outo sivu

elikkä ongelma olis semmonen kun avaan netin ja avaan jonkun sivun niin samalla aukeaa outo sivu > http://login.revenueloop.com/geo_tracking_redirect.html?a=CD1753&program_id=502 <tommonen. olen ajanut spybotin,F-securen ,ad adwaren ja smitfaudfixin ja mikään niistä ei löydä mitään, se ei aukea aina samalla sivulla vaan aukeaa miten sattuu.katoin netistä mitkä sivut noi on enkä muista et olisin ikinään käynyt ennen noilla sivuilla.jos joku osasisi sanoa syyn niin olisin kiitollinen on aika rasittava ongelma.

 

Lataa hjt:n tuosta http://koti.mbnet.fi/pattaya1/lataus/hijackthis_self.exe

asenna naputtele numero järjestyksessä

1.Unzip
2.OK
3.Close

scannaa paina tuosta > Do a system scan and save a logfile

Kopioi ponnahtava muistio hjt loki ja laita tänne.

======

viskaa kolikolla oli kruuna

Escan
Ohjeet tuolla sivulla.
http://koti.mbnet.fi/pattaya1/escanmwav.htm
lataa tuosta
http://www.spywareinfo.dk/download/mwav.exe
päivitä tuosta
http://koti.mbnet.fi/pattaya1/lataus/Mwav.bat
laita täpit merkkauksien mukaan
http://koti.mbnet.fi/pattaya1/eScan6.jpg

scannaa

jos ala luukkuun tulee jotain niin kopioi se näin:
Käytä komentoa Ctrl+A.
Kopioi rivit komennolla Ctrl+C.
Liitä rivit komennolla Ctrl+V.

Laita virus log tänne.

 

Logfile of Trend Micro HijackThis v2.0.0 (BETA)
Scan saved at 17:29:34, on 31.3.2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\NVIDIA Corporation\NvMixer\NVMixerTray.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\Program Files\Sonera Tietoturva\Common\FSM32.EXE
C:\Program Files\LClock\LClock.exe
C:\Program Files\VisualTooltip\VisualToolTip.exe
C:\Program Files\Styler\Styler.exe
C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe
C:\WINDOWS\system32\CFLMON.EXE
C:\WINDOWS\system32\ctfmon.exe
C:\PROGRA~1\SONERA~1\backweb\4436233\Program\SERVIC~1.EXE
C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe
C:\Program Files\Diskeeper Corporation\Diskeeper\DkService.exe
C:\Program Files\Thoosje Vista Sidebar v1.7.8\thoosje's sidebar.exe
C:\Program Files\Siber Systems\AI RoboForm\RoboTaskBarIcon.exe
C:\Program Files\Sonera Tietoturva\Anti-Virus\fsgk32st.exe
C:\Program Files\Sonera Tietoturva\Anti-Virus\FSGK32.EXE
C:\Program Files\Sonera Tietoturva\backweb\4436233\program\fsbwsys.exe
C:\Program Files\Sonera Tietoturva\Anti-Virus\fssm32.exe
C:\Program Files\Sonera Tietoturva\Common\FSMA32.EXE
C:\Program Files\Sonera Tietoturva\Common\FSMB32.EXE
C:\WINDOWS\system32\nvsvc32.exe
C:\Program Files\Sonera Tietoturva\Common\FCH32.EXE
C:\Program Files\Sonera Tietoturva\Common\FAMEH32.EXE
C:\PROGRA~1\INCRED~1\bin\IMApp.exe
C:\Program Files\Sonera Tietoturva\Anti-Virus\fsrw.exe
C:\Program Files\Sonera Tietoturva\Anti-Virus\fsav32.exe
C:\Program Files\Sonera Tietoturva\backweb\4436233\Program\fspex.exe
C:\Program Files\Sonera Tietoturva\FWES\Program\fsdfwd.exe
C:\PROGRA~1\SONERA~1\ANTI-S~1\fsaw.exe
C:\DOCUME~1\Marko\LOCALS~1\Temp\{59C2EA4E-6697-4407-A6C2-1985E059D05C}\Blaero Start Orb.exe
C:\Program Files\Sonera Tietoturva\FSGUI\fsguidll.exe
C:\DOCUME~1\Marko\LOCALS~1\Temp\Rar$EX01.562\TrayIt! 4.4.2\TrayIt!.exe
C:\Documents and Settings\Marko\Local Settings\Temporary Internet Files\Content.IE5\5B6YR7XG\HiJackThis_v2.0.0.0[1].exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.fi/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.windowsxlive.net
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Linkit
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: (no name) - {724d43a9-0d85-11d4-9908-00400523e39a} - C:\Program Files\Siber Systems\AI RoboForm\roboform.dll
O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\PROGRA~1\MICROS~2\Office12\GRA8E1~1.DLL
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: AcroIEToolbarHelper Class - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll
O3 - Toolbar: &RoboForm - {724d43a0-0d85-11d4-9908-00400523e39a} - C:\Program Files\Siber Systems\AI RoboForm\roboform.dll
O3 - Toolbar: StylerToolBar - {D2F8F919-690B-4EA2-9FA7-A203D1E04F75} - C:\Program Files\Styler\TB\StylerTB.dll
O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll
O3 - Toolbar: Easy-WebPrint - {327C2873-E90D-4c37-AA9D-10AC9BABA46C} - C:\Program Files\Canon\Easy-WebPrint\Toolband.dll
O4 - HKLM\..\Run: [NVMixerTray] "C:\Program Files\NVIDIA Corporation\NvMixer\NVMixerTray.exe"
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [F-Secure Manager] "C:\Program Files\Sonera Tietoturva\Common\FSM32.EXE" /splash
O4 - HKLM\..\Run: [F-Secure TNB] "C:\Program Files\Sonera Tietoturva\TNB\TNBUtil.exe" /CHECKALL /WAITFORSW
O4 - HKLM\..\Run: [F-Secure Startup Wizard] "C:\Program Files\Sonera Tietoturva\FSGUI\FSSW.EXE" /reboot
O4 - HKLM\..\Run: [News Service] "C:\Program Files\Sonera Tietoturva\FSGUI\ispnews.exe"
O4 - HKLM\..\Run: [LClock] C:\Program Files\LClock\LClock.exe
O4 - HKLM\..\Run: [VisualTooltip] C:\Program Files\VisualTooltip\VisualToolTip.exe
O4 - HKLM\..\Run: [Blaero Start Orb] C:\Program Files\Blaero Start Orb\Blaero Start Orb.exe
O4 - HKLM\..\Run: [Styler] C:\Program Files\Styler\Styler.exe
O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe
O4 - HKLM\..\Run: [GrooveMonitor] "C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe"
O4 - HKLM\..\Run: [Lector de documentos Doc de Windows] CFLMON.EXE
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [IncrediMail] C:\Program Files\IncrediMail\bin\IncMail.exe /c
O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe"
O4 - HKCU\..\Run: [thoosje's sidebar] C:\Program Files\Thoosje Vista Sidebar v1.7.8\thoosje's sidebar.exe
O4 - HKCU\..\Run: [RoboForm] "C:\Program Files\Siber Systems\AI RoboForm\RoboTaskBarIcon.exe"
O4 - HKCU\..\RunOnce: [Lector de documentos Doc de Windows] CFLMON.EXE
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Paikallinen palve')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Verkkopalve')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: Adobe Acrobat Speed Launcher.lnk = ?
O4 - Global Startup: Sonera Tietoturva.lnk = C:\Program Files\Sonera Tietoturva\backweb\4436233\Program\fspex.exe
O8 - Extra context menu item: &Estä tämä kohoikkuna - C:\Program Files\Sonera Tietoturva\Anti-Spyware\blockpopups.htm
O8 - Extra context menu item: Convert link target to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convert link target to existing PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Convert selected links to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
O8 - Extra context menu item: Convert selected links to existing PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
O8 - Extra context menu item: Convert selection to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convert selection to existing PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Convert to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convert to existing PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Easy-WebPrint Add To Print List - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_AddToList.html
O8 - Extra context menu item: Easy-WebPrint High Speed Print - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_HSPrint.html
O8 - Extra context menu item: Easy-WebPrint Preview - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_Preview.html
O8 - Extra context menu item: Easy-WebPrint Print - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_Print.html
O8 - Extra context menu item: Muutavalikkoa - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComCustomizeIEMenu.html
O8 - Extra context menu item: RF Työkalupalkki - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComShowToolbar.html
O8 - Extra context menu item: Tallenna lomakkeet - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComSavePass.html
O8 - Extra context menu item: Täytä lomakkeet - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComFillForms.html
O8 - Extra context menu item: V&ie Microsoft Exceliin - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O8 - Extra context menu item: Vie Microsoft E&xceliin - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: Lähetä OneNoteen - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: Läh&etä OneNoteen - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra button: IE-suojaus - {300DB664-75B5-47c0-8B45-A44ACCF73C00} - C:\Program Files\Sonera Tietoturva\Anti-Spyware\ieshield.dll
O9 - Extra 'Tools' menuitem: IE-suojaus... - {300DB664-75B5-47c0-8B45-A44ACCF73C00} - C:\Program Files\Sonera Tietoturva\Anti-Spyware\ieshield.dll
O9 - Extra button: Täytä lomakkeet - {320AF880-6646-11D3-ABEE-C5DBF3571F46} - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComFillForms.html
O9 - Extra 'Tools' menuitem: Täytä lomakkeet - {320AF880-6646-11D3-ABEE-C5DBF3571F46} - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComFillForms.html
O9 - Extra button: Tallenna - {320AF880-6646-11D3-ABEE-C5DBF3571F49} - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComSavePass.html
O9 - Extra 'Tools' menuitem: Tallenna lomakkeet - {320AF880-6646-11D3-ABEE-C5DBF3571F49} - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComSavePass.html
O9 - Extra button: RoboForm - {724d43aa-0d85-11d4-9908-00400523e39a} - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComShowToolbar.html
O9 - Extra 'Tools' menuitem: RF Työkalupalkki - {724d43aa-0d85-11d4-9908-00400523e39a} - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComShowToolbar.html
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O9 - Extra button: Lukutulkki - {B66541E2-E167-4084-8E77-68CA13C4B3B8} - C:\Program Files\NetClickup\Lukutulkki\Lutu.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\PROGRA~1\MICROS~2\Office12\GR99D3~1.DLL
O22 - SharedTaskScheduler: Browseui preloader - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - C:\WINDOWS\system32\browseui.dll
O22 - SharedTaskScheduler: Component Categories cache daemon - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\WINDOWS\system32\browseui.dll
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - Unknown owner - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe (file missing)
O23 - Service: avast! Antivirus - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashServ.exe (file missing)
O23 - Service: avast! Mail Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe (file missing)
O23 - Service: avast! Web Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe (file missing)
O23 - Service: Sonera Tietoturva (BackWeb Plug-in - 4436233) - Sonera Tietoturva - C:\PROGRA~1\SONERA~1\backweb\4436233\Program\SERVIC~1.EXE
O23 - Service: Diskeeper - Diskeeper Corporation - C:\Program Files\Diskeeper Corporation\Diskeeper\DkService.exe
O23 - Service: Loogisen levyn hallinnan valvontapalvelu (dmadmin) - Unknown owner - C:\WINDOWS\System32\dmadmin.exe
O23 - Service: Tapahtumaloki (Eventlog) - Unknown owner - C:\WINDOWS\system32\services.exe
O23 - Service: FSGKHS (F-Secure Gatekeeper Handler Starter) - Unknown owner - C:\Program Files\Sonera Tietoturva\Anti-Virus\fsgk32st.exe
O23 - Service: fsbwsys - Unknown owner - C:\Program Files\Sonera Tietoturva\backweb\4436233\program\fsbwsys.exe
O23 - Service: F-Secure Anti-Virus Firewall Daemon (FSDFWD) - F-Secure Corporation - C:\Program Files\Sonera Tietoturva\FWES\Program\fsdfwd.exe
O23 - Service: F-Secure Management Agent (FSMA) - F-Secure Corporation - C:\Program Files\Sonera Tietoturva\Common\FSMA32.EXE
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: CD-levyjen kirjoittamisen IMAPI COM -palvelu (ImapiService) - Unknown owner - C:\WINDOWS\system32\imapi.exe
O23 - Service: NetMeeting etätyöpöydän jakaminen (mnmsrvc) - Unknown owner - C:\WINDOWS\system32\mnmsrvc.exe
O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: Plug and Play (PlugPlay) - Unknown owner - C:\WINDOWS\system32\services.exe
O23 - Service: Etätyöpöydän ohjeen istunnonhallinta (RDSessMgr) - Unknown owner - C:\WINDOWS\system32\sessmgr.exe
O23 - Service: Älykortti (SCardSvr) - Unknown owner - C:\WINDOWS\System32\SCardSvr.exe
O23 - Service: Resurssilokit ja -hälytykset (SysmonLog) - Unknown owner - C:\WINDOWS\system32\smlogsvc.exe
O23 - Service: Aseman tilannevedos (VSS) - Unknown owner - C:\WINDOWS\System32\vssvc.exe
O23 - Service: WMI resurssisovitin (WmiApSrv) - Unknown owner - C:\WINDOWS\system32\wbem\wmiapsrv.exe

--
End of file - 14911 bytes

 

viskaa tuo beetta versio pois ja ota ylälinkistä 1.99.1 versio

F-securee ja avastia koneella mitähän mahat noista käyttää?
ilmeisesti F-securea

poista lisää poista sovelutuksesta

avast
==================
Mene vikasietotilaan
sammuta ja käynnistä
käynnistyksen yhteydessä hakkaa F8 nappia
valitse nuolinäppäimellä vikasietotila
paina enter ja enter
valitse käyttäjä tilisi ja taas pikkunen ikkuna paina ok

poista kansio
C:\Program Files\Alwil Software

===================

scannaa hjt:llä merkkaa paina Fix checked

O23 - Service: Avast! iAVS4 Control Service (aswUpdSv) - Unknown owner - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe (file missing)
O23 - Service: Avast! Antivirus - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashServ.exe (file missing)
O23 - Service: Avast! Mail Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe (file missing)
O23 - Service: Avast! Web Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe (file missing)

==================
Kopioi / liitä seuraava teksti alapuolella tyhjään muistioFiluun
Varmista että tiedoston tyyppi on ”all Files” ja tallenna se Poisto.bat. nimisenä
työpöydällesi.

