Apua: Virukset valtaavat koneeni

Vanha rouva

Hei!

Osaisiko joku auttaa!!! KOneessa troijalaisia ja joku backdoor ja jotain muutakin. Itse en ymmärrä koneista mitään, mutta luettuani näitä palstoja ajoin tällaisen HJT:n ja tässä loki. Mitähän tässä sanotaan?? Olisin kiitollinen selkeistä neuvoista.

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 23:06:34, on 3.6.2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16640)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\F-Secure Internet Security\Common\FSM32.EXE
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Java\j2re1.4.2_03\bin\jusched.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\WINDOWS\system32\CTsvcCDA.exe
C:\Program Files\F-Secure Internet Security\Anti-Virus\fsgk32st.exe
C:\Program Files\F-Secure Internet Security\Common\FSMA32.EXE
C:\Program Files\F-Secure Internet Security\Anti-Virus\FSGK32.EXE
C:\Program Files\Common Files\BinarySense\hldasvc.exe
C:\Program Files\F-Secure Internet Security\Common\FSMB32.EXE
C:\Program Files\Common Files\BinarySense\hldasvc.exe
C:\WINDOWS\System32\nvsvc32.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\F-Secure Internet Security\Common\FCH32.EXE
C:\WINDOWS\system32\MsPMSPSv.exe
C:\Program Files\F-Secure Internet Security\Common\FAMEH32.EXE
C:\Program Files\F-Secure Internet Security\Anti-Virus\fsqh.exe
C:\Program Files\F-Secure Internet Security\FSPC\fspc.exe
C:\Program Files\F-Secure Internet Security\FSGUI\fsguidll.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\F-Secure Internet Security\FSAUA\program\fsaua.exe
C:\Program Files\F-Secure Internet Security\Anti-Virus\fssm32.exe
C:\Program Files\F-Secure Internet Security\FWES\Program\fsdfwd.exe
C:\Program Files\F-Secure Internet Security\FSAUA\program\fsus.exe
C:\Program Files\F-Secure Internet Security\Anti-Virus\fsav32.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Creative\Sync Manager Unicode\CTSyncU.exe
C:\Program Files\Creative\Shared Files\CTSched.exe
C:\PROGRA~1\HPPAVI~1\Pavilion\XPHWWBS4\plugin\bin\PCHButton.exe
C:\Program Files\Microsoft Office\Office12\ONENOTEM.EXE
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.fi/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iesearch&locale=FI_FI&c=Q304&bd=pavilion&pf=desktop
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iesearch&locale=FI_FI&c=Q304&bd=pavilion&pf=desktop
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iesearch&locale=FI_FI&c=Q304&bd=pavilion&pf=desktop
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = \blank.htm
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Linkit
O2 - BHO: SDWin32 Class - {2F8EFE7E-EA44-4CBF-AF5A-26D5F9D56340} - (no file)
O2 - BHO: - {3577AC9F-E787-4A7D-8FE5-FA24D9E917E0} - (no file)
O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\PROGRA~1\MICROS~2\Office12\GRA8E1~1.DLL
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Windows Liven kirjautumisapuohjelma - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
O2 - BHO: Windows Live Toolbar Helper - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
O3 - Toolbar: HP-näkymä - {B2847E28-5D7D-4DEB-8B67-05D28BCF79F5} - c:\program files\hp\digital imaging\bin\hpdtlk02.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O3 - Toolbar: Windows Live Toolbar - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [F-Secure Manager] "C:\Program Files\F-Secure Internet Security\Common\FSM32.EXE" /splash
O4 - HKLM\..\Run: [F-Secure TNB] "C:\Program Files\F-Secure Internet Security\FSGUI\TNBUtil.exe" /CHECKALL /WAITFORSW
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\j2re1.4.2_03\bin\jusched.exe"
O4 - HKLM\..\Run: [Windows UDP Control] winudspm.exe
O4 - HKLM\..\Run: [Windows svchost] service.exe
O4 - HKCU\..\Run: [F-Secure TNB] "C:\Program Files\F-Secure Internet Security\FSGUI\TNBUtil.exe" /CHECKALL /WAITFORSW
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [BackupNotify] c:\Program Files\HP\Digital Imaging\bin\backupnotify.exe
O4 - HKCU\..\Run: [CTSyncU.exe] "C:\Program Files\Creative\Sync Manager Unicode\CTSyncU.exe"
O4 - HKCU\..\Run: [CreativeTaskScheduler] "C:\Program Files\Creative\Shared Files\CTSched.exe" /logon
O4 - HKCU\..\Run: [Acme.PCHButton] C:\PROGRA~1\HPPAVI~1\Pavilion\XPHWWBS4\plugin\bin\PCHButton.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Paikallinen palve')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Verkkopalve')
O4 - HKUS\S-1-5-18\..\Run: [Picasa Media Detector] C:\Program Files\Picasa2\PicasaMediaDetector.exe (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [Picasa Media Detector] C:\Program Files\Picasa2\PicasaMediaDetector.exe (User 'Default user')
O4 - Startup: OneNote 2007 -näyttöleikkeet ja Launcher.lnk = C:\Program Files\Microsoft Office\Office12\ONENOTEM.EXE
O8 - Extra context menu item: &Google Search - res://C:\Program Files\Google\GoogleToolbar1.dll/cmsearch.html
O8 - Extra context menu item: &Search - http://bar.mywebsearch.com/menusearch.html?p=ZCzfw003XXFI
O8 - Extra context menu item: &Translate English Word - res://C:\Program Files\Google\GoogleToolbar1.dll/cmwordtrans.html
O8 - Extra context menu item: &Windows Live Search - res://C:\Program Files\Windows Live Toolbar\msntb.dll/search.htm
O8 - Extra context menu item: Backward Links - res://C:\Program Files\Google\GoogleToolbar1.dll/cmbacklinks.html
O8 - Extra context menu item: Cached Snapshot of Page - res://C:\Program Files\Google\GoogleToolbar1.dll/cmcache.html
O8 - Extra context menu item: Similar Pages - res://C:\Program Files\Google\GoogleToolbar1.dll/cmsimilar.html
O8 - Extra context menu item: Translate Page into English - res://C:\Program Files\Google\GoogleToolbar1.dll/cmtrans.html
O8 - Extra context menu item: V&ie Microsoft Exceliin - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2_03\bin\npjpi142_03.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2_03\bin\npjpi142_03.dll
O9 - Extra button: Lapsilukko... - {200DB664-75B5-47c0-8B45-A44ACCF73C00} - C:\Program Files\F-Secure Internet Security\FSPC\fspcmsie.dll
O9 - Extra button: (no name) - {200DB664-75B5-47c0-8B45-A44ACCF73F01} - C:\Program Files\F-Secure Internet Security\FSPC\fspcmsie.dll
O9 - Extra 'Tools' menuitem: Lapsilukko... - {200DB664-75B5-47c0-8B45-A44ACCF73F01} - C:\Program Files\F-Secure Internet Security\FSPC\fspcmsie.dll
O9 - Extra button: (no name) - {200DB664-75B5-47c0-8B45-A44ACCF73F02} - C:\Program Files\F-Secure Internet Security\FSPC\fspcmsie.dll
O9 - Extra 'Tools' menuitem: &Keskeytä Web-sivujen suodatus - {200DB664-75B5-47c0-8B45-A44ACCF73F02} - C:\Program Files\F-Secure Internet Security\FSPC\fspcmsie.dll
O9 - Extra button: (no name) - {200DB664-75B5-47c0-8B45-A44ACCF73F03} - C:\Program Files\F-Secure Internet Security\FSPC\fspcmsie.dll
O9 - Extra 'Tools' menuitem: &Kiellä tämä Web-sivusto - {200DB664-75B5-47c0-8B45-A44ACCF73F03} - C:\Program Files\F-Secure Internet Security\FSPC\fspcmsie.dll
O9 - Extra button: (no name) - {200DB664-75B5-47c0-8B45-A44ACCF73F04} - C:\Program Files\F-Secure Internet Security\FSPC\fspcmsie.dll
O9 - Extra 'Tools' menuitem: &Salli tämä Web-sivusto - {200DB664-75B5-47c0-8B45-A44ACCF73F04} - C:\Program Files\F-Secure Internet Security\FSPC\fspcmsie.dll
O9 - Extra button: Lisää tämä blogiin - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra 'Tools' menuitem: &Lisää tämä blogiin tuotteessa Windows Live Writer - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra button: Lähetä OneNoteen - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: Läh&etä OneNoteen - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {1239CC52-59EF-4DFA-8C61-90FFA846DF7E} (Musicnotes Viewer) - http://www.musicnotes.com/download/mnviewer.cab
O16 - DPF: {1D4DB7D2-6EC9-47A3-BD87-1E41684E07BB} - http://ak.imgfarm.com/images/nocache/funwebproducts/ei/CursorManiaInitialSetup1.0.0.8.cab
O16 - DPF: {20A60F0D-9AFA-4515-A0FD-83BD84642501} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab56986.cab
O16 - DPF: {2917297F-F02B-4B9D-81DF-494B6333150B} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineSweeper.cab31267.cab
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://spaces.msn.com//PhotoUpload/MsnPUpld.cab
O16 - DPF: {5C051655-FCD5-4969-9182-770EA5AA5565} (Solitaire Showdown Class) - http://messenger.zone.msn.com/binary/SolitaireShowdown.cab56986.cab
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsClient.cab31267.cab
O16 - DPF: {A8F2B9BD-A6A0-486A-9744-18920D898429} (ScorchPlugin Class) - http://www.sibelius.com/download/software/win/ActiveXPlugin.cab
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/msnmessengersetupdownloader.cab
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (MSN Games - Installer) - http://messenger.zone.msn.com/binary/ZIntro.cab56649.cab
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
O16 - DPF: {F58E1CEF-A068-4C15-BA5E-587CAF3EE8C6} (MSN Chat Control 4.5) - http://chat.msn.com/controls/msnchat45.cab
O16 - DPF: {F5A7706B-B9C0-4C89-A715-7A0C6B05DD48} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineSweeper.cab56986.cab
O16 - DPF: {F6ACF75C-C32C-447B-9BEF-46B766368D29} (Creative Software AutoUpdate Support Package) - http://www.creative.com/su2/CTL_V02002/ocx/15034/CTPID.cab
O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\PROGRA~1\MICROS~2\Office12\GR99D3~1.DLL
O18 - Protocol: hddlife - {BD758015-47D9-477A-8873-4B688A2BC0E2} - "C:\Program Files\BinarySense\HDDlife 3\hlAPP.dll" (file missing)
O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft AB - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\system32\CTsvcCDA.exe
O23 - Service: F-Secure Gatekeeper Handler Starter - F-Secure Corporation - C:\Program Files\F-Secure Internet Security\Anti-Virus\fsgk32st.exe
O23 - Service: F-Secure Automatic Update Agent (FSAUA) - F-Secure Corporation - C:\Program Files\F-Secure Internet Security\FSAUA\program\fsaua.exe
O23 - Service: F-Secure Anti-Virus Firewall Daemon (FSDFWD) - F-Secure Corporation - C:\Program Files\F-Secure Internet Security\FWES\Program\fsdfwd.exe
O23 - Service: FSMA - F-Secure Corporation - C:\Program Files\F-Secure Internet Security\Common\FSMA32.EXE
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: HDDlife HDD Access service - BinarySense, Inc. - C:\Program Files\Common Files\BinarySense\hldasvc.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPod-palvelu (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe

--
End of file - 13402 bytes

20

844

Äänestä

    Vastaukset

    Anonyymi (Kirjaudu / Rekisteröidy)
    5000
    • ..........

      1. Lataa combofix.exe työpöydällesi jommastakummasta linkistä:
      http://www.techsupportforum.com/sectools/sUBs/ComboFix. exe
      http://download.bleepingcomputer.com/sUBs/ComboFix.exe

      2. Tuplaklikkaa combofix.exe tiedostoa ja seuraa ohjeistuksia.
      3. Kun työkalu on valmis, se tuottaa lokin. Lähetä tämä loki viesti ketjuusi.
      Huom! Älä klikkaile combofixin ikkunaa käytön aikana. Tämä saattaa aiheuttaa ohjelman jumiutumisen.



      Lataa SDFix by AndyManchesta ja tallenna se työpöydällesi.
      http://downloads.andymanchesta.com/RemovalTools/SDFix.zip

      Käynnistä koneesi vikasietotilaan ja valitse tavallinen käyttäjätilisi: Käynnistä tietokone
      Kun kuulet koneen piippaavan, paina F8, kuitenkin ennen Windowsin logon esiintuloa
      Seuraavaksi pitäisi ilmestyä valikko
      Valitse valikosta vikasietotila.

      Kun vikasietotilassa, pura tiedoston SDFix.zip sisältö (SDFix.exe) työpöydälle. Tuplakilikkaa työpöydälle ilmestynyttä sdfix.exe tiedostoa. Tiedosto purkaantuu ja asentaa itsensä siihen levyasemaan, minne on käyttöjärjestelmä on asennettu ja juureen ilmestyy kansio SDFix, ESIM C:\SDFix
      - Avaa SDFix-kansio ja tuplaklikkaa tiedostoa RunThis.bat käynnistääksesi ohjelman.
      -Paina Y käynnistääksesi skriptin.
      - Työkalu puhdistaa troijalaisen palvelut ja tekee myös joitakin korjauksia rekisteriin. Lopuksi se pyytää käynnistämään koneen uudelleen, "Press any key to Reboot".
      -Paina mitä tahansa näppäintä ja kone käynnistyy uudelleen.
      - Käynnistyminen kestää normaalia kauemmin sillä SDFix puhdistaa konetta.
      - Kun kone on käynnistynyt ja työpöytä latautunut, SDFix kertoo että puhdistus on suoritettu, "Finished".
      - Paina sitten mitä tahansa näppäintä sulkeaksesi skriptin ja ladataksesi pikakuvakkeet työpöydälle.
      - Lopuksi avaa SDFix kansio (työpöydällä) ja kopioi & liitä tiedoston Report.txt sisältö viestiketjuusi.



      Lataa Malwarebytes' Anti-Malware työpöydällesi.
      http://www.besttechie.net/tools/mbam-setup.exe
      Tuplaklikkaa mbam-setup.exe ja seuraa ohjeita asentaaksesi ohjelman.
      Lopuksi varmistu, että seuraavat on valittu: Update Malwarebytes' Anti-Malware ja Launch Malwarebytes' Anti-Malware ja sen jälkeen klikkaa Finish.
      Jos päivitys löytyy. ohjelma lataa ja asentaa uusimman version.
      Kun ohjelma on latautunut, valitse Perform full scan ja klikkaa Scan.
      Kun skanni on valmis, klikkaa OK ja sitten Show Results nähdäksesi tulokset.
      Varmistu, että kaikki on merkitty ja klikkaa Remove Selected.
      Tämän jälkeen loki avautuu muistioon. Tallenna se paikkaan, josta löydät sen helposti. Loki löytyy myös täältä: C:\Documents and Settings\Käyttäjänimi\Application Data\Malwarebytes\Malwarebytes' Anti-Malware\Logs\log-päiväys.txt
      Lähetä lokin sisältö seuraavassa viestissäsi.



      Javan päivitys ja välimuistin tyhjennys:

      1. Klikkaa Käynnistä -> Ohjauspaneeli ja tupla-klikkaa Lisää tai poista sovellus Ohjauspaneelissa.
      2. Etsi listasta kaikki entiset Java versiosi. (J2SE Runtime Environment.... )
      Niissä pitäisi olla seuraava kuva vieressä:

      3. Valitse kaikki entiset Java versiosi ja valitse Poista.
      4. Asenna uusin Java päivitys seuraavasta linkistä..
      5. Käynnistä kone uudelleen asennuksen jälkeen:

      http://java.sun.com/javase/downloads/index.jsp

      Rullaa alas kohteeseen Java Runtime Environment (JRE) 6u4

      Paina Download

      Ruksaa Accept, ota offline installation, tallenna vaikka työpöydälle ja asenna se.

      6. Käynnistyksen jälkeen, mene takaisin Ohjauspaneeliin ja avaa Java asetuksesi (Muita Ohjauspaneelin asetuksia -> Java kahvikuppi).

      7. General Settings -osion alla, vedä liukusäädintä (Disk Space) pienemmälle, ja klikkaa Delete Files -nappia.

      (Jotkut javapohjaiset ohjelmat saattavat tarvita enemmän levytilaa.
      Jos huomaat säädön pienentämisen jälkeen koneessa hitautta, siirrä liukusäädintä isommalle).

      8. Varmista että kaikki kaksi valintaa ovat rastitettuja:

      *Applications and Applets

      *Trace and Log Files


      Ja paina OK -nappia

      9. Klikkaa OK "Temporary Files Settings" -ikkunassasi.

      10. Klikkaa OK jättääksesi Java asetusikkunasi.



      Lataa tuolta http://www.ccleaner.com/download/builds.aspx
      CCleaner , ÄLÄ aseenna Yahoo toolbaria!

      laita asetukset näin:
      Valinnat --> Lisäasetukset --> Ota ruksi pois kohdasta Poista vain yli 48 tuntia vanhat tilapäistiedostot.

      aja Puhdistaja > tutki nappi > aja ccleaner nappi oikea alakulma
      aja Virheet > etsi rekisteri virheitä nappi > Korjaa rekisteri virheet. nappi


      kun nää on tehty niin niin laita noista kolmesta ekasta ohjelmasta tulleet raportit ja liitä vielä uusi HJT logi niin katsotaan lisää.

      • Vanha rouva

        Toivottavasti osaan tehdä tuon kaiken ;-)

        Palailen asiaan illemmalla, kun pääsen töistä kotiin.

        Hienoa, että on ihmisiä, joilta saa näitä neuvoja.

      • Vanha rouva
        Vanha rouva kirjoitti:

        Toivottavasti osaan tehdä tuon kaiken ;-)

        Palailen asiaan illemmalla, kun pääsen töistä kotiin.

        Hienoa, että on ihmisiä, joilta saa näitä neuvoja.

        Huh, huh, aika homma oli noudattaa ohjeita ja aikaakin kului.

        Combofix ei onnistunut ja luulen että SDFixin aikanakin tapahtui jotakin outoa enkä ehkä tehnyt sitä aivan oikein.

        Jos osaat(te) sanoa tästä jotakin, niin suuretkiitokset (ja muutenkin kiitokset, että olet neuvonut).


        Tässä tätä lokilistaa sitten kerrakseen:

        SDFix:
        C:\DOCUME~1\Omistaja\LOCALS~1\Temp\services.exe
        C:\DOCUME~1\Omistaja\LOCALS~1\Temp\winlogon.exe
        C:\Documents and Settings\Omistaja\Application Data\ntos.exe
        C:\fwdrv.sys
        C:\lich.exe
        C:\lich.sys
        C:\qqd.sys
        C:\suhdlog.sys
        C:\WINDOWS\Cursors\mkwsqp.cur
        C:\WINDOWS\Cursors\rqksgpu.cur
        C:\WINDOWS\Cursors\rwtatpl.lid
        C:\WINDOWS\Cursors\werasqlp.cur
        C:\WINDOWS\fkjdfje.sys
        C:\WINDOWS\help\aiqpbter.chm
        C:\WINDOWS\help\guntest.chm
        C:\WINDOWS\help\hqaply.chm
        C:\WINDOWS\help\lagednick.chm
        C:\WINDOWS\help\merqpo.chm
        C:\WINDOWS\help\oqtxde.chm
        C:\WINDOWS\help\pzqlp.chm
        C:\WINDOWS\help\zeqwur.chm
        C:\WINDOWS\ieqazhew.dll
        C:\WINDOWS\inf\accctsggw.cat
        C:\WINDOWS\inf\agehhtd.cat
        C:\WINDOWS\inf\cjwriiigqazft.cat
        C:\WINDOWS\inf\qwetab.inf
        C:\WINDOWS\inf\rYehhbqzx.adm
        C:\WINDOWS\inf\uxgrafj.adm
        C:\WINDOWS\inf\wseqnx.inf
        C:\WINDOWS\inf\yqzsypbgh.cat
        C:\WINDOWS\inf\yutsubk.cat
        C:\WINDOWS\inf\zyxelmodem.ADM
        C:\WINDOWS\mqzprwe.log
        C:\WINDOWS\njqzpir.sys
        C:\WINDOWS\nqaplwj.sys
        C:\WINDOWS\nkit.dll
        C:\WINDOWS\qalwpmdgt.sys
        C:\WINDOWS\qaszpurn.sys
        C:\WINDOWS\repair\kasutio
        C:\WINDOWS\serazavr.log
        C:\WINDOWS\spooldr.exe
        C:\WINDOWS\system\efidriver.drv
        C:\WINDOWS\system\hipsrv.mm
        C:\WINDOWS\system\pcximg.pif
        C:\WINDOWS\system\tap64drv
        C:\WINDOWS\system\tunnet.ocx
        C:\WINDOWS\system\userinfo32.ggt
        C:\WINDOWS\system32\3klagia.dll
        C:\WINDOWS\system32\4fdw.dll
        C:\WINDOWS\system32\bqzpas.sys
        C:\WINDOWS\system32\btstack.ibs
        C:\WINDOWS\system32\cmon32.lib
        C:\WINDOWS\system32\dbmgmnt.dll
        C:\WINDOWS\system32\DefLib.sys
        C:\WINDOWS\system32\dmclient.exe
        C:\WINDOWS\system32\dprot.sys
        C:\WINDOWS\system32\drivers\asc355.sys
        C:\WINDOWS\system32\drivers\asc355O.sys
        C:\WINDOWS\system32\drivers\asc3550a.sys
        C:\WINDOWS\system32\drivers\asc3550o.sys
        C:\WINDOWS\system32\drivers\asc3550p.sys
        C:\WINDOWS\system32\drivers\asc3550u.sys
        C:\WINDOWS\system32\drivers\asc3550v.sys
        C:\WINDOWS\system32\drivers\astq.tga
        C:\WINDOWS\system32\drivers\core.sys
        C:\WINDOWS\system32\drivers\ctl_w32.sys
        C:\WINDOWS\system32\drivers\dhlp.sys
        C:\WINDOWS\system32\drivers\fak32.sys
        C:\WINDOWS\system32\drivers\grande48.sys
        C:\WINDOWS\system32\drivers\FMTR.sys
        C:\WINDOWS\system32\drivers\ini910p.sys
        C:\WINDOWS\system32\drivers\kbd.sys
        C:\WINDOWS\system32\drivers\kcp.sys
        C:\WINDOWS\system32\drivers\khtml.sys
        C:\WINDOWS\system32\drivers\msgegh.sys
        C:\WINDOWS\system32\drivers\ntio922.sys
        C:\WINDOWS\system32\drivers\ndisaluo.sys
        C:\WINDOWS\system32\drivers\NdisWon.sys
        C:\WINDOWS\system32\drivers\nkv2.sys
        C:\WINDOWS\system32\drivers\ntndis.sys
        C:\WINDOWS\system32\drivers\ntosnh.sys
        C:\WINDOWS\system32\drivers\ntoss.sys
        C:\WINDOWS\system32\drivers\ohbusb.sys
        C:\WINDOWS\system32\drivers\ohbusb.syt
        C:\WINDOWS\system32\drivers\ohciusb.sys
        C:\WINDOWS\system32\drivers\ohciusb.syt
        C:\WINDOWS\system32\drivers\ohctusb.sys
        C:\WINDOWS\system32\drivers\ohctusb.syt
        C:\WINDOWS\system32\drivers\ohcuusb.sys
        C:\WINDOWS\system32\drivers\ohcuusb.syt
        C:\WINDOWS\system32\drivers\ohcusb.sys
        C:\WINDOWS\system32\drivers\ohcusb.syt
        C:\WINDOWS\system32\drivers\ohdusb.sys
        C:\WINDOWS\system32\drivers\ohdusb.syt
        C:\WINDOWS\system32\drivers\protect.sys
        C:\WINDOWS\system32\drivers\qandr.sys
        C:\WINDOWS\system32\drivers\qwer78.sys
        C:\WINDOWS\system32\drivers\retx2.sys
        C:\WINDOWS\system32\drivers\riode32.sys
        C:\WINDOWS\system32\drivers\rpcdrv.sys
        C:\WINDOWS\system32\drivers\rpcmon.sys
        C:\WINDOWS\system32\drivers\rpcsrv.sys
        C:\WINDOWS\system32\drivers\runtime.sys
        C:\WINDOWS\system32\drivers\runtime2.sys
        C:\WINDOWS\system32\drivers\runtime2.sy_
        C:\WINDOWS\system32\drivers\smtpdrv.sys
        C:\WINDOWS\system32\drivers\SndSystem.sys
        C:\WINDOWS\system32\drivers\spool.exe
        C:\WINDOWS\system32\drivers\spools.exe
        C:\WINDOWS\system32\drivers\srtwe.sys
        C:\WINDOWS\system32\drivers\symavc32.sys
        C:\WINDOWS\system32\drivers\tcpsr.sys
        C:\WINDOWS\system32\drivers\vissv.sys
        C:\WINDOWS\system32\drivers\wsnpoem.sys
        C:\WINDOWS\system32\drivers\xpdt.sys
        C:\WINDOWS\system32\dllcache\figaro.sys
        C:\WINDOWS\system32\dllcache\fuurod.sys
        C:\WINDOWS\system32\dxdss.sys
        C:\WINDOWS\system32\ellowtab.txt
        C:\WINDOWS\system32\frmwrk.exe
        C:\WINDOWS\system32\frmwrk.sys
        C:\WINDOWS\system32\fvelwow.sys
        C:\WINDOWS\system32\gsbgqpwwfw.sys
        C:\WINDOWS\system32\hdport.sys
        C:\WINDOWS\system32\hqiopa.sys
        C:\WINDOWS\system32\iasmngr.dll
        C:\WINDOWS\system32\itcoe.sys
        C:\WINDOWS\system32\itcom.sys
        C:\WINDOWS\system32\iasmngr.exe
        C:\WINDOWS\system32\iuzqpaf.sys
        C:\WINDOWS\system32\jecsst.sys
        C:\WINDOWS\system32\jkghje.dll
        C:\WINDOWS\system32\jnhjkfrn
        C:\WINDOWS\system32\kernelw.sys
        C:\WINDOWS\system32\krnllds.sys
        C:\WINDOWS\system32\ksnhtr.sys
        C:\WINDOWS\system32\ksys.sys
        C:\WINDOWS\system32\kzq5re.sys
        C:\WINDOWS\system32\lanmandrv.sys
        C:\WINDOWS\system32\ldr.exe
        C:\WINDOWS\system32\lspool.ini
        C:\WINDOWS\system32\lspool.exe
        C:\WINDOWS\system32\lspooldrv.sys
        C:\WINDOWS\system32\lzx32.sys
        C:\WINDOWS\system32\main.sys
        C:\WINDOWS\system32\mapi32.drv
        C:\WINDOWS\system32\mapi32.exe
        C:\WINDOWS\system32\mapi32.sys
        C:\WINDOWS\system32\mp32s.sys
        C:\WINDOWS\system32\msdnc.cmd
        C:\WINDOWS\system32\msdndr.dat
        C:\WINDOWS\system32\msdndr.pif
        C:\WINDOWS\system32\msdndr.sys
        C:\WINDOWS\system32\msdvdr.cmd
        C:\WINDOWS\system32\msdvdr.dat
        C:\WINDOWS\system32\msdvdr.pif
        C:\WINDOWS\system32\msdvdr.sys
        C:\WINDOWS\system32\msfsr.sys
        C:\WINDOWS\system32\msguard.sys
        C:\WINDOWS\system32\mssync20.sys
        C:\WINDOWS\system32\MZU_DRV.sys
        C:\WINDOWS\system32\nax12.sys
        C:\WINDOWS\system32\ndetect.exe
        C:\WINDOWS\system32\nested.sys
        C:\WINDOWS\system32\nexkaqf.sys
        C:\WINDOWS\system32\noskrnl.sys
        C:\WINDOWS\system32\nso12k.sys
        C:\WINDOWS\system32\ntio256.sys
        C:\WINDOWS\system32\ntload.sys
        C:\WINDOWS\system32\ntos.exe
        C:\WINDOWS\system32\ntsvc32.dll
        C:\WINDOWS\system32\nzqtegh.sys
        C:\WINDOWS\system32\pdbcopy.exe
        C:\WINDOWS\system32\pe386.sys
        C:\WINDOWS\system32\pjsapdg.sys
        C:\WINDOWS\system32\powerio.sys
        C:\WINDOWS\system32\powermgmt.sys
        C:\WINDOWS\system32\qtprot.sys
        C:\WINDOWS\system32\ras\hhlmken.scp
        C:\WINDOWS\system32\ras\slipmenu1.scp
        C:\WINDOWS\system32\ras\yeyqase.mis
        C:\WINDOWS\system32\reg.sys
        C:\WINDOWS\system32\rotr.sys
        C:\WINDOWS\system32\runtime.sys
        C:\WINDOWS\system32\service.sys
        C:\WINDOWS\system32\spooldr.sys
        C:\WINDOWS\system32\spoolsvv.sys
        C:\WINDOWS\system32\sysrest.sys
        C:\WINDOWS\system32\syswindrv.bin
        C:\WINDOWS\system32\sywtdxaz.sys
        C:\WINDOWS\system32\drivers\sysldr
        C:\WINDOWS\system32\szr_dr.sys
        C:\WINDOWS\system32\taskmon.sys
        C:\WINDOWS\system32\tdidrv32.sys
        C:\WINDOWS\system32\win32_rkt.sys
        C:\WINDOWS\system32\wincom32.sys
        C:\WINDOWS\system32\wininit.sys
        C:\WINDOWS\system32\wowfx.dll
        C:\WINDOWS\system32\wsnpoem.exe
        C:\WINDOWS\system32\wsnpoema.exe
        C:\WINDOWS\system32\wsnpoema\audio.dll
        C:\WINDOWS\system32\wsnpoema\audio.dll.cla
        C:\WINDOWS\system32\wsnpoema\video.dll
        C:\WINDOWS\system32\wsnpoema\log.txt
        C:\WINDOWS\system32\wsock32.sys
        C:\WINDOWS\system32\wzghui.sys
        C:\WINDOWS\system32\xwusuhzh.exe
        C:\WINDOWS\system32\yzbgqap.sys
        C:\WINDOWS\system32\ztx86.sys
        C:\WINDOWS\system32\zwqcplsp.sys
        C:\WINDOWS\Temp\kernel.sys
        C:\WINDOWS\trahtibedoh.sys
        C:\WINDOWS\twain_32\e67gdfg.ds
        C:\WINDOWS\twain_32\jwlbqzpi.dll
        C:\WINDOWS\twain_32\tzraqlo.dll
        C:\WINDOWS\twain_32\ytzpoqw.dll
        C:\WINDOWS\uazpiq.sys
        C:\WINDOWS\uerj45kj.sys
        C:\WINDOWS\widuxngq.sys
        C:\WINDOWS\ydhqzop.sys
        C:\WINDOWS\yeTyezzd.sys
        C:\WINDOWS\zalpqbj.sys
        C:\WINDOWS\zdegpig.ini
        C:\WINDOWS\zeqbqwp.sys
        C:\WINDOWS\zsqalpdt.sys

