RunDLL ikkuna käynnistettäessä

Discussion in 'Virukset ja haittaohjelmat - HijackThis -logit' started by Aleksi321, Jan 21, 2009.

  1. Aleksi321

    Aleksi321 Guest

    Kun Vistan käynnistää tulee tällainen ikkuna:
    RunDLL
    Virhe ladattaessa:C:\PROGRA~1\MYWEBS~1\bar\1.bin\M3PLUGIN. DLL
    Määritettyä osaa ei löydy


    HJT työntää muistioon tällaista:

    Logfile of Trend Micro HijackThis v2.0.2
    Scan saved at 16:31:02, on 21.1.2009
    Platform: Windows Vista (WinNT 6.00.1904)
    MSIE: Internet Explorer v7.00 (7.00.6000.16764)
    Boot mode: Normal

    Running processes:
    C:\Windows\system32\taskeng.exe
    C:\Windows\system32\Dwm.exe
    C:\Windows\Explorer.EXE
    C:\Program Files\Windows Defender\MSASCui.exe
    C:\Windows\RtHDVCpl.exe
    C:\Program Files\Motorola\SMSERIAL\sm56hlpr.exe
    C:\Program Files\Norman\Npm\Bin\Zlh.exe
    C:\Program Files\Java\jre6\bin\jusched.exe
    C:\Program Files\HP\HP Software Update\hpwuSchd2.exe
    G:\Muuta\Karon TV\tvjbMonitor.exe
    C:\Program Files\Windows Sidebar\sidebar.exe
    C:\Windows\ehome\ehtray.exe
    C:\Users\Aksun\AppData\Local\Google\Update\GoogleU pdate.exe
    c:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.EXE
    C:\Program Files\Windows Media Player\wmpnscfg.exe
    C:\Windows\ehome\ehmsas.exe
    C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
    C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CCC.exe
    C:\Program Files\HP\Digital Imaging\bin\hpqSTE08.exe
    C:\Program Files\Norman\Nvc\BIN\NIP.EXE
    C:\Program Files\Norman\Nvc\bin\cclaw.exe
    C:\Program Files\Windows Live\Messenger\msnmsgr.exe
    G:\LATAUKSET\Ladatut tiedostot\X-Chat 2\xchat.exe
    C:\Program Files\Mozilla Firefox\firefox.exe
    C:\Users\Aksun\Desktop\hjt\skanneri.exe.exe

    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.fi/
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
    R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://home.sweetim.com
    R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
    R3 - URLSearchHook: Winamp Search Class - {57BCA5FA-5DBB-45a2-B558-1755C3F6253B} - C:\Program Files\Winamp Toolbar\winamptb.dll
    R3 - URLSearchHook: SweetIM ToolbarURLSearchHook Class - {EEE6C35D-6118-11DC-9C72-001320C79847} - C:\Program Files\SweetIM\Toolbars\Internet Explorer\mgHelper.dll (file missing)
    O1 - Hosts: ::1 localhost
    O2 - BHO: HP Print Clips - {053F9267-DC04-4294-A72C-58F732D338C0} - C:\Program Files\HP\Smart Web Printing\hpswp_framework.dll
    O2 - BHO: Adobe PDF Reader -linkkiavustaja - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
    O2 - BHO: Winamp Toolbar Loader - {25CEE8EC-5730-41bc-8B58-22DDC8AB8C20} - C:\Program Files\Winamp Toolbar\winamptb.dll
    O2 - BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll
    O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
    O2 - BHO: Windows Liven kirjautumisapuohjelma - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
    O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
    O2 - BHO: Live TV Toolbar - {b69a9db4-d0a1-4722-b56b-f20757a29cdf} - C:\Program Files\Live_TV\tbLiv0.dll
    O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
    O2 - BHO: SWEETIE - {EEE6C35C-6118-11DC-9C72-001320C79847} - C:\Program Files\SweetIM\Toolbars\Internet Explorer\mgToolbarIE.dll (file missing)
    O3 - Toolbar: MSN-työkalurivi - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Toolbar\01.01.1601.0\fi\msntb.dll
    O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
    O3 - Toolbar: SweetIM Toolbar for Internet Explorer - {EEE6C35B-6118-11DC-9C72-001320C79847} - C:\Program Files\SweetIM\Toolbars\Internet Explorer\mgToolbarIE.dll (file missing)
    O3 - Toolbar: Live TV Toolbar - {b69a9db4-d0a1-4722-b56b-f20757a29cdf} - C:\Program Files\Live_TV\tbLiv0.dll
    O3 - Toolbar: BS.Player ControlBar - {2C688203-7EB3-4327-9995-1CB417BA23F9} - C:\Program Files\BS.Player ControlBar\BSToolbar.dll
    O3 - Toolbar: Winamp Toolbar - {EBF2BA02-9094-4c5a-858B-BB198F3D8DE2} - C:\Program Files\Winamp Toolbar\winamptb.dll
    O4 - HKLM\..\Run: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide
    O4 - HKLM\..\Run: [RtHDVCpl] RtHDVCpl.exe
    O4 - HKLM\..\Run: [SMSERIAL] C:\Program Files\Motorola\SMSERIAL\sm56hlpr.exe
    O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe
    O4 - HKLM\..\Run: [Norman ZANDA] "C:\Program Files\Norman\Npm\bin\ZLH.EXE" /LOAD /SPLASH
    O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
    O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
    O4 - HKLM\..\Run: [MyWebSearch Plugin] rundll32 C:\PROGRA~1\MYWEBS~1\bar\1.bin\M3PLUGIN.DLL,UPF
    O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
    O4 - HKLM\..\Run: [tvjbmonitor] G:\Muuta\Karon TV\tvjbMonitor.exe
    O4 - HKCU\..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun
    O4 - HKCU\..\Run: [StartCCC] c:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe
    O4 - HKCU\..\Run: [ehTray.exe] C:\Windows\ehome\ehTray.exe
    O4 - HKCU\..\Run: [Google Update] "C:\Users\Aksun\AppData\Local\Google\Update\Googl eUpdate.exe" /c
    O4 - HKCU\..\Run: [AdobeUpdater] C:\Program Files\Common Files\Adobe\Updater5\AdobeUpdater.exe
    O4 - HKCU\..\Run: [Orb] "C:\Program Files\Winamp Remote\bin\OrbTray.exe" /background
    O4 - HKCU\..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe
    O4 - Startup: OneNote 2007 -näyttöleikkeet ja Launcher.lnk = C:\Program Files\Microsoft Office\Office12\ONENOTEM.EXE
    O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
    O8 - Extra context menu item: &Winamp Search - C:\ProgramData\Winamp Toolbar\ieToolbar\resources\en-US\local\search.html
    O8 - Extra context menu item: V&ie Microsoft Exceliin - res://C:\PROGRA~1\MICROS~3\Office12\EXCEL.EXE/3000
    O9 - Extra button: Lähetä OneNoteen - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~3\Office12\ONBttnIE.dll
    O9 - Extra 'Tools' menuitem: Läh&etä OneNoteen - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~3\Office12\ONBttnIE.dll
    O9 - Extra button: HP-leikekirja - {58ECB495-38F0-49cb-A538-10282ABF65E7} - C:\Program Files\HP\Smart Web Printing\hpswp_extensions.dll
    O9 - Extra button: HP Smart -valitse - {700259D7-1666-479a-93B1-3250410481E8} - C:\Program Files\HP\Smart Web Printing\hpswp_extensions.dll
    O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\Office12\REFIEBAR.DLL
    O10 - Unknown file in Winsock LSP: c:\windows\system32\wpclsp.dll
    O10 - Unknown file in Winsock LSP: c:\windows\system32\wpclsp.dll
    O10 - Unknown file in Winsock LSP: c:\windows\system32\wpclsp.dll
    O10 - Unknown file in Winsock LSP: c:\windows\system32\wpclsp.dll
    O10 - Unknown file in Winsock LSP: c:\windows\system32\wpclsp.dll
    O10 - Unknown file in Winsock LSP: c:\windows\system32\wpclsp.dll
    O10 - Unknown file in Winsock LSP: c:\windows\system32\wpclsp.dll
    O10 - Unknown file in Winsock LSP: c:\windows\system32\wpclsp.dll
    O10 - Unknown file in Winsock LSP: c:\windows\system32\wpclsp.dll
    O13 - Gopher Prefix:
    O16 - DPF: {83AFB5CA-ED35-11D4-A452-0080C8D85045} (GameDesire Poker Games) - http://67.15.101.33/g_bin/eng/poker_2_0_0_49.cab
    O17 - HKLM\System\CCS\Services\Tcpip\..\{C33C1471-D664-46 5B-8D7D-3350E9C9261D}: NameServer = 195.197.54.100 195.74.0.47
    O23 - Service: Ati External Event Utility - ATI Technologies Inc. - C:\Windows\system32\Ati2evxx.exe
    O23 - Service: Norman eLogger service 6 (eLoggerSvc6) - Norman ASA - C:\Program Files\Norman\Npm\bin\ELOGSVC.EXE
    O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe
    O23 - Service: Norman NJeeves - Norman ASA - C:\Program Files\Norman\Npm\bin\NJEEVES.EXE
    O23 - Service: Norman ZANDA - Norman ASA - C:\Program Files\Norman\Npm\Bin\Zanda.exe
    O23 - Service: Norman Scanner Engine Service (nsesvc) - Norman ASA - C:\Program Files\Norman\nse\bin\NSESVC.EXE
    O23 - Service: Norman Virus Control on-access component (nvcoas) - Norman ASA - C:\Program Files\Norman\Nvc\bin\nvcoas.exe
    O23 - Service: Norman Virus Control Scheduler (NVCScheduler) - Norman ASA - C:\Program Files\Norman\Nvc\BIN\NVCSCHED.EXE
    O23 - Service: PnkBstrA - Unknown owner - C:\Windows\system32\PnkBstrA.exe
    O23 - Service: Fujitsu Siemens Computers Diagnostic Testhandler (TestHandler) - Fujitsu Siemens Computers - C:\firststeps\OnlineDiagnostic\TestManager\TestHandle r.exe
     
