Taisin saada tartunnan jostain, ja nyt Ohjauspaneeli on kateissa. Rekisterieditoriin ja Tehtävienhallintaankin oli pääsy kielletty, mutta ajoin Avastin virustarkistuksen, ja pääsen niihin nyt käsiksi. Selaimet eivät eilen suostuneet menemään mihinkään osoitteeseen, mutta uudeleenkäynnistyksen jälkeen ne toimivat. Thunderbird ei kuitenkaan saa sähköpostia lähetettyä, koska smtp.welho.comiin ei saa yhteyttä – vikasietotilassa TB toimii moitteetta.
Tässä HJT-logi:
Logfile of HijackThis v1.99.1
Scan saved at 19:57:00, on 6.11.2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Avast4\aswUpdSv.exe
C:\Program Files\Avast4\ashServ.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Progs\WindowBlinds\wbload.exe
C:\Program Files\Apache Group\Apache2\bin\Apache.exe
C:\Program Files\Common Files\Autodesk Shared\Service\AdskScSrv.exe
C:\PROGRA~1\F-Secure\BackWeb\7681197\Program\SERVIC~1.EXE
C:\WINDOWS\System32\DRIVERS\CDANTSRV.EXE
C:\Program Files\Apache Group\Apache2\bin\Apache.exe
C:\Program Files\F-Secure\Anti-Virus\fsgk32st.exe
C:\Program Files\F-Secure\BackWeb\7681197\Program\F-Secure Automatic Update.exe
C:\Program Files\F-Secure\Anti-Virus\FSGK32.EXE
C:\Program Files\F-Secure\BackWeb\7681197\program\fsbwsys.exe
C:\Program Files\F-Secure\Anti-Virus\fssm32.exe
C:\Program Files\F-Secure\Common\FSMA32.EXE
C:\Program Files\F-Secure\Common\FSMB32.EXE
C:\WINDOWS\Explorer.EXE
C:\Program Files\F-Secure\Common\FCH32.EXE
C:\WINDOWS\System32\svchost.exe
C:\Program Files\F-Secure\Common\FAMEH32.EXE
C:\Program Files\UPHClean\uphclean.exe
C:\Program Files\Avast4\ashMaiSv.exe
C:\Program Files\F-Secure\Common\FNRB32.EXE
C:\Program Files\Logitech\iTouch\iTouch.exe
C:\WINDOWS\system32\LVCOMSX.EXE
C:\Program Files\F-Secure\FWES\Program\fsdfwd.exe
C:\Program Files\F-Secure\Anti-Virus\fsav32.exe
C:\Program Files\F-Secure\Common\FIH32.EXE
C:\Program Files\F-Secure\Common\FSM32.EXE
C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Progs\Skype\Skype.exe
C:\Program Files\Rainlendar2\Rainlendar2.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\progs\ObjectDock\ObjectDock.exe
C:\Program Files\stickies\stickies.exe
C:\Program Files\Thunderbird-Tray\TBTray.exe
C:\Program Files\Trillian\trillian.exe
C:\progs\WinTidy\WinTidy.exe
C:\Program Files\F-Secure\FSGUI\fsguiexe.exe
C:\Program Files\Mozilla Thunderbird\thunderbird.exe
C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
C:\Progs\Skype\Plugin Manager\SkypePM.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\ABC\abc.exe
C:\progs\PowerDesk 6\PDExplo.exe
C:\HJT\HJT.exe
C:\WINDOWS\system32\wuauclt.exe
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = localhost;*.local
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Linkit
O2 - BHO: Adobe PDF Reader -linkkiavustaja - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O2 - BHO: (no name) - {88035E2B-FB56-4ECF-BCA1-099C731DFE2D} - (no file)
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Mouse Gestures - {A6A49249-57AE-4295-8D4D-18A9502C7D8E} - C:\Program Files\Internet Explorer\Plugins\Drowse\MouseGestures.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\2.0.301.7164\swg.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O4 - HKLM\..\Run: [zBrowser Launcher] C:\Program Files\Logitech\iTouch\iTouch.exe
O4 - HKLM\..\Run: [UpdReg] C:\WINDOWS\UpdReg.EXE
O4 - HKLM\..\Run: [LVCOMSX] C:\WINDOWS\system32\LVCOMSX.EXE
O4 - HKLM\..\Run: [F-Secure TNB] "C:\Program Files\F-Secure\TNB\TNBUtil.exe" /CHECKALL /WAITFORSW
O4 - HKLM\..\Run: [F-Secure Manager] "C:\Program Files\F-Secure\Common\FSM32.EXE" /splash
O4 - HKLM\..\Run: [Google Desktop Search] "C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe" /startup
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [Skype] "C:\Progs\Skype\Skype.exe" /nosplash /minimized
O4 - HKCU\..\Run: [Rainlendar2] C:\Program Files\Rainlendar2\Rainlendar2.exe
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - Startup: Stardock ObjectDock.lnk = C:\progs\ObjectDock\ObjectDock.exe
O4 - Startup: Stickies.lnk = C:\Program Files\stickies\stickies.exe
O4 - Startup: TB-Tray.lnk = C:\Program Files\Thunderbird-Tray\TBTray.exe
O4 - Startup: trillian.lnk = C:\Program Files\Trillian\trillian.exe
O4 - Startup: WinTidy.lnk = C:\progs\WinTidy\WinTidy.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\Progs\OfficeXP\Office10\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O9 - Extra button: Natural Reader - {0DF757C4-9999-463C-A4EB-B6BF1D8D8D3D} - C:\Audio\Progs\Natural Voice\read.html
O9 - Extra button: (no name) - {4E660F19-E91E-41e1-88EF-D1DFAB118F67} - C:\Program Files\Internet Explorer\Plugins\Drowse\MouseGestures.dll
O9 - Extra 'Tools' menuitem: Mouse Gestures... - {4E660F19-E91E-41e1-88EF-D1DFAB118F67} - C:\Program Files\Internet Explorer\Plugins\Drowse\MouseGestures.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O10 - Unknown file in Winsock LSP: c:\program files\bonjour\mdnsnsp.dll
O11 - Options group: [INTERNATIONAL] International*
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupd...b?1173132418927
O16 - DPF: {8BC53B30-32E4-4ED3-BEF9-DB761DB77453} (CInstallLPCtrl Object) - http://u3.sandisk.com/download/apps/LPInstaller.CAB
O16 - DPF: {B5E2F38B-1C54-4967-8630-38444B50E9B8} (efOrderXLib2.efOrderX2) - https://www.efoto.fi/efOrderX2.CAB
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O20 - Winlogon Notify: WB - C:\progs\WINDOW~1\fastload.dll
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Apache2 - Unknown owner - C:\Program Files\Apache Group\Apache2\bin\Apache.exe" -k runservice (file missing)
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Avast4\aswUpdSv.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: Autodesk Licensing Service - Unknown owner - C:\Program Files\Common Files\Autodesk Shared\Service\AdskScSrv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - Unknown owner - C:\Program Files\Avast4\ashMaiSv.exe" /service (file missing)
O23 - Service: avast! Web Scanner - Unknown owner - C:\Program Files\Avast4\ashWebSv.exe" /service (file missing)
O23 - Service: F-Secure Automatic Update (BackWeb Plug-in - 7681197) - Unknown owner - C:\PROGRA~1\F-Secure\BackWeb\7681197\Program\SERVIC~1.EXE
O23 - Service: C-DillaSrv - C-Dilla Ltd - C:\WINDOWS\System32\DRIVERS\CDANTSRV.EXE
O23 - Service: F-Secure Gatekeeper Handler Starter - F-Secure Corp. - C:\Program Files\F-Secure\Anti-Virus\fsgk32st.exe
O23 - Service: F-Secure Network Request Broker - F-Secure Corporation - C:\Program Files\F-Secure\Common\FNRB32.EXE
O23 - Service: fsbwsys - F-Secure Corp. - C:\Program Files\F-Secure\BackWeb\7681197\program\fsbwsys.exe
O23 - Service: F-Secure Anti-Virus Firewall Daemon (FSDFWD) - F-Secure Corporation - C:\Program Files\F-Secure\FWES\Program\fsdfwd.exe
O23 - Service: F-Secure Management Agent (FSMA) - F-Secure Corporation - C:\Program Files\F-Secure\Common\FSMA32.EXE
O23 - Service: GoogleDesktopManager - Google - C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPod-palvelu (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: License Management Service ESD - Unknown owner - C:\Program Files\Common Files\element5 Shared\Service\Licence Manager ESD.exe
O23 - Service: Macromedia Licensing Service - Unknown owner - C:\Program Files\Common Files\Macromedia Shared\Service\Macromedia Licensing.exe
O23 - Service: MATLAB Server (matlabserver) - Unknown owner - C:\progs\MATLAB7\webserver\bin\win32\matlabserver.exe
O23 - Service: Network Time Protocol Daemon (NTP) - Unknown owner - C:\Program Files\NTP\bin\ntpd.exe
