--- Search result list ---
Log: Activity: SchedLgU.Txt (Varmuuskopio, nothing done)
C:\WINDOWS\SchedLgU.Txt
Log: Shutdown: System32\wbem\logs\wbemess.log (Varmuuskopio, nothing done)
C:\WINDOWS\System32\wbem\logs\wbemess.log
Log: Shutdown: System32\wbem\logs\winmgmt.log (Varmuuskopio, nothing done)
C:\WINDOWS\System32\wbem\logs\winmgmt.log
Log: Shutdown: System32\wbem\logs\wmiprov.log (Varmuuskopio, nothing done)
C:\WINDOWS\System32\wbem\logs\wmiprov.log
MS Media Player: Anonymous ID (Muutos rekisterissä, nothing done)
HKEY_USERS\S-1-5-21-1131426265-514352727-2020637620-1005\Software\Microsoft\MediaPlayer\Preferences\SendUserGUID!=B=0
MS DirectInput: Most recent application (Muutos rekisterissä, nothing done)
HKEY_USERS\S-1-5-21-1131426265-514352727-2020637620-1005\Software\Microsoft\DirectInput\MostRecentApplication\Name!=
MS DirectInput: Most recent application ID (Muutos rekisterissä, nothing done)
HKEY_USERS\S-1-5-21-1131426265-514352727-2020637620-1005\Software\Microsoft\DirectInput\MostRecentApplication\Id!=
Windows Explorer: User Assistant history IE (1 files) (Rekisterin avain, nothing done)
HKEY_USERS\S-1-5-21-1131426265-514352727-2020637620-1005\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{5E6AB780-7743-11CF-A12B-00AA004AE837}\Count
Windows Explorer: User Assistant history files (1 files) (Rekisterin avain, nothing done)
HKEY_USERS\S-1-5-21-1131426265-514352727-2020637620-1005\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{75048700-EF1F-11D0-9888-006097DEACF9}\Count
Onnittelut!: Järjestelmästäsi ei löytynyt uhkaavia kohteita. ()
--- Spybot - Search & Destroy version: 1.3 .1 (build: 20040801) ---
2004-05-12 blindman.exe (1.0.0.0)
2004-08-05 SpyBotSD.exe (1.3.0.12)
2004-05-12 TeaTimer.exe (1.3.0.12)
2004-04-27 unins000.exe (51.13.0.0)
2004-05-12 Update.exe (1.3.0.0)
2004-08-01 advcheck.dll (1.0.1.0)
2004-05-12 borlndmm.dll (7.0.4.453)
2004-05-12 delphimm.dll (7.0.4.453)
2004-08-04 SDHelper.dll (1.3.0.12)
2004-05-12 Tools.dll (2.0.0.0)
2004-05-12 UnzDll.dll (1.73.1.1)
2004-05-12 ZipDll.dll (1.73.2.0)
2004-09-16 Includes\Beta.sbi
2004-08-30 Includes\Beta.uti
2004-08-11 Includes\Cookies.sbi
2004-09-16 Includes\Dialer.sbi
2004-09-16 Includes\Hijackers.sbi
2004-09-16 Includes\Keyloggers.sbi
2004-05-12 Includes\LSP.sbi
2004-09-16 Includes\Malware.sbi
2003-04-28 Includes\plugin-ignore.ini
2004-08-12 Includes\Revision.sbi
2004-09-16 Includes\Security.sbi
2004-09-16 Includes\Spybots.sbi
2004-08-30 Includes\Tracks.uti
2004-09-16 Includes\Trojans.sbi
--- System information ---
Windows XP (Build: 2600) Service Pack 1
/ DataAccess: Microsoft Data Access Components KB870669
/ DataAccess: Security update for Microsoft Data Access Components
/ DataAccess: Security Update for Microsoft Data Access Components
/ Windows Media Player / SP0: Windows Media Player Hotfix -päivitys [lisätietoja on artikkelissa wm828026]
/ Windows Media Player: Windows Media Update 817787
/ Windows Media Player: Windows Media Update 828026
/ Windows XP / SP1: Windows XP Service Pack 1
/ Windows XP / SP2: Windows XP Hotfix- KB810217
/ Windows XP / SP2: Advanced Networking Pack for Windows XP
/ Windows XP / SP2: Windows XP Hotfix- KB820291
/ Windows XP / SP2: Windows XP Hotfix- KB821253
/ Windows XP / SP2: Windows XP Hotfix- KB821557
/ Windows XP / SP2: Windows XP Hotfix- KB822603
/ Windows XP / SP2: Windows XP Hotfix- KB823182
/ Windows XP / SP2: Windows XP Hotfix- KB823559
/ Windows XP / SP2: Windows XP Hotfix- KB823980
/ Windows XP / SP2: Windows XP Hotfix- KB824105
/ Windows XP / SP2: Windows XP Hotfix- KB824141
/ Windows XP / SP2: Windows XP Hotfix- KB824146
/ Windows XP / SP2: Windows XP Hotfix- KB825119
/ Windows XP / SP2: Windows XP Hotfix- KB826942
/ Windows XP / SP2: Windows XP Hotfix- KB828028
/ Windows XP / SP2: Windows XP Hotfix- KB828035
/ Windows XP / SP2: Windows XP Hotfix- KB828741
/ Windows XP / SP2: Windows XP Hotfix- KB833987
/ Windows XP / SP2: Windows XP Hotfix- KB833998
/ Windows XP / SP2: Windows XP Hotfix- KB835732
/ Windows XP / SP2: Windows XP Hotfix- KB837001
/ Windows XP / SP2: Windows XP Hotfix- KB839643
/ Windows XP / SP2: Windows XP Hotfix- KB839645
/ Windows XP / SP2: Windows XP Hotfix- KB840315
/ Windows XP / SP2: Windows XP Hotfix- KB840374
/ Windows XP / SP2: Windows XP Hotfix- KB841873
/ Windows XP / SP2: Windows XP Hotfix- KB842773
/ Windows XP / SP2: Windows XP Hotfix- KB883357
/ Windows XP / SP2: Windows XP Hotfix (SP2) Q322011
/ Windows XP / SP2: Windows XP Hotfix [Lisätietoja saat lukemalla dokumentin Q323255]
/ Windows XP / SP2: Windows XP Hotfix (SP2) Q327979
/ Windows XP / SP2: Windows XP Hotfix (SP2) Q328310
/ Windows XP / SP2: Windows XP Hotfix [Lisätietoja saat lukemalla dokumentin Q329048]
/ Windows XP / SP2: Windows XP Hotfix [Lisätietoja saat lukemalla dokumentin Q329115]
/ Windows XP / SP2: Windows XP Hotfix (SP2) Q329170
/ Windows XP / SP2: Windows XP Hotfix [Lisätietoja saat lukemalla dokumentin Q329390]
/ Windows XP / SP2: Windows XP Hotfix (SP2) Q329441
/ Windows XP / SP2: Windows XP Hotfix [Lisätietoja saat lukemalla dokumentin Q329834]
/ Windows XP / SP2: Windows XP Hotfix (SP2) Q331953
/ Windows XP / SP2: Windows XP Hotfix (SP2) Q810565
/ Windows XP / SP2: Windows XP Hotfix (SP2) Q810577
/ Windows XP / SP2: Windows XP Hotfix (SP2) Q810833
/ Windows XP / SP2: Windows XP Hotfix (SP2) Q811493
/ Windows XP / SP2: Windows XP Hotfix (SP2) Q811630
/ Windows XP / SP2: Windows XP Hotfix (SP2) Q814033
/ Windows XP / SP2: Windows XP Hotfix (SP2) Q814995
/ Windows XP / SP2: Windows XP Hotfix (SP2) Q815021
/ Windows XP / SP2: Windows XP Hotfix (SP2) Q817287
/ Windows XP / SP2: Windows XP Hotfix (SP2) Q817606
/ Windows XP / SP2: Windows XP Hotfix (SP2) Q819696
--- Startup entries list ---
Located: HK_LM:Run, EM_EXEC
command: C:\OHJELM~1\Logitech\SYSTEM\EM_EXEC.EXE
file: C:\OHJELM~1\Logitech\SYSTEM\EM_EXEC.EXE
