logi (poistettavaa)

Logfile of HijackThis v1.99.1
Scan saved at 14:06:45, on 25.6.2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\PROGRA~1\MOUSEW~1\SYSTEM\EM_EXEC.EXE
C:\apps\ABoard\ABoard.exe
C:\apps\ABoard\AOSD.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\Virtual CD v4 SDK\system\vcsplay.exe
C:\Program Files\Common Files\Microsoft Shared\Works Shared\WkUFind.exe
C:\documents and settings\matti simi\local settings\temp\gain_trickler_3202a.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\D-Tools\daemon.exe
C:\Program Files\AVPersonal\AVGNT.EXE
C:\Program Files\MSN Apps\Updater\01.02.3000.1001\fi\msnappau.exe
C:\Program Files\MessengerPlus! 3\MsgPlus.exe
C:\PROGRA~1\COMMON~1\PCSuite\DATALA~1\DATALA~1.EXE
C:\PROGRA~1\Nokia\NOKIAP~1\TRAYAP~1.EXE
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\WINDOWS\system32\ctfmon.exe
G:\half life 2\Steam.exe
C:\Program Files\SEC\MagicTune 2.5\GammaTray.exe
C:\PROGRA~1\COMMON~1\PCSuite\Services\SERVIC~1.EXE
C:\Program Files\AVPersonal\AVWUPSRV.EXE
C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
C:\WINDOWS\system32\slserv.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Virtual CD v4 SDK\system\vcssecs.exe
C:\WINDOWS\system32\wscntfy.exe
C:\Program Files\SpeedFan\speedfan.exe
G:\ATITool\ATITool.exe
C:\Program Files\WhenUSearch\Search.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\hijackthis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.usvylemlzelrxyde.net/CLVFei1kHZPT1v0Y6ErvhQf5JZvHGckDtrWLuFd0mFRuM91RLqGOPF_IlGVaXhfA.html
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = file://C:\APPS\IE\offline\fin.htm
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Packard Bell
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Linkit
O2 - BHO: sPeerObj Class - {00000026-8735-428D-B81F-DD098223B25F} - C:\WINDOWS\speer.dll
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\apps\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: ST - {9394EDE7-C8B5-483E-8773-474BF36AF6E4} - C:\Program Files\MSN Apps\ST\01.03.0000.1005\en-xu\stmain.dll
O2 - BHO: (no name) - {A55A5CC8-180B-7A93-CED6-7F8202BD269F} - C:\DOCUME~1\MATTIS~1\APPLIC~1\Pokeone\UP TONS.exe
O2 - BHO: WhenUSearch Helper - {BA2325ED-F9EB-4830-8FCE-0BC35B16969B} - C:\Program Files\WhenUSearch\search.dll
O2 - BHO: MSNToolBandBHO - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Apps\MSN Toolbar\01.02.4000.1001\fi\msntb.dll
O3 - Toolbar: MSN - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Apps\MSN Toolbar\01.02.4000.1001\fi\msntb.dll
O4 - HKLM\..\Run: [EM_EXEC] C:\PROGRA~1\MOUSEW~1\SYSTEM\EM_EXEC.EXE
O4 - HKLM\..\Run: [ACTIVBOARD] c:\apps\ABoard\ABoard.exe
O4 - HKLM\..\Run: [CleanEasyImg] c:\apps\easydvd\cleanall.exe
O4 - HKLM\..\Run: [windows auto update] msblast.exe
O4 - HKLM\..\Run: [Microsoft Inet Xp..] teekids.exe
O4 - HKLM\..\Run: [TimeSink Ad Client] "C:\Program Files\TimeSink\AdGateway\TSAdBot.exe"
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [VCSPlayer] "C:\Program Files\Virtual CD v4 SDK\system\vcsplay.exe"
O4 - HKLM\..\Run: [Microsoft Works Update Detection] C:\Program Files\Common Files\Microsoft Shared\Works Shared\WkUFind.exe
O4 - HKLM\..\Run: [Trickler] "c:\documents and settings\matti simi\local settings\temp\gain_trickler_3202a.exe"
O4 - HKLM\..\Run: [avserve2.exe] C:\WINDOWS\avserve2.exe
O4 - HKLM\..\Run: [Microsoft Config 32bit] mscnfg32.exe
O4 - HKLM\..\Run: [Microsoft Restore] scrgrd.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [DAEMON Tools-1033] "C:\Program Files\D-Tools\daemon.exe" -lang 1033
O4 - HKLM\..\Run: [AVGCtrl] "C:\Program Files\AVPersonal\AVGNT.EXE" /min
O4 - HKLM\..\Run: [Microsoft Update] wuamgrd.exe
O4 - HKLM\..\Run: [msnappau] "C:\Program Files\MSN Apps\Updater\01.02.3000.1001\fi\msnappau.exe"
O4 - HKLM\..\Run: [MessengerPlus3] "C:\Program Files\MessengerPlus! 3\MsgPlus.exe"
O4 - HKLM\..\Run: [DataLayer] C:\PROGRA~1\COMMON~1\PCSuite\DATALA~1\DATALA~1.EXE
O4 - HKLM\..\Run: [PCSuiteTrayApplication] C:\PROGRA~1\Nokia\NOKIAP~1\TRAYAP~1.EXE
O4 - HKLM\..\Run: [beep ball exit cast] C:\Documents and Settings\All Users\Application Data\Each Safe Beep Ball\HolePing.exe
O4 - HKLM\..\Run: [RivaTunerStartupDaemon] "G:\RivaTuner v2.0 RC 15.4\RivaTuner.exe" /S
O4 - HKLM\..\RunServices: [363AE561] C:\WINDOWS\System32\bmuhthutc.exe
O4 - HKLM\..\RunServices: [Microsoft Config 32bit] mscnfg32.exe
O4 - HKLM\..\RunServices: [Microsoft Restore] scrgrd.exe
O4 - HKLM\..\RunServices: [Microsoft Update] wuamgrd.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [Update Service] C:\PROGRA~1\COMMON~1\TEKNUM~1\update.exe /startup
O4 - HKCU\..\Run: [Microsoft Config 32bit] mscnfg32.exe
O4 - HKCU\..\Run: [Microsoft Restore] scrgrd.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [Microsoft Update] wuamgrd.exe
O4 - HKCU\..\Run: [Steam] G:\half life 2\Steam.exe -silent
O4 - HKCU\..\Run: [Skype] "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized
O4 - Global Startup: Color Calibration.lnk = ?
O8 - Extra context menu item: Vie Microsoft E&xceliin - res://C:\PROGRA~1\MICROS~3\Office10\EXCEL.EXE/3000
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O12 - Plugin for .fpx: C:\\Program Files\\Internet Explorer\\PLUGINS\\NPRVRT32.dll
O12 - Plugin for .ivr: C:\\Program Files\\Internet Explorer\\PLUGINS\\NPRVRT32.dll
O14 - IERESET.INF: START_PAGE_URL=file://C:\APPS\IE\offline\fin.htm
O16 - DPF: {14B87622-7E19-4EA8-93B3-97215F77A6BC} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab31267.cab
O16 - DPF: {1D6711C8-7154-40BB-8380-3DEA45B69CBF} (Web P2P Installer) -
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://spaces.msn.com//PhotoUpload/MsnPUpld.cab
O16 - DPF: {54B52E52-8000-4413-BD67-FC7FE24B59F2} (EARTPatchX Class) - http://files.ea.com/downloads/rtpatch/v2/EARTPX.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://v5.windowsupdate.microsoft.com/v5consumer/V5Controls/en/x86/client/wuweb_site.cab?1097236922265
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/MsnMessengerSetupDownloader.cab
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (ZoneIntro Class) - http://messenger.zone.msn.com/binary/ZIntro.cab32846.cab
O16 - DPF: {BD393C14-72AD-4790-A095-76522973D6B8} (CBreakshotControl Class) - http://messenger.zone.msn.com/binary/Bankshot.cab31267.cab
O23 - Service: AntiVir Service (AntiVirService) - H BEDV Datentechnik GmbH - C:\Program Files\AVPersonal\AVGUARD.EXE
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: AntiVir Update (AVWUpSrv) - H BEDV Datentechnik GmbH, Germany - C:\Program Files\AVPersonal\AVWUPSRV.EXE
O23 - Service: Network Client (nwclntmon) - Unknown owner - C:\WINDOWS\system32\netclnt.exe (file missing)
O23 - Service: SmartLinkService (SLService) - - C:\WINDOWS\SYSTEM32\slserv.exe
O23 - Service: Virtual CD v4 Security service (SDK - Version) (VCSSecS) - H H Software GmbH - C:\Program Files\Virtual CD v4 SDK\system\vcssecs.exe

apua tarvitaan kirjoitti:

Logfile of HijackThis v1.99.1
Scan saved at 14:06:45, on 25.6.2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\PROGRA~1\MOUSEW~1\SYSTEM\EM_EXEC.EXE
C:\apps\ABoard\ABoard.exe
C:\apps\ABoard\AOSD.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\Virtual CD v4 SDK\system\vcsplay.exe
C:\Program Files\Common Files\Microsoft Shared\Works Shared\WkUFind.exe
C:\documents and settings\matti simi\local settings\temp\gain_trickler_3202a.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\D-Tools\daemon.exe
C:\Program Files\AVPersonal\AVGNT.EXE
C:\Program Files\MSN Apps\Updater\01.02.3000.1001\fi\msnappau.exe
C:\Program Files\MessengerPlus! 3\MsgPlus.exe
C:\PROGRA~1\COMMON~1\PCSuite\DATALA~1\DATALA~1.EXE
C:\PROGRA~1\Nokia\NOKIAP~1\TRAYAP~1.EXE
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\WINDOWS\system32\ctfmon.exe
G:\half life 2\Steam.exe
C:\Program Files\SEC\MagicTune 2.5\GammaTray.exe
C:\PROGRA~1\COMMON~1\PCSuite\Services\SERVIC~1.EXE
C:\Program Files\AVPersonal\AVWUPSRV.EXE
C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
C:\WINDOWS\system32\slserv.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Virtual CD v4 SDK\system\vcssecs.exe
C:\WINDOWS\system32\wscntfy.exe
C:\Program Files\SpeedFan\speedfan.exe
G:\ATITool\ATITool.exe
C:\Program Files\WhenUSearch\Search.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\hijackthis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.usvylemlzelrxyde.net/CLVFei1kHZPT1v0Y6ErvhQf5JZvHGckDtrWLuFd0mFRuM91RLqGOPF_IlGVaXhfA.html
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = file://C:\APPS\IE\offline\fin.htm
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Packard Bell
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Linkit
O2 - BHO: sPeerObj Class - {00000026-8735-428D-B81F-DD098223B25F} - C:\WINDOWS\speer.dll
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\apps\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: ST - {9394EDE7-C8B5-483E-8773-474BF36AF6E4} - C:\Program Files\MSN Apps\ST\01.03.0000.1005\en-xu\stmain.dll
O2 - BHO: (no name) - {A55A5CC8-180B-7A93-CED6-7F8202BD269F} - C:\DOCUME~1\MATTIS~1\APPLIC~1\Pokeone\UP TONS.exe
O2 - BHO: WhenUSearch Helper - {BA2325ED-F9EB-4830-8FCE-0BC35B16969B} - C:\Program Files\WhenUSearch\search.dll
O2 - BHO: MSNToolBandBHO - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Apps\MSN Toolbar\01.02.4000.1001\fi\msntb.dll
O3 - Toolbar: MSN - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Apps\MSN Toolbar\01.02.4000.1001\fi\msntb.dll
O4 - HKLM\..\Run: [EM_EXEC] C:\PROGRA~1\MOUSEW~1\SYSTEM\EM_EXEC.EXE
O4 - HKLM\..\Run: [ACTIVBOARD] c:\apps\ABoard\ABoard.exe
O4 - HKLM\..\Run: [CleanEasyImg] c:\apps\easydvd\cleanall.exe
O4 - HKLM\..\Run: [windows auto update] msblast.exe
O4 - HKLM\..\Run: [Microsoft Inet Xp..] teekids.exe
O4 - HKLM\..\Run: [TimeSink Ad Client] "C:\Program Files\TimeSink\AdGateway\TSAdBot.exe"
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [VCSPlayer] "C:\Program Files\Virtual CD v4 SDK\system\vcsplay.exe"
O4 - HKLM\..\Run: [Microsoft Works Update Detection] C:\Program Files\Common Files\Microsoft Shared\Works Shared\WkUFind.exe
O4 - HKLM\..\Run: [Trickler] "c:\documents and settings\matti simi\local settings\temp\gain_trickler_3202a.exe"
O4 - HKLM\..\Run: [avserve2.exe] C:\WINDOWS\avserve2.exe
O4 - HKLM\..\Run: [Microsoft Config 32bit] mscnfg32.exe
O4 - HKLM\..\Run: [Microsoft Restore] scrgrd.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [DAEMON Tools-1033] "C:\Program Files\D-Tools\daemon.exe" -lang 1033
O4 - HKLM\..\Run: [AVGCtrl] "C:\Program Files\AVPersonal\AVGNT.EXE" /min
O4 - HKLM\..\Run: [Microsoft Update] wuamgrd.exe
O4 - HKLM\..\Run: [msnappau] "C:\Program Files\MSN Apps\Updater\01.02.3000.1001\fi\msnappau.exe"
O4 - HKLM\..\Run: [MessengerPlus3] "C:\Program Files\MessengerPlus! 3\MsgPlus.exe"
O4 - HKLM\..\Run: [DataLayer] C:\PROGRA~1\COMMON~1\PCSuite\DATALA~1\DATALA~1.EXE
O4 - HKLM\..\Run: [PCSuiteTrayApplication] C:\PROGRA~1\Nokia\NOKIAP~1\TRAYAP~1.EXE
O4 - HKLM\..\Run: [beep ball exit cast] C:\Documents and Settings\All Users\Application Data\Each Safe Beep Ball\HolePing.exe
O4 - HKLM\..\Run: [RivaTunerStartupDaemon] "G:\RivaTuner v2.0 RC 15.4\RivaTuner.exe" /S
O4 - HKLM\..\RunServices: [363AE561] C:\WINDOWS\System32\bmuhthutc.exe
O4 - HKLM\..\RunServices: [Microsoft Config 32bit] mscnfg32.exe
O4 - HKLM\..\RunServices: [Microsoft Restore] scrgrd.exe
O4 - HKLM\..\RunServices: [Microsoft Update] wuamgrd.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [Update Service] C:\PROGRA~1\COMMON~1\TEKNUM~1\update.exe /startup
O4 - HKCU\..\Run: [Microsoft Config 32bit] mscnfg32.exe
O4 - HKCU\..\Run: [Microsoft Restore] scrgrd.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [Microsoft Update] wuamgrd.exe
O4 - HKCU\..\Run: [Steam] G:\half life 2\Steam.exe -silent
O4 - HKCU\..\Run: [Skype] "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized
O4 - Global Startup: Color Calibration.lnk = ?
O8 - Extra context menu item: Vie Microsoft E&xceliin - res://C:\PROGRA~1\MICROS~3\Office10\EXCEL.EXE/3000
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O12 - Plugin for .fpx: C:\\Program Files\\Internet Explorer\\PLUGINS\\NPRVRT32.dll
O12 - Plugin for .ivr: C:\\Program Files\\Internet Explorer\\PLUGINS\\NPRVRT32.dll
O14 - IERESET.INF: START_PAGE_URL=file://C:\APPS\IE\offline\fin.htm
O16 - DPF: {14B87622-7E19-4EA8-93B3-97215F77A6BC} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab31267.cab
O16 - DPF: {1D6711C8-7154-40BB-8380-3DEA45B69CBF} (Web P2P Installer) -
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://spaces.msn.com//PhotoUpload/MsnPUpld.cab
O16 - DPF: {54B52E52-8000-4413-BD67-FC7FE24B59F2} (EARTPatchX Class) - http://files.ea.com/downloads/rtpatch/v2/EARTPX.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://v5.windowsupdate.microsoft.com/v5consumer/V5Controls/en/x86/client/wuweb_site.cab?1097236922265
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/MsnMessengerSetupDownloader.cab
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (ZoneIntro Class) - http://messenger.zone.msn.com/binary/ZIntro.cab32846.cab
O16 - DPF: {BD393C14-72AD-4790-A095-76522973D6B8} (CBreakshotControl Class) - http://messenger.zone.msn.com/binary/Bankshot.cab31267.cab
O23 - Service: AntiVir Service (AntiVirService) - H BEDV Datentechnik GmbH - C:\Program Files\AVPersonal\AVGUARD.EXE
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: AntiVir Update (AVWUpSrv) - H BEDV Datentechnik GmbH, Germany - C:\Program Files\AVPersonal\AVWUPSRV.EXE
O23 - Service: Network Client (nwclntmon) - Unknown owner - C:\WINDOWS\system32\netclnt.exe (file missing)
O23 - Service: SmartLinkService (SLService) - - C:\WINDOWS\SYSTEM32\slserv.exe
O23 - Service: Virtual CD v4 Security service (SDK - Version) (VCSSecS) - H H Software GmbH - C:\Program Files\Virtual CD v4 SDK\system\vcssecs.exe