O23 - Service: ServiceLayer - Nokia. - C:\Program Files\Common Files\PCSuite\Services\ServiceLayer.exe
Tässä HJT-logi:
Logfile of HijackThis v1.99.1
Scan saved at 19:57:00, on 6.11.2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Avast4\aswUpdSv.exe
C:\Program Files\Avast4\ashServ.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Progs\WindowBlinds\wbload.exe
C:\Program Files\Apache Group\Apache2\bin\Apache.exe
C:\Program Files\Common Files\Autodesk Shared\Service\AdskScSrv.exe
C:\PROGRA~1\F-Secure\BackWeb\7681197\Program\SERVIC~1.EXE
C:\WINDOWS\System32\DRIVERS\CDANTSRV.EXE
C:\Program Files\Apache Group\Apache2\bin\Apache.exe
C:\Program Files\F-Secure\Anti-Virus\fsgk32st.exe
C:\Program Files\F-Secure\BackWeb\7681197\Program\F-Secure Automatic Update.exe
C:\Program Files\F-Secure\Anti-Virus\FSGK32.EXE
C:\Program Files\F-Secure\BackWeb\7681197\program\fsbwsys.exe
C:\Program Files\F-Secure\Anti-Virus\fssm32.exe
C:\Program Files\F-Secure\Common\FSMA32.EXE
C:\Program Files\F-Secure\Common\FSMB32.EXE
C:\WINDOWS\Explorer.EXE
C:\Program Files\F-Secure\Common\FCH32.EXE
C:\WINDOWS\System32\svchost.exe
C:\Program Files\F-Secure\Common\FAMEH32.EXE
C:\Program Files\UPHClean\uphclean.exe
C:\Program Files\Avast4\ashMaiSv.exe
C:\Program Files\F-Secure\Common\FNRB32.EXE
C:\Program Files\Logitech\iTouch\iTouch.exe
C:\WINDOWS\system32\LVCOMSX.EXE
C:\Program Files\F-Secure\FWES\Program\fsdfwd.exe
C:\Program Files\F-Secure\Anti-Virus\fsav32.exe
C:\Program Files\F-Secure\Common\FIH32.EXE
C:\Program Files\F-Secure\Common\FSM32.EXE
C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Progs\Skype\Skype.exe
C:\Program Files\Rainlendar2\Rainlendar2.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\progs\ObjectDock\ObjectDock.exe
C:\Program Files\stickies\stickies.exe
C:\Program Files\Thunderbird-Tray\TBTray.exe
C:\Program Files\Trillian\trillian.exe
C:\progs\WinTidy\WinTidy.exe
C:\Program Files\F-Secure\FSGUI\fsguiexe.exe
C:\Program Files\Mozilla Thunderbird\thunderbird.exe
C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
C:\Progs\Skype\Plugin Manager\SkypePM.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\ABC\abc.exe
C:\progs\PowerDesk 6\PDExplo.exe
C:\HJT\HJT.exe
C:\WINDOWS\system32\wuauclt.exe
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = localhost;*.local
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Linkit
O2 - BHO: Adobe PDF Reader -linkkiavustaja - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O2 - BHO: (no name) - {88035E2B-FB56-4ECF-BCA1-099C731DFE2D} - (no file)
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Mouse Gestures - {A6A49249-57AE-4295-8D4D-18A9502C7D8E} - C:\Program Files\Internet Explorer\Plugins\Drowse\MouseGestures.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\2.0.301.7164\swg.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O4 - HKLM\..\Run: [zBrowser Launcher] C:\Program Files\Logitech\iTouch\iTouch.exe
O4 - HKLM\..\Run: [UpdReg] C:\WINDOWS\UpdReg.EXE
O4 - HKLM\..\Run: [LVCOMSX] C:\WINDOWS\system32\LVCOMSX.EXE
O4 - HKLM\..\Run: [F-Secure TNB] "C:\Program Files\F-Secure\TNB\TNBUtil.exe" /CHECKALL /WAITFORSW
O4 - HKLM\..\Run: [F-Secure Manager] "C:\Program Files\F-Secure\Common\FSM32.EXE" /splash
O4 - HKLM\..\Run: [Google Desktop Search] "C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe" /startup
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [Skype] "C:\Progs\Skype\Skype.exe" /nosplash /minimized
O4 - HKCU\..\Run: [Rainlendar2] C:\Program Files\Rainlendar2\Rainlendar2.exe
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - Startup: Stardock ObjectDock.lnk = C:\progs\ObjectDock\ObjectDock.exe
O4 - Startup: Stickies.lnk = C:\Program Files\stickies\stickies.exe
O4 - Startup: TB-Tray.lnk = C:\Program Files\Thunderbird-Tray\TBTray.exe
O4 - Startup: trillian.lnk = C:\Program Files\Trillian\trillian.exe
O4 - Startup: WinTidy.lnk = C:\progs\WinTidy\WinTidy.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\Progs\OfficeXP\Office10\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O9 - Extra button: Natural Reader - {0DF757C4-9999-463C-A4EB-B6BF1D8D8D3D} - C:\Audio\Progs\Natural Voice\read.html
O9 - Extra button: (no name) - {4E660F19-E91E-41e1-88EF-D1DFAB118F67} - C:\Program Files\Internet Explorer\Plugins\Drowse\MouseGestures.dll
O9 - Extra 'Tools' menuitem: Mouse Gestures... - {4E660F19-E91E-41e1-88EF-D1DFAB118F67} - C:\Program Files\Internet Explorer\Plugins\Drowse\MouseGestures.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O10 - Unknown file in Winsock LSP: c:\program files\bonjour\mdnsnsp.dll
O11 - Options group: [INTERNATIONAL] International*
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupd...b?1173132418927
O16 - DPF: {8BC53B30-32E4-4ED3-BEF9-DB761DB77453} (CInstallLPCtrl Object) - http://u3.sandisk.com/download/apps/LPInstaller.CAB
O16 - DPF: {B5E2F38B-1C54-4967-8630-38444B50E9B8} (efOrderXLib2.efOrderX2) - https://www.efoto.fi/efOrderX2.CAB
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O20 - Winlogon Notify: WB - C:\progs\WINDOW~1\fastload.dll
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Apache2 - Unknown owner - C:\Program Files\Apache Group\Apache2\bin\Apache.exe" -k runservice (file missing)
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Avast4\aswUpdSv.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: Autodesk Licensing Service - Unknown owner - C:\Program Files\Common Files\Autodesk Shared\Service\AdskScSrv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - Unknown owner - C:\Program Files\Avast4\ashMaiSv.exe" /service (file missing)
O23 - Service: avast! Web Scanner - Unknown owner - C:\Program Files\Avast4\ashWebSv.exe" /service (file missing)
O23 - Service: F-Secure Automatic Update (BackWeb Plug-in - 7681197) - Unknown owner - C:\PROGRA~1\F-Secure\BackWeb\7681197\Program\SERVIC~1.EXE
O23 - Service: C-DillaSrv - C-Dilla Ltd - C:\WINDOWS\System32\DRIVERS\CDANTSRV.EXE
O23 - Service: F-Secure Gatekeeper Handler Starter - F-Secure Corp. - C:\Program Files\F-Secure\Anti-Virus\fsgk32st.exe
O23 - Service: F-Secure Network Request Broker - F-Secure Corporation - C:\Program Files\F-Secure\Common\FNRB32.EXE
O23 - Service: fsbwsys - F-Secure Corp. - C:\Program Files\F-Secure\BackWeb\7681197\program\fsbwsys.exe
O23 - Service: F-Secure Anti-Virus Firewall Daemon (FSDFWD) - F-Secure Corporation - C:\Program Files\F-Secure\FWES\Program\fsdfwd.exe
O23 - Service: F-Secure Management Agent (FSMA) - F-Secure Corporation - C:\Program Files\F-Secure\Common\FSMA32.EXE
O23 - Service: GoogleDesktopManager - Google - C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPod-palvelu (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: License Management Service ESD - Unknown owner - C:\Program Files\Common Files\element5 Shared\Service\Licence Manager ESD.exe
O23 - Service: Macromedia Licensing Service - Unknown owner - C:\Program Files\Common Files\Macromedia Shared\Service\Macromedia Licensing.exe
O23 - Service: MATLAB Server (matlabserver) - Unknown owner - C:\progs\MATLAB7\webserver\bin\win32\matlabserver.exe
O23 - Service: Network Time Protocol Daemon (NTP) - Unknown owner - C:\Program Files\NTP\bin\ntpd.exe
O23 - Service: ServiceLayer - Nokia. - C:\Program Files\Common Files\PCSuite\Services\ServiceLayer.exe
Vastaukset 5
Vanhimmat
Ajappas tuo ekana:
Lataa SDFix by AndyManchesta
http://downloads.andymanchesta.com/RemovalTools/SDFix.z ip
ja tallenna se työpöydällesi.
