Osaisiko joku auttaa epätoivoista? Koneelle hyökkäsi eilen jokin perhanan örkki (F-securen mukaan Backdoor.Win32.Rbot.gen) ja nyt masiina on käytännössä AIVAN JUMISSA. Lisäksi ruudulle hyppii pop-up(viestinvälityspalvelulta), jossa puhutaan jostain Critical erroreista ja käsketään mennä jollekin hämärälle nettisaitille lataamaan jotain kagaa.
Poistin koneelta ikivanhan F-securen (vikasietotilassa) ja yritin asentaa Avastia, jotta olisi saanut järjestelmän skannattua, muttei onnistunut. HTJ:n sain kuitenkin ajettua koneelle ja ohessa on sen tuottama lokitiedosto. Pystyisikö joku viisaampi tulkitsemaan sen sisältöä, koska itselleni tuo sekamelska ei sano mitään...
Logfile of HijackThis v1.99.1
Scan saved at 21:22:21, on 14.9.2006
Platform: Windows 2000 SP2 (WinNT 5.00.2195)
MSIE: Internet Explorer v6.00 (6.00.2600.0000)
Running processes:
C:\WINNT\System32\smss.exe
C:\WINNT\system32\csrss.exe
C:\WINNT\system32\winlogon.exe
C:\WINNT\system32\services.exe
C:\WINNT\system32\lsass.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\System32\WBEM\WinMgmt.exe
C:\WINNT\Explorer.EXE
C:\Program Files\Microsoft Office\Office\WINWORD.EXE
C:\HJT\HijackThis_v1.99.1.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.fi/
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Linkit
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: ST - {9394EDE7-C8B5-483E-8773-474BF36AF6E4} - C:\Program Files\MSN Apps\ST\01.03.0000.1005\en-xu\stmain.dll
O2 - BHO: MSNToolBandBHO - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Apps\MSN Toolbar\01.02.4000.1001\fi\msntb.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINNT\System32\msdxm.ocx
O3 - Toolbar: MSN - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Apps\MSN Toolbar\01.02.4000.1001\fi\msntb.dll
O4 - HKLM\..\Run: [Synchronization Manager] mobsync.exe /logon
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE NvQTwk,NvCplDaemon initialize
O4 - HKLM\..\Run: [NeroCheck] C:\WINNT\System32\NeroCheck.exe
O4 - HKLM\..\Run: [zBrowser Launcher] C:\Program Files\Logitech\iTouch\iTouch.exe
O4 - HKLM\..\Run: [EM_EXEC] C:\PROGRA~1\Logitech\MOUSEW~1\SYSTEM\EM_EXEC.EXE
O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINNT\System32\spool\drivers\w32x86\3\hpztsb03.exe
O4 - HKLM\..\Run: [Share-to-Web Namespace Daemon] C:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnd.exe
O4 - HKLM\..\Run: [CamMonitor] C:\Program Files\Hewlett-Packard\Digital Imaging\\Unload\hpqcmon.exe
O4 - HKLM\..\Run: [PE2CKFNT SE] C:\Program Files\Ulead Systems\Ulead Photo Express 2 SE\ChkFont.exe
O4 - HKLM\..\Run: [LoadQM] loadqm.exe
O4 - HKLM\..\Run: [msnappau] "C:\Program Files\MSN Apps\Updater\01.02.3000.1001\fi\msnappau.exe"
O4 - HKLM\..\Run: [Windows Network Firewall] C:\WINNT\System32\firewall.exe
O4 - HKLM\..\Run: [Microsoft (R) Windows Update Manager] C:\dihf.exe
O4 - HKCU\..\Run: [internat.exe] internat.exe
O4 - HKCU\..\Run: [Skype] "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O4 - Global Startup: Photo Express Calendar Checker SE.lnk = C:\Program Files\Ulead Systems\Ulead Photo Express 2 SE\CalCheck.exe
O4 - Global Startup: WinZip Quick Pick.lnk = C:\Program Files\WinZip\WZQKPICK.EXE
O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINNT\web\related.htm
O9 - Extra 'Tools' menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINNT\web\related.htm
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/msnmessengersetupdownloader.cab
O23 - Service: BackWeb Client - Unknown owner - C:\Program Files\F-Secure\BackWeb\BackWeb\Program\ServiceWrapper.exe (file missing)
O23 - Service: Loogisen levyn hallinnan valvontapalvelu (dmadmin) - VERITAS Software Corp. - C:\WINNT\System32\dmadmin.exe
O23 - Service: Windows Update Manager (UpdateManager) - Unknown owner - C:\dihf.exe
Poistin koneelta ikivanhan F-securen (vikasietotilassa) ja yritin asentaa Avastia, jotta olisi saanut järjestelmän skannattua, muttei onnistunut. HTJ:n sain kuitenkin ajettua koneelle ja ohessa on sen tuottama lokitiedosto. Pystyisikö joku viisaampi tulkitsemaan sen sisältöä, koska itselleni tuo sekamelska ei sano mitään...
Logfile of HijackThis v1.99.1
Scan saved at 21:22:21, on 14.9.2006
Platform: Windows 2000 SP2 (WinNT 5.00.2195)
MSIE: Internet Explorer v6.00 (6.00.2600.0000)
Running processes:
C:\WINNT\System32\smss.exe
C:\WINNT\system32\csrss.exe
C:\WINNT\system32\winlogon.exe
C:\WINNT\system32\services.exe
C:\WINNT\system32\lsass.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\System32\WBEM\WinMgmt.exe
C:\WINNT\Explorer.EXE
C:\Program Files\Microsoft Office\Office\WINWORD.EXE
C:\HJT\HijackThis_v1.99.1.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.fi/
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Linkit
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: ST - {9394EDE7-C8B5-483E-8773-474BF36AF6E4} - C:\Program Files\MSN Apps\ST\01.03.0000.1005\en-xu\stmain.dll
O2 - BHO: MSNToolBandBHO - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Apps\MSN Toolbar\01.02.4000.1001\fi\msntb.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINNT\System32\msdxm.ocx
O3 - Toolbar: MSN - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Apps\MSN Toolbar\01.02.4000.1001\fi\msntb.dll
O4 - HKLM\..\Run: [Synchronization Manager] mobsync.exe /logon
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE NvQTwk,NvCplDaemon initialize
O4 - HKLM\..\Run: [NeroCheck] C:\WINNT\System32\NeroCheck.exe
O4 - HKLM\..\Run: [zBrowser Launcher] C:\Program Files\Logitech\iTouch\iTouch.exe
O4 - HKLM\..\Run: [EM_EXEC] C:\PROGRA~1\Logitech\MOUSEW~1\SYSTEM\EM_EXEC.EXE
O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINNT\System32\spool\drivers\w32x86\3\hpztsb03.exe
O4 - HKLM\..\Run: [Share-to-Web Namespace Daemon] C:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnd.exe
O4 - HKLM\..\Run: [CamMonitor] C:\Program Files\Hewlett-Packard\Digital Imaging\\Unload\hpqcmon.exe
O4 - HKLM\..\Run: [PE2CKFNT SE] C:\Program Files\Ulead Systems\Ulead Photo Express 2 SE\ChkFont.exe
O4 - HKLM\..\Run: [LoadQM] loadqm.exe
O4 - HKLM\..\Run: [msnappau] "C:\Program Files\MSN Apps\Updater\01.02.3000.1001\fi\msnappau.exe"
O4 - HKLM\..\Run: [Windows Network Firewall] C:\WINNT\System32\firewall.exe
O4 - HKLM\..\Run: [Microsoft (R) Windows Update Manager] C:\dihf.exe
O4 - HKCU\..\Run: [internat.exe] internat.exe
O4 - HKCU\..\Run: [Skype] "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O4 - Global Startup: Photo Express Calendar Checker SE.lnk = C:\Program Files\Ulead Systems\Ulead Photo Express 2 SE\CalCheck.exe
O4 - Global Startup: WinZip Quick Pick.lnk = C:\Program Files\WinZip\WZQKPICK.EXE
O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINNT\web\related.htm
O9 - Extra 'Tools' menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINNT\web\related.htm
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/msnmessengersetupdownloader.cab
O23 - Service: BackWeb Client - Unknown owner - C:\Program Files\F-Secure\BackWeb\BackWeb\Program\ServiceWrapper.exe (file missing)
O23 - Service: Loogisen levyn hallinnan valvontapalvelu (dmadmin) - VERITAS Software Corp. - C:\WINNT\System32\dmadmin.exe
O23 - Service: Windows Update Manager (UpdateManager) - Unknown owner - C:\dihf.exe
Vastaukset 51
Vanhimmat
Oletkos ottanut vikasiedossa tämän
scannaa hjt:llä merkkaa ja paina Fix checked
O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINNT\web\related.htm
O9 - Extra 'Tools' menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINNT\web\related.htm
mene vikasietotilaan
sammuta ja käynnistä
käynnistyksenyhteydessä naputtele F8
valitse nuoli näppäimellä vikasietotila
paina Enter ja uudelleen Enter OK
Poista siellä
C:\WINNT\web\---> related.htm Piilota suojatut käyttöjärjestelmätiedostot
* Klikkaa Kyllä varmistaaksesi muutokset.
* Klikkaa OK.
Pistä taas sitten piilotidostot pois näkyvistä
hommelin jälkeen
Takasin normaaliin tilaan
------------------------------
Lataa tuolta
http://koti.mbnet.fi/pattaya1/escanmwav.htm
asenna, päivitä tapa2, laita täpit merkkauksien mukaan.
Scannaa
jos alaikkunaan virukset tulee jotain laita loki tänne.
kopioi se näin:
Käytä komentoa Ctrl A.
Kopioi rivit komennolla Ctrl C.
Liitä rivit komennolla Ctrl V.
laita sitten uusi hjt-loki myös.
Loki on tosiaan ajettu vikasietotilassa. Onko tällä merkitystä, eli kannattaisiko ajaa vielä normaali tilassakin?
se kertoo paljon enenmän kuin vikasiedossa ajettu.
aina normaalitilassa tuo hjt-loki
tuossa ei näy sulla edes tuota virustorjuntaa eikä palomuuria.
Logfile of HijackThis v1.99.1
Scan saved at 22:09:11, on 14.9.2006
Platform: Windows 2000 SP2 (WinNT 5.00.2195)
MSIE: Internet Explorer v6.00 (6.00.2600.0000)
Running processes:
C:\WINNT\System32\smss.exe
C:\WINNT\system32\winlogon.exe
C:\WINNT\system32\services.exe
C:\WINNT\system32\lsass.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\system32\spoolsv.exe
C:\WINNT\System32\svchost.exe
C:\WINNT\system32\regsvc.exe
C:\WINNT\system32\MSTask.exe
C:\WINNT\system32\stisvc.exe
C:\dihf.exe
C:\WINNT\System32\WBEM\WinMgmt.exe
C:\WINNT\Explorer.EXE
C:\Program Files\Logitech\iTouch\iTouch.exe
C:\PROGRA~1\Logitech\MOUSEW~1\SYSTEM\EM_EXEC.EXE
C:\WINNT\System32\spool\drivers\w32x86\3\hpztsb03.exe
C:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnd.exe
C:\Program Files\Hewlett-Packard\Digital Imaging\Unload\hpqcmon.exe
C:\Program Files\Ulead Systems\Ulead Photo Express 2 SE\ChkFont.exe
C:\WINNT\loadqm.exe
C:\Program Files\MSN Apps\Updater\01.02.3000.1001\fi\msnappau.exe
C:\WINNT\System32\firewall.exe
C:\WINNT\System32\internat.exe
C:\Program Files\Skype\Phone\Skype.exe
C:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnf.exe
C:\Program Files\Ulead Systems\Ulead Photo Express 2 SE\CalCheck.exe
C:\Program Files\WinZip\WZQKPICK.EXE
C:\HJT\HijackThis_v1.99.1.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.fi/
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Linkit
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: ST - {9394EDE7-C8B5-483E-8773-474BF36AF6E4} - C:\Program Files\MSN Apps\ST\01.03.0000.1005\en-xu\stmain.dll
O2 - BHO: MSNToolBandBHO - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Apps\MSN Toolbar\01.02.4000.1001\fi\msntb.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINNT\System32\msdxm.ocx
O3 - Toolbar: MSN - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Apps\MSN Toolbar\01.02.4000.1001\fi\msntb.dll
O4 - HKLM\..\Run: [Synchronization Manager] mobsync.exe /logon
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE NvQTwk,NvCplDaemon initialize
O4 - HKLM\..\Run: [NeroCheck] C:\WINNT\System32\NeroCheck.exe
O4 - HKLM\..\Run: [zBrowser Launcher] C:\Program Files\Logitech\iTouch\iTouch.exe
O4 - HKLM\..\Run: [EM_EXEC] C:\PROGRA~1\Logitech\MOUSEW~1\SYSTEM\EM_EXEC.EXE
O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINNT\System32\spool\drivers\w32x86\3\hpztsb03.exe
O4 - HKLM\..\Run: [Share-to-Web Namespace Daemon] C:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnd.exe
O4 - HKLM\..\Run: [CamMonitor] C:\Program Files\Hewlett-Packard\Digital Imaging\\Unload\hpqcmon.exe
O4 - HKLM\..\Run: [PE2CKFNT SE] C:\Program Files\Ulead Systems\Ulead Photo Express 2 SE\ChkFont.exe
O4 - HKLM\..\Run: [LoadQM] loadqm.exe
O4 - HKLM\..\Run: [msnappau] "C:\Program Files\MSN Apps\Updater\01.02.3000.1001\fi\msnappau.exe"
O4 - HKLM\..\Run: [Windows Network Firewall] C:\WINNT\System32\firewall.exe
O4 - HKLM\..\Run: [Microsoft (R) Windows Update Manager] C:\dihf.exe
O4 - HKCU\..\Run: [internat.exe] internat.exe
O4 - HKCU\..\Run: [Skype] "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O4 - Global Startup: Photo Express Calendar Checker SE.lnk = C:\Program Files\Ulead Systems\Ulead Photo Express 2 SE\CalCheck.exe
O4 - Global Startup: WinZip Quick Pick.lnk = C:\Program Files\WinZip\WZQKPICK.EXE
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/msnmessengersetupdownloader.cab
O23 - Service: BackWeb Client - Unknown owner - C:\Program Files\F-Secure\BackWeb\BackWeb\Program\ServiceWrapper.exe (file missing)
O23 - Service: Loogisen levyn hallinnan valvontapalvelu (dmadmin) - VERITAS Software Corp. - C:\WINNT\System32\dmadmin.exe
O23 - Service: Windows Update Manager (UpdateManager) - Unknown owner - C:\dihf.exe
Virustorjunta ja palomuuri softa.
sitten ajat tuon.
http://keskustelu.suomi24.fi/show.fcgi?category=108&conference=4500000000000628&posting=22000000019531190
lataa http://downloads.andymanchesta.com/RemovalTools/SDFix.zip
a tallenna se työpöydällesi.
Käynnistä koneesi vikasietotilaan ja valitse tavallinen käyttäjätilisi:
• Käynnistä tietokone
• Kun kuulet koneen piippaavan, paina F8, kuitenkin ennen Windowsin logon esiintuloa
• Seuraavaksi pitäisi ilmestyä valikko
• Valitse valikosta vikasietotila.
• Kun vikasietotilassa, pura tiedoston SDFix.zip sisältö (SDFix kansio) työpöydällesi. Työpöydälle pitäisi ilmestyä kansio nimeltä SDFix.
• Avaa SDFix-kansio ja tuplaklikkaa tiedostoa RunThis.bat käynnistääksesi ohjelman.
• Paina Y käynnistääksesi skriptin.
• Työkalu puhdistaa troijalaisen palvelut ja tekee myös joitakin korjauksia rekisteriin. Lopuksi se pyytää käynnistämään koneen uudelleen, "Press any key to Reboot".
• Paina mitä tahansa näppäintä ja kone käynnistyy uudelleen.
• Käynnistyminen kestää normaalia kauemmin sillä SDFix puhdistaa konetta.
• Kun kone on käynnistynyt ja työpöytä latautunut, SDFix kertoo että puhdistus on suoritettu, "Finished".
• Paina sitten mitä tahansa näppäintä sulkeaksesi skriptin ja ladataksesi pikakuvakkeet työpöydälle.
• Lopuksi avaa SDFix kansio (työpöydällä) ja kopioi & liitä tiedoston Report.txt sisältö viestiketjuusi uuden HijackThis lokin kera.
Osaatko sanoa, kuinka kauan koneen uudelleen käynnistymisen pitäisi suunnileen kestää, kun sdfix on ajettu? Nyt masiina on raksuttanut samassa tilassa (Checking for Malware files) jo reilut puoli tuntia. Onko homma jämähtänyt vai odotellaanko vain kärsivällisesti?
jollain se kone pitää saada aukastua.
Niin muutas toi nimi tuossa.
C:\HJT\HijackThis_v1.99.1.exe
Antaa sdfixin ruksuttaa. Jos tässä ei ihan lähihetkinä tapahdu mitään edistystä, painun pehkuihin ja palaan asiaan uudella tarmolla huomenissa. Kiitokset joka tapauksessa avustasi tähän asti!
tavaraa siellä koneella?
ajoin ite tuon lävitse hetki sitten ei mennyt kauvaan.
----------------------------------
tolla vois myös sekata koneen.
Lataa http://siri.urz.free.fr/Fix/SmitfraudFix.zip
Pura sisältö (kansio nimeltä SmitfraudFix työpöydällesi:
Avaa SmitfraudFix kansio ja tupla-klikkaa smitfraudfix.cmd
Valitse optio #1 - Search kirjoittamalla 1 ja painamalla Enter; tekstitiedosto avautuu, joka listaa tarttuneet tiedostot (jos olemassa).
Postita tämän tekstitiedoston sisältö viestiketjuusi.
Huomaa: process.exe filun tunnistaa jotkut Anti-virus ohjelmat (AntiVir, Dr.Web, Kaspersky) "Haittakaluna"; se ei ole virus, vaan ohjelma joka pysäyttää prosesseja. A/V ohjelmat eivät pysty tunnistamaan hyvän ja pahan käytön tälläisten ohjelmian väliltä, silloin ne saattavat varoittaa käyttäjää.
http://www.beyondlogic.org/consulting/processutil/processutil.htm
Oikeastaan vaan Office ja kuvankäsittelyohjelmia (kameran mukana tulleita) tiedostoja (lähinnä digikuvia) muutama giga. Kyseessä on tyttöystävän kone joten ihan tarkkaan en osaa tällä hetkellä sanoa, mitä se on syönyt. Ilmeisesti siis jotain hämärää tässä on, koska ei tuo ole vieläkään suostunut käynnistymään, sama ilmoitus edelleen ruudulla.
vikasietotilaan sitten kpurit sen ohjelman ja käynnistit.
kone sammui ja lähti taas normaaliintilaan
nyt ei näy työpöydällä muuta kuin se ikkuna ja siinäö teksti punaisella se on nyt siis tässä vaiheessa tällä hetkellä vai.
Hmmmm... oliswkohan se mennyt tiltiin tai sitten siellä on tulossa pitkä raportti lista mites prosesorin valo palaako tai vilkutteleeko se.
...homma eteni ja tilanne on nyt tuollainen kuin viestissäsi sanoit. Prosessorin valo palaa, mutta kiintolevyn valo ei ja muutenkin tuntuu aika hiljaiselta (ei kuulu mitään raksutusta). Vaikuttaa siltä, että tiltissä on. Tiimalasi on näkyvissä, kun hiiren osoittimen vie ulos ikkunasta.
Hmmmm johan rupesi kirjaimetkin menemään sekasin.
Oliskohan se mennyt tiltiin.
täytyy kai tässä kohta mennä sinne unille.
taitaa olla parasta kohta antaa sille koneelle kylmää nuijaa. Eli Virrat poikki vain kytkimestä
katsoa mitä SmitfraudFix kertoo.
sitten vain fixsailaan noita hjt-lokin näyttämiä örkkeja. Ja uutta yritystä taas noilla toisilla Fixseillä.
Tekisi mieli antaa ihan konkreettisestikin nuijaa tuolle toosalle. Laitetaan virrat poikki ja huomenna uusi yritys. Kiitokset ja hyvät yöt!
C:\dihf.exe on virus, poista se.
firewall.exe myös pois.
Älähän jännitä vielä
katotaas kun se ajaa tuon fixsin lävitse nähdään vielä poistetavat.
tuolta.
http://www.download.fi/tyopoytaohjelmat/haittaohjelmien_poisto/avast4home.cfm
sitten avasti pitää rekisteröidä
scannaa hjt:llä merkkaa ja paina Fix checked
O23 - Service: BackWeb Client - Unknown owner - C:\Program Files\F-Secure\BackWeb\BackWeb\Program\ServiceWrapper.exe (file missing)
kirjoita suorita luukkuun services.msc
sitten katso mitkä kertoo f-securesta jotain että ovat ei käytössä
jos joku ei ole ei käytössä niin klikkaa seis ja alasvetovalikosta ei käytössä käytä ja ok
Kiitoksia isosti jo tässä vaiheessa avustasi!
Tilanne on nyt se, että ongelmakoneella oli ikivanha F-secure, jonka poistin, jotta saisin asennettua Avastin tilalle. Jostain syystä kone ei suostu kuitenkaan tällä hetkellä asentamaan Avastia eikä myöskään palomuuriohjelmaa (Kerio), jotka latasin aiemmin päivällä tikulle työkoneella. Eli nyt siis virustorjuntaa/palomuuria ei ole lainkaan.
Myös aiemmassa viestissäsi mainitun escanin kanssa on ongelmia, eli se ei suostunut käynnistymään. Ilmoitti jostain virheellisestä päivämäärästä. Päivitysten hakukin muodostaa ongelman, koska tällä hetkellä koneessa ei siis ole palomuuria käytössä -> uskaltaako nettiin mennä? Tätä muuten kirjoitellaan läppärillä, eli olisiko sitä mahdollisuus hyödyntää päivitysten haussa? Läppäri on tyttöystävän työkone, joten en tiedä uskaltaako/voiko siihen asentaa escania.
SDfix on tällä hetkellä käynnissä, tai siis skripti on ajettu vikasietotilassa, mutta kone ei ole vielä uudelleen käynnistynyt (Checking for malware Files: Please wait...)
nettiin missä ei ole virus torjuntaa eikä palomuuria . no se fixsi siis on menossa lävitse kun se on mennyt niin laita uusi hjt-loki tänne.
----------------
Niin, olis tuossa toinen scanneri.
Jos kerran escannia herjaa.
Tallenna nämä ohjeet tekstitiedostoon tai tulosta nämä, muuten et pääse niihin käsiksi vikasietotilasta
Lataa http://www.ewido.net/en/download/ ja tallenna ohjelma työpöydällesi.
• Kun olet ladannut ohjelman, kaksoisklikkaa asennuohjelman pikakuvaketta työpöydälläsi, asennus alkaa.
• Asennuksen jälkeen täytyy ohjelma käynnistää ja sen tunnisteet päivittää.
• Käynnistä Ewido Anti-Spyware.
• Klikkaa "Update" kuvaketta päävalikossa. Sen jälkeen klikkaa "Update now" painiketta.
• Sitten klikkaa "Start Update" kuvaketta jolloin päivitys alkaa.
• Kun päivitykset on ladattu, klikkaa "Scanner" kuvaketta ikkunan ylälaidassa. Valitse sitten "Settings" välilehti.
• Kun "Settings" valikko on auennut, klikkaa "Recommended actions" ja sitten valitse "Quarantine".
• Sitten "Reports" valikon alta:
• Laita täppi kohtaan "Automatically generate report after every scan"
• Ota täppi pois kohdasta"Only if threats were found"
• Sulje ohjelma, ÄLÄ skannaa vielä.
Käynnistä koneesi vikasietotilaan
sammuta ja käynnistä
käynnistyksenyhteydessä naputtele F8
valitse nuoli näppäimellä vikasietotila
paina Enter ja uudelleen Enter OK
HUOM! Älä käytä muita ohjelmia Ewidon skannauksen aikana, tämä saattaa häiritä skannausta.
• Kun vikasietotilassa, käynnistä Ewido Anti-Spyware.
• Klikkaa "Scanner" kuvaketta ikkunan ylälaidassa ja valitse "Scan" välilehti. Sitten klikkaa "Complete System Scan".
• Ewido aloittaa nyt tietokoneen skannaamisen, ole kärsivällinen sillä skannaus vie aikaa.
Kun skannaus on valmis:
TÄRKEÄÄ : Älä klikkaa "Save Scan Report" ennen kuin klikkaat "Apply all Actions"
• Varmistu, että Set all elements to: näyttää Quarantine (1), jos ei, klikkaa linkkiä ja valitse Quarantine popup-valikosta.