size: 28672
MD5: e4d07dba556fe537595556bf1d957dfc
Located: HK_LM:Run, F-Secure Manager
command: "C:\Program Files\F-Secure Internet Security\Common\FSM32.EXE" /splash
file: C:\Program Files\F-Secure Internet Security\Common\FSM32.EXE
size: 110672
MD5: af1a4ca984646bf4cfbe2d29e4855f24
Located: HK_LM:Run, F-Secure TNB
command: "C:\Program Files\F-Secure Internet Security\TNB\TNBUtil.exe" /CHECKALL
file: C:\Program Files\F-Secure Internet Security\TNB\TNBUtil.exe
size: 643072
MD5: d4f28a56a906e2db4d99c843701c7405
Located: HK_LM:Run, HPDJ Taskbar Utility
command: C:\WINDOWS\System32\spool\drivers\w32x86\3\hpztsb04.exe
file: C:\WINDOWS\System32\spool\drivers\w32x86\3\hpztsb04.exe
size: 196608
MD5: 7c6b5065e7326e3c91a62800df3a31fa
Located: HK_LM:Run, SoundMan
command: SOUNDMAN.EXE
file: C:\WINDOWS\SOUNDMAN.EXE
size: 46592
MD5: d968b3259421c4a0627a62f4e0e96d6d
Located: HK_LM:Run, SunJavaUpdateSched
command: C:\Program Files\Java\j2re1.4.2_03\bin\jusched.exe
file: C:\Program Files\Java\j2re1.4.2_03\bin\jusched.exe
size: 32881
MD5: ed85b344e6edc30c1bc57ec1a2a56bf3
Located: HK_LM:Run, TkBellExe
command: "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
file: C:\Program Files\Common Files\Real\Update_OB\realsched.exe
size: 151597
MD5: 9a81cc033556eaaef8cd91d6618b6f57
Located: HK_LM:Run, zBrowser Launcher
command: C:\Program Files\Logitech\iTouch\iTouch.exe
file: C:\Program Files\Logitech\iTouch\iTouch.exe
size: 204800
MD5: f7a6f81f6ff573a8655532511e613710
Located: HK_CU:Run, SpybotSD TeaTimer
command: C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
file: C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
size: 1038336
MD5: 58f7e6434d285f4c98ad3621e0bd8c8d
Located: Startup (user), Microsoft Office Pikahaku.lnk
command: C:\Program Files\Microsoft Office\Office\FINDFAST.EXE
file: C:\Program Files\Microsoft Office\Office\FINDFAST.EXE
size: 111376
MD5: 477cc28cdbe10138448852639c03ed56
Located: Startup (user), Officen käynnistys.lnk
command: C:\Program Files\Microsoft Office\Office\OSA.EXE
file: C:\Program Files\Microsoft Office\Office\OSA.EXE
size: 51984
MD5: d06276d4cad46cdceabefdeb1a0d3c0d
Located: Win.ini, Run
command: C:\WESTWOOD\REDALERT\INSTICON.EXE C:\WESTWOOD\REDALERT\INSTICON.EXE
Located: WinLogon, crypt32chain
command: crypt32.dll
Located: WinLogon, cryptnet
command: cryptnet.dll
Located: WinLogon, cscdll
command: cscdll.dll
Located: WinLogon, ScCertProp
command: wlnotify.dll
Located: WinLogon, Schedule
command: wlnotify.dll
Located: WinLogon, sclgntfy
command: sclgntfy.dll
Located: WinLogon, SensLogn
command: WlNotify.dll
Located: WinLogon, termsrv
command: wlnotify.dll
Located: WinLogon, wlballoon
command: wlnotify.dll
--- Browser helper object list ---
{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} (AcroIEHlprObj Class)
BHO name:
CLSID name: AcroIEHlprObj Class
description: Adobe Acrobat reader
classification: Legitimate
known filename: AcroIEhelper.ocxAcroIEhelper.dll
info link: http://www.adobe.com/products/acrobat/readstep2.html
info source: TonyKlein
Path: C:\Ohjelmatiedostot\Adobe\Acrobat 5.0\Reader\ActiveX\
Long name: AcroIEHelper.ocx
Short name: ACROIE~1.OCX
Date (created): 2.10.2002 11:47:18
Date (last access): 29.9.2004 16:46:44
Date (last write): 16.4.2001 15:39:02
Filesize: 37808
Attributes: archive
MD5: 8394ABFC1BE196A62C9F532511936DF7
CRC32: 71D6E350
Version: 0.1.0.0
{1BDD55B8-3985-4E59-B906-5E0AD56D6710} ()
BHO name:
CLSID name:
{53707962-6F74-2D53-2644-206D7942484F} ()
BHO name:
CLSID name:
description: Spybot-S&D IE Browser plugin
classification: Legitimate
known filename: SDhelper.dll
info link: http://spybot.eon.net.au/
info source: Patrick M. Kolla
Path: C:\PROGRA~1\SPYBOT~1\
Long name: SDHelper.dll
Short name:
Date (created): 12.5.2004 1:03:00
Date (last access): 29.9.2004 17:42:42
Date (last write): 4.8.2004 12:10:42
Filesize: 773120
Attributes: archive
MD5: 0C332C33607F59C0FE0B788A0413A559
CRC32: 8928D78E
Version: 0.1.0.3
{AA58ED58-01DD-4d91-8333-CF10577473F7} (Google Toolbar Helper)
BHO name:
CLSID name: Google Toolbar Helper
description: Google toolbar
classification: Open for discussion
known filename: googletoolbar.dllgoogletoolbar*.dll(* = number)googletoolbar_en_*.**-big.dllGoogletoolbar_en_*.*.**-deleon.dll
info link: http://toolbar.google.com/
info source: TonyKlein
Path: c:\program files\google\
Long name: GoogleToolbar1.dll
Short name: GOOGLE~1.DLL
Date (created): 11.8.2004 19:40:18
Date (last access): 29.9.2004 17:42:42
Date (last write): 11.8.2004 19:40:18
Filesize: 774144
Attributes: readonly archive
MD5: 470EEC71AAB706A870A618E4FD75E283
CRC32: C25C3329
Version: 0.2.0.0
{DA7505BC-42B7-4595-84F6-3569CD2FC410} ()
BHO name:
CLSID name:
--- ActiveX list ---
Microsoft XML Parser for Java (Microsoft XML Parser for Java)
DPF name: Microsoft XML Parser for Java
CLSID name:
description:
classification: Legitimate
known filename: %WINDIR%\Java\classes\xmldso.cab
info link:
info source: Patrick M. Kolla
{0246ECA8-996F-11D1-BE2F-00A0C9037DFE} (TDServer Control)
DPF name:
CLSID name: TDServer Control
Path: C:\WINDOWS\DOWNLO~1\
Long name: tdserver.ocx
Short name:
Date (created): 2.8.2000 13:26:58
Date (last access): 29.9.2004 10:21:52
Date (last write): 2.8.2000 13:26:58
Filesize: 372736
Attributes: archive
MD5: ACABD7A367F26B84BCA35C33376BC19D
CRC32: 16F9FA01
Version: 0.1.0.0
{166B1BCA-3F9C-11CF-8075-444553540000} (Shockwave ActiveX Control)
DPF name:
CLSID name: Shockwave ActiveX Control
description: Macromedia ShockWave Flash Player 7
classification: Unknown
known filename: SWDIR.DLL
info link:
info source: Patrick M. Kolla
Path: C:\WINDOWS\System32\macromed\Shockwave 8\
Long name: Download.dll
Short name:
Date (created): 28.3.2002 17:13:06
Date (last access): 29.9.2004 10:21:52
Date (last write): 28.3.2002 17:13:06
Filesize: 65536
Attributes: archive
