Käynnistä-valikkooni ilmestyi verkkoympäristö-kuvake, joka ei yleensä näy siellä ja avattuani verkkoympäristö sivun siellä oli 4 kpl outoja kansioita mm. kansio nimeltä Delade dokum palvelimella Yeah (Finnholm) jne. Poistin kansiot kertaalleen mutta nyt ne ilmestyivät uudestaan. Olis ihan kiva tietää tunkeeko joku hurri verkkooni vai mistä nää kansiot oikeen on kotosin...Jos joku osais auttaa..
-> Lataa Hijackthis: http://koti.mbnet.fi/pattaya1/HijackThis.exe -> Tallenna hakemistoon C:\hjt ->Uudelleennimeä HijackThis.exe -> scanner.exe:ksi näin: 1. Klikkaa hiiren oikealla painikkeella HijackThis ikonia. 2. Valitse Uudelleennineä/ Rename. 3. Kirjoita scanner.exe -> Käynnistä HijackThis ja klikkaa: do a system scan and save a logfile. -> Lähetä ilmestynyt logisi tähän ketjuun
Logfile of HijackThis v1.99.1 Scan saved at 23:26:09, on 9.5.2007 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v7.00 (7.00.6000.16441) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\Explorer.EXE C:\WINDOWS\system32\RUNDLL32.EXE E:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe E:\Program Files\CyberLink\PowerDVD\PDVDServ.exe C:\WINDOWS\SOUNDMAN.EXE E:\Program Files\Java\jre1.6.0_01\bin\jusched.exe E:\Program Files\F-Secure Internet Security\Common\FSM32.EXE C:\WINDOWS\system32\ctfmon.exe E:\Program Files\DAEMON Tools\daemon.exe E:\Program Files\MSI\Core Center\CoreCenter.exe E:\Program Files\F-Secure Internet Security\Anti-Virus\fsgk32st.exe E:\Program Files\F-Secure Internet Security\Anti-Virus\FSGK32.EXE E:\Program Files\F-Secure Internet Security\Common\FSMA32.EXE C:\WINDOWS\system32\nvsvc32.exe C:\Program Files\Cyberlink\Shared files\RichVideo.exe E:\Program Files\F-Secure Internet Security\Common\FSMB32.EXE C:\WINDOWS\system32\svchost.exe E:\Program Files\F-Secure Internet Security\Common\FCH32.EXE E:\Program Files\F-Secure Internet Security\Anti-Virus\fssm32.exe E:\Program Files\F-Secure Internet Security\Common\FAMEH32.EXE E:\Program Files\F-Secure Internet Security\Anti-Virus\fsqh.exe E:\Program Files\F-Secure Internet Security\FSAUA\program\fsaua.exe E:\Program Files\F-Secure Internet Security\FWES\Program\fsdfwd.exe E:\Program Files\F-Secure Internet Security\FSAUA\program\fsus.exe E:\Program Files\F-Secure Internet Security\Anti-Virus\fsav32.exe E:\Program Files\F-Secure Internet Security\FSGUI\fsguidll.exe C:\Program Files\Internet Explorer\iexplore.exe C:\hjt\scanner.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.fi/ R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157 R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Linkit O2 - BHO: Adobe PDF Reader -linkkiavustaja - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - E:\PROGRA~1\MICROS~1\Office12\GRA8E1~1.DLL O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - E:\Program Files\Java\jre1.6.0_01\bin\ssv.dll O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file) O4 - HKLM\..\Run: [PtiuPbmd] Rundll32.exe ptipbm.dll,SetWriteBack O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup O4 - HKLM\..\Run: [nwiz] nwiz.exe /install O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit O4 - HKLM\..\Run: [GrooveMonitor] "E:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe" O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe O4 - HKLM\..\Run: [RemoteControl] "E:\Program Files\CyberLink\PowerDVD\PDVDServ.exe" O4 - HKLM\..\Run: [LanguageShortcut] "E:\Program Files\CyberLink\PowerDVD\Language\Language.exe" O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE O4 - HKLM\..\Run: [SunJavaUpdateSched] "E:\Program Files\Java\jre1.6.0_01\bin\jusched.exe" O4 - HKLM\..\Run: [F-Secure Manager] "E:\Program Files\F-Secure Internet Security\Common\FSM32.EXE" /splash O4 - HKLM\..\Run: [F-Secure TNB] "E:\Program Files\F-Secure Internet Security\FSGUI\TNBUtil.exe" /CHECKALL /WAITFORSW O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [DAEMON Tools] "E:\Program Files\DAEMON Tools\daemon.exe" -lang 1033 O4 - Global Startup: Adobe Reader Speed Launch.lnk = E:\Program Files\Adobe\Reader 8.0\Reader\reader_sl.exe O4 - Global Startup: Adobe Reader Synchronizer.lnk = E:\Program Files\Adobe\Reader 8.0\Reader\AdobeCollabSync.exe O4 - Global Startup: CoreCenter.lnk = E:\Program Files\MSI\Core Center\CoreCenter.exe O8 - Extra context menu item: V&ie Microsoft Exceliin - res://E:\PROGRA~1\MICROS~1\Office12\EXCEL.EXE/3000 O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - E:\Program Files\Java\jre1.6.0_01\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - E:\Program Files\Java\jre1.6.0_01\bin\ssv.dll O9 - Extra button: Lähetä OneNoteen - {2670000A-7350-4f3c-8081-5663EE0C6C49} - E:\PROGRA~1\MICROS~1\Office12\ONBttnIE.dll O9 - Extra 'Tools' menuitem: Läh&etä OneNoteen - {2670000A-7350-4f3c-8081-5663EE0C6C49} - E:\PROGRA~1\MICROS~1\Office12\ONBttnIE.dll O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - E:\PROGRA~1\MICROS~1\Office12\REFIEBAR.DLL O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing) O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing) O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O10 - Unknown file in Winsock LSP: e:\program files\f-secure internet security\fsps\program\fslsp.dll O10 - Unknown file in Winsock LSP: e:\program files\f-secure internet security\fsps\program\fslsp.dll O10 - Unknown file in Winsock LSP: e:\program files\f-secure internet security\fsps\program\fslsp.dll O10 - Unknown file in Winsock LSP: e:\program files\f-secure internet security\fsps\program\fslsp.dll O10 - Unknown file in Winsock LSP: e:\program files\f-secure internet security\fsps\program\fslsp.dll O10 - Unknown file in Winsock LSP: e:\program files\f-secure internet security\fsps\program\fslsp.dll O10 - Unknown file in Winsock LSP: e:\program files\f-secure internet security\fsps\program\fslsp.dll O10 - Unknown file in Winsock LSP: e:\program files\f-secure internet security\fsps\program\fslsp.dll O10 - Unknown file in Winsock LSP: e:\program files\f-secure internet security\fsps\program\fslsp.dll O10 - Unknown file in Winsock LSP: e:\program files\f-secure internet security\fsps\program\fslsp.dll O10 - Unknown file in Winsock LSP: e:\program files\f-secure internet security\fsps\program\fslsp.dll O10 - Unknown file in Winsock LSP: e:\program files\f-secure internet security\fsps\program\fslsp.dll O11 - Options group: [INTERNATIONAL] International* O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204 O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1178651981453 O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - E:\PROGRA~1\MICROS~1\Office12\GR99D3~1.DLL O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL O18 - Protocol: ms-help - {314111C7-A502-11D2-BBCA-00C04F8EC294} - C:\Program Files\Common Files\Microsoft Shared\Help\hxds.dll O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL O18 - Filter hijack: text/xml - {807563E5-5146-11D5-A672-00B0D022E945} - C:\PROGRA~1\COMMON~1\MICROS~1\OFFICE12\MSOXMLMF.DLL O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll O23 - Service: FSGKHS (F-Secure Gatekeeper Handler Starter) - F-Secure Corporation - E:\Program Files\F-Secure Internet Security\Anti-Virus\fsgk32st.exe O23 - Service: F-Secure Automatic Update Agent (FSAUA) - F-Secure Corporation - E:\Program Files\F-Secure Internet Security\FSAUA\program\fsaua.exe O23 - Service: F-Secure Anti-Virus Firewall Daemon (FSDFWD) - F-Secure Corporation - E:\Program Files\F-Secure Internet Security\FWES\Program\fsdfwd.exe O23 - Service: F-Secure Management Agent (FSMA) - F-Secure Corporation - E:\Program Files\F-Secure Internet Security\Common\FSMA32.EXE O23 - Service: NBService - Nero AG - E:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - C:\Program Files\Cyberlink\Shared files\RichVideo.exe
