Logfile of HijackThis v1.99.1
Scan saved at 17:34:24, on 17.8.2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\acer\Acer eConsole\MediaServerService.exe
C:\Documents and Settings\All Users\fswsclds.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\NVIDIA Corporation\NvMixer\NVMixerTray.exe
C:\Program Files\Acer\eRecovery\Monitor.exe
C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe
C:\Program Files\Acer\Acer eMode Management\AspireService.exe
C:\WINDOWS\AGRSMMSG.exe
C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
C:\Program Files\Hewlett-Packard\OrderReminder\OrderReminder.exe
C:\Program Files\QuickTime\qttask.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Olympus\DeviceDetector\DevDtct2.exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\Program Files\HP\Digital Imaging\bin\hpqgalry.exe
C:\PROGRA~1\MOZILL~1\FIREFOX.EXE
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\rundll32.exe
C:\HJT\HijackThis.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Linkit
O4 - HKLM\..\Run: [LaunchApp] Alaunch
O4 - HKLM\..\Run: [NVMixerTray] "C:\Program Files\NVIDIA Corporation\NvMixer\NVMixerTray.exe"
O4 - HKLM\..\Run: [eRecoveryService] C:\Program Files\Acer\eRecovery\Monitor.exe
O4 - HKLM\..\Run: [ntiMUI] C:\Program Files\NewTech Infosystems\NTI CD & DVD-Maker 7\ntiMUI.exe
O4 - HKLM\..\Run: [RemoteControl] "C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe"
O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
O4 - HKLM\..\Run: [MSPY2002] C:\WINDOWS\system32\IME\PINTLGNT\ImScInst.exe /SYNC
O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC
O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName
O4 - HKLM\..\Run: [AspireService] C:\Program Files\Acer\Acer eMode Management\AspireService.exe
O4 - HKLM\..\Run: [MediaSync] C:\Program Files\Acer\Acer eConsole\MediaSync.exe
O4 - HKLM\..\Run: [AGRSMMSG] AGRSMMSG.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [OrderReminder] C:\Program Files\Hewlett-Packard\OrderReminder\OrderReminder.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [keyboard] C:\\kybrdff_9.exe
O4 - HKLM\..\Run: [koyeb020] RUNDLL32.EXE w18f83c1.dll,n 002eb01e0000000a18f83c1
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: Device Detector 3.lnk = C:\Program Files\Olympus\DeviceDetector\DevDtct2.exe
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O4 - Global Startup: HP Image Zone -pikakäynnistys.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqthb08.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O8 - Extra context menu item: &Search - http://edits.mywebsearch.com/toolbaredits/menusearch.jhtml?p=ZCxdm342YYFI
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra button: (no name) - {B205A35E-1FC4-4CE3-818B-899DBBB3388C} - C:\Program Files\Common Files\Microsoft Shared\Encarta Search Bar\ENCSBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: RaptisoftGameLoader - http://www.miniclip.com/haphazard/raptisoftgameloader.cab
O16 - DPF: {1D4DB7D2-6EC9-47A3-BD87-1E41684E07BB} - http://ak.exe.imgfarm.com/images/nocache/funwebproducts/ei/CursorManiaFWBInitialSetup1.0.0.15.cab
O16 - DPF: {288C5F13-7E52-4ADA-A32E-F5BF9D125F99} (CR64Loader Object) - http://www.miniclip.com/puzzlepirates/miniclipGameLoader.dll
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/MsnMessengerSetupDownloader.cab
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O20 - Winlogon Notify: StillImage - C:\WINDOWS\system32\hgicons.dll (file missing)
O20 - Winlogon Notify: Syncmgr - C:\WINDOWS\system32\n2l80c3uef.dll
O23 - Service: Acer Media Server - Acer Inc. - C:\Program Files\acer\Acer eConsole\MediaServerService.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: Command Service (cmdService) - Unknown owner - C:\WINDOWS\UGlpYQ\command.exe (file missing)
O23 - Service: F-Secure Windows Security Center Legacy Detection Service (Fswsclds) - F-Secure Corporation - C:\Documents and Settings\All Users\fswsclds.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
Scan saved at 17:34:24, on 17.8.2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\acer\Acer eConsole\MediaServerService.exe
C:\Documents and Settings\All Users\fswsclds.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\NVIDIA Corporation\NvMixer\NVMixerTray.exe
C:\Program Files\Acer\eRecovery\Monitor.exe
C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe
C:\Program Files\Acer\Acer eMode Management\AspireService.exe
C:\WINDOWS\AGRSMMSG.exe
C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
C:\Program Files\Hewlett-Packard\OrderReminder\OrderReminder.exe
C:\Program Files\QuickTime\qttask.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Olympus\DeviceDetector\DevDtct2.exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\Program Files\HP\Digital Imaging\bin\hpqgalry.exe
C:\PROGRA~1\MOZILL~1\FIREFOX.EXE
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\rundll32.exe
C:\HJT\HijackThis.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Linkit
O4 - HKLM\..\Run: [LaunchApp] Alaunch
O4 - HKLM\..\Run: [NVMixerTray] "C:\Program Files\NVIDIA Corporation\NvMixer\NVMixerTray.exe"
O4 - HKLM\..\Run: [eRecoveryService] C:\Program Files\Acer\eRecovery\Monitor.exe
O4 - HKLM\..\Run: [ntiMUI] C:\Program Files\NewTech Infosystems\NTI CD & DVD-Maker 7\ntiMUI.exe
O4 - HKLM\..\Run: [RemoteControl] "C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe"
O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
O4 - HKLM\..\Run: [MSPY2002] C:\WINDOWS\system32\IME\PINTLGNT\ImScInst.exe /SYNC
O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC
O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName
O4 - HKLM\..\Run: [AspireService] C:\Program Files\Acer\Acer eMode Management\AspireService.exe
O4 - HKLM\..\Run: [MediaSync] C:\Program Files\Acer\Acer eConsole\MediaSync.exe
O4 - HKLM\..\Run: [AGRSMMSG] AGRSMMSG.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [OrderReminder] C:\Program Files\Hewlett-Packard\OrderReminder\OrderReminder.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [keyboard] C:\\kybrdff_9.exe
O4 - HKLM\..\Run: [koyeb020] RUNDLL32.EXE w18f83c1.dll,n 002eb01e0000000a18f83c1
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: Device Detector 3.lnk = C:\Program Files\Olympus\DeviceDetector\DevDtct2.exe
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O4 - Global Startup: HP Image Zone -pikakäynnistys.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqthb08.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O8 - Extra context menu item: &Search - http://edits.mywebsearch.com/toolbaredits/menusearch.jhtml?p=ZCxdm342YYFI
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra button: (no name) - {B205A35E-1FC4-4CE3-818B-899DBBB3388C} - C:\Program Files\Common Files\Microsoft Shared\Encarta Search Bar\ENCSBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: RaptisoftGameLoader - http://www.miniclip.com/haphazard/raptisoftgameloader.cab
O16 - DPF: {1D4DB7D2-6EC9-47A3-BD87-1E41684E07BB} - http://ak.exe.imgfarm.com/images/nocache/funwebproducts/ei/CursorManiaFWBInitialSetup1.0.0.15.cab
O16 - DPF: {288C5F13-7E52-4ADA-A32E-F5BF9D125F99} (CR64Loader Object) - http://www.miniclip.com/puzzlepirates/miniclipGameLoader.dll
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/MsnMessengerSetupDownloader.cab
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O20 - Winlogon Notify: StillImage - C:\WINDOWS\system32\hgicons.dll (file missing)
O20 - Winlogon Notify: Syncmgr - C:\WINDOWS\system32\n2l80c3uef.dll
O23 - Service: Acer Media Server - Acer Inc. - C:\Program Files\acer\Acer eConsole\MediaServerService.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: Command Service (cmdService) - Unknown owner - C:\WINDOWS\UGlpYQ\command.exe (file missing)
O23 - Service: F-Secure Windows Security Center Legacy Detection Service (Fswsclds) - F-Secure Corporation - C:\Documents and Settings\All Users\fswsclds.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
