira GmbH)
    AV: Avira AntiVir PersonalEdition Classic v0.0.0.0 (Avira GmbH)
    AV: Avira AntiVir PersonalEdition Classic v0.0.0.0 (Avira GmbH)
    AV: Avira AntiVir PersonalEdition Classic v0.0.0.0 (Avira GmbH)
    AV: Avira AntiVir PersonalEdition Classic v0.0.0.0 (Avira GmbH)
    AV: Avira AntiVir PersonalEdition Classic v0.0.0.0 (Avira GmbH)
    AV: Avira AntiVir PersonalEdition Classic v0.0.0.0 (Avira GmbH)
    AV: Avira AntiVir PersonalEdition Classic v0.0.0.0 (Avira GmbH)
    AV: Avira AntiVir PersonalEdition Classic v0.0.0.0 (Avira GmbH)
    AV: Avira AntiVir PersonalEdition Classic v0.0.0.0 (Avira GmbH)
    AV: Avira AntiVir PersonalEdition Classic v0.0.0.0 (Avira GmbH)
    AV: Avira AntiVir PersonalEdition Classic v0.0.0.0 (Avira GmbH)
    AV: Avira AntiVir PersonalEdition Classic v0.0.0.0 (Avira GmbH)
    AV: Avira AntiVir PersonalEdition Classic v0.0.0.0 (Avira GmbH)
    AV: Avira AntiVir PersonalEdition Classic v0.0.0.0 (Avira GmbH)
    AV: Avira AntiVir PersonalEdition Classic v0.0.0.0 (Avira GmbH)
    AV: Avira AntiVir PersonalEdition Classic v0.0.0.0 (Avira GmbH)
    AV: Avira AntiVir PersonalEdition Classic v0.0.0.0 (Avira GmbH)
    AV: Avira AntiVir PersonalEdition Classic v0.0.0.0 (Avira GmbH)
    AV: Avira AntiVir PersonalEdition Classic v0.0.0.0 (Avira GmbH)
    AV: Avira AntiVir PersonalEdition Classic v0.0.0.0 (Avira GmbH) Disabled
    AV: Avira AntiVir PersonalEdition Classic v0.0.0.0 (Avira GmbH)
    AV: Avira AntiVir PersonalEdition Classic v0.0.0.0 (Avira GmbH)
    AV: Avira AntiVir PersonalEdition Classic v0.0.0.0 (Avira GmbH)
    AV: Avira AntiVir PersonalEdition Classic v0.0.0.0 (Avira GmbH)
    AV: Avira AntiVir PersonalEdition Classic v0.0.0.0 (Avira GmbH) Disabled
    AV: Avira AntiVir PersonalEdition Classic v0.0.0.0 (Avira GmbH) Disabled
    AV: Avira AntiVir PersonalEdition Classic v0.0.0.0 (Avira GmbH)
    AV: Avira AntiVir PersonalEdition Classic v0.0.0.0 (Avira GmbH)
    AV: Avira AntiVir PersonalEdition Classic v0.0.0.0 (Avira GmbH)
    AV: Avira AntiVir PersonalEdition Classic v0.0.0.0 (Avira GmbH)
    AV: Avira AntiVir PersonalEdition Classic v0.0.0.0 (Avira GmbH)
    AV: Avira AntiVir PersonalEdition Classic v0.0.0.0 (Avira GmbH)
    AV: Avira AntiVir PersonalEdition Classic v0.0.0.0 (Avira GmbH)
    AV: Avira AntiVir PersonalEdition Classic v0.0.0.0 (Avira GmbH)
    AV: Avira AntiVir PersonalEdition Classic v0.0.0.0 (Avira GmbH)
    AV: Avira AntiVir PersonalEdition Classic v0.0.0.0 (Avira GmbH)
    AV: Avira AntiVir PersonalEdition Classic v0.0.0.0 (Avira GmbH)
    AV: Avira AntiVir PersonalEdition Classic v0.0.0.0 (Avira GmbH)

    [HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List]
    "%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:mad:xpsp2res.dll,-22019"
    "C:\\Program Files\\MSN Messenger\\msnmsgr.exe"="C:\\Program Files\\MSN Messenger\\msnmsgr.exe:*:Enabled:MSN Messenger 7.5"
    "%windir%\\Network Diagnostic\\xpnetdiag.exe"="%windir%\\Network Diagnostic\\xpnetdiag.exe:*:Enabled:mad:xpsp3res.dll,-20000"

    [HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]
    "C:\\Program Files\\Ares\\Ares.exe"="C:\\Program Files\\Ares\\Ares.exe:*:Enabled:Ares"
    "C:\\mysql\\bin\\mysqld.exe"="C:\\mysql\\bin\\mysqld.exe:*:Enabled:mysqld"
    "C:\\Pokeri\\PokerOffice\\bin\\javaw.exe"="C:\\Pokeri\\PokerOffice\\bin\\javaw.exe:*:Enabled:Java(TM) 2 Platform Standard Edition binary"
    "C:\\Program Files\\PokerOffice\\bin\\javaw.exe"="C:\\Program Files\\PokerOffice\\bin\\javaw.exe:*:Enabled:Java(TM) 2 Platform Standard Edition binary"
    "C:\\Pokeri\\PO\\bin\\javaw.exe"="C:\\Pokeri\\PO\\bin\\javaw.exe:*:Enabled:Java(TM) 2 Platform Standard Edition binary"
    "C:\\Program Files\\Java\\jre1.5.0_02\\bin\\javaw.exe"="C:\\Program Files\\Java\\jre1.5.0_02\\bin\\javaw.exe:*:Enabled:Java(TM) 2 Platform Standard Edition binary"
    "C:\\Program Files\\Java\\jre1.5.0_04\\bin\\javaw.exe"="C:\\Program Files\\Java\\jre1.5.0_04\\bin\\javaw.exe:*:Enabled:Java(TM) 2 Platform Standard Edition binary"
    "C:\\Program Files\\InterPoker\\UA.exe"="C:\\Program Files\\InterPoker\\UA.exe:*:Enabled:UA Application"
    "C:\\pelit\\Quake 4\\Quake4.exe"="C:\\pelit\\Quake 4\\Quake4.exe:*:Enabled:Quake 4"
    "C:\\Program Files\\DC++\\DCPlusPlus.exe"="C:\\Program Files\\DC++\\DCPlusPlus.exe:*:Disabled:DC++"
    "C:\\Program Files\\eDonkey2000\\edonkey2000.exe"="C:\\Program Files\\eDonkey2000\\edonkey2000.exe:*:Disabled:edonkey2000"
    "C:\\Program Files\\Clustone\\clustone.exe"="C:\\Program Files\\Clustone\\clustone.exe:*:Disabled:NeoClustone"
    "C:\\Program Files\\QuickTime\\QuickTimePlayer.exe"="C:\\Program Files\\QuickTime\\QuickTimePlayer.exe:*:Disabled:QuickTime Player"
    "C:\\Program Files\\Shareaza\\Shareaza.exe"="C:\\Program Files\\Shareaza\\Shareaza.exe:*:Disabled:Shareaza Ultimate File Sharing"
    "C:\\pelit\\civ4\\Civilization4.exe"="C:\\pelit\\civ4\\Civilization4.exe:*:Enabled:Sid Meier's Civilization 4"
    "C:\\WINDOWS\\system32\\sessmgr.exe"="C:\\WINDOWS\\system32\\sessmgr.exe:*:Disabled:mad:xpsp2res.dll,-22019"
    "C:\\Program Files\\GameSpy Arcade\\Aphex.exe"="C:\\Program Files\\GameSpy Arcade\\Aphex.exe:*:Disabled:GameSpy Arcade"
    "C:\\Program Files\\HLSW\\hlsw.exe"="C:\\Program Files\\HLSW\\hlsw.exe:*:Disabled:HLSW"
    "C:\\pelit\\REDALERT\\ww\\register.dat"="C:\\pelit\\REDALERT\\ww\\register.dat:*:Disabled:register"
    "C:\\Program Files\\The All-Seeing Eye\\eye.exe"="C:\\Program Files\\The All-Seeing Eye\\eye.exe:*:Disabled:Yahoo! All-Seeing Eye"
    "C:\\Program Files\\Mozilla Firefox\\firefox.exe"="C:\\Program Files\\Mozilla Firefox\\firefox.exe:*:Enabled:Firefox"
    "C:\\Program Files\\Java\\jre1.5.0_06\\bin\\javaw.exe"="C:\\Program Files\\Java\\jre1.5.0_06\\bin\\javaw.exe:*:Enabled:Java(TM) 2 Platform Standard Edition binary"
    "C:\\Program Files\\Microsoft Visual Studio\\Common\\Tools\\VS-Ent98\\Vanalyzr\\VARPC.EXE"="C:\\Program Files\\Microsoft Visual Studio\\Common\\Tools\\VS-Ent98\\Vanalyzr\\VARPC.EXE:*:Enabled:Microsoft (R) Visual Studio VSA RPC Event Creator"
    "C:\\pelit\\PokerOffice\\bin\\javaw.exe"="C:\\pelit\\PokerOffice\\bin\\javaw.exe:*:Enabled:Java(TM) 2 Platform Standard Edition binary"
    "C:\\Program Files\\Messenger\\msmsgs.exe"="C:\\Program Files\\Messenger\\msmsgs.exe:*:Enabled:Windows Messenger"
    "C:\\Program Files\\MSN Messenger\\msnmsgr.exe"="C:\\Program Files\\MSN Messenger\\msnmsgr.exe:*:Enabled:MSN Messenger 7.5"
    "C:\\Program Files\\iTunes\\iTunes.exe"="C:\\Program Files\\iTunes\\iTunes.exe:*:Enabled:iTunes"
    "%windir%\\Network Diagnostic\\xpnetdiag.exe"="%windir%\\Network Diagnostic\\xpnetdiag.exe:*:Enabled:mad:xpsp3res.dll,-20000"
    "C:\\Program Files\\Yahoo!\\Messenger\\YahooMessenger.exe"="C:\\Program Files\\Yahoo!\\Messenger\\YahooMessenger.exe:*:Enabled:Yahoo! Messenger"
    "C:\\Program Files\\Yahoo!\\Messenger\\YServer.exe"="C:\\Program Files\\Yahoo!\\Messenger\\YServer.exe:*:Enabled:Yahoo! FT Server"
    "C:\\Program Files\\PPMate\\ppmate.exe"="C:\\Program Files\\PPMate\\ppmate.exe:*:Enabled:pPMate"
    "C:\\Program Files\\PPMate\\ppmnet.exe"="C:\\Program Files\\PPMate\\ppmnet.exe:*:Enabled:pPMate"


    -- Environment Variables -------------------------------------------------------

    ALLUSERSPROFILE=C:\Documents and Settings\All Users
    APPDATA=C:\Documents and Settings\Lauri\Application Data
    CLASSPATH=C:\Program Files\Java\jre1.5.0_06\lib\ext\QTJava.zip
    CLIENTNAME=Console
    CommonProgramFiles=C:\Program Files\Common Files
    COMPUTERNAME=VANR
    ComSpec=C:\WINDOWS\system32\cmd.exe
    FP_NO_HOST_CHECK=NO
    HOMEDRIVE=C:
    HOMEPATH=\Documents and Settings\Lauri
    include=C:\Program Files\Microsoft Visual Studio\VC98\atl\include;C:\Program Files\Microsoft Visual Studio\VC98\mfc\include;C:\Program Files\Microsoft Visual Studio\VC98\include
    lib=C:\Program Files\Microsoft Visual Studio\VC98\mfc\lib;C:\Program Files\Microsoft Visual Studio\VC98\lib
    LOGONSERVER=\\VANR
    MSDevDir=C:\Program Files\Microsoft Visual Studio\Common\MSDev98
    NUMBER_OF_PROCESSORS=2
    OS=Windows_NT
    Path=C:\PROGRA~1\Java\JRE15~3.0_0\bin;C:\Program Files\Mozilla Firefox;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\Program Files\ATI Technologies\ATI Control Panel;C:\Program Files\ATI Technologies\ATI.ACE\;C:\Program Files\QuickTime\QTSystem\;C:\WINDOWS\system32\gs\gs7.05\bin;"C:\Program Files\Zone Labs\ZoneAlarm\MailFrontier";C:\Program Files\Microsoft Visual Studio\Common\Tools\WinNT;C:\Program Files\Microsoft Visual Studio\Common\MSDev98\Bin;C:\Program Files\Microsoft Visual Studio\Common\Tools;C:\Program Files\Microsoft Visual Studio\VC98\bin;C:\Pelit\PokerOffice\bin\Microsoft.VC80.ATL;C:\Pelit\PokerOffice\bin\Microsoft.VC80.CRT;C:\Pelit\PokerOffice\bin\Microsoft.VC80.MFC;.
    PATHEXT=.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH
    PROCESSOR_ARCHITECTURE=x86
    PROCESSOR_IDENTIFIER=x86 Family 15 Model 4 Stepping 1, GenuineIntel
    PROCESSOR_LEVEL=15
    PROCESSOR_REVISION=0401
    ProgramFiles=C:\Program Files
    PROMPT=$P$G
    QTJAVA=C:\Program Files\Java\jre1.5.0_06\lib\ext\QTJava.zip
    SESSIONNAME=Console
    SystemDrive=C:
    SystemRoot=C:\WINDOWS
    TEMP=C:\DOCUME~1\Lauri\LOCALS~1\Temp
    TMP=C:\DOCUME~1\Lauri\LOCALS~1\Temp
    tvdumpflags=8
    USERDOMAIN=VANR
    USERNAME=Lauri
    USERPROFILE=C:\Documents and Settings\Lauri
    windir=C:\WINDOWS


    -- User Profiles ---------------------------------------------------------------

    Lauri (admin)
    Pokeri
    vanr (new local)
    postgres
    Järjestelmänvalvoja (admin)


    -- Add/Remove Programs ---------------------------------------------------------

    --> rundll32.exe setupapi.dll,InstallHinfSection DefaultUninstall 132 C:\WINDOWS\INF\PCHealth.inf
    2.06 --> "C:\Program Files\ColorPicker v2.06\unins000.exe"
    ABIT uGuru --> RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{FF8500E6-EA0D-11D7-8755-0080C8F92A32}\Setup.exe" -l0x9
    Absolute Poker --> C:\Program Files\_uninstallation_info\Absolute Poker\CasinoUninstall.exe
    Ad-Aware SE Personal --> C:\PROGRA~1\Lavasoft\AD-AWA~1\UNWISE.EXE C:\PROGRA~1\Lavasoft\AD-AWA~1\INSTALL.LOG
    Adobe Flash Player ActiveX --> C:\WINDOWS\system32\Macromed\Flash\uninstall_activeX.exe
    Adobe Reader 7.0.9 - Suomi --> MsiExec.exe /I{AC76BA86-7AD7-1035-7B44-A70900000002}
    Advanced WindowsCare 2.30 Personal --> "C:\Program Files\IObit\Advanced WindowsCare V2\unins000.exe"
    allSnap version 1.30.6 Release --> "C:\Program Files\allSnap\unins000.exe"
    ATI - Software Uninstall Utility --> C:\Program Files\ATI Technologies\UninstallAll\AtiCimUn.exe
    ATI Catalyst Control Center --> MsiExec.exe /I{F8313341-8D53-4D84-8BEB-F82D556B21CD}
    ATI Control Panel --> RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\engine\6\INTEL3~1\ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{0BEDBD4E-2D34-47B5-9973-57E62B29307C}\setup.exe"
    ATI Display Driver --> rundll32 C:\WINDOWS\system32\atiiiexx.dll,_InfEngUnInstallINFFile_RunDLL@16 -force_restart -flags:0x2010001 -inf_class:DISPLAY -clean
    Audacity 1.2.6 --> "C:\Program Files\Audacity\unins000.exe"
    Avira AntiVir PersonalEdition Classic --> C:\Program Files\AntiVir PersonalEdition Classic\SETUP.EXE /REMOVE
    Azureus --> C:\Program Files\Azureus\Uninstall.exe
    CamStudio --> C:\Program Files\CamStudio\uninstall.exe
    Caribbean Sun Poker --> C:\WINDOWS\system32\UnPoker.exe CaribbeanSunPoker
    CCleaner (remove only) --> "C:\Program Files\CCleaner\uninst.exe"
    DC++ 0.698 --> "C:\Program Files\DC++\uninstall.exe"
    DivX --> C:\Program Files\DivX\DivXCodecUninstall.exe /CODEC
    DivX Player --> C:\Program Files\DivX\DivXPlayerUninstall.exe /PLAYER
    Elecard MPEG Player --> "C:\Program Files\Elecard\Elecard MPEG Player 4.0\Uninstall.exe" "C:\Program Files\Elecard\Elecard MPEG Player 4.0\install.log"
    EMS MySQL Data Export --> MsiExec.exe /X{828F2180-3DA2-4CE0-804F-D423B7F70D72}
    Eraser --> "C:\Program Files\Eraser\unins000.exe"
    Excel MySQL Import, Export & Convert 1.1 --> "C:\Program Files\Excel MySQL Import, Export & Convert\unins000.exe"
    ExcelMySQlConverter Demo --> "C:\Program Files\ExcelMySQlConverterDemo\unins000.exe"
    Forté Agent --> C:\PROGRA~1\Agent\UNWISE.EXE C:\PROGRA~1\Agent\INSTALL.LOG "Uninstall Forté Agent"
    FreshUI --> "C:\Program Files\FreshDevices\FreshUI\unins000.exe"
    Full Tilt Poker --> RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\11\50\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{D4C9692E-4EFA-4DA0-8B7F-9439466D9E31}\setup.exe" -l0x9 -removeonly
    Granite --> MsiExec.exe /I{470F9B02-EBB5-11D4-9957-0000E89E8230}
    GSpot Codec Information Appliance --> C:\Program Files\GSpot\Uninstall.exe
    HijackThis 2.0.2 --> "C:\Program Files\HijackThis\HijackThis.exe" /uninstall
    Hotfix-päivitys Windows XP:lle (KB914440) --> "C:\WINDOWS\$NtUninstallKB914440$\spuninst\spuninst.exe"
    IconArt --> C:\PROGRA~1\ConWare\IconArt\UNWISE.EXE C:\PROGRA~1\ConWare\IconArt\INSTALL.LOG
    Inno Setup versio 5.1.6 --> "C:\Program Files\Inno Setup 5\unins000.exe"
    InstallShield for Microsoft Visual C++ 6 --> C:\WINDOWS\IsUninst.exe -f"C:\Program Files\InstallShield\InstallShield for Microsoft Visual C++ 6\Uninst.isu"
    Intel(R) Processor ID Utility --> MsiExec.exe /X{A92A4DB0-CD37-42D1-BE1D-603D53C24328}
    iTunes --> C:\PROGRA~1\COMMON~1\INSTAL~1\Driver\11\INTEL3~1\IDriver.exe /M{59C4F14F-7590-45FC-BE9F-A67AB3590709} /l1035
    J2SE Runtime Environment 5.0 Update 6 --> MsiExec.exe /I{3248F0A8-6813-11D6-A77B-00B0D0150060}
    Java 2 Runtime Environment, SE v1.4.2_09 --> MsiExec.exe /I{7148F0A8-6813-11D6-A77B-00B0D0142090}
    Java 2 SDK, SE v1.4.2_09 --> MsiExec.exe /I{35A3A4F4-B792-11D6-A78A-00B0D0142090}
    Macromedia Shockwave Player --> C:\WINDOWS\system32\Macromed\SHOCKW~1\UNWISE.EXE C:\WINDOWS\system32\Macromed\SHOCKW~1\Install.log
    Microangelo Creation --> C:\WINDOWS\IsUninst.exe -f"C:\Program Files\Microangelo2\creation.isu"
    Microangelo Toolset 6 --> MsiExec.exe /I{71414EC2-0684-4A15-A85A-E0E259D117AF}
    Microsoft Office XP Media Content --> MsiExec.exe /I{90300409-6000-11D3-8CFE-0050048383C9}
    Microsoft Office XP Professional with FrontPage --> MsiExec.exe /I{90280409-6000-11D3-8CFE-0050048383C9}
    Microsoft Visual Studio 6.0 Enterprise Edition --> "C:\Program Files\Microsoft Visual Studio\Common\Setup\1033\Setup.exe"
    Microsoft Visual Studio Installer --> "C:\Program Files\Microsoft Visual Studio\Common\Tools\VSInst\Setup\1033\Setup.exe"
    Microsoft Web Publishing Wizard 1.53 --> RunDll32 ADVPACK.DLL,LaunchINFSection C:\WINDOWS\INF\wpie3x86.inf,WebPostUninstall
    MouseConfig (remove only) --> "C:\Program Files\MouseConfig\uninst.exe"
    Mozilla Firefox (2.0.0.5) --> C:\Program Files\Mozilla Firefox\uninstall\helper.exe
    Mozilla Firefox (2.0.0.6) --> C:\PROGRA~1\Mozilla Firefox\uninstall\helper.exe
    MSN Messenger 7.5 --> MsiExec.exe /I{9A379B72-03EC-11DA-BFBD-00065BBDC0B5}
    MyODBC --> MsiExec.exe /X{29042B1C-0713-4575-B7CA-5C8E7B0899D4}
    MySQL Server 4.1 --> MsiExec.exe /I{F16B02E4-23C0-4BE9-A706-0F1D40BFA40D}
    MySQL to Excel 2.5 Demo --> C:\PROGRA~1\INTELL~1\demos\demos\UNWISE.EXE /U C:\PROGRA~1\INTELL~1\demos\demos\sql2xls.log
    Natural Color --> RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\engine\6\INTEL3~1\ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{F51D9393-BB14-4566-99BF-D6ED63AEFCD7}\setup.exe"
    Nero - Burning Rom --> MsiExec.exe /X{A4D7B764-4140-11D4-88EB-0050DA3579C0}
    Ox Console 4.04 --> "C:\OxMetricsUus\Ox\bin\unins000.exe"
    OxEdit 4.04 --> "C:\OxMetricsUus\OxEdit\unins000.exe"
    PDF Maker --> C:\WINDOWS\st6unst.exe -n "C:\Program Files\PDFmaker\ST6UNST.LOG"
    Pdf995 --> C:\Program Files\pdf995\setup.exe uninstall
    Päivitys Windows XP:lle (KB894391) --> "C:\WINDOWS\$NtUninstallKB894391$\spuninst\spuninst.exe"
    Päivitys Windows XP:lle (KB896727) --> "C:\WINDOWS\$NtUninstallKB896727$\spuninst\spuninst.exe"
    Päivitys Windows XP:lle (KB898461) --> "C:\WINDOWS\$NtUninstallKB898461$\spuninst\spuninst.exe"
    Päivitys Windows XP:lle (KB900485) --> "C:\WINDOWS\$NtUninstallKB900485$\spuninst\spuninst.exe"
    Päivitys Windows XP:lle (KB904942) --> "C:\WINDOWS\$NtUninstallKB904942$\spuninst\spuninst.exe"
    Päivitys Windows XP:lle (KB910437) --> "C:\WINDOWS\$NtUninstallKB910437$\spuninst\spuninst.exe"
    Päivitys Windows XP:lle (KB916595) --> "C:\WINDOWS\$NtUninstallKB916595$\spuninst\spuninst.exe"
    Päivitys Windows XP:lle (KB920872) --> "C:\WINDOWS\$NtUninstallKB920872$\spuninst\spuninst.exe"
    Päivitys Windows XP:lle (KB922582) --> "C:\WINDOWS\$NtUninstallKB922582$\spuninst\spuninst.exe"
    Päivitys Windows XP:lle (KB927891) --> "C:\WINDOWS\$NtUninstallKB927891$\spuninst\spuninst.exe"
    Päivitys Windows XP:lle (KB929338) --> "C:\WINDOWS\$NtUninstallKB929338$\spuninst\spuninst.exe"
    Päivitys Windows XP:lle (KB930916) --> "C:\WINDOWS\$NtUninstallKB930916$\spuninst\spuninst.exe"
    Päivitys Windows XP:lle (KB931836) --> "C:\WINDOWS\$NtUninstallKB931836$\spuninst\spuninst.exe"
    Päivitys Windows XP:lle (KB936357) --> "C:\WINDOWS\$NtUninstallKB936357$\spuninst\spuninst.exe"
    Poker Clock 2.1 --> MsiExec.exe /X{9437C5DF-478F-4F92-9B7F-E4474F27C05A}
    Poker Evolver --> MsiExec.exe /I{ECAE40BC-D755-4336-87A3-EEFB164FEAD0}
    Poker Tracker Version 2.06.04 --> "C:\Pokeri\Poker Tracker V2\unins000.exe"
    Poker Tracker Version 2.16.00e --> "C:\Program Files\Poker Tracker V2\unins000.exe"
    PokerAce Hud (remove only) --> "C:\Program Files\PokerAce Hud\uninstall.exe"
    PokerOffice (remove only) --> "C:\Pelit\PokerOffice\uninstall.exe"
    PokerStove version 1.21 --> "C:\Program Files\PokerStove\unins000.exe"
    PostgreSQL 8.2 --> MsiExec.exe /I{1F701DBD-1660-4108-B10A-FB435EA63BF0}
    PPMate Network TV 2.3.1.54 --> C:\Program Files\PPMate\uninst.exe
    QuickTime --> C:\PROGRA~1\COMMON~1\INSTAL~1\Driver\11\INTEL3~1\IDriver.exe /M{929408E6-D265-4174-805F-81D1D914E2A4} /l1035
    R for Windows 2.4.0 --> "C:\Program Files\R\R-2.4.0\unins000.exe"
    Real Alternative 1.23 --> "C:\Program Files\Real Alternative\unins000.exe"
    Realtek AC'97 Audio --> RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\engine\6\INTEL3~1\ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{FB08F381-6533-4108-B7DD-039E11FBC27E}\setup.exe" REMOVE
    REALTEK Gigabit and Fast Ethernet NIC Driver --> RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{94FB906A-CF42-4128-A509-D353026A607E}\setup.exe" -l0xb REMOVE
    Room Arranger --> "C:\Program Files\Room Arranger\uninstall.exe"
    RS Somnífero --> "C:\Program Files\Rico Software\RS Somnífero\desinstalar.exe"
    SciViews-R version 0.8-9 --> "C:\Program Files\SciViews\unins000.exe"
    Security Task Manager 1.7 --> C:\Program Files\Security Task Manager\Uninstal.exe "C:\Documents and Settings\All Users\Käynnistä-valikko\Ohjelmat\Security Task Manager"
    Serif PhotoPlus 6.0 --> RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\0701\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{0609D0AF-1382-42BE-81DB-CF30F8B0F6E2}\Setup.exe" -l0x9
    Sid Meier's Civilization 4 --> RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\11\00\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{CFBCE791-2D53-4FCE-B3FB-D6E01F4112E8}\setup.exe" -l0x9 -removeonly
    SiSoftware Sandra Lite 2005.SR1 (Win64/32/CE) --> "C:\Program Files\SiSoftware\unins000.exe"
    SnoopFree Privacy Shield --> SnoopFreeUI.exe /U
    SopCast 1.1.2 --> C:\Program Files\SopCast\uninst.exe
    SpeechRedist --> MsiExec.exe /X{8795CBED-55E2-4693-9F14-84EC446935BE}
    Spybot - Search & Destroy 1.4 --> "C:\Program Files\Spybot - Search & Destroy\unins000.exe"
    SpywareBlaster v3.5.1 --> "C:\Program Files\SpywareBlaster\unins000.exe"
    SQLite ODBC Driver (remove only) --> C:\Program Files\SQLite ODBC Driver\Uninstall.exe
    Startup Guru --> C:\Program Files\StartupGuru\uninstal.exe
    Suojauspäivitys ohjelmistolle Windows XP (KB923689) --> "C:\WINDOWS\$NtUninstallKB923689$\spuninst\spuninst.exe"
    Suojauspäivitys Windows XP:lle (KB883939) --> "C:\WINDOWS\$NtUninstallKB883939$\spuninst\spuninst.exe"
    Suojauspäivitys Windows XP:lle (KB890046) --> "C:\WINDOWS\$NtUninstallKB890046$\spuninst\spuninst.exe"
    Suojauspäivitys Windows XP:lle (KB893756) --> "C:\WINDOWS\$NtUninstallKB893756$\spuninst\spuninst.exe"
    Suojauspäivitys Windows XP:lle (KB896358) --> "C:\WINDOWS\$NtUninstallKB896358$\spuninst\spuninst.exe"
    Suojauspäivitys Windows XP:lle (KB896422) --> "C:\WINDOWS\$NtUninstallKB896422$\spuninst\spuninst.exe"
    Suojauspäivitys Windows XP:lle (KB896423) --> "C:\WINDOWS\$NtUninstallKB896423$\spuninst\spuninst.exe"
    Suojauspäivitys Windows XP:lle (KB896424) --> "C:\WINDOWS\$NtUninstallKB896424$\spuninst\spuninst.exe"
    Suojauspäivitys Windows XP:lle (KB896428) --> "C:\WINDOWS\$NtUninstallKB896428$\spuninst\spuninst.exe"
    Suojauspäivitys Windows XP:lle (KB896688) --> "C:\WINDOWS\$NtUninstallKB896688$\spuninst\spuninst.exe"
    Suojauspäivitys Windows XP:lle (KB899587) --> "C:\WINDOWS\$NtUninstallKB899587$\spuninst\spuninst.exe"
    Suojauspäivitys Windows XP:lle (KB899588) --> "C:\WINDOWS\$NtUninstallKB899588$\spuninst\spuninst.exe"
    Suojauspäivitys Windows XP:lle (KB899591) --> "C:\WINDOWS\$NtUninstallKB899591$\spuninst\spuninst.exe"
    Suojauspäivitys Windows XP:lle (KB900725) --> "C:\WINDOWS\$NtUninstallKB900725$\spuninst\spuninst.exe"
    Suojauspäivitys Windows XP:lle (KB901017) --> "C:\WINDOWS\$NtUninstallKB901017$\spuninst\spuninst.exe"
    Suojauspäivitys Windows XP:lle (KB901214) --> "C:\WINDOWS\$NtUninstallKB901214$\spuninst\spuninst.exe"
    Suojauspäivitys Windows XP:lle (KB902400) --> "C:\WINDOWS\$NtUninstallKB902400$\spuninst\spuninst.exe"
    Suojauspäivitys Windows XP:lle (KB903235) --> "C:\WINDOWS\$NtUninstallKB903235$\spuninst\spuninst.exe"
    Suojauspäivitys Windows XP:lle (KB904706) --> "C:\WINDOWS\$NtUninstallKB904706$\spuninst\spuninst.exe"
    Suojauspäivitys Windows XP:lle (KB905414) --> "C:\WINDOWS\$NtUninstallKB905414$\spuninst\spuninst.exe"
    Suojauspäivitys Windows XP:lle (KB905749) --> "C:\WINDOWS\$NtUninstallKB905749$\spuninst\spuninst.exe"
    Suojauspäivitys Windows XP:lle (KB905915) --> "C:\WINDOWS\$NtUninstallKB905915$\spuninst\spuninst.exe"
    Suojauspäivitys Windows XP:lle (KB908519) --> "C:\WINDOWS\$NtUninstallKB908519$\spuninst\spuninst.exe"
    Suojauspäivitys Windows XP:lle (KB908531) --> "C:\WINDOWS\$NtUninstallKB908531$\spuninst\spuninst.exe"
    Suojauspäivitys Windows XP:lle (KB911280) --> "C:\WINDOWS\$NtUninstallKB911280$\spuninst\spuninst.exe"
    Suojauspäivitys Windows XP:lle (KB911562) --> "C:\WINDOWS\$NtUninstallKB911562$\spuninst\spuninst.exe"
    Suojauspäivitys Windows XP:lle (KB911567) --> "C:\WINDOWS\$NtUninstallKB911567$\spuninst\spuninst.exe"
    Suojauspäivitys Windows XP:lle (KB911927) --> "C:\WINDOWS\$NtUninstallKB911927$\spuninst\spuninst.exe"
    Suojauspäivitys Windows XP:lle (KB912812) --> "C:\WINDOWS\$NtUninstallKB912812$\spuninst\spuninst.exe"
    Suojauspäivitys Windows XP:lle (KB912919) --> "C:\WINDOWS\$NtUninstallKB912919$\spuninst\spuninst.exe"
    Suojauspäivitys Windows XP:lle (KB913446) --> "C:\WINDOWS\$NtUninstallKB913446$\spuninst\spuninst.exe"
    Suojauspäivitys Windows XP:lle (KB913580) --> "C:\WINDOWS\$NtUninstallKB913580$\spuninst\spuninst.exe"
    Suojauspäivitys Windows XP:lle (KB914388) --> "C:\WINDOWS\$NtUninstallKB914388$\spuninst\spuninst.exe"
    Suojauspäivitys Windows XP:lle (KB914389) --> "C:\WINDOWS\$NtUninstallKB914389$\spuninst\spuninst.exe"
    Suojauspäivitys Windows XP:lle (KB916281) --> "C:\WINDOWS\$NtUninstallKB916281$\spuninst\spuninst.exe"
    Suojauspäivitys Windows XP:lle (KB917159) --> "C:\WINDOWS\$NtUninstallKB917159$\spuninst\spuninst.exe"
    Suojauspäivitys Windows XP:lle (KB917344) --> "C:\WINDOWS\$NtUninstallKB917344$\spuninst\spuninst.exe"
    Suojauspäivitys Windows XP:lle (KB917422) --> "C:\WINDOWS\$NtUninstallKB917422$\spuninst\spuninst.exe"
    Suojauspäivitys Windows XP:lle (KB917953) --> "C:\WINDOWS\$NtUninstallKB917953$\spuninst\spuninst.exe"
    Suojauspäivitys Windows XP:lle (KB918118) --> "C:\WINDOWS\$NtUninstallKB918118$\spuninst\spuninst.exe"
    Suojauspäivitys Windows XP:lle (KB918439) --> "C:\WINDOWS\$NtUninstallKB918439$\spuninst\spuninst.exe"
    Suojauspäivitys Windows XP:lle (KB918899) --> "C:\WINDOWS\$NtUninstallKB918899$\spuninst\spuninst.exe"
    Suojauspäivitys Windows XP:lle (KB919007) --> "C:\WINDOWS\$NtUninstallKB919007$\spuninst\spuninst.exe"
    Suojauspäivitys Windows XP:lle (KB920213) --> "C:\WINDOWS\$NtUninstallKB920213$\spuninst\spuninst.exe"
    Suojauspäivitys Windows XP:lle (KB920214) --> "C:\WINDOWS\$NtUninstallKB920214$\spuninst\spuninst.exe"
    Suojauspäivitys Windows XP:lle (KB920670) --> "C:\WINDOWS\$NtUninstallKB920670$\spuninst\spuninst.exe"
    Suojauspäivitys Windows XP:lle (KB920683) --> "C:\WINDOWS\$NtUninstallKB920683$\spuninst\spuninst.exe"
    Suojauspäivitys Windows XP:lle (KB920685) --> "C:\WINDOWS\$NtUninstallKB920685$\spuninst\spuninst.exe"
    Suojauspäivitys Windows XP:lle (KB921398) --> "C:\WINDOWS\$NtUninstallKB921398$\spuninst\spuninst.exe"
    Suojauspäivitys Windows XP:lle (KB921883) --> "C:\WINDOWS\$NtUninstallKB921883$\spuninst\spuninst.exe"
    Suojauspäivitys Windows XP:lle (KB922616) --> "C:\WINDOWS\$NtUninstallKB922616$\spuninst\spuninst.exe"
    Suojauspäivitys Windows XP:lle (KB922760) --> "C:\WINDOWS\$NtUninstallKB922760$\spuninst\spuninst.exe"
    Suojauspäivitys Windows XP:lle (KB922819) --> "C:\WINDOWS\$NtUninstallKB922819$\spuninst\spuninst.exe"
    Suojauspäivitys Windows XP:lle (KB923191) --> "C:\WINDOWS\$NtUninstallKB923191$\spuninst\spuninst.exe"
    Suojauspäivitys Windows XP:lle (KB923414) --> "C:\WINDOWS\$NtUninstallKB923414$\spuninst\spuninst.exe"
    Suojauspäivitys Windows XP:lle (KB923694) --> "C:\WINDOWS\$NtUninstallKB923694$\spuninst\spuninst.exe"
    Suojauspäivitys Windows XP:lle (KB923980) --> "C:\WINDOWS\$NtUninstallKB923980$\spuninst\spuninst.exe"
    Suojauspäivitys Windows XP:lle (KB924191) --> "C:\WINDOWS\$NtUninstallKB924191$\spuninst\spuninst.exe"
    Suojauspäivitys Windows XP:lle (KB924270) --> "C:\WINDOWS\$NtUninstallKB924270$\spuninst\spuninst.exe"
    Suojauspäivitys Windows XP:lle (KB924496) --> "C:\WINDOWS\$NtUninstallKB924496$\spuninst\spuninst.exe"
    Suojauspäivitys Windows XP:lle (KB924667) --> "C:\WINDOWS\$NtUninstallKB924667$\spuninst\spuninst.exe"
    Suojauspäivitys Windows XP:lle (KB925486) --> "C:\WINDOWS\$NtUninstallKB925486$\spuninst\spuninst.exe"
    Suojauspäivitys Windows XP:lle (KB925902) --> "C:\WINDOWS\$NtUninstallKB925902$\spuninst\spuninst.exe"
    Suojauspäivitys Windows XP:lle (KB926255) --> "C:\WINDOWS\$NtUninstallKB926255$\spuninst\spuninst.exe"
    Suojauspäivitys Windows XP:lle (KB926436) --> "C:\WINDOWS\$NtUninstallKB926436$\spuninst\spuninst.exe"
    Suojauspäivitys Windows XP:lle (KB927779) --> "C:\WINDOWS\$NtUninstallKB927779$\spuninst\spuninst.exe"
    Suojauspäivitys Windows XP:lle (KB927802) --> "C:\WINDOWS\$NtUninstallKB927802$\spuninst\spuninst.exe"
    Suojauspäivitys Windows XP:lle (KB928255) --> "C:\WINDOWS\$NtUninstallKB928255$\spuninst\spuninst.exe"
    Suojauspäivitys Windows XP:lle (KB928843) --> "C:\WINDOWS\$NtUninstallKB928843$\spuninst\spuninst.exe"
    Suojauspäivitys Windows XP:lle (KB929123) --> "C:\WINDOWS\$NtUninstallKB929123$\spuninst\spuninst.exe"
    Suojauspäivitys Windows XP:lle (KB930178) --> "C:\WINDOWS\$NtUninstallKB930178$\spuninst\spuninst.exe"
    Suojauspäivitys Windows XP:lle (KB931261) --> "C:\WINDOWS\$NtUninstallKB931261$\spuninst\spuninst.exe"
    Suojauspäivitys Windows XP:lle (KB931784) --> "C:\WINDOWS\$NtUninstallKB931784$\spuninst\spuninst.exe"
    Suojauspäivitys Windows XP:lle (KB932168) --> "C:\WINDOWS\$NtUninstallKB932168$\spuninst\spuninst.exe"
    Suojauspäivitys Windows XP:lle (KB935839) --> "C:\WINDOWS\$NtUninstallKB935839$\spuninst\spuninst.exe"
    Suojauspäivitys Windows XP:lle (KB935840) --> "C:\WINDOWS\$NtUninstallKB935840$\spuninst\spuninst.exe"
    Topfield Windows Applications --> C:\Program Files\Topfield Windows Applications\uninst.exe
    TVAnts 1.0 --> C:\PROGRA~1\TVAnts\UNWISE.EXE C:\PROGRA~1\TVAnts\INSTALL.LOG
    Tweak Genie 6.0.0 Free Version --> C:\PROGRA~1\TWEAKG~1\UNWISE.EXE C:\PROGRA~1\TWEAKG~1\INSTALL.LOG
    Tweak UI --> "C:\WINDOWS\system32\mshta.exe" "res://C:\WINDOWS\system32\TweakUI.exe/uninstall.hta"
    UltraISO V7.62 ME --> "C:\Program Files\UltraISO\unins000.exe"
    Uniblue SpeedUpMyPC --> "C:\Program Files\Uniblue\SpeedUpMyPC\unins000.exe"
    Uninstall Startup Inspector for Windows --> "C:\Program Files\Startup Inspector for Windows\unins000.exe"
    VideoLAN VLC media player 0.8.2 --> C:\Program Files\VideoLAN\VLC\uninstall.exe
    WinRAR archiver --> C:\Program Files\WinRAR\uninstall.exe
    XoftSpySE --> C:\Program Files\XoftSpySE\uninstall.exe
    Yahoo! Messenger --> C:\PROGRA~1\Yahoo!\MESSEN~1\UNWISE.EXE /U C:\PROGRA~1\Yahoo!\MESSEN~1\INSTALL.LOG
    ZoneAlarm --> C:\Program Files\Zone Labs\ZoneAlarm\zauninst.exe