Käynnistä koneesi vikasietotilaan ja valitse tavallinen käyttäjätilisi:
• Käynnistä tietokone
• Kun kuulet koneen piippaavan, paina F8, kuitenkin ennen Windowsin logon esiintuloa
• Seuraavaksi pitäisi ilmestyä valikko
• Valitse valikosta vikasietotila.
• Kun vikasietotilassa, pura tiedoston SDFix.zip sisältö (SDFix kansio) työpöydällesi. Työpöydälle pitäisi ilmestyä kansio nimeltä SDFix.
• Avaa SDFix-kansio ja tuplaklikkaa tiedostoa RunThis.bat käynnistääksesi ohjelman.
• Paina Y käynnistääksesi skriptin.
• Työkalu puhdistaa troijalaisen palvelut ja tekee myös joitakin korjauksia rekisteriin. Lopuksi se pyytää käynnistämään koneen uudelleen, "Press any key to Reboot".
• Paina mitä tahansa näppäintä ja kone käynnistyy uudelleen.
• Käynnistyminen kestää normaalia kauemmin sillä SDFix puhdistaa konetta.
• Kun kone on käynnistynyt ja työpöytä latautunut, SDFix kertoo että puhdistus on suoritettu, "Finished".
• Paina sitten mitä tahansa näppäintä sulkeaksesi skriptin ja ladataksesi pikakuvakkeet työpöydälle.
• Lopuksi avaa SDFix kansio (työpöydällä) ja kopioi & liitä tiedoston Report.txt sisältö viestiketjuusi uuden HijackThis lokin kera
Tässä logit:
HJT:
Logfile of HijackThis v1.99.1
Scan saved at 22:06:38, on 7.11.2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Avast4\aswUpdSv.exe
C:\Program Files\Avast4\ashServ.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Progs\WindowBlinds\wbload.exe
C:\Program Files\Apache Group\Apache2\bin\Apache.exe
C:\Program Files\Common Files\Autodesk Shared\Service\AdskScSrv.exe
C:\PROGRA~1\F-Secure\BackWeb\7681197\Program\SERVIC~1.EXE
C:\Program Files\Apache Group\Apache2\bin\Apache.exe
C:\WINDOWS\System32\DRIVERS\CDANTSRV.EXE
C:\Program Files\F-Secure\BackWeb\7681197\Program\F-Secure Automatic Update.exe
C:\Program Files\F-Secure\Anti-Virus\fsgk32st.exe
C:\Program Files\F-Secure\Anti-Virus\FSGK32.EXE
C:\Program Files\F-Secure\BackWeb\7681197\program\fsbwsys.exe
C:\Program Files\F-Secure\Common\FSMA32.EXE
C:\Program Files\F-Secure\Anti-Virus\fssm32.exe
C:\Program Files\F-Secure\Common\FSMB32.EXE
C:\Program Files\F-Secure\Common\FCH32.EXE
C:\WINDOWS\System32\svchost.exe
C:\Program Files\F-Secure\Common\FAMEH32.EXE
C:\Program Files\UPHClean\uphclean.exe
C:\Program Files\Avast4\ashMaiSv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\F-Secure\Common\FNRB32.EXE
C:\Program Files\F-Secure\FWES\Program\fsdfwd.exe
C:\Program Files\F-Secure\Anti-Virus\fsav32.exe
C:\Program Files\F-Secure\Common\FIH32.EXE
C:\WINDOWS\system32\notepad.exe
C:\Program Files\Logitech\iTouch\iTouch.exe
C:\WINDOWS\system32\LVCOMSX.EXE
C:\Program Files\F-Secure\Common\FSM32.EXE
C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Progs\Skype\Skype.exe
C:\Program Files\Rainlendar2\Rainlendar2.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\progs\ObjectDock\ObjectDock.exe
C:\Program Files\stickies\stickies.exe
C:\Program Files\Thunderbird-Tray\TBTray.exe
C:\Program Files\Trillian\trillian.exe
C:\progs\WinTidy\WinTidy.exe
C:\Program Files\F-Secure\FSGUI\fsguiexe.exe
C:\Program Files\Mozilla Thunderbird\thunderbird.exe
C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
C:\Progs\Skype\Plugin Manager\SkypePM.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\gfx\progs\InDesign CS\InDesign.exe
C:\progs\PowerDesk 6\PDExplo.exe
C:\HJT\HJT.exe
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = localhost;*.local
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Linkit
O2 - BHO: Adobe PDF Reader -linkkiavustaja - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O2 - BHO: (no name) - {88035E2B-FB56-4ECF-BCA1-099C731DFE2D} - (no file)
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Mouse Gestures - {A6A49249-57AE-4295-8D4D-18A9502C7D8E} - C:\Program Files\Internet Explorer\Plugins\Drowse\MouseGestures.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\2.0.301.7164\swg.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O4 - HKLM\..\Run: [zBrowser Launcher] C:\Program Files\Logitech\iTouch\iTouch.exe
O4 - HKLM\..\Run: [UpdReg] C:\WINDOWS\UpdReg.EXE
O4 - HKLM\..\Run: [LVCOMSX] C:\WINDOWS\system32\LVCOMSX.EXE
O4 - HKLM\..\Run: [F-Secure TNB] "C:\Program Files\F-Secure\TNB\TNBUtil.exe" /CHECKALL /WAITFORSW
O4 - HKLM\..\Run: [F-Secure Manager] "C:\Program Files\F-Secure\Common\FSM32.EXE" /splash
O4 - HKLM\..\Run: [Google Desktop Search] "C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe" /startup
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [Skype] "C:\Progs\Skype\Skype.exe" /nosplash /minimized
O4 - HKCU\..\Run: [Rainlendar2] C:\Program Files\Rainlendar2\Rainlendar2.exe
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - Startup: Stardock ObjectDock.lnk = C:\progs\ObjectDock\ObjectDock.exe
O4 - Startup: Stickies.lnk = C:\Program Files\stickies\stickies.exe
O4 - Startup: TB-Tray.lnk = C:\Program Files\Thunderbird-Tray\TBTray.exe
O4 - Startup: trillian.lnk = C:\Program Files\Trillian\trillian.exe
O4 - Startup: WinTidy.lnk = C:\progs\WinTidy\WinTidy.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\Progs\OfficeXP\Office10\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O9 - Extra button: Natural Reader - {0DF757C4-9999-463C-A4EB-B6BF1D8D8D3D} - C:\Audio\Progs\Natural Voice\read.html