Avaa Oma tietokone -> Tee seuraava toimenpide kaikille Paikallisille levyille ========== Lataa CCleaner ja asenna se: Avaa "Options", sieltä "Language" ja valitse "Suomi (Finnish)" Avaa "Virheet" kohta, paina "Etsi rekisterin virheitä", paina "Korjaa valitut rekisterin virheet..". Paina "Kyllä", kun ohjelma kysyy "Haluatko varmuuskopioida muutokset rekisteriin", tallenna tiedosto esim. työpöydälle. Avaa "Puhdistaja", paina "Tutki" ja tämän jälkeen "Aja Ccleaner". Puhdista väliaikaistiedostot ja -kansiot ohjelmalla säännöllisesti. =======0 Avaa hijackthis merkkaa seuraavat rivi(t) ja paina fix checked, sulje muut ohjelmat siksi aikaa R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file) Tässä ohje miten merkataan: ==========0 1,Lataa AVG Anti-Spyware 7.5 ja tallenna ohjelma työpöydällesi. Jos sinulla on jo kyseinen ohjelma siirry suoraan kohtaan 2! [*]Kun olet ladannut ohjelman, kaksoisklikkaa asennuohjelman pikakuvaketta työpöydälläsi, asennus alkaa. [*]Asennuksen jälkeen täytyy ohjelma käynnistää ja sen tunnisteet päivittää. 2. [*]Käynnistä AVG eAnti-Spyware. [*]Klikkaa "Update" kuvaketta päävalikossa. Sen jälkeen klikkaa "Update now" painiketta. [*]Sitten klikkaa "Start Update" kuvaketta jolloin päivitys alkaa. [*]Paina hetken kuluttua uudestaan "Start Update" , jos päivitykset eivät heti onnistu [*]Jos automaattipäivitys ei jostain syystä toimi, niin tunnisteet voi ladata manuaalisesti http://www.ewido.net/en/download/updates/ -linkin takaa. [*]Kun päivitykset on ladattu, klikkaa "Scanner" kuvaketta ikkunan ylälaidassa. Valitse sitten "Settings" välilehti. [*]Kun "Settings" valikko on auennut, klikkaa "Recommended actions" ja sitten valitse "Quarantine". [*]Sitten "Reports" valikon alta: [*]Laita täppi kohtaan "Automatically generate report after every scan" [*]Ota täppi pois kohdasta"Only if threats were found" [*]Sitten klikkaa "Shield" kuvaketta ikkunan ylälaidassa [*]"Resident shield is", muuta tila active:sta inactive:ksi [*]Sulje ohjelma, ÄLÄ skannaa vielä. Käynnistä tietokone vikasietotilaan: 1. Käynnistä tietokone uudelleen. 2. Kun tietokone käynnistyy, paina F8-näppäintä. 3. Näyttöön tulee erilaisia käynnistysvaihtoehtoja. 4. Valitse näppäimistön nuolinäppäinten avulla Vikasietotila. 5. Paina ENTER-näppäintä. HUOM! Älä käytä muita ohjelmia AVG skannauksen aikana, tämä saattaa häiritä skannausta. [*]Kun vikasietotilassa, käynnistä AVG Anti-Spyware. [*]Klikkaa "Scanner" kuvaketta ikkunan ylälaidassa ja valitse "Scan" välilehti. Sitten klikkaa "Complete System Scan". [*]AVG aloittaa nyt tietokoneen skannaamisen, ole kärsivällinen sillä skannaus vie aikaa. Kun skannaus on valmis: TÄRKEÄÄ : Älä klikkaa "Save Scan Report" ennen kuin klikkaat "Apply all Actions" [*]Varmistu, että Set all elements to: näyttää Quarantine (1), jos ei, klikkaa linkkiä ja valitse Quarantine popup-valikosta. [*]Sinulta kysytään mitä tehdä jos infektioita löytyi, valitse silloin "Apply all actions" [*]Sitten klikkaa "Reports" kuvaketta ohjelma yläosasta. [*]Klikkaa "Save report as" painiketta ikkunan vasemmassa alalaidassa ja tallenna raportti työpöydälle. [*]Sulje ohjelma, käynnistä kone normaalisti ja lähetä AVG:n raportti viestiketjuusi. ========= Lataa Deckard's System Scanner Työpöydällesi. Huomioi: Sinulla tulee olla Järjestelmänvalvojan oikeudet ajaaksesi ohjelman. [*]Sulje kaikki avoimet ikkunat ja ohjelmat. [*]Tupla Klikkaa Dss.exe tiedostoa ajaaksesi ohjelman, seuraa ohjeita. [*]Kun Scannaus on valmis 2 textitiedostoa pitäisi avautua, Main.txt ja extra.txt [*]Näppäile Kopioi ( CTRL+A -> CTRL + C ) ja liitä ( CTRL + V ) [*]kopioi ja liitä Extra.txt & Main.txt sisältö seuraavaan vastaukseesi. ========= Uusi hjtlogi
--------------------------------------------------------- AVG Anti-Spyware - Scan Report --------------------------------------------------------- + Created at: 13:34:08 10.5.2007 + Scan result: Nothing found. ::Report end Deckard's System Scanner v20070426.43 Run by Omistaja on 2007-05-10 at 14:30:40 Computer is in Normal Mode. -------------------------------------------------------------------------------- -- System Restore -------------------------------------------------------------- Successfully created a Deckard's System Scanner Restore Point. -- Last 2 Restore Point(s) -- 2: 2007-05-10 11:30:44 UTC - RP40 - Deckard's System Scanner Restore Point 1: 2007-05-09 19:27:25 UTC - RP39 - Software Distribution Service 2.0 Backed up registry hives. Performed disk cleanup. -- HijackThis (run as Omistaja.exe) -------------------------------------------- Logfile of HijackThis v1.99.1 Scan saved at 14:31:45, on 10.5.2007 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v7.00 (7.00.6000.16441) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\Explorer.EXE C:\WINDOWS\system32\RUNDLL32.EXE E:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe E:\Program Files\CyberLink\PowerDVD\PDVDServ.exe C:\WINDOWS\SOUNDMAN.EXE E:\Program Files\Java\jre1.6.0_01\bin\jusched.exe E:\Program Files\F-Secure Internet Security\Common\FSM32.EXE C:\WINDOWS\system32\ctfmon.exe E:\Program Files\DAEMON Tools\daemon.exe E:\Program Files\MSI\Core Center\CoreCenter.exe E:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe E:\Program Files\F-Secure Internet Security\Anti-Virus\fsgk32st.exe E:\Program Files\F-Secure Internet Security\Anti-Virus\FSGK32.EXE E:\Program Files\F-Secure Internet Security\Common\FSMA32.EXE C:\WINDOWS\system32\nvsvc32.exe C:\Program Files\Cyberlink\Shared files\RichVideo.exe C:\WINDOWS\system32\svchost.exe E:\Program Files\F-Secure Internet Security\Common\FSMB32.EXE E:\Program Files\F-Secure Internet Security\Common\FCH32.EXE E:\Program Files\F-Secure Internet Security\Anti-Virus\fsqh.exe E:\Program Files\F-Secure Internet Security\Common\FAMEH32.EXE E:\Program Files\F-Secure Internet Security\Anti-Virus\fssm32.exe E:\Program Files\F-Secure Internet Security\FSAUA\program\fsaua.exe E:\Program Files\F-Secure Internet Security\FWES\Program\fsdfwd.exe E:\Program Files\F-Secure Internet Security\Anti-Virus\fsav32.exe E:\Program Files\F-Secure Internet Security\FSGUI\fsguidll.exe C:\Documents and Settings\Omistaja\Työpöytä\dss.exe C:\hjt\Omistaja.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.fi/ R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157 R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Linkit O2 - BHO: Adobe PDF Reader -linkkiavustaja - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - E:\PROGRA~1\MICROS~1\Office12\GRA8E1~1.DLL O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - E:\Program Files\Java\jre1.6.0_01\bin\ssv.dll O4 - HKLM\..\Run: [PtiuPbmd] Rundll32.exe ptipbm.dll,SetWriteBack O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup O4 - HKLM\..\Run: [nwiz] nwiz.exe /install O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit O4 - HKLM\..\Run: [GrooveMonitor] "E:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe" O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe O4 - HKLM\..\Run: [RemoteControl] "E:\Program Files\CyberLink\PowerDVD\PDVDServ.exe" O4 - HKLM\..\Run: [LanguageShortcut] "E:\Program Files\CyberLink\PowerDVD\Language\Language.exe" O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE O4 - HKLM\..\Run: [SunJavaUpdateSched] "E:\Program Files\Java\jre1.6.0_01\bin\jusched.exe" O4 - HKLM\..\Run: [F-Secure Manager] "E:\Program Files\F-Secure Internet Security\Common\FSM32.EXE" /splash O4 - HKLM\..\Run: [F-Secure TNB] "E:\Program Files\F-Secure Internet Security\FSGUI\TNBUtil.exe" /CHECKALL /WAITFORSW O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [DAEMON Tools] "E:\Program Files\DAEMON Tools\daemon.exe" -lang 1033 O4 - Global Startup: Adobe Reader Speed Launch.lnk = E:\Program Files\Adobe\Reader 8.0\Reader\reader_sl.exe O4 - Global Startup: Adobe Reader Synchronizer.lnk = E:\Program Files\Adobe\Reader 8.0\Reader\AdobeCollabSync.exe O4 - Global Startup: CoreCenter.lnk = E:\Program Files\MSI\Core Center\CoreCenter.exe O8 - Extra context menu item: V&ie Microsoft Exceliin - res://E:\PROGRA~1\MICROS~1\Office12\EXCEL.EXE/3000 O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - E:\Program Files\Java\jre1.6.0_01\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - E:\Program Files\Java\jre1.6.0_01\bin\ssv.dll O9 - Extra button: Lähetä OneNoteen - {2670000A-7350-4f3c-8081-5663EE0C6C49} - E:\PROGRA~1\MICROS~1\Office12\ONBttnIE.dll O9 - Extra 'Tools' menuitem: Läh&etä OneNoteen - {2670000A-7350-4f3c-8081-5663EE0C6C49} - E:\PROGRA~1\MICROS~1\Office12\ONBttnIE.dll O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - E:\PROGRA~1\MICROS~1\Office12\REFIEBAR.DLL O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing) O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing) O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O10 - Unknown file in Winsock LSP: e:\program files\f-secure internet security\fsps\program\fslsp.dll O10 - Unknown file in Winsock LSP: e:\program files\f-secure internet security\fsps\program\fslsp.dll O10 - Unknown file in Winsock LSP: e:\program files\f-secure internet security\fsps\program\fslsp.dll O10 - Unknown file in Winsock LSP: e:\program files\f-secure internet security\fsps\program\fslsp.dll O10 - Unknown file in Winsock LSP: e:\program files\f-secure internet security\fsps\program\fslsp.dll O10 - Unknown file in Winsock LSP: e:\program files\f-secure internet security\fsps\program\fslsp.dll O10 - Unknown file in Winsock LSP: e:\program files\f-secure internet security\fsps\program\fslsp.dll O10 - Unknown file in Winsock LSP: e:\program files\f-secure internet security\fsps\program\fslsp.dll O10 - Unknown file in Winsock LSP: e:\program files\f-secure internet security\fsps\program\fslsp.dll O10 - Unknown file in Winsock LSP: e:\program files\f-secure internet security\fsps\program\fslsp.dll O10 - Unknown file in Winsock LSP: e:\program files\f-secure internet security\fsps\program\fslsp.dll O10 - Unknown file in Winsock LSP: e:\program files\f-secure internet security\fsps\program\fslsp.dll O11 - Options group: [INTERNATIONAL] International* O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204 O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1178651981453 