    -- Application Event Log -------------------------------------------------------

    Event ID #6893: Error
    Event Submitted/Written: 08/12/2007 07:59:06 PM
    Event Source: PerfNet
    Event Description:
    Palvelinpalvelua ei voi avata. Palvelimen resurssitietoja
    ei palauteta. Palautettu virhekoodi on ensimmäisessä DWORD-tavussa.

    Event ID #6890: Warning
    Event Submitted/Written: 08/12/2007 07:50:47 PM
    Event Source: H+BEDV AntiVir
    Event Description:
    AntiVir has detected 'HTML/Crypted.Gen'
    in the file
    C:\Documents and Settings\Lauri\Local Settings\Application Data\Mozilla\Firefox\Profiles\tet9s883.Oletuskäyttäjä\Cache\D9DBB42Fd01

    Event ID #6889: Error
    Event Submitted/Written: 08/12/2007 10:36:12 AM
    Event Source: PerfNet
    Event Description:
    Palvelinpalvelua ei voi avata. Palvelimen resurssitietoja
    ei palauteta. Palautettu virhekoodi on ensimmäisessä DWORD-tavussa.

    Event ID #6886: Error
    Event Submitted/Written: 08/11/2007 11:50:39 AM
    Event Source: PerfNet
    Event Description:
    Palvelinpalvelua ei voi avata. Palvelimen resurssitietoja
    ei palauteta. Palautettu virhekoodi on ensimmäisessä DWORD-tavussa.

    Event ID #6883: Warning
    Event Submitted/Written: 08/10/2007 06:03:07 PM
    Event Source: Userenv
    Event Description:
    Windows tallensi käyttäjän VANR\Lauri rekisterin, kun jokin sovellus tai palvelu käytti yhä rekisteriä uloskirjautumisen aikana. Käyttäjän rekisterin varaamaa muistia ei ole vapautettu. Rekisterin lataus poistetaan, kun rekisteri ei ole enää käytössä.


    Tähän on usein syynä käyttäjän tilin avulla suoritettavat palvelut. Määritä palvelut LocalService- tai NetworkService-tilin avulla suoritettaviksi.



    -- Security Event Log ----------------------------------------------------------

    No Errors/Warnings found.


    -- System Event Log ------------------------------------------------------------

    Event ID #26204: Error
    Event Submitted/Written: 08/12/2007 11:08:23 PM
    Event Source: Service Control Manager
    Event Description:
    Palvelu Sovellusten hallinta lopetettiin virheen takia. Virhe:
    %%126

    Event ID #26201: Error
    Event Submitted/Written: 08/12/2007 11:08:23 PM
    Event Source: Service Control Manager
    Event Description:
    Palvelu Sovellusten hallinta lopetettiin virheen takia. Virhe:
    %%126

    Event ID #26197: Error
    Event Submitted/Written: 08/12/2007 11:08:23 PM
    Event Source: Service Control Manager
    Event Description:
    Palvelu Sovellusten hallinta lopetettiin virheen takia. Virhe:
    %%126

    Event ID #26195: Error
    Event Submitted/Written: 08/12/2007 11:08:23 PM
    Event Source: Service Control Manager
    Event Description:
    Palvelu Sovellusten hallinta lopetettiin virheen takia. Virhe:
    %%126

    Event ID #26192: Error
    Event Submitted/Written: 08/12/2007 11:08:23 PM
    Event Source: Service Control Manager
    Event Description:
    Palvelu Sovellusten hallinta lopetettiin virheen takia. Virhe:
    %%126



    -- End of Deckard's System Scanner: finished at 2007-08-12 at 23:10:15 ---------

     
    Laur1, Aug 12, 2007
    #3
  4. Laur1

    Laur1 Member

    Joined:
    Mar 1, 2007
    Messages:
    11
    Likes Received:
    0
    Trophy Points:
    11
    Ewido ei löytänyt mitään. Aiemmin tänään löytyi Trojan-Downloader.JS.Psyme.hz

    Tässä dss:n logit.

    Deckard's System Scanner v20070809.63
    Run by Lauri on 2007-08-12 at 23:05:39
    Computer is in Normal Mode.
    --------------------------------------------------------------------------------

    -- System Restore --------------------------------------------------------------

    Successfully created a Deckard's System Scanner Restore Point.


    -- Last 5 Restore Point(s) --
    60: 2007-08-12 20:05:54 UTC - RP638 - Deckard's System Scanner Restore Point
    59: 2007-08-12 20:04:53 UTC - RP637 - Removed J2SE Runtime Environment 5.0 Update 4
    58: 2007-08-12 20:03:38 UTC - RP636 - Removed J2SE Runtime Environment 5.0 Update 2
    57: 2007-08-12 19:49:09 UTC - RP635 - Poistettu QuickTime
    56: 2007-08-12 12:37:53 UTC - RP634 - Järjestelmän tarkistuspiste


    -- First Restore Point --
    1: 2007-05-15 12:01:39 UTC - RP579 - Järjestelmän tarkistuspiste


    Backed up registry hives.
    Performed disk cleanup.



    -- HijackThis (run as Lauri.exe) -----------------------------------------------

    Logfile of Trend Micro HijackThis v2.0.2
    Scan saved at 11:07:37 PM, on 08/12/2007
    Platform: Windows XP SP2 (WinNT 5.01.2600)
    MSIE: Internet Explorer v7.00 (7.00.6000.16473)
    Boot mode: Normal

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\system32\spoolsv.exe
    C:\WINDOWS\Explorer.EXE
    C:\Program Files\AntiVir PersonalEdition Classic\avgnt.exe
    C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
    C:\Program Files\ABIT\ABIT uGuru\uGuru.exe
    C:\WINDOWS\SnoopFreeUI.exe
    C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
    C:\WINDOWS\system32\ctfmon.exe
    C:\Program Files\ABIT\ABIT uGuru\uGuru_Event_Receiver.exe
    C:\Program Files\allSnap\allSnap.exe
    C:\Pelit\PokerOffice\bin\javaw.exe
    C:\Program Files\AntiVir PersonalEdition Classic\sched.exe
    C:\Program Files\AntiVir PersonalEdition Classic\avguard.exe
    C:\WINDOWS\System32\SnoopFreeSvc.exe
    C:\WINDOWS\system32\ZoneLabs\vsmon.exe
    C:\WINDOWS\system32\taskmgr.exe
    C:\Program Files\Mozilla Firefox\firefox.exe
    C:\WINDOWS\system32\rundll32.exe
    C:\Documents and Settings\Lauri\Työpöytä\ewido_micro.exe
    C:\PROGRA~1\COMMON~1\INSTAL~1\Driver\11\INTEL3~1\IDriverT.exe
    C:\PROGRA~1\COMMON~1\INSTAL~1\Driver\11\INTEL3~1\IDriverT.exe
    C:\PROGRA~1\COMMON~1\INSTAL~1\Driver\11\INTEL3~1\IDriverT.exe
    C:\WINDOWS\system32\msiexec.exe
    C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
    C:\WINDOWS\system32\MsiExec.exe
    C:\Documents and Settings\Lauri\Työpöytä\dss.exe
    C:\PROGRA~1\HIJACK~1\Lauri.exe

    R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Linkit
    O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
    O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
    O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
    O4 - HKLM\..\Run: [POEngine] "C:\Pelit\PokerOffice\POEngine.exe" C:\Pelit\PokerOffice
    O4 - HKLM\..\Run: [Zone Labs Client] C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
    O4 - HKLM\..\Run: [avgnt] "C:\Program Files\AntiVir PersonalEdition Classic\avgnt.exe" /min
    O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
    O4 - HKLM\..\Run: [ATICCC] "C:\Program Files\ATI Technologies\ATI.ACE\cli.exe" runtime
    O4 - HKLM\..\Run: [ABIT uGuru] C:\Program Files\ABIT\ABIT uGuru\uGuru.exe
    O4 - HKLM\..\Run: [SnoopFreeUI] SnoopFreeUI.exe
    O4 - HKLM\..\Run: [ZoneAlarm Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"
    O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
    O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
    O4 - HKCU\..\Run: [Yahoo! Pager] "C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe" -quiet
    O4 - HKCU\..\RunOnce: [ypagerps] cmd.exe /C del "C:\Program Files\Yahoo!\Messenger\ypagerps.dll"
    O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Paikallinen palve')
    O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Verkkopalve')
    O4 - HKUS\S-1-5-21-1085031214-813497703-725345543-1012\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'postgres')
    O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
    O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
    O4 - Startup: allSnap.lnk = C:\Program Files\allSnap\allSnap.exe
    O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
    O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~3\Office10\EXCEL.EXE/3000
    O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\npjpi150_06.dll
    O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\npjpi150_06.dll
    O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe
    O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe
    O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
    O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
    O10 - Unknown file in Winsock LSP: c:\windows\system32\nwprovau.dll
    O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
    O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://download.bitdefender.com/resources/scan8/oscan8.cab
    O23 - Service: AntiVir PersonalEdition Classic Scheduler (AntiVirScheduler) - Avira GmbH - C:\Program Files\AntiVir PersonalEdition Classic\sched.exe
    O23 - Service: AntiVir PersonalEdition Classic Guard (AntiVirService) - Avira GmbH - C:\Program Files\AntiVir PersonalEdition Classic\avguard.exe
    O23 - Service: PostgreSQL Database Server 8.2 (pgsql-8.2) - PostgreSQL Global Development Group - C:\Program Files\PostgreSQ3L\8.2\bin\pg_ctl.exe
    O23 - Service: Snoop Free Service (SnoopFreeSvc) - Unknown owner - C:\WINDOWS\System32\SnoopFreeSvc.exe
    O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe

    --
    End of file - 5667 bytes

    -- HijackThis Fixed Entries (C:\PROGRA~1\HIJACK~1\backups\) --------------------

    backup-20070812-222427-158 R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
    backup-20070812-222427-194 R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
    backup-20070812-222427-232 R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
    backup-20070812-222427-452 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = about:blank

    -- File Associations -----------------------------------------------------------

    All associations okay.


    -- Drivers: 0-Boot, 1-System, 2-Auto, 3-Demand, 4-Disabled ---------------------

    R0 sfdrv01 (StarForce Protection Environment Driver (version 1.x)) - c:\windows\system32\drivers\sfdrv01.sys <Not Verified; Protection Technology; StarForce Protection System>
    R0 sfhlp02 (StarForce Protection Helper Driver (version 2.x)) - c:\windows\system32\drivers\sfhlp02.sys <Not Verified; Protection Technology; StarForce Protection System>
    R0 sfsync02 (StarForce Protection Synchronization Driver (version 2.x)) - c:\windows\system32\drivers\sfsync02.sys <Not Verified; Protection Technology; StarForce Protection System>
    R0 SnoopFree (SnoopFree Driver) - c:\windows\system32\drivers\snopfree.sys
    R0 uGuru - c:\windows\system32\drivers\uguru.sys <Not Verified; ABIT Computer Corporation; uGuru V2.0 device driver>
    R3 pfc (Padus ASPI Shell) - c:\windows\system32\drivers\pfc.sys <Not Verified; Padus, Inc.; Padus(R) ASPI Shell>

    S3 gtermddo - c:\docume~1\lauri\locals~1\temp\gtermddo.sys (file missing)
    S3 Memctl - c:\program files\abit\abit uguru\memctl.sys
    S3 razerusb - c:\windows\system32\drivers\razerusb.sys <Not Verified; Razer Inc.; Razer USB Mouse Driver>
    S3 TFBULK (Topfield USB client driver) - c:\windows\system32\drivers\tfbulk.sys <Not Verified; Topfield Co., Ltd.; >
    S3 WinDriver6 - c:\windows\system32\drivers\windrvr6.sys <Not Verified; Jungo; WinDriver Device Driver>
    S3 Winflash - c:\program files\abit\abit uguru\winflash.sys


    -- Services: 0-Boot, 1-System, 2-Auto, 3-Demand, 4-Disabled --------------------

    R2 AntiVirScheduler (AntiVir PersonalEdition Classic Scheduler) - c:\program files\antivir personaledition classic\sched.exe <Not Verified; Avira GmbH; Scheduler>
    R2 pgsql-8.2 (PostgreSQL Database Server 8.2) - "c:\program files\postgresq3l\8.2\bin\pg_ctl.exe" runservice -n "pgsql-8.2" -d "c:\program files\postgresq3l\8.2\data\" <Not Verified; PostgreSQL Global Development Group; PostgreSQL>
    R2 SnoopFreeSvc (Snoop Free Service) - system32\snoopfreesvc.exe


    -- Device Manager: Disabled ----------------------------------------------------

    No disabled devices found.


    -- Scheduled Tasks -------------------------------------------------------------

    2007-06-19 03:00:00 362 --a------ C:\WINDOWS\Tasks\XoftSpySE.job


    -- Files created between 2007-07-12 and 2007-08-12 -----------------------------

    2007-08-12 22:38:17 0 d-------- C:\Program Files\SpywareBlaster
    2007-08-12 22:32:30 0 d-------- C:\hosts
    2007-08-12 21:06:22 0 dr-h----- C:\Documents and Settings\Lauri\Recent
    2007-08-12 20:30:54 0 d-------- C:\Program Files\CCleaner
    2007-08-09 11:49:27 0 d-------- C:\Program Files\PokerStove
    2007-08-08 17:14:00 0 d-a------ C:\Documents and Settings\All Users\Application Data\TEMP
    2007-07-19 23:37:25 0 d-------- C:\Program Files\Poker Evolver


    -- Find3M Report ---------------------------------------------------------------

    2007-08-12 23:05:24 0 d-------- C:\Program Files\Java
    2007-08-12 22:51:00 0 d-------- C:\Program Files\QuickTime
    2007-08-12 17:13:00 0 d-------- C:\Program Files\Poker Tracker V2
    2007-07-29 19:38:56 0 d-------- C:\Program Files\PokerAce Hud
    2007-07-20 12:12:12 375602 --a------ C:\WINDOWS\system32\perfh00B.dat
    2007-07-20 12:12:12 75610 --a------ C:\WINDOWS\system32\perfc00B.dat
    2007-06-15 00:15:01 0 d-------- C:\Program Files\TVAnts
    2007-06-15 00:04:51 0 d-------- C:\Program Files\PPMate
    2007-06-15 00:04:22 0 d-------- C:\Documents and Settings\Lauri\Application Data\PPMate
    2007-06-15 00:04:20 0 d-------- C:\Program Files\Common Files
    2007-06-15 00:04:20 0 d-------- C:\Program Files\Common Files\Synacast
    2007-06-15 00:03:37 0 d-------- C:\Documents and Settings\Lauri\Application Data\SopCast


    -- Registry Dump ---------------------------------------------------------------

    *Note* empty entries & legit default entries are not shown


    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "POEngine"="C:\Pelit\PokerOffice\POEngine.exe" [07/13/2005 05:17 PM]
    "Zone Labs Client"="C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe" [03/09/2007 12:02 AM]
    "avgnt"="C:\Program Files\AntiVir PersonalEdition Classic\avgnt.exe" [04/20/2007 09:12 PM]
    "ATIPTA"="C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe" [03/22/2005 09:05 PM]
    "ATICCC"="C:\Program Files\ATI Technologies\ATI.ACE\cli.exe" [08/31/2005 12:40 AM]
    "ABIT uGuru"="C:\Program Files\ABIT\ABIT uGuru\uGuru.exe" [05/21/2004 04:07 PM]
    "SnoopFreeUI"="SnoopFreeUI.exe" [02/21/2007 01:50 PM C:\WINDOWS\SnoopFreeUI.exe]
    "ZoneAlarm Client"="C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe" [03/09/2007 12:02 AM]
    "SunJavaUpdateSched"="C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe" [11/10/2005 02:03 PM]

    [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [09/15/2004 03:00 PM]
    "Yahoo! Pager"="C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe" [07/16/2007 03:17 PM]

    [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\runonce]
    "ypagerps"=cmd.exe /C del "C:\Program Files\Yahoo!\Messenger\ypagerps.dll"

    C:\Documents and Settings\Lauri\K„ynnist„-valikko\Ohjelmat\K„ynnistys\
    allSnap.lnk - C:\Program Files\allSnap\allSnap.exe [03/20/2004 12:02:14 AM]

    C:\Documents and Settings\All Users\K„ynnist„-valikko\Ohjelmat\K„ynnistys\
    Adobe Reader Speed Launch.lnk - C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe [09/23/2005 10:05:26 PM]

    [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer]
    "LinkResolveIgnoreLinkInfo"=0 (0x0)
    "NoResolveSearch"=1 (0x1)

    [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]
    "NoTrayItemsDisplay"=00000000
    "LinkResolveIgnoreLinkInfo"=0 (0x0)

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
    "SandraTheSrv"=3 (0x3)
    "SandraDataSrv"=3 (0x3)
    "iPodService"=3 (0x3)
    "IDriverT"=3 (0x3)
    "ATI Smart"=2 (0x2)
    "Ati HotKey Poller"=2 (0x2)

    [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-]
    "InCD"=C:\Program Files\Ahead\InCD\InCD.exe
    "iTunesHelper"="C:\Program Files\iTunes\iTunesHelper.exe"
    "NeroCheck"=C:\WINDOWS\system32\NeroCheck.exe
    "QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" -atboottime
    "type32"="C:\Program Files\Microsoft IntelliType Pro\type32.exe"


    [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\F]
    AutoRun\command- F:\LaunchU3.exe -a




    -- Hosts -----------------------------------------------------------------------

    127.0.0.1 ad.a8.net
    127.0.0.1 asy.a8ww.net
    127.0.0.1 www.aaa-livedoor.net #[Trojan-PSW.Win32.Maran.ei]
    127.0.0.1 www.abcsearcher.com #[Spamdexing][Microsoft.Strider]
    127.0.0.1 abc-search.info
    127.0.0.1 abloga.info #[Spamdexing]
    127.0.0.1 www.abx4.com #[Adware.ABXToolbar]
    127.0.0.1 www.acezip.net #[Win32/Adware.180Solutions]
    127.0.0.1 phpadsnew.abac.com
    127.0.0.1 a.abnad.net

    16032 more entries in hosts file.