Vastaukset 12
Vanhimmat
1. Lataa combofix.exe tiedosto työpöydällesi.
http://download.bleepingcomputer.com/sUBs/combofix.exe
2. Tuplaklikkaa combofix.exe tiedostoa ja seuraa ohjeistuksia.
3. Kun työkalu on valmis, se tuottaa lokin. Lähetä tämä loki viesti ketjuusi.
Huom! Älä klikkaile combofixin ikkunaa käytön aikana. Tämä saattaa aiheuttaa ohjelman jumiutumisen.
Pistä myös uus Hijack logi.
Väittää, ettei muka ole admin-oikeuksia, kokeiltu vikasietotilassa ja ilman.
kirjautua sisään järjestelmänvalvojana\admin ja koita uudestaan.
Sitä se vaan valittaa, voiko joku virus estää?
Lataa tuosta Look2Me-Destroyer.exe työpöydällesi.
http://www.atribune.org/ccount/click.php?id=7
* Sulje ikkunat jatkaaksesi.
* Tupla-klikkaa Look2Me-Destroyer.exe filua ajaaksesi sen.
* Rastita Run this program as a task.
* Saat viestin joka sanoo "Look2Me-Destroyer will close and re-open in approximately 1 minute". Klikkaa OK
* Kun se avautuu uudestaan, klikkaa Scan for L2M valintaa, pikakuvakkeesi katoavat; tämä on normaalia.
* Kun skannaus on valmis, klikkaa Remove L2M.
* Saat Done Scanning viestin, klikkaa OK.
* Kun valmis, saat tämän viestin: Done removing infected files! Look2Me-Destroyer will now shutdown your computer, klikkaa OK.
* Koneesi sammuu.
* Käynnistä se uudelleen.
* Postita C:\Look2Me-Destroyer.txt lokin sisältö seuraavaan viestiisi.
Pistä myö uus Hijack logi.
Jos Look2Me-Destroyer ei aukea automaattisesi, käynnistä tietokoneesi uudestaan ja koita uudelleen.
Jouduin poistumaan saastuneen koneen parista jo, palailen huomenna asiaan. Kiitos todella paljon, kun vaivaudut auttamaan.
Logfile of HijackThis v1.99.1
Scan saved at 13:27:17, on 18.8.2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\NVIDIA Corporation\NvMixer\NVMixerTray.exe
C:\Program Files\Acer\eRecovery\Monitor.exe
C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe
C:\Program Files\Acer\Acer eMode Management\AspireService.exe
C:\Program Files\Acer\Acer eConsole\MediaSync.exe
C:\WINDOWS\AGRSMMSG.exe
C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
C:\Program Files\Hewlett-Packard\OrderReminder\OrderReminder.exe
C:\Program Files\QuickTime\qttask.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\Program Files\F-Secure\Common\FSM32.EXE
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\MSN Messenger\msnmsgr.exe
C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
C:\Program Files\Olympus\DeviceDetector\DevDtct2.exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\Program Files\acer\Acer eConsole\MediaServerService.exe
C:\PROGRA~1\F-Secure\BackWeb\7681197\Program\SERVIC~1.EXE
C:\Program Files\F-Secure\Anti-Virus\fsgk32st.exe
C:\Program Files\F-Secure\Anti-Virus\FSGK32.EXE
C:\Program Files\F-Secure\BackWeb\7681197\program\fsbwsys.exe
C:\Program Files\F-Secure\Common\FSMA32.EXE
C:\Program Files\F-Secure\Anti-Virus\fssm32.exe
C:\Program Files\F-Secure\Common\FSMB32.EXE
C:\WINDOWS\system32\svchost.exe
C:\Program Files\F-Secure\BackWeb\7681197\Program\F-Secure Automatic Update.exe
C:\Program Files\F-Secure\Common\FCH32.EXE
C:\Program Files\HP\Digital Imaging\bin\hpqgalry.exe
C:\Program Files\F-Secure\Common\FAMEH32.EXE
C:\Program Files\F-Secure\Anti-Virus\fsqh.exe
C:\Program Files\F-Secure\Anti-Virus\fsrw.exe
C:\Program Files\F-Secure\Anti-Virus\fsav32.exe
C:\Program Files\F-Secure\Common\FNRB32.EXE
C:\Program Files\F-Secure\FWES\Program\fsdfwd.exe
C:\Program Files\F-Secure\Common\FIH32.EXE
C:\PROGRA~1\F-Secure\ANTI-S~1\fsaw.exe
C:\Program Files\F-Secure\FSGUI\fsguidll.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\Explorer.EXE
C:\HJT\HijackThis.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Linkit
O4 - HKLM\..\Run: [LaunchApp] Alaunch
O4 - HKLM\..\Run: [NVMixerTray] "C:\Program Files\NVIDIA Corporation\NvMixer\NVMixerTray.exe"
O4 - HKLM\..\Run: [eRecoveryService] C:\Program Files\Acer\eRecovery\Monitor.exe
O4 - HKLM\..\Run: [ntiMUI] C:\Program Files\NewTech Infosystems\NTI CD & DVD-Maker 7\ntiMUI.exe
O4 - HKLM\..\Run: [RemoteControl] "C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe"