    Aleksi321, Jan 21, 2009
    #1
  2. Hujo

    Hujo Guest

    scannaa hjt:llä merkkaa paina Fix checked

    R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://home.sweetim.com
    R3 - URLSearchHook: SweetIM ToolbarURLSearchHook Class - {EEE6C35D-6118-11DC-9C72-001320C79847} - C:\Program Files\SweetIM\Toolbars\Internet Explorer\mgHelper.dll (file missing)
    O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
    O2 - BHO: SWEETIE - {EEE6C35C-6118-11DC-9C72-001320C79847} - C:\Program Files\SweetIM\Toolbars\Internet Explorer\mgToolbarIE.dll (file missing)
    O3 - Toolbar: SweetIM Toolbar for Internet Explorer - {EEE6C35B-6118-11DC-9C72-001320C79847} - C:\Program Files\SweetIM\Toolbars\Internet Explorer\mgToolbarIE.dll (file missing)
    O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
    O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
    O4 - HKLM\..\Run: [MyWebSearch Plugin] rundll32 C:\PROGRA~1\MYWEBS~1\bar\1.bin\M3PLUGIN.DLL,UPF
    O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
    O4 - HKCU\..\Run: [Google Update] "C:\Users\Aksun\AppData\Local\Google\Update\Googl eUpdate.exe" /c
    O4 - HKCU\..\Run: [AdobeUpdater] C:\Program Files\Common Files\Adobe\Updater5\AdobeUpdater.exe

    Poista kansio

    C:\Program Files\SweetIM

    ==============

    Lataa Malwarebytes' Anti-Malware työpöydällesi.

    1. Tuplaklikkaa mbam-setup.exe ja seuraa ohjeita asentaaksesi ohjelman.
    2. Lopuksi varmistu, että seuraavat on valittu: Update Malwarebytes', Anti-Malwareja
    Launch Malwarebytes' Anti-Malware ja sen jälkeen klikkaaFinish.
    3. Jos päivitys löytyy. ohjelma lataa ja asentaa uusimman version.
    4. Kun ohjelma on latautunut, valitse Perform full scan ja klikkaa Scan.
    5. Kun skanni on valmis, klikkaa OK ja sitten Show Results nähdäksesi tulokset.
    6. Varmistu, että kaikki on merkitty ja klikkaa Remove Selected.
    7. Tämän jälkeen loki avautuu muistioon. Tallenna se paikkaan, josta löydät sen helposti. Loki
    löytyy myös täältä: C:\Documents and Settings\Käyttäjänimi\Application
    Data\Malwarebytes\Malwarebytes' Anti-Malware\Logs\log-päiväys.txt
    8. Lähetä lokin sisältö seuraavassa viestissäsi
     
    Hujo, Jan 21, 2009
    #2
  3. Aleksi321

    Aleksi321 Guest

    Malwaren logi:

    Malwarebytes' Anti-Malware 1.33
    Tietokantaversio: 1675
    Windows 6.0.6000

    21.1.2009 23:49:17
    mbam-log-2009-01-21 (23-49-17).txt

    Tarkistustyyppi: Täysi tarkistus (C:\|D:\|E:\|F:\|G:\|)
    Tarkistetut kohteet: 194548
    Kulunut aika: 2 hour(s), 25 minute(s), 43 second(s)

    Saastuneita muistiprosesseja: 0
    Saastuneita muistimoduuleja: 0
    Saastuneita rekisteriavaimia: 8
    Saastuneita rekisteriarvoja: 5
    Saastuneita rekisterikohteita: 0
    Saastuneita hakemistoja: 4
    Saastuneita tiedostoja: 5

    Saastuneita muistiprosesseja:
    (Haitallisia kohteita ei löydetty)

    Saastuneita muistimoduuleja:
    (Haitallisia kohteita ei löydetty)

    Saastuneita rekisteriavaimia:
    HKEY_CLASSES_ROOT\Interface\{cf54be1c-9359-4395-8533-1657cf209cfe} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
    HKEY_CLASSES_ROOT\CLSID\{b69a9db4-d0a1-4722-b56b-f20757a29cdf} (Adware.Agent) -> Quarantined and deleted successfully.
    HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{b69a9db4-d0a1-4722-b56b-f20757a29cdf} (Adware.Agent) -> Quarantined and deleted successfully.
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{b69a9db4-d0a1-4722-b56b-f20757a29cdf} (Adware.Agent) -> Quarantined and deleted successfully.
    HKEY_CLASSES_ROOT\CLSID\{147a976f-eee1-4377-8ea7-4716e4cdd239} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
    HKEY_CLASSES_ROOT\Typelib\{d518921a-4a03-425e-9873-b9a71756821e} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
    HKEY_LOCAL_MACHINE\SOFTWARE\Live_TV (Adware.Agent) -> Quarantined and deleted successfully.
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Live_TV Toolbar (Adware.Agent) -> Quarantined and deleted successfully.

