Messenger virus "muka" hävinnyt, kone jumii

Discussion in 'Virukset ja haittaohjelmat - HijackThis -logit' started by Koppis1, Jun 3, 2008.

  1. Koppis1

    Koppis1 Member

    Joined:
    Jun 26, 2007
    Messages:
    77
    Likes Received:
    0
    Trophy Points:
    16
    Eli messenger virus oli poistettu, mutta silti on toiminnassa.
    Kone jumii myös paljon.
    Tässä htj loki:

    Logfile of Trend Micro HijackThis v2.0.0 (BETA)
    Scan saved at 13:50, on 3.6.2008
    Platform: Windows XP SP2 (WinNT 5.01.2600)
    Boot mode: Normal

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\Ati2evxx.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\system32\Ati2evxx.exe
    C:\Program Files\DigitalPersona\Bin\DPWinLct.exe
    C:\WINDOWS\system32\spoolsv.exe
    C:\PROGRA~1\F-Secure\BackWeb\7681197\Program\SERVIC~1.EXE
    C:\WINDOWS\system32\drivers\CDAC11BA.EXE
    C:\Program Files\DigitalPersona\Bin\DpHost.exe
    C:\Program Files\F-Secure\Anti-Virus\fsgk32st.exe
    C:\Program Files\F-Secure\Anti-Virus\FSGK32.EXE
    C:\Program Files\F-Secure\BackWeb\7681197\program\fsbwsys.exe
    C:\Program Files\F-Secure\Anti-Virus\fssm32.exe
    C:\Program Files\F-Secure\Common\FSMA32.EXE
    C:\Program Files\F-Secure\Common\FSMB32.EXE
    C:\Program Files\F-Secure\Common\FCH32.EXE
    C:\Program Files\F-Secure\Common\FAMEH32.EXE
    C:\Program Files\F-Secure\Anti-Virus\fsqh.exe
    C:\Program Files\F-Secure\Anti-Virus\fsrw.exe
    C:\WINDOWS\system32\PnkBstrA.exe
    C:\Program Files\CheckPoint\SecuRemote\bin\SR_Service.exe
    C:\Program Files\CheckPoint\SecuRemote\bin\SR_WatchDog.exe
    C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\system32\UAService7.exe
    C:\Program Files\DigitalPersona\Bin\DPFUSMgr.exe
    C:\Program Files\F-Secure\Anti-Virus\fsav32.exe
    C:\Program Files\F-Secure\Common\FNRB32.EXE
    C:\Program Files\F-Secure\FWES\Program\fsdfwd.exe
    C:\Program Files\F-Secure\Common\FIH32.EXE
    C:\WINDOWS\Explorer.EXE
    C:\Program Files\CheckPoint\SecuRemote\bin\SR_GUI.Exe
    C:\Program Files\F-Secure\Common\FSM32.EXE
    C:\WINDOWS\System32\DLA\DLACTRLW.EXE
    C:\PROGRA~1\F-Secure\ANTI-S~1\fsaw.exe
    C:\WINDOWS\system32\LVCOMSX.EXE
    C:\Program Files\F-Secure\FSGUI\fsguidll.exe
    C:\Program Files\Logitech\Video\LogiTray.exe
    C:\Program Files\DAEMON Tools\daemon.exe
    C:\Program Files\Microsoft IntelliType Pro\itype.exe
    C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
    C:\Program Files\DigitalPersona\Bin\DPAgnt.exe
    C:\WINDOWS\system32\Rundll32.exe
    C:\Windows\mservice.exe
    C:\Program Files\Skype\Phone\Skype.exe
    C:\Program Files\PeerGuardian2\pg2.exe
    c:\Program Files\Microsoft IntelliType Pro\dpupdchk.exe
    C:\Program Files\Common Files\Sonic Shared\CineTray.exe
    C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\ccc.exe
    C:\Program Files\Logitech\Video\FxSvr2.exe
    C:\Program Files\Octoshape Streaming Services\Koppis\OctoshapeClient.exe
    C:\Program Files\Skype\Plugin Manager\SkypePM.exe
    C:\Program Files\Internet Explorer\IEXPLORE.EXE
    C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLLoginProxy.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\Ati2evxx.exe
    C:\Program Files\DigitalPersona\Bin\DPWinLct.exe
    C:\Program Files\F-Secure\BackWeb\7681197\program\F-Secure Automatic Update.exe
    C:\WINDOWS\system32\rundll32.exe
    C:\WINDOWS\RTHDCPL.EXE
    C:\Program Files\HiJackThis_v2\hoojiitee.exe

    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
    R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Linkit
    R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
    O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
    O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
    O2 - BHO: {871f3d22-8b2a-0819-b384-d0e59c475c01} - {10c574c9-5e0d-483b-9180-a2b822d3f178} - C:\WINDOWS\system32\vurqnwri.dll
    O2 - BHO: (no name) - {487C9905-26A8-42C8-8033-C58AD3D2AEC3} - C:\WINDOWS\system32\vtUolMgh.dll
    O2 - BHO: DriveLetterAccess - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\System32\DLA\DLASHX_W.DLL
    O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
    O2 - BHO: Windows Liven kirjautumisapuohjelma - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
    O2 - BHO: (no name) - {E6EC7EEE-BBC9-4EFC-B345-7D7C45EAB8AB} - C:\WINDOWS\system32\geBtTKDv.dll
    O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
    O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe
    O4 - HKLM\..\Run: [High Definition Audio -ominaisuussivun pikakuvake] HDAShCut.exe
    O4 - HKLM\..\Run: [F-Secure Manager] "C:\Program Files\F-Secure\Common\FSM32.EXE" /splash
    O4 - HKLM\..\Run: [F-Secure TNB] "C:\Program Files\F-Secure\TNB\TNBUtil.exe" /CHECKALL /WAITFORSW
    O4 - HKLM\..\Run: [DLA] C:\WINDOWS\System32\DLA\DLACTRLW.EXE
    O4 - HKLM\..\Run: [LVCOMSX] C:\WINDOWS\system32\LVCOMSX.EXE
    O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
    O4 - HKLM\..\Run: [LogitechVideoRepair] C:\Program Files\Logitech\Video\ISStart.exe
    O4 - HKLM\..\Run: [LogitechVideoTray] C:\Program Files\Logitech\Video\LogiTray.exe
    O4 - HKLM\..\Run: [DAEMON Tools] "C:\Program Files\DAEMON Tools\daemon.exe" -lang 1033
    O4 - HKLM\..\Run: [StartCCC] "C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe"
    O4 - HKLM\..\Run: [itype] "c:\Program Files\Microsoft IntelliType Pro\itype.exe"
    O4 - HKLM\..\Run: [DPAgnt] C:\Program Files\DigitalPersona\Bin\DPAgnt.exe
    O4 - HKLM\..\Run: [MSN] C:\Windows\mservice.exe
    O4 - HKLM\..\Run: [BMdff93d00] Rundll32.exe "C:\WINDOWS\system32\gvojukld.dll",s
    O4 - HKLM\..\Run: [dcca0e9c] rundll32.exe "C:\WINDOWS\system32\ncmobyek.dll",b
    O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background
    O4 - HKCU\..\Run: [Skype] "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized
    O4 - HKCU\..\Run: [igndlm.exe] C:\Program Files\Download Manager\DLM.exe /windowsstart /startifwork
    O4 - HKCU\..\Run: [PeerGuardian] C:\Program Files\PeerGuardian2\pg2.exe
    O4 - HKCU\..\Run: [LogitechSoftwareUpdate] "C:\Program Files\Logitech\Video\ManifestEngine.exe" boot
    O4 - HKCU\..\Run: [Octoshape Streaming Services] "C:\Program Files\Octoshape Streaming Services\Koppis\OctoshapeClient.exe" -inv:bootrun
    O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Paikallinen palve')
    O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Verkkopalve')
    O4 - HKUS\S-1-5-21-1343024091-606747145-839522115-1006\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe (User 'Vilpponen')
    O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
    O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
    O4 - Global Startup: F-Secure Automatic Update.lnk = C:\Program Files\F-Secure\BackWeb\7681197\program\F-Secure Automatic Update.exe
    O4 - Global Startup: Sonic CinePlayer Quick Launch.lnk = C:\Program Files\Common Files\Sonic Shared\CineTray.exe
    O8 - Extra context menu item: &Block this popup - C:\Program Files\F-Secure\Anti-Spyware\blockpopups.htm
    O8 - Extra context menu item: &D&ownload &with BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddLink.htm
    O8 - Extra context menu item: &D&ownload all video with BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddVideo.htm
    O8 - Extra context menu item: &D&ownload all with BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddAllLink.htm
    O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
    O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
    O9 - Extra button: IE Shield - {300DB664-75B5-47c0-8B45-A44ACCF73C00} - C:\Program Files\F-Secure\Anti-Spyware\ieshield.dll
    O9 - Extra 'Tools' menuitem: IE Shield... - {300DB664-75B5-47c0-8B45-A44ACCF73C00} - C:\Program Files\F-Secure\Anti-Spyware\ieshield.dll
    O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)
    O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)
    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - C:\Program Files\Yahoo!\Common\yinsthelper.dll
    O16 - DPF: {39B0684F-D7BF-4743-B050-FDC3F48F7E3B} (CDownloadCtrl Object) - http://www.fileplanet.com/fpdlmgr/cabs/FPDC_2.3.6.108.cab
    O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://download.bitdefender.com/resources/scan8/oscan8.cab
    O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1162297554309
    O17 - HKLM\System\CCS\Services\Tcpip\..\{EF416D88-D8DA-40DC-A196-4F3A1F7E69A4}: NameServer = 192.168.1.254
    O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
    O20 - Winlogon Notify: DPWLN - C:\WINDOWS\system32\DPWLEvHd.dll
    O20 - Winlogon Notify: vtUolMgh - C:\WINDOWS\SYSTEM32\vtUolMgh.dll
    O22 - SharedTaskScheduler: Browseui preloader - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - C:\WINDOWS\system32\browseui.dll
    O22 - SharedTaskScheduler: Component Categories cache daemon - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\WINDOWS\system32\browseui.dll
    O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
    O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
    O23 - Service: F-Secure Automatic Update (BackWeb Plug-in - 7681197) - F-Secure Automatic Update - C:\PROGRA~1\F-Secure\BackWeb\7681197\Program\SERVIC~1.EXE
    O23 - Service: C-DillaCdaC11BA - Macrovision - C:\WINDOWS\system32\drivers\CDAC11BA.EXE
    O23 - Service: Loogisen levyn hallinnan valvontapalvelu (dmadmin) - Unknown owner - C:\WINDOWS\System32\dmadmin.exe
    O23 - Service: Windows XP FUS Manager (DPFUSMgr) - DigitalPersona, Inc. - C:\Program Files\DigitalPersona\Bin\DPFUSMgr.exe
    O23 - Service: Biometric Authentication Service (DpHost) - DigitalPersona, Inc. - C:\Program Files\DigitalPersona\Bin\DpHost.exe
    O23 - Service: Tapahtumaloki (Eventlog) - Unknown owner - C:\WINDOWS\system32\services.exe
    O23 - Service: FSGKHS (F-Secure Gatekeeper Handler Starter) - Unknown owner - C:\Program Files\F-Secure\Anti-Virus\fsgk32st.exe
    O23 - Service: F-Secure Network Request Broker - F-Secure Corporation - C:\Program Files\F-Secure\Common\FNRB32.EXE
    O23 - Service: fsbwsys - Unknown owner - C:\Program Files\F-Secure\BackWeb\7681197\program\fsbwsys.exe
    O23 - Service: F-Secure Anti-Virus Firewall Daemon (FSDFWD) - F-Secure Corporation - C:\Program Files\F-Secure\FWES\Program\fsdfwd.exe
    O23 - Service: F-Secure Management Agent (FSMA) - F-Secure Corporation - C:\Program Files\F-Secure\Common\FSMA32.EXE
    O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
    O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
    O23 - Service: CD-levyjen kirjoittamisen IMAPI COM -palvelu (ImapiService) - Unknown owner - C:\WINDOWS\system32\imapi.exe
    O23 - Service: NetMeeting etätyöpöydän jakaminen (mnmsrvc) - Unknown owner - C:\WINDOWS\system32\mnmsrvc.exe
    O23 - Service: Plug and Play (PlugPlay) - Unknown owner - C:\WINDOWS\system32\services.exe
    O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\system32\PnkBstrA.exe
    O23 - Service: Etätyöpöydän ohjeen istunnonhallinta (RDSessMgr) - Unknown owner - C:\WINDOWS\system32\sessmgr.exe
    O23 - Service: Älykortti (SCardSvr) - Unknown owner - C:\WINDOWS\System32\SCardSvr.exe
    O23 - Service: Check Point SecuRemote Service (SR_Service) - Check Point Software Technologies - C:\Program Files\CheckPoint\SecuRemote\bin\SR_Service.exe
    O23 - Service: Check Point SecuRemote WatchDog (SR_WatchDog) - Check Point Software Technologies - C:\Program Files\CheckPoint\SecuRemote\bin\SR_WatchDog.exe
    O23 - Service: StarWind AE Service (StarWindServiceAE) - Rocket Division Software - C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe
    O23 - Service: Resurssilokit ja -hälytykset (SysmonLog) - Unknown owner - C:\WINDOWS\system32\smlogsvc.exe
    O23 - Service: Telnet (TlntSvr) - Unknown owner - C:\WINDOWS\system32\tlntsvr.exe
    O23 - Service: SecuROM User Access Service (V7) (UserAccess7) - Sony DADC Austria AG. - C:\WINDOWS\system32\UAService7.exe
    O23 - Service: Aseman tilannevedos (VSS) - Unknown owner - C:\WINDOWS\System32\vssvc.exe
    O23 - Service: WMI resurssisovitin (WmiApSrv) - Unknown owner - C:\WINDOWS\system32\wbem\wmiapsrv.exe

    --
    End of file - 13504 bytes
     
    Koppis1, Jun 3, 2008
    #1
  2. Hujo

    Hujo Guest

    Juumihan tuo aivan varmasti

    1.Lataa combofix.exe työpöydällesi yhdestä linkistä:
    combofix1
    combofix2

    2. Tuplaklikkaa combofix.exe tiedostoa ja seuraa ohjeistuksia.
    3. Kun työkalu on valmis, se tuottaa lokin. Lähetä tämä loki viesti ketjuusi.
    Huom! Älä klikkaile combofixin ikkunaa käytön aikana. Tämä saattaa aiheuttaa ohjelman jumiutumisen.

    =================

    Poista tää Trend Micro HijackThis v2.0.0 (BETA) hjt ja lataa uusi tuosta alta

    Lataa TÄSTÄ HJTInstall.exe

    * Tallenna HJTInstall.exe työpöydällesi.
    * Tuplaklikkaa HJTInstall.exe-kuvaketta työpöydälläsi.
    * Oletuksena se asentaa itsensä hakemistoon C:\Program Files\Trend Micro\HijackThis.
    * Klikkaa Install.
    * Asennusohjelma luo HijackThis-kuvakkeen työpöydälle.
    * Kun asennus on valmis, se käynnistää HijackThisin.
    * Klikkaa Do a system scan and save a logfile-painiketta. Ohjelma aloittaa skannauksen ja lokin pitäisi avautua Muistioon.
    * Klikkaa ensin "Muokkaa > Valitse kaikki" sitten "Muokkaa > Kopioi" kopioidaksesi koko lokin sisällön.
    * Liitä lokin sisältö seuraavaan vastaukseesi.
    * ÄLÄ käytä Analyse This-nappulaa, sen löydöt ovat vaarallisia väärinymmärrettyinä.
    * ÄLÄ fixaa HijackThis-ohjelmalla vielä mitään. Suurin osa sen löydöistä ovat joko harmittomia tai jopa tarpeellisia.
     
    Last edited by a moderator: Jun 3, 2008
    Hujo, Jun 3, 2008
    #2
  3. Koppis1

    Koppis1 Member

    Joined:
    Jun 26, 2007
    Messages:
    77
    Likes Received:
    0
    Trophy Points:
    16
    Ok :D
    Teen ComboFixin kohta, kunhan malwarescan on valmis.

    EDIT:Tai ääh, teen sen nyt, kun on vähän kiire
     
    Last edited: Jun 3, 2008
    Koppis1, Jun 3, 2008
    #3
  4. Hujo

    Hujo Guest

    Nimee se vielä kun tuossa oot nimennyt

    C:\Program Files\HiJackThis_v2\hoojiitee.exe
     
    Last edited by a moderator: Jun 3, 2008
    Hujo, Jun 3, 2008
    #4
  5. Koppis1

    Koppis1 Member

    Joined:
    Jun 26, 2007
    Messages:
    77
    Likes Received:
    0
    Trophy Points:
    16
    Tässä on combofix loki. Sitten perään vielä Hjt loki.
    Onko jo puhdasta?




    ComboFix 08-06-01.6 - Koppis 2008-06-03 19:09:08.5 - NTFSx86
    Microsoft Windows XP Professional 5.1.2600.2.1252.1.1035.18.882 [GMT 3:00]
    Running from: C:\Documents and Settings\Koppis\Työpöytä\ComboFix.exe
    * Resident AV is active


    WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
    .

    (((((((((((((((((((((((((((((((((((((( Muut poistot ))))))))))))))))))))))))))))))))))))))))))))))))))))))))
    .

    C:\WINDOWS\BMdff93d00.xml
    C:\WINDOWS\pskt.ini
    C:\WINDOWS\service.exe
    C:\WINDOWS\system32\abghewkr.dll
    C:\WINDOWS\system32\aeajhnuj.dll
    C:\WINDOWS\system32\bqubwbdd.dll
    C:\WINDOWS\system32\fnrfoals.dll
    C:\WINDOWS\system32\fvawsnht.dll
    C:\WINDOWS\system32\geBtTKDv.dll
    C:\WINDOWS\system32\gvojukld.dll
    C:\WINDOWS\system32\hvilbmhy.dll
    C:\WINDOWS\system32\keybomcn.ini
    C:\WINDOWS\system32\khfGAtUO.dll
    C:\WINDOWS\system32\ncmobyek.dll
    C:\WINDOWS\system32\ofddqmrj.exe
    C:\WINDOWS\system32\opnnollm.dll
    C:\WINDOWS\system32\rqRIcyXR.dll
    C:\WINDOWS\system32\rqRiIxuU.dll
    C:\WINDOWS\system32\tuvWonkH.dll
    C:\WINDOWS\system32\vDKTtBeg.ini
    C:\WINDOWS\system32\vDKTtBeg.ini2
    C:\WINDOWS\system32\vtUolMgh.dll
    C:\WINDOWS\system32\vurqnwri.dll
    C:\WINDOWS\system32\xhfxfqiv.exe
    .
    ---- Previous Run -------
    .
    C:\setup.exe
    C:\WINDOWS\pskt.ini

    .
    ((((( Tiedostot, jotka on luotu seuraavalla aikav„lill„: 2008-05-03 to 2008-06-03 )))))))))))))))))
    .

    2008-06-03 19:06 . 2008-06-03 19:06 86,548 --a------ C:\setz.exe
    2008-06-03 19:05 . 2008-06-03 19:05 4,217 --a------ C:\WINDOWS\is154890.exe
    2008-06-03 14:27 . 2008-06-03 14:27 60,114 --a------ C:\bot1.exe
    2008-06-03 13:21 . 2008-06-03 13:21 244 --ah----- C:\sqmnoopt16.sqm
    2008-06-03 13:21 . 2008-06-03 13:21 232 --ah----- C:\sqmdata16.sqm
    2008-06-03 13:14 . 2008-06-03 13:14 244 --ah----- C:\sqmnoopt15.sqm
    2008-06-03 13:14 . 2008-06-03 13:14 232 --ah----- C:\sqmdata15.sqm
    2008-06-03 13:13 . 2008-06-03 13:13 <KANSIO> d-------- C:\Documents and Settings\Vilpponen\Application Data\Malwarebytes
    2008-06-02 22:29 . 2008-06-02 22:29 97,116 --a------ C:\WINDOWS\DC5177176.zip
    2008-06-02 21:41 . 2008-06-02 21:41 96,950 -r-hs---- C:\WINDOWS\mservice.exe
    2008-06-01 23:33 . 2008-06-01 23:33 <KANSIO> d-------- C:\Program Files\Live_TV
    2008-06-01 23:30 . 2008-06-01 23:56 <KANSIO> d-------- C:\Program Files\3GP Converter 2007
    2008-06-01 23:30 . 2008-06-01 23:30 54,156 --ah----- C:\WINDOWS\QTFont.qfn
    2008-06-01 23:30 . 2008-06-01 23:30 1,409 --a------ C:\WINDOWS\QTFont.for
    2008-06-01 23:13 . 2008-06-01 23:13 3,758,036 --a------ C:\spore.3gp
    2008-06-01 23:09 . 2008-06-01 23:09 <KANSIO> d-------- C:\Program Files\WinAVI MP4 Converter
    2008-06-01 21:37 . 2008-06-01 21:37 <KANSIO> d-------- C:\Program Files\SmartFTP Client 3.0 Setup Files
    2008-06-01 21:37 . 2008-06-01 21:37 <KANSIO> d-------- C:\Program Files\SmartFTP Client
    2008-06-01 21:37 . 2008-06-01 21:37 <KANSIO> d-------- C:\Documents and Settings\Koppis\Application Data\SmartFTP
    2008-05-31 15:37 . 2008-05-31 15:37 0 --ah----- C:\WINDOWS\system32\drivers\Msft_Kernel_NuidFltr_01005.Wdf
    2008-05-31 15:36 . 2004-09-14 16:11 21,504 --a------ C:\WINDOWS\system32\drivers\hidserv.dll
    2008-05-31 10:46 . 2008-05-31 10:47 1,646,766 --a------ C:\We_hold_these_truths.flv.MP3.OGG
    2008-05-31 10:45 . 2008-05-31 10:46 558,088 --a------ C:\The Flight of the Bumble Bee.flv.MP3.OGG
    2008-05-31 10:44 . 2008-05-31 10:45 2,007,871 --a------ C:\Speed metal messiah.flv.MP3.OGG
    2008-05-31 10:43 . 2008-05-31 10:44 2,315,607 --a------ C:\necro.ogg.MP3.OGG
    2008-05-31 10:42 . 2008-05-31 10:43 2,297,579 --a------ C:\Jerryc - Canon Rock (Guitar Play).mp3.OGG
    2008-05-31 10:40 . 2008-05-31 10:42 3,361,200 --a------ C:\Dragonforce - Revolution Deathsquad.mp3.OGG
    2008-05-31 10:38 . 2008-05-31 10:40 2,260,120 --a------ C:\06 - Wedding Nails mp3.mp3.OGG
    2008-05-31 10:37 . 2008-05-31 10:38 2,090,948 --a------ C:\01 Black Dog.mp3.OGG
    2008-05-31 10:35 . 2008-05-31 10:37 2,797,956 --a------ C:\Wedding_Nails.mp3.OGG
    2008-05-31 10:29 . 2008-05-31 10:29 1,257,221 --a------ C:\The Flight of the Bumble Bee.flv.MP3
    2008-05-31 10:28 . 2008-05-31 10:28 5,231,595 --a------ C:\Corpse_tumor.flv.MP3
    2008-05-31 10:28 . 2008-05-31 10:29 4,536,111 --a------ C:\Speed metal messiah.flv.MP3
    2008-05-31 10:27 . 2008-05-31 10:27 7,047,627 --a------ C:\We_hold_these_truths.flv.MP3
    2008-05-30 17:50 . 2008-05-30 17:50 <KANSIO> d-------- C:\Program Files\Webteh
    2008-05-30 17:49 . 2008-05-30 17:49 9,380,296 --a------ C:\Program Files\bsplayer228.964_clip.exe
    2008-05-30 14:38 . 2008-05-30 14:38 <KANSIO> d-------- C:\WINDOWS\system32\Clickteam
    2008-05-30 14:38 . 2008-05-30 14:38 <KANSIO> d-------- C:\Documents and Settings\Koppis\Application Data\Clickteam
    2008-05-29 21:05 . 2008-05-29 21:05 <KANSIO> d-------- C:\Documents and Settings\Mirja Vilpponen\Application Data\DigitalPersona
    2008-05-29 18:26 . 2008-05-29 18:26 <KANSIO> d-------- C:\Documents and Settings\Vilpponen\Application Data\DigitalPersona
    2008-05-29 18:26 . 2008-05-29 18:26 <KANSIO> d-------- C:\Documents and Settings\Vilpponen\Application Data\ATI
    2008-05-29 10:32 . 2008-06-03 13:54 <KANSIO> d-------- C:\Program Files\Malwarebytes' Anti-Malware
    2008-05-29 10:32 . 2008-05-29 10:32 <KANSIO> d-------- C:\Documents and Settings\Koppis\Application Data\Malwarebytes
    2008-05-29 10:32 . 2008-05-29 10:32 <KANSIO> d-------- C:\Documents and Settings\All Users\Application Data\Malwarebytes
    2008-05-29 10:32 . 2008-05-30 01:06 34,296 --a------ C:\WINDOWS\system32\drivers\mbamcatchme.sys
    2008-05-29 10:32 . 2008-05-30 01:06 15,864 --a------ C:\WINDOWS\system32\drivers\mbam.sys
    2008-05-28 22:22 . 2008-05-28 22:22 <KANSIO> d-------- C:\Program Files\Trend Micro
    2008-05-28 21:41 . 2008-05-28 21:41 2,855 --a------ C:\ComboFix.PIF
    2008-05-28 21:31 . 2008-05-28 21:31 0 --a------ C:\ComboFix.exe
    2008-05-28 20:29 . 2008-06-03 13:50 <KANSIO> d-------- C:\Program Files\HiJackThis_v2
    2008-05-28 20:16 . 2008-05-28 20:28 <KANSIO> d-------- C:\WINDOWS\BDOSCAN8
    2008-05-28 18:05 . 2008-05-28 18:05 <KANSIO> d-------- C:\Documents and Settings\Koppis\Application Data\DigitalPersona
    2008-05-28 17:58 . 2008-05-28 17:58 <KANSIO> d-------- C:\WINDOWS\DPDrv
    2008-05-28 17:58 . 2008-05-28 17:58 <KANSIO> d-------- C:\Program Files\DigitalPersona
    2008-05-28 17:26 . 2008-05-28 17:26 <KANSIO> d-------- C:\Program Files\DP10-002
    2008-05-28 17:26 . 2008-05-28 17:26 2,334,453 --a------ C:\Program Files\DP10-002.zip
    2008-05-28 16:43 . 2008-05-28 16:43 8,579,136 --a------ C:\Program Files\DPPM_201_ENG.exe
    2008-05-28 16:04 . 2007-08-31 12:15 18,856 --a------ C:\WINDOWS\system32\drivers\nuidfltr.sys
    2008-05-28 16:03 . 2008-05-28 16:39 <KANSIO> d-------- C:\Program Files\Microsoft IntelliType Pro
    2008-05-28 15:48 . 2004-09-14 16:11 21,504 --a------ C:\WINDOWS\system32\hidserv.dll
    2008-05-28 15:48 . 2004-09-14 16:11 21,504 --a--c--- C:\WINDOWS\system32\dllcache\hidserv.dll
    2008-05-27 21:48 . 2008-05-27 21:48 3,510,857 --a------ C:\SMB2AV.MP3
    2008-05-27 21:48 . 2008-05-27 21:48 2,069,315 --a------ C:\FB.MP3
    2008-05-27 21:47 . 2008-05-27 21:48 3,554,742 --a------ C:\SMBAV.MP3
    2008-05-27 08:32 . 2008-05-27 08:32 <KANSIO> d-------- C:\Documents and Settings\Mirja Vilpponen\Application Data\ATI
    2008-05-25 21:05 . 2008-05-29 16:55 <KANSIO> d-------- C:\Program Files\Cheat Engine
    2008-05-25 21:05 . 2007-12-26 17:30 1,970,176 --a------ C:\WINDOWS\system32\d3dx9.dll
    2008-05-25 21:05 . 2007-12-26 17:30 679,936 --a------ C:\WINDOWS\system32\D3DX81ab.dll
    2008-05-22 22:13 . 2008-05-22 22:13 <KANSIO> d-------- C:\Program Files\Octoshape Streaming Services
    2008-05-22 15:11 . 2008-05-22 17:12 <KANSIO> d-------- C:\Program Files\mIRC
    2008-05-22 15:11 . 2008-05-22 17:16 <KANSIO> d-------- C:\Documents and Settings\Koppis\Application Data\mIRC
    2008-05-21 14:57 . 2008-06-03 14:14 31 --a------ C:\WINDOWS\system32\bbcap.err
    2008-05-21 14:56 . 2008-05-21 14:56 <KANSIO> d-------- C:\Documents and Settings\Koppis\Application Data\ATI
    2008-05-21 14:56 . 2008-05-21 14:56 <KANSIO> d-------- C:\Documents and Settings\All Users\Application Data\ATI
    2008-05-18 18:49 . 2008-05-18 18:49 <KANSIO> d-------- C:\Program Files\Mioplanet
    2008-05-18 18:49 . 2008-05-18 18:49 <KANSIO> d-------- C:\Documents and Settings\Koppis\Application Data\mioObjects
    2008-05-18 18:49 . 2008-05-18 18:49 407,047 --a------ C:\WINDOWS\system32\mioengine.exe
    2008-05-18 12:30 . 2008-05-18 12:30 <KANSIO> d-------- C:\Program Files\eRightSoft
    2008-05-18 12:30 . 2006-09-12 14:46 227,328 -r-hs---- C:\WINDOWS\system32\ac3DX.ax
    2008-05-18 12:30 . 2006-05-03 13:06 163,328 -r-hs---- C:\WINDOWS\system32\flvDX.dll
    2008-05-18 12:30 . 2008-02-04 22:26 151,040 ---hs---- C:\WINDOWS\system32\VistaUltm.dll
    2008-05-18 12:30 . 2006-01-13 02:23 123,904 -r-hs---- C:\WINDOWS\system32\AVCDX.ax
    2008-05-18 12:30 . 2003-11-21 02:00 54,784 -r-hs---- C:\WINDOWS\system32\RLAPEDec.ax
    2008-05-18 12:30 . 2004-04-27 02:00 37,888 -r-hs---- C:\WINDOWS\system32\RLMPCDec.ax
    2008-05-18 12:30 . 2007-02-21 14:47 31,232 -r-hs---- C:\WINDOWS\system32\msfDX.dll
    2008-05-18 12:30 . 2007-12-17 16:43 27,648 ---hs---- C:\WINDOWS\system32\Smab0.dll
    2008-05-18 12:30 . 2008-02-05 20:04 9,884 ---h----- C:\WINDOWS\super.chm
    2008-05-18 12:07 . 2008-05-18 12:07 <KANSIO> d-------- C:\Program Files\NCH Software
    2008-05-18 12:07 . 2008-05-18 12:07 <KANSIO> d-------- C:\Documents and Settings\Koppis\Application Data\NCH Swift Sound
    2008-05-18 12:07 . 2008-05-18 12:07 <KANSIO> d-------- C:\Documents and Settings\Koppis\Application Data\NCH Software
    2008-05-18 12:07 . 2008-05-18 12:07 <KANSIO> d-------- C:\Documents and Settings\All Users\Application Data\NCH Software
    2008-05-17 22:48 . 2007-10-12 15:14 3,734,536 --a------ C:\WINDOWS\system32\d3dx9_36.dll
    2008-05-13 07:34 . 2008-05-13 07:34 <KANSIO> d-------- C:\Program Files\Screen Recorder Gold