O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - E:\PROGRA~1\MICROS~1\Office12\GR99D3~1.DLL O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL O18 - Protocol: ms-help - {314111C7-A502-11D2-BBCA-00C04F8EC294} - C:\Program Files\Common Files\Microsoft Shared\Help\hxds.dll O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL O18 - Filter hijack: text/xml - {807563E5-5146-11D5-A672-00B0D022E945} - C:\PROGRA~1\COMMON~1\MICROS~1\OFFICE12\MSOXMLMF.DLL O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll O23 - Service: AVG Anti-Spyware Guard - Anti-Malware Development a.s. - E:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe O23 - Service: FSGKHS (F-Secure Gatekeeper Handler Starter) - F-Secure Corporation - E:\Program Files\F-Secure Internet Security\Anti-Virus\fsgk32st.exe O23 - Service: F-Secure Automatic Update Agent (FSAUA) - F-Secure Corporation - E:\Program Files\F-Secure Internet Security\FSAUA\program\fsaua.exe O23 - Service: F-Secure Anti-Virus Firewall Daemon (FSDFWD) - F-Secure Corporation - E:\Program Files\F-Secure Internet Security\FWES\Program\fsdfwd.exe O23 - Service: F-Secure Management Agent (FSMA) - F-Secure Corporation - E:\Program Files\F-Secure Internet Security\Common\FSMA32.EXE O23 - Service: NBService - Nero AG - E:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - C:\Program Files\Cyberlink\Shared files\RichVideo.exe -- HijackThis Fixed Entries (C:\hjt\backups\) ---------------------------------- backup-20070510-115045-360 O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file) backup-20070510-115045-778 R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = backup-20070510-115045-998 R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = -- File Associations ----------------------------------------------------------- All associations okay. -- Drivers: 0-Boot, 1-System, 2-Auto, 3-Demand, 4-Disabled --------------------- R0 FSFW (F-Secure Firewall Driver) - c:\windows\system32\drivers\fsdfw.sys <Not Verified; F-Secure Corporation; F-Secure Anti-Virus Internet Shield> R1 F-Secure HIPS - e:\program files\f-secure internet security\hips\fshs.sys <Not Verified; F-Secure Corporation; F-Secure HIPS Driver> R3 F-Secure Gatekeeper - e:\program files\f-secure internet security\anti-virus\minifilter\fsgk.sys R3 PCAlertDriver - e:\program files\msi\core center\ntglm7x.sys <Not Verified; MICRO-STAR INT'L CO., LTD.; MSI PCAlert 4> R3 RushTopDevice - e:\program files\msi\core center\rushtop.sys <Not Verified; MICRO-STAR INT'L CO., LTD.; MSI CoreCenter> S0 NVStrap - c:\windows\system32\drivers\nvstrap.sys S3 GMSIPCI - d:\install\gmsipci.sys (file missing) S3 RivaTuner32 - e:\program files\rivatuner v2.01\rivatuner32.sys S4 F-Secure Filter (F-Secure File System Filter) - e:\program files\f-secure internet security\anti-virus\win2k\fsfilter.sys S4 F-Secure Recognizer (F-Secure File System Recognizer) - e:\program files\f-secure internet security\anti-virus\win2k\fsrec.sys -- Services: 0-Boot, 1-System, 2-Auto, 3-Demand, 4-Disabled -------------------- R2 F-Secure Gatekeeper Handler Starter (FSGKHS) - "e:\program files\f-secure internet security\anti-virus\fsgk32st.exe" <Not Verified; F-Secure Corporation; F-Secure Corp. Startup service> R2 FSMA (F-Secure Management Agent) - "e:\program files\f-secure internet security\common\fsma32.exe" <Not Verified; F-Secure Corporation; F-Secure Management Agent> R3 FSAUA (F-Secure Automatic Update Agent) - "e:\program files\f-secure internet security\fsaua\program\fsaua.exe" <Not Verified; F-Secure Corporation; F-Secure Automatic Update Agent> R3 FSDFWD (F-Secure Anti-Virus Firewall Daemon) - "e:\program files\f-secure internet security\fwes\program\fsdfwd.exe" <Not Verified; F-Secure Corporation; F-Secure Anti-Virus Internet Shield> S3 NBService - e:\program files\nero\nero 7\nero backitup\nbservice.exe -- Files created between 2007-04-10 and 2007-05-10 ----------------------------- 2007-05-10 11:49:00 0 dr-h----- C:\Documents and Settings\Omistaja\Recent 2007-05-09 23:25:02 0 d-------- C:\hjt 2007-05-09 16:14:04 0 d-------- C:\Documents and Settings\Omistaja\Application Data\Macromedia 2007-05-09 13:12:51 29472 --a------ C:\WINDOWS\system32\drivers\fsndis5.sys <Not Verified; F-Secure Corporation; F-Secure Anti-Virus Internet Shield> 2007-05-09 13:12:51 50080 --a------ C:\WINDOWS\system32\drivers\fsdfw.sys <Not Verified; F-Secure Corporation; F-Secure Anti-Virus Internet Shield> 2007-05-09 13:12:42 0 d-------- C:\Documents and Settings\All Users\Application Data\F-Secure 2007-05-09 11:48:17 0 d-------- C:\Documents and Settings\Omistaja\Application Data\ispnews 2007-05-09 11:45:33 0 d-------- C:\WINDOWS\rnapxs 2007-05-09 01:59:11 0 d-------- C:\Program Files\MSXML 6.0 2007-05-09 01:52:40 0 d-------- C:\WINDOWS\system32\XPSViewer 2007-05-09 01:51:54 0 d-------- C:\Program Files\Reference Assemblies 2007-05-09 01:45:33 0 d-------- C:\WINDOWS\system32\URTTEMP 2007-05-09 01:06:55 0 d-------- C:\Documents and Settings\Omistaja\Application Data\WinRAR 2007-05-09 01:05:02 0 d-------- C:\WINDOWS\Sun 2007-05-09 00:46:38 0 d-------- C:\Program Files\MSXML 4.0 2007-05-09 00:40:40 0 d-------- C:\Documents and Settings\Omistaja\Application Data\Sun 2007-05-09 00:39:14 0 d-------- C:\Program Files\Common Files\Java 2007-05-08 23:47:25 49152 --a------ C:\WINDOWS\system32\ChCfg.exe 2007-05-08 23:45:57 0 d-------- C:\Program Files\Realtek AC97 2007-05-08 23:16:18 18359 -----n--- C:\WINDOWS\system32\Ntaccess.sys <Not Verified; Your Corporation; Your Product Name> 2007-05-08 23:16:18 6912 -----n--- C:\WINDOWS\system32\drivers\FlashSys.sys 2007-05-08 23:16:15 0 d-------- C:\Program Files\MSI 2007-05-08 23:15:54 0 d-------- C:\WINDOWS\system32\PreInstall 2007-05-08 23:15:11 0 d--hs---- C:\WINDOWS\Installer 2007-05-08 23:15:10 0 d-------- C:\Program Files\Common Files\ODBC 2007-05-08 23:15:07 0 d-------- C:\Program Files\Common Files\SpeechEngines 2007-05-08 23:15:06 0 dr------- C:\Program Files 2007-05-08 23:14:56 0 d-------- C:\Documents and Settings\Omistaja\Application Data\CyberLink 2007-05-08 23:14:42 0 d--h----- C:\Documents and Settings\Default User\Verkkoympäristö 2007-05-08 23:14:42 0 d-------- C:\Documents and Settings\Default User\Työpöytä 2007-05-08 23:14:42 0 d--h----- C:\Documents and Settings\Default User\Tulostinympäristö 2007-05-08 23:14:42 0 d-------- C:\Documents and Settings\Default User\Suosikit 2007-05-08 23:14:42 0 dr-h----- C:\Documents and Settings\Default User\SendTo 2007-05-08 23:14:42 0 d--h----- C:\Documents and Settings\Default User\Recent 2007-05-08 23:14:42 0 d--h----- C:\Documents and Settings\Default User\Mallit 2007-05-08 23:14:42 0 dr-h----- C:\Documents and Settings\Default User\Local Settings 2007-05-08 23:14:42 0 dr------- C:\Documents and Settings\Default User\Käynnistä-valikko 2007-05-08 23:14:42 0 d---s---- C:\Documents and Settings\Default User\Cookies 2007-05-08 23:14:42 0 d-------- C:\Documents and Settings\All Users\Työpöytä 2007-05-08 23:14:42 0 dr------- C:\Documents and Settings\All Users\Tiedostot 2007-05-08 23:14:42 0 d-------- C:\Documents and Settings\All Users\Suosikit 2007-05-08 23:14:42 0 d--h----- C:\Documents and Settings\All Users\Mallit 2007-05-08 23:14:42 0 dr------- C:\Documents and Settings\All Users\Käynnistä-valikko 2007-05-08 23:14:37 0 d-------- C:\Documents and Settings\All Users\Application Data\CyberLink 2007-05-08 23:13:02 0 d-------- C:\WINDOWS\system32\CatRoot2 2007-05-08 23:13:02 0 d-------- C:\WINDOWS\system32\CatRoot 2007-05-08 23:12:57 0 dr-h----- C:\Documents and Settings\Default User\Application Data 2007-05-08 23:12:57 0 d---s---- C:\Documents and Settings\Default User\Application Data\Microsoft 2007-05-08 23:12:57 0 dr-h----- C:\Documents and Settings\All Users\Application Data 2007-05-08 23:12:57 0 d---s---- C:\Documents and Settings\All Users\Application Data\Microsoft 2007-05-08 23:12:51 0 d-------- C:\Program Files\Cyberlink 2007-05-08 23:12:34 0 d--hs---- C:\System Volume Information 2007-05-08 23:12:34 0 d-------- C:\Documents and Settings 2007-05-08 23:08:34 0 d-------- C:\Documents and Settings\Omistaja\Application Data\Ahead 2007-05-08 23:06:33 0 d-------- C:\WINDOWS 2007-05-08 23:06:33 0 d-------- C:\WINDOWS\WinSxS 2007-05-08 23:06:33 0 dr------- C:\WINDOWS\Web 2007-05-08 23:06:33 0 d-------- C:\WINDOWS\twain_32 2007-05-08 23:06:33 0 d-------- C:\WINDOWS\system32 2007-05-08 23:06:33 0 d-------- C:\WINDOWS\system32\wins 2007-05-08 23:06:33 0 d-------- C:\WINDOWS\system32\wbem 2007-05-08 23:06:33 0 d-------- C:\WINDOWS\system32\usmt 2007-05-08 23:06:33 0 d-------- C:\WINDOWS\system32\spool 2007-05-08 23:06:33 0 d-------- C:\WINDOWS\system32\ShellExt 2007-05-08 23:06:33 0 d-------- C:\WINDOWS\system32\Setup 2007-05-08 23:06:33 0 d-------- C:\WINDOWS\system32\ras 2007-05-08 23:06:33 0 d-------- C:\WINDOWS\system32\oobe 2007-05-08 23:06:33 0 d-------- C:\WINDOWS\system32\npp 2007-05-08 23:06:33 0 d-------- C:\WINDOWS\system32\mui 2007-05-08 23:06:33 0 