        MALWAREBYTES:
        Malwarebytes' Anti-Malware 1.14
        Tietokantaversio: 826

        1:23:38 5.6.2008
        mbam-log-6-5-2008 (01-23-38).txt

        Tarkistustyyppi: Täysi tarkistus (C:\|D:\|)
        Tarkistetut kohteet: 145890
        Kulunut aika: 1 hour(s), 0 minute(s), 56 second(s)

        Saastuneita muistiprosesseja: 0
        Saastuneita muistimoduuleja: 0
        Saastuneita rekisteriavaimia: 5
        Saastuneita rekisteriarvoja: 7
        Saastuneita rekisterikohteita: 0
        Saastuneita hakemistoja: 18
        Saastuneita tiedostoja: 38

        Saastuneita muistiprosesseja:
        (Haitallisia kohteita ei löydetty)

        Saastuneita muistimoduuleja:
        (Haitallisia kohteita ei löydetty)

        Saastuneita rekisteriavaimia:
        HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{28abc5c0-4fcb-11cf-aax5-81cx1c635612} (Trojan.Agent) -> Quarantined and deleted successfully.
        HKEY_CLASSES_ROOT\CLSID\{147a976f-eee1-4377-8ea7-4716e4cdd239} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
        HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{1d4db7d2-6ec9-47a3-bd87-1e41684e07bb} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
        HKEY_LOCAL_MACHINE\SOFTWARE\MySearch (Adware.MyWebSearch) -> Quarantined and deleted successfully.
        HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Multimedia\WMPlayer\Schemes\f3pss (Adware.MyWebSearch) -> Quarantined and deleted successfully.

        Saastuneita rekisteriarvoja:
        HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\{014da6c9-189f-421a-88cd-07cfe51cff10} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
        HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\ShellBrowser\{014da6c9-189f-421a-88cd-07cfe51cff10} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
        HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\ShellBrowser\{07b18ea9-a523-4961-b6bb-170de4475cca} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
        HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Windows UDP Control (Backdoor.Bot) -> Quarantined and deleted successfully.
        HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Windows svchost (Backdoor.Bot) -> Quarantined and deleted successfully.
        HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows Media\WMSDK\Sources\f3PopularScreensavers (Adware.MyWebSearch) -> Quarantined and deleted successfully.
        HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\User Agent\Post Platform\FunWebProducts (Adware.MyWebSearch) -> Quarantined and deleted successfully.

        Saastuneita rekisterikohteita:
        (Haitallisia kohteita ei löydetty)

        Saastuneita hakemistoja:
        C:\Program Files\MyWebSearch (Adware.MyWebSearch) -> Quarantined and deleted successfully.
        C:\Program Files\MyWebSearch\bar (Adware.MyWebSearch) -> Quarantined and deleted successfully.
        C:\Program Files\MyWebSearch\SrchAstt (Adware.MyWebSearch) -> Quarantined and deleted successfully.
        C:\Program Files\MyWebSearch\bar\1.bin (Adware.MyWebSearch) -> Quarantined and deleted successfully.
        C:\Program Files\MyWebSearch\bar\Cache (Adware.MyWebSearch) -> Quarantined and deleted successfully.
        C:\Program Files\MyWebSearch\bar\Game (Adware.MyWebSearch) -> Quarantined and deleted successfully.
        C:\Program Files\MyWebSearch\bar\History (Adware.MyWebSearch) -> Quarantined and deleted successfully.
        C:\Program Files\MyWebSearch\bar\Settings (Adware.MyWebSearch) -> Quarantined and deleted successfully.
        C:\Program Files\MyWebSearch\SrchAstt\1.bin (Adware.MyWebSearch) -> Quarantined and deleted successfully.
        C:\Program Files\MyWebSearch\SrchAstt\Cache (Adware.MyWebSearch) -> Quarantined and deleted successfully.
        C:\Program Files\MyWebSearch\SrchAstt\Settings (Adware.MyWebSearch) -> Quarantined and deleted successfully.
        C:\Program Files\MySearch (Adware.MyWebSearch) -> Quarantined and deleted successfully.
        C:\Program Files\MySearch\bar (Adware.MyWebSearch) -> Quarantined and deleted successfully.
        C:\Program Files\MySearch\bar\1.bin (Adware.MyWebSearch) -> Quarantined and deleted successfully.
        C:\Program Files\MySearch\bar\2.bin (Adware.MyWebSearch) -> Quarantined and deleted successfully.
        C:\Program Files\MySearch\bar\Cache (Adware.MyWebSearch) -> Quarantined and deleted successfully.
        C:\Program Files\MySearch\bar\History (Adware.MyWebSearch) -> Quarantined and deleted successfully.
        C:\Program Files\MySearch\bar\Settings (Adware.MyWebSearch) -> Quarantined and deleted successfully.

        Saastuneita tiedostoja:
        C:\System Volume Information\_restore{EF7B9B72-035F-42A2-BDC2-6E27BDB1C4B7}\RP271\A0025242.0xe (Backdoor.Bot) -> Quarantined and deleted successfully.
        C:\System Volume Information\_restore{EF7B9B72-035F-42A2-BDC2-6E27BDB1C4B7}\RP271\A0025247.0xe (Backdoor.Bot) -> Quarantined and deleted successfully.
        C:\System Volume Information\_restore{EF7B9B72-035F-42A2-BDC2-6E27BDB1C4B7}\RP271\A0025266.0xe (Backdoor.Bot) -> Quarantined and deleted successfully.
        C:\WINDOWS\service.0xe (Backdoor.Bot) -> Quarantined and deleted successfully.
        C:\Program Files\MyWebSearch\bar\1.bin\F3BKGERR.JPG (Adware.MyWebSearch) -> Quarantined and deleted successfully.
        C:\Program Files\MyWebSearch\bar\1.bin\F3SPACER.WMV (Adware.MyWebSearch) -> Quarantined and deleted successfully.
        C:\Program Files\MyWebSearch\bar\1.bin\F3WALLPP.DAT (Adware.MyWebSearch) -> Quarantined and deleted successfully.
        C:\Program Files\MyWebSearch\bar\Cache\002D45C8.bin (Adware.MyWebSearch) -> Quarantined and deleted successfully.
        C:\Program Files\MyWebSearch\bar\Cache\002D47AC.bin (Adware.MyWebSearch) -> Quarantined and deleted successfully.
        C:\Program Files\MyWebSearch\bar\Cache\002D4A3D.bin (Adware.MyWebSearch) -> Quarantined and deleted successfully.
        C:\Program Files\MyWebSearch\bar\Cache\016B6396 (Adware.MyWebSearch) -> Quarantined and deleted successfully.
        C:\Program Files\MyWebSearch\bar\Cache\016B6C7F (Adware.MyWebSearch) -> Quarantined and deleted successfully.
        C:\Program Files\MyWebSearch\bar\Cache\016B6E44.bin (Adware.MyWebSearch) -> Quarantined and deleted successfully.
        C:\Program Files\MyWebSearch\bar\Cache\016B7394.bin (Adware.MyWebSearch) -> Quarantined and deleted successfully.
        C:\Program Files\MyWebSearch\bar\Cache\016B7653.bin (Adware.MyWebSearch) -> Quarantined and deleted successfully.
        C:\Program Files\MyWebSearch\bar\Cache\016B77AB.bin (Adware.MyWebSearch) -> Quarantined and deleted successfully.
        C:\Program Files\MyWebSearch\bar\Cache\016B7902.bin (Adware.MyWebSearch) -> Quarantined and deleted successfully.
        C:\Program Files\MyWebSearch\bar\Cache\016B7A4B.bin (Adware.MyWebSearch) -> Quarantined and deleted successfully.
        C:\Program Files\MyWebSearch\bar\Cache\016B7BD1.bin (Adware.MyWebSearch) -> Quarantined and deleted successfully.
        C:\Program Files\MyWebSearch\bar\Cache\016B7D19.bin (Adware.MyWebSearch) -> Quarantined and deleted successfully.
        C:\Program Files\MyWebSearch\bar\Cache\files.ini (Adware.MyWebSearch) -> Quarantined and deleted successfully.
        C:\Program Files\MyWebSearch\bar\Game\CHECKERS.F3S (Adware.MyWebSearch) -> Quarantined and deleted successfully.
        C:\Program Files\MyWebSearch\bar\Game\CHESS.F3S (Adware.MyWebSearch) -> Quarantined and deleted successfully.
        C:\Program Files\MyWebSearch\bar\Game\REVERSI.F3S (Adware.MyWebSearch) -> Quarantined and deleted successfully.
        C:\Program Files\MyWebSearch\bar\History\search (Adware.MyWebSearch) -> Quarantined and deleted successfully.
        C:\Program Files\MyWebSearch\bar\Settings\prevcfg.htm (Adware.MyWebSearch) -> Quarantined and deleted successfully.
        C:\Program Files\MyWebSearch\bar\Settings\s_pid.dat (Adware.MyWebSearch) -> Quarantined and deleted successfully.
        C:\Program Files\MyWebSearch\SrchAstt\Cache\02C0F3B6 (Adware.MyWebSearch) -> Quarantined and deleted successfully.
        C:\Program Files\MyWebSearch\SrchAstt\Cache\files.ini (Adware.MyWebSearch) -> Quarantined and deleted successfully.
        C:\Program Files\MyWebSearch\SrchAstt\Settings\prevcfg.htm (Adware.MyWebSearch) -> Quarantined and deleted successfully.
        C:\Program Files\MySearch\bar\Cache\00011AA7 (Adware.MyWebSearch) -> Quarantined and deleted successfully.
        C:\Program Files\MySearch\bar\Cache\00011FE7 (Adware.MyWebSearch) -> Quarantined and deleted successfully.
        C:\Program Files\MySearch\bar\Cache\00012100.bin (Adware.MyWebSearch) -> Quarantined and deleted successfully.
        C:\Program Files\MySearch\bar\Cache\00012323.bmp (Adware.MyWebSearch) -> Quarantined and deleted successfully.
        C:\Program Files\MySearch\bar\Cache\00012517.bmp (Adware.MyWebSearch) -> Quarantined and deleted successfully.
        C:\Program Files\MySearch\bar\Cache\files.ini (Adware.MyWebSearch) -> Quarantined and deleted successfully.
        C:\Program Files\MySearch\bar\History\search (Adware.MyWebSearch) -> Quarantined and deleted successfully.
        C:\Program Files\MySearch\bar\Settings\prevcfg.htm (Adware.MyWebSearch) -> Quarantined and deleted successfully.

        UUSI HJT:
        Logfile of Trend Micro HijackThis v2.0.2
        Scan saved at 1:51:02, on 5.6.2008
        Platform: Windows XP SP2 (WinNT 5.01.2600)
        MSIE: Internet Explorer v7.00 (7.00.6000.16640)
        Boot mode: Normal

        Running processes:
        C:\WINDOWS\System32\smss.exe
        C:\WINDOWS\system32\winlogon.exe
        C:\WINDOWS\system32\services.exe
        C:\WINDOWS\system32\lsass.exe
        C:\WINDOWS\system32\svchost.exe
        C:\WINDOWS\System32\svchost.exe
        C:\WINDOWS\system32\svchost.exe
        C:\WINDOWS\Explorer.EXE
        C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
        C:\WINDOWS\system32\spoolsv.exe
        C:\Program Files\F-Secure Internet Security\Common\FSM32.EXE
        C:\Program Files\iTunes\iTunesHelper.exe
        C:\Program Files\Java\jre1.6.0_06\bin\jusched.exe
        C:\WINDOWS\system32\ctfmon.exe
        C:\Program Files\Creative\Sync Manager Unicode\CTSyncU.exe
        C:\Program Files\Creative\Shared Files\CTSched.exe
        C:\PROGRA~1\HPPAVI~1\Pavilion\XPHWWBS4\plugin\bin\PCHButton.exe
        C:\Program Files\Microsoft Office\Office12\ONENOTEM.EXE
        C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
        C:\WINDOWS\system32\CTsvcCDA.exe
        C:\Program Files\F-Secure Internet Security\Anti-Virus\fsgk32st.exe
        C:\Program Files\F-Secure Internet Security\Common\FSMA32.EXE
        C:\Program Files\F-Secure Internet Security\Anti-Virus\FSGK32.EXE
        C:\Program Files\Common Files\BinarySense\hldasvc.exe
        C:\Program Files\F-Secure Internet Security\Common\FSMB32.EXE
        C:\Program Files\Common Files\BinarySense\hldasvc.exe
        C:\Program Files\F-Secure Internet Security\Common\FCH32.EXE
        C:\Program Files\F-Secure Internet Security\Common\FAMEH32.EXE
        C:\Program Files\F-Secure Internet Security\Anti-Virus\fsqh.exe
        C:\Program Files\F-Secure Internet Security\FSPC\fspc.exe
        C:\WINDOWS\System32\nvsvc32.exe
        C:\Program Files\F-Secure Internet Security\FSGUI\fsguidll.exe
        C:\WINDOWS\System32\svchost.exe
        C:\WINDOWS\system32\MsPMSPSv.exe
        C:\Program Files\iPod\bin\iPodService.exe
        C:\Program Files\F-Secure Internet Security\FSAUA\program\fsaua.exe
        C:\Program Files\F-Secure Internet Security\Anti-Virus\fssm32.exe
        C:\Program Files\F-Secure Internet Security\FWES\Program\fsdfwd.exe
        C:\Program Files\F-Secure Internet Security\FSAUA\program\fsus.exe
        C:\Program Files\F-Secure Internet Security\Anti-Virus\fsav32.exe
        C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

        R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.fi/
        R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iesearch&locale=FI_FI&c=Q304&bd=pavilion&pf=desktop
        R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iesearch&locale=FI_FI&c=Q304&bd=pavilion&pf=desktop
        R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iesearch&locale=FI_FI&c=Q304&bd=pavilion&pf=desktop
        R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = \blank.htm
        R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Linkit
        O2 - BHO: SDWin32 Class - {2F8EFE7E-EA44-4CBF-AF5A-26D5F9D56340} - (no file)
        O2 - BHO: - {3577AC9F-E787-4A7D-8FE5-FA24D9E917E0} - (no file)
        O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\PROGRA~1\MICROS~2\Office12\GRA8E1~1.DLL
        O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_06\bin\ssv.dll
        O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
        O2 - BHO: Windows Liven kirjautumisapuohjelma - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
        O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
        O2 - BHO: Windows Live Toolbar Helper - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
        O3 - Toolbar: HP-näkymä - {B2847E28-5D7D-4DEB-8B67-05D28BCF79F5} - c:\program files\hp\digital imaging\bin\hpdtlk02.dll
        O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
        O3 - Toolbar: Windows Live Toolbar - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
        O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
        O4 - HKLM\..\Run: [F-Secure Manager] "C:\Program Files\F-Secure Internet Security\Common\FSM32.EXE" /splash
        O4 - HKLM\..\Run: [F-Secure TNB] "C:\Program Files\F-Secure Internet Security\FSGUI\TNBUtil.exe" /CHECKALL /WAITFORSW
        O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
        O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_06\bin\jusched.exe"
        O4 - HKCU\..\Run: [F-Secure TNB] "C:\Program Files\F-Secure Internet Security\FSGUI\TNBUtil.exe" /CHECKALL /WAITFORSW
        O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
        O4 - HKCU\..\Run: [BackupNotify] c:\Program Files\HP\Digital Imaging\bin\backupnotify.exe
        O4 - HKCU\..\Run: [CTSyncU.exe] "C:\Program Files\Creative\Sync Manager Unicode\CTSyncU.exe"
        O4 - HKCU\..\Run: [CreativeTaskScheduler] "C:\Program Files\Creative\Shared Files\CTSched.exe" /logon
        O4 - HKCU\..\Run: [Acme.PCHButton] C:\PROGRA~1\HPPAVI~1\Pavilion\XPHWWBS4\plugin\bin\PCHButton.exe
        O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Paikallinen palve')
        O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Verkkopalve')
        O4 - HKUS\S-1-5-18\..\Run: [Picasa Media Detector] C:\Program Files\Picasa2\PicasaMediaDetector.exe (User 'SYSTEM')
        O4 - HKUS\.DEFAULT\..\Run: [Picasa Media Detector] C:\Program Files\Picasa2\PicasaMediaDetector.exe (User 'Default user')
        O4 - Startup: OneNote 2007 -näyttöleikkeet ja Launcher.lnk = C:\Program Files\Microsoft Office\Office12\ONENOTEM.EXE
        O8 - Extra context menu item: &Google Search - res://C:\Program Files\Google\GoogleToolbar1.dll/cmsearch.html
        O8 - Extra context menu item: &Search - http://bar.mywebsearch.com/menusearch.html?p=ZCzfw003XXFI
        O8 - Extra context menu item: &Translate English Word - res://C:\Program Files\Google\GoogleToolbar1.dll/cmwordtrans.html
        O8 - Extra context menu item: &Windows Live Search - res://C:\Program Files\Windows Live Toolbar\msntb.dll/search.htm
        O8 - Extra context menu item: Backward Links - res://C:\Program Files\Google\GoogleToolbar1.dll/cmbacklinks.html
        O8 - Extra context menu item: Cached Snapshot of Page - res://C:\Program Files\Google\GoogleToolbar1.dll/cmcache.html
        O8 - Extra context menu item: Similar Pages - res://C:\Program Files\Google\GoogleToolbar1.dll/cmsimilar.html
        O8 - Extra context menu item: Translate Page into English - res://C:\Program Files\Google\GoogleToolbar1.dll/cmtrans.html
        O8 - Extra context menu item: V&ie Microsoft Exceliin - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
        O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_06\bin\ssv.dll
        O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_06\bin\ssv.dll
        O9 - Extra button: Lapsilukko... - {200DB664-75B5-47c0-8B45-A44ACCF73C00} - C:\Program Files\F-Secure Internet Security\FSPC\fspcmsie.dll
        O9 - Extra button: (no name) - {200DB664-75B5-47c0-8B45-A44ACCF73F01} - C:\Program Files\F-Secure Internet Security\FSPC\fspcmsie.dll
        O9 - Extra 'Tools' menuitem: Lapsilukko... - {200DB664-75B5-47c0-8B45-A44ACCF73F01} - C:\Program Files\F-Secure Internet Security\FSPC\fspcmsie.dll
        O9 - Extra button: (no name) - {200DB664-75B5-47c0-8B45-A44ACCF73F02} - C:\Program Files\F-Secure Internet Security\FSPC\fspcmsie.dll
        O9 - Extra 'Tools' menuitem: &Keskeytä Web-sivujen suodatus - {200DB664-75B5-47c0-8B45-A44ACCF73F02} - C:\Program Files\F-Secure Internet Security\FSPC\fspcmsie.dll
        O9 - Extra button: (no name) - {200DB664-75B5-47c0-8B45-A44ACCF73F03} - C:\Program Files\F-Secure Internet Security\FSPC\fspcmsie.dll
        O9 - Extra 'Tools' menuitem: &Kiellä tämä Web-sivusto - {200DB664-75B5-47c0-8B45-A44ACCF73F03} - C:\Program Files\F-Secure Internet Security\FSPC\fspcmsie.dll
        O9 - Extra button: (no name) - {200DB664-75B5-47c0-8B45-A44ACCF73F04} - C:\Program Files\F-Secure Internet Security\FSPC\fspcmsie.dll
        O9 - Extra 'Tools' menuitem: &Salli tämä Web-sivusto - {200DB664-75B5-47c0-8B45-A44ACCF73F04} - C:\Program Files\F-Secure Internet Security\FSPC\fspcmsie.dll
        O9 - Extra button: Lisää tämä blogiin - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
        O9 - Extra 'Tools' menuitem: &Lisää tämä blogiin tuotteessa Windows Live Writer - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
        O9 - Extra button: Lähetä OneNoteen - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
        O9 - Extra 'Tools' menuitem: Läh&etä OneNoteen - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
        O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
        O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
        O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
        O16 - DPF: {1239CC52-59EF-4DFA-8C61-90FFA846DF7E} (Musicnotes Viewer) - http://www.musicnotes.com/download/mnviewer.cab
        O16 - DPF: {20A60F0D-9AFA-4515-A0FD-83BD84642501} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab56986.cab
        O16 - DPF: {2917297F-F02B-4B9D-81DF-494B6333150B} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineSweeper.cab31267.cab
        O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://spaces.msn.com//PhotoUpload/MsnPUpld.cab
        O16 - DPF: {5C051655-FCD5-4969-9182-770EA5AA5565} (Solitaire Showdown Class) - http://messenger.zone.msn.com/binary/SolitaireShowdown.cab56986.cab
        O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsClient.cab31267.cab
        O16 - DPF: {A8F2B9BD-A6A0-486A-9744-18920D898429} (ScorchPlugin Class) - http://www.sibelius.com/download/software/win/ActiveXPlugin.cab
        O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/msnmessengersetupdownloader.cab
        O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (MSN Games - Installer) - http://messenger.zone.msn.com/binary/ZIntro.cab56649.cab
        O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
        O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
        O16 - DPF: {F58E1CEF-A068-4C15-BA5E-587CAF3EE8C6} (MSN Chat Control 4.5) - http://chat.msn.com/controls/msnchat45.cab
        O16 - DPF: {F5A7706B-B9C0-4C89-A715-7A0C6B05DD48} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineSweeper.cab56986.cab
        O16 - DPF: {F6ACF75C-C32C-447B-9BEF-46B766368D29} (Creative Software AutoUpdate Support Package) - http://www.creative.com/su2/CTL_V02002/ocx/15034/CTPID.cab
        O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\PROGRA~1\MICROS~2\Office12\GR99D3~1.DLL
        O18 - Protocol: hddlife - {BD758015-47D9-477A-8873-4B688A2BC0E2} - "C:\Program Files\BinarySense\HDDlife 3\hlAPP.dll" (file missing)
        O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft AB - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
        O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
        O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\system32\CTsvcCDA.exe
        O23 - Service: F-Secure Gatekeeper Handler Starter - F-Secure Corporation - C:\Program Files\F-Secure Internet Security\Anti-Virus\fsgk32st.exe
        O23 - Service: F-Secure Automatic Update Agent (FSAUA) - F-Secure Corporation - C:\Program Files\F-Secure Internet Security\FSAUA\program\fsaua.exe
        O23 - Service: F-Secure Anti-Virus Firewall Daemon (FSDFWD) - F-Secure Corporation - C:\Program Files\F-Secure Internet Security\FWES\Program\fsdfwd.exe
        O23 - Service: FSMA - F-Secure Corporation - C:\Program Files\F-Secure Internet Security\Common\FSMA32.EXE
        O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
        O23 - Service: HDDlife HDD Access service - BinarySense, Inc. - C:\Program Files\Common Files\BinarySense\hldasvc.exe
        O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
        O23 - Service: iPod-palvelu (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
        O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe

        --
        End of file - 13251 bytes

      • FixFix
        Vanha rouva kirjoitti:

        Huh, huh, aika homma oli noudattaa ohjeita ja aikaakin kului.

        Combofix ei onnistunut ja luulen että SDFixin aikanakin tapahtui jotakin outoa enkä ehkä tehnyt sitä aivan oikein.

        Jos osaat(te) sanoa tästä jotakin, niin suuretkiitokset (ja muutenkin kiitokset, että olet neuvonut).


        Tässä tätä lokilistaa sitten kerrakseen:

        SDFix:
        C:\DOCUME~1\Omistaja\LOCALS~1\Temp\services.exe
        C:\DOCUME~1\Omistaja\LOCALS~1\Temp\winlogon.exe
        C:\Documents and Settings\Omistaja\Application Data\ntos.exe
        C:\fwdrv.sys
        C:\lich.exe
        C:\lich.sys
        C:\qqd.sys
        C:\suhdlog.sys
        C:\WINDOWS\Cursors\mkwsqp.cur
        C:\WINDOWS\Cursors\rqksgpu.cur
        C:\WINDOWS\Cursors\rwtatpl.lid
        C:\WINDOWS\Cursors\werasqlp.cur
        C:\WINDOWS\fkjdfje.sys
        C:\WINDOWS\help\aiqpbter.chm
        C:\WINDOWS\help\guntest.chm
        C:\WINDOWS\help\hqaply.chm
        C:\WINDOWS\help\lagednick.chm
        C:\WINDOWS\help\merqpo.chm
        C:\WINDOWS\help\oqtxde.chm
        C:\WINDOWS\help\pzqlp.chm
        C:\WINDOWS\help\zeqwur.chm
        C:\WINDOWS\ieqazhew.dll
        C:\WINDOWS\inf\accctsggw.cat
        C:\WINDOWS\inf\agehhtd.cat
        C:\WINDOWS\inf\cjwriiigqazft.cat
        C:\WINDOWS\inf\qwetab.inf
        C:\WINDOWS\inf\rYehhbqzx.adm
        C:\WINDOWS\inf\uxgrafj.adm
        C:\WINDOWS\inf\wseqnx.inf
        C:\WINDOWS\inf\yqzsypbgh.cat
        C:\WINDOWS\inf\yutsubk.cat
        C:\WINDOWS\inf\zyxelmodem.ADM
        C:\WINDOWS\mqzprwe.log
        C:\WINDOWS\njqzpir.sys
        C:\WINDOWS\nqaplwj.sys
        C:\WINDOWS\nkit.dll
        C:\WINDOWS\qalwpmdgt.sys
        C:\WINDOWS\qaszpurn.sys
        C:\WINDOWS\repair\kasutio
        C:\WINDOWS\serazavr.log
        C:\WINDOWS\spooldr.exe
        C:\WINDOWS\system\efidriver.drv
        C:\WINDOWS\system\hipsrv.mm
        C:\WINDOWS\system\pcximg.pif
        C:\WINDOWS\system\tap64drv
        C:\WINDOWS\system\tunnet.ocx
        C:\WINDOWS\system\userinfo32.ggt
        C:\WINDOWS\system32\3klagia.dll
        C:\WINDOWS\system32\4fdw.dll
        C:\WINDOWS\system32\bqzpas.sys
        C:\WINDOWS\system32\btstack.ibs
        C:\WINDOWS\system32\cmon32.lib
        C:\WINDOWS\system32\dbmgmnt.dll
        C:\WINDOWS\system32\DefLib.sys
        C:\WINDOWS\system32\dmclient.exe
        C:\WINDOWS\system32\dprot.sys
        C:\WINDOWS\system32\drivers\asc355.sys
        C:\WINDOWS\system32\drivers\asc355O.sys
        C:\WINDOWS\system32\drivers\asc3550a.sys
        C:\WINDOWS\system32\drivers\asc3550o.sys
        C:\WINDOWS\system32\drivers\asc3550p.sys
        C:\WINDOWS\system32\drivers\asc3550u.sys
        C:\WINDOWS\system32\drivers\asc3550v.sys
        C:\WINDOWS\system32\drivers\astq.tga
        C:\WINDOWS\system32\drivers\core.sys
        C:\WINDOWS\system32\drivers\ctl_w32.sys
        C:\WINDOWS\system32\drivers\dhlp.sys
        C:\WINDOWS\system32\drivers\fak32.sys
        C:\WINDOWS\system32\drivers\grande48.sys
        C:\WINDOWS\system32\drivers\FMTR.sys
        C:\WINDOWS\system32\drivers\ini910p.sys
        C:\WINDOWS\system32\drivers\kbd.sys
        C:\WINDOWS\system32\drivers\kcp.sys
        C:\WINDOWS\system32\drivers\khtml.sys
        C:\WINDOWS\system32\drivers\msgegh.sys
        C:\WINDOWS\system32\drivers\ntio922.sys
        C:\WINDOWS\system32\drivers\ndisaluo.sys
        C:\WINDOWS\system32\drivers\NdisWon.sys
        C:\WINDOWS\system32\drivers\nkv2.sys
        C:\WINDOWS\system32\drivers\ntndis.sys
        C:\WINDOWS\system32\drivers\ntosnh.sys
        C:\WINDOWS\system32\drivers\ntoss.sys
        C:\WINDOWS\system32\drivers\ohbusb.sys
        C:\WINDOWS\system32\drivers\ohbusb.syt
        C:\WINDOWS\system32\drivers\ohciusb.sys
        C:\WINDOWS\system32\drivers\ohciusb.syt
        C:\WINDOWS\system32\drivers\ohctusb.sys
        C:\WINDOWS\system32\drivers\ohctusb.syt
        C:\WINDOWS\system32\drivers\ohcuusb.sys
        C:\WINDOWS\system32\drivers\ohcuusb.syt
        C:\WINDOWS\system32\drivers\ohcusb.sys
        C:\WINDOWS\system32\drivers\ohcusb.syt
        C:\WINDOWS\system32\drivers\ohdusb.sys
        C:\WINDOWS\system32\drivers\ohdusb.syt
        C:\WINDOWS\system32\drivers\protect.sys
        C:\WINDOWS\system32\drivers\qandr.sys
        C:\WINDOWS\system32\drivers\qwer78.sys
        C:\WINDOWS\system32\drivers\retx2.sys
        C:\WINDOWS\system32\drivers\riode32.sys
        C:\WINDOWS\system32\drivers\rpcdrv.sys
        C:\WINDOWS\system32\drivers\rpcmon.sys
        C:\WINDOWS\system32\drivers\rpcsrv.sys
        C:\WINDOWS\system32\drivers\runtime.sys
        C:\WINDOWS\system32\drivers\runtime2.sys
        C:\WINDOWS\system32\drivers\runtime2.sy_
        C:\WINDOWS\system32\drivers\smtpdrv.sys
        C:\WINDOWS\system32\drivers\SndSystem.sys
        C:\WINDOWS\system32\drivers\spool.exe
        C:\WINDOWS\system32\drivers\spools.exe
        C:\WINDOWS\system32\drivers\srtwe.sys
        C:\WINDOWS\system32\drivers\symavc32.sys
        C:\WINDOWS\system32\drivers\tcpsr.sys
        C:\WINDOWS\system32\drivers\vissv.sys
        C:\WINDOWS\system32\drivers\wsnpoem.sys
        C:\WINDOWS\system32\drivers\xpdt.sys
        C:\WINDOWS\system32\dllcache\figaro.sys
        C:\WINDOWS\system32\dllcache\fuurod.sys
        C:\WINDOWS\system32\dxdss.sys
        C:\WINDOWS\system32\ellowtab.txt
        C:\WINDOWS\system32\frmwrk.exe
        C:\WINDOWS\system32\frmwrk.sys
        C:\WINDOWS\system32\fvelwow.sys
        C:\WINDOWS\system32\gsbgqpwwfw.sys
        C:\WINDOWS\system32\hdport.sys
        C:\WINDOWS\system32\hqiopa.sys
        C:\WINDOWS\system32\iasmngr.dll
        C:\WINDOWS\system32\itcoe.sys
        C:\WINDOWS\system32\itcom.sys
        C:\WINDOWS\system32\iasmngr.exe
        C:\WINDOWS\system32\iuzqpaf.sys
        C:\WINDOWS\system32\jecsst.sys
        C:\WINDOWS\system32\jkghje.dll
        C:\WINDOWS\system32\jnhjkfrn
        C:\WINDOWS\system32\kernelw.sys
        C:\WINDOWS\system32\krnllds.sys
        C:\WINDOWS\system32\ksnhtr.sys
        C:\WINDOWS\system32\ksys.sys
        C:\WINDOWS\system32\kzq5re.sys
        C:\WINDOWS\system32\lanmandrv.sys
        C:\WINDOWS\system32\ldr.exe
        C:\WINDOWS\system32\lspool.ini
        C:\WINDOWS\system32\lspool.exe
        C:\WINDOWS\system32\lspooldrv.sys
        C:\WINDOWS\system32\lzx32.sys
        C:\WINDOWS\system32\main.sys
        C:\WINDOWS\system32\mapi32.drv
        C:\WINDOWS\system32\mapi32.exe
        C:\WINDOWS\system32\mapi32.sys
        C:\WINDOWS\system32\mp32s.sys
        C:\WINDOWS\system32\msdnc.cmd
        C:\WINDOWS\system32\msdndr.dat
        C:\WINDOWS\system32\msdndr.pif
        C:\WINDOWS\system32\msdndr.sys
        C:\WINDOWS\system32\msdvdr.cmd
        C:\WINDOWS\system32\msdvdr.dat
        C:\WINDOWS\system32\msdvdr.pif
        C:\WINDOWS\system32\msdvdr.sys
        C:\WINDOWS\system32\msfsr.sys
        C:\WINDOWS\system32\msguard.sys
        C:\WINDOWS\system32\mssync20.sys
        C:\WINDOWS\system32\MZU_DRV.sys
        C:\WINDOWS\system32\nax12.sys
        C:\WINDOWS\system32\ndetect.exe
        C:\WINDOWS\system32\nested.sys
        C:\WINDOWS\system32\nexkaqf.sys
        C:\WINDOWS\system32\noskrnl.sys
        C:\WINDOWS\system32\nso12k.sys
        C:\WINDOWS\system32\ntio256.sys
        C:\WINDOWS\system32\ntload.sys
        C:\WINDOWS\system32\ntos.exe
        C:\WINDOWS\system32\ntsvc32.dll
        C:\WINDOWS\system32\nzqtegh.sys
        C:\WINDOWS\system32\pdbcopy.exe
        C:\WINDOWS\system32\pe386.sys
        C:\WINDOWS\system32\pjsapdg.sys
        C:\WINDOWS\system32\powerio.sys
        C:\WINDOWS\system32\powermgmt.sys
        C:\WINDOWS\system32\qtprot.sys
        C:\WINDOWS\system32\ras\hhlmken.scp
        C:\WINDOWS\system32\ras\slipmenu1.scp
        C:\WINDOWS\system32\ras\yeyqase.mis
        C:\WINDOWS\system32\reg.sys
        C:\WINDOWS\system32\rotr.sys
        C:\WINDOWS\system32\runtime.sys
        C:\WINDOWS\system32\service.sys
        C:\WINDOWS\system32\spooldr.sys
        C:\WINDOWS\system32\spoolsvv.sys
        C:\WINDOWS\system32\sysrest.sys
        C:\WINDOWS\system32\syswindrv.bin
        C:\WINDOWS\system32\sywtdxaz.sys
        C:\WINDOWS\system32\drivers\sysldr
        C:\WINDOWS\system32\szr_dr.sys
        C:\WINDOWS\system32\taskmon.sys
        C:\WINDOWS\system32\tdidrv32.sys
        C:\WINDOWS\system32\win32_rkt.sys
        C:\WINDOWS\system32\wincom32.sys
        C:\WINDOWS\system32\wininit.sys
        C:\WINDOWS\system32\wowfx.dll
        C:\WINDOWS\system32\wsnpoem.exe
        C:\WINDOWS\system32\wsnpoema.exe
        C:\WINDOWS\system32\wsnpoema\audio.dll
        C:\WINDOWS\system32\wsnpoema\audio.dll.cla
        C:\WINDOWS\system32\wsnpoema\video.dll
        C:\WINDOWS\system32\wsnpoema\log.txt
        C:\WINDOWS\system32\wsock32.sys
        C:\WINDOWS\system32\wzghui.sys
        C:\WINDOWS\system32\xwusuhzh.exe
        C:\WINDOWS\system32\yzbgqap.sys
        C:\WINDOWS\system32\ztx86.sys
        C:\WINDOWS\system32\zwqcplsp.sys
        C:\WINDOWS\Temp\kernel.sys
        C:\WINDOWS\trahtibedoh.sys
        C:\WINDOWS\twain_32\e67gdfg.ds
        C:\WINDOWS\twain_32\jwlbqzpi.dll
        C:\WINDOWS\twain_32\tzraqlo.dll
        C:\WINDOWS\twain_32\ytzpoqw.dll
        C:\WINDOWS\uazpiq.sys
        C:\WINDOWS\uerj45kj.sys
        C:\WINDOWS\widuxngq.sys
        C:\WINDOWS\ydhqzop.sys
        C:\WINDOWS\yeTyezzd.sys
        C:\WINDOWS\zalpqbj.sys
        C:\WINDOWS\zdegpig.ini
        C:\WINDOWS\zeqbqwp.sys
        C:\WINDOWS\zsqalpdt.sys

        MALWAREBYTES:
        Malwarebytes' Anti-Malware 1.14
        Tietokantaversio: 826

        1:23:38 5.6.2008
        mbam-log-6-5-2008 (01-23-38).txt

        Tarkistustyyppi: Täysi tarkistus (C:\|D:\|)
        Tarkistetut kohteet: 145890
        Kulunut aika: 1 hour(s), 0 minute(s), 56 second(s)

        Saastuneita muistiprosesseja: 0
        Saastuneita muistimoduuleja: 0
        Saastuneita rekisteriavaimia: 5
        Saastuneita rekisteriarvoja: 7
        Saastuneita rekisterikohteita: 0
        Saastuneita hakemistoja: 18
        Saastuneita tiedostoja: 38

        Saastuneita muistiprosesseja:
        (Haitallisia kohteita ei löydetty)

        Saastuneita muistimoduuleja:
        (Haitallisia kohteita ei löydetty)

        Saastuneita rekisteriavaimia:
        HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{28abc5c0-4fcb-11cf-aax5-81cx1c635612} (Trojan.Agent) -> Quarantined and deleted successfully.
        HKEY_CLASSES_ROOT\CLSID\{147a976f-eee1-4377-8ea7-4716e4cdd239} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
        HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{1d4db7d2-6ec9-47a3-bd87-1e41684e07bb} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
        HKEY_LOCAL_MACHINE\SOFTWARE\MySearch (Adware.MyWebSearch) -> Quarantined and deleted successfully.
        HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Multimedia\WMPlayer\Schemes\f3pss (Adware.MyWebSearch) -> Quarantined and deleted successfully.

        Saastuneita rekisteriarvoja:
        HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\{014da6c9-189f-421a-88cd-07cfe51cff10} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
        HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\ShellBrowser\{014da6c9-189f-421a-88cd-07cfe51cff10} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
        HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\ShellBrowser\{07b18ea9-a523-4961-b6bb-170de4475cca} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
        HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Windows UDP Control (Backdoor.Bot) -> Quarantined and deleted successfully.
        HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Windows svchost (Backdoor.Bot) -> Quarantined and deleted successfully.
        HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows Media\WMSDK\Sources\f3PopularScreensavers (Adware.MyWebSearch) -> Quarantined and deleted successfully.
        HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\User Agent\Post Platform\FunWebProducts (Adware.MyWebSearch) -> Quarantined and deleted successfully.

        Saastuneita rekisterikohteita:
        (Haitallisia kohteita ei löydetty)

        Saastuneita hakemistoja:
        C:\Program Files\MyWebSearch (Adware.MyWebSearch) -> Quarantined and deleted successfully.
        C:\Program Files\MyWebSearch\bar (Adware.MyWebSearch) -> Quarantined and deleted successfully.
        C:\Program Files\MyWebSearch\SrchAstt (Adware.MyWebSearch) -> Quarantined and deleted successfully.
        C:\Program Files\MyWebSearch\bar\1.bin (Adware.MyWebSearch) -> Quarantined and deleted successfully.
        C:\Program Files\MyWebSearch\bar\Cache (Adware.MyWebSearch) -> Quarantined and deleted successfully.
        C:\Program Files\MyWebSearch\bar\Game (Adware.MyWebSearch) -> Quarantined and deleted successfully.
        C:\Program Files\MyWebSearch\bar\History (Adware.MyWebSearch) -> Quarantined and deleted successfully.
        C:\Program Files\MyWebSearch\bar\Settings (Adware.MyWebSearch) -> Quarantined and deleted successfully.
        C:\Program Files\MyWebSearch\SrchAstt\1.bin (Adware.MyWebSearch) -> Quarantined and deleted successfully.
        C:\Program Files\MyWebSearch\SrchAstt\Cache (Adware.MyWebSearch) -> Quarantined and deleted successfully.
        C:\Program Files\MyWebSearch\SrchAstt\Settings (Adware.MyWebSearch) -> Quarantined and deleted successfully.
        C:\Program Files\MySearch (Adware.MyWebSearch) -> Quarantined and deleted successfully.
        C:\Program Files\MySearch\bar (Adware.MyWebSearch) -> Quarantined and deleted successfully.
        C:\Program Files\MySearch\bar\1.bin (Adware.MyWebSearch) -> Quarantined and deleted successfully.
        C:\Program Files\MySearch\bar\2.bin (Adware.MyWebSearch) -> Quarantined and deleted successfully.
        C:\Program Files\MySearch\bar\Cache (Adware.MyWebSearch) -> Quarantined and deleted successfully.
        C:\Program Files\MySearch\bar\History (Adware.MyWebSearch) -> Quarantined and deleted successfully.
        C:\Program Files\MySearch\bar\Settings (Adware.MyWebSearch) -> Quarantined and deleted successfully.

        Saastuneita tiedostoja:
        C:\System Volume Information\_restore{EF7B9B72-035F-42A2-BDC2-6E27BDB1C4B7}\RP271\A0025242.0xe (Backdoor.Bot) -> Quarantined and deleted successfully.
        C:\System Volume Information\_restore{EF7B9B72-035F-42A2-BDC2-6E27BDB1C4B7}\RP271\A0025247.0xe (Backdoor.Bot) -> Quarantined and deleted successfully.
        C:\System Volume Information\_restore{EF7B9B72-035F-42A2-BDC2-6E27BDB1C4B7}\RP271\A0025266.0xe (Backdoor.Bot) -> Quarantined and deleted successfully.
        C:\WINDOWS\service.0xe (Backdoor.Bot) -> Quarantined and deleted successfully.
        C:\Program Files\MyWebSearch\bar\1.bin\F3BKGERR.JPG (Adware.MyWebSearch) -> Quarantined and deleted successfully.
        C:\Program Files\MyWebSearch\bar\1.bin\F3SPACER.WMV (Adware.MyWebSearch) -> Quarantined and deleted successfully.
        C:\Program Files\MyWebSearch\bar\1.bin\F3WALLPP.DAT (Adware.MyWebSearch) -> Quarantined and deleted successfully.
        C:\Program Files\MyWebSearch\bar\Cache\002D45C8.bin (Adware.MyWebSearch) -> Quarantined and deleted successfully.
        C:\Program Files\MyWebSearch\bar\Cache\002D47AC.bin (Adware.MyWebSearch) -> Quarantined and deleted successfully.
        C:\Program Files\MyWebSearch\bar\Cache\002D4A3D.bin (Adware.MyWebSearch) -> Quarantined and deleted successfully.
        C:\Program Files\MyWebSearch\bar\Cache\016B6396 (Adware.MyWebSearch) -> Quarantined and deleted successfully.
        C:\Program Files\MyWebSearch\bar\Cache\016B6C7F (Adware.MyWebSearch) -> Quarantined and deleted successfully.
        C:\Program Files\MyWebSearch\bar\Cache\016B6E44.bin (Adware.MyWebSearch) -> Quarantined and deleted successfully.
        C:\Program Files\MyWebSearch\bar\Cache\016B7394.bin (Adware.MyWebSearch) -> Quarantined and deleted successfully.
        C:\Program Files\MyWebSearch\bar\Cache\016B7653.bin (Adware.MyWebSearch) -> Quarantined and deleted successfully.
        C:\Program Files\MyWebSearch\bar\Cache\016B77AB.bin (Adware.MyWebSearch) -> Quarantined and deleted successfully.
        C:\Program Files\MyWebSearch\bar\Cache\016B7902.bin (Adware.MyWebSearch) -> Quarantined and deleted successfully.
        C:\Program Files\MyWebSearch\bar\Cache\016B7A4B.bin (Adware.MyWebSearch) -> Quarantined and deleted successfully.
        C:\Program Files\MyWebSearch\bar\Cache\016B7BD1.bin (Adware.MyWebSearch) -> Quarantined and deleted successfully.
        C:\Program Files\MyWebSearch\bar\Cache\016B7D19.bin (Adware.MyWebSearch) -> Quarantined and deleted successfully.
        C:\Program Files\MyWebSearch\bar\Cache\files.ini (Adware.MyWebSearch) -> Quarantined and deleted successfully.
        C:\Program Files\MyWebSearch\bar\Game\CHECKERS.F3S (Adware.MyWebSearch) -> Quarantined and deleted successfully.
        C:\Program Files\MyWebSearch\bar\Game\CHESS.F3S (Adware.MyWebSearch) -> Quarantined and deleted successfully.
        C:\Program Files\MyWebSearch\bar\Game\REVERSI.F3S (Adware.MyWebSearch) -> Quarantined and deleted successfully.
        C:\Program Files\MyWebSearch\bar\History\search (Adware.MyWebSearch) -> Quarantined and deleted successfully.
        C:\Program Files\MyWebSearch\bar\Settings\prevcfg.htm (Adware.MyWebSearch) -> Quarantined and deleted successfully.
        C:\Program Files\MyWebSearch\bar\Settings\s_pid.dat (Adware.MyWebSearch) -> Quarantined and deleted successfully.
        C:\Program Files\MyWebSearch\SrchAstt\Cache\02C0F3B6 (Adware.MyWebSearch) -> Quarantined and deleted successfully.
        C:\Program Files\MyWebSearch\SrchAstt\Cache\files.ini (Adware.MyWebSearch) -> Quarantined and deleted successfully.
        C:\Program Files\MyWebSearch\SrchAstt\Settings\prevcfg.htm (Adware.MyWebSearch) -> Quarantined and deleted successfully.
        C:\Program Files\MySearch\bar\Cache\00011AA7 (Adware.MyWebSearch) -> Quarantined and deleted successfully.
        C:\Program Files\MySearch\bar\Cache\00011FE7 (Adware.MyWebSearch) -> Quarantined and deleted successfully.
        C:\Program Files\MySearch\bar\Cache\00012100.bin (Adware.MyWebSearch) -> Quarantined and deleted successfully.
        C:\Program Files\MySearch\bar\Cache\00012323.bmp (Adware.MyWebSearch) -> Quarantined and deleted successfully.
        C:\Program Files\MySearch\bar\Cache\00012517.bmp (Adware.MyWebSearch) -> Quarantined and deleted successfully.
        C:\Program Files\MySearch\bar\Cache\files.ini (Adware.MyWebSearch) -> Quarantined and deleted successfully.
        C:\Program Files\MySearch\bar\History\search (Adware.MyWebSearch) -> Quarantined and deleted successfully.
        C:\Program Files\MySearch\bar\Settings\prevcfg.htm (Adware.MyWebSearch) -> Quarantined and deleted successfully.