O9 - Extra button: (no name) - {4E660F19-E91E-41e1-88EF-D1DFAB118F67} - C:\Program Files\Internet Explorer\Plugins\Drowse\MouseGestures.dll
O9 - Extra 'Tools' menuitem: Mouse Gestures... - {4E660F19-E91E-41e1-88EF-D1DFAB118F67} - C:\Program Files\Internet Explorer\Plugins\Drowse\MouseGestures.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O10 - Unknown file in Winsock LSP: c:\program files\bonjour\mdnsnsp.dll
O11 - Options group: [INTERNATIONAL] International*
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1173132418927
O16 - DPF: {8BC53B30-32E4-4ED3-BEF9-DB761DB77453} (CInstallLPCtrl Object) - http://u3.sandisk.com/download/apps/LPInstaller.CAB
O16 - DPF: {B5E2F38B-1C54-4967-8630-38444B50E9B8} (efOrderXLib2.efOrderX2) - https://www.efoto.fi/efOrderX2.CAB
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O20 - Winlogon Notify: WB - C:\progs\WINDOW~1\fastload.dll
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Apache2 - Unknown owner - C:\Program Files\Apache Group\Apache2\bin\Apache.exe" -k runservice (file missing)
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Avast4\aswUpdSv.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: Autodesk Licensing Service - Unknown owner - C:\Program Files\Common Files\Autodesk Shared\Service\AdskScSrv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - Unknown owner - C:\Program Files\Avast4\ashMaiSv.exe" /service (file missing)
O23 - Service: avast! Web Scanner - Unknown owner - C:\Program Files\Avast4\ashWebSv.exe" /service (file missing)
O23 - Service: F-Secure Automatic Update (BackWeb Plug-in - 7681197) - Unknown owner - C:\PROGRA~1\F-Secure\BackWeb\7681197\Program\SERVIC~1.EXE
O23 - Service: C-DillaSrv - C-Dilla Ltd - C:\WINDOWS\System32\DRIVERS\CDANTSRV.EXE
O23 - Service: F-Secure Gatekeeper Handler Starter - F-Secure Corp. - C:\Program Files\F-Secure\Anti-Virus\fsgk32st.exe
O23 - Service: F-Secure Network Request Broker - F-Secure Corporation - C:\Program Files\F-Secure\Common\FNRB32.EXE
O23 - Service: fsbwsys - F-Secure Corp. - C:\Program Files\F-Secure\BackWeb\7681197\program\fsbwsys.exe
O23 - Service: F-Secure Anti-Virus Firewall Daemon (FSDFWD) - F-Secure Corporation - C:\Program Files\F-Secure\FWES\Program\fsdfwd.exe
O23 - Service: F-Secure Management Agent (FSMA) - F-Secure Corporation - C:\Program Files\F-Secure\Common\FSMA32.EXE
O23 - Service: GoogleDesktopManager - Google - C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPod-palvelu (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: License Management Service ESD - Unknown owner - C:\Program Files\Common Files\element5 Shared\Service\Licence Manager ESD.exe
O23 - Service: Macromedia Licensing Service - Unknown owner - C:\Program Files\Common Files\Macromedia Shared\Service\Macromedia Licensing.exe
O23 - Service: MATLAB Server (matlabserver) - Unknown owner - C:\progs\MATLAB7\webserver\bin\win32\matlabserver.exe
O23 - Service: Network Time Protocol Daemon (NTP) - Unknown owner - C:\Program Files\NTP\bin\ntpd.exe
O23 - Service: ServiceLayer - Nokia. - C:\Program Files\Common Files\PCSuite\Services\ServiceLayer.exe
Ja tässä SDFix:
SDFix: Version 1.114
Run by xxx on ke 07.11.2007 at 21:17
Microsoft Windows XP [versio 5.1.2600]
Running From: C:\SDFix
Safe Mode:
Checking Services:
Restoring Windows Registry Values
Restoring Windows Default Hosts File
Rebooting...
Normal Mode:
Checking Files:
Trojan Files Found:
C:\WINDOWS\SYSTEM32\DLH9JK~1.EXE - Deleted
C:\WINDOWS\SYSTEM32\DLLH8J~1.EXE - Deleted
C:\date.log - Deleted
C:\WINDOWS\services.exe - Deleted
C:\WINDOWS\system32\dlh9jkd1q8.exe - Deleted
C:\WINDOWS\system32\dllh8jkd1q8.exe - Deleted
Removing Temp Files...
ADS Check:
C:\WINDOWS
No streams found.
C:\WINDOWS\system32
No streams found.
C:\WINDOWS\system32\svchost.exe
No streams found.
C:\WINDOWS\system32\ntoskrnl.exe
No streams found.
Final Check:
catchme 0.3.1253 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2007-11-07 21:30:03
Windows 5.1.2600 Service Pack 2 NTFS
scanning hidden processes ...
IPC error: 2 Määritettyä tiedostoa ei löydy.
scanning hidden services & system hive ...
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\d347prt\Cfg\0Jf40]
scanning hidden registry entries ...
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\\x00ffc\xd3w\2]
"b049C053C7D38EE4AB9A00CB3B5D2472"="C?\Program Files\Common Files\Microsoft Shared\Web Folders\PUBPLACE.HTT"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Prefetcher]
"TracesProcessed"=dword:00000038
"TracesSuccessful"=dword:00000002
scanning hidden files ...
scan completed successfully
hidden processes: 0
hidden services: 0
hidden files: 0
Remaining Services:
------------------
Authorized Application Key Export:
[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
"%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"C:\\Program Files\\Logitech\\Desktop Messenger\\8876480\\Program\\backWeb-8876480.exe"="C:\\Program Files\\Logitech\\Desktop Messenger\\8876480\\Program\\backWeb-8876480.exe:*:Enabled:Logitech Desktop Messenger"
"C:\\Program Files\\F-Secure\\BackWeb\\7681197\\program\\F-Secure Automatic Update.exe"="C:\\Program Files\\F-Secure\\BackWeb\\7681197\\program\\F-Secure Automatic Update.exe:*:Enabled:F-Secure Automatic Update"