@echo off
sc stop aswUpdSv
sc delete aswUpdSv
sc stop Antivirus
sc delete Antivirus
sc stop ”Mail Scanner”
sc delete ”Mail Scanner”
sc stop “Web Scanner”
sc delete “Web Scanner”

Tupla-klikkaa Poisto.bat. filua työpöydälläsi , ikkuna avautuu ja Sulkeutuu tämä on normaalia.

=====================

lähetä
escan virus loki
uusi hjt loki

 

Logfile of HijackThis v1.99.1
Scan saved at 17:42:46, on 31.3.2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16414)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\NVIDIA Corporation\NvMixer\NVMixerTray.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\Program Files\Sonera Tietoturva\Common\FSM32.EXE
C:\Program Files\LClock\LClock.exe
C:\Program Files\VisualTooltip\VisualToolTip.exe
C:\Program Files\Styler\Styler.exe
C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe
C:\WINDOWS\system32\CFLMON.EXE
C:\WINDOWS\system32\ctfmon.exe
C:\PROGRA~1\SONERA~1\backweb\4436233\Program\SERVIC~1.EXE
C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe
C:\Program Files\Diskeeper Corporation\Diskeeper\DkService.exe
C:\Program Files\Thoosje Vista Sidebar v1.7.8\thoosje's sidebar.exe
C:\Program Files\Siber Systems\AI RoboForm\RoboTaskBarIcon.exe
C:\Program Files\Sonera Tietoturva\Anti-Virus\fsgk32st.exe
C:\Program Files\Sonera Tietoturva\Anti-Virus\FSGK32.EXE
C:\Program Files\Sonera Tietoturva\backweb\4436233\program\fsbwsys.exe
C:\Program Files\Sonera Tietoturva\Anti-Virus\fssm32.exe
C:\Program Files\Sonera Tietoturva\Common\FSMA32.EXE
C:\Program Files\Sonera Tietoturva\Common\FSMB32.EXE
C:\WINDOWS\system32\nvsvc32.exe
C:\Program Files\Sonera Tietoturva\Common\FCH32.EXE
C:\Program Files\Sonera Tietoturva\Common\FAMEH32.EXE
C:\PROGRA~1\INCRED~1\bin\IMApp.exe
C:\Program Files\Sonera Tietoturva\Anti-Virus\fsrw.exe
C:\Program Files\Sonera Tietoturva\Anti-Virus\fsav32.exe
C:\Program Files\Sonera Tietoturva\backweb\4436233\Program\fspex.exe
C:\Program Files\Sonera Tietoturva\FWES\Program\fsdfwd.exe
C:\PROGRA~1\SONERA~1\ANTI-S~1\fsaw.exe
C:\DOCUME~1\Marko\LOCALS~1\Temp\{59C2EA4E-6697-4407-A6C2-1985E059D05C}\Blaero Start Orb.exe
C:\Program Files\Sonera Tietoturva\FSGUI\fsguidll.exe
C:\DOCUME~1\Marko\LOCALS~1\Temp\Rar$EX01.562\TrayIt! 4.4.2\TrayIt!.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\HJT\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.fi/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.windowsxlive.net
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Linkit
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: (no name) - {724d43a9-0d85-11d4-9908-00400523e39a} - C:\Program Files\Siber Systems\AI RoboForm\roboform.dll
O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\PROGRA~1\MICROS~2\Office12\GRA8E1~1.DLL
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: AcroIEToolbarHelper Class - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll
O3 - Toolbar: &RoboForm - {724d43a0-0d85-11d4-9908-00400523e39a} - C:\Program Files\Siber Systems\AI RoboForm\roboform.dll
O3 - Toolbar: StylerToolBar - {D2F8F919-690B-4EA2-9FA7-A203D1E04F75} - C:\Program Files\Styler\TB\StylerTB.dll
O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll
O3 - Toolbar: Easy-WebPrint - {327C2873-E90D-4c37-AA9D-10AC9BABA46C} - C:\Program Files\Canon\Easy-WebPrint\Toolband.dll
O4 - HKLM\..\Run: [NVMixerTray] "C:\Program Files\NVIDIA Corporation\NvMixer\NVMixerTray.exe"
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [F-Secure Manager] "C:\Program Files\Sonera Tietoturva\Common\FSM32.EXE" /splash
O4 - HKLM\..\Run: [F-Secure TNB] "C:\Program Files\Sonera Tietoturva\TNB\TNBUtil.exe" /CHECKALL /WAITFORSW
O4 - HKLM\..\Run: [F-Secure Startup Wizard] "C:\Program Files\Sonera Tietoturva\FSGUI\FSSW.EXE" /reboot
O4 - HKLM\..\Run: [News Service] "C:\Program Files\Sonera Tietoturva\FSGUI\ispnews.exe"
O4 - HKLM\..\Run: [LClock] C:\Program Files\LClock\LClock.exe
O4 - HKLM\..\Run: [VisualTooltip] C:\Program Files\VisualTooltip\VisualToolTip.exe
O4 - HKLM\..\Run: [Blaero Start Orb] C:\Program Files\Blaero Start Orb\Blaero Start Orb.exe
O4 - HKLM\..\Run: [Styler] C:\Program Files\Styler\Styler.exe
O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe
O4 - HKLM\..\Run: [GrooveMonitor] "C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe"
O4 - HKLM\..\Run: [Lector de documentos Doc de Windows] CFLMON.EXE
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [IncrediMail] C:\Program Files\IncrediMail\bin\IncMail.exe /c
O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe"
O4 - HKCU\..\Run: [thoosje's sidebar] C:\Program Files\Thoosje Vista Sidebar v1.7.8\thoosje's sidebar.exe
O4 - HKCU\..\Run: [RoboForm] "C:\Program Files\Siber Systems\AI RoboForm\RoboTaskBarIcon.exe"
O4 - HKCU\..\RunOnce: [Lector de documentos Doc de Windows] CFLMON.EXE
O4 - Global Startup: Adobe Acrobat Speed Launcher.lnk = ?
O4 - Global Startup: Sonera Tietoturva.lnk = C:\Program Files\Sonera Tietoturva\backweb\4436233\Program\fspex.exe
O8 - Extra context menu item: &Estä tämä kohoikkuna - C:\Program Files\Sonera Tietoturva\Anti-Spyware\blockpopups.htm
O8 - Extra context menu item: Convert link target to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convert link target to existing PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Convert selected links to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
O8 - Extra context menu item: Convert selected links to existing PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
O8 - Extra context menu item: Convert selection to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convert selection to existing PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Convert to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convert to existing PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Easy-WebPrint Add To Print List - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_AddToList.html
O8 - Extra context menu item: Easy-WebPrint High Speed Print - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_HSPrint.html
O8 - Extra context menu item: Easy-WebPrint Preview - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_Preview.html
O8 - Extra context menu item: Easy-WebPrint Print - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_Print.html
O8 - Extra context menu item: Muutavalikkoa - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComCustomizeIEMenu.html
O8 - Extra context menu item: RF Työkalupalkki - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComShowToolbar.html
O8 - Extra context menu item: Tallenna lomakkeet - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComSavePass.html
O8 - Extra context menu item: Täytä lomakkeet - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComFillForms.html
O8 - Extra context menu item: V&ie Microsoft Exceliin - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O8 - Extra context menu item: Vie Microsoft E&xceliin - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: Lähetä OneNoteen - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: Läh&etä OneNoteen - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra button: IE-suojaus - {300DB664-75B5-47c0-8B45-A44ACCF73C00} - C:\Program Files\Sonera Tietoturva\Anti-Spyware\ieshield.dll
O9 - Extra 'Tools' menuitem: IE-suojaus... - {300DB664-75B5-47c0-8B45-A44ACCF73C00} - C:\Program Files\Sonera Tietoturva\Anti-Spyware\ieshield.dll
O9 - Extra button: Täytä lomakkeet - {320AF880-6646-11D3-ABEE-C5DBF3571F46} - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComFillForms.html
O9 - Extra 'Tools' menuitem: Täytä lomakkeet - {320AF880-6646-11D3-ABEE-C5DBF3571F46} - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComFillForms.html
O9 - Extra button: Tallenna - {320AF880-6646-11D3-ABEE-C5DBF3571F49} - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComSavePass.html
O9 - Extra 'Tools' menuitem: Tallenna lomakkeet - {320AF880-6646-11D3-ABEE-C5DBF3571F49} - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComSavePass.html
O9 - Extra button: RoboForm - {724d43aa-0d85-11d4-9908-00400523e39a} - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComShowToolbar.html
O9 - Extra 'Tools' menuitem: RF Työkalupalkki - {724d43aa-0d85-11d4-9908-00400523e39a} - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComShowToolbar.html
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O9 - Extra button: Lukutulkki - {B66541E2-E167-4084-8E77-68CA13C4B3B8} - C:\Program Files\NetClickup\Lukutulkki\Lutu.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O11 - Options group: [INTERNATIONAL] International*
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\PROGRA~1\MICROS~2\Office12\GR99D3~1.DLL
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Protocol: ms-help - {314111C7-A502-11D2-BBCA-00C04F8EC294} - C:\Program Files\Common Files\Microsoft Shared\Help\hxds.dll
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Filter hijack: text/xml - {807563E5-5146-11D5-A672-00B0D022E945} - C:\PROGRA~1\COMMON~1\MICROS~1\OFFICE12\MSOXMLMF.DLL
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - Unknown owner - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe (file missing)
O23 - Service: avast! Antivirus - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashServ.exe (file missing)
O23 - Service: avast! Mail Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe" /service (file missing)
O23 - Service: avast! Web Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe" /service (file missing)
O23 - Service: Sonera Tietoturva (BackWeb Plug-in - 4436233) - Sonera Tietoturva - C:\PROGRA~1\SONERA~1\backweb\4436233\Program\SERVIC~1.EXE
O23 - Service: Diskeeper - Diskeeper Corporation - C:\Program Files\Diskeeper Corporation\Diskeeper\DkService.exe
O23 - Service: FSGKHS (F-Secure Gatekeeper Handler Starter) - F-Secure Corp. - C:\Program Files\Sonera Tietoturva\Anti-Virus\fsgk32st.exe
O23 - Service: fsbwsys - F-Secure Corp. - C:\Program Files\Sonera Tietoturva\backweb\4436233\program\fsbwsys.exe
O23 - Service: F-Secure Anti-Virus Firewall Daemon (FSDFWD) - F-Secure Corporation - C:\Program Files\Sonera Tietoturva\FWES\Program\fsdfwd.exe
O23 - Service: F-Secure Management Agent (FSMA) - F-Secure Corporation - C:\Program Files\Sonera Tietoturva\Common\FSMA32.EXE
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe

F-securea käytän asensin ton avastin kun yritin päästä tosta ongelmasta eroon,poistin sen jo aikasemmin,sekä samalla ton kyseisen kansion,en tiedä miksi se näkyy tossa mut sitä ei ole program files kansiossa enään(etsin sitä myös haulla,eikä sitä löydy enään koko koneelta)

 

kato laitoin tonne ylös vielä avastin poisto ohjetta

aja sitten tuo escan mikä on tuolla ylempänä

 

File C:\WINDOWS\system32\closeapp.exe tagged as not-a-virus:RiskTool.Win32.CloseApp.a. No Action Taken.
File C:\WINDOWS\system32\vimc.exe tagged as not-a-virus:RiskTool.Win32.CloseApp.a. No Action Taken.
File C:\Documents and Settings\Marko\Omat tiedostot\SmitfraudFix\Reboot.exe tagged as not-a-virus:RiskTool.Win32.Reboot.f. No Action Taken.
File C:\WINDOWS\system32\closeapp.exe tagged as not-a-virus:RiskTool.Win32.CloseApp.a. No Action Taken.
File C:\WINDOWS\system32\vimc.exe tagged as not-a-virus:RiskTool.Win32.CloseApp.a. No Action Taken.

tommoset toi eScan löysi.