• Sinulta kysytään mitä tehdä jos infektioita löytyi, valitse silloin "Apply all actions"
• Sitten klikkaa "Reports" kuvaketta ohjelma yläosasta.
• Klikkaa "Save report as" painiketta ikkunan vasemmassa alalaidassa ja tallenna raportti työpöydälle.
• Sulje ohjelma, käynnistä kone normaalisti ja lähetä Ewidon raportti viestikejuusi.
scannaa hjt-llä merkkaa ja paina fix checked
O4 - HKLM\..\Run: [Windows Network Firewall] C:\WINNT\System32\firewall.exe
O4 - HKLM\..\Run: [Microsoft (R) Windows Update Manager] C:\dihf.exe
O23 - Service: BackWeb Client - Unknown owner - C:\Program Files\F-Secure\BackWeb\BackWeb\Program\ServiceWrapper.exe (file missing)
O23 - Service: Windows Update Manager (UpdateManager) - Unknown owner - C:\dihf.exe
Kirjoita suorita luukkuun rivien jälkeen paina enter
sc stop UpdateManager
sc delete UpdateManager
Mene vikasietotilaan poista sieltä
C:\WINNT\System32\----> firewall.exe dihf.exe F-Secure
No niin, homma etenee, tai miten sen nyt ottaa... Tämänhetkinen tilanne:
Smitfraudfix ei suostunut tekemään skannausta. Näytti käynnistyvän (ikkuna aukesi ja valitsin 1 - search -> enter), mutta mitään ei tapahtunut -> ei lokia.
Ewido ei suostunut käynnistymään vikasiedossa, mutta normaalitilassa kylläkin. Raportti siitä on erillisessä viestissä.
"Poistelen vain" ohjeiden mukaiset tiedostot on poistettu, paitsi firewall.exe, jota en löytänyt kiintolevyltä.
Viimeiseksi on vielä ajettu hjt-loki, joka on myös omassa viestissään.
Kaikenkaikkiaan kone tuntuu edelleen olevan aika jumissa. Kerio ei suostu asentumaan -> ei palomuuria. Avast ei suostu asentumaan -> ei virustorjuntaa. Avastin asennusvaiheessa antama virheloki on myös omassa viestissään, jos joku osaa tulkita sitä.
Tällä hetkellä kaikki apu otetaan enemmän kuin kiitollisena vastaan, sillä omin neuvoin en tunnu tässä eteenpäin pääsevän.
---------------------------------------------------------
ewido anti-spyware - Scan Report
---------------------------------------------------------
Created at: 20:40:09 15.9.2006
Scan result:
C:\WINNT\system32\firewall.exe -> Dropper.Paradrop.a : Cleaned with backup (quarantined).
C:\WINNT\system32\ufzutt.exe -> Dropper.Paradrop.a : Cleaned with backup (quarantined).
C:\WINNT\system32\wpcyftzi.exe -> Dropper.Paradrop.a : Cleaned with backup (quarantined).
C:\Documents and Settings\Himberg\Cookies\himberg@2o7[1].txt -> TrackingCookie.2o7 : Cleaned with backup (quarantined).
C:\Documents and Settings\Himberg\Cookies\himberg@advertising[2].txt -> TrackingCookie.Advertising : Cleaned with backup (quarantined).
C:\Documents and Settings\Himberg\Cookies\[email protected][1].txt -> TrackingCookie.Coremetrics : Cleaned with backup (quarantined).
C:\Documents and Settings\Himberg\Cookies\himberg@doubleclick[2].txt -> TrackingCookie.Doubleclick : Cleaned with backup (quarantined).
C:\Documents and Settings\Himberg\Cookies\[email protected][1].txt -> TrackingCookie.Specificclick : Cleaned with backup (quarantined).
::Report end
Logfile of HijackThis v1.99.1
Scan saved at 20:45:19, on 15.9.2006
Platform: Windows 2000 SP2 (WinNT 5.00.2195)
MSIE: Internet Explorer v6.00 (6.00.2600.0000)
Running processes:
C:\WINNT\System32\smss.exe
C:\WINNT\system32\winlogon.exe
C:\WINNT\system32\services.exe
C:\WINNT\system32\lsass.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\system32\spoolsv.exe
C:\WINNT\System32\svchost.exe
C:\WINNT\system32\regsvc.exe
C:\WINNT\system32\MSTask.exe
C:\WINNT\system32\stisvc.exe
C:\WINNT\System32\WBEM\WinMgmt.exe
C:\WINNT\Explorer.EXE
C:\Program Files\Logitech\iTouch\iTouch.exe
C:\PROGRA~1\Logitech\MOUSEW~1\SYSTEM\EM_EXEC.EXE
C:\WINNT\System32\spool\drivers\w32x86\3\hpztsb03.exe
C:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnd.exe
C:\Program Files\Hewlett-Packard\Digital Imaging\Unload\hpqcmon.exe
C:\Program Files\Ulead Systems\Ulead Photo Express 2 SE\ChkFont.exe
C:\WINNT\loadqm.exe
C:\Program Files\MSN Apps\Updater\01.02.3000.1001\fi\msnappau.exe
C:\Program Files\ewido anti-spyware 4.0\ewido.exe
C:\WINNT\System32\internat.exe
C:\Program Files\Skype\Phone\Skype.exe
C:\Program Files\Ulead Systems\Ulead Photo Express 2 SE\CalCheck.exe
C:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnf.exe
C:\Program Files\WinZip\WZQKPICK.EXE
C:\HJT\Skanneri.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.fi/
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Linkit
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: ST - {9394EDE7-C8B5-483E-8773-474BF36AF6E4} - C:\Program Files\MSN Apps\ST\01.03.0000.1005\en-xu\stmain.dll
O2 - BHO: MSNToolBandBHO - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Apps\MSN Toolbar\01.02.4000.1001\fi\msntb.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINNT\System32\msdxm.ocx
O3 - Toolbar: MSN - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Apps\MSN Toolbar\01.02.4000.1001\fi\msntb.dll
O4 - HKLM\..\Run: [Synchronization Manager] mobsync.exe /logon
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE NvQTwk,NvCplDaemon initialize
O4 - HKLM\..\Run: [NeroCheck] C:\WINNT\System32\NeroCheck.exe
O4 - HKLM\..\Run: [zBrowser Launcher] C:\Program Files\Logitech\iTouch\iTouch.exe
O4 - HKLM\..\Run: [EM_EXEC] C:\PROGRA~1\Logitech\MOUSEW~1\SYSTEM\EM_EXEC.EXE
O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINNT\System32\spool\drivers\w32x86\3\hpztsb03.exe
O4 - HKLM\..\Run: [Share-to-Web Namespace Daemon] C:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnd.exe
O4 - HKLM\..\Run: [CamMonitor] C:\Program Files\Hewlett-Packard\Digital Imaging\\Unload\hpqcmon.exe
O4 - HKLM\..\Run: [PE2CKFNT SE] C:\Program Files\Ulead Systems\Ulead Photo Express 2 SE\ChkFont.exe
O4 - HKLM\..\Run: [LoadQM] loadqm.exe
O4 - HKLM\..\Run: [msnappau] "C:\Program Files\MSN Apps\Updater\01.02.3000.1001\fi\msnappau.exe"
O4 - HKLM\..\Run: [!ewido] "C:\Program Files\ewido anti-spyware 4.0\ewido.exe" /minimized
O4 - HKCU\..\Run: [internat.exe] internat.exe
O4 - HKCU\..\Run: [Skype] "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O4 - Global Startup: Photo Express Calendar Checker SE.lnk = C:\Program Files\Ulead Systems\Ulead Photo Express 2 SE\CalCheck.exe
O4 - Global Startup: WinZip Quick Pick.lnk = C:\Program Files\WinZip\WZQKPICK.EXE
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/msnmessengersetupdownloader.cab
O23 - Service: Loogisen levyn hallinnan valvontapalvelu (dmadmin) - VERITAS Software Corp. - C:\WINNT\System32\dmadmin.exe
15.09.2006 20:42:49 general: Started: 15.09.2006, 20:42:49
15.09.2006 20:42:49 general: Running setup_av_pro-367 (871)
15.09.2006 20:42:49 system: Operating system: Windows2000 ver 5.0, build 2195, sp 2.0 [Service Pack 2]
15.09.2006 20:42:49 system: Computer WinName: HIMBERG-TUGHAXA
15.09.2006 20:42:49 system: Windows Net User: HIMBERG-TUGHAXA\Himberg
15.09.2006 20:42:49 general: Cmdline:
15.09.2006 20:42:49 general: Old version: ffffffff (-1)
15.09.2006 20:42:49 general: Install check: SetupVersion does NOT exist
15.09.2006 20:42:49 general: SGW32P::CheckIfInstalled set m_bAlreadyInstalled to 0
15.09.2006 20:42:49 general: DldSrc set to inet
15.09.2006 20:42:50 system: Computer DnsName: himberg-tughaxa
15.09.2006 20:42:50 system: Computer Ip Addr: 127.0.0.1
15.09.2006 20:42:50 registry: Get registry: Software\Microsoft\Internet Explorer\Version=6.0.2600.0000
15.09.2006 20:42:50 general: Operation set to INST_OP_INSTALL
15.09.2006 20:42:50 general: GUID: dc0a9da5-2b47-4d9c-bbfe-3fa78025c89a
15.09.2006 20:42:50 general: Default server pseudo definition loaded as ''.
15.09.2006 20:42:50 general: SelectCurrent: selected server 'FailSafeServer' from 'main'
15.09.2006 20:42:50 package: GetPackages - set proxy for inet
15.09.2006 20:42:50 internet: SYNCER: Type: use IE settings
15.09.2006 20:42:50 internet: SYNCER: Auth: another authentication, use WinInet
15.09.2006 20:42:50 general: Entered SetupProcessPro::Do( INST_OP_INSTALL )
15.09.2006 20:42:50 general: Entered SetupProcessWin32Avast::Do( INST_OP_INSTALL )
15.09.2006 20:42:50 general: Entered SetupProcessWin32::Do( INST_OP_INSTALL )
15.09.2006 20:42:50 general: Entered SetupProcess::Do( INST_OP_INSTALL )
15.09.2006 20:43:06 internet: SYNCER: Type: use IE settings
15.09.2006 20:43:06 internet: SYNCER: Auth: another authentication, use WinInet
15.09.2006 20:43:07 general: progress thread start
15.09.2006 20:43:07 general: progress start - 1
15.09.2006 20:43:07 general: compatCopyFile( \servers.def.vpu, C:\DOCUME~1\Himberg\LOCALS~1\Temp\_av_proI.tm~a01200\onefile ) failed with error 0x00000002
15.09.2006 20:43:07 general: InvalidateCurrent: invalidated server 'FailSafeServer' from 'main'
15.09.2006 20:43:07 general: SelectCurrent: unable to find any suitable server in 'main'
15.09.2006 20:43:07 internet: while trying to get file 'servers.def.vpu', error 0x00000002 has occured, try 1
15.09.2006 20:43:07 internet: tried 1 servers to get file 'servers.def.vpu', but failed (0x00000002)
15.09.2006 20:43:07 file: GetNewerStampedFile:GetFileWithRetry failed: C:\DOCUME~1\Himberg\LOCALS~1\Temp\_av_proI.tm~a01200\onefile, servers.def.vpu, error: 0x00000002
15.09.2006 20:43:07 package: Download servers.def, servers.def.vpu failed with error 0x20000011.
15.09.2006 20:43:07 general: compatCopyFile( \servers.def, C:\DOCUME~1\Himberg\LOCALS~1\Temp\_av_proI.tm~a01200\onefile ) failed with error 0x00000002
15.09.2006 20:43:07 general: InvalidateCurrent: invalidated server 'FailSafeServer' from 'main'
15.09.2006 20:43:07 general: SelectCurrent: unable to find any suitable server in 'main'
15.09.2006 20:43:07 internet: while trying to get file 'servers.def', error 0x00000002 has occured, try 1
15.09.2006 20:43:07 internet: tried 1 servers to get file 'servers.def', but failed (0x00000002)
15.09.2006 20:43:07 file: GetNewerStampedFile:GetFileWithRetry failed: C:\DOCUME~1\Himberg\LOCALS~1\Temp\_av_proI.tm~a01200\onefile, servers.def, error: 0x00000002
15.09.2006 20:43:07 package: Tried to download servers.def but failed with error 0x00000002.
15.09.2006 20:43:07 general: progress end - 0
15.09.2006 20:43:07 general: progress thread end
15.09.2006 20:43:07 general: InvalidateCurrent: invalidated server 'FailSafeServer' from 'main'
15.09.2006 20:43:07 general: SelectCurrent: unable to find any suitable server in 'main'
15.09.2006 20:43:07 internet: SYNCER: Type: Invalid
15.09.2006 20:43:07 internet: SYNCER: Auth: no authentication
15.09.2006 20:43:07 general: SelectCurrent: unable to find any suitable server in 'main'
15.09.2006 20:43:07 general: progress end - forced
15.09.2006 20:43:07 general: progress thread end
http://www.download.fi/tyopoytaohjelmat/haittaohjelmien_poisto/ccleaner.cfm
asenna
aja Puhdistaja ja virheet
Ccleanerissa on nyt ajettu puhdistaja ja korjattu rekisterin virheet. Onessa on poistettujen tiedostojen lista, jos siitä on jotain apua. Toiminta takkuaa edelleen, Avastia tai Keriota ei saa asennettua eikä Smitfraudia ajettua.
Puhdistus valmis - (4,778 sekuntia)
------------------------------------------------------------------------------------------
1 206,1Mt poistettu
------------------------------------------------------------------------------------------
Lista poistetuista tiedostoista
------------------------------------------------------------------------------------------
IE tilapäistiedostot (133 tiedosto(a)) 0,14Mt
Cookie:[email protected]/(&H100001) 93 tavua
Cookie:[email protected]/(&H100001) 169 tavua
Cookie:[email protected]/(&H100001) 96 tavua
Cookie:[email protected]/(&H100001) 80 tavua
Cookie:[email protected]/(&H100001) 100 tavua
Cookie:[email protected]/(&H100001) 67 tavua
Cookie:[email protected]/(&H100001) 79 tavua
Cookie:[email protected]/(&H100001) 83 tavua
Cookie:[email protected]/(&H100001) 101 tavua
Cookie:[email protected]/(&H100001) 179 tavua
Cookie:[email protected]/(&H100001) 85 tavua
Cookie:[email protected]/(&H100001) 111 tavua
Cookie:[email protected]/(&H100001) 98 tavua
Cookie:[email protected]/(&H100001) 243 tavua
Cookie:[email protected]/(&H100001) 127 tavua
Cookie:[email protected]/(&H100001) 97 tavua
Cookie:[email protected]/(&H100001) 119 tavua
Cookie:[email protected]/(&H100001) 82 tavua
Cookie:[email protected]/(&H100001) 70 tavua
Cookie:[email protected]/(&H100001) 80 tavua
Cookie:[email protected]/(&H100001) 191 tavua
Cookie:[email protected]/(&H100001) 91 tavua
Cookie:[email protected]/(&H100001) 186 tavua
Cookie:[email protected]/(&H100001) 183 tavua
Cookie:[email protected]/(&H100001) 680 tavua
Cookie:[email protected]/(&H100001) 95 tavua
Cookie:[email protected]/(&H100001) 316 tavua
Cookie:[email protected]/(&H100001) 549 tavua
Cookie:[email protected]/cgi-bin(&H100001) 97 tavua
Cookie:[email protected]/(&H100001) 522 tavua
Cookie:[email protected]/(&H100001) 130 tavua
Cookie:[email protected]/(&H100001) 325 tavua
Cookie:[email protected]/(&H100001) 131 tavua
Cookie:[email protected]/(&H100001) 428 tavua
Cookie:[email protected]/(&H100001) 331 tavua
Cookie:[email protected]/(&H100001) 91 tavua
Cookie:[email protected]/(&H100001) 128 tavua
Merkitty poistettavaksi: C:\Documents and Settings\Himberg\Local Settings\Temporary Internet Files\Content.IE5\index.dat
Merkitty poistettavaksi: C:\Documents and Settings\Himberg\Cookies\index.dat
Roskakorista poistettu (3 tiedosto(a)) 1,89Mt
C:\WINNT\TEMP\08.wav 36,3Mt
C:\WINNT\TEMP\HP Configure - 5_14_2002 18_35_2.txt 452 tavua
C:\WINNT\TEMP\HP Configure - 5_14_2002 18_57_15.txt 452 tavua
C:\WINNT\TEMP\HP000000.IDX 53 tavua
C:\WINNT\TEMP\HP000001.PDL 7,19Kt
C:\WINNT\TEMP\HP000002.PDL 7,19Kt
C:\WINNT\TEMP\HP001000.IDX 53 tavua
C:\WINNT\TEMP\HP002000.IDX 53 tavua
C:\WINNT\TEMP\HP003000.IDX 53 tavua
C:\WINNT\TEMP\hpfpdi00.log 377 tavua
C:\WINNT\TEMP\hpzcoi00.log 596 tavua
C:\WINNT\TEMP\hpzcoi01.log 596 tavua
C:\WINNT\TEMP\hpzcoi02.log 596 tavua
C:\WINNT\TEMP\hpzcoi03.log 1019 tavua
C:\WINNT\TEMP\hpzghoul00.log 411 tavua
C:\WINNT\TEMP\hpzghoul01.log 411 tavua
C:\WINNT\TEMP\hpzglue00.log 2,73Kt
C:\WINNT\TEMP\hpzpin00.log 345 tavua
C:\WINNT\TEMP\IadHide.dll 24,00Kt
C:\WINNT\TEMP\OLD32.tmp 0,78Mt
C:\WINNT\TEMP\OLD73.tmp 33,66Kt
C:\WINNT\TEMP\TempFolder.aaa\dirapi.dll 0,90Mt
C:\WINNT\TEMP\TempFolder.aaa\dirapi.mch 408 tavua
C:\WINNT\TEMP\TempFolder.aaa\iml32.dll 0,36Mt
C:\WINNT\TEMP\TempFolder.aab\dirapi.dll 0,90Mt
C:\WINNT\TEMP\TempFolder.aab\dirapi.mch 408 tavua
C:\WINNT\TEMP\TempFolder.aab\iml32.dll 0,36Mt
C:\WINNT\TEMP\TempFolder.aac\dirapi.dll 0,90Mt
C:\WINNT\TEMP\TempFolder.aac\dirapi.mch 408 tavua
C:\WINNT\TEMP\TempFolder.aac\iml32.dll 0,36Mt
C:\WINNT\TEMP\TempFolder.aad\dirapi.dll 0,90Mt
C:\WINNT\TEMP\TempFolder.aad\dirapi.mch 408 tavua
C:\WINNT\TEMP\TempFolder.aad\iml32.dll 0,36Mt
C:\WINNT\TEMP\TempFolder.aae\dirapi.dll 0,90Mt
C:\WINNT\TEMP\TempFolder.aae\dirapi.mch 408 tavua
C:\WINNT\TEMP\TempFolder.aae\iml32.dll 0,36Mt
C:\WINNT\TEMP\TempFolder.aaf\dirapi.dll 0,90Mt
C:\WINNT\TEMP\TempFolder.aaf\dirapi.mch 408 tavua
C:\WINNT\TEMP\TempFolder.aaf\iml32.dll 0,36Mt
C:\WINNT\TEMP\TempFolder.aag\dirapi.dll 0,90Mt
C:\WINNT\TEMP\TempFolder.aag\dirapi.mch 408 tavua
C:\WINNT\TEMP\TempFolder.aag\iml32.dll 0,36Mt
C:\WINNT\TEMP\TempFolder.aah\dirapi.dll 0,90Mt
C:\WINNT\TEMP\TempFolder.aah\dirapi.mch 408 tavua
C:\WINNT\TEMP\TempFolder.aah\iml32.dll 0,36Mt
C:\WINNT\TEMP\TempFolder.aai\dirapi.dll 0,90Mt
C:\WINNT\TEMP\TempFolder.aai\dirapi.mch 408 tavua