    -- End of Deckard's System Scanner: finished at 2007-08-12 at 23:10:15 ---------

    Deckard's System Scanner v20070809.63
    Extra logfile - please post this as an attachment with your post.
    --------------------------------------------------------------------------------

    -- System Information ----------------------------------------------------------

    Microsoft Windows XP Home Edition (build 2600) SP 2.0
    Architecture: X86; Language: Other (040B) - see http://preview.tinyurl.com/mhhp6

    CPU 0: Intel(R) Pentium(R) 4 CPU 3.00GHz
    CPU 1: Intel(R) Pentium(R) 4 CPU 3.00GHz
    Percentage of Memory in Use: 32%
    Physical Memory (total/avail): 2047.48 MiB / 1388.56 MiB
    Pagefile Memory (total/avail): 3429.91 MiB / 2808.06 MiB
    Virtual Memory (total/avail): 2047.88 MiB / 1960.73 MiB

    A: is Removable (No Media)
    C: is Fixed (NTFS) - 189.91 GiB total, 97.83 GiB free.
    D: is CDROM (UDF)
    E: is CDROM (No Media)


    -- Security Center -------------------------------------------------------------

    AUOptions is set to notify before download.
    Windows Internal Firewall is disabled.

    FirstRunDisabled is set.

    FW: ZoneAlarm Firewall v7.0.337.000 (Check Point, LTD.)
    AV: Avira AntiVir PersonalEdition Classic v0.0.0.0 (Avira GmbH) Disabled
    AV: Avira AntiVir PersonalEdition Classic v0.0.0.0 (Avira GmbH)
    AV: Avira AntiVir PersonalEdition Classic v0.0.0.0 (Avira GmbH)
    AV: Avira AntiVir PersonalEdition Classic v0.0.0.0 (Avira GmbH)
    AV: Avira AntiVir PersonalEdition Classic v0.0.0.0 (Avira GmbH)
    AV: Avira AntiVir PersonalEdition Classic v0.0.0.0 (Avira GmbH)
    AV: Avira AntiVir PersonalEdition Classic v0.0.0.0 (Avira GmbH)
    AV: Avira AntiVir PersonalEdition Classic v0.0.0.0 (Avira GmbH)
    AV: Avira AntiVir PersonalEdition Classic v0.0.0.0 (Avira GmbH) Disabled
    AV: Avira AntiVir PersonalEdition Classic v0.0.0.0 (Avira GmbH)
    AV: Avira AntiVir PersonalEdition Classic v0.0.0.0 (Avira GmbH)
    AV: Avira AntiVir PersonalEdition Classic v0.0.0.0 (Avira GmbH)
    AV: Avira AntiVir PersonalEdition Classic v0.0.0.0 (Avira GmbH)
    AV: Avira AntiVir PersonalEdition Classic v0.0.0.0 (Avira GmbH)
    AV: Avira AntiVir PersonalEdition Classic v0.0.0.0 (Avira GmbH)
    AV: Avira AntiVir PersonalEdition Classic v0.0.0.0 (Avira GmbH)
    AV: Avira AntiVir PersonalEdition Classic v0.0.0.0 (Avira GmbH)
    AV: Avira AntiVir PersonalEdition Classic v0.0.0.0 (Avira GmbH)
    AV: Avira AntiVir PersonalEdition Classic v0.0.0.0 (Avira GmbH)
    AV: Avira AntiVir PersonalEdition Classic v0.0.0.0 (Avira GmbH)
    AV: Avira AntiVir PersonalEdition Classic v0.0.0.0 (Avira GmbH) Disabled
    AV: Avira AntiVir PersonalEdition Classic v0.0.0.0 (Avira GmbH)
    AV: Avira AntiVir PersonalEdition Classic v0.0.0.0 (Avira GmbH)
    AV: Avira AntiVir PersonalEdition Classic v0.0.0.0 (Avira GmbH)
    AV: Avira AntiVir PersonalEdition Classic v0.0.0.0 (Avira GmbH)
    AV: Avira AntiVir PersonalEdition Classic v0.0.0.0 (Avira GmbH)
    AV: Avira AntiVir PersonalEdition Classic v0.0.0.0 (Avira GmbH)
    AV: Avira AntiVir PersonalEdition Classic v0.0.0.0 (Avira GmbH)
    AV: Avira AntiVir PersonalEdition Classic v0.0.0.0 (Avira GmbH) Disabled
    AV: Avira AntiVir PersonalEdition Classic v0.0.0.0 (Avira GmbH)
    AV: Avira AntiVir PersonalEdition Classic v0.0.0.0 (Avira GmbH)
    AV: Avira AntiVir PersonalEdition Classic v0.0.0.0 (Avira GmbH)
    AV: Avira AntiVir PersonalEdition Classic v0.0.0.0 (Avira GmbH)
    AV: Avira AntiVir PersonalEdition Classic v0.0.0.0 (Avira GmbH)
    AV: Avira AntiVir PersonalEdition Classic v0.0.0.0 (Avira GmbH)
    AV: Avira AntiVir PersonalEdition Classic v0.0.0.0 (Avira GmbH)
    AV: Avira AntiVir PersonalEdition Classic v0.0.0.0 (Avira GmbH)
    AV: Avira AntiVir PersonalEdition Classic v0.0.0.0 (Avira GmbH)
    AV: Avira AntiVir PersonalEdition Classic v0.0.0.0 (Avira GmbH)
    AV: Avira AntiVir PersonalEdition Classic v0.0.0.0 (Avira GmbH)
    AV: Avira AntiVir PersonalEdition Classic v0.0.0.0 (Avira GmbH)
    AV: Avira AntiVir PersonalEdition Classic v0.0.0.0 (Avira GmbH)
    AV: Avira AntiVir PersonalEdition Classic v0.0.0.0 (Avira GmbH)
    AV: Avira AntiVir PersonalEdition Classic v0.0.0.0 (Avira GmbH)
    AV: Avira AntiVir PersonalEdition Classic v0.0.0.0 (Avira GmbH)
    AV: Avira AntiVir PersonalEdition Classic v0.0.0.0 (Avira GmbH)
    AV: Avira AntiVir PersonalEdition Classic v0.0.0.0 (Avira GmbH)
    AV: Avira AntiVir PersonalEdition Classic v0.0.0.0 (Avira GmbH)
    AV: Avira AntiVir PersonalEdition Classic v0.0.0.0 (Avira GmbH)
    AV: Avira AntiVir PersonalEdition Classic v0.0.0.0 (Avira GmbH)
    AV: Avira AntiVir PersonalEdition Classic v0.0.0.0 (Avira GmbH)
    AV: Avira AntiVir PersonalEdition Classic v0.0.0.0 (Avira GmbH)
    AV: Avira AntiVir PersonalEdition Classic v0.0.0.0 (Avira GmbH)
    AV: Avira AntiVir PersonalEdition Classic v0.0.0.0 (Avira GmbH)
    AV: Avira AntiVir PersonalEdition Classic v0.0.0.0 (Avira GmbH)
    AV: Avira AntiVir PersonalEdition Classic v0.0.0.0 (Avira GmbH)
    AV: Avira AntiVir PersonalEdition Classic v0.0.0.0 (Avira GmbH)
    AV: Avira AntiVir PersonalEdition Classic v0.0.0.0 (Avira GmbH) Disabled
    AV: Avira AntiVir PersonalEdition Classic v0.0.0.0 (Avira GmbH)
    AV: Avira AntiVir PersonalEdition Classic v0.0.0.0 (Avira GmbH)
    AV: Avira AntiVir PersonalEdition Classic v0.0.0.0 (Avira GmbH)
    AV: Avira AntiVir PersonalEdition Classic v0.0.0.0 (Avira GmbH)
    AV: Avira AntiVir PersonalEdition Classic v0.0.0.0 (Avira GmbH)
    AV: Avira AntiVir PersonalEdition Classic v0.0.0.0 (Avira GmbH)
    AV: Avira AntiVir PersonalEdition Classic v0.0.0.0 (Avira GmbH) Disabled
    AV: Avira AntiVir PersonalEdition Classic v0.0.0.0 (Avira GmbH)
    AV: Avira AntiVir PersonalEdition Classic v0.0.0.0 (Avira GmbH)
    AV: Avira AntiVir PersonalEdition Classic v0.0.0.0 (Avira GmbH)
    AV: Avira AntiVir PersonalEdition Classic v0.0.0.0 (Avira GmbH)
    AV: Avira AntiVir PersonalEdition Classic v0.0.0.0 (Avira GmbH)
    AV: Avira AntiVir PersonalEdition Classic v0.0.0.0 (Avira GmbH)
    AV: Avira AntiVir PersonalEdition Classic v0.0.0.0 (Avira GmbH)
    AV: Avira AntiVir PersonalEdition Classic v 6.38.1.19
    (Avira GmbH) Disabled
    AV: Avira AntiVir PersonalEdition Classic v0.0.0.0 (Avira GmbH)
    AV: Avira AntiVir PersonalEdition Classic v0.0.0.0 (Avira GmbH) Disabled
    AV: Avira AntiVir PersonalEdition Classic v0.0.0.0 (Avira GmbH)
    AV: Avira AntiVir PersonalEdition Classic v0.0.0.0 (Avira GmbH)
    AV: Avira AntiVir PersonalEdition Classic v0.0.0.0 (Avira GmbH)
    AV: Avira AntiVir PersonalEdition Classic v0.0.0.0 (Avira GmbH)
    AV: Avira AntiVir PersonalEdition Classic v0.0.0.0 (Avira GmbH)
    AV: Avira AntiVir PersonalEdition Classic v0.0.0.0 (Avira GmbH)
    AV: Avira AntiVir PersonalEdition Classic v0.0.0.0 (Avira GmbH)
    AV: Avira AntiVir PersonalEdition Classic v0.0.0.0 (Avira GmbH)
    AV: Avira AntiVir PersonalEdition Classic v0.0.0.0 (Avira GmbH)
    AV: Avira AntiVir PersonalEdition Classic v0.0.0.0 (Avira GmbH)
    AV: Avira AntiVir PersonalEdition Classic v0.0.0.0 (Avira GmbH)
    AV: Avira AntiVir PersonalEdition Classic v0.0.0.0 (Avira GmbH)
    AV: Avira AntiVir PersonalEdition Classic v0.0.0.0 (Avira GmbH) Disabled
    AV: Avira AntiVir PersonalEdition Classic v0.0.0.0 (Avira GmbH)
    AV: Avira AntiVir PersonalEdition Classic v0.0.0.0 (Avira GmbH)
    AV: Avira AntiVir PersonalEdition Classic v0.0.0.0 (Avira GmbH)
    AV: Avira AntiVir PersonalEdition Classic v0.0.0.0 (Avira GmbH)
    AV: Avira AntiVir PersonalEdition Classic v0.0.0.0 (Avira GmbH)
    AV: Avira AntiVir PersonalEdition Classic v0.0.0.0 (Avira GmbH)
    AV: Avira AntiVir PersonalEdition Classic v0.0.0.0 (Avira GmbH)
    AV: Avira AntiVir PersonalEdition Classic v0.0.0.0 (Avira GmbH)
    AV: Avira AntiVir PersonalEdition Classic v0.0.0.0 (Avira GmbH)
    AV: Avira AntiVir PersonalEdition Classic v0.0.0.0 (Avira GmbH)
    AV: Avira AntiVir PersonalEdition Classic v0.0.0.0 (Avira GmbH)
    AV: Avira AntiVir PersonalEdition Classic v0.0.0.0 (Avira GmbH)
    AV: Avira AntiVir PersonalEdition Classic v0.0.0.0 (Avira GmbH)
    AV: Avira AntiVir PersonalEdition Classic v0.0.0.0 (Avira GmbH) Disabled
    AV: Avira AntiVir PersonalEdition Classic v0.0.0.0 (Avira GmbH)
    AV: Avira AntiVir PersonalEdition Classic v0.0.0.0 (Avira GmbH)
    AV: Avira AntiVir PersonalEdition Classic v0.0.0.0 (Avira GmbH)
    AV: Avira AntiVir PersonalEdition Classic v0.0.0.0 (Avira GmbH)
    AV: Avira AntiVir PersonalEdition Classic v0.0.0.0 (Avira GmbH)
    AV: Avira AntiVir PersonalEdition Classic v0.0.0.0 (Avira GmbH)
    AV: Avira AntiVir PersonalEdition Classic v0.0.0.0 (Avira GmbH)
    AV: Avira AntiVir PersonalEdition Classic v0.0.0.0 (Avira GmbH)
    AV: ZoneAlarm Security Suite Antivirus v7.0.337.000 (Check Point, LTD.)
    AV: Avira AntiVir PersonalEdition Classic v0.0.0.0 (Avira GmbH)
    AV: Avira AntiVir PersonalEdition Classic v0.0.0.0 (Avira GmbH)
    AV: Avira AntiVir PersonalEdition Classic v0.0.0.0 (Avira GmbH)
    AV: Avira AntiVir PersonalEdition Classic v0.0.0.0 (Avira GmbH)
    AV: Avira AntiVir PersonalEdition Classic v0.0.0.0 (Avira GmbH)
    AV: Avira AntiVir PersonalEdition Classic v0.0.0.0 (Avira GmbH)
    AV: Avira AntiVir PersonalEdition Classic v0.0.0.0 (Avira GmbH)
    AV: Avira AntiVir PersonalEdition Classic v 6.38.1.19
    (Avira GmbH)
    AV: Avira AntiVir PersonalEdition Classic v0.0.0.0 (Avira GmbH)
    AV: Avira AntiVir PersonalEdition Classic v0.0.0.0 (Avira GmbH)
    AV: Avira AntiVir PersonalEdition Classic v0.0.0.0 (Avira GmbH)
    AV: Avira AntiVir PersonalEdition Classic v0.0.0.0 (Avira GmbH) Disabled
    AV: Avira AntiVir PersonalEdition Classic v0.0.0.0 (Avira GmbH)
    AV: Avira AntiVir PersonalEdition Classic v0.0.0.0 (Avira GmbH)
    AV: Avira AntiVir PersonalEdition Classic v0.0.0.0 (Avira GmbH) Disabled
    AV: Avira AntiVir PersonalEdition Classic v0.0.0.0 (Avira GmbH)
    AV: Avira AntiVir PersonalEdition Classic v0.0.0.0 (Avira GmbH) Disabled
    AV: Avira AntiVir PersonalEdition Classic v0.0.0.0 (Avira GmbH)
    AV: Avira AntiVir PersonalEdition Classic v0.0.0.0 (Avira GmbH)
    AV: Avira AntiVir PersonalEdition Classic v0.0.0.0 (Avira GmbH)
    AV: Avira AntiVir PersonalEdition v 6.39.0.231
    (Avira GmbH)
    AV: Avira AntiVir PersonalEdition Classic v0.0.0.0 (Avira GmbH)
    AV: Avira AntiVir PersonalEdition Classic v0.0.0.0 (Avira GmbH)
    AV: Avira AntiVir PersonalEdition Classic v0.0.0.0 (Avira GmbH)
    AV: Avira AntiVir PersonalEdition Classic v0.0.0.0 (Avira GmbH)
    AV: Avira AntiVir PersonalEdition Classic v0.0.0.0 (Avira GmbH)
    AV: Avira AntiVir PersonalEdition Classic v0.0.0.0 (Avira GmbH)
    AV: Avira AntiVir PersonalEdition Classic v0.0.0.0 (Avira GmbH) Disabled
    AV: Avira AntiVir PersonalEdition Classic v0.0.0.0 (Avira GmbH)
    AV: Avira AntiVir PersonalEdition Classic v0.0.0.0 (Avira GmbH)
    AV: Avira AntiVir PersonalEdition Classic v0.0.0.0 (Avira GmbH)
    AV: Avira AntiVir PersonalEdition Classic v0.0.0.0 (Avira GmbH)
    AV: Avira AntiVir PersonalEdition Classic v0.0.0.0 (Avira GmbH)
    AV: Avira AntiVir PersonalEdition Classic v0.0.0.0 (Avira GmbH)
    AV: Avira AntiVir PersonalEdition Classic v0.0.0.0 (Avira GmbH)
    AV: Avira AntiVir PersonalEdition Classic v0.0.0.0 (Avira GmbH)
    AV: Avira AntiVir PersonalEdition Classic v0.0.0.0 (Avira GmbH)
    AV: Avira AntiVir PersonalEdition Classic v0.0.0.0 (Avira GmbH)
    AV: Avira AntiVir PersonalEdition Classic v0.0.0.0 (Avira GmbH)
    AV: Avira AntiVir PersonalEdition Classic v0.0.0.0 (Avira GmbH)
    AV: Avira AntiVir PersonalEdition Classic v0.0.0.0 (Avira GmbH)
    AV: Avira AntiVir PersonalEdition Classic v0.0.0.0 (Avira GmbH) Disabled
    AV: Avira AntiVir PersonalEdition Classic v0.0.0.0 (Avira GmbH)
    AV: Avira AntiVir PersonalEdition Classic v0.0.0.0 (Avira GmbH)
    AV: Avira AntiVir PersonalEdition Classic v0.0.0.0 (Avira GmbH)
    AV: Avira AntiVir PersonalEdition Classic v0.0.0.0 (Avira GmbH)
    AV: Avira AntiVir PersonalEdition Classic v0.0.0.0 (Avira GmbH) Disabled
    AV: Avira AntiVir PersonalEdition Classic v0.0.0.0 (Avira GmbH)
    AV: Avira AntiVir PersonalEdition Classic v0.0.0.0 (Avira GmbH)
    AV: Avira AntiVir PersonalEdition Classic v0.0.0.0 (Avira GmbH)
    AV: Avira AntiVir PersonalEdition Classic v0.0.0.0 (Avira GmbH)
    AV: Avira AntiVir PersonalEdition Classic v0.0.0.0 (Avira GmbH)
    AV: Avira AntiVir PersonalEdition Classic v0.0.0.0 (Avira GmbH)
    AV: Avira AntiVir PersonalEdition Classic v0.0.0.0 (Avira GmbH)
    AV: Avira AntiVir PersonalEdition Classic v0.0.0.0 (Avira GmbH)
    AV: Avira AntiVir PersonalEdition Classic v0.0.0.0 (Avira GmbH) Disabled
    AV: Avira AntiVir PersonalEdition Classic v0.0.0.0 (Avira GmbH)
    AV: Avira AntiVir PersonalEdition Classic v0.0.0.0 (Avira GmbH)
    AV: Avira AntiVir PersonalEdition Classic v0.0.0.0 (Avira GmbH) Disabled
    AV: Avira AntiVir PersonalEdition Classic v0.0.0.0 (Avira GmbH)
    AV: Avira AntiVir PersonalEdition Classic v0.0.0.0 (Avira GmbH)
    AV: Avira AntiVir PersonalEdition Classic v0.0.0.0 (Avira GmbH)
    AV: Avira AntiVir PersonalEdition Classic v0.0.0.0 (Avira GmbH)
    AV: Avira AntiVir PersonalEdition Classic v0.0.0.0 (Avira GmbH)
    AV: Avira AntiVir PersonalEdition Classic v0.0.0.0 (Avira GmbH)
    AV: Avira AntiVir PersonalEdition Classic v0.0.0.0 (Avira GmbH)
    AV: Avira AntiVir PersonalEdition Classic v0.0.0.0 (Avira GmbH) Disabled
    AV: Avira AntiVir PersonalEdition Classic v0.0.0.0 (Avira GmbH)
    AV: Avira AntiVir PersonalEdition Classic v0.0.0.0 (Avira GmbH)
    AV: Avira AntiVir PersonalEdition Classic v0.0.0.0 (Avira GmbH)
    AV: Avira AntiVir PersonalEdition Classic v0.0.0.0 (Avira GmbH)
    AV: Avira AntiVir PersonalEdition Classic v0.0.0.0 (Avira GmbH)
    AV: Avira AntiVir PersonalEdition Classic v0.0.0.0 (Avira GmbH)
    AV: Avira AntiVir PersonalEdition Classic v0.0.0.0 (Avira GmbH)
    AV: Avira AntiVir PersonalEdition Classic v0.0.0.0 (Avira GmbH)
    AV: Avira AntiVir PersonalEdition Classic v0.0.0.0 (Avira GmbH)
    AV: Avira AntiVir PersonalEdition Classic v0.0.0.0 (Avira GmbH)
    AV: Avira AntiVir PersonalEdition Classic v0.0.0.0 (Avira GmbH)
    AV: Avira AntiVir PersonalEdition Classic v0.0.0.0 (Avira GmbH)
    AV: Avira AntiVir PersonalEdition Classic v0.0.0.0 (Avira GmbH)
    AV: Avira AntiVir PersonalEdition Classic v0.0.0.0 (Avira GmbH)
    AV: Avira AntiVir PersonalEdition Classic v0.0.0.0 (Avira GmbH)
    AV: Avira AntiVir PersonalEdition Classic v0.0.0.0 (Avira GmbH)
    AV: Avira AntiVir PersonalEdition Classic v0.0.0.0 (Avira GmbH)
    AV: Avira AntiVir PersonalEdition Classic v0.0.0.0 (Avira GmbH)
    AV: Avira AntiVir PersonalEdition Classic v0.0.0.0 (Avira GmbH)
    AV: Avira AntiVir PersonalEdition Classic v0.0.0.0 (Avira GmbH)
    AV: Avira AntiVir PersonalEdition Classic v0.0.0.0 (Avira GmbH)
    AV: Avira AntiVir PersonalEdition Classic v0.0.0.0 (Avira GmbH)
    AV: Avira AntiVir PersonalEdition Classic v0.0.0.0 (Avira GmbH)
    AV: Avira AntiVir PersonalEdition Classic v0.0.0.0 (Avira GmbH)
    AV: Avira AntiVir PersonalEdition Classic v0.0.0.0 (Avira GmbH)
    AV: Avira AntiVir PersonalEdition Classic v0.0.0.0 (Avira GmbH) Disabled
    AV: Avira AntiVir PersonalEdition Classic v0.0.0.0 (Avira GmbH)
    AV: Avira AntiVir PersonalEdition Classic v0.0.0.0 (Avira GmbH)
    AV: Avira AntiVir PersonalEdition Classic v0.0.0.0 (Avira GmbH)
    AV: Avira AntiVir PersonalEdition Classic v0.0.0.0 (Avira GmbH)
    AV: Avira AntiVir PersonalEdition Classic v0.0.0.0 (Avira GmbH) Disabled
    AV: Avira AntiVir PersonalEdition Classic v0.0.0.0 (Avira GmbH) Disabled
    AV: Avira AntiVir PersonalEdition Classic v0.0.0.0 (Avira GmbH)
    AV: Avira AntiVir PersonalEdition Classic v0.0.0.0 (Avira GmbH)
    AV: Avira AntiVir PersonalEdition Classic v0.0.0.0 (Avira GmbH)
    AV: Avira AntiVir PersonalEdition Classic v0.0.0.0 (Avira GmbH)
    AV: Avira AntiVir PersonalEdition Classic v0.0.0.0 (Avira GmbH)
    AV: Avira AntiVir PersonalEdition Classic v0.0.0.0 (Avira GmbH)
    AV: Avira AntiVir PersonalEdition Classic v0.0.0.0 (Avira GmbH)
    AV: Avira AntiVir PersonalEdition Classic v0.0.0.0 (Avira GmbH)
    AV: Avira AntiVir PersonalEdition Classic v0.0.0.0 (Avira GmbH)
    AV: Avira AntiVir PersonalEdition Classic v0.0.0.0 (Avira GmbH)
    AV: Avira AntiVir PersonalEdition Classic v0.0.0.0 (Avira GmbH)
    AV: Avira AntiVir PersonalEdition Classic v0.0.0.0 (Avira GmbH)

    [HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List]
    "%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:mad:xpsp2res.dll,-22019"
    "C:\\Program Files\\MSN Messenger\\msnmsgr.exe"="C:\\Program Files\\MSN Messenger\\msnmsgr.exe:*:Enabled:MSN Messenger 7.5"
    "%windir%\\Network Diagnostic\\xpnetdiag.exe"="%windir%\\Network Diagnostic\\xpnetdiag.exe:*:Enabled:mad:xpsp3res.dll,-20000"