    .
    (((((((((((((((((((((((((((((((((((( Find3M-raportti ))))))))))))))))))))))))))))))))))))))))))))))))))))))
    .
    2008-06-03 16:23 --------- d-----w C:\Program Files\PeerGuardian2
    2008-06-03 16:22 --------- d-----w C:\Documents and Settings\Koppis\Application Data\Skype
    2008-06-02 19:35 --------- d-----w C:\Program Files\RevConnect
    2008-05-29 19:20 107,888 ----a-w C:\WINDOWS\system32\CmdLineExt.dll
    2008-05-28 17:01 --------- d---a-w C:\Documents and Settings\All Users\Application Data\TEMP
    2008-05-28 14:57 --------- d-----w C:\Program Files\Common Files\Wise Installation Wizard
    2008-05-22 11:36 --------- d-----w C:\Program Files\ATI
    2008-05-21 11:51 --------- d-----w C:\Program Files\ATI Technologies
    2008-05-21 11:50 --------- d--h--w C:\Program Files\InstallShield Installation Information
    2008-05-18 09:07 --------- d-----w C:\Program Files\NCH Swift Sound
    2008-05-18 09:00 --------- d-----w C:\Program Files\CamStudio
    2008-05-17 19:48 413,696 ----a-w C:\WINDOWS\system32\wrap_oal.dll
    2008-05-17 19:48 110,592 ----a-w C:\WINDOWS\system32\OpenAL32.dll
    2008-05-06 18:30 --------- d-----w C:\Program Files\Windows Live Safety Center
    2008-04-30 17:22 --------- d-----w C:\Documents and Settings\All Users\Application Data\Ubisoft
    2008-04-26 09:33 --------- d-----w C:\Program Files\Java
    2008-04-21 14:35 --------- d-----w C:\Program Files\HardCopy Pro
    2008-04-21 14:35 --------- d-----w C:\Documents and Settings\Koppis\Application Data\DeskSoft
    2008-04-16 13:40 --------- d-----w C:\Program Files\Winamp
    2008-04-16 13:29 --------- d-----w C:\Program Files\Game_Maker7
    2008-04-16 12:54 8,990,072 ----a-w C:\Program Files\winamp5531_full_emusic-7plus_en-us.exe
    2008-04-15 18:59 --------- d-----w C:\Program Files\Lavalys
    2008-04-15 16:12 --------- d-----w C:\Documents and Settings\Vilpponen\Application Data\The Hobbit
    2008-04-12 16:25 --------- d-----w C:\Program Files\Guitar Pro 5
    2008-04-09 13:49 --------- d-----w C:\Documents and Settings\Vilpponen\Application Data\Skype
    2008-04-06 15:42 --------- d-----w C:\Documents and Settings\Mirja Vilpponen\Application Data\Skype
    2008-03-29 05:19 9,801,728 ----a-w C:\WINDOWS\system32\atioglx2.dll
    2008-03-29 04:40 167,936 ----a-w C:\WINDOWS\system32\atiok3x2.dll
    2008-03-29 04:05 372,736 ----a-w C:\WINDOWS\system32\ATIDEMGX.dll
    2008-03-29 04:04 299,008 ----a-w C:\WINDOWS\system32\ati2dvag.dll
    2008-03-29 03:56 172,032 ----a-w C:\WINDOWS\system32\atipdlxx.dll
    2008-03-29 03:56 126,976 ----a-w C:\WINDOWS\system32\Oemdspif.dll
    2008-03-29 03:55 43,520 ----a-w C:\WINDOWS\system32\ati2edxx.dll
    2008-03-29 03:55 26,112 ----a-w C:\WINDOWS\system32\Ati2mdxx.exe
    2008-03-29 03:55 126,976 ----a-w C:\WINDOWS\system32\ati2evxx.dll
    2008-03-29 03:54 536,576 ----a-w C:\WINDOWS\system32\ati2evxx.exe
    2008-03-29 03:52 53,248 ----a-w C:\WINDOWS\system32\ATIDDC.DLL
    2008-03-29 03:43 3,176,480 ----a-w C:\WINDOWS\system32\ati3duag.dll
    2008-03-29 03:39 307,200 ----a-w C:\WINDOWS\system32\atiiiexx.dll
    2008-03-29 03:36 1,765,120 ----a-w C:\WINDOWS\system32\ativvaxx.dll
    2008-03-29 03:24 46,080 ----a-w C:\WINDOWS\system32\amdpcom32.dll
    2008-03-29 03:23 5,439,488 ----a-w C:\WINDOWS\system32\atioglxx.dll
    2008-03-29 03:21 393,216 ----a-w C:\WINDOWS\system32\atikvmag.dll
    2008-03-29 03:19 17,408 ----a-w C:\WINDOWS\system32\atitvo32.dll
    2008-03-29 03:12 520,192 ----a-w C:\WINDOWS\system32\ati2cqag.dll
    2008-03-28 18:05 593,920 ------w C:\WINDOWS\system32\ati2sgag.exe
    2008-03-25 04:51 621,344 ----a-w C:\WINDOWS\system32\mswstr10.dll
    2008-03-25 04:51 166,688 ----a-w C:\WINDOWS\system32\msjint40.dll
    2008-03-23 22:48 219 ----a-w C:\Documents and Settings\Vilpponen\hsqlprefs.dat
    2008-03-20 08:09 1,845,504 ----a-w C:\WINDOWS\system32\win32k.sys
    2008-03-14 13:16 43,520 ----a-w C:\WINDOWS\system32\CmdLineExt03.dll
    2008-03-10 18:16 22,328 ----a-w C:\Documents and Settings\Koppis\Application Data\PnkBstrK.sys
    2008-03-10 18:15 669,184 ----a-w C:\WINDOWS\system32\pbsvc.exe
    2008-03-10 18:15 66,872 ----a-w C:\WINDOWS\system32\PnkBstrA.exe
    2008-03-10 18:15 103,736 ----a-w C:\WINDOWS\system32\PnkBstrB.exe
    2008-03-04 21:06 24 ----a-w C:\juttelitoimii.bat
    2008-03-04 20:59 56 ----a-w C:\jutteli.bat
    2008-03-04 20:57 185 ----a-w C:\Copybmp.bat
    2008-03-04 11:31 84,526,232 ----a-w C:\Program Files\moviestudio80c-trial_enu.exe
    2008-03-02 18:51 2,699,171 ----a-w C:\Program Files\ccleaner_v2.05.555.zip
    2008-01-05 20:09 630,768 ----a-w C:\Program Files\eval-nwc.exe
    2007-12-15 11:37 8,454,584 ----a-w C:\Program Files\winamp55_full_emusic-7plus_en-us.exe
    2007-11-30 12:40 34,556,560 ----a-w C:\Program Files\QCCSENU.EXE
    2007-11-05 12:11 5,858 ----a-w C:\Program Files\install.log
    2007-11-05 12:10 487,377 ----a-w C:\Program Files\GameSpot_Download_Manager.exe
    2007-08-02 08:39 6,221,304 ----a-w C:\Program Files\winamp535_full_emusic-7plus.exe
    2007-07-10 08:50 1 ----a-w C:\Documents and Settings\Koppis\SI.bin
    2007-06-03 16:33 2,601,692 ----a-w C:\Program Files\mp3wavconverter.exe
    2007-06-01 12:28 1,980,533 ----a-w C:\Program Files\registrymedic.exe
    2007-04-27 14:23 1,205,365 ----a-w C:\Program Files\wrar37b7.exe
    2007-02-13 14:00 19,666,504 ----a-w C:\Program Files\QuickTimeInstaller.exe
    2007-02-07 19:11 643,144 ----a-w C:\Program Files\XviD-1.1.2-01112006.exe
    2007-01-27 20:20 1,063,810 ----a-w C:\Program Files\subedit.zip
    2006-11-30 12:46 1,410,680 ----a-w C:\Program Files\install_flash_player.exe
    2006-11-28 15:57 6,052,528 ----a-w C:\Program Files\FirefoxGoogleToolbarSetup.exe
    2006-11-26 16:21 29,172 -c--a-w C:\Program Files\Da-Vinci-Tour.kmz
    2006-11-26 15:52 14,879,120 ----a-w C:\Program Files\GoogleEarthWin.exe
    2006-11-25 18:05 2,855,080 ----a-w C:\Program Files\aawsepersonal.exe
    2006-11-23 13:07 362,496 ----a-w C:\Program Files\switchsetup.exe
    2006-11-10 14:15 11,284,970 ----a-w C:\Program Files\cdbxp_setup_3.0.116.zip
    2006-11-08 17:19 16,198,952 ----a-w C:\Program Files\Install_Messenger.exe
    2006-11-04 15:57 6,624,984 ----a-w C:\Program Files\winamp531_full_emusic-7plus.exe
    2006-11-04 15:52 3,262,369 ----a-w C:\Program Files\ALZip.exe
    2006-11-04 14:08 6,579,696 ----a-w C:\Program Files\Opera_9.02_International_Setup.exe
    2006-05-03 10:06 163,328 --sh--r C:\WINDOWS\system32\flvDX.dll
    2007-02-21 11:47 31,232 --sh--r C:\WINDOWS\system32\msfDX.dll
    2007-12-17 13:43 27,648 --sh--w C:\WINDOWS\system32\Smab0.dll
    2008-02-04 19:26 151,040 --sh--w C:\WINDOWS\system32\VistaUltm.dll
    .

    (((((((((((((((((((((((((((((( Rekisterin k„ynnistyskohteet )))))))))))))))))))))))))))))))))))))))))))))
    .
    .
    REGEDIT4
    *Huom* Tyhji„ arvoja ja laillisia oletusarvoja ei n„ytet„

    [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "MsnMsgr"="C:\Program Files\Windows Live\Messenger\MsnMsgr.exe" [ ]
    "Skype"="C:\Program Files\Skype\Phone\Skype.exe" [2006-12-11 21:41 25343016]
    "igndlm.exe"="C:\Program Files\Download Manager\DLM.exe" [2007-03-06 00:57 1103480]
    "PeerGuardian"="C:\Program Files\PeerGuardian2\pg2.exe" [2005-09-18 18:40 1421824]
    "LogitechSoftwareUpdate"="C:\Program Files\Logitech\Video\ManifestEngine.exe" [2005-06-08 15:44 196608]
    "Octoshape Streaming Services"="C:\Program Files\Octoshape Streaming Services\Koppis\OctoshapeClient.exe" [2006-02-13 19:33 214648]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "HotKeysCmds"="C:\WINDOWS\system32\hkcmd.exe" [2006-08-14 15:41 114688]
    "High Definition Audio -ominaisuussivun pikakuvake"="HDAShCut.exe" [2005-01-07 18:07 61952 C:\WINDOWS\system32\HdAShCut.exe]
    "F-Secure Manager"="C:\Program Files\F-Secure\Common\FSM32.exe" [2005-10-26 04:51 122929]
    "F-Secure TNB"="C:\Program Files\F-Secure\TNB\TNBUtil.exe" [2004-05-27 11:57 684032]
    "DLA"="C:\WINDOWS\System32\DLA\DLACTRLW.EXE" [2005-09-28 06:10 122940]
    "LVCOMSX"="C:\WINDOWS\system32\LVCOMSX.EXE" [2005-07-19 18:32 221184]
    "RTHDCPL"="RTHDCPL.EXE" [2006-10-11 18:36 16267776 C:\WINDOWS\RTHDCPL.exe]
    "LogitechVideoRepair"="C:\Program Files\Logitech\Video\ISStart.exe" [2005-06-08 16:24 458752]
    "LogitechVideoTray"="C:\Program Files\Logitech\Video\LogiTray.exe" [2005-06-08 16:14 217088]
    "DAEMON Tools"="C:\Program Files\DAEMON Tools\daemon.exe" [2006-09-14 23:09 157592]
    "StartCCC"="C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2008-01-21 12:17 61440]
    "itype"="c:\Program Files\Microsoft IntelliType Pro\itype.exe" [2007-08-31 12:13 988584]
    "DPAgnt"="C:\Program Files\DigitalPersona\Bin\DPAgnt.exe" [2006-10-09 16:27 807440]
    "Windows svchost"="service.exe" []

    [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
    "CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2006-03-02 15:00 15360]

    [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\ckpNotify]
    ckpNotify.dll 2005-03-01 20:49 24672 C:\WINDOWS\system32\ckpNotify.dll

    [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\DPWLN ]
    C:\WINDOWS\system32\DPWLEvHd.dll 2006-10-09 16:27 99856 C:\WINDOWS\system32\DPWLEvHd.dll

    [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
    "VIDC.I420"= i420vfw.dll
    "vidc.yv12"= yv12vfw.dll

    [HKEY_LOCAL_MACHINE\software\microsoft\security center]
    "AntiVirusDisableNotify"=dword:00000001
    "UpdatesDisableNotify"=dword:00000001
    "FirewallOverride"=dword:00000001

    [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
    "EnableFirewall"= 0 (0x0)

    [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
    "%windir%\\system32\\sessmgr.exe"=
    "C:\\Program Files\\F-Secure\\BackWeb\\7681197\\program\\F-Secure Automatic Update.exe"=
    "C:\\Program Files\\CheckPoint\\SecuRemote\\bin\\SR_Service.exe"=
    "C:\\Program Files\\CheckPoint\\SecuRemote\\bin\\SR_GUI.exe"=
    "C:\\Program Files\\CheckPoint\\SecuRemote\\bin\\scc.exe"=
    "C:\\Program Files\\CheckPoint\\SecuRemote\\bin\\SR_SDS.exe"=
    "C:\\Program Files\\CheckPoint\\SecuRemote\\bin\\SR_Diagnostics.exe"=
    "C:\\Program Files\\uTorrent\\uTorrent.exe"=
    "C:\\WINDOWS\\system32\\dplaysvr.exe"=
    "C:\\Pelit\\Settlers3\\s3.exe"=
    "C:\\Pelit\\Crysis\\Bin32\\Crysis.exe"=
    "C:\\Pelit\\Crysis\\Bin32\\CrysisDedicatedServer.exe"=
    "C:\\WINDOWS\\system32\\PnkBstrA.exe"=
    "C:\\WINDOWS\\system32\\PnkBstrB.exe"=
    "C:\\Program Files\\SmartFTP Client\\SmartFTP.exe"=
    "C:\\Program Files\\Skype\\Phone\\Skype.exe"=

    [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
    "9278:TCP"= 9278:TCP:BitComet 9278 TCP
    "9278:UDP"= 9278:UDP:BitComet 9278 UDP

    R0 FSFW;F-Secure Firewall Driver;C:\WINDOWS\system32\drivers\fsdfw.sys [2005-10-31 13:01]
    R1 bbcap;bbcap;C:\WINDOWS\system32\DRIVERS\bbcap.sys [2007-06-24 23:03]
    R2 BackWeb Plug-in - 7681197;F-Secure Automatic Update;C:\PROGRA~1\F-Secure\BackWeb\7681197\Program\SERVIC~1.EXE [2006-10-31 16:53]
    R2 F-Secure Filter;F-Secure File System Filter;C:\Program Files\F-Secure\Anti-Virus\Win2K\FSfilter.sys [2005-08-19 16:37]
    R2 F-Secure Gatekeeper;F-Secure Gatekeeper;C:\Program Files\F-Secure\Anti-Virus\Win2K\FSgk.sys [2005-10-06 17:30]
    R2 F-Secure Recognizer;F-Secure File System Recognizer;C:\Program Files\F-Secure\Anti-Virus\Win2K\FSrec.sys [2005-08-19 16:37]
    R2 Scap;SecureClient Application Policy Module;C:\WINDOWS\system32\DRIVERS\Scap.sys [2005-03-01 20:49]
    R2 SVKP;SVKP;C:\WINDOWS\system32\SVKP.sys [2007-06-01 15:28]
    R2 UxTuneUp;TuneUp Theme Extension;C:\WINDOWS\System32\svchost.exe [2006-03-02 15:00]
    R3 dpK0Bx01;Fingerprint Reader Filter Driver;C:\WINDOWS\system32\DRIVERS\dpK0Bx01.sys [2006-09-16 17:25]
    R3 FW1;SecuRemote Miniport;C:\WINDOWS\system32\DRIVERS\fw.sys [2005-03-01 20:49]
    R3 usbdpfp;Fingerprint Reader Class Driver;C:\WINDOWS\system32\DRIVERS\usbdpfp.sys [2006-09-16 17:23]
    S0 stwlfbus;stwlfbus;C:\WINDOWS\system32\DRIVERS\stwlfbus.sys [2003-04-27 13:39]
    S3 ggflt;SEMC USB Flash Driver Filter;C:\WINDOWS\system32\DRIVERS\ggflt.sys [2008-02-16 21:03]
    S3 gsplittm;gsplittm;C:\DOCUME~1\Koppis\LOCALS~1\Temp\gsplittm.sys []
    S3 OMVA;VPN-1 SecureClient Adapter;C:\WINDOWS\system32\DRIVERS\OMVA.sys [2005-03-01 20:49]
    S3 st3wolf;st3wolf;C:\WINDOWS\system32\DRIVERS\st3wolf.sys [2003-04-27 12:43]
    S3 w200bus;Sony Ericsson W200 driver (WDM);C:\WINDOWS\system32\DRIVERS\w200bus.sys [2006-11-07 10:42]
    S3 w200mdfl;Sony Ericsson W200 USB WMC Modem Filter;C:\WINDOWS\system32\DRIVERS\w200mdfl.sys [2006-11-07 10:42]
    S3 w200mdm;Sony Ericsson W200 USB WMC Modem Driver;C:\WINDOWS\system32\DRIVERS\w200mdm.sys [2006-11-07 10:42]
    S3 w200mgmt;Sony Ericsson W200 USB WMC Device Management Drivers (WDM);C:\WINDOWS\system32\DRIVERS\w200mgmt.sys [2006-11-07 10:42]
    S3 w200obex;Sony Ericsson W200 USB WMC OBEX Interface;C:\WINDOWS\system32\DRIVERS\w200obex.sys [2006-11-07 10:42]

    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost - NetSvcs
    UxTuneUp

    [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{86167224-b6ba-11dc-8548-0016350dc46d}]
    \Shell\AutoRun\command - I:\PortableApps\PortableAppsMenu\PortableAppsMenu.exe

    .
    'Ajoitetut teht„v„t'-kansion sis„lt”
    "2008-05-30 14:17:09 C:\WINDOWS\Tasks\1-Click Maintenance.job"
    - C:\Program Files\TuneUp Utilities 2007\SystemOptimizer.exe
    "2007-02-13 14:00:42 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job"
    - C:\Program Files\Apple Software Update\SoftwareUpdate.exe
    "2008-06-03 10:06:49 C:\WINDOWS\Tasks\Scheduled scanning task.job"
    - C:\PROGRA~1\F-Secure\ANTI-V~1\fsav.exeZ /HARD /ARCHIVE /DISINF /SCHED /NOBREAK /REPORT=C:\PROGRA~1\F-Secure\ANTI-V~1\report.txt
    .
    **************************************************************************

    catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
    Rootkit scan 2008-06-03 19:20:28
    Windows 5.1.2600 Service Pack 2 NTFS

    scanning hidden processes ...

    scanning hidden autostart entries ...

    scanning hidden files ...

    scan completed successfully
    hidden files: 0

    **************************************************************************
    .
    ------------------------ Other Running Processes ------------------------
    .
    C:\WINDOWS\system32\ati2evxx.exe
    C:\WINDOWS\system32\ati2evxx.exe
    C:\Program Files\DigitalPersona\Bin\DPWinLct.exe
    C:\WINDOWS\system32\drivers\CDAC11BA.EXE
    C:\Program Files\DigitalPersona\Bin\DpHost.exe
    C:\Program Files\F-Secure\Anti-Virus\fsgk32st.exe
    C:\Program Files\F-Secure\Anti-Virus\fsgk32.exe
    C:\Program Files\F-Secure\BackWeb\7681197\program\fsbwsys.exe
    C:\Program Files\F-Secure\Anti-Virus\fssm32.exe
    C:\Program Files\F-Secure\common\FSMA32.EXE
    C:\Program Files\F-Secure\common\FSMB32.EXE
    C:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\SMSvcHost.exe
    C:\Program Files\F-Secure\common\FCH32.EXE
    C:\WINDOWS\system32\PnkBstrA.exe
    C:\Program Files\CheckPoint\SecuRemote\bin\SR_Service.exe
    C:\Program Files\CheckPoint\SecuRemote\bin\SR_Watchdog.exe
    C:\Program Files\F-Secure\common\FAMEH32.EXE
    C:\Program Files\F-Secure\Anti-Virus\fsqh.exe
    C:\Program Files\F-Secure\Anti-Virus\FSRW.exe
    C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe
    C:\WINDOWS\system32\wdfmgr.exe
    C:\WINDOWS\system32\UAService7.exe
    C:\Program Files\DigitalPersona\Bin\DPFUSMgr.exe
    C:\Program Files\F-Secure\Anti-Virus\FSAV32.exe
    C:\Program Files\F-Secure\common\FNRB32.exe
    C:\Program Files\F-Secure\FWES\program\fsdfwd.exe
    C:\Program Files\F-Secure\common\FIH32.exe
    C:\Program Files\CheckPoint\SecuRemote\bin\SR_GUI.exe
    C:\PROGRA~1\F-Secure\ANTI-S~1\FSAW.exe
    C:\Program Files\F-Secure\FSGUI\fsguidll.exe
    C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
    C:\Program Files\Microsoft IntelliType Pro\dpupdchk.exe
    C:\Program Files\Logitech\Video\FxSvr2.exe
    C:\Program Files\F-Secure\BackWeb\7681197\program\F-Secure Automatic Update.exe
    C:\Program Files\Common Files\Sonic Shared\CineTray.exe
    C:\Program Files\Skype\Plugin Manager\skypePM.exe
    C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CCC.exe
    .
    **************************************************************************
    .
    Completion time: 2008-06-03 19:29:12 - machine was rebooted [Koppis]
    ComboFix-quarantined-files.txt 2008-06-03 16:29:07
    ComboFix2.txt 2008-05-29 11:02:29

    Pre-Run: 25,366,937,600 tavua vapaana
    Post-Run: 25,372,700,672 tavua vapaana

    380 --- E O F --- 2008-05-16 21:03:47


    HIJACKTHIS LOKI

    Logfile of Trend Micro HijackThis v2.0.0 (BETA)
    Scan saved at 19:32, on 3.6.2008
    Platform: Windows XP SP2 (WinNT 5.01.2600)
    Boot mode: Normal

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\Ati2evxx.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\system32\spoolsv.exe
    C:\WINDOWS\system32\Ati2evxx.exe
    C:\Program Files\DigitalPersona\Bin\DPWinLct.exe
    C:\PROGRA~1\F-Secure\BackWeb\7681197\Program\SERVIC~1.EXE
    C:\WINDOWS\system32\drivers\CDAC11BA.EXE
    C:\Program Files\DigitalPersona\Bin\DpHost.exe
    C:\Program Files\F-Secure\Anti-Virus\fsgk32st.exe
    C:\Program Files\F-Secure\Anti-Virus\FSGK32.EXE
    C:\Program Files\F-Secure\BackWeb\7681197\program\fsbwsys.exe
    C:\Program Files\F-Secure\Anti-Virus\fssm32.exe
    C:\Program Files\F-Secure\Common\FSMA32.EXE
    C:\Program Files\F-Secure\Common\FSMB32.EXE
    C:\Program Files\F-Secure\Common\FCH32.EXE
    C:\WINDOWS\system32\PnkBstrA.exe
    C:\Program Files\CheckPoint\SecuRemote\bin\SR_Service.exe
    C:\Program Files\CheckPoint\SecuRemote\bin\SR_WatchDog.exe
    C:\Program Files\F-Secure\Common\FAMEH32.EXE
    C:\Program Files\F-Secure\Anti-Virus\fsqh.exe
    C:\Program Files\F-Secure\Anti-Virus\fsrw.exe
    C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\system32\UAService7.exe
    C:\Program Files\DigitalPersona\Bin\DPFUSMgr.exe
    C:\Program Files\F-Secure\Anti-Virus\fsav32.exe
    C:\Program Files\F-Secure\Common\FNRB32.EXE
    C:\Program Files\F-Secure\FWES\Program\fsdfwd.exe
    C:\Program Files\F-Secure\Common\FIH32.EXE
    C:\Program Files\CheckPoint\SecuRemote\bin\SR_GUI.Exe
    C:\Program Files\F-Secure\Common\FSM32.EXE
    C:\PROGRA~1\F-Secure\ANTI-S~1\fsaw.exe
    C:\WINDOWS\System32\DLA\DLACTRLW.EXE
    C:\WINDOWS\system32\LVCOMSX.EXE
    C:\WINDOWS\RTHDCPL.EXE
    C:\Program Files\F-Secure\FSGUI\fsguidll.exe
    C:\Program Files\Logitech\Video\LogiTray.exe
    C:\Program Files\DAEMON Tools\daemon.exe
    C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
    C:\Program Files\Microsoft IntelliType Pro\itype.exe
    C:\Program Files\DigitalPersona\Bin\DPAgnt.exe
    C:\Program Files\Skype\Phone\Skype.exe
    c:\Program Files\Microsoft IntelliType Pro\dpupdchk.exe
    C:\Program Files\PeerGuardian2\pg2.exe
    C:\Program Files\Logitech\Video\FxSvr2.exe
    C:\Program Files\F-Secure\BackWeb\7681197\program\F-Secure Automatic Update.exe
    C:\Program Files\Common Files\Sonic Shared\CineTray.exe
    C:\Program Files\Skype\Plugin Manager\SkypePM.exe
    C:\Program Files\Octoshape Streaming Services\Koppis\OctoshapeClient.exe
    C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\ccc.exe
    C:\WINDOWS\explorer.exe
    C:\WINDOWS\system32\notepad.exe
    C:\Program Files\Mozilla Firefox\firefox.exe
    C:\Program Files\HiJackThis_v2\hoojiitee.exe