O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
O4 - HKLM\..\Run: [MSPY2002] C:\WINDOWS\system32\IME\PINTLGNT\ImScInst.exe /SYNC
O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC
O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName
O4 - HKLM\..\Run: [AspireService] C:\Program Files\Acer\Acer eMode Management\AspireService.exe
O4 - HKLM\..\Run: [MediaSync] C:\Program Files\Acer\Acer eConsole\MediaSync.exe
O4 - HKLM\..\Run: [AGRSMMSG] AGRSMMSG.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [OrderReminder] C:\Program Files\Hewlett-Packard\OrderReminder\OrderReminder.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [koyeb020] RUNDLL32.EXE w18f83c1.dll,n 002eb01e0000000a18f83c1
O4 - HKLM\..\Run: [F-Secure Manager] "C:\Program Files\F-Secure\Common\FSM32.EXE" /splash
O4 - HKLM\..\Run: [F-Secure TNB] "C:\Program Files\F-Secure\TNB\TNBUtil.exe" /CHECKALL /WAITFORSW
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: Device Detector 3.lnk = C:\Program Files\Olympus\DeviceDetector\DevDtct2.exe
O4 - Global Startup: F-Secure Automatic Update.lnk = C:\Program Files\F-Secure\BackWeb\7681197\program\F-Secure Automatic Update.exe
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O4 - Global Startup: HP Image Zone -pikakäynnistys.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqthb08.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O8 - Extra context menu item: &Block this popup - C:\Program Files\F-Secure\Anti-Spyware\blockpopups.htm
O8 - Extra context menu item: &Search - http://edits.mywebsearch.com/toolbaredits/menusearch.jhtml?p=ZCxdm342YYFI
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra button: IE Shield - {300DB664-75B5-47c0-8B45-A44ACCF73C00} - C:\Program Files\F-Secure\Anti-Spyware\ieshield.dll
O9 - Extra 'Tools' menuitem: IE Shield... - {300DB664-75B5-47c0-8B45-A44ACCF73C00} - C:\Program Files\F-Secure\Anti-Spyware\ieshield.dll
O9 - Extra button: (no name) - {B205A35E-1FC4-4CE3-818B-899DBBB3388C} - C:\Program Files\Common Files\Microsoft Shared\Encarta Search Bar\ENCSBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O10 - Unknown file in Winsock LSP: c:\program files\f-secure\fsps\program\fslsp.dll
O10 - Unknown file in Winsock LSP: c:\program files\f-secure\fsps\program\fslsp.dll
O10 - Unknown file in Winsock LSP: c:\program files\f-secure\fsps\program\fslsp.dll
O16 - DPF: RaptisoftGameLoader - http://www.miniclip.com/haphazard/raptisoftgameloader.cab
O16 - DPF: {1D4DB7D2-6EC9-47A3-BD87-1E41684E07BB} - http://ak.exe.imgfarm.com/images/nocache/funwebproducts/ei/CursorManiaFWBInitialSetup1.0.0.15.cab
O16 - DPF: {288C5F13-7E52-4ADA-A32E-F5BF9D125F99} (CR64Loader Object) - http://www.miniclip.com/puzzlepirates/miniclipGameLoader.dll
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/MsnMessengerSetupDownloader.cab
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O23 - Service: Acer Media Server - Acer Inc. - C:\Program Files\acer\Acer eConsole\MediaServerService.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: F-Secure Automatic Update (BackWeb Plug-in - 7681197) - F-Secure Automatic Update - C:\PROGRA~1\F-Secure\BackWeb\7681197\Program\SERVIC~1.EXE
O23 - Service: Command Service (cmdService) - Unknown owner - C:\WINDOWS\UGlpYQ\command.exe (file missing)
O23 - Service: FSGKHS (F-Secure Gatekeeper Handler Starter) - F-Secure Corp. - C:\Program Files\F-Secure\Anti-Virus\fsgk32st.exe
O23 - Service: F-Secure Network Request Broker - F-Secure Corporation - C:\Program Files\F-Secure\Common\FNRB32.EXE
O23 - Service: fsbwsys - F-Secure Corp. - C:\Program Files\F-Secure\BackWeb\7681197\program\fsbwsys.exe
O23 - Service: F-Secure Anti-Virus Firewall Daemon (FSDFWD) - F-Secure Corporation - C:\Program Files\F-Secure\FWES\Program\fsdfwd.exe
O23 - Service: F-Secure Management Agent (FSMA) - F-Secure Corporation - C:\Program Files\F-Secure\Common\FSMA32.EXE
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
Look2Me-Destroyer V1.0.12
Scanning for infected files.....