Putsaa koneesi ensin Escanilla:
Ohjeet ja ohjelmalinkki

http://koti.mbnet.fi/pattaya1/escanmwav.htm
Tallenna alaikkunan löydökset.

Boottaa kone scannin jälkeen ja lähetä uusi HJT-logi ja tallentamasi Escan-logi

juggis kirjoitti:

Putsaa koneesi ensin Escanilla:
Ohjeet ja ohjelmalinkki

http://koti.mbnet.fi/pattaya1/escanmwav.htm
Tallenna alaikkunan löydökset.

Boottaa kone scannin jälkeen ja lähetä uusi HJT-logi ja tallentamasi Escan-logi

escanin tulos:

File C:\DOCUME~1\MATTIS~1\LOCALS~1\temp\GAIN_T~3.EXE tagged as not-a-virus:AdWare.Gator.3202. No Action Taken.
File C:\PROGRA~1\WHENUS~1\Search.exe tagged as not-a-virus:AdWare.SaveNow.as. No Action Taken.
File C:\WINDOWS\speer.dll tagged as not-a-virus:AdWare.BetterInternet. No Action Taken.
File C:\DOCUME~1\MATTIS~1\APPLIC~1\Pokeone\UPTONS~1.EXE infected by "Trojan-Downloader.Win32.Swizzor.bo" Virus. Action Taken: File to be deleted on reboot.
File C:\PROGRA~1\WHENUS~1\search.dll tagged as not-a-virus:AdWare.SaveNow.az. No Action Taken.
File c:\DOCUME~1\MATTIS~1\LOCALS~1\temp\GAIN_T~3.EXE tagged as not-a-virus:AdWare.Gator.3202. No Action Taken.
File C:\DOCUME~1\ALLUSE~1\APPLIC~1\EACHSA~1\HolePing.exe tagged as not-a-virus:AdWare.Lop.p. No Action Taken.
File C:\WINDOWS\DrUninst.exe tagged as not-a-virus:AdWare.BetterInternet. No Action Taken.
File C:\WINDOWS\RESTORE.INS tagged as not-a-virus:NetTool.Win32.PsKill. No Action Taken.
File C:\WINDOWS\speer.dll tagged as not-a-virus:AdWare.BetterInternet. No Action Taken.
File C:\WINDOWS\TSAd.dll tagged as not-a-virus:AdWare.TimeSink.c. No Action Taken.
File C:\WINDOWS\system32\4907_up.exe infected by "Net-Worm.Win32.Sasser.a" Virus. Action Taken: File Deleted.
File C:\WINDOWS\system32\cd_clint.dll tagged as not-a-virus:AdWare.Cydoor. No Action Taken.
File C:\WINDOWS\system32\TFTP3512 infected by "Backdoor.Win32.Rbot.15" Virus. Action Taken: File Renamed.
File C:\Documents and Settings\All Users\Application Data\Each Safe Beep Ball\ballfind.exe tagged as not-a-virus:AdWare.Lop.p. No Action Taken.
File C:\Documents and Settings\All Users\Application Data\Each Safe Beep Ball\HolePing.exe tagged as not-a-virus:AdWare.Lop.p. No Action Taken.
File C:\Documents and Settings\matti simi\Application Data\close meet surf\csnexcie.exe tagged as not-a-virus:AdWare.Lop.p. No Action Taken.
File C:\Documents and Settings\matti simi\Application Data\close meet surf\hope data hole 64.exe infected by "Trojan-Downloader.Win32.Swizzor.ca" Virus. Action Taken: File Deleted.
File C:\Documents and Settings\matti simi\Application Data\close meet surf\kpwixrbq.exe tagged as not-a-virus:AdWare.Lop.p. No Action Taken.
File C:\Documents and Settings\matti simi\Application Data\close meet surf\objdart32.exe infected by "Trojan-Downloader.Win32.Swizzor.cb" Virus. Action Taken: File Deleted.
File C:\Documents and Settings\matti simi\Application Data\Pokeone\UP TONS.exe infected by "Trojan-Downloader.Win32.Swizzor.bo" Virus. Action Taken: File to be deleted on reboot.
File C:\Documents and Settings\matti simi\Local Settings\Temp\ADMCache\adm16.tmp tagged as not-a-virus:AdWare.Altnet.b. No Action Taken.
File C:\Documents and Settings\matti simi\Local Settings\Temp\ADMCache\adm18.tmp tagged as not-a-virus:AdWare.Altnet.b. No Action Taken.
File C:\Documents and Settings\matti simi\Local Settings\Temp\ADMCache\adm1A.tmp tagged as not-a-virus:AdWare.Altnet.l. No Action Taken.
File C:\Documents and Settings\matti simi\Local Settings\Temp\ADMCache\adm1F.tmp tagged as not-a-virus:AdWare.BrilliantDigital.1007. No Action Taken.
File C:\Documents and Settings\matti simi\Local Settings\Temp\ADMCache\adm21.tmp tagged as not-a-virus:AdWare.Altnet.h. No Action Taken.
File C:\Documents and Settings\matti simi\Local Settings\Temp\cd_clint.dll tagged as not-a-virus:AdWare.Cydoor. No Action Taken.
File C:\Documents and Settings\matti simi\Local Settings\Temp\gain_trickler_3202.exe tagged as not-a-virus:AdWare.Gator.3202. No Action Taken.
File C:\Documents and Settings\matti simi\Local Settings\Temp\gain_trickler_3202a.exe tagged as not-a-virus:AdWare.Gator.3202. No Action Taken.
File C:\Documents and Settings\matti simi\Local Settings\Temp\THI2517.tmp\adrmsper.cab tagged as not-a-virus:AdWare.BetterInternet. No Action Taken.
File C:\Documents and Settings\matti simi\Local Settings\Temp\THI2517.tmp\DrUninst.exe tagged as not-a-virus:AdWare.BetterInternet. No Action Taken.
File C:\Documents and Settings\matti simi\Local Settings\Temp\THI7E3F.tmp\speer.cab tagged as not-a-virus:AdWare.BetterInternet. No Action Taken.
File C:\Documents and Settings\matti simi\Local Settings\Temp\THI7E3F.tmp\speer.dll tagged as not-a-virus:AdWare.BetterInternet. No Action Taken.
File C:\Documents and Settings\matti simi\Local Settings\Temp\__unin__.exe tagged as not-a-virus:AdWare.Altnet.b. No Action Taken.
File C:\Documents and Settings\matti simi\Omat tiedostot\TNT-Soldier.of.Fortune_No_CD_CRK.ZIP tagged as not-a-virus:FalseAlarm.DrWeb.Backdoor.Theef.111. No Action Taken.
File C:\Documents and Settings\matti simi\Omat tiedostot\unzipped\TNT-Soldier_of_Fortune_no_cd.exe tagged as not-a-virus:FalseAlarm.DrWeb.Backdoor.Theef.111. No Action Taken.
File C:\eGames\Galaxy_of_Games_Red\UNWISE.EXE tagged as not-a-virus:Tool.Win32.Reboot. No Action Taken.
File C:\eJay\Dance3\eJay\eJay\OLEAUT_I.EXE tagged as not-a-virus:Tool.Win32.Reboot. No Action Taken.
File C:\eJay\Dance3\eJay\eJay\oset.exe tagged as not-a-virus:Tool.Win32.Reboot. No Action Taken.
File C:\Kazaa\TopSearch.dll tagged as not-a-virus:AdWare.Altnet.c. No Action Taken.
File C:\pelit\aawsepersonal.exe tagged as not-a-virus:Tool.Win32.Reboot. No Action Taken.
File C:\pelit\N64EMULAATTORI\Utility\cpy_supraF.zip tagged as not-a-virus:CrackTool.Win32.AssasinPatch. No Action Taken.
File C:\pelit\spy.exe tagged as not-a-virus:AdWare.ToolBar.AlexaBar.b. No Action Taken.
File C:\pelit\WinISO.v5.3-LasH.EXE tagged as not-a-virus:Tool.Win32.Reboot. No Action Taken.
File C:\Program Files\Altnet\Download Manager\adm25.dll tagged as not-a-virus:AdWare.Altnet.a. No Action Taken.
File C:\Program Files\Altnet\Download Manager\adm4.dll tagged as not-a-virus:AdWare.Altnet.a. No Action Taken.
File C:\Program Files\Altnet\Download Manager\adm4005.exe tagged as not-a-virus:AdWare.Altnet.a. No Action Taken.
File C:\Program Files\Altnet\Download Manager\admdloader.dll tagged as not-a-virus:AdWare.BrilliantDigital.3039. No Action Taken.
File C:\Program Files\Altnet\Download Manager\admfdi.dll tagged as not-a-virus:AdWare.Altnet.j. No Action Taken.
File C:\Program Files\Altnet\Download Manager\admprog.dll tagged as not-a-virus:AdWare.Altnet.i. No Action Taken.
File C:\Program Files\Altnet\Download Manager\altnetuninstall.exe tagged as not-a-virus:AdWare.Altnet.b. No Action Taken.
File C:\Program Files\Altnet\Download Manager\asm.exe tagged as not-a-virus:AdWare.Altnet.l. No Action Taken.
File C:\Program Files\Altnet\Points Manager\Points Manager.exe tagged as not-a-virus:AdWare.Altnet.h. No Action Taken.
File C:\Program Files\Altnet\Points Manager\sysdetect.dll tagged as not-a-virus:AdWare.BrilliantDigital.1007. No Action Taken.
File C:\Program Files\AquaMark3\UNWISE.EXE tagged as not-a-virus:Tool.Win32.Reboot. No Action Taken.
File C:\Program Files\AVPersonal\INFECTED\A0068495.EXE.VIR infected by "Net-Worm.Win32.Sasser.a" Virus. Action Taken: File Deleted.
File C:\Program Files\AVPersonal\INFECTED\A0068498.EXE.VIR infected by "Net-Worm.Win32.Sasser.a" Virus. Action Taken: File Deleted.
File C:\Program Files\AVPersonal\INFECTED\A0068500.EXE.VIR infected by "Net-Worm.Win32.Sasser.a" Virus. Action Taken: File Deleted.
File C:\Program Files\AVPersonal\INFECTED\A0083575.EXE.VIR infected by "Net-Worm.Win32.Padobot.k" Virus. Action Taken: File Deleted.
File C:\Program Files\AVPersonal\INFECTED\bmuhthutc.VIR infected by "Trojan-Proxy.Win32.Bobax.c" Virus. Action Taken: File Deleted.
File C:\Program Files\AVPersonal\INFECTED\EHYLAY.EXE.VIR infected by "Net-Worm.Win32.Padobot.g" Virus. Action Taken: File Deleted.
File C:\Program Files\AVPersonal\INFECTED\lrbz32.VIR infected by "Backdoor.Win32.Agobot.gen" Virus. Action Taken: File Renamed.
File C:\Program Files\AVPersonal\INFECTED\LSAC.EXE.VIR infected by "Backdoor.Win32.Rbot.gen" Virus. Action Taken: File Renamed.
File C:\Program Files\AVPersonal\INFECTED\lvkmaa.VIR infected by "Net-Worm.Win32.Padobot.n" Virus. Action Taken: File Deleted.
File C:\Program Files\AVPersonal\INFECTED\mix ace city.VIR tagged as not-a-virus:AdWare.Lop.m. No Action Taken.
File C:\Program Files\AVPersonal\INFECTED\mscnfg32.VIR infected by "Backdoor.Win32.Rbot.g" Virus. Action Taken: File Renamed.
File C:\Program Files\AVPersonal\INFECTED\mscnfg32.VIR00 infected by "Backdoor.Win32.Rbot.g" Virus. Action Taken: File Renamed.
File C:\Program Files\AVPersonal\INFECTED\mscnfg32.VIR01 infected by "Backdoor.Win32.Rbot.g" Virus. Action Taken: File Renamed.
File C:\Program Files\AVPersonal\INFECTED\mscnfg32.VIR02 infected by "Backdoor.Win32.Rbot.g" Virus. Action Taken: File Renamed.
File C:\Program Files\AVPersonal\INFECTED\mscnfg32.VIR03 infected by "Backdoor.Win32.Rbot.g" Virus. Action Taken: File Renamed.
File C:\Program Files\AVPersonal\INFECTED\mscnfg32.VIR04 infected by "Backdoor.Win32.Rbot.g" Virus. Action Taken: File Renamed.
File C:\Program Files\AVPersonal\INFECTED\mscnfg32.VIR05 infected by "Backdoor.Win32.Rbot.g" Virus. Action Taken: File Renamed.
File C:\Program Files\AVPersonal\INFECTED\mscnfg32.VIR06 infected by "Backdoor.Win32.Rbot.g" Virus. Action Taken: File Renamed.
File C:\Program Files\AVPersonal\INFECTED\ncobjapi.VIR infected by "Trojan-Downloader.Win32.Small.ij" Virus. Action Taken: File Deleted.
File C:\Program Files\AVPersonal\INFECTED\SCRGRD.EXE.VIR infected by "Backdoor.Win32.Rbot.15" Virus. Action Taken: File Renamed.
File C:\Program Files\AVPersonal\INFECTED\wuamgrd.VIR infected by "Backdoor.Win32.Rbot.gen" Virus. Action Taken: File Renamed.
