Viruksia ja troijalaisia koneessa. Hijack tehty.

Moi!
Kone tökkii tosi pahasti. Käynnistys kestää n. 4 min. Tullut viikko sitten putsauksesta. Virustorjuntana AVG 7.5 ja palomuurina Sygate personal. Käytän Firefoxia nettiselailuun ja nyt tämä Winantivirus sekä joku System Doctor (ei Nortonin) kaappaa jatkuvasti IE:n. Oon skannannut koneen läpi vaikka kuinka monella ohjelmalla ja aina löytyy jotain. Tuntuu vain, että ongelmat eivät poistu vaikka ohjelmat niin lupaileekin.

Vedin Hijackthis:in läpi.

Logfile of HijackThis v1.99.1
Scan saved at 12:15:31, on 20.4.2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Sygate\SPF\smc.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
C:\Program Files\Java\j2re1.4.2_03\bin\jusched.exe
C:\Program Files\BillP Studios\WinPatrol\winpatrol.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe
C:\PROGRA~1\Grisoft\AVG7\avgcc.exe
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\system32\PnkBstrA.exe
C:\Program Files\Logitech\SetPoint\SetPoint.exe
C:\Program Files\Ray Adams\ATI Tray Tools\atitray.exe
C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.EXE
C:\Program Files\Common Files\Logitech\khalshared\KHALMNPR.EXE
C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\ccc.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Documents and Settings\Jani.JAPPE-3UI5AROGO\Työpöytä\hijackthis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.fi/
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Linkit
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\j2re1.4.2_03\bin\jusched.exe
O4 - HKLM\..\Run: [Advanced DHTML Enable] C:\WINDOWS\System32\rjycl.exe
O4 - HKLM\..\Run: [SmcService] C:\PROGRA~1\Sygate\SPF\smc.exe -startgui
O4 - HKLM\..\Run: [Kernel and Hardware Abstraction Layer] KHALMNPR.EXE
O4 - HKLM\..\Run: [WinPatrol] C:\Program Files\BillP Studios\WinPatrol\winpatrol.exe
O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
O4 - HKLM\..\Run: [PrintDrive] rundll32.exe "C:\WINDOWS\system32\vnqvdtfi.dll",setvm
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVG7\avgcc.exe /STARTUP
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [StartCCC] C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe
O4 - HKCU\..\Run: [ccleaner] "C:\Program Files\CCleaner\ccleaner.exe" /AUTO
O4 - Startup: ATI Tray Tools.lnk = C:\Program Files\Ray Adams\ATI Tray Tools\atitray.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Reader 8.0\Reader\reader_sl.exe
O4 - Global Startup: Adobe Reader Synchronizer.lnk = C:\Program Files\Adobe\Reader 8.0\Reader\AdobeCollabSync.exe
O4 - Global Startup: Logitech SetPoint.lnk = C:\Program Files\Logitech\SetPoint\SetPoint.exe
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2_03\bin\npjpi142_03.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2_03\bin\npjpi142_03.dll
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1175086735484
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: AVG Anti-Spyware Guard - Anti-Malware Development a.s. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1150\Intel 32\IDriverT.exe
O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\system32\PnkBstrA.exe
O23 - Service: PnkBstrB - Unknown owner - C:\WINDOWS\system32\PnkBstrB.exe
O23 - Service: Sygate Personal Firewall (SmcService) - Sygate Technologies, Inc. - C:\Program Files\Sygate\SPF\smc.exe


Kiitos avuista jo etukäteen.

 

HijackThis.exe nimeä uudelleen esim. Skanneri.exe nimellä

Lataa VundoFix.exe työpöydällesi.
*Tupla-klikkaa VundoFix.exe ajaaksesi sen.
*Klikkaa Scan for Vundo valintaa.
*Kun skannaus on valmis, klikkaa Remove Vundo valintaa.
*Sinulta kysytään haluatko poistaa filut - klikkaa YES.
*Kun olet klikannut yes, työpöytäsi tyhjenee kun se alkaa poistamaan Vundoa.
*Kun se on valmis, fiksi ilmoittaa käynnistäväsi koneesi uudelleen, klikkaa OK.
*Postita C:\vundofix.txt lokin sekä tuoreen HijackThis lokin sisältö.


Huomaa: Se on mahdollista että VundoFix löysi tiedoston jota se ei pystynyt poistamaan.
Tässä tilanteessa, VundoFix ajaa itsensä rebootissa, seuraa vain yläpuolelle olevia ohjeita alkaen kohdasta "Klikkaa Scan for Vundo valintaa." kun VundoFix ilmaantuu uudelleenkäynnistyksen yhteydessä.

********

1. Lataa combofix.exe työpöydällesi jommastakummasta linkistä:
http://www.techsupportforum.com/sectools/sUBs/ComboFix.exe
http://download.bleepingcomputer.com/sUBs/ComboFix.exe

2. Tuplaklikkaa combofix.exe tiedostoa ja seuraa ohjeistuksia.
3. Kun työkalu on valmis, se tuottaa lokin. (C:\ComboFix.txt) Lähetä tämä loki viesti ketjuusi.
Huom! Älä klikkaile combofixin ikkunaa käytön aikana. Tämä saattaa aiheuttaa ohjelman jumiutumisen.

*******

uusi hijackthis logi

 

Moi!

Tässä pyytämäsi:

"Jani" - 07-04-20 13:36:30 Service Pack 2
ComboFix 07-04-19.2V - Running from: C:\Documents and Settings\Jani.JAPPE-3UI5AROGO\Ty”p”yt„\


(((((((((((((((((((((((((((((((((((((((((((((((((( V Log )))))))))))))))))))))))))))))))))))))))))))))))))))))))


C:\WINDOWS\system32\mljjj.dll
C:\WINDOWS\system32\pmkhi.dll
C:\WINDOWS\system32\vtstr.dll
C:\WINDOWS\system32\ckbjmvxo.dll
C:\WINDOWS\system32\cmoogmne.dll
C:\WINDOWS\system32\khsueunv.dll
C:\WINDOWS\system32\qnhawoee.dll
C:\WINDOWS\system32\weavbplo.dll
C:\WINDOWS\system32\jjjlm.ini
C:\WINDOWS\system32\ihkmp.ini
C:\WINDOWS\system32\rtstv.tmp
C:\WINDOWS\system32\cbxutst.dll


* * * POST RUN FILES/FOLDERS * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * *



(((((((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))


C:\install.log
C:\Program Files\windows adstatus


((((((((((((((((((((((((((((((( Files Created from 2007-03-20 to 2007-04-20 ))))))))))))))))))))))))))))))))))