 

ja tossa uusi tämä.niin ja viellä tosta haitasta se saattaa tulla jos vaikka rullaa tätä sivua tolla hiiren rullalla alas päin niin se alkaa yhtääkkiä avaamaan tuota kyseistä sivua toisessa linkissä.
Logfile of HijackThis v1.99.1
Scan saved at 20:16:58, on 31.3.2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16414)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\NVIDIA Corporation\NvMixer\NVMixerTray.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\Program Files\Sonera Tietoturva\Common\FSM32.EXE
C:\Program Files\LClock\LClock.exe
C:\Program Files\VisualTooltip\VisualToolTip.exe
C:\Program Files\Styler\Styler.exe
C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe
C:\WINDOWS\system32\ctfmon.exe
C:\PROGRA~1\SONERA~1\backweb\4436233\Program\SERVIC~1.EXE
C:\Program Files\Diskeeper Corporation\Diskeeper\DkService.exe
C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe
C:\Program Files\Thoosje Vista Sidebar v1.7.8\thoosje's sidebar.exe
C:\Program Files\Sonera Tietoturva\Anti-Virus\fsgk32st.exe
C:\Program Files\Sonera Tietoturva\Anti-Virus\FSGK32.EXE
C:\Program Files\Sonera Tietoturva\backweb\4436233\program\fsbwsys.exe
C:\Program Files\Sonera Tietoturva\Anti-Virus\fssm32.exe
C:\Program Files\Sonera Tietoturva\Common\FSMA32.EXE
C:\Program Files\Siber Systems\AI RoboForm\RoboTaskBarIcon.exe
C:\Program Files\Sonera Tietoturva\Common\FSMB32.EXE
C:\WINDOWS\system32\nvsvc32.exe
C:\Program Files\Sonera Tietoturva\Common\FCH32.EXE
C:\Program Files\Sonera Tietoturva\Common\FAMEH32.EXE
C:\Program Files\Sonera Tietoturva\Anti-Virus\fsrw.exe
C:\PROGRA~1\INCRED~1\bin\IMApp.exe
C:\Program Files\Sonera Tietoturva\Anti-Virus\fsav32.exe
C:\DOCUME~1\Marko\LOCALS~1\Temp\{0B43BD9F-3A9B-43F7-9F14-1CDC885C36DE}\Blaero Start Orb.exe
C:\Program Files\Sonera Tietoturva\FWES\Program\fsdfwd.exe
C:\PROGRA~1\SONERA~1\ANTI-S~1\fsaw.exe
C:\Program Files\Sonera Tietoturva\FSGUI\fsguidll.exe
C:\Program Files\Sonera Tietoturva\backweb\4436233\Program\fspex.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Kaspersky\mwavscan.com
C:\Kaspersky\kavss.exe
C:\HJT\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.fi/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.windowsxlive.net
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Linkit
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: (no name) - {724d43a9-0d85-11d4-9908-00400523e39a} - C:\Program Files\Siber Systems\AI RoboForm\roboform.dll
O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\PROGRA~1\MICROS~2\Office12\GRA8E1~1.DLL
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: AcroIEToolbarHelper Class - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll
O3 - Toolbar: &RoboForm - {724d43a0-0d85-11d4-9908-00400523e39a} - C:\Program Files\Siber Systems\AI RoboForm\roboform.dll
O3 - Toolbar: StylerToolBar - {D2F8F919-690B-4EA2-9FA7-A203D1E04F75} - C:\Program Files\Styler\TB\StylerTB.dll
O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll
O3 - Toolbar: Easy-WebPrint - {327C2873-E90D-4c37-AA9D-10AC9BABA46C} - C:\Program Files\Canon\Easy-WebPrint\Toolband.dll
O4 - HKLM\..\Run: [NVMixerTray] "C:\Program Files\NVIDIA Corporation\NvMixer\NVMixerTray.exe"
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [F-Secure Manager] "C:\Program Files\Sonera Tietoturva\Common\FSM32.EXE" /splash
O4 - HKLM\..\Run: [F-Secure TNB] "C:\Program Files\Sonera Tietoturva\TNB\TNBUtil.exe" /CHECKALL /WAITFORSW
O4 - HKLM\..\Run: [F-Secure Startup Wizard] "C:\Program Files\Sonera Tietoturva\FSGUI\FSSW.EXE" /reboot
O4 - HKLM\..\Run: [News Service] "C:\Program Files\Sonera Tietoturva\FSGUI\ispnews.exe"
O4 - HKLM\..\Run: [LClock] C:\Program Files\LClock\LClock.exe
O4 - HKLM\..\Run: [VisualTooltip] C:\Program Files\VisualTooltip\VisualToolTip.exe
O4 - HKLM\..\Run: [Blaero Start Orb] C:\Program Files\Blaero Start Orb\Blaero Start Orb.exe
O4 - HKLM\..\Run: [Styler] C:\Program Files\Styler\Styler.exe
O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe
O4 - HKLM\..\Run: [GrooveMonitor] "C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe"
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [IncrediMail] C:\Program Files\IncrediMail\bin\IncMail.exe /c
O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe"
O4 - HKCU\..\Run: [thoosje's sidebar] C:\Program Files\Thoosje Vista Sidebar v1.7.8\thoosje's sidebar.exe
O4 - HKCU\..\Run: [RoboForm] "C:\Program Files\Siber Systems\AI RoboForm\RoboTaskBarIcon.exe"
O4 - Global Startup: Adobe Acrobat Speed Launcher.lnk = ?
O4 - Global Startup: Sonera Tietoturva.lnk = C:\Program Files\Sonera Tietoturva\backweb\4436233\Program\fspex.exe
O8 - Extra context menu item: &Estä tämä kohoikkuna - C:\Program Files\Sonera Tietoturva\Anti-Spyware\blockpopups.htm
O8 - Extra context menu item: Convert link target to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convert link target to existing PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Convert selected links to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
O8 - Extra context menu item: Convert selected links to existing PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
O8 - Extra context menu item: Convert selection to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convert selection to existing PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Convert to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convert to existing PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Easy-WebPrint Add To Print List - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_AddToList.html
O8 - Extra context menu item: Easy-WebPrint High Speed Print - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_HSPrint.html
O8 - Extra context menu item: Easy-WebPrint Preview - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_Preview.html
O8 - Extra context menu item: Easy-WebPrint Print - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_Print.html
O8 - Extra context menu item: Muutavalikkoa - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComCustomizeIEMenu.html
O8 - Extra context menu item: RF Työkalupalkki - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComShowToolbar.html
O8 - Extra context menu item: Tallenna lomakkeet - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComSavePass.html
O8 - Extra context menu item: Täytä lomakkeet - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComFillForms.html
O8 - Extra context menu item: V&ie Microsoft Exceliin - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O8 - Extra context menu item: Vie Microsoft E&xceliin - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: Lähetä OneNoteen - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: Läh&etä OneNoteen - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra button: IE-suojaus - {300DB664-75B5-47c0-8B45-A44ACCF73C00} - C:\Program Files\Sonera Tietoturva\Anti-Spyware\ieshield.dll
O9 - Extra 'Tools' menuitem: IE-suojaus... - {300DB664-75B5-47c0-8B45-A44ACCF73C00} - C:\Program Files\Sonera Tietoturva\Anti-Spyware\ieshield.dll
O9 - Extra button: Täytä lomakkeet - {320AF880-6646-11D3-ABEE-C5DBF3571F46} - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComFillForms.html
O9 - Extra 'Tools' menuitem: Täytä lomakkeet - {320AF880-6646-11D3-ABEE-C5DBF3571F46} - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComFillForms.html
O9 - Extra button: Tallenna - {320AF880-6646-11D3-ABEE-C5DBF3571F49} - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComSavePass.html
O9 - Extra 'Tools' menuitem: Tallenna lomakkeet - {320AF880-6646-11D3-ABEE-C5DBF3571F49} - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComSavePass.html
O9 - Extra button: RoboForm - {724d43aa-0d85-11d4-9908-00400523e39a} - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComShowToolbar.html
O9 - Extra 'Tools' menuitem: RF Työkalupalkki - {724d43aa-0d85-11d4-9908-00400523e39a} - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComShowToolbar.html
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O9 - Extra button: Lukutulkki - {B66541E2-E167-4084-8E77-68CA13C4B3B8} - C:\Program Files\NetClickup\Lukutulkki\Lutu.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O11 - Options group: [INTERNATIONAL] International*
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\PROGRA~1\MICROS~2\Office12\GR99D3~1.DLL
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Protocol: ms-help - {314111C7-A502-11D2-BBCA-00C04F8EC294} - C:\Program Files\Common Files\Microsoft Shared\Help\hxds.dll
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Filter hijack: text/xml - {807563E5-5146-11D5-A672-00B0D022E945} - C:\PROGRA~1\COMMON~1\MICROS~1\OFFICE12\MSOXMLMF.DLL
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Sonera Tietoturva (BackWeb Plug-in - 4436233) - Sonera Tietoturva - C:\PROGRA~1\SONERA~1\backweb\4436233\Program\SERVIC~1.EXE
O23 - Service: Diskeeper - Diskeeper Corporation - C:\Program Files\Diskeeper Corporation\Diskeeper\DkService.exe
O23 - Service: FSGKHS (F-Secure Gatekeeper Handler Starter) - F-Secure Corp. - C:\Program Files\Sonera Tietoturva\Anti-Virus\fsgk32st.exe
O23 - Service: fsbwsys - F-Secure Corp. - C:\Program Files\Sonera Tietoturva\backweb\4436233\program\fsbwsys.exe
O23 - Service: F-Secure Anti-Virus Firewall Daemon (FSDFWD) - F-Secure Corporation - C:\Program Files\Sonera Tietoturva\FWES\Program\fsdfwd.exe
O23 - Service: F-Secure Management Agent (FSMA) - F-Secure Corporation - C:\Program Files\Sonera Tietoturva\Common\FSMA32.EXE
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe

 

1. Lataa combofix.exe työpöydällesi jommastakummasta linkistä:
http://www.techsupportforum.com/sectools/sUBs/ComboFix.exe
http://download.bleepingcomputer.com/sUBs/ComboFix.exe

2. Tuplaklikkaa combofix.exe tiedostoa ja seuraa ohjeistuksia.
3. Kun työkalu on valmis, se tuottaa lokin. (C:\ComboFix.txt) Lähetä tämä loki viesti ketjuusi.
Huom! Älä klikkaile combofixin ikkunaa käytön aikana. Tämä saattaa aiheuttaa ohjelman jumiutumisen.

 

"Marko" - 07-03-31 21:04:21 Service Pack 2
ComboFix 07-03-27.4.2 - Running from: "C:\Documents and Settings\Marko\Ty”p”yt„"


((((((((((((((((((((((((((((((( Files Created from 2007-02-28 to 2007-03-31 ))))))))))))))))))))))))))))))))))