d-------- C:\WINDOWS\system32\inetsrv 2007-05-08 23:06:33 0 d-------- C:\WINDOWS\system32\IME 2007-05-08 23:06:33 0 d-------- C:\WINDOWS\system32\icsxml 2007-05-08 23:06:33 0 d-------- C:\WINDOWS\system32\ias 2007-05-08 23:06:33 0 d-------- C:\WINDOWS\system32\export 2007-05-08 23:06:33 0 d-------- C:\WINDOWS\system32\drivers 2007-05-08 23:06:33 0 d-------- C:\WINDOWS\system32\drivers\etc 2007-05-08 23:06:33 0 d-------- C:\WINDOWS\system32\drivers\disdn 2007-05-08 23:06:33 0 dr-hs--c- C:\WINDOWS\system32\dllcache 2007-05-08 23:06:33 0 d-------- C:\WINDOWS\system32\dhcp 2007-05-08 23:06:33 0 d-------- C:\WINDOWS\system32\config 2007-05-08 23:06:33 0 d-------- C:\WINDOWS\system32\3com_dmi 2007-05-08 23:06:33 0 d-------- C:\WINDOWS\system32\3076 2007-05-08 23:06:33 0 d-------- C:\WINDOWS\system32\2052 2007-05-08 23:06:33 0 d-------- C:\WINDOWS\system32\1054 2007-05-08 23:06:33 0 d-------- C:\WINDOWS\system32\1042 2007-05-08 23:06:33 0 d-------- C:\WINDOWS\system32\1041 2007-05-08 23:06:33 0 d-------- C:\WINDOWS\system32\1037 2007-05-08 23:06:33 0 d-------- C:\WINDOWS\system32\1035 2007-05-08 23:06:33 0 d-------- C:\WINDOWS\system32\1033 2007-05-08 23:06:33 0 d-------- C:\WINDOWS\system32\1031 2007-05-08 23:06:33 0 d-------- C:\WINDOWS\system32\1028 2007-05-08 23:06:33 0 d-------- C:\WINDOWS\system32\1025 2007-05-08 23:06:33 0 d-------- C:\WINDOWS\system 2007-05-08 23:06:33 0 d-------- C:\WINDOWS\security 2007-05-08 23:06:33 0 d-------- C:\WINDOWS\Resources 2007-05-08 23:06:33 0 d-------- C:\WINDOWS\repair 2007-05-08 23:06:33 0 d-------- C:\WINDOWS\Provisioning 2007-05-08 23:06:33 0 d-------- C:\WINDOWS\PeerNet 2007-05-08 23:06:33 0 d-------- C:\WINDOWS\pchealth 2007-05-08 23:06:33 0 d-------- C:\WINDOWS\mui 2007-05-08 23:06:33 0 d-------- C:\WINDOWS\msapps 2007-05-08 23:06:33 0 d-------- C:\WINDOWS\msagent 2007-05-08 23:06:33 0 d-------- C:\WINDOWS\Media 2007-05-08 23:06:33 0 d-------- C:\WINDOWS\java 2007-05-08 23:06:33 0 d--h----- C:\WINDOWS\inf 2007-05-08 23:06:33 0 d-------- C:\WINDOWS\ime 2007-05-08 23:06:33 0 d-------- C:\WINDOWS\Help 2007-05-08 23:06:33 0 dr--s---- C:\WINDOWS\Fonts 2007-05-08 23:06:33 0 d-------- C:\WINDOWS\Driver Cache 2007-05-08 23:06:33 0 d-------- C:\WINDOWS\Debug 2007-05-08 23:06:33 0 d-------- C:\WINDOWS\Cursors 2007-05-08 23:06:33 0 d-------- C:\WINDOWS\Connection Wizard 2007-05-08 23:06:33 0 d-------- C:\WINDOWS\Config 2007-05-08 23:06:33 0 d-------- C:\WINDOWS\AppPatch 2007-05-08 23:06:33 0 d-------- C:\WINDOWS\addins 2007-05-08 23:06:14 0 d-------- C:\Program Files\Common Files\Ahead 2007-05-08 23:06:14 0 d-------- C:\Documents and Settings\All Users\Application Data\Nero 2007-05-08 22:56:05 0 d-------- C:\Documents and Settings\Omistaja\Contacts 2007-05-08 22:55:35 0 d------c- C:\WINDOWS\system32\DRVSTORE 2007-05-08 22:55:03 0 d-------- C:\Program Files\MSN Messenger 2007-05-08 22:50:04 0 d-------- C:\Program Files\Microsoft Works 2007-05-08 22:49:40 0 d-------- C:\Program Files\MSBuild 2007-05-08 22:44:52 0 d-------- C:\WINDOWS\SHELLNEW 2007-05-08 22:43:38 0 d-------- C:\Documents and Settings\All Users\Application Data\Microsoft Help 2007-05-08 22:39:27 0 d-------- C:\Program Files\Windows Media Connect 2 2007-05-08 22:38:06 0 d-------- C:\WINDOWS\system32\LogFiles 2007-05-08 22:38:06 0 d-------- C:\WINDOWS\system32\drivers\UMDF 2007-05-08 22:33:28 0 d-------- C:\Documents and Settings\Omistaja\Application Data\Adobe 2007-05-08 22:31:51 0 d-------- C:\WINDOWS\system32\fi-fi 2007-05-08 22:28:36 0 d-------- C:\WINDOWS\network diagnostic 2007-05-08 22:28:28 0 d--h----- C:\WINDOWS\$hf_mig$ 2007-05-08 22:21:12 0 d-------- C:\Documents and Settings\All Users\Application Data\Windows Genuine Advantage 2007-05-08 22:18:33 0 d--hs---- C:\Documents and Settings\Omistaja\UserData 2007-05-08 22:16:19 6784 --a------ C:\WINDOWS\nvoclock.sys <Not Verified; NVidia Corp.; NVidia System Utility Driver> 2007-05-08 22:16:19 273408 --a------ C:\WINDOWS\NVGfxOgl.dll 2007-05-08 22:16:19 1622016 --a------ C:\WINDOWS\NVBenchMarks.dll <Not Verified; NVIDIA; NVIDIA nTune> 2007-05-08 22:16:18 380928 --a------ C:\WINDOWS\nvsulib.dll <Not Verified; NVIDIA; NVIDIA nTune> 2007-05-08 22:16:18 368640 --a------ C:\WINDOWS\ntuneoem.dll <Not Verified; NVIDIA; NVIDIA nTune> 2007-05-08 22:16:18 45056 --a------ C:\WINDOWS\NTuneGpu.dll <Not Verified; NVIDIA; NVIDIA nTune> 2007-05-08 22:16:18 28672 --a------ C:\WINDOWS\AutoTuneScript.dll <Not Verified; NVIDIA; NVIDIA nTune> 2007-05-08 22:12:34 0 d-------- C:\Documents and Settings\Omistaja\Application Data\Talkback 2007-05-08 22:12:29 0 --a------ C:\WINDOWS\nsreg.dat 2007-05-08 22:12:27 0 d-------- C:\Documents and Settings\Omistaja\Application Data\Thunderbird 2007-05-08 22:12:27 0 d-------- C:\Documents and Settings\Omistaja\Application Data\Mozilla 2007-05-08 22:09:26 0 d-------- C:\Documents and Settings\All Users\Application Data\Adobe 2007-05-08 22:09:14 0 d-------- C:\Program Files\Common Files\Adobe 2007-05-08 22:08:03 10752 --a------ C:\WINDOWS\system32\ff_vfw.dll 2007-05-08 22:08:02 60273 --a------ C:\WINDOWS\system32\pthreadGC2.dll <Not Verified; Open Source Software community project; > 2007-05-08 21:56:55 682232 --a------ C:\WINDOWS\system32\drivers\sptd.sys 2007-05-08 21:26:07 4224 --a------ C:\WINDOWS\system32\drivers\NVStrap.sys 2007-05-08 21:22:58 0 d-------- C:\Documents and Settings\All Users\Application Data\NVIDIA 2007-05-08 21:22:18 8 --a------ C:\WINDOWS\system32\nvModes.dat 2007-05-08 21:21:58 0 d-------- C:\Documents and Settings\All Users\Application Data\nView_Profiles 2007-05-08 21:19:47 0 d-------- C:\WINDOWS\nview 2007-05-08 21:13:49 147456 --a------ C:\WINDOWS\system32\RtlCPAPI.dll <Not Verified; ; RtlCPAPI Module> 2007-05-08 21:13:49 4025984 --a------ C:\WINDOWS\system32\drivers\alcxwdm.sys <Not Verified; Realtek Semiconductor Corp.; Windows (R) WDM driver for Realtek AC'97 Audio(HRTF data Copyright 1994 by MIT Media Lab)> 2007-05-08 21:13:48 577536 --a------ C:\WINDOWS\soundman.exe <Not Verified; Realtek Semiconductor Corp.; Realtek Sound Manager> 2007-05-08 21:13:45 10528768 --a------ C:\WINDOWS\system32\RTLCPL.exe <Not Verified; Realtek Semiconductor Corp.; Realtek Audio Sound Effect Manager> 2007-05-08 21:13:29 315392 --a------ C:\WINDOWS\alcupd.exe <Not Verified; Realtek Semiconductor Corp.; Realtek AC'97 Update driver Tool> 2007-05-08 21:13:27 217088 --a------ C:\WINDOWS\Alcrmv.exe <Not Verified; Realtek Semiconductor Corp.; Realtek AC'97 Removing driver Tool> 2007-05-08 21:13:08 0 d--h----- C:\Program Files\InstallShield Installation Information 2007-05-08 21:12:30 0 d-------- C:\Program Files\VIA 2007-05-08 21:12:12 0 d-------- C:\Program Files\Common Files\InstallShield 2007-05-08 21:08:49 24576 -ra------ C:\WINDOWS\system32\ptipbm.dll <Not Verified; Promise Technology,Inc.; pmscache Dynamic Link Library> 2007-05-08 21:08:47 64256 -ra------ C:\WINDOWS\system32\drivers\ulsata.sys <Not Verified; Promise Technology, Inc.; Promise UlSata Series Driver> 2007-05-08 21:04:32 306688 --a------ C:\WINDOWS\IsUninst.exe <Not Verified; InstallShield Software Corporation; InstallShield® unInstaller> 2007-05-08 21:03:55 0 d-------- C:\WINDOWS\system32\ReinstallBackups 2007-05-08 20:59:57 0 d-------- C:\Documents and Settings\Omistaja\Application Data\F-Secure 2007-05-08 20:58:48 0 d-------- C:\WINDOWS\system32\SoftwareDistribution 2007-05-08 20:49:39 0 d-------- C:\Documents and Settings\All Users\Application Data\fssg 2007-05-08 20:30:36 0 d-------- C:\Documents and Settings\Omistaja\Application Data\Identities 2007-05-08 20:30:32 0 dr------- C:\Documents and Settings\Omistaja\Omat tiedostot 2007-05-08 20:30:24 0 d--h----- C:\Documents and Settings\Omistaja\Verkkoympäristö 2007-05-08 20:30:24 0 d-------- C:\Documents and Settings\Omistaja\Työpöytä 2007-05-08 20:30:24 0 d--h----- C:\Documents and Settings\Omistaja\Tulostinympäristö 2007-05-08 20:30:24 0 dr------- C:\Documents and Settings\Omistaja\Suosikit 2007-05-08 20:30:24 0 dr-h----- C:\Documents and Settings\Omistaja\SendTo 2007-05-08 20:30:24 1835008 --ah----- C:\Documents and Settings\Omistaja\NTUSER.DAT 2007-05-08 20:30:24 0 d--h----- C:\Documents and Settings\Omistaja\Mallit 2007-05-08 20:30:24 0 d--h----- C:\Documents and Settings\Omistaja\Local Settings 2007-05-08 20:30:24 0 dr------- C:\Documents and Settings\Omistaja\Käynnistä-valikko 2007-05-08 20:30:24 0 d--hs---- C:\Documents and Settings\Omistaja\Cookies 2007-05-08 20:30:24 0 dr-h----- C:\Documents and Settings\Omistaja\Application Data 2007-05-08 20:29:30 0 d-------- C:\WINDOWS\SoftwareDistribution 2007-05-08 20:29:29 0 d-------- C:\WINDOWS\Prefetch 2007-05-08 20:29:28 0 d---s---- C:\WINDOWS\system32\Microsoft 2007-05-08 20:29:27 229376 --ah----- C:\Documents and Settings\LocalService\NTUSER.DAT 2007-05-08 20:29:27 0 d--h----- C:\Documents and Settings\LocalService\Local Settings 2007-05-08 20:29:27 0 d--hs---- C:\Documents and Settings\LocalService\Cookies 2007-05-08 20:29:27 0 d-------- C:\Documents and