2007-04-20 11:49 125,460 --a------ C:\WINDOWS\system32\vtboyrgj.dll
2007-04-19 18:48 <KANSIO> d-------- C:\VundoFix Backups
2007-04-19 12:58 <KANSIO> d-------- C:\DOCUME~1\JANI~1.JAP\APPLIC~1\Help
2007-04-18 22:28 <KANSIO> d-------- C:\DOCUME~1\ALLUSE~1.WIN\APPLIC~1\Spybot - Search & Destroy
2007-04-17 14:55 765,952 --a------ C:\WINDOWS\system32\xvidcore.dll
2007-04-17 14:55 639,066 --a------ C:\WINDOWS\system32\divx.dll
2007-04-17 14:55 180,224 --a------ C:\WINDOWS\system32\xvidvfw.dll
2007-04-16 21:03 <KANSIO> d-------- C:\DOCUME~1\JANI~1.JAP\DoctorWeb
2007-04-16 20:31 10,752 --a------ C:\WINDOWS\system32\ff_vfw.dll
2007-04-16 20:31 <KANSIO> d-------- C:\Program Files\ffdshow
2007-04-16 19:19 <KANSIO> d-------- C:\Bases
2007-04-16 19:17 <KANSIO> d-------- C:\Kaspersky
2007-04-16 10:37 <KANSIO> d-------- C:\Program Files\Bus Driver
2007-04-16 10:20 <KANSIO> d-------- C:\DOCUME~1\JANI~1.JAP\APPLIC~1\Registry Booster
2007-04-15 23:35 376,832 --a------ C:\WINDOWS\system\xvid.dll
2007-04-15 14:18 <KANSIO> d-------- C:\DOCUME~1\JANI~1.JAP\APPLIC~1\Adobe
2007-04-15 14:13 <KANSIO> d-------- C:\DOCUME~1\ALLUSE~1.WIN\APPLIC~1\Adobe
2007-04-05 00:44 <KANSIO> d-------- C:\Program Files\ATITool
2007-04-04 00:52 118,784 --a------ C:\WINDOWS\system32\MSSTDFMT.DLL
2007-04-04 00:52 <KANSIO> d-------- C:\Program Files\SpywareBlaster
2007-04-03 23:20 22,584 --a------ C:\WINDOWS\system32\drivers\PnkBstrK.sys
2007-04-03 21:04 99,904 --a------ C:\WINDOWS\system32\PnkBstrB.exe
2007-04-03 21:04 63,040 --a------ C:\WINDOWS\system32\PnkBstrA.exe
2007-04-03 17:32 <KANSIO> d-------- C:\DOCUME~1\JANI~1.JAP\APPLIC~1\atitray
2007-04-03 17:31 <KANSIO> d-------- C:\Program Files\Ray Adams
2007-04-03 17:07 3,968 --a------ C:\WINDOWS\system32\drivers\AvgAsCln.sys
2007-04-03 17:05 <KANSIO> d-------- C:\Program Files\BillP Studios
2007-04-03 17:05 <KANSIO> d-------- C:\DOCUME~1\JANI~1.JAP\APPLIC~1\WinPatrol
2007-04-02 20:29 <KANSIO> d-------- C:\Program Files\Uniblue
2007-04-02 20:29 <KANSIO> d-------- C:\DOCUME~1\JANI~1.JAP\APPLIC~1\Uniblue
2007-04-02 17:22 5,600 --a------ C:\WINDOWS\system\WINASPI.DLL
2007-04-02 17:22 45,056 --a------ C:\WINDOWS\system32\WNASPI32.DLL
2007-04-02 17:22 4,672 --a------ C:\WINDOWS\system\WOWPOST.EXE
2007-04-02 17:22 25,244 --a------ C:\WINDOWS\system32\drivers\ASPI32.SYS
2007-04-02 17:21 165,376 --a------ C:\WINDOWS\system32\msvcr70.dll
2007-03-30 00:54 <KANSIO> d-------- C:\DOCUME~1\JANI~1.JAP\APPLIC~1\Azureus
2007-03-29 05:41 <KANSIO> d-------- C:\DOCUME~1\JANI~1.JAP\APPLIC~1\Media Player Classic
2007-03-29 05:40 73,728 --a------ C:\WINDOWS\system32\dpl100.dll
2007-03-29 05:40 3,596,288 --a------ C:\WINDOWS\system32\qt-dx331.dll
2007-03-29 05:40 217,088 --a------ C:\WINDOWS\system32\yv12vfw.dll
2007-03-29 05:40 200,704 --a------ C:\WINDOWS\system32\ssldivx.dll
2007-03-29 05:40 196,608 --a------ C:\WINDOWS\system32\dtu100.dll
2007-03-29 05:40 1,565,480 --a------ C:\WINDOWS\system32\wmv9vcm.dll
2007-03-29 05:40 1,044,480 --a------ C:\WINDOWS\system32\libdivx.dll
2007-03-29 05:40 <KANSIO> d-------- C:\DOCUME~1\JANI~1.JAP\APPLIC~1\Real
2007-03-29 05:40 <KANSIO> d-------- C:\DOCUME~1\ALLUSE~1.WIN\APPLIC~1\Real
2007-03-29 05:40 <KANSIO> d-------- C:\DOCUME~1\ALLUSE~1.WIN\APPLIC~1\Apple Computer
2007-03-28 20:28 0 --a------ C:\WINDOWS\nsreg.dat
2007-03-28 20:28 <KANSIO> d-------- C:\DOCUME~1\JANI~1.JAP\APPLIC~1\Talkback
2007-03-28 20:26 <KANSIO> d-------- C:\DOCUME~1\JANI~1.JAP\APPLIC~1\Logitech
2007-03-28 20:25 69,632 --a------ C:\WINDOWS\system32\KemXML.dll
2007-03-28 20:25 34,576 --a------ C:\WINDOWS\system32\drivers\LHidFilt.Sys
2007-03-28 20:25 33,296 --a------ C:\WINDOWS\system32\drivers\LMouFilt.Sys
2007-03-28 20:25 20,496 --a------ C:\WINDOWS\system32\drivers\L8042Kbd.sys
2007-03-28 20:25 163,840 --a------ C:\WINDOWS\system32\kemutb.dll
2007-03-28 20:25 135,168 --a------ C:\WINDOWS\system32\KemUtil.dll
2007-03-28 20:25 110,592 --a------ C:\WINDOWS\system32\KemWnd.dll
2007-03-28 20:25 101,136 --a------ C:\WINDOWS\KHALMNPR.Exe
2007-03-28 20:25 1,419,024 --a------ C:\WINDOWS\system32\WdfCoInstaller01005.dll
2007-03-28 20:24 83,096 --a------ C:\WINDOWS\system32\SSSensor.dll
2007-03-28 20:24 60,496 --a------ C:\WINDOWS\system32\drivers\Teefer.sys
2007-03-28 20:24 21,075 --a------ C:\WINDOWS\system32\drivers\wpsdrvnt.sys
2007-03-28 20:24 14,568 --a------ C:\WINDOWS\system32\drivers\wg6n.sys
2007-03-28 20:24 14,568 --a------ C:\WINDOWS\system32\drivers\wg5n.sys
2007-03-28 20:24 14,568 --a------ C:\WINDOWS\system32\drivers\wg4n.sys
2007-03-28 20:24 14,568 --a------ C:\WINDOWS\system32\drivers\wg3n.sys
2007-03-28 20:24 <KANSIO> d-------- C:\DOCUME~1\ALLUSE~1.WIN\APPLIC~1\Logitech
2007-03-28 20:22 <KANSIO> d-------- C:\Downloads
2007-03-28 20:22 <KANSIO> d-------- C:\DOCUME~1\JANI~1.JAP\APPLIC~1\GetRightToGo
2007-03-28 18:19 2,297,552 --a------ C:\WINDOWS\system32\d3dx9_26.dll
2007-03-28 18:12 499,712 --a------ C:\WINDOWS\system32\MSVCP71.dll
2007-03-28 18:12 348,160 --a------ C:\WINDOWS\system32\MSVCR71.dll
2007-03-28 18:12 1,060,864 --a------ C:\WINDOWS\system32\MFC71.dll
2007-03-28 16:59 450,560 --a------ C:\DOCUME~1\JRJEST~1.JAP\NTUSER.DAT
2007-03-28 16:59 <KANSIO> dr------- C:\DOCUME~1\JRJEST~1.JAP\Omat tiedostot
2007-03-28 16:59 <KANSIO> dr------- C:\DOCUME~1\JRJEST~1.JAP\K„ynnist„-valikko
2007-03-28 16:59 <KANSIO> d--h----- C:\DOCUME~1\JRJEST~1.JAP\Verkkoymp„rist”
2007-03-28 16:59 <KANSIO> d--h----- C:\DOCUME~1\JRJEST~1.JAP\Tulostinymp„rist”
2007-03-28 16:59 <KANSIO> d--h----- C:\DOCUME~1\JRJEST~1.JAP\Mallit
2007-03-28 16:59 <KANSIO> d-------- C:\DOCUME~1\JRJEST~1.JAP\Ty”p”yt„
2007-03-28 16:59 <KANSIO> d-------- C:\DOCUME~1\JRJEST~1.JAP\Suosikit
2007-03-28 16:59 <KANSIO> d-------- C:\DOCUME~1\JRJEST~1.JAP\APPLIC~1\Sun
2007-03-28 16:41 <KANSIO> d-------- C:\DOCUME~1\JANI~1.JAP\APPLIC~1\Lavasoft
2007-03-28 16:39 <KANSIO> d-------- C:\Program Files\CCleaner
2007-03-28 16:34 262,144 --a------ C:\DOCUME~1\ALLUSE~1.WIN\ntuser.dat
2007-03-28 16:33 <KANSIO> d-------- C:\DOCUME~1\ALLUSE~1.WIN\APPLIC~1\Windows Genuine Advantage
2007-03-28 16:11 5,632 --a------ C:\WINDOWS\system32\drivers\Entech64.sys
2007-03-28 16:11 3,972 --a------ C:\WINDOWS\system32\drivers\PciBus.sys
2007-03-28 16:11 21,664 --a------ C:\WINDOWS\system32\drivers\Entech.sys
2007-03-28 16:09 <KANSIO> d-------- C:\Program Files\Futuremark
2007-03-28 16:03 23,856 --a------ C:\WINDOWS\system32\spupdsvc.exe
2007-03-28 15:59 520,192 --------- C:\WINDOWS\system32\ati2sgag.exe
2007-03-28 15:58 <KANSIO> d---s---- C:\DOCUME~1\JANI~1.JAP\UserData
2007-03-28 15:58 <KANSIO> d-------- C:\Program Files\ATI Technologies
2007-03-28 15:39 <KANSIO> d-------- C:\WINDOWS\Prefetch
2007-03-28 15:35 221,184 --a------ C:\WINDOWS\system32\wmpns.dll
2007-03-28 15:32 8,192 --a------ C:\WINDOWS\system32\bitsprx2.dll
2007-03-28 15:32 7,168 --a------ C:\WINDOWS\system32\bitsprx3.dll
2007-03-28 15:32 23,040 --a------ C:\WINDOWS\system32\fltmc.exe
2007-03-28 15:32 16,896 --a------ C:\WINDOWS\system32\fltlib.dll
2007-03-28 15:32 128,896 --a------ C:\WINDOWS\system32\drivers\fltmgr.sys
2007-03-28 15:15 24,661 --a------ C:\WINDOWS\system32\spxcoins.dll
2007-03-28 15:15 13,312 --a------ C:\WINDOWS\system32\irclass.dll
2007-03-28 11:13 <KANSIO> d--hs---- C:\found.000
2007-03-28 02:49 6,400 --a------ C:\WINDOWS\system32\drivers\enum1394.sys
2007-03-28 02:49 57,216 --a------ C:\WINDOWS\system32\drivers\redbook.sys
2007-03-28 02:49 3,072 --a------ C:\WINDOWS\system32\drivers\audstub.sys
2007-03-28 02:45 69,856 --a------ C:\WINDOWS\system\AVICAP.DLL
2007-03-28 02:45 176,157 --a------ C:\WINDOWS\system32\dgrpsetu.dll
2007-03-28 02:45 11,264 --a------ C:\WINDOWS\system32\drivers\irenum.sys
2007-03-28 02:45 103,424 --a------ C:\WINDOWS\system32\EqnClass.Dll
2007-03-28 02:44 74,240 --a------ C:\WINDOWS\system32\storprop.dll
2007-03-28 02:44 <KANSIO> dr------- C:\DOCUME~1\DEFAUL~1.WIN\K„ynnist„-valikko
2007-03-28 02:44 <KANSIO> dr------- C:\DOCUME~1\ALLUSE~1.WIN\Tiedostot
2007-03-28 02:44 <KANSIO> dr------- C:\DOCUME~1\ALLUSE~1.WIN\K„ynnist„-valikko
2007-03-28 02:44 <KANSIO> d--h----- C:\DOCUME~1\DEFAUL~1.WIN\Verkkoymp„rist”
2007-03-28 02:44 <KANSIO> d--h----- C:\DOCUME~1\DEFAUL~1.WIN\Tulostinymp„rist”
2007-03-28 02:44 <KANSIO> d--h----- C:\DOCUME~1\DEFAUL~1.WIN\Mallit
2007-03-28 02:44 <KANSIO> d--h----- C:\DOCUME~1\ALLUSE~1.WIN\Mallit
2007-03-28 02:44 <KANSIO> d-------- C:\DOCUME~1\DEFAUL~1.WIN\Ty”p”yt„
2007-03-28 02:44 <KANSIO> d-------- C:\DOCUME~1\DEFAUL~1.WIN\Suosikit
2007-03-28 02:44 <KANSIO> d-------- C:\DOCUME~1\ALLUSE~1.WIN\Ty”p”yt„
2007-03-28 02:44 <KANSIO> d-------- C:\DOCUME~1\ALLUSE~1.WIN\Suosikit
2007-03-28 02:38 465,176 --a------ C:\WINDOWS\system32\wuapi.dll
2007-03-28 02:38 41,240 --a------ C:\WINDOWS\system32\wups.dll
2007-03-28 02:38 194,840 --a------ C:\WINDOWS\system32\wuaueng1.dll
2007-03-28 02:38 173,848 --a------ C:\WINDOWS\system32\wuauclt1.exe
2007-03-28 02:38 173,536 --a------ C:\WINDOWS\system32\wuweb.dll
2007-03-28 02:38 127,256 --a------ C:\WINDOWS\system32\wucltui.dll
2007-03-28 02:29 <KANSIO> d-------- C:\WUTemp
2007-03-28 02:26 <KANSIO> d-------- C:\DOCUME~1\JANI~1.JAP\APPLIC~1\ATI
2007-03-28 02:20 85,376 --a------ C:\WINDOWS\system32\drivers\nabtsfec.sys
2007-03-28 02:20 51,328 --a------ C:\WINDOWS\system32\drivers\msdv.sys
2007-03-28 02:20 19,328 --a------ C:\WINDOWS\system32\drivers\wstcodec.sys
2007-03-28 02:20 17,024 --a------ C:\WINDOWS\system32\drivers\ccdecode.sys
2007-03-28 02:13 576 --a------ C:\drvpnp.dat
2007-03-28 02:12 <KANSIO> d-------- C:\$CTJTMP
2007-03-28 02:09 86,016 -ra------ C:\WINDOWS\system32\mdmxsdk.dll
2007-03-28 02:09 679,808 -ra------ C:\WINDOWS\system32\drivers\HSF_CNXT.sys
2007-03-28 02:09 6,400 --a------ C:\WINDOWS\system32\drivers\splitter.sys
2007-03-28 02:09 53,248 --a------ C:\WINDOWS\system32\vbalicom6.dll
2007-03-28 02:09 52,864 --a------ C:\WINDOWS\system32\drivers\DMusic.sys
2007-03-28 02:09 38,784 -ra------ C:\WINDOWS\system32\drivers\an983.sys
2007-03-28 02:09 32,768 --a------ C:\WINDOWS\system32\ssubtmr6.dll
2007-03-28 02:09 32,218 -ra------ C:\WINDOWS\system32\HSFCI008.dll
2007-03-28 02:09 210,304 -ra------ C:\WINDOWS\system32\drivers\HSFHWBS2.sys
2007-03-28 02:09 12,970 -ra------ C:\WINDOWS\system32\drivers\mdmxsdk.sys
2007-03-28 02:09 1,042,816 -ra------ C:\WINDOWS\system32\drivers\HSF_DP.sys
2007-03-28 02:08 35,840 -ra------ C:\WINDOWS\system32\drivers\AmdK8.sys
2007-03-28 02:08 243,568 -ra------ C:\WINDOWS\system32\drivers\STAC97.sys
2007-03-28 02:07 763 --a------ C:\pnpID.dat
2007-03-28 02:05 5,504 --a------ C:\WINDOWS\system32\drivers\mstee.sys
2007-03-28 02:05 4,096 --a------ C:\WINDOWS\system32\ksuser.dll
2007-03-28 02:02 2,621,440 --ah----- C:\DOCUME~1\JANI~1.JAP\NTUSER.DAT
2007-03-28 02:02 <KANSIO> dr------- C:\DOCUME~1\JANI~1.JAP\Suosikit
2007-03-28 02:02 <KANSIO> dr------- C:\DOCUME~1\JANI~1.JAP\Omat tiedostot
2007-03-28 02:02 <KANSIO> dr------- C:\DOCUME~1\JANI~1.JAP\K„ynnist„-valikko
2007-03-28 02:02 <KANSIO> d--h----- C:\DOCUME~1\JANI~1.JAP\Verkkoymp„rist”
2007-03-28 02:02 <KANSIO> d--h----- C:\DOCUME~1\JANI~1.JAP\Tulostinymp„rist”
2007-03-28 02:02 <KANSIO> d--h----- C:\DOCUME~1\JANI~1.JAP\Mallit
2007-03-28 02:02 <KANSIO> d-------- C:\DOCUME~1\JANI~1.JAP\Ty”p”yt„
2007-03-28 02:02 <KANSIO> d-------- C:\DOCUME~1\JANI~1.JAP\APPLIC~1\Sun
2007-03-28 02:01 262,144 --ah----- C:\DOCUME~1\LOCALS~1.NT-\NTUSER.DAT
2007-03-28 02:01 233,472 --ah----- C:\DOCUME~1\NETWOR~1.NT-\NTUSER.DAT
2007-03-28 01:57 249,856 ---h----- C:\DOCUME~1\DEFAUL~1.WIN\NTUSER.DAT
2007-03-28 01:55 <KANSIO> dr------- C:\DOCUME~1\DEFAUL~1.WIN\Omat tiedostot
2007-03-28 01:55 <KANSIO> d-------- C:\WINDOWS\fsc
2007-03-28 01:55 <KANSIO> d-------- C:\DOCUME~1\DEFAUL~1.WIN\APPLIC~1\Sun
2007-03-28 01:55 <KANSIO> d-------- C:\AddOn
2007-03-28 01:54 26,112 --a------ C:\WINDOWS\system32\xpsp1hfm.exe
2007-03-28 01:54 240,640 --a------ C:\WINDOWS\system32\srrstr.dll
2007-03-28 01:54 186,368 --a------ C:\WINDOWS\system32\accwiz.exe
2007-03-28 01:53 112,128 --a------ C:\WINDOWS\system32\mapi32.dll
2007-03-28 01:53 0 --------- C:\AUTOEXEC.BAT
2007-03-28 01:52 45,568 --a------ C:\WINDOWS\system32\safrslv.dll
2007-03-28 01:52 43,520 --a------ C:\WINDOWS\system32\safrcdlg.dll
2007-03-28 01:52 43,520 --a------ C:\WINDOWS\system32\racpldlg.dll
2007-03-28 01:52 29,696 --a------ C:\WINDOWS\system32\safrdm.dll
2007-03-28 01:52 11,264 --a------ C:\WINDOWS\system32\atrace.dll
2007-03-28 01:52 <KANSIO> d--hs---- C:\DOCUME~1\ALLUSE~1.WIN\DRM
2007-03-28 01:51 86,016 --a------ C:\WINDOWS\system32\isign32.dll
2007-03-28 01:51 81,920 --a------ C:\WINDOWS\system32\ils.dll
2007-03-28 01:51 73,728 --a------ C:\WINDOWS\system32\icwdial.dll
2007-03-28 01:51 73,472 --a------ C:\WINDOWS\system32\drivers\sr.sys
2007-03-28 01:51 69,632 --a------ C:\WINDOWS\system32\msconf.dll
2007-03-28 01:51 67,584 --a------ C:\WINDOWS\system32\srclient.dll
2007-03-28 01:51 65,536 --a------ C:\WINDOWS\system32\icwphbk.dll
2007-03-28 01:51 64,512 --a------ C:\WINDOWS\system32\acctres.dll
2007-03-28 01:51 382,464 --a------ C:\WINDOWS\system32\qmgr.dll
2007-03-28 01:51 34,560 --a------ C:\WINDOWS\system32\mnmdd.dll
2007-03-28 01:51 32,768 --a------ C:\WINDOWS\system32\mnmsrvc.exe
2007-03-28 01:51 32,768 --a------ C:\WINDOWS\system32\isrdbg32.dll
2007-03-28 01:51 28,672 --a------ C:\WINDOWS\system32\nmmkcert.dll
2007-03-28 01:51 278,528 --a------ C:\WINDOWS\system32\inetcfg.dll
2007-03-28 01:51 276,480 --a------ C:\WINDOWS\system32\mstask.dll
2007-03-28 01:51 23,696 --a------ C:\WINDOWS\system32\emptyregdb.dat
2007-03-28 01:51 190,976 --a------ C:\WINDOWS\system32\schedsvc.dll
2007-03-28 01:51 18,944 --a------ C:\WINDOWS\system32\qmgrprxy.dll
2007-03-28 01:51 170,496 --a------ C:\WINDOWS\system32\srsvc.dll
2007-03-28 01:51 16,384 --a------ C:\WINDOWS\system32\icfgnt5.dll
2007-03-28 01:51 12,288 --a------ C:\WINDOWS\system32\nmevtmsg.dll
2007-03-28 01:51 12,288 --a------ C:\WINDOWS\system32\mstinit.exe
2007-03-28 01:50 97,792 --a------ C:\WINDOWS\system32\comrepl.dll
2007-03-28 01:50 956,416 --a------ C:\WINDOWS\system32\msdtctm.dll
2007-03-28 01:50 93,696 --a------ C:\WINDOWS\system32\tscfgwmi.dll
2007-03-28 01:50 91,136 --a------ C:\WINDOWS\system32\mtxoci.dll
2007-03-28 01:50 9,728 --a------ C:\WINDOWS\system32\reset.exe
2007-03-28 01:50 87,176 --a------ C:\WINDOWS\system32\rdpwsx.dll
2007-03-28 01:50 85,504 --a------ C:\WINDOWS\system32\catsrvps.dll
2007-03-28 01:50 80,896 --a------ C:\WINDOWS\system32\charmap.exe
2007-03-28 01:50 73,216 --a------ C:\WINDOWS\system32\avwav.dll
2007-03-28 01:50 67,072 --a------ C:\WINDOWS\system32\rdshost.exe
2007-03-28 01:50 655,360 --a------ C:\WINDOWS\system32\mstscax.dll
2007-03-28 01:50 625,152 --a------ C:\WINDOWS\system32\catsrvut.dll
2007-03-28 01:50 62,464 --a------ C:\WINDOWS\system32\rdpclip.exe
2007-03-28 01:50 605,696 --a------ C:\WINDOWS\system32\getuname.dll
2007-03-28 01:50 60,416 --a------ C:\WINDOWS\system32\remotepg.dll
2007-03-28 01:50 60,416 --a------ C:\WINDOWS\system32\colbact.dll
2007-03-28 01:50 6,656 --a------ C:\WINDOWS\system32\wuauserv.dll
2007-03-28 01:50 6,144 --a------ C:\WINDOWS\system32\msdtc.exe
2007-03-28 01:50 58,880 --a------ C:\WINDOWS\system32\msdtclog.dll
2007-03-28 01:50 58,880 --a------ C:\WINDOWS\system32\licwmi.dll
2007-03-28 01:50 56,832 --a------ C:\WINDOWS\system32\sol.exe
2007-03-28 01:50 56,320 --a------ C:\WINDOWS\system32\servdeps.dll
2007-03-28 01:50 55,296 --a------ C:\WINDOWS\system32\freecell.exe
2007-03-28 01:50 540,160 --a------ C:\WINDOWS\system32\comuid.dll
2007-03-28 01:50 54,272 --a------ C:\WINDOWS\system32\stclient.dll
2007-03-28 01:50 538,624 --a------ C:\WINDOWS\system32\spider.exe
2007-03-28 01:50 5,632 --a------ C:\WINDOWS\system32\write.exe
2007-03-28 01:50 5,120 --a------ C:\WINDOWS\system32\dcomcnfg.exe
2007-03-28 01:50 498,688 --a------ C:\WINDOWS\system32\clbcatq.dll
2007-03-28 01:50 44,544 --a------ C:\WINDOWS\system32\tscupgrd.exe
2007-03-28 01:50 44,544 --a------ C:\WINDOWS\system32\hticons.dll
2007-03-28 01:50 426,496 --a------ C:\WINDOWS\system32\msdtcprx.dll
2007-03-28 01:50 404,992 --a------ C:\WINDOWS\system32\mstsc.exe
2007-03-28 01:50 40,840 --a------ C:\WINDOWS\system32\drivers\termdd.sys
2007-03-28 01:50 4,096 --a------ C:\WINDOWS\system32\rdpcfgex.dll
2007-03-28 01:50 4,096 --a------ C:\WINDOWS\system32\mtxex.dll
2007-03-28 01:50 39,424 --a------ C:\WINDOWS\system32\cfgbkend.dll
2007-03-28 01:50 350,208 --a------ C:\WINDOWS\system32\hypertrm.dll
2007-03-28 01:50 35,328 --a------ C:\WINDOWS\system32\winchat.exe
2007-03-28 01:50 344,064 --a------ C:\WINDOWS\system32\mspaint.exe
2007-03-28 01:50 33,792 --a------ C:\WINDOWS\system32\regini.exe
2007-03-28 01:50 295,424 --a------ C:\WINDOWS\system32\termsrv.dll
2007-03-28 01:50 25,600 --a------ C:\WINDOWS\system32\comaddin.dll
2007-03-28 01:50 25,088 --a------ C:\WINDOWS\system32\mtxlegih.dll
2007-03-28 01:50 227,840 --a------ C:\WINDOWS\system32\avtapi.dll
2007-03-28 01:50 225,792 --a------ C:\WINDOWS\system32\catsrv.dll
2007-03-28 01:50 22,016 --a------ C:\WINDOWS\system32\qwinsta.exe
2007-03-28 01:50 21,896 --a------ C:\WINDOWS\system32\drivers\tdtcp.sys
2007-03-28 01:50 21,504 --a------ C:\WINDOWS\system32\msg.exe
2007-03-28 01:50 20,480 --a------ C:\WINDOWS\system32\qprocess.exe
2007-03-28 01:50 20,480 --a------ C:\WINDOWS\system32\mtxdm.dll
2007-03-28 01:50 196,864 --a------ C:\WINDOWS\system32\drivers\rdpdr.sys
2007-03-28 01:50 19,968 --a------ C:\WINDOWS\system32\rdpsnd.dll
2007-03-28 01:50 185,344 --a------ C:\WINDOWS\system32\cmprops.dll
2007-03-28 01:50 17,408 --a------ C:\WINDOWS\system32\tsshutdn.exe
2007-03-28 01:50 17,408 --a------ C:\WINDOWS\system32\mmfutil.dll
2007-03-28 01:50 161,280 --a------ C:\WINDOWS\system32\msdtcuiu.dll
2007-03-28 01:50 16,896 --a------ C:\WINDOWS\system32\qappsrv.exe
2007-03-28 01:50 16,384 --a------ C:\WINDOWS\system32\tskill.exe
2007-03-28 01:50 16,384 --a------ C:\WINDOWS\system32\avmeter.dll
2007-03-28 01:50 15,872 --a------ C:\WINDOWS\system32\rwinsta.exe
2007-03-28 01:50 15,872 --a------ C:\WINDOWS\system32\cdmodem.dll
2007-03-28 01:50 15,360 --a------ C:\WINDOWS\system32\tscon.exe
2007-03-28 01:50 15,360 --a------ C:\WINDOWS\system32\logoff.exe
2007-03-28 01:50 147,968 --a------ C:\WINDOWS\system32\rdchost.dll
2007-03-28 01:50 147,456 --a------ C:\WINDOWS\system32\comsnap.dll
2007-03-28 01:50 140,800 --a------ C:\WINDOWS\system32\sessmgr.exe
2007-03-28 01:50 14,848 --a------ C:\WINDOWS\system32\tsdiscon.exe
2007-03-28 01:50 14,848 --a------ C:\WINDOWS\system32\shadow.exe
2007-03-28 01:50 139,528 --a------ C:\WINDOWS\system32\drivers\rdpwd.sys
2007-03-28 01:50 138,752 --a------ C:\WINDOWS\system32\sndvol32.exe
2007-03-28 01:50 131,584 --a------ C:\WINDOWS\system32\sndrec32.exe
2007-03-28 01:50 13,824 --a------ C:\WINDOWS\system32\rdsaddin.exe
2007-03-28 01:50 126,976 --a------ C:\WINDOWS\system32\mshearts.exe
2007-03-28 01:50 124,696 --a------ C:\WINDOWS\system32\wuauclt.exe
2007-03-28 01:50 123,392 --a------ C:\WINDOWS\system32\mplay32.exe
2007-03-28 01:50 12,040 --a------ C:\WINDOWS\system32\drivers\tdpipe.sys
2007-03-28 01:50 119,808 --a------ C:\WINDOWS\system32\winmine.exe
2007-03-28 01:50 114,688 --a------ C:\WINDOWS\system32\calc.exe
2007-03-28 01:50 110,080 --a------ C:\WINDOWS\system32\clbcatex.dll
2007-03-28 01:50 11,776 --a------ C:\WINDOWS\system32\xolehlp.dll
2007-03-28 01:50 11,264 --a------ C:\WINDOWS\system32\icaapi.dll
2007-03-28 01:50 102,400 --a------ C:\WINDOWS\system32\clipbrd.exe
2007-03-28 01:50 1,343,768 --a------ C:\WINDOWS\system32\wuaueng.dll
2007-03-28 01:50 1,267,200 --a------ C:\WINDOWS\system32\comsvcs.dll
2007-03-28 01:50 1,161 --a------ C:\WINDOWS\system32\usrlogon.cmd
2007-03-27 23:42 <KANSIO> d-------- C:\DOCUME~1\Jani\APPLIC~1\ATI
2007-03-27 23:36 <KANSIO> d-------- C:\Program Files\Common Files\ATI Technologies
2007-03-27 22:43 27,904 --a------ C:\WINDOWS\system32\drivers\VIAAGP1.SYS
2007-03-27 22:42 <KANSIO> d-------- C:\Program Files\VIA
2007-03-27 22:21 <KANSIO> d-------- C:\Program Files\TechTracker
2007-03-27 22:21 <KANSIO> d-------- C:\DOCUME~1\Jani\APPLIC~1\VersionTracker Pro
2007-03-26 22:07 <KANSIO> d-------- C:\DOCUME~1\ALLUSE~1\APPLIC~1\Lavasoft
2007-03-20 19:06 <KANSIO> d-------- C:\cb65fb59f68f4d79e91c5359