Scan started at 18.8.2006 13:20:06
Infected! C:\WINDOWS\system32\q686lgls16q6.dll
Infected! C:\System Volume Information\_restore{6FFEE529-CD0F-4985-9F69-867CFC1412D9}\RP225\A0048801.dll
Infected! C:\System Volume Information\_restore{6FFEE529-CD0F-4985-9F69-867CFC1412D9}\RP225\A0048802.dll
Infected! C:\System Volume Information\_restore{6FFEE529-CD0F-4985-9F69-867CFC1412D9}\RP225\A0050805.dll
Infected! C:\System Volume Information\_restore{6FFEE529-CD0F-4985-9F69-867CFC1412D9}\RP225\A0050901.dll
Infected! C:\System Volume Information\_restore{6FFEE529-CD0F-4985-9F69-867CFC1412D9}\RP225\A0050936.dll
Infected! C:\System Volume Information\_restore{6FFEE529-CD0F-4985-9F69-867CFC1412D9}\RP225\A0050965.dll
Infected! C:\System Volume Information\_restore{6FFEE529-CD0F-4985-9F69-867CFC1412D9}\RP225\A0051013.dll
Infected! C:\System Volume Information\_restore{6FFEE529-CD0F-4985-9F69-867CFC1412D9}\RP225\A0051014.dll
Infected! C:\System Volume Information\_restore{6FFEE529-CD0F-4985-9F69-867CFC1412D9}\RP225\A0051020.dll
Infected! C:\System Volume Information\_restore{6FFEE529-CD0F-4985-9F69-867CFC1412D9}\RP225\A0052255.dll
Infected! C:\System Volume Information\_restore{6FFEE529-CD0F-4985-9F69-867CFC1412D9}\RP225\A0052259.dll
Infected! C:\System Volume Information\_restore{6FFEE529-CD0F-4985-9F69-867CFC1412D9}\RP226\A0052377.dll
Infected! C:\System Volume Information\_restore{6FFEE529-CD0F-4985-9F69-867CFC1412D9}\RP226\A0052418.dll
Infected! C:\System Volume Information\_restore{6FFEE529-CD0F-4985-9F69-867CFC1412D9}\RP226\A0052521.dll
Infected! C:\System Volume Information\_restore{6FFEE529-CD0F-4985-9F69-867CFC1412D9}\RP226\A0052579.dll
Infected! C:\System Volume Information\_restore{6FFEE529-CD0F-4985-9F69-867CFC1412D9}\RP226\A0052580.dll
Infected! C:\System Volume Information\_restore{6FFEE529-CD0F-4985-9F69-867CFC1412D9}\RP226\A0052628.dll
Infected! C:\System Volume Information\_restore{6FFEE529-CD0F-4985-9F69-867CFC1412D9}\RP226\A0052662.dll
Infected! C:\System Volume Information\_restore{6FFEE529-CD0F-4985-9F69-867CFC1412D9}\RP227\A0052744.dll
Infected! C:\System Volume Information\_restore{6FFEE529-CD0F-4985-9F69-867CFC1412D9}\RP227\A0052745.dll
Infected! C:\System Volume Information\_restore{6FFEE529-CD0F-4985-9F69-867CFC1412D9}\RP228\A0052844.dll
Infected! C:\System Volume Information\_restore{6FFEE529-CD0F-4985-9F69-867CFC1412D9}\RP228\A0052904.dll
Infected! C:\System Volume Information\_restore{6FFEE529-CD0F-4985-9F69-867CFC1412D9}\RP228\A0052913.dll
Infected! C:\System Volume Information\_restore{6FFEE529-CD0F-4985-9F69-867CFC1412D9}\RP228\A0053340.dll
Infected! C:\System Volume Information\_restore{6FFEE529-CD0F-4985-9F69-867CFC1412D9}\RP228\A0053351.dll
Infected! C:\System Volume Information\_restore{6FFEE529-CD0F-4985-9F69-867CFC1412D9}\RP228\A0053352.dll
Infected! C:\System Volume Information\_restore{6FFEE529-CD0F-4985-9F69-867CFC1412D9}\RP228\A0053354.dll
Infected! C:\System Volume Information\_restore{6FFEE529-CD0F-4985-9F69-867CFC1412D9}\RP228\A0053355.dll
Infected! C:\System Volume Information\_restore{6FFEE529-CD0F-4985-9F69-867CFC1412D9}\RP228\A0053356.dll
Infected! C:\System Volume Information\_restore{6FFEE529-CD0F-4985-9F69-867CFC1412D9}\RP228\A0053357.dll
Infected! C:\System Volume Information\_restore{6FFEE529-CD0F-4985-9F69-867CFC1412D9}\RP228\A0053358.dll
Infected! C:\System Volume Information\_restore{6FFEE529-CD0F-4985-9F69-867CFC1412D9}\RP228\A0053359.dll
Infected! C:\System Volume Information\_restore{6FFEE529-CD0F-4985-9F69-867CFC1412D9}\RP228\A0053360.dll
Infected! C:\System Volume Information\_restore{6FFEE529-CD0F-4985-9F69-867CFC1412D9}\RP228\A0053361.dll
Infected! C:\System Volume Information\_restore{6FFEE529-CD0F-4985-9F69-867CFC1412D9}\RP228\A0053362.dll
Infected! C:\System Volume Information\_restore{6FFEE529-CD0F-4985-9F69-867CFC1412D9}\RP228\A0053363.dll
Infected! C:\System Volume Information\_restore{6FFEE529-CD0F-4985-9F69-867CFC1412D9}\RP228\A0053365.dll
Infected! C:\System Volume Information\_restore{6FFEE529-CD0F-4985-9F69-867CFC1412D9}\RP228\A0053383.dll
Infected! C:\System Volume Information\_restore{6FFEE529-CD0F-4985-9F69-867CFC1412D9}\RP228\A0053388.dll
Infected! C:\System Volume Information\_restore{6FFEE529-CD0F-4985-9F69-867CFC1412D9}\RP228\A0053416.dll
Infected! C:\System Volume Information\_restore{6FFEE529-CD0F-4985-9F69-867CFC1412D9}\RP228\A0053418.dll
Infected! C:\System Volume Information\_restore{6FFEE529-CD0F-4985-9F69-867CFC1412D9}\RP229\A0053476.dll
Infected! C:\System Volume Information\_restore{6FFEE529-CD0F-4985-9F69-867CFC1412D9}\RP229\A0053579.dll
Infected! C:\System Volume Information\_restore{6FFEE529-CD0F-4985-9F69-867CFC1412D9}\RP229\A0053634.dll
Infected! C:\System Volume Information\_restore{6FFEE529-CD0F-4985-9F69-867CFC1412D9}\RP229\A0053677.dll
Infected! C:\System Volume Information\_restore{6FFEE529-CD0F-4985-9F69-867CFC1412D9}\RP231\A0053798.dll
Infected! C:\System Volume Information\_restore{6FFEE529-CD0F-4985-9F69-867CFC1412D9}\RP231\A0053799.dll
Infected! C:\System Volume Information\_restore{6FFEE529-CD0F-4985-9F69-867CFC1412D9}\RP231\A0053843.dll
Infected! C:\System Volume Information\_restore{6FFEE529-CD0F-4985-9F69-867CFC1412D9}\RP231\A0053871.dll
Infected! C:\System Volume Information\_restore{6FFEE529-CD0F-4985-9F69-867CFC1412D9}\RP231\A0054145.dll
Infected! C:\System Volume Information\_restore{6FFEE529-CD0F-4985-9F69-867CFC1412D9}\RP231\A0054212.dll
Infected! C:\System Volume Information\_restore{6FFEE529-CD0F-4985-9F69-867CFC1412D9}\RP231\A0054216.dll
Infected! C:\System Volume Information\_restore{6FFEE529-CD0F-4985-9F69-867CFC1412D9}\RP231\A0054246.dll
Infected! C:\System Volume Information\_restore{6FFEE529-CD0F-4985-9F69-867CFC1412D9}\RP231\A0054286.dll
Infected! C:\System Volume Information\_restore{6FFEE529-CD0F-4985-9F69-867CFC1412D9}\RP231\A0054322.dll
Infected! C:\WINDOWS\system32\c600lgdm160a.dll
Infected! C:\WINDOWS\system32\damstor.dll
Infected! C:\WINDOWS\system32\f42m0ef1eh2.dll
Infected! C:\WINDOWS\system32\iWsnap.dll
Infected! C:\WINDOWS\system32\nemsmgr.dll
Infected! C:\WINDOWS\system32\q686lgls16q6.dll
Infected! C:\WINDOWS\system32\sunceng.dll
Infected! C:\WINDOWS\system32\wvsdmoe2.dll
Attempting to delete infected files...