MD5: 9FA268C045BD642CC6297A4D9A5B5C86
CRC32: 36C691B2
Version: 0.8.0.5
{33564D57-0000-0010-8000-00AA00389B71} ()
DPF name:
CLSID name:
{33564D57-9980-0010-8000-00AA00389B71} ()
DPF name:
CLSID name:
description: Microsoft WMV Video Codec
classification: Legitimate
known filename: WMV9DMO.CAB
info link:
info source: Patrick M. Kolla
{74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control)
DPF name:
CLSID name: HouseCall Control
description: Trend Micro Antivirus online scanner
classification: Legitimate
known filename: XSCAN53.OCX
info link:
info source: Patrick M. Kolla
Path: C:\WINDOWS\DOWNLO~1\
Long name: xscan53.ocx
Short name:
Date (created): 25.7.2003 15:22:08
Date (last access): 29.9.2004 10:21:52
Date (last write): 25.7.2003 15:22:08
Filesize: 434176
Attributes: archive
MD5: 5100F10A2F7DC2DCCF6DF39553154575
CRC32: 9880FD01
Version: 0.5.0.70
{8AD9C840-044E-11D1-B3E9-00805F499D93} (Java Runtime Environment 1.4.2)
DPF name: Java Runtime Environment 1.4.2
CLSID name: Java Plug-in 1.4.2_03
description: Sun Java
classification: Legitimate
known filename: %PROGRAM FILES%\JabaSoft\JRE\*\Bin\npjava131.dll
info link:
info source: Patrick M. Kolla
Path: C:\Program Files\Java\j2re1.4.2_03\bin\
Long name: NPJPI142_03.dll
Short name: NPJPI1~1.DLL
Date (created): 19.11.2003 18:48:18
Date (last access): 29.9.2004 10:21:52
Date (last write): 19.11.2003 18:48:12
Filesize: 65650
Attributes: archive
MD5: 2AD31341BE41AC9B086128AD86A2B53F
CRC32: 081CFB35
Version: 0.1.0.4
{CAFEEFAC-0014-0002-0003-ABCDEFFEDCBA} (Java Runtime Environment 1.4.2)
DPF name: Java Runtime Environment 1.4.2
CLSID name: Java Plug-in 1.4.2_03
Path: C:\Program Files\Java\j2re1.4.2_03\bin\
Long name: NPJPI142_03.dll
Short name: NPJPI1~1.DLL
Date (created): 19.11.2003 18:48:18
Date (last access): 29.9.2004 17:57:00
Date (last write): 19.11.2003 18:48:12
Filesize: 65650
Attributes: archive
MD5: 2AD31341BE41AC9B086128AD86A2B53F
CRC32: 081CFB35
Version: 0.1.0.4
{D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object)
DPF name:
CLSID name: Shockwave Flash Object
description: Macromedia Shockwave Flash Player
classification: Legitimate
known filename:
info link:
info source: Patrick M. Kolla
Path: C:\WINDOWS\System32\macromed\flash\
Long name: Flash.ocx
Short name:
Date (created): 8.12.2003 15:01:58
Date (last access): 29.9.2004 16:31:26
Date (last write): 8.12.2003 15:01:58
Filesize: 933888
Attributes: archive
MD5: F7E435D02F7A48120B746E33254A70BC
CRC32: 02AF493D
Version: 0.7.0.0
--- Process list ---
PID: 0 ( 0) [System]
PID: 4 ( 0) System
PID: 136 (1960) C:\WINDOWS\Explorer.EXE
PID: 428 ( 4) \SystemRoot\System32\smss.exe
PID: 476 ( 428) csrss.exe
PID: 500 ( 428) \??\C:\WINDOWS\system32\winlogon.exe
PID: 544 ( 500) C:\WINDOWS\system32\services.exe
PID: 556 ( 500) C:\WINDOWS\system32\lsass.exe
PID: 712 ( 544) C:\WINDOWS\system32\svchost.exe
PID: 764 ( 544) C:\WINDOWS\System32\svchost.exe
PID: 928 ( 544) svchost.exe
PID: 964 ( 544) svchost.exe
PID: 1076 ( 544) C:\WINDOWS\system32\spoolsv.exe
PID: 1192 ( 544) C:\PROGRA~1\F-SECU~1\backweb\4476822\Program\SERVIC~1.EXE
PID: 1216 ( 544) C:\Program Files\F-Secure Internet Security\Anti-Virus\fsgk32st.exe
PID: 1236 ( 544) C:\Program Files\F-Secure Internet Security\backweb\4476822\program\fsbwsys.exe
PID: 1248 (1216) C:\Program Files\F-Secure Internet Security\Anti-Virus\FSGK32.EXE
PID: 1296 (1248) C:\Program Files\F-Secure Internet Security\Anti-Virus\fssm32.exe
PID: 1384 ( 544) C:\Program Files\F-Secure Internet Security\DFW\Program\fsdfwd.exe
PID: 1396 ( 544) C:\WINDOWS\System32\svchost.exe
PID: 1564 ( 544) C:\Program Files\F-Secure Internet Security\Common\FSMA32.EXE
PID: 1616 (1192) C:\Program Files\F-Secure Internet Security\backweb\4476822\Program\BackWeb-4476822.exe
PID: 1624 (1564) C:\Program Files\F-Secure Internet Security\Common\FSMB32.EXE
PID: 1720 (1564) C:\Program Files\F-Secure Internet Security\Common\FCH32.EXE
PID: 1736 ( 136) C:\Program Files\Spybot - Search & Destroy\SpybotSD.exe
PID: 1832 (1564) C:\Program Files\F-Secure Internet Security\Common\FAMEH32.EXE
PID: 1840 (1564) C:\Program Files\F-Secure Internet Security\Anti-Virus\fsav32.exe
PID: 2680 (1736) C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
Spybot - Search && Destroy process list report, 29.9.2004 17:57:00
--- Browser start & search pages list ---
Spybot - Search && Destroy browser pages report, 29.9.2004 17:57:00
HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\Local Page
C:\WINDOWS\System32\blank.htm
HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\Search Page
http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\Start Page
http://www.suomi24.fi/
HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\HomeOldSP
about:blank
HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Search\SearchAssistant
http://ie.search.msn.com/{SUB_RFC1766}/srchasst/srchasst.htm
HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main\Local Page
%SystemRoot%\system32\blank.htm
HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main\Search Page
http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main\Start Page
http://www.msn.com/
HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main\Default_Page_URL
http://www.mtv3.fi/
HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main\Default_Search_URL
http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Search\SearchAssistant
http://ie.search.msn.com/{SUB_RFC1766}/srchasst/srchasst.htm
HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Search\CustomizeSearch
http://ie.search.msn.com/{SUB_RFC1766}/srchasst/srchcust.htm
--- Winsock Layered Service Provider list ---
Protocol 0: MSAFD Tcpip [TCP/IP]
GUID: {E70F1AA0-AB8B-11CF-8CA3-00805F48A192}
Filename: %SystemRoot%\system32\mswsock.dll
Description: Microsoft Windows NT/2k/XP IP protocol
DB filename: %SystemRoot%\system32\mswsock.dll
