Selviääkö tästä mitään?

Discussion in 'Virukset ja haittaohjelmat - HijackThis -logit' started by Sarika, Apr 12, 2008.

  1. Sarika

    Sarika Member

    Joined:
    Apr 10, 2008
    Messages:
    9
    Likes Received:
    0
    Trophy Points:
    11
    Sain asennettua HijackThisin, käynnistyikin, mutta ilmoitti: An unexpected error has occured at procedure: modMain_StartScan()Error#5-invelid procedure call or argument.

    Onko tuosta logista mitään apua?

    Logfile of Trend Micro HijackThis v2.0.2
    Scan saved at 19:56:15, on 12.4.2008
    Platform: Windows XP SP1 (WinNT 5.01.2600)
    MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)
    Boot mode: Normal

    Running processes:
    C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

    R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page =
    R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Linkit
    F2 - REG:system.ini: UserInit=C:\WINDOWS\System32\Userinit.exe,C:\WINDOWS\System32\wmsdkns.exe,
    O2 - BHO: (no name) - {00000250-0320-4dd4-be4f-7566d2314352} - (no file)
    O2 - BHO: 624855 helper - {0e9a703a-d3d3-4663-9ddb-8558a4eb46ab} - C:\WINDOWS\System32\624855\624855.dll (file missing)
    O2 - BHO: (no name) - {13197ace-6851-45c3-a7ff-c281324d5489} - (no file)
    O2 - BHO: (no name) - {15651c7c-e812-44a2-a9ac-b467a2233e7d} - (no file)
    O2 - BHO: (no name) - {4e1075f4-eec4-4a86-add7-cd5f52858c31} - (no file)
    O2 - BHO: (no name) - {4e7bd74f-2b8d-469e-92c6-ce7eb590a94d} - (no file)
    O2 - BHO: (no name) - {5929cd6e-2062-44a4-b2c5-2c7e78fbab38} - (no file)
    O2 - BHO: (no name) - {5dafd089-24b1-4c5e-bd42-8ca72550717b} - (no file)
    O2 - BHO: (no name) - {5fa6752a-c4a0-4222-88c2-928ae5ab4966} - (no file)
    O2 - BHO: (no name) - {622cc208-b014-4fe0-801b-874a5e5e403a} - (no file)
    O2 - BHO: (no name) - {8674aea0-9d3d-11d9-99dc-00600f9a01f1} - (no file)
    O2 - BHO: (no name) - {965a592f-8efa-4250-8630-7960230792f1} - (no file)
    O2 - BHO: (no name) - {9c5b2f29-1f46-4639-a6b4-828942301d3e} - (no file)
    O2 - BHO: (no name) - {cf021f40-3e14-23a5-cba2-717765728274} - (no file)
    O2 - BHO: (no name) - {fc3a74e5-f281-4f10-ae1e-733078684f3c} - (no file)
    O2 - BHO: (no name) - {ffff0001-0002-101a-a3c9-08002b2f49fb} - (no file)
    O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
    O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll
    O4 - HKLM\..\Run: [Lwinst Run Profiler] C:\OHJELM~1\Logitech\WINGMA~1\Lwinst.exe -d -l "C:\OHJELM~1\Logitech\WINGMA~1\Lwpevntm.exe"
    O4 - HKLM\..\Run: [SETI Monitor] E:\SETI\SETIMON\SetiMon.exe
    O4 - HKLM\..\Run: [AtiCwd32] Aticwd32.exe
    O4 - HKLM\..\Run: [AtiQiPcl] AtiQiPcl.exe
    O4 - HKLM\..\Run: [NeroCheck] C:\WINDOWS\system32\NeroCheck.exe
    O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE NvQTwk,NvCplDaemon initialize
    O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
    O4 - HKLM\..\Run: [C-Media Mixer] Mixer.exe /startup
    O4 - HKLM\..\Run: [Microsoft Inet Xp..] teekids.exe
    O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
    O4 - HKLM\..\Run: [Zone Labs Client] C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
    O4 - HKLM\..\Run: [Samsung PanelMgr] C:\WINDOWS\Samsung\PanelMgr\ssmmgr.exe /autorun
    O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVG7\avgcc.exe /STARTUP
    O4 - HKLM\..\Run: [anysee_TR] C:\Program Files\anysee\anysee-E30\anysee_TR.exe
    O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe"
    O4 - HKLM\..\Run: [ntuser] C:\WINDOWS\system32\drivers\spools.exe
    O4 - HKLM\..\Run: [iSecurity applet] rundll32.exe iSecurity.cpl,SecurityMonitor
    O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
    O4 - HKCU\..\Run: [seticlient] e:\seti\SETI@home.exe -min
    O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe
    O4 - HKCU\..\Run: [ntuser] C:\WINDOWS\system32\drivers\spools.exe
    O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
    O4 - HKUS\.DEFAULT\..\Run: [Win32 USB2 Driver] smsc.exe (User 'Default user')
    O4 - HKUS\.DEFAULT\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'Default user')
    O4 - HKUS\.DEFAULT\..\Run: [ntuser] C:\WINDOWS\system32\drivers\spools.exe (User 'Default user')
    O4 - HKUS\.DEFAULT\..\Run: [WintelUpdate] c:\icxh.exe (User 'Default user')
    O4 - HKUS\.DEFAULT\..\RunOnce: [Win32 USB2 Driver] smsc.exe (User 'Default user')
    O4 - Startup: OpenOffice.org 641.lnk = E:\OpenOffice.org641\program\quickstart.exe
    O4 - Startup: OpenOffice.org 1.0.lnk = C:\Program Files\OpenOffice.org1.0\program\quickstart.exe
    O4 - Global Startup: Pikakuvake SetiSpy.lnk = E:\seti\SetiSpy.exe
    O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
    O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
    O4 - Global Startup: Picture Package VCD Maker.lnk = ?
    O8 - Extra context menu item: &Search - http://edits.mywebsearch.com/toolbaredits/menusearch.jhtml?p=ZRxdm185YYFI
    O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
    O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
    O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
    O9 - Extra 'Tools' menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
    O9 - Extra button: (no name) - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - (no file)
    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
    O9 - Extra 'Tools' menuitem: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
    O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
    O16 - DPF: {0eb0e74a-2a76-4ab3-a7fb-9bd8c29f7f75} (CKAVWebScan Object) - http://www.kaspersky.com/kos/eng/partner/default/kavwebscan_unicode.cab
    O16 - DPF: {1D4DB7D2-6EC9-47A3-BD87-1E41684E07BB} - http://ak.exe.imgfarm.com/images/no...ularScreenSaversFWBInitialSetup1.0.0.15-3.cab
    O16 - DPF: {2bc66f54-93a8-11d3-beb6-00105aa9b6ae} (Symantec AntiVirus scanner) - http://security.symantec.com/sscv6/SharedContent/vc/bin/AvSniff.cab
    O16 - DPF: {2d8ed06d-3c30-438b-96ae-4d110fdc1fb8} (ActiveScan 2.0 Installer Class) - http://acs.pandasoftware.com/activescan/cabs/as2stubie.cab
    O16 - DPF: {644e432f-49d3-41a1-8dd5-e099162eeec5} (Symantec RuFSI Utility Class) - http://security.symantec.com/sscv6/SharedContent/common/bin/cabsa.cab
    O16 - DPF: {7b297bfd-85e4-4092-b2af-16a91b2ea103} (WScanCtl Class) - http://www.ca.com/us/securityadvisor/virusinfo/webscan.cab
    O16 - DPF: {bdbde413-7b1c-4c68-a8ff-c5b2b4090876} (F-Secure Online Scanner 3.3) - http://support.f-secure.com/ols/fscax.cab
    O16 - DPF: {E8F628B5-259A-4734-97EE-BA914D7BE941} (Driver Agent ActiveX Control) - http://driveragent.com/files/driveragent.cab
    O20 - AppInit_DLLs: iSecurity.cpl
    O21 - SSODL: iSecurity - {A8311E8F-E459-4D22-89B4-CB9DCF10A425} - iSecurity.cpl (file missing)
    O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
    O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
    O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
    O23 - Service: Google Online Services - Unknown owner - C:\Documents and Settings\Timo Repo\ie_updates3r.exe (file missing)
    O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
    O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
    O23 - Service: Tehtävien ajoitus (Schedule) - Unknown owner - C:\WINDOWS\system32\drivers\spools.exe (file missing)