    Saastuneita rekisteriarvoja:
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar\{b69a9db4-d0a1-4722-b56b-f20757a29cdf} (Adware.Agent) -> Quarantined and deleted successfully.
    HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\URLSearchHooks\{b69a9db4-d0a1-4722-b56b-f20757a29cdf} (Adware.Agent) -> Quarantined and deleted successfully.
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\URLSearchHooks\{b69a9db4-d0a1-4722-b56b-f20757a29cdf} (Adware.Agent) -> Quarantined and deleted successfully.
    HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Toolbar\WebBrowser\{b69a9db4-d0a1-4722-b56b-f20757a29cdf} (Adware.Agent) -> Quarantined and deleted successfully.
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\MyWebSearch Plugin (Adware.MyWebSearch) -> Quarantined and deleted successfully.

    Saastuneita rekisterikohteita:
    (Haitallisia kohteita ei löydetty)

    Saastuneita hakemistoja:
    C:\Program Files\Live_TV (Adware.Agent) -> Quarantined and deleted successfully.
    C:\Program Files\FunWebProducts (Adware.MyWebSearch) -> Quarantined and deleted successfully.
    C:\Program Files\FunWebProducts\ScreenSaver (Adware.MyWebSearch) -> Quarantined and deleted successfully.
    C:\Program Files\FunWebProducts\ScreenSaver\Images (Adware.MyWebSearch) -> Quarantined and deleted successfully.

    Saastuneita tiedostoja:
    C:\Program Files\Live_TV\tbLiv0.dll (Adware.Agent) -> Quarantined and deleted successfully.
    C:\Program Files\Live_TV\INSTALL.LOG (Adware.Agent) -> Quarantined and deleted successfully.
    C:\Program Files\Live_TV\tbLive.dll (Adware.Agent) -> Quarantined and deleted successfully.
    C:\Program Files\Live_TV\toolbar.cfg (Adware.Agent) -> Quarantined and deleted successfully.
    C:\Program Files\Live_TV\UNWISE.EXE (Adware.Agent) -> Quarantined and deleted successfully.
     
    Aleksi321, Jan 22, 2009
    #3
  4. Hujo

    Hujo Guest

    1.Lataa Combofix.exe työpöydällesi yhdestä linkistä:
    Combofix1
    Combofix2

    älä asenna palautus consolia
    2. Tuplaklikkaa Combofix.exe tiedostoa ja seuraa ohjeistuksia.
    3. Kun työkalu on valmis, se tuottaa lokin. Lähetä tämä loki viesti ketjuusi.
    Huom! Älä klikkaile combofixin ikkunaa käytön aikana. Tämä saattaa aiheuttaa ohjelman jumiutumisen.
     
    Hujo, Jan 22, 2009
    #4
  5. Aleksi321

    Aleksi321 Guest

    ComboFixin loki:

    ComboFix 09-01-21.04 - Lamminaho 23.01.2009 7:45:22.1 - NTFSx86
    Microsoft® Windows Vista™ Home Premium 6.0.6000.0.1252.1.1035.18.1918.1207 [GMT 2:00]
    Sijainti: c:\users\Aksun\Desktop\ComboFix.exe
    AV: Norman Virus Control ver. 5.99 *On-access scanning disabled* (Updated)
    * Uusi palautuspiste luotu
    .

    (((((((((((((((((((((((((((((((((((((( Muut poistot ))))))))))))))))))))))))))))))))))))))))))))))))))))))))
    .

    c:\windows\system32\AutoRun.inf

    .
    ((((( Tiedostot, jotka on luotu seuraavalla aikavälillä: 2008-12-23 to 2009-01-23 )))))))))))))))))
    .

    2009-01-22 21:07 . 22.01.2009 21:07 <KANSIO> d-------- c:\users\Aksun\AppData\Roaming\Malwarebytes
    2009-01-21 21:15 . 21.01.2009 21:15 <KANSIO> d-------- c:\users\Lamminaho\AppData\Roaming\Malwarebytes
    2009-01-21 21:15 . 21.01.2009 21:15 <KANSIO> d-------- c:\users\All Users\Malwarebytes
    2009-01-21 21:15 . 21.01.2009 21:15 <KANSIO> d-------- c:\programdata\Malwarebytes
    2009-01-21 21:15 . 14.01.2009 16:11 38,496 --a------ c:\windows\System32\drivers\mbamswissarmy.sys
    2009-01-21 21:15 . 14.01.2009 16:11 15,504 --a------ c:\windows\System32\drivers\mbam.sys
    2009-01-18 20:25 . 18.01.2009 20:25 <KANSIO> d-------- c:\users\Lamminaho\AppData\Roaming\Lyrik
    2009-01-18 19:54 . 19.01.2009 18:36 <KANSIO> d-------- c:\users\Lamminaho\AppData\Roaming\foobar2000
    2009-01-18 17:38 . 18.01.2009 17:38 <KANSIO> d-------- c:\users\Aksun\AppData\Roaming\Ahead
    2009-01-18 15:25 . 01.12.2006 16:46 151,552 --a------ c:\windows\System32\MPEG2VideoDMO.dll
    2009-01-17 12:52 . 17.01.2009 12:53 <KANSIO> d-------- c:\users\Lamminaho\AppData\Roaming\Winamp
    2009-01-17 12:14 . 10.05.2008 05:30 858,112 --a------ c:\windows\System32\RacEngn.dll
    2009-01-17 12:14 . 03.09.2008 05:56 465,408 --a------ c:\windows\System32\newdev.dll
    2009-01-17 12:14 . 03.09.2008 05:56 74,752 --a------ c:\windows\System32\newdev.exe
    2009-01-17 12:14 . 10.05.2008 00:22 8,830 --a------ c:\windows\System32\RacUR.xml
    2009-01-17 12:14 . 10.05.2008 00:22 153 --a------ c:\windows\System32\RacUREx.xml
    2009-01-16 22:04 . 16.01.2009 22:04 <KANSIO> d-------- c:\users\All Users\Lyrik
    2009-01-16 22:04 . 16.01.2009 22:04 <KANSIO> d-------- c:\users\Aksun\AppData\Roaming\Lyrik
    2009-01-16 22:04 . 16.01.2009 22:04 <KANSIO> d-------- c:\programdata\Lyrik
    2009-01-16 22:04 . 10.09.2008 12:05 139,264 --a------ c:\windows\System32\sunitext.ocx
    2009-01-16 22:04 . 24.06.1998 01:00 108,336 --a------ c:\windows\System32\MSWINSCK.OCX
    2009-01-16 21:55 . 16.01.2009 21:55 <KANSIO> d-------- c:\users\All Users\Winamp Toolbar
    2009-01-16 21:55 . 16.01.2009 21:57 <KANSIO> d-------- c:\users\All Users\OrbNetworks
    2009-01-16 21:55 . 16.01.2009 21:55 <KANSIO> d-------- c:\programdata\Winamp Toolbar
    2009-01-16 21:55 . 16.01.2009 21:57 <KANSIO> d-------- c:\programdata\OrbNetworks
    2009-01-16 21:55 . 16.01.2009 21:55 <KANSIO> d-------- c:\program files\Winamp Toolbar
    2009-01-16 21:55 . 16.01.2009 21:55 <KANSIO> d-------- c:\program files\Winamp Remote
    2009-01-16 21:32 . 17.01.2009 13:07 <KANSIO> d-------- c:\users\Aksun\AppData\Roaming\Winamp
    2009-01-16 21:32 . 08.03.2007 01:51 129,784 --------- c:\windows\System32\pxafs.dll
    2009-01-14 16:33 . 16.12.2008 05:14 290,304 --a------ c:\windows\System32\drivers\srv.sys
    2009-01-11 15:13 . 11.01.2009 15:51 <KANSIO> d-------- c:\users\Lamminaho\AppData\Roaming\LimeWire
    2008-12-30 18:24 . 30.12.2008 18:24 <KANSIO> d-------- c:\users\Aksun\AppData\Roaming\Vidalia
    2008-12-30 18:02 . 20.01.2009 19:04 <KANSIO> d-------- c:\users\Aksun\AppData\Roaming\uTorrent
    2008-12-30 16:14 . 30.12.2008 18:34 <KANSIO> d-------- c:\users\Lamminaho\AppData\Roaming\Vidalia
    2008-12-28 19:22 . 28.12.2008 19:22 <KANSIO> d-------- c:\users\Lamminaho\AppData\Roaming\BSplayer Pro
    2008-12-28 19:22 . 29.12.2008 21:16 <KANSIO> d-------- c:\users\Lamminaho\AppData\Roaming\BSplayer
    2008-12-28 19:22 . 28.12.2008 19:22 <KANSIO> d-------- c:\users\Aksun\AppData\Roaming\dvdcss
    2008-12-28 19:22 . 28.12.2008 19:22 <KANSIO> d-------- c:\program files\BS.Player ControlBar
    2008-12-28 16:01 . 28.12.2008 16:01 <KANSIO> d-------- c:\program files\Conduit
    2008-12-26 22:06 . 20.01.2009 20:18 <KANSIO> d-------- c:\users\Aksun\AppData\Roaming\LimeWire
    2008-12-25 21:53 . 25.12.2008 21:53 <KANSIO> d-------- c:\program files\Opera
    2008-12-25 15:56 . 25.12.2008 15:56 <KANSIO> d-------- c:\program files\GameSpy Arcade
    2008-12-25 11:45 . 25.12.2008 11:45 <KANSIO> d-------- c:\users\Lamminaho\AppData\Roaming\GRETECH
    2008-12-23 16:15 . 09.01.2009 18:57 31 --a------ c:\users\Aksun\jagex_runescape_preferences.dat