DB protocol: MSAFD Tcpip [*]
Protocol 1: MSAFD Tcpip [UDP/IP]
GUID: {E70F1AA0-AB8B-11CF-8CA3-00805F48A192}
Filename: %SystemRoot%\system32\mswsock.dll
Description: Microsoft Windows NT/2k/XP IP protocol
DB filename: %SystemRoot%\system32\mswsock.dll
DB protocol: MSAFD Tcpip [*]
Protocol 2: MSAFD Tcpip [RAW/IP]
GUID: {E70F1AA0-AB8B-11CF-8CA3-00805F48A192}
Filename: %SystemRoot%\system32\mswsock.dll
Description: Microsoft Windows NT/2k/XP IP protocol
DB filename: %SystemRoot%\system32\mswsock.dll
DB protocol: MSAFD Tcpip [*]
Protocol 3: RSVP UDP Service Provider
GUID: {9D60A9E0-337A-11D0-BD88-0000C082E69A}
Filename: %SystemRoot%\system32\rsvpsp.dll
Description: Microsoft Windows NT/2k/XP RVSP
DB filename: %SystemRoot%\system32\rsvpsp.dll
DB protocol: RSVP * Service Provider
Protocol 4: RSVP TCP Service Provider
GUID: {9D60A9E0-337A-11D0-BD88-0000C082E69A}
Filename: %SystemRoot%\system32\rsvpsp.dll
Description: Microsoft Windows NT/2k/XP RVSP
DB filename: %SystemRoot%\system32\rsvpsp.dll
DB protocol: RSVP * Service Provider
Protocol 5: MSAFD NetBIOS [\Device\NetBT_Tcpip_{804F882B-8B29-4B46-8A83-8F72D8F9C54E}] SEQPACKET 5
GUID: {8D5F1830-C273-11CF-95C8-00805F48A192}
Filename: %SystemRoot%\system32\mswsock.dll
Description: Microsoft Windows NT/2k/XP NetBios protocol
DB filename: %SystemRoot%\system32\mswsock.dll
DB protocol: MSAFD NetBIOS *
Protocol 6: MSAFD NetBIOS [\Device\NetBT_Tcpip_{804F882B-8B29-4B46-8A83-8F72D8F9C54E}] DATAGRAM 5
GUID: {8D5F1830-C273-11CF-95C8-00805F48A192}
Filename: %SystemRoot%\system32\mswsock.dll
Description: Microsoft Windows NT/2k/XP NetBios protocol
DB filename: %SystemRoot%\system32\mswsock.dll
DB protocol: MSAFD NetBIOS *
Protocol 7: MSAFD NetBIOS [\Device\NetBT_Tcpip_{541BEC49-23CA-4069-89D0-95A17AA9599E}] SEQPACKET 0
GUID: {8D5F1830-C273-11CF-95C8-00805F48A192}
Filename: %SystemRoot%\system32\mswsock.dll
Description: Microsoft Windows NT/2k/XP NetBios protocol
DB filename: %SystemRoot%\system32\mswsock.dll
DB protocol: MSAFD NetBIOS *
Protocol 8: MSAFD NetBIOS [\Device\NetBT_Tcpip_{541BEC49-23CA-4069-89D0-95A17AA9599E}] DATAGRAM 0
GUID: {8D5F1830-C273-11CF-95C8-00805F48A192}
Filename: %SystemRoot%\system32\mswsock.dll
Description: Microsoft Windows NT/2k/XP NetBios protocol
DB filename: %SystemRoot%\system32\mswsock.dll
DB protocol: MSAFD NetBIOS *
Protocol 9: MSAFD NetBIOS [\Device\NetBT_Tcpip_{CCF35369-5C9E-49E3-97FD-B2E8A7534D50}] SEQPACKET 1
GUID: {8D5F1830-C273-11CF-95C8-00805F48A192}
Filename: %SystemRoot%\system32\mswsock.dll
Description: Microsoft Windows NT/2k/XP NetBios protocol
DB filename: %SystemRoot%\system32\mswsock.dll
DB protocol: MSAFD NetBIOS *
Protocol 10: MSAFD NetBIOS [\Device\NetBT_Tcpip_{CCF35369-5C9E-49E3-97FD-B2E8A7534D50}] DATAGRAM 1
GUID: {8D5F1830-C273-11CF-95C8-00805F48A192}
Filename: %SystemRoot%\system32\mswsock.dll
Description: Microsoft Windows NT/2k/XP NetBios protocol
DB filename: %SystemRoot%\system32\mswsock.dll
DB protocol: MSAFD NetBIOS *
Protocol 11: MSAFD NetBIOS [\Device\NetBT_Tcpip_{B23D0388-3703-4508-9A3B-F217F012AEA6}] SEQPACKET 2
GUID: {8D5F1830-C273-11CF-95C8-00805F48A192}
Filename: %SystemRoot%\system32\mswsock.dll
Description: Microsoft Windows NT/2k/XP NetBios protocol
DB filename: %SystemRoot%\system32\mswsock.dll
DB protocol: MSAFD NetBIOS *
Protocol 12: MSAFD NetBIOS [\Device\NetBT_Tcpip_{B23D0388-3703-4508-9A3B-F217F012AEA6}] DATAGRAM 2
GUID: {8D5F1830-C273-11CF-95C8-00805F48A192}
Filename: %SystemRoot%\system32\mswsock.dll
Description: Microsoft Windows NT/2k/XP NetBios protocol
DB filename: %SystemRoot%\system32\mswsock.dll
DB protocol: MSAFD NetBIOS *
Protocol 13: MSAFD NetBIOS [\Device\NetBT_Tcpip_{38B4F820-ED24-4E0E-9F65-0790FC30B4A3}] SEQPACKET 3
GUID: {8D5F1830-C273-11CF-95C8-00805F48A192}
Filename: %SystemRoot%\system32\mswsock.dll
Description: Microsoft Windows NT/2k/XP NetBios protocol
DB filename: %SystemRoot%\system32\mswsock.dll
DB protocol: MSAFD NetBIOS *
Protocol 14: MSAFD NetBIOS [\Device\NetBT_Tcpip_{38B4F820-ED24-4E0E-9F65-0790FC30B4A3}] DATAGRAM 3
GUID: {8D5F1830-C273-11CF-95C8-00805F48A192}
Filename: %SystemRoot%\system32\mswsock.dll
Description: Microsoft Windows NT/2k/XP NetBios protocol
DB filename: %SystemRoot%\system32\mswsock.dll
DB protocol: MSAFD NetBIOS *
Protocol 15: MSAFD NetBIOS [\Device\NetBT_Tcpip_{7AA745A7-6A7E-4DF0-90EE-9364D4958E3D}] SEQPACKET 4
GUID: {8D5F1830-C273-11CF-95C8-00805F48A192}
Filename: %SystemRoot%\system32\mswsock.dll
Description: Microsoft Windows NT/2k/XP NetBios protocol
DB filename: %SystemRoot%\system32\mswsock.dll
DB protocol: MSAFD NetBIOS *
Protocol 16: MSAFD NetBIOS [\Device\NetBT_Tcpip_{7AA745A7-6A7E-4DF0-90EE-9364D4958E3D}] DATAGRAM 4
GUID: {8D5F1830-C273-11CF-95C8-00805F48A192}
Filename: %SystemRoot%\system32\mswsock.dll
Description: Microsoft Windows NT/2k/XP NetBios protocol
DB filename: %SystemRoot%\system32\mswsock.dll
DB protocol: MSAFD NetBIOS *
Namespace Provider 0: TCP/IP
GUID: {22059D40-7E9E-11CF-AE5A-00AA00A7112B}
Filename: %SystemRoot%\System32\mswsock.dll
Description: Microsoft Windows NT/2k/XP TCP/IP name space provider
DB filename: %SystemRoot%\system32\mswsock.dll
DB protocol: TCP/IP
Namespace Provider 1: NTDS
GUID: {3B2637EE-E580-11CF-A555-00C04FD8D4AC}
Filename: %SystemRoot%\System32\winrnr.dll
Description: Microsoft Windows NT/2k/XP name space provider
DB filename: %SystemRoot%\system32\winrnr.dll
DB protocol: NTDS
Namespace Provider 2: NLA-nimiavaruus (Network Location Awareness)
GUID: {6642243A-3BA8-4AA6-BAA5-2E0BD71FDD83}
Filename: %SystemRoot%\System32\mswsock.dll
Description: Microsoft Windows NT/2k/XP name space provider
DB filename: %SystemRoot%\system32\mswsock.dll
DB protocol: NLA-Namespace
voisko joku kaikki tietävä katsoa tän ja vastata mitä tarttis tehdä näille?
itse eikä kaveri tiedä näistä kun ei suostuneet poistuun.