File C:\Program Files\AVPersonal\INFECTED\wuamgrd.VIR00 infected by "Backdoor.Win32.Rbot.gen" Virus. Action Taken: File Renamed.
File C:\Program Files\AVPersonal\INFECTED\wuamgrd.VIR01 infected by "Backdoor.Win32.Rbot.gen" Virus. Action Taken: File Renamed.
File C:\Program Files\AVPersonal\INFECTED\wuamgrd.VIR02 infected by "Backdoor.Win32.Rbot.gen" Virus. Action Taken: File Renamed.
File C:\Program Files\AVPersonal\INFECTED\wuamgrd.VIR03 infected by "Backdoor.Win32.Rbot.gen" Virus. Action Taken: File Renamed.
File C:\Program Files\AVPersonal\INFECTED\wuamgrd.VIR04 infected by "Backdoor.Win32.Rbot.gen" Virus. Action Taken: File Renamed.
File C:\Program Files\AVPersonal\INFECTED\wuamgrd.VIR05 infected by "Backdoor.Win32.Rbot.gen" Virus. Action Taken: File Renamed.
File C:\Program Files\AVPersonal\INFECTED\wuamgrd.VIR06 infected by "Backdoor.Win32.Rbot.gen" Virus. Action Taken: File Renamed.
File C:\Program Files\AVPersonal\INFECTED\wuamgrd.VIR07 infected by "Backdoor.Win32.Rbot.gen" Virus. Action Taken: File Renamed.
File C:\Program Files\AVPersonal\INFECTED\wuamgrd.VIR08 infected by "Backdoor.Win32.Rbot.gen" Virus. Action Taken: File Renamed.
File C:\Program Files\AVPersonal\INFECTED\wuamgrd.VIR09 infected by "Backdoor.Win32.Rbot.gen" Virus. Action Taken: File Renamed.
File C:\Program Files\AVPersonal\INFECTED\wuamgrd.VIR10 infected by "Backdoor.Win32.Rbot.gen" Virus. Action Taken: File Renamed.
File C:\Program Files\AVPersonal\INFECTED\wuamgrd.VIR11 infected by "Backdoor.Win32.Rbot.gen" Virus. Action Taken: File Renamed.
File C:\Program Files\AVPersonal\INFECTED\wuamgrd.VIR12 infected by "Backdoor.Win32.Rbot.gen" Virus. Action Taken: File Renamed.
File C:\Program Files\AVPersonal\INFECTED\wuamgrd.VIR13 infected by "Backdoor.Win32.Rbot.gen" Virus. Action Taken: File Renamed.
File C:\Program Files\AVPersonal\INFECTED\wuamgrd.VIR14 infected by "Backdoor.Win32.Rbot.gen" Virus. Action Taken: File Renamed.
File C:\Program Files\AVPersonal\INFECTED\wuamgrd.VIR15 infected by "Backdoor.Win32.Rbot.gen" Virus. Action Taken: File Renamed.
File C:\Program Files\AVPersonal\INFECTED\wuamgrd.VIR16 infected by "Backdoor.Win32.Rbot.gen" Virus. Action Taken: File Renamed.
File C:\Program Files\AVPersonal\INFECTED\wuamgrd.VIR17 infected by "Backdoor.Win32.Rbot.gen" Virus. Action Taken: File Renamed.
File C:\Program Files\AVPersonal\INFECTED\wuamgrd.VIR18 infected by "Backdoor.Win32.Rbot.gen" Virus. Action Taken: File Renamed.
File C:\Program Files\AVPersonal\INFECTED\wuamgrd.VIR19 infected by "Backdoor.Win32.Rbot.gen" Virus. Action Taken: File Renamed.
File C:\Program Files\AVPersonal\INFECTED\wuamgrd.VIR20 infected by "Backdoor.Win32.Rbot.gen" Virus. Action Taken: File Renamed.
File C:\Program Files\AVPersonal\INFECTED\wuamgrd.VIR21 infected by "Backdoor.Win32.Rbot.gen" Virus. Action Taken: File Renamed.
File C:\Program Files\AVPersonal\INFECTED\wuamgrd.VIR22 infected by "Backdoor.Win32.Rbot.gen" Virus. Action Taken: File Renamed.
File C:\Program Files\AVPersonal\INFECTED\wuamgrd.VIR23 infected by "Backdoor.Win32.Rbot.gen" Virus. Action Taken: File Renamed.
File C:\Program Files\AVPersonal\INFECTED\wuamgrd.VIR24 infected by "Backdoor.Win32.Rbot.gen" Virus. Action Taken: File Renamed.
File C:\Program Files\AVPersonal\INFECTED\wuamgrd.VIR25 infected by "Backdoor.Win32.Rbot.gen" Virus. Action Taken: File Renamed.
File C:\Program Files\AVPersonal\INFECTED\wuamgrd.VIR26 infected by "Backdoor.Win32.Rbot.gen" Virus. Action Taken: File Renamed.
File C:\Program Files\AVPersonal\INFECTED\wuamgrd.VIR27 infected by "Backdoor.Win32.Rbot.gen" Virus. Action Taken: File Renamed.
File C:\Program Files\AVPersonal\INFECTED\wuamgrd.VIR28 infected by "Backdoor.Win32.Rbot.gen" Virus. Action Taken: File Renamed.
File C:\Program Files\AVPersonal\INFECTED\wuamgrd.VIR29 infected by "Backdoor.Win32.Rbot.gen" Virus. Action Taken: File Renamed.
File C:\Program Files\AVPersonal\INFECTED\wuamgrd.VIR30 infected by "Backdoor.Win32.Rbot.gen" Virus. Action Taken: File Renamed.
File C:\Program Files\AVPersonal\INFECTED\wuamgrd.VIR31 infected by "Backdoor.Win32.Rbot.gen" Virus. Action Taken: File Renamed.
File C:\Program Files\AVPersonal\INFECTED\wuamgrd.VIR32 infected by "Backdoor.Win32.Rbot.gen" Virus. Action Taken: File Renamed.
File C:\Program Files\AVPersonal\INFECTED\wuamgrd.VIR33 infected by "Backdoor.Win32.Rbot.gen" Virus. Action Taken: File Renamed.
File C:\Program Files\AVPersonal\INFECTED\wuamgrd.VIR34 infected by "Backdoor.Win32.Rbot.gen" Virus. Action Taken: File Renamed.
File C:\Program Files\AVPersonal\INFECTED\wuamgrd.VIR35 infected by "Backdoor.Win32.Rbot.gen" Virus. Action Taken: File Renamed.
File C:\Program Files\AVPersonal\INFECTED\wuamgrd.VIR36 infected by "Backdoor.Win32.Rbot.gen" Virus. Action Taken: File Renamed.
File C:\Program Files\AVPersonal\INFECTED\XBOX EMULATOR.EXE.VIR infected by "P2P-Worm.Win32.SdDrop.e" Virus. Action Taken: File Deleted.
File C:\Program Files\AVPersonal\INFECTED\ygsuk.VIR infected by "Net-Worm.Win32.Padobot.k" Virus. Action Taken: File Deleted.
File C:\Program Files\C2Media\Setup.exe tagged as not-a-virus:AdWare.Lop. No Action Taken.
File C:\Program Files\Common Files\CMEII\CMEIIAPI.dll tagged as not-a-virus:AdWare.Gator.6041. No Action Taken.
File C:\Program Files\Common Files\CMEII\CMESys.exe tagged as not-a-virus:AdWare.Gator.6034. No Action Taken.
File C:\Program Files\Common Files\CMEII\GAppMgr.dll tagged as not-a-virus:AdWare.Gator.6041. No Action Taken.
File C:\Program Files\Common Files\CMEII\GController.dll tagged as not-a-virus:AdWare.Gator.6041. No Action Taken.
File C:\Program Files\Common Files\CMEII\GDwldEng.dll tagged as not-a-virus:AdWare.Gator.3124. No Action Taken.
File C:\Program Files\Common Files\CMEII\GIocl.dll tagged as not-a-virus:AdWare.Gator.6041. No Action Taken.
File C:\Program Files\Common Files\CMEII\GIoclClient.dll tagged as not-a-virus:AdWare.Gator.6041. No Action Taken.
File C:\Program Files\Common Files\CMEII\GMTProxy.dll tagged as not-a-virus:AdWare.Gator.6041. No Action Taken.
File C:\Program Files\Common Files\CMEII\GObjs.dll tagged as not-a-virus:AdWare.Gator.6041. No Action Taken.
File C:\Program Files\Common Files\CMEII\GStore.dll tagged as not-a-virus:AdWare.Gator.6041. No Action Taken.
File C:\Program Files\Common Files\CMEII\GStoreServer.dll tagged as not-a-virus:AdWare.Gator.6041. No Action Taken.
File C:\Program Files\Common Files\CMEII\Gtools.dll tagged as not-a-virus:AdWare.Gator.6041. No Action Taken.
File C:\Program Files\Common Files\GMT\EGGCEngine.dll tagged as not-a-virus:AdWare.Gator.6041. No Action Taken.
File C:\Program Files\Common Files\GMT\egIEEngine.dll tagged as not-a-virus:AdWare.Gator.6041. No Action Taken.
File C:\Program Files\Common Files\GMT\EGIEProcess.dll tagged as not-a-virus:AdWare.Gator.6041. No Action Taken.
File C:\Program Files\Common Files\GMT\EGNSEngine.dll tagged as not-a-virus:AdWare.Gator.5017. No Action Taken.
File C:\Program Files\Common Files\GMT\GatorRes.dll tagged as not-a-virus:AdWare.Gator.6041. No Action Taken.
File C:\Program Files\Common Files\GMT\GatorStubSetup.exe tagged as not-a-virus:AdWare.Gator.6034. No Action Taken.
File C:\Program Files\Common Files\GMT\GMT.exe tagged as not-a-virus:AdWare.Gator.6041. No Action Taken.
File C:\Program Files\Common Files\GMT\gtrawbm.fil tagged as not-a-virus:AdWare.Gator.a. No Action Taken.
File C:\Program Files\Common Files\GMT\GUninstaller.exe tagged as not-a-virus:AdWare.Gator.6041. No Action Taken.
File C:\Program Files\Common Files\UControl\UControl Scan and Remove\UNWISE.EXE tagged as not-a-virus:Tool.Win32.Reboot. No Action Taken.
File C:\Program Files\DC \Downloads\Flatout crack-serial-keygen.zip tagged as not-a-virus:Porn-Dialer.Win32.Intexdial. No Action Taken.
File C:\Program Files\DC \Downloads\Need For Speed Underground 2 Crack-Serial-Keygen.zip tagged as not-a-virus:Porn-Dialer.Win32.Intexdial. No Action Taken.
File C:\Program Files\Doom 3 Demo\UNWISE.EXE tagged as not-a-virus:Tool.Win32.Reboot. No Action Taken.
File C:\Program Files\eGames\3D Maze Man Special Edition\UNWISE.EXE tagged as not-a-virus:Tool.Win32.Reboot. No Action Taken.
File C:\Program Files\eGames\BUGS\UNWISE.EXE tagged as not-a-virus:Tool.Win32.Reboot. No Action Taken.
File C:\Program Files\eGames\Chomper 3D\UNWISE.EXE tagged as not-a-virus:Tool.Win32.Reboot. No Action Taken.
File C:\Program Files\eGames\Crazy Drake Special Edition\UNWISE.EXE tagged as not-a-virus:Tool.Win32.Reboot. No Action Taken.
File C:\Program Files\eGames\Demonstar Special Edition\UNWISE.EXE tagged as not-a-virus:Tool.Win32.Reboot. No Action Taken.
File C:\Program Files\eGames\Ludo Safari Special Edition\UNWISE.EXE tagged as not-a-virus:Tool.Win32.Reboot. No Action Taken.
File C:\Program Files\eGames\Mini Golf Master Special Edition\UNWISE.EXE tagged as not-a-virus:Tool.Win32.Reboot. No Action Taken.
File C:\Program Files\eGames\Moon Buggy\UNWISE.EXE tagged as not-a-virus:Tool.Win32.Reboot. No Action Taken.
File C:\Program Files\eGames\Moonshot\UNWISE.EXE tagged as not-a-virus:Tool.Win32.Reboot. No Action Taken.
File C:\Program Files\eGames\Nebulae Fighter SE\UNWISE.EXE tagged as not-a-virus:Tool.Win32.Reboot. No Action Taken.
File C:\Program Files\eGames\Playground Special Edition\UNWISE.EXE tagged as not-a-virus:Tool.Win32.Reboot. No Action Taken.
File C:\Program Files\eGames\Raptor Special Edition\UNWISE.EXE tagged as not-a-virus:Tool.Win32.Reboot. No Action Taken.
File C:\Program Files\eGames\Speedy Eggbert Special Edition\UNWISE.EXE tagged as not-a-virus:Tool.Win32.Reboot. No Action Taken.
File C:\Program Files\eGames\Star Miner Special Edition\UNWISE.EXE tagged as not-a-virus:Tool.Win32.Reboot. No Action Taken.
File C:\Program Files\eMule\Incoming\ (Crack) Flatout NOCD.zip tagged as not-a-virus:Porn-Dialer.Win32.Intexdial. No Action Taken.