    --
    End of file - 7612 bytes
     
    Sarika, Apr 12, 2008
    #1
  2. Hujo

    Hujo Guest

    scannaa hjt:llä merkkaa paina Fix checked

    O2 - BHO: (no name) - {00000250-0320-4dd4-be4f-7566d2314352} - (no file)
    O2 - BHO: (no name) - {13197ace-6851-45c3-a7ff-c281324d5489} - (no file)
    O2 - BHO: (no name) - {15651c7c-e812-44a2-a9ac-b467a2233e7d} - (no file)
    O2 - BHO: (no name) - {4e1075f4-eec4-4a86-add7-cd5f52858c31} - (no file)
    O2 - BHO: (no name) - {4e7bd74f-2b8d-469e-92c6-ce7eb590a94d} - (no file)
    O2 - BHO: (no name) - {5929cd6e-2062-44a4-b2c5-2c7e78fbab38} - (no file)
    O2 - BHO: (no name) - {5dafd089-24b1-4c5e-bd42-8ca72550717b} - (no file)
    O2 - BHO: (no name) - {5fa6752a-c4a0-4222-88c2-928ae5ab4966} - (no file)
    O2 - BHO: (no name) - {622cc208-b014-4fe0-801b-874a5e5e403a} - (no file)
    O2 - BHO: (no name) - {8674aea0-9d3d-11d9-99dc-00600f9a01f1} - (no file)
    O2 - BHO: (no name) - {965a592f-8efa-4250-8630-7960230792f1} - (no file)
    O2 - BHO: (no name) - {9c5b2f29-1f46-4639-a6b4-828942301d3e} - (no file)
    O2 - BHO: (no name) - {cf021f40-3e14-23a5-cba2-717765728274} - (no file)
    O2 - BHO: (no name) - {fc3a74e5-f281-4f10-ae1e-733078684f3c} - (no file)
    O2 - BHO: (no name) - {ffff0001-0002-101a-a3c9-08002b2f49fb} - (no file)
    O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
    O8 - Extra context menu item: &Search - http://edits.mywebsearch.com/toolbaredit...?p=ZRxdm185YYFI
    O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
    O9 - Extra 'Tools' menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
    O9 - Extra button: (no name) - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - (no file)
    O16 - DPF: {1D4DB7D2-6EC9-47A3-BD87-1E41684E07BB} - http://ak.exe.imgfarm.com/images/nocache...p1.0.0.15-3.cab
    O16 - DPF: {2bc66f54-93a8-11d3-beb6-00105aa9b6ae} (Symantec AntiVirus scanner) - http://security.symantec.com/sscv6/Share...bin/AvSniff.cab
    O16 - DPF: {644e432f-49d3-41a1-8dd5-e099162eeec5} (Symantec RuFSI Utility Class) - http://security.symantec.com/sscv6/Share...n/bin/cabsa.cab
    O16 - DPF: {bdbde413-7b1c-4c68-a8ff-c5b2b4090876} (F-Secure Online Scanner 3.3) - http://support.f-secure.com/ols/fscax.cab

    ===============

    Lataa SDFix by AndyManchesta ja tallenna se työpöydällesi.

    Käynnistä koneesi vikasietotilaan:

    sammuta ja käynnistä
    käynnistyksen yhteydessä hakkaa F8 nappia
    valitse nuolinäppäimellä vikasietotila
    paina enter ja enter
    valitse käyttäjätilisi
    paina kyllä

    Jossakin koneissa hakataan F8:sin sijasta F5:tä

    " Kun vikasietotilassa, pura tiedoston SDFix.zip sisältö (SDFix kansio) työpöydällesi. Työpöydälle pitäisi ilmestyä kansio nimeltä SDFix.
    " Avaa SDFix-kansio ja tuplaklikkaa tiedostoa RunThis.bat käynnistääksesi ohjelman.
    " Paina Y käynnistääksesi skriptin.
    " Työkalu puhdistaa troijalaisen palvelut ja tekee myös joitakin korjauksia rekisteriin. Lopuksi se pyytää käynnistämään koneen uudelleen, "Press any key to Reboot".
    " Paina mitä tahansa näppäintä ja kone käynnistyy uudelleen.
    " Käynnistyminen kestää normaalia kauemmin sillä SDFix puhdistaa konetta.
    " Kun kone on käynnistynyt ja työpöytä latautunut, SDFix kertoo että puhdistus on suoritettu, "Finished".
    " Paina sitten mitä tahansa näppäintä sulkeaksesi skriptin ja ladataksesi pikakuvakkeet työpöydälle.
    " Lopuksi avaa SDFix kansio (työpöydällä) ja kopioi & liitä tiedoston Report.txt sisältö viestiketjuusi uuden HijackThis:n lokin kera.

     
    Hujo, Apr 12, 2008
    #2
  3. Sarika

    Sarika Member

    Joined:
    Apr 10, 2008
    Messages:
    9
    Likes Received:
    0
    Trophy Points:
    11
    Merkkasin nuo mainitut, Fix checked ei tunnu tekevän mitään? Avaa nopsasti Welcome to HijackThis -laatikon.

    SDFix ei auennut vikasietotilassa, kuten ei oikeastaan mikään: "järjestelmään kytketty laite ei toimi". Purin siis normaalitilassa (mitään ei pysty avaamaan muuten kuin "suorita nimellä..."), hain RunThis.batin työpöydälle ja käynnistin sen vikasietotilassa. Painoin Y, jonka jälkeen tuli pitkä rivi "määritettyä polkua ei löydy" eikä muuta. Normaalitilaan on työpöydälle ilmaantunut tyhjät backupreg ja bacups -kansiot, muutama .exe ja parikymmentä tyhjää muistiota.


    Logfile of Trend Micro HijackThis v2.0.2
    Scan saved at 13:32:59, on 13.4.2008
    Platform: Windows XP SP1 (WinNT 5.01.2600)
    MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)
    Boot mode: Normal

    Running processes:
    C:\Program Files\Grisoft\AVG7\avgwb.dat
    C:\Program Files\Grisoft\AVG7\avgcc.exe
    C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