        UUSI HJT:
        Logfile of Trend Micro HijackThis v2.0.2
        Scan saved at 1:51:02, on 5.6.2008
        Platform: Windows XP SP2 (WinNT 5.01.2600)
        MSIE: Internet Explorer v7.00 (7.00.6000.16640)
        Boot mode: Normal

        Running processes:
        C:\WINDOWS\System32\smss.exe
        C:\WINDOWS\system32\winlogon.exe
        C:\WINDOWS\system32\services.exe
        C:\WINDOWS\system32\lsass.exe
        C:\WINDOWS\system32\svchost.exe
        C:\WINDOWS\System32\svchost.exe
        C:\WINDOWS\system32\svchost.exe
        C:\WINDOWS\Explorer.EXE
        C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
        C:\WINDOWS\system32\spoolsv.exe
        C:\Program Files\F-Secure Internet Security\Common\FSM32.EXE
        C:\Program Files\iTunes\iTunesHelper.exe
        C:\Program Files\Java\jre1.6.0_06\bin\jusched.exe
        C:\WINDOWS\system32\ctfmon.exe
        C:\Program Files\Creative\Sync Manager Unicode\CTSyncU.exe
        C:\Program Files\Creative\Shared Files\CTSched.exe
        C:\PROGRA~1\HPPAVI~1\Pavilion\XPHWWBS4\plugin\bin\PCHButton.exe
        C:\Program Files\Microsoft Office\Office12\ONENOTEM.EXE
        C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
        C:\WINDOWS\system32\CTsvcCDA.exe
        C:\Program Files\F-Secure Internet Security\Anti-Virus\fsgk32st.exe
        C:\Program Files\F-Secure Internet Security\Common\FSMA32.EXE
        C:\Program Files\F-Secure Internet Security\Anti-Virus\FSGK32.EXE
        C:\Program Files\Common Files\BinarySense\hldasvc.exe
        C:\Program Files\F-Secure Internet Security\Common\FSMB32.EXE
        C:\Program Files\Common Files\BinarySense\hldasvc.exe
        C:\Program Files\F-Secure Internet Security\Common\FCH32.EXE
        C:\Program Files\F-Secure Internet Security\Common\FAMEH32.EXE
        C:\Program Files\F-Secure Internet Security\Anti-Virus\fsqh.exe
        C:\Program Files\F-Secure Internet Security\FSPC\fspc.exe
        C:\WINDOWS\System32\nvsvc32.exe
        C:\Program Files\F-Secure Internet Security\FSGUI\fsguidll.exe
        C:\WINDOWS\System32\svchost.exe
        C:\WINDOWS\system32\MsPMSPSv.exe
        C:\Program Files\iPod\bin\iPodService.exe
        C:\Program Files\F-Secure Internet Security\FSAUA\program\fsaua.exe
        C:\Program Files\F-Secure Internet Security\Anti-Virus\fssm32.exe
        C:\Program Files\F-Secure Internet Security\FWES\Program\fsdfwd.exe
        C:\Program Files\F-Secure Internet Security\FSAUA\program\fsus.exe
        C:\Program Files\F-Secure Internet Security\Anti-Virus\fsav32.exe
        C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

        R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.fi/
        R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iesearch&locale=FI_FI&c=Q304&bd=pavilion&pf=desktop
        R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iesearch&locale=FI_FI&c=Q304&bd=pavilion&pf=desktop
        R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iesearch&locale=FI_FI&c=Q304&bd=pavilion&pf=desktop
        R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = \blank.htm
        R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Linkit
        O2 - BHO: SDWin32 Class - {2F8EFE7E-EA44-4CBF-AF5A-26D5F9D56340} - (no file)
        O2 - BHO: - {3577AC9F-E787-4A7D-8FE5-FA24D9E917E0} - (no file)
        O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\PROGRA~1\MICROS~2\Office12\GRA8E1~1.DLL
        O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_06\bin\ssv.dll
        O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
        O2 - BHO: Windows Liven kirjautumisapuohjelma - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
        O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
        O2 - BHO: Windows Live Toolbar Helper - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
        O3 - Toolbar: HP-näkymä - {B2847E28-5D7D-4DEB-8B67-05D28BCF79F5} - c:\program files\hp\digital imaging\bin\hpdtlk02.dll
        O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
        O3 - Toolbar: Windows Live Toolbar - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
        O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
        O4 - HKLM\..\Run: [F-Secure Manager] "C:\Program Files\F-Secure Internet Security\Common\FSM32.EXE" /splash
        O4 - HKLM\..\Run: [F-Secure TNB] "C:\Program Files\F-Secure Internet Security\FSGUI\TNBUtil.exe" /CHECKALL /WAITFORSW
        O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
        O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_06\bin\jusched.exe"
        O4 - HKCU\..\Run: [F-Secure TNB] "C:\Program Files\F-Secure Internet Security\FSGUI\TNBUtil.exe" /CHECKALL /WAITFORSW
        O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
        O4 - HKCU\..\Run: [BackupNotify] c:\Program Files\HP\Digital Imaging\bin\backupnotify.exe
        O4 - HKCU\..\Run: [CTSyncU.exe] "C:\Program Files\Creative\Sync Manager Unicode\CTSyncU.exe"
        O4 - HKCU\..\Run: [CreativeTaskScheduler] "C:\Program Files\Creative\Shared Files\CTSched.exe" /logon
        O4 - HKCU\..\Run: [Acme.PCHButton] C:\PROGRA~1\HPPAVI~1\Pavilion\XPHWWBS4\plugin\bin\PCHButton.exe
        O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Paikallinen palve')
        O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Verkkopalve')
        O4 - HKUS\S-1-5-18\..\Run: [Picasa Media Detector] C:\Program Files\Picasa2\PicasaMediaDetector.exe (User 'SYSTEM')
        O4 - HKUS\.DEFAULT\..\Run: [Picasa Media Detector] C:\Program Files\Picasa2\PicasaMediaDetector.exe (User 'Default user')
        O4 - Startup: OneNote 2007 -näyttöleikkeet ja Launcher.lnk = C:\Program Files\Microsoft Office\Office12\ONENOTEM.EXE
        O8 - Extra context menu item: &Google Search - res://C:\Program Files\Google\GoogleToolbar1.dll/cmsearch.html
        O8 - Extra context menu item: &Search - http://bar.mywebsearch.com/menusearch.html?p=ZCzfw003XXFI
        O8 - Extra context menu item: &Translate English Word - res://C:\Program Files\Google\GoogleToolbar1.dll/cmwordtrans.html
        O8 - Extra context menu item: &Windows Live Search - res://C:\Program Files\Windows Live Toolbar\msntb.dll/search.htm
        O8 - Extra context menu item: Backward Links - res://C:\Program Files\Google\GoogleToolbar1.dll/cmbacklinks.html
        O8 - Extra context menu item: Cached Snapshot of Page - res://C:\Program Files\Google\GoogleToolbar1.dll/cmcache.html
        O8 - Extra context menu item: Similar Pages - res://C:\Program Files\Google\GoogleToolbar1.dll/cmsimilar.html
        O8 - Extra context menu item: Translate Page into English - res://C:\Program Files\Google\GoogleToolbar1.dll/cmtrans.html
        O8 - Extra context menu item: V&ie Microsoft Exceliin - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
        O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_06\bin\ssv.dll
        O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_06\bin\ssv.dll
        O9 - Extra button: Lapsilukko... - {200DB664-75B5-47c0-8B45-A44ACCF73C00} - C:\Program Files\F-Secure Internet Security\FSPC\fspcmsie.dll
        O9 - Extra button: (no name) - {200DB664-75B5-47c0-8B45-A44ACCF73F01} - C:\Program Files\F-Secure Internet Security\FSPC\fspcmsie.dll
        O9 - Extra 'Tools' menuitem: Lapsilukko... - {200DB664-75B5-47c0-8B45-A44ACCF73F01} - C:\Program Files\F-Secure Internet Security\FSPC\fspcmsie.dll
        O9 - Extra button: (no name) - {200DB664-75B5-47c0-8B45-A44ACCF73F02} - C:\Program Files\F-Secure Internet Security\FSPC\fspcmsie.dll
        O9 - Extra 'Tools' menuitem: &Keskeytä Web-sivujen suodatus - {200DB664-75B5-47c0-8B45-A44ACCF73F02} - C:\Program Files\F-Secure Internet Security\FSPC\fspcmsie.dll
        O9 - Extra button: (no name) - {200DB664-75B5-47c0-8B45-A44ACCF73F03} - C:\Program Files\F-Secure Internet Security\FSPC\fspcmsie.dll
        O9 - Extra 'Tools' menuitem: &Kiellä tämä Web-sivusto - {200DB664-75B5-47c0-8B45-A44ACCF73F03} - C:\Program Files\F-Secure Internet Security\FSPC\fspcmsie.dll
        O9 - Extra button: (no name) - {200DB664-75B5-47c0-8B45-A44ACCF73F04} - C:\Program Files\F-Secure Internet Security\FSPC\fspcmsie.dll
        O9 - Extra 'Tools' menuitem: &Salli tämä Web-sivusto - {200DB664-75B5-47c0-8B45-A44ACCF73F04} - C:\Program Files\F-Secure Internet Security\FSPC\fspcmsie.dll
        O9 - Extra button: Lisää tämä blogiin - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
        O9 - Extra 'Tools' menuitem: &Lisää tämä blogiin tuotteessa Windows Live Writer - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
        O9 - Extra button: Lähetä OneNoteen - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
        O9 - Extra 'Tools' menuitem: Läh&etä OneNoteen - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
        O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
        O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
        O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
        O16 - DPF: {1239CC52-59EF-4DFA-8C61-90FFA846DF7E} (Musicnotes Viewer) - http://www.musicnotes.com/download/mnviewer.cab
        O16 - DPF: {20A60F0D-9AFA-4515-A0FD-83BD84642501} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab56986.cab
        O16 - DPF: {2917297F-F02B-4B9D-81DF-494B6333150B} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineSweeper.cab31267.cab
        O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://spaces.msn.com//PhotoUpload/MsnPUpld.cab
        O16 - DPF: {5C051655-FCD5-4969-9182-770EA5AA5565} (Solitaire Showdown Class) - http://messenger.zone.msn.com/binary/SolitaireShowdown.cab56986.cab
        O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsClient.cab31267.cab
        O16 - DPF: {A8F2B9BD-A6A0-486A-9744-18920D898429} (ScorchPlugin Class) - http://www.sibelius.com/download/software/win/ActiveXPlugin.cab
        O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/msnmessengersetupdownloader.cab
        O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (MSN Games - Installer) - http://messenger.zone.msn.com/binary/ZIntro.cab56649.cab
        O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
        O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
        O16 - DPF: {F58E1CEF-A068-4C15-BA5E-587CAF3EE8C6} (MSN Chat Control 4.5) - http://chat.msn.com/controls/msnchat45.cab
        O16 - DPF: {F5A7706B-B9C0-4C89-A715-7A0C6B05DD48} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineSweeper.cab56986.cab
        O16 - DPF: {F6ACF75C-C32C-447B-9BEF-46B766368D29} (Creative Software AutoUpdate Support Package) - http://www.creative.com/su2/CTL_V02002/ocx/15034/CTPID.cab
        O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\PROGRA~1\MICROS~2\Office12\GR99D3~1.DLL
        O18 - Protocol: hddlife - {BD758015-47D9-477A-8873-4B688A2BC0E2} - "C:\Program Files\BinarySense\HDDlife 3\hlAPP.dll" (file missing)
        O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft AB - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
        O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
        O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\system32\CTsvcCDA.exe
        O23 - Service: F-Secure Gatekeeper Handler Starter - F-Secure Corporation - C:\Program Files\F-Secure Internet Security\Anti-Virus\fsgk32st.exe
        O23 - Service: F-Secure Automatic Update Agent (FSAUA) - F-Secure Corporation - C:\Program Files\F-Secure Internet Security\FSAUA\program\fsaua.exe
        O23 - Service: F-Secure Anti-Virus Firewall Daemon (FSDFWD) - F-Secure Corporation - C:\Program Files\F-Secure Internet Security\FWES\Program\fsdfwd.exe
        O23 - Service: FSMA - F-Secure Corporation - C:\Program Files\F-Secure Internet Security\Common\FSMA32.EXE
        O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
        O23 - Service: HDDlife HDD Access service - BinarySense, Inc. - C:\Program Files\Common Files\BinarySense\hldasvc.exe
        O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
        O23 - Service: iPod-palvelu (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
        O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe

        --
        End of file - 13251 bytes

        scannaa hjt:llä merkkaa paina Fix checked

        R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = \blank.htm
        O2 - BHO: SDWin32 Class - {2F8EFE7E-EA44-4CBF-AF5A-26D5F9D56340} - (no file)
        O2 - BHO: - {3577AC9F-E787-4A7D-8FE5-FA24D9E917E0} - (no file)
        O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)

        ############

        yritäs saada tuo combofix toimimaan

        1.Lataa combofix.exe työpöydällesi yhdestä, kahdesta klinkistä:
        http://download.bleepingcomputer.com/sUBs/ComboFix.exe
        http://subs.geekstogo.com/ComboFix.exe

        2. Tuplaklikkaa combofix.exe tiedostoa ja seuraa ohjeistuksia.
        3. Kun työkalu on valmis, se tuottaa lokin. Lähetä tämä loki viesti ketjuusi.
        Huom! Älä klikkaile combofixin ikkunaa käytön aikana. Tämä saattaa aiheuttaa ohjelman jumiutumisen.

        ############

      • ..........
        Vanha rouva kirjoitti:

        Huh, huh, aika homma oli noudattaa ohjeita ja aikaakin kului.

        Combofix ei onnistunut ja luulen että SDFixin aikanakin tapahtui jotakin outoa enkä ehkä tehnyt sitä aivan oikein.

        Jos osaat(te) sanoa tästä jotakin, niin suuretkiitokset (ja muutenkin kiitokset, että olet neuvonut).


        Tässä tätä lokilistaa sitten kerrakseen:

        SDFix:
        C:\DOCUME~1\Omistaja\LOCALS~1\Temp\services.exe
        C:\DOCUME~1\Omistaja\LOCALS~1\Temp\winlogon.exe
        C:\Documents and Settings\Omistaja\Application Data\ntos.exe
        C:\fwdrv.sys
        C:\lich.exe
        C:\lich.sys
        C:\qqd.sys
        C:\suhdlog.sys
        C:\WINDOWS\Cursors\mkwsqp.cur
        C:\WINDOWS\Cursors\rqksgpu.cur
        C:\WINDOWS\Cursors\rwtatpl.lid
        C:\WINDOWS\Cursors\werasqlp.cur
        C:\WINDOWS\fkjdfje.sys
        C:\WINDOWS\help\aiqpbter.chm
        C:\WINDOWS\help\guntest.chm
        C:\WINDOWS\help\hqaply.chm
        C:\WINDOWS\help\lagednick.chm
        C:\WINDOWS\help\merqpo.chm
        C:\WINDOWS\help\oqtxde.chm
        C:\WINDOWS\help\pzqlp.chm
        C:\WINDOWS\help\zeqwur.chm
        C:\WINDOWS\ieqazhew.dll
        C:\WINDOWS\inf\accctsggw.cat
        C:\WINDOWS\inf\agehhtd.cat
        C:\WINDOWS\inf\cjwriiigqazft.cat
        C:\WINDOWS\inf\qwetab.inf
        C:\WINDOWS\inf\rYehhbqzx.adm
        C:\WINDOWS\inf\uxgrafj.adm
        C:\WINDOWS\inf\wseqnx.inf
        C:\WINDOWS\inf\yqzsypbgh.cat
        C:\WINDOWS\inf\yutsubk.cat
        C:\WINDOWS\inf\zyxelmodem.ADM
        C:\WINDOWS\mqzprwe.log
        C:\WINDOWS\njqzpir.sys
        C:\WINDOWS\nqaplwj.sys
        C:\WINDOWS\nkit.dll
        C:\WINDOWS\qalwpmdgt.sys
        C:\WINDOWS\qaszpurn.sys
        C:\WINDOWS\repair\kasutio
        C:\WINDOWS\serazavr.log
        C:\WINDOWS\spooldr.exe
        C:\WINDOWS\system\efidriver.drv
        C:\WINDOWS\system\hipsrv.mm
        C:\WINDOWS\system\pcximg.pif
        C:\WINDOWS\system\tap64drv
        C:\WINDOWS\system\tunnet.ocx
        C:\WINDOWS\system\userinfo32.ggt
        C:\WINDOWS\system32\3klagia.dll
        C:\WINDOWS\system32\4fdw.dll
        C:\WINDOWS\system32\bqzpas.sys
        C:\WINDOWS\system32\btstack.ibs
        C:\WINDOWS\system32\cmon32.lib
        C:\WINDOWS\system32\dbmgmnt.dll
        C:\WINDOWS\system32\DefLib.sys
        C:\WINDOWS\system32\dmclient.exe
        C:\WINDOWS\system32\dprot.sys
        C:\WINDOWS\system32\drivers\asc355.sys
        C:\WINDOWS\system32\drivers\asc355O.sys
        C:\WINDOWS\system32\drivers\asc3550a.sys
        C:\WINDOWS\system32\drivers\asc3550o.sys
        C:\WINDOWS\system32\drivers\asc3550p.sys
        C:\WINDOWS\system32\drivers\asc3550u.sys
        C:\WINDOWS\system32\drivers\asc3550v.sys
        C:\WINDOWS\system32\drivers\astq.tga
        C:\WINDOWS\system32\drivers\core.sys
        C:\WINDOWS\system32\drivers\ctl_w32.sys
        C:\WINDOWS\system32\drivers\dhlp.sys
        C:\WINDOWS\system32\drivers\fak32.sys
        C:\WINDOWS\system32\drivers\grande48.sys
        C:\WINDOWS\system32\drivers\FMTR.sys
        C:\WINDOWS\system32\drivers\ini910p.sys
        C:\WINDOWS\system32\drivers\kbd.sys
        C:\WINDOWS\system32\drivers\kcp.sys
        C:\WINDOWS\system32\drivers\khtml.sys
        C:\WINDOWS\system32\drivers\msgegh.sys
        C:\WINDOWS\system32\drivers\ntio922.sys
        C:\WINDOWS\system32\drivers\ndisaluo.sys
        C:\WINDOWS\system32\drivers\NdisWon.sys
        C:\WINDOWS\system32\drivers\nkv2.sys
        C:\WINDOWS\system32\drivers\ntndis.sys
        C:\WINDOWS\system32\drivers\ntosnh.sys
        C:\WINDOWS\system32\drivers\ntoss.sys
        C:\WINDOWS\system32\drivers\ohbusb.sys
        C:\WINDOWS\system32\drivers\ohbusb.syt
        C:\WINDOWS\system32\drivers\ohciusb.sys
        C:\WINDOWS\system32\drivers\ohciusb.syt
        C:\WINDOWS\system32\drivers\ohctusb.sys
        C:\WINDOWS\system32\drivers\ohctusb.syt
        C:\WINDOWS\system32\drivers\ohcuusb.sys
        C:\WINDOWS\system32\drivers\ohcuusb.syt
        C:\WINDOWS\system32\drivers\ohcusb.sys
        C:\WINDOWS\system32\drivers\ohcusb.syt
        C:\WINDOWS\system32\drivers\ohdusb.sys
        C:\WINDOWS\system32\drivers\ohdusb.syt
        C:\WINDOWS\system32\drivers\protect.sys
        C:\WINDOWS\system32\drivers\qandr.sys
        C:\WINDOWS\system32\drivers\qwer78.sys
        C:\WINDOWS\system32\drivers\retx2.sys
        C:\WINDOWS\system32\drivers\riode32.sys
        C:\WINDOWS\system32\drivers\rpcdrv.sys
        C:\WINDOWS\system32\drivers\rpcmon.sys
        C:\WINDOWS\system32\drivers\rpcsrv.sys
        C:\WINDOWS\system32\drivers\runtime.sys
        C:\WINDOWS\system32\drivers\runtime2.sys
        C:\WINDOWS\system32\drivers\runtime2.sy_
        C:\WINDOWS\system32\drivers\smtpdrv.sys
        C:\WINDOWS\system32\drivers\SndSystem.sys
        C:\WINDOWS\system32\drivers\spool.exe
        C:\WINDOWS\system32\drivers\spools.exe
        C:\WINDOWS\system32\drivers\srtwe.sys
        C:\WINDOWS\system32\drivers\symavc32.sys
        C:\WINDOWS\system32\drivers\tcpsr.sys
        C:\WINDOWS\system32\drivers\vissv.sys
        C:\WINDOWS\system32\drivers\wsnpoem.sys
        C:\WINDOWS\system32\drivers\xpdt.sys
        C:\WINDOWS\system32\dllcache\figaro.sys
        C:\WINDOWS\system32\dllcache\fuurod.sys
        C:\WINDOWS\system32\dxdss.sys
        C:\WINDOWS\system32\ellowtab.txt
        C:\WINDOWS\system32\frmwrk.exe
        C:\WINDOWS\system32\frmwrk.sys
        C:\WINDOWS\system32\fvelwow.sys
        C:\WINDOWS\system32\gsbgqpwwfw.sys
        C:\WINDOWS\system32\hdport.sys
        C:\WINDOWS\system32\hqiopa.sys
        C:\WINDOWS\system32\iasmngr.dll
        C:\WINDOWS\system32\itcoe.sys
        C:\WINDOWS\system32\itcom.sys
        C:\WINDOWS\system32\iasmngr.exe
        C:\WINDOWS\system32\iuzqpaf.sys
        C:\WINDOWS\system32\jecsst.sys
        C:\WINDOWS\system32\jkghje.dll
        C:\WINDOWS\system32\jnhjkfrn
        C:\WINDOWS\system32\kernelw.sys
        C:\WINDOWS\system32\krnllds.sys
        C:\WINDOWS\system32\ksnhtr.sys
        C:\WINDOWS\system32\ksys.sys
        C:\WINDOWS\system32\kzq5re.sys
        C:\WINDOWS\system32\lanmandrv.sys
        C:\WINDOWS\system32\ldr.exe
        C:\WINDOWS\system32\lspool.ini
        C:\WINDOWS\system32\lspool.exe
        C:\WINDOWS\system32\lspooldrv.sys
        C:\WINDOWS\system32\lzx32.sys
        C:\WINDOWS\system32\main.sys
        C:\WINDOWS\system32\mapi32.drv
        C:\WINDOWS\system32\mapi32.exe
        C:\WINDOWS\system32\mapi32.sys
        C:\WINDOWS\system32\mp32s.sys
        C:\WINDOWS\system32\msdnc.cmd
        C:\WINDOWS\system32\msdndr.dat
        C:\WINDOWS\system32\msdndr.pif
        C:\WINDOWS\system32\msdndr.sys
        C:\WINDOWS\system32\msdvdr.cmd
        C:\WINDOWS\system32\msdvdr.dat
        C:\WINDOWS\system32\msdvdr.pif
        C:\WINDOWS\system32\msdvdr.sys
        C:\WINDOWS\system32\msfsr.sys
        C:\WINDOWS\system32\msguard.sys
        C:\WINDOWS\system32\mssync20.sys
        C:\WINDOWS\system32\MZU_DRV.sys
        C:\WINDOWS\system32\nax12.sys
        C:\WINDOWS\system32\ndetect.exe
        C:\WINDOWS\system32\nested.sys
        C:\WINDOWS\system32\nexkaqf.sys
        C:\WINDOWS\system32\noskrnl.sys
        C:\WINDOWS\system32\nso12k.sys
        C:\WINDOWS\system32\ntio256.sys
        C:\WINDOWS\system32\ntload.sys
        C:\WINDOWS\system32\ntos.exe
        C:\WINDOWS\system32\ntsvc32.dll
        C:\WINDOWS\system32\nzqtegh.sys
        C:\WINDOWS\system32\pdbcopy.exe
        C:\WINDOWS\system32\pe386.sys
        C:\WINDOWS\system32\pjsapdg.sys
        C:\WINDOWS\system32\powerio.sys
        C:\WINDOWS\system32\powermgmt.sys
        C:\WINDOWS\system32\qtprot.sys
        C:\WINDOWS\system32\ras\hhlmken.scp
        C:\WINDOWS\system32\ras\slipmenu1.scp
        C:\WINDOWS\system32\ras\yeyqase.mis
        C:\WINDOWS\system32\reg.sys
        C:\WINDOWS\system32\rotr.sys
        C:\WINDOWS\system32\runtime.sys
        C:\WINDOWS\system32\service.sys
        C:\WINDOWS\system32\spooldr.sys
        C:\WINDOWS\system32\spoolsvv.sys
        C:\WINDOWS\system32\sysrest.sys
        C:\WINDOWS\system32\syswindrv.bin
        C:\WINDOWS\system32\sywtdxaz.sys
        C:\WINDOWS\system32\drivers\sysldr
        C:\WINDOWS\system32\szr_dr.sys
        C:\WINDOWS\system32\taskmon.sys
        C:\WINDOWS\system32\tdidrv32.sys
        C:\WINDOWS\system32\win32_rkt.sys
        C:\WINDOWS\system32\wincom32.sys
        C:\WINDOWS\system32\wininit.sys
        C:\WINDOWS\system32\wowfx.dll
        C:\WINDOWS\system32\wsnpoem.exe
        C:\WINDOWS\system32\wsnpoema.exe
        C:\WINDOWS\system32\wsnpoema\audio.dll
        C:\WINDOWS\system32\wsnpoema\audio.dll.cla
        C:\WINDOWS\system32\wsnpoema\video.dll
        C:\WINDOWS\system32\wsnpoema\log.txt
        C:\WINDOWS\system32\wsock32.sys
        C:\WINDOWS\system32\wzghui.sys
        C:\WINDOWS\system32\xwusuhzh.exe
        C:\WINDOWS\system32\yzbgqap.sys
        C:\WINDOWS\system32\ztx86.sys
        C:\WINDOWS\system32\zwqcplsp.sys
        C:\WINDOWS\Temp\kernel.sys
        C:\WINDOWS\trahtibedoh.sys
        C:\WINDOWS\twain_32\e67gdfg.ds
        C:\WINDOWS\twain_32\jwlbqzpi.dll
        C:\WINDOWS\twain_32\tzraqlo.dll
        C:\WINDOWS\twain_32\ytzpoqw.dll
        C:\WINDOWS\uazpiq.sys
        C:\WINDOWS\uerj45kj.sys
        C:\WINDOWS\widuxngq.sys
        C:\WINDOWS\ydhqzop.sys
        C:\WINDOWS\yeTyezzd.sys
        C:\WINDOWS\zalpqbj.sys
        C:\WINDOWS\zdegpig.ini
        C:\WINDOWS\zeqbqwp.sys
        C:\WINDOWS\zsqalpdt.sys