C:\WINNT\TEMP\TempFolder.aai\iml32.dll 0,36Mt
C:\WINNT\TEMP\TempFolder.aaj\dirapi.dll 0,90Mt
C:\WINNT\TEMP\TempFolder.aaj\dirapi.mch 408 tavua
C:\WINNT\TEMP\TempFolder.aaj\iml32.dll 0,36Mt
C:\WINNT\TEMP\TempFolder.aak\dirapi.dll 0,90Mt
C:\WINNT\TEMP\TempFolder.aak\dirapi.mch 408 tavua
C:\WINNT\TEMP\TempFolder.aak\iml32.dll 0,36Mt
C:\WINNT\TEMP\TempFolder.aal\dirapi.dll 0,90Mt
C:\WINNT\TEMP\TempFolder.aal\dirapi.mch 408 tavua
C:\WINNT\TEMP\TempFolder.aal\iml32.dll 0,36Mt
C:\WINNT\TEMP\TempFolder.aam\dirapi.dll 0,90Mt
C:\WINNT\TEMP\TempFolder.aam\dirapi.mch 408 tavua
C:\WINNT\TEMP\TempFolder.aam\iml32.dll 0,36Mt
C:\WINNT\TEMP\TempFolder.aan\dirapi.dll 0,90Mt
C:\WINNT\TEMP\TempFolder.aan\dirapi.mch 408 tavua
C:\WINNT\TEMP\TempFolder.aan\iml32.dll 0,36Mt
C:\WINNT\TEMP\TempFolder.aao\dirapi.dll 0,90Mt
C:\WINNT\TEMP\TempFolder.aao\dirapi.mch 408 tavua
C:\WINNT\TEMP\TempFolder.aao\iml32.dll 0,36Mt
C:\WINNT\TEMP\TempFolder.aap\dirapi.dll 0,90Mt
C:\WINNT\TEMP\TempFolder.aap\dirapi.mch 408 tavua
C:\WINNT\TEMP\TempFolder.aap\iml32.dll 0,36Mt
C:\WINNT\TEMP\TempFolder.aaq\dirapi.dll 0,90Mt
C:\WINNT\TEMP\TempFolder.aaq\dirapi.mch 408 tavua
C:\WINNT\TEMP\TempFolder.aaq\iml32.dll 0,36Mt
C:\WINNT\TEMP\TempFolder.aar\dirapi.dll 0,90Mt
C:\WINNT\TEMP\TempFolder.aar\dirapi.mch 408 tavua
C:\WINNT\TEMP\TempFolder.aar\iml32.dll 0,36Mt
C:\WINNT\TEMP\TempFolder.aas\dirapi.dll 0,90Mt
C:\WINNT\TEMP\TempFolder.aas\dirapi.mch 408 tavua
C:\WINNT\TEMP\TempFolder.aas\iml32.dll 0,36Mt
C:\WINNT\TEMP\TempFolder.aat\dirapi.dll 0,90Mt
C:\WINNT\TEMP\TempFolder.aat\dirapi.mch 408 tavua
C:\WINNT\TEMP\TempFolder.aat\iml32.dll 0,36Mt
C:\WINNT\TEMP\TempFolder.aau\dirapi.dll 0,90Mt
C:\WINNT\TEMP\TempFolder.aau\dirapi.mch 408 tavua
C:\WINNT\TEMP\TempFolder.aau\iml32.dll 0,36Mt
C:\WINNT\TEMP\TempFolder.aav\dirapi.dll 0,90Mt
C:\WINNT\TEMP\TempFolder.aav\dirapi.mch 408 tavua
C:\WINNT\TEMP\TempFolder.aav\iml32.dll 0,36Mt
C:\WINNT\TEMP\TempFolder.aaw\dirapi.dll 0,90Mt
C:\WINNT\TEMP\TempFolder.aaw\dirapi.mch 408 tavua
C:\WINNT\TEMP\TempFolder.aaw\iml32.dll 0,36Mt
C:\WINNT\TEMP\TempFolder.aax\dirapi.dll 0,90Mt
C:\WINNT\TEMP\TempFolder.aax\dirapi.mch 408 tavua
C:\WINNT\TEMP\TempFolder.aax\iml32.dll 0,36Mt
C:\WINNT\TEMP\TempFolder.aay\dirapi.dll 0,90Mt
C:\WINNT\TEMP\TempFolder.aay\dirapi.mch 408 tavua
C:\WINNT\TEMP\TempFolder.aay\iml32.dll 0,36Mt
C:\WINNT\TEMP\TempFolder.aaz\dirapi.dll 0,90Mt
C:\WINNT\TEMP\TempFolder.aaz\dirapi.mch 408 tavua
C:\WINNT\TEMP\TempFolder.aaz\iml32.dll 0,36Mt
C:\WINNT\TEMP\TempFolder.aba\dirapi.dll 0,90Mt
C:\WINNT\TEMP\TempFolder.aba\dirapi.mch 408 tavua
C:\WINNT\TEMP\TempFolder.aba\iml32.dll 0,36Mt
C:\WINNT\TEMP\TempFolder.abb\dirapi.dll 0,90Mt
C:\WINNT\TEMP\TempFolder.abb\dirapi.mch 408 tavua
C:\WINNT\TEMP\TempFolder.abb\iml32.dll 0,36Mt
C:\WINNT\TEMP\TempFolder.abc\dirapi.dll 0,90Mt
C:\WINNT\TEMP\TempFolder.abc\dirapi.mch 408 tavua
C:\WINNT\TEMP\TempFolder.abc\iml32.dll 0,36Mt
C:\WINNT\TEMP\TempFolder.abd\dirapi.dll 0,90Mt
C:\WINNT\TEMP\TempFolder.abd\dirapi.mch 408 tavua
C:\WINNT\TEMP\TempFolder.abd\iml32.dll 0,36Mt
C:\WINNT\TEMP\TempFolder.abe\dirapi.dll 0,90Mt
C:\WINNT\TEMP\TempFolder.abe\dirapi.mch 408 tavua
C:\WINNT\TEMP\TempFolder.abe\iml32.dll 0,36Mt
C:\WINNT\TEMP\TempFolder.abf\dirapi.dll 0,90Mt
C:\WINNT\TEMP\TempFolder.abf\dirapi.mch 408 tavua
C:\WINNT\TEMP\TempFolder.abf\iml32.dll 0,36Mt
C:\WINNT\TEMP\TempFolder.abg\dirapi.dll 0,90Mt
C:\WINNT\TEMP\TempFolder.abg\dirapi.mch 408 tavua
C:\WINNT\TEMP\TempFolder.abg\iml32.dll 0,36Mt
C:\WINNT\TEMP\TempFolder.abh\dirapi.dll 0,90Mt
C:\WINNT\TEMP\TempFolder.abh\dirapi.mch 408 tavua
C:\WINNT\TEMP\TempFolder.abh\iml32.dll 0,36Mt
C:\WINNT\TEMP\TempFolder.abi\dirapi.dll 0,90Mt
C:\WINNT\TEMP\TempFolder.abi\dirapi.mch 408 tavua
C:\WINNT\TEMP\TempFolder.abi\iml32.dll 0,36Mt
C:\WINNT\TEMP\TempFolder.abj\dirapi.dll 0,90Mt
C:\WINNT\TEMP\TempFolder.abj\dirapi.mch 408 tavua
C:\WINNT\TEMP\TempFolder.abj\iml32.dll 0,36Mt
C:\WINNT\TEMP\TempFolder.abk\dirapi.dll 0,90Mt
C:\WINNT\TEMP\TempFolder.abk\dirapi.mch 408 tavua
C:\WINNT\TEMP\TempFolder.abk\iml32.dll 0,36Mt
C:\WINNT\TEMP\TempFolder.abl\dirapi.dll 0,90Mt
C:\WINNT\TEMP\TempFolder.abl\dirapi.mch 408 tavua
C:\WINNT\TEMP\TempFolder.abl\iml32.dll 0,36Mt
C:\WINNT\TEMP\TempFolder.abm\dirapi.dll 0,90Mt
C:\WINNT\TEMP\TempFolder.abm\dirapi.mch 408 tavua
C:\WINNT\TEMP\TempFolder.abm\iml32.dll 0,36Mt
C:\WINNT\TEMP\TempFolder.abn\dirapi.dll 0,90Mt
C:\WINNT\TEMP\TempFolder.abn\dirapi.mch 408 tavua
C:\WINNT\TEMP\TempFolder.abn\iml32.dll 0,36Mt
C:\WINNT\TEMP\Track No01.wav 34,9Mt
C:\WINNT\TEMP\Track No02.wav 34,0Mt
C:\WINNT\TEMP\Track No03.wav 32,5Mt
C:\WINNT\TEMP\Track No04.wav 29,2Mt
C:\WINNT\TEMP\Track No05.wav 35,8Mt
C:\WINNT\TEMP\Track No06.wav 37,3Mt
C:\WINNT\TEMP\Track No07.wav 47,2Mt
C:\WINNT\TEMP\Track No08.wav 30,3Mt
C:\WINNT\TEMP\Track No09.wav 28,8Mt
C:\WINNT\TEMP\Track No10.wav 32,4Mt
C:\WINNT\TEMP\Track No11.wav 28,6Mt
C:\WINNT\TEMP\Track No12.wav 39,3Mt
C:\WINNT\TEMP\Track No13.wav 27,4Mt
C:\DOCUME~1\Himberg\LOCALS~1\Temp\1541843\auconfig.cab 6,98Kt
C:\DOCUME~1\Himberg\LOCALS~1\Temp\1541843\auconfig9x.cab 7,00Kt
C:\DOCUME~1\Himberg\LOCALS~1\Temp\1541843\auconfigXP.cab 7,00Kt
C:\DOCUME~1\Himberg\LOCALS~1\Temp\1541843\au_res.dll 3,00Kt
C:\DOCUME~1\Himberg\LOCALS~1\Temp\1541843\au_setup.dll 76,00Kt
C:\DOCUME~1\Himberg\LOCALS~1\Temp\1541843\au_util.dll 0,14Mt
C:\DOCUME~1\Himberg\LOCALS~1\Temp\1541843\msnappau.exe 92,00Kt
C:\DOCUME~1\Himberg\LOCALS~1\Temp\1541843\tbdwnmgr.dll 76,00Kt
C:\DOCUME~1\Himberg\LOCALS~1\Temp\367289.mst 3,50Kt
C:\DOCUME~1\Himberg\LOCALS~1\Temp\720b6.mst 48,00Kt
C:\DOCUME~1\Himberg\LOCALS~1\Temp\AAX11.tmp 23,77Kt
C:\DOCUME~1\Himberg\LOCALS~1\Temp\AAX14.tmp 23,77Kt
C:\DOCUME~1\Himberg\LOCALS~1\Temp\AAX1D.tmp 26,44Kt
C:\DOCUME~1\Himberg\LOCALS~1\Temp\AAX21.tmp 26,84Kt
C:\DOCUME~1\Himberg\LOCALS~1\Temp\AAX28.tmp 23,77Kt
C:\DOCUME~1\Himberg\LOCALS~1\Temp\AAX29.tmp 26,84Kt
C:\DOCUME~1\Himberg\LOCALS~1\Temp\AAX33.tmp 26,44Kt
C:\DOCUME~1\Himberg\LOCALS~1\Temp\AAX37.tmp 26,84Kt
C:\DOCUME~1\Himberg\LOCALS~1\Temp\AAX3E.tmp 26,84Kt
C:\DOCUME~1\Himberg\LOCALS~1\Temp\AAX56.tmp 23,77Kt
C:\DOCUME~1\Himberg\LOCALS~1\Temp\AAX61.tmp 26,44Kt
C:\DOCUME~1\Himberg\LOCALS~1\Temp\AAX65.tmp 26,84Kt
C:\DOCUME~1\Himberg\LOCALS~1\Temp\AAX6C.tmp 26,84Kt
C:\DOCUME~1\Himberg\LOCALS~1\Temp\Acr2.tmp 1,95Mt
C:\DOCUME~1\Himberg\LOCALS~1\Temp\au_all.cab 0,29Mt
C:\DOCUME~1\Himberg\LOCALS~1\Temp\au_res.dll 9,69Kt
C:\DOCUME~1\Himberg\LOCALS~1\Temp\au_setuph.dll 90,69Kt
C:\DOCUME~1\Himberg\LOCALS~1\Temp\avdb_mf 5,32Kt
C:\DOCUME~1\Himberg\LOCALS~1\Temp\avdb_mf.ref 180 tavua
C:\DOCUME~1\Himberg\LOCALS~1\Temp\avp.klb 11,31Kt
C:\DOCUME~1\Himberg\LOCALS~1\Temp\avp.set 1,45Kt
C:\DOCUME~1\Himberg\LOCALS~1\Temp\avp.vnd 6,43Kt
C:\DOCUME~1\Himberg\LOCALS~1\Temp\ca.avc 68,75Kt
C:\DOCUME~1\Himberg\LOCALS~1\Temp\daily.avc 31,87Kt
C:\DOCUME~1\Himberg\LOCALS~1\Temp\dbindex.cpt 2,66Kt
C:\DOCUME~1\Himberg\LOCALS~1\Temp\DLL_{7148F0A8-6813-11D6-A77B-00B0D0142100}.ini 3,14Kt
C:\DOCUME~1\Himberg\LOCALS~1\Temp\dup.pub 695 tavua
C:\DOCUME~1\Himberg\LOCALS~1\Temp\eicar.avc 1,92Kt
C:\DOCUME~1\Himberg\LOCALS~1\Temp\engine.dll 0,18Mt
C:\DOCUME~1\Himberg\LOCALS~1\Temp\ext.dat 424 tavua
C:\DOCUME~1\Himberg\LOCALS~1\Temp\fa.avc 20,17Kt
C:\DOCUME~1\Himberg\LOCALS~1\Temp\fsav.set 1,45Kt
C:\DOCUME~1\Himberg\LOCALS~1\Temp\gen001.avc 33,95Kt
C:\DOCUME~1\Himberg\LOCALS~1\Temp\gen002.avc 46,20Kt
C:\DOCUME~1\Himberg\LOCALS~1\Temp\gen003.avc 40,18Kt
C:\DOCUME~1\Himberg\LOCALS~1\Temp\gen004.avc 28,68Kt
C:\DOCUME~1\Himberg\LOCALS~1\Temp\gen999.avc 37,10Kt
C:\DOCUME~1\Himberg\LOCALS~1\Temp\GLB9.tmp 70,00Kt
C:\DOCUME~1\Himberg\LOCALS~1\Temp\GLCA.tmp 585,3Mt
C:\DOCUME~1\Himberg\LOCALS~1\Temp\GLF20.tmp 8,50Kt
C:\DOCUME~1\Himberg\LOCALS~1\Temp\GLFA.tmp 8,50Kt
C:\DOCUME~1\Himberg\LOCALS~1\Temp\header.ini 3,33Kt
C:\DOCUME~1\Himberg\LOCALS~1\Temp\HP PhotoSmart\Temporary File Cache\record.xml 11 tavua
C:\DOCUME~1\Himberg\LOCALS~1\Temp\hpilog00.txt 58,45Kt
C:\DOCUME~1\Himberg\LOCALS~1\Temp\hpilog01.txt 79,73Kt
C:\DOCUME~1\Himberg\LOCALS~1\Temp\hpilog02.txt 36,37Kt
C:\DOCUME~1\Himberg\LOCALS~1\Temp\hpilog03.txt 991 tavua
C:\DOCUME~1\Himberg\LOCALS~1\Temp\hpistr.hpi 3,04Kt
C:\DOCUME~1\Himberg\LOCALS~1\Temp\hppg01.wav 37,90Kt
C:\DOCUME~1\Himberg\LOCALS~1\Temp\HpTmpEml_2\HPIM0437.JPG 0,14Mt
C:\DOCUME~1\Himberg\LOCALS~1\Temp\IEC18.tmp 0,33Mt
C:\DOCUME~1\Himberg\LOCALS~1\Temp\IEC4.tmp 0,33Mt
C:\DOCUME~1\Himberg\LOCALS~1\Temp\jinstall.cfg 815 tavua
C:\DOCUME~1\Himberg\LOCALS~1\Temp\jinstaller142_10.exe 1,35Mt
C:\DOCUME~1\Himberg\LOCALS~1\Temp\kernel.avc 8,21Kt
C:\DOCUME~1\Himberg\LOCALS~1\Temp\krn001.avc 33,49Kt
C:\DOCUME~1\Himberg\LOCALS~1\Temp\krndos.avc 5,15Kt
C:\DOCUME~1\Himberg\LOCALS~1\Temp\krnengn.avc 26,18Kt
C:\DOCUME~1\Himberg\LOCALS~1\Temp\krnexe.avc 32,05Kt
C:\DOCUME~1\Himberg\LOCALS~1\Temp\krnexe32.avc 47,60Kt
C:\DOCUME~1\Himberg\LOCALS~1\Temp\krnjava.avc 36,74Kt
C:\DOCUME~1\Himberg\LOCALS~1\Temp\krnmacro.avc 86,42Kt
C:\DOCUME~1\Himberg\LOCALS~1\Temp\krnunp.avc 59,60Kt
C:\DOCUME~1\Himberg\LOCALS~1\Temp\list.bot 235 tavua
C:\DOCUME~1\Himberg\LOCALS~1\Temp\mail.avc 13,78Kt
C:\DOCUME~1\Himberg\LOCALS~1\Temp\malw001.avc 58,54Kt
C:\DOCUME~1\Himberg\LOCALS~1\Temp\malw002.avc 53,42Kt
C:\DOCUME~1\Himberg\LOCALS~1\Temp\malw003.avc 47,18Kt
C:\DOCUME~1\Himberg\LOCALS~1\Temp\malw004.avc 33,11Kt
C:\DOCUME~1\Himberg\LOCALS~1\Temp\manifest.cfg 602 tavua
C:\DOCUME~1\Himberg\LOCALS~1\Temp\msnsearch.exe 0,21Mt
C:\DOCUME~1\Himberg\LOCALS~1\Temp\msntb.cfg 12,59Kt
C:\DOCUME~1\Himberg\LOCALS~1\Temp\mso10.tmp 0 tavua
C:\DOCUME~1\Himberg\LOCALS~1\Temp\mso11.tmp 0 tavua
C:\DOCUME~1\Himberg\LOCALS~1\Temp\mso12.tmp 0 tavua
C:\DOCUME~1\Himberg\LOCALS~1\Temp\mso13.tmp 0 tavua
C:\DOCUME~1\Himberg\LOCALS~1\Temp\mso14.tmp 0 tavua
C:\DOCUME~1\Himberg\LOCALS~1\Temp\mso15.tmp 0 tavua
C:\DOCUME~1\Himberg\LOCALS~1\Temp\mso16.tmp 0 tavua
C:\DOCUME~1\Himberg\LOCALS~1\Temp\mso17.tmp 0 tavua
C:\DOCUME~1\Himberg\LOCALS~1\Temp\mso18.tmp 0 tavua
C:\DOCUME~1\Himberg\LOCALS~1\Temp\mso19.tmp 0 tavua
C:\DOCUME~1\Himberg\LOCALS~1\Temp\mso1A.tmp 0 tavua
C:\DOCUME~1\Himberg\LOCALS~1\Temp\mso1B.tmp 0 tavua
C:\DOCUME~1\Himberg\LOCALS~1\Temp\mso1C.tmp 0 tavua
C:\DOCUME~1\Himberg\LOCALS~1\Temp\mso1D.tmp 0 tavua
C:\DOCUME~1\Himberg\LOCALS~1\Temp\mso1E.tmp 0 tavua
C:\DOCUME~1\Himberg\LOCALS~1\Temp\mso1F.tmp 0 tavua
C:\DOCUME~1\Himberg\LOCALS~1\Temp\mso2.tmp 0 tavua
C:\DOCUME~1\Himberg\LOCALS~1\Temp\mso20.tmp 0 tavua
C:\DOCUME~1\Himberg\LOCALS~1\Temp\mso21.tmp 0 tavua
C:\DOCUME~1\Himberg\LOCALS~1\Temp\mso22.tmp 0 tavua
C:\DOCUME~1\Himberg\LOCALS~1\Temp\mso23.tmp 0 tavua
C:\DOCUME~1\Himberg\LOCALS~1\Temp\mso24.tmp 0 tavua
C:\DOCUME~1\Himberg\LOCALS~1\Temp\mso25.tmp 0 tavua
C:\DOCUME~1\Himberg\LOCALS~1\Temp\mso26.tmp 0 tavua
C:\DOCUME~1\Himberg\LOCALS~1\Temp\mso27.tmp 0 tavua
C:\DOCUME~1\Himberg\LOCALS~1\Temp\mso28.tmp 0 tavua
C:\DOCUME~1\Himberg\LOCALS~1\Temp\mso29.tmp 0 tavua
C:\DOCUME~1\Himberg\LOCALS~1\Temp\mso2A.tmp 0 tavua
C:\DOCUME~1\Himberg\LOCALS~1\Temp\mso2B.tmp 0 tavua
C:\DOCUME~1\Himberg\LOCALS~1\Temp\mso2C.tmp 0 tavua
C:\DOCUME~1\Himberg\LOCALS~1\Temp\mso2D.tmp 0 tavua
C:\DOCUME~1\Himberg\LOCALS~1\Temp\mso3.tmp 0 tavua
C:\DOCUME~1\Himberg\LOCALS~1\Temp\mso4.tmp 0 tavua
C:\DOCUME~1\Himberg\LOCALS~1\Temp\mso5.tmp 0 tavua
C:\DOCUME~1\Himberg\LOCALS~1\Temp\mso6.tmp 0 tavua
C:\DOCUME~1\Himberg\LOCALS~1\Temp\mso7.tmp 0 tavua
C:\DOCUME~1\Himberg\LOCALS~1\Temp\mso8.tmp 0 tavua
C:\DOCUME~1\Himberg\LOCALS~1\Temp\mso9.tmp 0 tavua
C:\DOCUME~1\Himberg\LOCALS~1\Temp\msoA.tmp 0 tavua
C:\DOCUME~1\Himberg\LOCALS~1\Temp\msoB.tmp 0 tavua
C:\DOCUME~1\Himberg\LOCALS~1\Temp\msoC.tmp 0 tavua
C:\DOCUME~1\Himberg\LOCALS~1\Temp\msoD.tmp 0 tavua
C:\DOCUME~1\Himberg\LOCALS~1\Temp\msoE.tmp 0 tavua
C:\DOCUME~1\Himberg\LOCALS~1\Temp\msoF.tmp 0 tavua
C:\DOCUME~1\Himberg\LOCALS~1\Temp\nsv8.tmp\InstallOptions.dll 12,50Kt
C:\DOCUME~1\Himberg\LOCALS~1\Temp\nsv8.tmp\ioFileY.ini 998 tavua
C:\DOCUME~1\Himberg\LOCALS~1\Temp\nsv8.tmp\ioSpecial.ini 740 tavua
C:\DOCUME~1\Himberg\LOCALS~1\Temp\nsv8.tmp\LangDLL.dll 5,00Kt
C:\DOCUME~1\Himberg\LOCALS~1\Temp\nsv8.tmp\modern-wizard.bmp 51,34Kt
C:\DOCUME~1\Himberg\LOCALS~1\Temp\nsv8.tmp\StopCC.dll 44,00Kt
C:\DOCUME~1\Himberg\LOCALS~1\Temp\ocr.avc 11,54Kt
C:\DOCUME~1\Himberg\LOCALS~1\Temp\offcln9.log 31,13Kt
C:\DOCUME~1\Himberg\LOCALS~1\Temp\Office 2000 Professional Setup (0002).txt 1,72Kt
C:\DOCUME~1\Himberg\LOCALS~1\Temp\Office 2000 Professional Setup (0002)_MsiExec.txt 0,28Mt
C:\DOCUME~1\Himberg\LOCALS~1\Temp\Office 2000 Professional Setup (0003).txt 323 tavua
C:\DOCUME~1\Himberg\LOCALS~1\Temp\OHotfix\OHotfix(00001).log 12,65Kt
C:\DOCUME~1\Himberg\LOCALS~1\Temp\OHotfix\OHotfix(00001)_Msi.log 20,3Mt
C:\DOCUME~1\Himberg\LOCALS~1\Temp\OHotfix\OHotfix(00002).log 63,07Kt
C:\DOCUME~1\Himberg\LOCALS~1\Temp\OHotfix\OHotfix(00002)_Msi.log 19,9Mt
C:\DOCUME~1\Himberg\LOCALS~1\Temp\Outlook Startup.Log 1,06Kt
C:\DOCUME~1\Himberg\LOCALS~1\Temp\pft33~tmp\dmaopt.dat 97 tavua
C:\DOCUME~1\Himberg\LOCALS~1\Temp\pft3~tmp\aliagp.sys 22,78Kt
C:\DOCUME~1\Himberg\LOCALS~1\Temp\pft3~tmp\data1.cab 0,46Mt
C:\DOCUME~1\Himberg\LOCALS~1\Temp\pft3~tmp\data1.hdr 9,55Kt
C:\DOCUME~1\Himberg\LOCALS~1\Temp\pft3~tmp\data2.cab 512 tavua
C:\DOCUME~1\Himberg\LOCALS~1\Temp\pft3~tmp\ikernel.ex_ 0,32Mt
C:\DOCUME~1\Himberg\LOCALS~1\Temp\pft3~tmp\layout.bin 473 tavua
C:\DOCUME~1\Himberg\LOCALS~1\Temp\pft3~tmp\nv4_disp.cat 15,42Kt
C:\DOCUME~1\Himberg\LOCALS~1\Temp\pft3~tmp\nv4_disp.dll 1,86Mt
C:\DOCUME~1\Himberg\LOCALS~1\Temp\pft3~tmp\nv4_disp.inf 0,11Mt
C:\DOCUME~1\Himberg\LOCALS~1\Temp\pft3~tmp\nv4_mini.sys 0,74Mt
C:\DOCUME~1\Himberg\LOCALS~1\Temp\pft3~tmp\nvcpl.dll 1,35Mt
C:\DOCUME~1\Himberg\LOCALS~1\Temp\pft3~tmp\nvcpl.hlp 38,53Kt
C:\DOCUME~1\Himberg\LOCALS~1\Temp\pft3~tmp\nvdccapp.cfg 1,39Kt
C:\DOCUME~1\Himberg\LOCALS~1\Temp\pft3~tmp\nvdesk32.dll 100,00Kt
C:\DOCUME~1\Himberg\LOCALS~1\Temp\pft3~tmp\nvdmcpl.dll 72,00Kt
C:\DOCUME~1\Himberg\LOCALS~1\Temp\pft3~tmp\nvinstnt.dll 76,00Kt
C:\DOCUME~1\Himberg\LOCALS~1\Temp\pft3~tmp\nvoglnt.dll 2,37Mt
C:\DOCUME~1\Himberg\LOCALS~1\Temp\pft3~tmp\nvqtwk.dll 0,14Mt
C:\DOCUME~1\Himberg\LOCALS~1\Temp\pft3~tmp\nvwsapps.cfg 6,08Kt
C:\DOCUME~1\Himberg\LOCALS~1\Temp\pft3~tmp\readme.txt 3,51Kt
C:\DOCUME~1\Himberg\LOCALS~1\Temp\pft3~tmp\setup.bmp 76,05Kt
C:\DOCUME~1\Himberg\LOCALS~1\Temp\pft3~tmp\Setup.exe 58,00Kt
C:\DOCUME~1\Himberg\LOCALS~1\Temp\pft3~tmp\Setup.ini 107 tavua
C:\DOCUME~1\Himberg\LOCALS~1\Temp\pft3~tmp\setup.inx 0,15Mt
C:\DOCUME~1\Himberg\LOCALS~1\Temp\pft3~tmp\setup.iss 435 tavua
C:\DOCUME~1\Himberg\LOCALS~1\Temp\pft3~tmp\Setup16.bmp 37,62Kt
C:\DOCUME~1\Himberg\LOCALS~1\Temp\pft4~tmp\Abcpy.ini 2,96Kt
C:\DOCUME~1\Himberg\LOCALS~1\Temp\pft4~tmp\DATA.TAG 103 tavua
C:\DOCUME~1\Himberg\LOCALS~1\Temp\pft4~tmp\data1.cab 6,50Kt
C:\DOCUME~1\Himberg\LOCALS~1\Temp\pft4~tmp\data1.hdr 28,66Kt
C:\DOCUME~1\Himberg\LOCALS~1\Temp\pft4~tmp\Help\ENU\ACROBAT.PDF 27,78Kt
C:\DOCUME~1\Himberg\LOCALS~1\Temp\pft4~tmp\Help\ENU\DocBox.pdf 3,99Kt
C:\DOCUME~1\Himberg\LOCALS~1\Temp\pft4~tmp\Help\ENU\MiniReader.pdf 75,21Kt
C:\DOCUME~1\Himberg\LOCALS~1\Temp\pft4~tmp\lang.dat 22,99Kt
C:\DOCUME~1\Himberg\LOCALS~1\Temp\pft4~tmp\layout.bin 609 tavua
C:\DOCUME~1\Himberg\LOCALS~1\Temp\pft4~tmp\os.dat 450 tavua
C:\DOCUME~1\Himberg\LOCALS~1\Temp\pft4~tmp\pftw1.pkg 8,28Mt
C:\DOCUME~1\Himberg\LOCALS~1\Temp\pft4~tmp\Reader\AceLite.dll 0,38Mt