    R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page =
    R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Linkit
    F2 - REG:system.ini: UserInit=C:\WINDOWS\System32\Userinit.exe,C:\WINDOWS\System32\wmsdkns.exe,
    O2 - BHO: (no name) - {00000250-0320-4dd4-be4f-7566d2314352} - (no file)
    O2 - BHO: 624855 helper - {0e9a703a-d3d3-4663-9ddb-8558a4eb46ab} - C:\WINDOWS\System32\624855\624855.dll (file missing)
    O2 - BHO: (no name) - {13197ace-6851-45c3-a7ff-c281324d5489} - (no file)
    O2 - BHO: (no name) - {15651c7c-e812-44a2-a9ac-b467a2233e7d} - (no file)
    O2 - BHO: (no name) - {4e1075f4-eec4-4a86-add7-cd5f52858c31} - (no file)
    O2 - BHO: (no name) - {4e7bd74f-2b8d-469e-92c6-ce7eb590a94d} - (no file)
    O2 - BHO: (no name) - {5929cd6e-2062-44a4-b2c5-2c7e78fbab38} - (no file)
    O2 - BHO: (no name) - {5dafd089-24b1-4c5e-bd42-8ca72550717b} - (no file)
    O2 - BHO: (no name) - {5fa6752a-c4a0-4222-88c2-928ae5ab4966} - (no file)
    O2 - BHO: (no name) - {622cc208-b014-4fe0-801b-874a5e5e403a} - (no file)
    O2 - BHO: (no name) - {8674aea0-9d3d-11d9-99dc-00600f9a01f1} - (no file)
    O2 - BHO: (no name) - {965a592f-8efa-4250-8630-7960230792f1} - (no file)
    O2 - BHO: (no name) - {9c5b2f29-1f46-4639-a6b4-828942301d3e} - (no file)
    O2 - BHO: (no name) - {cf021f40-3e14-23a5-cba2-717765728274} - (no file)
    O2 - BHO: (no name) - {fc3a74e5-f281-4f10-ae1e-733078684f3c} - (no file)
    O2 - BHO: (no name) - {ffff0001-0002-101a-a3c9-08002b2f49fb} - (no file)
    O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
    O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll
    O4 - HKLM\..\Run: [Lwinst Run Profiler] C:\OHJELM~1\Logitech\WINGMA~1\Lwinst.exe -d -l "C:\OHJELM~1\Logitech\WINGMA~1\Lwpevntm.exe"
    O4 - HKLM\..\Run: [SETI Monitor] E:\SETI\SETIMON\SetiMon.exe
    O4 - HKLM\..\Run: [AtiCwd32] Aticwd32.exe
    O4 - HKLM\..\Run: [AtiQiPcl] AtiQiPcl.exe
    O4 - HKLM\..\Run: [NeroCheck] C:\WINDOWS\system32\NeroCheck.exe
    O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE NvQTwk,NvCplDaemon initialize
    O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
    O4 - HKLM\..\Run: [C-Media Mixer] Mixer.exe /startup
    O4 - HKLM\..\Run: [Microsoft Inet Xp..] teekids.exe
    O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
    O4 - HKLM\..\Run: [Zone Labs Client] C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
    O4 - HKLM\..\Run: [Samsung PanelMgr] C:\WINDOWS\Samsung\PanelMgr\ssmmgr.exe /autorun
    O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVG7\avgcc.exe /STARTUP
    O4 - HKLM\..\Run: [anysee_TR] C:\Program Files\anysee\anysee-E30\anysee_TR.exe
    O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe"
    O4 - HKLM\..\Run: [ntuser] C:\WINDOWS\system32\drivers\spools.exe
    O4 - HKLM\..\Run: [iSecurity applet] rundll32.exe iSecurity.cpl,SecurityMonitor
    O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
    O4 - HKCU\..\Run: [seticlient] e:\seti\SETI@home.exe -min
    O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe
    O4 - HKCU\..\Run: [ntuser] C:\WINDOWS\system32\drivers\spools.exe
    O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
    O4 - HKUS\.DEFAULT\..\Run: [Win32 USB2 Driver] smsc.exe (User 'Default user')
    O4 - HKUS\.DEFAULT\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'Default user')
    O4 - HKUS\.DEFAULT\..\Run: [ntuser] C:\WINDOWS\system32\drivers\spools.exe (User 'Default user')
    O4 - HKUS\.DEFAULT\..\Run: [WintelUpdate] c:\icxh.exe (User 'Default user')
    O4 - HKUS\.DEFAULT\..\RunOnce: [Win32 USB2 Driver] smsc.exe (User 'Default user')
    O4 - Startup: OpenOffice.org 641.lnk = E:\OpenOffice.org641\program\quickstart.exe
    O4 - Startup: OpenOffice.org 1.0.lnk = C:\Program Files\OpenOffice.org1.0\program\quickstart.exe
    O4 - Global Startup: Pikakuvake SetiSpy.lnk = E:\seti\SetiSpy.exe
    O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
    O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
    O4 - Global Startup: Picture Package VCD Maker.lnk = ?
    O8 - Extra context menu item: &Search - http://edits.mywebsearch.com/toolbaredits/menusearch.jhtml?p=ZRxdm185YYFI
    O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
    O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
    O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
    O9 - Extra 'Tools' menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
    O9 - Extra button: (no name) - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - (no file)
    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
    O9 - Extra 'Tools' menuitem: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
    O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
    O16 - DPF: {0eb0e74a-2a76-4ab3-a7fb-9bd8c29f7f75} (CKAVWebScan Object) - http://www.kaspersky.com/kos/eng/partner/default/kavwebscan_unicode.cab
    O16 - DPF: {1D4DB7D2-6EC9-47A3-BD87-1E41684E07BB} - http://ak.exe.imgfarm.com/images/no...ularScreenSaversFWBInitialSetup1.0.0.15-3.cab
    O16 - DPF: {2bc66f54-93a8-11d3-beb6-00105aa9b6ae} (Symantec AntiVirus scanner) - http://security.symantec.com/sscv6/SharedContent/vc/bin/AvSniff.cab
    O16 - DPF: {2d8ed06d-3c30-438b-96ae-4d110fdc1fb8} (ActiveScan 2.0 Installer Class) - http://acs.pandasoftware.com/activescan/cabs/as2stubie.cab
    O16 - DPF: {644e432f-49d3-41a1-8dd5-e099162eeec5} (Symantec RuFSI Utility Class) - http://security.symantec.com/sscv6/SharedContent/common/bin/cabsa.cab
    O16 - DPF: {7b297bfd-85e4-4092-b2af-16a91b2ea103} (WScanCtl Class) - http://www.ca.com/us/securityadvisor/virusinfo/webscan.cab
    O16 - DPF: {bdbde413-7b1c-4c68-a8ff-c5b2b4090876} (F-Secure Online Scanner 3.3) - http://support.f-secure.com/ols/fscax.cab
    O16 - DPF: {E8F628B5-259A-4734-97EE-BA914D7BE941} (Driver Agent ActiveX Control) - http://driveragent.com/files/driveragent.cab
    O20 - AppInit_DLLs: iSecurity.cpl
    O21 - SSODL: iSecurity - {A8311E8F-E459-4D22-89B4-CB9DCF10A425} - iSecurity.cpl (file missing)
    O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
    O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
    O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
    O23 - Service: Google Online Services - Unknown owner - C:\Documents and Settings\Timo Repo\ie_updates3r.exe (file missing)
    O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
    O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
    O23 - Service: Tehtävien ajoitus (Schedule) - Unknown owner - C:\WINDOWS\system32\drivers\spools.exe (file missing)

    --
    End of file - 7694 bytes
     
    Last edited: Apr 13, 2008
    Sarika, Apr 13, 2008
    #3
  4. Hujo

    Hujo Guest

    1.Lataa combofix.exe työpöydällesi yhdestä linkistä:
    combofix1
    combofix2

    2. Tuplaklikkaa combofix.exe tiedostoa ja seuraa ohjeistuksia.
    3. Kun työkalu on valmis, se tuottaa lokin. Lähetä tämä loki viesti ketjuusi.
    Huom! Älä klikkaile combofixin ikkunaa käytön aikana. Tämä saattaa aiheuttaa ohjelman jumiutumisen.
     
    Hujo, Apr 13, 2008
    #4
  5. Sarika

    Sarika Member

    Joined:
    Apr 10, 2008
    Messages:
    9
    Likes Received:
    0
    Trophy Points:
    11
    'Backing up registry to C:\WINDOWS\erdnt\Hiv-backup' :in päälle tulee varoituksia:
    'Warning! Error saving file C:\WINDOWS\erdnt\Hiv-backup\SECURITY Continue with the next file? [RegCreateKeyEx:5 - Käyttö estetty]'
    Uskallanko vastata näihin 'kyllä'?
     
    Sarika, Apr 13, 2008
    #5
  6. Hujo

    Hujo Guest

    kyllä mutta taitaa tulla vielä korjausasennus vaihe eteen
    tai täysin formatointi

    =================

    onkos sulla tuo käyttöjärjestelmä cd ja muut tarvittavat cd joita tarvitaan ääniajuri ja grafiika ajureiden asennukseen

    sillä tämä on mahottoman lyhyt

    Running processes:
    C:\Program Files\Grisoft\AVG7\avgwb.dat
    C:\Program Files\Grisoft\AVG7\avgcc.exe
    C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

    mitäs oot koneella tehnyt kun tuo noin lyhyt on
    sieltä puuttuu paljon tietoa mitä siellä kuuluisi olla.
     