2007-03-31 18:18 <KANSIO> d-------- C:\Kaspersky
2007-03-31 18:18 <KANSIO> d-------- C:\Downloads
2007-03-31 18:18 <KANSIO> d-------- C:\Bases
2007-03-31 17:42 <KANSIO> d-------- C:\HJT
2007-03-31 16:30 <KANSIO> d-------- C:\Program Files\Lavasoft
2007-03-31 16:30 <KANSIO> d-------- C:\DOCUME~1\Marko\APPLIC~1\Lavasoft
2007-03-31 09:16 94,424 --a------ C:\WINDOWS\system32\drivers\aswmon2.sys
2007-03-31 09:16 85,952 --a------ C:\WINDOWS\system32\drivers\aswmon.sys
2007-03-31 09:16 689,280 --a------ C:\WINDOWS\system32\aswBoot.exe
2007-03-31 09:16 43,176 --a------ C:\WINDOWS\system32\drivers\aswTdi.sys
2007-03-31 09:16 31,560 --a------ C:\WINDOWS\system32\drivers\aavmker4.sys
2007-03-31 09:16 23,352 --a------ C:\WINDOWS\system32\drivers\aswRdr.sys
2007-03-31 08:10 3,294 --a------ C:\WINDOWS\system32\tmp.reg
2007-03-30 21:36 <KANSIO> d-------- C:\DOCUME~1\ALLUSE~1\APPLIC~1\Spybot - Search & Destroy
2007-03-30 19:31 72,064 --a------ C:\WINDOWS\system32\drivers\core.sys
2007-03-30 19:31 1 --a------ C:\WINDOWS\system32\sav85014.sys
2007-03-30 10:02 233,472 --a------ C:\WINDOWS\system32\wrap_oal.dll
2007-03-30 09:53 <KANSIO> d-------- C:\Program Files\Prolific Publishing, Inc
2007-03-30 09:44 <KANSIO> d-------- C:\Program Files\SereneScreen
2007-03-30 07:17 <KANSIO> d-------- C:\DOCUME~1\Marko\APPLIC~1\CD-LabelPrint
2007-03-30 07:09 <KANSIO> d-------- C:\Program Files\MSBuild
2007-03-30 07:07 1,168 --a------ C:\WINDOWS\mozver.dat
2007-03-29 20:49 0 --a------ C:\WINDOWS\nsreg.dat
2007-03-29 09:44 1,206,968 ---h----- C:\WINDOWS\system32\cflmon.exe
2007-03-28 12:49 163,840 --a------ C:\WINDOWS\BJPSUNST.EXE
2007-03-28 12:48 306,688 --a------ C:\WINDOWS\IsUninst.exe
2007-03-28 12:45 86,016 -ra------ C:\WINDOWS\system32\CNMCP64.exe
2007-03-28 12:45 7,680 --a------ C:\WINDOWS\system32\CNMVS64.DLL
2007-03-28 12:45 116,736 --a------ C:\WINDOWS\system32\CNMLM64.DLL
2007-03-28 12:45 <KANSIO> d--h----- C:\BJPrinter
2007-03-28 12:44 <KANSIO> d-------- C:\Program Files\Canon
2007-03-27 14:14 <KANSIO> d-------- C:\Program Files\MSXML 4.0
2007-03-27 11:59 180,224 --a------ C:\WINDOWS\system32\xwsindex.exe
2007-03-27 11:58 876,544 --a------ C:\WINDOWS\system32\XaraDocG.dll
2007-03-27 11:58 86,016 --a------ C:\WINDOWS\system32\BinCoder.dll
2007-03-27 11:58 253,952 --a------ C:\WINDOWS\system32\TemplOp.dll
2007-03-27 11:58 23,552 --a------ C:\WINDOWS\system32\XFontMan.dll
2007-03-27 11:58 131,072 --a------ C:\WINDOWS\system32\BmpImporter.dll
2007-03-27 11:58 126,976 --a------ C:\WINDOWS\system32\TemplMan.dll
2007-03-27 11:58 118,784 --a------ C:\WINDOWS\system32\XMUpload.dll
2007-03-27 11:58 110,592 --a------ C:\WINDOWS\system32\tsccvid.dll
2007-03-27 11:58 <KANSIO> d-------- C:\WSTemplates
2007-03-27 11:58 <KANSIO> d-------- C:\WINDOWS\system32\Xara
2007-03-27 11:58 <KANSIO> d-------- C:\Program Files\Xara
2007-03-27 11:58 <KANSIO> d-------- C:\DOCUME~1\Marko\APPLIC~1\Xara
2007-03-26 21:15 <KANSIO> d-------- C:\DOCUME~1\Marko\APPLIC~1\iolo
2007-03-26 21:15 <KANSIO> d-------- C:\DOCUME~1\ALLUSE~1\APPLIC~1\iolo
2007-03-26 21:10 <KANSIO> d-------- C:\Uusi kansio (2)
2007-03-26 19:02 <KANSIO> d-------- C:\Program Files\Notepad++
2007-03-26 15:28 <KANSIO> d-------- C:\ProgramData
2007-03-26 15:27 <KANSIO> d-------- C:\WINDOWS\Downloaded Installations
2007-03-26 15:27 <KANSIO> d-------- C:\Program Files\Electronic Arts
2007-03-26 15:26 438,272 --a------ C:\WINDOWS\system32\vp6vfw.dll
2007-03-26 15:26 118,832 --a------ C:\WINDOWS\system32\SHW32.DLL
2007-03-26 15:22 2,297,552 --a------ C:\WINDOWS\system32\d3dx9_26.dll
2007-03-25 20:21 <KANSIO> d-------- C:\Program Files\Crimson Editor
2007-03-25 10:36 <KANSIO> d-------- C:\Program Files\Diskeeper Corporation
2007-03-25 09:03 <KANSIO> d-------- C:\WSOY
2007-03-25 09:02 <KANSIO> d-------- C:\Program Files\WSOY Elektroninen sanakirja 5.0
2007-03-25 09:02 <KANSIO> d-------- C:\Program Files\WSOY
2007-03-24 23:01 <KANSIO> d-------- C:\Program Files\CrystalButton2
2007-03-24 12:29 <KANSIO> d-------- C:\MyWebSite
2007-03-23 20:33 <KANSIO> d-------- C:\DOCUME~1\Marko\APPLIC~1\Notepad++
2007-03-23 08:41 178,408 --a------ C:\WINDOWS\system32\muweb.dll
2007-03-23 08:41 127,208 --a------ C:\WINDOWS\system32\mucltui.dll
2007-03-23 08:31 32,592 --a------ C:\WINDOWS\system32\msonpmon.dll
2007-03-23 08:30 <KANSIO> d-------- C:\Program Files\Microsoft Works
2007-03-23 08:26 <KANSIO> dr-h----- C:\MSOCache
2007-03-23 08:26 <KANSIO> d-------- C:\DOCUME~1\ALLUSE~1\APPLIC~1\Microsoft Help
2007-03-22 13:20 <KANSIO> d-------- C:\Uusi kansio
2007-03-22 13:14 <KANSIO> d-------- C:\Program Files\kotisiv.tekoon
2007-03-22 11:50 <KANSIO> d-------- C:\DOCUME~1\ALLUSE~1\APPLIC~1\NVIDIA
2007-03-22 04:45 <KANSIO> d-------- C:\DOCUME~1\ALLUSE~1\APPLIC~1\Adobe
2007-03-21 23:49 <KANSIO> d-------- C:\Program Files\GRekPK
2007-03-21 21:58 <KANSIO> d-------- C:\WINDOWS\Noslip
2007-03-21 21:58 <KANSIO> d-------- C:\DOCUME~1\ALLUSE~1\APPLIC~1\Ulead Systems
2007-03-21 20:47 545 --a------ C:\WINDOWS\UC.PIF
2007-03-21 20:47 545 --a------ C:\WINDOWS\RAR.PIF
2007-03-21 20:47 545 --a------ C:\WINDOWS\PKZIP.PIF
2007-03-21 20:47 545 --a------ C:\WINDOWS\PKUNZIP.PIF
2007-03-21 20:47 545 --a------ C:\WINDOWS\NOCLOSE.PIF
2007-03-21 20:47 545 --a------ C:\WINDOWS\LHA.PIF
2007-03-21 20:47 545 --a------ C:\WINDOWS\ARJ.PIF
2007-03-21 20:47 <KANSIO> d-------- C:\totalcmd
2007-03-21 19:17 <KANSIO> d-------- C:\Program Files\DC++
2007-03-21 19:14 <KANSIO> d-------- C:\DOCUME~1\Marko\APPLIC~1\uTorrent
2007-03-21 19:10 <KANSIO> d-------- C:\Program Files\uTorrent
2007-03-21 19:03 5 --ahs---- C:\WINDOWS\system32\bbcac0_s.dll
2007-03-21 19:03 <KANSIO> d-------- C:\Program Files\jv16 PowerTools 2006
2007-03-21 18:59 <KANSIO> d-------- C:\Program Files\Namo
2007-03-21 18:56 <KANSIO> d-------- C:\DOCUME~1\Marko\Contacts
2007-03-21 18:55 <KANSIO> d----c--- C:\WINDOWS\system32\DRVSTORE
2007-03-21 18:55 <KANSIO> d-------- C:\Program Files\MSN Messenger
2007-03-21 18:54 <KANSIO> d-------- C:\Program Files\CCleaner
2007-03-21 18:44 <KANSIO> d-------- C:\Program Files\PowerISO
2007-03-21 18:38 <KANSIO> d-------- C:\Program Files\Common Files\Jasc Software Inc
2007-03-21 18:38 <KANSIO> d-------- C:\DOCUME~1\Marko\APPLIC~1\Jasc Software Inc
2007-03-21 18:38 <KANSIO> d-------- C:\DOCUME~1\ALLUSE~1\APPLIC~1\InstallShield
2007-03-21 18:37 <KANSIO> d-------- C:\Program Files\Jasc Software Inc
2007-03-21 18:36 <KANSIO> d-------- C:\DOCUME~1\Marko\APPLIC~1\AdobeUM
2007-03-21 18:28 <KANSIO> d-------- C:\Program Files\Common Files\Adobe Systems Shared
2007-03-21 18:28 <KANSIO> d-------- C:\DOCUME~1\Marko\APPLIC~1\Adobe
2007-03-21 18:28 <KANSIO> d-------- C:\DOCUME~1\ALLUSE~1\APPLIC~1\Adobe Systems
2007-03-21 18:27 <KANSIO> d-------- C:\Program Files\Common Files\Adobe
2007-03-21 18:22 <KANSIO> d-------- C:\sovellukset
2007-03-21 18:18 <KANSIO> d-------- C:\Program Files\Your Uninstaller 2006
2007-03-21 18:18 <KANSIO> d-------- C:\DOCUME~1\Marko\APPLIC~1\URSoft
2007-03-21 18:12 78,336 --a------ C:\WINDOWS\system32\ATX32PIC.DLL
2007-03-21 18:12 346,112 --a------ C:\WINDOWS\system32\PPRO100.DLL
2007-03-21 18:12 28,160 --a------ C:\WINDOWS\system32\ATX32OLE.DLL
2007-03-21 18:12 <KANSIO> d-------- C:\WebSite X5
2007-03-21 18:11 29,696 --a------ C:\WINDOWS\system32\VB5STKIT.DLL
2007-03-21 18:11 237,568 --a------ C:\WINDOWS\system32\CompPl32.dll
2007-03-21 18:11 142,336 --a------ C:\WINDOWS\system32\iwpsetup.exe
2007-03-21 18:06 <KANSIO> d-------- C:\Program Files\Thoosje Vista Sidebar v1.7.8
2007-03-21 18:04 <KANSIO> d-------- C:\Program Files\Webteh
2007-03-21 18:04 <KANSIO> d-------- C:\DOCUME~1\Marko\APPLIC~1\BSplayer Pro
2007-03-21 18:03 765,952 --a------ C:\WINDOWS\system32\xvidcore.dll
2007-03-21 18:03 73,728 --a------ C:\WINDOWS\system32\dpl100.dll
2007-03-21 18:03 635,486 --a------ C:\WINDOWS\system32\divx.dll
2007-03-21 18:03 499,712 --a------ C:\WINDOWS\system32\msvcp71.dll
2007-03-21 18:03 348,160 --a------ C:\WINDOWS\system32\msvcr71.dll
2007-03-21 18:03 3,596,288 --a------ C:\WINDOWS\system32\qt-dx331.dll
2007-03-21 18:03 200,704 --a------ C:\WINDOWS\system32\ssldivx.dll
2007-03-21 18:03 196,608 --a------ C:\WINDOWS\system32\dtu100.dll
2007-03-21 18:03 180,224 --a------ C:\WINDOWS\system32\xvidvfw.dll
2007-03-21 18:03 10,752 --a------ C:\WINDOWS\system32\ff_vfw.dll
2007-03-21 18:03 1,565,480 --a------ C:\WINDOWS\system32\wmv9vcm.dll
2007-03-21 18:03 1,044,480 --a------ C:\WINDOWS\system32\libdivx.dll
2007-03-21 18:03 <KANSIO> d-------- C:\Program Files\K-Lite Codec Pack
2007-03-21 17:59 24,072 --a------ C:\WINDOWS\system32\uxtuneup.dll
2007-03-21 17:59 <KANSIO> d-------- C:\Program Files\TuneUp Utilities 2007
2007-03-21 17:59 <KANSIO> d-------- C:\Program Files\Common Files\Wise Installation Wizard
2007-03-21 17:59 <KANSIO> d-------- C:\DOCUME~1\Marko\APPLIC~1\TuneUp Software
2007-03-21 17:59 <KANSIO> d-------- C:\DOCUME~1\ALLUSE~1\APPLIC~1\TuneUp Software
2007-03-21 17:42 17,920 --a------ C:\WINDOWS\system32\mdimon.dll
2007-03-21 17:41 <KANSIO> d-------- C:\WINDOWS\SHELLNEW
2007-03-21 17:41 <KANSIO> d-------- C:\Program Files\Microsoft.NET
2007-03-21 17:38 <KANSIO> d--hs---- C:\RECYCLER
2007-03-21 17:37 <KANSIO> d-------- C:\DOCUME~1\Marko\APPLIC~1\Ahead
2007-03-21 17:36 <KANSIO> d-------- C:\Program Files\Nero
2007-03-21 17:36 <KANSIO> d-------- C:\Program Files\Common Files\Ahead
2007-03-21 16:56 5,248 --a------ C:\WINDOWS\system32\drivers\a347scsi.sys
2007-03-21 16:56 160,640 --a------ C:\WINDOWS\system32\drivers\a347bus.sys
2007-03-21 16:56 <KANSIO> d-------- C:\Program Files\Alcohol Soft
2007-03-21 15:43 57,216 --a------ C:\WINDOWS\system32\drivers\redbook.sys
2007-03-21 15:43 3,072 --a------ C:\WINDOWS\system32\drivers\audstub.sys
2007-03-21 15:42 74,240 --a------ C:\WINDOWS\system32\usbui.dll
2007-03-21 15:42 20,992 --a------ C:\WINDOWS\system32\drivers\RTL8139.sys
2007-03-21 15:41 9,936 --a------ C:\WINDOWS\system\LZEXPAND.DLL
2007-03-21 15:41 9,008 --a------ C:\WINDOWS\system\VER.DLL
2007-03-21 15:41 85,020 --a------ C:\WINDOWS\system32\dgsetup.dll
2007-03-21 15:41 82,944 --a------ C:\WINDOWS\system\OLECLI.DLL
2007-03-21 15:41 8,704 --a------ C:\WINDOWS\system32\batt.dll
2007-03-21 15:41 8,192 -ra------ C:\WINDOWS\system32\kbdhept.dll
2007-03-21 15:41 74,240 --a------ C:\WINDOWS\system32\storprop.dll
2007-03-21 15:41 7,168 -ra------ C:\WINDOWS\system32\kbdcz.dll
2007-03-21 15:41 69,856 --a------ C:\WINDOWS\system\AVICAP.DLL
2007-03-21 15:41 69,632 --a------ C:\WINDOWS\NOTEPAD.EXE
2007-03-21 15:41 68,768 --a------ C:\WINDOWS\system\MMSYSTEM.DLL
2007-03-21 15:41 6,656 -ra------ C:\WINDOWS\system32\kbdycl.dll
2007-03-21 15:41 6,656 -ra------ C:\WINDOWS\system32\kbdsl1.dll
2007-03-21 15:41 6,656 -ra------ C:\WINDOWS\system32\kbdsl.dll
2007-03-21 15:41 6,656 -ra------ C:\WINDOWS\system32\kbdpl.dll
2007-03-21 15:41 6,656 -ra------ C:\WINDOWS\system32\kbdhu.dll
2007-03-21 15:41 6,656 -ra------ C:\WINDOWS\system32\kbdhela3.dll
2007-03-21 15:41 6,656 -ra------ C:\WINDOWS\system32\kbdcz2.dll
2007-03-21 15:41 6,656 -ra------ C:\WINDOWS\system32\kbdcz1.dll
2007-03-21 15:41 6,656 -ra------ C:\WINDOWS\system32\kbdcr.dll
2007-03-21 15:41 6,656 -ra------ C:\WINDOWS\system32\KBDAL.DLL