Attempting to delete: C:\WINDOWS\system32\q686lgls16q6.dll
C:\WINDOWS\system32\q686lgls16q6.dll Deleted successfully!
Attempting to delete: C:\System Volume Information\_restore{6FFEE529-CD0F-4985-9F69-867CFC1412D9}\RP225\A0048801.dll
C:\System Volume Information\_restore{6FFEE529-CD0F-4985-9F69-867CFC1412D9}\RP225\A0048801.dll Deleted successfully!
Attempting to delete: C:\System Volume Information\_restore{6FFEE529-CD0F-4985-9F69-867CFC1412D9}\RP225\A0048802.dll
C:\System Volume Information\_restore{6FFEE529-CD0F-4985-9F69-867CFC1412D9}\RP225\A0048802.dll Deleted successfully!
Attempting to delete: C:\System Volume Information\_restore{6FFEE529-CD0F-4985-9F69-867CFC1412D9}\RP225\A0050805.dll
C:\System Volume Information\_restore{6FFEE529-CD0F-4985-9F69-867CFC1412D9}\RP225\A0050805.dll Deleted successfully!
Attempting to delete: C:\System Volume Information\_restore{6FFEE529-CD0F-4985-9F69-867CFC1412D9}\RP225\A0050901.dll
C:\System Volume Information\_restore{6FFEE529-CD0F-4985-9F69-867CFC1412D9}\RP225\A0050901.dll Deleted successfully!
Attempting to delete: C:\System Volume Information\_restore{6FFEE529-CD0F-4985-9F69-867CFC1412D9}\RP225\A0050936.dll
C:\System Volume Information\_restore{6FFEE529-CD0F-4985-9F69-867CFC1412D9}\RP225\A0050936.dll Deleted successfully!
Attempting to delete: C:\System Volume Information\_restore{6FFEE529-CD0F-4985-9F69-867CFC1412D9}\RP225\A0050965.dll
C:\System Volume Information\_restore{6FFEE529-CD0F-4985-9F69-867CFC1412D9}\RP225\A0050965.dll Deleted successfully!
Attempting to delete: C:\System Volume Information\_restore{6FFEE529-CD0F-4985-9F69-867CFC1412D9}\RP225\A0051013.dll
C:\System Volume Information\_restore{6FFEE529-CD0F-4985-9F69-867CFC1412D9}\RP225\A0051013.dll Deleted successfully!
Attempting to delete: C:\System Volume Information\_restore{6FFEE529-CD0F-4985-9F69-867CFC1412D9}\RP225\A0051014.dll
C:\System Volume Information\_restore{6FFEE529-CD0F-4985-9F69-867CFC1412D9}\RP225\A0051014.dll Deleted successfully!
Attempting to delete: C:\System Volume Information\_restore{6FFEE529-CD0F-4985-9F69-867CFC1412D9}\RP225\A0051020.dll
C:\System Volume Information\_restore{6FFEE529-CD0F-4985-9F69-867CFC1412D9}\RP225\A0051020.dll Deleted successfully!
Attempting to delete: C:\System Volume Information\_restore{6FFEE529-CD0F-4985-9F69-867CFC1412D9}\RP225\A0052255.dll
C:\System Volume Information\_restore{6FFEE529-CD0F-4985-9F69-867CFC1412D9}\RP225\A0052255.dll Deleted successfully!
Attempting to delete: C:\System Volume Information\_restore{6FFEE529-CD0F-4985-9F69-867CFC1412D9}\RP225\A0052259.dll
C:\System Volume Information\_restore{6FFEE529-CD0F-4985-9F69-867CFC1412D9}\RP225\A0052259.dll Deleted successfully!
Attempting to delete: C:\System Volume Information\_restore{6FFEE529-CD0F-4985-9F69-867CFC1412D9}\RP226\A0052377.dll
C:\System Volume Information\_restore{6FFEE529-CD0F-4985-9F69-867CFC1412D9}\RP226\A0052377.dll Deleted successfully!
Attempting to delete: C:\System Volume Information\_restore{6FFEE529-CD0F-4985-9F69-867CFC1412D9}\RP226\A0052418.dll
C:\System Volume Information\_restore{6FFEE529-CD0F-4985-9F69-867CFC1412D9}\RP226\A0052418.dll Deleted successfully!
Attempting to delete: C:\System Volume Information\_restore{6FFEE529-CD0F-4985-9F69-867CFC1412D9}\RP226\A0052521.dll
C:\System Volume Information\_restore{6FFEE529-CD0F-4985-9F69-867CFC1412D9}\RP226\A0052521.dll Deleted successfully!
Attempting to delete: C:\System Volume Information\_restore{6FFEE529-CD0F-4985-9F69-867CFC1412D9}\RP226\A0052579.dll
C:\System Volume Information\_restore{6FFEE529-CD0F-4985-9F69-867CFC1412D9}\RP226\A0052579.dll Deleted successfully!
Attempting to delete: C:\System Volume Information\_restore{6FFEE529-CD0F-4985-9F69-867CFC1412D9}\RP226\A0052580.dll
C:\System Volume Information\_restore{6FFEE529-CD0F-4985-9F69-867CFC1412D9}\RP226\A0052580.dll Deleted successfully!
Attempting to delete: C:\System Volume Information\_restore{6FFEE529-CD0F-4985-9F69-867CFC1412D9}\RP226\A0052628.dll
C:\System Volume Information\_restore{6FFEE529-CD0F-4985-9F69-867CFC1412D9}\RP226\A0052628.dll Deleted successfully!
Attempting to delete: C:\System Volume Information\_restore{6FFEE529-CD0F-4985-9F69-867CFC1412D9}\RP226\A0052662.dll
C:\System Volume Information\_restore{6FFEE529-CD0F-4985-9F69-867CFC1412D9}\RP226\A0052662.dll Deleted successfully!