(((((((((((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))))


2007-04-17 14:56 -------- d-------- C:\Program Files\k-lite codec pack
2007-04-17 14:53 -------- d-------- C:\Program Files\xvid
2007-04-15 18:06 -------- d-------- C:\Program Files\dc++
2007-04-06 22:58 -------- d-------- C:\Program Files\electronic arts
2007-04-02 17:22 -------- d-------- C:\Program Files\tsunami-filter-pack
2007-04-02 17:21 -------- d--h----- C:\Program Files\installshield installation information
2007-04-01 19:18 -------- d-------- C:\Program Files\winace
2007-03-30 08:08 -------- d-------- C:\Program Files\winamp
2007-03-30 00:52 -------- d-------- C:\Program Files\azureus
2007-03-28 21:56 75814 --a------ C:\WINDOWS\system32\perfc00b.dat
2007-03-28 21:56 375932 --a------ C:\WINDOWS\system32\perfh00b.dat
2007-03-28 20:25 -------- d-------- C:\Program Files\Common Files\logitech
2007-03-28 16:41 -------- d-------- C:\Program Files\lavasoft
2007-03-28 16:33 -------- d-------- C:\Program Files\messenger
2007-03-28 15:32 -------- d-------- C:\Program Files\movie maker
2007-03-28 15:30 -------- d-------- C:\Program Files\windows nt
2007-03-28 02:44 62 --ahs---- C:\DOCUME~1\JANI~1.JAP\APPLIC~1\desktop.ini
2007-03-28 02:38 -------- d--h----- C:\Program Files\windowsupdate
2007-03-28 01:55 -------- d-------- C:\Program Files\java
2007-03-19 20:19 -------- d-------- C:\Program Files\msbuild
2007-03-19 20:15 -------- d-------- C:\Program Files\reference assemblies
2007-03-19 20:12 -------- d-------- C:\Program Files\gamespy
2007-03-19 20:03 -------- d-------- C:\Program Files\msxml 4.0
2007-03-19 18:44 -------- d-------- C:\Program Files\microsoft activesync
2007-03-17 16:44 292864 --a------ C:\WINDOWS\system32\winsrv.dll
2007-03-12 17:55 -------- d-------- C:\Program Files\maxis
2007-03-08 19:03 -------- d-------- C:\Program Files\zio interactive
2007-03-08 18:38 578048 --a------ C:\WINDOWS\system32\user32.dll
2007-03-08 18:37 40960 --a------ C:\WINDOWS\system32\mf3216.dll
2007-03-08 18:37 281600 --a------ C:\WINDOWS\system32\gdi32.dll
2007-03-08 18:34 1843840 --a------ C:\WINDOWS\system32\win32k.sys
2007-03-04 15:10 -------- d-------- C:\Program Files\orb networks
2007-02-21 18:05 -------- d-------- C:\Program Files\hexacto games
2007-02-05 23:19 185344 --a------ C:\WINDOWS\system32\upnphost.dll
2007-02-02 23:17 307200 --a------ C:\WINDOWS\system32\atiiiexx.dll
2007-02-02 23:04 307200 --a------ C:\WINDOWS\system32\atidemgx.dll
2007-02-02 23:03 264704 --a------ C:\WINDOWS\system32\ati2dvag.dll
2007-02-02 22:57 118784 --a------ C:\WINDOWS\system32\atipdlxx.dll
2007-02-02 22:56 42496 --a------ C:\WINDOWS\system32\ati2edxx.dll
2007-02-02 22:56 26112 --a------ C:\WINDOWS\system32\ati2mdxx.exe
2007-02-02 22:56 110592 --a------ C:\WINDOWS\system32\oemdspif.dll
2007-02-02 22:56 110592 --a------ C:\WINDOWS\system32\ati2evxx.dll
2007-02-02 22:55 446464 --a------ C:\WINDOWS\system32\ati2evxx.exe
2007-02-02 22:54 53248 --a------ C:\WINDOWS\system32\atiddc.dll
2007-02-02 22:46 2827968 --a------ C:\WINDOWS\system32\ati3duag.dll
2007-02-02 22:40 3107788 --a------ C:\WINDOWS\system32\ativvaxx.dat
2007-02-02 22:40 1272960 --a------ C:\WINDOWS\system32\ativvaxx.dll
2007-02-02 22:27 241664 --a------ C:\WINDOWS\system32\atikvmag.dll
2007-02-02 22:25 17408 --a------ C:\WINDOWS\system32\atitvo32.dll
2007-02-02 22:20 348160 --a------ C:\WINDOWS\system32\ati2cqag.dll
2007-02-02 22:19 5312512 --a------ C:\WINDOWS\system32\atioglxx.dll
2007-01-30 19:21 128813 --a------ C:\WINDOWS\system32\atiicdxx.dat