2007-03-21 15:41 6,144 -ra------ C:\WINDOWS\system32\kbdtuq.dll
2007-03-21 15:41 6,144 -ra------ C:\WINDOWS\system32\kbdtuf.dll
2007-03-21 15:41 6,144 -ra------ C:\WINDOWS\system32\kbdlv1.dll
2007-03-21 15:41 6,144 -ra------ C:\WINDOWS\system32\kbdlv.dll
2007-03-21 15:41 6,144 -ra------ C:\WINDOWS\system32\kbdhela2.dll
2007-03-21 15:41 6,144 -ra------ C:\WINDOWS\system32\kbdgkl.dll
2007-03-21 15:41 6,144 -ra------ C:\WINDOWS\system32\kbdest.dll
2007-03-21 15:41 5,632 -ra------ C:\WINDOWS\system32\kbdro.dll
2007-03-21 15:41 5,632 -ra------ C:\WINDOWS\system32\kbdpl1.dll
2007-03-21 15:41 5,632 -ra------ C:\WINDOWS\system32\kbdmon.dll
2007-03-21 15:41 5,632 -ra------ C:\WINDOWS\system32\kbdlt1.dll
2007-03-21 15:41 5,632 -ra------ C:\WINDOWS\system32\kbdlt.dll
2007-03-21 15:41 5,632 -ra------ C:\WINDOWS\system32\kbdkyr.dll
2007-03-21 15:41 5,632 -ra------ C:\WINDOWS\system32\kbdhu1.dll
2007-03-21 15:41 5,632 -ra------ C:\WINDOWS\system32\kbdhe319.dll
2007-03-21 15:41 5,632 -ra------ C:\WINDOWS\system32\kbdhe220.dll
2007-03-21 15:41 5,632 -ra------ C:\WINDOWS\system32\kbdhe.dll
2007-03-21 15:41 5,632 -ra------ C:\WINDOWS\system32\kbdazel.dll
2007-03-21 15:41 5,120 --a------ C:\WINDOWS\system\SHELL.DLL
2007-03-21 15:41 33,120 --a------ C:\WINDOWS\system\COMMDLG.DLL
2007-03-21 15:41 24,661 --a------ C:\WINDOWS\system32\spxcoins.dll
2007-03-21 15:41 24,064 --a------ C:\WINDOWS\system\OLESVR.DLL
2007-03-21 15:41 19,200 --a------ C:\WINDOWS\system\TAPI.DLL
2007-03-21 15:41 176,157 --a------ C:\WINDOWS\system32\dgrpsetu.dll
2007-03-21 15:41 15,360 --a------ C:\WINDOWS\TASKMAN.EXE
2007-03-21 15:41 13,312 --a------ C:\WINDOWS\system32\irclass.dll
2007-03-21 15:41 126,912 --a------ C:\WINDOWS\system\MSVIDEO.DLL
2007-03-21 15:41 11,264 --a------ C:\WINDOWS\system32\drivers\irenum.sys
2007-03-21 15:41 109,504 --a------ C:\WINDOWS\system\AVIFILE.DLL
2007-03-21 15:41 103,424 --a------ C:\WINDOWS\system32\EqnClass.Dll
2007-03-21 15:41 <KANSIO> dr------- C:\Program Files
2007-03-21 15:41 <KANSIO> d--hs---- C:\WINDOWS\Installer
2007-03-21 15:41 <KANSIO> d-------- C:\Program Files\Common Files\SpeechEngines
2007-03-21 15:41 <KANSIO> d-------- C:\Program Files\Common Files\ODBC
2007-03-21 15:40 <KANSIO> dr------- C:\DOCUME~1\DEFAUL~1\K„ynnist„-valikko
2007-03-21 15:40 <KANSIO> dr------- C:\DOCUME~1\ALLUSE~1\Tiedostot
2007-03-21 15:40 <KANSIO> dr------- C:\DOCUME~1\ALLUSE~1\K„ynnist„-valikko
2007-03-21 15:40 <KANSIO> d--h----- C:\DOCUME~1\DEFAUL~1\Verkkoymp„rist”
2007-03-21 15:40 <KANSIO> d--h----- C:\DOCUME~1\DEFAUL~1\Tulostinymp„rist”
2007-03-21 15:40 <KANSIO> d--h----- C:\DOCUME~1\DEFAUL~1\Mallit
2007-03-21 15:40 <KANSIO> d--h----- C:\DOCUME~1\ALLUSE~1\Mallit
2007-03-21 15:40 <KANSIO> d-------- C:\DOCUME~1\DEFAUL~1\Ty”p”yt„
2007-03-21 15:40 <KANSIO> d-------- C:\DOCUME~1\DEFAUL~1\Suosikit
2007-03-21 15:40 <KANSIO> d-------- C:\DOCUME~1\ALLUSE~1\Ty”p”yt„
2007-03-21 15:40 <KANSIO> d-------- C:\DOCUME~1\ALLUSE~1\Suosikit
2007-03-21 15:39 <KANSIO> d-------- C:\WINDOWS\system32\CatRoot2
2007-03-21 15:39 <KANSIO> d-------- C:\WINDOWS\system32\CatRoot
2007-03-21 15:38 <KANSIO> d--hs---- C:\System Volume Information
2007-03-21 15:38 <KANSIO> d-------- C:\Documents and Settings
2007-03-21 15:32 <KANSIO> dr-hsc--- C:\WINDOWS\system32\dllcache
2007-03-21 15:32 <KANSIO> dr--s---- C:\WINDOWS\Fonts
2007-03-21 15:32 <KANSIO> dr------- C:\WINDOWS\Web
2007-03-21 15:32 <KANSIO> d--h----- C:\WINDOWS\inf
2007-03-21 15:32 <KANSIO> d-------- C:\WINDOWS\WinSxS
2007-03-21 15:32 <KANSIO> d-------- C:\WINDOWS\twain_32
2007-03-21 15:32 <KANSIO> d-------- C:\WINDOWS\system32\wins
2007-03-21 15:32 <KANSIO> d-------- C:\WINDOWS\system32\wbem
2007-03-21 15:32 <KANSIO> d-------- C:\WINDOWS\system32\usmt
2007-03-21 15:32 <KANSIO> d-------- C:\WINDOWS\system32\spool
2007-03-21 15:32 <KANSIO> d-------- C:\WINDOWS\system32\ShellExt
2007-03-21 15:32 <KANSIO> d-------- C:\WINDOWS\system32\Setup
2007-03-21 15:32 <KANSIO> d-------- C:\WINDOWS\system32\ras
2007-03-21 15:32 <KANSIO> d-------- C:\WINDOWS\system32\oobe
2007-03-21 15:32 <KANSIO> d-------- C:\WINDOWS\system32\npp
2007-03-21 15:32 <KANSIO> d-------- C:\WINDOWS\system32\mui
2007-03-21 15:32 <KANSIO> d-------- C:\WINDOWS\system32\inetsrv
2007-03-21 15:32 <KANSIO> d-------- C:\WINDOWS\system32\IME
2007-03-21 15:32 <KANSIO> d-------- C:\WINDOWS\system32\icsxml
2007-03-21 15:32 <KANSIO> d-------- C:\WINDOWS\system32\ias
2007-03-21 15:32 <KANSIO> d-------- C:\WINDOWS\system32\export
2007-03-21 15:32 <KANSIO> d-------- C:\WINDOWS\system32\drivers\etc
2007-03-21 15:32 <KANSIO> d-------- C:\WINDOWS\system32\drivers\disdn
2007-03-21 15:32 <KANSIO> d-------- C:\WINDOWS\system32\drivers
2007-03-21 15:32 <KANSIO> d-------- C:\WINDOWS\system32\dhcp
2007-03-21 15:32 <KANSIO> d-------- C:\WINDOWS\system32\config
2007-03-21 15:32 <KANSIO> d-------- C:\WINDOWS\system32\3com_dmi
2007-03-21 15:32 <KANSIO> d-------- C:\WINDOWS\system32\3076
2007-03-21 15:32 <KANSIO> d-------- C:\WINDOWS\system32\2052
2007-03-21 15:32 <KANSIO> d-------- C:\WINDOWS\system32\1054
2007-03-21 15:32 <KANSIO> d-------- C:\WINDOWS\system32\1042
2007-03-21 15:32 <KANSIO> d-------- C:\WINDOWS\system32\1041
2007-03-21 15:32 <KANSIO> d-------- C:\WINDOWS\system32\1037
2007-03-21 15:32 <KANSIO> d-------- C:\WINDOWS\system32\1035
2007-03-21 15:32 <KANSIO> d-------- C:\WINDOWS\system32\1033
2007-03-21 15:32 <KANSIO> d-------- C:\WINDOWS\system32\1031
2007-03-21 15:32 <KANSIO> d-------- C:\WINDOWS\system32\1028
2007-03-21 15:32 <KANSIO> d-------- C:\WINDOWS\system32\1025
2007-03-21 15:32 <KANSIO> d-------- C:\WINDOWS\system32
2007-03-21 15:32 <KANSIO> d-------- C:\WINDOWS\system
2007-03-21 15:32 <KANSIO> d-------- C:\WINDOWS\security
2007-03-21 15:32 <KANSIO> d-------- C:\WINDOWS\Resources
2007-03-21 15:32 <KANSIO> d-------- C:\WINDOWS\repair
2007-03-21 15:32 <KANSIO> d-------- C:\WINDOWS\Provisioning
2007-03-21 15:32 <KANSIO> d-------- C:\WINDOWS\PeerNet
2007-03-21 15:32 <KANSIO> d-------- C:\WINDOWS\pchealth
2007-03-21 15:32 <KANSIO> d-------- C:\WINDOWS\mui
2007-03-21 15:32 <KANSIO> d-------- C:\WINDOWS\msapps
2007-03-21 15:32 <KANSIO> d-------- C:\WINDOWS\msagent
2007-03-21 15:32 <KANSIO> d-------- C:\WINDOWS\Media
2007-03-21 15:32 <KANSIO> d-------- C:\WINDOWS\java
2007-03-21 15:32 <KANSIO> d-------- C:\WINDOWS\ime
2007-03-21 15:32 <KANSIO> d-------- C:\WINDOWS\Help
2007-03-21 15:32 <KANSIO> d-------- C:\WINDOWS\ehome
2007-03-21 15:32 <KANSIO> d-------- C:\WINDOWS\Driver Cache
2007-03-21 15:32 <KANSIO> d-------- C:\WINDOWS\Debug
2007-03-21 15:32 <KANSIO> d-------- C:\WINDOWS\Cursors
2007-03-21 15:32 <KANSIO> d-------- C:\WINDOWS\Connection Wizard
2007-03-21 15:32 <KANSIO> d-------- C:\WINDOWS\Config
2007-03-21 15:32 <KANSIO> d-------- C:\WINDOWS\AppPatch
2007-03-21 15:32 <KANSIO> d-------- C:\WINDOWS\addins
2007-03-21 15:32 <KANSIO> d-------- C:\WINDOWS
2007-03-21 15:23 <KANSIO> d-------- C:\DOCUME~1\Marko\APPLIC~1\Styler
2007-03-21 15:19 7,287,808 --a------ C:\WINDOWS\system32\vistaui.exe
2007-03-21 15:19 <KANSIO> d-------- C:\Program Files\VisualTooltip
2007-03-21 15:19 <KANSIO> d-------- C:\Program Files\Styler
2007-03-21 15:19 <KANSIO> d-------- C:\Program Files\Blaero Start Orb
2007-03-21 15:19 <KANSIO> d-------- C:\DOCUME~1\Marko\APPLIC~1\Stardock
2007-03-21 15:18 414,223 --a------ C:\WINDOWS\system32\vimc.exe
2007-03-21 15:18 <KANSIO> d-------- C:\Program Files\LClock
2007-03-21 15:14 81,920 --a------ C:\WINDOWS\system32\closeapp.exe
2007-03-21 15:14 8,636 --a------ C:\WINDOWS\system32\modifype.exe
2007-03-21 15:14 69,632 --a------ C:\WINDOWS\system32\moveex.exe
2007-03-21 15:14 19,968 --a------ C:\WINDOWS\system32\reico.exe
2007-03-21 15:14 111,104 --a------ C:\WINDOWS\system32\Uharc.exe
2007-03-21 15:14 <KANSIO> d-------- C:\WINDOWS\system32\VITrans
2007-03-21 15:14 <KANSIO> d-------- C:\VTPFiles
2007-03-21 15:00 <KANSIO> d-------- C:\Program Files\Siber Systems
2007-03-21 15:00 <KANSIO> d-------- C:\DOCUME~1\ALLUSE~1\APPLIC~1\RoboForm
2007-03-21 14:57 <KANSIO> d-------- C:\Program Files\NetClickup
2007-03-21 14:43 <KANSIO> d-------- C:\Program Files\IncrediMail
2007-03-21 14:37 <KANSIO> d-------- C:\WINDOWS\system32\fi-fi
2007-03-21 14:34 262,144 --a------ C:\DOCUME~1\ALLUSE~1\ntuser.dat
2007-03-21 14:34 <KANSIO> d-------- C:\WINDOWS\network diagnostic
2007-03-21 14:25 <KANSIO> d-------- C:\DOCUME~1\ALLUSE~1\APPLIC~1\Windows Genuine Advantage
2007-03-21 14:23 <KANSIO> d--hs---- C:\DOCUME~1\Marko\UserData
2007-03-21 14:21 <KANSIO> d-------- C:\DOCUME~1\Marko\APPLIC~1\F-Secure
2007-03-21 14:19 22,752 --a------ C:\WINDOWS\system32\spupdsvc.exe
2007-03-21 14:19 <KANSIO> d--h----- C:\WINDOWS\$hf_mig$
2007-03-21 14:19 <KANSIO> d-------- C:\WINDOWS\system32\PreInstall
2007-03-21 14:17 <KANSIO> d-------- C:\DOCUME~1\Marko\APPLIC~1\ispnews
2007-03-21 14:15 70,224 --a------ C:\WINDOWS\system32\drivers\fsdfw.sys
2007-03-21 14:15 33,840 --a------ C:\WINDOWS\system32\drivers\fsndis5.sys
2007-03-21 14:15 <KANSIO> d-------- C:\DOCUME~1\ALLUSE~1\APPLIC~1\F-Secure
2007-03-21 14:09 118,842 -r------- C:\WINDOWS\bwUnin-6.3.2.116-4436233L.exe
2007-03-21 14:09 <KANSIO> d-------- C:\Program Files\Sonera Tietoturva
2007-03-21 14:07 <KANSIO> d-------- C:\DOCUME~1\ALLUSE~1\APPLIC~1\nView_Profiles
2007-03-21 14:05 208,896 --a------ C:\WINDOWS\system32\nvudisp.exe
2007-03-21 14:05 <KANSIO> d-------- C:\WINDOWS\nview
2007-03-21 14:03 82,944 --a------ C:\WINDOWS\system32\drivers\wdmaud.sys
2007-03-21 14:03 7,552 --a------ C:\WINDOWS\system32\drivers\MSKSSRV.sys
2007-03-21 14:03 60,800 --a------ C:\WINDOWS\system32\drivers\sysaudio.sys
2007-03-21 14:03 60,288 --a------ C:\WINDOWS\system32\drivers\drmk.sys
2007-03-21 14:03 6,400 --a------ C:\WINDOWS\system32\drivers\splitter.sys
2007-03-21 14:03 54,272 --a------ C:\WINDOWS\system32\drivers\swmidi.sys
2007-03-21 14:03 52,864 --a------ C:\WINDOWS\system32\drivers\DMusic.sys
2007-03-21 14:03 5,376 --a------ C:\WINDOWS\system32\drivers\MSPCLOCK.sys
2007-03-21 14:03 4,992 --a------ C:\WINDOWS\system32\drivers\MSPQM.sys
2007-03-21 14:03 4,096 --a------ C:\WINDOWS\system32\ksuser.dll
2007-03-21 14:03 208,896 --a------ C:\WINDOWS\system32\nvuide.exe
2007-03-21 14:03 208,896 --a------ C:\WINDOWS\system32\nvuaudio.exe
2007-03-21 14:03 2,944 --a------ C:\WINDOWS\system32\drivers\drmkaud.sys
2007-03-21 14:03 172,416 --a------ C:\WINDOWS\system32\drivers\kmixer.sys
2007-03-21 14:03 145,792 --a------ C:\WINDOWS\system32\drivers\portcls.sys
2007-03-21 14:03 142,464 --a------ C:\WINDOWS\system32\drivers\aec.sys
2007-03-21 14:03 <KANSIO> d--h----- C:\Program Files\InstallShield Installation Information
2007-03-21 14:03 <KANSIO> d-------- C:\Program Files\NVIDIA Corporation
2007-03-21 14:03 <KANSIO> d-------- C:\Program Files\Common Files\NVIDIA Shared
2007-03-21 14:02 208,896 --a------ C:\WINDOWS\system32\nvusmb.exe
2007-03-21 14:02 208,896 --a------ C:\WINDOWS\system32\NVUNINST.EXE
2007-03-21 14:02 208,896 --a------ C:\WINDOWS\system32\nvumctl.exe
2007-03-21 14:02 208,896 --a------ C:\WINDOWS\system32\nvugart.exe
2007-03-21 14:02 208,896 --a------ C:\WINDOWS\system32\nvuenet.exe
2007-03-21 14:02 <KANSIO> d-------- C:\WINDOWS\system32\ReinstallBackups
2007-03-21 14:02 <KANSIO> d-------- C:\Program Files\Common Files\InstallShield