Attempting to delete: C:\System Volume Information\_restore{6FFEE529-CD0F-4985-9F69-867CFC1412D9}\RP227\A0052744.dll
C:\System Volume Information\_restore{6FFEE529-CD0F-4985-9F69-867CFC1412D9}\RP227\A0052744.dll Deleted successfully!
Attempting to delete: C:\System Volume Information\_restore{6FFEE529-CD0F-4985-9F69-867CFC1412D9}\RP227\A0052745.dll
C:\System Volume Information\_restore{6FFEE529-CD0F-4985-9F69-867CFC1412D9}\RP227\A0052745.dll Deleted successfully!
Attempting to delete: C:\System Volume Information\_restore{6FFEE529-CD0F-4985-9F69-867CFC1412D9}\RP228\A0052844.dll
C:\System Volume Information\_restore{6FFEE529-CD0F-4985-9F69-867CFC1412D9}\RP228\A0052844.dll Deleted successfully!
Attempting to delete: C:\System Volume Information\_restore{6FFEE529-CD0F-4985-9F69-867CFC1412D9}\RP228\A0052904.dll
C:\System Volume Information\_restore{6FFEE529-CD0F-4985-9F69-867CFC1412D9}\RP228\A0052904.dll Deleted successfully!
Attempting to delete: C:\System Volume Information\_restore{6FFEE529-CD0F-4985-9F69-867CFC1412D9}\RP228\A0052913.dll
C:\System Volume Information\_restore{6FFEE529-CD0F-4985-9F69-867CFC1412D9}\RP228\A0052913.dll Deleted successfully!
Attempting to delete: C:\System Volume Information\_restore{6FFEE529-CD0F-4985-9F69-867CFC1412D9}\RP228\A0053340.dll
C:\System Volume Information\_restore{6FFEE529-CD0F-4985-9F69-867CFC1412D9}\RP228\A0053340.dll Deleted successfully!
Attempting to delete: C:\System Volume Information\_restore{6FFEE529-CD0F-4985-9F69-867CFC1412D9}\RP228\A0053351.dll
C:\System Volume Information\_restore{6FFEE529-CD0F-4985-9F69-867CFC1412D9}\RP228\A0053351.dll Deleted successfully!
Attempting to delete: C:\System Volume Information\_restore{6FFEE529-CD0F-4985-9F69-867CFC1412D9}\RP228\A0053352.dll
C:\System Volume Information\_restore{6FFEE529-CD0F-4985-9F69-867CFC1412D9}\RP228\A0053352.dll Deleted successfully!
Attempting to delete: C:\System Volume Information\_restore{6FFEE529-CD0F-4985-9F69-867CFC1412D9}\RP228\A0053354.dll
C:\System Volume Information\_restore{6FFEE529-CD0F-4985-9F69-867CFC1412D9}\RP228\A0053354.dll Deleted successfully!
Attempting to delete: C:\System Volume Information\_restore{6FFEE529-CD0F-4985-9F69-867CFC1412D9}\RP228\A0053355.dll
C:\System Volume Information\_restore{6FFEE529-CD0F-4985-9F69-867CFC1412D9}\RP228\A0053355.dll Deleted successfully!
Attempting to delete: C:\System Volume Information\_restore{6FFEE529-CD0F-4985-9F69-867CFC1412D9}\RP228\A0053356.dll
C:\System Volume Information\_restore{6FFEE529-CD0F-4985-9F69-867CFC1412D9}\RP228\A0053356.dll Deleted successfully!
Attempting to delete: C:\System Volume Information\_restore{6FFEE529-CD0F-4985-9F69-867CFC1412D9}\RP228\A0053357.dll
C:\System Volume Information\_restore{6FFEE529-CD0F-4985-9F69-867CFC1412D9}\RP228\A0053357.dll Deleted successfully!
Attempting to delete: C:\System Volume Information\_restore{6FFEE529-CD0F-4985-9F69-867CFC1412D9}\RP228\A0053358.dll
C:\System Volume Information\_restore{6FFEE529-CD0F-4985-9F69-867CFC1412D9}\RP228\A0053358.dll Deleted successfully!
Attempting to delete: C:\System Volume Information\_restore{6FFEE529-CD0F-4985-9F69-867CFC1412D9}\RP228\A0053359.dll
C:\System Volume Information\_restore{6FFEE529-CD0F-4985-9F69-867CFC1412D9}\RP228\A0053359.dll Deleted successfully!
Attempting to delete: C:\System Volume Information\_restore{6FFEE529-CD0F-4985-9F69-867CFC1412D9}\RP228\A0053360.dll
C:\System Volume Information\_restore{6FFEE529-CD0F-4985-9F69-867CFC1412D9}\RP228\A0053360.dll Deleted successfully!
Attempting to delete: C:\System Volume Information\_restore{6FFEE529-CD0F-4985-9F69-867CFC1412D9}\RP228\A0053361.dll
C:\System Volume Information\_restore{6FFEE529-CD0F-4985-9F69-867CFC1412D9}\RP228\A0053361.dll Deleted successfully!
Attempting to delete: C:\System Volume Information\_restore{6FFEE529-CD0F-4985-9F69-867CFC1412D9}\RP228\A0053362.dll
C:\System Volume Information\_restore{6FFEE529-CD0F-4985-9F69-867CFC1412D9}\RP228\A0053362.dll Deleted successfully!
Attempting to delete: C:\System Volume Information\_restore{6FFEE529-CD0F-4985-9F69-867CFC1412D9}\RP228\A0053363.dll
C:\System Volume Information\_restore{6FFEE529-CD0F-4985-9F69-867CFC1412D9}\RP228\A0053363.dll Deleted successfully!
Attempting to delete: C:\System Volume Information\_restore{6FFEE529-CD0F-4985-9F69-867CFC1412D9}\RP228\A0053365.dll
C:\System Volume Information\_restore{6FFEE529-CD0F-4985-9F69-867CFC1412D9}\RP228\A0053365.dll Deleted successfully!
Attempting to delete: C:\System Volume Information\_restore{6FFEE529-CD0F-4985-9F69-867CFC1412D9}\RP228\A0053383.dll
C:\System Volume Information\_restore{6FFEE529-CD0F-4985-9F69-867CFC1412D9}\RP228\A0053383.dll Deleted successfully!