Log: Activity: SchedLgU.Txt (Varmuuskopio, nothing done)
C:\WINDOWS\SchedLgU.Txt
Log: Shutdown: System32\wbem\logs\wbemess.log (Varmuuskopio, nothing done)
C:\WINDOWS\System32\wbem\logs\wbemess.log
Log: Shutdown: System32\wbem\logs\winmgmt.log (Varmuuskopio, nothing done)
C:\WINDOWS\System32\wbem\logs\winmgmt.log
Log: Shutdown: System32\wbem\logs\wmiprov.log (Varmuuskopio, nothing done)
C:\WINDOWS\System32\wbem\logs\wmiprov.log
MS Media Player: Anonymous ID (Muutos rekisterissä, nothing done)
HKEY_USERS\S-1-5-21-1131426265-514352727-2020637620-1005\Software\Microsoft\MediaPlayer\Preferences\SendUserGUID!=B=0
MS DirectInput: Most recent application (Muutos rekisterissä, nothing done)
HKEY_USERS\S-1-5-21-1131426265-514352727-2020637620-1005\Software\Microsoft\DirectInput\MostRecentApplication\Name!=
MS DirectInput: Most recent application ID (Muutos rekisterissä, nothing done)
HKEY_USERS\S-1-5-21-1131426265-514352727-2020637620-1005\Software\Microsoft\DirectInput\MostRecentApplication\Id!=
Windows Explorer: User Assistant history IE (1 files) (Rekisterin avain, nothing done)
HKEY_USERS\S-1-5-21-1131426265-514352727-2020637620-1005\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{5E6AB780-7743-11CF-A12B-00AA004AE837}\Count
Windows Explorer: User Assistant history files (1 files) (Rekisterin avain, nothing done)
HKEY_USERS\S-1-5-21-1131426265-514352727-2020637620-1005\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{75048700-EF1F-11D0-9888-006097DEACF9}\Count
Onnittelut!: Järjestelmästäsi ei löytynyt uhkaavia kohteita. ()
--- Spybot - Search & Destroy version: 1.3 .1 (build: 20040801) ---
2004-05-12 blindman.exe (1.0.0.0)
2004-08-05 SpyBotSD.exe (1.3.0.12)
2004-05-12 TeaTimer.exe (1.3.0.12)
2004-04-27 unins000.exe (51.13.0.0)
2004-05-12 Update.exe (1.3.0.0)
2004-08-01 advcheck.dll (1.0.1.0)
2004-05-12 borlndmm.dll (7.0.4.453)
2004-05-12 delphimm.dll (7.0.4.453)
2004-08-04 SDHelper.dll (1.3.0.12)
2004-05-12 Tools.dll (2.0.0.0)
2004-05-12 UnzDll.dll (1.73.1.1)
2004-05-12 ZipDll.dll (1.73.2.0)
2004-09-16 Includes\Beta.sbi
2004-08-30 Includes\Beta.uti
2004-08-11 Includes\Cookies.sbi
2004-09-16 Includes\Dialer.sbi
2004-09-16 Includes\Hijackers.sbi
2004-09-16 Includes\Keyloggers.sbi
2004-05-12 Includes\LSP.sbi
2004-09-16 Includes\Malware.sbi
2003-04-28 Includes\plugin-ignore.ini
2004-08-12 Includes\Revision.sbi
2004-09-16 Includes\Security.sbi
2004-09-16 Includes\Spybots.sbi
2004-08-30 Includes\Tracks.uti
2004-09-16 Includes\Trojans.sbi
--- System information ---
Windows XP (Build: 2600) Service Pack 1
/ DataAccess: Microsoft Data Access Components KB870669
/ DataAccess: Security update for Microsoft Data Access Components
/ DataAccess: Security Update for Microsoft Data Access Components
/ Windows Media Player / SP0: Windows Media Player Hotfix -päivitys [lisätietoja on artikkelissa wm828026]
/ Windows Media Player: Windows Media Update 817787
/ Windows Media Player: Windows Media Update 828026
/ Windows XP / SP1: Windows XP Service Pack 1
/ Windows XP / SP2: Windows XP Hotfix- KB810217
/ Windows XP / SP2: Advanced Networking Pack for Windows XP
/ Windows XP / SP2: Windows XP Hotfix- KB820291
/ Windows XP / SP2: Windows XP Hotfix- KB821253
/ Windows XP / SP2: Windows XP Hotfix- KB821557
/ Windows XP / SP2: Windows XP Hotfix- KB822603
/ Windows XP / SP2: Windows XP Hotfix- KB823182
/ Windows XP / SP2: Windows XP Hotfix- KB823559
/ Windows XP / SP2: Windows XP Hotfix- KB823980
/ Windows XP / SP2: Windows XP Hotfix- KB824105
/ Windows XP / SP2: Windows XP Hotfix- KB824141
/ Windows XP / SP2: Windows XP Hotfix- KB824146
/ Windows XP / SP2: Windows XP Hotfix- KB825119
/ Windows XP / SP2: Windows XP Hotfix- KB826942
/ Windows XP / SP2: Windows XP Hotfix- KB828028
/ Windows XP / SP2: Windows XP Hotfix- KB828035
/ Windows XP / SP2: Windows XP Hotfix- KB828741
/ Windows XP / SP2: Windows XP Hotfix- KB833987
/ Windows XP / SP2: Windows XP Hotfix- KB833998
/ Windows XP / SP2: Windows XP Hotfix- KB835732
/ Windows XP / SP2: Windows XP Hotfix- KB837001
/ Windows XP / SP2: Windows XP Hotfix- KB839643
/ Windows XP / SP2: Windows XP Hotfix- KB839645
/ Windows XP / SP2: Windows XP Hotfix- KB840315
/ Windows XP / SP2: Windows XP Hotfix- KB840374
/ Windows XP / SP2: Windows XP Hotfix- KB841873
/ Windows XP / SP2: Windows XP Hotfix- KB842773
/ Windows XP / SP2: Windows XP Hotfix- KB883357
/ Windows XP / SP2: Windows XP Hotfix (SP2) Q322011
/ Windows XP / SP2: Windows XP Hotfix [Lisätietoja saat lukemalla dokumentin Q323255]
/ Windows XP / SP2: Windows XP Hotfix (SP2) Q327979
/ Windows XP / SP2: Windows XP Hotfix (SP2) Q328310
/ Windows XP / SP2: Windows XP Hotfix [Lisätietoja saat lukemalla dokumentin Q329048]
/ Windows XP / SP2: Windows XP Hotfix [Lisätietoja saat lukemalla dokumentin Q329115]
/ Windows XP / SP2: Windows XP Hotfix (SP2) Q329170
/ Windows XP / SP2: Windows XP Hotfix [Lisätietoja saat lukemalla dokumentin Q329390]
/ Windows XP / SP2: Windows XP Hotfix (SP2) Q329441
/ Windows XP / SP2: Windows XP Hotfix [Lisätietoja saat lukemalla dokumentin Q329834]
/ Windows XP / SP2: Windows XP Hotfix (SP2) Q331953
/ Windows XP / SP2: Windows XP Hotfix (SP2) Q810565
/ Windows XP / SP2: Windows XP Hotfix (SP2) Q810577
/ Windows XP / SP2: Windows XP Hotfix (SP2) Q810833
/ Windows XP / SP2: Windows XP Hotfix (SP2) Q811493
/ Windows XP / SP2: Windows XP Hotfix (SP2) Q811630
/ Windows XP / SP2: Windows XP Hotfix (SP2) Q814033
/ Windows XP / SP2: Windows XP Hotfix (SP2) Q814995
/ Windows XP / SP2: Windows XP Hotfix (SP2) Q815021
/ Windows XP / SP2: Windows XP Hotfix (SP2) Q817287
/ Windows XP / SP2: Windows XP Hotfix (SP2) Q817606
/ Windows XP / SP2: Windows XP Hotfix (SP2) Q819696
--- Startup entries list ---
Located: HK_LM:Run, EM_EXEC
command: C:\OHJELM~1\Logitech\SYSTEM\EM_EXEC.EXE
file: C:\OHJELM~1\Logitech\SYSTEM\EM_EXEC.EXE
size: 28672
MD5: e4d07dba556fe537595556bf1d957dfc
Located: HK_LM:Run, F-Secure Manager
command: "C:\Program Files\F-Secure Internet Security\Common\FSM32.EXE" /splash
file: C:\Program Files\F-Secure Internet Security\Common\FSM32.EXE
size: 110672