    .
    (((((((((((((((((((((((((((((((((((( Find3M-raportti ))))))))))))))))))))))))))))))))))))))))))))))))))))))
    .
    2009-01-23 05:05 --------- d-----w c:\program files\Norman
    2009-01-22 19:56 --------- d-----w c:\users\Aksun\AppData\Roaming\X-Chat 2
    2009-01-19 17:21 --------- d-----w c:\users\Aksun\AppData\Roaming\foobar2000
    2009-01-18 13:25 --------- d--h--w c:\program files\InstallShield Installation Information
    2009-01-17 15:23 720 ----a-w c:\users\Aksun\AppData\Roaming\wklnhst.dat
    2009-01-16 18:12 --------- d-----w c:\programdata\WLInstaller
    2009-01-16 16:00 --------- d-----w c:\program files\Norton Security Scan
    2009-01-16 16:00 --------- d-----w c:\program files\Common Files\Symantec Shared
    2009-01-14 20:01 --------- d-----w c:\program files\Windows Mail
    2009-01-09 15:46 31 ----a-w c:\users\Lamminaho\jagex_runescape_preferences.dat
    2009-01-05 17:16 --------- d-----w c:\users\Lamminaho\AppData\Roaming\X-Chat 2
    2008-12-30 13:10 --------- d-----w c:\users\Aksun\AppData\Roaming\gtk-2.0
    2008-12-25 21:11 --------- d-----w c:\program files\OpenOffice.org 3
    2008-12-25 13:55 --------- d-----w c:\program files\Microsoft Games
    2008-12-25 10:26 --------- d-----w c:\program files\EA SPORTS
    2008-12-25 09:56 --------- d-----w c:\users\Lamminaho\AppData\Roaming\mIRC
    2008-12-22 15:42 --------- d-----w c:\users\Aksun\AppData\Roaming\BSplayer
    2008-12-22 15:25 --------- d-----w c:\users\Aksun\AppData\Roaming\GRETECH
    2008-12-20 13:27 --------- d-----w c:\program files\Common Files\Adobe
    2008-12-14 13:17 410,984 ----a-w c:\windows\System32\deploytk.dll
    2008-12-14 13:16 --------- d-----w c:\program files\Java
    2008-12-12 16:36 --------- d-----w c:\programdata\Microsoft Help
    2008-12-10 13:54 174 --sha-w c:\program files\desktop.ini
    2008-12-09 16:51 --------- d-----w c:\program files\Windows Live Safety Center
    2008-11-29 18:53 --------- d-----w c:\users\Aksun\AppData\Roaming\HP
    2008-11-29 11:58 --------- d-----w c:\programdata\Symantec
    2008-11-01 03:33 537,600 ----a-w c:\windows\AppPatch\AcLayers.dll
    2008-11-01 03:33 52,736 ----a-w c:\windows\AppPatch\iebrshim.dll
    2008-11-01 03:33 449,536 ----a-w c:\windows\AppPatch\AcSpecfc.dll
    2008-11-01 03:33 28,672 ----a-w c:\windows\System32\Apphlpdm.dll
    2008-11-01 03:33 2,144,256 ----a-w c:\windows\AppPatch\AcGenral.dll
    2008-11-01 03:33 173,056 ----a-w c:\windows\AppPatch\AcXtrnal.dll
    2008-11-01 03:33 1,687,040 ----a-w c:\windows\System32\gameux.dll
    2008-10-31 23:38 4,247,552 ----a-w c:\windows\System32\GameUXLegacyGDFs.dll
    2008-10-31 23:23 2,560 ----a-w c:\windows\AppPatch\AcRes.dll
    2008-10-29 06:20 2,923,520 ----a-w c:\windows\explorer.exe
    2008-04-14 16:24 728 ----a-w c:\users\Lamminaho\AppData\Roaming\wklnhst.dat
    2008-07-23 09:16 16,384 --sha-w c:\windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat
    2008-07-23 09:16 32,768 --sha-w c:\windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat
    2008-07-23 09:16 16,384 --sha-w c:\windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Cookies\index.dat
    .

    (((((((((((((((((((((((((((((( Rekisterin käynnistyskohteet )))))))))))))))))))))))))))))))))))))))))))))
    .
    .
    *Huom* Tyhjiä arvoja ja laillisia oletusarvoja ei näytetä
    REGEDIT4

    [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "Sidebar"="c:\program files\Windows Sidebar\sidebar.exe" [09.01.2008 18:46 1232896]
    "StartCCC"="c:\program files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [10.11.2006 21:35 90112]
    "ehTray.exe"="c:\windows\ehome\ehTray.exe" [02.11.2006 14:35 125440]
    "swg"="c:\program files\Google\GoogleToolbarNotifier\1.2.908.8472\GoogleToolbarNotifier.exe" [18.07.2008 11:30 165304]
    "WMPNSCFG"="c:\program files\Windows Media Player\WMPNSCFG.exe" [02.11.2006 14:36 201728]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "SMSERIAL"="c:\program files\Motorola\SMSERIAL\sm56hlpr.exe" [22.11.2006 18:31 630784]
    "NeroFilterCheck"="c:\program files\Common Files\Ahead\Lib\NeroCheck.exe" [26.02.2007 20:46 153136]
    "Norman ZANDA"="c:\program files\Norman\Npm\bin\ZLH.EXE" [02.06.2008 13:46 273520]
    "SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [14.12.2008 15:17 136600]
    "HP Software Update"="c:\program files\HP\HP Software Update\HPWuSchd2.exe" [11.03.2007 21:34 49152]
    "Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [15.10.2008 01:04 39792]
    "tvjbmonitor"="g:\muuta\Karon TV\tvjbMonitor.exe" [26.12.2006 17:08 53248]
    "RtHDVCpl"="RtHDVCpl.exe" [10.04.2007 16:01 4431872 c:\windows\RtHDVCpl.exe]

    c:\users\Lamminaho\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
    OneNote 2007 -n„ytt”leikkeet ja Launcher.lnk - c:\program files\Microsoft Office\Office12\ONENOTEM.EXE [2007-12-07 101440]
    wkcalrem.LNK - c:\program files\Common Files\microsoft shared\Works Shared\WkCalRem.exe [2005-08-19 21504]

    c:\users\Aksun\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
    OneNote 2007 -n„ytt”leikkeet ja Launcher.lnk - c:\program files\Microsoft Office\Office12\ONENOTEM.EXE [2007-12-07 101440]

    c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
    HP Digital Imaging Monitor.lnk - c:\program files\HP\Digital Imaging\bin\hpqtra08.exe [2007-03-11 210520]