Attempting to delete: C:\System Volume Information\_restore{6FFEE529-CD0F-4985-9F69-867CFC1412D9}\RP228\A0053388.dll
C:\System Volume Information\_restore{6FFEE529-CD0F-4985-9F69-867CFC1412D9}\RP228\A0053388.dll Deleted successfully!
Attempting to delete: C:\System Volume Information\_restore{6FFEE529-CD0F-4985-9F69-867CFC1412D9}\RP228\A0053416.dll
C:\System Volume Information\_restore{6FFEE529-CD0F-4985-9F69-867CFC1412D9}\RP228\A0053416.dll Deleted successfully!
Attempting to delete: C:\System Volume Information\_restore{6FFEE529-CD0F-4985-9F69-867CFC1412D9}\RP228\A0053418.dll
C:\System Volume Information\_restore{6FFEE529-CD0F-4985-9F69-867CFC1412D9}\RP228\A0053418.dll Deleted successfully!
Attempting to delete: C:\System Volume Information\_restore{6FFEE529-CD0F-4985-9F69-867CFC1412D9}\RP229\A0053476.dll
C:\System Volume Information\_restore{6FFEE529-CD0F-4985-9F69-867CFC1412D9}\RP229\A0053476.dll Deleted successfully!
Attempting to delete: C:\System Volume Information\_restore{6FFEE529-CD0F-4985-9F69-867CFC1412D9}\RP229\A0053579.dll
C:\System Volume Information\_restore{6FFEE529-CD0F-4985-9F69-867CFC1412D9}\RP229\A0053579.dll Deleted successfully!
Attempting to delete: C:\System Volume Information\_restore{6FFEE529-CD0F-4985-9F69-867CFC1412D9}\RP229\A0053634.dll
C:\System Volume Information\_restore{6FFEE529-CD0F-4985-9F69-867CFC1412D9}\RP229\A0053634.dll Deleted successfully!
Attempting to delete: C:\System Volume Information\_restore{6FFEE529-CD0F-4985-9F69-867CFC1412D9}\RP229\A0053677.dll
C:\System Volume Information\_restore{6FFEE529-CD0F-4985-9F69-867CFC1412D9}\RP229\A0053677.dll Deleted successfully!
Attempting to delete: C:\System Volume Information\_restore{6FFEE529-CD0F-4985-9F69-867CFC1412D9}\RP231\A0053798.dll
C:\System Volume Information\_restore{6FFEE529-CD0F-4985-9F69-867CFC1412D9}\RP231\A0053798.dll Deleted successfully!
Attempting to delete: C:\System Volume Information\_restore{6FFEE529-CD0F-4985-9F69-867CFC1412D9}\RP231\A0053799.dll
C:\System Volume Information\_restore{6FFEE529-CD0F-4985-9F69-867CFC1412D9}\RP231\A0053799.dll Deleted successfully!
Attempting to delete: C:\System Volume Information\_restore{6FFEE529-CD0F-4985-9F69-867CFC1412D9}\RP231\A0053843.dll
C:\System Volume Information\_restore{6FFEE529-CD0F-4985-9F69-867CFC1412D9}\RP231\A0053843.dll Deleted successfully!
Attempting to delete: C:\System Volume Information\_restore{6FFEE529-CD0F-4985-9F69-867CFC1412D9}\RP231\A0053871.dll
C:\System Volume Information\_restore{6FFEE529-CD0F-4985-9F69-867CFC1412D9}\RP231\A0053871.dll Deleted successfully!
Attempting to delete: C:\System Volume Information\_restore{6FFEE529-CD0F-4985-9F69-867CFC1412D9}\RP231\A0054145.dll
C:\System Volume Information\_restore{6FFEE529-CD0F-4985-9F69-867CFC1412D9}\RP231\A0054145.dll Deleted successfully!
Attempting to delete: C:\System Volume Information\_restore{6FFEE529-CD0F-4985-9F69-867CFC1412D9}\RP231\A0054212.dll
C:\System Volume Information\_restore{6FFEE529-CD0F-4985-9F69-867CFC1412D9}\RP231\A0054212.dll Deleted successfully!
Attempting to delete: C:\System Volume Information\_restore{6FFEE529-CD0F-4985-9F69-867CFC1412D9}\RP231\A0054216.dll
C:\System Volume Information\_restore{6FFEE529-CD0F-4985-9F69-867CFC1412D9}\RP231\A0054216.dll Deleted successfully!
Attempting to delete: C:\System Volume Information\_restore{6FFEE529-CD0F-4985-9F69-867CFC1412D9}\RP231\A0054246.dll
C:\System Volume Information\_restore{6FFEE529-CD0F-4985-9F69-867CFC1412D9}\RP231\A0054246.dll Deleted successfully!
Attempting to delete: C:\System Volume Information\_restore{6FFEE529-CD0F-4985-9F69-867CFC1412D9}\RP231\A0054286.dll
C:\System Volume Information\_restore{6FFEE529-CD0F-4985-9F69-867CFC1412D9}\RP231\A0054286.dll Deleted successfully!
Attempting to delete: C:\System Volume Information\_restore{6FFEE529-CD0F-4985-9F69-867CFC1412D9}\RP231\A0054322.dll
C:\System Volume Information\_restore{6FFEE529-CD0F-4985-9F69-867CFC1412D9}\RP231\A0054322.dll Deleted successfully!
Attempting to delete: C:\WINDOWS\system32\c600lgdm160a.dll
C:\WINDOWS\system32\c600lgdm160a.dll Deleted successfully!
Attempting to delete: C:\WINDOWS\system32\damstor.dll
C:\WINDOWS\system32\damstor.dll Deleted successfully!
Attempting to delete: C:\WINDOWS\system32\f42m0ef1eh2.dll
C:\WINDOWS\system32\f42m0ef1eh2.dll Deleted successfully!
Attempting to delete: C:\WINDOWS\system32\iWsnap.dll
C:\WINDOWS\system32\iWsnap.dll Deleted successfully!
Attempting to delete: C:\WINDOWS\system32\nemsmgr.dll
C:\WINDOWS\system32\nemsmgr.dll Deleted successfully!
Attempting to delete: C:\WINDOWS\system32\q686lgls16q6.dll
C:\WINDOWS\system32\q686lgls16q6.dll Deleted successfully!
Attempting to delete: C:\WINDOWS\system32\sunceng.dll
C:\WINDOWS\system32\sunceng.dll Deleted successfully!
Attempting to delete: C:\WINDOWS\system32\wvsdmoe2.dll
C:\WINDOWS\system32\wvsdmoe2.dll Deleted successfully!
Making registry repairs.