MD5: af1a4ca984646bf4cfbe2d29e4855f24
Located: HK_LM:Run, F-Secure TNB
command: "C:\Program Files\F-Secure Internet Security\TNB\TNBUtil.exe" /CHECKALL
file: C:\Program Files\F-Secure Internet Security\TNB\TNBUtil.exe
size: 643072
MD5: d4f28a56a906e2db4d99c843701c7405
Located: HK_LM:Run, HPDJ Taskbar Utility
command: C:\WINDOWS\System32\spool\drivers\w32x86\3\hpztsb04.exe
file: C:\WINDOWS\System32\spool\drivers\w32x86\3\hpztsb04.exe
size: 196608
MD5: 7c6b5065e7326e3c91a62800df3a31fa
Located: HK_LM:Run, SoundMan
command: SOUNDMAN.EXE
file: C:\WINDOWS\SOUNDMAN.EXE
size: 46592
MD5: d968b3259421c4a0627a62f4e0e96d6d
Located: HK_LM:Run, SunJavaUpdateSched
command: C:\Program Files\Java\j2re1.4.2_03\bin\jusched.exe
file: C:\Program Files\Java\j2re1.4.2_03\bin\jusched.exe
size: 32881
MD5: ed85b344e6edc30c1bc57ec1a2a56bf3
Located: HK_LM:Run, TkBellExe
command: "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
file: C:\Program Files\Common Files\Real\Update_OB\realsched.exe
size: 151597
MD5: 9a81cc033556eaaef8cd91d6618b6f57
Located: HK_LM:Run, zBrowser Launcher
command: C:\Program Files\Logitech\iTouch\iTouch.exe
file: C:\Program Files\Logitech\iTouch\iTouch.exe
size: 204800
MD5: f7a6f81f6ff573a8655532511e613710
Located: HK_CU:Run, SpybotSD TeaTimer
command: C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
file: C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
size: 1038336
MD5: 58f7e6434d285f4c98ad3621e0bd8c8d
Located: Startup (user), Microsoft Office Pikahaku.lnk
command: C:\Program Files\Microsoft Office\Office\FINDFAST.EXE
file: C:\Program Files\Microsoft Office\Office\FINDFAST.EXE
size: 111376
MD5: 477cc28cdbe10138448852639c03ed56
Located: Startup (user), Officen käynnistys.lnk
command: C:\Program Files\Microsoft Office\Office\OSA.EXE
file: C:\Program Files\Microsoft Office\Office\OSA.EXE
size: 51984
MD5: d06276d4cad46cdceabefdeb1a0d3c0d
Located: Win.ini, Run
command: C:\WESTWOOD\REDALERT\INSTICON.EXE C:\WESTWOOD\REDALERT\INSTICON.EXE
Located: WinLogon, crypt32chain
command: crypt32.dll
Located: WinLogon, cryptnet
command: cryptnet.dll
Located: WinLogon, cscdll
command: cscdll.dll
Located: WinLogon, ScCertProp
command: wlnotify.dll
Located: WinLogon, Schedule
command: wlnotify.dll
Located: WinLogon, sclgntfy
command: sclgntfy.dll
Located: WinLogon, SensLogn
command: WlNotify.dll
Located: WinLogon, termsrv
command: wlnotify.dll
Located: WinLogon, wlballoon
command: wlnotify.dll
--- Browser helper object list ---
{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} (AcroIEHlprObj Class)
BHO name:
CLSID name: AcroIEHlprObj Class
description: Adobe Acrobat reader
classification: Legitimate
known filename: AcroIEhelper.ocxAcroIEhelper.dll
info link: http://www.adobe.com/products/acrobat/readstep2.html
info source: TonyKlein
Path: C:\Ohjelmatiedostot\Adobe\Acrobat 5.0\Reader\ActiveX\
Long name: AcroIEHelper.ocx
Short name: ACROIE~1.OCX
Date (created): 2.10.2002 11:47:18
Date (last access): 29.9.2004 16:46:44
Date (last write): 16.4.2001 15:39:02
Filesize: 37808
Attributes: archive
MD5: 8394ABFC1BE196A62C9F532511936DF7
CRC32: 71D6E350
Version: 0.1.0.0
{1BDD55B8-3985-4E59-B906-5E0AD56D6710} ()
BHO name:
CLSID name:
{53707962-6F74-2D53-2644-206D7942484F} ()
BHO name:
CLSID name:
description: Spybot-S&D IE Browser plugin
classification: Legitimate
known filename: SDhelper.dll
info link: http://spybot.eon.net.au/
info source: Patrick M. Kolla
Path: C:\PROGRA~1\SPYBOT~1\
Long name: SDHelper.dll
Short name:
Date (created): 12.5.2004 1:03:00
Date (last access): 29.9.2004 17:42:42
Date (last write): 4.8.2004 12:10:42
Filesize: 773120
Attributes: archive
MD5: 0C332C33607F59C0FE0B788A0413A559
CRC32: 8928D78E
Version: 0.1.0.3
{AA58ED58-01DD-4d91-8333-CF10577473F7} (Google Toolbar Helper)
BHO name:
CLSID name: Google Toolbar Helper
description: Google toolbar
classification: Open for discussion
known filename: googletoolbar.dllgoogletoolbar*.dll(* = number)googletoolbar_en_*.**-big.dllGoogletoolbar_en_*.*.**-deleon.dll
info link: http://toolbar.google.com/
info source: TonyKlein
Path: c:\program files\google\
Long name: GoogleToolbar1.dll
Short name: GOOGLE~1.DLL
Date (created): 11.8.2004 19:40:18
Date (last access): 29.9.2004 17:42:42
Date (last write): 11.8.2004 19:40:18
Filesize: 774144
Attributes: readonly archive
MD5: 470EEC71AAB706A870A618E4FD75E283
CRC32: C25C3329
Version: 0.2.0.0
{DA7505BC-42B7-4595-84F6-3569CD2FC410} ()
BHO name:
CLSID name:
--- ActiveX list ---
Microsoft XML Parser for Java (Microsoft XML Parser for Java)
DPF name: Microsoft XML Parser for Java
CLSID name:
description:
classification: Legitimate
known filename: %WINDIR%\Java\classes\xmldso.cab
info link:
info source: Patrick M. Kolla
{0246ECA8-996F-11D1-BE2F-00A0C9037DFE} (TDServer Control)
DPF name:
CLSID name: TDServer Control
Path: C:\WINDOWS\DOWNLO~1\
Long name: tdserver.ocx
Short name:
Date (created): 2.8.2000 13:26:58
Date (last access): 29.9.2004 10:21:52
Date (last write): 2.8.2000 13:26:58
Filesize: 372736
Attributes: archive
MD5: ACABD7A367F26B84BCA35C33376BC19D
CRC32: 16F9FA01
Version: 0.1.0.0
{166B1BCA-3F9C-11CF-8075-444553540000} (Shockwave ActiveX Control)
DPF name:
CLSID name: Shockwave ActiveX Control
description: Macromedia ShockWave Flash Player 7
classification: Unknown
known filename: SWDIR.DLL
info link:
info source: Patrick M. Kolla
Path: C:\WINDOWS\System32\macromed\Shockwave 8\
Long name: Download.dll
Short name:
Date (created): 28.3.2002 17:13:06
Date (last access): 29.9.2004 10:21:52
Date (last write): 28.3.2002 17:13:06
Filesize: 65536
Attributes: archive
MD5: 9FA268C045BD642CC6297A4D9A5B5C86
CRC32: 36C691B2
Version: 0.8.0.5
{33564D57-0000-0010-8000-00AA00389B71} ()
DPF name:
CLSID name:
{33564D57-9980-0010-8000-00AA00389B71} ()
DPF name:
CLSID name:
description: Microsoft WMV Video Codec
classification: Legitimate
known filename: WMV9DMO.CAB
info link:
info source: Patrick M. Kolla
{74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control)
DPF name:
CLSID name: HouseCall Control
description: Trend Micro Antivirus online scanner
classification: Legitimate