    [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
    "vidc.dvsd"= pdvcodec.dll
    "msacm.divxa32"= msaud32_divx.acm

    [HKLM\~\services\sharedaccess\parameters\firewallpolicy\FirewallRules]
    "{6CC88650-53D2-434E-AEAE-7169045F159D}"= UDP:c:\program files\Microsoft Office\Office12\ONENOTE.EXE:Microsoft Office OneNote
    "{D9F0A7DF-E790-4287-B2B4-E0E5DDC69201}"= TCP:c:\program files\Microsoft Office\Office12\ONENOTE.EXE:Microsoft Office OneNote
    "{D93ADF38-AE8B-4C99-8C16-EB02533CA035}"= UDP:c:\program files\Norman\NVC\bin\Nvcut.exe:Apuohjelmat
    "{6350CF68-929A-4CFD-825C-DC6125F014F1}"= TCP:c:\program files\Norman\NVC\bin\Nvcut.exe:Apuohjelmat
    "{62A5CCE5-23A0-4780-B72F-6D82FD574A32}"= UDP:c:\program files\MSN Messenger\msnmsgr.exe:MSN Messenger 6.2
    "{DA30A97E-5DE2-44FE-B8E3-299BA0CC0D4B}"= TCP:c:\program files\MSN Messenger\msnmsgr.exe:MSN Messenger 6.2
    "{15F384FD-F121-42D1-A53F-884B512AFBC2}"= UDP:c:\program files\MSN Messenger\msnmsgr.exe:MSN Messenger 6.2
    "{2016B760-A24C-4B17-B1E8-A77C8DD08E17}"= TCP:c:\program files\MSN Messenger\msnmsgr.exe:MSN Messenger 6.2
    "{2A2F158D-A475-4FD6-9116-CAA5A32C66CD}"= c:\program files\Windows Live\Messenger\livecall.exe:Windows Live Messenger (Phone)
    "TCP Query User{FF44BCD9-C592-442C-ADC3-09A979E2376D}c:\\program files\\internet explorer\\iexplore.exe"= UDP:c:\program files\internet explorer\iexplore.exe:Internet Explorer
    "UDP Query User{A203CA7F-7990-41AD-B87E-CE0CA3B69E19}c:\\program files\\internet explorer\\iexplore.exe"= TCP:c:\program files\internet explorer\iexplore.exe:Internet Explorer
    "{96D853C9-4927-4FF1-B969-7C72DA19BE6C}"= UDP:c:\program files\Windows Live\Messenger\msnmsgr.exe:Windows Live Messenger
    "{7CCD2815-BFA2-4540-AFCA-F0CFB4A05410}"= TCP:c:\program files\Windows Live\Messenger\msnmsgr.exe:Windows Live Messenger
    "TCP Query User{559F064E-CB10-407A-8866-8C86C50B5206}c:\\program files\\internet explorer\\iexplore.exe"= UDP:c:\program files\internet explorer\iexplore.exe:Internet Explorer
    "UDP Query User{F05982A9-DC6F-4898-804A-B8415F19ED87}c:\\program files\\internet explorer\\iexplore.exe"= TCP:c:\program files\internet explorer\iexplore.exe:Internet Explorer
    "TCP Query User{B4073C50-9528-4E51-B49B-2C4AF65361BE}c:\\program files\\mozilla firefox\\firefox.exe"= UDP:c:\program files\mozilla firefox\firefox.exe:Firefox
    "UDP Query User{F37BA870-2FDA-4F47-996F-0B933A3B8279}c:\\program files\\mozilla firefox\\firefox.exe"= TCP:c:\program files\mozilla firefox\firefox.exe:Firefox
    "TCP Query User{64583F97-15F9-49D8-8434-08221AF497B6}c:\\windows\\system32\\java.exe"= UDP:c:\windows\system32\java.exe:Java(TM) Platform SE binary
    "UDP Query User{5DF56AD9-A994-465D-A3A9-1C78045B9DBA}c:\\windows\\system32\\java.exe"= TCP:c:\windows\system32\java.exe:Java(TM) Platform SE binary
    "TCP Query User{430831A2-CCD4-49B1-B633-DB907E44235D}c:\\program files\\wolfenstein - enemy territory\\et.exe"= UDP:c:\program files\wolfenstein - enemy territory\et.exe:ET
    "UDP Query User{0E25855B-438A-4488-AEDB-693E19ADFA02}c:\\program files\\wolfenstein - enemy territory\\et.exe"= TCP:c:\program files\wolfenstein - enemy territory\et.exe:ET
    "TCP Query User{590C0D07-2D23-4F91-9978-152D239AFC8C}c:\\program files\\ea sports\\nhl 2005\\nhl2005.exe"= UDP:c:\program files\ea sports\nhl 2005\nhl2005.exe:nhl2005
    "UDP Query User{889519C6-F51B-411F-A6CB-D9000FC04F8C}c:\\program files\\ea sports\\nhl 2005\\nhl2005.exe"= TCP:c:\program files\ea sports\nhl 2005\nhl2005.exe:nhl2005
    "TCP Query User{93E029D4-1A23-4AA6-8AA5-1FE1936CF86B}c:\\program files\\mirc\\mirc.exe"= UDP:c:\program files\mirc\mirc.exe:mIRC
    "UDP Query User{DA43561B-1EB2-4FA1-BB2D-A95AA9FD7E3E}c:\\program files\\mirc\\mirc.exe"= TCP:c:\program files\mirc\mirc.exe:mIRC
    "TCP Query User{060D4BD7-BEDA-4B99-A02D-D60FAD4E2239}c:\\program files\\nokia\\nokia software updater\\nsu_ui_client.exe"= UDP:c:\program files\nokia\nokia software updater\nsu_ui_client.exe:Nokia Software Updater
    "UDP Query User{80C0F71D-9895-4DD4-BFB1-70A4F2E63FF0}c:\\program files\\nokia\\nokia software updater\\nsu_ui_client.exe"= TCP:c:\program files\nokia\nokia software updater\nsu_ui_client.exe:Nokia Software Updater
    "TCP Query User{CD3672FC-26CD-4AF7-B8AE-56ABD778A947}c:\\program files\\common files\\nokia\\service layer\\a\\nsl_host_process.exe"= UDP:c:\program files\common files\nokia\service layer\a\nsl_host_process.exe:Nokia Service Layer Host Process
    "UDP Query User{692F2152-EDAD-4D4C-80F7-B3C5A50C75E6}c:\\program files\\common files\\nokia\\service layer\\a\\nsl_host_process.exe"= TCP:c:\program files\common files\nokia\service layer\a\nsl_host_process.exe:Nokia Service Layer Host Process