2007-03-21 14:02 <KANSIO> d-------- C:\NVIDIA
2007-03-21 13:58 8,650,752 --ah----- C:\DOCUME~1\Marko\NTUSER.DAT
2007-03-21 13:58 <KANSIO> dr------- C:\DOCUME~1\Marko\Suosikit
2007-03-21 13:58 <KANSIO> dr------- C:\DOCUME~1\Marko\Omat tiedostot
2007-03-21 13:58 <KANSIO> dr------- C:\DOCUME~1\Marko\K„ynnist„-valikko
2007-03-21 13:58 <KANSIO> d--h----- C:\DOCUME~1\Marko\Verkkoymp„rist”
2007-03-21 13:58 <KANSIO> d--h----- C:\DOCUME~1\Marko\Tulostinymp„rist”
2007-03-21 13:58 <KANSIO> d--h----- C:\DOCUME~1\Marko\Mallit
2007-03-21 13:58 <KANSIO> d-------- C:\DOCUME~1\Marko\Ty”p”yt„
2007-03-21 13:57 <KANSIO> d-------- C:\WINDOWS\system32\SoftwareDistribution
2007-03-21 13:56 786,432 --ah----- C:\DOCUME~1\NETWOR~1\NTUSER.DAT
2007-03-21 13:56 786,432 --ah----- C:\DOCUME~1\LOCALS~1\NTUSER.DAT
2007-03-21 13:56 <KANSIO> d-------- C:\WINDOWS\SoftwareDistribution
2007-03-21 13:56 <KANSIO> d-------- C:\WINDOWS\Prefetch
2007-03-21 13:52 229,376 ---h----- C:\DOCUME~1\DEFAUL~1\NTUSER.DAT
2007-03-21 13:52 0 -rahs---- C:\MSDOS.SYS
2007-03-21 13:52 0 -rahs---- C:\IO.SYS
2007-03-21 13:52 0 --a------ C:\CONFIG.SYS
2007-03-21 13:52 0 --a------ C:\AUTOEXEC.BAT
2007-03-21 13:52 <KANSIO> d-------- C:\WINDOWS\system32\xircom
2007-03-21 13:52 <KANSIO> d-------- C:\Program Files\microsoft frontpage
2007-03-21 13:51 112,128 --a------ C:\WINDOWS\system32\mapi32.dll
2007-03-21 13:51 <KANSIO> d--hs---- C:\DOCUME~1\ALLUSE~1\DRM
2007-03-21 13:50 <KANSIO> dr------- C:\WINDOWS\Offline Web Pages
2007-03-21 13:50 <KANSIO> d--h----- C:\Program Files\WindowsUpdate
2007-03-21 13:50 <KANSIO> d---s---- C:\WINDOWS\Downloaded Program Files
2007-03-21 13:50 <KANSIO> d-------- C:\WINDOWS\system32\DirectX
2007-03-21 13:50 <KANSIO> d-------- C:\Program Files\Online Services
2007-03-21 13:49 86,016 --a------ C:\WINDOWS\system32\isign32.dll
2007-03-21 13:49 81,920 --a------ C:\WINDOWS\system32\ils.dll
2007-03-21 13:49 8,192 --a------ C:\WINDOWS\system32\bitsprx2.dll
2007-03-21 13:49 73,728 --a------ C:\WINDOWS\system32\icwdial.dll
2007-03-21 13:49 73,472 --a------ C:\WINDOWS\system32\drivers\sr.sys
2007-03-21 13:49 7,168 --a------ C:\WINDOWS\system32\bitsprx3.dll
2007-03-21 13:49 69,632 --a------ C:\WINDOWS\system32\msconf.dll
2007-03-21 13:49 679,424 --a------ C:\WINDOWS\system32\inetcomm.dll
2007-03-21 13:49 67,584 --a------ C:\WINDOWS\system32\srclient.dll
2007-03-21 13:49 65,536 --a------ C:\WINDOWS\system32\icwphbk.dll
2007-03-21 13:49 64,512 --a------ C:\WINDOWS\system32\acctres.dll
2007-03-21 13:49 6,656 --a------ C:\WINDOWS\system32\wuauserv.dll
2007-03-21 13:49 48,640 --a------ C:\WINDOWS\system32\inetres.dll
2007-03-21 13:49 45,568 --a------ C:\WINDOWS\system32\safrslv.dll
2007-03-21 13:49 43,520 --a------ C:\WINDOWS\system32\safrcdlg.dll
2007-03-21 13:49 43,520 --a------ C:\WINDOWS\system32\racpldlg.dll
2007-03-21 13:49 429,336 --a------ C:\WINDOWS\system32\wuapi.dll
2007-03-21 13:49 41,240 --a------ C:\WINDOWS\system32\wups.dll
2007-03-21 13:49 382,464 --a------ C:\WINDOWS\system32\qmgr.dll
2007-03-21 13:49 34,560 --a------ C:\WINDOWS\system32\mnmdd.dll
2007-03-21 13:49 333,312 --a------ C:\WINDOWS\system32\mstask.dll
2007-03-21 13:49 32,768 --a------ C:\WINDOWS\system32\mnmsrvc.exe
2007-03-21 13:49 32,768 --a------ C:\WINDOWS\system32\isrdbg32.dll
2007-03-21 13:49 29,696 --a------ C:\WINDOWS\system32\safrdm.dll
2007-03-21 13:49 28,672 --a------ C:\WINDOWS\system32\nmmkcert.dll
2007-03-21 13:49 278,528 --a------ C:\WINDOWS\system32\inetcfg.dll
2007-03-21 13:49 252,928 --a------ C:\WINDOWS\system32\msoeacct.dll
2007-03-21 13:49 240,640 --a------ C:\WINDOWS\system32\srrstr.dll
2007-03-21 13:49 23,040 --a------ C:\WINDOWS\system32\fltmc.exe
2007-03-21 13:49 194,840 --a------ C:\WINDOWS\system32\wuaueng1.dll
2007-03-21 13:49 190,976 --a------ C:\WINDOWS\system32\schedsvc.dll
2007-03-21 13:49 18,944 --a------ C:\WINDOWS\system32\qmgrprxy.dll
2007-03-21 13:49 173,848 --a------ C:\WINDOWS\system32\wuauclt1.exe
2007-03-21 13:49 173,536 --a------ C:\WINDOWS\system32\wuweb.dll
2007-03-21 13:49 170,496 --a------ C:\WINDOWS\system32\srsvc.dll
2007-03-21 13:49 16,896 --a------ C:\WINDOWS\system32\fltlib.dll
2007-03-21 13:49 16,384 --a------ C:\WINDOWS\system32\icfgnt5.dll
2007-03-21 13:49 128,896 --a------ C:\WINDOWS\system32\drivers\fltmgr.sys
2007-03-21 13:49 127,256 --a------ C:\WINDOWS\system32\wucltui.dll
2007-03-21 13:49 124,696 --a------ C:\WINDOWS\system32\wuauclt.exe
2007-03-21 13:49 12,288 --a------ C:\WINDOWS\system32\nmevtmsg.dll
2007-03-21 13:49 12,288 --a------ C:\WINDOWS\system32\mstinit.exe
2007-03-21 13:49 11,264 --a------ C:\WINDOWS\system32\atrace.dll
2007-03-21 13:49 105,984 --a------ C:\WINDOWS\system32\msoert2.dll
2007-03-21 13:49 1,343,768 --a------ C:\WINDOWS\system32\wuaueng.dll
2007-03-21 13:49 <KANSIO> d---s---- C:\WINDOWS\Tasks
2007-03-21 13:49 <KANSIO> d-------- C:\WINDOWS\system32\Restore
2007-03-21 13:49 <KANSIO> d-------- C:\WINDOWS\system32\Macromed
2007-03-21 13:49 <KANSIO> d-------- C:\WINDOWS\srchasst
2007-03-21 13:49 <KANSIO> d-------- C:\Program Files\Movie Maker
2007-03-21 13:49 <KANSIO> d-------- C:\Program Files\Common Files\MSSoap
2007-03-21 13:48 21,672 --a------ C:\WINDOWS\system32\emptyregdb.dat
2007-03-21 13:48 <KANSIO> d-------- C:\WINDOWS\Registration
2007-03-21 13:48 <KANSIO> d-------- C:\Program Files\Messenger
2007-03-21 13:47 97,792 --a------ C:\WINDOWS\system32\comrepl.dll
2007-03-21 13:47 956,416 --a------ C:\WINDOWS\system32\msdtctm.dll
2007-03-21 13:47 93,696 --a------ C:\WINDOWS\system32\tscfgwmi.dll
2007-03-21 13:47 91,136 --a------ C:\WINDOWS\system32\mtxoci.dll
2007-03-21 13:47 9,728 --a------ C:\WINDOWS\system32\reset.exe
2007-03-21 13:47 87,176 --a------ C:\WINDOWS\system32\rdpwsx.dll
2007-03-21 13:47 85,504 --a------ C:\WINDOWS\system32\catsrvps.dll
2007-03-21 13:47 83,968 --a------ C:\WINDOWS\system32\charmap.exe
2007-03-21 13:47 73,216 --a------ C:\WINDOWS\system32\avwav.dll
2007-03-21 13:47 714,752 --a------ C:\WINDOWS\system32\mstsc.exe
2007-03-21 13:47 67,072 --a------ C:\WINDOWS\system32\rdshost.exe
2007-03-21 13:47 655,360 --a------ C:\WINDOWS\system32\mstscax.dll
2007-03-21 13:47 625,152 --a------ C:\WINDOWS\system32\catsrvut.dll
2007-03-21 13:47 62,464 --a------ C:\WINDOWS\system32\rdpclip.exe
2007-03-21 13:47 605,696 --a------ C:\WINDOWS\system32\getuname.dll
2007-03-21 13:47 60,416 --a------ C:\WINDOWS\system32\sol.exe
2007-03-21 13:47 60,416 --a------ C:\WINDOWS\system32\remotepg.dll
2007-03-21 13:47 60,416 --a------ C:\WINDOWS\system32\colbact.dll
2007-03-21 13:47 6,144 --a------ C:\WINDOWS\system32\msdtc.exe
2007-03-21 13:47 58,880 --a------ C:\WINDOWS\system32\msdtclog.dll
2007-03-21 13:47 58,880 --a------ C:\WINDOWS\system32\licwmi.dll
2007-03-21 13:47 58,880 --a------ C:\WINDOWS\system32\freecell.exe
2007-03-21 13:47 56,320 --a------ C:\WINDOWS\system32\servdeps.dll
2007-03-21 13:47 543,232 --a------ C:\WINDOWS\system32\spider.exe
2007-03-21 13:47 540,160 --a------ C:\WINDOWS\system32\comuid.dll
2007-03-21 13:47 54,272 --a------ C:\WINDOWS\system32\stclient.dll
2007-03-21 13:47 5,632 --a------ C:\WINDOWS\system32\write.exe
2007-03-21 13:47 5,120 --a------ C:\WINDOWS\system32\dcomcnfg.exe
2007-03-21 13:47 498,688 --a------ C:\WINDOWS\system32\clbcatq.dll
2007-03-21 13:47 44,544 --a------ C:\WINDOWS\system32\tscupgrd.exe
2007-03-21 13:47 44,544 --a------ C:\WINDOWS\system32\hticons.dll
2007-03-21 13:47 426,496 --a------ C:\WINDOWS\system32\msdtcprx.dll
2007-03-21 13:47 4,096 --a------ C:\WINDOWS\system32\rdpcfgex.dll
2007-03-21 13:47 4,096 --a------ C:\WINDOWS\system32\mtxex.dll
2007-03-21 13:47 39,424 --a------ C:\WINDOWS\system32\cfgbkend.dll
2007-03-21 13:47 362,496 --a------ C:\WINDOWS\system32\mspaint.exe
2007-03-21 13:47 350,208 --a------ C:\WINDOWS\system32\hypertrm.dll
2007-03-21 13:47 35,328 --a------ C:\WINDOWS\system32\winchat.exe
2007-03-21 13:47 33,792 --a------ C:\WINDOWS\system32\regini.exe
2007-03-21 13:47 295,424 --a------ C:\WINDOWS\system32\termsrv.dll
2007-03-21 13:47 25,600 --a------ C:\WINDOWS\system32\comaddin.dll
2007-03-21 13:47 25,088 --a------ C:\WINDOWS\system32\mtxlegih.dll
2007-03-21 13:47 227,840 --a------ C:\WINDOWS\system32\avtapi.dll
2007-03-21 13:47 225,792 --a------ C:\WINDOWS\system32\catsrv.dll
2007-03-21 13:47 22,016 --a------ C:\WINDOWS\system32\qwinsta.exe
2007-03-21 13:47 21,896 --a------ C:\WINDOWS\system32\drivers\tdtcp.sys
2007-03-21 13:47 21,504 --a------ C:\WINDOWS\system32\msg.exe
2007-03-21 13:47 20,480 --a------ C:\WINDOWS\system32\qprocess.exe
2007-03-21 13:47 20,480 --a------ C:\WINDOWS\system32\mtxdm.dll
2007-03-21 13:47 19,968 --a------ C:\WINDOWS\system32\rdpsnd.dll
2007-03-21 13:47 186,368 --a------ C:\WINDOWS\system32\accwiz.exe
2007-03-21 13:47 185,344 --a------ C:\WINDOWS\system32\cmprops.dll
2007-03-21 13:47 17,408 --a------ C:\WINDOWS\system32\tsshutdn.exe
2007-03-21 13:47 17,408 --a------ C:\WINDOWS\system32\mmfutil.dll
2007-03-21 13:47 161,280 --a------ C:\WINDOWS\system32\msdtcuiu.dll
2007-03-21 13:47 16,896 --a------ C:\WINDOWS\system32\qappsrv.exe
2007-03-21 13:47 16,384 --a------ C:\WINDOWS\system32\tskill.exe
2007-03-21 13:47 16,384 --a------ C:\WINDOWS\system32\avmeter.dll
2007-03-21 13:47 158,720 --a------ C:\WINDOWS\system32\sndvol32.exe
2007-03-21 13:47 15,872 --a------ C:\WINDOWS\system32\rwinsta.exe
2007-03-21 13:47 15,872 --a------ C:\WINDOWS\system32\cdmodem.dll
2007-03-21 13:47 15,360 --a------ C:\WINDOWS\system32\tscon.exe
2007-03-21 13:47 15,360 --a------ C:\WINDOWS\system32\logoff.exe
2007-03-21 13:47 147,968 --a------ C:\WINDOWS\system32\rdchost.dll
2007-03-21 13:47 147,456 --a------ C:\WINDOWS\system32\comsnap.dll
2007-03-21 13:47 140,800 --a------ C:\WINDOWS\system32\sessmgr.exe
2007-03-21 13:47 14,848 --a------ C:\WINDOWS\system32\tsdiscon.exe
2007-03-21 13:47 14,848 --a------ C:\WINDOWS\system32\shadow.exe
2007-03-21 13:47 139,528 --a------ C:\WINDOWS\system32\drivers\rdpwd.sys
2007-03-21 13:47 131,584 --a------ C:\WINDOWS\system32\sndrec32.exe
2007-03-21 13:47 130,560 --a------ C:\WINDOWS\system32\mshearts.exe
2007-03-21 13:47 13,824 --a------ C:\WINDOWS\system32\rdsaddin.exe
2007-03-21 13:47 123,392 --a------ C:\WINDOWS\system32\mplay32.exe
2007-03-21 13:47 122,880 --a------ C:\WINDOWS\system32\winmine.exe
2007-03-21 13:47 12,040 --a------ C:\WINDOWS\system32\drivers\tdpipe.sys
2007-03-21 13:47 117,760 --a------ C:\WINDOWS\system32\calc.exe
2007-03-21 13:47 110,080 --a------ C:\WINDOWS\system32\clbcatex.dll
2007-03-21 13:47 11,776 --a------ C:\WINDOWS\system32\xolehlp.dll
2007-03-21 13:47 11,264 --a------ C:\WINDOWS\system32\icaapi.dll
2007-03-21 13:47 102,400 --a------ C:\WINDOWS\system32\clipbrd.exe
2007-03-21 13:47 1,267,200 --a------ C:\WINDOWS\system32\comsvcs.dll
2007-03-21 13:47 1,161 --a------ C:\WINDOWS\system32\usrlogon.cmd
2007-03-21 13:47 <KANSIO> d-------- C:\WINDOWS\system32\MsDtc
2007-03-21 13:47 <KANSIO> d-------- C:\WINDOWS\system32\Com
2007-03-21 13:47 <KANSIO> d-------- C:\Program Files\Windows NT
2007-03-21 13:47 <KANSIO> d-------- C:\Program Files\MSN Gaming Zone
2007-03-21 13:46 40,840 --a------ C:\WINDOWS\system32\drivers\termdd.sys
2007-03-21 13:46 196,864 --a------ C:\WINDOWS\system32\drivers\rdpdr.sys