File C:\Program Files\eMule\Incoming\(Crack) Flatout NOCD [p2p-11066].exe tagged as not-a-virus:Porn-Dialer.Win32.Intexdial. No Action Taken.
File C:\Program Files\GameSpy Arcade\UNWISE.EXE tagged as not-a-virus:Tool.Win32.Reboot. No Action Taken.
File C:\Program Files\Lavasoft\Ad-Aware SE Personal\UNWISE.EXE tagged as not-a-virus:Tool.Win32.Reboot. No Action Taken.
File C:\Program Files\MyWay\myBar\2.bin\MYBAR.DLL tagged as not-a-virus:AdWare.ToolBar.MyWay.m. No Action Taken.
File C:\Program Files\Save\Save.exe tagged as not-a-virus:AdWare.SaveNow.bc. No Action Taken.
File C:\Program Files\Save\SaveUninst.exe tagged as not-a-virus:AdWare.SaveNow.bc. No Action Taken.
File C:\Program Files\Soldier of Fortune II - Double Helix MP TEST\Uninstall\UNWISE.EXE tagged as not-a-virus:Tool.Win32.Reboot. No Action Taken.
File C:\Program Files\StreamCast\Morpheus\Downloads\Nintendo.N64.Emulator. .Utility.zip tagged as not-a-virus:CrackTool.Win32.AssasinPatch. No Action Taken.
File C:\Program Files\VectorWorks\InstDrv.EXE tagged as not-a-virus:Tool.Win32.Reboot. No Action Taken.
File C:\Program Files\WhenUSearch\search.dll tagged as not-a-virus:AdWare.SaveNow.az. No Action Taken.
File C:\Program Files\WhenUSearch\Search.exe tagged as not-a-virus:AdWare.SaveNow.as. No Action Taken.
File C:\Program Files\WhenUSearch\Uninst.exe tagged as not-a-virus:AdWare.SaveNow.az. No Action Taken.
File C:\Program Files\WhenUSearch\whse.exe tagged as not-a-virus:AdWare.SaveNow.bd. No Action Taken.
File C:\System Volume Information\_restore{66FCF0F1-26A6-4635-939D-AFC6B17B7CE3}\RP707\A0180401.exe infected by "Net-Worm.Win32.Sasser.a" Virus. Action Taken: File Deleted.
File C:\System Volume Information\_restore{66FCF0F1-26A6-4635-939D-AFC6B17B7CE3}\RP707\A0180402.exe infected by "Trojan-Downloader.Win32.Swizzor.ca" Virus. Action Taken: File Deleted.
File C:\System Volume Information\_restore{66FCF0F1-26A6-4635-939D-AFC6B17B7CE3}\RP707\A0180403.exe infected by "Trojan-Downloader.Win32.Swizzor.cb" Virus. Action Taken: File Deleted.
File C:\UNWISE.EXE tagged as not-a-virus:Tool.Win32.Reboot. No Action Taken.
File C:\WINDOWS\Downloaded Installations\AmericasArmy\SEEMEP~1.cab tagged as not-a-virus:Tool.Win32.Reboot. No Action Taken.
File C:\WINDOWS\DrUninst.exe tagged as not-a-virus:AdWare.BetterInternet. No Action Taken.
File C:\WINDOWS\RESTORE.INS tagged as not-a-virus:NetTool.Win32.PsKill. No Action Taken.
File C:\WINDOWS\speer.dll tagged as not-a-virus:AdWare.BetterInternet. No Action Taken.
File C:\WINDOWS\system\RESTORE.INS tagged as not-a-virus:NetTool.Win32.PsKill. No Action Taken.
File C:\WINDOWS\system32\cd_clint.dll tagged as not-a-virus:AdWare.Cydoor. No Action Taken.
File C:\WINDOWS\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\7MVGZWZP\212.181.230[1].gif infected by "Trojan-Proxy.Win32.Bobax.c" Virus. Action Taken: File Deleted.
File C:\WINDOWS\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\7MVGZWZP\217.234.106[1].gif infected by "Trojan-Proxy.Win32.Bobax.c" Virus. Action Taken: File Deleted.
File C:\WINDOWS\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\7MVGZWZP\4.226.147[1].gif infected by "Trojan-Proxy.Win32.Bobax.c" Virus. Action Taken: File Deleted.
File C:\WINDOWS\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\7MVGZWZP\61.203.167[1].gif infected by "Trojan-Proxy.Win32.Bobax.c" Virus. Action Taken: File Deleted.
File C:\WINDOWS\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\7MVGZWZP\83.31.129[1].gif infected by "Trojan-Proxy.Win32.Bobax.c" Virus. Action Taken: File Deleted.
File C:\WINDOWS\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\7MVGZWZP\leet[1].htm infected by "Trojan-Clicker.JS.Linker.j" Virus. Action Taken: File Deleted.
File C:\WINDOWS\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\8H0QT4N2\194.134.134[1].gif infected by "Trojan-Proxy.Win32.Bobax.c" Virus. Action Taken: File Deleted.
File C:\WINDOWS\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\8H0QT4N2\212.18.58[1].gif infected by "Trojan-Proxy.Win32.Bobax.c" Virus. Action Taken: File Deleted.
File C:\WINDOWS\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\8H0QT4N2\213.23.249[1].gif infected by "Trojan-Proxy.Win32.Bobax.c" Virus. Action Taken: File Deleted.
File C:\WINDOWS\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\8H0QT4N2\218.219.250[1].gif infected by "Trojan-Proxy.Win32.Bobax.c" Virus. Action Taken: File Deleted.
File C:\WINDOWS\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\8H0QT4N2\221.113.203[1].gif infected by "Trojan-Proxy.Win32.Bobax.c" Virus. Action Taken: File Deleted.
File C:\WINDOWS\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\8H0QT4N2\65.177.129[1].gif infected by "Trojan-Proxy.Win32.Bobax.c" Virus. Action Taken: File Deleted.
File C:\WINDOWS\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\8H0QT4N2\80.53.157[1].gif infected by "Trojan-Proxy.Win32.Bobax.c" Virus. Action Taken: File Deleted.
File C:\WINDOWS\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\8H0QT4N2\83.129.145[1].gif infected by "Trojan-Proxy.Win32.Bobax.c" Virus. Action Taken: File Deleted.
File C:\WINDOWS\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\8H0QT4N2\MediaTicketsInstaller[1].cab tagged as not-a-virus:AdWare.MediaTickets.b. No Action Taken.
File C:\WINDOWS\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\I1G9SFOZ\193.95.90[1].gif infected by "Trojan-Proxy.Win32.Bobax.c" Virus. Action Taken: File Deleted.
File C:\WINDOWS\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\I1G9SFOZ\200.46.99[1].gif infected by "Trojan-Proxy.Win32.Bobax.c" Virus. Action Taken: File Deleted.
File C:\WINDOWS\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\I1G9SFOZ\217.95.49[1].gif infected by "Trojan-Proxy.Win32.Bobax.c" Virus. Action Taken: File Deleted.
File C:\WINDOWS\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\I1G9SFOZ\24.166.82[1].gif infected by "Trojan-Proxy.Win32.Bobax.c" Virus. Action Taken: File Deleted.
File C:\WINDOWS\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\I1G9SFOZ\4.47.129[1].gif infected by "Trojan-Proxy.Win32.Bobax.c" Virus. Action Taken: File Deleted.
File C:\WINDOWS\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\I1G9SFOZ\62.143.38[1].gif infected by "Trojan-Proxy.Win32.Bobax.c" Virus. Action Taken: File Deleted.
File C:\WINDOWS\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\I1G9SFOZ\81.60.72[1].gif infected by "Trojan-Proxy.Win32.Bobax.c" Virus. Action Taken: File Deleted.
File C:\WINDOWS\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\I1G9SFOZ\leet[1].htm infected by "Trojan-Clicker.JS.Linker.j" Virus. Action Taken: File Deleted.
File C:\WINDOWS\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\JSBK5VT7\151.204.154[1].gif infected by "Trojan-Proxy.Win32.Bobax.c" Virus. Action Taken: File Deleted.
File C:\WINDOWS\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\JSBK5VT7\212.42.63[1].gif infected by "Trojan-Proxy.Win32.Bobax.c" Virus. Action Taken: File Deleted.
File C:\WINDOWS\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\JSBK5VT7\213.7.131[1].gif infected by "Trojan-Proxy.Win32.Bobax.c" Virus. Action Taken: File Deleted.
File C:\WINDOWS\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\JSBK5VT7\62.249.168[1].gif infected by "Trojan-Proxy.Win32.Bobax.c" Virus. Action Taken: File Deleted.
File C:\WINDOWS\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\JSBK5VT7\63.13.185[1].gif infected by "Trojan-Proxy.Win32.Bobax.c" Virus. Action Taken: File Deleted.
File C:\WINDOWS\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\JSBK5VT7\80.116.41[1].gif infected by "Trojan-Proxy.Win32.Bobax.c" Virus. Action Taken: File Deleted.
File C:\WINDOWS\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\JSBK5VT7\81.130.36[1].gif infected by "Trojan-Proxy.Win32.Bobax.c" Virus. Action Taken: File Deleted.
File C:\WINDOWS\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\JSBK5VT7\MediaTicketsInstaller[1].cab tagged as not-a-virus:AdWare.MediaTickets.b. No Action Taken.
File C:\WINDOWS\system32\Macromed\Shockwave 8\UNWISE.EXE tagged as not-a-virus:Tool.Win32.Reboot. No Action Taken.
File C:\WINDOWS\Temp\Altnet\adm25.dll tagged as not-a-virus:AdWare.Altnet.a. No Action Taken.
File C:\WINDOWS\Temp\Altnet\adm4.dll tagged as not-a-virus:AdWare.Altnet.a. No Action Taken.
File C:\WINDOWS\Temp\Altnet\admdloader.dll tagged as not-a-virus:AdWare.BrilliantDigital.3039. No Action Taken.
File C:\WINDOWS\Temp\Altnet\admfdi.dll tagged as not-a-virus:AdWare.Altnet.j. No Action Taken.
File C:\WINDOWS\Temp\Altnet\admprog.dll tagged as not-a-virus:AdWare.Altnet.i. No Action Taken.
File C:\WINDOWS\Temp\Altnet\dmfiles.cab tagged as not-a-virus:AdWare.Altnet.b. No Action Taken.
File C:\WINDOWS\Temp\Altnet\mysearch.cab tagged as not-a-virus:AdWare.ToolBar.MyWay.b. No Action Taken.
File C:\WINDOWS\Temp\Altnet\pmfiles.cab tagged as not-a-virus:AdWare.BrilliantDigital.1007. No Action Taken.
File C:\WINDOWS\Temp\Altnet\Setup.exe tagged as not-a-virus:AdWare.Altnet.b. No Action Taken.
File C:\WINDOWS\Temp\Brilliant\b3d3200package.cab tagged as not-a-virus:AdWare.BrilliantDigital.1007. No Action Taken.
File C:\WINDOWS\Temp\Brilliant\b3dsetup.exe tagged as not-a-virus:AdWare.BrilliantDigital.1100. No Action Taken.
File C:\WINDOWS\Temp\Brilliant\bdedownloader.dll tagged as not-a-virus:AdWare.BrilliantDigital.3039. No Action Taken.
File C:\WINDOWS\Temp\Brilliant\bdefdi.dll tagged as not-a-virus:AdWare.Altnet.k. No Action Taken.
File C:\WINDOWS\Temp\Brilliant\bdeinsta25.dll tagged as not-a-virus:AdWare.Altnet.a. No Action Taken.
File C:\WINDOWS\TSAd.dll tagged as not-a-virus:AdWare.TimeSink.c. No Action Taken.
File G:\half life 2\UNWISE.EXE tagged as not-a-virus:Tool.Win32.Reboot. No Action Taken.
File G:\Valve\Condition Zero\steaminstall.exe tagged as not-a-virus:Tool.Win32.Reboot. No Action Taken.
File G:\Valve\Condition Zero\UNWISE.EXE tagged as not-a-virus:Tool.Win32.Reboot. No Action Taken.