"C:\\WINDOWS\\system32\\P2P Networking\\P2P Networking.exe"="C:\\WINDOWS\\system32\\P2P Networking\\P2P Networking.exe:*:Enabled:P2P Networking"
"C:\\Pelit\\RedFaction\\RedFaction.exe"="C:\\Pelit\\RedFaction\\RedFaction.exe:*:Enabled:Red Faction Launcher"
"C:\\Pelit\\RedFaction\\rf.exe"="C:\\Pelit\\RedFaction\\rf.exe:*:Enabled:Red Faction"
"C:\\progs\\RealPlayer\\realplay.exe"="C:\\progs\\RealPlayer\\realplay.exe:*:Enabled:RealPlayer"
"C:\\progs\\WinaXe_Plus\\Xwppeg.exe"="C:\\progs\\WinaXe_Plus\\Xwppeg.exe:*:Enabled:xwppeg"
"C:\\progs\\WinaXe_Plus\\Xserver.exe"="C:\\progs\\WinaXe_Plus\\Xserver.exe:*:Enabled:Xserver"
"C:\\progs\\Trillian\\trillian.exe"="C:\\progs\\Trillian\\trillian.exe:*:Enabled:Trillian"
"C:\\Program Files\\Messenger\\msmsgs.exe"="C:\\Program Files\\Messenger\\msmsgs.exe:*:Enabled:Windows Messenger"
"C:\\progs\\mIRC\\mirc.exe"="C:\\progs\\mIRC\\mirc.exe:*:Enabled:mIRC"
"C:\\progs\\Kazaa Lite K++\\KazaaLite.kpp"="C:\\progs\\Kazaa Lite K++\\KazaaLite.kpp:*:Enabled:KazaaLite"
"C:\\Pelit\\Wolfenstein - Enemy Territory\\ET.exe"="C:\\Pelit\\Wolfenstein - Enemy Territory\\ET.exe:*:Enabled:ET"
"C:\\Pelit\\Worms2\\frontend.exe"="C:\\Pelit\\Worms2\\frontend.exe:*:Enabled:Worms 2 Frontend"
"C:\\progs\\LeechFTP\\Leechftp.exe"="C:\\progs\\LeechFTP\\Leechftp.exe:*:Enabled:LeechFTP"
"C:\\progs\\Gecko Phone\\Gecko Phone.exe"="C:\\progs\\Gecko Phone\\Gecko Phone.exe:*:Enabled:Gecko Phone VOIP Application"
"C:\\Pelit\\NFS Porsche\\Porsche.exe"="C:\\Pelit\\NFS Porsche\\Porsche.exe:*:Enabled:Porsche"
"C:\\Pelit\\Operation Flashpoint\\Operation Flashpoint\\OperationFlashpoint.exe"="C:\\Pelit\\Operation Flashpoint\\Operation Flashpoint\\OperationFlashpoint.exe:*:Enabled:Operation Flashpoint"
"C:\\WINDOWS\\system32\\dpnsvr.exe"="C:\\WINDOWS\\system32\\dpnsvr.exe:*:Enabled:Microsoft DirectPlay8 Server"
"C:\\progs\\ViRC\\ViRC.exe"="C:\\progs\\ViRC\\ViRC.exe:*:Enabled:Visual IRC Client"
"C:\\progs\\ABC\\abc.exe"="C:\\progs\\ABC\\abc.exe:*:Enabled:abc"
"C:\\Pelit\\Soldat\\Soldat.exe"="C:\\Pelit\\Soldat\\Soldat.exe:*:Enabled:Soldat"
"C:\\gfx\\progs\\3dsmax7\\3dsmax.exe"="C:\\gfx\\progs\\3dsmax7\\3dsmax.exe:*:Enabled:3ds max 7"
"C:\\gfx\\progs\\3dsmax5\\backburner2\\monitor.exe"="C:\\gfx\\progs\\3dsmax5\\backburner2\\monitor.exe:*:Enabled:backburner 2.3 monitor"
"C:\\gfx\\progs\\3dsmax5\\backburner2\\manager.exe"="C:\\gfx\\progs\\3dsmax5\\backburner2\\manager.exe:*:Enabled:backburner 2.3 manager"
"C:\\gfx\\progs\\3dsmax5\\backburner2\\server.exe"="C:\\gfx\\progs\\3dsmax5\\backburner2\\server.exe:*:Enabled:backburner 2.3 server"
"C:\\WINDOWS\\system32\\ping.exe"="C:\\WINDOWS\\system32\\ping.exe:*:Enabled:ping.exe"
"C:\\Pelit\\Armagetron\\armagetron.exe"="C:\\Pelit\\Armagetron\\armagetron.exe:*:Enabled:armagetron"
"C:\\Pelit\\LieroX\\LieroX.exe"="C:\\Pelit\\LieroX\\LieroX.exe:*:Enabled:LieroX"
"C:\\Pelit\\NFSHP2\\NFSHP2.exe"="C:\\Pelit\\NFSHP2\\NFSHP2.exe:*:Enabled:NFSHP2"
"C:\\progs\\Opera7\\Opera.exe"="C:\\progs\\Opera7\\Opera.exe:*:Enabled:Opera Internet Browser"
"C:\\progs\\Trillian3\\trillian.exe"="C:\\progs\\Trillian3\\trillian.exe:*:Enabled:Trillian"
"C:\\progs\\miFiles\\miFiles.exe"="C:\\progs\\miFiles\\miFiles.exe:*:Enabled:miFiles"
"C:\\progs\\eMule\\emule.exe"="C:\\progs\\eMule\\emule.exe:*:Enabled:eMule"
"C:\\Audio\\progs\\JetAudio\\JcServer.exe"="C:\\Audio\\progs\\JetAudio\\JcServer.exe:*:Enabled:jcServer"
"C:\\Audio\\progs\\JetAudio\\jetChat.exe"="C:\\Audio\\progs\\JetAudio\\jetChat.exe:*:Enabled:jetChat - chatting for jetCast"
"C:\\Program Files\\Apache Group\\Apache2\\bin\\Apache.exe"="C:\\Program Files\\Apache Group\\Apache2\\bin\\Apache.exe:*:Enabled:Apache HTTP Server"
"C:\\Program Files\\Trillian 3\\trillian.exe"="C:\\Program Files\\Trillian 3\\trillian.exe:*:Enabled:Trillian"
"C:\\progs\\Trillian 3\\trillian.exe"="C:\\progs\\Trillian 3\\trillian.exe:*:Enabled:Trillian"
"C:\\progs\\Kaspersky\\kavupd.exe"="C:\\progs\\Kaspersky\\kavupd.exe:*:Enabled:kavupd"
"C:\\Program Files\\SmartFTP\\SmartFTP.exe"="C:\\Program Files\\SmartFTP\\SmartFTP.exe:*:Enabled:SmartFTP"
"C:\\progs\\XoftSpy\\XoftSpy.exe"="C:\\progs\\XoftSpy\\XoftSpy.exe:*:Enabled:XoftSpy"
"C:\\Imut\\MyPCUninstaller.exe"="C:\\Imut\\MyPCUninstaller.exe:*:Enabled:MyPCUninstaller.exe"
"C:\\Imut\\nailfix.exe"="C:\\Imut\\nailfix.exe:*:Enabled:nailfix.exe"
"C:\\Program Files\\MSN Messenger\\msnmsgr.exe"="C:\\Program Files\\MSN Messenger\\msnmsgr.exe:*:Enabled:Windows Live Messenger 8.0"
"C:\\Program Files\\MSN Messenger\\msncall.exe"="C:\\Program Files\\MSN Messenger\\msncall.exe:*:Enabled:Windows Live Messenger 8.0 (Phone)"
"C:\\progs\\Trillian 3 Pro\\trillian.exe"="C:\\progs\\Trillian 3 Pro\\trillian.exe:*:Enabled:Trillian"
"C:\\progs\\BitTornado\\btdownloadgui.exe"="C:\\progs\\BitTornado\\btdownloadgui.exe:*:Enabled:btdownloadgui"
"C:\\progs\\AvantBrowser\\avant.exe"="C:\\progs\\AvantBrowser\\avant.exe:*:Enabled:Avant Browser"
"C:\\progs\\HTML-Kit\\Bin\\HTMLKit.exe"="C:\\progs\\HTML-Kit\\Bin\\HTMLKit.exe:*:Enabled:HTML-Kit"
"C:\\Program Files\\Bonjour\\mDNSResponder.exe"="C:\\Program Files\\Bonjour\\mDNSResponder.exe:*:Enabled:Bonjour"
"C:\\Program Files\\iTunes\\iTunes.exe"="C:\\Program Files\\iTunes\\iTunes.exe:*:Enabled:iTunes"
"C:\\Program Files\\LimeWire\\LimeWire.exe"="C:\\Program Files\\LimeWire\\LimeWire.exe:*:Enabled:LimeWire"