(((((((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))


*Note* empty entries & legit default entries are not shown

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects]
{1557B435-8242-4686-9AA3-9265BF7525A4} C:\WINDOWS\system32\qnhawoee.dll [x]
{53707962-6F74-2D53-2644-206D7942484F} C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
{E14B6B7D-5EA2-4D27-93D9-671D4ABD8883} C:\WINDOWS\system32\jkhff.dll [x]
{F8AB987E-08CC-4953-9125-40DDBF4DEE66} C:\WINDOWS\system32\vtboyrgj.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run]
"SunJavaUpdateSched"="C:\\Program Files\\Java\\j2re1.4.2_03\\bin\\jusched.exe"
"Advanced DHTML Enable"="C:\\WINDOWS\\System32\\rjycl.exe"
"SmcService"="C:\\PROGRA~1\\Sygate\\SPF\\smc.exe -startgui"
"Kernel and Hardware Abstraction Layer"="KHALMNPR.EXE"
"WinPatrol"="C:\\Program Files\\BillP Studios\\WinPatrol\\winpatrol.exe"
"!AVG Anti-Spyware"="\"C:\\Program Files\\Grisoft\\AVG Anti-Spyware 7.5\\avgas.exe\" /minimized"
"AVG7_CC"="C:\\PROGRA~1\\Grisoft\\AVG7\\avgcc.exe /STARTUP"

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run]
"CTFMON.EXE"="C:\\WINDOWS\\system32\\ctfmon.exe"
"StartCCC"="C:\\Program Files\\ATI Technologies\\ATI.ACE\\Core-Static\\CLIStart.exe"
"ccleaner"="\"C:\\Program Files\\CCleaner\\ccleaner.exe\" /AUTO"

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\system]
"DisableRegistryTools"=dword:00000000

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shellexecutehooks]
"{57B86673-276A-48B2-BAE7-C6DBB3020EB8}"="AVG Anti-Spyware 7.5"

HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa
Authentication Packages REG_MULTI_SZ msv1_0\0\0
Security Packages REG_MULTI_SZ kerberos\0msv1_0\0schannel\0wdigest\0\0
Notification Packages REG_MULTI_SZ scecli\0\0

HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\minimal\WdfLoadGroup

[HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Svchost]
LocalService REG_MULTI_SZ Alerter\0WebClient\0LmHosts\0RemoteRegistry\0upnphost\0SSDPSRV\0\0
NetworkService REG_MULTI_SZ DnsCache\0\0
rpcss REG_MULTI_SZ RpcSs\0\0
imgsvc REG_MULTI_SZ StiSvc\0\0
termsvcs REG_MULTI_SZ TermService\0\0
HTTPFilter REG_MULTI_SZ HTTPFilter\0\0
DcomLaunch REG_MULTI_SZ DcomLaunch\0TermService\0\0


********************************************************************

catchme 0.2 W2K/XP/Vista - userland rootkit detector by Gmer, 17 October 2006
http://www.gmer.net

scanning hidden processes ...

scanning hidden services ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden processes: 0
hidden services: 0
hidden files: 0

********************************************************************

Completion time: 07-04-20 13:45:18 - machine was rebooted
C:\ComboFix-quarantined-files.txt ... 07-04-20 13:45





Logfile of HijackThis v1.99.1
Scan saved at 13:46:26, on 20.4.2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Sygate\SPF\smc.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
C:\WINDOWS\system32\PnkBstrA.exe
C:\Program Files\Java\j2re1.4.2_03\bin\jusched.exe
C:\Program Files\BillP Studios\WinPatrol\winpatrol.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe
C:\PROGRA~1\Grisoft\AVG7\avgcc.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Adobe\Reader 8.0\Reader\reader_sl.exe
C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.EXE
C:\Program Files\Logitech\SetPoint\SetPoint.exe
C:\Program Files\Ray Adams\ATI Tray Tools\atitray.exe
C:\Program Files\Common Files\Logitech\khalshared\KHALMNPR.EXE
C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\ccc.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\system32\NOTEPAD.EXE
C:\Documents and Settings\Jani.JAPPE-3UI5AROGO\Työpöytä\hijackthis\Skanneri.exe.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.fi/
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Linkit
O2 - BHO: Adobe PDF Reader -linkkiavustaja - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {1557B435-8242-4686-9AA3-9265BF7525A4} - C:\WINDOWS\system32\qnhawoee.dll (file missing)
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O2 - BHO: (no name) - {E14B6B7D-5EA2-4D27-93D9-671D4ABD8883} - C:\WINDOWS\system32\jkhff.dll (file missing)
O2 - BHO: (no name) - {F8AB987E-08CC-4953-9125-40DDBF4DEE66} - C:\WINDOWS\system32\vtboyrgj.dll
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\j2re1.4.2_03\bin\jusched.exe
O4 - HKLM\..\Run: [Advanced DHTML Enable] C:\WINDOWS\System32\rjycl.exe
O4 - HKLM\..\Run: [SmcService] C:\PROGRA~1\Sygate\SPF\smc.exe -startgui
O4 - HKLM\..\Run: [Kernel and Hardware Abstraction Layer] KHALMNPR.EXE
O4 - HKLM\..\Run: [WinPatrol] C:\Program Files\BillP Studios\WinPatrol\winpatrol.exe
O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVG7\avgcc.exe /STARTUP
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [StartCCC] C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe
O4 - HKCU\..\Run: [ccleaner] "C:\Program Files\CCleaner\ccleaner.exe" /AUTO
O4 - Startup: ATI Tray Tools.lnk = C:\Program Files\Ray Adams\ATI Tray Tools\atitray.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Reader 8.0\Reader\reader_sl.exe
O4 - Global Startup: Adobe Reader Synchronizer.lnk = C:\Program Files\Adobe\Reader 8.0\Reader\AdobeCollabSync.exe
O4 - Global Startup: Logitech SetPoint.lnk = C:\Program Files\Logitech\SetPoint\SetPoint.exe
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2_03\bin\npjpi142_03.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2_03\bin\npjpi142_03.dll
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1175086735484
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: AVG Anti-Spyware Guard - Anti-Malware Development a.s. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1150\Intel 32\IDriverT.exe
O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\system32\PnkBstrA.exe
O23 - Service: PnkBstrB - Unknown owner - C:\WINDOWS\system32\PnkBstrB.exe
O23 - Service: Sygate Personal Firewall (SmcService) - Sygate Technologies, Inc. - C:\Program Files\Sygate\SPF\smc.exe

TOivon mukaan tein kaikki oikein.

 

Ota ensin rekisteristä näin varmuuskopio:

Suorita -> regedit -> ok. Sitten Tiedosto -> Vie. Kirjoita sille joku nimi ja sitten Tallenna(ja laita muistiin, mihin tallensit sen).

Sitten tallenna tämä alla oleva tekstinpätkä nimellä fix.reg vaikka muistiossa ja vaikka työpöydälle (tallennusmuoto kaikki tiedostot)

Tuplaklikkaa ja paina kyllä ja ok. Käynnistä kone uudelleen.

********

Fixaa nää rivit

O2 - BHO: (no name) - {1557B435-8242-4686-9AA3-9265BF7525A4} - C:\WINDOWS\system32\qnhawoee.dll (file missing)
O2 - BHO: (no name) - {E14B6B7D-5EA2-4D27-93D9-671D4ABD8883} - C:\WINDOWS\system32\jkhff.dll (file missing)
O2 - BHO: (no name) - {F8AB987E-08CC-4953-9125-40DDBF4DEE66} - C:\WINDOWS\system32\vtboyrgj.dll
O4 - HKLM\..\Run: [Advanced DHTML Enable] C:\WINDOWS\System32\rjycl.exe

******

Lataa AVG Anti-Spyware 7.5 ja tallenna ohjelma työpöydällesi.

[*]Kun olet ladannut ohjelman, kaksoisklikkaa asennuohjelman pikakuvaketta työpöydälläsi, asennus alkaa.
[*]Asennuksen jälkeen täytyy ohjelma käynnistää ja sen tunnisteet päivittää.
[*]Käynnistä AVG Anti-Spyware.
[*]Klikkaa "Update" kuvaketta päävalikossa. Sen jälkeen klikkaa "Update now" painiketta.
[*]Sitten klikkaa "Start Update" kuvaketta jolloin päivitys alkaa.
[*]Paina hetken kuluttua uudestaan "Start Update" , jos päivitykset eivät heti onnistu
[*]Jos automaattipäivitys ei jostain syystä toimi, niin tunnisteet voi ladata manuaalisesti http://www.ewido.net/en/download/updates/ -linkin takaa.
[*]Kun päivitykset on ladattu, klikkaa "Scanner" kuvaketta ikkunan ylälaidassa. Valitse sitten "Settings" välilehti.
[*]Kun "Settings" valikko on auennut, klikkaa "Recommended actions" ja sitten valitse "Quarantine".
[*]Sitten "Reports" valikon alta:
[*]Laita täppi kohtaan "Automatically generate report after every scan"
[*]Ota täppi pois kohdasta"Only if threats were found"
[*]Sitten klikkaa "Shield" kuvaketta ikkunan ylälaidassa
[*]"Resident shield is", muuta tila active:sta inactive:ksi
[*]Sulje ohjelma, ÄLÄ skannaa vielä.

Käynnistä tietokone vikasietotilaan:
1. Käynnistä tietokone uudelleen.
2. Kun tietokone käynnistyy, paina F8-näppäintä.
3. Näyttöön tulee erilaisia käynnistysvaihtoehtoja.
4. Valitse näppäimistön nuolinäppäinten avulla Vikasietotila.
5. Paina ENTER-näppäintä.

HUOM! Älä käytä muita ohjelmia AVG skannauksen aikana, tämä saattaa häiritä skannausta.
[*]Kun vikasietotilassa, käynnistä AVG Anti-Spyware.
[*]Klikkaa "Scanner" kuvaketta ikkunan ylälaidassa ja valitse "Scan" välilehti. Sitten klikkaa "Complete System Scan".
[*]AVG aloittaa nyt tietokoneen skannaamisen, ole kärsivällinen sillä skannaus vie aikaa.
Kun skannaus on valmis:
TÄRKEÄÄ : Älä klikkaa "Save Scan Report" ennen kuin klikkaat "Apply all Actions"
[*]Varmistu, että Set all elements to: näyttää Quarantine (1), jos ei, klikkaa linkkiä ja valitse Quarantine popup-valikosta.
[*]Sinulta kysytään mitä tehdä jos infektioita löytyi, valitse silloin "Apply all actions"

[*]Sitten klikkaa "Reports" kuvaketta ohjelma yläosasta.
[*]Klikkaa "Save report as" painiketta ikkunan vasemmassa alalaidassa ja tallenna raportti työpöydälle.
[*]Sulje ohjelma, käynnistä kone normaalisti ja lähetä AVG:n raportti viestiketjuusi.

*****

Javan päivitys ja välimuistin tyhjennys:

1. Klikkaa Käynnistä -> Ohjauspaneeli ja tupla-klikkaa Lisää tai poista sovellus Ohjauspaneelissa.
2. Etsi listasta kaikki entiset Java versiosi. (J2SE Runtime Environment.... )
Niissä pitäisi olla seuraava kuva vieressä:
3. Valitse kaikki entiset Java versiosi ja valitse Poista.
4. Asenna uusin Java päivitys seuraavasta linkistä..
5. Käynnistä kone uudelleen asennuksen jälkeen:

http://java.sun.com/javase/downloads/index.jsp

Rullaa alas kohteeseen Java Runtime Environment (JRE) 6u1

Paina Download

Ruksaa Accept, ota offline installation, tallenna vaikka työpöydälle ja asenna se.

6. Käynnistyksen jälkeen, mene takaisin Ohjauspaneeliin ja avaa Java asetuksesi (Muita Ohjauspaneelin asetuksia -> Java kahvikuppi).