        MALWAREBYTES:
        Malwarebytes' Anti-Malware 1.14
        Tietokantaversio: 826

        1:23:38 5.6.2008
        mbam-log-6-5-2008 (01-23-38).txt

        Tarkistustyyppi: Täysi tarkistus (C:\|D:\|)
        Tarkistetut kohteet: 145890
        Kulunut aika: 1 hour(s), 0 minute(s), 56 second(s)

        Saastuneita muistiprosesseja: 0
        Saastuneita muistimoduuleja: 0
        Saastuneita rekisteriavaimia: 5
        Saastuneita rekisteriarvoja: 7
        Saastuneita rekisterikohteita: 0
        Saastuneita hakemistoja: 18
        Saastuneita tiedostoja: 38

        Saastuneita muistiprosesseja:
        (Haitallisia kohteita ei löydetty)

        Saastuneita muistimoduuleja:
        (Haitallisia kohteita ei löydetty)

        Saastuneita rekisteriavaimia:
        HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{28abc5c0-4fcb-11cf-aax5-81cx1c635612} (Trojan.Agent) -> Quarantined and deleted successfully.
        HKEY_CLASSES_ROOT\CLSID\{147a976f-eee1-4377-8ea7-4716e4cdd239} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
        HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{1d4db7d2-6ec9-47a3-bd87-1e41684e07bb} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
        HKEY_LOCAL_MACHINE\SOFTWARE\MySearch (Adware.MyWebSearch) -> Quarantined and deleted successfully.
        HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Multimedia\WMPlayer\Schemes\f3pss (Adware.MyWebSearch) -> Quarantined and deleted successfully.

        Saastuneita rekisteriarvoja:
        HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\{014da6c9-189f-421a-88cd-07cfe51cff10} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
        HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\ShellBrowser\{014da6c9-189f-421a-88cd-07cfe51cff10} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
        HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\ShellBrowser\{07b18ea9-a523-4961-b6bb-170de4475cca} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
        HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Windows UDP Control (Backdoor.Bot) -> Quarantined and deleted successfully.
        HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Windows svchost (Backdoor.Bot) -> Quarantined and deleted successfully.
        HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows Media\WMSDK\Sources\f3PopularScreensavers (Adware.MyWebSearch) -> Quarantined and deleted successfully.
        HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\User Agent\Post Platform\FunWebProducts (Adware.MyWebSearch) -> Quarantined and deleted successfully.

        Saastuneita rekisterikohteita:
        (Haitallisia kohteita ei löydetty)

        Saastuneita hakemistoja:
        C:\Program Files\MyWebSearch (Adware.MyWebSearch) -> Quarantined and deleted successfully.
        C:\Program Files\MyWebSearch\bar (Adware.MyWebSearch) -> Quarantined and deleted successfully.
        C:\Program Files\MyWebSearch\SrchAstt (Adware.MyWebSearch) -> Quarantined and deleted successfully.
        C:\Program Files\MyWebSearch\bar\1.bin (Adware.MyWebSearch) -> Quarantined and deleted successfully.
        C:\Program Files\MyWebSearch\bar\Cache (Adware.MyWebSearch) -> Quarantined and deleted successfully.
        C:\Program Files\MyWebSearch\bar\Game (Adware.MyWebSearch) -> Quarantined and deleted successfully.
        C:\Program Files\MyWebSearch\bar\History (Adware.MyWebSearch) -> Quarantined and deleted successfully.
        C:\Program Files\MyWebSearch\bar\Settings (Adware.MyWebSearch) -> Quarantined and deleted successfully.
        C:\Program Files\MyWebSearch\SrchAstt\1.bin (Adware.MyWebSearch) -> Quarantined and deleted successfully.
        C:\Program Files\MyWebSearch\SrchAstt\Cache (Adware.MyWebSearch) -> Quarantined and deleted successfully.
        C:\Program Files\MyWebSearch\SrchAstt\Settings (Adware.MyWebSearch) -> Quarantined and deleted successfully.
        C:\Program Files\MySearch (Adware.MyWebSearch) -> Quarantined and deleted successfully.
        C:\Program Files\MySearch\bar (Adware.MyWebSearch) -> Quarantined and deleted successfully.
        C:\Program Files\MySearch\bar\1.bin (Adware.MyWebSearch) -> Quarantined and deleted successfully.
        C:\Program Files\MySearch\bar\2.bin (Adware.MyWebSearch) -> Quarantined and deleted successfully.
        C:\Program Files\MySearch\bar\Cache (Adware.MyWebSearch) -> Quarantined and deleted successfully.
        C:\Program Files\MySearch\bar\History (Adware.MyWebSearch) -> Quarantined and deleted successfully.
        C:\Program Files\MySearch\bar\Settings (Adware.MyWebSearch) -> Quarantined and deleted successfully.

        Saastuneita tiedostoja:
        C:\System Volume Information\_restore{EF7B9B72-035F-42A2-BDC2-6E27BDB1C4B7}\RP271\A0025242.0xe (Backdoor.Bot) -> Quarantined and deleted successfully.
        C:\System Volume Information\_restore{EF7B9B72-035F-42A2-BDC2-6E27BDB1C4B7}\RP271\A0025247.0xe (Backdoor.Bot) -> Quarantined and deleted successfully.
        C:\System Volume Information\_restore{EF7B9B72-035F-42A2-BDC2-6E27BDB1C4B7}\RP271\A0025266.0xe (Backdoor.Bot) -> Quarantined and deleted successfully.
        C:\WINDOWS\service.0xe (Backdoor.Bot) -> Quarantined and deleted successfully.
        C:\Program Files\MyWebSearch\bar\1.bin\F3BKGERR.JPG (Adware.MyWebSearch) -> Quarantined and deleted successfully.
        C:\Program Files\MyWebSearch\bar\1.bin\F3SPACER.WMV (Adware.MyWebSearch) -> Quarantined and deleted successfully.
        C:\Program Files\MyWebSearch\bar\1.bin\F3WALLPP.DAT (Adware.MyWebSearch) -> Quarantined and deleted successfully.
        C:\Program Files\MyWebSearch\bar\Cache\002D45C8.bin (Adware.MyWebSearch) -> Quarantined and deleted successfully.
        C:\Program Files\MyWebSearch\bar\Cache\002D47AC.bin (Adware.MyWebSearch) -> Quarantined and deleted successfully.
        C:\Program Files\MyWebSearch\bar\Cache\002D4A3D.bin (Adware.MyWebSearch) -> Quarantined and deleted successfully.
        C:\Program Files\MyWebSearch\bar\Cache\016B6396 (Adware.MyWebSearch) -> Quarantined and deleted successfully.
        C:\Program Files\MyWebSearch\bar\Cache\016B6C7F (Adware.MyWebSearch) -> Quarantined and deleted successfully.
        C:\Program Files\MyWebSearch\bar\Cache\016B6E44.bin (Adware.MyWebSearch) -> Quarantined and deleted successfully.
        C:\Program Files\MyWebSearch\bar\Cache\016B7394.bin (Adware.MyWebSearch) -> Quarantined and deleted successfully.
        C:\Program Files\MyWebSearch\bar\Cache\016B7653.bin (Adware.MyWebSearch) -> Quarantined and deleted successfully.
        C:\Program Files\MyWebSearch\bar\Cache\016B77AB.bin (Adware.MyWebSearch) -> Quarantined and deleted successfully.
        C:\Program Files\MyWebSearch\bar\Cache\016B7902.bin (Adware.MyWebSearch) -> Quarantined and deleted successfully.
        C:\Program Files\MyWebSearch\bar\Cache\016B7A4B.bin (Adware.MyWebSearch) -> Quarantined and deleted successfully.
        C:\Program Files\MyWebSearch\bar\Cache\016B7BD1.bin (Adware.MyWebSearch) -> Quarantined and deleted successfully.
        C:\Program Files\MyWebSearch\bar\Cache\016B7D19.bin (Adware.MyWebSearch) -> Quarantined and deleted successfully.
        C:\Program Files\MyWebSearch\bar\Cache\files.ini (Adware.MyWebSearch) -> Quarantined and deleted successfully.
        C:\Program Files\MyWebSearch\bar\Game\CHECKERS.F3S (Adware.MyWebSearch) -> Quarantined and deleted successfully.
        C:\Program Files\MyWebSearch\bar\Game\CHESS.F3S (Adware.MyWebSearch) -> Quarantined and deleted successfully.
        C:\Program Files\MyWebSearch\bar\Game\REVERSI.F3S (Adware.MyWebSearch) -> Quarantined and deleted successfully.
        C:\Program Files\MyWebSearch\bar\History\search (Adware.MyWebSearch) -> Quarantined and deleted successfully.
        C:\Program Files\MyWebSearch\bar\Settings\prevcfg.htm (Adware.MyWebSearch) -> Quarantined and deleted successfully.
        C:\Program Files\MyWebSearch\bar\Settings\s_pid.dat (Adware.MyWebSearch) -> Quarantined and deleted successfully.
        C:\Program Files\MyWebSearch\SrchAstt\Cache\02C0F3B6 (Adware.MyWebSearch) -> Quarantined and deleted successfully.
        C:\Program Files\MyWebSearch\SrchAstt\Cache\files.ini (Adware.MyWebSearch) -> Quarantined and deleted successfully.
        C:\Program Files\MyWebSearch\SrchAstt\Settings\prevcfg.htm (Adware.MyWebSearch) -> Quarantined and deleted successfully.
        C:\Program Files\MySearch\bar\Cache\00011AA7 (Adware.MyWebSearch) -> Quarantined and deleted successfully.
        C:\Program Files\MySearch\bar\Cache\00011FE7 (Adware.MyWebSearch) -> Quarantined and deleted successfully.
        C:\Program Files\MySearch\bar\Cache\00012100.bin (Adware.MyWebSearch) -> Quarantined and deleted successfully.
        C:\Program Files\MySearch\bar\Cache\00012323.bmp (Adware.MyWebSearch) -> Quarantined and deleted successfully.
        C:\Program Files\MySearch\bar\Cache\00012517.bmp (Adware.MyWebSearch) -> Quarantined and deleted successfully.
        C:\Program Files\MySearch\bar\Cache\files.ini (Adware.MyWebSearch) -> Quarantined and deleted successfully.
        C:\Program Files\MySearch\bar\History\search (Adware.MyWebSearch) -> Quarantined and deleted successfully.
        C:\Program Files\MySearch\bar\Settings\prevcfg.htm (Adware.MyWebSearch) -> Quarantined and deleted successfully.

        UUSI HJT:
        Logfile of Trend Micro HijackThis v2.0.2
        Scan saved at 1:51:02, on 5.6.2008
        Platform: Windows XP SP2 (WinNT 5.01.2600)
        MSIE: Internet Explorer v7.00 (7.00.6000.16640)
        Boot mode: Normal

        Running processes:
        C:\WINDOWS\System32\smss.exe
        C:\WINDOWS\system32\winlogon.exe
        C:\WINDOWS\system32\services.exe
        C:\WINDOWS\system32\lsass.exe
        C:\WINDOWS\system32\svchost.exe
        C:\WINDOWS\System32\svchost.exe
        C:\WINDOWS\system32\svchost.exe
        C:\WINDOWS\Explorer.EXE
        C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
        C:\WINDOWS\system32\spoolsv.exe
        C:\Program Files\F-Secure Internet Security\Common\FSM32.EXE
        C:\Program Files\iTunes\iTunesHelper.exe
        C:\Program Files\Java\jre1.6.0_06\bin\jusched.exe
        C:\WINDOWS\system32\ctfmon.exe
        C:\Program Files\Creative\Sync Manager Unicode\CTSyncU.exe
        C:\Program Files\Creative\Shared Files\CTSched.exe
        C:\PROGRA~1\HPPAVI~1\Pavilion\XPHWWBS4\plugin\bin\PCHButton.exe
        C:\Program Files\Microsoft Office\Office12\ONENOTEM.EXE
        C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
        C:\WINDOWS\system32\CTsvcCDA.exe
        C:\Program Files\F-Secure Internet Security\Anti-Virus\fsgk32st.exe
        C:\Program Files\F-Secure Internet Security\Common\FSMA32.EXE
        C:\Program Files\F-Secure Internet Security\Anti-Virus\FSGK32.EXE
        C:\Program Files\Common Files\BinarySense\hldasvc.exe
        C:\Program Files\F-Secure Internet Security\Common\FSMB32.EXE
        C:\Program Files\Common Files\BinarySense\hldasvc.exe
        C:\Program Files\F-Secure Internet Security\Common\FCH32.EXE
        C:\Program Files\F-Secure Internet Security\Common\FAMEH32.EXE
        C:\Program Files\F-Secure Internet Security\Anti-Virus\fsqh.exe
        C:\Program Files\F-Secure Internet Security\FSPC\fspc.exe
        C:\WINDOWS\System32\nvsvc32.exe
        C:\Program Files\F-Secure Internet Security\FSGUI\fsguidll.exe
        C:\WINDOWS\System32\svchost.exe
        C:\WINDOWS\system32\MsPMSPSv.exe
        C:\Program Files\iPod\bin\iPodService.exe
        C:\Program Files\F-Secure Internet Security\FSAUA\program\fsaua.exe
        C:\Program Files\F-Secure Internet Security\Anti-Virus\fssm32.exe
        C:\Program Files\F-Secure Internet Security\FWES\Program\fsdfwd.exe
        C:\Program Files\F-Secure Internet Security\FSAUA\program\fsus.exe
        C:\Program Files\F-Secure Internet Security\Anti-Virus\fsav32.exe
        C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

        R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.fi/
        R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iesearch&locale=FI_FI&c=Q304&bd=pavilion&pf=desktop
        R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iesearch&locale=FI_FI&c=Q304&bd=pavilion&pf=desktop
        R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iesearch&locale=FI_FI&c=Q304&bd=pavilion&pf=desktop
        R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = \blank.htm
        R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Linkit
        O2 - BHO: SDWin32 Class - {2F8EFE7E-EA44-4CBF-AF5A-26D5F9D56340} - (no file)
        O2 - BHO: - {3577AC9F-E787-4A7D-8FE5-FA24D9E917E0} - (no file)
        O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\PROGRA~1\MICROS~2\Office12\GRA8E1~1.DLL
        O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_06\bin\ssv.dll
        O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
        O2 - BHO: Windows Liven kirjautumisapuohjelma - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
        O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
        O2 - BHO: Windows Live Toolbar Helper - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
        O3 - Toolbar: HP-näkymä - {B2847E28-5D7D-4DEB-8B67-05D28BCF79F5} - c:\program files\hp\digital imaging\bin\hpdtlk02.dll
        O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
        O3 - Toolbar: Windows Live Toolbar - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
        O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
        O4 - HKLM\..\Run: [F-Secure Manager] "C:\Program Files\F-Secure Internet Security\Common\FSM32.EXE" /splash
        O4 - HKLM\..\Run: [F-Secure TNB] "C:\Program Files\F-Secure Internet Security\FSGUI\TNBUtil.exe" /CHECKALL /WAITFORSW
        O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
        O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_06\bin\jusched.exe"
        O4 - HKCU\..\Run: [F-Secure TNB] "C:\Program Files\F-Secure Internet Security\FSGUI\TNBUtil.exe" /CHECKALL /WAITFORSW
        O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
        O4 - HKCU\..\Run: [BackupNotify] c:\Program Files\HP\Digital Imaging\bin\backupnotify.exe
        O4 - HKCU\..\Run: [CTSyncU.exe] "C:\Program Files\Creative\Sync Manager Unicode\CTSyncU.exe"
        O4 - HKCU\..\Run: [CreativeTaskScheduler] "C:\Program Files\Creative\Shared Files\CTSched.exe" /logon
        O4 - HKCU\..\Run: [Acme.PCHButton] C:\PROGRA~1\HPPAVI~1\Pavilion\XPHWWBS4\plugin\bin\PCHButton.exe
        O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Paikallinen palve')
        O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Verkkopalve')
        O4 - HKUS\S-1-5-18\..\Run: [Picasa Media Detector] C:\Program Files\Picasa2\PicasaMediaDetector.exe (User 'SYSTEM')
        O4 - HKUS\.DEFAULT\..\Run: [Picasa Media Detector] C:\Program Files\Picasa2\PicasaMediaDetector.exe (User 'Default user')
        O4 - Startup: OneNote 2007 -näyttöleikkeet ja Launcher.lnk = C:\Program Files\Microsoft Office\Office12\ONENOTEM.EXE
        O8 - Extra context menu item: &Google Search - res://C:\Program Files\Google\GoogleToolbar1.dll/cmsearch.html
        O8 - Extra context menu item: &Search - http://bar.mywebsearch.com/menusearch.html?p=ZCzfw003XXFI
        O8 - Extra context menu item: &Translate English Word - res://C:\Program Files\Google\GoogleToolbar1.dll/cmwordtrans.html
        O8 - Extra context menu item: &Windows Live Search - res://C:\Program Files\Windows Live Toolbar\msntb.dll/search.htm
        O8 - Extra context menu item: Backward Links - res://C:\Program Files\Google\GoogleToolbar1.dll/cmbacklinks.html
        O8 - Extra context menu item: Cached Snapshot of Page - res://C:\Program Files\Google\GoogleToolbar1.dll/cmcache.html
        O8 - Extra context menu item: Similar Pages - res://C:\Program Files\Google\GoogleToolbar1.dll/cmsimilar.html
        O8 - Extra context menu item: Translate Page into English - res://C:\Program Files\Google\GoogleToolbar1.dll/cmtrans.html
        O8 - Extra context menu item: V&ie Microsoft Exceliin - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
        O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_06\bin\ssv.dll
        O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_06\bin\ssv.dll
        O9 - Extra button: Lapsilukko... - {200DB664-75B5-47c0-8B45-A44ACCF73C00} - C:\Program Files\F-Secure Internet Security\FSPC\fspcmsie.dll
        O9 - Extra button: (no name) - {200DB664-75B5-47c0-8B45-A44ACCF73F01} - C:\Program Files\F-Secure Internet Security\FSPC\fspcmsie.dll
        O9 - Extra 'Tools' menuitem: Lapsilukko... - {200DB664-75B5-47c0-8B45-A44ACCF73F01} - C:\Program Files\F-Secure Internet Security\FSPC\fspcmsie.dll
        O9 - Extra button: (no name) - {200DB664-75B5-47c0-8B45-A44ACCF73F02} - C:\Program Files\F-Secure Internet Security\FSPC\fspcmsie.dll
        O9 - Extra 'Tools' menuitem: &Keskeytä Web-sivujen suodatus - {200DB664-75B5-47c0-8B45-A44ACCF73F02} - C:\Program Files\F-Secure Internet Security\FSPC\fspcmsie.dll
        O9 - Extra button: (no name) - {200DB664-75B5-47c0-8B45-A44ACCF73F03} - C:\Program Files\F-Secure Internet Security\FSPC\fspcmsie.dll
        O9 - Extra 'Tools' menuitem: &Kiellä tämä Web-sivusto - {200DB664-75B5-47c0-8B45-A44ACCF73F03} - C:\Program Files\F-Secure Internet Security\FSPC\fspcmsie.dll
        O9 - Extra button: (no name) - {200DB664-75B5-47c0-8B45-A44ACCF73F04} - C:\Program Files\F-Secure Internet Security\FSPC\fspcmsie.dll
        O9 - Extra 'Tools' menuitem: &Salli tämä Web-sivusto - {200DB664-75B5-47c0-8B45-A44ACCF73F04} - C:\Program Files\F-Secure Internet Security\FSPC\fspcmsie.dll
        O9 - Extra button: Lisää tämä blogiin - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
        O9 - Extra 'Tools' menuitem: &Lisää tämä blogiin tuotteessa Windows Live Writer - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
        O9 - Extra button: Lähetä OneNoteen - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
        O9 - Extra 'Tools' menuitem: Läh&etä OneNoteen - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
        O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
        O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
        O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
        O16 - DPF: {1239CC52-59EF-4DFA-8C61-90FFA846DF7E} (Musicnotes Viewer) - http://www.musicnotes.com/download/mnviewer.cab
        O16 - DPF: {20A60F0D-9AFA-4515-A0FD-83BD84642501} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab56986.cab
        O16 - DPF: {2917297F-F02B-4B9D-81DF-494B6333150B} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineSweeper.cab31267.cab
        O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://spaces.msn.com//PhotoUpload/MsnPUpld.cab
        O16 - DPF: {5C051655-FCD5-4969-9182-770EA5AA5565} (Solitaire Showdown Class) - http://messenger.zone.msn.com/binary/SolitaireShowdown.cab56986.cab
        O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsClient.cab31267.cab
        O16 - DPF: {A8F2B9BD-A6A0-486A-9744-18920D898429} (ScorchPlugin Class) - http://www.sibelius.com/download/software/win/ActiveXPlugin.cab
        O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/msnmessengersetupdownloader.cab
        O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (MSN Games - Installer) - http://messenger.zone.msn.com/binary/ZIntro.cab56649.cab
        O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
        O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
        O16 - DPF: {F58E1CEF-A068-4C15-BA5E-587CAF3EE8C6} (MSN Chat Control 4.5) - http://chat.msn.com/controls/msnchat45.cab
        O16 - DPF: {F5A7706B-B9C0-4C89-A715-7A0C6B05DD48} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineSweeper.cab56986.cab
        O16 - DPF: {F6ACF75C-C32C-447B-9BEF-46B766368D29} (Creative Software AutoUpdate Support Package) - http://www.creative.com/su2/CTL_V02002/ocx/15034/CTPID.cab
        O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\PROGRA~1\MICROS~2\Office12\GR99D3~1.DLL
        O18 - Protocol: hddlife - {BD758015-47D9-477A-8873-4B688A2BC0E2} - "C:\Program Files\BinarySense\HDDlife 3\hlAPP.dll" (file missing)
        O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft AB - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
        O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
        O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\system32\CTsvcCDA.exe
        O23 - Service: F-Secure Gatekeeper Handler Starter - F-Secure Corporation - C:\Program Files\F-Secure Internet Security\Anti-Virus\fsgk32st.exe
        O23 - Service: F-Secure Automatic Update Agent (FSAUA) - F-Secure Corporation - C:\Program Files\F-Secure Internet Security\FSAUA\program\fsaua.exe
        O23 - Service: F-Secure Anti-Virus Firewall Daemon (FSDFWD) - F-Secure Corporation - C:\Program Files\F-Secure Internet Security\FWES\Program\fsdfwd.exe
        O23 - Service: FSMA - F-Secure Corporation - C:\Program Files\F-Secure Internet Security\Common\FSMA32.EXE
        O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
        O23 - Service: HDDlife HDD Access service - BinarySense, Inc. - C:\Program Files\Common Files\BinarySense\hldasvc.exe
        O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
        O23 - Service: iPod-palvelu (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
        O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe

        --
        End of file - 13251 bytes

        Merkkaa noi FixFix laittamat rivit ja nää vielä ja paina fix checked

        O8 - Extra context menu item: &Search - http://bar.mywebsearch.com/menusearch.html?p=ZCzfw003XXFI
        O18 - Protocol: hddlife - {BD758015-47D9-477A-8873-4B688A2BC0E2} - "C:\Program Files\BinarySense\HDDlife 3\hlAPP.dll" (file missing)

        Mene vikasietotilaan ja aja SDfix uudestaan.