    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
    R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Linkit
    R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
    O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
    O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
    O2 - BHO: DriveLetterAccess - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\System32\DLA\DLASHX_W.DLL
    O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
    O2 - BHO: Windows Liven kirjautumisapuohjelma - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
    O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
    O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe
    O4 - HKLM\..\Run: [High Definition Audio -ominaisuussivun pikakuvake] HDAShCut.exe
    O4 - HKLM\..\Run: [F-Secure Manager] "C:\Program Files\F-Secure\Common\FSM32.EXE" /splash
    O4 - HKLM\..\Run: [F-Secure TNB] "C:\Program Files\F-Secure\TNB\TNBUtil.exe" /CHECKALL /WAITFORSW
    O4 - HKLM\..\Run: [DLA] C:\WINDOWS\System32\DLA\DLACTRLW.EXE
    O4 - HKLM\..\Run: [LVCOMSX] C:\WINDOWS\system32\LVCOMSX.EXE
    O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
    O4 - HKLM\..\Run: [LogitechVideoRepair] C:\Program Files\Logitech\Video\ISStart.exe
    O4 - HKLM\..\Run: [LogitechVideoTray] C:\Program Files\Logitech\Video\LogiTray.exe
    O4 - HKLM\..\Run: [DAEMON Tools] "C:\Program Files\DAEMON Tools\daemon.exe" -lang 1033
    O4 - HKLM\..\Run: [StartCCC] "C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe"
    O4 - HKLM\..\Run: [itype] "c:\Program Files\Microsoft IntelliType Pro\itype.exe"
    O4 - HKLM\..\Run: [DPAgnt] C:\Program Files\DigitalPersona\Bin\DPAgnt.exe
    O4 - HKLM\..\Run: [Windows svchost] service.exe
    O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background
    O4 - HKCU\..\Run: [Skype] "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized
    O4 - HKCU\..\Run: [igndlm.exe] C:\Program Files\Download Manager\DLM.exe /windowsstart /startifwork
    O4 - HKCU\..\Run: [PeerGuardian] C:\Program Files\PeerGuardian2\pg2.exe
    O4 - HKCU\..\Run: [LogitechSoftwareUpdate] "C:\Program Files\Logitech\Video\ManifestEngine.exe" boot
    O4 - HKCU\..\Run: [Octoshape Streaming Services] "C:\Program Files\Octoshape Streaming Services\Koppis\OctoshapeClient.exe" -inv:bootrun
    O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Paikallinen palve')
    O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Verkkopalve')
    O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
    O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
    O4 - Global Startup: F-Secure Automatic Update.lnk = C:\Program Files\F-Secure\BackWeb\7681197\program\F-Secure Automatic Update.exe
    O4 - Global Startup: Sonic CinePlayer Quick Launch.lnk = C:\Program Files\Common Files\Sonic Shared\CineTray.exe
    O8 - Extra context menu item: &Block this popup - C:\Program Files\F-Secure\Anti-Spyware\blockpopups.htm
    O8 - Extra context menu item: &D&ownload &with BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddLink.htm
    O8 - Extra context menu item: &D&ownload all video with BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddVideo.htm
    O8 - Extra context menu item: &D&ownload all with BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddAllLink.htm
    O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
    O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
    O9 - Extra button: IE Shield - {300DB664-75B5-47c0-8B45-A44ACCF73C00} - C:\Program Files\F-Secure\Anti-Spyware\ieshield.dll
    O9 - Extra 'Tools' menuitem: IE Shield... - {300DB664-75B5-47c0-8B45-A44ACCF73C00} - C:\Program Files\F-Secure\Anti-Spyware\ieshield.dll
    O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)
    O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)
    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - C:\Program Files\Yahoo!\Common\yinsthelper.dll
    O16 - DPF: {39B0684F-D7BF-4743-B050-FDC3F48F7E3B} (CDownloadCtrl Object) - http://www.fileplanet.com/fpdlmgr/cabs/FPDC_2.3.6.108.cab
    O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://download.bitdefender.com/resources/scan8/oscan8.cab
    O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1162297554309
    O17 - HKLM\System\CCS\Services\Tcpip\..\{EF416D88-D8DA-40DC-A196-4F3A1F7E69A4}: NameServer = 192.168.1.254
    O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
    O20 - Winlogon Notify: DPWLN - C:\WINDOWS\system32\DPWLEvHd.dll
    O22 - SharedTaskScheduler: Browseui preloader - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - C:\WINDOWS\system32\browseui.dll
    O22 - SharedTaskScheduler: Component Categories cache daemon - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\WINDOWS\system32\browseui.dll
    O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
    O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
    O23 - Service: F-Secure Automatic Update (BackWeb Plug-in - 7681197) - F-Secure Automatic Update - C:\PROGRA~1\F-Secure\BackWeb\7681197\Program\SERVIC~1.EXE
    O23 - Service: C-DillaCdaC11BA - Macrovision - C:\WINDOWS\system32\drivers\CDAC11BA.EXE
    O23 - Service: Loogisen levyn hallinnan valvontapalvelu (dmadmin) - Unknown owner - C:\WINDOWS\System32\dmadmin.exe
    O23 - Service: Windows XP FUS Manager (DPFUSMgr) - DigitalPersona, Inc. - C:\Program Files\DigitalPersona\Bin\DPFUSMgr.exe
    O23 - Service: Biometric Authentication Service (DpHost) - DigitalPersona, Inc. - C:\Program Files\DigitalPersona\Bin\DpHost.exe
    O23 - Service: Tapahtumaloki (Eventlog) - Unknown owner - C:\WINDOWS\system32\services.exe
    O23 - Service: FSGKHS (F-Secure Gatekeeper Handler Starter) - Unknown owner - C:\Program Files\F-Secure\Anti-Virus\fsgk32st.exe
    O23 - Service: F-Secure Network Request Broker - F-Secure Corporation - C:\Program Files\F-Secure\Common\FNRB32.EXE
    O23 - Service: fsbwsys - Unknown owner - C:\Program Files\F-Secure\BackWeb\7681197\program\fsbwsys.exe
    O23 - Service: F-Secure Anti-Virus Firewall Daemon (FSDFWD) - F-Secure Corporation - C:\Program Files\F-Secure\FWES\Program\fsdfwd.exe
    O23 - Service: F-Secure Management Agent (FSMA) - F-Secure Corporation - C:\Program Files\F-Secure\Common\FSMA32.EXE
    O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
    O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
    O23 - Service: CD-levyjen kirjoittamisen IMAPI COM -palvelu (ImapiService) - Unknown owner - C:\WINDOWS\system32\imapi.exe
    O23 - Service: NetMeeting etätyöpöydän jakaminen (mnmsrvc) - Unknown owner - C:\WINDOWS\system32\mnmsrvc.exe
    O23 - Service: Plug and Play (PlugPlay) - Unknown owner - C:\WINDOWS\system32\services.exe
    O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\system32\PnkBstrA.exe
    O23 - Service: Etätyöpöydän ohjeen istunnonhallinta (RDSessMgr) - Unknown owner - C:\WINDOWS\system32\sessmgr.exe
    O23 - Service: Älykortti (SCardSvr) - Unknown owner - C:\WINDOWS\System32\SCardSvr.exe
    O23 - Service: Check Point SecuRemote Service (SR_Service) - Check Point Software Technologies - C:\Program Files\CheckPoint\SecuRemote\bin\SR_Service.exe
    O23 - Service: Check Point SecuRemote WatchDog (SR_WatchDog) - Check Point Software Technologies - C:\Program Files\CheckPoint\SecuRemote\bin\SR_WatchDog.exe
    O23 - Service: StarWind AE Service (StarWindServiceAE) - Rocket Division Software - C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe
    O23 - Service: Resurssilokit ja -hälytykset (SysmonLog) - Unknown owner - C:\WINDOWS\system32\smlogsvc.exe
    O23 - Service: Telnet (TlntSvr) - Unknown owner - C:\WINDOWS\system32\tlntsvr.exe
    O23 - Service: SecuROM User Access Service (V7) (UserAccess7) - Sony DADC Austria AG. - C:\WINDOWS\system32\UAService7.exe
    O23 - Service: Aseman tilannevedos (VSS) - Unknown owner - C:\WINDOWS\System32\vssvc.exe
    O23 - Service: WMI resurssisovitin (WmiApSrv) - Unknown owner - C:\WINDOWS\system32\wbem\wmiapsrv.exe

    --
    End of file - 12568 bytes

     
    Koppis1, Jun 3, 2008
    #5
  6. Hujo

    Hujo Guest

    Avaa Muistio ja kopioi/liitä quoteboxin sisältö sinne:

    Tallenna se nimellä CFScript.txt

    Sitten raahaa CFScript ComboFix.exeen kuten alla.
    [​IMG]

    Käynnistä tietokone uudelleen pyydettäessä ja lähetä combofix.txt-tiedoston sisältö tänne.

    =============

    Lataa Malwarebytes' Anti-Malware työpöydällesi.

    1. Tuplaklikkaa mbam-setup.exe ja seuraa ohjeita asentaaksesi ohjelman.
    2. Lopuksi varmistu, että seuraavat on valittu: Update Malwarebytes', Anti-Malwareja
    Launch Malwarebytes' Anti-Malware ja sen jälkeen klikkaaFinish.
    3. Jos päivitys löytyy. ohjelma lataa ja asentaa uusimman version.
    4. Kun ohjelma on latautunut, valitse Perform full scan ja klikkaa Scan.
    5. Kun skanni on valmis, klikkaa OK ja sitten Show Results nähdäksesi tulokset.
    6. Varmistu, että kaikki on merkitty ja klikkaa Remove Selected.
    7. Tämän jälkeen loki avautuu muistioon. Tallenna se paikkaan, josta löydät sen helposti. Loki
    löytyy myös täältä: C:\Documents and Settings\Käyttäjänimi\Application
    Data\Malwarebytes\Malwarebytes' Anti-Malware\Logs\log-päiväys.txt
    8. Lähetä lokin sisältö seuraavassa viestissäsi.

    ==============

    Lataa SDFix by AndyManchesta ja tallenna se työpöydällesi.

    Käynnistä koneesi vikasietotilaan:

    sammuta ja käynnistä
    käynnistyksen yhteydessä hakkaa F8 nappia
    valitse nuolinäppäimellä vikasietotila
    paina enter ja enter
    valitse käyttäjätilisi
    paina kyllä

    Jossakin koneissa hakataan F8:sin sijasta F5:tä

    " Kun vikasietotilassa, pura tiedoston SDFix.zip sisältö (SDFix kansio) työpöydällesi. Työpöydälle pitäisi ilmestyä kansio nimeltä SDFix.
    " Avaa SDFix-kansio ja tuplaklikkaa tiedostoa RunThis.bat käynnistääksesi ohjelman.
    " Paina Y käynnistääksesi skriptin.
    " Työkalu puhdistaa troijalaisen palvelut ja tekee myös joitakin korjauksia rekisteriin. Lopuksi se pyytää käynnistämään koneen uudelleen, "Press any key to Reboot".
    " Paina mitä tahansa näppäintä ja kone käynnistyy uudelleen.
    " Käynnistyminen kestää normaalia kauemmin sillä SDFix puhdistaa konetta.
    " Kun kone on käynnistynyt ja työpöytä latautunut, SDFix kertoo että puhdistus on suoritettu, "Finished".
    " Paina sitten mitä tahansa näppäintä sulkeaksesi skriptin ja ladataksesi pikakuvakkeet työpöydälle.
    " Lopuksi avaa SDFix kansio (työpöydällä) ja kopioi & liitä tiedoston Report.txt sisältö viestiketjuusi uuden HijackThis:n lokin kera.

     
    Hujo, Jun 3, 2008
    #6
  7. Koppis1

    Koppis1 Member

    Joined:
    Jun 26, 2007
    Messages:
    77
    Likes Received:
    0
    Trophy Points:
    16
    Nyt tulee kaikki 4 lokia.


    SDFix: Version 1.187
    Run by Koppis on ti 03.06.2008 at 22:03

    Microsoft Windows XP [versio 5.1.2600]
    Running From: C:\DOCUME~1\Koppis\TYPYT~1\SDFix

    Checking Services :


    Restoring Windows Registry Values
    Restoring Windows Default Hosts File

    Rebooting


    Checking Files :

    No Trojan Files Found






    Removing Temp Files

    ADS Check :



    Final Check :

    catchme 0.3.1361.2 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
    Rootkit scan 2008-06-03 22:19:31
    Windows 5.1.2600 Service Pack 2 NTFS

    scanning hidden processes ...

    scanning hidden services & system hive ...

    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg]
    "s1"=dword:412c1832
    "s2"=dword:4f2c8721
    "h0"=dword:00000002

    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04]
    "p0"="C:\Program Files\Alcohol Soft\Alcohol 120\"
    "h0"=dword:00000001
    "ujdew"=hex:c5,69,d5,da,60,7c,3c,15,97,a7,e4,95,e2,54,14,21,33,0f,b7,d2,ee,..

    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4]
    "p0"="C:\Program Files\DAEMON Tools\"
    "h0"=dword:00000000
    "khjeh"=hex:80,4e,ed,43,59,91,1d,eb,0a,38,b0,17,bf,28,1d,ff,52,42,17,79,8f,..

    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001]
    "a0"=hex:20,01,00,00,0b,87,e1,a9,20,75,31,bb,87,92,96,6b,4d,22,0d,4c,1d,..
    "khjeh"=hex:36,9c,35,90,fa,be,7e,d9,54,ae,99,e5,4b,a1,7e,90,56,68,0c,8c,12,..

    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40]
    "khjeh"=hex:8e,16,fd,45,5f,74,4c,97,36,2a,5d,fb,19,f5,b4,ef,c3,66,a7,d4,ae,..

    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf41]
    "khjeh"=hex:37,53,ec,04,e3,ec,18,b4,b2,1a,e2,d9,6f,2c,df,ad,ef,25,ad,05,9b,..

    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf42]
    "khjeh"=hex:f9,4e,3c,46,25,5e,34,cf,f8,e8,e9,45,7b,83,6d,cb,7e,85,0d,f2,f0,..

    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf43]
    "khjeh"=hex:c6,db,17,aa,88,11,d6,61,b2,94,b5,ab,4a,ee,bc,12,d3,11,6b,51,cf,..
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04]
    "p0"="C:\Program Files\Alcohol Soft\Alcohol 120\"
    "h0"=dword:00000001
    "ujdew"=hex:c5,69,d5,da,60,7c,3c,15,97,a7,e4,95,e2,54,14,21,33,0f,b7,d2,ee,..
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4]
    "p0"="C:\Program Files\DAEMON Tools\"
    "h0"=dword:00000000
    "khjeh"=hex:80,4e,ed,43,59,91,1d,eb,0a,38,b0,17,bf,28,1d,ff,52,42,17,79,8f,..

    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001]
    "a0"=hex:20,01,00,00,0b,87,e1,a9,20,75,31,bb,87,92,96,6b,4d,22,0d,4c,1d,..
    "khjeh"=hex:36,9c,35,90,fa,be,7e,d9,54,ae,99,e5,4b,a1,7e,90,56,68,0c,8c,12,..

    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40]
    "khjeh"=hex:8e,16,fd,45,5f,74,4c,97,36,2a,5d,fb,19,f5,b4,ef,c3,66,a7,d4,ae,..

    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf41]
    "khjeh"=hex:37,53,ec,04,e3,ec,18,b4,b2,1a,e2,d9,6f,2c,df,ad,ef,25,ad,05,9b,..

    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf42]
    "khjeh"=hex:f9,4e,3c,46,25,5e,34,cf,f8,e8,e9,45,7b,83,6d,cb,7e,85,0d,f2,f0,..

    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf43]
    "khjeh"=hex:c6,db,17,aa,88,11,d6,61,b2,94,b5,ab,4a,ee,bc,12,d3,11,6b,51,cf,..

    scanning hidden registry entries ...

    scanning hidden files ...

    scan completed successfully
    hidden processes: 0
    hidden services: 0
    hidden files: 0


    Remaining Services :




    Authorized Application Key Export:

    [HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
    "%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:mad:xpsp2res.dll,-22019"
    "C:\\Program Files\\F-Secure\\BackWeb\\7681197\\program\\F-Secure Automatic Update.exe"="C:\\Program Files\\F-Secure\\BackWeb\\7681197\\program\\F-Secure Automatic Update.exe:*:Enabled:F-Secure Automatic Update"
    "C:\\Program Files\\CheckPoint\\SecuRemote\\bin\\SR_Service.exe"="C:\\Program Files\\CheckPoint\\SecuRemote\\bin\\SR_Service.exe:*:Enabled:VPN-1 SecuRemote/SecureClient service"
    "C:\\Program Files\\CheckPoint\\SecuRemote\\bin\\SR_GUI.exe"="C:\\Program Files\\CheckPoint\\SecuRemote\\bin\\SR_GUI.exe:*:Enabled:VPN-1 SecuRemote/SecureClient application"
    "C:\\Program Files\\CheckPoint\\SecuRemote\\bin\\scc.exe"="C:\\Program Files\\CheckPoint\\SecuRemote\\bin\\scc.exe:*:Enabled:VPN-1 SecuRemote/SecureClient command line"
    "C:\\Program Files\\CheckPoint\\SecuRemote\\bin\\SR_SDS.exe"="C:\\Program Files\\CheckPoint\\SecuRemote\\bin\\SR_SDS.exe:*:Enabled:VPN-1 SecuRemote/SecureClient SDS agent"
    "C:\\Program Files\\CheckPoint\\SecuRemote\\bin\\SR_Diagnostics.exe"="C:\\Program Files\\CheckPoint\\SecuRemote\\bin\\SR_Diagnostics.exe:*:Enabled:VPN-1 SecuRemote/SecureClient diagnostics"
    "C:\\Program Files\\uTorrent\\uTorrent.exe"="C:\\Program Files\\uTorrent\\uTorrent.exe:*:Enabled:æTorrent"
    "C:\\WINDOWS\\system32\\dplaysvr.exe"="C:\\WINDOWS\\system32\\dplaysvr.exe:*:Enabled:Microsoft DirectPlay Helper"
    "C:\\Pelit\\Settlers3\\s3.exe"="C:\\Pelit\\Settlers3\\s3.exe:*:Enabled:Siedler3"
    "C:\\Pelit\\Crysis\\Bin32\\Crysis.exe"="C:\\Pelit\\Crysis\\Bin32\\Crysis.exe:*:Enabled:Crysis_32"
    "C:\\Pelit\\Crysis\\Bin32\\CrysisDedicatedServer.exe"="C:\\Pelit\\Crysis\\Bin32\\CrysisDedicatedServer.exe:*:Enabled:CrysisDedicatedServer_32"
    "C:\\WINDOWS\\system32\\PnkBstrA.exe"="C:\\WINDOWS\\system32\\PnkBstrA.exe:*:Enabled:pnkBstrA"
    "C:\\WINDOWS\\system32\\PnkBstrB.exe"="C:\\WINDOWS\\system32\\PnkBstrB.exe:*:Enabled:pnkBstrB"
    "C:\\Program Files\\SmartFTP Client\\SmartFTP.exe"="C:\\Program Files\\SmartFTP Client\\SmartFTP.exe:*:Enabled:SmartFTP Client 3.0"
    "C:\\Program Files\\Skype\\Phone\\Skype.exe"="C:\\Program Files\\Skype\\Phone\\Skype.exe:*:Enabled:Skype"

    [HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
    "%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:mad:xpsp2res.dll,-22019"
    "C:\\Program Files\\F-Secure\\BackWeb\\7681197\\program\\F-Secure Automatic Update.exe"="C:\\Program Files\\F-Secure\\BackWeb\\7681197\\program\\F-Secure Automatic Update.exe:*:Enabled:F-Secure Automatic Update"
    "C:\\Program Files\\CheckPoint\\SecuRemote\\bin\\SR_Service.exe"="C:\\Program Files\\CheckPoint\\SecuRemote\\bin\\SR_Service.exe:*:Enabled:VPN-1 SecuRemote/SecureClient service"
    "C:\\Program Files\\CheckPoint\\SecuRemote\\bin\\SR_GUI.exe"="C:\\Program Files\\CheckPoint\\SecuRemote\\bin\\SR_GUI.exe:*:Enabled:VPN-1 SecuRemote/SecureClient application"
    "C:\\Program Files\\CheckPoint\\SecuRemote\\bin\\scc.exe"="C:\\Program Files\\CheckPoint\\SecuRemote\\bin\\scc.exe:*:Enabled:VPN-1 SecuRemote/SecureClient command line"
    "C:\\Program Files\\CheckPoint\\SecuRemote\\bin\\SR_SDS.exe"="C:\\Program Files\\CheckPoint\\SecuRemote\\bin\\SR_SDS.exe:*:Enabled:VPN-1 SecuRemote/SecureClient SDS agent"
    "C:\\Program Files\\CheckPoint\\SecuRemote\\bin\\SR_Diagnostics.exe"="C:\\Program Files\\CheckPoint\\SecuRemote\\bin\\SR_Diagnostics.exe:*:Enabled:VPN-1 SecuRemote/SecureClient diagnostics"
    "C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"="C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe:*:Enabled:Windows Live Messenger"
    "C:\\Program Files\\Windows Live\\Messenger\\livecall.exe"="C:\\Program Files\\Windows Live\\Messenger\\livecall.exe:*:Enabled:Windows Live Messenger (Phone)"

    Remaining Files :



    Files with Hidden Attributes :

    Sun 4 Jan 2004 51,200 A..H. --- "C:\mirja\Maritxt\~WRL0003.TMP"
    Mon 5 Jan 2004 72,704 A..H. --- "C:\mirja\Maritxt\~WRL0004.TMP"
    Mon 5 Jan 2004 51,200 A..H. --- "C:\mirja\Maritxt\~WRL3606.tmp"
    Tue 20 Feb 2007 5,355,320 A..H. --- "C:\Program Files\Picasa2\setup.exe"
    Wed 3 May 2006 163,328 ..SHR --- "C:\WINDOWS\system32\flvDX.dll"
    Wed 21 Feb 2007 31,232 ..SHR --- "C:\WINDOWS\system32\msfDX.dll"
    Mon 17 Dec 2007 27,648 ..SH. --- "C:\WINDOWS\system32\Smab0.dll"
    Mon 4 Feb 2008 151,040 ..SH. --- "C:\WINDOWS\system32\VistaUltm.dll"
    Fri 10 Aug 2007 4,348 ..SH. --- "C:\Documents and Settings\All Users\DRM\DRMv1.bak"
    Sun 26 Jun 2005 616,448 ..SHR --- "C:\Program Files\eRightSoft\SUPER\cygwin1.dll"
    Wed 22 Jun 2005 45,568 ..SHR --- "C:\Program Files\eRightSoft\SUPER\cygz.dll"
    Thu 7 Feb 2008 72,704 ..SHR --- "C:\Program Files\eRightSoft\SUPER\Setup.exe"
    Fri 27 Oct 2006 16,384 A.SHR --- "C:\Program Files\eRightSoft\SUPER\_Setup.dll"
    Fri 27 Feb 2004 233,472 A..H. --- "C:\Program Files\Image-Line\FL Studio 7\REX Shared Library.dll"
    Tue 4 Jun 2002 84,992 ...HR --- "C:\Program Files\eRightSoft\SUPER\mencoder\14_43260.dll"
    Tue 4 Jun 2002 44,032 ...HR --- "C:\Program Files\eRightSoft\SUPER\mencoder\28_83260.dll"
    Tue 10 Dec 2002 73,766 ...HR --- "C:\Program Files\eRightSoft\SUPER\mencoder\atrc3260.dll"
    Tue 10 Dec 2002 65,575 ...HR --- "C:\Program Files\eRightSoft\SUPER\mencoder\cook3260.dll"
    Sun 9 Jun 2002 36,864 ...HR --- "C:\Program Files\eRightSoft\SUPER\mencoder\ddnt3260.dll"
    Tue 4 Jun 2002 20,480 ...HR --- "C:\Program Files\eRightSoft\SUPER\mencoder\dnet3260.dll"
    Tue 10 Dec 2002 102,437 ...HR --- "C:\Program Files\eRightSoft\SUPER\mencoder\drv13260.dll"
    Tue 10 Dec 2002 176,165 ...HR --- "C:\Program Files\eRightSoft\SUPER\mencoder\drv23260.dll"
    Tue 10 Dec 2002 208,935 ...HR --- "C:\Program Files\eRightSoft\SUPER\mencoder\drv33260.dll"
    Tue 10 Dec 2002 217,127 ...HR --- "C:\Program Files\eRightSoft\SUPER\mencoder\drv43260.dll"
    Sun 9 Jun 2002 40,448 ...HR --- "C:\Program Files\eRightSoft\SUPER\mencoder\dspr3260.dll"
    Sun 4 Nov 2001 225,280 ...HR --- "C:\Program Files\eRightSoft\SUPER\mencoder\ivvideo.dll"
    Tue 10 Apr 2001 225,280 ...HR --- "C:\Program Files\eRightSoft\SUPER\mencoder\qtmlClient.dll"
    Fri 20 Feb 2004 232,960 ...HR --- "C:\Program Files\eRightSoft\SUPER\mencoder\raac.dll"
    Sun 9 Jun 2002 525,824 ...HR --- "C:\Program Files\eRightSoft\SUPER\mencoder\rnco3260.dll"
    Tue 10 Dec 2002 245,805 ...HR --- "C:\Program Files\eRightSoft\SUPER\mencoder\rnlt3260.dll"
    Tue 10 Dec 2002 45,093 ...HR --- "C:\Program Files\eRightSoft\SUPER\mencoder\rv103260.dll"
    Tue 10 Dec 2002 98,341 ...HR --- "C:\Program Files\eRightSoft\SUPER\mencoder\rv203260.dll"
    Tue 10 Dec 2002 94,247 ...HR --- "C:\Program Files\eRightSoft\SUPER\mencoder\rv303260.dll"
    Tue 10 Dec 2002 90,151 ...HR --- "C:\Program Files\eRightSoft\SUPER\mencoder\rv403260.dll"
    Tue 10 Dec 2002 102,439 ...HR --- "C:\Program Files\eRightSoft\SUPER\mencoder\sipr3260.dll"
    Sun 9 Jun 2002 49,152 ...HR --- "C:\Program Files\eRightSoft\SUPER\mencoder\tokr3260.dll"
    Wed 7 May 2008 0 A..H. --- "C:\WINDOWS\SoftwareDistribution\Download\0045d90d3c637c74f834c75fe192b558\BIT21.tmp"
    Wed 28 May 2008 0 A..H. --- "C:\WINDOWS\SoftwareDistribution\Download\027df41720931012b94b91a7776c3165\BIT28.tmp"
    Thu 24 Jan 2008 0 A..H. --- "C:\WINDOWS\SoftwareDistribution\Download\523d056929e13eacf8392044f602e53e\BIT17.tmp"
    Tue 4 Mar 2008 0 A..H. --- "C:\WINDOWS\SoftwareDistribution\Download\bc066f3f60df1b38218903dd0d40ce98\BIT19.tmp"
    Wed 28 May 2008 0 A..H. --- "C:\WINDOWS\SoftwareDistribution\Download\f49cda1898bcf48b982dace6ad0aeca3\BIT29.tmp"
    Mon 2 Jun 2008 2,633 ...HR --- "C:\Documents and Settings\Koppis\Application Data\SecuROM\UserData\securom_v7_01.bak"

    Finished!








    ==========================














    Malwarebytes' Anti-Malware 1.14
    Tietokantaversio: 818

    21:45:26 3.6.2008
    mbam-log-6-3-2008 (21-45-26).txt

    Tarkistustyyppi: Täysi tarkistus (C:\|)
    Tarkistetut kohteet: 303376
    Kulunut aika: 1 hour(s), 22 minute(s), 22 second(s)

    Saastuneita muistiprosesseja: 0
    Saastuneita muistimoduuleja: 0
    Saastuneita rekisteriavaimia: 3
    Saastuneita rekisteriarvoja: 1
    Saastuneita rekisterikohteita: 0
    Saastuneita hakemistoja: 0
    Saastuneita tiedostoja: 57

    Saastuneita muistiprosesseja:
    (Haitallisia kohteita ei löydetty)

    Saastuneita muistimoduuleja:
    (Haitallisia kohteita ei löydetty)

    Saastuneita rekisteriavaimia:
    HKEY_CURRENT_USER\Software\Microsoft\affri (Malware.Trace) -> Quarantined and deleted successfully.
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\affri (Malware.Trace) -> Quarantined and deleted successfully.
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\MS Juan (Malware.Trace) -> Quarantined and deleted successfully.

    Saastuneita rekisteriarvoja:
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Windows svchost (Backdoor.Bot) -> Quarantined and deleted successfully.