Settings\LocalService\Application Data 2007-05-08 20:29:27 0 d---s---- C:\Documents and Settings\LocalService\Application Data\Microsoft 2007-05-08 20:29:08 229376 --ah----- C:\Documents and Settings\NetworkService\NTUSER.DAT 2007-05-08 20:29:08 0 d--h----- C:\Documents and Settings\NetworkService\Local Settings 2007-05-08 20:29:08 0 d---s---- C:\Documents and Settings\NetworkService\Cookies 2007-05-08 20:29:08 0 d-------- C:\Documents and Settings\NetworkService\Application Data 2007-05-08 20:29:08 0 d---s---- C:\Documents and Settings\NetworkService\Application Data\Microsoft 2007-05-08 20:26:31 0 d-------- C:\WINDOWS\system32\xircom 2007-05-08 20:26:31 0 d-------- C:\Program Files\microsoft frontpage 2007-05-08 20:26:28 229376 ---h----- C:\Documents and Settings\Default User\NTUSER.DAT 2007-05-08 20:26:17 0 -rahs---- C:\MSDOS.SYS 2007-05-08 20:26:17 0 -rahs---- C:\IO.SYS 2007-05-08 20:26:17 0 --a------ C:\CONFIG.SYS 2007-05-08 20:26:17 0 --a------ C:\AUTOEXEC.BAT 2007-05-08 20:25:26 0 d--hs---- C:\Documents and Settings\All Users\DRM 2007-05-08 20:25:17 0 dr------- C:\WINDOWS\Offline Web Pages 2007-05-08 20:25:17 0 d---s---- C:\WINDOWS\Downloaded Program Files 2007-05-08 20:25:07 0 d--h----- C:\Program Files\WindowsUpdate 2007-05-08 20:25:04 0 d-------- C:\Program Files\Online Services 2007-05-08 20:24:50 0 d-------- C:\WINDOWS\system32\DirectX 2007-05-08 20:24:21 0 d---s---- C:\WINDOWS\Tasks 2007-05-08 20:24:20 0 d-------- C:\Program Files\Common Files\MSSoap 2007-05-08 20:24:17 0 d-------- C:\WINDOWS\system32\Macromed 2007-05-08 20:24:17 0 d-------- C:\WINDOWS\srchasst 2007-05-08 20:24:10 0 d-------- C:\Program Files\Movie Maker 2007-05-08 20:24:04 0 d-------- C:\WINDOWS\system32\Restore 2007-05-08 20:23:50 21672 --a------ C:\WINDOWS\system32\emptyregdb.dat 2007-05-08 20:23:35 0 d-------- C:\WINDOWS\Registration 2007-05-08 20:23:05 0 d-------- C:\Program Files\Messenger 2007-05-08 20:23:02 0 d-------- C:\Program Files\MSN Gaming Zone 2007-05-08 20:22:41 0 d-------- C:\Program Files\Windows NT 2007-05-08 20:22:39 0 d-------- C:\WINDOWS\system32\MsDtc 2007-05-08 20:22:37 0 d-------- C:\WINDOWS\system32\Com -- Find3M Report --------------------------------------------------------------- 2007-05-09 13:12:58 417942 --a------ C:\WINDOWS\system32\perfh00B.dat 2007-05-09 13:12:58 86868 --a------ C:\WINDOWS\system32\perfc00B.dat 2007-05-08 23:14:42 62 --ahs---- C:\Documents and Settings\Omistaja\Application Data\desktop.ini 2007-03-22 20:25:02 124928 -----n--- C:\WINDOWS\system32\prntvpt.dll <Not Verified; Microsoft Corporation; Microsoft® Windows® Operating System> -- Registry Dump --------------------------------------------------------------- [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects] {72853161-30C5-4D22-B7F9-0BBC1D38A37E} E:\PROGRA~1\MICROS~1\Office12\GRA8E1~1.DLL {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} E:\Program Files\Java\jre1.6.0_01\bin\ssv.dll [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run] "PtiuPbmd"="Rundll32.exe ptipbm.dll,SetWriteBack" "NvCplDaemon"="RUNDLL32.EXE C:\\WINDOWS\\system32\\NvCpl.dll,NvStartup" "nwiz"="nwiz.exe /install" "NvMediaCenter"="RUNDLL32.EXE C:\\WINDOWS\\system32\\NvMcTray.dll,NvTaskbarInit" "GrooveMonitor"="\"E:\\Program Files\\Microsoft Office\\Office12\\GrooveMonitor.exe\"" "NeroFilterCheck"="C:\\Program Files\\Common Files\\Ahead\\Lib\\NeroCheck.exe" "RemoteControl"="\"E:\\Program Files\\CyberLink\\PowerDVD\\PDVDServ.exe\"" "LanguageShortcut"="\"E:\\Program Files\\CyberLink\\PowerDVD\\Language\\Language.exe\"" "SoundMan"="SOUNDMAN.EXE" "SunJavaUpdateSched"="\"E:\\Program Files\\Java\\jre1.6.0_01\\bin\\jusched.exe\"" "F-Secure Manager"="\"E:\\Program Files\\F-Secure Internet Security\\Common\\FSM32.EXE\" /splash" "F-Secure TNB"="\"E:\\Program Files\\F-Secure Internet Security\\FSGUI\\TNBUtil.exe\" /CHECKALL /WAITFORSW" [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run] "CTFMON.EXE"="C:\\WINDOWS\\system32\\ctfmon.exe" "DAEMON Tools"="\"E:\\Program Files\\DAEMON Tools\\daemon.exe\" -lang 1033" [HKEY_USERS\.default\software\microsoft\windows\currentversion\run] "CTFMON.EXE"="C:\\WINDOWS\\system32\\CTFMON.EXE" [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\system] "DisableRegistryTools"=dword:00000000 [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shellexecutehooks] "{B5A7F190-DDA6-4420-B3BA-52453494E6CD}"="Groove GFS Stub Execution Hook" "{57B86673-276A-48B2-BAE7-C6DBB3020EB8}"="AVG Anti-Spyware 7.5" HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa Authentication Packages REG_MULTI_SZ msv1_0\0\0 Security Packages REG_MULTI_SZ kerberos\0msv1_0\0schannel\0wdigest\0\0 Notification Packages REG_MULTI_SZ scecli\0\0 [HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Svchost] HTTPFilter REG_MULTI_SZ HTTPFilter\0\0 LocalService REG_MULTI_SZ Alerter\0WebClient\0LmHosts\0RemoteRegistry\0upnphost\0SSDPSRV\0\0 NetworkService REG_MULTI_SZ DnsCache\0\0 DcomLaunch REG_MULTI_SZ DcomLaunch\0TermService\0\0 rpcss REG_MULTI_SZ RpcSs\0\0 imgsvc REG_MULTI_SZ StiSvc\0\0 termsvcs REG_MULTI_SZ TermService\0\0 WudfServiceGroup REG_MULTI_SZ WUDFSvc\0\0 -- End of Deckard's System Scanner: finished at 2007-05-10 at 14:32:34 --------- ----------------------------------------------------------------------------------------------------------------------------------------------- Deckard's System Scanner v20070426.43 Extra logfile - please post this as an attachment with your post. -------------------------------------------------------------------------------- -- System Information ---------------------------------------------------------- Microsoft Windows XP Home Edition (build 2600) SP 2.0 Architecture: X86; Language: Other (040B) - see http://preview.tinyurl.com/mhhp6 CPU 0: AMD Athlon(tm) 64 Processor 3000+ Percentage of Memory in Use: 42% Physical Memory (total/avail): 1023.48 MiB / 584.29 MiB Pagefile Memory (total/avail): 2460.05 MiB / 2077.62 MiB Virtual Memory (total/avail): 2047.88 MiB / 1954.87 MiB A: is Removable (No Media) C: is Fixed (NTFS) - 20.02 GiB total, 14.09 GiB free. D: is CDROM (No Media) E: is Fixed (NTFS) - 129.03 GiB total, 123.42 GiB free. F: is Fixed (NTFS) - 122.07 GiB total, 41.85 GiB free. G: is Fixed (NTFS) - 111.69 GiB total, 21.61 GiB free. R: is CDROM (No Media) -- Security Center ------------------------------------------------------------- AUOptions is scheduled to auto-install. Windows Internal Firewall is disabled. FirstRunDisabled is set. FW: F-Secure Internet Security 2007 7.01 v7.01 (F-Secure Corporation) AV: F-Secure Internet Security 2007 7.01 v7.01 (F-Secure Corporation) -- Environment Variables ------------------------------------------------------- ALLUSERSPROFILE=C:\Documents and Settings\All Users APPDATA=C:\Documents and Settings\Omistaja\Application Data CLIENTNAME=Console CommonProgramFiles=C:\Program Files\Common Files COMPUTERNAME=TIETOKONE ComSpec=C:\WINDOWS\system32\cmd.exe FP_NO_HOST_CHECK=NO HOMEDRIVE=C: HOMEPATH=\Documents and Settings\Omistaja LOGONSERVER=\\TIETOKONE NUMBER_OF_PROCESSORS=1 OS=Windows_NT Path=C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\Program Files\Common Files\Ahead\Lib\ PATHEXT=.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH PROCESSOR_ARCHITECTURE=x86 PROCESSOR_IDENTIFIER=x86 Family 15 Model 12 Stepping 0, AuthenticAMD PROCESSOR_LEVEL=15 PROCESSOR_REVISION=0c00 ProgramFiles=C:\Program Files PROMPT=$P$G SESSIONNAME=Console SystemDrive=C: SystemRoot=C:\WINDOWS TEMP=C:\DOCUME~1\Omistaja\LOCALS~1\Temp TMP=C:\DOCUME~1\Omistaja\LOCALS~1\Temp USERDOMAIN=TIETOKONE USERNAME=Omistaja USERPROFILE=C:\Documents and Settings\Omistaja windir=C:\WINDOWS -- User Profiles --------------------------------------------------------------- Omistaja (admin) -- Add/Remove Programs --------------------------------------------------------- --> "E:\Program Files\F-Secure Internet Security\Uninstall\fsuninst.exe" /UninstRegKey:"F-Secure Anti-Spyware Scanner" --> "E:\Program Files\F-Secure Internet Security\Uninstall\fsuninst.exe" /UninstRegKey:"F-Secure Anti-Spyware" --> "E:\Program Files\F-Secure Internet Security\Uninstall\fsuninst.exe" /UninstRegKey:"F-Secure Anti-Virus Client Security Installer" --> "E:\Program Files\F-Secure Internet Security\Uninstall\fsuninst.exe" /UninstRegKey:"F-Secure Anti-Virus" --> "E:\Program Files\F-Secure Internet Security\Uninstall\fsuninst.exe" /UninstRegKey:"F-Secure Automatic Update Agent" --> "E:\Program Files\F-Secure Internet Security\Uninstall\fsuninst.exe" /UninstRegKey:"F-Secure DAAS" --> "E:\Program Files\F-Secure Internet Security\Uninstall\fsuninst.exe" /UninstRegKey:"F-Secure Diagnostics" --> "E:\Program Files\F-Secure Internet Security\Uninstall\fsuninst.exe" /UninstRegKey:"F-Secure E-mail Scanning" --> "E:\Program Files\F-Secure Internet Security\Uninstall\fsuninst.exe" /UninstRegKey:"F-Secure FWES" --> "E:\Program Files\F-Secure Internet Security\Uninstall\fsuninst.exe" /UninstRegKey:"F-Secure GateKeeper