    Last edited by a moderator: Apr 13, 2008
    Hujo, Apr 13, 2008
    #6
  7. Sarika

    Sarika Member

    Joined:
    Apr 10, 2008
    Messages:
    9
    Likes Received:
    0
    Trophy Points:
    11
    On vino pino CD:tä, käyttis ja varmasti kaikki muukin tarvittava (näkyy olevan kaikki Windows 98:ta eli tämän huushollin aikojen alusta lähtien).

    Oikeesti meistä kumpikaan ei tajua tästä vehkeestä juuri mitään, vaikka oon itse koonnut ja asentanut kaiken. Jotain oli tapahtunut alkuviikosta, minä sitten skannailin eri on-line virustorjuntaohjelmilla kunnes tuli seinä vastaan...
     
    Sarika, Apr 13, 2008
    #7
  8. Hujo

    Hujo Guest

    Onkos sulla tämä cd Windows XP SP1
     
    Hujo, Apr 13, 2008
    #8
  9. Sarika

    Sarika Member

    Joined:
    Apr 10, 2008
    Messages:
    9
    Likes Received:
    0
    Trophy Points:
    11
    Windows XP Päivitys versio 2002 (pohjalla oli se 98) ja SP2
     
    Sarika, Apr 13, 2008
    #9
  10. Hujo

    Hujo Guest

    Pitäs olla tuo Windows XP SP1 käyttöjärjestelmä

    Niin sais tehtyä sen korjausasennuksen / formatoinin ja asentaa kaikki uudestaan

    epäilen että se ei kestä Windows XP SP2:ta sillä tulee nuo koneen tehot ja keskusmuisti vastaan ja sitten se kone pyörii todella hitaasti.

     
    Hujo, Apr 13, 2008
    #10
  11. Hujo

    Hujo Guest

    Pitäs olla tuo Windows XP SP1 käyttöjärjestelmä

    Niin sais tehtyä sen korjausasennuksen / formatoinin ja asentaa kaikki uudestaan

    epäilen että se ei kestä Windows XP SP2:ta sillä tulee nuo koneen tehot ja keskusmuisti vastaan ja sitten se kone pyörii todella hitaasti.

     
    Hujo, Apr 13, 2008
    #11
  12. Sarika

    Sarika Member

    Joined:
    Apr 10, 2008
    Messages:
    9
    Likes Received:
    0
    Trophy Points:
    11
    Kiitos oikein paljon avusta, pitää vähän miettiä mitä nyt tehdään. Nyt kuiteskin on pakko lukea huomiseen tentiin vielä, onneksi se matsku on enimmäkseen paperilla...
     
    Sarika, Apr 13, 2008
    #12
  13. Hujo

    Hujo Guest

    no koitetaas tällä ettiä

    Escan
    Ohjeet tuolla sivulla.
    http://koti.mbnet.fi/pattaya1/escanmwav.htm
    lataa tuosta
    http://www.spywareinfo.dk/download/mwav.exe
    päivitä tuosta
    http://koti.mbnet.fi/pattaya1/lataus/Mwav.bat
    laita täpit merkkauksien mukaan
    http://koti.mbnet.fi/pattaya1/eScan6.jpg

    scannaa

    jos ala luukkuun tulee jotain niin kopioi se näin:
    Käytä komentoa Ctrl+A.
    Kopioi rivit komennolla Ctrl+C.
    Liitä rivit komennolla Ctrl+V.

    Laita virus log tänne.

    ===============

    Ohje AVG:n Anti-Spyware 7.5:n käyttöön
    Huom! Tässä ohjeessa sammutetaan tuo reaaliaikasuojaus (Shield). Näin vältetään tilanteet joissa suojaus estäisi esim HijackThis:n työkalun toimintaa.

    Tallenna nämä ohjeet tekstitiedostoon tai tulosta nämä, muuten et pääse niihin käsiksi vikasietotilasta

    Lataa AVG:n Anti-Spyware 7.5:n
    ja tallenna ohjelma työpöydällesi.
    o Kun olet ladannut ohjelman, kaksoisklikkaa asennuohjelman pikakuvaketta työpöydälläsi, asennus alkaa.
    o Asennuksen jälkeen täytyy ohjelma käynnistää ja sen tunnisteet päivittää.
    o Käynnistä AVG:n Anti-Spyware.
    o Klikkaa "Update" kuvaketta päävalikossa. Sen jälkeen klikkaa "Update now" painiketta.

    o Sitten klikkaa "Start Update" kuvaketta jolloin päivitys alkaa.

    o Kun päivitykset on ladattu, klikkaa "Scanner" kuvaketta ikkunan ylälaidassa. Valitse sitten "Settings" välilehti.
    o Kun "Settings" valikko on auennut, klikkaa "Recommended actions" ja sitten valitse "Quarantine".

    o Sitten "Reports" valikon alta:
    o Laita täppi kohtaan "Automatically generate report after every scan"
    o Ota täppi pois kohdasta"Only if threats were found"

    o Sitten klikkaa "Shield" kuvaketta ikkunan ylälaidassa
    o "Resident shield is", muuta tila active:sta inactive:ksi
    o Sulje ohjelma, ÄLÄ skannaa vielä.

    Käynnistä koneesi vikasietotilaan,
    sammuta ja käynnistä
    käynnistyksen yhteydessä naputtele F8
    valitse nuoli näppäimellä vikasietotila
    paina enter ja enter

    Toisissa koneissa paukutetaan F8:sin sijasta F5:tä

    HUOM! Älä käytä muita ohjelmia AVG:n skannauksen aikana, tämä saattaa häiritä skannausta.
    o Kun vikasietotilassa, käynnistä AVG:n Anti-Spyware.
    o Klikkaa "Scanner" kuvaketta ikkunan ylälaidassa ja valitse "Scan" välilehti. Sitten klikkaa "Complete System Scan".
    o Ewido aloittaa nyt tietokoneen skannaamisen, ole kärsivällinen sillä skannaus vie aikaa.

    Kun skannaus on valmis:
    TÄRKEÄÄ : Älä klikkaa "Save Scan Report" ennen kuin klikkaat "Apply all Actions"
    o Varmistu, että Set all elements to: näyttää Quarantine (1), jos ei, klikkaa linkkiä ja valitse Quarantine popup-valikosta.
    o Sinulta kysytään mitä tehdä jos infektioita löytyi, valitse silloin "Apply all actions"
    [​IMG]
    o Sitten klikkaa "Reports" kuvaketta ohjelma yläosasta.
    o Klikkaa "Save report as" painiketta ikkunan vasemmassa alalaidassa ja tallenna raportti työpöydälle.
    o Sulje ohjelma, käynnistä kone normaalisti ja lähetä AVG:n raportti viestikejuusi.

    ================

    Lataa Malwarebytes' Anti-Malware työpöydällesi.

    1. Tuplaklikkaa mbam-setup.exe ja seuraa ohjeita asentaaksesi ohjelman.
    2. Lopuksi varmistu, että seuraavat on valittu: Update Malwarebytes', Anti-Malwareja
    Launch Malwarebytes' Anti-Malware ja sen jälkeen klikkaaFinish.
    3. Jos päivitys löytyy. ohjelma lataa ja asentaa uusimman version.
    4. Kun ohjelma on latautunut, valitse Perform full scan ja klikkaa Scan.
    5. Kun skanni on valmis, klikkaa OK ja sitten Show Results nähdäksesi tulokset.
    6. Varmistu, että kaikki on merkitty ja klikkaa Remove Selected.
    7. Tämän jälkeen loki avautuu muistioon. Tallenna se paikkaan, josta löydät sen helposti. Loki
    löytyy myös täältä: C:\Documents and Settings\Käyttäjänimi\Application
    Data\Malwarebytes\Malwarebytes' Anti-Malware\Logs\log-päiväys.txt
    8. Lähetä lokin sisältö seuraavassa viestissäsi.
     