"%windir%\\system32\\winav.exe"="%windir%\\system32\\winav.exe:*:Enabled:@xpsp2res.dll,-22019"
"C:\\Progs\\Skype\\Skype.exe"="C:\\Progs\\Skype\\Skype.exe:*:Enabled:Skype"
[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
"%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"C:\\Program Files\\MSN Messenger\\msnmsgr.exe"="C:\\Program Files\\MSN Messenger\\msnmsgr.exe:*:Enabled:Windows Live Messenger 8.0"
"C:\\Program Files\\MSN Messenger\\msncall.exe"="C:\\Program Files\\MSN Messenger\\msncall.exe:*:Enabled:Windows Live Messenger 8.0 (Phone)"
"%windir%\\system32\\winav.exe"="%windir%\\system32\\winav.exe:*:Enabled:@xpsp2res.dll,-22019"
Remaining Files:
---------------
File Backups: - C:\SDFix\backups\backups.zip
Files with Hidden Attributes:
Wed 31 Jan 2007 34,816 A..H. --- "C:\Duunit\Talvisota\~WRL1368.tmp"
Tue 30 Jan 2007 34,816 A..H. --- "C:\Duunit\Talvisota\~WRL3240.tmp"
Tue 6 Nov 2007 4,604,416 ...H. --- "C:\HUT\Dippa\~WRL3506.tmp"
Tue 8 May 2007 50,688 ...H. --- "C:\HUT\MVJ\~WRL0015.tmp"
Tue 8 May 2007 51,200 ...H. --- "C:\HUT\MVJ\~WRL0020.tmp"
Tue 8 May 2007 58,880 ...H. --- "C:\HUT\MVJ\~WRL0041.tmp"
Tue 8 May 2007 48,128 ...H. --- "C:\HUT\MVJ\~WRL0048.tmp"
Tue 8 May 2007 57,856 ...H. --- "C:\HUT\MVJ\~WRL0133.tmp"
Tue 8 May 2007 49,664 ...H. --- "C:\HUT\MVJ\~WRL0138.tmp"
Tue 8 May 2007 59,904 ...H. --- "C:\HUT\MVJ\~WRL0155.tmp"
Tue 8 May 2007 50,688 ...H. --- "C:\HUT\MVJ\~WRL0171.tmp"
Tue 8 May 2007 59,904 ...H. --- "C:\HUT\MVJ\~WRL0217.tmp"
Tue 8 May 2007 59,392 ...H. --- "C:\HUT\MVJ\~WRL0223.tmp"
Tue 8 May 2007 49,152 ...H. --- "C:\HUT\MVJ\~WRL0249.tmp"
Wed 9 May 2007 83,456 ...H. --- "C:\HUT\MVJ\~WRL0255.tmp"
Tue 8 May 2007 58,880 ...H. --- "C:\HUT\MVJ\~WRL0259.tmp"
Tue 8 May 2007 60,416 ...H. --- "C:\HUT\MVJ\~WRL0261.tmp"
Tue 8 May 2007 50,688 ...H. --- "C:\HUT\MVJ\~WRL0337.tmp"
Tue 8 May 2007 51,200 ...H. --- "C:\HUT\MVJ\~WRL0445.tmp"
Wed 9 May 2007 74,240 ...H. --- "C:\HUT\MVJ\~WRL0461.tmp"
Wed 9 May 2007 69,120 ...H. --- "C:\HUT\MVJ\~WRL0490.tmp"
Wed 9 May 2007 83,968 ...H. --- "C:\HUT\MVJ\~WRL0510.tmp"
Tue 8 May 2007 49,152 ...H. --- "C:\HUT\MVJ\~WRL0523.tmp"
Tue 8 May 2007 57,856 ...H. --- "C:\HUT\MVJ\~WRL0547.tmp"
Tue 8 May 2007 47,616 ...H. --- "C:\HUT\MVJ\~WRL0596.tmp"
Wed 9 May 2007 72,704 ...H. --- "C:\HUT\MVJ\~WRL0607.tmp"
Tue 8 May 2007 49,152 ...H. --- "C:\HUT\MVJ\~WRL0629.tmp"
Wed 9 May 2007 84,480 ...H. --- "C:\HUT\MVJ\~WRL0648.tmp"
Wed 9 May 2007 71,168 ...H. --- "C:\HUT\MVJ\~WRL0656.tmp"
Tue 8 May 2007 50,176 ...H. --- "C:\HUT\MVJ\~WRL0666.tmp"
Tue 8 May 2007 52,736 ...H. --- "C:\HUT\MVJ\~WRL0673.tmp"
Tue 8 May 2007 56,320 ...H. --- "C:\HUT\MVJ\~WRL0675.tmp"
Tue 8 May 2007 48,128 ...H. --- "C:\HUT\MVJ\~WRL0722.tmp"
Tue 8 May 2007 58,880 ...H. --- "C:\HUT\MVJ\~WRL0753.tmp"
Tue 8 May 2007 55,296 ...H. --- "C:\HUT\MVJ\~WRL0802.tmp"
Tue 8 May 2007 57,856 ...H. --- "C:\HUT\MVJ\~WRL0803.tmp"
Tue 8 May 2007 52,736 ...H. --- "C:\HUT\MVJ\~WRL0807.tmp"
Tue 8 May 2007 57,856 ...H. --- "C:\HUT\MVJ\~WRL0810.tmp"
Wed 9 May 2007 73,728 ...H. --- "C:\HUT\MVJ\~WRL0903.tmp"
Wed 9 May 2007 68,608 ...H. --- "C:\HUT\MVJ\~WRL0912.tmp"
Wed 9 May 2007 84,480 ...H. --- "C:\HUT\MVJ\~WRL0928.tmp"
Tue 8 May 2007 56,832 ...H. --- "C:\HUT\MVJ\~WRL0946.tmp"
Tue 8 May 2007 50,688 ...H. --- "C:\HUT\MVJ\~WRL0962.tmp"
Wed 9 May 2007 70,656 ...H. --- "C:\HUT\MVJ\~WRL0990.tmp"
Tue 8 May 2007 59,904 ...H. --- "C:\HUT\MVJ\~WRL1022.tmp"
Wed 9 May 2007 67,072 ...H. --- "C:\HUT\MVJ\~WRL1083.tmp"
Wed 9 May 2007 71,680 ...H. --- "C:\HUT\MVJ\~WRL1119.tmp"
Wed 9 May 2007 83,968 ...H. --- "C:\HUT\MVJ\~WRL1142.tmp"
Tue 8 May 2007 56,320 ...H. --- "C:\HUT\MVJ\~WRL1159.tmp"
Wed 9 May 2007 73,728 ...H. --- "C:\HUT\MVJ\~WRL1222.tmp"
Tue 8 May 2007 57,856 ...H. --- "C:\HUT\MVJ\~WRL1264.tmp"
Tue 8 May 2007 57,856 ...H. --- "C:\HUT\MVJ\~WRL1285.tmp"
Tue 8 May 2007 56,320 ...H. --- "C:\HUT\MVJ\~WRL1327.tmp"
Tue 8 May 2007 57,344 ...H. --- "C:\HUT\MVJ\~WRL1353.tmp"
Tue 8 May 2007 59,904 ...H. --- "C:\HUT\MVJ\~WRL1455.tmp"
Tue 8 May 2007 60,416 ...H. --- "C:\HUT\MVJ\~WRL1497.tmp"
Tue 8 May 2007 59,904 ...H. --- "C:\HUT\MVJ\~WRL1573.tmp"
Tue 8 May 2007 58,368 ...H. --- "C:\HUT\MVJ\~WRL1597.tmp"
Wed 9 May 2007 68,608 ...H. --- "C:\HUT\MVJ\~WRL1628.tmp"
Tue 8 May 2007 57,856 ...H. --- "C:\HUT\MVJ\~WRL1662.tmp"
Tue 8 May 2007 52,224 ...H. --- "C:\HUT\MVJ\~WRL1680.tmp"
Wed 9 May 2007 71,168 ...H. --- "C:\HUT\MVJ\~WRL1681.tmp"
Wed 9 May 2007 84,480 ...H. --- "C:\HUT\MVJ\~WRL1695.tmp"
Wed 9 May 2007 73,728 ...H. --- "C:\HUT\MVJ\~WRL1747.tmp"
Wed 9 May 2007 72,192 ...H. --- "C:\HUT\MVJ\~WRL1756.tmp"
Tue 8 May 2007 58,880 ...H. --- "C:\HUT\MVJ\~WRL1764.tmp"
Tue 8 May 2007 51,200 ...H. --- "C:\HUT\MVJ\~WRL1796.tmp"
Tue 8 May 2007 56,320 ...H. --- "C:\HUT\MVJ\~WRL1833.tmp"
Tue 8 May 2007 49,152 ...H. --- "C:\HUT\MVJ\~WRL1894.tmp"
Tue 8 May 2007 55,296 ...H. --- "C:\HUT\MVJ\~WRL1903.tmp"
Tue 8 May 2007 60,416 ...H. --- "C:\HUT\MVJ\~WRL2037.tmp"
Tue 8 May 2007 56,320 ...H. --- "C:\HUT\MVJ\~WRL2054.tmp"
Tue 8 May 2007 56,320 ...H. --- "C:\HUT\MVJ\~WRL2068.tmp"
Wed 9 May 2007 83,456 ...H. --- "C:\HUT\MVJ\~WRL2070.tmp"
Tue 8 May 2007 57,856 ...H. --- "C:\HUT\MVJ\~WRL2077.tmp"
Wed 9 May 2007 73,728 ...H. --- "C:\HUT\MVJ\~WRL2087.tmp"
Wed 9 May 2007 73,216 ...H. --- "C:\HUT\MVJ\~WRL2114.tmp"