        Vikasietotilaan:
        paina käynnistä uudelleen
        käynnistyksen yhteydessä hakkaa F8 nappia
        valitse nuolinäppäimellä vikasietotila
        paina enter ja enter
        valitse käyttäjä tilisi ja taas pikkunen ikkuna paina ok

        jossakin koneissa pitää naputella F5



        Laita siitä koko logi ja koita tosiaan saada Combofix toimimaan. Jos ei toimi niin poista se ja hae tää ja aja.


        Lataa Dr.Web CureIt työpöydälle:
        ftp://ftp.drweb.com/pub/drweb/cureit/drweb-cureit.exe

        Tuplaklikkaa drweb-cureit.exe ja anna sen tehdä express scan
        Se skannaa käynnissä olevat ohjelmat ja jos jotain löytyy, klikkaa yes kun se kysyy haluatko poistaa sen. Tämä on vain lyhyt scan.
        Kun scan on valmis, Klikkaa Custom scan merkkaa asemat, jotka haluat scannata.
        Valitse kaikki asemat. Punainen piste osoittaa, mitkä asemat on valittu.
        Klikaa vihreää nuolta oikealla ja scan alkaa.
        Klikkaa Yes to all, jos kysytään haluatko poistaa/siirtää tiedoston.
        Kun scannaus on valmis
        Klikaa Select all ja Klikkaa Delete
        Klikaa File, save report list
        Tallenna työpödälle ja kopio lista tänne

      • FixFix
        .......... kirjoitti:

        Merkkaa noi FixFix laittamat rivit ja nää vielä ja paina fix checked

        O8 - Extra context menu item: &Search - http://bar.mywebsearch.com/menusearch.html?p=ZCzfw003XXFI
        O18 - Protocol: hddlife - {BD758015-47D9-477A-8873-4B688A2BC0E2} - "C:\Program Files\BinarySense\HDDlife 3\hlAPP.dll" (file missing)

        Mene vikasietotilaan ja aja SDfix uudestaan.

        Vikasietotilaan:
        paina käynnistä uudelleen
        käynnistyksen yhteydessä hakkaa F8 nappia
        valitse nuolinäppäimellä vikasietotila
        paina enter ja enter
        valitse käyttäjä tilisi ja taas pikkunen ikkuna paina ok

        jossakin koneissa pitää naputella F5



        Laita siitä koko logi ja koita tosiaan saada Combofix toimimaan. Jos ei toimi niin poista se ja hae tää ja aja.


        Lataa Dr.Web CureIt työpöydälle:
        ftp://ftp.drweb.com/pub/drweb/cureit/drweb-cureit.exe

        Tuplaklikkaa drweb-cureit.exe ja anna sen tehdä express scan
        Se skannaa käynnissä olevat ohjelmat ja jos jotain löytyy, klikkaa yes kun se kysyy haluatko poistaa sen. Tämä on vain lyhyt scan.
        Kun scan on valmis, Klikkaa Custom scan merkkaa asemat, jotka haluat scannata.
        Valitse kaikki asemat. Punainen piste osoittaa, mitkä asemat on valittu.
        Klikaa vihreää nuolta oikealla ja scan alkaa.
        Klikkaa Yes to all, jos kysytään haluatko poistaa/siirtää tiedoston.
        Kun scannaus on valmis
        Klikaa Select all ja Klikkaa Delete
        Klikaa File, save report list
        Tallenna työpödälle ja kopio lista tänne

        eipä mennä tuollain puuhun

      • ..........
        FixFix kirjoitti:

        eipä mennä tuollain puuhun

        kyllä sinne latvaan pääsee vaikka menis perse edellä, menee vaan aikaa enemmän;)

        Jatka sä tää loppuun, mä lähen hankkii leivänpäälle voita. Tulee hikinen iltavuoro!

      • Vanha rouva
        .......... kirjoitti:

        kyllä sinne latvaan pääsee vaikka menis perse edellä, menee vaan aikaa enemmän;)

        Jatka sä tää loppuun, mä lähen hankkii leivänpäälle voita. Tulee hikinen iltavuoro!

        Hei!

        Tässä tätä logia taas pukkaa. SDFix ei mennyt ihan niinkuin ohjeissanne luki, joten en tiedä teinkö oikein. Piti painaa ctrl alt del jossain vaiheessa, koska se jumitti. Combofix meni toisella kerralla ok - kesti n. 20 min. Näiden kaikkien ajojenjälkeen kone hidastui ja kun käynnistin uudelleen, ilmoitti f-secure heti viruksesta...

        Kiitos, jos autatte ja kunolette jo auttaneet, olen kahden teini-ikäisen äiti ja haluaisin koneen putipuhtaaksi.Ilman apua tästä ei tulisi mitään ;-)

        SDFix:

        Authorized Application Key Export:

        [HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
        "%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
        "C:\\Program Files\\iMesh\\Client\\iMeshClient.exe"="C:\\Program Files\\iMesh\\Client\\iMeshClient.exe:*:Disabled:iMesh Client for PC platforms"
        "C:\\Program Files\\Messenger\\msmsgs.exe"="C:\\Program Files\\Messenger\\msmsgs.exe:*:Enabled:Windows Messenger"
        "C:\\Program Files\\Google\\Google Talk\\googletalk.exe"="C:\\Program Files\\Google\\Google Talk\\googletalk.exe:*:Enabled:Google Talk"
        "C:\\Program Files\\Last.fm\\LastFM.exe"="C:\\Program Files\\Last.fm\\LastFM.exe:*:Enabled:Last.fm"
        "C:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE"="C:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE:*:Enabled:Microsoft Office Outlook"
        "C:\\Program Files\\Microsoft Office\\Office12\\GROOVE.EXE"="C:\\Program Files\\Microsoft Office\\Office12\\GROOVE.EXE:*:Enabled:Microsoft Office Groove"
        "C:\\Program Files\\Microsoft Office\\Office12\\ONENOTE.EXE"="C:\\Program Files\\Microsoft Office\\Office12\\ONENOTE.EXE:*:Enabled:Microsoft Office OneNote"
        "C:\\Program Files\\iTunes\\iTunes.exe"="C:\\Program Files\\iTunes\\iTunes.exe:*:Enabled:iTunes"
        "C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"="C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe:*:Enabled:Windows Live Messenger"
        "C:\\Program Files\\Windows Live\\Messenger\\livecall.exe"="C:\\Program Files\\Windows Live\\Messenger\\livecall.exe:*:Enabled:Windows Live Messenger (Phone)"

        [HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
        "%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
        "C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"="C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe:*:Enabled:Windows Live Messenger"
        "C:\\Program Files\\Windows Live\\Messenger\\livecall.exe"="C:\\Program Files\\Windows Live\\Messenger\\livecall.exe:*:Enabled:Windows Live Messenger (Phone)"

        [b]Remaining Files [/b]:



        [b]Files with Hidden Attributes [/b]:

        Sat 18 Sep 2004 196 A.SHR --- "C:\BOOT.BAK"
        Thu 6 Sep 2001 1,700,352 A..H. --- "C:\gdiplus.dll"
        Sun 7 Oct 2007 5,903,928 A..H. --- "C:\Program Files\Picasa2\setup.exe"
        Sun 21 Aug 2005 4,348 A.SH. --- "C:\Documents and Settings\All Users\DRM\DRMv1.bak"
        Wed 24 Aug 2005 401 A.SH. --- "C:\Documents and Settings\All Users\DRM\DRMv10.bak"
        Tue 25 Dec 2007 0 A.SH. --- "C:\Documents and Settings\All Users\DRM\Cache\Indiv01.tmp"
        Sat 13 Nov 2004 37,376 ...H. --- "C:\Program Files\Common Files\Adobe\ESD\DLMCleanup.exe"
        Thu 8 May 2008 0 A..H. --- "C:\WINDOWS\SoftwareDistribution\Download\0045d90d3c637c74f834c75fe192b558\BIT2.tmp"
        Wed 12 Dec 2007 0 A..H. --- "C:\WINDOWS\SoftwareDistribution\Download\0a67b6c406b1d7e0f5c1e6f6d44a3f6e\BIT2.tmp"
        Wed 12 Dec 2007 0 A..H. --- "C:\WINDOWS\SoftwareDistribution\Download\18b19374451d28a8fbaf1939cf31ff45\BIT5.tmp"
        Wed 12 Dec 2007 0 A..H. --- "C:\WINDOWS\SoftwareDistribution\Download\26924cbc8132a10b438ce6e2b49d4652\BIT1.tmp"
        Wed 12 Dec 2007 0 A..H. --- "C:\WINDOWS\SoftwareDistribution\Download\3cf0038d9844b330cbc012d961537773\BIT6.tmp"
        Wed 12 Dec 2007 0 A..H. --- "C:\WINDOWS\SoftwareDistribution\Download\445ce037cf936bf0308bd0a2bf4516e5\BIT4.tmp"
        Wed 12 Dec 2007 0 A..H. --- "C:\WINDOWS\SoftwareDistribution\Download\d7ce22e444dc91400829a7d1a2d39aa2\BIT7.tmp"
        Wed 12 Dec 2007 0 A..H. --- "C:\WINDOWS\SoftwareDistribution\Download\ddfab57ae20e024ecd85b4ea1a62ef6f\BIT3.tmp"
        Wed 29 Nov 2006 24,576 ...H. --- "C:\Documents and Settings\Omistaja\Ty”p”yt„\KATJA\22 Vuorovaikutus asiakasty”ss„\VUOROVAIKUTUS- LUENTO\~WRL0001.tmp"
        Wed 30 Apr 2008 1,373 A..H. --- "C:\Documents and Settings\All Users\Application Data\YAMAHA\DMN\Downloads\Temp\BIT3F7.tmp"

        [b]Finished![/b]

        Combofix:
        ComboFix 08-06-05.3 - Omistaja 2008-06-05 23:55:18.2 - NTFSx86
        Running from: C:\Documents and Settings\Omistaja\Työpöytä\ComboFix.exe
        * Resident AV is active

        .

        (((((((((((((((((((((((((((((((((((((( Muut poistot ))))))))))))))))))))))))))))))))))))))))))))))))))))))))
        .

        C:\Documents and Settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr0.dat
        C:\Documents and Settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr1.dat
        C:\Documents and Settings\Omistaja\Application Data\Sskknwrd.dll
        C:\WINDOWS\bundles
        C:\WINDOWS\bundles\adv0ltc0m.exe
        C:\WINDOWS\bundles\CSV7P070.exe
        C:\WINDOWS\bundles\cxt_big.exe
        C:\WINDOWS\bundles\dealhelper.exe
        C:\WINDOWS\bundles\Decade.exe
        C:\WINDOWS\bundles\ez_advolt.exe
        C:\WINDOWS\bundles\optimizejames.exe
        C:\WINDOWS\bundles\setup_silent_26221.exe
        C:\WINDOWS\bundles\snackman.exe
        C:\WINDOWS\bundles\stlb2_seed.exe
        C:\WINDOWS\Downloaded Program Files\setup.inf
        C:\WINDOWS\system32\Cache

        ----- BITS: Possible infected sites -----

        hxxp://gateway.digitalmusicnotebook.com
        .
        ((((( Tiedostot, jotka on luotu seuraavalla aikavälillä: 2008-05-05 to 2008-06-05 )))))))))))))))))
        .

        2008-06-05 01:38 . 2008-03-25 02:37   69,632   --a------   C:\WINDOWS\system32\javacpl.cpl
        2008-06-05 00:20 . 2008-06-05 00:20      d--------   C:\Program Files\Malwarebytes' Anti-Malware
        2008-06-05 00:20 . 2008-06-05 00:20      d--------   C:\Documents and Settings\Omistaja\Application Data\Malwarebytes
        2008-06-05 00:20 . 2008-06-05 00:20      d--------   C:\Documents and Settings\All Users\Application Data\Malwarebytes
        2008-06-05 00:20 . 2008-05-30 01:06   34,296   --a------   C:\WINDOWS\system32\drivers\mbamcatchme.sys
        2008-06-05 00:20 . 2008-05-30 01:06   15,864   --a------   C:\WINDOWS\system32\drivers\mbam.sys
        2008-06-04 23:53 . 2008-06-04 23:53      d--------   C:\WINDOWS\ERUNT
        2008-06-03 23:25 . 2008-06-03 23:25      d--------   C:\Program Files\Sun
        2008-05-30 16:27 . 2008-05-30 22:09   86,498   --a------   C:\setup.0xe
        2008-05-30 16:27 . 2008-05-30 19:03   60,132   --a------   C:\dci.0xe
        2008-05-29 19:41 . 2008-05-30 18:16   96,768   --a------   C:\is154890.0xe
        2008-05-29 17:40 . 2008-05-29 18:12   56,832   --a------   C:\fa.0om
        2008-05-29 17:16 . 2008-05-29 17:16   40,960   --a------   C:\ddc.exe
        2008-05-29 17:09 . 2008-05-29 17:08   56,832   -r-hs----   C:\WINDOWS\winudspm.0xe
        2008-05-27 13:48 . 2008-05-27 13:49      d--------   C:\WINDOWS\system32\Artemis Fowl dir

        .
        (((((((((((((((((((((((((((((((((((( Find3M-raportti ))))))))))))))))))))))))))))))))))))))))))))))))))))))
        .
        2008-06-05 20:49   ---------   d---a-w   C:\Documents and Settings\All Users\Application Data\TEMP
        2008-06-04 22:38   ---------   d-----w   C:\Program Files\Java
        2008-05-27 10:48   202,240   ----a-w   C:\WINDOWS\system32\Artemis Fowl.scr
        2008-05-14 20:33   ---------   d-----w   C:\Documents and Settings\All Users\Application Data\Microsoft Help
        2008-04-27 14:13   ---------   d-----w   C:\Documents and Settings\Omistaja\Application Data\YAMAHA
        2008-04-27 14:08   ---------   d-----w   C:\Program Files\YAMAHA
        2008-04-27 14:08   ---------   d-----w   C:\Documents and Settings\All Users\Application Data\YAMAHA
        2008-04-21 17:16   ---------   d-----w   C:\Documents and Settings\All Users\Application Data\Musicnotes
        2008-04-21 17:09   ---------   d-----w   C:\Program Files\Musicnotes
        2008-03-25 04:51   621,344   ----a-w   C:\WINDOWS\system32\mswstr10.dll
        2008-03-25 04:51   166,688   ----a-w   C:\WINDOWS\system32\msjint40.dll
        2008-03-20 08:09   1,845,504   ----a-w   C:\WINDOWS\system32\win32k.sys
        2006-09-28 10:19   40,744   ----a-w   C:\Documents and Settings\Omistaja\Application Data\GDIPFONTCACHEV1.DAT
        .

        (((((((((((((((((((((((((((((( Rekisterin käynnistyskohteet )))))))))))))))))))))))))))))))))))))))))))))
        .
        .
        REGEDIT4
        *Huom* Tyhjiä arvoja ja laillisia oletusarvoja ei näytetä

        [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
        "F-Secure TNB"="C:\Program Files\F-Secure Internet Security\FSGUI\TNBUtil.exe" [2007-05-25 16:11 740208]
        "ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-09-15 02:12 15360]
        "BackupNotify"="c:\Program Files\HP\Digital Imaging\bin\backupnotify.exe" [2004-01-09 02:34 32768]
        "CTSyncU.exe"="C:\Program Files\Creative\Sync Manager Unicode\CTSyncU.exe" [2007-07-17 12:03 868352]
        "CreativeTaskScheduler"="C:\Program Files\Creative\Shared Files\CTSched.exe" [2006-11-17 04:42 53341]
        "Acme.PCHButton"="C:\PROGRA~1\HPPAVI~1\Pavilion\XPHWWBS4\plugin\bin\PCHButton.exe" [2004-01-01 12:18 159744]

        [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
        "NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2004-02-23 22:43 3026944]
        "F-Secure Manager"="C:\Program Files\F-Secure Internet Security\Common\FSM32.exe" [2007-05-25 16:12 183208]
        "F-Secure TNB"="C:\Program Files\F-Secure Internet Security\FSGUI\TNBUtil.exe" [2007-05-25 16:11 740208]
        "iTunesHelper"="C:\Program Files\iTunes\iTunesHelper.exe" [2007-08-15 20:15 271672]
        "SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_06\bin\jusched.exe" [2008-03-25 04:28 144784]

        [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
        "Picasa Media Detector"="C:\Program Files\Picasa2\PicasaMediaDetector.exe" [2007-09-28 04:17 443968]

        C:\Documents and Settings\Omistaja\K„ynnist„-valikko\Ohjelmat\K„ynnistys\
        OneNote 2007 -n„ytt”leikkeet ja Launcher.lnk - C:\Program Files\Microsoft Office\Office12\ONENOTEM.EXE [2006-10-26 20:24:54 98632]

        [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer]
        "NoResolveSearch"= 1 (0x1)

        [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
        "EnableFirewall"= 0 (0x0)

        [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
        "%windir%\\system32\\sessmgr.exe"=
        "C:\\Program Files\\iMesh\\Client\\iMeshClient.exe"=
        "C:\\Program Files\\Messenger\\msmsgs.exe"=
        "C:\\Program Files\\Google\\Google Talk\\googletalk.exe"=
        "C:\\Program Files\\Last.fm\\LastFM.exe"=
        "C:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE"=
        "C:\\Program Files\\Microsoft Office\\Office12\\GROOVE.EXE"=
        "C:\\Program Files\\Microsoft Office\\Office12\\ONENOTE.EXE"=
        "C:\\Program Files\\iTunes\\iTunes.exe"=
        "C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
        "C:\\Program Files\\Windows Live\\Messenger\\livecall.exe"=

        R0 FSFW;F-Secure Firewall Driver;C:\WINDOWS\system32\drivers\fsdfw.sys [2008-03-17 17:50]
        R0 sonyhcb;Sony Digital Imaging Base;C:\WINDOWS\system32\DRIVERS\sonyhcb.sys [2001-11-05 09:23]
        R1 F-Secure HIPS;F-Secure HIPS;C:\Program Files\F-Secure Internet Security\HIPS\fshs.sys [2008-02-13 18:14]
        R2 HDDlife HDD Access service;HDDlife HDD Access service;"C:\Program Files\Common Files\BinarySense\hldasvc.exe" [2007-08-09 14:23]
        R3 F-Secure Gatekeeper;F-Secure Gatekeeper;C:\Program Files\F-Secure Internet Security\Anti-Virus\minifilter\fsgk.sys [2007-05-25 16:08]
        S3 sonyhcs;Sony Digital Imaging Video;C:\WINDOWS\system32\DRIVERS\sonyhcs.sys [2001-11-05 09:23]
        S4 F-Secure Filter;F-Secure File System Filter;C:\Program Files\F-Secure Internet Security\Anti-Virus\Win2K\FSfilter.sys [2007-05-25 16:09]
        S4 F-Secure Recognizer;F-Secure File System Recognizer;C:\Program Files\F-Secure Internet Security\Anti-Virus\Win2K\FSrec.sys [2007-05-25 16:09]

        .
        'Ajoitetut tehtävät'-kansion sisältö
        "2008-05-19 11:16:03 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job"
        - C:\Program Files\Apple Software Update\SoftwareUpdate.exe
        "2008-06-05 03:46:55 C:\WINDOWS\Tasks\Scheduled scanning task.job"
        - C:\PROGRA~1\F-SECU~1\ANTI-V~1\fsav.exeQ /HARD /POLICY /SCHED /NOBREAK /REPORT=C:\PROGRA~1\F-SECU~1\ANTI-V~1\report.txt
        "2008-06-05 20:19:02 C:\WINDOWS\Tasks\Tarkistetaan Windows Live -työkalurivin päivitykset.job"
        - C:\Program Files\Windows Live Toolbar\MSNTBUP.EXE
        .
        **************************************************************************

        catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
        Rootkit scan 2008-06-06 00:03:39
        Windows 5.1.2600 Service Pack 2 NTFS

        scanning hidden processes ...

        scanning hidden autostart entries ...

        scanning hidden files ...

        scan completed successfully
        hidden files: 0

        **************************************************************************
        .
        Completion time: 2008-06-06 0:14:44
        ComboFix-quarantined-files.txt 2008-06-05 21:14:39

        Pre-Run: 82,345,066,496 tavua vapaana
        Post-Run: 82,331,353,088 tavua vapaana

        129   --- E O F ---   2008-05-28 16:33:51

        HJT:

        Logfile of Trend Micro HijackThis v2.0.2
        Scan saved at 0:25:28, on 6.6.2008
        Platform: Windows XP SP2 (WinNT 5.01.2600)
        MSIE: Internet Explorer v7.00 (7.00.6000.16640)
        Boot mode: Normal

        Running processes:
        C:\WINDOWS\System32\smss.exe
        C:\WINDOWS\system32\winlogon.exe
        C:\WINDOWS\system32\services.exe
        C:\WINDOWS\system32\lsass.exe
        C:\WINDOWS\system32\svchost.exe
        C:\WINDOWS\System32\svchost.exe
        C:\WINDOWS\system32\svchost.exe
        C:\WINDOWS\Explorer.EXE
        C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
        C:\WINDOWS\system32\spoolsv.exe
        C:\Program Files\F-Secure Internet Security\Common\FSM32.EXE
        C:\Program Files\iTunes\iTunesHelper.exe
        C:\Program Files\Java\jre1.6.0_06\bin\jusched.exe
        C:\WINDOWS\system32\ctfmon.exe
        C:\Program Files\Creative\Sync Manager Unicode\CTSyncU.exe
        C:\Program Files\Creative\Shared Files\CTSched.exe
        C:\PROGRA~1\HPPAVI~1\Pavilion\XPHWWBS4\plugin\bin\PCHButton.exe
        C:\Program Files\Microsoft Office\Office12\ONENOTEM.EXE
        C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
        C:\WINDOWS\system32\CTsvcCDA.exe
        C:\Program Files\F-Secure Internet Security\Anti-Virus\fsgk32st.exe
        C:\Program Files\F-Secure Internet Security\Common\FSMA32.EXE
        C:\Program Files\F-Secure Internet Security\Anti-Virus\FSGK32.EXE
        C:\Program Files\Common Files\BinarySense\hldasvc.exe
        C:\Program Files\F-Secure Internet Security\Common\FSMB32.EXE
        C:\Program Files\Common Files\BinarySense\hldasvc.exe
        C:\Program Files\F-Secure Internet Security\Common\FCH32.EXE
        C:\Program Files\F-Secure Internet Security\Common\FAMEH32.EXE
        C:\Program Files\F-Secure Internet Security\Anti-Virus\fsqh.exe
        C:\WINDOWS\System32\nvsvc32.exe
        C:\Program Files\F-Secure Internet Security\FSPC\fspc.exe
        C:\Program Files\F-Secure Internet Security\FSGUI\fsguidll.exe
        C:\WINDOWS\System32\svchost.exe
        C:\WINDOWS\system32\MsPMSPSv.exe
        C:\Program Files\iPod\bin\iPodService.exe
        C:\Program Files\F-Secure Internet Security\Anti-Virus\fssm32.exe
        C:\Program Files\F-Secure Internet Security\FSAUA\program\fsaua.exe
        C:\Program Files\F-Secure Internet Security\FWES\Program\fsdfwd.exe
        C:\Program Files\F-Secure Internet Security\FSAUA\program\fsus.exe
        C:\Program Files\F-Secure Internet Security\Anti-Virus\fsav32.exe
        C:\WINDOWS\system32\wuauclt.exe
        C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