    Saastuneita rekisterikohteita:
    (Haitallisia kohteita ei löydetty)

    Saastuneita hakemistoja:
    (Haitallisia kohteita ei löydetty)

    Saastuneita tiedostoja:
    C:\bot1.exe (Backdoor.Bot) -> Quarantined and deleted successfully.
    C:\Eero\sparrow\image23.JPG-www.msnimages.com (Backdoor.Bot) -> Quarantined and deleted successfully.
    C:\QooBox\Quarantine\C\setup.exe.vir (Backdoor.Bot) -> Quarantined and deleted successfully.
    C:\QooBox\Quarantine\C\WINDOWS\mservice.exe.vir (Backdoor.Bot) -> Quarantined and deleted successfully.
    C:\QooBox\Quarantine\C\WINDOWS\system32\abghewkr.dll.vir (Trojan.Vundo) -> Quarantined and deleted successfully.
    C:\QooBox\Quarantine\C\WINDOWS\system32\bqubwbdd.dll.vir (Trojan.Vundo) -> Quarantined and deleted successfully.
    C:\QooBox\Quarantine\C\WINDOWS\system32\fvawsnht.dll.vir (Trojan.Vundo) -> Quarantined and deleted successfully.
    C:\QooBox\Quarantine\C\WINDOWS\system32\geBtTKDv.dll.vir (Trojan.Vundo) -> Quarantined and deleted successfully.
    C:\QooBox\Quarantine\C\WINDOWS\system32\hvilbmhy.dll.vir (Trojan.Vundo) -> Quarantined and deleted successfully.
    C:\QooBox\Quarantine\C\WINDOWS\system32\khfGAtUO.dll.vir (Trojan.FakeAlert) -> Quarantined and deleted successfully.
    C:\QooBox\Quarantine\C\WINDOWS\system32\ncmobyek.dll.vir (Trojan.Vundo) -> Quarantined and deleted successfully.
    C:\QooBox\Quarantine\C\WINDOWS\system32\ofddqmrj.exe.vir (Trojan.LowZones) -> Quarantined and deleted successfully.
    C:\QooBox\Quarantine\C\WINDOWS\system32\opnnollm.dll.vir (Trojan.FakeAlert) -> Quarantined and deleted successfully.
    C:\QooBox\Quarantine\C\WINDOWS\system32\rqRIcyXR.dll.vir (Trojan.FakeAlert) -> Quarantined and deleted successfully.
    C:\QooBox\Quarantine\C\WINDOWS\system32\rqRiIxuU.dll.vir (Trojan.FakeAlert) -> Quarantined and deleted successfully.
    C:\QooBox\Quarantine\C\WINDOWS\system32\tuvWonkH.dll.vir (Trojan.FakeAlert) -> Quarantined and deleted successfully.
    C:\QooBox\Quarantine\C\WINDOWS\system32\vtUolMgh.dll.vir (Trojan.FakeAlert) -> Quarantined and deleted successfully.
    C:\QooBox\Quarantine\C\WINDOWS\system32\vurqnwri.dll.vir (Trojan.Vundo) -> Quarantined and deleted successfully.
    C:\QooBox\Quarantine\C\WINDOWS\system32\xhfxfqiv.exe.vir (Trojan.LowZones) -> Quarantined and deleted successfully.
    C:\System Volume Information\_restore{84BAE593-4252-4F5F-9FBA-F19648C5B781}\RP11\A0002540.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
    C:\System Volume Information\_restore{84BAE593-4252-4F5F-9FBA-F19648C5B781}\RP11\A0002541.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
    C:\System Volume Information\_restore{84BAE593-4252-4F5F-9FBA-F19648C5B781}\RP11\A0002566.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
    C:\System Volume Information\_restore{84BAE593-4252-4F5F-9FBA-F19648C5B781}\RP11\A0002567.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
    C:\System Volume Information\_restore{84BAE593-4252-4F5F-9FBA-F19648C5B781}\RP11\A0002570.dll (Trojan.FakeAlert) -> Quarantined and deleted successfully.
    C:\System Volume Information\_restore{84BAE593-4252-4F5F-9FBA-F19648C5B781}\RP13\A0002601.exe (Backdoor.Bot) -> Quarantined and deleted successfully.
    C:\System Volume Information\_restore{84BAE593-4252-4F5F-9FBA-F19648C5B781}\RP13\A0002602.exe (Backdoor.Bot) -> Quarantined and deleted successfully.
    C:\System Volume Information\_restore{84BAE593-4252-4F5F-9FBA-F19648C5B781}\RP13\A0002622.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
    C:\System Volume Information\_restore{84BAE593-4252-4F5F-9FBA-F19648C5B781}\RP13\A0002623.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
    C:\System Volume Information\_restore{84BAE593-4252-4F5F-9FBA-F19648C5B781}\RP13\A0002627.dll (Trojan.FakeAlert) -> Quarantined and deleted successfully.
    C:\System Volume Information\_restore{84BAE593-4252-4F5F-9FBA-F19648C5B781}\RP13\A0002630.dll (Trojan.FakeAlert) -> Quarantined and deleted successfully.
    C:\System Volume Information\_restore{84BAE593-4252-4F5F-9FBA-F19648C5B781}\RP13\A0002642.exe (Backdoor.Bot) -> Quarantined and deleted successfully.
    C:\System Volume Information\_restore{84BAE593-4252-4F5F-9FBA-F19648C5B781}\RP14\A0002651.exe (Backdoor.Bot) -> Quarantined and deleted successfully.
    C:\System Volume Information\_restore{84BAE593-4252-4F5F-9FBA-F19648C5B781}\RP14\A0002664.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
    C:\System Volume Information\_restore{84BAE593-4252-4F5F-9FBA-F19648C5B781}\RP14\A0003677.exe (Backdoor.Bot) -> Quarantined and deleted successfully.
    C:\System Volume Information\_restore{84BAE593-4252-4F5F-9FBA-F19648C5B781}\RP14\A0003679.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
    C:\System Volume Information\_restore{84BAE593-4252-4F5F-9FBA-F19648C5B781}\RP15\A0003773.exe (Backdoor.Bot) -> Quarantined and deleted successfully.
    C:\System Volume Information\_restore{84BAE593-4252-4F5F-9FBA-F19648C5B781}\RP15\A0003776.exe (Backdoor.Bot) -> Quarantined and deleted successfully.
    C:\System Volume Information\_restore{84BAE593-4252-4F5F-9FBA-F19648C5B781}\RP15\A0003780.exe (Backdoor.Bot) -> Quarantined and deleted successfully.
    C:\System Volume Information\_restore{84BAE593-4252-4F5F-9FBA-F19648C5B781}\RP16\A0003803.exe (Backdoor.Bot) -> Quarantined and deleted successfully.
    C:\System Volume Information\_restore{84BAE593-4252-4F5F-9FBA-F19648C5B781}\RP16\A0004759.exe (Backdoor.Bot) -> Quarantined and deleted successfully.
    C:\System Volume Information\_restore{84BAE593-4252-4F5F-9FBA-F19648C5B781}\RP16\A0005796.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
    C:\System Volume Information\_restore{84BAE593-4252-4F5F-9FBA-F19648C5B781}\RP16\A0005798.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
    C:\System Volume Information\_restore{84BAE593-4252-4F5F-9FBA-F19648C5B781}\RP16\A0005800.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
    C:\System Volume Information\_restore{84BAE593-4252-4F5F-9FBA-F19648C5B781}\RP16\A0005801.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
    C:\System Volume Information\_restore{84BAE593-4252-4F5F-9FBA-F19648C5B781}\RP16\A0005803.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
    C:\System Volume Information\_restore{84BAE593-4252-4F5F-9FBA-F19648C5B781}\RP16\A0005804.dll (Trojan.FakeAlert) -> Quarantined and deleted successfully.
    C:\System Volume Information\_restore{84BAE593-4252-4F5F-9FBA-F19648C5B781}\RP16\A0005805.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
    C:\System Volume Information\_restore{84BAE593-4252-4F5F-9FBA-F19648C5B781}\RP16\A0005806.exe (Trojan.LowZones) -> Quarantined and deleted successfully.
    C:\System Volume Information\_restore{84BAE593-4252-4F5F-9FBA-F19648C5B781}\RP16\A0005807.dll (Trojan.FakeAlert) -> Quarantined and deleted successfully.
    C:\System Volume Information\_restore{84BAE593-4252-4F5F-9FBA-F19648C5B781}\RP16\A0005808.dll (Trojan.FakeAlert) -> Quarantined and deleted successfully.
    C:\System Volume Information\_restore{84BAE593-4252-4F5F-9FBA-F19648C5B781}\RP16\A0005809.dll (Trojan.FakeAlert) -> Quarantined and deleted successfully.
    C:\System Volume Information\_restore{84BAE593-4252-4F5F-9FBA-F19648C5B781}\RP16\A0005810.dll (Trojan.FakeAlert) -> Quarantined and deleted successfully.
    C:\System Volume Information\_restore{84BAE593-4252-4F5F-9FBA-F19648C5B781}\RP16\A0005811.dll (Trojan.FakeAlert) -> Quarantined and deleted successfully.
    C:\System Volume Information\_restore{84BAE593-4252-4F5F-9FBA-F19648C5B781}\RP16\A0005812.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
    C:\System Volume Information\_restore{84BAE593-4252-4F5F-9FBA-F19648C5B781}\RP16\A0005813.exe (Trojan.LowZones) -> Quarantined and deleted successfully.
    C:\System Volume Information\_restore{84BAE593-4252-4F5F-9FBA-F19648C5B781}\RP16\A0005840.exe (Backdoor.Bot) -> Quarantined and deleted successfully.
    C:\System Volume Information\_restore{84BAE593-4252-4F5F-9FBA-F19648C5B781}\RP17\A0005879.exe (Backdoor.Bot) -> Quarantined and deleted successfully.






    ================================







    ComboFix 08-06-01.6 - Koppis 2008-06-03 20:08:34.6 - NTFSx86
    Microsoft Windows XP Professional 5.1.2600.2.1252.1.1035.18.818 [GMT 3:00]
    Running from: C:\Documents and Settings\Koppis\Työpöytä\ComboFix.exe
    Command switches used :: C:\Documents and Settings\Koppis\Työpöytä\CFScript.txt.txt
    * Created a new restore point
    * Resident AV is active


    WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!

    FILE ::
    C:\WINDOWS\mservice.exe
    C:\WINDOWS\service.exe
    C:\WINDOWS\system32\gvojukld.dll
    .

    (((((((((((((((((((((((((((((((((((((( Muut poistot ))))))))))))))))))))))))))))))))))))))))))))))))))))))))
    .

    C:\WINDOWS\mservice.exe

    .
    ((((( Tiedostot, jotka on luotu seuraavalla aikavälillä: 2008-05-03 to 2008-06-03 )))))))))))))))))
    .

    2008-06-03 19:06 . 2008-06-03 19:06 86,548 --a------ C:\setz.exe
    2008-06-03 19:05 . 2008-06-03 19:05 4,217 --a------ C:\WINDOWS\is154890.exe
    2008-06-03 14:27 . 2008-06-03 14:27 60,114 --a------ C:\bot1.exe
    2008-06-03 13:21 . 2008-06-03 13:21 244 --ah----- C:\sqmnoopt16.sqm
    2008-06-03 13:21 . 2008-06-03 13:21 232 --ah----- C:\sqmdata16.sqm
    2008-06-03 13:14 . 2008-06-03 13:14 244 --ah----- C:\sqmnoopt15.sqm
    2008-06-03 13:14 . 2008-06-03 13:14 232 --ah----- C:\sqmdata15.sqm
    2008-06-03 13:13 . 2008-06-03 13:13 <KANSIO> d-------- C:\Documents and Settings\Vilpponen\Application Data\Malwarebytes
    2008-06-02 22:29 . 2008-06-02 22:29 97,116 --a------ C:\WINDOWS\DC5177176.zip
    2008-06-01 23:33 . 2008-06-01 23:33 <KANSIO> d-------- C:\Program Files\Live_TV
    2008-06-01 23:30 . 2008-06-01 23:56 <KANSIO> d-------- C:\Program Files\3GP Converter 2007
    2008-06-01 23:30 . 2008-06-01 23:30 54,156 --ah----- C:\WINDOWS\QTFont.qfn
    2008-06-01 23:30 . 2008-06-01 23:30 1,409 --a------ C:\WINDOWS\QTFont.for
    2008-06-01 23:13 . 2008-06-01 23:13 3,758,036 --a------ C:\spore.3gp
    2008-06-01 23:09 . 2008-06-01 23:09 <KANSIO> d-------- C:\Program Files\WinAVI MP4 Converter
    2008-06-01 21:37 . 2008-06-01 21:37 <KANSIO> d-------- C:\Program Files\SmartFTP Client 3.0 Setup Files
    2008-06-01 21:37 . 2008-06-01 21:37 <KANSIO> d-------- C:\Program Files\SmartFTP Client
    2008-06-01 21:37 . 2008-06-01 21:37 <KANSIO> d-------- C:\Documents and Settings\Koppis\Application Data\SmartFTP
    2008-05-31 15:37 . 2008-05-31 15:37 0 --ah----- C:\WINDOWS\system32\drivers\Msft_Kernel_NuidFltr_01005.Wdf
    2008-05-31 15:36 . 2004-09-14 16:11 21,504 --a------ C:\WINDOWS\system32\drivers\hidserv.dll
    2008-05-31 10:46 . 2008-05-31 10:47 1,646,766 --a------ C:\We_hold_these_truths.flv.MP3.OGG
    2008-05-31 10:45 . 2008-05-31 10:46 558,088 --a------ C:\The Flight of the Bumble Bee.flv.MP3.OGG
    2008-05-31 10:44 . 2008-05-31 10:45 2,007,871 --a------ C:\Speed metal messiah.flv.MP3.OGG
    2008-05-31 10:43 . 2008-05-31 10:44 2,315,607 --a------ C:\necro.ogg.MP3.OGG
    2008-05-31 10:42 . 2008-05-31 10:43 2,297,579 --a------ C:\Jerryc - Canon Rock (Guitar Play).mp3.OGG
    2008-05-31 10:40 . 2008-05-31 10:42 3,361,200 --a------ C:\Dragonforce - Revolution Deathsquad.mp3.OGG
    2008-05-31 10:38 . 2008-05-31 10:40 2,260,120 --a------ C:\06 - Wedding Nails mp3.mp3.OGG
    2008-05-31 10:37 . 2008-05-31 10:38 2,090,948 --a------ C:\01 Black Dog.mp3.OGG
    2008-05-31 10:35 . 2008-05-31 10:37 2,797,956 --a------ C:\Wedding_Nails.mp3.OGG
    2008-05-31 10:29 . 2008-05-31 10:29 1,257,221 --a------ C:\The Flight of the Bumble Bee.flv.MP3
    2008-05-31 10:28 . 2008-05-31 10:28 5,231,595 --a------ C:\Corpse_tumor.flv.MP3
    2008-05-31 10:28 . 2008-05-31 10:29 4,536,111 --a------ C:\Speed metal messiah.flv.MP3
    2008-05-31 10:27 . 2008-05-31 10:27 7,047,627 --a------ C:\We_hold_these_truths.flv.MP3
    2008-05-30 17:50 . 2008-05-30 17:50 <KANSIO> d-------- C:\Program Files\Webteh
    2008-05-30 17:49 . 2008-05-30 17:49 9,380,296 --a------ C:\Program Files\bsplayer228.964_clip.exe
    2008-05-30 14:38 . 2008-05-30 14:38 <KANSIO> d-------- C:\WINDOWS\system32\Clickteam
    2008-05-30 14:38 . 2008-05-30 14:38 <KANSIO> d-------- C:\Documents and Settings\Koppis\Application Data\Clickteam
    2008-05-29 21:05 . 2008-05-29 21:05 <KANSIO> d-------- C:\Documents and Settings\Mirja Vilpponen\Application Data\DigitalPersona
    2008-05-29 18:26 . 2008-05-29 18:26 <KANSIO> d-------- C:\Documents and Settings\Vilpponen\Application Data\DigitalPersona
    2008-05-29 18:26 . 2008-05-29 18:26 <KANSIO> d-------- C:\Documents and Settings\Vilpponen\Application Data\ATI
    2008-05-29 10:32 . 2008-06-03 13:54 <KANSIO> d-------- C:\Program Files\Malwarebytes' Anti-Malware
    2008-05-29 10:32 . 2008-05-29 10:32 <KANSIO> d-------- C:\Documents and Settings\Koppis\Application Data\Malwarebytes
    2008-05-29 10:32 . 2008-05-29 10:32 <KANSIO> d-------- C:\Documents and Settings\All Users\Application Data\Malwarebytes
    2008-05-29 10:32 . 2008-05-30 01:06 34,296 --a------ C:\WINDOWS\system32\drivers\mbamcatchme.sys
    2008-05-29 10:32 . 2008-05-30 01:06 15,864 --a------ C:\WINDOWS\system32\drivers\mbam.sys
    2008-05-28 22:22 . 2008-05-28 22:22 <KANSIO> d-------- C:\Program Files\Trend Micro
    2008-05-28 21:41 . 2008-05-28 21:41 2,855 --a------ C:\ComboFix.PIF
    2008-05-28 21:31 . 2008-05-28 21:31 0 --a------ C:\ComboFix.exe
    2008-05-28 20:29 . 2008-06-03 19:32 <KANSIO> d-------- C:\Program Files\HiJackThis_v2
    2008-05-28 20:16 . 2008-05-28 20:28 <KANSIO> d-------- C:\WINDOWS\BDOSCAN8
    2008-05-28 18:05 . 2008-05-28 18:05 <KANSIO> d-------- C:\Documents and Settings\Koppis\Application Data\DigitalPersona
    2008-05-28 17:58 . 2008-05-28 17:58 <KANSIO> d-------- C:\WINDOWS\DPDrv
    2008-05-28 17:58 . 2008-05-28 17:58 <KANSIO> d-------- C:\Program Files\DigitalPersona
    2008-05-28 17:26 . 2008-05-28 17:26 <KANSIO> d-------- C:\Program Files\DP10-002
    2008-05-28 17:26 . 2008-05-28 17:26 2,334,453 --a------ C:\Program Files\DP10-002.zip
    2008-05-28 16:43 . 2008-05-28 16:43 8,579,136 --a------ C:\Program Files\DPPM_201_ENG.exe
    2008-05-28 16:04 . 2007-08-31 12:15 18,856 --a------ C:\WINDOWS\system32\drivers\nuidfltr.sys
    2008-05-28 16:03 . 2008-05-28 16:39 <KANSIO> d-------- C:\Program Files\Microsoft IntelliType Pro
    2008-05-28 15:48 . 2004-09-14 16:11 21,504 --a------ C:\WINDOWS\system32\hidserv.dll
    2008-05-28 15:48 . 2004-09-14 16:11 21,504 --a--c--- C:\WINDOWS\system32\dllcache\hidserv.dll
    2008-05-27 21:48 . 2008-05-27 21:48 3,510,857 --a------ C:\SMB2AV.MP3
    2008-05-27 21:48 . 2008-05-27 21:48 2,069,315 --a------ C:\FB.MP3
    2008-05-27 21:47 . 2008-05-27 21:48 3,554,742 --a------ C:\SMBAV.MP3
    2008-05-27 08:32 . 2008-05-27 08:32 <KANSIO> d-------- C:\Documents and Settings\Mirja Vilpponen\Application Data\ATI
    2008-05-25 21:05 . 2008-05-29 16:55 <KANSIO> d-------- C:\Program Files\Cheat Engine
    2008-05-25 21:05 . 2007-12-26 17:30 1,970,176 --a------ C:\WINDOWS\system32\d3dx9.dll
    2008-05-25 21:05 . 2007-12-26 17:30 679,936 --a------ C:\WINDOWS\system32\D3DX81ab.dll
    2008-05-22 22:13 . 2008-05-22 22:13 <KANSIO> d-------- C:\Program Files\Octoshape Streaming Services
    2008-05-22 15:11 . 2008-05-22 17:12 <KANSIO> d-------- C:\Program Files\mIRC
    2008-05-22 15:11 . 2008-05-22 17:16 <KANSIO> d-------- C:\Documents and Settings\Koppis\Application Data\mIRC
    2008-05-21 14:57 . 2008-06-03 14:14 31 --a------ C:\WINDOWS\system32\bbcap.err
    2008-05-21 14:56 . 2008-05-21 14:56 <KANSIO> d-------- C:\Documents and Settings\Koppis\Application Data\ATI
    2008-05-21 14:56 . 2008-05-21 14:56 <KANSIO> d-------- C:\Documents and Settings\All Users\Application Data\ATI
    2008-05-18 18:49 . 2008-05-18 18:49 <KANSIO> d-------- C:\Program Files\Mioplanet
    2008-05-18 18:49 . 2008-05-18 18:49 <KANSIO> d-------- C:\Documents and Settings\Koppis\Application Data\mioObjects
    2008-05-18 18:49 . 2008-05-18 18:49 407,047 --a------ C:\WINDOWS\system32\mioengine.exe
    2008-05-18 12:30 . 2008-05-18 12:30 <KANSIO> d-------- C:\Program Files\eRightSoft
    2008-05-18 12:30 . 2006-09-12 14:46 227,328 -r-hs---- C:\WINDOWS\system32\ac3DX.ax
    2008-05-18 12:30 . 2006-05-03 13:06 163,328 -r-hs---- C:\WINDOWS\system32\flvDX.dll
    2008-05-18 12:30 . 2008-02-04 22:26 151,040 ---hs---- C:\WINDOWS\system32\VistaUltm.dll
    2008-05-18 12:30 . 2006-01-13 02:23 123,904 -r-hs---- C:\WINDOWS\system32\AVCDX.ax
    2008-05-18 12:30 . 2003-11-21 02:00 54,784 -r-hs---- C:\WINDOWS\system32\RLAPEDec.ax
    2008-05-18 12:30 . 2004-04-27 02:00 37,888 -r-hs---- C:\WINDOWS\system32\RLMPCDec.ax
    2008-05-18 12:30 . 2007-02-21 14:47 31,232 -r-hs---- C:\WINDOWS\system32\msfDX.dll
    2008-05-18 12:30 . 2007-12-17 16:43 27,648 ---hs---- C:\WINDOWS\system32\Smab0.dll
    2008-05-18 12:30 . 2008-02-05 20:04 9,884 ---h----- C:\WINDOWS\super.chm
    2008-05-18 12:07 . 2008-05-18 12:07 <KANSIO> d-------- C:\Program Files\NCH Software
    2008-05-18 12:07 . 2008-05-18 12:07 <KANSIO> d-------- C:\Documents and Settings\Koppis\Application Data\NCH Swift Sound
    2008-05-18 12:07 . 2008-05-18 12:07 <KANSIO> d-------- C:\Documents and Settings\Koppis\Application Data\NCH Software
    2008-05-18 12:07 . 2008-05-18 12:07 <KANSIO> d-------- C:\Documents and Settings\All Users\Application Data\NCH Software
    2008-05-17 22:48 . 2007-10-12 15:14 3,734,536 --a------ C:\WINDOWS\system32\d3dx9_36.dll
    2008-05-13 07:34 . 2008-05-13 07:34 <KANSIO> d-------- C:\Program Files\Screen Recorder Gold

    .
    (((((((((((((((((((((((((((((((((((( Find3M-raportti ))))))))))))))))))))))))))))))))))))))))))))))))))))))
    .
    2008-06-03 17:10 --------- d-----w C:\Program Files\PeerGuardian2
    2008-06-03 16:55 --------- d-----w C:\Documents and Settings\Koppis\Application Data\Skype
    2008-06-02 19:35 --------- d-----w C:\Program Files\RevConnect
    2008-05-29 19:20 107,888 ----a-w C:\WINDOWS\system32\CmdLineExt.dll
    2008-05-28 17:01 --------- d---a-w C:\Documents and Settings\All Users\Application Data\TEMP
    2008-05-28 14:57 --------- d-----w C:\Program Files\Common Files\Wise Installation Wizard
    2008-05-22 11:36 --------- d-----w C:\Program Files\ATI
    2008-05-21 11:51 --------- d-----w C:\Program Files\ATI Technologies
    2008-05-21 11:50 --------- d--h--w C:\Program Files\InstallShield Installation Information
    2008-05-18 09:07 --------- d-----w C:\Program Files\NCH Swift Sound
    2008-05-18 09:00 --------- d-----w C:\Program Files\CamStudio
    2008-05-17 19:48 413,696 ----a-w C:\WINDOWS\system32\wrap_oal.dll
    2008-05-17 19:48 110,592 ----a-w C:\WINDOWS\system32\OpenAL32.dll
    2008-05-06 18:30 --------- d-----w C:\Program Files\Windows Live Safety Center
    2008-04-30 17:22 --------- d-----w C:\Documents and Settings\All Users\Application Data\Ubisoft
    2008-04-26 09:33 --------- d-----w C:\Program Files\Java
    2008-04-21 14:35 --------- d-----w C:\Program Files\HardCopy Pro
    2008-04-21 14:35 --------- d-----w C:\Documents and Settings\Koppis\Application Data\DeskSoft
    2008-04-16 13:40 --------- d-----w C:\Program Files\Winamp
    2008-04-16 13:29 --------- d-----w C:\Program Files\Game_Maker7
    2008-04-16 12:54 8,990,072 ----a-w C:\Program Files\winamp5531_full_emusic-7plus_en-us.exe
    2008-04-15 18:59 --------- d-----w C:\Program Files\Lavalys
    2008-04-15 16:12 --------- d-----w C:\Documents and Settings\Vilpponen\Application Data\The Hobbit
    2008-04-12 16:25 --------- d-----w C:\Program Files\Guitar Pro 5
    2008-04-09 13:49 --------- d-----w C:\Documents and Settings\Vilpponen\Application Data\Skype
    2008-04-06 15:42 --------- d-----w C:\Documents and Settings\Mirja Vilpponen\Application Data\Skype
    2008-03-29 05:19 9,801,728 ----a-w C:\WINDOWS\system32\atioglx2.dll
    2008-03-29 04:40 167,936 ----a-w C:\WINDOWS\system32\atiok3x2.dll
    2008-03-29 04:05 372,736 ----a-w C:\WINDOWS\system32\ATIDEMGX.dll
    2008-03-29 04:04 299,008 ----a-w C:\WINDOWS\system32\ati2dvag.dll
    2008-03-29 03:56 172,032 ----a-w C:\WINDOWS\system32\atipdlxx.dll
    2008-03-29 03:56 126,976 ----a-w C:\WINDOWS\system32\Oemdspif.dll
    2008-03-29 03:55 43,520 ----a-w C:\WINDOWS\system32\ati2edxx.dll
    2008-03-29 03:55 26,112 ----a-w C:\WINDOWS\system32\Ati2mdxx.exe
    2008-03-29 03:55 126,976 ----a-w C:\WINDOWS\system32\ati2evxx.dll
    2008-03-29 03:54 536,576 ----a-w C:\WINDOWS\system32\ati2evxx.exe
    2008-03-29 03:52 53,248 ----a-w C:\WINDOWS\system32\ATIDDC.DLL
    2008-03-29 03:43 3,176,480 ----a-w C:\WINDOWS\system32\ati3duag.dll
    2008-03-29 03:39 307,200 ----a-w C:\WINDOWS\system32\atiiiexx.dll
    2008-03-29 03:36 1,765,120 ----a-w C:\WINDOWS\system32\ativvaxx.dll
    2008-03-29 03:24 46,080 ----a-w C:\WINDOWS\system32\amdpcom32.dll
    2008-03-29 03:23 5,439,488 ----a-w C:\WINDOWS\system32\atioglxx.dll
    2008-03-29 03:21 393,216 ----a-w C:\WINDOWS\system32\atikvmag.dll
    2008-03-29 03:19 17,408 ----a-w C:\WINDOWS\system32\atitvo32.dll
    2008-03-29 03:12 520,192 ----a-w C:\WINDOWS\system32\ati2cqag.dll
    2008-03-28 18:05 593,920 ------w C:\WINDOWS\system32\ati2sgag.exe
    2008-03-25 04:51 621,344 ----a-w C:\WINDOWS\system32\mswstr10.dll
    2008-03-25 04:51 166,688 ----a-w C:\WINDOWS\system32\msjint40.dll
    2008-03-23 22:48 219 ----a-w C:\Documents and Settings\Vilpponen\hsqlprefs.dat
    2008-03-20 08:09 1,845,504 ----a-w C:\WINDOWS\system32\win32k.sys
    2008-03-14 13:16 43,520 ----a-w C:\WINDOWS\system32\CmdLineExt03.dll
    2008-03-10 18:16 22,328 ----a-w C:\Documents and Settings\Koppis\Application Data\PnkBstrK.sys
    2008-03-10 18:15 669,184 ----a-w C:\WINDOWS\system32\pbsvc.exe
    2008-03-10 18:15 66,872 ----a-w C:\WINDOWS\system32\PnkBstrA.exe
    2008-03-10 18:15 103,736 ----a-w C:\WINDOWS\system32\PnkBstrB.exe
    2008-03-04 21:06 24 ----a-w C:\juttelitoimii.bat
    2008-03-04 20:59 56 ----a-w C:\jutteli.bat
    2008-03-04 20:57 185 ----a-w C:\Copybmp.bat
    2008-03-04 11:31 84,526,232 ----a-w C:\Program Files\moviestudio80c-trial_enu.exe
    2008-03-02 18:51 2,699,171 ----a-w C:\Program Files\ccleaner_v2.05.555.zip
    2008-01-05 20:09 630,768 ----a-w C:\Program Files\eval-nwc.exe
    2007-12-15 11:37 8,454,584 ----a-w C:\Program Files\winamp55_full_emusic-7plus_en-us.exe
    2007-11-30 12:40 34,556,560 ----a-w C:\Program Files\QCCSENU.EXE
    2007-11-05 12:11 5,858 ----a-w C:\Program Files\install.log
    2007-11-05 12:10 487,377 ----a-w C:\Program Files\GameSpot_Download_Manager.exe
    2007-08-02 08:39 6,221,304 ----a-w C:\Program Files\winamp535_full_emusic-7plus.exe
    2007-07-10 08:50 1 ----a-w C:\Documents and Settings\Koppis\SI.bin
    2007-06-03 16:33 2,601,692 ----a-w C:\Program Files\mp3wavconverter.exe
    2007-06-01 12:28 1,980,533 ----a-w C:\Program Files\registrymedic.exe
    2007-04-27 14:23 1,205,365 ----a-w C:\Program Files\wrar37b7.exe
    2007-02-13 14:00 19,666,504 ----a-w C:\Program Files\QuickTimeInstaller.exe
    2007-02-07 19:11 643,144 ----a-w C:\Program Files\XviD-1.1.2-01112006.exe
    2007-01-27 20:20 1,063,810 ----a-w C:\Program Files\subedit.zip
    2006-11-30 12:46 1,410,680 ----a-w C:\Program Files\install_flash_player.exe
    2006-11-28 15:57 6,052,528 ----a-w C:\Program Files\FirefoxGoogleToolbarSetup.exe
    2006-11-26 16:21 29,172 -c--a-w C:\Program Files\Da-Vinci-Tour.kmz
    2006-11-26 15:52 14,879,120 ----a-w C:\Program Files\GoogleEarthWin.exe
    2006-11-25 18:05 2,855,080 ----a-w C:\Program Files\aawsepersonal.exe
    2006-11-23 13:07 362,496 ----a-w C:\Program Files\switchsetup.exe
    2006-11-10 14:15 11,284,970 ----a-w C:\Program Files\cdbxp_setup_3.0.116.zip
    2006-11-08 17:19 16,198,952 ----a-w C:\Program Files\Install_Messenger.exe
    2006-11-04 15:57 6,624,984 ----a-w C:\Program Files\winamp531_full_emusic-7plus.exe
    2006-11-04 15:52 3,262,369 ----a-w C:\Program Files\ALZip.exe
    2006-11-04 14:08 6,579,696 ----a-w C:\Program Files\Opera_9.02_International_Setup.exe
    2006-05-03 10:06 163,328 --sh--r C:\WINDOWS\system32\flvDX.dll
    2007-02-21 11:47 31,232 --sh--r C:\WINDOWS\system32\msfDX.dll
    2007-12-17 13:43 27,648 --sh--w C:\WINDOWS\system32\Smab0.dll
    2008-02-04 19:26 151,040 --sh--w C:\WINDOWS\system32\VistaUltm.dll
    .