7. General Settings -osion alla, vedä liukusäädintä (Disk Space) pienemmälle, ja klikkaa Delete Files -nappia.

(Jotkut javapohjaiset ohjelmat saattavat tarvita enemmän levytilaa.
Jos huomaat säädön pienentämisen jälkeen koneessa hitautta, siirrä liukusäädintä isommalle).

8. Varmista että kaikki kaksi valintaa ovat rastitettuja:

*Applications and Applets

*Trace and Log Files


Ja paina OK -nappia

9. Klikkaa OK "Temporary Files Settings" -ikkunassasi.

10. Klikkaa OK jättääksesi Java asetusikkunasi.

*****

Uusi Hijackthis logi ja aja combo uudestaan ja laita sen logi,

 

Tässä skannauksen tulos. Kesti melkein 3 tuntia

---------------------------------------------------------
AVG Anti-Spyware - Scan Report
---------------------------------------------------------

+ Created at: 20:13:12 20.4.2007

+ Scan result:



C:\Documents and Settings\Jani.JAPPE-3UI5AROGO\Työpöytä\hijackthis\backups\backup-20070419-185924-929.dll -> Adware.Virtumonde : Cleaned with backup (quarantined).
C:\Documents and Settings\Jani.JAPPE-3UI5AROGO\Työpöytä\hijackthis\backups\backup-20070419-185936-742.dll -> Adware.Virtumonde : Cleaned with backup (quarantined).
C:\QooBox\Quarantine\C\WINDOWS\system32\cbxutst.dll.vir -> Adware.Virtumonde : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{C0824D3B-9BBE-455E-B0BA-237974912F09}\RP37\A0029941.dll -> Adware.Virtumonde : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{C0824D3B-9BBE-455E-B0BA-237974912F09}\RP40\A0032884.dll -> Adware.Virtumonde : Cleaned with backup (quarantined).


::Report end

 

"Jani" - 07-04-20 20:29:34 Service Pack 2
ComboFix 07-04-19.2V - Running from: C:\Documents and Settings\Jani.JAPPE-3UI5AROGO\Ty”p”yt„\


((((((((((((((((((((((((((((((( Files Created from 2007-03-20 to 2007-04-20 ))))))))))))))))))))))))))))))))))