hjt:

ogfile of HijackThis v1.99.1
Scan saved at 22:42:23, on 25.6.2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\PROGRA~1\MOUSEW~1\SYSTEM\EM_EXEC.EXE
C:\apps\ABoard\ABoard.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\Virtual CD v4 SDK\system\vcsplay.exe
C:\apps\ABoard\AOSD.exe
C:\Program Files\Common Files\Microsoft Shared\Works Shared\WkUFind.exe
C:\documents and settings\matti simi\local settings\temp\gain_trickler_3202a.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\D-Tools\daemon.exe
C:\Program Files\AVPersonal\AVGNT.EXE
C:\Program Files\MSN Apps\Updater\01.02.3000.1001\fi\msnappau.exe
C:\Program Files\MessengerPlus! 3\MsgPlus.exe
C:\PROGRA~1\COMMON~1\PCSuite\DATALA~1\DATALA~1.EXE
C:\PROGRA~1\Nokia\NOKIAP~1\TRAYAP~1.EXE
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\WINDOWS\system32\ctfmon.exe
G:\half life 2\Steam.exe
C:\PROGRA~1\COMMON~1\PCSuite\Services\SERVIC~1.EXE
C:\Program Files\SEC\MagicTune 2.5\GammaTray.exe
C:\Program Files\Common Files\Teknum Systems\updsvc.exe
C:\Program Files\AVPersonal\AVWUPSRV.EXE
C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
C:\WINDOWS\system32\slserv.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Virtual CD v4 SDK\system\vcssecs.exe
C:\WINDOWS\system32\wscntfy.exe
C:\Program Files\WhenUSearch\Search.exe
C:\hijackthis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.usvylemlzelrxyde.net/CLVFei1kHZPT1v0Y6ErvhQf5JZvHGckDtrWLuFd0mFRuM91RLqGOPF_IlGVaXhfA.html
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = file://C:\APPS\IE\offline\fin.htm
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Packard Bell
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Linkit
O2 - BHO: sPeerObj Class - {00000026-8735-428D-B81F-DD098223B25F} - C:\WINDOWS\speer.dll
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\apps\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: ST - {9394EDE7-C8B5-483E-8773-474BF36AF6E4} - C:\Program Files\MSN Apps\ST\01.03.0000.1005\en-xu\stmain.dll
O2 - BHO: WhenUSearch Helper - {BA2325ED-F9EB-4830-8FCE-0BC35B16969B} - C:\Program Files\WhenUSearch\search.dll
O2 - BHO: MSNToolBandBHO - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Apps\MSN Toolbar\01.02.4000.1001\fi\msntb.dll
O3 - Toolbar: MSN - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Apps\MSN Toolbar\01.02.4000.1001\fi\msntb.dll
O4 - HKLM\..\Run: [EM_EXEC] C:\PROGRA~1\MOUSEW~1\SYSTEM\EM_EXEC.EXE
O4 - HKLM\..\Run: [ACTIVBOARD] c:\apps\ABoard\ABoard.exe
O4 - HKLM\..\Run: [windows auto update] msblast.exe
O4 - HKLM\..\Run: [TimeSink Ad Client] "C:\Program Files\TimeSink\AdGateway\TSAdBot.exe"
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [VCSPlayer] "C:\Program Files\Virtual CD v4 SDK\system\vcsplay.exe"
O4 - HKLM\..\Run: [Microsoft Works Update Detection] C:\Program Files\Common Files\Microsoft Shared\Works Shared\WkUFind.exe
O4 - HKLM\..\Run: [Trickler] "c:\documents and settings\matti simi\local settings\temp\gain_trickler_3202a.exe"
O4 - HKLM\..\Run: [Microsoft Config 32bit] mscnfg32.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [DAEMON Tools-1033] "C:\Program Files\D-Tools\daemon.exe" -lang 1033
O4 - HKLM\..\Run: [AVGCtrl] "C:\Program Files\AVPersonal\AVGNT.EXE" /min
O4 - HKLM\..\Run: [msnappau] "C:\Program Files\MSN Apps\Updater\01.02.3000.1001\fi\msnappau.exe"
O4 - HKLM\..\Run: [MessengerPlus3] "C:\Program Files\MessengerPlus! 3\MsgPlus.exe"
O4 - HKLM\..\Run: [DataLayer] C:\PROGRA~1\COMMON~1\PCSuite\DATALA~1\DATALA~1.EXE
O4 - HKLM\..\Run: [PCSuiteTrayApplication] C:\PROGRA~1\Nokia\NOKIAP~1\TRAYAP~1.EXE
O4 - HKLM\..\Run: [beep ball exit cast] C:\Documents and Settings\All Users\Application Data\Each Safe Beep Ball\HolePing.exe
O4 - HKLM\..\Run: [RivaTunerStartupDaemon] "G:\RivaTuner v2.0 RC 15.4\RivaTuner.exe" /S
O4 - HKLM\..\RunServices: [Microsoft Config 32bit] mscnfg32.exe
O4 - HKLM\..\RunServices: [Microsoft Update] wuamgrd.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [Update Service] C:\PROGRA~1\COMMON~1\TEKNUM~1\update.exe /startup
O4 - HKCU\..\Run: [Microsoft Restore] scrgrd.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [Steam] G:\half life 2\Steam.exe -silent
O4 - Global Startup: Color Calibration.lnk = ?
O8 - Extra context menu item: Vie Microsoft E&xceliin - res://C:\PROGRA~1\MICROS~3\Office10\EXCEL.EXE/3000
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O12 - Plugin for .fpx: C:\\Program Files\\Internet Explorer\\PLUGINS\\NPRVRT32.dll
O12 - Plugin for .ivr: C:\\Program Files\\Internet Explorer\\PLUGINS\\NPRVRT32.dll
O14 - IERESET.INF: START_PAGE_URL=file://C:\APPS\IE\offline\fin.htm
O16 - DPF: {14B87622-7E19-4EA8-93B3-97215F77A6BC} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab31267.cab
O16 - DPF: {1D6711C8-7154-40BB-8380-3DEA45B69CBF} (Web P2P Installer) -
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://spaces.msn.com//PhotoUpload/MsnPUpld.cab
O16 - DPF: {54B52E52-8000-4413-BD67-FC7FE24B59F2} (EARTPatchX Class) - http://files.ea.com/downloads/rtpatch/v2/EARTPX.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://v5.windowsupdate.microsoft.com/v5consumer/V5Controls/en/x86/client/wuweb_site.cab?1097236922265
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/MsnMessengerSetupDownloader.cab
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (ZoneIntro Class) - http://messenger.zone.msn.com/binary/ZIntro.cab32846.cab
O16 - DPF: {BD393C14-72AD-4790-A095-76522973D6B8} (CBreakshotControl Class) - http://messenger.zone.msn.com/binary/Bankshot.cab31267.cab
O23 - Service: AntiVir Service (AntiVirService) - H BEDV Datentechnik GmbH - C:\Program Files\AVPersonal\AVGUARD.EXE
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: AntiVir Update (AVWUpSrv) - H BEDV Datentechnik GmbH, Germany - C:\Program Files\AVPersonal\AVWUPSRV.EXE
O23 - Service: Network Client (nwclntmon) - Unknown owner - C:\WINDOWS\system32\netclnt.exe (file missing)
O23 - Service: SmartLinkService (SLService) - - C:\WINDOWS\SYSTEM32\slserv.exe
O23 - Service: Virtual CD v4 Security service (SDK - Version) (VCSSecS) - H H Software GmbH - C:\Program Files\Virtual CD v4 SDK\system\vcssecs.exe

apua tarvitaan kirjoitti:

escanin tulos:

File C:\DOCUME~1\MATTIS~1\LOCALS~1\temp\GAIN_T~3.EXE tagged as not-a-virus:AdWare.Gator.3202. No Action Taken.
File C:\PROGRA~1\WHENUS~1\Search.exe tagged as not-a-virus:AdWare.SaveNow.as. No Action Taken.
File C:\WINDOWS\speer.dll tagged as not-a-virus:AdWare.BetterInternet. No Action Taken.
File C:\DOCUME~1\MATTIS~1\APPLIC~1\Pokeone\UPTONS~1.EXE infected by "Trojan-Downloader.Win32.Swizzor.bo" Virus. Action Taken: File to be deleted on reboot.
File C:\PROGRA~1\WHENUS~1\search.dll tagged as not-a-virus:AdWare.SaveNow.az. No Action Taken.
File c:\DOCUME~1\MATTIS~1\LOCALS~1\temp\GAIN_T~3.EXE tagged as not-a-virus:AdWare.Gator.3202. No Action Taken.
File C:\DOCUME~1\ALLUSE~1\APPLIC~1\EACHSA~1\HolePing.exe tagged as not-a-virus:AdWare.Lop.p. No Action Taken.
File C:\WINDOWS\DrUninst.exe tagged as not-a-virus:AdWare.BetterInternet. No Action Taken.
File C:\WINDOWS\RESTORE.INS tagged as not-a-virus:NetTool.Win32.PsKill. No Action Taken.
File C:\WINDOWS\speer.dll tagged as not-a-virus:AdWare.BetterInternet. No Action Taken.
File C:\WINDOWS\TSAd.dll tagged as not-a-virus:AdWare.TimeSink.c. No Action Taken.
File C:\WINDOWS\system32\4907_up.exe infected by "Net-Worm.Win32.Sasser.a" Virus. Action Taken: File Deleted.
File C:\WINDOWS\system32\cd_clint.dll tagged as not-a-virus:AdWare.Cydoor. No Action Taken.
File C:\WINDOWS\system32\TFTP3512 infected by "Backdoor.Win32.Rbot.15" Virus. Action Taken: File Renamed.
File C:\Documents and Settings\All Users\Application Data\Each Safe Beep Ball\ballfind.exe tagged as not-a-virus:AdWare.Lop.p. No Action Taken.
File C:\Documents and Settings\All Users\Application Data\Each Safe Beep Ball\HolePing.exe tagged as not-a-virus:AdWare.Lop.p. No Action Taken.
File C:\Documents and Settings\matti simi\Application Data\close meet surf\csnexcie.exe tagged as not-a-virus:AdWare.Lop.p. No Action Taken.
File C:\Documents and Settings\matti simi\Application Data\close meet surf\hope data hole 64.exe infected by "Trojan-Downloader.Win32.Swizzor.ca" Virus. Action Taken: File Deleted.
File C:\Documents and Settings\matti simi\Application Data\close meet surf\kpwixrbq.exe tagged as not-a-virus:AdWare.Lop.p. No Action Taken.
File C:\Documents and Settings\matti simi\Application Data\close meet surf\objdart32.exe infected by "Trojan-Downloader.Win32.Swizzor.cb" Virus. Action Taken: File Deleted.
File C:\Documents and Settings\matti simi\Application Data\Pokeone\UP TONS.exe infected by "Trojan-Downloader.Win32.Swizzor.bo" Virus. Action Taken: File to be deleted on reboot.
File C:\Documents and Settings\matti simi\Local Settings\Temp\ADMCache\adm16.tmp tagged as not-a-virus:AdWare.Altnet.b. No Action Taken.
File C:\Documents and Settings\matti simi\Local Settings\Temp\ADMCache\adm18.tmp tagged as not-a-virus:AdWare.Altnet.b. No Action Taken.
File C:\Documents and Settings\matti simi\Local Settings\Temp\ADMCache\adm1A.tmp tagged as not-a-virus:AdWare.Altnet.l. No Action Taken.
File C:\Documents and Settings\matti simi\Local Settings\Temp\ADMCache\adm1F.tmp tagged as not-a-virus:AdWare.BrilliantDigital.1007. No Action Taken.
File C:\Documents and Settings\matti simi\Local Settings\Temp\ADMCache\adm21.tmp tagged as not-a-virus:AdWare.Altnet.h. No Action Taken.
File C:\Documents and Settings\matti simi\Local Settings\Temp\cd_clint.dll tagged as not-a-virus:AdWare.Cydoor. No Action Taken.
File C:\Documents and Settings\matti simi\Local Settings\Temp\gain_trickler_3202.exe tagged as not-a-virus:AdWare.Gator.3202. No Action Taken.
File C:\Documents and Settings\matti simi\Local Settings\Temp\gain_trickler_3202a.exe tagged as not-a-virus:AdWare.Gator.3202. No Action Taken.
File C:\Documents and Settings\matti simi\Local Settings\Temp\THI2517.tmp\adrmsper.cab tagged as not-a-virus:AdWare.BetterInternet. No Action Taken.
File C:\Documents and Settings\matti simi\Local Settings\Temp\THI2517.tmp\DrUninst.exe tagged as not-a-virus:AdWare.BetterInternet. No Action Taken.
File C:\Documents and Settings\matti simi\Local Settings\Temp\THI7E3F.tmp\speer.cab tagged as not-a-virus:AdWare.BetterInternet. No Action Taken.
File C:\Documents and Settings\matti simi\Local Settings\Temp\THI7E3F.tmp\speer.dll tagged as not-a-virus:AdWare.BetterInternet. No Action Taken.
File C:\Documents and Settings\matti simi\Local Settings\Temp\__unin__.exe tagged as not-a-virus:AdWare.Altnet.b. No Action Taken.
File C:\Documents and Settings\matti simi\Omat tiedostot\TNT-Soldier.of.Fortune_No_CD_CRK.ZIP tagged as not-a-virus:FalseAlarm.DrWeb.Backdoor.Theef.111. No Action Taken.
File C:\Documents and Settings\matti simi\Omat tiedostot\unzipped\TNT-Soldier_of_Fortune_no_cd.exe tagged as not-a-virus:FalseAlarm.DrWeb.Backdoor.Theef.111. No Action Taken.
File C:\eGames\Galaxy_of_Games_Red\UNWISE.EXE tagged as not-a-virus:Tool.Win32.Reboot. No Action Taken.
File C:\eJay\Dance3\eJay\eJay\OLEAUT_I.EXE tagged as not-a-virus:Tool.Win32.Reboot. No Action Taken.
File C:\eJay\Dance3\eJay\eJay\oset.exe tagged as not-a-virus:Tool.Win32.Reboot. No Action Taken.
File C:\Kazaa\TopSearch.dll tagged as not-a-virus:AdWare.Altnet.c. No Action Taken.
File C:\pelit\aawsepersonal.exe tagged as not-a-virus:Tool.Win32.Reboot. No Action Taken.
File C:\pelit\N64EMULAATTORI\Utility\cpy_supraF.zip tagged as not-a-virus:CrackTool.Win32.AssasinPatch. No Action Taken.
File C:\pelit\spy.exe tagged as not-a-virus:AdWare.ToolBar.AlexaBar.b. No Action Taken.
File C:\pelit\WinISO.v5.3-LasH.EXE tagged as not-a-virus:Tool.Win32.Reboot. No Action Taken.
File C:\Program Files\Altnet\Download Manager\adm25.dll tagged as not-a-virus:AdWare.Altnet.a. No Action Taken.
File C:\Program Files\Altnet\Download Manager\adm4.dll tagged as not-a-virus:AdWare.Altnet.a. No Action Taken.
File C:\Program Files\Altnet\Download Manager\adm4005.exe tagged as not-a-virus:AdWare.Altnet.a. No Action Taken.
File C:\Program Files\Altnet\Download Manager\admdloader.dll tagged as not-a-virus:AdWare.BrilliantDigital.3039. No Action Taken.
File C:\Program Files\Altnet\Download Manager\admfdi.dll tagged as not-a-virus:AdWare.Altnet.j. No Action Taken.
File C:\Program Files\Altnet\Download Manager\admprog.dll tagged as not-a-virus:AdWare.Altnet.i. No Action Taken.
File C:\Program Files\Altnet\Download Manager\altnetuninstall.exe tagged as not-a-virus:AdWare.Altnet.b. No Action Taken.
File C:\Program Files\Altnet\Download Manager\asm.exe tagged as not-a-virus:AdWare.Altnet.l. No Action Taken.
File C:\Program Files\Altnet\Points Manager\Points Manager.exe tagged as not-a-virus:AdWare.Altnet.h. No Action Taken.
File C:\Program Files\Altnet\Points Manager\sysdetect.dll tagged as not-a-virus:AdWare.BrilliantDigital.1007. No Action Taken.
File C:\Program Files\AquaMark3\UNWISE.EXE tagged as not-a-virus:Tool.Win32.Reboot. No Action Taken.
File C:\Program Files\AVPersonal\INFECTED\A0068495.EXE.VIR infected by "Net-Worm.Win32.Sasser.a" Virus. Action Taken: File Deleted.
File C:\Program Files\AVPersonal\INFECTED\A0068498.EXE.VIR infected by "Net-Worm.Win32.Sasser.a" Virus. Action Taken: File Deleted.
File C:\Program Files\AVPersonal\INFECTED\A0068500.EXE.VIR infected by "Net-Worm.Win32.Sasser.a" Virus. Action Taken: File Deleted.
File C:\Program Files\AVPersonal\INFECTED\A0083575.EXE.VIR infected by "Net-Worm.Win32.Padobot.k" Virus. Action Taken: File Deleted.
File C:\Program Files\AVPersonal\INFECTED\bmuhthutc.VIR infected by "Trojan-Proxy.Win32.Bobax.c" Virus. Action Taken: File Deleted.
File C:\Program Files\AVPersonal\INFECTED\EHYLAY.EXE.VIR infected by "Net-Worm.Win32.Padobot.g" Virus. Action Taken: File Deleted.
File C:\Program Files\AVPersonal\INFECTED\lrbz32.VIR infected by "Backdoor.Win32.Agobot.gen" Virus. Action Taken: File Renamed.
File C:\Program Files\AVPersonal\INFECTED\LSAC.EXE.VIR infected by "Backdoor.Win32.Rbot.gen" Virus. Action Taken: File Renamed.
File C:\Program Files\AVPersonal\INFECTED\lvkmaa.VIR infected by "Net-Worm.Win32.Padobot.n" Virus. Action Taken: File Deleted.
File C:\Program Files\AVPersonal\INFECTED\mix ace city.VIR tagged as not-a-virus:AdWare.Lop.m. No Action Taken.
File C:\Program Files\AVPersonal\INFECTED\mscnfg32.VIR infected by "Backdoor.Win32.Rbot.g" Virus. Action Taken: File Renamed.
File C:\Program Files\AVPersonal\INFECTED\mscnfg32.VIR00 infected by "Backdoor.Win32.Rbot.g" Virus. Action Taken: File Renamed.
File C:\Program Files\AVPersonal\INFECTED\mscnfg32.VIR01 infected by "Backdoor.Win32.Rbot.g" Virus. Action Taken: File Renamed.
File C:\Program Files\AVPersonal\INFECTED\mscnfg32.VIR02 infected by "Backdoor.Win32.Rbot.g" Virus. Action Taken: File Renamed.
File C:\Program Files\AVPersonal\INFECTED\mscnfg32.VIR03 infected by "Backdoor.Win32.Rbot.g" Virus. Action Taken: File Renamed.
File C:\Program Files\AVPersonal\INFECTED\mscnfg32.VIR04 infected by "Backdoor.Win32.Rbot.g" Virus. Action Taken: File Renamed.
File C:\Program Files\AVPersonal\INFECTED\mscnfg32.VIR05 infected by "Backdoor.Win32.Rbot.g" Virus. Action Taken: File Renamed.
File C:\Program Files\AVPersonal\INFECTED\mscnfg32.VIR06 infected by "Backdoor.Win32.Rbot.g" Virus. Action Taken: File Renamed.
File C:\Program Files\AVPersonal\INFECTED\ncobjapi.VIR infected by "Trojan-Downloader.Win32.Small.ij" Virus. Action Taken: File Deleted.
File C:\Program Files\AVPersonal\INFECTED\SCRGRD.EXE.VIR infected by "Backdoor.Win32.Rbot.15" Virus. Action Taken: File Renamed.
File C:\Program Files\AVPersonal\INFECTED\wuamgrd.VIR infected by "Backdoor.Win32.Rbot.gen" Virus. Action Taken: File Renamed.
File C:\Program Files\AVPersonal\INFECTED\wuamgrd.VIR00 infected by "Backdoor.Win32.Rbot.gen" Virus. Action Taken: File Renamed.
File C:\Program Files\AVPersonal\INFECTED\wuamgrd.VIR01 infected by "Backdoor.Win32.Rbot.gen" Virus. Action Taken: File Renamed.
File C:\Program Files\AVPersonal\INFECTED\wuamgrd.VIR02 infected by "Backdoor.Win32.Rbot.gen" Virus. Action Taken: File Renamed.
File C:\Program Files\AVPersonal\INFECTED\wuamgrd.VIR03 infected by "Backdoor.Win32.Rbot.gen" Virus. Action Taken: File Renamed.
File C:\Program Files\AVPersonal\INFECTED\wuamgrd.VIR04 infected by "Backdoor.Win32.Rbot.gen" Virus. Action Taken: File Renamed.
File C:\Program Files\AVPersonal\INFECTED\wuamgrd.VIR05 infected by "Backdoor.Win32.Rbot.gen" Virus. Action Taken: File Renamed.
File C:\Program Files\AVPersonal\INFECTED\wuamgrd.VIR06 infected by "Backdoor.Win32.Rbot.gen" Virus. Action Taken: File Renamed.
File C:\Program Files\AVPersonal\INFECTED\wuamgrd.VIR07 infected by "Backdoor.Win32.Rbot.gen" Virus. Action Taken: File Renamed.
File C:\Program Files\AVPersonal\INFECTED\wuamgrd.VIR08 infected by "Backdoor.Win32.Rbot.gen" Virus. Action Taken: File Renamed.
File C:\Program Files\AVPersonal\INFECTED\wuamgrd.VIR09 infected by "Backdoor.Win32.Rbot.gen" Virus. Action Taken: File Renamed.
File C:\Program Files\AVPersonal\INFECTED\wuamgrd.VIR10 infected by "Backdoor.Win32.Rbot.gen" Virus. Action Taken: File Renamed.
File C:\Program Files\AVPersonal\INFECTED\wuamgrd.VIR11 infected by "Backdoor.Win32.Rbot.gen" Virus. Action Taken: File Renamed.
File C:\Program Files\AVPersonal\INFECTED\wuamgrd.VIR12 infected by "Backdoor.Win32.Rbot.gen" Virus. Action Taken: File Renamed.
File C:\Program Files\AVPersonal\INFECTED\wuamgrd.VIR13 infected by "Backdoor.Win32.Rbot.gen" Virus. Action Taken: File Renamed.
File C:\Program Files\AVPersonal\INFECTED\wuamgrd.VIR14 infected by "Backdoor.Win32.Rbot.gen" Virus. Action Taken: File Renamed.
File C:\Program Files\AVPersonal\INFECTED\wuamgrd.VIR15 infected by "Backdoor.Win32.Rbot.gen" Virus. Action Taken: File Renamed.
File C:\Program Files\AVPersonal\INFECTED\wuamgrd.VIR16 infected by "Backdoor.Win32.Rbot.gen" Virus. Action Taken: File Renamed.
File C:\Program Files\AVPersonal\INFECTED\wuamgrd.VIR17 infected by "Backdoor.Win32.Rbot.gen" Virus. Action Taken: File Renamed.
File C:\Program Files\AVPersonal\INFECTED\wuamgrd.VIR18 infected by "Backdoor.Win32.Rbot.gen" Virus. Action Taken: File Renamed.
File C:\Program Files\AVPersonal\INFECTED\wuamgrd.VIR19 infected by "Backdoor.Win32.Rbot.gen" Virus. Action Taken: File Renamed.
File C:\Program Files\AVPersonal\INFECTED\wuamgrd.VIR20 infected by "Backdoor.Win32.Rbot.gen" Virus. Action Taken: File Renamed.
File C:\Program Files\AVPersonal\INFECTED\wuamgrd.VIR21 infected by "Backdoor.Win32.Rbot.gen" Virus. Action Taken: File Renamed.
File C:\Program Files\AVPersonal\INFECTED\wuamgrd.VIR22 infected by "Backdoor.Win32.Rbot.gen" Virus. Action Taken: File Renamed.
File C:\Program Files\AVPersonal\INFECTED\wuamgrd.VIR23 infected by "Backdoor.Win32.Rbot.gen" Virus. Action Taken: File Renamed.
File C:\Program Files\AVPersonal\INFECTED\wuamgrd.VIR24 infected by "Backdoor.Win32.Rbot.gen" Virus. Action Taken: File Renamed.
File C:\Program Files\AVPersonal\INFECTED\wuamgrd.VIR25 infected by "Backdoor.Win32.Rbot.gen" Virus. Action Taken: File Renamed.
File C:\Program Files\AVPersonal\INFECTED\wuamgrd.VIR26 infected by "Backdoor.Win32.Rbot.gen" Virus. Action Taken: File Renamed.
File C:\Program Files\AVPersonal\INFECTED\wuamgrd.VIR27 infected by "Backdoor.Win32.Rbot.gen" Virus. Action Taken: File Renamed.
File C:\Program Files\AVPersonal\INFECTED\wuamgrd.VIR28 infected by "Backdoor.Win32.Rbot.gen" Virus. Action Taken: File Renamed.
File C:\Program Files\AVPersonal\INFECTED\wuamgrd.VIR29 infected by "Backdoor.Win32.Rbot.gen" Virus. Action Taken: File Renamed.
File C:\Program Files\AVPersonal\INFECTED\wuamgrd.VIR30 infected by "Backdoor.Win32.Rbot.gen" Virus. Action Taken: File Renamed.
File C:\Program Files\AVPersonal\INFECTED\wuamgrd.VIR31 infected by "Backdoor.Win32.Rbot.gen" Virus. Action Taken: File Renamed.
File C:\Program Files\AVPersonal\INFECTED\wuamgrd.VIR32 infected by "Backdoor.Win32.Rbot.gen" Virus. Action Taken: File Renamed.
File C:\Program Files\AVPersonal\INFECTED\wuamgrd.VIR33 infected by "Backdoor.Win32.Rbot.gen" Virus. Action Taken: File Renamed.
File C:\Program Files\AVPersonal\INFECTED\wuamgrd.VIR34 infected by "Backdoor.Win32.Rbot.gen" Virus. Action Taken: File Renamed.
File C:\Program Files\AVPersonal\INFECTED\wuamgrd.VIR35 infected by "Backdoor.Win32.Rbot.gen" Virus. Action Taken: File Renamed.
File C:\Program Files\AVPersonal\INFECTED\wuamgrd.VIR36 infected by "Backdoor.Win32.Rbot.gen" Virus. Action Taken: File Renamed.
File C:\Program Files\AVPersonal\INFECTED\XBOX EMULATOR.EXE.VIR infected by "P2P-Worm.Win32.SdDrop.e" Virus. Action Taken: File Deleted.
File C:\Program Files\AVPersonal\INFECTED\ygsuk.VIR infected by "Net-Worm.Win32.Padobot.k" Virus. Action Taken: File Deleted.
File C:\Program Files\C2Media\Setup.exe tagged as not-a-virus:AdWare.Lop. No Action Taken.