Wed 9 May 2007 67,072 ...H. --- "C:\HUT\MVJ\~WRL2148.tmp"
Wed 9 May 2007 69,120 ...H. --- "C:\HUT\MVJ\~WRL2155.tmp"
Wed 9 May 2007 67,072 ...H. --- "C:\HUT\MVJ\~WRL2182.tmp"
Wed 9 May 2007 84,480 ...H. --- "C:\HUT\MVJ\~WRL2235.tmp"
Tue 8 May 2007 50,688 ...H. --- "C:\HUT\MVJ\~WRL2258.tmp"
Tue 8 May 2007 54,784 ...H. --- "C:\HUT\MVJ\~WRL2282.tmp"
Tue 8 May 2007 55,296 ...H. --- "C:\HUT\MVJ\~WRL2307.tmp"
Wed 9 May 2007 84,480 ...H. --- "C:\HUT\MVJ\~WRL2308.tmp"
Tue 8 May 2007 56,320 ...H. --- "C:\HUT\MVJ\~WRL2338.tmp"
Tue 8 May 2007 57,856 ...H. --- "C:\HUT\MVJ\~WRL2445.tmp"
Tue 8 May 2007 52,224 ...H. --- "C:\HUT\MVJ\~WRL2485.tmp"
Wed 9 May 2007 83,968 ...H. --- "C:\HUT\MVJ\~WRL2521.tmp"
Wed 9 May 2007 70,656 ...H. --- "C:\HUT\MVJ\~WRL2546.tmp"
Wed 9 May 2007 83,968 ...H. --- "C:\HUT\MVJ\~WRL2576.tmp"
Wed 28 Feb 2007 139,776 ...H. --- "C:\HUT\MVJ\~WRL2596.tmp"
Wed 9 May 2007 69,632 ...H. --- "C:\HUT\MVJ\~WRL2607.tmp"
Tue 8 May 2007 55,296 ...H. --- "C:\HUT\MVJ\~WRL2626.tmp"
Wed 9 May 2007 83,968 ...H. --- "C:\HUT\MVJ\~WRL2632.tmp"
Tue 8 May 2007 54,272 ...H. --- "C:\HUT\MVJ\~WRL2802.tmp"
Tue 8 May 2007 49,152 ...H. --- "C:\HUT\MVJ\~WRL2820.tmp"
Tue 8 May 2007 57,856 ...H. --- "C:\HUT\MVJ\~WRL2894.tmp"
Wed 9 May 2007 72,192 ...H. --- "C:\HUT\MVJ\~WRL2895.tmp"
Wed 9 May 2007 83,456 ...H. --- "C:\HUT\MVJ\~WRL2898.tmp"
Tue 8 May 2007 50,688 ...H. --- "C:\HUT\MVJ\~WRL2933.tmp"
Wed 9 May 2007 66,048 ...H. --- "C:\HUT\MVJ\~WRL2975.tmp"
Tue 8 May 2007 50,688 ...H. --- "C:\HUT\MVJ\~WRL3040.tmp"
Wed 9 May 2007 84,480 ...H. --- "C:\HUT\MVJ\~WRL3154.tmp"
Wed 9 May 2007 83,456 ...H. --- "C:\HUT\MVJ\~WRL3173.tmp"
Tue 8 May 2007 56,320 ...H. --- "C:\HUT\MVJ\~WRL3185.tmp"
Wed 9 May 2007 66,048 ...H. --- "C:\HUT\MVJ\~WRL3205.tmp"
Tue 8 May 2007 49,152 ...H. --- "C:\HUT\MVJ\~WRL3213.tmp"
Tue 8 May 2007 54,272 ...H. --- "C:\HUT\MVJ\~WRL3220.tmp"
Tue 8 May 2007 51,712 ...H. --- "C:\HUT\MVJ\~WRL3281.tmp"
Wed 9 May 2007 71,680 ...H. --- "C:\HUT\MVJ\~WRL3324.tmp"
Tue 8 May 2007 59,904 ...H. --- "C:\HUT\MVJ\~WRL3325.tmp"
Tue 8 May 2007 59,904 ...H. --- "C:\HUT\MVJ\~WRL3336.tmp"
Tue 8 May 2007 56,320 ...H. --- "C:\HUT\MVJ\~WRL3337.tmp"
Tue 8 May 2007 55,808 ...H. --- "C:\HUT\MVJ\~WRL3381.tmp"
Tue 8 May 2007 57,344 ...H. --- "C:\HUT\MVJ\~WRL3390.tmp"
Tue 8 May 2007 59,904 ...H. --- "C:\HUT\MVJ\~WRL3424.tmp"
Tue 8 May 2007 60,928 ...H. --- "C:\HUT\MVJ\~WRL3468.tmp"
Tue 8 May 2007 55,296 ...H. --- "C:\HUT\MVJ\~WRL3504.tmp"
Tue 8 May 2007 58,880 ...H. --- "C:\HUT\MVJ\~WRL3523.tmp"
Wed 9 May 2007 73,216 ...H. --- "C:\HUT\MVJ\~WRL3525.tmp"
Tue 8 May 2007 53,760 ...H. --- "C:\HUT\MVJ\~WRL3570.tmp"
Tue 8 May 2007 53,760 ...H. --- "C:\HUT\MVJ\~WRL3633.tmp"
Wed 9 May 2007 70,144 ...H. --- "C:\HUT\MVJ\~WRL3650.tmp"
Wed 9 May 2007 84,992 ...H. --- "C:\HUT\MVJ\~WRL3651.tmp"
Tue 8 May 2007 57,856 ...H. --- "C:\HUT\MVJ\~WRL3653.tmp"
Tue 8 May 2007 59,904 ...H. --- "C:\HUT\MVJ\~WRL3665.tmp"
Wed 9 May 2007 71,680 ...H. --- "C:\HUT\MVJ\~WRL3678.tmp"
Tue 8 May 2007 57,856 ...H. --- "C:\HUT\MVJ\~WRL3739.tmp"
Tue 8 May 2007 52,736 ...H. --- "C:\HUT\MVJ\~WRL3798.tmp"
Tue 8 May 2007 60,416 ...H. --- "C:\HUT\MVJ\~WRL3841.tmp"
Tue 8 May 2007 52,736 ...H. --- "C:\HUT\MVJ\~WRL3847.tmp"
Tue 8 May 2007 57,856 ...H. --- "C:\HUT\MVJ\~WRL3882.tmp"
Wed 9 May 2007 73,728 ...H. --- "C:\HUT\MVJ\~WRL3923.tmp"
Wed 9 May 2007 83,456 ...H. --- "C:\HUT\MVJ\~WRL3981.tmp"
Wed 9 May 2007 74,240 ...H. --- "C:\HUT\MVJ\~WRL4017.tmp"
Tue 8 May 2007 60,416 ...H. --- "C:\HUT\MVJ\~WRL4047.tmp"
Tue 8 May 2007 53,760 ...H. --- "C:\HUT\MVJ\~WRL4051.tmp"
Wed 9 May 2007 69,120 ...H. --- "C:\HUT\MVJ\~WRL4065.tmp"
Thu 1 Mar 2007 292,352 ...H. --- "C:\HUT\VV\~WRL2517.tmp"
Fri 10 Mar 2000 84,992 A.SH. --- "C:\Program Files\Zwei-Stein\14_43260.DLL"
Fri 10 Mar 2000 44,032 A.SH. --- "C:\Program Files\Zwei-Stein\28_83260.DLL"
Fri 10 Mar 2000 30,208 A.SH. --- "C:\Program Files\Zwei-Stein\AUTH3260.DLL"
Fri 10 Mar 2000 23,552 A.SH. --- "C:\Program Files\Zwei-Stein\BASC3260.DLL"
Fri 10 Mar 2000 23,552 A.SH. --- "C:\Program Files\Zwei-Stein\COKR3260.DLL"
Fri 10 Mar 2000 25,088 A.SH. --- "C:\Program Files\Zwei-Stein\COOK3260.DLL"
Fri 10 Mar 2000 20,480 A.SH. --- "C:\Program Files\Zwei-Stein\DNET3260.DLL"
Fri 10 Mar 2000 78,848 A.SH. --- "C:\Program Files\Zwei-Stein\EDNT3260.DLL"
Fri 10 Mar 2000 446,976 A.SH. --- "C:\Program Files\Zwei-Stein\ENCN3260.DLL"
Fri 10 Mar 2000 21,504 A.SH. --- "C:\Program Files\Zwei-Stein\ENLV3260.DLL"
Fri 10 Mar 2000 92,672 A.SH. --- "C:\Program Files\Zwei-Stein\ERV13260.DLL"
Fri 10 Mar 2000 272,384 A.SH. --- "C:\Program Files\Zwei-Stein\ERV23260.DLL"
Fri 10 Mar 2000 59,392 A.SH. --- "C:\Program Files\Zwei-Stein\ESPR3260.DLL"
Tue 16 Oct 2001 139,264 A.SH. --- "C:\Program Files\Zwei-Stein\jpeglib.dll"
Fri 10 Mar 2000 278,528 A.SH. --- "C:\Program Files\Zwei-Stein\PNCRT.DLL"
Fri 10 Mar 2000 379,904 A.SH. --- "C:\Program Files\Zwei-Stein\PNGU3264.DLL"
Fri 10 Mar 2000 11,264 A.SH. --- "C:\Program Files\Zwei-Stein\PNRS3260.DLL"
Fri 10 Mar 2000 508,928 A.SH. --- "C:\Program Files\Zwei-Stein\RMBE3260.DLL"
Fri 10 Mar 2000 521,216 A.SH. --- "C:\Program Files\Zwei-Stein\RMME3260.DLL"
Fri 10 Mar 2000 328,192 A.SH. --- "C:\Program Files\Zwei-Stein\RMTO3260.DLL"
Fri 10 Mar 2000 28,160 A.SH. --- "C:\Program Files\Zwei-Stein\RN5A3260.DLL"