    (((((((((((((((((((((((((((((( Rekisterin käynnistyskohteet )))))))))))))))))))))))))))))))))))))))))))))
    .
    .
    REGEDIT4
    *Huom* Tyhjiä arvoja ja laillisia oletusarvoja ei näytetä

    [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "MsnMsgr"="C:\Program Files\Windows Live\Messenger\MsnMsgr.exe" [ ]
    "Skype"="C:\Program Files\Skype\Phone\Skype.exe" [2006-12-11 21:41 25343016]
    "igndlm.exe"="C:\Program Files\Download Manager\DLM.exe" [2007-03-06 00:57 1103480]
    "PeerGuardian"="C:\Program Files\PeerGuardian2\pg2.exe" [2005-09-18 18:40 1421824]
    "LogitechSoftwareUpdate"="C:\Program Files\Logitech\Video\ManifestEngine.exe" [2005-06-08 15:44 196608]
    "Octoshape Streaming Services"="C:\Program Files\Octoshape Streaming Services\Koppis\OctoshapeClient.exe" [2006-02-13 19:33 214648]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "HotKeysCmds"="C:\WINDOWS\system32\hkcmd.exe" [2006-08-14 15:41 114688]
    "High Definition Audio -ominaisuussivun pikakuvake"="HDAShCut.exe" [2005-01-07 18:07 61952 C:\WINDOWS\system32\HdAShCut.exe]
    "F-Secure Manager"="C:\Program Files\F-Secure\Common\FSM32.exe" [2005-10-26 04:51 122929]
    "F-Secure TNB"="C:\Program Files\F-Secure\TNB\TNBUtil.exe" [2004-05-27 11:57 684032]
    "DLA"="C:\WINDOWS\System32\DLA\DLACTRLW.EXE" [2005-09-28 06:10 122940]
    "LVCOMSX"="C:\WINDOWS\system32\LVCOMSX.EXE" [2005-07-19 18:32 221184]
    "RTHDCPL"="RTHDCPL.EXE" [2006-10-11 18:36 16267776 C:\WINDOWS\RTHDCPL.exe]
    "LogitechVideoRepair"="C:\Program Files\Logitech\Video\ISStart.exe" [2005-06-08 16:24 458752]
    "LogitechVideoTray"="C:\Program Files\Logitech\Video\LogiTray.exe" [2005-06-08 16:14 217088]
    "DAEMON Tools"="C:\Program Files\DAEMON Tools\daemon.exe" [2006-09-14 23:09 157592]
    "StartCCC"="C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2008-01-21 12:17 61440]
    "itype"="c:\Program Files\Microsoft IntelliType Pro\itype.exe" [2007-08-31 12:13 988584]
    "DPAgnt"="C:\Program Files\DigitalPersona\Bin\DPAgnt.exe" [2006-10-09 16:27 807440]
    "Windows svchost"="service.exe" []

    [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
    "CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2006-03-02 15:00 15360]

    C:\Documents and Settings\All Users\K„ynnist„-valikko\Ohjelmat\K„ynnistys\
    F-Secure Automatic Update.lnk - C:\Program Files\F-Secure\BackWeb\7681197\program\F-Secure Automatic Update.exe [2006-10-31 16:53:14 32807]
    Sonic CinePlayer Quick Launch.lnk - C:\Program Files\Common Files\Sonic Shared\CineTray.exe [2005-10-15 03:01:00 114688]

    [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\ckpNotify]
    ckpNotify.dll 2005-03-01 20:49 24672 C:\WINDOWS\system32\ckpNotify.dll

    [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\DPWLN ]
    C:\WINDOWS\system32\DPWLEvHd.dll 2006-10-09 16:27 99856 C:\WINDOWS\system32\DPWLEvHd.dll

    [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
    "VIDC.I420"= i420vfw.dll
    "vidc.yv12"= yv12vfw.dll

    [HKEY_LOCAL_MACHINE\software\microsoft\security center]
    "AntiVirusDisableNotify"=dword:00000001
    "UpdatesDisableNotify"=dword:00000001
    "FirewallOverride"=dword:00000001

    [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
    "EnableFirewall"= 0 (0x0)

    [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
    "%windir%\\system32\\sessmgr.exe"=
    "C:\\Program Files\\F-Secure\\BackWeb\\7681197\\program\\F-Secure Automatic Update.exe"=
    "C:\\Program Files\\CheckPoint\\SecuRemote\\bin\\SR_Service.exe"=
    "C:\\Program Files\\CheckPoint\\SecuRemote\\bin\\SR_GUI.exe"=
    "C:\\Program Files\\CheckPoint\\SecuRemote\\bin\\scc.exe"=
    "C:\\Program Files\\CheckPoint\\SecuRemote\\bin\\SR_SDS.exe"=
    "C:\\Program Files\\CheckPoint\\SecuRemote\\bin\\SR_Diagnostics.exe"=
    "C:\\Program Files\\uTorrent\\uTorrent.exe"=
    "C:\\WINDOWS\\system32\\dplaysvr.exe"=
    "C:\\Pelit\\Settlers3\\s3.exe"=
    "C:\\Pelit\\Crysis\\Bin32\\Crysis.exe"=
    "C:\\Pelit\\Crysis\\Bin32\\CrysisDedicatedServer.exe"=
    "C:\\WINDOWS\\system32\\PnkBstrA.exe"=
    "C:\\WINDOWS\\system32\\PnkBstrB.exe"=
    "C:\\Program Files\\SmartFTP Client\\SmartFTP.exe"=
    "C:\\Program Files\\Skype\\Phone\\Skype.exe"=

    [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
    "9278:TCP"= 9278:TCP:BitComet 9278 TCP
    "9278:UDP"= 9278:UDP:BitComet 9278 UDP

    R0 FSFW;F-Secure Firewall Driver;C:\WINDOWS\system32\drivers\fsdfw.sys [2005-10-31 13:01]
    R1 bbcap;bbcap;C:\WINDOWS\system32\DRIVERS\bbcap.sys [2007-06-24 23:03]
    R2 BackWeb Plug-in - 7681197;F-Secure Automatic Update;C:\PROGRA~1\F-Secure\BackWeb\7681197\Program\SERVIC~1.EXE [2006-10-31 16:53]
    R2 F-Secure Filter;F-Secure File System Filter;C:\Program Files\F-Secure\Anti-Virus\Win2K\FSfilter.sys [2005-08-19 16:37]
    R2 F-Secure Gatekeeper;F-Secure Gatekeeper;C:\Program Files\F-Secure\Anti-Virus\Win2K\FSgk.sys [2005-10-06 17:30]
    R2 F-Secure Recognizer;F-Secure File System Recognizer;C:\Program Files\F-Secure\Anti-Virus\Win2K\FSrec.sys [2005-08-19 16:37]
    R2 Scap;SecureClient Application Policy Module;C:\WINDOWS\system32\DRIVERS\Scap.sys [2005-03-01 20:49]
    R2 SVKP;SVKP;C:\WINDOWS\system32\SVKP.sys [2007-06-01 15:28]
    R2 UxTuneUp;TuneUp Theme Extension;C:\WINDOWS\System32\svchost.exe [2006-03-02 15:00]
    R3 dpK0Bx01;Fingerprint Reader Filter Driver;C:\WINDOWS\system32\DRIVERS\dpK0Bx01.sys [2006-09-16 17:25]
    R3 FW1;SecuRemote Miniport;C:\WINDOWS\system32\DRIVERS\fw.sys [2005-03-01 20:49]
    R3 usbdpfp;Fingerprint Reader Class Driver;C:\WINDOWS\system32\DRIVERS\usbdpfp.sys [2006-09-16 17:23]
    S0 stwlfbus;stwlfbus;C:\WINDOWS\system32\DRIVERS\stwlfbus.sys [2003-04-27 13:39]
    S3 ggflt;SEMC USB Flash Driver Filter;C:\WINDOWS\system32\DRIVERS\ggflt.sys [2008-02-16 21:03]
    S3 gsplittm;gsplittm;C:\DOCUME~1\Koppis\LOCALS~1\Temp\gsplittm.sys []
    S3 OMVA;VPN-1 SecureClient Adapter;C:\WINDOWS\system32\DRIVERS\OMVA.sys [2005-03-01 20:49]
    S3 st3wolf;st3wolf;C:\WINDOWS\system32\DRIVERS\st3wolf.sys [2003-04-27 12:43]
    S3 w200bus;Sony Ericsson W200 driver (WDM);C:\WINDOWS\system32\DRIVERS\w200bus.sys [2006-11-07 10:42]
    S3 w200mdfl;Sony Ericsson W200 USB WMC Modem Filter;C:\WINDOWS\system32\DRIVERS\w200mdfl.sys [2006-11-07 10:42]
    S3 w200mdm;Sony Ericsson W200 USB WMC Modem Driver;C:\WINDOWS\system32\DRIVERS\w200mdm.sys [2006-11-07 10:42]
    S3 w200mgmt;Sony Ericsson W200 USB WMC Device Management Drivers (WDM);C:\WINDOWS\system32\DRIVERS\w200mgmt.sys [2006-11-07 10:42]
    S3 w200obex;Sony Ericsson W200 USB WMC OBEX Interface;C:\WINDOWS\system32\DRIVERS\w200obex.sys [2006-11-07 10:42]

    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost - NetSvcs
    UxTuneUp

    [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{86167224-b6ba-11dc-8548-0016350dc46d}]
    \Shell\AutoRun\command - I:\PortableApps\PortableAppsMenu\PortableAppsMenu.exe

    .
    'Ajoitetut tehtävät'-kansion sisältö
    "2008-05-30 14:17:09 C:\WINDOWS\Tasks\1-Click Maintenance.job"
    - C:\Program Files\TuneUp Utilities 2007\SystemOptimizer.exe
    "2007-02-13 14:00:42 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job"
    - C:\Program Files\Apple Software Update\SoftwareUpdate.exe
    "2008-06-03 10:06:49 C:\WINDOWS\Tasks\Scheduled scanning task.job"
    - C:\PROGRA~1\F-Secure\ANTI-V~1\fsav.exeZ /HARD /ARCHIVE /DISINF /SCHED /NOBREAK /REPORT=C:\PROGRA~1\F-Secure\ANTI-V~1\report.txt
    .
    **************************************************************************

    catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
    Rootkit scan 2008-06-03 20:10:03
    Windows 5.1.2600 Service Pack 2 NTFS

    scanning hidden processes ...

    scanning hidden autostart entries ...

    scanning hidden files ...

    scan completed successfully
    hidden files: 0

    **************************************************************************
    .
    Completion time: 2008-06-03 20:12:27
    ComboFix-quarantined-files.txt 2008-06-03 17:11:52
    ComboFix2.txt 2008-06-03 16:29:13
    ComboFix3.txt 2008-05-29 11:02:29

    Pre-Run: 25,309,265,920 tavua vapaana
    Post-Run: 25,295,093,760 tavua vapaana

    319 --- E O F --- 2008-05-16 21:03:47





    ==================================







    Logfile of Trend Micro HijackThis v2.0.0 (BETA)
    Scan saved at 22:33, on 3.6.2008
    Platform: Windows XP SP2 (WinNT 5.01.2600)
    Boot mode: Normal

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\Ati2evxx.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\system32\spoolsv.exe
    C:\WINDOWS\system32\Ati2evxx.exe
    C:\Program Files\DigitalPersona\Bin\DPWinLct.exe
    C:\PROGRA~1\F-Secure\BackWeb\7681197\Program\SERVIC~1.EXE
    C:\WINDOWS\system32\drivers\CDAC11BA.EXE
    C:\Program Files\DigitalPersona\Bin\DpHost.exe
    C:\Program Files\F-Secure\Anti-Virus\fsgk32st.exe
    C:\Program Files\F-Secure\Anti-Virus\FSGK32.EXE
    C:\Program Files\F-Secure\BackWeb\7681197\program\fsbwsys.exe
    C:\Program Files\F-Secure\Anti-Virus\fssm32.exe
    C:\Program Files\F-Secure\Common\FSMA32.EXE
    C:\Program Files\F-Secure\Common\FSMB32.EXE
    C:\WINDOWS\system32\PnkBstrA.exe
    C:\Program Files\F-Secure\Common\FCH32.EXE
    C:\Program Files\CheckPoint\SecuRemote\bin\SR_Service.exe
    C:\Program Files\CheckPoint\SecuRemote\bin\SR_WatchDog.exe
    C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe
    C:\WINDOWS\system32\svchost.exe
    C:\Program Files\F-Secure\Common\FAMEH32.EXE
    C:\Program Files\F-Secure\Anti-Virus\fsqh.exe
    C:\Program Files\F-Secure\Anti-Virus\fsrw.exe
    C:\WINDOWS\system32\UAService7.exe
    C:\Program Files\DigitalPersona\Bin\DPFUSMgr.exe
    C:\Program Files\F-Secure\Anti-Virus\fsav32.exe
    C:\Program Files\F-Secure\Common\FNRB32.EXE
    C:\Program Files\F-Secure\FWES\Program\fsdfwd.exe
    C:\Program Files\F-Secure\Common\FIH32.EXE
    C:\WINDOWS\system32\wscntfy.exe
    C:\WINDOWS\Explorer.EXE
    C:\Program Files\CheckPoint\SecuRemote\bin\SR_GUI.Exe
    C:\Program Files\F-Secure\Common\FSM32.EXE
    C:\WINDOWS\System32\DLA\DLACTRLW.EXE
    C:\WINDOWS\system32\LVCOMSX.EXE
    C:\PROGRA~1\F-Secure\ANTI-S~1\fsaw.exe
    C:\WINDOWS\RTHDCPL.EXE
    C:\Program Files\Logitech\Video\LogiTray.exe
    C:\Program Files\F-Secure\FSGUI\fsguidll.exe
    C:\Program Files\DAEMON Tools\daemon.exe
    C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
    C:\Program Files\Microsoft IntelliType Pro\itype.exe
    C:\Program Files\DigitalPersona\Bin\DPAgnt.exe
    C:\Program Files\Skype\Phone\Skype.exe
    C:\Program Files\PeerGuardian2\pg2.exe
    C:\Program Files\F-Secure\BackWeb\7681197\program\F-Secure Automatic Update.exe
    c:\Program Files\Microsoft IntelliType Pro\dpupdchk.exe
    C:\Program Files\Common Files\Sonic Shared\CineTray.exe
    C:\Program Files\Logitech\Video\FxSvr2.exe
    C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\ccc.exe
    C:\Program Files\Skype\Plugin Manager\SkypePM.exe
    C:\Program Files\Octoshape Streaming Services\Koppis\OctoshapeClient.exe
    C:\Program Files\Mozilla Firefox\firefox.exe
    C:\Program Files\HiJackThis_v2\hoojiitee.exe

    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
    R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Linkit
    R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
    O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
    O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
    O2 - BHO: DriveLetterAccess - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\System32\DLA\DLASHX_W.DLL
    O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
    O2 - BHO: Windows Liven kirjautumisapuohjelma - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
    O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
    O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe
    O4 - HKLM\..\Run: [High Definition Audio -ominaisuussivun pikakuvake] HDAShCut.exe
    O4 - HKLM\..\Run: [F-Secure Manager] "C:\Program Files\F-Secure\Common\FSM32.EXE" /splash
    O4 - HKLM\..\Run: [F-Secure TNB] "C:\Program Files\F-Secure\TNB\TNBUtil.exe" /CHECKALL /WAITFORSW
    O4 - HKLM\..\Run: [DLA] C:\WINDOWS\System32\DLA\DLACTRLW.EXE
    O4 - HKLM\..\Run: [LVCOMSX] C:\WINDOWS\system32\LVCOMSX.EXE
    O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
    O4 - HKLM\..\Run: [LogitechVideoRepair] C:\Program Files\Logitech\Video\ISStart.exe
    O4 - HKLM\..\Run: [LogitechVideoTray] C:\Program Files\Logitech\Video\LogiTray.exe
    O4 - HKLM\..\Run: [DAEMON Tools] "C:\Program Files\DAEMON Tools\daemon.exe" -lang 1033
    O4 - HKLM\..\Run: [StartCCC] "C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe"
    O4 - HKLM\..\Run: [itype] "c:\Program Files\Microsoft IntelliType Pro\itype.exe"
    O4 - HKLM\..\Run: [DPAgnt] C:\Program Files\DigitalPersona\Bin\DPAgnt.exe
    O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background
    O4 - HKCU\..\Run: [Skype] "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized
    O4 - HKCU\..\Run: [igndlm.exe] C:\Program Files\Download Manager\DLM.exe /windowsstart /startifwork
    O4 - HKCU\..\Run: [PeerGuardian] C:\Program Files\PeerGuardian2\pg2.exe
    O4 - HKCU\..\Run: [LogitechSoftwareUpdate] "C:\Program Files\Logitech\Video\ManifestEngine.exe" boot
    O4 - HKCU\..\Run: [Octoshape Streaming Services] "C:\Program Files\Octoshape Streaming Services\Koppis\OctoshapeClient.exe" -inv:bootrun
    O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Paikallinen palve')
    O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Verkkopalve')
    O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
    O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
    O4 - Global Startup: F-Secure Automatic Update.lnk = C:\Program Files\F-Secure\BackWeb\7681197\program\F-Secure Automatic Update.exe
    O4 - Global Startup: Sonic CinePlayer Quick Launch.lnk = C:\Program Files\Common Files\Sonic Shared\CineTray.exe
    O8 - Extra context menu item: &Block this popup - C:\Program Files\F-Secure\Anti-Spyware\blockpopups.htm
    O8 - Extra context menu item: &D&ownload &with BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddLink.htm
    O8 - Extra context menu item: &D&ownload all video with BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddVideo.htm
    O8 - Extra context menu item: &D&ownload all with BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddAllLink.htm
    O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
    O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
    O9 - Extra button: IE Shield - {300DB664-75B5-47c0-8B45-A44ACCF73C00} - C:\Program Files\F-Secure\Anti-Spyware\ieshield.dll
    O9 - Extra 'Tools' menuitem: IE Shield... - {300DB664-75B5-47c0-8B45-A44ACCF73C00} - C:\Program Files\F-Secure\Anti-Spyware\ieshield.dll
    O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)
    O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)
    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - C:\Program Files\Yahoo!\Common\yinsthelper.dll
    O16 - DPF: {39B0684F-D7BF-4743-B050-FDC3F48F7E3B} (CDownloadCtrl Object) - http://www.fileplanet.com/fpdlmgr/cabs/FPDC_2.3.6.108.cab
    O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://download.bitdefender.com/resources/scan8/oscan8.cab
    O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1162297554309
    O17 - HKLM\System\CCS\Services\Tcpip\..\{EF416D88-D8DA-40DC-A196-4F3A1F7E69A4}: NameServer = 192.168.1.254
    O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
    O20 - Winlogon Notify: DPWLN - C:\WINDOWS\system32\DPWLEvHd.dll
    O22 - SharedTaskScheduler: Browseui preloader - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - C:\WINDOWS\system32\browseui.dll
    O22 - SharedTaskScheduler: Component Categories cache daemon - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\WINDOWS\system32\browseui.dll
    O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
    O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
    O23 - Service: F-Secure Automatic Update (BackWeb Plug-in - 7681197) - F-Secure Automatic Update - C:\PROGRA~1\F-Secure\BackWeb\7681197\Program\SERVIC~1.EXE
    O23 - Service: C-DillaCdaC11BA - Macrovision - C:\WINDOWS\system32\drivers\CDAC11BA.EXE
    O23 - Service: Loogisen levyn hallinnan valvontapalvelu (dmadmin) - Unknown owner - C:\WINDOWS\System32\dmadmin.exe
    O23 - Service: Windows XP FUS Manager (DPFUSMgr) - DigitalPersona, Inc. - C:\Program Files\DigitalPersona\Bin\DPFUSMgr.exe
    O23 - Service: Biometric Authentication Service (DpHost) - DigitalPersona, Inc. - C:\Program Files\DigitalPersona\Bin\DpHost.exe
    O23 - Service: Tapahtumaloki (Eventlog) - Unknown owner - C:\WINDOWS\system32\services.exe
    O23 - Service: FSGKHS (F-Secure Gatekeeper Handler Starter) - Unknown owner - C:\Program Files\F-Secure\Anti-Virus\fsgk32st.exe
    O23 - Service: F-Secure Network Request Broker - F-Secure Corporation - C:\Program Files\F-Secure\Common\FNRB32.EXE
    O23 - Service: fsbwsys - Unknown owner - C:\Program Files\F-Secure\BackWeb\7681197\program\fsbwsys.exe
    O23 - Service: F-Secure Anti-Virus Firewall Daemon (FSDFWD) - F-Secure Corporation - C:\Program Files\F-Secure\FWES\Program\fsdfwd.exe
    O23 - Service: F-Secure Management Agent (FSMA) - F-Secure Corporation - C:\Program Files\F-Secure\Common\FSMA32.EXE
    O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
    O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
    O23 - Service: CD-levyjen kirjoittamisen IMAPI COM -palvelu (ImapiService) - Unknown owner - C:\WINDOWS\system32\imapi.exe
    O23 - Service: NetMeeting etätyöpöydän jakaminen (mnmsrvc) - Unknown owner - C:\WINDOWS\system32\mnmsrvc.exe
    O23 - Service: Plug and Play (PlugPlay) - Unknown owner - C:\WINDOWS\system32\services.exe
    O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\system32\PnkBstrA.exe
    O23 - Service: Etätyöpöydän ohjeen istunnonhallinta (RDSessMgr) - Unknown owner - C:\WINDOWS\system32\sessmgr.exe
    O23 - Service: Älykortti (SCardSvr) - Unknown owner - C:\WINDOWS\System32\SCardSvr.exe
    O23 - Service: Check Point SecuRemote Service (SR_Service) - Check Point Software Technologies - C:\Program Files\CheckPoint\SecuRemote\bin\SR_Service.exe
    O23 - Service: Check Point SecuRemote WatchDog (SR_WatchDog) - Check Point Software Technologies - C:\Program Files\CheckPoint\SecuRemote\bin\SR_WatchDog.exe
    O23 - Service: StarWind AE Service (StarWindServiceAE) - Rocket Division Software - C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe
    O23 - Service: Resurssilokit ja -hälytykset (SysmonLog) - Unknown owner - C:\WINDOWS\system32\smlogsvc.exe
    O23 - Service: Telnet (TlntSvr) - Unknown owner - C:\WINDOWS\system32\tlntsvr.exe
    O23 - Service: SecuROM User Access Service (V7) (UserAccess7) - Sony DADC Austria AG. - C:\WINDOWS\system32\UAService7.exe
    O23 - Service: Aseman tilannevedos (VSS) - Unknown owner - C:\WINDOWS\System32\vssvc.exe
    O23 - Service: WMI resurssisovitin (WmiApSrv) - Unknown owner - C:\WINDOWS\system32\wbem\wmiapsrv.exe

    --
    End of file - 12519 bytes



    Noniin, pitkä viesti
     
    Koppis1, Jun 3, 2008
    #7
  8. Hujo

    Hujo Guest

    Avaa Muistio ja kopioi/liitä quoteboxin sisältö sinne:

    Tallenna se nimellä CFScript.txt

    Sitten raahaa CFScript ComboFix.exeen kuten alla.
    [​IMG]

    Käynnistä tietokone uudelleen pyydettäessä ja lähetä combofix.txt-tiedoston sisältö tänne.
     
    Hujo, Jun 3, 2008
    #8
  9. Koppis1

    Koppis1 Member

    Joined:
    Jun 26, 2007
    Messages:
    77
    Likes Received:
    0
    Trophy Points:
    16
    Olin kolme päivää lomalla mökillä, tässä ComboFix loki:





    ComboFix 08-06-01.6 - Koppis 2008-06-08 15:45:51.7 - NTFSx86
    Microsoft Windows XP Professional 5.1.2600.2.1252.1.1035.18.925 [GMT 3:00]
    Running from: C:\Documents and Settings\Koppis\Työpöytä\ComboFix.exe
    Command switches used :: C:\Documents and Settings\Koppis\Työpöytä\CFScript.txt.txt
    * Created a new restore point
    * Resident AV is active


    WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!

    FILE ::
    C:\bot1.exe
    C:\sqmdata15.sqm
    C:\sqmdata16.sqm
    C:\sqmnoopt15.sqm
    C:\sqmnoopt16.sqm
    .

    (((((((((((((((((((((((((((((((((((((( Muut poistot ))))))))))))))))))))))))))))))))))))))))))))))))))))))))
    .

    C:\sqmdata15.sqm
    C:\sqmdata16.sqm
    C:\sqmnoopt15.sqm
    C:\sqmnoopt16.sqm

    .
    ((((( Tiedostot, jotka on luotu seuraavalla aikavälillä: 2008-05-08 to 2008-06-08 )))))))))))))))))
    .