    "TCP Query User{DCA36E3E-7B52-4A1F-ADC5-9D21E1662679}c:\\program files\\x-chat 2\\xchat.exe"= UDP:c:\program files\x-chat 2\xchat.exe:xchat
    "UDP Query User{068D94C1-4A48-44BE-92BD-707734081B97}c:\\program files\\x-chat 2\\xchat.exe"= TCP:c:\program files\x-chat 2\xchat.exe:xchat
    "{A464D637-B74F-45B1-9804-4D2B3CDDEC8B}"= UDP:4360:Klassikot
    "{39B348DB-F67C-4C64-8698-9E9974C1754E}"= UDP:4450:Muut yksinpelit
    "{E1BA94D6-B007-4058-B413-2E3CA913C58F}"= UDP:4500:Korttipelit
    "{A6F4BEF0-3BB4-4D0A-96C6-1B7D9F45ECF3}"= UDP:4350:Minigolf
    "TCP Query User{CC54857C-0C82-4748-88B0-392AA86AE11B}c:\\program files\\opera\\opera.exe"= UDP:c:\program files\opera\opera.exe:Opera Internet Browser
    "UDP Query User{A79C3846-2B17-4456-AEE1-EE9F5846ED81}c:\\program files\\opera\\opera.exe"= TCP:c:\program files\opera\opera.exe:Opera Internet Browser
    "TCP Query User{477CE136-63A8-442F-959F-18834AAF4FB5}c:\\program files\\java\\jre6\\bin\\java.exe"= UDP:c:\program files\java\jre6\bin\java.exe:Java(TM) Platform SE binary
    "UDP Query User{D6DE7EB3-31FE-47BA-A5C0-E771DD597EA1}c:\\program files\\java\\jre6\\bin\\java.exe"= TCP:c:\program files\java\jre6\bin\java.exe:Java(TM) Platform SE binary
    "TCP Query User{7AE36B62-338E-4A2B-BEC5-1F7E103883E9}c:\\users\\aksun\\desktop\\xchat.exe"= UDP:c:\users\aksun\desktop\xchat.exe:xchat.exe
    "UDP Query User{B3CE7E78-A4EE-42B6-A846-1E01E4A7A849}c:\\users\\aksun\\desktop\\xchat.exe"= TCP:c:\users\aksun\desktop\xchat.exe:xchat.exe
    "TCP Query User{277E91BF-5CB2-47B6-8A90-56D4F141CE2D}c:\\program files\\microsoft games\\halo trial\\halo.exe"= UDP:c:\program files\microsoft games\halo trial\halo.exe:Halo
    "UDP Query User{C5432DD4-6D24-4844-AB1C-824B2810D40D}c:\\program files\\microsoft games\\halo trial\\halo.exe"= TCP:c:\program files\microsoft games\halo trial\halo.exe:Halo
    "TCP Query User{CC5E8351-6D6F-474F-A2E4-9D5AA69BFD0D}f:\\lataukset\\dc++\\dcplusplus.exe"= UDP:f:\lataukset\dc++\dcplusplus.exe:DC++
    "UDP Query User{24976099-EE81-45FD-8848-2A581818CDF1}f:\\lataukset\\dc++\\dcplusplus.exe"= TCP:f:\lataukset\dc++\dcplusplus.exe:DC++
    "TCP Query User{CCCDBB5E-3439-4E47-8D17-19132251C0AA}f:\\ohjelmia\\asennennetut\\dc++\\dcplusplus.exe"= UDP:f:\ohjelmia\asennennetut\dc++\dcplusplus.exe:DC++
    "UDP Query User{B8ACA32E-5887-462F-9F06-EEE9CBF67754}f:\\ohjelmia\\asennennetut\\dc++\\dcplusplus.exe"= TCP:f:\ohjelmia\asennennetut\dc++\dcplusplus.exe:DC++
    "TCP Query User{9D30F4F2-DDEE-41E9-BBD9-6156C69EFA36}f:\\ohjelmia\\dc++\\dcplusplus.exe"= UDP:f:\ohjelmia\dc++\dcplusplus.exe:DC++
    "UDP Query User{A1440078-625A-4227-ADD7-9F3ED03AE13D}f:\\ohjelmia\\dc++\\dcplusplus.exe"= TCP:f:\ohjelmia\dc++\dcplusplus.exe:DC++
    "TCP Query User{DDAA7A4C-A20D-4543-94E8-7820C038223B}f:\\ohjelmia\\dc++\\dcplusplus (2).exe"= UDP:f:\ohjelmia\dc++\dcplusplus (2).exe:DC++
    "UDP Query User{AC7BAC90-A21D-42B5-87F0-3F276DD7B6FC}f:\\ohjelmia\\dc++\\dcplusplus (2).exe"= TCP:f:\ohjelmia\dc++\dcplusplus (2).exe:DC++
    "TCP Query User{44ABC1DE-ED9A-4E76-A7BC-B8241D8891B0}f:\\ohjelmia\\xchat.exe"= UDP:f:\ohjelmia\xchat.exe:xchat
    "UDP Query User{12738921-9DE6-4622-AA94-EF9EB099CA48}f:\\ohjelmia\\xchat.exe"= TCP:f:\ohjelmia\xchat.exe:xchat
    "TCP Query User{0B82C252-DBD9-4F5D-8F35-A54D1CDB8057}g:\\ohjelmia\\dc++\\dcplusplus (2).exe"= UDP:g:\ohjelmia\dc++\dcplusplus (2).exe:DC++
    "UDP Query User{EB8BE2A6-1D48-43CA-8816-A3CBFEC2B63A}g:\\ohjelmia\\dc++\\dcplusplus (2).exe"= TCP:g:\ohjelmia\dc++\dcplusplus (2).exe:DC++
    "TCP Query User{DF680E50-3738-4E86-A59A-54C65CFDF981}g:\\lataukset\\ladatut tiedostot\\x-chat 2\\xchat.exe"= UDP:g:\lataukset\ladatut tiedostot\x-chat 2\xchat.exe:xchat
    "UDP Query User{A1898278-4F96-44B5-BE24-E274C26D075C}g:\\lataukset\\ladatut tiedostot\\x-chat 2\\xchat.exe"= TCP:g:\lataukset\ladatut tiedostot\x-chat 2\xchat.exe:xchat
    "TCP Query User{2FD323C9-CDD3-4E43-B960-E4DC7EC787EB}g:\\dc++\\dcplusplus.exe"= UDP:g:\dc++\dcplusplus.exe:DC++
    "UDP Query User{B7966988-AF23-46D4-9EA9-E0F8D3F47DBE}g:\\dc++\\dcplusplus.exe"= TCP:g:\dc++\dcplusplus.exe:DC++
    "TCP Query User{88A17301-BF5B-4469-B703-707BE402F4D2}g:\\asennustiedostot tänne!\\x-chat 2\\xchat.exe"= UDP:g:\asennustiedostot tänne!\x-chat 2\xchat.exe:xchat
    "UDP Query User{2951461D-C830-443E-BF70-7A01CD18CCE7}g:\\asennustiedostot tänne!\\x-chat 2\\xchat.exe"= TCP:g:\asennustiedostot tänne!\x-chat 2\xchat.exe:xchat
    "TCP Query User{E636CCE3-5A99-46DD-B155-3CB0DE2C3714}g:\\ohjelmia\\asennennetut\\dc++\\dcplusplus.exe"= UDP:g:\ohjelmia\asennennetut\dc++\dcplusplus.exe:DC++
    "UDP Query User{9B7E9380-7423-407B-A8FF-C050365C5392}g:\\ohjelmia\\asennennetut\\dc++\\dcplusplus.exe"= TCP:g:\ohjelmia\asennennetut\dc++\dcplusplus.exe:DC++