    [HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]
    "C:\\Program Files\\Ares\\Ares.exe"="C:\\Program Files\\Ares\\Ares.exe:*:Enabled:Ares"
    "C:\\mysql\\bin\\mysqld.exe"="C:\\mysql\\bin\\mysqld.exe:*:Enabled:mysqld"
    "C:\\Pokeri\\PokerOffice\\bin\\javaw.exe"="C:\\Pokeri\\PokerOffice\\bin\\javaw.exe:*:Enabled:Java(TM) 2 Platform Standard Edition binary"
    "C:\\Program Files\\PokerOffice\\bin\\javaw.exe"="C:\\Program Files\\PokerOffice\\bin\\javaw.exe:*:Enabled:Java(TM) 2 Platform Standard Edition binary"
    "C:\\Pokeri\\PO\\bin\\javaw.exe"="C:\\Pokeri\\PO\\bin\\javaw.exe:*:Enabled:Java(TM) 2 Platform Standard Edition binary"
    "C:\\Program Files\\Java\\jre1.5.0_02\\bin\\javaw.exe"="C:\\Program Files\\Java\\jre1.5.0_02\\bin\\javaw.exe:*:Enabled:Java(TM) 2 Platform Standard Edition binary"
    "C:\\Program Files\\Java\\jre1.5.0_04\\bin\\javaw.exe"="C:\\Program Files\\Java\\jre1.5.0_04\\bin\\javaw.exe:*:Enabled:Java(TM) 2 Platform Standard Edition binary"
    "C:\\Program Files\\InterPoker\\UA.exe"="C:\\Program Files\\InterPoker\\UA.exe:*:Enabled:UA Application"
    "C:\\pelit\\Quake 4\\Quake4.exe"="C:\\pelit\\Quake 4\\Quake4.exe:*:Enabled:Quake 4"
    "C:\\Program Files\\DC++\\DCPlusPlus.exe"="C:\\Program Files\\DC++\\DCPlusPlus.exe:*:Disabled:DC++"
    "C:\\Program Files\\eDonkey2000\\edonkey2000.exe"="C:\\Program Files\\eDonkey2000\\edonkey2000.exe:*:Disabled:edonkey2000"
    "C:\\Program Files\\Clustone\\clustone.exe"="C:\\Program Files\\Clustone\\clustone.exe:*:Disabled:NeoClustone"
    "C:\\Program Files\\QuickTime\\QuickTimePlayer.exe"="C:\\Program Files\\QuickTime\\QuickTimePlayer.exe:*:Disabled:QuickTime Player"
    "C:\\Program Files\\Shareaza\\Shareaza.exe"="C:\\Program Files\\Shareaza\\Shareaza.exe:*:Disabled:Shareaza Ultimate File Sharing"
    "C:\\pelit\\civ4\\Civilization4.exe"="C:\\pelit\\civ4\\Civilization4.exe:*:Enabled:Sid Meier's Civilization 4"
    "C:\\WINDOWS\\system32\\sessmgr.exe"="C:\\WINDOWS\\system32\\sessmgr.exe:*:Disabled:mad:xpsp2res.dll,-22019"
    "C:\\Program Files\\GameSpy Arcade\\Aphex.exe"="C:\\Program Files\\GameSpy Arcade\\Aphex.exe:*:Disabled:GameSpy Arcade"
    "C:\\Program Files\\HLSW\\hlsw.exe"="C:\\Program Files\\HLSW\\hlsw.exe:*:Disabled:HLSW"
    "C:\\pelit\\REDALERT\\ww\\register.dat"="C:\\pelit\\REDALERT\\ww\\register.dat:*:Disabled:register"
    "C:\\Program Files\\The All-Seeing Eye\\eye.exe"="C:\\Program Files\\The All-Seeing Eye\\eye.exe:*:Disabled:Yahoo! All-Seeing Eye"
    "C:\\Program Files\\Mozilla Firefox\\firefox.exe"="C:\\Program Files\\Mozilla Firefox\\firefox.exe:*:Enabled:Firefox"
    "C:\\Program Files\\Java\\jre1.5.0_06\\bin\\javaw.exe"="C:\\Program Files\\Java\\jre1.5.0_06\\bin\\javaw.exe:*:Enabled:Java(TM) 2 Platform Standard Edition binary"
    "C:\\Program Files\\Microsoft Visual Studio\\Common\\Tools\\VS-Ent98\\Vanalyzr\\VARPC.EXE"="C:\\Program Files\\Microsoft Visual Studio\\Common\\Tools\\VS-Ent98\\Vanalyzr\\VARPC.EXE:*:Enabled:Microsoft (R) Visual Studio VSA RPC Event Creator"
    "C:\\pelit\\PokerOffice\\bin\\javaw.exe"="C:\\pelit\\PokerOffice\\bin\\javaw.exe:*:Enabled:Java(TM) 2 Platform Standard Edition binary"
    "C:\\Program Files\\Messenger\\msmsgs.exe"="C:\\Program Files\\Messenger\\msmsgs.exe:*:Enabled:Windows Messenger"
    "C:\\Program Files\\MSN Messenger\\msnmsgr.exe"="C:\\Program Files\\MSN Messenger\\msnmsgr.exe:*:Enabled:MSN Messenger 7.5"
    "C:\\Program Files\\iTunes\\iTunes.exe"="C:\\Program Files\\iTunes\\iTunes.exe:*:Enabled:iTunes"
    "%windir%\\Network Diagnostic\\xpnetdiag.exe"="%windir%\\Network Diagnostic\\xpnetdiag.exe:*:Enabled:mad:xpsp3res.dll,-20000"
    "C:\\Program Files\\Yahoo!\\Messenger\\YahooMessenger.exe"="C:\\Program Files\\Yahoo!\\Messenger\\YahooMessenger.exe:*:Enabled:Yahoo! Messenger"
    "C:\\Program Files\\Yahoo!\\Messenger\\YServer.exe"="C:\\Program Files\\Yahoo!\\Messenger\\YServer.exe:*:Enabled:Yahoo! FT Server"
    "C:\\Program Files\\PPMate\\ppmate.exe"="C:\\Program Files\\PPMate\\ppmate.exe:*:Enabled:pPMate"
    "C:\\Program Files\\PPMate\\ppmnet.exe"="C:\\Program Files\\PPMate\\ppmnet.exe:*:Enabled:pPMate"


    -- Environment Variables -------------------------------------------------------

    ALLUSERSPROFILE=C:\Documents and Settings\All Users
    APPDATA=C:\Documents and Settings\Lauri\Application Data
    CLASSPATH=C:\Program Files\Java\jre1.5.0_06\lib\ext\QTJava.zip
    CLIENTNAME=Console
    CommonProgramFiles=C:\Program Files\Common Files
    COMPUTERNAME=VANR
    ComSpec=C:\WINDOWS\system32\cmd.exe
    FP_NO_HOST_CHECK=NO
    HOMEDRIVE=C:
    HOMEPATH=\Documents and Settings\Lauri
    include=C:\Program Files\Microsoft Visual Studio\VC98\atl\include;C:\Program Files\Microsoft Visual Studio\VC98\mfc\include;C:\Program Files\Microsoft Visual Studio\VC98\include
    lib=C:\Program Files\Microsoft Visual Studio\VC98\mfc\lib;C:\Program Files\Microsoft Visual Studio\VC98\lib
    LOGONSERVER=\\VANR
    MSDevDir=C:\Program Files\Microsoft Visual Studio\Common\MSDev98
    NUMBER_OF_PROCESSORS=2
    OS=Windows_NT
    Path=C:\PROGRA~1\Java\JRE15~3.0_0\bin;C:\Program Files\Mozilla Firefox;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\Program Files\ATI Technologies\ATI Control Panel;C:\Program Files\ATI Technologies\ATI.ACE\;C:\Program Files\QuickTime\QTSystem\;C:\WINDOWS\system32\gs\gs7.05\bin;"C:\Program Files\Zone Labs\ZoneAlarm\MailFrontier";C:\Program Files\Microsoft Visual Studio\Common\Tools\WinNT;C:\Program Files\Microsoft Visual Studio\Common\MSDev98\Bin;C:\Program Files\Microsoft Visual Studio\Common\Tools;C:\Program Files\Microsoft Visual Studio\VC98\bin;C:\Pelit\PokerOffice\bin\Microsoft.VC80.ATL;C:\Pelit\PokerOffice\bin\Microsoft.VC80.CRT;C:\Pelit\PokerOffice\bin\Microsoft.VC80.MFC;.
    PATHEXT=.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH
    PROCESSOR_ARCHITECTURE=x86
    PROCESSOR_IDENTIFIER=x86 Family 15 Model 4 Stepping 1, GenuineIntel
    PROCESSOR_LEVEL=15
    PROCESSOR_REVISION=0401
    ProgramFiles=C:\Program Files
    PROMPT=$P$G
    QTJAVA=C:\Program Files\Java\jre1.5.0_06\lib\ext\QTJava.zip
    SESSIONNAME=Console
    SystemDrive=C:
    SystemRoot=C:\WINDOWS
    TEMP=C:\DOCUME~1\Lauri\LOCALS~1\Temp
    TMP=C:\DOCUME~1\Lauri\LOCALS~1\Temp
    tvdumpflags=8
    USERDOMAIN=VANR
    USERNAME=Lauri
    USERPROFILE=C:\Documents and Settings\Lauri
    windir=C:\WINDOWS


    -- User Profiles ---------------------------------------------------------------

    Lauri (admin)
    Pokeri
    vanr (new local)
    postgres
    Järjestelmänvalvoja (admin)


    -- Add/Remove Programs ---------------------------------------------------------

    --> rundll32.exe setupapi.dll,InstallHinfSection DefaultUninstall 132 C:\WINDOWS\INF\PCHealth.inf
    2.06 --> "C:\Program Files\ColorPicker v2.06\unins000.exe"
    ABIT uGuru --> RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{FF8500E6-EA0D-11D7-8755-0080C8F92A32}\Setup.exe" -l0x9
    Absolute Poker --> C:\Program Files\_uninstallation_info\Absolute Poker\CasinoUninstall.exe
    Ad-Aware SE Personal --> C:\PROGRA~1\Lavasoft\AD-AWA~1\UNWISE.EXE C:\PROGRA~1\Lavasoft\AD-AWA~1\INSTALL.LOG
    Adobe Flash Player ActiveX --> C:\WINDOWS\system32\Macromed\Flash\uninstall_activeX.exe
    Adobe Reader 7.0.9 - Suomi --> MsiExec.exe /I{AC76BA86-7AD7-1035-7B44-A70900000002}
    Advanced WindowsCare 2.30 Personal --> "C:\Program Files\IObit\Advanced WindowsCare V2\unins000.exe"
    allSnap version 1.30.6 Release --> "C:\Program Files\allSnap\unins000.exe"
    ATI - Software Uninstall Utility --> C:\Program Files\ATI Technologies\UninstallAll\AtiCimUn.exe
    ATI Catalyst Control Center --> MsiExec.exe /I{F8313341-8D53-4D84-8BEB-F82D556B21CD}
    ATI Control Panel --> RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\engine\6\INTEL3~1\ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{0BEDBD4E-2D34-47B5-9973-57E62B29307C}\setup.exe"
    ATI Display Driver --> rundll32 C:\WINDOWS\system32\atiiiexx.dll,_InfEngUnInstallINFFile_RunDLL@16 -force_restart -flags:0x2010001 -inf_class:DISPLAY -clean
    Audacity 1.2.6 --> "C:\Program Files\Audacity\unins000.exe"
    Avira AntiVir PersonalEdition Classic --> C:\Program Files\AntiVir PersonalEdition Classic\SETUP.EXE /REMOVE
    Azureus --> C:\Program Files\Azureus\Uninstall.exe
    CamStudio --> C:\Program Files\CamStudio\uninstall.exe
    Caribbean Sun Poker --> C:\WINDOWS\system32\UnPoker.exe CaribbeanSunPoker
    CCleaner (remove only) --> "C:\Program Files\CCleaner\uninst.exe"
    DC++ 0.698 --> "C:\Program Files\DC++\uninstall.exe"
    DivX --> C:\Program Files\DivX\DivXCodecUninstall.exe /CODEC
    DivX Player --> C:\Program Files\DivX\DivXPlayerUninstall.exe /PLAYER
    Elecard MPEG Player --> "C:\Program Files\Elecard\Elecard MPEG Player 4.0\Uninstall.exe" "C:\Program Files\Elecard\Elecard MPEG Player 4.0\install.log"
    EMS MySQL Data Export --> MsiExec.exe /X{828F2180-3DA2-4CE0-804F-D423B7F70D72}
    Eraser --> "C:\Program Files\Eraser\unins000.exe"
    Excel MySQL Import, Export & Convert 1.1 --> "C:\Program Files\Excel MySQL Import, Export & Convert\unins000.exe"
    ExcelMySQlConverter Demo --> "C:\Program Files\ExcelMySQlConverterDemo\unins000.exe"
    Forté Agent --> C:\PROGRA~1\Agent\UNWISE.EXE C:\PROGRA~1\Agent\INSTALL.LOG "Uninstall Forté Agent"
    FreshUI --> "C:\Program Files\FreshDevices\FreshUI\unins000.exe"
    Full Tilt Poker --> RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\11\50\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{D4C9692E-4EFA-4DA0-8B7F-9439466D9E31}\setup.exe" -l0x9 -removeonly
    Granite --> MsiExec.exe /I{470F9B02-EBB5-11D4-9957-0000E89E8230}
    GSpot Codec Information Appliance --> C:\Program Files\GSpot\Uninstall.exe
    HijackThis 2.0.2 --> "C:\Program Files\HijackThis\HijackThis.exe" /uninstall
    Hotfix-päivitys Windows XP:lle (KB914440) --> "C:\WINDOWS\$NtUninstallKB914440$\spuninst\spuninst.exe"
    IconArt --> C:\PROGRA~1\ConWare\IconArt\UNWISE.EXE C:\PROGRA~1\ConWare\IconArt\INSTALL.LOG
    Inno Setup versio 5.1.6 --> "C:\Program Files\Inno Setup 5\unins000.exe"
    InstallShield for Microsoft Visual C++ 6 --> C:\WINDOWS\IsUninst.exe -f"C:\Program Files\InstallShield\InstallShield for Microsoft Visual C++ 6\Uninst.isu"
    Intel(R) Processor ID Utility --> MsiExec.exe /X{A92A4DB0-CD37-42D1-BE1D-603D53C24328}
    iTunes --> C:\PROGRA~1\COMMON~1\INSTAL~1\Driver\11\INTEL3~1\IDriver.exe /M{59C4F14F-7590-45FC-BE9F-A67AB3590709} /l1035
    J2SE Runtime Environment 5.0 Update 6 --> MsiExec.exe /I{3248F0A8-6813-11D6-A77B-00B0D0150060}
    Java 2 Runtime Environment, SE v1.4.2_09 --> MsiExec.exe /I{7148F0A8-6813-11D6-A77B-00B0D0142090}
    Java 2 SDK, SE v1.4.2_09 --> MsiExec.exe /I{35A3A4F4-B792-11D6-A78A-00B0D0142090}
    Macromedia Shockwave Player --> C:\WINDOWS\system32\Macromed\SHOCKW~1\UNWISE.EXE C:\WINDOWS\system32\Macromed\SHOCKW~1\Install.log
    Microangelo Creation --> C:\WINDOWS\IsUninst.exe -f"C:\Program Files\Microangelo2\creation.isu"
    Microangelo Toolset 6 --> MsiExec.exe /I{71414EC2-0684-4A15-A85A-E0E259D117AF}
    Microsoft Office XP Media Content --> MsiExec.exe /I{90300409-6000-11D3-8CFE-0050048383C9}
    Microsoft Office XP Professional with FrontPage --> MsiExec.exe /I{90280409-6000-11D3-8CFE-0050048383C9}
    Microsoft Visual Studio 6.0 Enterprise Edition --> "C:\Program Files\Microsoft Visual Studio\Common\Setup\1033\Setup.exe"
    Microsoft Visual Studio Installer --> "C:\Program Files\Microsoft Visual Studio\Common\Tools\VSInst\Setup\1033\Setup.exe"
    Microsoft Web Publishing Wizard 1.53 --> RunDll32 ADVPACK.DLL,LaunchINFSection C:\WINDOWS\INF\wpie3x86.inf,WebPostUninstall
    MouseConfig (remove only) --> "C:\Program Files\MouseConfig\uninst.exe"
    Mozilla Firefox (2.0.0.5) --> C:\Program Files\Mozilla Firefox\uninstall\helper.exe
    Mozilla Firefox (2.0.0.6) --> C:\PROGRA~1\Mozilla Firefox\uninstall\helper.exe
    MSN Messenger 7.5 --> MsiExec.exe /I{9A379B72-03EC-11DA-BFBD-00065BBDC0B5}
    MyODBC --> MsiExec.exe /X{29042B1C-0713-4575-B7CA-5C8E7B0899D4}
    MySQL Server 4.1 --> MsiExec.exe /I{F16B02E4-23C0-4BE9-A706-0F1D40BFA40D}
    MySQL to Excel 2.5 Demo --> C:\PROGRA~1\INTELL~1\demos\demos\UNWISE.EXE /U C:\PROGRA~1\INTELL~1\demos\demos\sql2xls.log
    Natural Color --> RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\engine\6\INTEL3~1\ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{F51D9393-BB14-4566-99BF-D6ED63AEFCD7}\setup.exe"
    Nero - Burning Rom --> MsiExec.exe /X{A4D7B764-4140-11D4-88EB-0050DA3579C0}
    Ox Console 4.04 --> "C:\OxMetricsUus\Ox\bin\unins000.exe"
    OxEdit 4.04 --> "C:\OxMetricsUus\OxEdit\unins000.exe"
    PDF Maker --> C:\WINDOWS\st6unst.exe -n "C:\Program Files\PDFmaker\ST6UNST.LOG"
    Pdf995 --> C:\Program Files\pdf995\setup.exe uninstall
    Päivitys Windows XP:lle (KB894391) --> "C:\WINDOWS\$NtUninstallKB894391$\spuninst\spuninst.exe"
    Päivitys Windows XP:lle (KB896727) --> "C:\WINDOWS\$NtUninstallKB896727$\spuninst\spuninst.exe"
    Päivitys Windows XP:lle (KB898461) --> "C:\WINDOWS\$NtUninstallKB898461$\spuninst\spuninst.exe"
    Päivitys Windows XP:lle (KB900485) --> "C:\WINDOWS\$NtUninstallKB900485$\spuninst\spuninst.exe"
    Päivitys Windows XP:lle (KB904942) --> "C:\WINDOWS\$NtUninstallKB904942$\spuninst\spuninst.exe"
    Päivitys Windows XP:lle (KB910437) --> "C:\WINDOWS\$NtUninstallKB910437$\spuninst\spuninst.exe"
    Päivitys Windows XP:lle (KB916595) --> "C:\WINDOWS\$NtUninstallKB916595$\spuninst\spuninst.exe"
    Päivitys Windows XP:lle (KB920872) --> "C:\WINDOWS\$NtUninstallKB920872$\spuninst\spuninst.exe"
    Päivitys Windows XP:lle (KB922582) --> "C:\WINDOWS\$NtUninstallKB922582$\spuninst\spuninst.exe"
    Päivitys Windows XP:lle (KB927891) --> "C:\WINDOWS\$NtUninstallKB927891$\spuninst\spuninst.exe"
    Päivitys Windows XP:lle (KB929338) --> "C:\WINDOWS\$NtUninstallKB929338$\spuninst\spuninst.exe"
    Päivitys Windows XP:lle (KB930916) --> "C:\WINDOWS\$NtUninstallKB930916$\spuninst\spuninst.exe"
    Päivitys Windows XP:lle (KB931836) --> "C:\WINDOWS\$NtUninstallKB931836$\spuninst\spuninst.exe"
    Päivitys Windows XP:lle (KB936357) --> "C:\WINDOWS\$NtUninstallKB936357$\spuninst\spuninst.exe"
    Poker Clock 2.1 --> MsiExec.exe /X{9437C5DF-478F-4F92-9B7F-E4474F27C05A}
    Poker Evolver --> MsiExec.exe /I{ECAE40BC-D755-4336-87A3-EEFB164FEAD0}
    Poker Tracker Version 2.06.04 --> "C:\Pokeri\Poker Tracker V2\unins000.exe"
    Poker Tracker Version 2.16.00e --> "C:\Program Files\Poker Tracker V2\unins000.exe"
    PokerAce Hud (remove only) --> "C:\Program Files\PokerAce Hud\uninstall.exe"
    PokerOffice (remove only) --> "C:\Pelit\PokerOffice\uninstall.exe"
    PokerStove version 1.21 --> "C:\Program Files\PokerStove\unins000.exe"
    PostgreSQL 8.2 --> MsiExec.exe /I{1F701DBD-1660-4108-B10A-FB435EA63BF0}
    PPMate Network TV 2.3.1.54 --> C:\Program Files\PPMate\uninst.exe
    QuickTime --> C:\PROGRA~1\COMMON~1\INSTAL~1\Driver\11\INTEL3~1\IDriver.exe /M{929408E6-D265-4174-805F-81D1D914E2A4} /l1035
    R for Windows 2.4.0 --> "C:\Program Files\R\R-2.4.0\unins000.exe"
    Real Alternative 1.23 --> "C:\Program Files\Real Alternative\unins000.exe"
    Realtek AC'97 Audio --> RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\engine\6\INTEL3~1\ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{FB08F381-6533-4108-B7DD-039E11FBC27E}\setup.exe" REMOVE
    REALTEK Gigabit and Fast Ethernet NIC Driver --> RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{94FB906A-CF42-4128-A509-D353026A607E}\setup.exe" -l0xb REMOVE
    Room Arranger --> "C:\Program Files\Room Arranger\uninstall.exe"
    RS Somnífero --> "C:\Program Files\Rico Software\RS Somnífero\desinstalar.exe"
    SciViews-R version 0.8-9 --> "C:\Program Files\SciViews\unins000.exe"
    Security Task Manager 1.7 --> C:\Program Files\Security Task Manager\Uninstal.exe "C:\Documents and Settings\All Users\Käynnistä-valikko\Ohjelmat\Security Task Manager"
    Serif PhotoPlus 6.0 --> RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\0701\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{0609D0AF-1382-42BE-81DB-CF30F8B0F6E2}\Setup.exe" -l0x9
    Sid Meier's Civilization 4 --> RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\11\00\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{CFBCE791-2D53-4FCE-B3FB-D6E01F4112E8}\setup.exe" -l0x9 -removeonly
    SiSoftware Sandra Lite 2005.SR1 (Win64/32/CE) --> "C:\Program Files\SiSoftware\unins000.exe"
    SnoopFree Privacy Shield --> SnoopFreeUI.exe /U
    SopCast 1.1.2 --> C:\Program Files\SopCast\uninst.exe
    SpeechRedist --> MsiExec.exe /X{8795CBED-55E2-4693-9F14-84EC446935BE}
    Spybot - Search & Destroy 1.4 --> "C:\Program Files\Spybot - Search & Destroy\unins000.exe"
    SpywareBlaster v3.5.1 --> "C:\Program Files\SpywareBlaster\unins000.exe"
    SQLite ODBC Driver (remove only) --> C:\Program Files\SQLite ODBC Driver\Uninstall.exe
    Startup Guru --> C:\Program Files\StartupGuru\uninstal.exe
    Suojauspäivitys ohjelmistolle Windows XP (KB923689) --> "C:\WINDOWS\$NtUninstallKB923689$\spuninst\spuninst.exe"
    Suojauspäivitys Windows XP:lle (KB883939) --> "C:\WINDOWS\$NtUninstallKB883939$\spuninst\spuninst.exe"
    Suojauspäivitys Windows XP:lle (KB890046) --> "C:\WINDOWS\$NtUninstallKB890046$\spuninst\spuninst.exe"
    Suojauspäivitys Windows XP:lle (KB893756) --> "C:\WINDOWS\$NtUninstallKB893756$\spuninst\spuninst.exe"
    Suojauspäivitys Windows XP:lle (KB896358) --> "C:\WINDOWS\$NtUninstallKB896358$\spuninst\spuninst.exe"
    Suojauspäivitys Windows XP:lle (KB896422) --> "C:\WINDOWS\$NtUninstallKB896422$\spuninst\spuninst.exe"
    Suojauspäivitys Windows XP:lle (KB896423) --> "C:\WINDOWS\$NtUninstallKB896423$\spuninst\spuninst.exe"
    Suojauspäivitys Windows XP:lle (KB896424) --> "C:\WINDOWS\$NtUninstallKB896424$\spuninst\spuninst.exe"
    Suojauspäivitys Windows XP:lle (KB896428) --> "C:\WINDOWS\$NtUninstallKB896428$\spuninst\spuninst.exe"
    Suojauspäivitys Windows XP:lle (KB896688) --> "C:\WINDOWS\$NtUninstallKB896688$\spuninst\spuninst.exe"
    Suojauspäivitys Windows XP:lle (KB899587) --> "C:\WINDOWS\$NtUninstallKB899587$\spuninst\spuninst.exe"
    Suojauspäivitys Windows XP:lle (KB899588) --> "C:\WINDOWS\$NtUninstallKB899588$\spuninst\spuninst.exe"
    Suojauspäivitys Windows XP:lle (KB899591) --> "C:\WINDOWS\$NtUninstallKB899591$\spuninst\spuninst.exe"
    Suojauspäivitys Windows XP:lle (KB900725) --> "C:\WINDOWS\$NtUninstallKB900725$\spuninst\spuninst.exe"
    Suojauspäivitys Windows XP:lle (KB901017) --> "C:\WINDOWS\$NtUninstallKB901017$\spuninst\spuninst.exe"
    Suojauspäivitys Windows XP:lle (KB901214) --> "C:\WINDOWS\$NtUninstallKB901214$\spuninst\spuninst.exe"
    Suojauspäivitys Windows XP:lle (KB902400) --> "C:\WINDOWS\$NtUninstallKB902400$\spuninst\spuninst.exe"
    Suojauspäivitys Windows XP:lle (KB903235) --> "C:\WINDOWS\$NtUninstallKB903235$\spuninst\spuninst.exe"
    Suojauspäivitys Windows XP:lle (KB904706) --> "C:\WINDOWS\$NtUninstallKB904706$\spuninst\spuninst.exe"
    Suojauspäivitys Windows XP:lle (KB905414) --> "C:\WINDOWS\$NtUninstallKB905414$\spuninst\spuninst.exe"
    Suojauspäivitys Windows XP:lle (KB905749) --> "C:\WINDOWS\$NtUninstallKB905749$\spuninst\spuninst.exe"
    Suojauspäivitys Windows XP:lle (KB905915) --> "C:\WINDOWS\$NtUninstallKB905915$\spuninst\spuninst.exe"
    Suojauspäivitys Windows XP:lle (KB908519) --> "C:\WINDOWS\$NtUninstallKB908519$\spuninst\spuninst.exe"
    Suojauspäivitys Windows XP:lle (KB908531) --> "C:\WINDOWS\$NtUninstallKB908531$\spuninst\spuninst.exe"
    Suojauspäivitys Windows XP:lle (KB911280) --> "C:\WINDOWS\$NtUninstallKB911280$\spuninst\spuninst.exe"
    Suojauspäivitys Windows XP:lle (KB911562) --> "C:\WINDOWS\$NtUninstallKB911562$\spuninst\spuninst.exe"
    Suojauspäivitys Windows XP:lle (KB911567) --> "C:\WINDOWS\$NtUninstallKB911567$\spuninst\spuninst.exe"
    Suojauspäivitys Windows XP:lle (KB911927) --> "C:\WINDOWS\$NtUninstallKB911927$\spuninst\spuninst.exe"
    Suojauspäivitys Windows XP:lle (KB912812) --> "C:\WINDOWS\$NtUninstallKB912812$\spuninst\spuninst.exe"
    Suojauspäivitys Windows XP:lle (KB912919) --> "C:\WINDOWS\$NtUninstallKB912919$\spuninst\spuninst.exe"
    Suojauspäivitys Windows XP:lle (KB913446) --> "C:\WINDOWS\$NtUninstallKB913446$\spuninst\spuninst.exe"
    Suojauspäivitys Windows XP:lle (KB913580) --> "C:\WINDOWS\$NtUninstallKB913580$\spuninst\spuninst.exe"
    Suojauspäivitys Windows XP:lle (KB914388) --> "C:\WINDOWS\$NtUninstallKB914388$\spuninst\spuninst.exe"
    Suojauspäivitys Windows XP:lle (KB914389) --> "C:\WINDOWS\$NtUninstallKB914389$\spuninst\spuninst.exe"
    Suojauspäivitys Windows XP:lle (KB916281) --> "C:\WINDOWS\$NtUninstallKB916281$\spuninst\spuninst.exe"
    Suojauspäivitys Windows XP:lle (KB917159) --> "C:\WINDOWS\$NtUninstallKB917159$\spuninst\spuninst.exe"
    Suojauspäivitys Windows XP:lle (KB917344) --> "C:\WINDOWS\$NtUninstallKB917344$\spuninst\spuninst.exe"
    Suojauspäivitys Windows XP:lle (KB917422) --> "C:\WINDOWS\$NtUninstallKB917422$\spuninst\spuninst.exe"
    Suojauspäivitys Windows XP:lle (KB917953) --> "C:\WINDOWS\$NtUninstallKB917953$\spuninst\spuninst.exe"
    Suojauspäivitys Windows XP:lle (KB918118) --> "C:\WINDOWS\$NtUninstallKB918118$\spuninst\spuninst.exe"
    Suojauspäivitys Windows XP:lle (KB918439) --> "C:\WINDOWS\$NtUninstallKB918439$\spuninst\spuninst.exe"
    Suojauspäivitys Windows XP:lle (KB918899) --> "C:\WINDOWS\$NtUninstallKB918899$\spuninst\spuninst.exe"
    Suojauspäivitys Windows XP:lle (KB919007) --> "C:\WINDOWS\$NtUninstallKB919007$\spuninst\spuninst.exe"
    Suojauspäivitys Windows XP:lle (KB920213) --> "C:\WINDOWS\$NtUninstallKB920213$\spuninst\spuninst.exe"
    Suojauspäivitys Windows XP:lle (KB920214) --> "C:\WINDOWS\$NtUninstallKB920214$\spuninst\spuninst.exe"
    Suojauspäivitys Windows XP:lle (KB920670) --> "C:\WINDOWS\$NtUninstallKB920670$\spuninst\spuninst.exe"
    Suojauspäivitys Windows XP:lle (KB920683) --> "C:\WINDOWS\$NtUninstallKB920683$\spuninst\spuninst.exe"
    Suojauspäivitys Windows XP:lle (KB920685) --> "C:\WINDOWS\$NtUninstallKB920685$\spuninst\spuninst.exe"
    Suojauspäivitys Windows XP:lle (KB921398) --> "C:\WINDOWS\$NtUninstallKB921398$\spuninst\spuninst.exe"
    Suojauspäivitys Windows XP:lle (KB921883) --> "C:\WINDOWS\$NtUninstallKB921883$\spuninst\spuninst.exe"
    Suojauspäivitys Windows XP:lle (KB922616) --> "C:\WINDOWS\$NtUninstallKB922616$\spuninst\spuninst.exe"
    Suojauspäivitys Windows XP:lle (KB922760) --> "C:\WINDOWS\$NtUninstallKB922760$\spuninst\spuninst.exe"
    Suojauspäivitys Windows XP:lle (KB922819) --> "C:\WINDOWS\$NtUninstallKB922819$\spuninst\spuninst.exe"
    Suojauspäivitys Windows XP:lle (KB923191) --> "C:\WINDOWS\$NtUninstallKB923191$\spuninst\spuninst.exe"
    Suojauspäivitys Windows XP:lle (KB923414) --> "C:\WINDOWS\$NtUninstallKB923414$\spuninst\spuninst.exe"
    Suojauspäivitys Windows XP:lle (KB923694) --> "C:\WINDOWS\$NtUninstallKB923694$\spuninst\spuninst.exe"
    Suojauspäivitys Windows XP:lle (KB923980) --> "C:\WINDOWS\$NtUninstallKB923980$\spuninst\spuninst.exe"
    Suojauspäivitys Windows XP:lle (KB924191) --> "C:\WINDOWS\$NtUninstallKB924191$\spuninst\spuninst.exe"
    Suojauspäivitys Windows XP:lle (KB924270) --> "C:\WINDOWS\$NtUninstallKB924270$\spuninst\spuninst.exe"
    Suojauspäivitys Windows XP:lle (KB924496) --> "C:\WINDOWS\$NtUninstallKB924496$\spuninst\spuninst.exe"
    Suojauspäivitys Windows XP:lle (KB924667) --> "C:\WINDOWS\$NtUninstallKB924667$\spuninst\spuninst.exe"
    Suojauspäivitys Windows XP:lle (KB925486) --> "C:\WINDOWS\$NtUninstallKB925486$\spuninst\spuninst.exe"
    Suojauspäivitys Windows XP:lle (KB925902) --> "C:\WINDOWS\$NtUninstallKB925902$\spuninst\spuninst.exe"
    Suojauspäivitys Windows XP:lle (KB926255) --> "C:\WINDOWS\$NtUninstallKB926255$\spuninst\spuninst.exe"
    Suojauspäivitys Windows XP:lle (KB926436) --> "C:\WINDOWS\$NtUninstallKB926436$\spuninst\spuninst.exe"
    Suojauspäivitys Windows XP:lle (KB927779) --> "C:\WINDOWS\$NtUninstallKB927779$\spuninst\spuninst.exe"
    Suojauspäivitys Windows XP:lle (KB927802) --> "C:\WINDOWS\$NtUninstallKB927802$\spuninst\spuninst.exe"
    Suojauspäivitys Windows XP:lle (KB928255) --> "C:\WINDOWS\$NtUninstallKB928255$\spuninst\spuninst.exe"
    Suojauspäivitys Windows XP:lle (KB928843) --> "C:\WINDOWS\$NtUninstallKB928843$\spuninst\spuninst.exe"
    Suojauspäivitys Windows XP:lle (KB929123) --> "C:\WINDOWS\$NtUninstallKB929123$\spuninst\spuninst.exe"
    Suojauspäivitys Windows XP:lle (KB930178) --> "C:\WINDOWS\$NtUninstallKB930178$\spuninst\spuninst.exe"
    Suojauspäivitys Windows XP:lle (KB931261) --> "C:\WINDOWS\$NtUninstallKB931261$\spuninst\spuninst.exe"
    Suojauspäivitys Windows XP:lle (KB931784) --> "C:\WINDOWS\$NtUninstallKB931784$\spuninst\spuninst.exe"
    Suojauspäivitys Windows XP:lle (KB932168) --> "C:\WINDOWS\$NtUninstallKB932168$\spuninst\spuninst.exe"
    Suojauspäivitys Windows XP:lle (KB935839) --> "C:\WINDOWS\$NtUninstallKB935839$\spuninst\spuninst.exe"
    Suojauspäivitys Windows XP:lle (KB935840) --> "C:\WINDOWS\$NtUninstallKB935840$\spuninst\spuninst.exe"
    Topfield Windows Applications --> C:\Program Files\Topfield Windows Applications\uninst.exe
    TVAnts 1.0 --> C:\PROGRA~1\TVAnts\UNWISE.EXE C:\PROGRA~1\TVAnts\INSTALL.LOG
    Tweak Genie 6.0.0 Free Version --> C:\PROGRA~1\TWEAKG~1\UNWISE.EXE C:\PROGRA~1\TWEAKG~1\INSTALL.LOG
    Tweak UI --> "C:\WINDOWS\system32\mshta.exe" "res://C:\WINDOWS\system32\TweakUI.exe/uninstall.hta"
    UltraISO V7.62 ME --> "C:\Program Files\UltraISO\unins000.exe"
    Uniblue SpeedUpMyPC --> "C:\Program Files\Uniblue\SpeedUpMyPC\unins000.exe"
    Uninstall Startup Inspector for Windows --> "C:\Program Files\Startup Inspector for Windows\unins000.exe"
    VideoLAN VLC media player 0.8.2 --> C:\Program Files\VideoLAN\VLC\uninstall.exe
    WinRAR archiver --> C:\Program Files\WinRAR\uninstall.exe
    XoftSpySE --> C:\Program Files\XoftSpySE\uninstall.exe
    Yahoo! Messenger --> C:\PROGRA~1\Yahoo!\MESSEN~1\UNWISE.EXE /U C:\PROGRA~1\Yahoo!\MESSEN~1\INSTALL.LOG
    ZoneAlarm --> C:\Program Files\Zone Labs\ZoneAlarm\zauninst.exe