C:\DOCUME~1\Himberg\LOCALS~1\Temp\pft4~tmp\Reader\ACROFX32.DLL 52,00Kt
C:\DOCUME~1\Himberg\LOCALS~1\Temp\pft4~tmp\Reader\AcroRd32.exe 3,70Mt
C:\DOCUME~1\Himberg\LOCALS~1\Temp\pft4~tmp\Reader\ActiveX\AcroIEHelper.ocx 36,92Kt
C:\DOCUME~1\Himberg\LOCALS~1\Temp\pft4~tmp\Reader\ActiveX\pdf.ocx 0,37Mt
C:\DOCUME~1\Himberg\LOCALS~1\Temp\pft4~tmp\Reader\ActiveX\pdf.tlb 3,95Kt
C:\DOCUME~1\Himberg\LOCALS~1\Temp\pft4~tmp\Reader\Agm.dll 1,09Mt
C:\DOCUME~1\Himberg\LOCALS~1\Temp\pft4~tmp\Reader\Bib.dll 0,14Mt
C:\DOCUME~1\Himberg\LOCALS~1\Temp\pft4~tmp\Reader\Browser\nppdf32.dll 100,89Kt
C:\DOCUME~1\Himberg\LOCALS~1\Temp\pft4~tmp\Reader\CoolType.dll 1,38Mt
C:\DOCUME~1\Himberg\LOCALS~1\Temp\pft4~tmp\Reader\JavaScripts\aform.js 33,78Kt
C:\DOCUME~1\Himberg\LOCALS~1\Temp\pft4~tmp\Reader\msvcp60.dll 0,38Mt
C:\DOCUME~1\Himberg\LOCALS~1\Temp\pft4~tmp\Reader\msvcrt.dll 0,25Mt
C:\DOCUME~1\Himberg\LOCALS~1\Temp\pft4~tmp\Reader\oleaut32.dll 0,57Mt
C:\DOCUME~1\Himberg\LOCALS~1\Temp\pft4~tmp\Reader\Optional\README.TXT 46 tavua
C:\DOCUME~1\Himberg\LOCALS~1\Temp\pft4~tmp\Reader\plug_ins\AcroFill.api 0,61Mt
C:\DOCUME~1\Himberg\LOCALS~1\Temp\pft4~tmp\Reader\plug_ins\EScript.api 0,61Mt
C:\DOCUME~1\Himberg\LOCALS~1\Temp\pft4~tmp\Reader\plug_ins\EWH32.api 68,07Kt
C:\DOCUME~1\Himberg\LOCALS~1\Temp\pft4~tmp\Reader\plug_ins\hls.api 52,06Kt
C:\DOCUME~1\Himberg\LOCALS~1\Temp\pft4~tmp\Reader\plug_ins\InterTrust\DocBox.api 0,39Mt
C:\DOCUME~1\Himberg\LOCALS~1\Temp\pft4~tmp\Reader\plug_ins\InterTrust\NPDocBox.dll 0,21Mt
C:\DOCUME~1\Himberg\LOCALS~1\Temp\pft4~tmp\Reader\plug_ins\Movie\Movie.api 0,26Mt
C:\DOCUME~1\Himberg\LOCALS~1\Temp\pft4~tmp\Reader\plug_ins\Movie\QT2.dll 24,00Kt
C:\DOCUME~1\Himberg\LOCALS~1\Temp\pft4~tmp\Reader\plug_ins\Movie\QT3.dll 32,00Kt
C:\DOCUME~1\Himberg\LOCALS~1\Temp\pft4~tmp\Reader\plug_ins\Movie\QT4.dll 36,00Kt
C:\DOCUME~1\Himberg\LOCALS~1\Temp\pft4~tmp\Reader\plug_ins\reflow.api 0,24Mt
C:\DOCUME~1\Himberg\LOCALS~1\Temp\pft4~tmp\Reader\plug_ins\WEBBUY\HTML\btn_submit.gif 746 tavua
C:\DOCUME~1\Himberg\LOCALS~1\Temp\pft4~tmp\Reader\plug_ins\WEBBUY\HTML\table_btm.gif 249 tavua
C:\DOCUME~1\Himberg\LOCALS~1\Temp\pft4~tmp\Reader\plug_ins\WEBBUY\HTML\template1.html 2,02Kt
C:\DOCUME~1\Himberg\LOCALS~1\Temp\pft4~tmp\Reader\plug_ins\WEBBUY\HTML\template2.html 2,93Kt
C:\DOCUME~1\Himberg\LOCALS~1\Temp\pft4~tmp\Reader\plug_ins\WEBBUY\HTML\template5.html 192 tavua
C:\DOCUME~1\Himberg\LOCALS~1\Temp\pft4~tmp\Reader\plug_ins\WEBBUY\HTML\title_acrobat.gif 742 tavua
C:\DOCUME~1\Himberg\LOCALS~1\Temp\pft4~tmp\Reader\plug_ins\WEBBUY\HTML\title_adobe.gif 806 tavua
C:\DOCUME~1\Himberg\LOCALS~1\Temp\pft4~tmp\Reader\plug_ins\WEBBUY\HTML\title_end.gif 223 tavua
C:\DOCUME~1\Himberg\LOCALS~1\Temp\pft4~tmp\Reader\plug_ins\WEBBUY\HTML\title_mid.gif 300 tavua
C:\DOCUME~1\Himberg\LOCALS~1\Temp\pft4~tmp\Reader\plug_ins\Webbuy.api 0,41Mt
C:\DOCUME~1\Himberg\LOCALS~1\Temp\pft4~tmp\Reader\plug_ins\weblink.api 0,10Mt
C:\DOCUME~1\Himberg\LOCALS~1\Temp\pft4~tmp\Reader\plug_ins\WHA.api 68,00Kt
C:\DOCUME~1\Himberg\LOCALS~1\Temp\pft4~tmp\Reader\RdrENU.xml 198 tavua
C:\DOCUME~1\Himberg\LOCALS~1\Temp\pft4~tmp\Reader\SPPlugins\ADMPlugin.apl 0,85Mt
C:\DOCUME~1\Himberg\LOCALS~1\Temp\pft4~tmp\Reader\SPPlugins\ExpressViews.apl 0,19Mt
C:\DOCUME~1\Himberg\LOCALS~1\Temp\pft4~tmp\Reader\Uninstall\Uninst.dll 80,00Kt
C:\DOCUME~1\Himberg\LOCALS~1\Temp\pft4~tmp\Reader\WHA Library.dll 0,16Mt
C:\DOCUME~1\Himberg\LOCALS~1\Temp\pft4~tmp\ReadMe.html 21,75Kt
C:\DOCUME~1\Himberg\LOCALS~1\Temp\pft4~tmp\Resource\CMap\Identity-H 6,25Kt
C:\DOCUME~1\Himberg\LOCALS~1\Temp\pft4~tmp\Resource\CMap\Identity-V 1,17Kt
C:\DOCUME~1\Himberg\LOCALS~1\Temp\pft4~tmp\Resource\ENUtxt.pdf 1,38Kt
C:\DOCUME~1\Himberg\LOCALS~1\Temp\pft4~tmp\Resource\Font\AdobeFnt.lst 23 tavua
C:\DOCUME~1\Himberg\LOCALS~1\Temp\pft4~tmp\Resource\Font\cobo____.pfb 49,35Kt
C:\DOCUME~1\Himberg\LOCALS~1\Temp\pft4~tmp\Resource\Font\cob_____.pfb 34,67Kt
C:\DOCUME~1\Himberg\LOCALS~1\Temp\pft4~tmp\Resource\Font\com_____.pfb 33,77Kt
C:\DOCUME~1\Himberg\LOCALS~1\Temp\pft4~tmp\Resource\Font\coo_____.pfb 47,33Kt
C:\DOCUME~1\Himberg\LOCALS~1\Temp\pft4~tmp\Resource\Font\PFM\COBO____.PFM 686 tavua
C:\DOCUME~1\Himberg\LOCALS~1\Temp\pft4~tmp\Resource\Font\PFM\COB_____.PFM 679 tavua
C:\DOCUME~1\Himberg\LOCALS~1\Temp\pft4~tmp\Resource\Font\PFM\COM_____.PFM 674 tavua
C:\DOCUME~1\Himberg\LOCALS~1\Temp\pft4~tmp\Resource\Font\PFM\COO_____.PFM 682 tavua
C:\DOCUME~1\Himberg\LOCALS~1\Temp\pft4~tmp\Resource\Font\PFM\SY______.PFM 672 tavua
C:\DOCUME~1\Himberg\LOCALS~1\Temp\pft4~tmp\Resource\Font\PFM\ZD______.PFM 684 tavua
C:\DOCUME~1\Himberg\LOCALS~1\Temp\pft4~tmp\Resource\Font\PFM\ZX______.MMM 7,08Kt
C:\DOCUME~1\Himberg\LOCALS~1\Temp\pft4~tmp\Resource\Font\PFM\zx______.pfm 683 tavua
C:\DOCUME~1\Himberg\LOCALS~1\Temp\pft4~tmp\Resource\Font\PFM\ZY______.MMM 7,08Kt
C:\DOCUME~1\Himberg\LOCALS~1\Temp\pft4~tmp\Resource\Font\PFM\zy______.pfm 684 tavua
C:\DOCUME~1\Himberg\LOCALS~1\Temp\pft4~tmp\Resource\Font\PFM\_ABI____.PFM 5,21Kt
C:\DOCUME~1\Himberg\LOCALS~1\Temp\pft4~tmp\Resource\Font\PFM\_AB_____.PFM 5,21Kt
C:\DOCUME~1\Himberg\LOCALS~1\Temp\pft4~tmp\Resource\Font\PFM\_AI_____.PFM 5,68Kt
C:\DOCUME~1\Himberg\LOCALS~1\Temp\pft4~tmp\Resource\Font\PFM\_A______.PFM 5,67Kt
C:\DOCUME~1\Himberg\LOCALS~1\Temp\pft4~tmp\Resource\Font\PFM\_ebi____.pfm 4,57Kt
C:\DOCUME~1\Himberg\LOCALS~1\Temp\pft4~tmp\Resource\Font\PFM\_eb_____.pfm 4,83Kt
C:\DOCUME~1\Himberg\LOCALS~1\Temp\pft4~tmp\Resource\Font\PFM\_ei_____.pfm 4,70Kt
C:\DOCUME~1\Himberg\LOCALS~1\Temp\pft4~tmp\Resource\Font\PFM\_er_____.pfm 4,58Kt
C:\DOCUME~1\Himberg\LOCALS~1\Temp\pft4~tmp\Resource\Font\SY______.PFB 33,89Kt
C:\DOCUME~1\Himberg\LOCALS~1\Temp\pft4~tmp\Resource\Font\ZD______.PFB 48,43Kt
C:\DOCUME~1\Himberg\LOCALS~1\Temp\pft4~tmp\Resource\Font\ZX______.PFB 73,80Kt
C:\DOCUME~1\Himberg\LOCALS~1\Temp\pft4~tmp\Resource\Font\ZY______.PFB 94,16Kt
C:\DOCUME~1\Himberg\LOCALS~1\Temp\pft4~tmp\Resource\Font\_ABI____.PFB 31,27Kt
C:\DOCUME~1\Himberg\LOCALS~1\Temp\pft4~tmp\Resource\Font\_AB_____.PFB 31,22Kt
C:\DOCUME~1\Himberg\LOCALS~1\Temp\pft4~tmp\Resource\Font\_AI_____.PFB 31,36Kt
C:\DOCUME~1\Himberg\LOCALS~1\Temp\pft4~tmp\Resource\Font\_A______.PFB 31,33Kt
C:\DOCUME~1\Himberg\LOCALS~1\Temp\pft4~tmp\Resource\Font\_ebi____.pfb 37,64Kt
C:\DOCUME~1\Himberg\LOCALS~1\Temp\pft4~tmp\Resource\Font\_eb_____.pfb 34,55Kt
C:\DOCUME~1\Himberg\LOCALS~1\Temp\pft4~tmp\Resource\Font\_ei_____.pfb 36,64Kt
C:\DOCUME~1\Himberg\LOCALS~1\Temp\pft4~tmp\Resource\Font\_er_____.pfb 34,55Kt
C:\DOCUME~1\Himberg\LOCALS~1\Temp\pft4~tmp\Setup.exe 80,00Kt
C:\DOCUME~1\Himberg\LOCALS~1\Temp\pft4~tmp\SETUP.INI 103 tavua
C:\DOCUME~1\Himberg\LOCALS~1\Temp\pft4~tmp\setup.ins 0,15Mt
C:\DOCUME~1\Himberg\LOCALS~1\Temp\pft4~tmp\setup.lid 49 tavua
C:\DOCUME~1\Himberg\LOCALS~1\Temp\pft4~tmp\SVG Files\NPSVGVw.dll 0,29Mt
C:\DOCUME~1\Himberg\LOCALS~1\Temp\pft4~tmp\SVG Files\ReadMe.html 18,73Kt
C:\DOCUME~1\Himberg\LOCALS~1\Temp\pft4~tmp\SVG Files\SVG Viewer License.txt 22,00Kt
C:\DOCUME~1\Himberg\LOCALS~1\Temp\pft4~tmp\SVG Files\SVGAbout.svg 77,58Kt
C:\DOCUME~1\Himberg\LOCALS~1\Temp\pft4~tmp\SVG Files\SVGControl.dll 0,47Mt
C:\DOCUME~1\Himberg\LOCALS~1\Temp\pft4~tmp\SVG Files\SVGHelp.html 2,86Kt
C:\DOCUME~1\Himberg\LOCALS~1\Temp\pft4~tmp\SVG Files\SVGRSRC.DLL 12,00Kt
C:\DOCUME~1\Himberg\LOCALS~1\Temp\pft4~tmp\SVG Files\SVGView.dll 1,52Mt
C:\DOCUME~1\Himberg\LOCALS~1\Temp\pft4~tmp\SVG Files\SVGViewer.dict 18,01Kt
C:\DOCUME~1\Himberg\LOCALS~1\Temp\pft4~tmp\SVG Files\SVGViewer.ini 0 tavua
C:\DOCUME~1\Himberg\LOCALS~1\Temp\pft4~tmp\SVG Files\SVGViewer.zip 0,19Mt
C:\DOCUME~1\Himberg\LOCALS~1\Temp\pft4~tmp\_INST32I.EX_ 0,28Mt
C:\DOCUME~1\Himberg\LOCALS~1\Temp\pft4~tmp\_ISDel.exe 32,00Kt
C:\DOCUME~1\Himberg\LOCALS~1\Temp\pft4~tmp\_Setup.dll 34,00Kt
C:\DOCUME~1\Himberg\LOCALS~1\Temp\pft4~tmp\_sys1.cab 0,17Mt
C:\DOCUME~1\Himberg\LOCALS~1\Temp\pft4~tmp\_sys1.hdr 4,95Kt
C:\DOCUME~1\Himberg\LOCALS~1\Temp\pft4~tmp\_user1.cab 0,26Mt
C:\DOCUME~1\Himberg\LOCALS~1\Temp\pft4~tmp\_user1.hdr 5,65Kt
C:\DOCUME~1\Himberg\LOCALS~1\Temp\qmgr.cab 77,52Kt
C:\DOCUME~1\Himberg\LOCALS~1\Temp\qmgr.inf 2,02Kt
C:\DOCUME~1\Himberg\LOCALS~1\Temp\smart.avc 5,04Kt
C:\DOCUME~1\Himberg\LOCALS~1\Temp\sr1patch\ASENNA.EXE 0,23Mt
C:\DOCUME~1\Himberg\LOCALS~1\Temp\sr1patch\Office 2000 SR-1 Setup(0001).txt 5,38Kt
C:\DOCUME~1\Himberg\LOCALS~1\Temp\sr1patch\Office 2000 SR-1 Setup(0001)_MsiExec.txt 0,15Mt
C:\DOCUME~1\Himberg\LOCALS~1\Temp\sr1patch\source.ini 4,75Kt
C:\DOCUME~1\Himberg\LOCALS~1\Temp\TFR10.tmp 70,00Kt
C:\DOCUME~1\Himberg\LOCALS~1\Temp\TFR11.tmp 34,74Kt
C:\DOCUME~1\Himberg\LOCALS~1\Temp\TFR12.tmp 31,45Kt
C:\DOCUME~1\Himberg\LOCALS~1\Temp\TFR13.tmp 70,00Kt
C:\DOCUME~1\Himberg\LOCALS~1\Temp\TFR14.tmp 22,88Kt
C:\DOCUME~1\Himberg\LOCALS~1\Temp\TFR15.tmp 9,99Kt
C:\DOCUME~1\Himberg\LOCALS~1\Temp\TFR16.tmp 34,74Kt
C:\DOCUME~1\Himberg\LOCALS~1\Temp\TFR17.tmp 31,45Kt
C:\DOCUME~1\Himberg\LOCALS~1\Temp\TFR19.tmp 70,00Kt
C:\DOCUME~1\Himberg\LOCALS~1\Temp\TFR1A.tmp 9,99Kt
C:\DOCUME~1\Himberg\LOCALS~1\Temp\TFR1B.tmp 20,63Kt
C:\DOCUME~1\Himberg\LOCALS~1\Temp\TFR1C.tmp 22,88Kt
C:\DOCUME~1\Himberg\LOCALS~1\Temp\TFR1D.tmp 22,88Kt
C:\DOCUME~1\Himberg\LOCALS~1\Temp\TFR1E.tmp 70,00Kt
C:\DOCUME~1\Himberg\LOCALS~1\Temp\TFR1F.tmp 34,74Kt
C:\DOCUME~1\Himberg\LOCALS~1\Temp\TFR20.tmp 65,98Kt
C:\DOCUME~1\Himberg\LOCALS~1\Temp\TFR21.tmp 20,63Kt
C:\DOCUME~1\Himberg\LOCALS~1\Temp\TFR22.tmp 9,99Kt
C:\DOCUME~1\Himberg\LOCALS~1\Temp\TFR23.tmp 20,63Kt
C:\DOCUME~1\Himberg\LOCALS~1\Temp\TFR24.tmp 22,88Kt
C:\DOCUME~1\Himberg\LOCALS~1\Temp\TFR25.tmp 65,98Kt
C:\DOCUME~1\Himberg\LOCALS~1\Temp\TFR26.tmp 65,98Kt
C:\DOCUME~1\Himberg\LOCALS~1\Temp\TFR27.tmp 70,00Kt
C:\DOCUME~1\Himberg\LOCALS~1\Temp\TFR28.tmp 20,63Kt
C:\DOCUME~1\Himberg\LOCALS~1\Temp\TFR2A.tmp 65,98Kt
C:\DOCUME~1\Himberg\LOCALS~1\Temp\TFR2C.tmp 44,94Kt
C:\DOCUME~1\Himberg\LOCALS~1\Temp\TFR2D.tmp 22,88Kt
C:\DOCUME~1\Himberg\LOCALS~1\Temp\TFR2E.tmp 15,80Kt
C:\DOCUME~1\Himberg\LOCALS~1\Temp\TFR3.tmp 27,13Kt
C:\DOCUME~1\Himberg\LOCALS~1\Temp\TFR30.tmp 44,94Kt
C:\DOCUME~1\Himberg\LOCALS~1\Temp\TFR32.tmp 15,80Kt
C:\DOCUME~1\Himberg\LOCALS~1\Temp\TFR33.tmp 25,63Kt
C:\DOCUME~1\Himberg\LOCALS~1\Temp\TFR34.tmp 20,63Kt
C:\DOCUME~1\Himberg\LOCALS~1\Temp\TFR36.tmp 25,63Kt
C:\DOCUME~1\Himberg\LOCALS~1\Temp\TFR37.tmp 20,08Kt
C:\DOCUME~1\Himberg\LOCALS~1\Temp\TFR38.tmp 65,98Kt
C:\DOCUME~1\Himberg\LOCALS~1\Temp\TFR3A.tmp 20,08Kt
C:\DOCUME~1\Himberg\LOCALS~1\Temp\TFR3B.tmp 45,57Kt
C:\DOCUME~1\Himberg\LOCALS~1\Temp\TFR3F.tmp 55,33Kt
C:\DOCUME~1\Himberg\LOCALS~1\Temp\TFR4.tmp 31,45Kt
C:\DOCUME~1\Himberg\LOCALS~1\Temp\TFR40.tmp 45,57Kt
C:\DOCUME~1\Himberg\LOCALS~1\Temp\TFR42.tmp 55,33Kt
C:\DOCUME~1\Himberg\LOCALS~1\Temp\TFR43.tmp 57,83Kt
C:\DOCUME~1\Himberg\LOCALS~1\Temp\TFR45.tmp 57,83Kt
C:\DOCUME~1\Himberg\LOCALS~1\Temp\TFR6.tmp 27,13Kt
C:\DOCUME~1\Himberg\LOCALS~1\Temp\TFR7.tmp 31,45Kt
C:\DOCUME~1\Himberg\LOCALS~1\Temp\TFR8.tmp 34,74Kt
C:\DOCUME~1\Himberg\LOCALS~1\Temp\TFR9.tmp 34,74Kt
C:\DOCUME~1\Himberg\LOCALS~1\Temp\TFRA.tmp 9,99Kt
C:\DOCUME~1\Himberg\LOCALS~1\Temp\TFRB.tmp 27,13Kt
C:\DOCUME~1\Himberg\LOCALS~1\Temp\TFRC.tmp 9,99Kt
C:\DOCUME~1\Himberg\LOCALS~1\Temp\TFRD.tmp 31,45Kt
C:\DOCUME~1\Himberg\LOCALS~1\Temp\TFRE.tmp 27,13Kt
C:\DOCUME~1\Himberg\LOCALS~1\Temp\TFRF.tmp 27,13Kt
C:\DOCUME~1\Himberg\LOCALS~1\Temp\troj001.avc 98,85Kt
C:\DOCUME~1\Himberg\LOCALS~1\Temp\troj003.avc 0,10Mt
C:\DOCUME~1\Himberg\LOCALS~1\Temp\troj005.avc 50,26Kt
C:\DOCUME~1\Himberg\LOCALS~1\Temp\troj006.avc 50,18Kt
C:\DOCUME~1\Himberg\LOCALS~1\Temp\troj007.avc 49,49Kt
C:\DOCUME~1\Himberg\LOCALS~1\Temp\troj008.avc 49,30Kt
C:\DOCUME~1\Himberg\LOCALS~1\Temp\troj009.avc 49,68Kt
C:\DOCUME~1\Himberg\LOCALS~1\Temp\troj010.avc 49,05Kt
C:\DOCUME~1\Himberg\LOCALS~1\Temp\troj011.avc 50,59Kt
C:\DOCUME~1\Himberg\LOCALS~1\Temp\troj012.avc 48,46Kt
C:\DOCUME~1\Himberg\LOCALS~1\Temp\troj013.avc 48,94Kt
C:\DOCUME~1\Himberg\LOCALS~1\Temp\troj014.avc 49,67Kt
C:\DOCUME~1\Himberg\LOCALS~1\Temp\troj015.avc 48,79Kt
C:\DOCUME~1\Himberg\LOCALS~1\Temp\troj016.avc 49,22Kt
C:\DOCUME~1\Himberg\LOCALS~1\Temp\troj017.avc 48,95Kt
C:\DOCUME~1\Himberg\LOCALS~1\Temp\troj018.avc 49,28Kt
C:\DOCUME~1\Himberg\LOCALS~1\Temp\troj019.avc 48,84Kt
C:\DOCUME~1\Himberg\LOCALS~1\Temp\troj020.avc 49,07Kt
C:\DOCUME~1\Himberg\LOCALS~1\Temp\troj021.avc 49,05Kt
C:\DOCUME~1\Himberg\LOCALS~1\Temp\troj022.avc 55,31Kt
C:\DOCUME~1\Himberg\LOCALS~1\Temp\troj023.avc 54,35Kt
C:\DOCUME~1\Himberg\LOCALS~1\Temp\troj024.avc 55,00Kt
C:\DOCUME~1\Himberg\LOCALS~1\Temp\troj025.avc 50,24Kt
C:\DOCUME~1\Himberg\LOCALS~1\Temp\troj026.avc 45,98Kt
C:\DOCUME~1\Himberg\LOCALS~1\Temp\troj027.avc 42,40Kt
C:\DOCUME~1\Himberg\LOCALS~1\Temp\troj028.avc 40,49Kt
C:\DOCUME~1\Himberg\LOCALS~1\Temp\troj029.avc 49,33Kt
C:\DOCUME~1\Himberg\LOCALS~1\Temp\troj030.avc 47,58Kt
C:\DOCUME~1\Himberg\LOCALS~1\Temp\troj031.avc 48,89Kt
C:\DOCUME~1\Himberg\LOCALS~1\Temp\troj032.avc 48,15Kt
C:\DOCUME~1\Himberg\LOCALS~1\Temp\troj033.avc 48,48Kt
C:\DOCUME~1\Himberg\LOCALS~1\Temp\troj034.avc 26,85Kt
C:\DOCUME~1\Himberg\LOCALS~1\Temp\TWAIN.LOG 219 tavua
C:\DOCUME~1\Himberg\LOCALS~1\Temp\Twain001.Mtx 4 tavua
C:\DOCUME~1\Himberg\LOCALS~1\Temp\Twunk001.MTX 156 tavua
C:\DOCUME~1\Himberg\LOCALS~1\Temp\Twunk002.MTX 0 tavua
C:\DOCUME~1\Himberg\LOCALS~1\Temp\unknown.htm 236 tavua
C:\DOCUME~1\Himberg\LOCALS~1\Temp\unp000.avc 7,82Kt
C:\DOCUME~1\Himberg\LOCALS~1\Temp\unp001.avc 55,57Kt
C:\DOCUME~1\Himberg\LOCALS~1\Temp\unp002.avc 70,05Kt
C:\DOCUME~1\Himberg\LOCALS~1\Temp\unp003.avc 53,65Kt
C:\DOCUME~1\Himberg\LOCALS~1\Temp\unp004.avc 65,67Kt
C:\DOCUME~1\Himberg\LOCALS~1\Temp\unp005.avc 60,43Kt
C:\DOCUME~1\Himberg\LOCALS~1\Temp\unp006.avc 55,01Kt
C:\DOCUME~1\Himberg\LOCALS~1\Temp\unp007.avc 79,82Kt
C:\DOCUME~1\Himberg\LOCALS~1\Temp\unp008.avc 55,30Kt
C:\DOCUME~1\Himberg\LOCALS~1\Temp\unp009.avc 50,85Kt
C:\DOCUME~1\Himberg\LOCALS~1\Temp\unp010.avc 69,30Kt
C:\DOCUME~1\Himberg\LOCALS~1\Temp\unp011.avc 54,14Kt
C:\DOCUME~1\Himberg\LOCALS~1\Temp\unp012.avc 37,59Kt
C:\DOCUME~1\Himberg\LOCALS~1\Temp\unp013.avc 79,91Kt
C:\DOCUME~1\Himberg\LOCALS~1\Temp\unp014.avc 59,93Kt
C:\DOCUME~1\Himberg\LOCALS~1\Temp\unp015.avc 60,93Kt
C:\DOCUME~1\Himberg\LOCALS~1\Temp\unp016.avc 69,22Kt
C:\DOCUME~1\Himberg\LOCALS~1\Temp\unp017.avc 32,42Kt
C:\DOCUME~1\Himberg\LOCALS~1\Temp\unp018.avc 43,44Kt
C:\DOCUME~1\Himberg\LOCALS~1\Temp\unp019.avc 78,40Kt
C:\DOCUME~1\Himberg\LOCALS~1\Temp\unp020.avc 38,18Kt
C:\DOCUME~1\Himberg\LOCALS~1\Temp\unp021.avc 29,70Kt
C:\DOCUME~1\Himberg\LOCALS~1\Temp\unp022.avc 48,96Kt
C:\DOCUME~1\Himberg\LOCALS~1\Temp\unp023.avc 79,53Kt
C:\DOCUME~1\Himberg\LOCALS~1\Temp\unp024.avc 42,21Kt
C:\DOCUME~1\Himberg\LOCALS~1\Temp\unp025.avc 49,67Kt
C:\DOCUME~1\Himberg\LOCALS~1\Temp\unp026.avc 43,57Kt
C:\DOCUME~1\Himberg\LOCALS~1\Temp\VBE\MSForms.exd 0,14Mt
C:\DOCUME~1\Himberg\LOCALS~1\Temp\virus001.avc 74,79Kt
C:\DOCUME~1\Himberg\LOCALS~1\Temp\virus002.avc 74,71Kt
C:\DOCUME~1\Himberg\LOCALS~1\Temp\virus003.avc 71,99Kt
C:\DOCUME~1\Himberg\LOCALS~1\Temp\virus004.avc 77,10Kt
C:\DOCUME~1\Himberg\LOCALS~1\Temp\virus005.avc 71,71Kt
C:\DOCUME~1\Himberg\LOCALS~1\Temp\virus006.avc 74,33Kt
C:\DOCUME~1\Himberg\LOCALS~1\Temp\virus007.avc 72,39Kt
C:\DOCUME~1\Himberg\LOCALS~1\Temp\virus008.avc 73,43Kt
C:\DOCUME~1\Himberg\LOCALS~1\Temp\virus009.avc 69,76Kt
C:\DOCUME~1\Himberg\LOCALS~1\Temp\virus010.avc 72,47Kt