2007-04-20 11:49 125,460 --a------ C:\WINDOWS\system32\vtboyrgj.dll
2007-04-19 18:48 <KANSIO> d-------- C:\VundoFix Backups
2007-04-19 12:58 <KANSIO> d-------- C:\DOCUME~1\JANI~1.JAP\APPLIC~1\Help
2007-04-18 22:28 <KANSIO> d-------- C:\DOCUME~1\ALLUSE~1.WIN\APPLIC~1\Spybot - Search & Destroy
2007-04-17 14:55 765,952 --a------ C:\WINDOWS\system32\xvidcore.dll
2007-04-17 14:55 639,066 --a------ C:\WINDOWS\system32\divx.dll
2007-04-17 14:55 180,224 --a------ C:\WINDOWS\system32\xvidvfw.dll
2007-04-16 21:03 <KANSIO> d-------- C:\DOCUME~1\JANI~1.JAP\DoctorWeb
2007-04-16 20:31 10,752 --a------ C:\WINDOWS\system32\ff_vfw.dll
2007-04-16 20:31 <KANSIO> d-------- C:\Program Files\ffdshow
2007-04-16 19:19 <KANSIO> d-------- C:\Bases
2007-04-16 19:17 <KANSIO> d-------- C:\Kaspersky
2007-04-16 10:37 <KANSIO> d-------- C:\Program Files\Bus Driver
2007-04-16 10:20 <KANSIO> d-------- C:\DOCUME~1\JANI~1.JAP\APPLIC~1\Registry Booster
2007-04-15 23:35 376,832 --a------ C:\WINDOWS\system\xvid.dll
2007-04-15 14:18 <KANSIO> d-------- C:\DOCUME~1\JANI~1.JAP\APPLIC~1\Adobe
2007-04-15 14:13 <KANSIO> d-------- C:\DOCUME~1\ALLUSE~1.WIN\APPLIC~1\Adobe
2007-04-05 00:44 <KANSIO> d-------- C:\Program Files\ATITool
2007-04-04 00:52 118,784 --a------ C:\WINDOWS\system32\MSSTDFMT.DLL
2007-04-04 00:52 <KANSIO> d-------- C:\Program Files\SpywareBlaster
2007-04-03 23:20 22,584 --a------ C:\WINDOWS\system32\drivers\PnkBstrK.sys
2007-04-03 21:04 99,904 --a------ C:\WINDOWS\system32\PnkBstrB.exe
2007-04-03 21:04 63,040 --a------ C:\WINDOWS\system32\PnkBstrA.exe
2007-04-03 17:32 <KANSIO> d-------- C:\DOCUME~1\JANI~1.JAP\APPLIC~1\atitray
2007-04-03 17:31 <KANSIO> d-------- C:\Program Files\Ray Adams
2007-04-03 17:07 3,968 --a------ C:\WINDOWS\system32\drivers\AvgAsCln.sys
2007-04-03 17:05 <KANSIO> d-------- C:\Program Files\BillP Studios
2007-04-03 17:05 <KANSIO> d-------- C:\DOCUME~1\JANI~1.JAP\APPLIC~1\WinPatrol
2007-04-02 20:29 <KANSIO> d-------- C:\Program Files\Uniblue
2007-04-02 20:29 <KANSIO> d-------- C:\DOCUME~1\JANI~1.JAP\APPLIC~1\Uniblue
2007-04-02 17:22 5,600 --a------ C:\WINDOWS\system\WINASPI.DLL
2007-04-02 17:22 45,056 --a------ C:\WINDOWS\system32\WNASPI32.DLL
2007-04-02 17:22 4,672 --a------ C:\WINDOWS\system\WOWPOST.EXE
2007-04-02 17:22 25,244 --a------ C:\WINDOWS\system32\drivers\ASPI32.SYS
2007-04-02 17:21 165,376 --a------ C:\WINDOWS\system32\msvcr70.dll
2007-03-30 00:54 <KANSIO> d-------- C:\DOCUME~1\JANI~1.JAP\APPLIC~1\Azureus
2007-03-29 05:41 <KANSIO> d-------- C:\DOCUME~1\JANI~1.JAP\APPLIC~1\Media Player Classic
2007-03-29 05:40 73,728 --a------ C:\WINDOWS\system32\dpl100.dll
2007-03-29 05:40 3,596,288 --a------ C:\WINDOWS\system32\qt-dx331.dll
2007-03-29 05:40 217,088 --a------ C:\WINDOWS\system32\yv12vfw.dll
2007-03-29 05:40 200,704 --a------ C:\WINDOWS\system32\ssldivx.dll
2007-03-29 05:40 196,608 --a------ C:\WINDOWS\system32\dtu100.dll
2007-03-29 05:40 1,565,480 --a------ C:\WINDOWS\system32\wmv9vcm.dll
2007-03-29 05:40 1,044,480 --a------ C:\WINDOWS\system32\libdivx.dll
2007-03-29 05:40 <KANSIO> d-------- C:\DOCUME~1\JANI~1.JAP\APPLIC~1\Real
2007-03-29 05:40 <KANSIO> d-------- C:\DOCUME~1\ALLUSE~1.WIN\APPLIC~1\Real
2007-03-29 05:40 <KANSIO> d-------- C:\DOCUME~1\ALLUSE~1.WIN\APPLIC~1\Apple Computer
2007-03-28 20:28 0 --a------ C:\WINDOWS\nsreg.dat
2007-03-28 20:28 <KANSIO> d-------- C:\DOCUME~1\JANI~1.JAP\APPLIC~1\Talkback
2007-03-28 20:26 <KANSIO> d-------- C:\DOCUME~1\JANI~1.JAP\APPLIC~1\Logitech
2007-03-28 20:25 69,632 --a------ C:\WINDOWS\system32\KemXML.dll
2007-03-28 20:25 34,576 --a------ C:\WINDOWS\system32\drivers\LHidFilt.Sys
2007-03-28 20:25 33,296 --a------ C:\WINDOWS\system32\drivers\LMouFilt.Sys
2007-03-28 20:25 20,496 --a------ C:\WINDOWS\system32\drivers\L8042Kbd.sys
2007-03-28 20:25 163,840 --a------ C:\WINDOWS\system32\kemutb.dll
2007-03-28 20:25 135,168 --a------ C:\WINDOWS\system32\KemUtil.dll
2007-03-28 20:25 110,592 --a------ C:\WINDOWS\system32\KemWnd.dll
2007-03-28 20:25 101,136 --a------ C:\WINDOWS\KHALMNPR.Exe
2007-03-28 20:25 1,419,024 --a------ C:\WINDOWS\system32\WdfCoInstaller01005.dll
2007-03-28 20:24 83,096 --a------ C:\WINDOWS\system32\SSSensor.dll
2007-03-28 20:24 60,496 --a------ C:\WINDOWS\system32\drivers\Teefer.sys
2007-03-28 20:24 21,075 --a------ C:\WINDOWS\system32\drivers\wpsdrvnt.sys
2007-03-28 20:24 14,568 --a------ C:\WINDOWS\system32\drivers\wg6n.sys
2007-03-28 20:24 14,568 --a------ C:\WINDOWS\system32\drivers\wg5n.sys
2007-03-28 20:24 14,568 --a------ C:\WINDOWS\system32\drivers\wg4n.sys
2007-03-28 20:24 14,568 --a------ C:\WINDOWS\system32\drivers\wg3n.sys
2007-03-28 20:24 <KANSIO> d-------- C:\DOCUME~1\ALLUSE~1.WIN\APPLIC~1\Logitech
2007-03-28 20:22 <KANSIO> d-------- C:\Downloads
2007-03-28 20:22 <KANSIO> d-------- C:\DOCUME~1\JANI~1.JAP\APPLIC~1\GetRightToGo
2007-03-28 18:19 2,297,552 --a------ C:\WINDOWS\system32\d3dx9_26.dll
2007-03-28 18:12 499,712 --a------ C:\WINDOWS\system32\MSVCP71.dll
2007-03-28 18:12 348,160 --a------ C:\WINDOWS\system32\MSVCR71.dll
2007-03-28 18:12 1,060,864 --a------ C:\WINDOWS\system32\MFC71.dll
2007-03-28 16:59 450,560 --a------ C:\DOCUME~1\JRJEST~1.JAP\NTUSER.DAT
2007-03-28 16:59 <KANSIO> dr------- C:\DOCUME~1\JRJEST~1.JAP\Omat tiedostot
2007-03-28 16:59 <KANSIO> dr------- C:\DOCUME~1\JRJEST~1.JAP\K„ynnist„-valikko
2007-03-28 16:59 <KANSIO> d--h----- C:\DOCUME~1\JRJEST~1.JAP\Verkkoymp„rist”
2007-03-28 16:59 <KANSIO> d--h----- C:\DOCUME~1\JRJEST~1.JAP\Tulostinymp„rist”
2007-03-28 16:59 <KANSIO> d--h----- C:\DOCUME~1\JRJEST~1.JAP\Mallit
2007-03-28 16:59 <KANSIO> d-------- C:\DOCUME~1\JRJEST~1.JAP\Ty”p”yt„
2007-03-28 16:59 <KANSIO> d-------- C:\DOCUME~1\JRJEST~1.JAP\Suosikit
2007-03-28 16:59 <KANSIO> d-------- C:\DOCUME~1\JRJEST~1.JAP\APPLIC~1\Sun
2007-03-28 16:41 <KANSIO> d-------- C:\DOCUME~1\JANI~1.JAP\APPLIC~1\Lavasoft
2007-03-28 16:39 <KANSIO> d-------- C:\Program Files\CCleaner
2007-03-28 16:34 262,144 --a------ C:\DOCUME~1\ALLUSE~1.WIN\ntuser.dat
2007-03-28 16:33 <KANSIO> d-------- C:\DOCUME~1\ALLUSE~1.WIN\APPLIC~1\Windows Genuine Advantage
2007-03-28 16:11 5,632 --a------ C:\WINDOWS\system32\drivers\Entech64.sys
2007-03-28 16:11 3,972 --a------ C:\WINDOWS\system32\drivers\PciBus.sys
2007-03-28 16:11 21,664 --a------ C:\WINDOWS\system32\drivers\Entech.sys
2007-03-28 16:09 <KANSIO> d-------- C:\Program Files\Futuremark
2007-03-28 16:03 23,856 --a------ C:\WINDOWS\system32\spupdsvc.exe
2007-03-28 15:59 520,192 --------- C:\WINDOWS\system32\ati2sgag.exe
2007-03-28 15:58 <KANSIO> d---s---- C:\DOCUME~1\JANI~1.JAP\UserData
2007-03-28 15:58 <KANSIO> d-------- C:\Program Files\ATI Technologies
2007-03-28 15:39 <KANSIO> d-------- C:\WINDOWS\Prefetch
2007-03-28 15:35 221,184 --a------ C:\WINDOWS\system32\wmpns.dll
2007-03-28 15:32 8,192 --a------ C:\WINDOWS\system32\bitsprx2.dll
2007-03-28 15:32 7,168 --a------ C:\WINDOWS\system32\bitsprx3.dll
2007-03-28 15:32 23,040 --a------ C:\WINDOWS\system32\fltmc.exe
2007-03-28 15:32 16,896 --a------ C:\WINDOWS\system32\fltlib.dll
2007-03-28 15:32 128,896 --a------ C:\WINDOWS\system32\drivers\fltmgr.sys
2007-03-28 15:15 24,661 --a------ C:\WINDOWS\system32\spxcoins.dll
2007-03-28 15:15 13,312 --a------ C:\WINDOWS\system32\irclass.dll
2007-03-28 11:13 <KANSIO> d--hs---- C:\found.000
2007-03-28 02:49 6,400 --a------ C:\WINDOWS\system32\drivers\enum1394.sys
2007-03-28 02:49 57,216 --a------ C:\WINDOWS\system32\drivers\redbook.sys
2007-03-28 02:49 3,072 --a------ C:\WINDOWS\system32\drivers\audstub.sys
2007-03-28 02:45 69,856 --a------ C:\WINDOWS\system\AVICAP.DLL
2007-03-28 02:45 176,157 --a------ C:\WINDOWS\system32\dgrpsetu.dll
2007-03-28 02:45 11,264 --a------ C:\WINDOWS\system32\drivers\irenum.sys
2007-03-28 02:45 103,424 --a------ C:\WINDOWS\system32\EqnClass.Dll
2007-03-28 02:44 74,240 --a------ C:\WINDOWS\system32\storprop.dll
2007-03-28 02:44 <KANSIO> dr------- C:\DOCUME~1\DEFAUL~1.WIN\K„ynnist„-valikko
2007-03-28 02:44 <KANSIO> dr------- C:\DOCUME~1\ALLUSE~1.WIN\Tiedostot
2007-03-28 02:44 <KANSIO> dr------- C:\DOCUME~1\ALLUSE~1.WIN\K„ynnist„-valikko
2007-03-28 02:44 <KANSIO> d--h----- C:\DOCUME~1\DEFAUL~1.WIN\Verkkoymp„rist”
2007-03-28 02:44 <KANSIO> d--h----- C:\DOCUME~1\DEFAUL~1.WIN\Tulostinymp„rist”
2007-03-28 02:44 <KANSIO> d--h----- C:\DOCUME~1\DEFAUL~1.WIN\Mallit
2007-03-28 02:44 <KANSIO> d--h----- C:\DOCUME~1\ALLUSE~1.WIN\Mallit
2007-03-28 02:44 <KANSIO> d-------- C:\DOCUME~1\DEFAUL~1.WIN\Ty”p”yt„
2007-03-28 02:44 <KANSIO> d-------- C:\DOCUME~1\DEFAUL~1.WIN\Suosikit
2007-03-28 02:44 <KANSIO> d-------- C:\DOCUME~1\ALLUSE~1.WIN\Ty”p”yt„
2007-03-28 02:44 <KANSIO> d-------- C:\DOCUME~1\ALLUSE~1.WIN\Suosikit
2007-03-28 02:38 465,176 --a------ C:\WINDOWS\system32\wuapi.dll
2007-03-28 02:38 41,240 --a------ C:\WINDOWS\system32\wups.dll
2007-03-28 02:38 194,840 --a------ C:\WINDOWS\system32\wuaueng1.dll
2007-03-28 02:38 173,848 --a------ C:\WINDOWS\system32\wuauclt1.exe
2007-03-28 02:38 173,536 --a------ C:\WINDOWS\system32\wuweb.dll
2007-03-28 02:38 127,256 --a------ C:\WINDOWS\system32\wucltui.dll
2007-03-28 02:29 <KANSIO> d-------- C:\WUTemp
2007-03-28 02:26 <KANSIO> d-------- C:\DOCUME~1\JANI~1.JAP\APPLIC~1\ATI
2007-03-28 02:20 85,376 --a------ C:\WINDOWS\system32\drivers\nabtsfec.sys
2007-03-28 02:20 51,328 --a------ C:\WINDOWS\system32\drivers\msdv.sys
2007-03-28 02:20 19,328 --a------ C:\WINDOWS\system32\drivers\wstcodec.sys
2007-03-28 02:20 17,024 --a------ C:\WINDOWS\system32\drivers\ccdecode.sys
2007-03-28 02:13 576 --a------ C:\drvpnp.dat
2007-03-28 02:12 <KANSIO> d-------- C:\$CTJTMP
2007-03-28 02:09 86,016 -ra------ C:\WINDOWS\system32\mdmxsdk.dll
2007-03-28 02:09 679,808 -ra------ C:\WINDOWS\system32\drivers\HSF_CNXT.sys
2007-03-28 02:09 6,400 --a------ C:\WINDOWS\system32\drivers\splitter.sys
2007-03-28 02:09 53,248 --a------ C:\WINDOWS\system32\vbalicom6.dll
2007-03-28 02:09 52,864 --a------ C:\WINDOWS\system32\drivers\DMusic.sys
2007-03-28 02:09 38,784 -ra------ C:\WINDOWS\system32\drivers\an983.sys
2007-03-28 02:09 32,768 --a------ C:\WINDOWS\system32\ssubtmr6.dll
2007-03-28 02:09 32,218 -ra------ C:\WINDOWS\system32\HSFCI008.dll
2007-03-28 02:09 210,304 -ra------ C:\WINDOWS\system32\drivers\HSFHWBS2.sys
2007-03-28 02:09 12,970 -ra------ C:\WINDOWS\system32\drivers\mdmxsdk.sys
2007-03-28 02:09 1,042,816 -ra------ C:\WINDOWS\system32\drivers\HSF_DP.sys
2007-03-28 02:08 35,840 -ra------ C:\WINDOWS\system32\drivers\AmdK8.sys
2007-03-28 02:08 243,568 -ra------ C:\WINDOWS\system32\drivers\STAC97.sys
2007-03-28 02:07 763 --a------ C:\pnpID.dat
2007-03-28 02:05 5,504 --a------ C:\WINDOWS\system32\drivers\mstee.sys
2007-03-28 02:05 4,096 --a------ C:\WINDOWS\system32\ksuser.dll
2007-03-28 02:02 2,621,440 --ah----- C:\DOCUME~1\JANI~1.JAP\NTUSER.DAT
2007-03-28 02:02 <KANSIO> dr------- C:\DOCUME~1\JANI~1.JAP\Suosikit
2007-03-28 02:02 <KANSIO> dr------- C:\DOCUME~1\JANI~1.JAP\Omat tiedostot
2007-03-28 02:02 <KANSIO> dr------- C:\DOCUME~1\JANI~1.JAP\K„ynnist„-valikko
2007-03-28 02:02 <KANSIO> d--h----- C:\DOCUME~1\JANI~1.JAP\Verkkoymp„rist”
2007-03-28 02:02 <KANSIO> d--h----- C:\DOCUME~1\JANI~1.JAP\Tulostinymp„rist”
2007-03-28 02:02 <KANSIO> d--h----- C:\DOCUME~1\JANI~1.JAP\Mallit
2007-03-28 02:02 <KANSIO> d-------- C:\DOCUME~1\JANI~1.JAP\Ty”p”yt„
2007-03-28 02:02 <KANSIO> d-------- C:\DOCUME~1\JANI~1.JAP\APPLIC~1\Sun
2007-03-28 02:01 262,144 --ah----- C:\DOCUME~1\LOCALS~1.NT-\NTUSER.DAT
2007-03-28 02:01 233,472 --ah----- C:\DOCUME~1\NETWOR~1.NT-\NTUSER.DAT
2007-03-28 01:57 249,856 ---h----- C:\DOCUME~1\DEFAUL~1.WIN\NTUSER.DAT
2007-03-28 01:55 <KANSIO> dr------- C:\DOCUME~1\DEFAUL~1.WIN\Omat tiedostot
2007-03-28 01:55 <KANSIO> d-------- C:\WINDOWS\fsc
2007-03-28 01:55 <KANSIO> d-------- C:\DOCUME~1\DEFAUL~1.WIN\APPLIC~1\Sun
2007-03-28 01:55 <KANSIO> d-------- C:\AddOn
2007-03-28 01:54 26,112 --a------ C:\WINDOWS\system32\xpsp1hfm.exe
2007-03-28 01:54 240,640 --a------ C:\WINDOWS\system32\srrstr.dll
2007-03-28 01:54 186,368 --a------ C:\WINDOWS\system32\accwiz.exe
2007-03-28 01:53 112,128 --a------ C:\WINDOWS\system32\mapi32.dll
2007-03-28 01:53 0 --------- C:\AUTOEXEC.BAT
2007-03-28 01:52 45,568 --a------ C:\WINDOWS\system32\safrslv.dll
2007-03-28 01:52 43,520 --a------ C:\WINDOWS\system32\safrcdlg.dll
2007-03-28 01:52 43,520 --a------ C:\WINDOWS\system32\racpldlg.dll
2007-03-28 01:52 29,696 --a------ C:\WINDOWS\system32\safrdm.dll
2007-03-28 01:52 11,264 --a------ C:\WINDOWS\system32\atrace.dll
2007-03-28 01:52 <KANSIO> d--hs---- C:\DOCUME~1\ALLUSE~1.WIN\DRM
2007-03-28 01:51 86,016 --a------ C:\WINDOWS\system32\isign32.dll
2007-03-28 01:51 81,920 --a------ C:\WINDOWS\system32\ils.dll
2007-03-28 01:51 73,728 --a------ C:\WINDOWS\system32\icwdial.dll
2007-03-28 01:51 73,472 --a------ C:\WINDOWS\system32\drivers\sr.sys
2007-03-28 01:51 69,632 --a------ C:\WINDOWS\system32\msconf.dll
2007-03-28 01:51 67,584 --a------ C:\WINDOWS\system32\srclient.dll
2007-03-28 01:51 65,536 --a------ C:\WINDOWS\system32\icwphbk.dll
2007-03-28 01:51 64,512 --a------ C:\WINDOWS\system32\acctres.dll
2007-03-28 01:51 382,464 --a------ C:\WINDOWS\system32\qmgr.dll
2007-03-28 01:51 34,560 --a------ C:\WINDOWS\system32\mnmdd.dll
2007-03-28 01:51 32,768 --a------ C:\WINDOWS\system32\mnmsrvc.exe
2007-03-28 01:51 32,768 --a------ C:\WINDOWS\system32\isrdbg32.dll
2007-03-28 01:51 28,672 --a------ C:\WINDOWS\system32\nmmkcert.dll
2007-03-28 01:51 278,528 --a------ C:\WINDOWS\system32\inetcfg.dll
2007-03-28 01:51 276,480 --a------ C:\WINDOWS\system32\mstask.dll
2007-03-28 01:51 23,696 --a------ C:\WINDOWS\system32\emptyregdb.dat
2007-03-28 01:51 190,976 --a------ C:\WINDOWS\system32\schedsvc.dll
2007-03-28 01:51 18,944 --a------ C:\WINDOWS\system32\qmgrprxy.dll
2007-03-28 01:51 170,496 --a------ C:\WINDOWS\system32\srsvc.dll
2007-03-28 01:51 16,384 --a------ C:\WINDOWS\system32\icfgnt5.dll
2007-03-28 01:51 12,288 --a------ C:\WINDOWS\system32\nmevtmsg.dll
2007-03-28 01:51 12,288 --a------ C:\WINDOWS\system32\mstinit.exe
2007-03-28 01:50 97,792 --a------ C:\WINDOWS\system32\comrepl.dll
2007-03-28 01:50 956,416 --a------ C:\WINDOWS\system32\msdtctm.dll
2007-03-28 01:50 93,696 --a------ C:\WINDOWS\system32\tscfgwmi.dll
2007-03-28 01:50 91,136 --a------ C:\WINDOWS\system32\mtxoci.dll
2007-03-28 01:50 9,728 --a------ C:\WINDOWS\system32\reset.exe
2007-03-28 01:50 87,176 --a------ C:\WINDOWS\system32\rdpwsx.dll
2007-03-28 01:50 85,504 --a------ C:\WINDOWS\system32\catsrvps.dll
2007-03-28 01:50 80,896 --a------ C:\WINDOWS\system32\charmap.exe
2007-03-28 01:50 73,216 --a------ C:\WINDOWS\system32\avwav.dll
2007-03-28 01:50 67,072 --a------ C:\WINDOWS\system32\rdshost.exe
2007-03-28 01:50 655,360 --a------ C:\WINDOWS\system32\mstscax.dll
2007-03-28 01:50 625,152 --a------ C:\WINDOWS\system32\catsrvut.dll
2007-03-28 01:50 62,464 --a------ C:\WINDOWS\system32\rdpclip.exe
2007-03-28 01:50 605,696 --a------ C:\WINDOWS\system32\getuname.dll
2007-03-28 01:50 60,416 --a------ C:\WINDOWS\system32\remotepg.dll
2007-03-28 01:50 60,416 --a------ C:\WINDOWS\system32\colbact.dll
2007-03-28 01:50 6,656 --a------ C:\WINDOWS\system32\wuauserv.dll
2007-03-28 01:50 6,144 --a------ C:\WINDOWS\system32\msdtc.exe
2007-03-28 01:50 58,880 --a------ C:\WINDOWS\system32\msdtclog.dll
2007-03-28 01:50 58,880 --a------ C:\WINDOWS\system32\licwmi.dll
2007-03-28 01:50 56,832 --a------ C:\WINDOWS\system32\sol.exe
2007-03-28 01:50 56,320 --a------ C:\WINDOWS\system32\servdeps.dll
2007-03-28 01:50 55,296 --a------ C:\WINDOWS\system32\freecell.exe
2007-03-28 01:50 540,160 --a------ C:\WINDOWS\system32\comuid.dll
2007-03-28 01:50 54,272 --a------ C:\WINDOWS\system32\stclient.dll
2007-03-28 01:50 538,624 --a------ C:\WINDOWS\system32\spider.exe
2007-03-28 01:50 5,632 --a------ C:\WINDOWS\system32\write.exe
2007-03-28 01:50 5,120 --a------ C:\WINDOWS\system32\dcomcnfg.exe
2007-03-28 01:50 498,688 --a------ C:\WINDOWS\system32\clbcatq.dll
2007-03-28 01:50 44,544 --a------ C:\WINDOWS\system32\tscupgrd.exe
2007-03-28 01:50 44,544 --a------ C:\WINDOWS\system32\hticons.dll
2007-03-28 01:50 426,496 --a------ C:\WINDOWS\system32\msdtcprx.dll
2007-03-28 01:50 404,992 --a------ C:\WINDOWS\system32\mstsc.exe
2007-03-28 01:50 40,840 --a------ C:\WINDOWS\system32\drivers\termdd.sys
2007-03-28 01:50 4,096 --a------ C:\WINDOWS\system32\rdpcfgex.dll
2007-03-28 01:50 4,096 --a------ C:\WINDOWS\system32\mtxex.dll
2007-03-28 01:50 39,424 --a------ C:\WINDOWS\system32\cfgbkend.dll
2007-03-28 01:50 350,208 --a------ C:\WINDOWS\system32\hypertrm.dll
2007-03-28 01:50 35,328 --a------ C:\WINDOWS\system32\winchat.exe
2007-03-28 01:50 344,064 --a------ C:\WINDOWS\system32\mspaint.exe
2007-03-28 01:50 33,792 --a------ C:\WINDOWS\system32\regini.exe
2007-03-28 01:50 295,424 --a------ C:\WINDOWS\system32\termsrv.dll
2007-03-28 01:50 25,600 --a------ C:\WINDOWS\system32\comaddin.dll
2007-03-28 01:50 25,088 --a------ C:\WINDOWS\system32\mtxlegih.dll
2007-03-28 01:50 227,840 --a------ C:\WINDOWS\system32\avtapi.dll
2007-03-28 01:50 225,792 --a------ C:\WINDOWS\system32\catsrv.dll
2007-03-28 01:50 22,016 --a------ C:\WINDOWS\system32\qwinsta.exe
2007-03-28 01:50 21,896 --a------ C:\WINDOWS\system32\drivers\tdtcp.sys
2007-03-28 01:50 21,504 --a------ C:\WINDOWS\system32\msg.exe
2007-03-28 01:50 20,480 --a------ C:\WINDOWS\system32\qprocess.exe
2007-03-28 01:50 20,480 --a------ C:\WINDOWS\system32\mtxdm.dll
2007-03-28 01:50 196,864 --a------ C:\WINDOWS\system32\drivers\rdpdr.sys
2007-03-28 01:50 19,968 --a------ C:\WINDOWS\system32\rdpsnd.dll
2007-03-28 01:50 185,344 --a------ C:\WINDOWS\system32\cmprops.dll
2007-03-28 01:50 17,408 --a------ C:\WINDOWS\system32\tsshutdn.exe
2007-03-28 01:50 17,408 --a------ C:\WINDOWS\system32\mmfutil.dll
2007-03-28 01:50 161,280 --a------ C:\WINDOWS\system32\msdtcuiu.dll
2007-03-28 01:50 16,896 --a------ C:\WINDOWS\system32\qappsrv.exe
2007-03-28 01:50 16,384 --a------ C:\WINDOWS\system32\tskill.exe
2007-03-28 01:50 16,384 --a------ C:\WINDOWS\system32\avmeter.dll
2007-03-28 01:50 15,872 --a------ C:\WINDOWS\system32\rwinsta.exe
2007-03-28 01:50 15,872 --a------ C:\WINDOWS\system32\cdmodem.dll
2007-03-28 01:50 15,360 --a------ C:\WINDOWS\system32\tscon.exe
2007-03-28 01:50 15,360 --a------ C:\WINDOWS\system32\logoff.exe
2007-03-28 01:50 147,968 --a------ C:\WINDOWS\system32\rdchost.dll
2007-03-28 01:50 147,456 --a------ C:\WINDOWS\system32\comsnap.dll
2007-03-28 01:50 140,800 --a------ C:\WINDOWS\system32\sessmgr.exe
2007-03-28 01:50 14,848 --a------ C:\WINDOWS\system32\tsdiscon.exe
2007-03-28 01:50 14,848 --a------ C:\WINDOWS\system32\shadow.exe
2007-03-28 01:50 139,528 --a------ C:\WINDOWS\system32\drivers\rdpwd.sys
2007-03-28 01:50 138,752 --a------ C:\WINDOWS\system32\sndvol32.exe
2007-03-28 01:50 131,584 --a------ C:\WINDOWS\system32\sndrec32.exe
2007-03-28 01:50 13,824 --a------ C:\WINDOWS\system32\rdsaddin.exe
2007-03-28 01:50 126,976 --a------ C:\WINDOWS\system32\mshearts.exe
2007-03-28 01:50 124,696 --a------ C:\WINDOWS\system32\wuauclt.exe
2007-03-28 01:50 123,392 --a------ C:\WINDOWS\system32\mplay32.exe
2007-03-28 01:50 12,040 --a------ C:\WINDOWS\system32\drivers\tdpipe.sys
2007-03-28 01:50 119,808 --a------ C:\WINDOWS\system32\winmine.exe
2007-03-28 01:50 114,688 --a------ C:\WINDOWS\system32\calc.exe
2007-03-28 01:50 110,080 --a------ C:\WINDOWS\system32\clbcatex.dll
2007-03-28 01:50 11,776 --a------ C:\WINDOWS\system32\xolehlp.dll
2007-03-28 01:50 11,264 --a------ C:\WINDOWS\system32\icaapi.dll
2007-03-28 01:50 102,400 --a------ C:\WINDOWS\system32\clipbrd.exe
2007-03-28 01:50 1,343,768 --a------ C:\WINDOWS\system32\wuaueng.dll
2007-03-28 01:50 1,267,200 --a------ C:\WINDOWS\system32\comsvcs.dll
2007-03-28 01:50 1,161 --a------ C:\WINDOWS\system32\usrlogon.cmd
2007-03-27 23:42 <KANSIO> d-------- C:\DOCUME~1\Jani\APPLIC~1\ATI
2007-03-27 23:36 <KANSIO> d-------- C:\Program Files\Common Files\ATI Technologies
2007-03-27 22:43 27,904 --a------ C:\WINDOWS\system32\drivers\VIAAGP1.SYS
2007-03-27 22:42 <KANSIO> d-------- C:\Program Files\VIA
2007-03-27 22:21 <KANSIO> d-------- C:\Program Files\TechTracker
2007-03-27 22:21 <KANSIO> d-------- C:\DOCUME~1\Jani\APPLIC~1\VersionTracker Pro
2007-03-26 22:07 <KANSIO> d-------- C:\DOCUME~1\ALLUSE~1\APPLIC~1\Lavasoft
2007-03-20 19:06 <KANSIO> d-------- C:\cb65fb59f68f4d79e91c5359