    2008-06-03 23:06 . 2008-06-03 23:06 <KANSIO> d-------- C:\Documents and Settings\All Users\Application Data\YoYoGames
    2008-06-03 21:54 . 2008-06-03 21:54 <KANSIO> d-------- C:\WINDOWS\ERUNT
    2008-06-03 21:51 . 2008-06-03 21:51 <KANSIO> d-------- C:\Documents and Settings\Koppis\Ty÷p÷ytõ
    2008-06-03 19:06 . 2008-06-03 19:06 86,548 --a------ C:\setz.exe
    2008-06-03 19:05 . 2008-06-03 19:05 4,217 --a------ C:\WINDOWS\is154890.exe
    2008-06-03 13:13 . 2008-06-03 13:13 <KANSIO> d-------- C:\Documents and Settings\Vilpponen\Application Data\Malwarebytes
    2008-06-02 22:29 . 2008-06-02 22:29 97,116 --a------ C:\WINDOWS\DC5177176.zip
    2008-06-01 23:33 . 2008-06-01 23:33 <KANSIO> d-------- C:\Program Files\Live_TV
    2008-06-01 23:30 . 2008-06-01 23:56 <KANSIO> d-------- C:\Program Files\3GP Converter 2007
    2008-06-01 23:30 . 2008-06-01 23:30 54,156 --ah----- C:\WINDOWS\QTFont.qfn
    2008-06-01 23:30 . 2008-06-01 23:30 1,409 --a------ C:\WINDOWS\QTFont.for
    2008-06-01 23:13 . 2008-06-01 23:13 3,758,036 --a------ C:\spore.3gp
    2008-06-01 23:09 . 2008-06-01 23:09 <KANSIO> d-------- C:\Program Files\WinAVI MP4 Converter
    2008-06-01 21:37 . 2008-06-01 21:37 <KANSIO> d-------- C:\Program Files\SmartFTP Client 3.0 Setup Files
    2008-06-01 21:37 . 2008-06-01 21:37 <KANSIO> d-------- C:\Program Files\SmartFTP Client
    2008-06-01 21:37 . 2008-06-01 21:37 <KANSIO> d-------- C:\Documents and Settings\Koppis\Application Data\SmartFTP
    2008-05-31 15:37 . 2008-05-31 15:37 0 --ah----- C:\WINDOWS\system32\drivers\Msft_Kernel_NuidFltr_01005.Wdf
    2008-05-31 15:36 . 2004-09-14 16:11 21,504 --a------ C:\WINDOWS\system32\drivers\hidserv.dll
    2008-05-31 10:46 . 2008-05-31 10:47 1,646,766 --a------ C:\We_hold_these_truths.flv.MP3.OGG
    2008-05-31 10:45 . 2008-05-31 10:46 558,088 --a------ C:\The Flight of the Bumble Bee.flv.MP3.OGG
    2008-05-31 10:44 . 2008-05-31 10:45 2,007,871 --a------ C:\Speed metal messiah.flv.MP3.OGG
    2008-05-31 10:43 . 2008-05-31 10:44 2,315,607 --a------ C:\necro.ogg.MP3.OGG
    2008-05-31 10:42 . 2008-05-31 10:43 2,297,579 --a------ C:\Jerryc - Canon Rock (Guitar Play).mp3.OGG
    2008-05-31 10:40 . 2008-05-31 10:42 3,361,200 --a------ C:\Dragonforce - Revolution Deathsquad.mp3.OGG
    2008-05-31 10:38 . 2008-05-31 10:40 2,260,120 --a------ C:\06 - Wedding Nails mp3.mp3.OGG
    2008-05-31 10:37 . 2008-05-31 10:38 2,090,948 --a------ C:\01 Black Dog.mp3.OGG
    2008-05-31 10:35 . 2008-05-31 10:37 2,797,956 --a------ C:\Wedding_Nails.mp3.OGG
    2008-05-31 10:29 . 2008-05-31 10:29 1,257,221 --a------ C:\The Flight of the Bumble Bee.flv.MP3
    2008-05-31 10:28 . 2008-05-31 10:28 5,231,595 --a------ C:\Corpse_tumor.flv.MP3
    2008-05-31 10:28 . 2008-05-31 10:29 4,536,111 --a------ C:\Speed metal messiah.flv.MP3
    2008-05-31 10:27 . 2008-05-31 10:27 7,047,627 --a------ C:\We_hold_these_truths.flv.MP3
    2008-05-30 17:50 . 2008-05-30 17:50 <KANSIO> d-------- C:\Program Files\Webteh
    2008-05-30 17:49 . 2008-05-30 17:49 9,380,296 --a------ C:\Program Files\bsplayer228.964_clip.exe
    2008-05-30 14:38 . 2008-05-30 14:38 <KANSIO> d-------- C:\WINDOWS\system32\Clickteam
    2008-05-30 14:38 . 2008-05-30 14:38 <KANSIO> d-------- C:\Documents and Settings\Koppis\Application Data\Clickteam
    2008-05-29 21:05 . 2008-05-29 21:05 <KANSIO> d-------- C:\Documents and Settings\Mirja Vilpponen\Application Data\DigitalPersona
    2008-05-29 18:26 . 2008-05-29 18:26 <KANSIO> d-------- C:\Documents and Settings\Vilpponen\Application Data\DigitalPersona
    2008-05-29 18:26 . 2008-05-29 18:26 <KANSIO> d-------- C:\Documents and Settings\Vilpponen\Application Data\ATI
    2008-05-29 10:32 . 2008-06-03 13:54 <KANSIO> d-------- C:\Program Files\Malwarebytes' Anti-Malware
    2008-05-29 10:32 . 2008-05-29 10:32 <KANSIO> d-------- C:\Documents and Settings\Koppis\Application Data\Malwarebytes
    2008-05-29 10:32 . 2008-05-29 10:32 <KANSIO> d-------- C:\Documents and Settings\All Users\Application Data\Malwarebytes
    2008-05-29 10:32 . 2008-05-30 01:06 34,296 --a------ C:\WINDOWS\system32\drivers\mbamcatchme.sys
    2008-05-29 10:32 . 2008-05-30 01:06 15,864 --a------ C:\WINDOWS\system32\drivers\mbam.sys
    2008-05-28 22:22 . 2008-05-28 22:22 <KANSIO> d-------- C:\Program Files\Trend Micro
    2008-05-28 21:41 . 2008-05-28 21:41 2,855 --a------ C:\ComboFix.PIF
    2008-05-28 21:31 . 2008-05-28 21:31 0 --a------ C:\ComboFix.exe
    2008-05-28 20:29 . 2008-06-03 22:33 <KANSIO> d-------- C:\Program Files\HiJackThis_v2
    2008-05-28 20:16 . 2008-05-28 20:28 <KANSIO> d-------- C:\WINDOWS\BDOSCAN8
    2008-05-28 18:05 . 2008-05-28 18:05 <KANSIO> d-------- C:\Documents and Settings\Koppis\Application Data\DigitalPersona
    2008-05-28 17:58 . 2008-05-28 17:58 <KANSIO> d-------- C:\WINDOWS\DPDrv
    2008-05-28 17:58 . 2008-05-28 17:58 <KANSIO> d-------- C:\Program Files\DigitalPersona
    2008-05-28 17:26 . 2008-05-28 17:26 <KANSIO> d-------- C:\Program Files\DP10-002
    2008-05-28 17:26 . 2008-05-28 17:26 2,334,453 --a------ C:\Program Files\DP10-002.zip
    2008-05-28 16:43 . 2008-05-28 16:43 8,579,136 --a------ C:\Program Files\DPPM_201_ENG.exe
    2008-05-28 16:04 . 2007-08-31 12:15 18,856 --a------ C:\WINDOWS\system32\drivers\nuidfltr.sys
    2008-05-28 16:03 . 2008-05-28 16:39 <KANSIO> d-------- C:\Program Files\Microsoft IntelliType Pro
    2008-05-28 15:48 . 2004-09-14 16:11 21,504 --a------ C:\WINDOWS\system32\hidserv.dll
    2008-05-28 15:48 . 2004-09-14 16:11 21,504 --a--c--- C:\WINDOWS\system32\dllcache\hidserv.dll
    2008-05-27 21:48 . 2008-05-27 21:48 3,510,857 --a------ C:\SMB2AV.MP3
    2008-05-27 21:48 . 2008-05-27 21:48 2,069,315 --a------ C:\FB.MP3
    2008-05-27 21:47 . 2008-05-27 21:48 3,554,742 --a------ C:\SMBAV.MP3
    2008-05-27 08:32 . 2008-05-27 08:32 <KANSIO> d-------- C:\Documents and Settings\Mirja Vilpponen\Application Data\ATI
    2008-05-25 21:05 . 2008-05-29 16:55 <KANSIO> d-------- C:\Program Files\Cheat Engine
    2008-05-25 21:05 . 2007-12-26 17:30 1,970,176 --a------ C:\WINDOWS\system32\d3dx9.dll
    2008-05-25 21:05 . 2007-12-26 17:30 679,936 --a------ C:\WINDOWS\system32\D3DX81ab.dll
    2008-05-22 22:13 . 2008-05-22 22:13 <KANSIO> d-------- C:\Program Files\Octoshape Streaming Services
    2008-05-22 15:11 . 2008-05-22 17:12 <KANSIO> d-------- C:\Program Files\mIRC
    2008-05-22 15:11 . 2008-05-22 17:16 <KANSIO> d-------- C:\Documents and Settings\Koppis\Application Data\mIRC
    2008-05-21 14:57 . 2008-06-08 13:44 31 --a------ C:\WINDOWS\system32\bbcap.err
    2008-05-21 14:56 . 2008-05-21 14:56 <KANSIO> d-------- C:\Documents and Settings\Koppis\Application Data\ATI
    2008-05-21 14:56 . 2008-05-21 14:56 <KANSIO> d-------- C:\Documents and Settings\All Users\Application Data\ATI
    2008-05-18 18:49 . 2008-05-18 18:49 <KANSIO> d-------- C:\Program Files\Mioplanet
    2008-05-18 18:49 . 2008-05-18 18:49 <KANSIO> d-------- C:\Documents and Settings\Koppis\Application Data\mioObjects
    2008-05-18 18:49 . 2008-05-18 18:49 407,047 --a------ C:\WINDOWS\system32\mioengine.exe
    2008-05-18 12:30 . 2008-05-18 12:30 <KANSIO> d-------- C:\Program Files\eRightSoft
    2008-05-18 12:30 . 2006-09-12 14:46 227,328 -r-hs---- C:\WINDOWS\system32\ac3DX.ax
    2008-05-18 12:30 . 2006-05-03 13:06 163,328 -r-hs---- C:\WINDOWS\system32\flvDX.dll
    2008-05-18 12:30 . 2008-02-04 22:26 151,040 ---hs---- C:\WINDOWS\system32\VistaUltm.dll
    2008-05-18 12:30 . 2006-01-13 02:23 123,904 -r-hs---- C:\WINDOWS\system32\AVCDX.ax
    2008-05-18 12:30 . 2003-11-21 02:00 54,784 -r-hs---- C:\WINDOWS\system32\RLAPEDec.ax
    2008-05-18 12:30 . 2004-04-27 02:00 37,888 -r-hs---- C:\WINDOWS\system32\RLMPCDec.ax
    2008-05-18 12:30 . 2007-02-21 14:47 31,232 -r-hs---- C:\WINDOWS\system32\msfDX.dll
    2008-05-18 12:30 . 2007-12-17 16:43 27,648 ---hs---- C:\WINDOWS\system32\Smab0.dll
    2008-05-18 12:30 . 2008-02-05 20:04 9,884 ---h----- C:\WINDOWS\super.chm
    2008-05-18 12:07 . 2008-05-18 12:07 <KANSIO> d-------- C:\Program Files\NCH Software
    2008-05-18 12:07 . 2008-05-18 12:07 <KANSIO> d-------- C:\Documents and Settings\Koppis\Application Data\NCH Swift Sound
    2008-05-18 12:07 . 2008-05-18 12:07 <KANSIO> d-------- C:\Documents and Settings\Koppis\Application Data\NCH Software
    2008-05-18 12:07 . 2008-05-18 12:07 <KANSIO> d-------- C:\Documents and Settings\All Users\Application Data\NCH Software
    2008-05-17 22:48 . 2007-10-12 15:14 3,734,536 --a------ C:\WINDOWS\system32\d3dx9_36.dll
    2008-05-13 07:34 . 2008-05-13 07:34 <KANSIO> d-------- C:\Program Files\Screen Recorder Gold

    .
    (((((((((((((((((((((((((((((((((((( Find3M-raportti ))))))))))))))))))))))))))))))))))))))))))))))))))))))
    .
    2008-06-08 12:50 --------- d-----w C:\Program Files\PeerGuardian2
    2008-06-08 12:50 --------- d-----w C:\Documents and Settings\Koppis\Application Data\Skype
    2008-06-02 19:35 --------- d-----w C:\Program Files\RevConnect
    2008-05-29 19:20 107,888 ----a-w C:\WINDOWS\system32\CmdLineExt.dll
    2008-05-28 17:01 --------- d---a-w C:\Documents and Settings\All Users\Application Data\TEMP
    2008-05-28 14:57 --------- d-----w C:\Program Files\Common Files\Wise Installation Wizard
    2008-05-22 11:36 --------- d-----w C:\Program Files\ATI
    2008-05-21 11:51 --------- d-----w C:\Program Files\ATI Technologies
    2008-05-21 11:50 --------- d--h--w C:\Program Files\InstallShield Installation Information
    2008-05-18 09:07 --------- d-----w C:\Program Files\NCH Swift Sound
    2008-05-18 09:00 --------- d-----w C:\Program Files\CamStudio
    2008-05-17 19:48 413,696 ----a-w C:\WINDOWS\system32\wrap_oal.dll
    2008-05-17 19:48 110,592 ----a-w C:\WINDOWS\system32\OpenAL32.dll
    2008-05-06 18:30 --------- d-----w C:\Program Files\Windows Live Safety Center
    2008-04-30 17:22 --------- d-----w C:\Documents and Settings\All Users\Application Data\Ubisoft
    2008-04-26 09:33 --------- d-----w C:\Program Files\Java
    2008-04-21 14:35 --------- d-----w C:\Program Files\HardCopy Pro
    2008-04-21 14:35 --------- d-----w C:\Documents and Settings\Koppis\Application Data\DeskSoft
    2008-04-16 13:40 --------- d-----w C:\Program Files\Winamp
    2008-04-16 13:29 --------- d-----w C:\Program Files\Game_Maker7
    2008-04-16 12:54 8,990,072 ----a-w C:\Program Files\winamp5531_full_emusic-7plus_en-us.exe
    2008-04-15 18:59 --------- d-----w C:\Program Files\Lavalys
    2008-04-15 16:12 --------- d-----w C:\Documents and Settings\Vilpponen\Application Data\The Hobbit
    2008-04-12 16:25 --------- d-----w C:\Program Files\Guitar Pro 5
    2008-04-09 13:49 --------- d-----w C:\Documents and Settings\Vilpponen\Application Data\Skype
    2008-03-29 05:19 9,801,728 ----a-w C:\WINDOWS\system32\atioglx2.dll
    2008-03-29 04:40 167,936 ----a-w C:\WINDOWS\system32\atiok3x2.dll
    2008-03-29 04:05 372,736 ----a-w C:\WINDOWS\system32\ATIDEMGX.dll
    2008-03-29 04:04 299,008 ----a-w C:\WINDOWS\system32\ati2dvag.dll
    2008-03-29 03:56 172,032 ----a-w C:\WINDOWS\system32\atipdlxx.dll
    2008-03-29 03:56 126,976 ----a-w C:\WINDOWS\system32\Oemdspif.dll
    2008-03-29 03:55 43,520 ----a-w C:\WINDOWS\system32\ati2edxx.dll
    2008-03-29 03:55 26,112 ----a-w C:\WINDOWS\system32\Ati2mdxx.exe
    2008-03-29 03:55 126,976 ----a-w C:\WINDOWS\system32\ati2evxx.dll
    2008-03-29 03:54 536,576 ----a-w C:\WINDOWS\system32\ati2evxx.exe
    2008-03-29 03:52 53,248 ----a-w C:\WINDOWS\system32\ATIDDC.DLL
    2008-03-29 03:43 3,176,480 ----a-w C:\WINDOWS\system32\ati3duag.dll
    2008-03-29 03:39 307,200 ----a-w C:\WINDOWS\system32\atiiiexx.dll
    2008-03-29 03:36 1,765,120 ----a-w C:\WINDOWS\system32\ativvaxx.dll
    2008-03-29 03:24 46,080 ----a-w C:\WINDOWS\system32\amdpcom32.dll
    2008-03-29 03:23 5,439,488 ----a-w C:\WINDOWS\system32\atioglxx.dll
    2008-03-29 03:21 393,216 ----a-w C:\WINDOWS\system32\atikvmag.dll
    2008-03-29 03:19 17,408 ----a-w C:\WINDOWS\system32\atitvo32.dll
    2008-03-29 03:12 520,192 ----a-w C:\WINDOWS\system32\ati2cqag.dll
    2008-03-28 18:05 593,920 ------w C:\WINDOWS\system32\ati2sgag.exe
    2008-03-25 04:51 621,344 ----a-w C:\WINDOWS\system32\mswstr10.dll
    2008-03-25 04:51 166,688 ----a-w C:\WINDOWS\system32\msjint40.dll
    2008-03-23 22:48 219 ----a-w C:\Documents and Settings\Vilpponen\hsqlprefs.dat
    2008-03-20 08:09 1,845,504 ----a-w C:\WINDOWS\system32\win32k.sys
    2008-03-14 13:16 43,520 ----a-w C:\WINDOWS\system32\CmdLineExt03.dll
    2008-03-10 18:16 22,328 ----a-w C:\Documents and Settings\Koppis\Application Data\PnkBstrK.sys
    2008-03-10 18:15 669,184 ----a-w C:\WINDOWS\system32\pbsvc.exe
    2008-03-10 18:15 66,872 ----a-w C:\WINDOWS\system32\PnkBstrA.exe
    2008-03-10 18:15 103,736 ----a-w C:\WINDOWS\system32\PnkBstrB.exe
    2008-03-04 11:31 84,526,232 ----a-w C:\Program Files\moviestudio80c-trial_enu.exe
    2008-03-02 18:51 2,699,171 ----a-w C:\Program Files\ccleaner_v2.05.555.zip
    2008-01-05 20:09 630,768 ----a-w C:\Program Files\eval-nwc.exe
    2007-12-15 11:37 8,454,584 ----a-w C:\Program Files\winamp55_full_emusic-7plus_en-us.exe
    2007-11-30 12:40 34,556,560 ----a-w C:\Program Files\QCCSENU.EXE
    2007-11-05 12:11 5,858 ----a-w C:\Program Files\install.log
    2007-11-05 12:10 487,377 ----a-w C:\Program Files\GameSpot_Download_Manager.exe
    2007-08-02 08:39 6,221,304 ----a-w C:\Program Files\winamp535_full_emusic-7plus.exe
    2007-07-10 08:50 1 ----a-w C:\Documents and Settings\Koppis\SI.bin
    2007-06-03 16:33 2,601,692 ----a-w C:\Program Files\mp3wavconverter.exe
    2007-06-01 12:28 1,980,533 ----a-w C:\Program Files\registrymedic.exe
    2007-04-27 14:23 1,205,365 ----a-w C:\Program Files\wrar37b7.exe
    2007-02-13 14:00 19,666,504 ----a-w C:\Program Files\QuickTimeInstaller.exe
    2007-02-07 19:11 643,144 ----a-w C:\Program Files\XviD-1.1.2-01112006.exe
    2007-01-27 20:20 1,063,810 ----a-w C:\Program Files\subedit.zip
    2006-11-30 12:46 1,410,680 ----a-w C:\Program Files\install_flash_player.exe
    2006-11-28 15:57 6,052,528 ----a-w C:\Program Files\FirefoxGoogleToolbarSetup.exe
    2006-11-26 16:21 29,172 -c--a-w C:\Program Files\Da-Vinci-Tour.kmz
    2006-11-26 15:52 14,879,120 ----a-w C:\Program Files\GoogleEarthWin.exe
    2006-11-25 18:05 2,855,080 ----a-w C:\Program Files\aawsepersonal.exe
    2006-11-23 13:07 362,496 ----a-w C:\Program Files\switchsetup.exe
    2006-11-10 14:15 11,284,970 ----a-w C:\Program Files\cdbxp_setup_3.0.116.zip
    2006-11-08 17:19 16,198,952 ----a-w C:\Program Files\Install_Messenger.exe
    2006-11-04 15:57 6,624,984 ----a-w C:\Program Files\winamp531_full_emusic-7plus.exe
    2006-11-04 15:52 3,262,369 ----a-w C:\Program Files\ALZip.exe
    2006-11-04 14:08 6,579,696 ----a-w C:\Program Files\Opera_9.02_International_Setup.exe
    2006-05-03 10:06 163,328 --sh--r C:\WINDOWS\system32\flvDX.dll
    2007-02-21 11:47 31,232 --sh--r C:\WINDOWS\system32\msfDX.dll
    2007-12-17 13:43 27,648 --sh--w C:\WINDOWS\system32\Smab0.dll
    2008-02-04 19:26 151,040 --sh--w C:\WINDOWS\system32\VistaUltm.dll
    .

    ((((((((((((((((((((((((((((( snapshot@2008-06-03_19.28.49.32 )))))))))))))))))))))))))))))))))))))))))
    .
    - 2008-06-03 16:19:20 2,048 --s-a-w C:\WINDOWS\bootstat.dat
    + 2008-06-08 10:41:55 2,048 --s-a-w C:\WINDOWS\bootstat.dat
    + 2008-06-01 16:12:42 163,328 ----a-w C:\WINDOWS\ERUNT\SDFIX\ERDNT.EXE
    + 2008-06-03 18:54:44 8,753,152 ----a-w C:\WINDOWS\ERUNT\SDFIX\Users\00000001\NTUSER.DAT
    + 2008-06-03 18:54:46 352,256 ----a-w C:\WINDOWS\ERUNT\SDFIX\Users\00000002\UsrClass.dat
    + 2008-06-01 16:12:42 163,328 ----a-w C:\WINDOWS\ERUNT\SDFIX_First_Run\ERDNT.EXE
    + 2008-06-03 18:54:30 8,753,152 ----a-w C:\WINDOWS\ERUNT\SDFIX_First_Run\Users\00000001\NTUSER.DAT
    + 2008-06-03 18:54:30 352,256 ----a-w C:\WINDOWS\ERUNT\SDFIX_First_Run\Users\00000002\UsrClass.dat
    - 2007-11-21 00:52:38 2,884,992 ----a-w C:\WINDOWS\system32\Macromed\Flash\NPSWF32.dll
    + 2008-03-25 03:21:18 2,889,088 ----a-w C:\WINDOWS\system32\Macromed\Flash\NPSWF32.dll
    - 2007-11-21 00:52:40 218,496 ----a-w C:\WINDOWS\system32\Macromed\Flash\NPSWF32_FlashUtil.exe
    + 2008-03-25 03:21:20 218,496 ----a-w C:\WINDOWS\system32\Macromed\Flash\NPSWF32_FlashUtil.exe
    - 2008-01-29 19:04:22 70,264 ----a-w C:\WINDOWS\system32\Macromed\Flash\uninstall_plugin.exe
    + 2008-06-08 10:48:10 70,264 ----a-w C:\WINDOWS\system32\Macromed\Flash\uninstall_plugin.exe
    .
    (((((((((((((((((((((((((((((( Rekisterin käynnistyskohteet )))))))))))))))))))))))))))))))))))))))))))))
    .
    .
    REGEDIT4
    *Huom* Tyhjiä arvoja ja laillisia oletusarvoja ei näytetä

    [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "MsnMsgr"="C:\Program Files\Windows Live\Messenger\MsnMsgr.exe" [ ]
    "Skype"="C:\Program Files\Skype\Phone\Skype.exe" [2006-12-11 21:41 25343016]
    "igndlm.exe"="C:\Program Files\Download Manager\DLM.exe" [2007-03-06 00:57 1103480]
    "PeerGuardian"="C:\Program Files\PeerGuardian2\pg2.exe" [2005-09-18 18:40 1421824]
    "LogitechSoftwareUpdate"="C:\Program Files\Logitech\Video\ManifestEngine.exe" [2005-06-08 15:44 196608]
    "Octoshape Streaming Services"="C:\Program Files\Octoshape Streaming Services\Koppis\OctoshapeClient.exe" [2006-02-13 19:33 214648]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "HotKeysCmds"="C:\WINDOWS\system32\hkcmd.exe" [2006-08-14 15:41 114688]
    "High Definition Audio -ominaisuussivun pikakuvake"="HDAShCut.exe" [2005-01-07 18:07 61952 C:\WINDOWS\system32\HdAShCut.exe]
    "F-Secure Manager"="C:\Program Files\F-Secure\Common\FSM32.exe" [2005-10-26 04:51 122929]
    "F-Secure TNB"="C:\Program Files\F-Secure\TNB\TNBUtil.exe" [2004-05-27 11:57 684032]
    "DLA"="C:\WINDOWS\System32\DLA\DLACTRLW.EXE" [2005-09-28 06:10 122940]
    "LVCOMSX"="C:\WINDOWS\system32\LVCOMSX.EXE" [2005-07-19 18:32 221184]
    "RTHDCPL"="RTHDCPL.EXE" [2006-10-11 18:36 16267776 C:\WINDOWS\RTHDCPL.exe]
    "LogitechVideoRepair"="C:\Program Files\Logitech\Video\ISStart.exe" [2005-06-08 16:24 458752]
    "LogitechVideoTray"="C:\Program Files\Logitech\Video\LogiTray.exe" [2005-06-08 16:14 217088]
    "DAEMON Tools"="C:\Program Files\DAEMON Tools\daemon.exe" [2006-09-14 23:09 157592]
    "StartCCC"="C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2008-01-21 12:17 61440]
    "itype"="c:\Program Files\Microsoft IntelliType Pro\itype.exe" [2007-08-31 12:13 988584]
    "DPAgnt"="C:\Program Files\DigitalPersona\Bin\DPAgnt.exe" [2006-10-09 16:27 807440]

    [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
    "CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2006-03-02 15:00 15360]

    C:\Documents and Settings\All Users\K„ynnist„-valikko\Ohjelmat\K„ynnistys\
    F-Secure Automatic Update.lnk - C:\Program Files\F-Secure\BackWeb\7681197\program\F-Secure Automatic Update.exe [2006-10-31 16:53:14 32807]
    Sonic CinePlayer Quick Launch.lnk - C:\Program Files\Common Files\Sonic Shared\CineTray.exe [2005-10-15 03:01:00 114688]

    [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\ckpNotify]
    ckpNotify.dll 2005-03-01 20:49 24672 C:\WINDOWS\system32\ckpNotify.dll

    [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\DPWLN ]
    C:\WINDOWS\system32\DPWLEvHd.dll 2006-10-09 16:27 99856 C:\WINDOWS\system32\DPWLEvHd.dll

    [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
    "VIDC.I420"= i420vfw.dll
    "vidc.yv12"= yv12vfw.dll

    [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
    "EnableFirewall"= 0 (0x0)

    [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
    "%windir%\\system32\\sessmgr.exe"=
    "C:\\Program Files\\F-Secure\\BackWeb\\7681197\\program\\F-Secure Automatic Update.exe"=
    "C:\\Program Files\\CheckPoint\\SecuRemote\\bin\\SR_Service.exe"=
    "C:\\Program Files\\CheckPoint\\SecuRemote\\bin\\SR_GUI.exe"=
    "C:\\Program Files\\CheckPoint\\SecuRemote\\bin\\scc.exe"=
    "C:\\Program Files\\CheckPoint\\SecuRemote\\bin\\SR_SDS.exe"=
    "C:\\Program Files\\CheckPoint\\SecuRemote\\bin\\SR_Diagnostics.exe"=
    "C:\\Program Files\\uTorrent\\uTorrent.exe"=
    "C:\\WINDOWS\\system32\\dplaysvr.exe"=
    "C:\\Pelit\\Settlers3\\s3.exe"=
    "C:\\Pelit\\Crysis\\Bin32\\Crysis.exe"=
    "C:\\Pelit\\Crysis\\Bin32\\CrysisDedicatedServer.exe"=
    "C:\\WINDOWS\\system32\\PnkBstrA.exe"=
    "C:\\WINDOWS\\system32\\PnkBstrB.exe"=
    "C:\\Program Files\\SmartFTP Client\\SmartFTP.exe"=
    "C:\\Program Files\\Skype\\Phone\\Skype.exe"=

    [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
    "9278:TCP"= 9278:TCP:BitComet 9278 TCP
    "9278:UDP"= 9278:UDP:BitComet 9278 UDP

    R0 FSFW;F-Secure Firewall Driver;C:\WINDOWS\system32\drivers\fsdfw.sys [2005-10-31 13:01]
    R1 bbcap;bbcap;C:\WINDOWS\system32\DRIVERS\bbcap.sys [2007-06-24 23:03]
    R2 BackWeb Plug-in - 7681197;F-Secure Automatic Update;C:\PROGRA~1\F-Secure\BackWeb\7681197\Program\SERVIC~1.EXE [2006-10-31 16:53]
    R2 F-Secure Filter;F-Secure File System Filter;C:\Program Files\F-Secure\Anti-Virus\Win2K\FSfilter.sys [2005-08-19 16:37]
    R2 F-Secure Gatekeeper;F-Secure Gatekeeper;C:\Program Files\F-Secure\Anti-Virus\Win2K\FSgk.sys [2005-10-06 17:30]
    R2 F-Secure Recognizer;F-Secure File System Recognizer;C:\Program Files\F-Secure\Anti-Virus\Win2K\FSrec.sys [2005-08-19 16:37]
    R2 Scap;SecureClient Application Policy Module;C:\WINDOWS\system32\DRIVERS\Scap.sys [2005-03-01 20:49]
    R2 SVKP;SVKP;C:\WINDOWS\system32\SVKP.sys [2007-06-01 15:28]
    R2 UxTuneUp;TuneUp Theme Extension;C:\WINDOWS\System32\svchost.exe [2006-03-02 15:00]
    R3 dpK0Bx01;Fingerprint Reader Filter Driver;C:\WINDOWS\system32\DRIVERS\dpK0Bx01.sys [2006-09-16 17:25]
    R3 FW1;SecuRemote Miniport;C:\WINDOWS\system32\DRIVERS\fw.sys [2005-03-01 20:49]
    R3 usbdpfp;Fingerprint Reader Class Driver;C:\WINDOWS\system32\DRIVERS\usbdpfp.sys [2006-09-16 17:23]
    S0 stwlfbus;stwlfbus;C:\WINDOWS\system32\DRIVERS\stwlfbus.sys [2003-04-27 13:39]
    S3 ggflt;SEMC USB Flash Driver Filter;C:\WINDOWS\system32\DRIVERS\ggflt.sys [2008-02-16 21:03]
    S3 gsplittm;gsplittm;C:\DOCUME~1\Koppis\LOCALS~1\Temp\gsplittm.sys []
    S3 OMVA;VPN-1 SecureClient Adapter;C:\WINDOWS\system32\DRIVERS\OMVA.sys [2005-03-01 20:49]
    S3 st3wolf;st3wolf;C:\WINDOWS\system32\DRIVERS\st3wolf.sys [2003-04-27 12:43]
    S3 w200bus;Sony Ericsson W200 driver (WDM);C:\WINDOWS\system32\DRIVERS\w200bus.sys [2006-11-07 10:42]
    S3 w200mdfl;Sony Ericsson W200 USB WMC Modem Filter;C:\WINDOWS\system32\DRIVERS\w200mdfl.sys [2006-11-07 10:42]
    S3 w200mdm;Sony Ericsson W200 USB WMC Modem Driver;C:\WINDOWS\system32\DRIVERS\w200mdm.sys [2006-11-07 10:42]
    S3 w200mgmt;Sony Ericsson W200 USB WMC Device Management Drivers (WDM);C:\WINDOWS\system32\DRIVERS\w200mgmt.sys [2006-11-07 10:42]
    S3 w200obex;Sony Ericsson W200 USB WMC OBEX Interface;C:\WINDOWS\system32\DRIVERS\w200obex.sys [2006-11-07 10:42]

    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost - NetSvcs
    UxTuneUp

    [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{86167224-b6ba-11dc-8548-0016350dc46d}]
    \Shell\AutoRun\command - I:\PortableApps\PortableAppsMenu\PortableAppsMenu.exe

    *Newly Created Service* - PGFILTER
    .
    'Ajoitetut tehtävät'-kansion sisältö
    "2008-05-30 14:17:09 C:\WINDOWS\Tasks\1-Click Maintenance.job"
    - C:\Program Files\TuneUp Utilities 2007\SystemOptimizer.exe
    "2007-02-13 14:00:42 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job"
    - C:\Program Files\Apple Software Update\SoftwareUpdate.exe
    "2008-06-08 10:42:21 C:\WINDOWS\Tasks\Scheduled scanning task.job"
    - C:\PROGRA~1\F-Secure\ANTI-V~1\fsav.exeZ /HARD /ARCHIVE /DISINF /SCHED /NOBREAK /REPORT=C:\PROGRA~1\F-Secure\ANTI-V~1\report.txt
    .
    **************************************************************************

    catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
    Rootkit scan 2008-06-08 15:50:47
    Windows 5.1.2600 Service Pack 2 NTFS

    scanning hidden processes ...

    scanning hidden autostart entries ...

    scanning hidden files ...

    scan completed successfully
    hidden files: 0

    **************************************************************************
    .
    Completion time: 2008-06-08 15:54:19
    ComboFix-quarantined-files.txt 2008-06-08 12:54:15
    ComboFix2.txt 2008-06-03 17:12:28
    ComboFix3.txt 2008-06-03 16:29:13
    ComboFix4.txt 2008-05-29 11:02:29

    Pre-Run: 25,179,209,728 tavua vapaana
    Post-Run: 25,170,620,416 tavua vapaana

    332 --- E O F --- 2008-05-16 21:03:47
     
    Koppis1, Jun 8, 2008
    #9
  10. Koppis1

    Koppis1 Member

    Joined:
    Jun 26, 2007
    Messages:
    77
    Likes Received:
    0
    Trophy Points:
    16
    tippuu tämä aihe
     
    Koppis1, Jun 9, 2008
    #10
  11. Koppis1

    Koppis1 Member

    Joined:
    Jun 26, 2007
    Messages:
    77
    Likes Received:
    0
    Trophy Points:
    16
    voisiko joku nyt vastata?
     