C:\DOCUME~1\Himberg\LOCALS~1\Temp\virus011.avc 76,61Kt
C:\DOCUME~1\Himberg\LOCALS~1\Temp\virus012.avc 75,57Kt
C:\DOCUME~1\Himberg\LOCALS~1\Temp\virus013.avc 76,39Kt
C:\DOCUME~1\Himberg\LOCALS~1\Temp\virus014.avc 73,29Kt
C:\DOCUME~1\Himberg\LOCALS~1\Temp\virus015.avc 74,50Kt
C:\DOCUME~1\Himberg\LOCALS~1\Temp\virus016.avc 78,85Kt
C:\DOCUME~1\Himberg\LOCALS~1\Temp\virus017.avc 77,41Kt
C:\DOCUME~1\Himberg\LOCALS~1\Temp\virus018.avc 75,00Kt
C:\DOCUME~1\Himberg\LOCALS~1\Temp\virus019.avc 55,03Kt
C:\DOCUME~1\Himberg\LOCALS~1\Temp\virus020.avc 32,06Kt
C:\DOCUME~1\Himberg\LOCALS~1\Temp\worm001.avc 49,07Kt
C:\DOCUME~1\Himberg\LOCALS~1\Temp\worm002.avc 51,26Kt
C:\DOCUME~1\Himberg\LOCALS~1\Temp\worm003.avc 50,53Kt
C:\DOCUME~1\Himberg\LOCALS~1\Temp\worm004.avc 52,46Kt
C:\DOCUME~1\Himberg\LOCALS~1\Temp\worm005.avc 48,28Kt
C:\DOCUME~1\Himberg\LOCALS~1\Temp\worm006.avc 19,09Kt
C:\DOCUME~1\Himberg\LOCALS~1\Temp\worm999.avc 5,21Kt
C:\DOCUME~1\Himberg\LOCALS~1\Temp\ytb2.exe 0,95Mt
C:\DOCUME~1\Himberg\LOCALS~1\Temp\_ISTMP1.DIR\_ISTMP0.DIR\FileGrp\nppdf32.dll 100,89Kt
C:\DOCUME~1\Himberg\LOCALS~1\Temp\_spi_setup.log 1,26Kt
C:\DOCUME~1\Himberg\LOCALS~1\Temp\{5809e7cf-4dcf-11d4-9875-00105ace7734}\Rekisteröinti Logitechin Web-sivustoon.url 89 tavua
C:\DOCUME~1\Himberg\LOCALS~1\Temp\~DEST\HPIM0437.JPG 0,14Mt
C:\DOCUME~1\Himberg\LOCALS~1\Temp\~DF4A53.tmp 16,00Kt
C:\DOCUME~1\Himberg\LOCALS~1\Temp\~DFC4A3.tmp 16,00Kt
C:\WINNT\system32\wbem\Logs\DSProvider.log 2 tavua
C:\WINNT\system32\wbem\Logs\mofcomp.log 3,01Kt
C:\WINNT\system32\wbem\Logs\wbemcore.log 8,97Kt
C:\WINNT\system32\wbem\Logs\WinMgmt.log 29,24Kt
C:\WINNT\system32\wbem\Logs\wmiadap.log 13,31Kt
C:\WINNT\system32\wbem\Logs\wmiprov.log 1,25Kt
C:\WINNT\system32\wbem\Logs\wbemcore.lo_ 64,04Kt
C:\WINNT\COM .log 388 tavua
C:\WINNT\comsetup.log 47,99Kt
C:\WINNT\dahotfix.log 1,70Kt
C:\WINNT\Directx.log 65,62Kt
C:\WINNT\F-Bot.log 0,41Mt
C:\WINNT\FSAVINST.LOG 20,84Kt
C:\WINNT\fsavunin.log 2,73Kt
C:\WINNT\fsbwinst.log 2,25Kt
C:\WINNT\FSISU.log 0,68Mt
C:\WINNT\fsmaunin.log 1,66Kt
C:\WINNT\fswssdbg.log 67,13Kt
C:\WINNT\iis5.log 60,29Kt
C:\WINNT\imsins.log 1,40Kt
C:\WINNT\MEHInst.log 166 tavua
C:\WINNT\MEHUnIn.log 50 tavua
C:\WINNT\mmdet.log 344 tavua
C:\WINNT\ocgen.log 12,66Kt
C:\WINNT\ockodak.log 971 tavua
C:\WINNT\setupact.log 98,02Kt
C:\WINNT\setupapi.log 0,35Mt
C:\WINNT\setuperr.log 0 tavua
C:\WINNT\SP2SRP1.log 27,25Kt
C:\WINNT\wmsetup.log 356 tavua
C:\WINNT\Active Setup Log.BAK 1,50Kt
C:\WINNT\imsins.BAK 4,33Kt
C:\WINNT\Active Setup Log.txt 1,02Kt
C:\WINNT\ntbtlog.txt 72,21Kt
C:\WINNT\OEWABLog.txt 1,15Kt
C:\WINNT\setuplog.txt 0,19Mt
C:\WINNT\Debug\NetSetup.LOG 3,50Kt
C:\WINNT\Debug\UserMode\userenv.log 6,62Kt
C:\WINNT\security\logs\backup.log 2,43Kt
C:\WINNT\security\logs\scesetup.log 1,32Mt
C:\Documents and Settings\Himberg\Application Data\Macromedia\Flash Player\#SharedObjects\JJTZEW3K\video.google.com\googleplayer.swf\mediaPlayerUserSettings.sol 94 tavua
C:\Documents and Settings\Himberg\Application Data\Macromedia\Flash Player\#SharedObjects\JJTZEW3K\youtube.com\soundData.sol 58 tavua
C:\Documents and Settings\Himberg\Application Data\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#video.google.com\settings.sol 86 tavua
C:\Documents and Settings\Himberg\Application Data\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#youtube.com\settings.sol 81 tavua
C:\Documents and Settings\Himberg\Application Data\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\settings.sol 397 tavua
C:\Program Files\Ahead\Nero\NeroHistory.log 67,31Kt
------------------------------------------------------------------------------------------
unistaall lista
• Avaa HiJackThis
• Klikkaa "Configure" valintaa oikealla alhaalla
• Klikkaa "Misc Tools"
• Klikkaa boxia joka sanoo "Uninstall Manager"
• Klikkaa valintaa "Save list"
• Kopioi ja liitä kyseinen lista muistiosta postiisi
Adobe Acrobat 5.0
CCleaner (remove only)
ewido anti-spyware 4.0
GT Suomi
HijackThis 1.99.1
hp deskjet 845c series (Vain poisto)
HP löydä digitaalinen valokuvaus
HP Photo and Imaging 2.0 - Photosmart Cameras
HP-muistolevy
Logitech iTouch -ohjelmisto
Logitech MouseWare 9.42 .1
Logitech-käyttöopas
Macromedia Flash Player 8
Micrografx Designer 7
Micrografx Graphics Suite 2 Enterprise
Micrografx Picture Publisher 7
Micrografx QuickVector
Micrografx Simply 3D 2
Microsoft Internet Explorer 6
Microsoft Office 2000 SR-1 Professional
MSN Messenger 7.0
MSN Työkalupalkki
MUSTEK 1200 UB v2.0a
nemosf
Nero - Burning Rom
NVIDIA Windows 2000 Display Drivers
Paint Shop Pro 7
Skype 2.0
Symbols
Ulead Photo Express 2.0 SE
Windows 2000 Hotfix (Pre-SP3) [See Q252795 for more information]
Windows 2000 Hotfix (Pre-SP3) [See Q286221 for more information]
Windows 2000 Hotfix (Pre-SP3) [See Q308707 for more information]
Windows 2000 Hotfix (Pre-SP3) [See Q311537 for more information]
Windows 2000 Hotfix (Pre-SP3) [See Q311967 for more information]
Windows 2000 Hotfix (Pre-SP3) [See Q313582 for more information]
Windows 2000 Hotfix (Pre-SP3) [See Q313829 for more information]
Windows 2000 Hotfix (Pre-SP3) [See Q314147 for more information]
Windows 2000 Security Rollup Package [See Q311401 for more information]
winter
WinZip
osu silmään erikoista.
katotaas tolla.
Lataa Findlop by Metallica
http://metallica.geekstogo.com/findlop.zip
pura zippi, tuplaklikkaa findlop.bat
loki on täällä -> C:\findlop.txt
kohta tulee vain mieleen käyttöjärjestelmän uudeleen asennus :(
Aika laiha oli tulos, tekstitiedostoon ei tullut kuin yksi rivi (koitin sekä normaali- että vikasietotilassa):
[TRACE] Enumerating jobs and queues
Alkaa itselläkin usko loppumaan ja tekisi mieli valella laite sytytysnesteellä ja heittää tikku perään. Jos ei enää tule uusia ideoita, ei mahda mitään. Arvostan apuasi joka tapauksessa aivan helvatisti. Iso hatunnosto, että olet jaksanut sinnitellä mukana! Tietokoneiden parissa aika kuluu rattoisasti...
Meinaan ilman virustorjunta ohjelmaa ja palomuuria ei ole nettiin mitään asiaa koneella.
lataa http://www.f-secure.com/blacklight/try.shtml
työpöydällesi;
Tupla-klikkaa blbeta.exe, hyväksy sopimus, klikkaa > Scan, sitten > Next
Näet listan kaikesta mitä löytyi. Työpöydällesi myös ilmestyy loki jonka nimi on fsbl.xxxxxxx.log (xxxxxxx;n tilalla on luultavimmin numeroita).
Kopioi ja liitä tämä loki seuraavaan vastaukseesi. Älä valitse "Rename" optiota vielä! Haluamme nähdä login ensin, koska hyviä tiedostoja saattaa olla mukana, kuten "wbemtest.exe".
tuo viellä testiin
Lataa Aproposkorjaus seuraavasta linkistä;
http://swandog46.geekstogo.com/aproposfix.exe
Tallenna se työpöydällesi mutta älä tee sillä mitään vielä.
Käynnistä kone vikasietotilassa;
1) Käynnistä uudelleen
2) Hakkaa F8;a ennen kuin Windowsin latauskuva tulee.
3) Pitäisi ilmestyä valikko
4) Valitse ensimmäinen optio; käynnistä Vikasietotilassa
Tuplaklikkaa aproposfix.exe ja unzippaa se työpöydälle. Avaa AproposFix kansio työpöydältäsi ja käynnistä RunThis.bat. Seuraa ohjeita.
Kun se on valmis, boottaa normaalisti Windowsiin, ja postita uusi HijackThis loki ja sen mukana kaikki sisältö log.txt filusta AproposFix kansion sisältä
Tässä loki. Mitta alkaa olla sen verran täynnä, että taidan painua unten maille ja vetää huomenna isot kännit. Jos tulee vielä jotain mieleen tämän lokin tiimoilta tai muuten, ehdotuksia otetaan luonnollisesti mielellään edelleen vastaan... Kiitokset ja öitä.
09/16/06 00:51:20 [Info]: BlackLight Engine 1.0.46 initialized
09/16/06 00:51:20 [Info]: OS: 5.0 build 2195 (Service Pack 2)
09/16/06 00:51:20 [Note]: 7019 4
09/16/06 00:51:20 [Note]: 7005 0
09/16/06 00:51:22 [Note]: 7006 0
09/16/06 00:51:22 [Note]: 7011 764
09/16/06 00:51:22 [Note]: 7026 0
09/16/06 00:51:23 [Note]: 7026 0
09/16/06 00:51:26 [Note]: FSRAW library version 1.7.1019
09/16/06 00:52:24 [Note]: 2000 1006
09/16/06 00:52:24 [Note]: 2000 1006
09/16/06 00:52:24 [Note]: 2000 1006
09/16/06 00:52:36 [Note]: 7007 0
öitä tuo on puhas
Peli jatkuu... Tässä Aproposfixin antama loki (vaikutti kyllä siltä, ettei se toiminut kunnolla, "skannaus" ei kestänyt juuri paria sekuntia kauempaa ja ilmoitti, että jotain apropos.txt tiedostoa ei löytynyt). Apropos -lokin perässä on viimeisin hjt-loki.
Log of AproposFix v1.1
************
Running from directory:
C:\Documents and Settings\Himberg\Ty”p”yt„\aproposfix
************
Registry entries found:
************
No service found!
Removing hidden folder:
No folder found!
Deleting files:
Backing up files:
-----
Tästä alkaa hjt-loki:
Logfile of HijackThis v1.99.1
Scan saved at 13:25:49, on 16.9.2006
Platform: Windows 2000 SP2 (WinNT 5.00.2195)
MSIE: Internet Explorer v6.00 (6.00.2600.0000)
Running processes:
C:\WINNT\System32\smss.exe
C:\WINNT\system32\winlogon.exe
C:\WINNT\system32\services.exe
C:\WINNT\system32\lsass.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\system32\spoolsv.exe
C:\WINNT\System32\svchost.exe
C:\WINNT\system32\regsvc.exe
C:\WINNT\system32\MSTask.exe
C:\WINNT\system32\stisvc.exe
C:\WINNT\System32\WBEM\WinMgmt.exe
C:\WINNT\Explorer.EXE
C:\Program Files\Logitech\iTouch\iTouch.exe
C:\PROGRA~1\Logitech\MOUSEW~1\SYSTEM\EM_EXEC.EXE
C:\WINNT\System32\spool\drivers\w32x86\3\hpztsb03.exe
C:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnd.exe
C:\Program Files\Hewlett-Packard\Digital Imaging\Unload\hpqcmon.exe
C:\Program Files\Ulead Systems\Ulead Photo Express 2 SE\ChkFont.exe
C:\WINNT\loadqm.exe
C:\Program Files\MSN Apps\Updater\01.02.3000.1001\fi\msnappau.exe
C:\Program Files\ewido anti-spyware 4.0\ewido.exe
C:\WINNT\System32\internat.exe
C:\Program Files\Skype\Phone\Skype.exe
C:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnf.exe
C:\Program Files\Ulead Systems\Ulead Photo Express 2 SE\CalCheck.exe
C:\Program Files\WinZip\WZQKPICK.EXE
C:\HJT\Skanneri.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.fi/
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Linkit
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: ST - {9394EDE7-C8B5-483E-8773-474BF36AF6E4} - C:\Program Files\MSN Apps\ST\01.03.0000.1005\en-xu\stmain.dll
O2 - BHO: MSNToolBandBHO - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Apps\MSN Toolbar\01.02.4000.1001\fi\msntb.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINNT\System32\msdxm.ocx
O3 - Toolbar: MSN - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Apps\MSN Toolbar\01.02.4000.1001\fi\msntb.dll
O4 - HKLM\..\Run: [Synchronization Manager] mobsync.exe /logon
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE NvQTwk,NvCplDaemon initialize
O4 - HKLM\..\Run: [NeroCheck] C:\WINNT\System32\NeroCheck.exe
O4 - HKLM\..\Run: [zBrowser Launcher] C:\Program Files\Logitech\iTouch\iTouch.exe
O4 - HKLM\..\Run: [EM_EXEC] C:\PROGRA~1\Logitech\MOUSEW~1\SYSTEM\EM_EXEC.EXE
O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINNT\System32\spool\drivers\w32x86\3\hpztsb03.exe
O4 - HKLM\..\Run: [Share-to-Web Namespace Daemon] C:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnd.exe
O4 - HK
No niin, peli jatkuu...
Apropos on nyt ajettu, mutta tuntui vähän siltä, ettei toiminut kunnolla. "Skannaus" kesti n. pari sekuntia ja se antoi virheilmituksen, ettei löytänyt jotain apropos.txt -tiedostoa. Tässä nyt joka tapauksessa log.tx tiedoston sisältö. sen perässä on viimeisin hjt-loki.
Log of AproposFix v1.1
************
Running from directory:
C:\Documents and Settings\Himberg\Ty”p”yt„\aproposfix
************
Registry entries found:
************
No service found!
Removing hidden folder:
No folder found!
Deleting files:
Backing up files:
--------------------
Hjt loki:
Logfile of HijackThis v1.99.1
Scan saved at 13:25:49, on 16.9.2006
Platform: Windows 2000 SP2 (WinNT 5.00.2195)
MSIE: Internet Explorer v6.00 (6.00.2600.0000)
Running processes:
C:\WINNT\System32\smss.exe
C:\WINNT\system32\winlogon.exe
C:\WINNT\system32\services.exe
C:\WINNT\system32\lsass.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\system32\spoolsv.exe
C:\WINNT\System32\svchost.exe
C:\WINNT\system32\regsvc.exe
C:\WINNT\system32\MSTask.exe
C:\WINNT\system32\stisvc.exe
C:\WINNT\System32\WBEM\WinMgmt.exe
C:\WINNT\Explorer.EXE
C:\Program Files\Logitech\iTouch\iTouch.exe
C:\PROGRA~1\Logitech\MOUSEW~1\SYSTEM\EM_EXEC.EXE
C:\WINNT\System32\spool\drivers\w32x86\3\hpztsb03.exe
C:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnd.exe
C:\Program Files\Hewlett-Packard\Digital Imaging\Unload\hpqcmon.exe
C:\Program Files\Ulead Systems\Ulead Photo Express 2 SE\ChkFont.exe
C:\WINNT\loadqm.exe
C:\Program Files\MSN Apps\Updater\01.02.3000.1001\fi\msnappau.exe
C:\Program Files\ewido anti-spyware 4.0\ewido.exe
C:\WINNT\System32\internat.exe
C:\Program Files\Skype\Phone\Skype.exe
C:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnf.exe
C:\Program Files\Ulead Systems\Ulead Photo Express 2 SE\CalCheck.exe
C:\Program Files\WinZip\WZQKPICK.EXE
C:\HJT\Skanneri.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.fi/
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Linkit
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: ST - {9394EDE7-C8B5-483E-8773-474BF36AF6E4} - C:\Program Files\MSN Apps\ST\01.03.0000.1005\en-xu\stmain.dll
O2 - BHO: MSNToolBandBHO - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Apps\MSN Toolbar\01.02.4000.1001\fi\msntb.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINNT\System32\msdxm.ocx
O3 - Toolbar: MSN - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Apps\MSN Toolbar\01.02.4000.1001\fi\msntb.dll
O4 - HKLM\..\Run: [Synchronization Manager] mobsync.exe /logon
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE NvQTwk,NvCplDaemon initialize
O4 - HKLM\..\Run: [NeroCheck] C:\WINNT\System32\NeroCheck.exe
O4 - HKLM\..\Run: [zBrowser Launcher] C:\Program Files\Logitech\iTouch\iTouch.exe
O4 - HKLM\..\Run: [EM_EXEC] C:\PROGRA~1\Logitech\MOUSEW~1\SYSTEM\EM_EXEC.EXE
O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINNT\System32\spool\drivers\w32x86\3\hpztsb03.exe
O4 - HKLM\..\Run: [Share-to-Web Namespace Daemon] C:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnd.exe
O4 - HKLM\..\Run: [CamMonitor] C:\Program Files\Hewlett-Packard\Digital Imaging\\Unload\hpqcmon.exe
O4 - HKLM\..\Run: [PE2CKFNT SE] C:\Program Files\Ulead Systems\Ulead Photo Express 2 SE\ChkFont.exe
O4 - HKLM\..\Run: [LoadQM] loadqm.exe
O4 - HKLM\..\Run: [msnappau] "C:\Program Files\MSN Apps\Updater\01.02.3000.1001\fi\msnappau.exe"
O4 - HKLM\..\Run: [!ewido] "C:\Program Files\ewido anti-spyware 4.0\ewido.exe" /minimized
O4 - HKCU\..\Run: [internat.exe] internat.exe
O4 - HKCU\..\Run: [Skype] "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O4 - Global Startup: Photo Express Calendar Checker SE.lnk = C:\Program Files\Ulead Systems\Ulead Photo Express 2 SE\CalCheck.exe
O4 - Global Startup: WinZip Quick Pick.lnk = C:\Program Files\WinZip\WZQKPICK.EXE
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/msnmessengersetupdownloader.cab
O23 - Service: Loogisen levyn hallinnan valvontapalvelu (dmadmin) - VERITAS Software Corp. - C:\WINNT\System32\dmadmin.exe
Nyt näköjään alkaa viestien lähettäminenkin tökkimään... Olisi varmaan parempi pitää näppinsä erossa näistä laitteista. Eka lähetys vaikutti epäonnistuvan (viestiä ei näkynyt ketjussa, mutta nyt se sitten tietysti möllöttää siellä tuplana) Pahoittelen päällekkäisyyttä...
suomi24.fi toiminnasta.
kokeiles asentaa virustorjutaa.
joko se nyt menisi koneelle.