    Last edited by a moderator: Apr 13, 2008
    Hujo, Apr 13, 2008
    #13
  14. Sarika

    Sarika Member

    Joined:
    Apr 10, 2008
    Messages:
    9
    Likes Received:
    0
    Trophy Points:
    11
    No niin, tänään kerkesin ton eScanin kanssa temppuilla. Päivitys ei onnistu kummallakaan tavalla, eikä suostunut skannaamaankaan vaan käskee ladata uusimman toolkitin mwti.netistä. Latasin ja skannasin vaikkei se poistakaan mitään. Se totesi heti kärkeen, ettei minulla ole järjestelmänvalvojan oikeuksia eikä kaikkia toimintoja ehkä suoriteta, mutta kaikenlaista löytyi:

    Object "funwebproducts Spyware/Adware" found in File System! Action Taken: No Action Taken.
    Object "securitytoolbar Toolbar" found in File System! Action Taken: No Action Taken.
    Object "transponder parasite variant Spyware/Adware" found in File System! Action Taken: No Action Taken.
    Object "spediabar Spyware/Adware" found in File System! Action Taken: No Action Taken.
    Object "2020search Spyware/Adware" found in File System! Action Taken: No Action Taken.
    Object "2020search Spyware/Adware" found in File System! Action Taken: No Action Taken.
    Object "seekmo Adware" found in File System! Action Taken: No Action Taken.
    Object "180solutions Spyware/Adware" found in File System! Action Taken: No Action Taken.
    Object "adlogix.com zamingo Spyware/Adware" found in File System! Action Taken: No Action Taken.
    Object "adrotator Spyware/Adware" found in File System! Action Taken: No Action Taken.
    Object "matrix technology network 123mania Spyware/Adware" found in File System! Action Taken: No Action Taken.
    Object "classid test HackTool" found in File System! Action Taken: No Action Taken.
    Object "00d dialer Spyware/Adware" found in File System! Action Taken: No Action Taken.
    Object "funwebproducts Spyware/Adware" found in File System! Action Taken: No Action Taken.
    Object "securitytoolbar Toolbar" found in File System! Action Taken: No Action Taken.
    Object "securitytoolbar Toolbar" found in File System! Action Taken: No Action Taken.
    Object "funwebproducts Spyware/Adware" found in File System! Action Taken: No Action Taken.
    Object "funwebproducts Spyware/Adware" found in File System! Action Taken: No Action Taken.
    Object "funwebproducts Spyware/Adware" found in File System! Action Taken: No Action Taken.
    Object "mwsoemon Spyware/Adware" found in File System! Action Taken: No Action Taken.
    Object "funwebproducts Spyware/Adware" found in File System! Action Taken: No Action Taken.
    Object "mwsoemon Spyware/Adware" found in File System! Action Taken: No Action Taken.
    Object "win32.passma Virus" found in File System! Action Taken: No Action Taken.
    Object "multipassrecover Spyware" found in File System! Action Taken: No Action Taken.
    Object "muul.com "sitehistory" hijacker Spyware/Adware" found in File System! Action Taken: No Action Taken.
    Object "tx 4 browserad Spyware/Adware" found in File System! Action Taken: No Action Taken.
    Object "tx 4 browserad Spyware/Adware" found in File System! Action Taken: No Action Taken.
    Object "tx 4 browserad Spyware/Adware" found in File System! Action Taken: No Action Taken.
    Object "tx 4 browserad Spyware/Adware" found in File System! Action Taken: No Action Taken.
    Object "tx 4 browserad Spyware/Adware" found in File System! Action Taken: No Action Taken.
    Object "tx 4 browserad Spyware/Adware" found in File System! Action Taken: No Action Taken.
    Object "tx 4 browserad Spyware/Adware" found in File System! Action Taken: No Action Taken.
    Object "tx 4 browserad Spyware/Adware" found in File System! Action Taken: No Action Taken.
    Object "tx 4 browserad Spyware/Adware" found in File System! Action Taken: No Action Taken.
    Object "tx 4 browserad Spyware/Adware" found in File System! Action Taken: No Action Taken.
    Object "tx 4 browserad Spyware/Adware" found in File System! Action Taken: No Action Taken.
    Object "tx 4 browserad Spyware/Adware" found in File System! Action Taken: No Action Taken.
    Object "180solutions Spyware/Adware" found in File System! Action Taken: No Action Taken.
    Object "topconverting Spyware/Adware" found in File System! Action Taken: No Action Taken.
    Object "ncase Spyware/Adware" found in File System! Action Taken: No Action Taken.
    Object "dyfuca.internet optimizer Spyware/Adware" found in File System! Action Taken: No Action Taken.
    Object "2020search Spyware/Adware" found in File System! Action Taken: No Action Taken.
    Object "trojan-clicker.win32.delf.bc Spyware/Adware" found in File System! Action Taken: No Action Taken.
    Object "adlogix.com zamingo Spyware/Adware" found in File System! Action Taken: No Action Taken.
    Object "transponder parasite variant Spyware/Adware" found in File System! Action Taken: No Action Taken.
    Object "second thought Spyware/Adware" found in File System! Action Taken: No Action Taken.
    Object "ncase Spyware/Adware" found in File System! Action Taken: No Action Taken.
    Object "matrix technology network 123mania Spyware/Adware" found in File System! Action Taken: No Action Taken.
    Object "funwebproducts Spyware/Adware" found in File System! Action Taken: No Action Taken.
    Object "zango Spyware/Adware" found in File System! Action Taken: No Action Taken.
    Object "mwsoemon Spyware/Adware" found in File System! Action Taken: No Action Taken.
    Object "seekmo Adware" found in File System! Action Taken: No Action Taken.
    Object "180searchassistant Spyware/Adware" found in File System! Action Taken: No Action Taken.
    Object "180solutions Spyware/Adware" found in File System! Action Taken: No Action Taken.
    Object "180searchassistant Spyware/Adware" found in File System! Action Taken: No Action Taken.
    Object "smitfraud new Spyware/Adware" found in File System! Action Taken: No Action Taken.
    Object "trackware.prosearch Spyware/Adware" found in File System! Action Taken: No Action Taken.
    Object "betterinternet Trojan" found in File System! Action Taken: No Action Taken.
    Object "seekmo Adware" found in File System! Action Taken: No Action Taken.
    Object "betterinternet Trojan" found in File System! Action Taken: No Action Taken.
    Object "regsort Corrupted Adware/Spyware" found in File System! Action Taken: No Action Taken.
    Object "dyfuca.internet optimizer Spyware/Adware" found in File System! Action Taken: No Action Taken.
    Object "smitfraud new Spyware/Adware" found in File System! Action Taken: No Action Taken.
    Object "trackware.prosearch Spyware/Adware" found in File System! Action Taken: No Action Taken.
    Object "trackware.prosearch Spyware/Adware" found in File System! Action Taken: No Action Taken.
    Object "trackware.prosearch Spyware/Adware" found in File System! Action Taken: No Action Taken.
    Entry "HKCR\Overview.Document" refers to invalid object "{DA23B9C9-6893-11D0-8534-00C04FD7AD0C}". Action Taken: No Action Taken.
    Entry "HKCR\PhotoBase.Document" refers to invalid object "{F90E7260-9545-11D0-87A0-444553540000}". Action Taken: No Action Taken.
    Entry "HKCR\Plenoptic.Plenoptic" refers to invalid object "{607C27E9-AB27-11d3-A116-A0EA50C10801}". Action Taken: No Action Taken.
    Entry "HKCR\Plenoptic.Plenoptic.1" refers to invalid object "{607C27E9-AB27-11d3-A116-A0EA50C10801}". Action Taken: No Action Taken.
    Entry "HKCR\TSHOOT.TSHOOTCtrl.1" refers to invalid object "{4B106874-DD36-11D0-8B44-00A024DD9EFF}". Action Taken: No Action Taken.
    Entry "HKCR\WMPPublsihCntr.WMPPublsihCntr" refers to invalid object "{939438A9-CF0F-44d8-9140-599736F0D3A2}". Action Taken: No Action Taken.
    Entry "HKCR\WMPPublsihCntr.WMPPublsihCntr.1" refers to invalid object "{939438A9-CF0F-44d8-9140-599736F0D3A2}". Action Taken: No Action Taken.
    Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\ModuleUsage" refers to invalid object "c:\windows\downloaded program files\avsniff.dll". Action Taken: No Action Taken.
    Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\ModuleUsage" refers to invalid object "c:\windows\downloaded program files\fscax.dll". Action Taken: No Action Taken.
    Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\ModuleUsage" refers to invalid object "c:\windows\downloaded program files\rufsi.dll". Action Taken: No Action Taken.
    Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\ModuleUsage" refers to invalid object "Software\Microsoft\Windows\CurrentVersion\ModuleUsage\C:\WINDOWS\SYSTEM\danim.dll". Action Taken: No Action Taken.
    Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\ModuleUsage" refers to invalid object "Software\Microsoft\Windows\CurrentVersion\ModuleUsage\C:\WINDOWS\SYSTEM\ddrawex.dll". Action Taken: No Action Taken.
    Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\ModuleUsage" refers to invalid object "Software\Microsoft\Windows\CurrentVersion\ModuleUsage\C:\WINDOWS\SYSTEM\quartz.dll". Action Taken: No Action Taken.
    Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "C:\Ohjelmatiedostot\Creative\ShareDLL\MediaDet.log". Action Taken: No Action Taken.
    Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "C:\WINDOWS\SYSTEM\CTDetect.hlp". Action Taken: No Action Taken.
    Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "C:\Program Files\Creative\ShareDLL\CTRes32.dll". Action Taken: No Action Taken.
    Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "C:\Program Files\Creative\ShareDLL\CTRMenu.dll". Action Taken: No Action Taken.
    Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "C:\Program Files\Creative\ShareDLL\CTSkin.dll". Action Taken: No Action Taken.
    Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "C:\Program Files\Creative\ShareDLL\CTSpea32.dll". Action Taken: No Action Taken.
    Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "C:\Program Files\Creative\ShareDLL\PfMod.dll". Action Taken: No Action Taken.
    Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "C:\Program Files\Creative\ShareDLL\Mediadet.log". Action Taken: No Action Taken.
    Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "C:\Program Files\greenstreet\Utils\Keypad\KEYUS.FTS". Action Taken: No Action Taken.
    Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "C:\Program Files\greenstreet\Utils\Snapshot\snapshot.FTS". Action Taken: No Action Taken.
    Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "C:\Program Files\greenstreet\Utils\Phed\PhotoFX.fts". Action Taken: No Action Taken.
    Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "C:\Ohjelmatiedostot\ahead\CoverDesigner\covered-deu.nls". Action Taken: No Action Taken.
    Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "C:\Program Files\Common Files\muvee Technologies\030625\S00002_Chaplinesque\S00002_Chaplinesque.bmp". Action Taken: No Action Taken.
    Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "C:\Program Files\Common Files\muvee Technologies\030625\S00002_Chaplinesque\S00002_Chaplinesque.wmv". Action Taken: No Action Taken.
    Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "C:\Program Files\Common Files\muvee Technologies\030625\S00007_OverTheTopMusicVideo\S00007_OverTheTopMusicVideo.bmp". Action Taken: No Action Taken.
    Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "C:\Program Files\Common Files\muvee Technologies\030625\S00007_OverTheTopMusicVideo\S00007_OverTheTopMusicVideo.wmv". Action Taken: No Action Taken.
    Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "C:\Program Files\Common Files\muvee Technologies\030625\S00010_ProMedium\S00010_ProMedium.bmp". Action Taken: No Action Taken.
    Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "C:\Program Files\Common Files\muvee Technologies\030625\S00010_ProMedium\S00010_ProMedium.wmv". Action Taken: No Action Taken.
    Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "C:\Program Files\Common Files\muvee Technologies\030625\S00011_ProSlow\S00011_ProSlow.bmp". Action Taken: No Action Taken.
    Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "C:\Program Files\Common Files\muvee Technologies\030625\S00011_ProSlow\S00011_ProSlow.wmv". Action Taken: No Action Taken.
    Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "C:\Program Files\Common Files\muvee Technologies\030625\S00017_Smoky\S00017_Smoky.bmp". Action Taken: No Action Taken.
    Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "C:\Program Files\Common Files\muvee Technologies\030625\S00017_Smoky\S00017_Smoky.wmv". Action Taken: No Action Taken.
    Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "C:\Program Files\greenstreet\Publisher\Export To Web\Netitpub.GID". Action Taken: No Action Taken.
    Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "C:\Program Files\greenstreet\Publisher\Export To Web\Printer\Unidrv.GID". Action Taken: No Action Taken.
    Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "C:\Program Files\greenstreet\Publisher\Export To Web\NTPrint\Rasddui.GID". Action Taken: No Action Taken.
    Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "C:\Program Files\greenstreet\Utils\Picture Browser\BROWSER.GID". Action Taken: No Action Taken.
    Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "C:\Program Files\greenstreet\Utils\Keypad\KEYUS.GID". Action Taken: No Action Taken.
    Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "C:\Program Files\greenstreet\Utils\Keypad\KEYUS.CNT". Action Taken: No Action Taken.
    Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "C:\Program Files\greenstreet\Utils\Snapshot\Snapshot.GID". Action Taken: No Action Taken.
    Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "C:\Program Files\greenstreet\Utils\Snapshot\SNAPSHOT.CNT". Action Taken: No Action Taken.
    Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "C:\Program Files\greenstreet\Utils\Phed\Photofx.GID". Action Taken: No Action Taken.
    Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "C:\Program Files\greenstreet\Utils\Phed\PHOTOFX.CNT". Action Taken: No Action Taken.
    Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "C:\WINDOWS\Downloaded Program Files\fscax.dll". Action Taken: No Action Taken.
    Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "C:\WINDOWS\Downloaded Program Files\rufsi.dll". Action Taken: No Action Taken.
    Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "C:\WINDOWS\Downloaded Program Files\avsniff.dll". Action Taken: No Action Taken.
    Entry "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts" refers to invalid object ".". Action Taken: No Action Taken.
    Entry "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts" refers to invalid object ".0&disp=attd&view=att&th=1191324d15f066af". Action Taken: No Action Taken.
    Entry "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts" refers to invalid object ".001". Action Taken: No Action Taken.
    Entry "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts" refers to invalid object ".1ST". Action Taken: No Action Taken.
    Entry "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts" refers to invalid object ".2006&A44I_SKANDIT=%C4%C5%D6%E4%E5%F6&Tallenna=Tallenna". Action Taken: No Action Taken.
    Entry "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts" refers to invalid object ".3". Action Taken: No Action Taken.
    Entry "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts" refers to invalid object ".3ds". Action Taken: No Action Taken.
    Entry "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts" refers to invalid object ".ART". Action Taken: No Action Taken.
    Entry "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts" refers to invalid object ".axp". Action Taken: No Action Taken.
    Entry "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts" refers to invalid object ".bkg". Action Taken: No Action Taken.
    Entry "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts" refers to invalid object ".BUP". Action Taken: No Action Taken.
    Entry "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts" refers to invalid object ".CFG". Action Taken: No Action Taken.
    Entry "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts" refers to invalid object ".dtp". Action Taken: No Action Taken.