    -- Application Event Log -------------------------------------------------------

    Event ID #6893: Error
    Event Submitted/Written: 08/12/2007 07:59:06 PM
    Event Source: PerfNet
    Event Description:
    Palvelinpalvelua ei voi avata. Palvelimen resurssitietoja
    ei palauteta. Palautettu virhekoodi on ensimmäisessä DWORD-tavussa.

    Event ID #6890: Warning
    Event Submitted/Written: 08/12/2007 07:50:47 PM
    Event Source: H+BEDV AntiVir
    Event Description:
    AntiVir has detected 'HTML/Crypted.Gen'
    in the file
    C:\Documents and Settings\Lauri\Local Settings\Application Data\Mozilla\Firefox\Profiles\tet9s883.Oletuskäyttäjä\Cache\D9DBB42Fd01

    Event ID #6889: Error
    Event Submitted/Written: 08/12/2007 10:36:12 AM
    Event Source: PerfNet
    Event Description:
    Palvelinpalvelua ei voi avata. Palvelimen resurssitietoja
    ei palauteta. Palautettu virhekoodi on ensimmäisessä DWORD-tavussa.

    Event ID #6886: Error
    Event Submitted/Written: 08/11/2007 11:50:39 AM
    Event Source: PerfNet
    Event Description:
    Palvelinpalvelua ei voi avata. Palvelimen resurssitietoja
    ei palauteta. Palautettu virhekoodi on ensimmäisessä DWORD-tavussa.

    Event ID #6883: Warning
    Event Submitted/Written: 08/10/2007 06:03:07 PM
    Event Source: Userenv
    Event Description:
    Windows tallensi käyttäjän VANR\Lauri rekisterin, kun jokin sovellus tai palvelu käytti yhä rekisteriä uloskirjautumisen aikana. Käyttäjän rekisterin varaamaa muistia ei ole vapautettu. Rekisterin lataus poistetaan, kun rekisteri ei ole enää käytössä.


    Tähän on usein syynä käyttäjän tilin avulla suoritettavat palvelut. Määritä palvelut LocalService- tai NetworkService-tilin avulla suoritettaviksi.



    -- Security Event Log ----------------------------------------------------------

    No Errors/Warnings found.


    -- System Event Log ------------------------------------------------------------

    Event ID #26204: Error
    Event Submitted/Written: 08/12/2007 11:08:23 PM
    Event Source: Service Control Manager
    Event Description:
    Palvelu Sovellusten hallinta lopetettiin virheen takia. Virhe:
    %%126

    Event ID #26201: Error
    Event Submitted/Written: 08/12/2007 11:08:23 PM
    Event Source: Service Control Manager
    Event Description:
    Palvelu Sovellusten hallinta lopetettiin virheen takia. Virhe:
    %%126

    Event ID #26197: Error
    Event Submitted/Written: 08/12/2007 11:08:23 PM
    Event Source: Service Control Manager
    Event Description:
    Palvelu Sovellusten hallinta lopetettiin virheen takia. Virhe:
    %%126

    Event ID #26195: Error
    Event Submitted/Written: 08/12/2007 11:08:23 PM
    Event Source: Service Control Manager
    Event Description:
    Palvelu Sovellusten hallinta lopetettiin virheen takia. Virhe:
    %%126

    Event ID #26192: Error
    Event Submitted/Written: 08/12/2007 11:08:23 PM
    Event Source: Service Control Manager
    Event Description:
    Palvelu Sovellusten hallinta lopetettiin virheen takia. Virhe:
    %%126



    -- End of Deckard's System Scanner: finished at 2007-08-12 at 23:10:15 ---------

     
    Laur1, Aug 12, 2007
    #4
  5. Laur1

    Laur1 Member

    Joined:
    Mar 1, 2007
    Messages:
    11
    Likes Received:
    0
    Trophy Points:
    11
    Ewido ei löytänyt mitään. Aiemmin tänään löytyi Trojan-Downloader.JS.Psyme.hz

    Tässä dss:n logit.

    Deckard's System Scanner v20070809.63
    Run by Lauri on 2007-08-12 at 23:05:39
    Computer is in Normal Mode.
    --------------------------------------------------------------------------------

    -- System Restore --------------------------------------------------------------

    Successfully created a Deckard's System Scanner Restore Point.


    -- Last 5 Restore Point(s) --
    60: 2007-08-12 20:05:54 UTC - RP638 - Deckard's System Scanner Restore Point
    59: 2007-08-12 20:04:53 UTC - RP637 - Removed J2SE Runtime Environment 5.0 Update 4
    58: 2007-08-12 20:03:38 UTC - RP636 - Removed J2SE Runtime Environment 5.0 Update 2
    57: 2007-08-12 19:49:09 UTC - RP635 - Poistettu QuickTime
    56: 2007-08-12 12:37:53 UTC - RP634 - Järjestelmän tarkistuspiste


    -- First Restore Point --
    1: 2007-05-15 12:01:39 UTC - RP579 - Järjestelmän tarkistuspiste


    Backed up registry hives.
    Performed disk cleanup.



    -- HijackThis (run as Lauri.exe) -----------------------------------------------

    Logfile of Trend Micro HijackThis v2.0.2
    Scan saved at 11:07:37 PM, on 08/12/2007
    Platform: Windows XP SP2 (WinNT 5.01.2600)
    MSIE: Internet Explorer v7.00 (7.00.6000.16473)
    Boot mode: Normal

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\system32\spoolsv.exe
    C:\WINDOWS\Explorer.EXE
    C:\Program Files\AntiVir PersonalEdition Classic\avgnt.exe
    C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
    C:\Program Files\ABIT\ABIT uGuru\uGuru.exe
    C:\WINDOWS\SnoopFreeUI.exe
    C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
    C:\WINDOWS\system32\ctfmon.exe
    C:\Program Files\ABIT\ABIT uGuru\uGuru_Event_Receiver.exe
    C:\Program Files\allSnap\allSnap.exe
    C:\Pelit\PokerOffice\bin\javaw.exe
    C:\Program Files\AntiVir PersonalEdition Classic\sched.exe
    C:\Program Files\AntiVir PersonalEdition Classic\avguard.exe
    C:\WINDOWS\System32\SnoopFreeSvc.exe
    C:\WINDOWS\system32\ZoneLabs\vsmon.exe
    C:\WINDOWS\system32\taskmgr.exe
    C:\Program Files\Mozilla Firefox\firefox.exe
    C:\WINDOWS\system32\rundll32.exe
    C:\Documents and Settings\Lauri\Työpöytä\ewido_micro.exe
    C:\PROGRA~1\COMMON~1\INSTAL~1\Driver\11\INTEL3~1\IDriverT.exe
    C:\PROGRA~1\COMMON~1\INSTAL~1\Driver\11\INTEL3~1\IDriverT.exe
    C:\PROGRA~1\COMMON~1\INSTAL~1\Driver\11\INTEL3~1\IDriverT.exe
    C:\WINDOWS\system32\msiexec.exe
    C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
    C:\WINDOWS\system32\MsiExec.exe
    C:\Documents and Settings\Lauri\Työpöytä\dss.exe
    C:\PROGRA~1\HIJACK~1\Lauri.exe

    R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Linkit
    O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
    O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
    O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
    O4 - HKLM\..\Run: [POEngine] "C:\Pelit\PokerOffice\POEngine.exe" C:\Pelit\PokerOffice
    O4 - HKLM\..\Run: [Zone Labs Client] C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
    O4 - HKLM\..\Run: [avgnt] "C:\Program Files\AntiVir PersonalEdition Classic\avgnt.exe" /min
    O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
    O4 - HKLM\..\Run: [ATICCC] "C:\Program Files\ATI Technologies\ATI.ACE\cli.exe" runtime
    O4 - HKLM\..\Run: [ABIT uGuru] C:\Program Files\ABIT\ABIT uGuru\uGuru.exe
    O4 - HKLM\..\Run: [SnoopFreeUI] SnoopFreeUI.exe
    O4 - HKLM\..\Run: [ZoneAlarm Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"
    O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
    O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
    O4 - HKCU\..\Run: [Yahoo! Pager] "C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe" -quiet
    O4 - HKCU\..\RunOnce: [ypagerps] cmd.exe /C del "C:\Program Files\Yahoo!\Messenger\ypagerps.dll"
    O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Paikallinen palve')
    O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Verkkopalve')
    O4 - HKUS\S-1-5-21-1085031214-813497703-725345543-1012\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'postgres')
    O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
    O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
    O4 - Startup: allSnap.lnk = C:\Program Files\allSnap\allSnap.exe
    O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
    O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~3\Office10\EXCEL.EXE/3000
    O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\npjpi150_06.dll
    O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\npjpi150_06.dll
    O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe
    O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe
    O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
    O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
    O10 - Unknown file in Winsock LSP: c:\windows\system32\nwprovau.dll
    O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
    O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://download.bitdefender.com/resources/scan8/oscan8.cab
    O23 - Service: AntiVir PersonalEdition Classic Scheduler (AntiVirScheduler) - Avira GmbH - C:\Program Files\AntiVir PersonalEdition Classic\sched.exe
    O23 - Service: AntiVir PersonalEdition Classic Guard (AntiVirService) - Avira GmbH - C:\Program Files\AntiVir PersonalEdition Classic\avguard.exe
    O23 - Service: PostgreSQL Database Server 8.2 (pgsql-8.2) - PostgreSQL Global Development Group - C:\Program Files\PostgreSQ3L\8.2\bin\pg_ctl.exe
    O23 - Service: Snoop Free Service (SnoopFreeSvc) - Unknown owner - C:\WINDOWS\System32\SnoopFreeSvc.exe
    O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe

    --
    End of file - 5667 bytes

    -- HijackThis Fixed Entries (C:\PROGRA~1\HIJACK~1\backups\) --------------------

    backup-20070812-222427-158 R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
    backup-20070812-222427-194 R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
    backup-20070812-222427-232 R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
    backup-20070812-222427-452 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = about:blank

    -- File Associations -----------------------------------------------------------

    All associations okay.


    -- Drivers: 0-Boot, 1-System, 2-Auto, 3-Demand, 4-Disabled ---------------------

    R0 sfdrv01 (StarForce Protection Environment Driver (version 1.x)) - c:\windows\system32\drivers\sfdrv01.sys <Not Verified; Protection Technology; StarForce Protection System>
    R0 sfhlp02 (StarForce Protection Helper Driver (version 2.x)) - c:\windows\system32\drivers\sfhlp02.sys <Not Verified; Protection Technology; StarForce Protection System>
    R0 sfsync02 (StarForce Protection Synchronization Driver (version 2.x)) - c:\windows\system32\drivers\sfsync02.sys <Not Verified; Protection Technology; StarForce Protection System>
    R0 SnoopFree (SnoopFree Driver) - c:\windows\system32\drivers\snopfree.sys
    R0 uGuru - c:\windows\system32\drivers\uguru.sys <Not Verified; ABIT Computer Corporation; uGuru V2.0 device driver>
    R3 pfc (Padus ASPI Shell) - c:\windows\system32\drivers\pfc.sys <Not Verified; Padus, Inc.; Padus(R) ASPI Shell>

    S3 gtermddo - c:\docume~1\lauri\locals~1\temp\gtermddo.sys (file missing)
    S3 Memctl - c:\program files\abit\abit uguru\memctl.sys
    S3 razerusb - c:\windows\system32\drivers\razerusb.sys <Not Verified; Razer Inc.; Razer USB Mouse Driver>
    S3 TFBULK (Topfield USB client driver) - c:\windows\system32\drivers\tfbulk.sys <Not Verified; Topfield Co., Ltd.; >
    S3 WinDriver6 - c:\windows\system32\drivers\windrvr6.sys <Not Verified; Jungo; WinDriver Device Driver>
    S3 Winflash - c:\program files\abit\abit uguru\winflash.sys


    -- Services: 0-Boot, 1-System, 2-Auto, 3-Demand, 4-Disabled --------------------

    R2 AntiVirScheduler (AntiVir PersonalEdition Classic Scheduler) - c:\program files\antivir personaledition classic\sched.exe <Not Verified; Avira GmbH; Scheduler>
    R2 pgsql-8.2 (PostgreSQL Database Server 8.2) - "c:\program files\postgresq3l\8.2\bin\pg_ctl.exe" runservice -n "pgsql-8.2" -d "c:\program files\postgresq3l\8.2\data\" <Not Verified; PostgreSQL Global Development Group; PostgreSQL>
    R2 SnoopFreeSvc (Snoop Free Service) - system32\snoopfreesvc.exe


    -- Device Manager: Disabled ----------------------------------------------------

    No disabled devices found.


    -- Scheduled Tasks -------------------------------------------------------------

    2007-06-19 03:00:00 362 --a------ C:\WINDOWS\Tasks\XoftSpySE.job


    -- Files created between 2007-07-12 and 2007-08-12 -----------------------------

    2007-08-12 22:38:17 0 d-------- C:\Program Files\SpywareBlaster
    2007-08-12 22:32:30 0 d-------- C:\hosts
    2007-08-12 21:06:22 0 dr-h----- C:\Documents and Settings\Lauri\Recent
    2007-08-12 20:30:54 0 d-------- C:\Program Files\CCleaner
    2007-08-09 11:49:27 0 d-------- C:\Program Files\PokerStove
    2007-08-08 17:14:00 0 d-a------ C:\Documents and Settings\All Users\Application Data\TEMP
    2007-07-19 23:37:25 0 d-------- C:\Program Files\Poker Evolver


    -- Find3M Report ---------------------------------------------------------------

    2007-08-12 23:05:24 0 d-------- C:\Program Files\Java
    2007-08-12 22:51:00 0 d-------- C:\Program Files\QuickTime
    2007-08-12 17:13:00 0 d-------- C:\Program Files\Poker Tracker V2
    2007-07-29 19:38:56 0 d-------- C:\Program Files\PokerAce Hud
    2007-07-20 12:12:12 375602 --a------ C:\WINDOWS\system32\perfh00B.dat
    2007-07-20 12:12:12 75610 --a------ C:\WINDOWS\system32\perfc00B.dat
    2007-06-15 00:15:01 0 d-------- C:\Program Files\TVAnts
    2007-06-15 00:04:51 0 d-------- C:\Program Files\PPMate
    2007-06-15 00:04:22 0 d-------- C:\Documents and Settings\Lauri\Application Data\PPMate
    2007-06-15 00:04:20 0 d-------- C:\Program Files\Common Files
    2007-06-15 00:04:20 0 d-------- C:\Program Files\Common Files\Synacast
    2007-06-15 00:03:37 0 d-------- C:\Documents and Settings\Lauri\Application Data\SopCast


    -- Registry Dump ---------------------------------------------------------------

    *Note* empty entries & legit default entries are not shown


    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "POEngine"="C:\Pelit\PokerOffice\POEngine.exe" [07/13/2005 05:17 PM]
    "Zone Labs Client"="C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe" [03/09/2007 12:02 AM]
    "avgnt"="C:\Program Files\AntiVir PersonalEdition Classic\avgnt.exe" [04/20/2007 09:12 PM]
    "ATIPTA"="C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe" [03/22/2005 09:05 PM]
    "ATICCC"="C:\Program Files\ATI Technologies\ATI.ACE\cli.exe" [08/31/2005 12:40 AM]
    "ABIT uGuru"="C:\Program Files\ABIT\ABIT uGuru\uGuru.exe" [05/21/2004 04:07 PM]
    "SnoopFreeUI"="SnoopFreeUI.exe" [02/21/2007 01:50 PM C:\WINDOWS\SnoopFreeUI.exe]
    "ZoneAlarm Client"="C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe" [03/09/2007 12:02 AM]
    "SunJavaUpdateSched"="C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe" [11/10/2005 02:03 PM]

    [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [09/15/2004 03:00 PM]
    "Yahoo! Pager"="C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe" [07/16/2007 03:17 PM]

    [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\runonce]
    "ypagerps"=cmd.exe /C del "C:\Program Files\Yahoo!\Messenger\ypagerps.dll"

    C:\Documents and Settings\Lauri\K„ynnist„-valikko\Ohjelmat\K„ynnistys\
    allSnap.lnk - C:\Program Files\allSnap\allSnap.exe [03/20/2004 12:02:14 AM]

    C:\Documents and Settings\All Users\K„ynnist„-valikko\Ohjelmat\K„ynnistys\
    Adobe Reader Speed Launch.lnk - C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe [09/23/2005 10:05:26 PM]

    [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer]
    "LinkResolveIgnoreLinkInfo"=0 (0x0)
    "NoResolveSearch"=1 (0x1)

    [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]
    "NoTrayItemsDisplay"=00000000
    "LinkResolveIgnoreLinkInfo"=0 (0x0)

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
    "SandraTheSrv"=3 (0x3)
    "SandraDataSrv"=3 (0x3)
    "iPodService"=3 (0x3)
    "IDriverT"=3 (0x3)
    "ATI Smart"=2 (0x2)
    "Ati HotKey Poller"=2 (0x2)

    [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-]
    "InCD"=C:\Program Files\Ahead\InCD\InCD.exe
    "iTunesHelper"="C:\Program Files\iTunes\iTunesHelper.exe"
    "NeroCheck"=C:\WINDOWS\system32\NeroCheck.exe
    "QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" -atboottime
    "type32"="C:\Program Files\Microsoft IntelliType Pro\type32.exe"


    [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\F]
    AutoRun\command- F:\LaunchU3.exe -a




    -- Hosts -----------------------------------------------------------------------

    127.0.0.1 ad.a8.net
    127.0.0.1 asy.a8ww.net
    127.0.0.1 www.aaa-livedoor.net #[Trojan-PSW.Win32.Maran.ei]
    127.0.0.1 www.abcsearcher.com #[Spamdexing][Microsoft.Strider]
    127.0.0.1 abc-search.info
    127.0.0.1 abloga.info #[Spamdexing]
    127.0.0.1 www.abx4.com #[Adware.ABXToolbar]
    127.0.0.1 www.acezip.net #[Win32/Adware.180Solutions]
    127.0.0.1 phpadsnew.abac.com
    127.0.0.1 a.abnad.net

    16032 more entries in hosts file.


    -- End of Deckard's System Scanner: finished at 2007-08-12 at 23:10:15 ---------

    Deckard's System Scanner v20070809.63
    Extra logfile - please post this as an attachment with your post.
    --------------------------------------------------------------------------------

    -- System Information ----------------------------------------------------------

    Microsoft Windows XP Home Edition (build 2600) SP 2.0
    Architecture: X86; Language: Other (040B) - see http://preview.tinyurl.com/mhhp6

    CPU 0: Intel(R) Pentium(R) 4 CPU 3.00GHz
    CPU 1: Intel(R) Pentium(R) 4 CPU 3.00GHz
    Percentage of Memory in Use: 32%
    Physical Memory (total/avail): 2047.48 MiB / 1388.56 MiB
    Pagefile Memory (total/avail): 3429.91 MiB / 2808.06 MiB
    Virtual Memory (total/avail): 2047.88 MiB / 1960.73 MiB

    A: is Removable (No Media)
    C: is Fixed (NTFS) - 189.91 GiB total, 97.83 GiB free.
    D: is CDROM (UDF)
    E: is CDROM (No Media)


    -- Security Center -------------------------------------------------------------

    AUOptions is set to notify before download.
    Windows Internal Firewall is disabled.

    FirstRunDisabled is set.