Latasin avg:n ja se sain sen asennettua. Ei käynnistynyt normaalitilassa, mutta vikasiedossa kylläkin. Skannaus kesken, mutta aika paljon kagaa löytänyt nyt jo. Laitan lisäinfoa, kun skannaus valmis.
sitten se palomuuri koneelle. Kun avg on tappanut örkkejä.
Pääset sillä konella sitten nettiin loppujen lopuksi :))
sitten sulla on siellä muistaakseni escan ja ewido niillä vielä kone lävitse
ewido pitää päivittää myös escan.
Muuttuukohan tämä vielä iloksi.
Ei tarvii formatoida. Se jää vielä nähtäväksi.
sitten kun koneellasi on avg toimiva ja palomuuri niin sitten nettiin ja tuonne.
http://www.pandasoftware.com/activescan/com/activescan_principal.htm
* Kun olet Pandan sivulla, klikkaa Scan your PC-painiketta
* Uusi ikkuna aukeaa...klikkaa Check Now-painiketta
* Valitse maa, Country
* Syötä kaupunki, State/Province
* Syötä sähköpostiosoitteesi, e-mail address ja klikkaa send-painiketta
* Valitse joko kotikäyttäjä Home User tai yritys Company
* Klikkaa suurta Scan Now-painiketta
* Jos ActiveX-komponentin asentamista kysytään, salli se.
* Tarvittavien tiedostojen lataaminen alkaa (Huom: Tämä vaihe voi viedä muutamia minuutteja)
* Kun lataukset ovat valmiit, klikkaa Local Disks aloittaaksesi skannauksen
* Kun skannaus on valmis, klikkaa See Report-painiketta jos infektioita löytyi. Klikkaa sitten Save Report ja tallenna raportti johonkin sopivaan sijaintiin (esim työpöydälle).
Pitäisikö infektoituneet tiedostot viedä virus vaultiin vai mitä niille kuuluu tehdä (juuri muita vaihtoehtoja ei näyttäisi olevan tarjolla)? Kaikille riveille tätä ei näköjään pysty edes tekemään -> Move to vault -painiketta ei tule näkyviin. Muutenkin avg:n toiminnassa on jotain hämärää, koska yritin avata control centeriä ja virus vaultia testien jälkeen, mutta kummassakin tapauksessa tulee ruudulle virheilmoitus: Application cannot run due to an error while verifying its electronic certificate.
No, alla joka tapauksessa myös tämän skannauksen tulokset, jos niistä on jotain iloa (aika valtava lista). Nyt laitan taas pillit pussiin tältä erää ja lähden juomaan itseni humalaan. Isot kiitokset taas kaikille ongelman selvittelyyn osallistuneille ja palaillaan asiaan.
C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe,"Virus identified Win32/Virut.A","Infected"
C:\PROGRA~1\Logitech\MOUSEW~1\SYSTEM\EM_EXEC.EXE,"Virus identified Win32/Virut.A","Infected"
C:\Program Files\Common Files\Microsoft Shared\PhotoEd\PHOTOED.EXE,"Virus identified Win32/Virut.A","Infected"
C:\Program Files\Hewlett-Packard\Digital Imaging\\Unload\HpqCmon.exe,"Virus identified Win32/Virut.A","Infected"
C:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnd.exe,"Virus identified Win32/Virut.A","Infected"
C:\Program Files\Internet Explorer\IEXPLORE.EXE,"Virus identified Win32/Virut.A","Infected"
C:\Program Files\Logitech\iTouch\iTouch.exe,"Virus identified Win32/Virut.A","Infected"
C:\Program Files\MSN Apps\Updater\01.02.3000.1001\fi\msnappau.exe,"Virus identified Win32/Virut.A","Infected"
C:\Program Files\Microsoft Office\Office\WINWORD.EXE,"Virus identified Win32/Virut.A","Infected"
C:\Program Files\Ulead Systems\Ulead Photo Express 2 SE\ChkFont.exe,"Virus identified Win32/Virut.A","Infected"
C:\Program Files\ewido anti-spyware 4.0\ewido.exe,"Virus identified Win32/Virut.A","Infected"
C:\WINNT\System32\NeroCheck.exe,"Virus identified Win32/Virut.A","Infected"
C:\WINNT\System32\internat.exe,"Virus identified Win32/Virut.A","Infected"
C:\WINNT\System32\mobsync.exe,"Virus identified Win32/Virut.A","Infected"
C:\WINNT\System32\mshta.exe,"Virus identified Win32/Virut.A","Infected"
C:\WINNT\System32\rundll32.exe,"Virus identified Win32/Virut.A","Infected"
C:\WINNT\System32\spool\drivers\w32x86\3\hpztsb03.exe,"Virus identified Win32/Virut.A","Infected"
C:\WINNT\System32\wscript.exe,"Virus identified Win32/Virut.A","Infected"
C:\WINNT\loadqm.exe,"Virus identified Win32/Virut.A","Infected"
C:\WINNT\regedit.exe,"Virus identified Win32/Virut.A","Infected"
C:\UNWISE.EXE,"Virus identified Win32/Virut.A","Infected"
C:\Documents and Settings\Himberg\Työpöytä\jt.exe,"Virus identified Win32/Virut.A","Infected"
C:\Documents and Settings\Himberg\Työpöytä\aproposfix\grep.exe,"Virus identified Win32/Virut.A","Infected"
C:\Documents and Settings\Himberg\Työpöytä\aproposfix\sed.exe,"Virus identified Win32/Virut.A","Infected"
C:\Documents and Settings\Himberg\Työpöytä\aproposfix\zip.exe,"Virus identified Win32/Virut.A","Infected"
C:\Documents and Settings\Himberg\Työpöytä\SDFix\Process.exe,"Virus identified Win32/Virut.A","Infected"
C:\Documents and Settings\Himberg\Työpöytä\SDFix\RegDACL.exe,"Virus identified Win32/Virut.A","Infected"
C:\Documents and Settings\Himberg\Työpöytä\SDFix\RestartIt!.exe,"Virus identified Win32/Virut.A","Infected"
C:\Documents and Settings\Himberg\Työpöytä\SDFix\swreg.exe,"Virus identified Win32/Virut.A","Infected"
C:\Documents and Settings\Himberg\Työpöytä\SDFix\swsc.exe,"Virus identified Win32/Virut.A","Infected"
C:\Documents and Settings\Himberg\Työpöytä\SDFix\zip.exe,"Virus identified Win32/Virut.A","Infected"
C:\Documents and Settings\Himberg\Työpöytä\SmitfraudFix\dumphive.exe,"Virus identified Win32/Virut.A","Infected"
C:\Documents and Settings\Himberg\Työpöytä\SmitfraudFix\GenericRenosFix.exe,"Virus identified Win32/Virut.A","Infected"
C:\Documents and Settings\Himberg\Työpöytä\SmitfraudFix\Process.exe,"Virus identified Win32/Virut.A","Infected"
C:\Documents and Settings\Himberg\Työpöytä\SmitfraudFix\Reboot.exe,"Virus identified Win32/Virut.A","Infected"
C:\Documents and Settings\Himberg\Työpöytä\SmitfraudFix\restart.exe,"Virus identified Win32/Virut.A","Infected"
C:\Documents and Settings\Himberg\Työpöytä\SmitfraudFix\swreg.exe,"Virus identified Win32/Virut.A","Infected"
C:\Documents and Settings\Himberg\Työpöytä\SmitfraudFix\swsc.exe,"Virus identified Win32/Virut.A","Infected"
C:\HJT\Skanneri.exe,"Virus identified Win32/Virut.A","Infected"
C:\I386\EXPAND.EXE,"Virus identified Win32/Virut.A","Infected"
C:\I386\NTSD.EXE,"Virus identified Win32/Virut.A","Infected"
C:\I386\REGEDIT.EXE,"Virus identified Win32/Virut.A","Infected"
C:\I386\TELNET.EXE,"Virus identified Win32/Virut.A","Infected"
C:\I386\WINNT32.EXE,"Virus identified Win32/Virut.A","Infected"
C:\I386\WIN9XMIG\FAX\AWDVSTUB.EXE,"Virus identified Win32/Virut.A","Infected"
C:\I386\WIN9XMIG\INOCULAN\_INOC\INSTHLPR.EXE,"Virus identified Win32/Virut.A","Infected"
C:\I386\WIN9XMIG\INOCULAN\_INOC\MIRSETUP.EXE,"Virus identified Win32/Virut.A","Infected"
C:\I386\WIN9XMIG\MAPI\DLL\MKNTFRMCACHE.EXE,"Virus identified Win32/Virut.A","Infected"
C:\I386\WIN9XMIG\NAV\MIGAPP.EXE,"Virus identified Win32/Virut.A","Infected"
C:\Kaspersky\Getvlist.exe,"Virus identified Win32/Virut.A","Infected"
C:\Kaspersky\kavss.exe,"Virus identified Win32/Virut.A","Infected"
C:\Kaspersky\kavupd.exe,"Virus identified Win32/Virut.A","Infected"
C:\Program Files\Adobe\Acrobat 5.0\Reader\AcroRd32.exe,"Virus identified Win32/Virut.A","Infected"
C:\Program Files\ahead\CoverDesigner\CoverDes.exe,"Virus identified Win32/Virut.A","Infected"
C:\Program Files\ahead\Nero\nero.exe,"Virus identified Win32/Virut.A","Infected"
C:\Program Files\ahead\Nero\NeroCmd.exe,"Virus identified Win32/Virut.A","Infected"
C:\Program Files\ahead\Nero\WaveEditor\WaveEdit.exe,"Virus identified Win32/Virut.A","Infected"
C:\Program Files\ahead\Nero ToolKit\CDSpeed.exe,"Virus identified Win32/Virut.A","Infected"
C:\Program Files\ahead\Nero ToolKit\DriveSpeed.exe,"Virus identified Win32/Virut.A","Infected"
C:\Program Files\CCleaner\ccleaner.exe,"Virus identified Win32/Virut.A","Infected"
C:\Program Files\Common Files\InstallShield\Engine\6\Intel 32\IKernel.exe,"Virus identified Win32/Virut.A","Infected"
C:\Program Files\Common Files\InstallShield\Engine\6\Intel 32\knlwrap.exe,"Virus identified Win32/Virut.A","Infected"
C:\Program Files\Common Files\Logitech\CdlsHand\CdlsHand.exe,"Virus identified Win32/Virut.A","Infected"
C:\Program Files\Common Files\Logitech\WebColct\WebColct.exe,"Virus identified Win32/Virut.A","Infected"
C:\Program Files\Common Files\Microsoft Shared\Artgalry\ARTGALRY.EXE,"Virus identified Win32/Virut.A","Infected"
C:\Program Files\Common Files\Microsoft Shared\Artgalry\CAG.EXE,"Virus identified Win32/Virut.A","Infected"
C:\Program Files\Common Files\Microsoft Shared\Database Replication\WZCNFLCT.EXE,"Virus identified Win32/Virut.A","Infected"
C:\Program Files\Common Files\Microsoft Shared\Datamap\DATAINST.EXE,"Virus identified Win32/Virut.A","Infected"
C:\Program Files\Common Files\Microsoft Shared\Datamap\MSMAP.EXE,"Virus identified Win32/Virut.A","Infected"
C:\Program Files\Common Files\Microsoft Shared\Equation\EQNEDT32.EXE,"Virus identified Win32/Virut.A","Infected"
C:\Program Files\Common Files\Microsoft Shared\MSInfo\msinfo32.exe,"Virus identified Win32/Virut.A","Infected"
C:\Program Files\Common Files\Microsoft Shared\MSInfo\OFFPROV.EXE,"Virus identified Win32/Virut.A","Infected"
C:\Program Files\Common Files\Microsoft Shared\OrgChart\ORGCHART.EXE,"Virus identified Win32/Virut.A","Infected"
C:\Program Files\Common Files\Microsoft Shared\PhotoEd\PHOTOED.EXE,"Virus identified Win32/Virut.A","Infected"
C:\Program Files\Common Files\System\Mapi\1035\NT\CNFNOT32.EXE,"Virus identified Win32/Virut.A","Infected"
C:\Program Files\Common Files\System\Mapi\1035\NT\NEWPROF.EXE,"Virus identified Win32/Virut.A","Infected"
C:\Program Files\Common Files\System\Mapi\1035\NT\SCANPST.EXE,"Virus identified Win32/Virut.A","Infected"
C:\Program Files\EuroTool\euroconv.exe,"Virus identified Win32/Virut.A","Infected"
C:\Program Files\ewido anti-spyware 4.0\ewido.exe,"Virus identified Win32/Virut.A","Infected"
C:\Program Files\ewido anti-spyware 4.0\guard.exe,"Virus identified Win32/Virut.A","Infected"
C:\Program Files\Grisoft\AVG Free\avgcc.exe,"Virus identified Win32/Virut.A","Infected"
C:\Program Files\Grisoft\AVG Free\avgvv.exe,"Virus identified Win32/Virut.A","Infected"
C:\Program Files\Grisoft\AVG Free\avgw.exe,"Virus identified Win32/Virut.A","Infected"
C:\Program Files\Grisoft\AVG Free\setup.exe,"Virus identified Win32/Virut.A","Infected"
C:\Program Files\GTSuomi\GTSuomi.exe,"Virus identified Win32/Virut.A","Infected"
C:\Program Files\GTSuomi\UNWISE.EXE,"Virus identified Win32/Virut.A","Infected"
C:\Program Files\Hewlett-Packard\Digital Imaging\Album\hpqaprnt.exe,"Virus identified Win32/Virut.A","Infected"
C:\Program Files\Hewlett-Packard\Digital Imaging\bin\DestTest.exe,"Virus identified Win32/Virut.A","Infected"
C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpqanon.exe,"Virus identified Win32/Virut.A","Infected"
C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpqaol08.exe,"Virus identified Win32/Virut.A","Infected"
C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpqclpbd.exe,"Virus identified Win32/Virut.A","Infected"
C:\Program Files\Hewlett-Packard\Digital Imaging\bin\Hpqdirec.exe,"Virus identified Win32/Virut.A","Infected"
C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpqdstcp.exe,"Virus identified Win32/Virut.A","Infected"
C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpqEmlsz.exe,"Virus identified Win32/Virut.A","Infected"
C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpqfru07.exe,"Virus identified Win32/Virut.A","Infected"
C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpqirs08.exe,"Virus identified Win32/Virut.A","Infected"
C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpqpos08.exe,"Virus identified Win32/Virut.A","Infected"
C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpqprntw.exe,"Virus identified Win32/Virut.A","Infected"
C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpqptc08.exe,"Virus identified Win32/Virut.A","Infected"
C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpqqpj08.exe,"Virus identified Win32/Virut.A","Infected"
C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpqtax08.exe,"Virus identified Win32/Virut.A","Infected"
C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpqthb08.exe,"Virus identified Win32/Virut.A","Infected"
C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpqudc08.exe,"Virus identified Win32/Virut.A","Infected"
C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpqvwr08.exe,"Virus identified Win32/Virut.A","Infected"
C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpqwrap.exe,"Virus identified Win32/Virut.A","Infected"
C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpqwrg.exe,"Virus identified Win32/Virut.A","Infected"
C:\Program Files\Hewlett-Packard\Digital Imaging\bin\svtf.exe,"Virus identified Win32/Virut.A","Infected"
C:\Program Files\Hewlett-Packard\Digital Imaging\Diagnostics\Diagnostics\HPSysDig.exe,"Virus identified Win32/Virut.A","Infected"
C:\Program Files\Hewlett-Packard\Digital Imaging\Unload\HpqApkil.exe,"Virus identified Win32/Virut.A","Infected"
C:\Program Files\Hewlett-Packard\Digital Imaging\Unload\HpqCmon.exe,"Virus identified Win32/Virut.A","Infected"
C:\Program Files\Hewlett-Packard\Digital Imaging\Unload\HpqPhUnl.exe,"Virus identified Win32/Virut.A","Infected"
C:\Program Files\Hewlett-Packard\Digital Imaging\Unload\HpqPSmon.exe,"Virus identified Win32/Virut.A","Infected"
C:\Program Files\Hewlett-Packard\Digital Imaging\Unload\HpqUnSet.exe,"Virus identified Win32/Virut.A","Infected"
C:\Program Files\Hewlett-Packard\hp deskjet assistant\bin\browser.exe,"Virus identified Win32/Virut.A","Infected"
C:\Program Files\Hewlett-Packard\hp deskjet assistant\bin\printpcl.exe,"Virus identified Win32/Virut.A","Infected"
C:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnd.exe,"Virus identified Win32/Virut.A","Infected"
C:\Program Files\Hewlett-Packard\HP Share-to-Web\S2WEx.exe,"Virus identified Win32/Virut.A","Infected"
C:\Program Files\Hewlett-Packard\HP Share-to-Web\Shar2Web.exe,"Virus identified Win32/Virut.A","Infected"
C:\Program Files\Hewlett-Packard\HPCDROM\msinfo32.exe,"Virus identified Win32/Virut.A","Infected"
C:\Program Files\Hewlett-Packard\HPCDROM\creative\Setup.exe,"Virus identified Win32/Virut.A","Infected"
C:\Program Files\Hewlett-Packard\HPZ\Glue\hpfsched.exe,"Virus identified Win32/Virut.A","Infected"
C:\Program Files\Hewlett-Packard\HPZ\Glue\hpzcin04.exe,"Virus identified Win32/Virut.A","Infected"
C:\Program Files\Hewlett-Packard\HPZ\Glue\hpzglu03.exe,"Virus identified Win32/Virut.A","Infected"
C:\Program Files\Hewlett-Packard\HPZ\Glue\util\845c\hpfpdi03.exe,"Virus identified Win32/Virut.A","Infected"
C:\Program Files\Hewlett-Packard\HPZ\Glue\util\845c\hpzghl03.exe,"Virus identified Win32/Virut.A","Infected"
C:\Program Files\Hewlett-Packard\HPZ\Glue\util\845c\hpzpin03.exe,"Virus identified Win32/Virut.A","Infected"
C:\Program Files\Hewlett-Packard\Memories Disc\hpod.exe,"Virus identified Win32/Virut.A","Infected"
C:\Program Files\Hewlett-Packard\Memories Disc\hpodinst.exe,"Virus identified Win32/Virut.A","Infected"
C:\Program Files\Hewlett-Packard\Memories Disc\hpodlog.exe,"Virus identified Win32/Virut.A","Infected"
C:\Program Files\hp deskjet 845c series\hpfinsta.exe,"Virus identified Win32/Virut.A","Infected"
C:\Program Files\hp deskjet 845c series\hpfiui.exe,"Virus identified Win32/Virut.A","Infected"
C:\Program Files\hp deskjet 845c series\hpfxicm.exe,"Virus identified Win32/Virut.A","Infected"
C:\Program Files\hp deskjet 845c series\printpcl.exe,"Virus identified Win32/Virut.A","Infected"
C:\Program Files\hp deskjet 845c series\ereg\register.exe,"Virus identified Win32/Virut.A","Infected"
C:\Program Files\InstallShield Installation Information\{036AA4D4-6D32-11D4-9875-00105ACE7734}\Setup.exe,"Virus identified Win32/Virut.A","Infected"
C:\Program Files\InstallShield Installation Information\{5809E7CF-4DCF-11D4-9875-00105ACE7734}\Setup.exe,"Virus identified Win32/Virut.A","Infected"
C:\Program Files\InstallShield Installation Information\{92B3EF78-3DB2-4DED-8DD1-F2DDF6EC2DF3}\Setup.exe,"Virus identified Win32/Virut.A","Infected"
C:\Program Files\InstallShield Installation Information\{CBE0FCA1-4E95-11D4-9875-00105ACE7734}\Setup.exe,"Virus identified Win32/Virut.A","Infected"
C:\Program Files\Internet Explorer\DW15.EXE,"Virus identified Win32/Virut.A","Infected"
C:\Program Files\Internet Explorer\IEXPLORE.EXE,"Virus identified Win32/Virut.A","Infected"
C:\Program Files\Internet Explorer\Connection Wizard\icwconn1.exe,"Virus identified Win32/Virut.A","Infected"
C:\Program Files\Internet Explorer\Connection Wizard\icwconn2.exe,"Virus identified Win32/Virut.A","Infected"
C:\Program Files\Internet Explorer\Connection Wizard\icwrmind.exe,"Virus identified Win32/Virut.A","Infected"
C:\Program Files\Internet Explorer\Connection Wizard\icwtutor.exe,"Virus identified Win32/Virut.A","Infected"
C:\Program Files\Internet Explorer\Connection Wizard\inetwiz.exe,"Virus identified Win32/Virut.A","Infected"
C:\Program Files\Internet Explorer\Connection Wizard\isignup.exe,"Virus identified Win32/Virut.A","Infected"
C:\Program Files\Internet Explorer\IE Uninstall\w2kexcp.exe,"Virus identified Win32/Virut.A","Infected"
C:\Program Files\Internet Explorer\W2K\expinst.exe,"Virus identified Win32/Virut.A","Infected"
C:\Program Files\Jasc Software Inc\Paint Shop Pro 7\anim.exe,"Virus identified Win32/Virut.A","Infected"
C:\Program Files\Jasc Software Inc\Paint Shop Pro 7\psp.exe,"Virus identified Win32/Virut.A","Infected"
C:\Program Files\Jasc Software Inc\Paint Shop Pro 7\tubeconverter.exe,"Virus identified Win32/Virut.A","Infected"
C:\Program Files\Logitech\iTouch\Browser.exe,"Virus identified Win32/Virut.A","Infected"
C:\Program Files\Logitech\iTouch\iTouch.exe,"Virus identified Win32/Virut.A","Infected"
C:\Program Files\Logitech\iTouch\iTouchcf.exe,"Virus identified Win32/Virut.A","Infected"
C:\Program Files\Logitech\iTouch\KbdTray.exe,"Virus identified Win32/Virut.A","Infected"
C:\Program Files\Logitech\iTouch\secloc.exe,"Virus identified Win32/Virut.A","Infected"
C:\Program Files\Logitech\MouseWare\system\EM_EXEC.EXE,"Virus identified Win32/Virut.A","Infected"
C:\Program Files\Micrografx\Designer\DS70.exe,"Virus identified Win32/Virut.A","Infected"
C:\Program Files\Micrografx\Picture Publisher\Pp70.exe,"Virus identified Win32/Virut.A","Infected"
C:\Program Files\Micrografx\Simply 3D 2\S3D2.exe,"Virus identified Win32/Virut.A","Infected"
C:\Program Files\Micrografx\System2\Media Manager\abcmm.exe,"Virus identified Win32/Virut.A","Infected"
C:\Program Files\Micrografx\System2\Media Manager\abcmmcnv.exe,"Virus identified Win32/Virut.A","Infected"
C:\Program Files\Micrografx\System2\MgxIcons\MgxIcons.exe,"Virus identified Win32/Virut.A","Infected"
C:\Program Files\Microsoft Office\Office\BINDER.EXE,"Virus identified Win32/Virut.A","Infected"
C:\Program Files\Microsoft Office\Office\DLGCANCL.EXE,"Virus identified Win32/Virut.A","Infected"