File C:\Program Files\Common Files\CMEII\CMEIIAPI.dll tagged as not-a-virus:AdWare.Gator.6041. No Action Taken.
File C:\Program Files\Common Files\CMEII\CMESys.exe tagged as not-a-virus:AdWare.Gator.6034. No Action Taken.
File C:\Program Files\Common Files\CMEII\GAppMgr.dll tagged as not-a-virus:AdWare.Gator.6041. No Action Taken.
File C:\Program Files\Common Files\CMEII\GController.dll tagged as not-a-virus:AdWare.Gator.6041. No Action Taken.
File C:\Program Files\Common Files\CMEII\GDwldEng.dll tagged as not-a-virus:AdWare.Gator.3124. No Action Taken.
File C:\Program Files\Common Files\CMEII\GIocl.dll tagged as not-a-virus:AdWare.Gator.6041. No Action Taken.
File C:\Program Files\Common Files\CMEII\GIoclClient.dll tagged as not-a-virus:AdWare.Gator.6041. No Action Taken.
File C:\Program Files\Common Files\CMEII\GMTProxy.dll tagged as not-a-virus:AdWare.Gator.6041. No Action Taken.
File C:\Program Files\Common Files\CMEII\GObjs.dll tagged as not-a-virus:AdWare.Gator.6041. No Action Taken.
File C:\Program Files\Common Files\CMEII\GStore.dll tagged as not-a-virus:AdWare.Gator.6041. No Action Taken.
File C:\Program Files\Common Files\CMEII\GStoreServer.dll tagged as not-a-virus:AdWare.Gator.6041. No Action Taken.
File C:\Program Files\Common Files\CMEII\Gtools.dll tagged as not-a-virus:AdWare.Gator.6041. No Action Taken.
File C:\Program Files\Common Files\GMT\EGGCEngine.dll tagged as not-a-virus:AdWare.Gator.6041. No Action Taken.
File C:\Program Files\Common Files\GMT\egIEEngine.dll tagged as not-a-virus:AdWare.Gator.6041. No Action Taken.
File C:\Program Files\Common Files\GMT\EGIEProcess.dll tagged as not-a-virus:AdWare.Gator.6041. No Action Taken.
File C:\Program Files\Common Files\GMT\EGNSEngine.dll tagged as not-a-virus:AdWare.Gator.5017. No Action Taken.
File C:\Program Files\Common Files\GMT\GatorRes.dll tagged as not-a-virus:AdWare.Gator.6041. No Action Taken.
File C:\Program Files\Common Files\GMT\GatorStubSetup.exe tagged as not-a-virus:AdWare.Gator.6034. No Action Taken.
File C:\Program Files\Common Files\GMT\GMT.exe tagged as not-a-virus:AdWare.Gator.6041. No Action Taken.
File C:\Program Files\Common Files\GMT\gtrawbm.fil tagged as not-a-virus:AdWare.Gator.a. No Action Taken.
File C:\Program Files\Common Files\GMT\GUninstaller.exe tagged as not-a-virus:AdWare.Gator.6041. No Action Taken.
File C:\Program Files\Common Files\UControl\UControl Scan and Remove\UNWISE.EXE tagged as not-a-virus:Tool.Win32.Reboot. No Action Taken.
File C:\Program Files\DC \Downloads\Flatout crack-serial-keygen.zip tagged as not-a-virus:Porn-Dialer.Win32.Intexdial. No Action Taken.
File C:\Program Files\DC \Downloads\Need For Speed Underground 2 Crack-Serial-Keygen.zip tagged as not-a-virus:Porn-Dialer.Win32.Intexdial. No Action Taken.
File C:\Program Files\Doom 3 Demo\UNWISE.EXE tagged as not-a-virus:Tool.Win32.Reboot. No Action Taken.
File C:\Program Files\eGames\3D Maze Man Special Edition\UNWISE.EXE tagged as not-a-virus:Tool.Win32.Reboot. No Action Taken.
File C:\Program Files\eGames\BUGS\UNWISE.EXE tagged as not-a-virus:Tool.Win32.Reboot. No Action Taken.
File C:\Program Files\eGames\Chomper 3D\UNWISE.EXE tagged as not-a-virus:Tool.Win32.Reboot. No Action Taken.
File C:\Program Files\eGames\Crazy Drake Special Edition\UNWISE.EXE tagged as not-a-virus:Tool.Win32.Reboot. No Action Taken.
File C:\Program Files\eGames\Demonstar Special Edition\UNWISE.EXE tagged as not-a-virus:Tool.Win32.Reboot. No Action Taken.
File C:\Program Files\eGames\Ludo Safari Special Edition\UNWISE.EXE tagged as not-a-virus:Tool.Win32.Reboot. No Action Taken.
File C:\Program Files\eGames\Mini Golf Master Special Edition\UNWISE.EXE tagged as not-a-virus:Tool.Win32.Reboot. No Action Taken.
File C:\Program Files\eGames\Moon Buggy\UNWISE.EXE tagged as not-a-virus:Tool.Win32.Reboot. No Action Taken.
File C:\Program Files\eGames\Moonshot\UNWISE.EXE tagged as not-a-virus:Tool.Win32.Reboot. No Action Taken.
File C:\Program Files\eGames\Nebulae Fighter SE\UNWISE.EXE tagged as not-a-virus:Tool.Win32.Reboot. No Action Taken.
File C:\Program Files\eGames\Playground Special Edition\UNWISE.EXE tagged as not-a-virus:Tool.Win32.Reboot. No Action Taken.
File C:\Program Files\eGames\Raptor Special Edition\UNWISE.EXE tagged as not-a-virus:Tool.Win32.Reboot. No Action Taken.
File C:\Program Files\eGames\Speedy Eggbert Special Edition\UNWISE.EXE tagged as not-a-virus:Tool.Win32.Reboot. No Action Taken.
File C:\Program Files\eGames\Star Miner Special Edition\UNWISE.EXE tagged as not-a-virus:Tool.Win32.Reboot. No Action Taken.
File C:\Program Files\eMule\Incoming\ (Crack) Flatout NOCD.zip tagged as not-a-virus:Porn-Dialer.Win32.Intexdial. No Action Taken.
File C:\Program Files\eMule\Incoming\(Crack) Flatout NOCD [p2p-11066].exe tagged as not-a-virus:Porn-Dialer.Win32.Intexdial. No Action Taken.
File C:\Program Files\GameSpy Arcade\UNWISE.EXE tagged as not-a-virus:Tool.Win32.Reboot. No Action Taken.
File C:\Program Files\Lavasoft\Ad-Aware SE Personal\UNWISE.EXE tagged as not-a-virus:Tool.Win32.Reboot. No Action Taken.
File C:\Program Files\MyWay\myBar\2.bin\MYBAR.DLL tagged as not-a-virus:AdWare.ToolBar.MyWay.m. No Action Taken.
File C:\Program Files\Save\Save.exe tagged as not-a-virus:AdWare.SaveNow.bc. No Action Taken.
File C:\Program Files\Save\SaveUninst.exe tagged as not-a-virus:AdWare.SaveNow.bc. No Action Taken.
File C:\Program Files\Soldier of Fortune II - Double Helix MP TEST\Uninstall\UNWISE.EXE tagged as not-a-virus:Tool.Win32.Reboot. No Action Taken.
File C:\Program Files\StreamCast\Morpheus\Downloads\Nintendo.N64.Emulator. .Utility.zip tagged as not-a-virus:CrackTool.Win32.AssasinPatch. No Action Taken.
File C:\Program Files\VectorWorks\InstDrv.EXE tagged as not-a-virus:Tool.Win32.Reboot. No Action Taken.
File C:\Program Files\WhenUSearch\search.dll tagged as not-a-virus:AdWare.SaveNow.az. No Action Taken.
File C:\Program Files\WhenUSearch\Search.exe tagged as not-a-virus:AdWare.SaveNow.as. No Action Taken.
File C:\Program Files\WhenUSearch\Uninst.exe tagged as not-a-virus:AdWare.SaveNow.az. No Action Taken.
File C:\Program Files\WhenUSearch\whse.exe tagged as not-a-virus:AdWare.SaveNow.bd. No Action Taken.
File C:\System Volume Information\_restore{66FCF0F1-26A6-4635-939D-AFC6B17B7CE3}\RP707\A0180401.exe infected by "Net-Worm.Win32.Sasser.a" Virus. Action Taken: File Deleted.
File C:\System Volume Information\_restore{66FCF0F1-26A6-4635-939D-AFC6B17B7CE3}\RP707\A0180402.exe infected by "Trojan-Downloader.Win32.Swizzor.ca" Virus. Action Taken: File Deleted.
File C:\System Volume Information\_restore{66FCF0F1-26A6-4635-939D-AFC6B17B7CE3}\RP707\A0180403.exe infected by "Trojan-Downloader.Win32.Swizzor.cb" Virus. Action Taken: File Deleted.
File C:\UNWISE.EXE tagged as not-a-virus:Tool.Win32.Reboot. No Action Taken.
File C:\WINDOWS\Downloaded Installations\AmericasArmy\SEEMEP~1.cab tagged as not-a-virus:Tool.Win32.Reboot. No Action Taken.
File C:\WINDOWS\DrUninst.exe tagged as not-a-virus:AdWare.BetterInternet. No Action Taken.
File C:\WINDOWS\RESTORE.INS tagged as not-a-virus:NetTool.Win32.PsKill. No Action Taken.
File C:\WINDOWS\speer.dll tagged as not-a-virus:AdWare.BetterInternet. No Action Taken.
File C:\WINDOWS\system\RESTORE.INS tagged as not-a-virus:NetTool.Win32.PsKill. No Action Taken.
File C:\WINDOWS\system32\cd_clint.dll tagged as not-a-virus:AdWare.Cydoor. No Action Taken.
File C:\WINDOWS\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\7MVGZWZP\212.181.230[1].gif infected by "Trojan-Proxy.Win32.Bobax.c" Virus. Action Taken: File Deleted.
File C:\WINDOWS\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\7MVGZWZP\217.234.106[1].gif infected by "Trojan-Proxy.Win32.Bobax.c" Virus. Action Taken: File Deleted.
File C:\WINDOWS\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\7MVGZWZP\4.226.147[1].gif infected by "Trojan-Proxy.Win32.Bobax.c" Virus. Action Taken: File Deleted.
File C:\WINDOWS\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\7MVGZWZP\61.203.167[1].gif infected by "Trojan-Proxy.Win32.Bobax.c" Virus. Action Taken: File Deleted.
File C:\WINDOWS\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\7MVGZWZP\83.31.129[1].gif infected by "Trojan-Proxy.Win32.Bobax.c" Virus. Action Taken: File Deleted.
File C:\WINDOWS\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\7MVGZWZP\leet[1].htm infected by "Trojan-Clicker.JS.Linker.j" Virus. Action Taken: File Deleted.
File C:\WINDOWS\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\8H0QT4N2\194.134.134[1].gif infected by "Trojan-Proxy.Win32.Bobax.c" Virus. Action Taken: File Deleted.
File C:\WINDOWS\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\8H0QT4N2\212.18.58[1].gif infected by "Trojan-Proxy.Win32.Bobax.c" Virus. Action Taken: File Deleted.
File C:\WINDOWS\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\8H0QT4N2\213.23.249[1].gif infected by "Trojan-Proxy.Win32.Bobax.c" Virus. Action Taken: File Deleted.
File C:\WINDOWS\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\8H0QT4N2\218.219.250[1].gif infected by "Trojan-Proxy.Win32.Bobax.c" Virus. Action Taken: File Deleted.
File C:\WINDOWS\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\8H0QT4N2\221.113.203[1].gif infected by "Trojan-Proxy.Win32.Bobax.c" Virus. Action Taken: File Deleted.
File C:\WINDOWS\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\8H0QT4N2\65.177.129[1].gif infected by "Trojan-Proxy.Win32.Bobax.c" Virus. Action Taken: File Deleted.
File C:\WINDOWS\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\8H0QT4N2\80.53.157[1].gif infected by "Trojan-Proxy.Win32.Bobax.c" Virus. Action Taken: File Deleted.
File C:\WINDOWS\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\8H0QT4N2\83.129.145[1].gif infected by "Trojan-Proxy.Win32.Bobax.c" Virus. Action Taken: File Deleted.
File C:\WINDOWS\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\8H0QT4N2\MediaTicketsInstaller[1].cab tagged as not-a-virus:AdWare.MediaTickets.b. No Action Taken.
File C:\WINDOWS\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\I1G9SFOZ\193.95.90[1].gif infected by "Trojan-Proxy.Win32.Bobax.c" Virus. Action Taken: File Deleted.
File C:\WINDOWS\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\I1G9SFOZ\200.46.99[1].gif infected by "Trojan-Proxy.Win32.Bobax.c" Virus. Action Taken: File Deleted.
File C:\WINDOWS\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\I1G9SFOZ\217.95.49[1].gif infected by "Trojan-Proxy.Win32.Bobax.c" Virus. Action Taken: File Deleted.
File C:\WINDOWS\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\I1G9SFOZ\24.166.82[1].gif infected by "Trojan-Proxy.Win32.Bobax.c" Virus. Action Taken: File Deleted.
File C:\WINDOWS\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\I1G9SFOZ\4.47.129[1].gif infected by "Trojan-Proxy.Win32.Bobax.c" Virus. Action Taken: File Deleted.
File C:\WINDOWS\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\I1G9SFOZ\62.143.38[1].gif infected by "Trojan-Proxy.Win32.Bobax.c" Virus. Action Taken: File Deleted.
File C:\WINDOWS\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\I1G9SFOZ\81.60.72[1].gif infected by "Trojan-Proxy.Win32.Bobax.c" Virus. Action Taken: File Deleted.
File C:\WINDOWS\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\I1G9SFOZ\leet[1].htm infected by "Trojan-Clicker.JS.Linker.j" Virus. Action Taken: File Deleted.
File C:\WINDOWS\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\JSBK5VT7\151.204.154[1].gif infected by "Trojan-Proxy.Win32.Bobax.c" Virus. Action Taken: File Deleted.
File C:\WINDOWS\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\JSBK5VT7\212.42.63[1].gif infected by "Trojan-Proxy.Win32.Bobax.c" Virus. Action Taken: File Deleted.
File C:\WINDOWS\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\JSBK5VT7\213.7.131[1].gif infected by "Trojan-Proxy.Win32.Bobax.c" Virus. Action Taken: File Deleted.
File C:\WINDOWS\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\JSBK5VT7\62.249.168[1].gif infected by "Trojan-Proxy.Win32.Bobax.c" Virus. Action Taken: File Deleted.
File C:\WINDOWS\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\JSBK5VT7\63.13.185[1].gif infected by "Trojan-Proxy.Win32.Bobax.c" Virus. Action Taken: File Deleted.
File C:\WINDOWS\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\JSBK5VT7\80.116.41[1].gif infected by "Trojan-Proxy.Win32.Bobax.c" Virus. Action Taken: File Deleted.
File C:\WINDOWS\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\JSBK5VT7\81.130.36[1].gif infected by "Trojan-Proxy.Win32.Bobax.c" Virus. Action Taken: File Deleted.
File C:\WINDOWS\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\JSBK5VT7\MediaTicketsInstaller[1].cab tagged as not-a-virus:AdWare.MediaTickets.b. No Action Taken.
File C:\WINDOWS\system32\Macromed\Shockwave 8\UNWISE.EXE tagged as not-a-virus:Tool.Win32.Reboot. No Action Taken.
File C:\WINDOWS\Temp\Altnet\adm25.dll tagged as not-a-virus:AdWare.Altnet.a. No Action Taken.
File C:\WINDOWS\Temp\Altnet\adm4.dll tagged as not-a-virus:AdWare.Altnet.a. No Action Taken.
File C:\WINDOWS\Temp\Altnet\admdloader.dll tagged as not-a-virus:AdWare.BrilliantDigital.3039. No Action Taken.
File C:\WINDOWS\Temp\Altnet\admfdi.dll tagged as not-a-virus:AdWare.Altnet.j. No Action Taken.
File C:\WINDOWS\Temp\Altnet\admprog.dll tagged as not-a-virus:AdWare.Altnet.i. No Action Taken.
File C:\WINDOWS\Temp\Altnet\dmfiles.cab tagged as not-a-virus:AdWare.Altnet.b. No Action Taken.
File C:\WINDOWS\Temp\Altnet\mysearch.cab tagged as not-a-virus:AdWare.ToolBar.MyWay.b. No Action Taken.
File C:\WINDOWS\Temp\Altnet\pmfiles.cab tagged as not-a-virus:AdWare.BrilliantDigital.1007. No Action Taken.
File C:\WINDOWS\Temp\Altnet\Setup.exe tagged as not-a-virus:AdWare.Altnet.b. No Action Taken.
File C:\WINDOWS\Temp\Brilliant\b3d3200package.cab tagged as not-a-virus:AdWare.BrilliantDigital.1007. No Action Taken.
File C:\WINDOWS\Temp\Brilliant\b3dsetup.exe tagged as not-a-virus:AdWare.BrilliantDigital.1100. No Action Taken.
File C:\WINDOWS\Temp\Brilliant\bdedownloader.dll tagged as not-a-virus:AdWare.BrilliantDigital.3039. No Action Taken.
File C:\WINDOWS\Temp\Brilliant\bdefdi.dll tagged as not-a-virus:AdWare.Altnet.k. No Action Taken.
File C:\WINDOWS\Temp\Brilliant\bdeinsta25.dll tagged as not-a-virus:AdWare.Altnet.a. No Action Taken.
File C:\WINDOWS\TSAd.dll tagged as not-a-virus:AdWare.TimeSink.c. No Action Taken.
File G:\half life 2\UNWISE.EXE tagged as not-a-virus:Tool.Win32.Reboot. No Action Taken.
File G:\Valve\Condition Zero\steaminstall.exe tagged as not-a-virus:Tool.Win32.Reboot. No Action Taken.
File G:\Valve\Condition Zero\UNWISE.EXE tagged as not-a-virus:Tool.Win32.Reboot. No Action Taken.