        R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.fi/
        R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
        R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
        R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iesearch&locale=FI_FI&c=Q304&bd=pavilion&pf=desktop
        R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
        R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Linkit
        O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\PROGRA~1\MICROS~2\Office12\GRA8E1~1.DLL
        O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_06\bin\ssv.dll
        O2 - BHO: Windows Liven kirjautumisapuohjelma - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
        O2 - BHO: (no name) - {AA58ED58-01DD-4d91-8333-CF10577473F7} - (no file)
        O2 - BHO: Windows Live Toolbar Helper - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
        O3 - Toolbar: HP-näkymä - {B2847E28-5D7D-4DEB-8B67-05D28BCF79F5} - c:\program files\hp\digital imaging\bin\hpdtlk02.dll
        O3 - Toolbar: (no name) - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - (no file)
        O3 - Toolbar: Windows Live Toolbar - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
        O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
        O4 - HKLM\..\Run: [F-Secure Manager] "C:\Program Files\F-Secure Internet Security\Common\FSM32.EXE" /splash
        O4 - HKLM\..\Run: [F-Secure TNB] "C:\Program Files\F-Secure Internet Security\FSGUI\TNBUtil.exe" /CHECKALL /WAITFORSW
        O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
        O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_06\bin\jusched.exe"
        O4 - HKCU\..\Run: [F-Secure TNB] "C:\Program Files\F-Secure Internet Security\FSGUI\TNBUtil.exe" /CHECKALL /WAITFORSW
        O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
        O4 - HKCU\..\Run: [BackupNotify] c:\Program Files\HP\Digital Imaging\bin\backupnotify.exe
        O4 - HKCU\..\Run: [CTSyncU.exe] "C:\Program Files\Creative\Sync Manager Unicode\CTSyncU.exe"
        O4 - HKCU\..\Run: [CreativeTaskScheduler] "C:\Program Files\Creative\Shared Files\CTSched.exe" /logon
        O4 - HKCU\..\Run: [Acme.PCHButton] C:\PROGRA~1\HPPAVI~1\Pavilion\XPHWWBS4\plugin\bin\PCHButton.exe
        O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Paikallinen palve')
        O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Verkkopalve')
        O4 - HKUS\S-1-5-18\..\Run: [Picasa Media Detector] C:\Program Files\Picasa2\PicasaMediaDetector.exe (User 'SYSTEM')
        O4 - HKUS\.DEFAULT\..\Run: [Picasa Media Detector] C:\Program Files\Picasa2\PicasaMediaDetector.exe (User 'Default user')
        O4 - Startup: OneNote 2007 -näyttöleikkeet ja Launcher.lnk = C:\Program Files\Microsoft Office\Office12\ONENOTEM.EXE
        O8 - Extra context menu item: &Google Search - res://C:\Program Files\Google\GoogleToolbar1.dll/cmsearch.html
        O8 - Extra context menu item: &Translate English Word - res://C:\Program Files\Google\GoogleToolbar1.dll/cmwordtrans.html
        O8 - Extra context menu item: &Windows Live Search - res://C:\Program Files\Windows Live Toolbar\msntb.dll/search.htm
        O8 - Extra context menu item: Backward Links - res://C:\Program Files\Google\GoogleToolbar1.dll/cmbacklinks.html
        O8 - Extra context menu item: Cached Snapshot of Page - res://C:\Program Files\Google\GoogleToolbar1.dll/cmcache.html
        O8 - Extra context menu item: Similar Pages - res://C:\Program Files\Google\GoogleToolbar1.dll/cmsimilar.html
        O8 - Extra context menu item: Translate Page into English - res://C:\Program Files\Google\GoogleToolbar1.dll/cmtrans.html
        O8 - Extra context menu item: V&ie Microsoft Exceliin - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
        O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_06\bin\ssv.dll
        O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_06\bin\ssv.dll
        O9 - Extra button: Lapsilukko... - {200DB664-75B5-47c0-8B45-A44ACCF73C00} - C:\Program Files\F-Secure Internet Security\FSPC\fspcmsie.dll
        O9 - Extra button: (no name) - {200DB664-75B5-47c0-8B45-A44ACCF73F01} - C:\Program Files\F-Secure Internet Security\FSPC\fspcmsie.dll
        O9 - Extra 'Tools' menuitem: Lapsilukko... - {200DB664-75B5-47c0-8B45-A44ACCF73F01} - C:\Program Files\F-Secure Internet Security\FSPC\fspcmsie.dll
        O9 - Extra button: (no name) - {200DB664-75B5-47c0-8B45-A44ACCF73F02} - C:\Program Files\F-Secure Internet Security\FSPC\fspcmsie.dll
        O9 - Extra 'Tools' menuitem: &Keskeytä Web-sivujen suodatus - {200DB664-75B5-47c0-8B45-A44ACCF73F02} - C:\Program Files\F-Secure Internet Security\FSPC\fspcmsie.dll
        O9 - Extra button: (no name) - {200DB664-75B5-47c0-8B45-A44ACCF73F03} - C:\Program Files\F-Secure Internet Security\FSPC\fspcmsie.dll
        O9 - Extra 'Tools' menuitem: &Kiellä tämä Web-sivusto - {200DB664-75B5-47c0-8B45-A44ACCF73F03} - C:\Program Files\F-Secure Internet Security\FSPC\fspcmsie.dll
        O9 - Extra button: (no name) - {200DB664-75B5-47c0-8B45-A44ACCF73F04} - C:\Program Files\F-Secure Internet Security\FSPC\fspcmsie.dll
        O9 - Extra 'Tools' menuitem: &Salli tämä Web-sivusto - {200DB664-75B5-47c0-8B45-A44ACCF73F04} - C:\Program Files\F-Secure Internet Security\FSPC\fspcmsie.dll
        O9 - Extra button: Lisää tämä blogiin - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
        O9 - Extra 'Tools' menuitem: &Lisää tämä blogiin tuotteessa Windows Live Writer - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
        O9 - Extra button: Lähetä OneNoteen - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
        O9 - Extra 'Tools' menuitem: Läh&etä OneNoteen - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
        O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
        O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
        O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
        O16 - DPF: {1239CC52-59EF-4DFA-8C61-90FFA846DF7E} (Musicnotes Viewer) - http://www.musicnotes.com/download/mnviewer.cab
        O16 - DPF: {20A60F0D-9AFA-4515-A0FD-83BD84642501} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab56986.cab
        O16 - DPF: {2917297F-F02B-4B9D-81DF-494B6333150B} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineSweeper.cab31267.cab
        O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://spaces.msn.com//PhotoUpload/MsnPUpld.cab
        O16 - DPF: {5C051655-FCD5-4969-9182-770EA5AA5565} (Solitaire Showdown Class) - http://messenger.zone.msn.com/binary/SolitaireShowdown.cab56986.cab
        O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsClient.cab31267.cab
        O16 - DPF: {A8F2B9BD-A6A0-486A-9744-18920D898429} (ScorchPlugin Class) - http://www.sibelius.com/download/software/win/ActiveXPlugin.cab
        O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/msnmessengersetupdownloader.cab
        O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (MSN Games - Installer) - http://messenger.zone.msn.com/binary/ZIntro.cab56649.cab
        O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
        O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
        O16 - DPF: {F58E1CEF-A068-4C15-BA5E-587CAF3EE8C6} (MSN Chat Control 4.5) - http://chat.msn.com/controls/msnchat45.cab
        O16 - DPF: {F5A7706B-B9C0-4C89-A715-7A0C6B05DD48} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineSweeper.cab56986.cab
        O16 - DPF: {F6ACF75C-C32C-447B-9BEF-46B766368D29} (Creative Software AutoUpdate Support Package) - http://www.creative.com/su2/CTL_V02002/ocx/15034/CTPID.cab
        O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\PROGRA~1\MICROS~2\Office12\GR99D3~1.DLL
        O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft AB - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
        O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
        O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\system32\CTsvcCDA.exe
        O23 - Service: F-Secure Gatekeeper Handler Starter - F-Secure Corporation - C:\Program Files\F-Secure Internet Security\Anti-Virus\fsgk32st.exe
        O23 - Service: F-Secure Automatic Update Agent (FSAUA) - F-Secure Corporation - C:\Program Files\F-Secure Internet Security\FSAUA\program\fsaua.exe
        O23 - Service: F-Secure Anti-Virus Firewall Daemon (FSDFWD) - F-Secure Corporation - C:\Program Files\F-Secure Internet Security\FWES\Program\fsdfwd.exe
        O23 - Service: FSMA - F-Secure Corporation - C:\Program Files\F-Secure Internet Security\Common\FSMA32.EXE
        O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
        O23 - Service: HDDlife HDD Access service - BinarySense, Inc. - C:\Program Files\Common Files\BinarySense\hldasvc.exe
        O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
        O23 - Service: iPod-palvelu (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
        O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe

        --
        End of file - 12695 bytes

      • FixFix
        Vanha rouva kirjoitti:

        Hei!

        Tässä tätä logia taas pukkaa. SDFix ei mennyt ihan niinkuin ohjeissanne luki, joten en tiedä teinkö oikein. Piti painaa ctrl alt del jossain vaiheessa, koska se jumitti. Combofix meni toisella kerralla ok - kesti n. 20 min. Näiden kaikkien ajojenjälkeen kone hidastui ja kun käynnistin uudelleen, ilmoitti f-secure heti viruksesta...

        Kiitos, jos autatte ja kunolette jo auttaneet, olen kahden teini-ikäisen äiti ja haluaisin koneen putipuhtaaksi.Ilman apua tästä ei tulisi mitään ;-)

        SDFix:

        Authorized Application Key Export:

        [HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
        "%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
        "C:\\Program Files\\iMesh\\Client\\iMeshClient.exe"="C:\\Program Files\\iMesh\\Client\\iMeshClient.exe:*:Disabled:iMesh Client for PC platforms"
        "C:\\Program Files\\Messenger\\msmsgs.exe"="C:\\Program Files\\Messenger\\msmsgs.exe:*:Enabled:Windows Messenger"
        "C:\\Program Files\\Google\\Google Talk\\googletalk.exe"="C:\\Program Files\\Google\\Google Talk\\googletalk.exe:*:Enabled:Google Talk"
        "C:\\Program Files\\Last.fm\\LastFM.exe"="C:\\Program Files\\Last.fm\\LastFM.exe:*:Enabled:Last.fm"
        "C:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE"="C:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE:*:Enabled:Microsoft Office Outlook"
        "C:\\Program Files\\Microsoft Office\\Office12\\GROOVE.EXE"="C:\\Program Files\\Microsoft Office\\Office12\\GROOVE.EXE:*:Enabled:Microsoft Office Groove"
        "C:\\Program Files\\Microsoft Office\\Office12\\ONENOTE.EXE"="C:\\Program Files\\Microsoft Office\\Office12\\ONENOTE.EXE:*:Enabled:Microsoft Office OneNote"
        "C:\\Program Files\\iTunes\\iTunes.exe"="C:\\Program Files\\iTunes\\iTunes.exe:*:Enabled:iTunes"
        "C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"="C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe:*:Enabled:Windows Live Messenger"
        "C:\\Program Files\\Windows Live\\Messenger\\livecall.exe"="C:\\Program Files\\Windows Live\\Messenger\\livecall.exe:*:Enabled:Windows Live Messenger (Phone)"

        [HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
        "%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
        "C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"="C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe:*:Enabled:Windows Live Messenger"
        "C:\\Program Files\\Windows Live\\Messenger\\livecall.exe"="C:\\Program Files\\Windows Live\\Messenger\\livecall.exe:*:Enabled:Windows Live Messenger (Phone)"

        [b]Remaining Files [/b]:



        [b]Files with Hidden Attributes [/b]:

        Sat 18 Sep 2004 196 A.SHR --- "C:\BOOT.BAK"
        Thu 6 Sep 2001 1,700,352 A..H. --- "C:\gdiplus.dll"
        Sun 7 Oct 2007 5,903,928 A..H. --- "C:\Program Files\Picasa2\setup.exe"
        Sun 21 Aug 2005 4,348 A.SH. --- "C:\Documents and Settings\All Users\DRM\DRMv1.bak"
        Wed 24 Aug 2005 401 A.SH. --- "C:\Documents and Settings\All Users\DRM\DRMv10.bak"
        Tue 25 Dec 2007 0 A.SH. --- "C:\Documents and Settings\All Users\DRM\Cache\Indiv01.tmp"
        Sat 13 Nov 2004 37,376 ...H. --- "C:\Program Files\Common Files\Adobe\ESD\DLMCleanup.exe"
        Thu 8 May 2008 0 A..H. --- "C:\WINDOWS\SoftwareDistribution\Download\0045d90d3c637c74f834c75fe192b558\BIT2.tmp"
        Wed 12 Dec 2007 0 A..H. --- "C:\WINDOWS\SoftwareDistribution\Download\0a67b6c406b1d7e0f5c1e6f6d44a3f6e\BIT2.tmp"
        Wed 12 Dec 2007 0 A..H. --- "C:\WINDOWS\SoftwareDistribution\Download\18b19374451d28a8fbaf1939cf31ff45\BIT5.tmp"
        Wed 12 Dec 2007 0 A..H. --- "C:\WINDOWS\SoftwareDistribution\Download\26924cbc8132a10b438ce6e2b49d4652\BIT1.tmp"
        Wed 12 Dec 2007 0 A..H. --- "C:\WINDOWS\SoftwareDistribution\Download\3cf0038d9844b330cbc012d961537773\BIT6.tmp"
        Wed 12 Dec 2007 0 A..H. --- "C:\WINDOWS\SoftwareDistribution\Download\445ce037cf936bf0308bd0a2bf4516e5\BIT4.tmp"
        Wed 12 Dec 2007 0 A..H. --- "C:\WINDOWS\SoftwareDistribution\Download\d7ce22e444dc91400829a7d1a2d39aa2\BIT7.tmp"
        Wed 12 Dec 2007 0 A..H. --- "C:\WINDOWS\SoftwareDistribution\Download\ddfab57ae20e024ecd85b4ea1a62ef6f\BIT3.tmp"
        Wed 29 Nov 2006 24,576 ...H. --- "C:\Documents and Settings\Omistaja\Ty”p”yt„\KATJA\22 Vuorovaikutus asiakasty”ss„\VUOROVAIKUTUS- LUENTO\~WRL0001.tmp"
        Wed 30 Apr 2008 1,373 A..H. --- "C:\Documents and Settings\All Users\Application Data\YAMAHA\DMN\Downloads\Temp\BIT3F7.tmp"

        [b]Finished![/b]

        Combofix:
        ComboFix 08-06-05.3 - Omistaja 2008-06-05 23:55:18.2 - NTFSx86
        Running from: C:\Documents and Settings\Omistaja\Työpöytä\ComboFix.exe
        * Resident AV is active

        .

        (((((((((((((((((((((((((((((((((((((( Muut poistot ))))))))))))))))))))))))))))))))))))))))))))))))))))))))
        .

        C:\Documents and Settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr0.dat
        C:\Documents and Settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr1.dat
        C:\Documents and Settings\Omistaja\Application Data\Sskknwrd.dll
        C:\WINDOWS\bundles
        C:\WINDOWS\bundles\adv0ltc0m.exe
        C:\WINDOWS\bundles\CSV7P070.exe
        C:\WINDOWS\bundles\cxt_big.exe
        C:\WINDOWS\bundles\dealhelper.exe
        C:\WINDOWS\bundles\Decade.exe
        C:\WINDOWS\bundles\ez_advolt.exe
        C:\WINDOWS\bundles\optimizejames.exe
        C:\WINDOWS\bundles\setup_silent_26221.exe
        C:\WINDOWS\bundles\snackman.exe
        C:\WINDOWS\bundles\stlb2_seed.exe
        C:\WINDOWS\Downloaded Program Files\setup.inf
        C:\WINDOWS\system32\Cache

        ----- BITS: Possible infected sites -----

        hxxp://gateway.digitalmusicnotebook.com
        .
        ((((( Tiedostot, jotka on luotu seuraavalla aikavälillä: 2008-05-05 to 2008-06-05 )))))))))))))))))
        .

        2008-06-05 01:38 . 2008-03-25 02:37   69,632   --a------   C:\WINDOWS\system32\javacpl.cpl
        2008-06-05 00:20 . 2008-06-05 00:20      d--------   C:\Program Files\Malwarebytes' Anti-Malware
        2008-06-05 00:20 . 2008-06-05 00:20      d--------   C:\Documents and Settings\Omistaja\Application Data\Malwarebytes
        2008-06-05 00:20 . 2008-06-05 00:20      d--------   C:\Documents and Settings\All Users\Application Data\Malwarebytes
        2008-06-05 00:20 . 2008-05-30 01:06   34,296   --a------   C:\WINDOWS\system32\drivers\mbamcatchme.sys
        2008-06-05 00:20 . 2008-05-30 01:06   15,864   --a------   C:\WINDOWS\system32\drivers\mbam.sys
        2008-06-04 23:53 . 2008-06-04 23:53      d--------   C:\WINDOWS\ERUNT
        2008-06-03 23:25 . 2008-06-03 23:25      d--------   C:\Program Files\Sun
        2008-05-30 16:27 . 2008-05-30 22:09   86,498   --a------   C:\setup.0xe
        2008-05-30 16:27 . 2008-05-30 19:03   60,132   --a------   C:\dci.0xe
        2008-05-29 19:41 . 2008-05-30 18:16   96,768   --a------   C:\is154890.0xe
        2008-05-29 17:40 . 2008-05-29 18:12   56,832   --a------   C:\fa.0om
        2008-05-29 17:16 . 2008-05-29 17:16   40,960   --a------   C:\ddc.exe
        2008-05-29 17:09 . 2008-05-29 17:08   56,832   -r-hs----   C:\WINDOWS\winudspm.0xe
        2008-05-27 13:48 . 2008-05-27 13:49      d--------   C:\WINDOWS\system32\Artemis Fowl dir

        .
        (((((((((((((((((((((((((((((((((((( Find3M-raportti ))))))))))))))))))))))))))))))))))))))))))))))))))))))
        .
        2008-06-05 20:49   ---------   d---a-w   C:\Documents and Settings\All Users\Application Data\TEMP
        2008-06-04 22:38   ---------   d-----w   C:\Program Files\Java
        2008-05-27 10:48   202,240   ----a-w   C:\WINDOWS\system32\Artemis Fowl.scr
        2008-05-14 20:33   ---------   d-----w   C:\Documents and Settings\All Users\Application Data\Microsoft Help
        2008-04-27 14:13   ---------   d-----w   C:\Documents and Settings\Omistaja\Application Data\YAMAHA
        2008-04-27 14:08   ---------   d-----w   C:\Program Files\YAMAHA
        2008-04-27 14:08   ---------   d-----w   C:\Documents and Settings\All Users\Application Data\YAMAHA
        2008-04-21 17:16   ---------   d-----w   C:\Documents and Settings\All Users\Application Data\Musicnotes
        2008-04-21 17:09   ---------   d-----w   C:\Program Files\Musicnotes
        2008-03-25 04:51   621,344   ----a-w   C:\WINDOWS\system32\mswstr10.dll
        2008-03-25 04:51   166,688   ----a-w   C:\WINDOWS\system32\msjint40.dll
        2008-03-20 08:09   1,845,504   ----a-w   C:\WINDOWS\system32\win32k.sys
        2006-09-28 10:19   40,744   ----a-w   C:\Documents and Settings\Omistaja\Application Data\GDIPFONTCACHEV1.DAT
        .

        (((((((((((((((((((((((((((((( Rekisterin käynnistyskohteet )))))))))))))))))))))))))))))))))))))))))))))
        .
        .
        REGEDIT4
        *Huom* Tyhjiä arvoja ja laillisia oletusarvoja ei näytetä

        [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
        "F-Secure TNB"="C:\Program Files\F-Secure Internet Security\FSGUI\TNBUtil.exe" [2007-05-25 16:11 740208]
        "ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-09-15 02:12 15360]
        "BackupNotify"="c:\Program Files\HP\Digital Imaging\bin\backupnotify.exe" [2004-01-09 02:34 32768]
        "CTSyncU.exe"="C:\Program Files\Creative\Sync Manager Unicode\CTSyncU.exe" [2007-07-17 12:03 868352]
        "CreativeTaskScheduler"="C:\Program Files\Creative\Shared Files\CTSched.exe" [2006-11-17 04:42 53341]
        "Acme.PCHButton"="C:\PROGRA~1\HPPAVI~1\Pavilion\XPHWWBS4\plugin\bin\PCHButton.exe" [2004-01-01 12:18 159744]

        [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
        "NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2004-02-23 22:43 3026944]
        "F-Secure Manager"="C:\Program Files\F-Secure Internet Security\Common\FSM32.exe" [2007-05-25 16:12 183208]
        "F-Secure TNB"="C:\Program Files\F-Secure Internet Security\FSGUI\TNBUtil.exe" [2007-05-25 16:11 740208]
        "iTunesHelper"="C:\Program Files\iTunes\iTunesHelper.exe" [2007-08-15 20:15 271672]
        "SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_06\bin\jusched.exe" [2008-03-25 04:28 144784]

        [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
        "Picasa Media Detector"="C:\Program Files\Picasa2\PicasaMediaDetector.exe" [2007-09-28 04:17 443968]

        C:\Documents and Settings\Omistaja\K„ynnist„-valikko\Ohjelmat\K„ynnistys\
        OneNote 2007 -n„ytt”leikkeet ja Launcher.lnk - C:\Program Files\Microsoft Office\Office12\ONENOTEM.EXE [2006-10-26 20:24:54 98632]

        [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer]
        "NoResolveSearch"= 1 (0x1)

        [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
        "EnableFirewall"= 0 (0x0)

        [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
        "%windir%\\system32\\sessmgr.exe"=
        "C:\\Program Files\\iMesh\\Client\\iMeshClient.exe"=
        "C:\\Program Files\\Messenger\\msmsgs.exe"=
        "C:\\Program Files\\Google\\Google Talk\\googletalk.exe"=
        "C:\\Program Files\\Last.fm\\LastFM.exe"=
        "C:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE"=
        "C:\\Program Files\\Microsoft Office\\Office12\\GROOVE.EXE"=
        "C:\\Program Files\\Microsoft Office\\Office12\\ONENOTE.EXE"=
        "C:\\Program Files\\iTunes\\iTunes.exe"=
        "C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
        "C:\\Program Files\\Windows Live\\Messenger\\livecall.exe"=

        R0 FSFW;F-Secure Firewall Driver;C:\WINDOWS\system32\drivers\fsdfw.sys [2008-03-17 17:50]
        R0 sonyhcb;Sony Digital Imaging Base;C:\WINDOWS\system32\DRIVERS\sonyhcb.sys [2001-11-05 09:23]
        R1 F-Secure HIPS;F-Secure HIPS;C:\Program Files\F-Secure Internet Security\HIPS\fshs.sys [2008-02-13 18:14]
        R2 HDDlife HDD Access service;HDDlife HDD Access service;"C:\Program Files\Common Files\BinarySense\hldasvc.exe" [2007-08-09 14:23]
        R3 F-Secure Gatekeeper;F-Secure Gatekeeper;C:\Program Files\F-Secure Internet Security\Anti-Virus\minifilter\fsgk.sys [2007-05-25 16:08]
        S3 sonyhcs;Sony Digital Imaging Video;C:\WINDOWS\system32\DRIVERS\sonyhcs.sys [2001-11-05 09:23]
        S4 F-Secure Filter;F-Secure File System Filter;C:\Program Files\F-Secure Internet Security\Anti-Virus\Win2K\FSfilter.sys [2007-05-25 16:09]
        S4 F-Secure Recognizer;F-Secure File System Recognizer;C:\Program Files\F-Secure Internet Security\Anti-Virus\Win2K\FSrec.sys [2007-05-25 16:09]

        .
        'Ajoitetut tehtävät'-kansion sisältö
        "2008-05-19 11:16:03 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job"
        - C:\Program Files\Apple Software Update\SoftwareUpdate.exe
        "2008-06-05 03:46:55 C:\WINDOWS\Tasks\Scheduled scanning task.job"
        - C:\PROGRA~1\F-SECU~1\ANTI-V~1\fsav.exeQ /HARD /POLICY /SCHED /NOBREAK /REPORT=C:\PROGRA~1\F-SECU~1\ANTI-V~1\report.txt
        "2008-06-05 20:19:02 C:\WINDOWS\Tasks\Tarkistetaan Windows Live -työkalurivin päivitykset.job"
        - C:\Program Files\Windows Live Toolbar\MSNTBUP.EXE
        .
        **************************************************************************

        catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
        Rootkit scan 2008-06-06 00:03:39
        Windows 5.1.2600 Service Pack 2 NTFS

        scanning hidden processes ...

        scanning hidden autostart entries ...

        scanning hidden files ...