C:\Program Files\Microsoft Office\Office\EXCEL.EXE,"Virus identified Win32/Virut.A","Infected"
C:\Program Files\Microsoft Office\Office\FINDER.EXE,"Virus identified Win32/Virut.A","Infected"
C:\Program Files\Microsoft Office\Office\GRAPH9.EXE,"Virus identified Win32/Virut.A","Infected"
C:\Program Files\Microsoft Office\Office\MAKECERT.EXE,"Virus identified Win32/Virut.A","Infected"
C:\Program Files\Microsoft Office\Office\MSACCESS.EXE,"Virus identified Win32/Virut.A","Infected"
C:\Program Files\Microsoft Office\Office\MSO7FTP.EXE,"Virus identified Win32/Virut.A","Infected"
C:\Program Files\Microsoft Office\Office\MSO7FTPA.EXE,"Virus identified Win32/Virut.A","Infected"
C:\Program Files\Microsoft Office\Office\MSO7FTPS.EXE,"Virus identified Win32/Virut.A","Infected"
C:\Program Files\Microsoft Office\Office\MSOHTMED.EXE,"Virus identified Win32/Virut.A","Infected"
C:\Program Files\Microsoft Office\Office\MSQRY32.EXE,"Virus identified Win32/Virut.A","Infected"
C:\Program Files\Microsoft Office\Office\OSA9.EXE,"Virus identified Win32/Virut.A","Infected"
C:\Program Files\Microsoft Office\Office\OUTLOOK.EXE,"Virus identified Win32/Virut.A","Infected"
C:\Program Files\Microsoft Office\Office\POWERPNT.EXE,"Virus identified Win32/Virut.A","Infected"
C:\Program Files\Microsoft Office\Office\SELFCERT.EXE,"Virus identified Win32/Virut.A","Infected"
C:\Program Files\Microsoft Office\Office\SETLANG.EXE,"Virus identified Win32/Virut.A","Infected"
C:\Program Files\Microsoft Office\Office\WEBPUB.EXE,"Virus identified Win32/Virut.A","Infected"
C:\Program Files\Microsoft Office\Office\WINWORD.EXE,"Virus identified Win32/Virut.A","Infected"
C:\Program Files\Microsoft Office\Office\1035\MSOFFICE.EXE,"Virus identified Win32/Virut.A","Infected"
C:\Program Files\Microsoft Office\Office\1035\MSOHELP.EXE,"Virus identified Win32/Virut.A","Infected"
C:\Program Files\Microsoft Office\Office\1035\NFCLEAN.EXE,"Virus identified Win32/Virut.A","Infected"
C:\Program Files\Microsoft Office\Office\1035\PROJWIZ.EXE,"Virus identified Win32/Virut.A","Infected"
C:\Program Files\Microsoft Office\Office\1035\SCHDPL32.EXE,"Virus identified Win32/Virut.A","Infected"
C:\Program Files\Microsoft Office\Office\1035\WRKGADM.EXE,"Virus identified Win32/Virut.A","Infected"
C:\Program Files\Microsoft Office\Office\forms\1035\REGCFG.EXE,"Virus identified Win32/Virut.A","Infected"
C:\Program Files\Microsoft Office\Office\Xlators\PPVIEW32.EXE,"Virus identified Win32/Virut.A","Infected"
C:\Program Files\MSN Apps\MSN Toolbar\01.02.4000.1001\fi\mtbs.exe,"Virus identified Win32/Virut.A","Infected"
C:\Program Files\MSN Apps\Updater\01.02.0002.1001\fi\msnappau.exe,"Virus identified Win32/Virut.A","Infected"
C:\Program Files\MSN Apps\Updater\01.02.3000.1001\fi\msnappau.exe,"Virus identified Win32/Virut.A","Infected"
C:\Program Files\MSN Messenger\msmsgs.exe,"Virus identified Win32/Virut.A","Infected"
C:\Program Files\MSN Messenger\msnmsgr.exe,"Virus identified Win32/Virut.A","Infected"
C:\Program Files\NetMeeting\cb32.exe,"Virus identified Win32/Virut.A","Infected"
C:\Program Files\NetMeeting\conf.exe,"Virus identified Win32/Virut.A","Infected"
C:\Program Files\NetMeeting\wb32.exe,"Virus identified Win32/Virut.A","Infected"
C:\Program Files\Outlook Express\msimn.exe,"Virus identified Win32/Virut.A","Infected"
C:\Program Files\Outlook Express\oemig50.exe,"Virus identified Win32/Virut.A","Infected"
C:\Program Files\Outlook Express\setup50.exe,"Virus identified Win32/Virut.A","Infected"
C:\Program Files\Outlook Express\wab.exe,"Virus identified Win32/Virut.A","Infected"
C:\Program Files\Outlook Express\wabmig.exe,"Virus identified Win32/Virut.A","Infected"
C:\Program Files\Snapshot Viewer\SNAPVIEW.EXE,"Virus identified Win32/Virut.A","Infected"
C:\Program Files\Symbols\Symbols.exe,"Virus identified Win32/Virut.A","Infected"
C:\Program Files\Symbols\Ohjelmat\Ajat.exe,"Virus identified Win32/Virut.A","Infected"
C:\Program Files\Symbols\Ohjelmat\budj.exe,"Virus identified Win32/Virut.A","Infected"
C:\Program Files\Symbols\Ohjelmat\favorites.exe,"Virus identified Win32/Virut.A","Infected"
C:\Program Files\Symbols\Ohjelmat\Jmtieto.exe,"Virus identified Win32/Virut.A","Infected"
C:\Program Files\Symbols\Ohjelmat\Kalent.exe,"Virus identified Win32/Virut.A","Infected"
C:\Program Files\Symbols\Ohjelmat\Kannat.exe,"Virus identified Win32/Virut.A","Infected"
C:\Program Files\Symbols\Ohjelmat\Kokki.exe,"Virus identified Win32/Virut.A","Infected"
C:\Program Files\Symbols\Ohjelmat\Krypto.exe,"Virus identified Win32/Virut.A","Infected"
C:\Program Files\Symbols\Ohjelmat\Lottery.exe,"Virus identified Win32/Virut.A","Infected"
C:\Program Files\Symbols\Ohjelmat\Lukujarj.exe,"Virus identified Win32/Virut.A","Infected"
C:\Program Files\Symbols\Ohjelmat\Mietelau.exe,"Virus identified Win32/Virut.A","Infected"
C:\Program Files\Symbols\Ohjelmat\Nlaskin.exe,"Virus identified Win32/Virut.A","Infected"
C:\Program Files\Symbols\Ohjelmat\Palat.exe,"Virus identified Win32/Virut.A","Infected"
C:\Program Files\Symbols\Ohjelmat\Puhelin.exe,"Virus identified Win32/Virut.A","Infected"
C:\Program Files\Symbols\Ohjelmat\pvKirja.exe,"Virus identified Win32/Virut.A","Infected"
C:\Program Files\Symbols\Ohjelmat\Taulukko.exe,"Virus identified Win32/Virut.A","Infected"
C:\Program Files\Symbols\Ohjelmat\Varitys.exe,"Virus identified Win32/Virut.A","Infected"
C:\Program Files\Symbols\Ohjelmat\JM\jetman.exe,"Virus identified Win32/Virut.A","Infected"
C:\Program Files\Ulead Systems\Ulead Photo Express 2 SE\CalCheck.exe,"Virus identified Win32/Virut.A","Infected"
C:\Program Files\Ulead Systems\Ulead Photo Express 2 SE\ChkFont.exe,"Virus identified Win32/Virut.A","Infected"
C:\Program Files\Ulead Systems\Ulead Photo Express 2 SE\Ipe20.exe,"Virus identified Win32/Virut.A","Infected"
C:\Program Files\Ulead Systems\Ulead Photo Express 2 SE\IPEShell.exe,"Virus identified Win32/Virut.A","Infected"
C:\Program Files\Ulead Systems\Ulead Photo Express 2 SE\Olreg.exe,"Virus identified Win32/Virut.A","Infected"
C:\Program Files\Ulead Systems\Ulead Photo Express 2 SE\pepack.exe,"Virus identified Win32/Virut.A","Infected"
C:\Program Files\Windows Media Player\logagent.exe,"Virus identified Win32/Virut.A","Infected"
C:\Program Files\Windows Media Player\mplayer2.exe,"Virus identified Win32/Virut.A","Infected"
C:\Program Files\Windows NT\dialer.exe,"Virus identified Win32/Virut.A","Infected"
C:\Program Files\Windows NT\hypertrm.exe,"Virus identified Win32/Virut.A","Infected"
C:\Program Files\Windows NT\Accessories\wordpad.exe,"Virus identified Win32/Virut.A","Infected"
C:\Program Files\Windows NT\Accessories\ImageVue\kodakimg.exe,"Virus identified Win32/Virut.A","Infected"
C:\Program Files\Windows NT\Accessories\ImageVue\kodakprv.exe,"Virus identified Win32/Virut.A","Infected"
C:\Program Files\Windows NT\Pinball\PINBALL.EXE,"Virus identified Win32/Virut.A","Infected"
C:\Program Files\WinZip\WINZIP32.EXE,"Virus identified Win32/Virut.A","Infected"
C:\Program Files\WinZip\WZQKPICK.EXE,"Virus identified Win32/Virut.A","Infected"
C:\Program Files\WinZip\WZSEPE32.EXE,"Virus identified Win32/Virut.A","Infected"
C:\WINNT\delttsul.exe,"Virus identified Win32/Virut.A","Infected"
C:\WINNT\discover.exe,"Virus identified Win32/Virut.A","Infected"
C:\WINNT\hh.exe,"Virus identified Win32/Virut.A","Infected"
C:\WINNT\IsUn040b.exe,"Virus identified Win32/Virut.A","Infected"
C:\WINNT\IsUninst.exe,"Virus identified Win32/Virut.A","Infected"
C:\WINNT\loadqm.exe,"Virus identified Win32/Virut.A","Infected"
C:\WINNT\Mgxclean.exe,"Virus identified Win32/Virut.A","Infected"
C:\WINNT\NOTEPAD.EXE,"Virus identified Win32/Virut.A","Infected"
C:\WINNT\Photo Express 2 SE.scr,"Virus identified Win32/Virut.A","Infected"
C:\WINNT\regedit.exe,"Virus identified Win32/Virut.A","Infected"
C:\WINNT\ss3unstl.exe,"Virus identified Win32/Virut.A","Infected"
C:\WINNT\TASKMAN.EXE,"Virus identified Win32/Virut.A","Infected"
C:\WINNT\twunk_32.exe,"Virus identified Win32/Virut.A","Infected"
C:\WINNT\uninst.exe,"Virus identified Win32/Virut.A","Infected"
C:\WINNT\upwizun.exe,"Virus identified Win32/Virut.A","Infected"
C:\WINNT\welcome.exe,"Virus identified Win32/Virut.A","Infected"
C:\WINNT\winhlp32.exe,"Virus identified Win32/Virut.A","Infected"
C:\WINNT\winrep.exe,"Virus identified Win32/Virut.A","Infected"
C:\WINNT\$NtUninstallQ252795$\hotfix.exe,"Virus identified Win32/Virut.A","Infected"
C:\WINNT\$NtUninstallQ286221$\hotfix.exe,"Virus identified Win32/Virut.A","Infected"
C:\WINNT\$NtUninstallQ308707$\hotfix.exe,"Virus identified Win32/Virut.A","Infected"
C:\WINNT\$NtUninstallQ311537$\hotfix.exe,"Virus identified Win32/Virut.A","Infected"
C:\WINNT\$NtUninstallQ311967$\hotfix.exe,"Virus identified Win32/Virut.A","Infected"
C:\WINNT\$NtUninstallQ313582$\hotfix.exe,"Virus identified Win32/Virut.A","Infected"
C:\WINNT\$NtUninstallQ313829$\hotfix.exe,"Virus identified Win32/Virut.A","Infected"
C:\WINNT\$NtUninstallQ314147$\evntwin.exe,"Virus identified Win32/Virut.A","Infected"
C:\WINNT\$NtUninstallQ314147$\hotfix.exe,"Virus identified Win32/Virut.A","Infected"
C:\WINNT\$NtUninstallQ314147$\snmp.exe,"Virus identified Win32/Virut.A","Infected"
C:\WINNT\$NtUninstallSP2SRP1$\admin.exe,"Virus identified Win32/Virut.A","Infected"
C:\WINNT\$NtUninstallSP2SRP1$\author.exe,"Virus identified Win32/Virut.A","Infected"
C:\WINNT\$NtUninstallSP2SRP1$\cfgwiz.exe,"Virus identified Win32/Virut.A","Infected"
C:\WINNT\$NtUninstallSP2SRP1$\cipher.exe,"Virus identified Win32/Virut.A","Infected"
C:\WINNT\$NtUninstallSP2SRP1$\fpadmcgi.exe,"Virus identified Win32/Virut.A","Infected"
C:\WINNT\$NtUninstallSP2SRP1$\fpcount.exe,"Virus identified Win32/Virut.A","Infected"
C:\WINNT\$NtUninstallSP2SRP1$\fpremadm.exe,"Virus identified Win32/Virut.A","Infected"
C:\WINNT\$NtUninstallSP2SRP1$\htimage.exe,"Virus identified Win32/Virut.A","Infected"
C:\WINNT\$NtUninstallSP2SRP1$\hypertrm.exe,"Virus identified Win32/Virut.A","Infected"
C:\WINNT\$NtUninstallSP2SRP1$\imagemap.exe,"Virus identified Win32/Virut.A","Infected"
C:\WINNT\$NtUninstallSP2SRP1$\lsass.exe,"Virus identified Win32/Virut.A","Infected"
C:\WINNT\$NtUninstallSP2SRP1$\mq1sync.exe,"Virus identified Win32/Virut.A","Infected"
C:\WINNT\$NtUninstallSP2SRP1$\mqbkup.exe,"Virus identified Win32/Virut.A","Infected"
C:\WINNT\$NtUninstallSP2SRP1$\mqmig.exe,"Virus identified Win32/Virut.A","Infected"
C:\WINNT\$NtUninstallSP2SRP1$\mqsvc.exe,"Virus identified Win32/Virut.A","Infected"
C:\WINNT\$NtUninstallSP2SRP1$\netdde.exe,"Virus identified Win32/Virut.A","Infected"
C:\WINNT\$NtUninstallSP2SRP1$\schmupd.exe,"Virus identified Win32/Virut.A","Infected"
C:\WINNT\$NtUninstallSP2SRP1$\shtml.exe,"Virus identified Win32/Virut.A","Infected"
C:\WINNT\$NtUninstallSP2SRP1$\spiisupd.exe,"Virus identified Win32/Virut.A","Infected"
C:\WINNT\$NtUninstallSP2SRP1$\spoolsv.exe,"Virus identified Win32/Virut.A","Infected"
C:\WINNT\$NtUninstallSP2SRP1$\tcptest.exe,"Virus identified Win32/Virut.A","Infected"
C:\WINNT\$NtUninstallSP2SRP1$\tlntsess.exe,"Virus identified Win32/Virut.A","Infected"
C:\WINNT\$NtUninstallSP2SRP1$\tlntsvr.exe,"Virus identified Win32/Virut.A","Infected"
C:\WINNT\$NtUninstallSP2SRP1$\w32tm.exe,"Virus identified Win32/Virut.A","Infected"
C:\WINNT\$NtUninstallSP2SRP1$\wab.exe,"Virus identified Win32/Virut.A","Infected"
C:\WINNT\$NtUninstallSP2SRP1$\winlogon.exe,"Virus identified Win32/Virut.A","Infected"
C:\WINNT\$NtUninstallSP2SRP1$\winver.exe,"Virus identified Win32/Virut.A","Infected"
C:\WINNT\$NtUninstallSP2SRP1$\spuninst\spuninst.exe,"Virus identified Win32/Virut.A","Infected"
C:\WINNT\inf\unregmp2.exe,"Virus identified Win32/Virut.A","Infected"
C:\WINNT\Installer\{0001040B-78E1-11D2-B60F-006097C998E7}\accicons.exe,"Virus identified Win32/Virut.A","Infected"
C:\WINNT\Installer\{0001040B-78E1-11D2-B60F-006097C998E7}\bindico.exe,"Virus identified Win32/Virut.A","Infected"
C:\WINNT\Installer\{0001040B-78E1-11D2-B60F-006097C998E7}\fpicon.exe,"Virus identified Win32/Virut.A","Infected"
C:\WINNT\Installer\{0001040B-78E1-11D2-B60F-006097C998E7}\misc.exe,"Virus identified Win32/Virut.A","Infected"
C:\WINNT\Installer\{0001040B-78E1-11D2-B60F-006097C998E7}\outicon.exe,"Virus identified Win32/Virut.A","Infected"
C:\WINNT\Installer\{0001040B-78E1-11D2-B60F-006097C998E7}\PEicons.exe,"Virus identified Win32/Virut.A","Infected"
C:\WINNT\Installer\{0001040B-78E1-11D2-B60F-006097C998E7}\pptico.exe,"Virus identified Win32/Virut.A","Infected"
C:\WINNT\Installer\{0001040B-78E1-11D2-B60F-006097C998E7}\wordicon.exe,"Virus identified Win32/Virut.A","Infected"
C:\WINNT\Installer\{0001040B-78E1-11D2-B60F-006097C998E7}\xlicons.exe,"Virus identified Win32/Virut.A","Infected"
C:\WINNT\Installer\{32F67131-285D-4DC6-8162-656874ED84D4}\Unload.exe,"Virus identified Win32/Virut.A","Infected"
C:\WINNT\Installer\{32F67131-285D-4DC6-8162-656874ED84D4}\_486AD40031E5_4A05_BAE5_67FC693FE0EF.exe,"Virus identified Win32/Virut.A","Infected"
C:\WINNT\Installer\{6F716DA6-398F-11D3-85E1-005004838609}\places.exe,"Virus identified Win32/Virut.A","Infected"
C:\WINNT\Installer\{A4D7B764-4140-11D4-88EB-0050DA3579C0}\_6EFC48EDCB29_4E9D_AA11_85CB6BF4567E.exe,"Virus identified Win32/Virut.A","Infected"
C:\WINNT\Installer\{D6DE02C7-1F47-11D4-9515-00105AE4B89A}\_F55775012939_41F4_B817_313F464745AD.exe,"Virus identified Win32/Virut.A","Infected"
C:\WINNT\msagent\agentsvr.exe,"Virus identified Win32/Virut.A","Infected"
C:\WINNT\Speech\vcmd.exe,"Virus identified Win32/Virut.A","Infected"
C:\WINNT\system32\accwiz.exe,"Virus identified Win32/Virut.A","Infected"
C:\WINNT\system32\actmovie.exe,"Virus identified Win32/Virut.A","Infected"
C:\WINNT\system32\arp.exe,"Virus identified Win32/Virut.A","Infected"
C:\WINNT\system32\at.exe,"Virus identified Win32/Virut.A","Infected"
C:\WINNT\system32\atmadm.exe,"Virus identified Win32/Virut.A","Infected"
C:\WINNT\system32\attrib.exe,"Virus identified Win32/Virut.A","Infected"
C:\WINNT\system32\bootok.exe,"Virus identified Win32/Virut.A","Infected"
C:\WINNT\system32\bootvrfy.exe,"Virus identified Win32/Virut.A","Infected"
C:\WINNT\system32\cacls.exe,"Virus identified Win32/Virut.A","Infected"
C:\WINNT\system32\calc.exe,"Virus identified Win32/Virut.A","Infected"
C:\WINNT\system32\cdplayer.exe,"Virus identified Win32/Virut.A","Infected"
C:\WINNT\system32\charmap.exe,"Virus identified Win32/Virut.A","Infected"
C:\WINNT\system32\chkdsk.exe,"Virus identified Win32/Virut.A","Infected"
C:\WINNT\system32\chkntfs.exe,"Virus identified Win32/Virut.A","Infected"
C:\WINNT\system32\cidaemon.exe,"Virus identified Win32/Virut.A","Infected"
C:\WINNT\system32\cipher.exe,"Virus identified Win32/Virut.A","Infected"
C:\WINNT\system32\cisvc.exe,"Virus identified Win32/Virut.A","Infected"
C:\WINNT\system32\ckcnv.exe,"Virus identified Win32/Virut.A","Infected"
C:\WINNT\system32\cleanmgr.exe,"Virus identified Win32/Virut.A","Infected"
C:\WINNT\system32\cliconfg.exe,"Virus identified Win32/Virut.A","Infected"
C:\WINNT\system32\clipbrd.exe,"Virus identified Win32/Virut.A","Infected"
C:\WINNT\system32\clipsrv.exe,"Virus identified Win32/Virut.A","Infected"
C:\WINNT\system32\clspack.exe,"Virus identified Win32/Virut.A","Infected"
C:\WINNT\system32\cluster.exe,"Virus identified Win32/Virut.A","Infected"
C:\WINNT\system32\cmd.exe,"Virus identified Win32/Virut.A","Infected"
C:\WINNT\system32\cmdl32.exe,"Virus identified Win32/Virut.A","Infected"
C:\WINNT\system32\cmmgr32.exe,"Virus identified Win32/Virut.A","Infected"
C:\WINNT\system32\cmmon32.exe,"Virus identified Win32/Virut.A","Infected"
C:\WINNT\system32\cmstp.exe,"Virus identified Win32/Virut.A","Infected"
C:\WINNT\system32\comclust.exe,"Virus identified Win32/Virut.A","Infected"
C:\WINNT\system32\comp.exe,"Virus identified Win32/Virut.A","Infected"
C:\WINNT\system32\compact.exe,"Virus identified Win32/Virut.A","Infected"
C:\WINNT\system32\conime.exe,"Virus identified Win32/Virut.A","Infected"
C:\WINNT\system32\control.exe,"Virus identified Win32/Virut.A","Infected"
C:\WINNT\system32\convert.exe,"Virus identified Win32/Virut.A","Infected"
C:\WINNT\system32\cscript.exe,"Virus identified Win32/Virut.A","Infected"
C:\WINNT\system32\dcomcnfg.exe,"Virus identified Win32/Virut.A","Infected"
C:\WINNT\system32\ddeshare.exe,"Virus identified Win32/Virut.A","Infected"
C:\WINNT\system32\ddmprxy.exe,"Virus identified Win32/Virut.A","Infected"
C:\WINNT\system32\dfrgfat.exe,"Virus identified Win32/Virut.A","Infected"
C:\WINNT\system32\dfrgntfs.exe,"Virus identified Win32/Virut.A","Infected"
C:\WINNT\system32\diantz.exe,"Virus identified Win32/Virut.A","Infected"
C:\WINNT\system32\diskperf.exe,"Virus identified Win32/Virut.A","Infected"
C:\WINNT\system32\dllhost.exe,"Virus identified Win32/Virut.A","Infected"
C:\WINNT\system32\dllhst3g.exe,"Virus identified Win32/Virut.A","Infected"
C:\WINNT\system32\dmadmin.exe,"Virus identified Win32/Virut.A","Infected"
C:\WINNT\system32\dmremote.exe,"Virus identified Win32/Virut.A","Infected"
C:\WINNT\system32\doskey.exe,"Virus identified Win32/Virut.A","Infected"
C:\WINNT\system32\dplaysvr.exe,"Virus identified Win32/Virut.A","Infected"
C:\WINNT\system32\dpnsvr.exe,"Virus identified Win32/Virut.A","Infected"
C:\WINNT\system32\dpvsetup.exe,"Virus identified Win32/Virut.A","Infected"
C:\WINNT\system32\drwtsn32.exe,"Virus identified Win32/Virut.A","Infected"
C:\WINNT\system32\dvdplay.exe,"Virus identified Win32/Virut.A","Infected"
C:\WINNT\system32\dxdiag.exe,"Virus identified Win32/Virut.A","Infected"
C:\WINNT\system32\dxdllreg.exe,"Virus identified Win32/Virut.A","Infected"
C:\WINNT\system32\esentutl.exe,"Virus identified Win32/Virut.A","Infected"
C:\WINNT\system32\eudcedit.exe,"Virus identified Win32/Virut.A","Infected"
C:\WINNT\system32\eventvwr.exe,"Virus identified Win32/Virut.A","Infected"
C:\WINNT\system32\expand.exe,"Virus identified Win32/Virut.A","Infected"
C:\WINNT\system32\extrac32.exe,"Virus identified Win32/Virut.A","Infected"
C:\WINNT\system32\faxcover.exe,"Virus identified Win32/Virut.A","Infected"
C:\WINNT\system32\faxqueue.exe,"Virus identified Win32/Virut.A","Infected"
C:\WINNT\system32\faxsend.exe,"Virus identified Win32/Virut.A","Infected"
C:\WINNT\system32\faxsvc.exe,"Virus identified Win32/Virut.A","Infected"
C:\WINNT\system32\fc.exe,"Virus identified Win32/Virut.A","Infected"
C:\WINNT\system32\find.exe,"Virus identified Win32/Virut.A","Infected"
C:\WINNT\system32\findstr.exe,"Virus identified Win32/Virut.A","Infected"
C:\WINNT\system32\finger.exe,"Virus identified Win32/Virut.A","Infected"
C:\WINNT\system32\fixmapi.exe,"Virus identified Win32/Virut.A","Infected"
C:\WINNT\system32\fontview.exe,"Virus identified Win32/Virut.A","Infected"