Removing: HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\ThemeManager
Removing: HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved "{7B723352-8C17-4DFE-9AA9-92E5C11B3C87}"
HKCR\Clsid\{7B723352-8C17-4DFE-9AA9-92E5C11B3C87}
Removing: HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved "{1196510C-D56C-4C48-AE74-69E56FD418B5}"
HKCR\Clsid\{1196510C-D56C-4C48-AE74-69E56FD418B5}
Removing: HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved "{CE8602F3-C9C3-40D7-BBD3-B7975A0E43EF}"
HKCR\Clsid\{CE8602F3-C9C3-40D7-BBD3-B7975A0E43EF}
Removing: HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved "{137F8D79-E6E7-4C0D-89CA-1AC0402CC3E4}"
HKCR\Clsid\{137F8D79-E6E7-4C0D-89CA-1AC0402CC3E4}
Removing: HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved "{5FE9A86D-35AD-4A4B-BE75-C9AB1DF41F0A}"
HKCR\Clsid\{5FE9A86D-35AD-4A4B-BE75-C9AB1DF41F0A}
Removing: HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved "{61EE45D9-D943-4A02-BB8C-140A4C933382}"
HKCR\Clsid\{61EE45D9-D943-4A02-BB8C-140A4C933382}
Removing: HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved "{A4B5D463-5F25-450D-9D3C-26A5E2D8FF37}"
HKCR\Clsid\{A4B5D463-5F25-450D-9D3C-26A5E2D8FF37}
Removing: HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved "{46184555-DF64-42E3-AEFF-10535491402C}"
HKCR\Clsid\{46184555-DF64-42E3-AEFF-10535491402C}
Removing: HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved "{6CCE4F9E-6804-496B-9DA8-332118B4E58B}"
HKCR\Clsid\{6CCE4F9E-6804-496B-9DA8-332118B4E58B}
Removing: HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved "{C8BB7E83-8DEE-41E2-B5BF-8AC3E803C7CA}"
HKCR\Clsid\{C8BB7E83-8DEE-41E2-B5BF-8AC3E803C7CA}
Removing: HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved "{06576AB3-BBF6-4BDC-B686-9A82FCCDEEC1}"
HKCR\Clsid\{06576AB3-BBF6-4BDC-B686-9A82FCCDEEC1}
Removing: HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved "{E25BC24C-1F6B-43B6-915C-D667CD26A98B}"
HKCR\Clsid\{E25BC24C-1F6B-43B6-915C-D667CD26A98B}
Removing: HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved "{D1A35914-EE4F-4960-BAB5-DD07FDFBFD13}"
HKCR\Clsid\{D1A35914-EE4F-4960-BAB5-DD07FDFBFD13}
Removing: HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved "{E905936B-51E1-45AF-BBA5-2EEA6063397A}"
HKCR\Clsid\{E905936B-51E1-45AF-BBA5-2EEA6063397A}
Removing: HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved "{C05CA745-CD10-43CC-9B8F-6FEDD3FCF01D}"
HKCR\Clsid\{C05CA745-CD10-43CC-9B8F-6FEDD3FCF01D}
Removing: HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved "{6FC0D949-209F-4699-8CC5-3170E67BBC5C}"
HKCR\Clsid\{6FC0D949-209F-4699-8CC5-3170E67BBC5C}
Removing: HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved "{BE2B052B-9D65-4A21-AF72-EDB1245CB1F5}"
HKCR\Clsid\{BE2B052B-9D65-4A21-AF72-EDB1245CB1F5}
Removing: HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved "{505699E6-22F2-4F21-9B20-5AA9E75528D7}"
HKCR\Clsid\{505699E6-22F2-4F21-9B20-5AA9E75528D7}
Removing: HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved "{5D6278D8-CB17-4630-9E40-83FBF277EBA5}"
HKCR\Clsid\{5D6278D8-CB17-4630-9E40-83FBF277EBA5}
Removing: HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved "{F9802C52-DB19-4028-AAF0-0C977B71A57B}"
HKCR\Clsid\{F9802C52-DB19-4028-AAF0-0C977B71A57B}
Removing: HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved "{DC07D292-53FF-45E9-A928-CCECA8C930AC}"
HKCR\Clsid\{DC07D292-53FF-45E9-A928-CCECA8C930AC}
Removing: HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved "{533B94CC-99CB-46A3-84EB-C167DB154CE1}"
HKCR\Clsid\{533B94CC-99CB-46A3-84EB-C167DB154CE1}
Removing: HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved "{3955D260-8064-48B6-B605-DA714AAE1224}"
HKCR\Clsid\{3955D260-8064-48B6-B605-DA714AAE1224}
Removing: HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved "{79EC1A7A-05FD-4461-B7A8-D74786B3FE51}"
HKCR\Clsid\{79EC1A7A-05FD-4461-B7A8-D74786B3FE51}
Removing: HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved "{C0D423A9-9B12-450D-8AD9-7F409C535C76}"
HKCR\Clsid\{C0D423A9-9B12-450D-8AD9-7F409C535C76}
Restoring Windows certificates.
Replaced hosts file with default windows hosts file
Restoring SeDebugPrivilege for Järjestelmänvalvojat - Succeeded
tuo löytyy koneelta niin scannaa se tuolla ja ilmoita tulos
w18f83c1.dll
http://www.virustotal.com/en/indexf.html
O8 - Extra context menu item: &Search - http://edits.mywebsearch.com/toolbaredits/menusearch.jh tml?p=ZCxdm342YYFI
O16 - DPF: RaptisoftGameLoader - http://www.miniclip.com/haphazard/raptisoftgameloader.c ab
O16 - DPF: {1D4DB7D2-6EC9-47A3-BD87-1E41684E07BB} - http://ak.exe.imgfarm.com/images/nocache/funwebproducts /ei/CursorManiaFWBInitialSetup1.0.0.15.cab
O16 - DPF: {288C5F13-7E52-4ADA-A32E-F5BF9D125F99} (CR64Loader Object) - http://www.miniclip.com/puzzlepirates/miniclipGameLoade r.dll
Käyn vielä huomenna illalla tutkailemassa tuota konetta ja pistän uutta logia, mutta ilmeisesti look2me-destroyer poisti pahimmat ongelmat. Konetta pystyy jopa käyttämään. Kiitos avusta!
Näemmä koneen tarkistus jää maanantaihin. Kone on kuulemma kuitenkin toiminut jo moitteetta.