    "TCP Query User{8154B015-E91A-4CC5-92B9-547BA1D2C8C7}g:\\waret\\dc++\\dcplusplus.exe"= UDP:g:\waret\dc++\dcplusplus.exe:DC++
    "UDP Query User{5FDD0FC6-42A6-437B-9FF6-C64C3BD3FA1A}g:\\waret\\dc++\\dcplusplus.exe"= TCP:g:\waret\dc++\dcplusplus.exe:DC++
    "TCP Query User{1F290B02-38B0-42A1-BF76-9FBD60EE415D}c:\\users\\aksun\\desktop\\dc++\\dcplusplus.exe"= UDP:c:\users\aksun\desktop\dc++\dcplusplus.exe:dcplusplus.exe
    "UDP Query User{C12827CD-BE0E-4E99-B69D-54B88F68456E}c:\\users\\aksun\\desktop\\dc++\\dcplusplus.exe"= TCP:c:\users\aksun\desktop\dc++\dcplusplus.exe:dcplusplus.exe
    "TCP Query User{E933C3AA-0016-45E5-BC47-48508BB9FF67}g:\\lataukset\\utorrent.exe"= UDP:g:\lataukset\utorrent.exe:µTorrent
    "UDP Query User{1C40630D-B596-46B3-B241-9D00CBE38866}g:\\lataukset\\utorrent.exe"= TCP:g:\lataukset\utorrent.exe:µTorrent
    "TCP Query User{32FFD328-71D5-4030-AB50-437D142D09B5}g:\\lataukset\\ladatut tiedostot\\x-chat 2\\xchat.exe"= UDP:g:\lataukset\ladatut tiedostot\x-chat 2\xchat.exe:xchat
    "UDP Query User{32761F26-4FA6-4EEF-8E07-5094C6EC1A08}g:\\lataukset\\ladatut tiedostot\\x-chat 2\\xchat.exe"= TCP:g:\lataukset\ladatut tiedostot\x-chat 2\xchat.exe:xchat
    "TCP Query User{2D5267B2-ED6A-48F6-B563-48F7007E1176}c:\\users\\aksun\\desktop\\dc++\\dcplusplus.exe"= UDP:c:\users\aksun\desktop\dc++\dcplusplus.exe:dcplusplus.exe
    "UDP Query User{EB205FCF-0F56-4FEC-9CF0-2436C65F7873}c:\\users\\aksun\\desktop\\dc++\\dcplusplus.exe"= TCP:c:\users\aksun\desktop\dc++\dcplusplus.exe:dcplusplus.exe
    "TCP Query User{074C3D0C-9C0F-427D-BAC4-DEE973538C29}c:\\program files\\microsoft games\\halo trial\\halo.exe"= UDP:c:\program files\microsoft games\halo trial\halo.exe:Halo
    "UDP Query User{2790D39F-C061-4482-93CA-1991B15DC1F8}c:\\program files\\microsoft games\\halo trial\\halo.exe"= TCP:c:\program files\microsoft games\halo trial\halo.exe:Halo
    "TCP Query User{9772CCF9-75A3-4EBD-9B7A-974DC93A54E7}g:\\limewire\\limewire.exe"= UDP:g:\limewire\limewire.exe:LimeWire
    "UDP Query User{7340119D-668F-4552-96FF-EBE4102C9D7C}g:\\limewire\\limewire.exe"= TCP:g:\limewire\limewire.exe:LimeWire
    "TCP Query User{6729F5EF-C7C6-4E3B-8555-B04D3B64C504}g:\\lataukset\\utorrent.exe"= UDP:g:\lataukset\utorrent.exe:µTorrent
    "UDP Query User{EE93127B-674F-4E09-AC70-1F9CA6A4E0D4}g:\\lataukset\\utorrent.exe"= TCP:g:\lataukset\utorrent.exe:µTorrent
    "TCP Query User{7A300ECE-5033-41F1-960F-FF4C5B529B8D}g:\\propilkki2\\propilkki2.exe"= UDP:g:\propilkki2\propilkki2.exe:Main executable of PP2
    "UDP Query User{C7050B58-2530-46D8-809E-AAEAB1B34D80}g:\\propilkki2\\propilkki2.exe"= TCP:g:\propilkki2\propilkki2.exe:Main executable of PP2
    "{6A98885A-FB24-4853-BA2B-075839677D97}"= UDP:c:\program files\Winamp Remote\bin\Orb.exe:Orb
    "{60BAFF87-91DE-4101-9E16-21DF0C463732}"= TCP:c:\program files\Winamp Remote\bin\Orb.exe:Orb
    "{E6B786D5-4747-43F9-9A20-272F634C6449}"= UDP:c:\program files\Winamp Remote\bin\OrbTray.exe:OrbTray
    "{C214AD42-0152-41B6-BEA5-DE7C57DB0445}"= TCP:c:\program files\Winamp Remote\bin\OrbTray.exe:OrbTray
    "{1C275F4C-201B-4D86-980A-ADD57C2B4CDC}"= UDP:c:\program files\Winamp Remote\bin\OrbIR.exe:OrbIR
    "{7AC1D6BD-48E5-4500-AEDA-07D6C93B81DD}"= TCP:c:\program files\Winamp Remote\bin\OrbIR.exe:OrbIR
    "{E20DE17F-37F3-44FD-95BA-F3322170697C}"= UDP:c:\program files\Winamp Remote\bin\OrbStreamerClient.exe:Orb Stream Client
    "{B11C3706-2F9C-4DF7-A181-835ECFA8ACB7}"= TCP:c:\program files\Winamp Remote\bin\OrbStreamerClient.exe:Orb Stream Client
    "TCP Query User{D183A70E-BA75-437B-87BA-284DB6010E72}g:\\ohjelmia\\winamp\\winamp.exe"= UDP:g:\ohjelmia\winamp\winamp.exe:Winamp
    "UDP Query User{8EE807FD-5B8A-4847-8300-57EE0C516BBA}g:\\ohjelmia\\winamp\\winamp.exe"= TCP:g:\ohjelmia\winamp\winamp.exe:Winamp
    "TCP Query User{05E6453D-E980-409C-9C1F-E16D15023681}c:\\program files\\winamp remote\\bin\\orbtray.exe"= UDP:c:\program files\winamp remote\bin\orbtray.exe:Orb
    "UDP Query User{49846CDD-6683-4DA6-964B-3C0F09E6F094}c:\\program files\\winamp remote\\bin\\orbtray.exe"= TCP:c:\program files\winamp remote\bin\orbtray.exe:Orb
    "TCP Query User{B825DCD9-64EE-4EEF-8A99-656EF6AFD415}g:\\ohjelmia\\asennennetut\\winamp\\winamp.exe"= UDP:g:\ohjelmia\asennennetut\winamp\winamp.exe:Winamp
    "UDP Query User{9473D886-DF18-419A-A7BE-ED3FB40F5003}g:\\ohjelmia\\asennennetut\\winamp\\winamp.exe"= TCP:g:\ohjelmia\asennennetut\winamp\winamp.exe:Winamp
    "{7244DCE9-A21C-4AA4-AB87-E80D7BE644AF}"= UDP:g:\asennustiedostot tänne!\uTorrent.exe:µTorrent (TCP-In)
    "{E7A384A2-953E-47E1-BED6-E11FAA4608E7}"= TCP:g:\asennustiedostot tänne!\uTorrent.exe:µTorrent (UDP-In)