    Entry "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts" refers to invalid object ".DTX". Action Taken: No Action Taken.
    Entry "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts" refers to invalid object ".EW". Action Taken: No Action Taken.
    Entry "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts" refers to invalid object ".F". Action Taken: No Action Taken.
    Entry "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts" refers to invalid object ".GEM". Action Taken: No Action Taken.
    Entry "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts" refers to invalid object ".GID". Action Taken: No Action Taken.
    Entry "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts" refers to invalid object ".ID". Action Taken: No Action Taken.
    Entry "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts" refers to invalid object ".IMS". Action Taken: No Action Taken.
    Entry "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts" refers to invalid object ".isu". Action Taken: No Action Taken.
    Entry "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts" refers to invalid object ".lng". Action Taken: No Action Taken.
    Entry "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts" refers to invalid object ".LST". Action Taken: No Action Taken.
    Entry "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts" refers to invalid object ".mac". Action Taken: No Action Taken.
    Entry "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts" refers to invalid object ".mbx". Action Taken: No Action Taken.
    Entry "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts" refers to invalid object ".mmt". Action Taken: No Action Taken.
    Entry "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts" refers to invalid object ".MTB". Action Taken: No Action Taken.
    Entry "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts" refers to invalid object ".MYS". Action Taken: No Action Taken.
    Entry "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts" refers to invalid object ".pf". Action Taken: No Action Taken.
    Entry "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts" refers to invalid object ".php". Action Taken: No Action Taken.
    Entry "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts" refers to invalid object ".ra". Action Taken: No Action Taken.
    Entry "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts" refers to invalid object ".ram". Action Taken: No Action Taken.
    Entry "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts" refers to invalid object ".rf". Action Taken: No Action Taken.
    Entry "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts" refers to invalid object ".rjs". Action Taken: No Action Taken.
    Entry "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts" refers to invalid object ".rm". Action Taken: No Action Taken.
    Entry "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts" refers to invalid object ".rmm". Action Taken: No Action Taken.
    Entry "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts" refers to invalid object ".rmp". Action Taken: No Action Taken.
    Entry "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts" refers to invalid object ".rmx". Action Taken: No Action Taken.
    Entry "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts" refers to invalid object ".rnx". Action Taken: No Action Taken.
    Entry "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts" refers to invalid object ".rp". Action Taken: No Action Taken.
    Entry "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts" refers to invalid object ".rsl". Action Taken: No Action Taken.
    Entry "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts" refers to invalid object ".rsml". Action Taken: No Action Taken.
    Entry "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts" refers to invalid object ".rt". Action Taken: No Action Taken.
    Entry "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts" refers to invalid object ".rv". Action Taken: No Action Taken.
    Entry "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts" refers to invalid object ".sah". Action Taken: No Action Taken.
    Entry "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts" refers to invalid object ".sav". Action Taken: No Action Taken.
    Entry "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts" refers to invalid object ".sbk". Action Taken: No Action Taken.
    Entry "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts" refers to invalid object ".sdi". Action Taken: No Action Taken.
    Entry "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts" refers to invalid object ".smi". Action Taken: No Action Taken.
    Entry "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts" refers to invalid object ".smil". Action Taken: No Action Taken.
    Entry "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts" refers to invalid object ".ssm". Action Taken: No Action Taken.
    Entry "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts" refers to invalid object ".tls". Action Taken: No Action Taken.
    Entry "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts" refers to invalid object ".tmp". Action Taken: No Action Taken.
    Entry "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts" refers to invalid object ".VDF". Action Taken: No Action Taken.
    Entry "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts" refers to invalid object ".VOB". Action Taken: No Action Taken.
    Entry "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts" refers to invalid object ".W32". Action Taken: No Action Taken.
    Entry "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts" refers to invalid object ".wks". Action Taken: No Action Taken.
    Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache" refers to invalid object "AntiVir/XP". Action Taken: No Action Taken.
    Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache" refers to invalid object "ieupdate". Action Taken: No Action Taken.
    Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache" refers to invalid object "K-Oikotiet 1.0". Action Taken: No Action Taken.
    Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache" refers to invalid object "KB824146". Action Taken: No Action Taken.
    Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache" refers to invalid object "oeupdate". Action Taken: No Action Taken.
    Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache" refers to invalid object "Popillon Demo". Action Taken: No Action Taken.
    Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache" refers to invalid object "Q311967". Action Taken: No Action Taken.
    Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache" refers to invalid object "Q313450". Action Taken: No Action Taken.
    Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache" refers to invalid object "Q314147". Action Taken: No Action Taken.
    Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache" refers to invalid object "Q314862". Action Taken: No Action Taken.
    Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache" refers to invalid object "Q315000". Action Taken: No Action Taken.
    Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache" refers to invalid object "Q315403". Action Taken: No Action Taken.
    Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache" refers to invalid object "Q317277". Action Taken: No Action Taken.
    Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache" refers to invalid object "Q318138". Action Taken: No Action Taken.
    Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache" refers to invalid object "RealPlayer 6.0". Action Taken: No Action Taken.
    Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache" refers to invalid object "SETI@home". Action Taken: No Action Taken.
    Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache" refers to invalid object "Sound Blaster PCI". Action Taken: No Action Taken.
    Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache" refers to invalid object "{7357A00D-1395-42CD-B803-1BB134C7457D}". Action Taken: No Action Taken.