Interface" --> "E:\Program Files\F-Secure Internet Security\Uninstall\fsuninst.exe" /UninstRegKey:"F-Secure Gemini" --> "E:\Program Files\F-Secure Internet Security\Uninstall\fsuninst.exe" /UninstRegKey:"F-Secure GUI" --> "E:\Program Files\F-Secure Internet Security\Uninstall\fsuninst.exe" /UninstRegKey:"F-Secure Help" --> "E:\Program Files\F-Secure Internet Security\Uninstall\fsuninst.exe" /UninstRegKey:"F-Secure HIPS" --> "E:\Program Files\F-Secure Internet Security\Uninstall\fsuninst.exe" /UninstRegKey:"F-Secure Internet Shield" --> "E:\Program Files\F-Secure Internet Security\Uninstall\fsuninst.exe" /UninstRegKey:"F-Secure Localization API" --> "E:\Program Files\F-Secure Internet Security\Uninstall\fsuninst.exe" /UninstRegKey:"F-Secure Management Agent" --> "E:\Program Files\F-Secure Internet Security\Uninstall\fsuninst.exe" /UninstRegKey:"F-Secure Pegasus Engine" --> "E:\Program Files\F-Secure Internet Security\Uninstall\fsuninst.exe" /UninstRegKey:"F-Secure Protocol Scanner" --> "E:\Program Files\F-Secure Internet Security\Uninstall\fsuninst.exe" /UninstRegKey:"F-Secure Spam Control" --> "E:\Program Files\F-Secure Internet Security\Uninstall\fsuninst.exe" /UninstRegKey:"F-Secure Spam Scanner" --> "E:\Program Files\F-Secure Internet Security\Uninstall\fsuninst.exe" /UninstRegKey:"F-Secure TNB" --> "E:\Program Files\F-Secure Internet Security\Uninstall\fsuninst.exe" /UninstRegKey:"F-Secure Uninstall" --> "E:\Program Files\F-Secure Internet Security\Uninstall\fsuninst.exe" /UninstRegKey:"News Service" --> C:\WINDOWS\UNNeroBackItUp.exe /UNINSTALL --> C:\WINDOWS\UNNeroMediaHome.exe /UNINSTALL --> C:\WINDOWS\UNNeroShowTime.exe /UNINSTALL --> C:\WINDOWS\UNNeroVision.exe /UNINSTALL --> C:\WINDOWS\UNRecode.exe /UNINSTALL --> E:\Program Files\Nero\Nero 7\\nero\uninstall\UNNERO.exe /UNINSTALL --> rundll32.exe setupapi.dll,InstallHinfSection DefaultUninstall 132 C:\WINDOWS\INF\PCHealth.inf Adobe Flash Player 9 ActiveX --> C:\WINDOWS\system32\Macromed\Flash\FlashUtil9c.exe -uninstallUnlock Adobe Reader 8 - Suomi --> MsiExec.exe /I{AC76BA86-7AD7-1035-7B44-A80000000000} AVG Anti-Spyware 7.5 --> E:\Program Files\Grisoft\AVG Anti-Spyware 7.5\Uninstall.exe CCleaner (remove only) --> "E:\Program Files\CCleaner\uninst.exe" Core Center --> C:\WINDOWS\IsUninst.exe -f"E:\Program Files\MSI\Core Center\Uninst.isu" F-Secure Internet Security 2007 --> "E:\Program Files\F-Secure Internet Security\FSGUI\SetupGUIMngr.exe" /tUnInstall ffdshow [rev 1133] [2007-05-04] --> "E:\Program Files\ffdshow\unins000.exe" HijackThis 1.99.1 --> C:\hjt\HijackThis.exe /uninstall Hotfix-päivitys Windows XP:lle (KB914440) --> "C:\WINDOWS\$NtUninstallKB914440$\spuninst\spuninst.exe" Hotfix for Windows Media Format 11 SDK (KB929399) --> "C:\WINDOWS\$NtUninstallKB929399$\spuninst\spuninst.exe" J2SE Runtime Environment 5.0 Update 9 --> MsiExec.exe /I{3248F0A8-6813-11D6-A77B-00B0D0150090} Java(TM) SE Runtime Environment 6 Update 1 --> MsiExec.exe /I{3248F0A8-6813-11D6-A77B-00B0D0160010} Microsoft Base Smart Card Cryptographic Service Provider Package --> "C:\WINDOWS\$NtUninstallbasecsp$\spuninst\spuninst.exe" Microsoft Compression Client Pack 1.0 for Windows XP --> "C:\WINDOWS\$NtUninstallMSCompPackV1$\spuninst\spuninst.exe" Microsoft Office Access MUI (Finnish) 2007 --> MsiExec.exe /X{90120000-0015-040B-0000-0000000FF1CE} Microsoft Office Enterprise 2007 --> "C:\Program Files\Common Files\Microsoft Shared\OFFICE12\Office Setup Controller\setup.exe" /uninstall ENTERPRISE /dll OSETUP.DLL Microsoft Office Enterprise 2007 --> MsiExec.exe /X{90120000-0030-0000-0000-0000000FF1CE} Microsoft Office Excel MUI (Finnish) 2007 --> MsiExec.exe /X{90120000-0016-040B-0000-0000000FF1CE} Microsoft Office Groove MUI (Finnish) 2007 --> MsiExec.exe /X{90120000-00BA-040B-0000-0000000FF1CE} Microsoft Office InfoPath MUI (Finnish) 2007 --> MsiExec.exe /X{90120000-0044-040B-0000-0000000FF1CE} Microsoft Office OneNote MUI (Finnish) 2007 --> MsiExec.exe /X{90120000-00A1-040B-0000-0000000FF1CE} Microsoft Office Outlook MUI (Finnish) 2007 --> MsiExec.exe /X{90120000-001A-040B-0000-0000000FF1CE} Microsoft Office PowerPoint MUI (Finnish) 2007 --> MsiExec.exe /X{90120000-0018-040B-0000-0000000FF1CE} Microsoft Office Proof (English) 2007 --> MsiExec.exe /X{90120000-001F-0409-0000-0000000FF1CE} Microsoft Office Proof (Finnish) 2007 --> MsiExec.exe /X{90120000-001F-040B-0000-0000000FF1CE} Microsoft Office Proof (German) 2007 --> MsiExec.exe /X{90120000-001F-0407-0000-0000000FF1CE} Microsoft Office Proof (Swedish) 2007 --> MsiExec.exe /X{90120000-001F-041D-0000-0000000FF1CE} Microsoft Office Proofing (Finnish) 2007 --> MsiExec.exe /X{90120000-002C-040B-0000-0000000FF1CE} Microsoft Office Publisher MUI (Finnish) 2007 --> MsiExec.exe /X{90120000-0019-040B-0000-0000000FF1CE} Microsoft Office Shared MUI (Finnish) 2007 --> MsiExec.exe /X{90120000-006E-040B-0000-0000000FF1CE} Microsoft Office Word MUI (Finnish) 2007 --> MsiExec.exe /X{90120000-001B-040B-0000-0000000FF1CE} Microsoft User-Mode Driver Framework Feature Pack 1.0 --> "C:\WINDOWS\$NtUninstallWudf01000$\spuninst\spuninst.exe" Mozilla Thunderbird (2.0.0.0) --> E:\Program Files\Mozilla Thunderbird\uninstall\helper.exe MSI Live Update 3 --> C:\WINDOWS\IsUninst.exe -f"C:\Program Files\MSI\Live Update 3\Uninst.isu" MSXML 6.0 Parser --> MsiExec.exe /I{A43BF6A5-D5F0-4AAA-BF41-65995063EC44} Nero 7 Ultra Edition --> MsiExec.exe /I{4F2CE68F-EDBB-4592-BF07-5AC930A51035} neroxml --> MsiExec.exe /I{56C049BE-79E9-4502-BEA7-9754A3E60F9B} NVIDIA Drivers --> C:\WINDOWS\system32\nvudisp.exe UninstallGUI Päivitys Windows XP:lle (KB894391) --> "C:\WINDOWS\$NtUninstallKB894391$\spuninst\spuninst.exe" Päivitys Windows XP:lle (KB898461) --> "C:\WINDOWS\$NtUninstallKB898461$\spuninst\spuninst.exe" Päivitys Windows XP:lle (KB900485) --> "C:\WINDOWS\$NtUninstallKB900485$\spuninst\spuninst.exe" Päivitys Windows XP:lle (KB904942) --> "C:\WINDOWS\$NtUninstallKB904942$\spuninst\spuninst.exe" Päivitys Windows XP:lle (KB908531) --> "C:\WINDOWS\$NtUninstallKB908531$\spuninst\spuninst.exe" Päivitys Windows XP:lle (KB910437) --> "C:\WINDOWS\$NtUninstallKB910437$\spuninst\spuninst.exe" Päivitys Windows XP:lle (KB911280) --> "C:\WINDOWS\$NtUninstallKB911280$\spuninst\spuninst.exe" Päivitys Windows XP:lle (KB916595) --> "C:\WINDOWS\$NtUninstallKB916595$\spuninst\spuninst.exe" Päivitys Windows XP:lle (KB920342) --> "C:\WINDOWS\$NtUninstallKB920342$\spuninst\spuninst.exe" Päivitys Windows XP:lle (KB920872) --> "C:\WINDOWS\$NtUninstallKB920872$\spuninst\spuninst.exe" Päivitys Windows XP:lle (KB922582) --> "C:\WINDOWS\$NtUninstallKB922582$\spuninst\spuninst.exe" Päivitys Windows XP:lle (KB925720) --> "C:\WINDOWS\$NtUninstallKB925720$\spuninst\spuninst.exe" Päivitys Windows XP:lle (KB925876) --> "C:\WINDOWS\$NtUninstallKB925876$\spuninst\spuninst.exe" Päivitys Windows XP:lle (KB930916) --> "C:\WINDOWS\$NtUninstallKB930916$\spuninst\spuninst.exe" Päivitys Windows XP:lle (KB931836) --> "C:\WINDOWS\$NtUninstallKB931836$\spuninst\spuninst.exe" PowerDVD --> "C:\Program Files\InstallShield Installation Information\{6811CAA0-BF12-11D4-9EA1-0050BAE317E1}\Setup.exe" -l0x000409 /z-uninstall Realtek AC'97 Audio --> RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\11\50\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{FB08F381-6533-4108-B7DD-039E11FBC27E}\Setup.exe" -l0xb -removeonly RivaTuner v2.01 --> "E:\Program Files\RivaTuner v2.01\uninstall.exe" Security Update for Excel 2007 (KB934670) --> msiexec /package {90120000-0030-0000-0000-0000000FF1CE} /uninstall {CD098537-8857-4065-B4B6-AC023CB2C48E} Security Update for Office 2007 (KB934062) --> msiexec /package {90120000-0030-0000-0000-0000000FF1CE} /uninstall {305D509B-F194-4638-9F0F-D9E4C05F9D33} Suojauspäivitys Windows XP:lle (KB890046) --> "C:\WINDOWS\$NtUninstallKB890046$\spuninst\spuninst.exe" Suojauspäivitys Windows XP:lle (KB893756) --> "C:\WINDOWS\$NtUninstallKB893756$\spuninst\spuninst.exe" Suojauspäivitys Windows XP:lle (KB896358) --> "C:\WINDOWS\$NtUninstallKB896358$\spuninst\spuninst.exe" Suojauspäivitys Windows XP:lle (KB896423) --> "C:\WINDOWS\$NtUninstallKB896423$\spuninst\spuninst.exe" Suojauspäivitys Windows XP:lle (KB896428) --> "C:\WINDOWS\$NtUninstallKB896428$\spuninst\spuninst.exe" Suojauspäivitys Windows XP:lle (KB899587) --> "C:\WINDOWS\$NtUninstallKB899587$\spuninst\spuninst.exe" Suojauspäivitys Windows XP:lle (KB899591) --> "C:\WINDOWS\$NtUninstallKB899591$\spuninst\spuninst.exe" Suojauspäivitys Windows XP:lle (KB900725) --> "C:\WINDOWS\$NtUninstallKB900725$\spuninst\spuninst.exe" Suojauspäivitys Windows XP:lle (KB901017) --> "C:\WINDOWS\$NtUninstallKB901017$\spuninst\spuninst.exe" Suojauspäivitys Windows XP:lle (KB901214) --> "C:\WINDOWS\$NtUninstallKB901214$\spuninst\spuninst.exe" Suojauspäivitys Windows XP:lle (KB902400) --> "C:\WINDOWS\$NtUninstallKB902400$\spuninst\spuninst.exe" Suojauspäivitys Windows XP:lle (KB904706) --> "C:\WINDOWS\$NtUninstallKB904706$\spuninst\spuninst.exe" Suojauspäivitys