    [HKLM\~\services\sharedaccess\parameters\firewallpolicy\RestrictedServices\Static\System]
    "DFSR-1"= RPort=5722|UDP:%SystemRoot%\system32\svchost.exe|Svc=DFSR:Allow inbound TCP traffic|

    R3 nsesvc;Norman Scanner Engine Service;c:\program files\Norman\Nse\Bin\Nsesvc.exe [2008-06-29 322616]
    R3 NvcMFlt;NvcMFlt;c:\windows\System32\drivers\nvcv32mf.sys [2008-09-09 19512]
    R3 nvcoas;Norman Virus Control on-access component;c:\program files\Norman\NVC\bin\Nvcoas.exe [2008-06-29 183352]
    R3 NVCScheduler;Norman Virus Control Scheduler;c:\program files\Norman\NVC\bin\Nvcsched.exe [2008-06-29 146488]
    R4 Ndiskio;Ndiskio;c:\program files\Norman\Nse\Bin\Ndiskio.sys [2007-12-01 20448]
    S3 EC168BDA;EC168BDA service;c:\windows\System32\drivers\EC168BDA.sys [2007-10-17 107904]
    S3 nvcfsr;nvcfsr;c:\program files\Norman\NVC\bin\Nvcfsr.sys [2007-12-01 6712]
    S3 nvcoafl4;nvcoafl4;c:\program files\Norman\NVC\bin\Nvcoafl4.sys [2007-12-01 36472]
    S3 nvcoaft4;nvcoaft4;c:\program files\Norman\NVC\bin\Nvcoaft4.sys [2007-12-01 104288]
    S3 nvcoarc4;nvcoarc4;c:\program files\Norman\NVC\bin\Nvcoarc4.sys [2007-12-01 25528]

    --- Muut muistissa olevat ajurit/palvelut ---

    *Deregistered* - mchInjDrv

    [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
    HPZ12 REG_MULTI_SZ Pml Driver HPZ12 Net Driver HPZ12
    hpdevmgmt REG_MULTI_SZ hpqcxs08 hpqddsvc

    [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\F]
    \shell\AutoRun\command - F:\AutoRun.exe

    [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{0f83e0ac-5167-11dd-a110-00030d72bb5b}]
    \shell\AutoRun\command - H:\AutoRun.exe

    [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{0f83e0ae-5167-11dd-a110-00030d72bb5b}]
    \shell\AutoRun\command - H:\AutoRun.exe

    [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{1019fa40-c123-11dc-8ccd-00030d72bb5b}]
    \shell\AutoRun\command - F:\AutoRun.exe

    [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{1019fa41-c123-11dc-8ccd-00030d72bb5b}]
    \shell\AutoRun\command - F:\AutoRun.exe

    [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{aa9bb427-a5a1-11dc-ad5d-00030d72bb5b}]
    \shell\AutoRun\command - F:\AutoRun.exe

    [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{aa9bb43f-a5a1-11dc-ad5d-00030d72bb5b}]
    \shell\AutoRun\command - F:\AutoRun.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\ccc-core-static]
    msiexec /fums {C61E8F12-31F1-C2E6-DC0C-505CBF2BEE57} /qb
    .
    'Ajoitetut tehtävät'-kansion sisältö

    2009-01-21 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-3305909626-2715354323-1799598968-1004.job
    - c:\users\Aksun\AppData\Local\Google\Update\GoogleUpdate.exe [03.09.2008 15:22]

    2009-01-21 c:\windows\Tasks\Norton Security Scan for Lamminaho.job
    - c:\program files\Norton Security Scan\Nss.exe [19.09.2008 04:18]
    .
    - - - - POISTETUT JÄMÄRIVIT - - - -

    URLSearchHooks-{EEE6C35D-6118-11DC-9C72-001320C79847} - c:\program files\SweetIM\Toolbars\Internet Explorer\mgHelper.dll
    BHO-{EEE6C35C-6118-11DC-9C72-001320C79847} - c:\program files\SweetIM\Toolbars\Internet Explorer\mgToolbarIE.dll
    Toolbar-{EEE6C35B-6118-11DC-9C72-001320C79847} - c:\program files\SweetIM\Toolbars\Internet Explorer\mgToolbarIE.dll
    WebBrowser-{EEE6C35B-6118-11DC-9C72-001320C79847} - c:\program files\SweetIM\Toolbars\Internet Explorer\mgToolbarIE.dll


    .
    ------- Täydentävä tarkistus -------
    .
    uStart Page = hxxp://www.google.fi/
    mStart Page = hxxp://home.sweetim.com
    IE: V&ie Microsoft Exceliin - c:\progra~1\MICROS~3\Office12\EXCEL.EXE/3000
    LSP: c:\windows\system32\wpclsp.dll
    FF - ProfilePath - c:\users\Lamminaho\AppData\Roaming\Mozilla\Firefox\Profiles\y9qtzdgp.default\
    FF - prefs.js: browser.search.defaulturl - hxxp://search.sweetim.com/search.asp?src=2&q=
    FF - prefs.js: browser.search.selectedEngine - Google
    FF - prefs.js: browser.startup.homepage - www.google.fi
    FF - prefs.js: keyword.URL - hxxp://search.sweetim.com/search.asp?src=2&q=
    FF - plugin: c:\program files\Mozilla Firefox\plugins\np-mswmp.dll
    FF - plugin: c:\program files\Mozilla Firefox\plugins\npganymedenet.dll
    .

    **************************************************************************

    catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
    Rootkit scan 2009-01-23 07:49:08
    Windows 6.0.6000 NTFS

    tarkistaa piilotettuja prosesseja ...

    tarkistaa piilotettuja käynnistysarvoja ...

    tarkistaa piilotettuja tiedostoja ...

    tarkistus on valmis
    piilotetut tiedostot: 0

    **************************************************************************
    .
    Valmistumisajankohta: 23.01.2009 7:51:48
    ComboFix-quarantined-files.txt 2009-01-23 05:51:44

    Ennen ajoa: 101 282 295 808 tavua vapaana
    Ajon jälkeen: 103,582,552,064 tavua vapaana

    303 --- E O F --- 2009-01-17 19:18:53
     
    Aleksi321, Jan 23, 2009
    #5
  6. Hujo

    Hujo Guest

    Kirjoita suorita luukkuun

    ComboFix /u

    Klikkaa OK

    ========
     
    Hujo, Jan 23, 2009
    #6
  7. Aleksi321

    Aleksi321 Guest

    Tehty. Tuon jälkeen tuli: 'Troijalainen siirretty karanteeniin'
    Nytkö on valmista? Kiitoksia avusta! =)
     
    Aleksi321, Jan 23, 2009
    #7
  8. Hujo

    Hujo Guest

    Tyhjennä Malwarebytes' Anti-Malware karanteeni

    Poista roskat

    ===========

    Lataa Tästä Ccleaner
    CCleaner v 2.14.750.- Standard Build, ÄLÄ aseenna Yahoo toolbaria!
    Asennuksessa poista merkki/rasti kohdasta "asenna Yahoo! toolbar/työkalupalkki".
    Asennuksen jälkeen aukaise CCleaneri.
    Valitse vasemmalta pystyrivistä Options.
    Valitse viereisestä pystyrivistä Settings.
    Language kohtaan valitse Suomi.

    Puhdistaja
    Valitse vasemmalta pystyrivistä Puhdistaja.
    Paina alhaalta Tutki.
    Nyt CCleaneri tutkii, mitä voidaan poistaa (tempit, cookiessit jne.).
    Kun tutkiminen on valmis, paina Aja CCleaner.
    Nyt CCleaneri poistaa löydetyt tempit, cookiessit jne.

    Rekisterin virheiden korjaus
    Valitse vasemmalta pystyrivistä Rekisteri.
    Paina alhaalta Etsi rekisterin virheitä.
    Kun etsintä on valmis ja olet varma, että haluat korjata ne rivit jotka ovat merkattuja, niin paina Korjaa valitut rekisterin virheet.
    Sinulta kysytään "haluatko varmuuskopioida muutokset rekisteriin", paina Kyllä. Tallenna varmuuskopio vaikka "Omat tiedostot" -kansioon.
    Klikkaa uudesta aukeavasta ikkunasta Korjaa kaikki valitut virheet.
    Saat vielä varmistus kysymyksen, paina Ok.
    Kun virheet on korjattu, paina Sulje.
    Nyt voit sulkea CCleanerin painamalla oikealta ylhäältä punaista rastia.
     
    Hujo, Jan 23, 2009
    #8

Share This Page