hjt:

ogfile of HijackThis v1.99.1
Scan saved at 22:42:23, on 25.6.2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\PROGRA~1\MOUSEW~1\SYSTEM\EM_EXEC.EXE
C:\apps\ABoard\ABoard.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\Virtual CD v4 SDK\system\vcsplay.exe
C:\apps\ABoard\AOSD.exe
C:\Program Files\Common Files\Microsoft Shared\Works Shared\WkUFind.exe
C:\documents and settings\matti simi\local settings\temp\gain_trickler_3202a.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\D-Tools\daemon.exe
C:\Program Files\AVPersonal\AVGNT.EXE
C:\Program Files\MSN Apps\Updater\01.02.3000.1001\fi\msnappau.exe
C:\Program Files\MessengerPlus! 3\MsgPlus.exe
C:\PROGRA~1\COMMON~1\PCSuite\DATALA~1\DATALA~1.EXE
C:\PROGRA~1\Nokia\NOKIAP~1\TRAYAP~1.EXE
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\WINDOWS\system32\ctfmon.exe
G:\half life 2\Steam.exe
C:\PROGRA~1\COMMON~1\PCSuite\Services\SERVIC~1.EXE
C:\Program Files\SEC\MagicTune 2.5\GammaTray.exe
C:\Program Files\Common Files\Teknum Systems\updsvc.exe
C:\Program Files\AVPersonal\AVWUPSRV.EXE
C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
C:\WINDOWS\system32\slserv.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Virtual CD v4 SDK\system\vcssecs.exe
C:\WINDOWS\system32\wscntfy.exe
C:\Program Files\WhenUSearch\Search.exe
C:\hijackthis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.usvylemlzelrxyde.net/CLVFei1kHZPT1v0Y6ErvhQf5JZvHGckDtrWLuFd0mFRuM91RLqGOPF_IlGVaXhfA.html
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = file://C:\APPS\IE\offline\fin.htm
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Packard Bell
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Linkit
O2 - BHO: sPeerObj Class - {00000026-8735-428D-B81F-DD098223B25F} - C:\WINDOWS\speer.dll
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\apps\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: ST - {9394EDE7-C8B5-483E-8773-474BF36AF6E4} - C:\Program Files\MSN Apps\ST\01.03.0000.1005\en-xu\stmain.dll
O2 - BHO: WhenUSearch Helper - {BA2325ED-F9EB-4830-8FCE-0BC35B16969B} - C:\Program Files\WhenUSearch\search.dll
O2 - BHO: MSNToolBandBHO - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Apps\MSN Toolbar\01.02.4000.1001\fi\msntb.dll
O3 - Toolbar: MSN - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Apps\MSN Toolbar\01.02.4000.1001\fi\msntb.dll
O4 - HKLM\..\Run: [EM_EXEC] C:\PROGRA~1\MOUSEW~1\SYSTEM\EM_EXEC.EXE
O4 - HKLM\..\Run: [ACTIVBOARD] c:\apps\ABoard\ABoard.exe
O4 - HKLM\..\Run: [windows auto update] msblast.exe
O4 - HKLM\..\Run: [TimeSink Ad Client] "C:\Program Files\TimeSink\AdGateway\TSAdBot.exe"
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [VCSPlayer] "C:\Program Files\Virtual CD v4 SDK\system\vcsplay.exe"
O4 - HKLM\..\Run: [Microsoft Works Update Detection] C:\Program Files\Common Files\Microsoft Shared\Works Shared\WkUFind.exe
O4 - HKLM\..\Run: [Trickler] "c:\documents and settings\matti simi\local settings\temp\gain_trickler_3202a.exe"
O4 - HKLM\..\Run: [Microsoft Config 32bit] mscnfg32.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [DAEMON Tools-1033] "C:\Program Files\D-Tools\daemon.exe" -lang 1033
O4 - HKLM\..\Run: [AVGCtrl] "C:\Program Files\AVPersonal\AVGNT.EXE" /min
O4 - HKLM\..\Run: [msnappau] "C:\Program Files\MSN Apps\Updater\01.02.3000.1001\fi\msnappau.exe"
O4 - HKLM\..\Run: [MessengerPlus3] "C:\Program Files\MessengerPlus! 3\MsgPlus.exe"
O4 - HKLM\..\Run: [DataLayer] C:\PROGRA~1\COMMON~1\PCSuite\DATALA~1\DATALA~1.EXE
O4 - HKLM\..\Run: [PCSuiteTrayApplication] C:\PROGRA~1\Nokia\NOKIAP~1\TRAYAP~1.EXE
O4 - HKLM\..\Run: [beep ball exit cast] C:\Documents and Settings\All Users\Application Data\Each Safe Beep Ball\HolePing.exe
O4 - HKLM\..\Run: [RivaTunerStartupDaemon] "G:\RivaTuner v2.0 RC 15.4\RivaTuner.exe" /S
O4 - HKLM\..\RunServices: [Microsoft Config 32bit] mscnfg32.exe
O4 - HKLM\..\RunServices: [Microsoft Update] wuamgrd.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [Update Service] C:\PROGRA~1\COMMON~1\TEKNUM~1\update.exe /startup
O4 - HKCU\..\Run: [Microsoft Restore] scrgrd.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [Steam] G:\half life 2\Steam.exe -silent
O4 - Global Startup: Color Calibration.lnk = ?
O8 - Extra context menu item: Vie Microsoft E&xceliin - res://C:\PROGRA~1\MICROS~3\Office10\EXCEL.EXE/3000
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O12 - Plugin for .fpx: C:\\Program Files\\Internet Explorer\\PLUGINS\\NPRVRT32.dll
O12 - Plugin for .ivr: C:\\Program Files\\Internet Explorer\\PLUGINS\\NPRVRT32.dll
O14 - IERESET.INF: START_PAGE_URL=file://C:\APPS\IE\offline\fin.htm
O16 - DPF: {14B87622-7E19-4EA8-93B3-97215F77A6BC} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab31267.cab
O16 - DPF: {1D6711C8-7154-40BB-8380-3DEA45B69CBF} (Web P2P Installer) -
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://spaces.msn.com//PhotoUpload/MsnPUpld.cab
O16 - DPF: {54B52E52-8000-4413-BD67-FC7FE24B59F2} (EARTPatchX Class) - http://files.ea.com/downloads/rtpatch/v2/EARTPX.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://v5.windowsupdate.microsoft.com/v5consumer/V5Controls/en/x86/client/wuweb_site.cab?1097236922265
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/MsnMessengerSetupDownloader.cab
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (ZoneIntro Class) - http://messenger.zone.msn.com/binary/ZIntro.cab32846.cab
O16 - DPF: {BD393C14-72AD-4790-A095-76522973D6B8} (CBreakshotControl Class) - http://messenger.zone.msn.com/binary/Bankshot.cab31267.cab
O23 - Service: AntiVir Service (AntiVirService) - H BEDV Datentechnik GmbH - C:\Program Files\AVPersonal\AVGUARD.EXE
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: AntiVir Update (AVWUpSrv) - H BEDV Datentechnik GmbH, Germany - C:\Program Files\AVPersonal\AVWUPSRV.EXE
O23 - Service: Network Client (nwclntmon) - Unknown owner - C:\WINDOWS\system32\netclnt.exe (file missing)
O23 - Service: SmartLinkService (SLService) - - C:\WINDOWS\SYSTEM32\slserv.exe
O23 - Service: Virtual CD v4 Security service (SDK - Version) (VCSSecS) - H H Software GmbH - C:\Program Files\Virtual CD v4 SDK\system\vcssecs.exe

No niin.

Tyhjää kaikki temp ja temporary internet files hakemistot kaikista käyttäjätileistä

Esim näin
Näppää "käynnistä" "suorita" kirjoita ruutuun "cleanmgr" ja paina enter ja ok

Valitse

temporary internet files
roskakori
tilapäiset tiedostot

Ja näppää "ok"

Laita piilotiedostot näkyviin ja sammuta järjestelmän palautus, ohjeet:

piilotiedostot

Oma Tietokone >
- Työkalut >
- Kansion asetukset >
- Näytä
Tiedostot ja kansiot >
- vieritä alaspäin
RUKSI pois seuraavasta kohdasta
- Piilota tunnettujen tiedostotyyppien tunnisteet
Piilotetut tiedostot ja kansiot
- RUKSI > Näytä piilotetut tiedostot ja kansiot
Käytä > OK


Järjestelmän palautus:

Oma Tietokone >
- Muuta asetusta >
- järjestelmä >
- järjestelmän palautus-välilehti >
- ruksi ruutuun "poista järjestelmän palauttaminen kaikista asemista >
- Käytä >
- Ok

Poista lisää/poista sovelluksen kautta

messenger plus

Sammuta seuraavat prosessit tehtävienhallinnasta jos löytyy:

msblast.exe
mscnfg32.exe
wuamgrd.exe
scrgrd.exe

Scannaa hijackilla ja ruksaa:

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.usvylemlzelrxyde.net/CLVFei1kHZPT1v0Y6ErvhQf 5JZvHGckDtrWLuFd0mFRuM91RLqGOPF_IlGVaXhfA.html
O2 - BHO: sPeerObj Class - {00000026-8735-428D-B81F-DD098223B25F} - C:\WINDOWS\speer.dll
O2 - BHO: WhenUSearch Helper - {BA2325ED-F9EB-4830-8FCE-0BC35B16969B} - C:\Program Files\WhenUSearch\search.dll
O4 - HKLM\..\Run: [windows auto update] msblast.exe
O4 - HKLM\..\Run: [TimeSink Ad Client] "C:\Program Files\TimeSink\AdGateway\TSAdBot.exe"
O4 - HKLM\..\Run: [Trickler] "c:\documents and settings\matti simi\local settings\temp\gain_trickler_3202a.exe"
O4 - HKLM\..\Run: [Microsoft Config 32bit] mscnfg32.exe
O4 - HKLM\..\Run: [MessengerPlus3] "C:\Program Files\MessengerPlus! 3\MsgPlus.exe"
O4 - HKLM\..\Run: [beep ball exit cast] C:\Documents and Settings\All Users\Application Data\Each Safe Beep Ball\HolePing.exe
O4 - HKLM\..\RunServices: [Microsoft Config 32bit] mscnfg32.exe
O4 - HKLM\..\RunServices: [Microsoft Update] wuamgrd.exe
O4 - HKCU\..\Run: [Microsoft Restore] scrgrd.exe
O16 - DPF: {1D6711C8-7154-40BB-8380-3DEA45B69CBF} (Web P2P Installer) -

Sammuta muut ohjelmat ja ikkunat ja paina Fix Checked.

Käynnistä kone vikasietotilaan ja etsi ja poista seuraavat jos löytyy:

C:\WINDOWS\speer.dll