Windows XP:lle (KB905414) --> "C:\WINDOWS\$NtUninstallKB905414$\spuninst\spuninst.exe" Suojauspäivitys Windows XP:lle (KB905749) --> "C:\WINDOWS\$NtUninstallKB905749$\spuninst\spuninst.exe" Suojauspäivitys Windows XP:lle (KB908519) --> "C:\WINDOWS\$NtUninstallKB908519$\spuninst\spuninst.exe" Suojauspäivitys Windows XP:lle (KB911562) --> "C:\WINDOWS\$NtUninstallKB911562$\spuninst\spuninst.exe" Suojauspäivitys Windows XP:lle (KB911927) --> "C:\WINDOWS\$NtUninstallKB911927$\spuninst\spuninst.exe" Suojauspäivitys Windows XP:lle (KB913580) --> "C:\WINDOWS\$NtUninstallKB913580$\spuninst\spuninst.exe" Suojauspäivitys Windows XP:lle (KB914388) --> "C:\WINDOWS\$NtUninstallKB914388$\spuninst\spuninst.exe" Suojauspäivitys Windows XP:lle (KB914389) --> "C:\WINDOWS\$NtUninstallKB914389$\spuninst\spuninst.exe" Suojauspäivitys Windows XP:lle (KB917422) --> "C:\WINDOWS\$NtUninstallKB917422$\spuninst\spuninst.exe" Suojauspäivitys Windows XP:lle (KB917953) --> "C:\WINDOWS\$NtUninstallKB917953$\spuninst\spuninst.exe" Suojauspäivitys Windows XP:lle (KB918118) --> "C:\WINDOWS\$NtUninstallKB918118$\spuninst\spuninst.exe" Suojauspäivitys Windows XP:lle (KB918439) --> "C:\WINDOWS\$NtUninstallKB918439$\spuninst\spuninst.exe" Suojauspäivitys Windows XP:lle (KB919007) --> "C:\WINDOWS\$NtUninstallKB919007$\spuninst\spuninst.exe" Suojauspäivitys Windows XP:lle (KB920213) --> "C:\WINDOWS\$NtUninstallKB920213$\spuninst\spuninst.exe" Suojauspäivitys Windows XP:lle (KB920670) --> "C:\WINDOWS\$NtUninstallKB920670$\spuninst\spuninst.exe" Suojauspäivitys Windows XP:lle (KB920683) --> "C:\WINDOWS\$NtUninstallKB920683$\spuninst\spuninst.exe" Suojauspäivitys Windows XP:lle (KB920685) --> "C:\WINDOWS\$NtUninstallKB920685$\spuninst\spuninst.exe" Suojauspäivitys Windows XP:lle (KB922819) --> "C:\WINDOWS\$NtUninstallKB922819$\spuninst\spuninst.exe" Suojauspäivitys Windows XP:lle (KB923191) --> "C:\WINDOWS\$NtUninstallKB923191$\spuninst\spuninst.exe" Suojauspäivitys Windows XP:lle (KB923414) --> "C:\WINDOWS\$NtUninstallKB923414$\spuninst\spuninst.exe" Suojauspäivitys Windows XP:lle (KB923694) --> "C:\WINDOWS\$NtUninstallKB923694$\spuninst\spuninst.exe" Suojauspäivitys Windows XP:lle (KB923789) --> C:\WINDOWS\system32\MacroMed\Flash\genuinst.exe C:\WINDOWS\system32\MacroMed\Flash\KB923789.inf Suojauspäivitys Windows XP:lle (KB923980) --> "C:\WINDOWS\$NtUninstallKB923980$\spuninst\spuninst.exe" Suojauspäivitys Windows XP:lle (KB924191) --> "C:\WINDOWS\$NtUninstallKB924191$\spuninst\spuninst.exe" Suojauspäivitys Windows XP:lle (KB924270) --> "C:\WINDOWS\$NtUninstallKB924270$\spuninst\spuninst.exe" Suojauspäivitys Windows XP:lle (KB924667) --> "C:\WINDOWS\$NtUninstallKB924667$\spuninst\spuninst.exe" Suojauspäivitys Windows XP:lle (KB925902) --> "C:\WINDOWS\$NtUninstallKB925902$\spuninst\spuninst.exe" Suojauspäivitys Windows XP:lle (KB926255) --> "C:\WINDOWS\$NtUninstallKB926255$\spuninst\spuninst.exe" Suojauspäivitys Windows XP:lle (KB926436) --> "C:\WINDOWS\$NtUninstallKB926436$\spuninst\spuninst.exe" Suojauspäivitys Windows XP:lle (KB927779) --> "C:\WINDOWS\$NtUninstallKB927779$\spuninst\spuninst.exe" Suojauspäivitys Windows XP:lle (KB927802) --> "C:\WINDOWS\$NtUninstallKB927802$\spuninst\spuninst.exe" Suojauspäivitys Windows XP:lle (KB928255) --> "C:\WINDOWS\$NtUninstallKB928255$\spuninst\spuninst.exe" Suojauspäivitys Windows XP:lle (KB928843) --> "C:\WINDOWS\$NtUninstallKB928843$\spuninst\spuninst.exe" Suojauspäivitys Windows XP:lle (KB930178) --> "C:\WINDOWS\$NtUninstallKB930178$\spuninst\spuninst.exe" Suojauspäivitys Windows XP:lle (KB931261) --> "C:\WINDOWS\$NtUninstallKB931261$\spuninst\spuninst.exe" Suojauspäivitys Windows XP:lle (KB931784) --> "C:\WINDOWS\$NtUninstallKB931784$\spuninst\spuninst.exe" Suojauspäivitys Windows XP:lle (KB932168) --> "C:\WINDOWS\$NtUninstallKB932168$\spuninst\spuninst.exe" Update for Office 2007 (KB932080) --> msiexec /package {90120000-0030-0000-0000-0000000FF1CE} /uninstall {EDC9CA29-6BC1-471C-828C-7A36109005D7} Update for Office 2007 (KB933688) --> msiexec /package {90120000-0030-0000-0000-0000000FF1CE} /uninstall {F6E692F1-63C2-4760-94C6-C689DCD053F1} Update for Office 2007 (KB934393) --> msiexec /package {90120000-0030-0000-0000-0000000FF1CE} /uninstall {92FBAD46-E7F6-49FA-89B5-C39FC5BFAD15} Update for Outlook 2007 Junk Email Filter (KB934655) --> msiexec /package {90120000-0030-0000-0000-0000000FF1CE} /uninstall {F7185592-E40D-476E-9BC4-38DF96EE176B} Update for Word 2007 (KB934173) --> msiexec /package {90120000-0030-0000-0000-0000000FF1CE} /uninstall {C6A89125-5473-45E3-B413-ED8186437475} VIA Ohjelmistoalustan laitehallinta --> C:\PROGRA~1\COMMON~1\INSTAL~1\Driver\7\INTEL3~1\IDriver.exe /M{20D4A895-748C-4D88-871C-FDB1695B0169} Windows Communication Foundation --> MsiExec.exe /X{491DD792-AD81-429C-9EB4-86DD3D22E333} Windows Imaging Component --> "C:\WINDOWS\$NtUninstallWIC$\spuninst\spuninst.exe" Windows Live Messenger --> MsiExec.exe /I{DF6FEB75-A0D1-44E5-A754-0072D4967734} Windows Media Format 11 runtime --> "C:\WINDOWS\$NtUninstallWMFDist11$\spuninst\spuninst.exe" Windows Presentation Foundation --> MsiExec.exe /X{BAF78226-3200-4DB4-BE33-4D922A799840} Windows Presentation Foundation Language Pack (FIN) --> MsiExec.exe /X{935FADCB-C25B-4F62-B9B4-F22C40431642} Windows Workflow Foundation --> MsiExec.exe /I{7D1B85BD-AA07-48B8-808D-67A4067FC6BD} Windows Workflow Foundation FI Language Pack --> MsiExec.exe /I{8E5D0B52-BB72-46C6-8AB8-2B041D959594} WinRAR archiver --> E:\Program Files\WinRAR\uninstall.exe XML Paper Specification Shared Components Language Pack 1.0 --> "C:\WINDOWS\$NtUninstallXPSEPSCLP$\spuninst\spuninst.exe" XML Paper Specification Shared Components Pack 1.0 --> -- End of Deckard's System Scanner: finished at 2007-05-10 at 14:32:34 --------- ----------------------------------------------------------------------------------------------------------------------------------------------- Logfile of HijackThis v1.99.1 Scan saved at 14:42:07, on 10.5.2007 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v7.00 (7.00.6000.16441) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\Explorer.EXE C:\WINDOWS\system32\RUNDLL32.EXE E:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe E:\Program Files\CyberLink\PowerDVD\PDVDServ.exe C:\WINDOWS\SOUNDMAN.EXE E:\Program Files\Java\jre1.6.0_01\bin\jusched.exe E:\Program Files\F-Secure Internet Security\Common\FSM32.EXE C:\WINDOWS\system32\ctfmon.exe E:\Program Files\DAEMON Tools\daemon.exe E:\Program Files\MSI\Core Center\CoreCenter.exe E:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe E:\Program Files\F-Secure Internet Security\Anti-Virus\fsgk32st.exe E:\Program Files\F-Secure Internet Security\Anti-Virus\FSGK32.EXE E:\Program Files\F-Secure Internet Security\Common\FSMA32.EXE C:\WINDOWS\system32\nvsvc32.exe C:\Program Files\Cyberlink\Shared files\RichVideo.exe C:\WINDOWS\system32\svchost.exe E:\Program Files\F-Secure Internet Security\Common\FSMB32.EXE E:\Program Files\F-Secure Internet Security\Common\FCH32.EXE E:\Program Files\F-Secure Internet Security\Anti-Virus\fsqh.exe E:\Program Files\F-Secure Internet Security\Common\FAMEH32.EXE E:\Program Files\F-Secure Internet Security\Anti-Virus\fssm32.exe E:\Program Files\F-Secure Internet Security\FSAUA\program\fsaua.exe E:\Program Files\F-Secure Internet Security\FWES\Program\fsdfwd.exe E:\Program Files\F-Secure Internet Security\Anti-Virus\fsav32.exe E:\Program Files\F-Secure Internet Security\FSGUI\fsguidll.exe E:\Program Files\Microsoft Office\Office12\WINWORD.EXE C:\Program Files\Internet Explorer\iexplore.exe E:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe C:\hjt\scanner.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.fi/ R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157 R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Linkit O2 - BHO: Adobe PDF Reader -linkkiavustaja - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - E:\PROGRA~1\MICROS~1\Office12\GRA8E1~1.DLL O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - E:\Program Files\Java\jre1.6.0_01\bin\ssv.dll O4 - HKLM\..\Run: [PtiuPbmd] Rundll32.exe ptipbm.dll,SetWriteBack O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup O4 - HKLM\..\Run: [nwiz] nwiz.exe /install O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit O4 - HKLM\..\Run: [GrooveMonitor] "E:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe" O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe O4 - HKLM\..\Run: [RemoteControl] "E:\Program Files\CyberLink\PowerDVD\PDVDServ.exe" O4 - HKLM\..\Run: [LanguageShortcut] "E:\Program Files\CyberLink\PowerDVD\Language\Language.exe" O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE O4 - HKLM\..\Run: [SunJavaUpdateSched] "E:\Program Files\Java\jre1.6.0_01\bin\jusched.exe" O4 - HKLM\..\Run: [F-Secure Manager] "E:\Program Files\F-Secure Internet Security\Common\FSM32.EXE" /splash O4 - HKLM\..