Fri 10 Mar 2000 500,224 A.SH. --- "C:\Program Files\Zwei-Stein\RNCO3260.DLL"
Fri 10 Mar 2000 30,208 A.SH. --- "C:\Program Files\Zwei-Stein\RV103260.DLL"
Fri 10 Mar 2000 90,624 A.SH. --- "C:\Program Files\Zwei-Stein\RV203260.DLL"
Fri 10 Mar 2000 41,472 A.SH. --- "C:\Program Files\Zwei-Stein\SDPP3260.DLL"
Fri 10 Mar 2000 17,408 A.SH. --- "C:\Program Files\Zwei-Stein\SIPR3260.DLL"
Tue 16 Oct 2001 569,344 A.SH. --- "C:\Program Files\Zwei-Stein\tablib.dll"
Tue 16 Oct 2001 1,167,360 A.SH. --- "C:\Program Files\Zwei-Stein\tassdll.dll"
Tue 16 Oct 2001 32,768 A.SH. --- "C:\Program Files\Zwei-Stein\thereal.dll"
Tue 16 Oct 2001 20,480 A.SH. --- "C:\Program Files\Zwei-Stein\vidfowin.dll"
Tue 16 Oct 2001 20,480 A.SH. --- "C:\Program Files\Zwei-Stein\wavout.dll"
Tue 16 Oct 2001 98,304 A.SH. --- "C:\Program Files\Zwei-Stein\wmfwrite.dll"
Fri 3 Dec 2004 8 A.SHR --- "C:\WINDOWS\system32\F507DCCE79.sys"
Tue 30 Jan 2007 10,856 A.SH. --- "C:\WINDOWS\system32\KGyGaAvL.sys"
Mon 20 Sep 2004 4,348 ..SH. --- "C:\Documents and Settings\All Users\DRM\DRMv1.bak"
Tue 23 Jan 2007 5,297,976 A..H. --- "C:\gfx\progs\Picasa2\setup.exe"
Mon 20 Nov 2006 171,520 ...H. --- "C:\HUT\KNT\OLED\~WRL0005.tmp"
Tue 21 Nov 2006 171,520 ...H. --- "C:\HUT\KNT\OLED\~WRL0295.tmp"
Sat 25 Nov 2006 180,224 ...H. --- "C:\HUT\KNT\OLED\~WRL3222.tmp"
Sun 25 Mar 2007 138,752 ...H. --- "C:\HUT\MVJ\final report\~WRL3531.tmp"
Sun 3 Dec 2006 0 A.SH. --- "C:\Documents and Settings\All Users\DRM\Cache\Indiv01.tmp"
Mon 5 Mar 2007 0 A.SH. --- "C:\Documents and Settings\All Users\DRM\Cache\Indiv02.tmp"
Thu 15 Mar 2007 0 A.SH. --- "C:\Documents and Settings\All Users\DRM\Cache\Indiv03.tmp"
Thu 15 Mar 2007 0 A.SH. --- "C:\Documents and Settings\All Users\DRM\Cache\Indiv04.tmp"
Thu 25 Oct 2007 0 A.SH. --- "C:\Documents and Settings\All Users\DRM\Cache\Indiv05.tmp"
Sat 27 Oct 2007 0 A.SH. --- "C:\Documents and Settings\All Users\DRM\Cache\Indiv06.tmp"
Sat 24 Mar 2007 47,104 ...H. --- "C:\Documents and Settings\Username\Application Data\Microsoft\Templates\~WRL0786.tmp"
Sun 4 Mar 2007 36,352 ...H. --- "C:\Documents and Settings\Username\Application Data\Microsoft\Templates\~WRL2291.tmp"
Tue 27 Feb 2007 35,328 ...H. --- "C:\Documents and Settings\Username\Application Data\Microsoft\Templates\~WRL3088.tmp"
Sat 24 Mar 2007 58,368 ...H. --- "C:\Documents and Settings\Username\Application Data\Microsoft\Templates\~WRL3278.tmp"
Fri 2 Nov 2007 61,440 ...H. --- "C:\Documents and Settings\Username\Application Data\Microsoft\Word\~WRL2464.tmp"
Thu 7 Dec 2006 3,096,576 A..H. --- "C:\Documents and Settings\Username\Application Data\U3\temp\Launchpad Removal.exe"
Finished!
Merkkaa ja paina fix checked:
O2 - BHO: (no name) - {88035E2B-FB56-4ECF-BCA1-099C731DFE2D} - (no file)
Ohje AVG Anti-Spyware 7.5:n käyttöön
Huom! Tässä ohjeessa sammutetaan tuo reaaliaikasuojaus (Shield). Näin vältetään tilanteet joissa suojaus estäisi esim HijackThis työkalun toimintaa.
Tallenna nämä ohjeet tekstitiedostoon tai tulosta nämä, muuten et pääse niihin käsiksi vikasietotilasta
Lataa AVG Anti-Spyware 7.5 http://www.ewido.net/en/download/
ja tallenna ohjelma työpöydällesi.
• Kun olet ladannut ohjelman, kaksoisklikkaa asennuohjelman pikakuvaketta työpöydälläsi, asennus alkaa.
• Asennuksen jälkeen täytyy ohjelma käynnistää ja sen tunnisteet päivittää.
• Käynnistä AVG Anti-Spyware.
• Klikkaa "Update" kuvaketta päävalikossa. Sen jälkeen klikkaa "Update now" painiketta.
o Sitten klikkaa "Start Update" kuvaketta jolloin päivitys alkaa.
• Kun päivitykset on ladattu, klikkaa "Scanner" kuvaketta ikkunan ylälaidassa. Valitse sitten "Settings" välilehti.
• Kun "Settings" valikko on auennut, klikkaa "Recommended actions" ja sitten valitse "Quarantine".
• Sitten "Reports" valikon alta:
o Laita täppi kohtaan "Automatically generate report after every scan"
o Ota täppi pois kohdasta"Only if threats were found"
• Sitten klikkaa "Shield" kuvaketta ikkunan ylälaidassa
• "Resident shield is", muuta tila active:sta inactive:ksi
• Sulje ohjelma, ÄLÄ skannaa vielä.
Käynnistä koneesi vikasietotilaan,
sammuta ja käynnistä
käynnistyksen yhteydessä naputtele F8
valitse nuoli näppäimellä vikasietotila
paina enter ja enter
HUOM! Älä käytä muita ohjelmia AVG skannauksen aikana, tämä saattaa häiritä skannausta.
• Kun vikasietotilassa, käynnistä AVG Anti-Spyware.
• Klikkaa "Scanner" kuvaketta ikkunan ylälaidassa ja valitse "Scan" välilehti. Sitten klikkaa "Complete System Scan".
• Ewido aloittaa nyt tietokoneen skannaamisen, ole kärsivällinen sillä skannaus vie aikaa.
Kun skannaus on valmis:
TÄRKEÄÄ : Älä klikkaa "Save Scan Report" ennen kuin klikkaat "Apply all Actions"
• Varmistu, että Set all elements to: näyttää Quarantine (1), jos ei, klikkaa linkkiä ja valitse Quarantine popup-valikosta.
• Sinulta kysytään mitä tehdä jos infektioita löytyi, valitse silloin "Apply all actions"
• Sitten klikkaa "Reports" kuvaketta ohjelma yläosasta.
• Klikkaa "Save report as" painiketta ikkunan vasemmassa alalaidassa ja tallenna raportti työpöydälle.
• Sulje ohjelma, käynnistä kone normaalisti ja lähetä AVG:n raportti viestikejuusi.
Tänks. Tuota noin, ongelmat ovat jo näennäisesti poissa. Pitäiskö toi AVG silti ajaa?
Eihän mitään ole pakko tehdä, mutta suositan kovasti sen ajamista..=)