(((((((((((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))))


2007-03-30 10:02 81920 --a------ C:\WINDOWS\system32\openal32.dll
2007-03-25 13:07 49574 --a------ C:\WINDOWS\system32\perfc00b.dat
2007-03-25 13:07 286308 --a------ C:\WINDOWS\system32\perfh00b.dat
2007-03-21 15:40 62 --ahs---- C:\DOCUME~1\Marko\APPLIC~1\desktop.ini
2007-02-12 17:07 778240 --a------ C:\notepad++.exe
2007-02-03 01:21 341504 --a------ C:\SciLexer.dll
2007-01-08 20:01 17408 --a------ C:\WINDOWS\system32\corpol.dll


(((((((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))

*Note* empty entries & legit default entries are not shown

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run]
"CTFMON.EXE"="C:\\WINDOWS\\system32\\ctfmon.exe"
"IncrediMail"="C:\\Program Files\\IncrediMail\\bin\\IncMail.exe /c"
"BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="\"C:\\Program Files\\Common Files\\Ahead\\Lib\\NMBgMonitor.exe\""
"thoosje's sidebar"="C:\\Program Files\\Thoosje Vista Sidebar v1.7.8\\thoosje's sidebar.exe"
"RoboForm"="\"C:\\Program Files\\Siber Systems\\AI RoboForm\\RoboTaskBarIcon.exe\""

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run]
"NVMixerTray"="\"C:\\Program Files\\NVIDIA Corporation\\NvMixer\\NVMixerTray.exe\""
"NvCplDaemon"="RUNDLL32.EXE C:\\WINDOWS\\system32\\NvCpl.dll,NvStartup"
"nwiz"="nwiz.exe /install"
"NvMediaCenter"="RUNDLL32.EXE C:\\WINDOWS\\system32\\NvMcTray.dll,NvTaskbarInit"
"F-Secure Manager"="\"C:\\Program Files\\Sonera Tietoturva\\Common\\FSM32.EXE\" /splash"
"F-Secure TNB"="\"C:\\Program Files\\Sonera Tietoturva\\TNB\\TNBUtil.exe\" /CHECKALL /WAITFORSW"
"F-Secure Startup Wizard"="\"C:\\Program Files\\Sonera Tietoturva\\FSGUI\\FSSW.EXE\" /reboot"
"News Service"="\"C:\\Program Files\\Sonera Tietoturva\\FSGUI\\ispnews.exe\""
"LClock"="C:\\Program Files\\LClock\\LClock.exe"
"VisualTooltip"="C:\\Program Files\\VisualTooltip\\VisualToolTip.exe"
"Blaero Start Orb"="C:\\Program Files\\Blaero Start Orb\\Blaero Start Orb.exe"
"Styler"="C:\\Program Files\\Styler\\Styler.exe"
"NeroFilterCheck"="C:\\Program Files\\Common Files\\Ahead\\Lib\\NeroCheck.exe"
"GrooveMonitor"="\"C:\\Program Files\\Microsoft Office\\Office12\\GrooveMonitor.exe\""

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents\IMAIL]
"Installed"="1"

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents\MAPI]
"Installed"="1"
"NoChange"="1"

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents\MSFS]
"Installed"="1"

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run-]
"updateMgr"="C:\\Program Files\\Adobe\\Acrobat 7.0\\Acrobat\\AdobeUpdateManager.exe AcPro7_0_5"

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-]
"PWRISOVM.EXE"="C:\\Program Files\\PowerISO\\PWRISOVM.EXE"
"Acrobat Assistant 7.0"="\"C:\\Program Files\\Adobe\\Acrobat 7.0\\Distillr\\Acrotray.exe\""
"Easy-PrintToolBox"="C:\\Program Files\\Canon\\Easy-PrintToolBox\\BJPSMAIN.EXE /logon"
"avast!"="C:\\PROGRA~1\\ALWILS~1\\Avast4\\ashDisp.exe"
"avgnt"="\"C:\\Program Files\\AntiVir PersonalEdition Classic\\avgnt.exe\" /min"


[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shellexecutehooks]
"{B5A7F190-DDA6-4420-B3BA-52453494E6CD}"="Groove GFS Stub Execution Hook"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders]
"SecurityProviders"="msapsspc.dll, schannel.dll, digest.dll, msnsspc.dll"

[HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Svchost]
HTTPFilter REG_MULTI_SZ HTTPFilter\0\0
LocalService REG_MULTI_SZ Alerter\0WebClient\0LmHosts\0RemoteRegistry\0upnphost\0SSDPSRV\0\0
NetworkService REG_MULTI_SZ DnsCache\0\0
DcomLaunch REG_MULTI_SZ DcomLaunch\0TermService\0\0
rpcss REG_MULTI_SZ RpcSs\0\0
imgsvc REG_MULTI_SZ StiSvc\0\0
termsvcs REG_MULTI_SZ TermService\0\0
Usnsvc REG_MULTI_SZ usnsvc\0\0

hklm\software\Microsoft\Windows NT\CurrentVersion\Svchost *netsvcs*
UxTuneUp




~ ~ ~ ~ ~ ~ ~ ~ Hijackthis Backups ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~

backup-20070331-181522-857
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - Unknown owner - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe (file missing)
backup-20070331-180721-910
O23 - Service: avast! Web Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe" /service (file missing)
backup-20070331-180721-797
O23 - Service: avast! Antivirus - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashServ.exe (file missing)
backup-20070331-180721-577
O23 - Service: avast! Mail Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe" /service (file missing)
backup-20070331-180721-942
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - Unknown owner - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe (file missing)

Contents of the 'Scheduled Tasks' folder
C:\WINDOWS\tasks\1-Click Maintenance.job
C:\WINDOWS\tasks\User_Feed_Synchronization-{BA2DB4E5-17BA-492C-AA22-74877ABBDBEB}.job


********************************************************************

catchme 0.2 W2K/XP/Vista - userland rootkit detector by Gmer, 17 October 2006
http://www.gmer.net

scanning hidden processes ...

scanning hidden services ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden processes: 0
hidden services: 0
hidden files: 0

********************************************************************

Completion time: 07-03-31 21:06:50

 

Lataa AVG Anti-Spyware 7.5 ja tallenna ohjelma työpöydällesi.