(((((((((((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))))


2007-04-20 20:26 -------- d-------- C:\Program Files\java
2007-04-17 14:56 -------- d-------- C:\Program Files\k-lite codec pack
2007-04-17 14:53 -------- d-------- C:\Program Files\xvid
2007-04-15 18:06 -------- d-------- C:\Program Files\dc++
2007-04-06 22:58 -------- d-------- C:\Program Files\electronic arts
2007-04-02 17:22 -------- d-------- C:\Program Files\tsunami-filter-pack
2007-04-02 17:21 -------- d--h----- C:\Program Files\installshield installation information
2007-04-01 19:18 -------- d-------- C:\Program Files\winace
2007-03-30 08:08 -------- d-------- C:\Program Files\winamp
2007-03-30 00:52 -------- d-------- C:\Program Files\azureus
2007-03-28 21:56 75814 --a------ C:\WINDOWS\system32\perfc00b.dat
2007-03-28 21:56 375932 --a------ C:\WINDOWS\system32\perfh00b.dat
2007-03-28 20:25 -------- d-------- C:\Program Files\Common Files\logitech
2007-03-28 16:41 -------- d-------- C:\Program Files\lavasoft
2007-03-28 16:33 -------- d-------- C:\Program Files\messenger
2007-03-28 15:32 -------- d-------- C:\Program Files\movie maker
2007-03-28 15:30 -------- d-------- C:\Program Files\windows nt
2007-03-28 02:44 62 --ahs---- C:\DOCUME~1\JANI~1.JAP\APPLIC~1\desktop.ini
2007-03-28 02:38 -------- d--h----- C:\Program Files\windowsupdate
2007-03-19 20:19 -------- d-------- C:\Program Files\msbuild
2007-03-19 20:15 -------- d-------- C:\Program Files\reference assemblies
2007-03-19 20:12 -------- d-------- C:\Program Files\gamespy
2007-03-19 20:03 -------- d-------- C:\Program Files\msxml 4.0
2007-03-19 18:44 -------- d-------- C:\Program Files\microsoft activesync
2007-03-17 16:44 292864 --a------ C:\WINDOWS\system32\winsrv.dll
2007-03-12 17:55 -------- d-------- C:\Program Files\maxis
2007-03-08 19:03 -------- d-------- C:\Program Files\zio interactive
2007-03-08 18:38 578048 --a------ C:\WINDOWS\system32\user32.dll
2007-03-08 18:37 40960 --a------ C:\WINDOWS\system32\mf3216.dll
2007-03-08 18:37 281600 --a------ C:\WINDOWS\system32\gdi32.dll
2007-03-08 18:34 1843840 --a------ C:\WINDOWS\system32\win32k.sys
2007-03-04 15:10 -------- d-------- C:\Program Files\orb networks
2007-02-21 18:05 -------- d-------- C:\Program Files\hexacto games
2007-02-05 23:19 185344 --a------ C:\WINDOWS\system32\upnphost.dll
2007-02-02 23:17 307200 --a------ C:\WINDOWS\system32\atiiiexx.dll
2007-02-02 23:04 307200 --a------ C:\WINDOWS\system32\atidemgx.dll
2007-02-02 23:03 264704 --a------ C:\WINDOWS\system32\ati2dvag.dll
2007-02-02 22:57 118784 --a------ C:\WINDOWS\system32\atipdlxx.dll
2007-02-02 22:56 42496 --a------ C:\WINDOWS\system32\ati2edxx.dll
2007-02-02 22:56 26112 --a------ C:\WINDOWS\system32\ati2mdxx.exe
2007-02-02 22:56 110592 --a------ C:\WINDOWS\system32\oemdspif.dll
2007-02-02 22:56 110592 --a------ C:\WINDOWS\system32\ati2evxx.dll
2007-02-02 22:55 446464 --a------ C:\WINDOWS\system32\ati2evxx.exe
2007-02-02 22:54 53248 --a------ C:\WINDOWS\system32\atiddc.dll
2007-02-02 22:46 2827968 --a------ C:\WINDOWS\system32\ati3duag.dll
2007-02-02 22:40 3107788 --a------ C:\WINDOWS\system32\ativvaxx.dat
2007-02-02 22:40 1272960 --a------ C:\WINDOWS\system32\ativvaxx.dll
2007-02-02 22:27 241664 --a------ C:\WINDOWS\system32\atikvmag.dll
2007-02-02 22:25 17408 --a------ C:\WINDOWS\system32\atitvo32.dll
2007-02-02 22:20 348160 --a------ C:\WINDOWS\system32\ati2cqag.dll
2007-02-02 22:19 5312512 --a------ C:\WINDOWS\system32\atioglxx.dll
2007-01-30 19:21 128813 --a------ C:\WINDOWS\system32\atiicdxx.dat


(((((((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))


*Note* empty entries & legit default entries are not shown

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects]
{53707962-6F74-2D53-2644-206D7942484F} C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
{761497BB-D6F0-462C-B6EB-D4DAF1D92D43} C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run]
"SunJavaUpdateSched"="\"C:\\Program Files\\Java\\jre1.6.0_01\\bin\\jusched.exe\""
"SmcService"="C:\\PROGRA~1\\Sygate\\SPF\\smc.exe -startgui"
"Kernel and Hardware Abstraction Layer"="KHALMNPR.EXE"
"WinPatrol"="C:\\Program Files\\BillP Studios\\WinPatrol\\winpatrol.exe"
"!AVG Anti-Spyware"="\"C:\\Program Files\\Grisoft\\AVG Anti-Spyware 7.5\\avgas.exe\" /minimized"
"AVG7_CC"="C:\\PROGRA~1\\Grisoft\\AVG7\\avgcc.exe /STARTUP"

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run]
"CTFMON.EXE"="C:\\WINDOWS\\system32\\ctfmon.exe"
"StartCCC"="C:\\Program Files\\ATI Technologies\\ATI.ACE\\Core-Static\\CLIStart.exe"
"ccleaner"="\"C:\\Program Files\\CCleaner\\ccleaner.exe\" /AUTO"

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shellexecutehooks]
"{57B86673-276A-48B2-BAE7-C6DBB3020EB8}"="AVG Anti-Spyware 7.5"

HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa
Authentication Packages REG_MULTI_SZ msv1_0\0\0
Security Packages REG_MULTI_SZ kerberos\0msv1_0\0schannel\0wdigest\0\0
Notification Packages REG_MULTI_SZ scecli\0\0

HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\minimal\WdfLoadGroup

[HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Svchost]
LocalService REG_MULTI_SZ Alerter\0WebClient\0LmHosts\0RemoteRegistry\0upnphost\0SSDPSRV\0\0
NetworkService REG_MULTI_SZ DnsCache\0\0
rpcss REG_MULTI_SZ RpcSs\0\0
imgsvc REG_MULTI_SZ StiSvc\0\0
termsvcs REG_MULTI_SZ TermService\0\0
HTTPFilter REG_MULTI_SZ HTTPFilter\0\0
DcomLaunch REG_MULTI_SZ DcomLaunch\0TermService\0\0


********************************************************************

catchme 0.2 W2K/XP/Vista - userland rootkit detector by Gmer, 17 October 2006
http://www.gmer.net

scanning hidden processes ...

scanning hidden services ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden processes: 0
hidden services: 0
hidden files: 0