C:\WINNT\system32\forcedos.exe,"Virus identified Win32/Virut.A","Infected"
C:\WINNT\system32\freecell.exe,"Virus identified Win32/Virut.A","Infected"
C:\WINNT\system32\ftp.exe,"Virus identified Win32/Virut.A","Infected"
C:\WINNT\system32\grpconv.exe,"Virus identified Win32/Virut.A","Infected"
C:\WINNT\system32\gsw32.exe,"Virus identified Win32/Virut.A","Infected"
C:\WINNT\system32\help.exe,"Virus identified Win32/Virut.A","Infected"
C:\WINNT\system32\hostname.exe,"Virus identified Win32/Virut.A","Infected"
C:\WINNT\system32\hpfinsta.exe,"Virus identified Win32/Virut.A","Infected"
C:\WINNT\system32\ie4uinit.exe,"Virus identified Win32/Virut.A","Infected"
C:\WINNT\system32\ieshwiz.exe,"Virus identified Win32/Virut.A","Infected"
C:\WINNT\system32\iexpress.exe,"Virus identified Win32/Virut.A","Infected"
C:\WINNT\system32\internat.exe,"Virus identified Win32/Virut.A","Infected"
C:\WINNT\system32\ipconfig.exe,"Virus identified Win32/Virut.A","Infected"
C:\WINNT\system32\ipsecmon.exe,"Virus identified Win32/Virut.A","Infected"
C:\WINNT\system32\ipxroute.exe,"Virus identified Win32/Virut.A","Infected"
C:\WINNT\system32\irftp.exe,"Virus identified Win32/Virut.A","Infected"
C:\WINNT\system32\jdbgmgr.exe,"Virus identified Win32/Virut.A","Infected"
C:\WINNT\system32\jview.exe,"Virus identified Win32/Virut.A","Infected"
C:\WINNT\system32\Kanavanäytönsäästäjä.scr,"Virus identified Win32/Virut.A","Infected"
C:\WINNT\system32\label.exe,"Virus identified Win32/Virut.A","Infected"
C:\WINNT\system32\lights.exe,"Virus identified Win32/Virut.A","Infected"
C:\WINNT\system32\lnkstub.exe,"Virus identified Win32/Virut.A","Infected"
C:\WINNT\system32\locator.exe,"Virus identified Win32/Virut.A","Infected"
C:\WINNT\system32\lodctr.exe,"Virus identified Win32/Virut.A","Infected"
C:\WINNT\system32\logagent.exe,"Virus identified Win32/Virut.A","Infected"
C:\WINNT\system32\logon.scr,"Virus identified Win32/Virut.A","Infected"
C:\WINNT\system32\lpq.exe,"Virus identified Win32/Virut.A","Infected"
C:\WINNT\system32\lpr.exe,"Virus identified Win32/Virut.A","Infected"
C:\WINNT\system32\magnify.exe,"Virus identified Win32/Virut.A","Infected"
C:\WINNT\system32\makecab.exe,"Virus identified Win32/Virut.A","Infected"
C:\WINNT\system32\MAPISRVR.EXE,"Virus identified Win32/Virut.A","Infected"
C:\WINNT\system32\migpwd.exe,"Virus identified Win32/Virut.A","Infected"
C:\WINNT\system32\mmc.exe,"Virus identified Win32/Virut.A","Infected"
C:\WINNT\system32\mnmsrvc.exe,"Virus identified Win32/Virut.A","Infected"
C:\WINNT\system32\mobsync.exe,"Virus identified Win32/Virut.A","Infected"
C:\WINNT\system32\mountvol.exe,"Virus identified Win32/Virut.A","Infected"
C:\WINNT\system32\mplay32.exe,"Virus identified Win32/Virut.A","Infected"
C:\WINNT\system32\mpnotify.exe,"Virus identified Win32/Virut.A","Infected"
C:\WINNT\system32\mrinfo.exe,"Virus identified Win32/Virut.A","Infected"
C:\WINNT\system32\msdtc.exe,"Virus identified Win32/Virut.A","Infected"
C:\WINNT\system32\mshta.exe,"Virus identified Win32/Virut.A","Infected"
C:\WINNT\system32\msiexec.exe,"Virus identified Win32/Virut.A","Infected"
C:\WINNT\system32\mspaint.exe,"Virus identified Win32/Virut.A","Infected"
C:\WINNT\system32\msswchx.exe,"Virus identified Win32/Virut.A","Infected"
C:\WINNT\system32\mstask.exe,"Virus identified Win32/Virut.A","Infected"
C:\WINNT\system32\mstinit.exe,"Virus identified Win32/Virut.A","Infected"
C:\WINNT\system32\narrator.exe,"Virus identified Win32/Virut.A","Infected"
C:\WINNT\system32\nbtstat.exe,"Virus identified Win32/Virut.A","Infected"
C:\WINNT\system32\nddeapir.exe,"Virus identified Win32/Virut.A","Infected"
C:\WINNT\system32\NeroCheck.exe,"Virus identified Win32/Virut.A","Infected"
C:\WINNT\system32\net.exe,"Virus identified Win32/Virut.A","Infected"
C:\WINNT\system32\net1.exe,"Virus identified Win32/Virut.A","Infected"
C:\WINNT\system32\NETDDE.EXE,"Virus identified Win32/Virut.A","Infected"
C:\WINNT\system32\netsh.exe,"Virus identified Win32/Virut.A","Infected"
C:\WINNT\system32\netstat.exe,"Virus identified Win32/Virut.A","Infected"
C:\WINNT\system32\notepad.exe,"Virus identified Win32/Virut.A","Infected"
C:\WINNT\system32\nslookup.exe,"Virus identified Win32/Virut.A","Infected"
C:\WINNT\system32\ntbackup.exe,"Virus identified Win32/Virut.A","Infected"
C:\WINNT\system32\ntdsutil.exe,"Virus identified Win32/Virut.A","Infected"
C:\WINNT\system32\ntsd.exe,"Virus identified Win32/Virut.A","Infected"
C:\WINNT\system32\ntvdm.exe,"Virus identified Win32/Virut.A","Infected"
C:\WINNT\system32\nwscript.exe,"Virus identified Win32/Virut.A","Infected"
C:\WINNT\system32\odbcad32.exe,"Virus identified Win32/Virut.A","Infected"
C:\WINNT\system32\odbcconf.exe,"Virus identified Win32/Virut.A","Infected"
C:\WINNT\system32\os2.exe,"Virus identified Win32/Virut.A","Infected"
C:\WINNT\system32\os2srv.exe,"Virus identified Win32/Virut.A","Infected"
C:\WINNT\system32\osk.exe,"Virus identified Win32/Virut.A","Infected"
C:\WINNT\system32\packager.exe,"Virus identified Win32/Virut.A","Infected"
C:\WINNT\system32\pathping.exe,"Virus identified Win32/Virut.A","Infected"
C:\WINNT\system32\pax.exe,"Virus identified Win32/Virut.A","Infected"
C:\WINNT\system32\pentnt.exe,"Virus identified Win32/Virut.A","Infected"
C:\WINNT\system32\perfmon.exe,"Virus identified Win32/Virut.A","Infected"
C:\WINNT\system32\ping.exe,"Virus identified Win32/Virut.A","Infected"
C:\WINNT\system32\posix.exe,"Virus identified Win32/Virut.A","Infected"
C:\WINNT\system32\print.exe,"Virus identified Win32/Virut.A","Infected"
C:\WINNT\system32\Process.exe,"Virus identified Win32/Virut.A","Infected"
C:\WINNT\system32\progman.exe,"Virus identified Win32/Virut.A","Infected"
C:\WINNT\system32\proquota.exe,"Virus identified Win32/Virut.A","Infected"
C:\WINNT\system32\psxss.exe,"Virus identified Win32/Virut.A","Infected"
C:\WINNT\system32\rasadmin.exe,"Virus identified Win32/Virut.A","Infected"
C:\WINNT\system32\rasautou.exe,"Virus identified Win32/Virut.A","Infected"
C:\WINNT\system32\rasdial.exe,"Virus identified Win32/Virut.A","Infected"
C:\WINNT\system32\rasphone.exe,"Virus identified Win32/Virut.A","Infected"
C:\WINNT\system32\rcp.exe,"Virus identified Win32/Virut.A","Infected"
C:\WINNT\system32\recover.exe,"Virus identified Win32/Virut.A","Infected"
C:\WINNT\system32\regedt32.exe,"Virus identified Win32/Virut.A","Infected"
C:\WINNT\system32\regsvc.exe,"Virus identified Win32/Virut.A","Infected"
C:\WINNT\system32\regsvr32.exe,"Virus identified Win32/Virut.A","Infected"
C:\WINNT\system32\regwiz.exe,"Virus identified Win32/Virut.A","Infected"
C:\WINNT\system32\replace.exe,"Virus identified Win32/Virut.A","Infected"
C:\WINNT\system32\rexec.exe,"Virus identified Win32/Virut.A","Infected"
C:\WINNT\system32\route.exe,"Virus identified Win32/Virut.A","Infected"
C:\WINNT\system32\routemon.exe,"Virus identified Win32/Virut.A","Infected"
C:\WINNT\system32\rsh.exe,"Virus identified Win32/Virut.A","Infected"
C:\WINNT\system32\rsm.exe,"Virus identified Win32/Virut.A","Infected"
C:\WINNT\system32\rsnotify.exe,"Virus identified Win32/Virut.A","Infected"
C:\WINNT\system32\rsvp.exe,"Virus identified Win32/Virut.A","Infected"
C:\WINNT\system32\runas.exe,"Virus identified Win32/Virut.A","Infected"
C:\WINNT\system32\rundll32.exe,"Virus identified Win32/Virut.A","Infected"
C:\WINNT\system32\runonce.exe,"Virus identified Win32/Virut.A","Infected"
C:\WINNT\system32\savedump.exe,"Virus identified Win32/Virut.A","Infected"
C:\WINNT\system32\scardsvr.exe,"Virus identified Win32/Virut.A","Infected"
C:\WINNT\system32\schmupd.exe,"Virus identified Win32/Virut.A","Infected"
C:\WINNT\system32\scrnsave.scr,"Virus identified Win32/Virut.A","Infected"
C:\WINNT\system32\secedit.exe,"Virus identified Win32/Virut.A","Infected"
C:\WINNT\system32\sethc.exe,"Virus identified Win32/Virut.A","Infected"
C:\WINNT\system32\setreg.exe,"Virus identified Win32/Virut.A","Infected"
C:\WINNT\system32\setup.exe,"Virus identified Win32/Virut.A","Infected"
C:\WINNT\system32\setup_45715.exe,"Virus identified Win32/Virut.A","Infected"
C:\WINNT\system32\sfc.exe,"Virus identified Win32/Virut.A","Infected"
C:\WINNT\system32\shmgrate.exe,"Virus identified Win32/Virut.A","Infected"
C:\WINNT\system32\shrpubw.exe,"Virus identified Win32/Virut.A","Infected"
C:\WINNT\system32\sigverif.exe,"Virus identified Win32/Virut.A","Infected"
C:\WINNT\system32\skeys.exe,"Virus identified Win32/Virut.A","Infected"
C:\WINNT\system32\smlogsvc.exe,"Virus identified Win32/Virut.A","Infected"
C:\WINNT\system32\sndrec32.exe,"Virus identified Win32/Virut.A","Infected"
C:\WINNT\system32\sndvol32.exe,"Virus identified Win32/Virut.A","Infected"
C:\WINNT\system32\sol.exe,"Virus identified Win32/Virut.A","Infected"
C:\WINNT\system32\sort.exe,"Virus identified Win32/Virut.A","Infected"
C:\WINNT\system32\spiisupd.exe,"Virus identified Win32/Virut.A","Infected"
C:\WINNT\system32\spoolsv.exe,"Virus identified Win32/Virut.A","Infected"
C:\WINNT\system32\ss3dfo.scr,"Virus identified Win32/Virut.A","Infected"
C:\WINNT\system32\ssbezier.scr,"Virus identified Win32/Virut.A","Infected"
C:\WINNT\system32\ssflwbox.scr,"Virus identified Win32/Virut.A","Infected"
C:\WINNT\system32\ssmarque.scr,"Virus identified Win32/Virut.A","Infected"
C:\WINNT\system32\ssmaze.scr,"Virus identified Win32/Virut.A","Infected"
C:\WINNT\system32\ssmyst.scr,"Virus identified Win32/Virut.A","Infected"
C:\WINNT\system32\sspipes.scr,"Virus identified Win32/Virut.A","Infected"
C:\WINNT\system32\ssstars.scr,"Virus identified Win32/Virut.A","Infected"
C:\WINNT\system32\sstext3d.scr,"Virus identified Win32/Virut.A","Infected"
C:\WINNT\system32\stimon.exe,"Virus identified Win32/Virut.A","Infected"
C:\WINNT\system32\stisvc.exe,"Virus identified Win32/Virut.A","Infected"
C:\WINNT\system32\subst.exe,"Virus identified Win32/Virut.A","Infected"
C:\WINNT\system32\swreg.exe,"Virus identified Win32/Virut.A","Infected"
C:\WINNT\system32\swsc.exe,"Virus identified Win32/Virut.A","Infected"
C:\WINNT\system32\syncapp.exe,"Virus identified Win32/Virut.A","Infected"
C:\WINNT\system32\syskey.exe,"Virus identified Win32/Virut.A","Infected"
C:\WINNT\system32\sysocmgr.exe,"Virus identified Win32/Virut.A","Infected"
C:\WINNT\system32\systray.exe,"Virus identified Win32/Virut.A","Infected"
C:\WINNT\system32\taskman.exe,"Virus identified Win32/Virut.A","Infected"
C:\WINNT\system32\taskmgr.exe,"Virus identified Win32/Virut.A","Infected"
C:\WINNT\system32\tcmsetup.exe,"Virus identified Win32/Virut.A","Infected"
C:\WINNT\system32\tcpsvcs.exe,"Virus identified Win32/Virut.A","Infected"
C:\WINNT\system32\telnet.exe,"Virus identified Win32/Virut.A","Infected"
C:\WINNT\system32\tftp.exe,"Virus identified Win32/Virut.A","Infected"
C:\WINNT\system32\themes.exe,"Virus identified Win32/Virut.A","Infected"
C:\WINNT\system32\tlntadmn.exe,"Virus identified Win32/Virut.A","Infected"
C:\WINNT\system32\tlntsess.exe,"Virus identified Win32/Virut.A","Infected"
C:\WINNT\system32\tlntsvr.exe,"Virus identified Win32/Virut.A","Infected"
C:\WINNT\system32\tracert.exe,"Virus identified Win32/Virut.A","Infected"
C:\WINNT\system32\unlodctr.exe,"Virus identified Win32/Virut.A","Infected"
C:\WINNT\system32\updcrl.exe,"Virus identified Win32/Virut.A","Infected"
C:\WINNT\system32\ups.exe,"Virus identified Win32/Virut.A","Infected"
C:\WINNT\system32\userinit.exe,"Virus identified Win32/Virut.A","Infected"
C:\WINNT\system32\utilman.exe,"Virus identified Win32/Virut.A","Infected"
C:\WINNT\system32\verifier.exe,"Virus identified Win32/Virut.A","Infected"
C:\WINNT\system32\w32tm.exe,"Virus identified Win32/Virut.A","Infected"
C:\WINNT\system32\wextract.exe,"Virus identified Win32/Virut.A","Infected"
C:\WINNT\system32\winhlp32.exe,"Virus identified Win32/Virut.A","Infected"
C:\WINNT\system32\winmine.exe,"Virus identified Win32/Virut.A","Infected"
C:\WINNT\system32\winmsd.exe,"Virus identified Win32/Virut.A","Infected"
C:\WINNT\system32\winver.exe,"Virus identified Win32/Virut.A","Infected"
C:\WINNT\system32\wjview.exe,"Virus identified Win32/Virut.A","Infected"
C:\WINNT\system32\wpnpinst.exe,"Virus identified Win32/Virut.A","Infected"
C:\WINNT\system32\write.exe,"Virus identified Win32/Virut.A","Infected"
C:\WINNT\system32\wscript.exe,"Virus identified Win32/Virut.A","Infected"
C:\WINNT\system32\wupdmgr.exe,"Virus identified Win32/Virut.A","Infected"
C:\WINNT\system32\xcopy.exe,"Virus identified Win32/Virut.A","Infected"
C:\WINNT\system32\Com\comrepl.exe,"Virus identified Win32/Virut.A","Infected"
C:\WINNT\system32\Com\comrereg.exe,"Virus identified Win32/Virut.A","Infected"
C:\WINNT\system32\dllcache\accwiz.exe,"Virus identified Win32/Virut.A","Infected"
C:\WINNT\system32\dllcache\actmovie.exe,"Virus identified Win32/Virut.A","Infected"
C:\WINNT\system32\dllcache\admin.exe,"Virus identified Win32/Virut.A","Infected"
C:\WINNT\system32\dllcache\agentsvr.exe,"Virus identified Win32/Virut.A","Infected"
C:\WINNT\system32\dllcache\arp.exe,"Virus identified Win32/Virut.A","Infected"
C:\WINNT\system32\dllcache\at.exe,"Virus identified Win32/Virut.A","Infected"
C:\WINNT\system32\dllcache\atmadm.exe,"Virus identified Win32/Virut.A","Infected"
C:\WINNT\system32\dllcache\attrib.exe,"Virus identified Win32/Virut.A","Infected"
C:\WINNT\system32\dllcache\author.exe,"Virus identified Win32/Virut.A","Infected"
C:\WINNT\system32\dllcache\bootok.exe,"Virus identified Win32/Virut.A","Infected"
C:\WINNT\system32\dllcache\bootvrfy.exe,"Virus identified Win32/Virut.A","Infected"
C:\WINNT\system32\dllcache\cacls.exe,"Virus identified Win32/Virut.A","Infected"
C:\WINNT\system32\dllcache\calc.exe,"Virus identified Win32/Virut.A","Infected"
C:\WINNT\system32\dllcache\cb32.exe,"Virus identified Win32/Virut.A","Infected"
C:\WINNT\system32\dllcache\cdplayer.exe,"Virus identified Win32/Virut.A","Infected"
C:\WINNT\system32\dllcache\cfgwiz.exe,"Virus identified Win32/Virut.A","Infected"
C:\WINNT\system32\dllcache\charmap.exe,"Virus identified Win32/Virut.A","Infected"
C:\WINNT\system32\dllcache\chkdsk.exe,"Virus identified Win32/Virut.A","Infected"
C:\WINNT\system32\dllcache\chkntfs.exe,"Virus identified Win32/Virut.A","Infected"
C:\WINNT\system32\dllcache\cidaemon.exe,"Virus identified Win32/Virut.A","Infected"
C:\WINNT\system32\dllcache\cipher.exe,"Virus identified Win32/Virut.A","Infected"
C:\WINNT\system32\dllcache\cisvc.exe,"Virus identified Win32/Virut.A","Infected"
C:\WINNT\system32\dllcache\ckcnv.exe,"Virus identified Win32/Virut.A","Infected"
C:\WINNT\system32\dllcache\cleanmgr.exe,"Virus identified Win32/Virut.A","Infected"
C:\WINNT\system32\dllcache\clipbrd.exe,"Virus identified Win32/Virut.A","Infected"
C:\WINNT\system32\dllcache\clipsrv.exe,"Virus identified Win32/Virut.A","Infected"
C:\WINNT\system32\dllcache\clspack.exe,"Virus identified Win32/Virut.A","Infected"
C:\WINNT\system32\dllcache\cluster.exe,"Virus identified Win32/Virut.A","Infected"
C:\WINNT\system32\dllcache\cmd.exe,"Virus identified Win32/Virut.A","Infected"
C:\WINNT\system32\dllcache\cmdl32.exe,"Virus identified Win32/Virut.A","Infected"
C:\WINNT\system32\dllcache\cmmgr32.exe,"Virus identified Win32/Virut.A","Infected"
C:\WINNT\system32\dllcache\cmmon32.exe,"Virus identified Win32/Virut.A","Infected"
C:\WINNT\system32\dllcache\cmstp.exe,"Virus identified Win32/Virut.A","Infected"
C:\WINNT\system32\dllcache\comclust.exe,"Virus identified Win32/Virut.A","Infected"
C:\WINNT\system32\dllcache\comp.exe,"Virus identified Win32/Virut.A","Infected"
C:\WINNT\system32\dllcache\compact.exe,"Virus identified Win32/Virut.A","Infected"
C:\WINNT\system32\dllcache\comrepl.exe,"Virus identified Win32/Virut.A","Infected"
C:\WINNT\system32\dllcache\comrereg.exe,"Virus identified Win32/Virut.A","Infected"
C:\WINNT\system32\dllcache\conf.exe,"Virus identified Win32/Virut.A","Infected"
C:\WINNT\system32\dllcache\conime.exe,"Virus identified Win32/Virut.A","Infected"
C:\WINNT\system32\dllcache\control.exe,"Virus identified Win32/Virut.A","Infected"
C:\WINNT\system32\dllcache\convert.exe,"Virus identified Win32/Virut.A","Infected"
C:\WINNT\system32\dllcache\convlog.exe,"Virus identified Win32/Virut.A","Infected"
C:\WINNT\system32\dllcache\cplexe.exe,"Virus identified Win32/Virut.A","Infected"
C:\WINNT\system32\dllcache\cscript.exe,"Virus identified Win32/Virut.A","Infected"
C:\WINNT\system32\dllcache\dcomcnfg.exe,"Virus identified Win32/Virut.A","Infected"
C:\WINNT\system32\dllcache\ddeshare.exe,"Virus identified Win32/Virut.A","Infected"
C:\WINNT\system32\dllcache\ddmprxy.exe,"Virus identified Win32/Virut.A","Infected"
C:\WINNT\system32\dllcache\delttsul.exe,"Virus identified Win32/Virut.A","Infected"
C:\WINNT\system32\dllcache\dfrgfat.exe,"Virus identified Win32/Virut.A","Infected"
C:\WINNT\system32\dllcache\dfrgntfs.exe,"Virus identified Win32/Virut.A","Infected"
C:\WINNT\system32\dllcache\dialer.exe,"Virus identified Win32/Virut.A","Infected"
C:\WINNT\system32\dllcache\diantz.exe,"Virus identified Win32/Virut.A","Infected"
C:\WINNT\system32\dllcache\discover.exe,"Vi
saakos ajettua ton escan
Lataa tuolta
http://koti.mbnet.fi/pattaya1/escanmwav.htm
asenna, päivitä tapa2, laita täpit merkkauksien mukaan.
Scannaa
jos alaikkunaan virukset tulee jotain laita loki tänne.
kopioi se näin:
Käytä komentoa Ctrl A.
Kopioi rivit komennolla Ctrl C.
Liitä rivit komennolla Ctrl V.
laita sitten uusi hjt-loki myös.
mitä avg sanoi niin Formatoi kone ja asenna uudestaan käyttöjärjestelmä.
jos saat escan ajettua niin laita siintäkin loki tänne.
Suuret kiitokset kaikille osallistuneille ja erityisen syvä kumarrus ja iso hatunnosto nimimerkille "Poistelen vain", joka jaksoi painia tämän ongelman kanssa todella aktiivisesti. Jos joskus törmätään, tarjoan kaljat.
Escan ei suostunut asentumaan ja siinä vaiheessa totesin itseni selätetyksi henkisesti ja fyysisesti. No, aina ei voi voittaa. Onneksi sentään kaikki elintärkeät tiedostot saatiin talteen. Käyttis meni uusiksi ja koneen ympärille aion kaivaa aika syvän vallihaudan viruksen perkeleitä vastaan, ennen kuin edes näytän sille verkkopiuhaa.
Kiitos ja näkemiin
-kun googletin:Win32/Rbot.gen.Se antoi sellaisen ohjelman trialin kuin:A-Squared(emsi software)Oli tuo mörkö myös tunkenut koneeseeni,mutta se poisti sen mukavasti.No,toisissa koneissa toimii,toisissa ei.Kun,ovat henkimaailman vekottimia.Mutta,jos et ole vielä asiaa saanut hoidettua,ei tuokaan mitään maksa,vaikka kokeilisit?
...mutta ei tuokaan ohjelma suostunut ikävä kyllä asentumaan. Kone tuntuu olevan täysin solmussa. Sain kuitenkin avg:n asennettua ja se jopa aloitti skannauksen vikasietotilassa. Nyt jo 44 infected items ja skannaus vielä kesken... Katsotaan mitä tapahtuu kun homma valmis.
olen pahoillani,en osaa auttaa nytyy..
sori,etten enempään pystynyt...
se auttaapi...