    FW: ZoneAlarm Firewall v7.0.337.000 (Check Point, LTD.)
    AV: Avira AntiVir PersonalEdition Classic v0.0.0.0 (Avira GmbH) Disabled
    AV: Avira AntiVir PersonalEdition Classic v0.0.0.0 (Avira GmbH)
    AV: Avira AntiVir PersonalEdition Classic v0.0.0.0 (Avira GmbH)
    AV: Avira AntiVir PersonalEdition Classic v0.0.0.0 (Avira GmbH)
    AV: Avira AntiVir PersonalEdition Classic v0.0.0.0 (Avira GmbH)
    AV: Avira AntiVir PersonalEdition Classic v0.0.0.0 (Avira GmbH)
    AV: Avira AntiVir PersonalEdition Classic v0.0.0.0 (Avira GmbH)
    AV: Avira AntiVir PersonalEdition Classic v0.0.0.0 (Avira GmbH)
    AV: Avira AntiVir PersonalEdition Classic v0.0.0.0 (Avira GmbH) Disabled
    AV: Avira AntiVir PersonalEdition Classic v0.0.0.0 (Avira GmbH)
    AV: Avira AntiVir PersonalEdition Classic v0.0.0.0 (Avira GmbH)
    AV: Avira AntiVir PersonalEdition Classic v0.0.0.0 (Avira GmbH)
    AV: Avira AntiVir PersonalEdition Classic v0.0.0.0 (Avira GmbH)
    AV: Avira AntiVir PersonalEdition Classic v0.0.0.0 (Avira GmbH)
    AV: Avira AntiVir PersonalEdition Classic v0.0.0.0 (Avira GmbH)
    AV: Avira AntiVir PersonalEdition Classic v0.0.0.0 (Avira GmbH)
    AV: Avira AntiVir PersonalEdition Classic v0.0.0.0 (Avira GmbH)
    AV: Avira AntiVir PersonalEdition Classic v0.0.0.0 (Avira GmbH)
    AV: Avira AntiVir PersonalEdition Classic v0.0.0.0 (Avira GmbH)
    AV: Avira AntiVir PersonalEdition Classic v0.0.0.0 (Avira GmbH)
    AV: Avira AntiVir PersonalEdition Classic v0.0.0.0 (Avira GmbH) Disabled
    AV: Avira AntiVir PersonalEdition Classic v0.0.0.0 (Avira GmbH)
    AV: Avira AntiVir PersonalEdition Classic v0.0.0.0 (Avira GmbH)
    AV: Avira AntiVir PersonalEdition Classic v0.0.0.0 (Avira GmbH)
    AV: Avira AntiVir PersonalEdition Classic v0.0.0.0 (Avira GmbH)
    AV: Avira AntiVir PersonalEdition Classic v0.0.0.0 (Avira GmbH)
    AV: Avira AntiVir PersonalEdition Classic v0.0.0.0 (Avira GmbH)
    AV: Avira AntiVir PersonalEdition Classic v0.0.0.0 (Avira GmbH)
    AV: Avira AntiVir PersonalEdition Classic v0.0.0.0 (Avira GmbH) Disabled
    AV: Avira AntiVir PersonalEdition Classic v0.0.0.0 (Avira GmbH)
    AV: Avira AntiVir PersonalEdition Classic v0.0.0.0 (Avira GmbH)
    AV: Avira AntiVir PersonalEdition Classic v0.0.0.0 (Avira GmbH)
    AV: Avira AntiVir PersonalEdition Classic v0.0.0.0 (Avira GmbH)
    AV: Avira AntiVir PersonalEdition Classic v0.0.0.0 (Avira GmbH)
    AV: Avira AntiVir PersonalEdition Classic v0.0.0.0 (Avira GmbH)
    AV: Avira AntiVir PersonalEdition Classic v0.0.0.0 (Avira GmbH)
    AV: Avira AntiVir PersonalEdition Classic v0.0.0.0 (Avira GmbH)
    AV: Avira AntiVir PersonalEdition Classic v0.0.0.0 (Avira GmbH)
    AV: Avira AntiVir PersonalEdition Classic v0.0.0.0 (Avira GmbH)
    AV: Avira AntiVir PersonalEdition Classic v0.0.0.0 (Avira GmbH)
    AV: Avira AntiVir PersonalEdition Classic v0.0.0.0 (Avira GmbH)
    AV: Avira AntiVir PersonalEdition Classic v0.0.0.0 (Avira GmbH)
    AV: Avira AntiVir PersonalEdition Classic v0.0.0.0 (Avira GmbH)
    AV: Avira AntiVir PersonalEdition Classic v0.0.0.0 (Avira GmbH)
    AV: Avira AntiVir PersonalEdition Classic v0.0.0.0 (Avira GmbH)
    AV: Avira AntiVir PersonalEdition Classic v0.0.0.0 (Avira GmbH)
    AV: Avira AntiVir PersonalEdition Classic v0.0.0.0 (Avira GmbH)
    AV: Avira AntiVir PersonalEdition Classic v0.0.0.0 (Avira GmbH)
    AV: Avira AntiVir PersonalEdition Classic v0.0.0.0 (Avira GmbH)
    AV: Avira AntiVir PersonalEdition Classic v0.0.0.0 (Avira GmbH)
    AV: Avira AntiVir PersonalEdition Classic v0.0.0.0 (Avira GmbH)
    AV: Avira AntiVir PersonalEdition Classic v0.0.0.0 (Avira GmbH)
    AV: Avira AntiVir PersonalEdition Classic v0.0.0.0 (Avira GmbH)
    AV: Avira AntiVir PersonalEdition Classic v0.0.0.0 (Avira GmbH)
    AV: Avira AntiVir PersonalEdition Classic v0.0.0.0 (Avira GmbH)
    AV: Avira AntiVir PersonalEdition Classic v0.0.0.0 (Avira GmbH)
    AV: Avira AntiVir PersonalEdition Classic v0.0.0.0 (Avira GmbH)
    AV: Avira AntiVir PersonalEdition Classic v0.0.0.0 (Avira GmbH) Disabled
    AV: Avira AntiVir PersonalEdition Classic v0.0.0.0 (Avira GmbH)
    AV: Avira AntiVir PersonalEdition Classic v0.0.0.0 (Avira GmbH)
    AV: Avira AntiVir PersonalEdition Classic v0.0.0.0 (Avira GmbH)
    AV: Avira AntiVir PersonalEdition Classic v0.0.0.0 (Avira GmbH)
    AV: Avira AntiVir PersonalEdition Classic v0.0.0.0 (Avira GmbH)
    AV: Avira AntiVir PersonalEdition Classic v0.0.0.0 (Avira GmbH)
    AV: Avira AntiVir PersonalEdition Classic v0.0.0.0 (Avira GmbH) Disabled
    AV: Avira AntiVir PersonalEdition Classic v0.0.0.0 (Avira GmbH)
    AV: Avira AntiVir PersonalEdition Classic v0.0.0.0 (Avira GmbH)
    AV: Avira AntiVir PersonalEdition Classic v0.0.0.0 (Avira GmbH)
    AV: Avira AntiVir PersonalEdition Classic v0.0.0.0 (Avira GmbH)
    AV: Avira AntiVir PersonalEdition Classic v0.0.0.0 (Avira GmbH)
    AV: Avira AntiVir PersonalEdition Classic v0.0.0.0 (Avira GmbH)
    AV: Avira AntiVir PersonalEdition Classic v0.0.0.0 (Avira GmbH)
    AV: Avira AntiVir PersonalEdition Classic v 6.38.1.19
    (Avira GmbH) Disabled
    AV: Avira AntiVir PersonalEdition Classic v0.0.0.0 (Avira GmbH)
    AV: Avira AntiVir PersonalEdition Classic v0.0.0.0 (Avira GmbH) Disabled
    AV: Avira AntiVir PersonalEdition Classic v0.0.0.0 (Avira GmbH)
    AV: Avira AntiVir PersonalEdition Classic v0.0.0.0 (Avira GmbH)
    AV: Avira AntiVir PersonalEdition Classic v0.0.0.0 (Avira GmbH)
    AV: Avira AntiVir PersonalEdition Classic v0.0.0.0 (Avira GmbH)
    AV: Avira AntiVir PersonalEdition Classic v0.0.0.0 (Avira GmbH)
    AV: Avira AntiVir PersonalEdition Classic v0.0.0.0 (Avira GmbH)
    AV: Avira AntiVir PersonalEdition Classic v0.0.0.0 (Avira GmbH)
    AV: Avira AntiVir PersonalEdition Classic v0.0.0.0 (Avira GmbH)
    AV: Avira AntiVir PersonalEdition Classic v0.0.0.0 (Avira GmbH)
    AV: Avira AntiVir PersonalEdition Classic v0.0.0.0 (Avira GmbH)
    AV: Avira AntiVir PersonalEdition Classic v0.0.0.0 (Avira GmbH)
    AV: Avira AntiVir PersonalEdition Classic v0.0.0.0 (Avira GmbH)
    AV: Avira AntiVir PersonalEdition Classic v0.0.0.0 (Avira GmbH) Disabled
    AV: Avira AntiVir PersonalEdition Classic v0.0.0.0 (Avira GmbH)
    AV: Avira AntiVir PersonalEdition Classic v0.0.0.0 (Avira GmbH)
    AV: Avira AntiVir PersonalEdition Classic v0.0.0.0 (Avira GmbH)
    AV: Avira AntiVir PersonalEdition Classic v0.0.0.0 (Avira GmbH)
    AV: Avira AntiVir PersonalEdition Classic v0.0.0.0 (Avira GmbH)
    AV: Avira AntiVir PersonalEdition Classic v0.0.0.0 (Avira GmbH)
    AV: Avira AntiVir PersonalEdition Classic v0.0.0.0 (Avira GmbH)
    AV: Avira AntiVir PersonalEdition Classic v0.0.0.0 (Avira GmbH)
    AV: Avira AntiVir PersonalEdition Classic v0.0.0.0 (Avira GmbH)
    AV: Avira AntiVir PersonalEdition Classic v0.0.0.0 (Avira GmbH)
    AV: Avira AntiVir PersonalEdition Classic v0.0.0.0 (Avira GmbH)
    AV: Avira AntiVir PersonalEdition Classic v0.0.0.0 (Avira GmbH)
    AV: Avira AntiVir PersonalEdition Classic v0.0.0.0 (Avira GmbH)
    AV: Avira AntiVir PersonalEdition Classic v0.0.0.0 (Avira GmbH) Disabled
    AV: Avira AntiVir PersonalEdition Classic v0.0.0.0 (Avira GmbH)
    AV: Avira AntiVir PersonalEdition Classic v0.0.0.0 (Avira GmbH)
    AV: Avira AntiVir PersonalEdition Classic v0.0.0.0 (Avira GmbH)
    AV: Avira AntiVir PersonalEdition Classic v0.0.0.0 (Avira GmbH)
    AV: Avira AntiVir PersonalEdition Classic v0.0.0.0 (Avira GmbH)
    AV: Avira AntiVir PersonalEdition Classic v0.0.0.0 (Avira GmbH)
    AV: Avira AntiVir PersonalEdition Classic v0.0.0.0 (Avira GmbH)
    AV: Avira AntiVir PersonalEdition Classic v0.0.0.0 (Avira GmbH)
    AV: ZoneAlarm Security Suite Antivirus v7.0.337.000 (Check Point, LTD.)
    AV: Avira AntiVir PersonalEdition Classic v0.0.0.0 (Avira GmbH)
    AV: Avira AntiVir PersonalEdition Classic v0.0.0.0 (Avira GmbH)
    AV: Avira AntiVir PersonalEdition Classic v0.0.0.0 (Avira GmbH)
    AV: Avira AntiVir PersonalEdition Classic v0.0.0.0 (Avira GmbH)
    AV: Avira AntiVir PersonalEdition Classic v0.0.0.0 (Avira GmbH)
    AV: Avira AntiVir PersonalEdition Classic v0.0.0.0 (Avira GmbH)
    AV: Avira AntiVir PersonalEdition Classic v0.0.0.0 (Avira GmbH)
    AV: Avira AntiVir PersonalEdition Classic v 6.38.1.19
    (Avira GmbH)
    AV: Avira AntiVir PersonalEdition Classic v0.0.0.0 (Avira GmbH)
    AV: Avira AntiVir PersonalEdition Classic v0.0.0.0 (Avira GmbH)
    AV: Avira AntiVir PersonalEdition Classic v0.0.0.0 (Avira GmbH)
    AV: Avira AntiVir PersonalEdition Classic v0.0.0.0 (Avira GmbH) Disabled
    AV: Avira AntiVir PersonalEdition Classic v0.0.0.0 (Avira GmbH)
    AV: Avira AntiVir PersonalEdition Classic v0.0.0.0 (Avira GmbH)
    AV: Avira AntiVir PersonalEdition Classic v0.0.0.0 (Avira GmbH) Disabled
    AV: Avira AntiVir PersonalEdition Classic v0.0.0.0 (Avira GmbH)
    AV: Avira AntiVir PersonalEdition Classic v0.0.0.0 (Avira GmbH) Disabled
    AV: Avira AntiVir PersonalEdition Classic v0.0.0.0 (Avira GmbH)
    AV: Avira AntiVir PersonalEdition Classic v0.0.0.0 (Avira GmbH)
    AV: Avira AntiVir PersonalEdition Classic v0.0.0.0 (Avira GmbH)
    AV: Avira AntiVir PersonalEdition v 6.39.0.231
    (Avira GmbH)
    AV: Avira AntiVir PersonalEdition Classic v0.0.0.0 (Avira GmbH)
    AV: Avira AntiVir PersonalEdition Classic v0.0.0.0 (Avira GmbH)
    AV: Avira AntiVir PersonalEdition Classic v0.0.0.0 (Avira GmbH)
    AV: Avira AntiVir PersonalEdition Classic v0.0.0.0 (Avira GmbH)
    AV: Avira AntiVir PersonalEdition Classic v0.0.0.0 (Avira GmbH)
    AV: Avira AntiVir PersonalEdition Classic v0.0.0.0 (Avira GmbH)
    AV: Avira AntiVir PersonalEdition Classic v0.0.0.0 (Avira GmbH) Disabled
    AV: Avira AntiVir PersonalEdition Classic v0.0.0.0 (Avira GmbH)
    AV: Avira AntiVir PersonalEdition Classic v0.0.0.0 (Avira GmbH)
    AV: Avira AntiVir PersonalEdition Classic v0.0.0.0 (Avira GmbH)
    AV: Avira AntiVir PersonalEdition Classic v0.0.0.0 (Avira GmbH)
    AV: Avira AntiVir PersonalEdition Classic v0.0.0.0 (Avira GmbH)
    AV: Avira AntiVir PersonalEdition Classic v0.0.0.0 (Avira GmbH)
    AV: Avira AntiVir PersonalEdition Classic v0.0.0.0 (Avira GmbH)
    AV: Avira AntiVir PersonalEdition Classic v0.0.0.0 (Avira GmbH)
    AV: Avira AntiVir PersonalEdition Classic v0.0.0.0 (Avira GmbH)
    AV: Avira AntiVir PersonalEdition Classic v0.0.0.0 (Avira GmbH)
    AV: Avira AntiVir PersonalEdition Classic v0.0.0.0 (Avira GmbH)
    AV: Avira AntiVir PersonalEdition Classic v0.0.0.0 (Avira GmbH)
    AV: Avira AntiVir PersonalEdition Classic v0.0.0.0 (Avira GmbH)
    AV: Avira AntiVir PersonalEdition Classic v0.0.0.0 (Avira GmbH) Disabled
    AV: Avira AntiVir PersonalEdition Classic v0.0.0.0 (Avira GmbH)
    AV: Avira AntiVir PersonalEdition Classic v0.0.0.0 (Avira GmbH)
    AV: Avira AntiVir PersonalEdition Classic v0.0.0.0 (Avira GmbH)
    AV: Avira AntiVir PersonalEdition Classic v0.0.0.0 (Avira GmbH)
    AV: Avira AntiVir PersonalEdition Classic v0.0.0.0 (Avira GmbH) Disabled
    AV: Avira AntiVir PersonalEdition Classic v0.0.0.0 (Avira GmbH)
    AV: Avira AntiVir PersonalEdition Classic v0.0.0.0 (Avira GmbH)
    AV: Avira AntiVir PersonalEdition Classic v0.0.0.0 (Avira GmbH)
    AV: Avira AntiVir PersonalEdition Classic v0.0.0.0 (Avira GmbH)
    AV: Avira AntiVir PersonalEdition Classic v0.0.0.0 (Avira GmbH)
    AV: Avira AntiVir PersonalEdition Classic v0.0.0.0 (Avira GmbH)
    AV: Avira AntiVir PersonalEdition Classic v0.0.0.0 (Avira GmbH)
    AV: Avira AntiVir PersonalEdition Classic v0.0.0.0 (Avira GmbH)
    AV: Avira AntiVir PersonalEdition Classic v0.0.0.0 (Avira GmbH) Disabled
    AV: Avira AntiVir PersonalEdition Classic v0.0.0.0 (Avira GmbH)
    AV: Avira AntiVir PersonalEdition Classic v0.0.0.0 (Avira GmbH)
    AV: Avira AntiVir PersonalEdition Classic v0.0.0.0 (Avira GmbH) Disabled
    AV: Avira AntiVir PersonalEdition Classic v0.0.0.0 (Avira GmbH)
    AV: Avira AntiVir PersonalEdition Classic v0.0.0.0 (Avira GmbH)
    AV: Avira AntiVir PersonalEdition Classic v0.0.0.0 (Avira GmbH)
    AV: Avira AntiVir PersonalEdition Classic v0.0.0.0 (Avira GmbH)
    AV: Avira AntiVir PersonalEdition Classic v0.0.0.0 (Avira GmbH)
    AV: Avira AntiVir PersonalEdition Classic v0.0.0.0 (Avira GmbH)
    AV: Avira AntiVir PersonalEdition Classic v0.0.0.0 (Avira GmbH)
    AV: Avira AntiVir PersonalEdition Classic v0.0.0.0 (Avira GmbH) Disabled
    AV: Avira AntiVir PersonalEdition Classic v0.0.0.0 (Avira GmbH)
    AV: Avira AntiVir PersonalEdition Classic v0.0.0.0 (Avira GmbH)
    AV: Avira AntiVir PersonalEdition Classic v0.0.0.0 (Avira GmbH)
    AV: Avira AntiVir PersonalEdition Classic v0.0.0.0 (Avira GmbH)
    AV: Avira AntiVir PersonalEdition Classic v0.0.0.0 (Avira GmbH)
    AV: Avira AntiVir PersonalEdition Classic v0.0.0.0 (Avira GmbH)
    AV: Avira AntiVir PersonalEdition Classic v0.0.0.0 (Avira GmbH)
    AV: Avira AntiVir PersonalEdition Classic v0.0.0.0 (Avira GmbH)
    AV: Avira AntiVir PersonalEdition Classic v0.0.0.0 (Avira GmbH)
    AV: Avira AntiVir PersonalEdition Classic v0.0.0.0 (Avira GmbH)
    AV: Avira AntiVir PersonalEdition Classic v0.0.0.0 (Avira GmbH)
    AV: Avira AntiVir PersonalEdition Classic v0.0.0.0 (Avira GmbH)
    AV: Avira AntiVir PersonalEdition Classic v0.0.0.0 (Avira GmbH)
    AV: Avira AntiVir PersonalEdition Classic v0.0.0.0 (Avira GmbH)
    AV: Avira AntiVir PersonalEdition Classic v0.0.0.0 (Avira GmbH)
    AV: Avira AntiVir PersonalEdition Classic v0.0.0.0 (Avira GmbH)
    AV: Avira AntiVir PersonalEdition Classic v0.0.0.0 (Avira GmbH)
    AV: Avira AntiVir PersonalEdition Classic v0.0.0.0 (Avira GmbH)
    AV: Avira AntiVir PersonalEdition Classic v0.0.0.0 (Avira GmbH)
    AV: Avira AntiVir PersonalEdition Classic v0.0.0.0 (Avira GmbH)
    AV: Avira AntiVir PersonalEdition Classic v0.0.0.0 (Avira GmbH)
    AV: Avira AntiVir PersonalEdition Classic v0.0.0.0 (Avira GmbH)
    AV: Avira AntiVir PersonalEdition Classic v0.0.0.0 (Avira GmbH)
    AV: Avira AntiVir PersonalEdition Classic v0.0.0.0 (Avira GmbH)
    AV: Avira AntiVir PersonalEdition Classic v0.0.0.0 (Avira GmbH)
    AV: Avira AntiVir PersonalEdition Classic v0.0.0.0 (Avira GmbH) Disabled
    AV: Avira AntiVir PersonalEdition Classic v0.0.0.0 (Avira GmbH)
    AV: Avira AntiVir PersonalEdition Classic v0.0.0.0 (Avira GmbH)
    AV: Avira AntiVir PersonalEdition Classic v0.0.0.0 (Avira GmbH)
    AV: Avira AntiVir PersonalEdition Classic v0.0.0.0 (Avira GmbH)
    AV: Avira AntiVir PersonalEdition Classic v0.0.0.0 (Avira GmbH) Disabled
    AV: Avira AntiVir PersonalEdition Classic v0.0.0.0 (Avira GmbH) Disabled
    AV: Avira AntiVir PersonalEdition Classic v0.0.0.0 (Avira GmbH)
    AV: Avira AntiVir PersonalEdition Classic v0.0.0.0 (Avira GmbH)
    AV: Avira AntiVir PersonalEdition Classic v0.0.0.0 (Avira GmbH)
    AV: Avira AntiVir PersonalEdition Classic v0.0.0.0 (Avira GmbH)
    AV: Avira AntiVir PersonalEdition Classic v0.0.0.0 (Avira GmbH)
    AV: Avira AntiVir PersonalEdition Classic v0.0.0.0 (Avira GmbH)
    AV: Avira AntiVir PersonalEdition Classic v0.0.0.0 (Avira GmbH)
    AV: Avira AntiVir PersonalEdition Classic v0.0.0.0 (Avira GmbH)
    AV: Avira AntiVir PersonalEdition Classic v0.0.0.0 (Avira GmbH)
    AV: Avira AntiVir PersonalEdition Classic v0.0.0.0 (Avira GmbH)
    AV: Avira AntiVir PersonalEdition Classic v0.0.0.0 (Avira GmbH)
    AV: Avira AntiVir PersonalEdition Classic v0.0.0.0 (Avira GmbH)

    [HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List]
    "%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:mad:xpsp2res.dll,-22019"
    "C:\\Program Files\\MSN Messenger\\msnmsgr.exe"="C:\\Program Files\\MSN Messenger\\msnmsgr.exe:*:Enabled:MSN Messenger 7.5"
    "%windir%\\Network Diagnostic\\xpnetdiag.exe"="%windir%\\Network Diagnostic\\xpnetdiag.exe:*:Enabled:mad:xpsp3res.dll,-20000"

    [HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]
    "C:\\Program Files\\Ares\\Ares.exe"="C:\\Program Files\\Ares\\Ares.exe:*:Enabled:Ares"
    "C:\\mysql\\bin\\mysqld.exe"="C:\\mysql\\bin\\mysqld.exe:*:Enabled:mysqld"
    "C:\\Pokeri\\PokerOffice\\bin\\javaw.exe"="C:\\Pokeri\\PokerOffice\\bin\\javaw.exe:*:Enabled:Java(TM) 2 Platform Standard Edition binary"
    "C:\\Program Files\\PokerOffice\\bin\\javaw.exe"="C:\\Program Files\\PokerOffice\\bin\\javaw.exe:*:Enabled:Java(TM) 2 Platform Standard Edition binary"
    "C:\\Pokeri\\PO\\bin\\javaw.exe"="C:\\Pokeri\\PO\\bin\\javaw.exe:*:Enabled:Java(TM) 2 Platform Standard Edition binary"
    "C:\\Program Files\\Java\\jre1.5.0_02\\bin\\javaw.exe"="C:\\Program Files\\Java\\jre1.5.0_02\\bin\\javaw.exe:*:Enabled:Java(TM) 2 Platform Standard Edition binary"
    "C:\\Program Files\\Java\\jre1.5.0_04\\bin\\javaw.exe"="C:\\Program Files\\Java\\jre1.5.0_04\\bin\\javaw.exe:*:Enabled:Java(TM) 2 Platform Standard Edition binary"
    "C:\\Program Files\\InterPoker\\UA.exe"="C:\\Program Files\\InterPoker\\UA.exe:*:Enabled:UA Application"
    "C:\\pelit\\Quake 4\\Quake4.exe"="C:\\pelit\\Quake 4\\Quake4.exe:*:Enabled:Quake 4"
    "C:\\Program Files\\DC++\\DCPlusPlus.exe"="C:\\Program Files\\DC++\\DCPlusPlus.exe:*:Disabled:DC++"
    "C:\\Program Files\\eDonkey2000\\edonkey2000.exe"="C:\\Program Files\\eDonkey2000\\edonkey2000.exe:*:Disabled:edonkey2000"
    "C:\\Program Files\\Clustone\\clustone.exe"="C:\\Program Files\\Clustone\\clustone.exe:*:Disabled:NeoClustone"
    "C:\\Program Files\\QuickTime\\QuickTimePlayer.exe"="C:\\Program Files\\QuickTime\\QuickTimePlayer.exe:*:Disabled:QuickTime Player"
    "C:\\Program Files\\Shareaza\\Shareaza.exe"="C:\\Program Files\\Shareaza\\Shareaza.exe:*:Disabled:Shareaza Ultimate File Sharing"
    "C:\\pelit\\civ4\\Civilization4.exe"="C:\\pelit\\civ4\\Civilization4.exe:*:Enabled:Sid Meier's Civilization 4"
    "C:\\WINDOWS\\system32\\sessmgr.exe"="C:\\WINDOWS\\system32\\sessmgr.exe:*:Disabled:mad:xpsp2res.dll,-22019"
    "C:\\Program Files\\GameSpy Arcade\\Aphex.exe"="C:\\Program Files\\GameSpy Arcade\\Aphex.exe:*:Disabled:GameSpy Arcade"
    "C:\\Program Files\\HLSW\\hlsw.exe"="C:\\Program Files\\HLSW\\hlsw.exe:*:Disabled:HLSW"
    "C:\\pelit\\REDALERT\\ww\\register.dat"="C:\\pelit\\REDALERT\\ww\\register.dat:*:Disabled:register"
    "C:\\Program Files\\The All-Seeing Eye\\eye.exe"="C:\\Program Files\\The All-Seeing Eye\\eye.exe:*:Disabled:Yahoo! All-Seeing Eye"
    "C:\\Program Files\\Mozilla Firefox\\firefox.exe"="C:\\Program Files\\Mozilla Firefox\\firefox.exe:*:Enabled:Firefox"
    "C:\\Program Files\\Java\\jre1.5.0_06\\bin\\javaw.exe"="C:\\Program Files\\Java\\jre1.5.0_06\\bin\\javaw.exe:*:Enabled:Java(TM) 2 Platform Standard Edition binary"
    "C:\\Program Files\\Microsoft Visual Studio\\Common\\Tools\\VS-Ent98\\Vanalyzr\\VARPC.EXE"="C:\\Program Files\\Microsoft Visual Studio\\Common\\Tools\\VS-Ent98\\Vanalyzr\\VARPC.EXE:*:Enabled:Microsoft (R) Visual Studio VSA RPC Event Creator"
    "C:\\pelit\\PokerOffice\\bin\\javaw.exe"="C:\\pelit\\PokerOffice\\bin\\javaw.exe:*:Enabled:Java(TM) 2 Platform Standard Edition binary"
    "C:\\Program Files\\Messenger\\msmsgs.exe"="C:\\Program Files\\Messenger\\msmsgs.exe:*:Enabled:Windows Messenger"
    "C:\\Program Files\\MSN Messenger\\msnmsgr.exe"="C:\\Program Files\\MSN Messenger\\msnmsgr.exe:*:Enabled:MSN Messenger 7.5"
    "C:\\Program Files\\iTunes\\iTunes.exe"="C:\\Program Files\\iTunes\\iTunes.exe:*:Enabled:iTunes"
    "%windir%\\Network Diagnostic\\xpnetdiag.exe"="%windir%\\Network Diagnostic\\xpnetdiag.exe:*:Enabled:mad:xpsp3res.dll,-20000"
    "C:\\Program Files\\Yahoo!\\Messenger\\YahooMessenger.exe"="C:\\Program Files\\Yahoo!\\Messenger\\YahooMessenger.exe:*:Enabled:Yahoo! Messenger"
    "C:\\Program Files\\Yahoo!\\Messenger\\YServer.exe"="C:\\Program Files\\Yahoo!\\Messenger\\YServer.exe:*:Enabled:Yahoo! FT Server"
    "C:\\Program Files\\PPMate\\ppmate.exe"="C:\\Program Files\\PPMate\\ppmate.exe:*:Enabled:pPMate"
    "C:\\Program Files\\PPMate\\ppmnet.exe"="C:\\Program Files\\PPMate\\ppmnet.exe:*:Enabled:pPMate"


    -- Environment Variables -------------------------------------------------------

    ALLUSERSPROFILE=C:\Documents and Settings\All Users
    APPDATA=C:\Documents and Settings\Lauri\Application Data
    CLASSPATH=C:\Program Files\Java\jre1.5.0_06\lib\ext\QTJava.zip
    CLIENTNAME=Console
    CommonProgramFiles=C:\Program Files\Common Files
    COMPUTERNAME=VANR
    ComSpec=C:\WINDOWS\system32\cmd.exe
    FP_NO_HOST_CHECK=NO
    HOMEDRIVE=C:
    HOMEPATH=\Documents and Settings\Lauri
    include=C:\Program Files\Microsoft Visual Studio\VC98\atl\include;C:\Program Files\Microsoft Visual Studio\VC98\mfc\include;C:\Program Files\Microsoft Visual Studio\VC98\include
    lib=C:\Program Files\Microsoft Visual Studio\VC98\mfc\lib;C:\Program Files\Microsoft Visual Studio\VC98\lib
    LOGONSERVER=\\VANR
    MSDevDir=C:\Program Files\Microsoft Visual Studio\Common\MSDev98
    NUMBER_OF_PROCESSORS=2
    OS=Windows_NT
    Path=C:\PROGRA~1\Java\JRE15~3.0_0\bin;C:\Program Files\Mozilla Firefox;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\Program Files\ATI Technologies\ATI Control Panel;C:\Program Files\ATI Technologies\ATI.ACE\;C:\Program Files\QuickTime\QTSystem\;C:\WINDOWS\system32\gs\gs7.05\bin;"C:\Program Files\Zone Labs\ZoneAlarm\MailFrontier";C:\Program Files\Microsoft Visual Studio\Common\Tools\WinNT;C:\Program Files\Microsoft Visual Studio\Common\MSDev98\Bin;C:\Program Files\Microsoft Visual Studio\Common\Tools;C:\Program Files\Microsoft Visual Studio\VC98\bin;C:\Pelit\PokerOffice\bin\Microsoft.VC80.ATL;C:\Pelit\PokerOffice\bin\Microsoft.VC80.CRT;C:\Pelit\PokerOffice\bin\Microsoft.VC80.MFC;.
    PATHEXT=.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH
    PROCESSOR_ARCHITECTURE=x86
    PROCESSOR_IDENTIFIER=x86 Family 15 Model 4 Stepping 1, GenuineIntel
    PROCESSOR_LEVEL=15
    PROCESSOR_REVISION=0401
    ProgramFiles=C:\Program Files
    PROMPT=$P$G
    QTJAVA=C:\Program Files\Java\jre1.5.0_06\lib\ext\QTJava.zip
    SESSIONNAME=Console
    SystemDrive=C:
    SystemRoot=C:\WINDOWS
    TEMP=C:\DOCUME~1\Lauri\LOCALS~1\Temp
    TMP=C:\DOCUME~1\Lauri\LOCALS~1\Temp
    tvdumpflags=8
    USERDOMAIN=VANR
    USERNAME=Lauri
    USERPROFILE=C:\Documents and Settings\Lauri
    windir=C:\WINDOWS


    -- User Profiles ---------------------------------------------------------------

    Lauri (admin)
    Pokeri
    vanr (new local)
    postgres
    Järjestelmänvalvoja (admin)