\Run: [F-Secure TNB] "E:\Program Files\F-Secure Internet Security\FSGUI\TNBUtil.exe" /CHECKALL /WAITFORSW O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [DAEMON Tools] "E:\Program Files\DAEMON Tools\daemon.exe" -lang 1033 O4 - Global Startup: Adobe Reader Speed Launch.lnk = E:\Program Files\Adobe\Reader 8.0\Reader\reader_sl.exe O4 - Global Startup: Adobe Reader Synchronizer.lnk = E:\Program Files\Adobe\Reader 8.0\Reader\AdobeCollabSync.exe O4 - Global Startup: CoreCenter.lnk = E:\Program Files\MSI\Core Center\CoreCenter.exe O8 - Extra context menu item: V&ie Microsoft Exceliin - res://E:\PROGRA~1\MICROS~1\Office12\EXCEL.EXE/3000 O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - E:\Program Files\Java\jre1.6.0_01\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - E:\Program Files\Java\jre1.6.0_01\bin\ssv.dll O9 - Extra button: Lähetä OneNoteen - {2670000A-7350-4f3c-8081-5663EE0C6C49} - E:\PROGRA~1\MICROS~1\Office12\ONBttnIE.dll O9 - Extra 'Tools' menuitem: Läh&etä OneNoteen - {2670000A-7350-4f3c-8081-5663EE0C6C49} - E:\PROGRA~1\MICROS~1\Office12\ONBttnIE.dll O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - E:\PROGRA~1\MICROS~1\Office12\REFIEBAR.DLL O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing) O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing) O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O10 - Unknown file in Winsock LSP: e:\program files\f-secure internet security\fsps\program\fslsp.dll O10 - Unknown file in Winsock LSP: e:\program files\f-secure internet security\fsps\program\fslsp.dll O10 - Unknown file in Winsock LSP: e:\program files\f-secure internet security\fsps\program\fslsp.dll O10 - Unknown file in Winsock LSP: e:\program files\f-secure internet security\fsps\program\fslsp.dll O10 - Unknown file in Winsock LSP: e:\program files\f-secure internet security\fsps\program\fslsp.dll O10 - Unknown file in Winsock LSP: e:\program files\f-secure internet security\fsps\program\fslsp.dll O10 - Unknown file in Winsock LSP: e:\program files\f-secure internet security\fsps\program\fslsp.dll O10 - Unknown file in Winsock LSP: e:\program files\f-secure internet security\fsps\program\fslsp.dll O10 - Unknown file in Winsock LSP: e:\program files\f-secure internet security\fsps\program\fslsp.dll O10 - Unknown file in Winsock LSP: e:\program files\f-secure internet security\fsps\program\fslsp.dll O10 - Unknown file in Winsock LSP: e:\program files\f-secure internet security\fsps\program\fslsp.dll O10 - Unknown file in Winsock LSP: e:\program files\f-secure internet security\fsps\program\fslsp.dll O11 - Options group: [INTERNATIONAL] International* O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204 O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1178651981453 O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - E:\PROGRA~1\MICROS~1\Office12\GR99D3~1.DLL O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL O18 - Protocol: ms-help - {314111C7-A502-11D2-BBCA-00C04F8EC294} - C:\Program Files\Common Files\Microsoft Shared\Help\hxds.dll O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL O18 - Filter hijack: text/xml - {807563E5-5146-11D5-A672-00B0D022E945} - C:\PROGRA~1\COMMON~1\MICROS~1\OFFICE12\MSOXMLMF.DLL O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll O23 - Service: AVG Anti-Spyware Guard - Anti-Malware Development a.s. - E:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe O23 - Service: FSGKHS (F-Secure Gatekeeper Handler Starter) - F-Secure Corporation - E:\Program Files\F-Secure Internet Security\Anti-Virus\fsgk32st.exe O23 - Service: F-Secure Automatic Update Agent (FSAUA) - F-Secure Corporation - E:\Program Files\F-Secure Internet Security\FSAUA\program\fsaua.exe O23 - Service: F-Secure Anti-Virus Firewall Daemon (FSDFWD) - F-Secure Corporation - E:\Program Files\F-Secure Internet Security\FWES\Program\fsdfwd.exe O23 - Service: F-Secure Management Agent (FSMA) - F-Secure Corporation - E:\Program Files\F-Secure Internet Security\Common\FSMA32.EXE O23 - Service: NBService - Nero AG - E:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - C:\Program Files\Cyberlink\Shared files\RichVideo.exe Ok. Siinä olis taas vähän listaa…
ääh, ei noista oikein auennu mitään varmaa Lataa Dr.Web CureIt työpöydälle: ftp://ftp.drweb.com/pub/drweb/cureit/drweb-cureit.exe [*]Tuplaklikkaa drweb-cureit.exe ja anna sen tehdä express scan [*]Se skannaa käynnissä olevat ohjelmat ja jos jotain löytyy, klikkaa yes kun se kysyy haluatko poistaa sen. Tämä on vain lyhyt scan. [*]Kun scan on valmis, merkkaa asemat, jotka haluat scannata. [*]Valitse kaikki asemat. Punainen piste osoittaa, mitkä asemat on valittu. [*]Klikaa vihreää nuolta oikealla ja scan alkaa. [*]Klikkaa 'Yes to all', jos kysytään haluatko poistaa/siirtää tiedoston. [*]Kun scan on valmis, katso voitko klikata next-kuvaketta löytyneiden tiedostojen vieressä: [*]Jos asia on niin, klikkaa sitä ja sitten klikkaa next-kuvaketta oikealla alhaalla ja valitse Move incurable kuten alla olevalla kuvassa: Tämä siirtää sen %userprofile%\DoctorWeb\quarantine-hakemistoon. [*]Tämän jälkeen klikkaa Dr.Web CureIt-valikossa file ja valitse save report list [*]Tallenna raportti työpöydälle. Raportin nimi on DrWeb.csv [*]Sulje Dr.Web Cureit. [*]Käynnistä kone uudelleen !! Tämä siksi, että käytössä olevat tiedostot poistetaan/siirretään käynnistyksen yhteydessä. [*]Käynnistyksen jälkeen liitä Dr.Web-lokin, jonka tallensit aiemmin, sisältö seuraavaan vastaukseesi.
Dr.Web Cure It skannaus - No Viruses found, joten ei lokia. Olen asentanut windowsin puhtaasti uudelleen viimeksi 8.5.2007 joten tuntuisikin aika ihmeelliseltä että tää kone olis oikein saastunut. Nää verkkoympäristökansiot ilmestyivät siis 1. kerran jo ennen uudelleenasennusta. Ja uudelleenasennuksen jälkeen ne ilmestyivät samana päivänä mutta eivät heti asennuksen jälkeen?!? Voisikohan tässä olla jokin hässä esim. laajakaistapalveluntarjoajan osalta siten, että olen jossain samassa ”työryhmässä” muiden tietokoneiden kanssa? Koska aikaisemmin ei ole ollut mitään verkkoympäristökuvakettakaan käynnistä-valikossa ja nytkin se tuli sinne vasta asennuksen jälkeen…ei siis heti. Itse saan tästä sen verran tolkkua että Microsoft Windows Networkin alla on useita työryhmiä näkyvissä..työryhmässä Mshome on useita tietokoneita( kaikki nimeltään jotenkin suomenruotsalaisia..joten tuntuis että aivan tästä lähialueelta?!?...Tässä työryhmässä on tietokone/palvelin nimeltään Yeah (Finnholm), jonka 4 kansiota näkyy siis verkkoympäristö kuvakketta klikatessa( ovatko ehkä jotenkin jaossa…). Lisäksi tän tietokoneen tulostin näkyy minulla.. Voisinkohan ehkä jotenkin poistaa tän microsoft windows network-systeemin ilman että oma nettiyhteys lakkaa toimimasta. Itselläni ei siis oo mitään kotiverkkoakaan tai muuta sellasta. langattomia laitteitakaan mulla ei ole. mut anyway , kiitti sulle ku viitit autella!
Edit. edelliseen . Kokeilin poistaa ne kansiot ja otin verkkoyhteydet asetuksista täpin pois kohdasta tiedostojen ja tulostimien jakaminen microsoft-verkoissa. Käynnistin sitten myllyn uudestaan ja verkkoympäristö kuvake oli hävinnyt käynnistä-valikosta...Lisäksi muita tietokoneita ei löytynyt enää Mshome-verkosta ..joten hmm. kai täs vaan pitää seurata tilannetta. Olis kiva vaan tietää kuuluko täs mun verkossa olla muka muita koneita tolleen...
ok, puhtaaltahan näyttää, googlaamalla löytyy tuosta kansiosta lisäasiaa Pysy puhtaana -> Tyhjennä järjestelmänpalautus Ohjeet Tyhjennä järjestelmänpalautuskansio ja luo uusi palautuspiste. Tämä puhdistaa palautuskansion mahdollisista haittaohjelmajäännöksistä. -> Käytä CCleaneria -> CCleaner Lataa ja asenna CCleaner. Puhdista väliaikaistiedostot ja -kansiot ohjelmalla säännöllisesti. -> Asenna SpywareBlaster -> SpywareBlaster SpywareBlaster estää haittaohjelmia asentumasta koneellesi. Ei kuluta muistia! Opas saatavilla suomeksi! Nimimerkki Ad-Awaren opas -> Asenna MVPS Hosts tiedosto -> MVPS Hosts Estää koneesi yhteyden haitallisiin sivustoihin. Opas saatavilla suomeksi! Nimimerkki Axelin opas -> Vaihda selaimesi Firefoxiin -> Firefox Firefox on nopeampi, turvallisempi ja parempi selain kuin Internet Explorer. -> Pidä järjestelmäsi ajantasalla. -> Windows Update Vieraile Windows Updatessa säännöllisesti. -> Pidä palomuuri ja virustorjunta ajantasalla Päivitä ja skannaa koneesi säännöllisesti virustorjuntaohjelmallasi. ja hyvä myös escan http://koti.mbnet.fi/pattaya1/escanmwav.htm ->Pidä ohjelmistosi ajantasalla. -> Secunia Software Inspector Secunia Software Inspector tutkii sinun järjestälmäsi ja ohjelmistosi puuttuvien turvallisuuspäivityksien osalta. Tavallinen tutkinta kestää normaalisti 5-40 sekuntia, kun läpikotainen (thorough system inspection) voi kestää useita minuutteja. ->Seuraa säännöllisesti viestintäviraston tietoja uusista haavoittuvuuksista -> CERT-FI
Todennäköisesti palveluntarjoajasi verkossa on muita koneita joilla ei ole suojaukset kohdallaan ja tiedostojen jako on avoin kaikille. Koneesi löytää ne koneet automaattisesti ja lisää verkkoympäristöösi.