********************************************************************

Completion time: 07-04-20 20:32:41
C:\ComboFix-quarantined-files.txt ... 07-04-20 20:32
C:\ComboFix2.txt ... 07-04-20 13:45


Logfile of HijackThis v1.99.1
Scan saved at 20:28:55, on 20.4.2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Sygate\SPF\smc.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
C:\WINDOWS\system32\PnkBstrA.exe
C:\Program Files\Java\j2re1.4.2_03\bin\jusched.exe
C:\Program Files\BillP Studios\WinPatrol\winpatrol.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe
C:\PROGRA~1\Grisoft\AVG7\avgcc.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.EXE
C:\Program Files\Logitech\SetPoint\SetPoint.exe
C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\ccc.exe
C:\Program Files\Ray Adams\ATI Tray Tools\atitray.exe
C:\Program Files\Common Files\Logitech\khalshared\KHALMNPR.EXE
C:\PROGRA~1\Mozilla Firefox\firefox.exe
C:\WINDOWS\system32\msiexec.exe
C:\Documents and Settings\Jani.JAPPE-3UI5AROGO\Työpöytä\hijackthis\Skanneri.exe.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.fi/
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Linkit
O2 - BHO: Adobe PDF Reader -linkkiavustaja - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe"
O4 - HKLM\..\Run: [SmcService] C:\PROGRA~1\Sygate\SPF\smc.exe -startgui
O4 - HKLM\..\Run: [Kernel and Hardware Abstraction Layer] KHALMNPR.EXE
O4 - HKLM\..\Run: [WinPatrol] C:\Program Files\BillP Studios\WinPatrol\winpatrol.exe
O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVG7\avgcc.exe /STARTUP
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [StartCCC] C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe
O4 - HKCU\..\Run: [ccleaner] "C:\Program Files\CCleaner\ccleaner.exe" /AUTO
O4 - Startup: ATI Tray Tools.lnk = C:\Program Files\Ray Adams\ATI Tray Tools\atitray.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Reader 8.0\Reader\reader_sl.exe
O4 - Global Startup: Adobe Reader Synchronizer.lnk = C:\Program Files\Adobe\Reader 8.0\Reader\AdobeCollabSync.exe
O4 - Global Startup: Logitech SetPoint.lnk = C:\Program Files\Logitech\SetPoint\SetPoint.exe
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\npjpi160_01.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\npjpi160_01.dll
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1175086735484
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: AVG Anti-Spyware Guard - Anti-Malware Development a.s. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1150\Intel 32\IDriverT.exe
O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\system32\PnkBstrA.exe
O23 - Service: PnkBstrB - Unknown owner - C:\WINDOWS\system32\PnkBstrB.exe
O23 - Service: Sygate Personal Firewall (SmcService) - Sygate Technologies, Inc. - C:\Program Files\Sygate\SPF\smc.exe

 

1. Klikkaa käynnistä > Oma tietokone oikean puoleisella hiiren napilla
2. Valitse ominaisuudet
3. Valitse järjestelmän palauttaminen välilehti
4. Ruksi eteen ¤ poista järjestelmän palauttaminen kaikissa asemissa
5. Paina Käytä
6. Paina ok
7. Sammuta ja käynnistä
8. Ota ruksi pois ¤ poista järjestelmän palauttaminen kaikissa asemissa
9. Käytä ja OK

******

Lataa Killbox Option^Explicitiltä.

Huomaa: Jos sinulla on jo Killbox, tämä on uusi versio joka sinun tulee asentaa. Poista aikaisempi.

[*]Tallenna työpöydällesi.
[*] Tupla-klikkaa Killbox.exe ajaaksesi ohjelman.
[*] Valitse: [*]Delete on Reboot[*] sitten klikkaa All Files valintaa.
[*]Kopioi ja liitä alapuolella olevat tiedostopolut leikepöydälle mustaamalla KAIKKI ne ja painamalla CTRL + C (tai, mustaamisen jälkeen, oikea klikki hiirellä ja valitse kopioi):

C:\WINDOWS\system32\vtboyrgj.dll

[*] Palaa Killboxiin, mene File valikkoon, ja valitse Paste from Clipboard.

[*]Klikkaa puna-valkoista Delete File valintaa. Klikkaa Yes "Delete on Reboot" pyyntöön. Klikkaa OK mihin vain PendingFileRenameOperations pyyntöön (ja anna fixaajan tietää jos jokin tälläinen tulee!).
Käynnistä koneesi itse jos se ei sitä automaattisesti tee

Jos saat tälläisen viestin: "Component 'MsComCtl.ocx' or one of its dependencies not correctly registered: a file is missing or invalid." Kun yrität ajaa KillBoxia, klikkaa tätä ladataksesi ja ajaaksesi Missingfilessetup.exe;n. Sitten koita KillBoxia uudestaan.

*******

1) Lataa http://secured2k.home.comcast.net/tools/VirtumundoBeGone.exe
2) Tallenna VirtumundoBeGone.exe työpöydällesi.
3) Aja VirtumundoBeGone.exe ja seuraa ohjeita. Älä huoli jos näet sinisen ruudun "Fatal Error" viestin, tämä on normaalia.
4) Kun työkalu on valmis, käynnistä kone uudelleen.

Se luo työpöydällesi lokin nimeltä VBG.TXT, kopioi ja liitä sen sisältö vastaukseesi.

Ongelmia vielä?

 

Tässä loki:
[04/21/2007, 9:47:36] - VirtumundoBeGone v1.5 ( "C:\Documents and Settings\Jani.JAPPE-3UI5AROGO\Työpöytä\VirtumundoBeGone.exe" )
[04/21/2007, 9:47:42] - Detected System Information:
[04/21/2007, 9:47:42] - Windows Version: 5.1.2600, Service Pack 2
[04/21/2007, 9:47:42] - Current Username: Jani (Admin)
[04/21/2007, 9:47:42] - Windows is in NORMAL mode.
[04/21/2007, 9:47:42] - Searching for Browser Helper Objects:
[04/21/2007, 9:47:42] - BHO 1: {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} (Adobe PDF Reader -linkkiavustaja)
[04/21/2007, 9:47:42] - BHO 2: {53707962-6F74-2D53-2644-206D7942484F} ()
[04/21/2007, 9:47:42] - WARNING: BHO has no default name. Checking for Winlogon reference.
[04/21/2007, 9:47:42] - Checking for HKLM\...\Winlogon\Notify\SDHelper
[04/21/2007, 9:47:42] - Key not found: HKLM\...\Winlogon\Notify\SDHelper, continuing.
[04/21/2007, 9:47:42] - BHO 3: {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} (SSVHelper Class)
[04/21/2007, 9:47:42] - Finished Searching Browser Helper Objects
[04/21/2007, 9:47:42] - Finishing up...
[04/21/2007, 9:47:42] - Nothing found! Exiting...

Kone toimii kuin uutena. KIITOS!!!

 

Ok, hyvä

-> Tyhjennä järjestelmänpalautus Ohjeet
Tyhjennä järjestelmänpalautuskansio ja luo uusi palautuspiste. Tämä puhdistaa palautuskansion mahdollisista haittaohjelmajäännöksistä.

-> Käytä CCleaneria -> CCleaner
Lataa ja asenna CCleaner. Puhdista väliaikaistiedostot ja -kansiot ohjelmalla säännöllisesti.

-> Asenna SpywareBlaster -> SpywareBlaster
SpywareBlaster estää haittaohjelmia asentumasta koneellesi. Ei kuluta muistia!
Opas saatavilla suomeksi! Nimimerkki Ad-Awaren opas

-> Asenna MVPS Hosts tiedosto -> MVPS Hosts
Estää koneesi yhteyden haitallisiin sivustoihin.
Opas saatavilla suomeksi! Nimimerkki Axelin opas

-> Vaihda selaimesi Firefoxiin -> Firefox
Firefox on nopeampi, turvallisempi ja parempi selain kuin Internet Explorer.

-> Pidä järjestelmäsi ajantasalla. -> Windows Update
Vieraile Windows Updatessa säännöllisesti.

-> Pidä palomuuri ja virustorjunta ajantasalla
Päivitä ja skannaa koneesi säännöllisesti virustorjuntaohjelmallasi.
ja hyvä myös escan http://koti.mbnet.fi/pattaya1/escanmwav.htm

 

Moi! Kaikki pyytämäsi on tehty. Katsoin ohjeita siihen järjestelmän palautukseen ja siellä käskettiin tehdä 2 eri scannia. Tein Pandan online scanin ja se löysi tämmöistä. Onko jotain vikaa vai kaikki kunnossa?


Incident Status Location

Potentially unwanted tool:application/myway Not disinfected c:\program files\MyWay
Potentially unwanted tool:Application/Processor Not disinfected C:\Documents and Settings\Jani.JAPPE-3UI5AROGO\Local Settings\Temp\nsf6.tmp
Potentially unwanted tool:Application/NirCmd.A Not disinfected C:\Documents and Settings\Jani.JAPPE-3UI5AROGO\Työpöytä\ComboFix.exe[ComboFixT\nircmd.cfexe]
Potentially unwanted tool:Application/Processor Not disinfected C:\Documents and Settings\Jani.JAPPE-3UI5AROGO\Työpöytä\VirtumundoBeGone.exe
Spyware:Cookie/DomainSponsor Not disinfected C:\RECYCLER\NPROTECT\00004804.MOZ[landing.domainsponsor.com/]
Spyware:Cookie/DomainSponsor Not disinfected C:\RECYCLER\NPROTECT\00004805.MOZ[landing.domainsponsor.com/]
Spyware:Cookie/DomainSponsor Not disinfected C:\RECYCLER\NPROTECT\00004808.MOZ[landing.domainsponsor.com/]
Spyware:Cookie/DomainSponsor Not disinfected C:\RECYCLER\NPROTECT\00004810.MOZ[landing.domainsponsor.com/]
Spyware:Cookie/bravenetA Not disinfected C:\RECYCLER\NPROTECT\00004811.MOZ[.bravenet.com/]
Spyware:Cookie/DomainSponsor Not disinfected C:\RECYCLER\NPROTECT\00004811.MOZ[landing.domainsponsor.com/]
Spyware:Cookie/bravenetA Not disinfected C:\RECYCLER\NPROTECT\00005646.MOZ[.bravenet.com/]
Spyware:Cookie/DomainSponsor Not disinfected C:\RECYCLER\NPROTECT\00005646.MOZ[landing.domainsponsor.com/]
Spyware:Cookie/bravenetA Not disinfected C:\RECYCLER\NPROTECT\00005837.MOZ[.bravenet.com/]
Spyware:Cookie/DomainSponsor Not disinfected C:\RECYCLER\NPROTECT\00005837.MOZ[landing.domainsponsor.com/]
Spyware:Spyware/Virtumonde Not disinfected C:\VundoFix Backups\lmpvupsa.dll.bad
Spyware:Spyware/Virtumonde Not disinfected C:\VundoFix Backups\qvsueypa.dll.bad

 

Moi! Kaikki pyytämäsi on tehty. Katsoin ohjeita siihen järjestelmän palautukseen ja siellä käskettiin tehdä 2 eri scannia. Tein Pandan online scanin ja se löysi tämmöistä. Onko jotain vikaa vai kaikki kunnossa?


Incident Status Location

Potentially unwanted tool:application/myway Not disinfected c:\program files\MyWay
Potentially unwanted tool:Application/Processor Not disinfected C:\Documents and Settings\Jani.JAPPE-3UI5AROGO\Local Settings\Temp\nsf6.tmp
Potentially unwanted tool:Application/NirCmd.A Not disinfected C:\Documents and Settings\Jani.JAPPE-3UI5AROGO\Työpöytä\ComboFix.exe[ComboFixT\nircmd.cfexe]
Potentially unwanted tool:Application/Processor Not disinfected C:\Documents and Settings\Jani.JAPPE-3UI5AROGO\Työpöytä\VirtumundoBeGone.exe
Spyware:Cookie/DomainSponsor Not disinfected C:\RECYCLER\NPROTECT\00004804.MOZ[landing.domainsponsor.com/]
Spyware:Cookie/DomainSponsor Not disinfected C:\RECYCLER\NPROTECT\00004805.MOZ[landing.domainsponsor.com/]
Spyware:Cookie/DomainSponsor Not disinfected C:\RECYCLER\NPROTECT\00004808.MOZ[landing.domainsponsor.com/]
Spyware:Cookie/DomainSponsor Not disinfected C:\RECYCLER\NPROTECT\00004810.MOZ[landing.domainsponsor.com/]
Spyware:Cookie/bravenetA Not disinfected C:\RECYCLER\NPROTECT\00004811.MOZ[.bravenet.com/]
Spyware:Cookie/DomainSponsor Not disinfected C:\RECYCLER\NPROTECT\00004811.MOZ[landing.domainsponsor.com/]
Spyware:Cookie/bravenetA Not disinfected C:\RECYCLER\NPROTECT\00005646.MOZ[.bravenet.com/]
Spyware:Cookie/DomainSponsor Not disinfected C:\RECYCLER\NPROTECT\00005646.MOZ[landing.domainsponsor.com/]
Spyware:Cookie/bravenetA Not disinfected C:\RECYCLER\NPROTECT\00005837.MOZ[.bravenet.com/]
Spyware:Cookie/DomainSponsor Not disinfected C:\RECYCLER\NPROTECT\00005837.MOZ[landing.domainsponsor.com/]
Spyware:Spyware/Virtumonde Not disinfected C:\VundoFix Backups\lmpvupsa.dll.bad
Spyware:Spyware/Virtumonde Not disinfected C:\VundoFix Backups\qvsueypa.dll.bad

 

kaikki kunnossa

tän kansion voi poistaa

C:\VundoFix Backups

 

Loistavaa. Kiitos tuhannesti!