    -- Add/Remove Programs ---------------------------------------------------------

    --> rundll32.exe setupapi.dll,InstallHinfSection DefaultUninstall 132 C:\WINDOWS\INF\PCHealth.inf
    2.06 --> "C:\Program Files\ColorPicker v2.06\unins000.exe"
    ABIT uGuru --> RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{FF8500E6-EA0D-11D7-8755-0080C8F92A32}\Setup.exe" -l0x9
    Absolute Poker --> C:\Program Files\_uninstallation_info\Absolute Poker\CasinoUninstall.exe
    Ad-Aware SE Personal --> C:\PROGRA~1\Lavasoft\AD-AWA~1\UNWISE.EXE C:\PROGRA~1\Lavasoft\AD-AWA~1\INSTALL.LOG
    Adobe Flash Player ActiveX --> C:\WINDOWS\system32\Macromed\Flash\uninstall_activeX.exe
    Adobe Reader 7.0.9 - Suomi --> MsiExec.exe /I{AC76BA86-7AD7-1035-7B44-A70900000002}
    Advanced WindowsCare 2.30 Personal --> "C:\Program Files\IObit\Advanced WindowsCare V2\unins000.exe"
    allSnap version 1.30.6 Release --> "C:\Program Files\allSnap\unins000.exe"
    ATI - Software Uninstall Utility --> C:\Program Files\ATI Technologies\UninstallAll\AtiCimUn.exe
    ATI Catalyst Control Center --> MsiExec.exe /I{F8313341-8D53-4D84-8BEB-F82D556B21CD}
    ATI Control Panel --> RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\engine\6\INTEL3~1\ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{0BEDBD4E-2D34-47B5-9973-57E62B29307C}\setup.exe"
    ATI Display Driver --> rundll32 C:\WINDOWS\system32\atiiiexx.dll,_InfEngUnInstallINFFile_RunDLL@16 -force_restart -flags:0x2010001 -inf_class:DISPLAY -clean
    Audacity 1.2.6 --> "C:\Program Files\Audacity\unins000.exe"
    Avira AntiVir PersonalEdition Classic --> C:\Program Files\AntiVir PersonalEdition Classic\SETUP.EXE /REMOVE
    Azureus --> C:\Program Files\Azureus\Uninstall.exe
    CamStudio --> C:\Program Files\CamStudio\uninstall.exe
    Caribbean Sun Poker --> C:\WINDOWS\system32\UnPoker.exe CaribbeanSunPoker
    CCleaner (remove only) --> "C:\Program Files\CCleaner\uninst.exe"
    DC++ 0.698 --> "C:\Program Files\DC++\uninstall.exe"
    DivX --> C:\Program Files\DivX\DivXCodecUninstall.exe /CODEC
    DivX Player --> C:\Program Files\DivX\DivXPlayerUninstall.exe /PLAYER
    Elecard MPEG Player --> "C:\Program Files\Elecard\Elecard MPEG Player 4.0\Uninstall.exe" "C:\Program Files\Elecard\Elecard MPEG Player 4.0\install.log"
    EMS MySQL Data Export --> MsiExec.exe /X{828F2180-3DA2-4CE0-804F-D423B7F70D72}
    Eraser --> "C:\Program Files\Eraser\unins000.exe"
    Excel MySQL Import, Export & Convert 1.1 --> "C:\Program Files\Excel MySQL Import, Export & Convert\unins000.exe"
    ExcelMySQlConverter Demo --> "C:\Program Files\ExcelMySQlConverterDemo\unins000.exe"
    Forté Agent --> C:\PROGRA~1\Agent\UNWISE.EXE C:\PROGRA~1\Agent\INSTALL.LOG "Uninstall Forté Agent"
    FreshUI --> "C:\Program Files\FreshDevices\FreshUI\unins000.exe"
    Full Tilt Poker --> RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\11\50\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{D4C9692E-4EFA-4DA0-8B7F-9439466D9E31}\setup.exe" -l0x9 -removeonly
    Granite --> MsiExec.exe /I{470F9B02-EBB5-11D4-9957-0000E89E8230}
    GSpot Codec Information Appliance --> C:\Program Files\GSpot\Uninstall.exe
    HijackThis 2.0.2 --> "C:\Program Files\HijackThis\HijackThis.exe" /uninstall
    Hotfix-päivitys Windows XP:lle (KB914440) --> "C:\WINDOWS\$NtUninstallKB914440$\spuninst\spuninst.exe"
    IconArt --> C:\PROGRA~1\ConWare\IconArt\UNWISE.EXE C:\PROGRA~1\ConWare\IconArt\INSTALL.LOG
    Inno Setup versio 5.1.6 --> "C:\Program Files\Inno Setup 5\unins000.exe"
    InstallShield for Microsoft Visual C++ 6 --> C:\WINDOWS\IsUninst.exe -f"C:\Program Files\InstallShield\InstallShield for Microsoft Visual C++ 6\Uninst.isu"
    Intel(R) Processor ID Utility --> MsiExec.exe /X{A92A4DB0-CD37-42D1-BE1D-603D53C24328}
    iTunes --> C:\PROGRA~1\COMMON~1\INSTAL~1\Driver\11\INTEL3~1\IDriver.exe /M{59C4F14F-7590-45FC-BE9F-A67AB3590709} /l1035
    J2SE Runtime Environment 5.0 Update 6 --> MsiExec.exe /I{3248F0A8-6813-11D6-A77B-00B0D0150060}
    Java 2 Runtime Environment, SE v1.4.2_09 --> MsiExec.exe /I{7148F0A8-6813-11D6-A77B-00B0D0142090}
    Java 2 SDK, SE v1.4.2_09 --> MsiExec.exe /I{35A3A4F4-B792-11D6-A78A-00B0D0142090}
    Macromedia Shockwave Player --> C:\WINDOWS\system32\Macromed\SHOCKW~1\UNWISE.EXE C:\WINDOWS\system32\Macromed\SHOCKW~1\Install.log
    Microangelo Creation --> C:\WINDOWS\IsUninst.exe -f"C:\Program Files\Microangelo2\creation.isu"
    Microangelo Toolset 6 --> MsiExec.exe /I{71414EC2-0684-4A15-A85A-E0E259D117AF}
    Microsoft Office XP Media Content --> MsiExec.exe /I{90300409-6000-11D3-8CFE-0050048383C9}
    Microsoft Office XP Professional with FrontPage --> MsiExec.exe /I{90280409-6000-11D3-8CFE-0050048383C9}
    Microsoft Visual Studio 6.0 Enterprise Edition --> "C:\Program Files\Microsoft Visual Studio\Common\Setup\1033\Setup.exe"
    Microsoft Visual Studio Installer --> "C:\Program Files\Microsoft Visual Studio\Common\Tools\VSInst\Setup\1033\Setup.exe"
    Microsoft Web Publishing Wizard 1.53 --> RunDll32 ADVPACK.DLL,LaunchINFSection C:\WINDOWS\INF\wpie3x86.inf,WebPostUninstall
    MouseConfig (remove only) --> "C:\Program Files\MouseConfig\uninst.exe"
    Mozilla Firefox (2.0.0.5) --> C:\Program Files\Mozilla Firefox\uninstall\helper.exe
    Mozilla Firefox (2.0.0.6) --> C:\PROGRA~1\Mozilla Firefox\uninstall\helper.exe
    MSN Messenger 7.5 --> MsiExec.exe /I{9A379B72-03EC-11DA-BFBD-00065BBDC0B5}
    MyODBC --> MsiExec.exe /X{29042B1C-0713-4575-B7CA-5C8E7B0899D4}
    MySQL Server 4.1 --> MsiExec.exe /I{F16B02E4-23C0-4BE9-A706-0F1D40BFA40D}
    MySQL to Excel 2.5 Demo --> C:\PROGRA~1\INTELL~1\demos\demos\UNWISE.EXE /U C:\PROGRA~1\INTELL~1\demos\demos\sql2xls.log
    Natural Color --> RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\engine\6\INTEL3~1\ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{F51D9393-BB14-4566-99BF-D6ED63AEFCD7}\setup.exe"
    Nero - Burning Rom --> MsiExec.exe /X{A4D7B764-4140-11D4-88EB-0050DA3579C0}
    Ox Console 4.04 --> "C:\OxMetricsUus\Ox\bin\unins000.exe"
    OxEdit 4.04 --> "C:\OxMetricsUus\OxEdit\unins000.exe"
    PDF Maker --> C:\WINDOWS\st6unst.exe -n "C:\Program Files\PDFmaker\ST6UNST.LOG"
    Pdf995 --> C:\Program Files\pdf995\setup.exe uninstall
    Päivitys Windows XP:lle (KB894391) --> "C:\WINDOWS\$NtUninstallKB894391$\spuninst\spuninst.exe"
    Päivitys Windows XP:lle (KB896727) --> "C:\WINDOWS\$NtUninstallKB896727$\spuninst\spuninst.exe"
    Päivitys Windows XP:lle (KB898461) --> "C:\WINDOWS\$NtUninstallKB898461$\spuninst\spuninst.exe"
    Päivitys Windows XP:lle (KB900485) --> "C:\WINDOWS\$NtUninstallKB900485$\spuninst\spuninst.exe"
    Päivitys Windows XP:lle (KB904942) --> "C:\WINDOWS\$NtUninstallKB904942$\spuninst\spuninst.exe"
    Päivitys Windows XP:lle (KB910437) --> "C:\WINDOWS\$NtUninstallKB910437$\spuninst\spuninst.exe"
    Päivitys Windows XP:lle (KB916595) --> "C:\WINDOWS\$NtUninstallKB916595$\spuninst\spuninst.exe"
    Päivitys Windows XP:lle (KB920872) --> "C:\WINDOWS\$NtUninstallKB920872$\spuninst\spuninst.exe"
    Päivitys Windows XP:lle (KB922582) --> "C:\WINDOWS\$NtUninstallKB922582$\spuninst\spuninst.exe"
    Päivitys Windows XP:lle (KB927891) --> "C:\WINDOWS\$NtUninstallKB927891$\spuninst\spuninst.exe"
    Päivitys Windows XP:lle (KB929338) --> "C:\WINDOWS\$NtUninstallKB929338$\spuninst\spuninst.exe"
    Päivitys Windows XP:lle (KB930916) --> "C:\WINDOWS\$NtUninstallKB930916$\spuninst\spuninst.exe"
    Päivitys Windows XP:lle (KB931836) --> "C:\WINDOWS\$NtUninstallKB931836$\spuninst\spuninst.exe"
    Päivitys Windows XP:lle (KB936357) --> "C:\WINDOWS\$NtUninstallKB936357$\spuninst\spuninst.exe"
    Poker Clock 2.1 --> MsiExec.exe /X{9437C5DF-478F-4F92-9B7F-E4474F27C05A}
    Poker Evolver --> MsiExec.exe /I{ECAE40BC-D755-4336-87A3-EEFB164FEAD0}
    Poker Tracker Version 2.06.04 --> "C:\Pokeri\Poker Tracker V2\unins000.exe"
    Poker Tracker Version 2.16.00e --> "C:\Program Files\Poker Tracker V2\unins000.exe"
    PokerAce Hud (remove only) --> "C:\Program Files\PokerAce Hud\uninstall.exe"
    PokerOffice (remove only) --> "C:\Pelit\PokerOffice\uninstall.exe"
    PokerStove version 1.21 --> "C:\Program Files\PokerStove\unins000.exe"
    PostgreSQL 8.2 --> MsiExec.exe /I{1F701DBD-1660-4108-B10A-FB435EA63BF0}
    PPMate Network TV 2.3.1.54 --> C:\Program Files\PPMate\uninst.exe
    QuickTime --> C:\PROGRA~1\COMMON~1\INSTAL~1\Driver\11\INTEL3~1\IDriver.exe /M{929408E6-D265-4174-805F-81D1D914E2A4} /l1035
    R for Windows 2.4.0 --> "C:\Program Files\R\R-2.4.0\unins000.exe"
    Real Alternative 1.23 --> "C:\Program Files\Real Alternative\unins000.exe"
    Realtek AC'97 Audio --> RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\engine\6\INTEL3~1\ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{FB08F381-6533-4108-B7DD-039E11FBC27E}\setup.exe" REMOVE
    REALTEK Gigabit and Fast Ethernet NIC Driver --> RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{94FB906A-CF42-4128-A509-D353026A607E}\setup.exe" -l0xb REMOVE
    Room Arranger --> "C:\Program Files\Room Arranger\uninstall.exe"
    RS Somnífero --> "C:\Program Files\Rico Software\RS Somnífero\desinstalar.exe"
    SciViews-R version 0.8-9 --> "C:\Program Files\SciViews\unins000.exe"
    Security Task Manager 1.7 --> C:\Program Files\Security Task Manager\Uninstal.exe "C:\Documents and Settings\All Users\Käynnistä-valikko\Ohjelmat\Security Task Manager"
    Serif PhotoPlus 6.0 --> RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\0701\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{0609D0AF-1382-42BE-81DB-CF30F8B0F6E2}\Setup.exe" -l0x9
    Sid Meier's Civilization 4 --> RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\11\00\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{CFBCE791-2D53-4FCE-B3FB-D6E01F4112E8}\setup.exe" -l0x9 -removeonly
    SiSoftware Sandra Lite 2005.SR1 (Win64/32/CE) --> "C:\Program Files\SiSoftware\unins000.exe"
    SnoopFree Privacy Shield --> SnoopFreeUI.exe /U
    SopCast 1.1.2 --> C:\Program Files\SopCast\uninst.exe
    SpeechRedist --> MsiExec.exe /X{8795CBED-55E2-4693-9F14-84EC446935BE}
    Spybot - Search & Destroy 1.4 --> "C:\Program Files\Spybot - Search & Destroy\unins000.exe"
    SpywareBlaster v3.5.1 --> "C:\Program Files\SpywareBlaster\unins000.exe"
    SQLite ODBC Driver (remove only) --> C:\Program Files\SQLite ODBC Driver\Uninstall.exe
    Startup Guru --> C:\Program Files\StartupGuru\uninstal.exe
    Suojauspäivitys ohjelmistolle Windows XP (KB923689) --> "C:\WINDOWS\$NtUninstallKB923689$\spuninst\spuninst.exe"
    Suojauspäivitys Windows XP:lle (KB883939) --> "C:\WINDOWS\$NtUninstallKB883939$\spuninst\spuninst.exe"
    Suojauspäivitys Windows XP:lle (KB890046) --> "C:\WINDOWS\$NtUninstallKB890046$\spuninst\spuninst.exe"
    Suojauspäivitys Windows XP:lle (KB893756) --> "C:\WINDOWS\$NtUninstallKB893756$\spuninst\spuninst.exe"
    Suojauspäivitys Windows XP:lle (KB896358) --> "C:\WINDOWS\$NtUninstallKB896358$\spuninst\spuninst.exe"
    Suojauspäivitys Windows XP:lle (KB896422) --> "C:\WINDOWS\$NtUninstallKB896422$\spuninst\spuninst.exe"
    Suojauspäivitys Windows XP:lle (KB896423) --> "C:\WINDOWS\$NtUninstallKB896423$\spuninst\spuninst.exe"
    Suojauspäivitys Windows XP:lle (KB896424) --> "C:\WINDOWS\$NtUninstallKB896424$\spuninst\spuninst.exe"
    Suojauspäivitys Windows XP:lle (KB896428) --> "C:\WINDOWS\$NtUninstallKB896428$\spuninst\spuninst.exe"
    Suojauspäivitys Windows XP:lle (KB896688) --> "C:\WINDOWS\$NtUninstallKB896688$\spuninst\spuninst.exe"
    Suojauspäivitys Windows XP:lle (KB899587) --> "C:\WINDOWS\$NtUninstallKB899587$\spuninst\spuninst.exe"
    Suojauspäivitys Windows XP:lle (KB899588) --> "C:\WINDOWS\$NtUninstallKB899588$\spuninst\spuninst.exe"
    Suojauspäivitys Windows XP:lle (KB899591) --> "C:\WINDOWS\$NtUninstallKB899591$\spuninst\spuninst.exe"
    Suojauspäivitys Windows XP:lle (KB900725) --> "C:\WINDOWS\$NtUninstallKB900725$\spuninst\spuninst.exe"
    Suojauspäivitys Windows XP:lle (KB901017) --> "C:\WINDOWS\$NtUninstallKB901017$\spuninst\spuninst.exe"
    Suojauspäivitys Windows XP:lle (KB901214) --> "C:\WINDOWS\$NtUninstallKB901214$\spuninst\spuninst.exe"
    Suojauspäivitys Windows XP:lle (KB902400) --> "C:\WINDOWS\$NtUninstallKB902400$\spuninst\spuninst.exe"
    Suojauspäivitys Windows XP:lle (KB903235) --> "C:\WINDOWS\$NtUninstallKB903235$\spuninst\spuninst.exe"
    Suojauspäivitys Windows XP:lle (KB904706) --> "C:\WINDOWS\$NtUninstallKB904706$\spuninst\spuninst.exe"
    Suojauspäivitys Windows XP:lle (KB905414) --> "C:\WINDOWS\$NtUninstallKB905414$\spuninst\spuninst.exe"
    Suojauspäivitys Windows XP:lle (KB905749) --> "C:\WINDOWS\$NtUninstallKB905749$\spuninst\spuninst.exe"
    Suojauspäivitys Windows XP:lle (KB905915) --> "C:\WINDOWS\$NtUninstallKB905915$\spuninst\spuninst.exe"
    Suojauspäivitys Windows XP:lle (KB908519) --> "C:\WINDOWS\$NtUninstallKB908519$\spuninst\spuninst.exe"
    Suojauspäivitys Windows XP:lle (KB908531) --> "C:\WINDOWS\$NtUninstallKB908531$\spuninst\spuninst.exe"
    Suojauspäivitys Windows XP:lle (KB911280) --> "C:\WINDOWS\$NtUninstallKB911280$\spuninst\spuninst.exe"
    Suojauspäivitys Windows XP:lle (KB911562) --> "C:\WINDOWS\$NtUninstallKB911562$\spuninst\spuninst.exe"
    Suojauspäivitys Windows XP:lle (KB911567) --> "C:\WINDOWS\$NtUninstallKB911567$\spuninst\spuninst.exe"
    Suojauspäivitys Windows XP:lle (KB911927) --> "C:\WINDOWS\$NtUninstallKB911927$\spuninst\spuninst.exe"
    Suojauspäivitys Windows XP:lle (KB912812) --> "C:\WINDOWS\$NtUninstallKB912812$\spuninst\spuninst.exe"
    Suojauspäivitys Windows XP:lle (KB912919) --> "C:\WINDOWS\$NtUninstallKB912919$\spuninst\spuninst.exe"
    Suojauspäivitys Windows XP:lle (KB913446) --> "C:\WINDOWS\$NtUninstallKB913446$\spuninst\spuninst.exe"
    Suojauspäivitys Windows XP:lle (KB913580) --> "C:\WINDOWS\$NtUninstallKB913580$\spuninst\spuninst.exe"
    Suojauspäivitys Windows XP:lle (KB914388) --> "C:\WINDOWS\$NtUninstallKB914388$\spuninst\spuninst.exe"
    Suojauspäivitys Windows XP:lle (KB914389) --> "C:\WINDOWS\$NtUninstallKB914389$\spuninst\spuninst.exe"
    Suojauspäivitys Windows XP:lle (KB916281) --> "C:\WINDOWS\$NtUninstallKB916281$\spuninst\spuninst.exe"
    Suojauspäivitys Windows XP:lle (KB917159) --> "C:\WINDOWS\$NtUninstallKB917159$\spuninst\spuninst.exe"
    Suojauspäivitys Windows XP:lle (KB917344) --> "C:\WINDOWS\$NtUninstallKB917344$\spuninst\spuninst.exe"
    Suojauspäivitys Windows XP:lle (KB917422) --> "C:\WINDOWS\$NtUninstallKB917422$\spuninst\spuninst.exe"
    Suojauspäivitys Windows XP:lle (KB917953) --> "C:\WINDOWS\$NtUninstallKB917953$\spuninst\spuninst.exe"
    Suojauspäivitys Windows XP:lle (KB918118) --> "C:\WINDOWS\$NtUninstallKB918118$\spuninst\spuninst.exe"
    Suojauspäivitys Windows XP:lle (KB918439) --> "C:\WINDOWS\$NtUninstallKB918439$\spuninst\spuninst.exe"
    Suojauspäivitys Windows XP:lle (KB918899) --> "C:\WINDOWS\$NtUninstallKB918899$\spuninst\spuninst.exe"
    Suojauspäivitys Windows XP:lle (KB919007) --> "C:\WINDOWS\$NtUninstallKB919007$\spuninst\spuninst.exe"
    Suojauspäivitys Windows XP:lle (KB920213) --> "C:\WINDOWS\$NtUninstallKB920213$\spuninst\spuninst.exe"
    Suojauspäivitys Windows XP:lle (KB920214) --> "C:\WINDOWS\$NtUninstallKB920214$\spuninst\spuninst.exe"
    Suojauspäivitys Windows XP:lle (KB920670) --> "C:\WINDOWS\$NtUninstallKB920670$\spuninst\spuninst.exe"
    Suojauspäivitys Windows XP:lle (KB920683) --> "C:\WINDOWS\$NtUninstallKB920683$\spuninst\spuninst.exe"
    Suojauspäivitys Windows XP:lle (KB920685) --> "C:\WINDOWS\$NtUninstallKB920685$\spuninst\spuninst.exe"
    Suojauspäivitys Windows XP:lle (KB921398) --> "C:\WINDOWS\$NtUninstallKB921398$\spuninst\spuninst.exe"
    Suojauspäivitys Windows XP:lle (KB921883) --> "C:\WINDOWS\$NtUninstallKB921883$\spuninst\spuninst.exe"
    Suojauspäivitys Windows XP:lle (KB922616) --> "C:\WINDOWS\$NtUninstallKB922616$\spuninst\spuninst.exe"
    Suojauspäivitys Windows XP:lle (KB922760) --> "C:\WINDOWS\$NtUninstallKB922760$\spuninst\spuninst.exe"
    Suojauspäivitys Windows XP:lle (KB922819) --> "C:\WINDOWS\$NtUninstallKB922819$\spuninst\spuninst.exe"
    Suojauspäivitys Windows XP:lle (KB923191) --> "C:\WINDOWS\$NtUninstallKB923191$\spuninst\spuninst.exe"
    Suojauspäivitys Windows XP:lle (KB923414) --> "C:\WINDOWS\$NtUninstallKB923414$\spuninst\spuninst.exe"
    Suojauspäivitys Windows XP:lle (KB923694) --> "C:\WINDOWS\$NtUninstallKB923694$\spuninst\spuninst.exe"
    Suojauspäivitys Windows XP:lle (KB923980) --> "C:\WINDOWS\$NtUninstallKB923980$\spuninst\spuninst.exe"
    Suojauspäivitys Windows XP:lle (KB924191) --> "C:\WINDOWS\$NtUninstallKB924191$\spuninst\spuninst.exe"
    Suojauspäivitys Windows XP:lle (KB924270) --> "C:\WINDOWS\$NtUninstallKB924270$\spuninst\spuninst.exe"
    Suojauspäivitys Windows XP:lle (KB924496) --> "C:\WINDOWS\$NtUninstallKB924496$\spuninst\spuninst.exe"
    Suojauspäivitys Windows XP:lle (KB924667) --> "C:\WINDOWS\$NtUninstallKB924667$\spuninst\spuninst.exe"
    Suojauspäivitys Windows XP:lle (KB925486) --> "C:\WINDOWS\$NtUninstallKB925486$\spuninst\spuninst.exe"
    Suojauspäivitys Windows XP:lle (KB925902) --> "C:\WINDOWS\$NtUninstallKB925902$\spuninst\spuninst.exe"
    Suojauspäivitys Windows XP:lle (KB926255) --> "C:\WINDOWS\$NtUninstallKB926255$\spuninst\spuninst.exe"
    Suojauspäivitys Windows XP:lle (KB926436) --> "C:\WINDOWS\$NtUninstallKB926436$\spuninst\spuninst.exe"
    Suojauspäivitys Windows XP:lle (KB927779) --> "C:\WINDOWS\$NtUninstallKB927779$\spuninst\spuninst.exe"
    Suojauspäivitys Windows XP:lle (KB927802) --> "C:\WINDOWS\$NtUninstallKB927802$\spuninst\spuninst.exe"
    Suojauspäivitys Windows XP:lle (KB928255) --> "C:\WINDOWS\$NtUninstallKB928255$\spuninst\spuninst.exe"
    Suojauspäivitys Windows XP:lle (KB928843) --> "C:\WINDOWS\$NtUninstallKB928843$\spuninst\spuninst.exe"
    Suojauspäivitys Windows XP:lle (KB929123) --> "C:\WINDOWS\$NtUninstallKB929123$\spuninst\spuninst.exe"
    Suojauspäivitys Windows XP:lle (KB930178) --> "C:\WINDOWS\$NtUninstallKB930178$\spuninst\spuninst.exe"
    Suojauspäivitys Windows XP:lle (KB931261) --> "C:\WINDOWS\$NtUninstallKB931261$\spuninst\spuninst.exe"
    Suojauspäivitys Windows XP:lle (KB931784) --> "C:\WINDOWS\$NtUninstallKB931784$\spuninst\spuninst.exe"
    Suojauspäivitys Windows XP:lle (KB932168) --> "C:\WINDOWS\$NtUninstallKB932168$\spuninst\spuninst.exe"
    Suojauspäivitys Windows XP:lle (KB935839) --> "C:\WINDOWS\$NtUninstallKB935839$\spuninst\spuninst.exe"
    Suojauspäivitys Windows XP:lle (KB935840) --> "C:\WINDOWS\$NtUninstallKB935840$\spuninst\spuninst.exe"
    Topfield Windows Applications --> C:\Program Files\Topfield Windows Applications\uninst.exe
    TVAnts 1.0 --> C:\PROGRA~1\TVAnts\UNWISE.EXE C:\PROGRA~1\TVAnts\INSTALL.LOG
    Tweak Genie 6.0.0 Free Version --> C:\PROGRA~1\TWEAKG~1\UNWISE.EXE C:\PROGRA~1\TWEAKG~1\INSTALL.LOG
    Tweak UI --> "C:\WINDOWS\system32\mshta.exe" "res://C:\WINDOWS\system32\TweakUI.exe/uninstall.hta"
    UltraISO V7.62 ME --> "C:\Program Files\UltraISO\unins000.exe"
    Uniblue SpeedUpMyPC --> "C:\Program Files\Uniblue\SpeedUpMyPC\unins000.exe"
    Uninstall Startup Inspector for Windows --> "C:\Program Files\Startup Inspector for Windows\unins000.exe"
    VideoLAN VLC media player 0.8.2 --> C:\Program Files\VideoLAN\VLC\uninstall.exe
    WinRAR archiver --> C:\Program Files\WinRAR\uninstall.exe
    XoftSpySE --> C:\Program Files\XoftSpySE\uninstall.exe
    Yahoo! Messenger --> C:\PROGRA~1\Yahoo!\MESSEN~1\UNWISE.EXE /U C:\PROGRA~1\Yahoo!\MESSEN~1\INSTALL.LOG
    ZoneAlarm --> C:\Program Files\Zone Labs\ZoneAlarm\zauninst.exe


    -- Application Event Log -------------------------------------------------------

    Event ID #6893: Error
    Event Submitted/Written: 08/12/2007 07:59:06 PM
    Event Source: PerfNet
    Event Description:
    Palvelinpalvelua ei voi avata. Palvelimen resurssitietoja
    ei palauteta. Palautettu virhekoodi on ensimmäisessä DWORD-tavussa.

    Event ID #6890: Warning
    Event Submitted/Written: 08/12/2007 07:50:47 PM
    Event Source: H+BEDV AntiVir
    Event Description:
    AntiVir has detected 'HTML/Crypted.Gen'
    in the file
    C:\Documents and Settings\Lauri\Local Settings\Application Data\Mozilla\Firefox\Profiles\tet9s883.Oletuskäyttäjä\Cache\D9DBB42Fd01

    Event ID #6889: Error
    Event Submitted/Written: 08/12/2007 10:36:12 AM
    Event Source: PerfNet
    Event Description:
    Palvelinpalvelua ei voi avata. Palvelimen resurssitietoja
    ei palauteta. Palautettu virhekoodi on ensimmäisessä DWORD-tavussa.

    Event ID #6886: Error
    Event Submitted/Written: 08/11/2007 11:50:39 AM
    Event Source: PerfNet
    Event Description:
    Palvelinpalvelua ei voi avata. Palvelimen resurssitietoja
    ei palauteta. Palautettu virhekoodi on ensimmäisessä DWORD-tavussa.