known filename: XSCAN53.OCX
info link:
info source: Patrick M. Kolla
Path: C:\WINDOWS\DOWNLO~1\
Long name: xscan53.ocx
Short name:
Date (created): 25.7.2003 15:22:08
Date (last access): 29.9.2004 10:21:52
Date (last write): 25.7.2003 15:22:08
Filesize: 434176
Attributes: archive
MD5: 5100F10A2F7DC2DCCF6DF39553154575
CRC32: 9880FD01
Version: 0.5.0.70
{8AD9C840-044E-11D1-B3E9-00805F499D93} (Java Runtime Environment 1.4.2)
DPF name: Java Runtime Environment 1.4.2
CLSID name: Java Plug-in 1.4.2_03
description: Sun Java
classification: Legitimate
known filename: %PROGRAM FILES%\JabaSoft\JRE\*\Bin\npjava131.dll
info link:
info source: Patrick M. Kolla
Path: C:\Program Files\Java\j2re1.4.2_03\bin\
Long name: NPJPI142_03.dll
Short name: NPJPI1~1.DLL
Date (created): 19.11.2003 18:48:18
Date (last access): 29.9.2004 10:21:52
Date (last write): 19.11.2003 18:48:12
Filesize: 65650
Attributes: archive
MD5: 2AD31341BE41AC9B086128AD86A2B53F
CRC32: 081CFB35
Version: 0.1.0.4
{CAFEEFAC-0014-0002-0003-ABCDEFFEDCBA} (Java Runtime Environment 1.4.2)
DPF name: Java Runtime Environment 1.4.2
CLSID name: Java Plug-in 1.4.2_03
Path: C:\Program Files\Java\j2re1.4.2_03\bin\
Long name: NPJPI142_03.dll
Short name: NPJPI1~1.DLL
Date (created): 19.11.2003 18:48:18
Date (last access): 29.9.2004 17:57:00
Date (last write): 19.11.2003 18:48:12
Filesize: 65650
Attributes: archive
MD5: 2AD31341BE41AC9B086128AD86A2B53F
CRC32: 081CFB35
Version: 0.1.0.4
{D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object)
DPF name:
CLSID name: Shockwave Flash Object
description: Macromedia Shockwave Flash Player
classification: Legitimate
known filename:
info link:
info source: Patrick M. Kolla
Path: C:\WINDOWS\System32\macromed\flash\
Long name: Flash.ocx
Short name:
Date (created): 8.12.2003 15:01:58
Date (last access): 29.9.2004 16:31:26
Date (last write): 8.12.2003 15:01:58
Filesize: 933888
Attributes: archive
MD5: F7E435D02F7A48120B746E33254A70BC
CRC32: 02AF493D
Version: 0.7.0.0
--- Process list ---
PID: 0 ( 0) [System]
PID: 4 ( 0) System
PID: 136 (1960) C:\WINDOWS\Explorer.EXE
PID: 428 ( 4) \SystemRoot\System32\smss.exe
PID: 476 ( 428) csrss.exe
PID: 500 ( 428) \??\C:\WINDOWS\system32\winlogon.exe
PID: 544 ( 500) C:\WINDOWS\system32\services.exe
PID: 556 ( 500) C:\WINDOWS\system32\lsass.exe
PID: 712 ( 544) C:\WINDOWS\system32\svchost.exe
PID: 764 ( 544) C:\WINDOWS\System32\svchost.exe
PID: 928 ( 544) svchost.exe
PID: 964 ( 544) svchost.exe
PID: 1076 ( 544) C:\WINDOWS\system32\spoolsv.exe
PID: 1192 ( 544) C:\PROGRA~1\F-SECU~1\backweb\4476822\Program\SERVIC~1.EXE
PID: 1216 ( 544) C:\Program Files\F-Secure Internet Security\Anti-Virus\fsgk32st.exe
PID: 1236 ( 544) C:\Program Files\F-Secure Internet Security\backweb\4476822\program\fsbwsys.exe
PID: 1248 (1216) C:\Program Files\F-Secure Internet Security\Anti-Virus\FSGK32.EXE
PID: 1296 (1248) C:\Program Files\F-Secure Internet Security\Anti-Virus\fssm32.exe
PID: 1384 ( 544) C:\Program Files\F-Secure Internet Security\DFW\Program\fsdfwd.exe
PID: 1396 ( 544) C:\WINDOWS\System32\svchost.exe
PID: 1564 ( 544) C:\Program Files\F-Secure Internet Security\Common\FSMA32.EXE
PID: 1616 (1192) C:\Program Files\F-Secure Internet Security\backweb\4476822\Program\BackWeb-4476822.exe
PID: 1624 (1564) C:\Program Files\F-Secure Internet Security\Common\FSMB32.EXE
PID: 1720 (1564) C:\Program Files\F-Secure Internet Security\Common\FCH32.EXE
PID: 1736 ( 136) C:\Program Files\Spybot - Search & Destroy\SpybotSD.exe
PID: 1832 (1564) C:\Program Files\F-Secure Internet Security\Common\FAMEH32.EXE
PID: 1840 (1564) C:\Program Files\F-Secure Internet Security\Anti-Virus\fsav32.exe
PID: 2680 (1736) C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
Spybot - Search && Destroy process list report, 29.9.2004 17:57:00
--- Browser start & search pages list ---
Spybot - Search && Destroy browser pages report, 29.9.2004 17:57:00
HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\Local Page
C:\WINDOWS\System32\blank.htm
HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\Search Page
http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\Start Page
http://www.suomi24.fi/
HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\HomeOldSP
about:blank
HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Search\SearchAssistant
http://ie.search.msn.com/{SUB_RFC1766}/srchasst/srchasst.htm
HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main\Local Page
%SystemRoot%\system32\blank.htm
HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main\Search Page
http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main\Start Page
http://www.msn.com/
HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main\Default_Page_URL
http://www.mtv3.fi/
HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main\Default_Search_URL
http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Search\SearchAssistant
http://ie.search.msn.com/{SUB_RFC1766}/srchasst/srchasst.htm
HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Search\CustomizeSearch
http://ie.search.msn.com/{SUB_RFC1766}/srchasst/srchcust.htm
--- Winsock Layered Service Provider list ---
Protocol 0: MSAFD Tcpip [TCP/IP]
GUID: {E70F1AA0-AB8B-11CF-8CA3-00805F48A192}
Filename: %SystemRoot%\system32\mswsock.dll
Description: Microsoft Windows NT/2k/XP IP protocol
DB filename: %SystemRoot%\system32\mswsock.dll
DB protocol: MSAFD Tcpip [*]
Protocol 1: MSAFD Tcpip [UDP/IP]
GUID: {E70F1AA0-AB8B-11CF-8CA3-00805F48A192}
Filename: %SystemRoot%\system32\mswsock.dll
Description: Microsoft Windows NT/2k/XP IP protocol
DB filename: %SystemRoot%\system32\mswsock.dll
DB protocol: MSAFD Tcpip [*]
Protocol 2: MSAFD Tcpip [RAW/IP]
GUID: {E70F1AA0-AB8B-11CF-8CA3-00805F48A192}
Filename: %SystemRoot%\system32\mswsock.dll
Description: Microsoft Windows NT/2k/XP IP protocol
DB filename: %SystemRoot%\system32\mswsock.dll
DB protocol: MSAFD Tcpip [*]
Protocol 3: RSVP UDP Service Provider
GUID: {9D60A9E0-337A-11D0-BD88-0000C082E69A}
Filename: %SystemRoot%\system32\rsvpsp.dll
Description: Microsoft Windows NT/2k/XP RVSP
DB filename: %SystemRoot%\system32\rsvpsp.dll