    Koppis1, Jun 12, 2008
    #11
  12. Hujo

    Hujo Guest

    Avaa Muistio ja kopioi/liitä quoteboxin sisältö sinne:

    Tallenna se nimellä CFScript.txt

    Sitten raahaa CFScript ComboFix.exeen kuten alla.
    [​IMG]

    Käynnistä tietokone uudelleen pyydettäessä ja lähetä combofix.txt-tiedoston sisältö tänne.

    ===============

    Päivitä Malwarebytes' Anti-Malware ja aja



     
    Hujo, Jun 12, 2008
    #12
  13. Koppis1

    Koppis1 Member

    Joined:
    Jun 26, 2007
    Messages:
    77
    Likes Received:
    0
    Trophy Points:
    16
    Ajan kohta malwaren.


    ComboFix 08-06-01.6 - Koppis 2008-06-12 21:54:28.9 - NTFSx86
    Microsoft Windows XP Professional 5.1.2600.2.1252.1.1035.18.901 [GMT 3:00]
    Running from: C:\Documents and Settings\Koppis\Työpöytä\ComboFix.exe
    Command switches used :: C:\Documents and Settings\Koppis\Työpöytä\CFScript.txt
    * Created a new restore point
    * Resident AV is active


    WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!

    FILE ::
    C:\setz.exe
    C:\WINDOWS\DC5177176.zip
    C:\WINDOWS\is154890.exe
    C:\WINDOWS\system32\flvDX.dll
    C:\WINDOWS\system32\msfDX.dll
    .

    (((((((((((((((((((((((((((((((((((((( Muut poistot ))))))))))))))))))))))))))))))))))))))))))))))))))))))))
    .

    C:\setz.exe
    C:\WINDOWS\DC5177176.zip
    C:\WINDOWS\is154890.exe
    C:\WINDOWS\system32\flvDX.dll
    C:\WINDOWS\system32\msfDX.dll

    .
    ((((( Tiedostot, jotka on luotu seuraavalla aikavälillä: 2008-05-12 to 2008-06-12 )))))))))))))))))
    .

    2008-06-12 19:45 . 2008-06-12 19:45 54,156 --ah----- C:\WINDOWS\QTFont.qfn
    2008-06-12 19:45 . 2008-06-12 19:45 1,409 --a------ C:\WINDOWS\QTFont.for
    2008-06-11 15:09 . 2008-03-05 15:56 3,786,760 --a------ C:\WINDOWS\system32\D3DX9_37.dll
    2008-06-11 15:09 . 2008-03-05 15:56 1,420,824 --a------ C:\WINDOWS\system32\D3DCompiler_37.dll
    2008-06-11 15:09 . 2007-10-12 15:14 1,374,232 --a------ C:\WINDOWS\system32\D3DCompiler_36.dll
    2008-06-11 15:09 . 2008-03-05 16:03 479,752 --a------ C:\WINDOWS\system32\XAudio2_0.dll
    2008-06-11 15:09 . 2008-02-05 23:07 462,864 --a------ C:\WINDOWS\system32\d3dx10_37.dll
    2008-06-11 15:09 . 2007-10-02 09:56 444,776 --a------ C:\WINDOWS\system32\d3dx10_36.dll
    2008-06-11 15:09 . 2007-10-22 03:39 267,272 --a------ C:\WINDOWS\system32\xactengine2_10.dll
    2008-06-11 15:09 . 2007-07-20 00:57 267,112 --a------ C:\WINDOWS\system32\xactengine2_9.dll
    2008-06-11 15:09 . 2008-03-05 16:03 238,088 --a------ C:\WINDOWS\system32\xactengine3_0.dll
    2008-06-11 15:09 . 2008-03-05 16:00 25,608 --a------ C:\WINDOWS\system32\X3DAudio1_3.dll
    2008-06-11 14:10 . 2008-06-11 14:29 487,189,936 --a------ C:\Program Files\LEGOIndyDemoSetup1.exe
    2008-06-11 12:50 . 2008-04-14 18:52 272,128 --------- C:\WINDOWS\system32\drivers\bthport.sys
    2008-06-11 12:50 . 2008-04-14 18:52 272,128 -----c--- C:\WINDOWS\system32\dllcache\bthport.sys
    2008-06-09 19:27 . 2008-06-09 19:27 244 --ah----- C:\sqmnoopt15.sqm
    2008-06-09 19:27 . 2008-06-09 19:27 232 --ah----- C:\sqmdata15.sqm
    2008-06-09 19:25 . 2008-06-09 19:25 2,402,320 --a------ C:\Program Files\WLinstaller.exe
    2008-06-03 23:06 . 2008-06-11 17:59 <KANSIO> d-------- C:\Documents and Settings\All Users\Application Data\YoYoGames
    2008-06-03 21:54 . 2008-06-03 21:54 <KANSIO> d-------- C:\WINDOWS\ERUNT
    2008-06-03 21:51 . 2008-06-03 21:51 <KANSIO> d-------- C:\Documents and Settings\Koppis\Ty÷p÷ytõ
    2008-06-03 13:13 . 2008-06-03 13:13 <KANSIO> d-------- C:\Documents and Settings\Vilpponen\Application Data\Malwarebytes
    2008-06-01 23:33 . 2008-06-01 23:33 <KANSIO> d-------- C:\Program Files\Live_TV
    2008-06-01 23:30 . 2008-06-01 23:56 <KANSIO> d-------- C:\Program Files\3GP Converter 2007
    2008-06-01 23:13 . 2008-06-01 23:13 3,758,036 --a------ C:\spore.3gp
    2008-06-01 23:09 . 2008-06-12 18:54 <KANSIO> d-------- C:\Program Files\WinAVI MP4 Converter
    2008-06-01 21:37 . 2008-06-01 21:37 <KANSIO> d-------- C:\Program Files\SmartFTP Client 3.0 Setup Files
    2008-06-01 21:37 . 2008-06-01 21:37 <KANSIO> d-------- C:\Program Files\SmartFTP Client
    2008-06-01 21:37 . 2008-06-01 21:37 <KANSIO> d-------- C:\Documents and Settings\Koppis\Application Data\SmartFTP
    2008-05-31 15:37 . 2008-05-31 15:37 0 --ah----- C:\WINDOWS\system32\drivers\Msft_Kernel_NuidFltr_01005.Wdf
    2008-05-31 15:36 . 2004-09-14 16:11 21,504 --a------ C:\WINDOWS\system32\drivers\hidserv.dll
    2008-05-31 10:46 . 2008-05-31 10:47 1,646,766 --a------ C:\We_hold_these_truths.flv.MP3.OGG
    2008-05-31 10:45 . 2008-05-31 10:46 558,088 --a------ C:\The Flight of the Bumble Bee.flv.MP3.OGG
    2008-05-31 10:44 . 2008-05-31 10:45 2,007,871 --a------ C:\Speed metal messiah.flv.MP3.OGG
    2008-05-31 10:43 . 2008-05-31 10:44 2,315,607 --a------ C:\necro.ogg.MP3.OGG
    2008-05-31 10:42 . 2008-05-31 10:43 2,297,579 --a------ C:\Jerryc - Canon Rock (Guitar Play).mp3.OGG
    2008-05-31 10:40 . 2008-05-31 10:42 3,361,200 --a------ C:\Dragonforce - Revolution Deathsquad.mp3.OGG
    2008-05-31 10:38 . 2008-05-31 10:40 2,260,120 --a------ C:\06 - Wedding Nails mp3.mp3.OGG
    2008-05-31 10:37 . 2008-05-31 10:38 2,090,948 --a------ C:\01 Black Dog.mp3.OGG
    2008-05-31 10:35 . 2008-05-31 10:37 2,797,956 --a------ C:\Wedding_Nails.mp3.OGG
    2008-05-31 10:29 . 2008-05-31 10:29 1,257,221 --a------ C:\The Flight of the Bumble Bee.flv.MP3
    2008-05-31 10:28 . 2008-05-31 10:28 5,231,595 --a------ C:\Corpse_tumor.flv.MP3
    2008-05-31 10:28 . 2008-05-31 10:29 4,536,111 --a------ C:\Speed metal messiah.flv.MP3
    2008-05-31 10:27 . 2008-05-31 10:27 7,047,627 --a------ C:\We_hold_these_truths.flv.MP3
    2008-05-30 17:50 . 2008-05-30 17:50 <KANSIO> d-------- C:\Program Files\Webteh
    2008-05-30 17:49 . 2008-05-30 17:49 9,380,296 --a------ C:\Program Files\bsplayer228.964_clip.exe
    2008-05-30 14:38 . 2008-05-30 14:38 <KANSIO> d-------- C:\WINDOWS\system32\Clickteam
    2008-05-30 14:38 . 2008-05-30 14:38 <KANSIO> d-------- C:\Documents and Settings\Koppis\Application Data\Clickteam
    2008-05-29 21:05 . 2008-05-29 21:05 <KANSIO> d-------- C:\Documents and Settings\Mirja Vilpponen\Application Data\DigitalPersona
    2008-05-29 18:26 . 2008-05-29 18:26 <KANSIO> d-------- C:\Documents and Settings\Vilpponen\Application Data\DigitalPersona
    2008-05-29 18:26 . 2008-05-29 18:26 <KANSIO> d-------- C:\Documents and Settings\Vilpponen\Application Data\ATI
    2008-05-29 10:32 . 2008-06-03 13:54 <KANSIO> d-------- C:\Program Files\Malwarebytes' Anti-Malware
    2008-05-29 10:32 . 2008-05-29 10:32 <KANSIO> d-------- C:\Documents and Settings\Koppis\Application Data\Malwarebytes
    2008-05-29 10:32 . 2008-05-29 10:32 <KANSIO> d-------- C:\Documents and Settings\All Users\Application Data\Malwarebytes
    2008-05-29 10:32 . 2008-05-30 01:06 34,296 --a------ C:\WINDOWS\system32\drivers\mbamcatchme.sys
    2008-05-29 10:32 . 2008-05-30 01:06 15,864 --a------ C:\WINDOWS\system32\drivers\mbam.sys
    2008-05-28 22:22 . 2008-05-28 22:22 <KANSIO> d-------- C:\Program Files\Trend Micro
    2008-05-28 21:41 . 2008-05-28 21:41 2,855 --a------ C:\ComboFix.PIF
    2008-05-28 21:31 . 2008-05-28 21:31 0 --a------ C:\ComboFix.exe
    2008-05-28 20:29 . 2008-06-03 22:33 <KANSIO> d-------- C:\Program Files\HiJackThis_v2
    2008-05-28 20:16 . 2008-05-28 20:28 <KANSIO> d-------- C:\WINDOWS\BDOSCAN8
    2008-05-28 18:05 . 2008-05-28 18:05 <KANSIO> d-------- C:\Documents and Settings\Koppis\Application Data\DigitalPersona
    2008-05-28 17:58 . 2008-05-28 17:58 <KANSIO> d-------- C:\WINDOWS\DPDrv
    2008-05-28 17:58 . 2008-05-28 17:58 <KANSIO> d-------- C:\Program Files\DigitalPersona
    2008-05-28 17:26 . 2008-05-28 17:26 <KANSIO> d-------- C:\Program Files\DP10-002
    2008-05-28 17:26 . 2008-05-28 17:26 2,334,453 --a------ C:\Program Files\DP10-002.zip
    2008-05-28 16:43 . 2008-05-28 16:43 8,579,136 --a------ C:\Program Files\DPPM_201_ENG.exe
    2008-05-28 16:04 . 2007-08-31 12:15 18,856 --a------ C:\WINDOWS\system32\drivers\nuidfltr.sys
    2008-05-28 16:03 . 2008-05-28 16:39 <KANSIO> d-------- C:\Program Files\Microsoft IntelliType Pro
    2008-05-28 15:48 . 2004-09-14 16:11 21,504 --a------ C:\WINDOWS\system32\hidserv.dll
    2008-05-28 15:48 . 2004-09-14 16:11 21,504 --a--c--- C:\WINDOWS\system32\dllcache\hidserv.dll
    2008-05-27 21:48 . 2008-05-27 21:48 3,510,857 --a------ C:\SMB2AV.MP3
    2008-05-27 21:48 . 2008-05-27 21:48 2,069,315 --a------ C:\FB.MP3
    2008-05-27 21:47 . 2008-05-27 21:48 3,554,742 --a------ C:\SMBAV.MP3
    2008-05-27 08:32 . 2008-05-27 08:32 <KANSIO> d-------- C:\Documents and Settings\Mirja Vilpponen\Application Data\ATI
    2008-05-25 21:05 . 2008-05-29 16:55 <KANSIO> d-------- C:\Program Files\Cheat Engine
    2008-05-25 21:05 . 2007-12-26 17:30 1,970,176 --a------ C:\WINDOWS\system32\d3dx9.dll
    2008-05-25 21:05 . 2007-12-26 17:30 679,936 --a------ C:\WINDOWS\system32\D3DX81ab.dll
    2008-05-22 22:13 . 2008-05-22 22:13 <KANSIO> d-------- C:\Program Files\Octoshape Streaming Services
    2008-05-22 15:11 . 2008-05-22 17:12 <KANSIO> d-------- C:\Program Files\mIRC
    2008-05-22 15:11 . 2008-05-22 17:16 <KANSIO> d-------- C:\Documents and Settings\Koppis\Application Data\mIRC
    2008-05-21 14:57 . 2008-06-10 23:15 31 --a------ C:\WINDOWS\system32\bbcap.err
    2008-05-21 14:56 . 2008-05-21 14:56 <KANSIO> d-------- C:\Documents and Settings\Koppis\Application Data\ATI
    2008-05-21 14:56 . 2008-05-21 14:56 <KANSIO> d-------- C:\Documents and Settings\All Users\Application Data\ATI
    2008-05-18 18:49 . 2008-05-18 18:49 <KANSIO> d-------- C:\Program Files\Mioplanet
    2008-05-18 18:49 . 2008-05-18 18:49 <KANSIO> d-------- C:\Documents and Settings\Koppis\Application Data\mioObjects
    2008-05-18 18:49 . 2008-05-18 18:49 407,047 --a------ C:\WINDOWS\system32\mioengine.exe
    2008-05-18 12:30 . 2008-05-18 12:30 <KANSIO> d-------- C:\Program Files\eRightSoft
    2008-05-18 12:30 . 2006-09-12 14:46 227,328 -r-hs---- C:\WINDOWS\system32\ac3DX.ax
    2008-05-18 12:30 . 2008-02-04 22:26 151,040 ---hs---- C:\WINDOWS\system32\VistaUltm.dll
    2008-05-18 12:30 . 2006-01-13 02:23 123,904 -r-hs---- C:\WINDOWS\system32\AVCDX.ax
    2008-05-18 12:30 . 2003-11-21 02:00 54,784 -r-hs---- C:\WINDOWS\system32\RLAPEDec.ax
    2008-05-18 12:30 . 2004-04-27 02:00 37,888 -r-hs---- C:\WINDOWS\system32\RLMPCDec.ax
    2008-05-18 12:30 . 2007-12-17 16:43 27,648 ---hs---- C:\WINDOWS\system32\Smab0.dll
    2008-05-18 12:30 . 2008-02-05 20:04 9,884 ---h----- C:\WINDOWS\super.chm
    2008-05-18 12:07 . 2008-05-18 12:07 <KANSIO> d-------- C:\Program Files\NCH Software
    2008-05-18 12:07 . 2008-05-18 12:07 <KANSIO> d-------- C:\Documents and Settings\Koppis\Application Data\NCH Swift Sound
    2008-05-18 12:07 . 2008-05-18 12:07 <KANSIO> d-------- C:\Documents and Settings\Koppis\Application Data\NCH Software
    2008-05-18 12:07 . 2008-05-18 12:07 <KANSIO> d-------- C:\Documents and Settings\All Users\Application Data\NCH Software
    2008-05-17 22:48 . 2007-10-12 15:14 3,734,536 --a------ C:\WINDOWS\system32\d3dx9_36.dll
    2008-05-13 07:34 . 2008-05-13 07:34 <KANSIO> d-------- C:\Program Files\Screen Recorder Gold

    .
    (((((((((((((((((((((((((((((((((((( Find3M-raportti ))))))))))))))))))))))))))))))))))))))))))))))))))))))
    .
    2008-06-12 18:59 --------- d-----w C:\Program Files\PeerGuardian2
    2008-06-12 16:50 --------- d-----w C:\Documents and Settings\Koppis\Application Data\Skype
    2008-06-12 16:33 --------- d-----w C:\Program Files\RevConnect
    2008-06-11 12:10 --------- d--h--w C:\Program Files\InstallShield Installation Information
    2008-06-09 16:26 --------- dcsh--w C:\Program Files\Common Files\WindowsLiveInstaller
    2008-06-09 16:25 --------- d-----w C:\Documents and Settings\All Users\Application Data\WLInstaller
    2008-05-29 19:20 107,888 ----a-w C:\WINDOWS\system32\CmdLineExt.dll
    2008-05-28 17:01 --------- d---a-w C:\Documents and Settings\All Users\Application Data\TEMP
    2008-05-28 14:57 --------- d-----w C:\Program Files\Common Files\Wise Installation Wizard
    2008-05-22 11:36 --------- d-----w C:\Program Files\ATI
    2008-05-21 11:51 --------- d-----w C:\Program Files\ATI Technologies
    2008-05-18 09:07 --------- d-----w C:\Program Files\NCH Swift Sound
    2008-05-18 09:00 --------- d-----w C:\Program Files\CamStudio
    2008-05-17 19:48 413,696 ----a-w C:\WINDOWS\system32\wrap_oal.dll
    2008-05-17 19:48 110,592 ----a-w C:\WINDOWS\system32\OpenAL32.dll
    2008-05-08 12:28 202,752 ----a-w C:\WINDOWS\system32\drivers\rmcast.sys
    2008-05-07 05:15 1,288,192 ----a-w C:\WINDOWS\system32\quartz.dll
    2008-05-06 18:30 --------- d-----w C:\Program Files\Windows Live Safety Center
    2008-04-30 17:22 --------- d-----w C:\Documents and Settings\All Users\Application Data\Ubisoft
    2008-04-26 09:33 --------- d-----w C:\Program Files\Java
    2008-04-21 14:35 --------- d-----w C:\Program Files\HardCopy Pro
    2008-04-21 14:35 --------- d-----w C:\Documents and Settings\Koppis\Application Data\DeskSoft
    2008-04-21 07:02 659,456 ----a-w C:\WINDOWS\system32\wininet.dll
    2008-04-16 13:40 --------- d-----w C:\Program Files\Winamp
    2008-04-16 13:29 --------- d-----w C:\Program Files\Game_Maker7
    2008-04-16 12:54 8,990,072 ----a-w C:\Program Files\winamp5531_full_emusic-7plus_en-us.exe
    2008-04-15 18:59 --------- d-----w C:\Program Files\Lavalys
    2008-04-15 16:12 --------- d-----w C:\Documents and Settings\Vilpponen\Application Data\The Hobbit
    2008-04-12 16:25 --------- d-----w C:\Program Files\Guitar Pro 5
    2008-03-29 05:19 9,801,728 ----a-w C:\WINDOWS\system32\atioglx2.dll
    2008-03-29 04:40 167,936 ----a-w C:\WINDOWS\system32\atiok3x2.dll
    2008-03-29 04:05 372,736 ----a-w C:\WINDOWS\system32\ATIDEMGX.dll
    2008-03-29 04:04 299,008 ----a-w C:\WINDOWS\system32\ati2dvag.dll
    2008-03-29 03:56 172,032 ----a-w C:\WINDOWS\system32\atipdlxx.dll
    2008-03-29 03:56 126,976 ----a-w C:\WINDOWS\system32\Oemdspif.dll
    2008-03-29 03:55 43,520 ----a-w C:\WINDOWS\system32\ati2edxx.dll
    2008-03-29 03:55 26,112 ----a-w C:\WINDOWS\system32\Ati2mdxx.exe
    2008-03-29 03:55 126,976 ----a-w C:\WINDOWS\system32\ati2evxx.dll
    2008-03-29 03:54 536,576 ----a-w C:\WINDOWS\system32\ati2evxx.exe
    2008-03-29 03:52 53,248 ----a-w C:\WINDOWS\system32\ATIDDC.DLL
    2008-03-29 03:43 3,176,480 ----a-w C:\WINDOWS\system32\ati3duag.dll
    2008-03-29 03:39 307,200 ----a-w C:\WINDOWS\system32\atiiiexx.dll
    2008-03-29 03:36 1,765,120 ----a-w C:\WINDOWS\system32\ativvaxx.dll
    2008-03-29 03:24 46,080 ----a-w C:\WINDOWS\system32\amdpcom32.dll
    2008-03-29 03:23 5,439,488 ----a-w C:\WINDOWS\system32\atioglxx.dll
    2008-03-29 03:21 393,216 ----a-w C:\WINDOWS\system32\atikvmag.dll
    2008-03-29 03:19 17,408 ----a-w C:\WINDOWS\system32\atitvo32.dll
    2008-03-29 03:12 520,192 ----a-w C:\WINDOWS\system32\ati2cqag.dll
    2008-03-28 18:05 593,920 ------w C:\WINDOWS\system32\ati2sgag.exe
    2008-03-25 04:51 621,344 ----a-w C:\WINDOWS\system32\mswstr10.dll
    2008-03-25 04:51 166,688 ----a-w C:\WINDOWS\system32\msjint40.dll
    2008-03-23 22:48 219 ----a-w C:\Documents and Settings\Vilpponen\hsqlprefs.dat
    2008-03-20 08:09 1,845,504 ----a-w C:\WINDOWS\system32\win32k.sys
    2008-03-14 13:16 43,520 ----a-w C:\WINDOWS\system32\CmdLineExt03.dll
    2008-03-10 18:16 22,328 ----a-w C:\Documents and Settings\Koppis\Application Data\PnkBstrK.sys
    2008-03-04 11:31 84,526,232 ----a-w C:\Program Files\moviestudio80c-trial_enu.exe
    2008-03-02 18:51 2,699,171 ----a-w C:\Program Files\ccleaner_v2.05.555.zip
    2008-01-05 20:09 630,768 ----a-w C:\Program Files\eval-nwc.exe
    2007-12-15 11:37 8,454,584 ----a-w C:\Program Files\winamp55_full_emusic-7plus_en-us.exe
    2007-11-30 12:40 34,556,560 ----a-w C:\Program Files\QCCSENU.EXE
    2007-11-05 12:11 5,858 ----a-w C:\Program Files\install.log
    2007-11-05 12:10 487,377 ----a-w C:\Program Files\GameSpot_Download_Manager.exe
    2007-08-02 08:39 6,221,304 ----a-w C:\Program Files\winamp535_full_emusic-7plus.exe
    2007-07-10 08:50 1 ----a-w C:\Documents and Settings\Koppis\SI.bin
    2007-06-03 16:33 2,601,692 ----a-w C:\Program Files\mp3wavconverter.exe
    2007-06-01 12:28 1,980,533 ----a-w C:\Program Files\registrymedic.exe
    2007-04-27 14:23 1,205,365 ----a-w C:\Program Files\wrar37b7.exe
    2007-02-13 14:00 19,666,504 ----a-w C:\Program Files\QuickTimeInstaller.exe
    2007-02-07 19:11 643,144 ----a-w C:\Program Files\XviD-1.1.2-01112006.exe
    2007-01-27 20:20 1,063,810 ----a-w C:\Program Files\subedit.zip
    2006-11-30 12:46 1,410,680 ----a-w C:\Program Files\install_flash_player.exe
    2006-11-28 15:57 6,052,528 ----a-w C:\Program Files\FirefoxGoogleToolbarSetup.exe
    2006-11-26 16:21 29,172 -c--a-w C:\Program Files\Da-Vinci-Tour.kmz
    2006-11-26 15:52 14,879,120 ----a-w C:\Program Files\GoogleEarthWin.exe
    2006-11-25 18:05 2,855,080 ----a-w C:\Program Files\aawsepersonal.exe
    2006-11-23 13:07 362,496 ----a-w C:\Program Files\switchsetup.exe
    2006-11-10 14:15 11,284,970 ----a-w C:\Program Files\cdbxp_setup_3.0.116.zip
    2006-11-08 17:19 16,198,952 ----a-w C:\Program Files\Install_Messenger.exe
    2006-11-04 15:57 6,624,984 ----a-w C:\Program Files\winamp531_full_emusic-7plus.exe
    2006-11-04 15:52 3,262,369 ----a-w C:\Program Files\ALZip.exe
    2006-11-04 14:08 6,579,696 ----a-w C:\Program Files\Opera_9.02_International_Setup.exe
    2007-12-17 13:43 27,648 --sh--w C:\WINDOWS\system32\Smab0.dll
    2008-02-04 19:26 151,040 --sh--w C:\WINDOWS\system32\VistaUltm.dll
    .