    Event ID #6883: Warning
    Event Submitted/Written: 08/10/2007 06:03:07 PM
    Event Source: Userenv
    Event Description:
    Windows tallensi käyttäjän VANR\Lauri rekisterin, kun jokin sovellus tai palvelu käytti yhä rekisteriä uloskirjautumisen aikana. Käyttäjän rekisterin varaamaa muistia ei ole vapautettu. Rekisterin lataus poistetaan, kun rekisteri ei ole enää käytössä.


    Tähän on usein syynä käyttäjän tilin avulla suoritettavat palvelut. Määritä palvelut LocalService- tai NetworkService-tilin avulla suoritettaviksi.



    -- Security Event Log ----------------------------------------------------------

    No Errors/Warnings found.


    -- System Event Log ------------------------------------------------------------

    Event ID #26204: Error
    Event Submitted/Written: 08/12/2007 11:08:23 PM
    Event Source: Service Control Manager
    Event Description:
    Palvelu Sovellusten hallinta lopetettiin virheen takia. Virhe:
    %%126

    Event ID #26201: Error
    Event Submitted/Written: 08/12/2007 11:08:23 PM
    Event Source: Service Control Manager
    Event Description:
    Palvelu Sovellusten hallinta lopetettiin virheen takia. Virhe:
    %%126

    Event ID #26197: Error
    Event Submitted/Written: 08/12/2007 11:08:23 PM
    Event Source: Service Control Manager
    Event Description:
    Palvelu Sovellusten hallinta lopetettiin virheen takia. Virhe:
    %%126

    Event ID #26195: Error
    Event Submitted/Written: 08/12/2007 11:08:23 PM
    Event Source: Service Control Manager
    Event Description:
    Palvelu Sovellusten hallinta lopetettiin virheen takia. Virhe:
    %%126

    Event ID #26192: Error
    Event Submitted/Written: 08/12/2007 11:08:23 PM
    Event Source: Service Control Manager
    Event Description:
    Palvelu Sovellusten hallinta lopetettiin virheen takia. Virhe:
    %%126



    -- End of Deckard's System Scanner: finished at 2007-08-12 at 23:10:15 ---------

     
    Laur1, Aug 12, 2007
    #5
  6. Auttaja

    Auttaja Guest

    Päivitä toi java viestissäni olleen ohjeen mukaisesti.. sitten

    1. Lataa combofix.exe työpöydällesi jommastakummasta linkistä:
    http://www.techsupportforum.com/sectools/sUBs/ComboFix.exe
    http://download.bleepingcomputer.com/sUBs/ComboFix.exe

    2. Tuplaklikkaa combofix.exe tiedostoa ja seuraa ohjeistuksia.
    3. Kun työkalu on valmis, se tuottaa lokin. (C:\ComboFix.txt) Lähetä tämä loki viesti ketjuusi.
    Huom! Älä klikkaile combofixin ikkunaa käytön aikana. Tämä saattaa aiheuttaa ohjelman jumiutumisen.
     
    Auttaja, Aug 12, 2007
    #6
  7. Laur1

    Laur1 Member

    Joined:
    Mar 1, 2007
    Messages:
    11
    Likes Received:
    0
    Trophy Points:
    11
    Pahoittelut, että edellinen viesti meni useaan kertaan. Java on nyt päivitetty. Tässä combofixin logi:

    ComboFix 07-08-09.3 - "Lauri" 2007-08-13 11:01:38.1 - NTFSx86
    Microsoft Windows XP Home Edition 5.1.2600.2.1252.358.1035.18.1602 [GMT 3:00]
    * Created a new restore point


    ((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))


    C:\WINDOWS\system32\drivers\npf.sys
    C:\WINDOWS\system32\packet.dll


    ((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))


    -------\nm
    -------\NPF


    ((((((((((((((((((((((((( Files Created from 2007-07-13 to 2007-08-13 )))))))))))))))))))))))))))))))


    2007-08-13 11:00 51,200 --a------ C:\WINDOWS\nircmd.exe
    2007-08-13 03:15 21,568 --a------ C:\avcmhk4.dll
    2007-08-12 23:05 <KANSIO> d-------- C:\Deckard
    2007-08-12 22:38 <KANSIO> d-------- C:\Program Files\SpywareBlaster
    2007-08-12 22:32 <KANSIO> d-------- C:\hosts
    2007-08-12 20:30 <KANSIO> d-------- C:\Program Files\CCleaner
    2007-08-09 11:49 <KANSIO> d-------- C:\Program Files\PokerStove
    2007-08-08 17:14 <KANSIO> d-a------ C:\DOCUME~1\ALLUSE~1\APPLIC~1\TEMP
    2007-07-19 23:37 <KANSIO> d-------- C:\Program Files\Poker Evolver


    (((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))

    2007-08-13 09:28 860228 --ahs---- C:\WINDOWS\system32\drivers\fidbox.idx
    2007-08-13 09:28 64150048 --ahs---- C:\WINDOWS\system32\drivers\fidbox.dat
    2007-08-13 09:28 16916 --ahs---- C:\WINDOWS\system32\drivers\fidbox2.idx
    2007-08-13 09:28 168992 --ahs---- C:\WINDOWS\system32\drivers\fidbox2.dat
    2007-08-13 02:45 --------- d-------- C:\Program Files\Poker Tracker V2
    2007-08-13 02:23 --------- d-------- C:\Program Files\Red Kings Poker
    2007-08-12 22:51 --------- d-------- C:\Program Files\QuickTime
    2007-07-29 19:38 --------- d-------- C:\Program Files\PokerAce Hud
    2007-07-20 12:12 75610 --a------ C:\WINDOWS\system32\perfc00B.dat
    2007-07-20 12:12 375602 --a------ C:\WINDOWS\system32\perfh00B.dat
    2007-06-28 18:43 --------- d-------- C:\DOCUME~1\Lauri\APPLIC~1\Azureus
    2007-06-15 00:15 --------- d-------- C:\Program Files\TVAnts
    2007-06-15 00:04 --------- d-------- C:\Program Files\PPMate
    2007-06-15 00:04 --------- d-------- C:\Program Files\Common Files\Synacast
    2007-06-15 00:04 --------- d-------- C:\DOCUME~1\Lauri\APPLIC~1\PPMate
    2007-06-15 00:03 --------- d-------- C:\DOCUME~1\Lauri\APPLIC~1\SopCast
    2007-05-16 18:14 86528 --a--c--- C:\WINDOWS\system32\dllcache\directdb.dll
    2007-05-16 18:14 85504 --a--c--- C:\WINDOWS\system32\dllcache\wabimp.dll
    2007-05-16 18:14 683520 --a--c--- C:\WINDOWS\system32\dllcache\inetcomm.dll
    2007-05-16 18:14 683520 --a------ C:\WINDOWS\system32\inetcomm.dll
    2007-05-16 18:14 510976 --a--c--- C:\WINDOWS\system32\dllcache\wab32.dll
    2007-05-16 18:14 1314816 --a--c--- C:\WINDOWS\system32\dllcache\msoe.dll
    2006-11-01 16:32 18456 --a------ C:\DOCUME~1\Lauri\APPLIC~1\GDIPFONTCACHEV1.DAT
    2004-03-11 13:27 40960 --a------ C:\Program Files\Uninstall_CDS.exe


    ((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))


    *Note* empty entries & legit default entries are not shown

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "POEngine"="C:\Pelit\PokerOffice\POEngine.exe" [2005-07-13 17:17]
    "Zone Labs Client"="C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe" [2007-03-09 00:02]
    "avgnt"="C:\Program Files\AntiVir PersonalEdition Classic\avgnt.exe" [2007-04-20 21:12]
    "ATIPTA"="C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe" [2005-03-22 21:05]
    "ATICCC"="C:\Program Files\ATI Technologies\ATI.ACE\cli.exe" [2005-08-31 00:40]
    "ABIT uGuru"="C:\Program Files\ABIT\ABIT uGuru\uGuru.exe" [2004-05-21 16:07]
    "SnoopFreeUI"="SnoopFreeUI.exe" [2007-02-21 13:50 C:\WINDOWS\SnoopFreeUI.exe]
    "ZoneAlarm Client"="C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe" [2007-03-09 00:02]
    "SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe" [2007-07-12 04:00]

    [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-09-15 15:00]

    C:\Documents and Settings\Lauri\K„ynnist„-valikko\Ohjelmat\K„ynnistys\
    allSnap.lnk - C:\Program Files\allSnap\allSnap.exe [2004-03-20 00:02:14]

    C:\Documents and Settings\All Users\K„ynnist„-valikko\Ohjelmat\K„ynnistys\
    Adobe Reader Speed Launch.lnk - C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2005-09-23 22:05:26]

    [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer]
    "LinkResolveIgnoreLinkInfo"=0 (0x0)
    "NoResolveSearch"=1 (0x1)

    [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]
    "NoTrayItemsDisplay"=00000000
    "LinkResolveIgnoreLinkInfo"=0 (0x0)

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
    "SandraTheSrv"=3 (0x3)
    "SandraDataSrv"=3 (0x3)
    "iPodService"=3 (0x3)
    "IDriverT"=3 (0x3)
    "ATI Smart"=2 (0x2)
    "Ati HotKey Poller"=2 (0x2)

    [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-]
    "InCD"=C:\Program Files\Ahead\InCD\InCD.exe
    "iTunesHelper"="C:\Program Files\iTunes\iTunesHelper.exe"
    "NeroCheck"=C:\WINDOWS\system32\NeroCheck.exe
    "QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" -atboottime
    "type32"="C:\Program Files\Microsoft IntelliType Pro\type32.exe"

    R0 sfsync02;StarForce Protection Synchronization Driver (version 2.x);C:\WINDOWS\system32\drivers\sfsync02.sys
    R0 uGuru;uGuru;C:\WINDOWS\system32\Drivers\uGuru.sys
    R1 avgio;avgio;\??\C:\Program Files\AntiVir PersonalEdition Classic\avgio.sys
    R1 avipbb;avipbb;C:\WINDOWS\system32\DRIVERS\avipbb.sys
    R2 pgsql-8.2;PostgreSQL Database Server 8.2;"C:\Program Files\PostgreSQ3L\8.2\bin\pg_ctl.exe" runservice -N "pgsql-8.2" -D "C:\Program Files\PostgreSQ3L\8.2\data\"
    R3 avgntflt;avgntflt;\??\C:\Program Files\AntiVir PersonalEdition Classic\avgntflt.sys
    R3 RTL8023xp;Realtek RTL8139/810x/8169/8110 all in one NDIS XP Driver;C:\WINDOWS\system32\DRIVERS\Rtlnicxp.sys
    S3 gtermddo;gtermddo;\??\C:\DOCUME~1\Lauri\LOCALS~1\Temp\gtermddo.sys
    S3 Memctl;Memctl;\??\C:\Program Files\ABIT\ABIT uGuru\Memctl.sys
    S3 razerusb;razerusb;C:\WINDOWS\system32\DRIVERS\razerusb.sys
    S3 ssmdrv;ssmdrv;C:\WINDOWS\system32\DRIVERS\ssmdrv.sys
    S3 TFBULK;Topfield USB client driver;C:\WINDOWS\system32\drivers\TfBulk.sys
    S3 WinDriver6;WinDriver6;C:\WINDOWS\system32\drivers\windrvr6.sys
    S3 Winflash;WINFLASH;\??\C:\Program Files\ABIT\ABIT uGuru\WinFlash.sys


    [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\F]
    AutoRun\command- F:\LaunchU3.exe -a


    Contents of the 'Scheduled Tasks' folder
    2007-06-19 00:00:00 C:\WINDOWS\Tasks\XoftSpySE.job - C:\Program Files\XoftSpySE\XoftSpy.exe

    **************************************************************************

    catchme 0.3.1061 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
    Rootkit scan 2007-08-13 11:05:18
    Windows 5.1.2600 Service Pack 2 NTFS

    scanning hidden processes ...

    scanning hidden registry entries ...

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\\x90\x2022\x20ac|\xff\xff\xff\xff"\x2022\x20ac|\xfe\xbb\xd3w\2]
    "b049C053C7D38EE4AB9A00CB3B5D2472"="C?\Program Files\Common Files\Microsoft Shared\Web Folders\PUBPLACE.HTT"

    scanning hidden files ...

    scan completed successfully
    hidden files: 0

    **************************************************************************

    Completion time: 2007-08-13 11:07:11 - machine was rebooted
    C:\ComboFix-quarantined-files.txt ... 2007-08-13 11:07

    --- E O F ---
     
    Laur1, Aug 13, 2007
    #7
  8. Auttaja

    Auttaja Guest


    Avaa Notepad ja kopioi/liitä allaolevassa lainausboxissa oleva teksti sinne:

    Tallenna se nimellä CFScript (Tarkista että on juuri noin kirjoitettu)

    Sitten raahaa CFScript ComboFix.exeen kuten alla.

    [​IMG]

    Käynnistä tietokone uudelleen pyydettäessä ja lähetä combofix.txt-tiedoston sisältö tänne.

    myös uusi hijackthis logi
     
    Auttaja, Aug 13, 2007
    #8
  9. Laur1

    Laur1 Member

    Joined:
    Mar 1, 2007
    Messages:
    11
    Likes Received:
    0
    Trophy Points:
    11
    Ensin combofixin logi ja sitten uusi HjT logi.

    ComboFix 07-08-09.3 - "Lauri" 2007-08-13 16:51:25.2 - NTFSx86
    Microsoft Windows XP Home Edition 5.1.2600.2.1252.358.1035.18.1511 [GMT 3:00]
    Command switches used :: C:\Documents and Settings\Lauri\Ty”p”yt„\CFScript.txt

    FILE::
    c:\docume~1\lauri\locals~1\temp\gtermddo.sys


    ((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))


    -------\LEGACY_GTERMDDO
    -------\gtermddo


    ((((((((((((((((((((((((( Files Created from 2007-07-13 to 2007-08-13 )))))))))))))))))))))))))))))))


    2007-08-13 11:00 51,200 --a------ C:\WINDOWS\nircmd.exe
    2007-08-13 03:15 21,568 --a------ C:\avcmhk4.dll
    2007-08-12 23:05 <KANSIO> d-------- C:\Deckard
    2007-08-12 22:38 <KANSIO> d-------- C:\Program Files\SpywareBlaster
    2007-08-12 22:32 <KANSIO> d-------- C:\hosts
    2007-08-12 20:30 <KANSIO> d-------- C:\Program Files\CCleaner
    2007-08-09 11:49 <KANSIO> d-------- C:\Program Files\PokerStove
    2007-08-08 17:14 <KANSIO> d-a------ C:\DOCUME~1\ALLUSE~1\APPLIC~1\TEMP
    2007-07-19 23:37 <KANSIO> d-------- C:\Program Files\Poker Evolver


    (((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))

    2007-08-13 15:40 --------- d-------- C:\Program Files\Poker Tracker V2
    2007-08-13 15:38 --------- d-------- C:\Program Files\Red Kings Poker
    2007-08-13 09:28 860228 --ahs---- C:\WINDOWS\system32\drivers\fidbox.idx
    2007-08-13 09:28 64150048 --ahs---- C:\WINDOWS\system32\drivers\fidbox.dat
    2007-08-13 09:28 16916 --ahs---- C:\WINDOWS\system32\drivers\fidbox2.idx
    2007-08-13 09:28 168992 --ahs---- C:\WINDOWS\system32\drivers\fidbox2.dat
    2007-08-12 22:51 --------- d-------- C:\Program Files\QuickTime
    2007-07-29 19:38 --------- d-------- C:\Program Files\PokerAce Hud
    2007-07-20 12:12 75610 --a------ C:\WINDOWS\system32\perfc00B.dat
    2007-07-20 12:12 375602 --a------ C:\WINDOWS\system32\perfh00B.dat
    2007-06-28 18:43 --------- d-------- C:\DOCUME~1\Lauri\APPLIC~1\Azureus
    2007-06-15 00:15 --------- d-------- C:\Program Files\TVAnts
    2007-06-15 00:04 --------- d-------- C:\Program Files\PPMate
    2007-06-15 00:04 --------- d-------- C:\Program Files\Common Files\Synacast
    2007-06-15 00:04 --------- d-------- C:\DOCUME~1\Lauri\APPLIC~1\PPMate
    2007-06-15 00:03 --------- d-------- C:\DOCUME~1\Lauri\APPLIC~1\SopCast
    2007-05-16 18:14 86528 --a--c--- C:\WINDOWS\system32\dllcache\directdb.dll
    2007-05-16 18:14 85504 --a--c--- C:\WINDOWS\system32\dllcache\wabimp.dll
    2007-05-16 18:14 683520 --a--c--- C:\WINDOWS\system32\dllcache\inetcomm.dll
    2007-05-16 18:14 683520 --a------ C:\WINDOWS\system32\inetcomm.dll
    2007-05-16 18:14 510976 --a--c--- C:\WINDOWS\system32\dllcache\wab32.dll
    2007-05-16 18:14 1314816 --a--c--- C:\WINDOWS\system32\dllcache\msoe.dll
    2006-11-01 16:32 18456 --a------ C:\DOCUME~1\Lauri\APPLIC~1\GDIPFONTCACHEV1.DAT
    2004-03-11 13:27 40960 --a------ C:\Program Files\Uninstall_CDS.exe


    ((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))


    *Note* empty entries & legit default entries are not shown

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "POEngine"="C:\Pelit\PokerOffice\POEngine.exe" [2005-07-13 17:17]
    "Zone Labs Client"="C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe" [2007-03-09 00:02]
    "avgnt"="C:\Program Files\AntiVir PersonalEdition Classic\avgnt.exe" [2007-04-20 21:12]
    "ATIPTA"="C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe" [2005-03-22 21:05]
    "ATICCC"="C:\Program Files\ATI Technologies\ATI.ACE\cli.exe" [2005-08-31 00:40]
    "ABIT uGuru"="C:\Program Files\ABIT\ABIT uGuru\uGuru.exe" [2004-05-21 16:07]
    "SnoopFreeUI"="SnoopFreeUI.exe" [2007-02-21 13:50 C:\WINDOWS\SnoopFreeUI.exe]
    "ZoneAlarm Client"="C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe" [2007-03-09 00:02]
    "SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe" [2007-07-12 04:00]

    [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-09-15 15:00]

    C:\Documents and Settings\Lauri\K„ynnist„-valikko\Ohjelmat\K„ynnistys\
    allSnap.lnk - C:\Program Files\allSnap\allSnap.exe [2004-03-20 00:02:14]

    C:\Documents and Settings\All Users\K„ynnist„-valikko\Ohjelmat\K„ynnistys\
    Adobe Reader Speed Launch.lnk - C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2005-09-23 22:05:26]

    [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer]
    "LinkResolveIgnoreLinkInfo"=0 (0x0)
    "NoResolveSearch"=1 (0x1)

    [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]
    "NoTrayItemsDisplay"=00000000
    "LinkResolveIgnoreLinkInfo"=0 (0x0)

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
    "SandraTheSrv"=3 (0x3)
    "SandraDataSrv"=3 (0x3)
    "iPodService"=3 (0x3)
    "IDriverT"=3 (0x3)
    "ATI Smart"=2 (0x2)
    "Ati HotKey Poller"=2 (0x2)

    [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-]
    "InCD"=C:\Program Files\Ahead\InCD\InCD.exe
    "iTunesHelper"="C:\Program Files\iTunes\iTunesHelper.exe"
    "NeroCheck"=C:\WINDOWS\system32\NeroCheck.exe
    "QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" -atboottime
    "type32"="C:\Program Files\Microsoft IntelliType Pro\type32.exe"

    R0 sfsync02;StarForce Protection Synchronization Driver (version 2.x);C:\WINDOWS\system32\drivers\sfsync02.sys
    R0 uGuru;uGuru;C:\WINDOWS\system32\Drivers\uGuru.sys
    R1 avgio;avgio;\??\C:\Program Files\AntiVir PersonalEdition Classic\avgio.sys
    R1 avipbb;avipbb;C:\WINDOWS\system32\DRIVERS\avipbb.sys
    R2 pgsql-8.2;PostgreSQL Database Server 8.2;"C:\Program Files\PostgreSQ3L\8.2\bin\pg_ctl.exe" runservice -N "pgsql-8.2" -D "C:\Program Files\PostgreSQ3L\8.2\data\"
    R3 avgntflt;avgntflt;\??\C:\Program Files\AntiVir PersonalEdition Classic\avgntflt.sys
    R3 RTL8023xp;Realtek RTL8139/810x/8169/8110 all in one NDIS XP Driver;C:\WINDOWS\system32\DRIVERS\Rtlnicxp.sys
    S3 Memctl;Memctl;\??\C:\Program Files\ABIT\ABIT uGuru\Memctl.sys
    S3 razerusb;razerusb;C:\WINDOWS\system32\DRIVERS\razerusb.sys
    S3 ssmdrv;ssmdrv;C:\WINDOWS\system32\DRIVERS\ssmdrv.sys
    S3 TFBULK;Topfield USB client driver;C:\WINDOWS\system32\drivers\TfBulk.sys
    S3 WinDriver6;WinDriver6;C:\WINDOWS\system32\drivers\windrvr6.sys
    S3 Winflash;WINFLASH;\??\C:\Program Files\ABIT\ABIT uGuru\WinFlash.sys


    [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\F]
    AutoRun\command- F:\LaunchU3.exe -a


    Contents of the 'Scheduled Tasks' folder
    2007-06-19 00:00:00 C:\WINDOWS\Tasks\XoftSpySE.job - C:\Program Files\XoftSpySE\XoftSpy.exe

    **************************************************************************

    catchme 0.3.1061 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
    Rootkit scan 2007-08-13 16:55:02
    Windows 5.1.2600 Service Pack 2 NTFS

    scanning hidden processes ...

    scanning hidden registry entries ...

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\\x90\x2022\x20ac|\xff\xff\xff\xff"\x2022\x20ac|\xfe\xbb\xd3w\2]
    "b049C053C7D38EE4AB9A00CB3B5D2472"="C?\Program Files\Common Files\Microsoft Shared\Web Folders\PUBPLACE.HTT"

    scanning hidden files ...

    scan completed successfully
    hidden files: 0

    **************************************************************************

    Completion time: 2007-08-13 16:56:46 - machine was rebooted
    C:\ComboFix-quarantined-files.txt ... 2007-08-13 16:56
    C:\ComboFix2.txt ... 2007-08-13 11:07

    --- E O F ---

    Logfile of Trend Micro HijackThis v2.0.2
    Scan saved at 4:57:59 PM, on 08/13/2007
    Platform: Windows XP SP2 (WinNT 5.01.2600)
    MSIE: Internet Explorer v7.00 (7.00.6000.16473)
    Boot mode: Normal

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\system32\spoolsv.exe
    C:\WINDOWS\Explorer.EXE
    C:\Program Files\AntiVir PersonalEdition Classic\sched.exe
    C:\Program Files\AntiVir PersonalEdition Classic\avguard.exe
    C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
    C:\Program Files\AntiVir PersonalEdition Classic\avgnt.exe
    C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
    C:\Program Files\ABIT\ABIT uGuru\uGuru.exe
    C:\WINDOWS\SnoopFreeUI.exe
    C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe
    C:\WINDOWS\system32\ctfmon.exe
    C:\WINDOWS\System32\SnoopFreeSvc.exe
    C:\Program Files\ABIT\ABIT uGuru\uGuru_Event_Receiver.exe
    C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
    C:\WINDOWS\system32\ZoneLabs\vsmon.exe
    C:\Pelit\PokerOffice\bin\javaw.exe
    C:\Program Files\allSnap\allSnap.exe
    C:\WINDOWS\system32\wuauclt.exe
    C:\WINDOWS\system32\notepad.exe
    C:\Program Files\Mozilla Firefox\firefox.exe
    C:\Program Files\HijackThis\HijackThis.exe

    R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
    R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Linkit
    O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
    O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
    O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
    O4 - HKLM\..\Run: [POEngine] "C:\Pelit\PokerOffice\POEngine.exe" C:\Pelit\PokerOffice
    O4 - HKLM\..\Run: [Zone Labs Client] C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
    O4 - HKLM\..\Run: [avgnt] "C:\Program Files\AntiVir PersonalEdition Classic\avgnt.exe" /min
    O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
    O4 - HKLM\..\Run: [ATICCC] "C:\Program Files\ATI Technologies\ATI.ACE\cli.exe" runtime
    O4 - HKLM\..\Run: [ABIT uGuru] C:\Program Files\ABIT\ABIT uGuru\uGuru.exe
    O4 - HKLM\..\Run: [SnoopFreeUI] SnoopFreeUI.exe
    O4 - HKLM\..\Run: [ZoneAlarm Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"
    O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe"
    O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
    O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Paikallinen palve')
    O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Verkkopalve')
    O4 - HKUS\S-1-5-21-1085031214-813497703-725345543-1012\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'postgres')
    O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
    O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
    O4 - Startup: allSnap.lnk = C:\Program Files\allSnap\allSnap.exe
    O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
    O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~3\Office10\EXCEL.EXE/3000
    O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
    O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
    O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe
    O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe
    O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
    O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
    O10 - Unknown file in Winsock LSP: c:\windows\system32\nwprovau.dll
    O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
    O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://download.bitdefender.com/resources/scan8/oscan8.cab
    O23 - Service: AntiVir PersonalEdition Classic Scheduler (AntiVirScheduler) - Avira GmbH - C:\Program Files\AntiVir PersonalEdition Classic\sched.exe
    O23 - Service: AntiVir PersonalEdition Classic Guard (AntiVirService) - Avira GmbH - C:\Program Files\AntiVir PersonalEdition Classic\avguard.exe
    O23 - Service: PostgreSQL Database Server 8.2 (pgsql-8.2) - PostgreSQL Global Development Group - C:\Program Files\PostgreSQ3L\8.2\bin\pg_ctl.exe
    O23 - Service: Snoop Free Service (SnoopFreeSvc) - Unknown owner - C:\WINDOWS\System32\SnoopFreeSvc.exe
    O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe

    --
    End of file - 5241 bytes

     
    Laur1, Aug 13, 2007
    #9
  10. Auttaja

    Auttaja Guest

    Pysy puhtaana

    -> Tyhjennä järjestelmänpalautus Ohjeet
    Tyhjennä järjestelmänpalautuskansio ja luo uusi palautuspiste. Tämä puhdistaa palautuskansion mahdollisista haittaohjelmajäännöksistä.

    -> Käytä CCleaneria -> CCleaner
    Lataa ja asenna CCleaner. Puhdista väliaikaistiedostot ja -kansiot ohjelmalla säännöllisesti.

    -> Asenna SpywareBlaster -> SpywareBlaster
    SpywareBlaster estää haittaohjelmia asentumasta koneellesi. Ei kuluta muistia!
    Opas saatavilla suomeksi! Nimimerkki Ad-Awaren opas

    -> Asenna MVPS Hosts tiedosto -> MVPS Hosts
    Estää koneesi yhteyden haitallisiin sivustoihin.
    Opas saatavilla suomeksi! Nimimerkki Axelin opas

    -> Vaihda selaimesi Firefoxiin -> Firefox
    Firefox on nopeampi, turvallisempi ja parempi selain kuin Internet Explorer.

    -> Pidä järjestelmäsi ajantasalla. -> Windows Update
    Vieraile Windows Updatessa säännöllisesti.

    -> Pidä palomuuri ja virustorjunta ajantasalla
    Päivitä ja skannaa koneesi säännöllisesti virustorjuntaohjelmallasi.
    ja hyvä myös escan http://koti.mbnet.fi/pattaya1/escanmwav.htm

    ->Pidä ohjelmistosi ajantasalla. -> Secunia Software Inspector
    Secunia Software Inspector tutkii sinun järjestälmäsi ja ohjelmistosi puuttuvien turvallisuuspäivityksien osalta. Tavallinen tutkinta kestää normaalisti 5-40 sekuntia, kun läpikotainen (thorough system inspection) voi kestää useita minuutteja.

    ->Seuraa säännöllisesti viestintäviraston tietoja uusista haavoittuvuuksista -> CERT-FI

    Jos tulevaisuudessa tulee haittaohjelmien kanssa ongelmia, älä epäröi laittaa Hijackthis-logia tarkistettavaksi!
     
    Auttaja, Aug 13, 2007
    #10
  11. Laur1

    Laur1 Member

    Joined:
    Mar 1, 2007
    Messages:
    11
    Likes Received:
    0
    Trophy Points:
    11
    Kiitos paljon nopeasta avusta!
     
    Laur1, Aug 13, 2007
    #11

Share This Page