    File C:\WINDOWS\System32\.pif infected by "Trojan-Downloader.BAT.Ftp.y" Virus! Action Taken: No Action Taken.
    File C:\TEMPOR~1\Content.IE5\WBLRIYF5\PopularScreenSaversFWBInitialSetup1.0.0.15-3[1].cab/f3Setup1.exe tagged as "not-a-virus:AdTool.Win32.MyWebSearch.aw". Action Taken: No Action Taken.
    File C:\WINDOWS\SYSTEM32\.pif infected by "Trojan-Downloader.BAT.Ftp.y" Virus! Action Taken: No Action Taken.
    File C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\8J0P438H\sdferw[1].htm//PE_Patch.UPX//UPX tagged as "not-a-virus:AdWare.Win32.E404.g". Action Taken: No Action Taken.
    File C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\4FWDKBQJ\hrvvjn[1].txt infected by "Trojan-Downloader.Win32.Small.uhg" Virus! Action Taken: No Action Taken.
    File C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\6HAN4P2X\bhos[1].exe infected by "Trojan-Downloader.Win32.Small.ixc" Virus! Action Taken: No Action Taken.
    File C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\6HAN4P2X\1207636973[1].dll//PE_Patch.PECompact//PecBundle//PECompact infected by "Trojan-Downloader.Win32.Small.ixg" Virus! Action Taken: No Action Taken.
    File C:\System Volume Information\_restore{C2DF4AD9-1997-4BA1-AF30-B196284CC8C3}\RP1341\A0170483.DLL tagged as "not-a-virus:AdWare.Win32.FunWeb.e". Action Taken: No Action Taken.
    File C:\System Volume Information\_restore{C2DF4AD9-1997-4BA1-AF30-B196284CC8C3}\RP1346\A0170580.dll tagged as "not-a-virus:AdTool.Win32.MyWebSearch.au". Action Taken: No Action Taken.
    File C:\System Volume Information\_restore{C2DF4AD9-1997-4BA1-AF30-B196284CC8C3}\RP1346\A0170581.scr tagged as "not-a-virus:AdTool.Win32.MyWebSearch". Action Taken: No Action Taken.
    File C:\System Volume Information\_restore{C2DF4AD9-1997-4BA1-AF30-B196284CC8C3}\RP1346\A0170582.DLL tagged as "not-a-virus:AdTool.Win32.MyWebSearch.at". Action Taken: No Action Taken.
    File C:\System Volume Information\_restore{C2DF4AD9-1997-4BA1-AF30-B196284CC8C3}\RP1346\A0170584.DLL tagged as "not-a-virus:AdTool.Win32.MyWebSearch.bc". Action Taken: No Action Taken.
    File C:\System Volume Information\_restore{C2DF4AD9-1997-4BA1-AF30-B196284CC8C3}\RP1346\A0170585.DLL tagged as "not-a-virus:AdTool.Win32.MyWebSearch". Action Taken: No Action Taken.
    File C:\System Volume Information\_restore{C2DF4AD9-1997-4BA1-AF30-B196284CC8C3}\RP1346\A0170586.DLL tagged as "not-a-virus:AdTool.Win32.MyWebSearch.af". Action Taken: No Action Taken.
    File C:\System Volume Information\_restore{C2DF4AD9-1997-4BA1-AF30-B196284CC8C3}\RP1346\A0170587.DLL tagged as "not-a-virus:AdTool.Win32.MyWebSearch.au". Action Taken: No Action Taken.
    File C:\System Volume Information\_restore{C2DF4AD9-1997-4BA1-AF30-B196284CC8C3}\RP1346\A0170588.DLL tagged as "not-a-virus:AdTool.Win32.MyWebSearch.au". Action Taken: No Action Taken.
    File C:\System Volume Information\_restore{C2DF4AD9-1997-4BA1-AF30-B196284CC8C3}\RP1346\A0170589.SCR tagged as "not-a-virus:AdTool.Win32.MyWebSearch". Action Taken: No Action Taken.
    File C:\System Volume Information\_restore{C2DF4AD9-1997-4BA1-AF30-B196284CC8C3}\RP1346\A0170590.DLL tagged as "not-a-virus:AdTool.Win32.MyWebSearch.au". Action Taken: No Action Taken.
    File C:\System Volume Information\_restore{C2DF4AD9-1997-4BA1-AF30-B196284CC8C3}\RP1346\A0170591.DLL tagged as "not-a-virus:AdTool.Win32.MyWebSearch". Action Taken: No Action Taken.
    File C:\System Volume Information\_restore{C2DF4AD9-1997-4BA1-AF30-B196284CC8C3}\RP1346\A0170592.EXE tagged as "not-a-virus:AdTool.Win32.MyWebSearch.a". Action Taken: No Action Taken.
    File C:\System Volume Information\_restore{C2DF4AD9-1997-4BA1-AF30-B196284CC8C3}\RP1346\A0170593.DLL tagged as "not-a-virus:AdTool.Win32.MyWebSearch.an". Action Taken: No Action Taken.
    File C:\System Volume Information\_restore{C2DF4AD9-1997-4BA1-AF30-B196284CC8C3}\RP1346\A0170594.DLL tagged as "not-a-virus:AdTool.Win32.MyWebSearch.aq". Action Taken: No Action Taken.
    File C:\System Volume Information\_restore{C2DF4AD9-1997-4BA1-AF30-B196284CC8C3}\RP1346\A0170595.DLL tagged as "not-a-virus:AdTool.Win32.MyWebSearch.bh". Action Taken: No Action Taken.
    File C:\System Volume Information\_restore{C2DF4AD9-1997-4BA1-AF30-B196284CC8C3}\RP1346\A0170597.DLL tagged as "not-a-virus:AdTool.Win32.MyWebSearch.bc". Action Taken: No Action Taken.
    File C:\System Volume Information\_restore{C2DF4AD9-1997-4BA1-AF30-B196284CC8C3}\RP1346\A0170598.DLL tagged as "not-a-virus:AdTool.Win32.MyWebSearch.ax". Action Taken: No Action Taken.
    File C:\System Volume Information\_restore{C2DF4AD9-1997-4BA1-AF30-B196284CC8C3}\RP1346\A0170600.DLL tagged as "not-a-virus:AdTool.Win32.MyWebSearch.bc". Action Taken: No Action Taken.
    File C:\System Volume Information\_restore{C2DF4AD9-1997-4BA1-AF30-B196284CC8C3}\RP1346\A0170602.DLL tagged as "not-a-virus:AdTool.Win32.MyWebSearch". Action Taken: No Action Taken.
    File C:\System Volume Information\_restore{C2DF4AD9-1997-4BA1-AF30-B196284CC8C3}\RP1346\A0170603.DLL tagged as "not-a-virus:AdTool.Win32.MyWebSearch.as". Action Taken: No Action Taken.
    File C:\System Volume Information\_restore{C2DF4AD9-1997-4BA1-AF30-B196284CC8C3}\RP1346\A0170604.DLL tagged as "not-a-virus:AdTool.Win32.MyWebSearch.ad". Action Taken: No Action Taken.
    File C:\System Volume Information\_restore{C2DF4AD9-1997-4BA1-AF30-B196284CC8C3}\RP1346\A0170606.EXE tagged as "not-a-virus:AdTool.Win32.MyWebSearch.au". Action Taken: No Action Taken.
    File C:\System Volume Information\_restore{C2DF4AD9-1997-4BA1-AF30-B196284CC8C3}\RP1346\A0170607.EXE tagged as "not-a-virus:AdTool.Win32.MyWebSearch.au". Action Taken: No Action Taken.
    File C:\System Volume Information\_restore{C2DF4AD9-1997-4BA1-AF30-B196284CC8C3}\RP1346\A0170608.DLL tagged as "not-a-virus:AdTool.Win32.MyWebSearch.au". Action Taken: No Action Taken.
    File C:\System Volume Information\_restore{C2DF4AD9-1997-4BA1-AF30-B196284CC8C3}\RP1346\A0170609.DLL tagged as "not-a-virus:AdTool.Win32.MyWebSearch.i". Action Taken: No Action Taken.
    File C:\System Volume Information\_restore{C2DF4AD9-1997-4BA1-AF30-B196284CC8C3}\RP1346\A0170633.DLL tagged as "not-a-virus:AdTool.Win32.MyWebSearch.as". Action Taken: No Action Taken.
    File C:\System Volume Information\_restore{C2DF4AD9-1997-4BA1-AF30-B196284CC8C3}\RP1346\A0170634.DLL tagged as "not-a-virus:AdTool.Win32.MyWebSearch.l". Action Taken: No Action Taken.
    File C:\System Volume Information\_restore{C2DF4AD9-1997-4BA1-AF30-B196284CC8C3}\RP1346\A0170635.DLL tagged as "not-a-virus:AdTool.Win32.MyWebSearch.bc". Action Taken: No Action Taken.
    File C:\System Volume Information\_restore{C2DF4AD9-1997-4BA1-AF30-B196284CC8C3}\RP1346\A0170636.EXE tagged as "not-a-virus:AdTool.Win32.MyWebSearch". Action Taken: No Action Taken.
    File C:\System Volume Information\_restore{C2DF4AD9-1997-4BA1-AF30-B196284CC8C3}\RP1346\A0170637.DLL tagged as "not-a-virus:AdTool.Win32.MyWebSearch". Action Taken: No Action Taken.
    File C:\System Volume Information\_restore{C2DF4AD9-1997-4BA1-AF30-B196284CC8C3}\RP1347\A0170657.dll tagged as "not-a-virus:AdTool.Win32.MyWebSearch.bc". Action Taken: No Action Taken.
    File C:\8e162bd98e59943c7271b004a40eb8\helpctr.exe infected by "NULL.Corrupted" Virus! Action Taken: No Action Taken.
    File C:\0134d3ee2d233ac5252b\helpctr.exe infected by "NULL.Corrupted" Virus! Action Taken: No Action Taken.
    File C:\Temporary Internet Files\Content.IE5\WBLRIYF5\PopularScreenSaversFWBInitialSetup1.0.0.15-3[1].cab/f3Setup1.exe tagged as "not-a-virus:AdTool.Win32.MyWebSearch.aw". Action Taken: No Action Taken.
    File C:\Program Files\Helper\1207535106.dll//PE_Patch.UPX//UPX tagged as "not-a-virus:AdWare.Win32.E404.f". Action Taken: No Action Taken.
    File E:\sokoman.exe infected by "NULL.Corrupted" Virus! Action Taken: No Action Taken.
     
    Sarika, Apr 15, 2008
    #14
  15. Hujo

    Hujo Guest

    otas valvojan oikeudet käyttöön
    jos niitä ei ole niin koneen puhdistaminen vaikeeta...
    ilmankos noi fixsauksilla ei lähtenyt ne pois mitä laitoin

    sitten tuo käyttöön
    Malwarebytes' Anti-Malware
     
    Hujo, Apr 15, 2008
    #15

Share This Page