[*]Kun olet ladannut ohjelman, kaksoisklikkaa asennuohjelman pikakuvaketta työpöydälläsi, asennus alkaa.
[*]Asennuksen jälkeen täytyy ohjelma käynnistää ja sen tunnisteet päivittää.
[*]Käynnistä AVG Anti-Spyware.
[*]Klikkaa "Update" kuvaketta päävalikossa. Sen jälkeen klikkaa "Update now" painiketta.
[*]Sitten klikkaa "Start Update" kuvaketta jolloin päivitys alkaa.
[*]Kun päivitykset on ladattu, klikkaa "Scanner" kuvaketta ikkunan ylälaidassa. Valitse sitten "Settings" välilehti.
[*]Kun "Settings" valikko on auennut, klikkaa "Recommended actions" ja sitten valitse "Quarantine".
[*]Sitten "Reports" valikon alta:
[*]Laita täppi kohtaan "Automatically generate report after every scan"
[*]Ota täppi pois kohdasta"Only if threats were found"
[*]Sitten klikkaa "Shield" kuvaketta ikkunan ylälaidassa
[*]"Resident shield is", muuta tila active:sta inactive:ksi
[*]Sulje ohjelma, ÄLÄ skannaa vielä.

Käynnistä tietokone vikasietotilaan:
1. Käynnistä tietokone uudelleen.
2. Kun tietokone käynnistyy, paina F8-näppäintä.
3. Näyttöön tulee erilaisia käynnistysvaihtoehtoja.
4. Valitse näppäimistön nuolinäppäinten avulla Vikasietotila.
5. Paina ENTER-näppäintä.

HUOM! Älä käytä muita ohjelmia AVG skannauksen aikana, tämä saattaa häiritä skannausta.
[*]Kun vikasietotilassa, käynnistä AVG Anti-Spyware.
[*]Klikkaa "Scanner" kuvaketta ikkunan ylälaidassa ja valitse "Scan" välilehti. Sitten klikkaa "Complete System Scan".
[*]AVG aloittaa nyt tietokoneen skannaamisen, ole kärsivällinen sillä skannaus vie aikaa.
Kun skannaus on valmis:
TÄRKEÄÄ : Älä klikkaa "Save Scan Report" ennen kuin klikkaat "Apply all Actions"
[*]Varmistu, että Set all elements to: näyttää Quarantine (1), jos ei, klikkaa linkkiä ja valitse Quarantine popup-valikosta.
[*]Sinulta kysytään mitä tehdä jos infektioita löytyi, valitse silloin "Apply all actions"

[*]Sitten klikkaa "Reports" kuvaketta ohjelma yläosasta.
[*]Klikkaa "Save report as" painiketta ikkunan vasemmassa alalaidassa ja tallenna raportti työpöydälle.
[*]Sulje ohjelma, käynnistä kone normaalisti ja lähetä AVG:n raportti viestiketjuusi.

 

tässä se raportti,huomasin vaan et siinämissä olis pitäny olla se Quarantine (1), oli delete,et se tais poistaa noi mitkä se löys? no semmosta sattuu mut tässä se raportti,se vika ei hävinny mihinkään,heti kun avasin netin niin avaaili taas omia linkkejä tai siis sen edellä mainitun sivun.

---------------------------------------------------------
AVG Anti-Spyware - Scan Report
---------------------------------------------------------

+ Created at: 22:19:36 31.3.2007

+ Scan result:



F:\System Volume Information\_restore{9C0EAFB4-4329-4711-8BC8-42E8703EA848}\RP131\A0072276.0xe -> Backdoor.Bifrose.la : Cleaned.
F:\sovelluksia 2\AVG.Anti-Virus.Professional.v7.5.423.810.Incl.Keygen-SSG.rar.0ar/AVG.Anti-Virus.Professional.v7.5.423.810.Incl.Keygen-SSG.rar\Windows.Genuine.Crack.exe -> Backdoor.Bifrose.la : Cleaned.
F:\sovelluksia 1\Alcohol 120% v1.9.5.3823.0ar/Alcohol 120% v1.9.5.3823\alcohol_activator.exe -> Backdoor.VB.ayh : Cleaned.
F:\sovelluksia 1\WINRAR(fin)\Rarlab.WinRAR.v3.51.Finnish.Incl.Patch-F4CG.0ip/wrar351fi.exe/x.exe -> Downloader.Agent.bfu : Cleaned.
F:\sovelluksia 1\WINRAR(fin)\wrar351fi.0xe/x.exe -> Downloader.Agent.bfu : Cleaned.
F:\sovelluksia 3\Rarlab.WinRAR.v3.51.Finnish.Incl.Patch-F4CG.0ip/wrar351fi.exe/x.exe -> Downloader.Agent.bfu : Cleaned.
C:\Documents and Settings\Marko\Cookies\marko@cpvfeed[2].txt -> TrackingCookie.Cpvfeed : Cleaned.
C:\Documents and Settings\Marko\Cookies\marko@cpvfeed[3].txt -> TrackingCookie.Cpvfeed : Cleaned.
C:\Documents and Settings\Marko\Cookies\marko@statistik-gallup[1].txt -> TrackingCookie.Statistik-gallup : Cleaned.
C:\Documents and Settings\Marko\Cookies\marko@statistik-gallup[2].txt -> TrackingCookie.Statistik-gallup : Cleaned.
F:\sovelluksia 2\Winrar 3.70 + Crack\CrAcK.0xe -> Trojan.Agent : Cleaned.
F:\sovelluksia 1\Alcohol 120% v1.9.5.3823 + SeRiAl.rar/Alcohol 120% v1.9.5.3823 + SeRiAl\activator.exe -> Trojan.Agent.sk : Cleaned.
D:\SOVELLUKSIA\AddRemove Plus 5.1![Eng]+Crack.rar/AddRemove Plus! 5.1\AddRemove Plus! 5.1.rar/AddRemove Plus! 5.1\Crack.exe -> Trojan.Feutel.av : Cleaned.
D:\SOVELLUKSIA\AddRemove Plus 5.1![Eng]+Crack.rar/AddRemove Plus! 5.1\Crack.exe -> Trojan.Feutel.av : Cleaned.
F:\sovelluksia 3\AddRemove Plus 5.1![Eng]+Crack.rar/AddRemove Plus! 5.1\AddRemove Plus! 5.1.rar/AddRemove Plus! 5.1\Crack.exe -> Trojan.Feutel.av : Cleaned.
F:\sovelluksia 3\AddRemove Plus 5.1![Eng]+Crack.rar/AddRemove Plus! 5.1\Crack.exe -> Trojan.Feutel.av : Cleaned.
D:\SOVELLUKSIA\WinRAR.3.62.Final.zip/WinRAR.3.62.Final-Patch.exe -> Trojan.Small : Cleaned.
D:\SOVELLUKSIA 2\Microsoft - Office XP PRO - FIN\Windows.XP.Keygenerator.exe -> Trojan.Small.edz : Cleaned.


::Report end

 

nyt se avas itestään tämmösen sivun http://www.amaena.com/securityworm5/?ax=1&ex=1&mpt=1175369479627&aid=mgwvfrcg10

 

Oletko tarkastanu, ettei ole proxya käytössä, kun ilmeisesti IE:llä surffailet? Kaverille kävi vähän samalla tavalla ja sille oli jostain tullut epämääräinen proxy IE:lle käyttöön.

Käytä ihmeessä Opera tai Firefox selainta.

 

en ole tarkistanut koska en tiedä mikä se on?? on kyllä firefox mut käytän sitä harvemmin koska tota robofofmin palkkia ei ole siinä tai en osaa asentaa sitä siihen.

 

joo,näyttäis kovasti siltä et se ongelma on ainoastaan IE:ssä,voisko joku kertoa mikä on proxy??

 

Ajetaanpas blacklightia.

Lataa ja tallenna Blacklight työpöydällesi;

Tupla-klikkaa blbeta.exe, hyväksy sopimus, klikkaa > Scan, sitten > Next

Näet listan kaikesta mitä löytyi. Työpöydällesi myös ilmestyy loki jonka nimi on fsbl.xxxxxxx.log (xxxxxxx;n tilalla on luultavimmin numeroita).

Kopioi ja liitä tämä loki seuraavaan vastaukseesi. Älä valitse "Rename" optiota vielä! Haluamme nähdä login ensin, koska hyviä tiedostoja saattaa olla mukana.

*********

Lataa tuosta CCleaner ja asenna se: http://ccleaner.com/download/downloadpage.aspx?1
Kun asennat tätä ohjelmaa niin älä asenna sen mukana tulevaa yahoo-toolbaria. Tämä ohjelma
etsii ja poistaa ns. turhia tiedostoja koneeltasi eli esim: temp tiedostot ja tällä saat myös
puhdistettua rekisterisi. -korjaa automaattisesti tiedostojärjestelmän virheet¨
-etsi ja yritä korjata virheelliset sektorit

**********

Lataa Dr.Web CureIt työpöydälle:
ftp://ftp.drweb.com/pub/drweb/cureit/drweb-cureit.exe


* Tuplaklikkaa drweb-cureit.exe ja anna sen tehdä express scan
* Se skannaa käynnissä olevat ohjelmat ja jos jotain löytyy, klikkaa yes kun se kysyy haluatko poistaa sen. Tämä on vain lyhyt scan.
* Kun scan on valmis, merkkaa asemat, jotka haluat scannata.
* Valitse kaikki asemat. Punainen piste osoittaa, mitkä asemat on valittu.
* Klikaa vihreää nuolta oikealla ja scan alkaa.
* Klikkaa 'Yes to all', jos kysytään haluatko poistaa/siirtää tiedoston.
* Kun scan on valmis, katso voitko klikata next-kuvaketta löytyneiden tiedostojen vieressä:
* Jos asia on niin, klikkaa sitä ja sitten klikkaa next-kuvaketta oikealla alhaalla ja valitse Move incurable kuten alla olevalla kuvassa:

Tämä siirtää sen %userprofile%\DoctorWeb\quarantine-hakemistoon.
* Tämän jälkeen klikkaa Dr.Web CureIt-valikossa file ja valitse save report list
* Tallenna raportti työpöydälle. Raportin nimi on DrWeb.csv
* Sulje Dr.Web Cureit.
* Käynnistä kone uudelleen !! Tämä siksi, että käytössä olevat tiedostot poistetaan/siirretään käynnistyksen yhteydessä.
* Käynnistyksen jälkeen liitä Dr.Web-lokin, jonka tallensit aiemmin, sisältö seuraavaan vastaukseesi.

****

Poista tää ohjelma "thoosje's sidebar.exe" ja sen kansiot jos et tartte&tiedä&tunne sitä ohjelmaa

 

03/31/07 23:47:35 [Info]: BlackLight Engine 1.0.61 initialized
03/31/07 23:47:35 [Info]: OS: 5.1 build 2600 (Service Pack 2)
03/31/07 23:47:35 [Note]: 7019 4
03/31/07 23:47:35 [Note]: 7005 0
03/31/07 23:47:37 [Note]: 7006 0
03/31/07 23:47:37 [Note]: 7011 1332
03/31/07 23:47:37 [Note]: 7026 0
03/31/07 23:47:37 [Note]: 7026 0
03/31/07 23:47:42 [Note]: FSRAW library version 1.7.1021
03/31/07 23:50:27 [Note]: 7007 0
tossa kaikki mitä se f-secure löysi.mulla on asennettuna ccleaner sekä jv16 power tools sekä tune up2007 niistä ei ole apua tähän. tiedän mikä toohje sidebar on.

 

Lataa WinPFind3 http://download.bleepingcomputer.com/oldtimer/winpfind3u.exe työpöydällesi ja tuplaklikkaa exeä purkaaksesi sen. Kansio nimeltä WinPFind3u luodaan työpöydällesi.


* Avaa WinPFind3u-kansio ja tuplaklikkaa WinPFind3U.exe käynnistääksesi ohjelman.

o Files Created Within-kohdassa klikkaa30 days
o Files Modified Within-kohdassa klikkaa30 days
o File String Search -kohdassa klikkaaNon-Microsoft

* Nyt klikkaa Run Scan-nappulaa työkalupalkissa.
* Kun skanni on valmis, raportti avautuu muistioon.
* Klikkaa Muotoile ja varmistu ettei automaattinen rivitys ole valittuna. Jos on, ota valinta pois.


Lähetä loki seuraavassa vastauksessasi. Voit tarvita siihen useita vastauksia, ettei se jää vaillinaiseksi.

 

kun asennan tuon WinPFind3 ja aloitan scannaamaan se menee jumiin,olen yrittänyt poistaa ja asentaa uudestaan sitä.se oli koko yön päällä mut mitään ei tapahtunut??