DB protocol: RSVP * Service Provider
Protocol 4: RSVP TCP Service Provider
GUID: {9D60A9E0-337A-11D0-BD88-0000C082E69A}
Filename: %SystemRoot%\system32\rsvpsp.dll
Description: Microsoft Windows NT/2k/XP RVSP
DB filename: %SystemRoot%\system32\rsvpsp.dll
DB protocol: RSVP * Service Provider
Protocol 5: MSAFD NetBIOS [\Device\NetBT_Tcpip_{804F882B-8B29-4B46-8A83-8F72D8F9C54E}] SEQPACKET 5
GUID: {8D5F1830-C273-11CF-95C8-00805F48A192}
Filename: %SystemRoot%\system32\mswsock.dll
Description: Microsoft Windows NT/2k/XP NetBios protocol
DB filename: %SystemRoot%\system32\mswsock.dll
DB protocol: MSAFD NetBIOS *
Protocol 6: MSAFD NetBIOS [\Device\NetBT_Tcpip_{804F882B-8B29-4B46-8A83-8F72D8F9C54E}] DATAGRAM 5
GUID: {8D5F1830-C273-11CF-95C8-00805F48A192}
Filename: %SystemRoot%\system32\mswsock.dll
Description: Microsoft Windows NT/2k/XP NetBios protocol
DB filename: %SystemRoot%\system32\mswsock.dll
DB protocol: MSAFD NetBIOS *
Protocol 7: MSAFD NetBIOS [\Device\NetBT_Tcpip_{541BEC49-23CA-4069-89D0-95A17AA9599E}] SEQPACKET 0
GUID: {8D5F1830-C273-11CF-95C8-00805F48A192}
Filename: %SystemRoot%\system32\mswsock.dll
Description: Microsoft Windows NT/2k/XP NetBios protocol
DB filename: %SystemRoot%\system32\mswsock.dll
DB protocol: MSAFD NetBIOS *
Protocol 8: MSAFD NetBIOS [\Device\NetBT_Tcpip_{541BEC49-23CA-4069-89D0-95A17AA9599E}] DATAGRAM 0
GUID: {8D5F1830-C273-11CF-95C8-00805F48A192}
Filename: %SystemRoot%\system32\mswsock.dll
Description: Microsoft Windows NT/2k/XP NetBios protocol
DB filename: %SystemRoot%\system32\mswsock.dll
DB protocol: MSAFD NetBIOS *
Protocol 9: MSAFD NetBIOS [\Device\NetBT_Tcpip_{CCF35369-5C9E-49E3-97FD-B2E8A7534D50}] SEQPACKET 1
GUID: {8D5F1830-C273-11CF-95C8-00805F48A192}
Filename: %SystemRoot%\system32\mswsock.dll
Description: Microsoft Windows NT/2k/XP NetBios protocol
DB filename: %SystemRoot%\system32\mswsock.dll
DB protocol: MSAFD NetBIOS *
Protocol 10: MSAFD NetBIOS [\Device\NetBT_Tcpip_{CCF35369-5C9E-49E3-97FD-B2E8A7534D50}] DATAGRAM 1
GUID: {8D5F1830-C273-11CF-95C8-00805F48A192}
Filename: %SystemRoot%\system32\mswsock.dll
Description: Microsoft Windows NT/2k/XP NetBios protocol
DB filename: %SystemRoot%\system32\mswsock.dll
DB protocol: MSAFD NetBIOS *
Protocol 11: MSAFD NetBIOS [\Device\NetBT_Tcpip_{B23D0388-3703-4508-9A3B-F217F012AEA6}] SEQPACKET 2
GUID: {8D5F1830-C273-11CF-95C8-00805F48A192}
Filename: %SystemRoot%\system32\mswsock.dll
Description: Microsoft Windows NT/2k/XP NetBios protocol
DB filename: %SystemRoot%\system32\mswsock.dll
DB protocol: MSAFD NetBIOS *
Protocol 12: MSAFD NetBIOS [\Device\NetBT_Tcpip_{B23D0388-3703-4508-9A3B-F217F012AEA6}] DATAGRAM 2
GUID: {8D5F1830-C273-11CF-95C8-00805F48A192}
Filename: %SystemRoot%\system32\mswsock.dll
Description: Microsoft Windows NT/2k/XP NetBios protocol
DB filename: %SystemRoot%\system32\mswsock.dll
DB protocol: MSAFD NetBIOS *
Protocol 13: MSAFD NetBIOS [\Device\NetBT_Tcpip_{38B4F820-ED24-4E0E-9F65-0790FC30B4A3}] SEQPACKET 3
GUID: {8D5F1830-C273-11CF-95C8-00805F48A192}
Filename: %SystemRoot%\system32\mswsock.dll
Description: Microsoft Windows NT/2k/XP NetBios protocol
DB filename: %SystemRoot%\system32\mswsock.dll
DB protocol: MSAFD NetBIOS *
Protocol 14: MSAFD NetBIOS [\Device\NetBT_Tcpip_{38B4F820-ED24-4E0E-9F65-0790FC30B4A3}] DATAGRAM 3
GUID: {8D5F1830-C273-11CF-95C8-00805F48A192}
Filename: %SystemRoot%\system32\mswsock.dll
Description: Microsoft Windows NT/2k/XP NetBios protocol
DB filename: %SystemRoot%\system32\mswsock.dll
DB protocol: MSAFD NetBIOS *
Protocol 15: MSAFD NetBIOS [\Device\NetBT_Tcpip_{7AA745A7-6A7E-4DF0-90EE-9364D4958E3D}] SEQPACKET 4
GUID: {8D5F1830-C273-11CF-95C8-00805F48A192}
Filename: %SystemRoot%\system32\mswsock.dll
Description: Microsoft Windows NT/2k/XP NetBios protocol
DB filename: %SystemRoot%\system32\mswsock.dll
DB protocol: MSAFD NetBIOS *
Protocol 16: MSAFD NetBIOS [\Device\NetBT_Tcpip_{7AA745A7-6A7E-4DF0-90EE-9364D4958E3D}] DATAGRAM 4
GUID: {8D5F1830-C273-11CF-95C8-00805F48A192}
Filename: %SystemRoot%\system32\mswsock.dll
Description: Microsoft Windows NT/2k/XP NetBios protocol
DB filename: %SystemRoot%\system32\mswsock.dll
DB protocol: MSAFD NetBIOS *
Namespace Provider 0: TCP/IP
GUID: {22059D40-7E9E-11CF-AE5A-00AA00A7112B}
Filename: %SystemRoot%\System32\mswsock.dll
Description: Microsoft Windows NT/2k/XP TCP/IP name space provider
DB filename: %SystemRoot%\system32\mswsock.dll
DB protocol: TCP/IP
Namespace Provider 1: NTDS
GUID: {3B2637EE-E580-11CF-A555-00C04FD8D4AC}
Filename: %SystemRoot%\System32\winrnr.dll
Description: Microsoft Windows NT/2k/XP name space provider
DB filename: %SystemRoot%\system32\winrnr.dll
DB protocol: NTDS
Namespace Provider 2: NLA-nimiavaruus (Network Location Awareness)
GUID: {6642243A-3BA8-4AA6-BAA5-2E0BD71FDD83}
Filename: %SystemRoot%\System32\mswsock.dll
Description: Microsoft Windows NT/2k/XP name space provider
DB filename: %SystemRoot%\system32\mswsock.dll
DB protocol: NLA-Namespace
voisko joku kaikki tietävä katsoa tän ja vastata mitä tarttis tehdä näille?
itse eikä kaveri tiedä näistä kun ei suostuneet poistuun.
Vastaukset 3
Vanhimmat
Onnittelut!: Järjestelmästäsi ei löytynyt uhkaavia kohteita. ()
Siinä se.
Ja eipä tuossa (mailin mittaisessa) lokissa
pikasilmäyksellä mitään ihmeitä ole.
SP2:n kanssa voi kyllä tulla ihmeet ja kummat,
mutta se on toinen juttu...
onko väärin asetukset laitettu ,vai onko spybot.... huono ohjelma?kannattaako ottaa poi?
huoh.. ei ohjelmassa ole mitään vikaa ja tuskinpa asetuksiakaan olet kovin pahasti voinut mokata (paitsi jos olet käynyt ohitettavat sivulla ja rastinut sieltä kaikki)
ja logiin..
koneestasi ei löytynyt spywaretta. kaikki on siis loistavasti.
mitä se sitten löysi?
se löysi muutaman turhan tiedoston. pari keksiä. erinäisin windowsin seuranta tiedostoja. nämä tiedostot ovat vakio kamaa jokaisessa winkussa.
spybot tarjoaa sinulle vain joka ajossa tilaisuutta halutessasi tyhjätä moiset kohdat jos haluat sen tehdä.
eli: punaiset rivit ovat spywarea. huolestu niistä
vihreät rivit ovat muuta sälää mitä koneisiin aina kertyy mitä ei ole pakko poistaa ja mikä ei ole vaarallista.