    ((((((((((((((((((((((((((((( snapshot@2008-06-03_19.28.49.32 )))))))))))))))))))))))))))))))))))))))))
    .
    - 2008-03-09 11:19:05 53,248 ----a-w C:\WINDOWS\assembly\GAC\Microsoft.DirectX.AudioVideoPlayback\1.0.2902.0__31bf3856ad364e35\Microsoft.DirectX.AudioVideoPlayback.dll
    + 2008-06-11 12:08:53 53,248 ----a-w C:\WINDOWS\assembly\GAC\Microsoft.DirectX.AudioVideoPlayback\1.0.2902.0__31bf3856ad364e35\Microsoft.DirectX.AudioVideoPlayback.dll
    - 2008-03-09 11:19:05 12,800 ----a-w C:\WINDOWS\assembly\GAC\Microsoft.DirectX.Diagnostics\1.0.2902.0__31bf3856ad364e35\Microsoft.DirectX.Diagnostics.dll
    + 2008-06-11 12:08:53 12,800 ----a-w C:\WINDOWS\assembly\GAC\Microsoft.DirectX.Diagnostics\1.0.2902.0__31bf3856ad364e35\Microsoft.DirectX.Diagnostics.dll
    - 2008-03-09 11:19:05 473,600 ----a-w C:\WINDOWS\assembly\GAC\Microsoft.DirectX.Direct3D\1.0.2902.0__31bf3856ad364e35\Microsoft.DirectX.Direct3D.dll
    + 2008-06-11 12:08:54 473,600 ----a-w C:\WINDOWS\assembly\GAC\Microsoft.DirectX.Direct3D\1.0.2902.0__31bf3856ad364e35\Microsoft.DirectX.Direct3D.dll
    - 2008-03-09 11:19:02 2,676,224 ----a-w C:\WINDOWS\assembly\GAC\Microsoft.DirectX.Direct3DX\1.0.2902.0__31bf3856ad364e35\Microsoft.DirectX.Direct3DX.dll
    + 2008-06-11 12:08:48 2,676,224 ----a-w C:\WINDOWS\assembly\GAC\Microsoft.DirectX.Direct3DX\1.0.2902.0__31bf3856ad364e35\Microsoft.DirectX.Direct3DX.dll
    - 2008-03-09 11:19:02 2,846,720 ----a-w C:\WINDOWS\assembly\GAC\Microsoft.DirectX.Direct3DX\1.0.2903.0__31bf3856ad364e35\Microsoft.DirectX.Direct3DX.dll
    + 2008-06-11 12:08:49 2,846,720 ----a-w C:\WINDOWS\assembly\GAC\Microsoft.DirectX.Direct3DX\1.0.2903.0__31bf3856ad364e35\Microsoft.DirectX.Direct3DX.dll
    - 2008-03-09 11:19:03 563,712 ----a-w C:\WINDOWS\assembly\GAC\Microsoft.DirectX.Direct3DX\1.0.2904.0__31bf3856ad364e35\Microsoft.DirectX.Direct3DX.dll
    + 2008-06-11 12:08:49 563,712 ----a-w C:\WINDOWS\assembly\GAC\Microsoft.DirectX.Direct3DX\1.0.2904.0__31bf3856ad364e35\Microsoft.DirectX.Direct3DX.dll
    - 2008-03-09 11:19:03 567,296 ----a-w C:\WINDOWS\assembly\GAC\Microsoft.DirectX.Direct3DX\1.0.2905.0__31bf3856ad364e35\Microsoft.DirectX.Direct3DX.dll
    + 2008-06-11 12:08:50 567,296 ----a-w C:\WINDOWS\assembly\GAC\Microsoft.DirectX.Direct3DX\1.0.2905.0__31bf3856ad364e35\Microsoft.DirectX.Direct3DX.dll
    - 2008-03-09 11:19:03 576,000 ----a-w C:\WINDOWS\assembly\GAC\Microsoft.DirectX.Direct3DX\1.0.2906.0__31bf3856ad364e35\Microsoft.DirectX.Direct3DX.dll
    + 2008-06-11 12:08:50 576,000 ----a-w C:\WINDOWS\assembly\GAC\Microsoft.DirectX.Direct3DX\1.0.2906.0__31bf3856ad364e35\Microsoft.DirectX.Direct3DX.dll
    - 2008-03-09 11:19:03 577,024 ----a-w C:\WINDOWS\assembly\GAC\Microsoft.DirectX.Direct3DX\1.0.2907.0__31bf3856ad364e35\Microsoft.DirectX.Direct3DX.dll
    + 2008-06-11 12:08:51 577,024 ----a-w C:\WINDOWS\assembly\GAC\Microsoft.DirectX.Direct3DX\1.0.2907.0__31bf3856ad364e35\Microsoft.DirectX.Direct3DX.dll
    - 2008-03-09 11:19:03 577,536 ----a-w C:\WINDOWS\assembly\GAC\Microsoft.DirectX.Direct3DX\1.0.2908.0__31bf3856ad364e35\Microsoft.DirectX.Direct3DX.dll
    + 2008-06-11 12:08:51 577,536 ----a-w C:\WINDOWS\assembly\GAC\Microsoft.DirectX.Direct3DX\1.0.2908.0__31bf3856ad364e35\Microsoft.DirectX.Direct3DX.dll
    - 2008-03-09 11:19:04 577,536 ----a-w C:\WINDOWS\assembly\GAC\Microsoft.DirectX.Direct3DX\1.0.2909.0__31bf3856ad364e35\Microsoft.DirectX.Direct3DX.dll
    + 2008-06-11 12:08:52 577,536 ----a-w C:\WINDOWS\assembly\GAC\Microsoft.DirectX.Direct3DX\1.0.2909.0__31bf3856ad364e35\Microsoft.DirectX.Direct3DX.dll
    - 2008-03-09 11:19:04 578,560 ----a-w C:\WINDOWS\assembly\GAC\Microsoft.DirectX.Direct3DX\1.0.2910.0__31bf3856ad364e35\Microsoft.DirectX.Direct3DX.dll
    + 2008-06-11 12:08:52 578,560 ----a-w C:\WINDOWS\assembly\GAC\Microsoft.DirectX.Direct3DX\1.0.2910.0__31bf3856ad364e35\Microsoft.DirectX.Direct3DX.dll
    - 2008-03-09 11:19:05 578,560 ----a-w C:\WINDOWS\assembly\GAC\Microsoft.DirectX.Direct3DX\1.0.2911.0__31bf3856ad364e35\Microsoft.DirectX.Direct3DX.dll
    + 2008-06-11 12:08:54 578,560 ----a-w C:\WINDOWS\assembly\GAC\Microsoft.DirectX.Direct3DX\1.0.2911.0__31bf3856ad364e35\Microsoft.DirectX.Direct3DX.dll
    - 2008-03-09 11:19:05 145,920 ----a-w C:\WINDOWS\assembly\GAC\Microsoft.DirectX.DirectDraw\1.0.2902.0__31bf3856ad364e35\Microsoft.DirectX.DirectDraw.dll
    + 2008-06-11 12:08:54 145,920 ----a-w C:\WINDOWS\assembly\GAC\Microsoft.DirectX.DirectDraw\1.0.2902.0__31bf3856ad364e35\Microsoft.DirectX.DirectDraw.dll
    - 2008-03-09 11:19:05 159,232 ----a-w C:\WINDOWS\assembly\GAC\Microsoft.DirectX.DirectInput\1.0.2902.0__31bf3856ad364e35\Microsoft.DirectX.DirectInput.dll
    + 2008-06-11 12:08:54 159,232 ----a-w C:\WINDOWS\assembly\GAC\Microsoft.DirectX.DirectInput\1.0.2902.0__31bf3856ad364e35\Microsoft.DirectX.DirectInput.dll
    - 2008-03-09 11:19:05 364,544 ----a-w C:\WINDOWS\assembly\GAC\Microsoft.DirectX.DirectPlay\1.0.2902.0__31bf3856ad364e35\Microsoft.DirectX.DirectPlay.dll
    + 2008-06-11 12:08:55 364,544 ----a-w C:\WINDOWS\assembly\GAC\Microsoft.DirectX.DirectPlay\1.0.2902.0__31bf3856ad364e35\Microsoft.DirectX.DirectPlay.dll
    - 2008-03-09 11:19:06 178,176 ----a-w C:\WINDOWS\assembly\GAC\Microsoft.DirectX.DirectSound\1.0.2902.0__31bf3856ad364e35\Microsoft.DirectX.DirectSound.dll
    + 2008-06-11 12:08:55 178,176 ----a-w C:\WINDOWS\assembly\GAC\Microsoft.DirectX.DirectSound\1.0.2902.0__31bf3856ad364e35\Microsoft.DirectX.DirectSound.dll
    - 2008-03-09 11:19:05 223,232 ----a-w C:\WINDOWS\assembly\GAC\Microsoft.DirectX\1.0.2902.0__31bf3856ad364e35\Microsoft.DirectX.dll
    + 2008-06-11 12:08:53 223,232 ----a-w C:\WINDOWS\assembly\GAC\Microsoft.DirectX\1.0.2902.0__31bf3856ad364e35\Microsoft.DirectX.dll
    - 2008-06-03 16:19:20 2,048 --s-a-w C:\WINDOWS\bootstat.dat
    + 2008-06-12 18:44:43 2,048 --s-a-w C:\WINDOWS\bootstat.dat
    + 2008-04-14 15:52:59 272,128 ------w C:\WINDOWS\Driver Cache\i386\bthport.sys
    + 2008-06-01 16:12:42 163,328 ----a-w C:\WINDOWS\ERUNT\SDFIX\ERDNT.EXE
    + 2008-06-03 18:54:44 8,753,152 ----a-w C:\WINDOWS\ERUNT\SDFIX\Users\00000001\NTUSER.DAT
    + 2008-06-03 18:54:46 352,256 ----a-w C:\WINDOWS\ERUNT\SDFIX\Users\00000002\UsrClass.dat
    + 2008-06-01 16:12:42 163,328 ----a-w C:\WINDOWS\ERUNT\SDFIX_First_Run\ERDNT.EXE
    + 2008-06-03 18:54:30 8,753,152 ----a-w C:\WINDOWS\ERUNT\SDFIX_First_Run\Users\00000001\NTUSER.DAT
    + 2008-06-03 18:54:30 352,256 ----a-w C:\WINDOWS\ERUNT\SDFIX_First_Run\Users\00000002\UsrClass.dat
    + 2008-06-11 12:08:19 5,694 ----a-r C:\WINDOWS\Installer\{066ED8C4-8C66-4824-ACF4-8F622E88E074}\ARPPRODUCTICON.exe
    - 2008-03-03 11:02:49 29,926 ----a-r C:\WINDOWS\Installer\{A9174A72-1B46-445B-B3CF-90ED2C63D83B}\MsblIco.Exe
    + 2008-06-09 16:26:58 29,926 ----a-r C:\WINDOWS\Installer\{A9174A72-1B46-445B-B3CF-90ED2C63D83B}\MsblIco.Exe
    - 2008-02-16 09:02:36 1,023,488 ----a-w C:\WINDOWS\system32\browseui.dll
    + 2008-04-21 07:02:46 1,023,488 ----a-w C:\WINDOWS\system32\browseui.dll
    - 2008-02-16 09:02:36 151,552 ----a-w C:\WINDOWS\system32\cdfview.dll
    + 2008-04-21 07:02:46 151,552 ----a-w C:\WINDOWS\system32\cdfview.dll
    - 2008-02-16 09:02:37 1,055,232 ----a-w C:\WINDOWS\system32\danim.dll
    + 2008-04-21 07:02:47 1,055,232 ----a-w C:\WINDOWS\system32\danim.dll
    - 2008-02-16 09:02:36 1,023,488 -c--a-w C:\WINDOWS\system32\dllcache\browseui.dll
    + 2008-04-21 07:02:46 1,023,488 -c--a-w C:\WINDOWS\system32\dllcache\browseui.dll
    - 2008-02-16 09:02:36 151,552 -c--a-w C:\WINDOWS\system32\dllcache\cdfview.dll
    + 2008-04-21 07:02:46 151,552 -c--a-w C:\WINDOWS\system32\dllcache\cdfview.dll
    - 2008-02-16 09:02:37 1,055,232 -c--a-w C:\WINDOWS\system32\dllcache\danim.dll
    + 2008-04-21 07:02:47 1,055,232 -c--a-w C:\WINDOWS\system32\dllcache\danim.dll
    - 2008-02-16 09:02:37 357,888 -c--a-w C:\WINDOWS\system32\dllcache\dxtmsft.dll
    + 2008-04-21 07:02:47 357,888 -c--a-w C:\WINDOWS\system32\dllcache\dxtmsft.dll
    - 2008-02-16 09:02:37 205,312 -c--a-w C:\WINDOWS\system32\dllcache\dxtrans.dll
    + 2008-04-21 07:02:47 205,312 -c--a-w C:\WINDOWS\system32\dllcache\dxtrans.dll
    - 2008-02-16 09:02:37 55,808 -c--a-w C:\WINDOWS\system32\dllcache\extmgr.dll
    + 2008-04-21 07:02:47 55,808 -c--a-w C:\WINDOWS\system32\dllcache\extmgr.dll
    - 2008-02-15 09:23:37 18,432 -c--a-w C:\WINDOWS\system32\dllcache\iedw.exe
    + 2008-04-17 10:52:54 18,432 -c--a-w C:\WINDOWS\system32\dllcache\iedw.exe
    - 2008-02-16 09:02:38 250,880 -c--a-w C:\WINDOWS\system32\dllcache\iepeers.dll
    + 2008-04-21 07:02:47 250,880 -c--a-w C:\WINDOWS\system32\dllcache\iepeers.dll
    - 2008-02-16 09:02:38 96,256 -c--a-w C:\WINDOWS\system32\dllcache\inseng.dll
    + 2008-04-21 07:02:47 96,256 -c--a-w C:\WINDOWS\system32\dllcache\inseng.dll
    - 2008-02-16 09:02:38 16,384 -c--a-w C:\WINDOWS\system32\dllcache\jsproxy.dll
    + 2008-04-21 07:02:47 16,384 -c--a-w C:\WINDOWS\system32\dllcache\jsproxy.dll
    - 2008-02-16 22:32:40 3,080,704 -c--a-w C:\WINDOWS\system32\dllcache\mshtml.dll
    + 2008-04-21 07:02:49 3,080,704 -c--a-w C:\WINDOWS\system32\dllcache\mshtml.dll
    - 2008-02-16 09:02:39 449,024 -c--a-w C:\WINDOWS\system32\dllcache\mshtmled.dll
    + 2008-04-21 07:02:49 449,024 -c--a-w C:\WINDOWS\system32\dllcache\mshtmled.dll
    - 2008-02-16 09:02:39 146,432 -c--a-w C:\WINDOWS\system32\dllcache\msrating.dll
    + 2008-04-21 07:02:49 146,432 -c--a-w C:\WINDOWS\system32\dllcache\msrating.dll
    - 2008-02-16 09:02:39 532,480 -c--a-w C:\WINDOWS\system32\dllcache\mstime.dll
    + 2008-04-21 07:02:50 532,480 -c--a-w C:\WINDOWS\system32\dllcache\mstime.dll
    - 2008-02-16 09:02:39 39,424 -c--a-w C:\WINDOWS\system32\dllcache\pngfilt.dll
    + 2008-04-21 07:02:50 39,424 -c--a-w C:\WINDOWS\system32\dllcache\pngfilt.dll
    - 2007-10-29 22:43:51 1,288,192 -c--a-w C:\WINDOWS\system32\dllcache\quartz.dll
    + 2008-05-07 05:15:43 1,288,192 -c--a-w C:\WINDOWS\system32\dllcache\quartz.dll
    - 2006-07-13 08:48:58 202,240 -c--a-w C:\WINDOWS\system32\dllcache\rmcast.sys
    + 2008-05-08 12:28:49 202,752 -c--a-w C:\WINDOWS\system32\dllcache\rmcast.sys
    - 2008-02-16 09:02:41 1,494,016 -c--a-w C:\WINDOWS\system32\dllcache\shdocvw.dll
    + 2008-04-21 07:02:51 1,494,016 -c--a-w C:\WINDOWS\system32\dllcache\shdocvw.dll
    - 2008-02-16 09:02:41 474,112 -c--a-w C:\WINDOWS\system32\dllcache\shlwapi.dll
    + 2008-04-21 07:02:51 474,112 -c--a-w C:\WINDOWS\system32\dllcache\shlwapi.dll
    - 2008-02-16 09:02:41 616,448 -c--a-w C:\WINDOWS\system32\dllcache\urlmon.dll
    + 2008-04-21 07:02:52 616,448 -c--a-w C:\WINDOWS\system32\dllcache\urlmon.dll
    - 2008-02-16 09:02:42 659,456 -c--a-w C:\WINDOWS\system32\dllcache\wininet.dll
    + 2008-04-21 07:02:52 659,456 -c--a-w C:\WINDOWS\system32\dllcache\wininet.dll
    - 2008-02-16 09:02:37 357,888 ----a-w C:\WINDOWS\system32\dxtmsft.dll
    + 2008-04-21 07:02:47 357,888 ----a-w C:\WINDOWS\system32\dxtmsft.dll
    - 2008-02-16 09:02:37 205,312 ----a-w C:\WINDOWS\system32\dxtrans.dll
    + 2008-04-21 07:02:47 205,312 ----a-w C:\WINDOWS\system32\dxtrans.dll
    - 2008-02-16 09:02:37 55,808 ----a-w C:\WINDOWS\system32\extmgr.dll
    + 2008-04-21 07:02:47 55,808 ----a-w C:\WINDOWS\system32\extmgr.dll
    - 2008-02-16 09:02:38 250,880 ----a-w C:\WINDOWS\system32\iepeers.dll
    + 2008-04-21 07:02:47 250,880 ----a-w C:\WINDOWS\system32\iepeers.dll
    - 2008-02-16 09:02:38 96,256 ----a-w C:\WINDOWS\system32\inseng.dll
    + 2008-04-21 07:02:47 96,256 ----a-w C:\WINDOWS\system32\inseng.dll
    - 2008-02-16 09:02:38 16,384 ----a-w C:\WINDOWS\system32\jsproxy.dll
    + 2008-04-21 07:02:47 16,384 ----a-w C:\WINDOWS\system32\jsproxy.dll
    - 2007-11-21 00:52:38 2,884,992 ----a-w C:\WINDOWS\system32\Macromed\Flash\NPSWF32.dll
    + 2008-03-25 03:21:18 2,889,088 ----a-w C:\WINDOWS\system32\Macromed\Flash\NPSWF32.dll
    - 2007-11-21 00:52:40 218,496 ----a-w C:\WINDOWS\system32\Macromed\Flash\NPSWF32_FlashUtil.exe
    + 2008-03-25 03:21:20 218,496 ----a-w C:\WINDOWS\system32\Macromed\Flash\NPSWF32_FlashUtil.exe
    - 2008-01-29 19:04:22 70,264 ----a-w C:\WINDOWS\system32\Macromed\Flash\uninstall_plugin.exe
    + 2008-06-08 10:48:10 70,264 ----a-w C:\WINDOWS\system32\Macromed\Flash\uninstall_plugin.exe
    - 2008-05-09 21:35:04 16,863,864 ----a-w C:\WINDOWS\system32\MRT.exe
    + 2008-05-29 23:35:11 17,486,968 ----a-w C:\WINDOWS\system32\MRT.exe
    - 2008-02-16 22:32:40 3,080,704 ----a-w C:\WINDOWS\system32\mshtml.dll
    + 2008-04-21 07:02:49 3,080,704 ----a-w C:\WINDOWS\system32\mshtml.dll
    - 2008-02-16 09:02:39 449,024 ----a-w C:\WINDOWS\system32\mshtmled.dll
    + 2008-04-21 07:02:49 449,024 ----a-w C:\WINDOWS\system32\mshtmled.dll
    - 2008-02-16 09:02:39 146,432 ----a-w C:\WINDOWS\system32\msrating.dll
    + 2008-04-21 07:02:49 146,432 ----a-w C:\WINDOWS\system32\msrating.dll
    - 2008-02-16 09:02:39 532,480 ----a-w C:\WINDOWS\system32\mstime.dll
    + 2008-04-21 07:02:50 532,480 ----a-w C:\WINDOWS\system32\mstime.dll
    - 2008-02-16 09:02:39 39,424 ----a-w C:\WINDOWS\system32\pngfilt.dll
    + 2008-04-21 07:02:50 39,424 ----a-w C:\WINDOWS\system32\pngfilt.dll
    - 2008-02-16 09:02:41 1,494,016 ----a-w C:\WINDOWS\system32\shdocvw.dll
    + 2008-04-21 07:02:51 1,494,016 ----a-w C:\WINDOWS\system32\shdocvw.dll
    - 2008-02-16 09:02:41 474,112 ----a-w C:\WINDOWS\system32\shlwapi.dll
    + 2008-04-21 07:02:51 474,112 ----a-w C:\WINDOWS\system32\shlwapi.dll
    + 2007-10-18 08:31:46 51,224 ----a-w C:\WINDOWS\system32\sirenacm.dll
    - 2006-10-08 19:51:14 14,640 ------w C:\WINDOWS\system32\spmsg.dll
    + 2007-11-30 11:19:02 17,272 ------w C:\WINDOWS\system32\spmsg.dll
    - 2008-02-16 09:02:41 616,448 ----a-w C:\WINDOWS\system32\urlmon.dll
    + 2008-04-21 07:02:52 616,448 ----a-w C:\WINDOWS\system32\urlmon.dll
    - 2007-05-31 16:29:42 18,280 ----a-w C:\WINDOWS\system32\x3daudio1_2.dll
    + 2007-10-22 00:37:16 17,928 ----a-w C:\WINDOWS\system32\X3DAudio1_2.dll
    - 2007-05-31 16:30:22 266,088 ----a-w C:\WINDOWS\system32\xactengine2_8.dll
    + 2007-06-20 17:46:04 266,088 ----a-w C:\WINDOWS\system32\xactengine2_8.dll
    - 2008-02-15 23:03:12 357,888 ----a-w C:\WINDOWS\system32\xpsp3res.dll
    + 2008-04-17 11:03:44 357,888 ----a-w C:\WINDOWS\system32\xpsp3res.dll
    + 2006-06-05 11:14:28 479,232 ----a-w C:\WINDOWS\WinSxS\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.163_x-ww_681e29fb\msvcm80.dll
    + 2006-06-05 11:14:28 548,864 ----a-w C:\WINDOWS\WinSxS\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.163_x-ww_681e29fb\msvcp80.dll
    + 2006-06-05 11:14:28 626,688 ----a-w C:\WINDOWS\WinSxS\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.163_x-ww_681e29fb\msvcr80.dll
    .
    -- Snapshot reset to current date --
    .
    (((((((((((((((((((((((((((((( Rekisterin käynnistyskohteet )))))))))))))))))))))))))))))))))))))))))))))
    .
    .
    REGEDIT4
    *Huom* Tyhjiä arvoja ja laillisia oletusarvoja ei näytetä

    [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "MsnMsgr"="C:\Program Files\Windows Live\Messenger\MsnMsgr.exe" [2007-10-18 11:34 5724184]
    "Skype"="C:\Program Files\Skype\Phone\Skype.exe" [2006-12-11 21:41 25343016]
    "igndlm.exe"="C:\Program Files\Download Manager\DLM.exe" [2007-03-06 00:57 1103480]
    "PeerGuardian"="C:\Program Files\PeerGuardian2\pg2.exe" [2005-09-18 18:40 1421824]
    "LogitechSoftwareUpdate"="C:\Program Files\Logitech\Video\ManifestEngine.exe" [2005-06-08 15:44 196608]
    "Octoshape Streaming Services"="C:\Program Files\Octoshape Streaming Services\Koppis\OctoshapeClient.exe" [2006-02-13 19:33 214648]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "HotKeysCmds"="C:\WINDOWS\system32\hkcmd.exe" [2006-08-14 15:41 114688]
    "High Definition Audio -ominaisuussivun pikakuvake"="HDAShCut.exe" [2005-01-07 18:07 61952 C:\WINDOWS\system32\HdAShCut.exe]
    "F-Secure Manager"="C:\Program Files\F-Secure\Common\FSM32.exe" [2005-10-26 04:51 122929]
    "F-Secure TNB"="C:\Program Files\F-Secure\TNB\TNBUtil.exe" [2004-05-27 11:57 684032]
    "DLA"="C:\WINDOWS\System32\DLA\DLACTRLW.EXE" [2005-09-28 06:10 122940]
    "LVCOMSX"="C:\WINDOWS\system32\LVCOMSX.EXE" [2005-07-19 18:32 221184]
    "RTHDCPL"="RTHDCPL.EXE" [2006-10-11 18:36 16267776 C:\WINDOWS\RTHDCPL.exe]
    "LogitechVideoRepair"="C:\Program Files\Logitech\Video\ISStart.exe" [2005-06-08 16:24 458752]
    "LogitechVideoTray"="C:\Program Files\Logitech\Video\LogiTray.exe" [2005-06-08 16:14 217088]
    "DAEMON Tools"="C:\Program Files\DAEMON Tools\daemon.exe" [2006-09-14 23:09 157592]
    "StartCCC"="C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2008-01-21 12:17 61440]
    "itype"="c:\Program Files\Microsoft IntelliType Pro\itype.exe" [2007-08-31 12:13 988584]
    "DPAgnt"="C:\Program Files\DigitalPersona\Bin\DPAgnt.exe" [2006-10-09 16:27 807440]

    [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
    "CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2006-03-02 15:00 15360]

    C:\Documents and Settings\All Users\K„ynnist„-valikko\Ohjelmat\K„ynnistys\
    F-Secure Automatic Update.lnk - C:\Program Files\F-Secure\BackWeb\7681197\program\F-Secure Automatic Update.exe [2006-10-31 16:53:14 32807]
    Sonic CinePlayer Quick Launch.lnk - C:\Program Files\Common Files\Sonic Shared\CineTray.exe [2005-10-15 03:01:00 114688]

    [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\ckpNotify]
    ckpNotify.dll 2005-03-01 20:49 24672 C:\WINDOWS\system32\ckpNotify.dll

    [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\DPWLN ]
    C:\WINDOWS\system32\DPWLEvHd.dll 2006-10-09 16:27 99856 C:\WINDOWS\system32\DPWLEvHd.dll

    [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
    "VIDC.I420"= i420vfw.dll
    "vidc.yv12"= yv12vfw.dll

    [HKEY_LOCAL_MACHINE\software\microsoft\security center]
    "AntiVirusOverride"=dword:00000001

    [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
    "EnableFirewall"= 0 (0x0)

    [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
    "%windir%\\system32\\sessmgr.exe"=
    "C:\\Program Files\\F-Secure\\BackWeb\\7681197\\program\\F-Secure Automatic Update.exe"=
    "C:\\Program Files\\CheckPoint\\SecuRemote\\bin\\SR_Service.exe"=
    "C:\\Program Files\\CheckPoint\\SecuRemote\\bin\\SR_GUI.exe"=
    "C:\\Program Files\\CheckPoint\\SecuRemote\\bin\\scc.exe"=
    "C:\\Program Files\\CheckPoint\\SecuRemote\\bin\\SR_SDS.exe"=
    "C:\\Program Files\\CheckPoint\\SecuRemote\\bin\\SR_Diagnostics.exe"=
    "C:\\Program Files\\uTorrent\\uTorrent.exe"=
    "C:\\WINDOWS\\system32\\dplaysvr.exe"=
    "C:\\Pelit\\Settlers3\\s3.exe"=
    "C:\\Pelit\\Crysis\\Bin32\\Crysis.exe"=
    "C:\\Pelit\\Crysis\\Bin32\\CrysisDedicatedServer.exe"=
    "C:\\WINDOWS\\system32\\PnkBstrA.exe"=
    "C:\\WINDOWS\\system32\\PnkBstrB.exe"=
    "C:\\Program Files\\SmartFTP Client\\SmartFTP.exe"=
    "C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
    "C:\\Program Files\\Windows Live\\Messenger\\livecall.exe"=
    "C:\\Program Files\\Skype\\Phone\\Skype.exe"=

    [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
    "9278:TCP"= 9278:TCP:BitComet 9278 TCP
    "9278:UDP"= 9278:UDP:BitComet 9278 UDP

    R0 FSFW;F-Secure Firewall Driver;C:\WINDOWS\system32\drivers\fsdfw.sys [2005-10-31 13:01]
    R1 bbcap;bbcap;C:\WINDOWS\system32\DRIVERS\bbcap.sys [2007-06-24 23:03]
    R2 BackWeb Plug-in - 7681197;F-Secure Automatic Update;C:\PROGRA~1\F-Secure\BackWeb\7681197\Program\SERVIC~1.EXE [2006-10-31 16:53]
    R2 F-Secure Filter;F-Secure File System Filter;C:\Program Files\F-Secure\Anti-Virus\Win2K\FSfilter.sys [2005-08-19 16:37]
    R2 F-Secure Gatekeeper;F-Secure Gatekeeper;C:\Program Files\F-Secure\Anti-Virus\Win2K\FSgk.sys [2005-10-06 17:30]
    R2 F-Secure Recognizer;F-Secure File System Recognizer;C:\Program Files\F-Secure\Anti-Virus\Win2K\FSrec.sys [2005-08-19 16:37]
    R2 Scap;SecureClient Application Policy Module;C:\WINDOWS\system32\DRIVERS\Scap.sys [2005-03-01 20:49]
    R2 SVKP;SVKP;C:\WINDOWS\system32\SVKP.sys [2007-06-01 15:28]
    R2 UxTuneUp;TuneUp Theme Extension;C:\WINDOWS\System32\svchost.exe [2006-03-02 15:00]
    R3 dpK0Bx01;Fingerprint Reader Filter Driver;C:\WINDOWS\system32\DRIVERS\dpK0Bx01.sys [2006-09-16 17:25]
    R3 FW1;SecuRemote Miniport;C:\WINDOWS\system32\DRIVERS\fw.sys [2005-03-01 20:49]
    R3 usbdpfp;Fingerprint Reader Class Driver;C:\WINDOWS\system32\DRIVERS\usbdpfp.sys [2006-09-16 17:23]
    S0 stwlfbus;stwlfbus;C:\WINDOWS\system32\DRIVERS\stwlfbus.sys [2003-04-27 13:39]
    S3 ggflt;SEMC USB Flash Driver Filter;C:\WINDOWS\system32\DRIVERS\ggflt.sys [2008-02-16 21:03]
    S3 gsplittm;gsplittm;C:\DOCUME~1\Koppis\LOCALS~1\Temp\gsplittm.sys []
    S3 OMVA;VPN-1 SecureClient Adapter;C:\WINDOWS\system32\DRIVERS\OMVA.sys [2005-03-01 20:49]
    S3 st3wolf;st3wolf;C:\WINDOWS\system32\DRIVERS\st3wolf.sys [2003-04-27 12:43]
    S3 w200bus;Sony Ericsson W200 driver (WDM);C:\WINDOWS\system32\DRIVERS\w200bus.sys [2006-11-07 10:42]
    S3 w200mdfl;Sony Ericsson W200 USB WMC Modem Filter;C:\WINDOWS\system32\DRIVERS\w200mdfl.sys [2006-11-07 10:42]
    S3 w200mdm;Sony Ericsson W200 USB WMC Modem Driver;C:\WINDOWS\system32\DRIVERS\w200mdm.sys [2006-11-07 10:42]
    S3 w200mgmt;Sony Ericsson W200 USB WMC Device Management Drivers (WDM);C:\WINDOWS\system32\DRIVERS\w200mgmt.sys [2006-11-07 10:42]
    S3 w200obex;Sony Ericsson W200 USB WMC OBEX Interface;C:\WINDOWS\system32\DRIVERS\w200obex.sys [2006-11-07 10:42]

    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost - NetSvcs
    UxTuneUp

    [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{86167224-b6ba-11dc-8548-0016350dc46d}]
    \Shell\AutoRun\command - I:\PortableApps\PortableAppsMenu\PortableAppsMenu.exe

    *Newly Created Service* - PGFILTER
    .
    'Ajoitetut tehtävät'-kansion sisältö
    "2008-05-30 14:17:09 C:\WINDOWS\Tasks\1-Click Maintenance.job"
    - C:\Program Files\TuneUp Utilities 2007\SystemOptimizer.exe
    "2007-02-13 14:00:42 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job"
    - C:\Program Files\Apple Software Update\SoftwareUpdate.exe
    "2008-06-12 14:46:58 C:\WINDOWS\Tasks\Scheduled scanning task.job"
    - C:\PROGRA~1\F-Secure\ANTI-V~1\fsav.exeZ /HARD /ARCHIVE /DISINF /SCHED /NOBREAK /REPORT=C:\PROGRA~1\F-Secure\ANTI-V~1\report.txt
    .
    **************************************************************************

    catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
    Rootkit scan 2008-06-12 21:59:13
    Windows 5.1.2600 Service Pack 2 NTFS

    scanning hidden processes ...

    scanning hidden autostart entries ...

    scanning hidden files ...

    scan completed successfully
    hidden files: 0

    **************************************************************************
    .
    Completion time: 2008-06-12 22:02:52
    ComboFix-quarantined-files.txt 2008-06-12 19:02:48
    ComboFix2.txt 2008-06-08 12:54:20
    ComboFix3.txt 2008-06-03 17:12:28
    ComboFix4.txt 2008-06-03 16:29:13
    ComboFix5.txt 2008-05-29 11:02:29

    Pre-Run: 7,503,593,472 tavua vapaana
    Post-Run: 8,023,191,552 tavua vapaana

    480 --- E O F --- 2008-06-11 15:04:34
     
    Koppis1, Jun 12, 2008
    #13
  14. Hujo

    Hujo Guest

    Hujo, Jun 12, 2008
    #14

Share This Page