        scan completed successfully
        hidden files: 0

        **************************************************************************
        .
        Completion time: 2008-06-06 0:14:44
        ComboFix-quarantined-files.txt 2008-06-05 21:14:39

        Pre-Run: 82,345,066,496 tavua vapaana
        Post-Run: 82,331,353,088 tavua vapaana

        129   --- E O F ---   2008-05-28 16:33:51

        HJT:

        Logfile of Trend Micro HijackThis v2.0.2
        Scan saved at 0:25:28, on 6.6.2008
        Platform: Windows XP SP2 (WinNT 5.01.2600)
        MSIE: Internet Explorer v7.00 (7.00.6000.16640)
        Boot mode: Normal

        Running processes:
        C:\WINDOWS\System32\smss.exe
        C:\WINDOWS\system32\winlogon.exe
        C:\WINDOWS\system32\services.exe
        C:\WINDOWS\system32\lsass.exe
        C:\WINDOWS\system32\svchost.exe
        C:\WINDOWS\System32\svchost.exe
        C:\WINDOWS\system32\svchost.exe
        C:\WINDOWS\Explorer.EXE
        C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
        C:\WINDOWS\system32\spoolsv.exe
        C:\Program Files\F-Secure Internet Security\Common\FSM32.EXE
        C:\Program Files\iTunes\iTunesHelper.exe
        C:\Program Files\Java\jre1.6.0_06\bin\jusched.exe
        C:\WINDOWS\system32\ctfmon.exe
        C:\Program Files\Creative\Sync Manager Unicode\CTSyncU.exe
        C:\Program Files\Creative\Shared Files\CTSched.exe
        C:\PROGRA~1\HPPAVI~1\Pavilion\XPHWWBS4\plugin\bin\PCHButton.exe
        C:\Program Files\Microsoft Office\Office12\ONENOTEM.EXE
        C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
        C:\WINDOWS\system32\CTsvcCDA.exe
        C:\Program Files\F-Secure Internet Security\Anti-Virus\fsgk32st.exe
        C:\Program Files\F-Secure Internet Security\Common\FSMA32.EXE
        C:\Program Files\F-Secure Internet Security\Anti-Virus\FSGK32.EXE
        C:\Program Files\Common Files\BinarySense\hldasvc.exe
        C:\Program Files\F-Secure Internet Security\Common\FSMB32.EXE
        C:\Program Files\Common Files\BinarySense\hldasvc.exe
        C:\Program Files\F-Secure Internet Security\Common\FCH32.EXE
        C:\Program Files\F-Secure Internet Security\Common\FAMEH32.EXE
        C:\Program Files\F-Secure Internet Security\Anti-Virus\fsqh.exe
        C:\WINDOWS\System32\nvsvc32.exe
        C:\Program Files\F-Secure Internet Security\FSPC\fspc.exe
        C:\Program Files\F-Secure Internet Security\FSGUI\fsguidll.exe
        C:\WINDOWS\System32\svchost.exe
        C:\WINDOWS\system32\MsPMSPSv.exe
        C:\Program Files\iPod\bin\iPodService.exe
        C:\Program Files\F-Secure Internet Security\Anti-Virus\fssm32.exe
        C:\Program Files\F-Secure Internet Security\FSAUA\program\fsaua.exe
        C:\Program Files\F-Secure Internet Security\FWES\Program\fsdfwd.exe
        C:\Program Files\F-Secure Internet Security\FSAUA\program\fsus.exe
        C:\Program Files\F-Secure Internet Security\Anti-Virus\fsav32.exe
        C:\WINDOWS\system32\wuauclt.exe
        C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

        R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.fi/
        R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
        R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
        R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iesearch&locale=FI_FI&c=Q304&bd=pavilion&pf=desktop
        R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
        R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Linkit
        O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\PROGRA~1\MICROS~2\Office12\GRA8E1~1.DLL
        O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_06\bin\ssv.dll
        O2 - BHO: Windows Liven kirjautumisapuohjelma - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
        O2 - BHO: (no name) - {AA58ED58-01DD-4d91-8333-CF10577473F7} - (no file)
        O2 - BHO: Windows Live Toolbar Helper - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
        O3 - Toolbar: HP-näkymä - {B2847E28-5D7D-4DEB-8B67-05D28BCF79F5} - c:\program files\hp\digital imaging\bin\hpdtlk02.dll
        O3 - Toolbar: (no name) - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - (no file)
        O3 - Toolbar: Windows Live Toolbar - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
        O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
        O4 - HKLM\..\Run: [F-Secure Manager] "C:\Program Files\F-Secure Internet Security\Common\FSM32.EXE" /splash
        O4 - HKLM\..\Run: [F-Secure TNB] "C:\Program Files\F-Secure Internet Security\FSGUI\TNBUtil.exe" /CHECKALL /WAITFORSW
        O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
        O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_06\bin\jusched.exe"
        O4 - HKCU\..\Run: [F-Secure TNB] "C:\Program Files\F-Secure Internet Security\FSGUI\TNBUtil.exe" /CHECKALL /WAITFORSW
        O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
        O4 - HKCU\..\Run: [BackupNotify] c:\Program Files\HP\Digital Imaging\bin\backupnotify.exe
        O4 - HKCU\..\Run: [CTSyncU.exe] "C:\Program Files\Creative\Sync Manager Unicode\CTSyncU.exe"
        O4 - HKCU\..\Run: [CreativeTaskScheduler] "C:\Program Files\Creative\Shared Files\CTSched.exe" /logon
        O4 - HKCU\..\Run: [Acme.PCHButton] C:\PROGRA~1\HPPAVI~1\Pavilion\XPHWWBS4\plugin\bin\PCHButton.exe
        O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Paikallinen palve')
        O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Verkkopalve')
        O4 - HKUS\S-1-5-18\..\Run: [Picasa Media Detector] C:\Program Files\Picasa2\PicasaMediaDetector.exe (User 'SYSTEM')
        O4 - HKUS\.DEFAULT\..\Run: [Picasa Media Detector] C:\Program Files\Picasa2\PicasaMediaDetector.exe (User 'Default user')
        O4 - Startup: OneNote 2007 -näyttöleikkeet ja Launcher.lnk = C:\Program Files\Microsoft Office\Office12\ONENOTEM.EXE
        O8 - Extra context menu item: &Google Search - res://C:\Program Files\Google\GoogleToolbar1.dll/cmsearch.html
        O8 - Extra context menu item: &Translate English Word - res://C:\Program Files\Google\GoogleToolbar1.dll/cmwordtrans.html
        O8 - Extra context menu item: &Windows Live Search - res://C:\Program Files\Windows Live Toolbar\msntb.dll/search.htm
        O8 - Extra context menu item: Backward Links - res://C:\Program Files\Google\GoogleToolbar1.dll/cmbacklinks.html
        O8 - Extra context menu item: Cached Snapshot of Page - res://C:\Program Files\Google\GoogleToolbar1.dll/cmcache.html
        O8 - Extra context menu item: Similar Pages - res://C:\Program Files\Google\GoogleToolbar1.dll/cmsimilar.html
        O8 - Extra context menu item: Translate Page into English - res://C:\Program Files\Google\GoogleToolbar1.dll/cmtrans.html
        O8 - Extra context menu item: V&ie Microsoft Exceliin - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
        O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_06\bin\ssv.dll
        O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_06\bin\ssv.dll
        O9 - Extra button: Lapsilukko... - {200DB664-75B5-47c0-8B45-A44ACCF73C00} - C:\Program Files\F-Secure Internet Security\FSPC\fspcmsie.dll
        O9 - Extra button: (no name) - {200DB664-75B5-47c0-8B45-A44ACCF73F01} - C:\Program Files\F-Secure Internet Security\FSPC\fspcmsie.dll
        O9 - Extra 'Tools' menuitem: Lapsilukko... - {200DB664-75B5-47c0-8B45-A44ACCF73F01} - C:\Program Files\F-Secure Internet Security\FSPC\fspcmsie.dll
        O9 - Extra button: (no name) - {200DB664-75B5-47c0-8B45-A44ACCF73F02} - C:\Program Files\F-Secure Internet Security\FSPC\fspcmsie.dll
        O9 - Extra 'Tools' menuitem: &Keskeytä Web-sivujen suodatus - {200DB664-75B5-47c0-8B45-A44ACCF73F02} - C:\Program Files\F-Secure Internet Security\FSPC\fspcmsie.dll
        O9 - Extra button: (no name) - {200DB664-75B5-47c0-8B45-A44ACCF73F03} - C:\Program Files\F-Secure Internet Security\FSPC\fspcmsie.dll
        O9 - Extra 'Tools' menuitem: &Kiellä tämä Web-sivusto - {200DB664-75B5-47c0-8B45-A44ACCF73F03} - C:\Program Files\F-Secure Internet Security\FSPC\fspcmsie.dll
        O9 - Extra button: (no name) - {200DB664-75B5-47c0-8B45-A44ACCF73F04} - C:\Program Files\F-Secure Internet Security\FSPC\fspcmsie.dll
        O9 - Extra 'Tools' menuitem: &Salli tämä Web-sivusto - {200DB664-75B5-47c0-8B45-A44ACCF73F04} - C:\Program Files\F-Secure Internet Security\FSPC\fspcmsie.dll
        O9 - Extra button: Lisää tämä blogiin - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
        O9 - Extra 'Tools' menuitem: &Lisää tämä blogiin tuotteessa Windows Live Writer - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
        O9 - Extra button: Lähetä OneNoteen - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
        O9 - Extra 'Tools' menuitem: Läh&etä OneNoteen - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
        O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
        O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
        O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
        O16 - DPF: {1239CC52-59EF-4DFA-8C61-90FFA846DF7E} (Musicnotes Viewer) - http://www.musicnotes.com/download/mnviewer.cab
        O16 - DPF: {20A60F0D-9AFA-4515-A0FD-83BD84642501} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab56986.cab
        O16 - DPF: {2917297F-F02B-4B9D-81DF-494B6333150B} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineSweeper.cab31267.cab
        O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://spaces.msn.com//PhotoUpload/MsnPUpld.cab
        O16 - DPF: {5C051655-FCD5-4969-9182-770EA5AA5565} (Solitaire Showdown Class) - http://messenger.zone.msn.com/binary/SolitaireShowdown.cab56986.cab
        O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsClient.cab31267.cab
        O16 - DPF: {A8F2B9BD-A6A0-486A-9744-18920D898429} (ScorchPlugin Class) - http://www.sibelius.com/download/software/win/ActiveXPlugin.cab
        O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/msnmessengersetupdownloader.cab
        O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (MSN Games - Installer) - http://messenger.zone.msn.com/binary/ZIntro.cab56649.cab
        O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
        O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
        O16 - DPF: {F58E1CEF-A068-4C15-BA5E-587CAF3EE8C6} (MSN Chat Control 4.5) - http://chat.msn.com/controls/msnchat45.cab
        O16 - DPF: {F5A7706B-B9C0-4C89-A715-7A0C6B05DD48} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineSweeper.cab56986.cab
        O16 - DPF: {F6ACF75C-C32C-447B-9BEF-46B766368D29} (Creative Software AutoUpdate Support Package) - http://www.creative.com/su2/CTL_V02002/ocx/15034/CTPID.cab
        O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\PROGRA~1\MICROS~2\Office12\GR99D3~1.DLL
        O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft AB - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
        O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
        O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\system32\CTsvcCDA.exe
        O23 - Service: F-Secure Gatekeeper Handler Starter - F-Secure Corporation - C:\Program Files\F-Secure Internet Security\Anti-Virus\fsgk32st.exe
        O23 - Service: F-Secure Automatic Update Agent (FSAUA) - F-Secure Corporation - C:\Program Files\F-Secure Internet Security\FSAUA\program\fsaua.exe
        O23 - Service: F-Secure Anti-Virus Firewall Daemon (FSDFWD) - F-Secure Corporation - C:\Program Files\F-Secure Internet Security\FWES\Program\fsdfwd.exe
        O23 - Service: FSMA - F-Secure Corporation - C:\Program Files\F-Secure Internet Security\Common\FSMA32.EXE
        O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
        O23 - Service: HDDlife HDD Access service - BinarySense, Inc. - C:\Program Files\Common Files\BinarySense\hldasvc.exe
        O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
        O23 - Service: iPod-palvelu (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
        O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe

        --
        End of file - 12695 bytes

        kun sait tuon combofixsin aikaseksi


        Avaa Muistio ja kopioi/liitä quoteboxin sisältö sinne:

        [quote]

        File::
        C:\setup.0xe
        C:\dci.0xe
        C:\is154890.0xe
        C:\fa.0om
        C:\WINDOWS\winudspm.0xe

        [/quote]

        Tallenna se nimellä CFScript.txt

        Sitten raahaa CFScript ComboFix.exeen kuten alla.
        [img]http://users.pandora.be/bluepatchy/miekiemoes/images/CFScript.gif[/img]

        Käynnistä tietokone uudelleen pyydettäessä ja lähetä combofix.txt-tiedoston sisältö tänne.

      • Vanha rouva
        FixFix kirjoitti:

        kun sait tuon combofixsin aikaseksi


        Avaa Muistio ja kopioi/liitä quoteboxin sisältö sinne:

        [quote]

        File::
        C:\setup.0xe
        C:\dci.0xe
        C:\is154890.0xe
        C:\fa.0om
        C:\WINDOWS\winudspm.0xe

        [/quote]

        Tallenna se nimellä CFScript.txt

        Sitten raahaa CFScript ComboFix.exeen kuten alla.
        [img]http://users.pandora.be/bluepatchy/miekiemoes/images/CFScript.gif[/img]

        Käynnistä tietokone uudelleen pyydettäessä ja lähetä combofix.txt-tiedoston sisältö tänne.

        Toivottavasti ymmärsin, mitä pitää tehdä. Palaan asiaan iltapäivällä. Nyt kiirettä töissä... Kiitosta.

      • Vanha rouva
        FixFix kirjoitti:

        kun sait tuon combofixsin aikaseksi


        Avaa Muistio ja kopioi/liitä quoteboxin sisältö sinne:

        [quote]

        File::
        C:\setup.0xe
        C:\dci.0xe
        C:\is154890.0xe
        C:\fa.0om
        C:\WINDOWS\winudspm.0xe

        [/quote]

        Tallenna se nimellä CFScript.txt

        Sitten raahaa CFScript ComboFix.exeen kuten alla.
        [img]http://users.pandora.be/bluepatchy/miekiemoes/images/CFScript.gif[/img]

        Käynnistä tietokone uudelleen pyydettäessä ja lähetä combofix.txt-tiedoston sisältö tänne.

        En osannut toimia tuon viimeisen ohjeen mukaan. En saanut "raahattua" sitä muistion sisältöä tuonne combofixiin tai sitten en ymmärtänyt mitä pitää tehdä. Niinpä tuli klikattua tuota combofixiä ja se tarkasti koneen uudelleen ja tässä loki. Oli kuiteknin nopeampi tarkistus kuin eilen, mutta en tiedä onko sillä merkitystä.

        Kiva jos vielä ehdit(te) antaa tästä vinkkiä.

        ComboFix 08-06-05.3 - Omistaja 2008-06-06 20:21:58.3 - NTFSx86
        Running from: C:\Documents and Settings\Omistaja\Työpöytä\ComboFix2.exe
        * Resident AV is active

        .

        ((((( Tiedostot, jotka on luotu seuraavalla aikavälillä: 2008-05-06 to 2008-06-06 )))))))))))))))))
        .

        2008-06-05 01:38 . 2008-03-25 02:37   69,632   --a------   C:\WINDOWS\system32\javacpl.cpl
        2008-06-05 00:20 . 2008-06-05 00:20      d--------   C:\Program Files\Malwarebytes' Anti-Malware
        2008-06-05 00:20 . 2008-06-05 00:20      d--------   C:\Documents and Settings\Omistaja\Application Data\Malwarebytes
        2008-06-05 00:20 . 2008-06-05 00:20      d--------   C:\Documents and Settings\All Users\Application Data\Malwarebytes
        2008-06-05 00:20 . 2008-05-30 01:06   34,296   --a------   C:\WINDOWS\system32\drivers\mbamcatchme.sys
        2008-06-05 00:20 . 2008-05-30 01:06   15,864   --a------   C:\WINDOWS\system32\drivers\mbam.sys
        2008-06-04 23:53 . 2008-06-04 23:53      d--------   C:\WINDOWS\ERUNT
        2008-06-03 23:25 . 2008-06-03 23:25      d--------   C:\Program Files\Sun
        2008-05-30 16:27 . 2008-05-30 22:09   86,498   --a------   C:\setup.0xe
        2008-05-30 16:27 . 2008-05-30 19:03   60,132   --a------   C:\dci.0xe
        2008-05-29 19:41 . 2008-05-30 18:16   96,768   --a------   C:\is154890.0xe
        2008-05-29 17:40 . 2008-05-29 18:12   56,832   --a------   C:\fa.0om
        2008-05-29 17:16 . 2008-05-29 17:16   40,960   --a------   C:\ddc.0xe
        2008-05-29 17:09 . 2008-05-29 17:08   56,832   -r-hs----   C:\WINDOWS\winudspm.0xe
        2008-05-27 13:48 . 2008-05-27 13:49      d--------   C:\WINDOWS\system32\Artemis Fowl dir

        .
        (((((((((((((((((((((((((((((((((((( Find3M-raportti ))))))))))))))))))))))))))))))))))))))))))))))))))))))
        .
        2008-06-06 04:30   ---------   d---a-w   C:\Documents and Settings\All Users\Application Data\TEMP
        2008-06-04 22:38   ---------   d-----w   C:\Program Files\Java
        2008-05-27 10:48   202,240   ----a-w   C:\WINDOWS\system32\Artemis Fowl.scr
        2008-05-14 20:33   ---------   d-----w   C:\Documents and Settings\All Users\Application Data\Microsoft Help
        2008-04-27 14:13   ---------   d-----w   C:\Documents and Settings\Omistaja\Application Data\YAMAHA
        2008-04-27 14:08   ---------   d-----w   C:\Program Files\YAMAHA
        2008-04-27 14:08   ---------   d-----w   C:\Documents and Settings\All Users\Application Data\YAMAHA
        2008-04-21 17:16   ---------   d-----w   C:\Documents and Settings\All Users\Application Data\Musicnotes
        2008-04-21 17:09   ---------   d-----w   C:\Program Files\Musicnotes
        2008-03-25 04:51   621,344   ----a-w   C:\WINDOWS\system32\mswstr10.dll
        2008-03-25 04:51   166,688   ----a-w   C:\WINDOWS\system32\msjint40.dll
        2008-03-20 08:09   1,845,504   ----a-w   C:\WINDOWS\system32\win32k.sys
        2006-09-28 10:19   40,744   ----a-w   C:\Documents and Settings\Omistaja\Application Data\GDIPFONTCACHEV1.DAT
        .

        ((((((((((((((((((((((((((((( snapshot@2008-06-06_ 0.14.20.09 )))))))))))))))))))))))))))))))))))))))))
        .
        - 2008-06-05 20:49:25   2,048   --s-a-w   C:\WINDOWS\bootstat.dat
        2008-06-06 04:30:14   2,048   --s-a-w   C:\WINDOWS\bootstat.dat
        2008-06-06 04:30:32   16,384   ----atw   C:\WINDOWS\Temp\Perflib_Perfdata_818.dat
        .
        (((((((((((((((((((((((((((((( Rekisterin käynnistyskohteet )))))))))))))))))))))))))))))))))))))))))))))
        .
        .
        REGEDIT4
        *Huom* Tyhjiä arvoja ja laillisia oletusarvoja ei näytetä

        [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
        "F-Secure TNB"="C:\Program Files\F-Secure Internet Security\FSGUI\TNBUtil.exe" [2007-05-25 16:11 740208]
        "ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-09-15 02:12 15360]
        "BackupNotify"="c:\Program Files\HP\Digital Imaging\bin\backupnotify.exe" [2004-01-09 02:34 32768]
        "CTSyncU.exe"="C:\Program Files\Creative\Sync Manager Unicode\CTSyncU.exe" [2007-07-17 12:03 868352]
        "CreativeTaskScheduler"="C:\Program Files\Creative\Shared Files\CTSched.exe" [2006-11-17 04:42 53341]
        "Acme.PCHButton"="C:\PROGRA~1\HPPAVI~1\Pavilion\XPHWWBS4\plugin\bin\PCHButton.exe" [2004-01-01 12:18 159744]

        [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
        "NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2004-02-23 22:43 3026944]
        "F-Secure Manager"="C:\Program Files\F-Secure Internet Security\Common\FSM32.exe" [2007-05-25 16:12 183208]
        "F-Secure TNB"="C:\Program Files\F-Secure Internet Security\FSGUI\TNBUtil.exe" [2007-05-25 16:11 740208]
        "iTunesHelper"="C:\Program Files\iTunes\iTunesHelper.exe" [2007-08-15 20:15 271672]
        "SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_06\bin\jusched.exe" [2008-03-25 04:28 144784]

        [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
        "Picasa Media Detector"="C:\Program Files\Picasa2\PicasaMediaDetector.exe" [2007-09-28 04:17 443968]

        C:\Documents and Settings\Omistaja\K„ynnist„-valikko\Ohjelmat\K„ynnistys\
        OneNote 2007 -n„ytt”leikkeet ja Launcher.lnk - C:\Program Files\Microsoft Office\Office12\ONENOTEM.EXE [2006-10-26 20:24:54 98632]

        [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer]
        "NoResolveSearch"= 1 (0x1)

        [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
        "EnableFirewall"= 0 (0x0)

        [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
        "%windir%\\system32\\sessmgr.exe"=
        "C:\\Program Files\\iMesh\\Client\\iMeshClient.exe"=
        "C:\\Program Files\\Messenger\\msmsgs.exe"=
        "C:\\Program Files\\Google\\Google Talk\\googletalk.exe"=
        "C:\\Program Files\\Last.fm\\LastFM.exe"=
        "C:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE"=
        "C:\\Program Files\\Microsoft Office\\Office12\\GROOVE.EXE"=
        "C:\\Program Files\\Microsoft Office\\Office12\\ONENOTE.EXE"=
        "C:\\Program Files\\iTunes\\iTunes.exe"=
        "C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
        "C:\\Program Files\\Windows Live\\Messenger\\livecall.exe"=

        R0 FSFW;F-Secure Firewall Driver;C:\WINDOWS\system32\drivers\fsdfw.sys [2008-03-17 17:50]
        R0 sonyhcb;Sony Digital Imaging Base;C:\WINDOWS\system32\DRIVERS\sonyhcb.sys [2001-11-05 09:23]
        R1 F-Secure HIPS;F-Secure HIPS;C:\Program Files\F-Secure Internet Security\HIPS\fshs.sys [2008-02-13 18:14]
        R2 HDDlife HDD Access service;HDDlife HDD Access service;"C:\Program Files\Common Files\BinarySense\hldasvc.exe" [2007-08-09 14:23]
        R3 F-Secure Gatekeeper;F-Secure Gatekeeper;C:\Program Files\F-Secure Internet Security\Anti-Virus\minifilter\fsgk.sys [2007-05-25 16:08]
        S3 sonyhcs;Sony Digital Imaging Video;C:\WINDOWS\system32\DRIVERS\sonyhcs.sys [2001-11-05 09:23]
        S4 F-Secure Filter;F-Secure File System Filter;C:\Program Files\F-Secure Internet Security\Anti-Virus\Win2K\FSfilter.sys [2007-05-25 16:09]
        S4 F-Secure Recognizer;F-Secure File System Recognizer;C:\Program Files\F-Secure Internet Security\Anti-Virus\Win2K\FSrec.sys [2007-05-25 16:09]

        .
        'Ajoitetut tehtävät'-kansion sisältö
        "2008-05-19 11:16:03 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job"
        - C:\Program Files\Apple Software Update\SoftwareUpdate.exe
        "2008-06-06 04:31:10 C:\WINDOWS\Tasks\Scheduled scanning task.job"
        - C:\PROGRA~1\F-SECU~1\ANTI-V~1\fsav.exeQ /HARD /POLICY /SCHED /NOBREAK /REPORT=C:\PROGRA~1\F-SECU~1\ANTI-V~1\report.txt
        "2008-06-06 17:19:01 C:\WINDOWS\Tasks\Tarkistetaan Windows Live -työkalurivin päivitykset.job"
        - C:\Program Files\Windows Live Toolbar\MSNTBUP.EXE
        .
        **************************************************************************

        catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
        Rootkit scan 2008-06-06 20:29:11
        Windows 5.1.2600 Service Pack 2 NTFS

        scanning hidden processes ...

        scanning hidden autostart entries ...

        scanning hidden files ...

        scan completed successfully
        hidden files: 0

        **************************************************************************
        .
        Completion time: 2008-06-06 20:40:27
        ComboFix-quarantined-files.txt 2008-06-06 17:40:14
        ComboFix2.txt 2008-06-05 21:14:45

        Pre-Run: 82,330,705,920 tavua vapaana
        Post-Run: 82,322,403,328 tavua vapaana

        115   --- E O F ---   2008-05-28 16:33:51

      • FixFix
        Vanha rouva kirjoitti:

        En osannut toimia tuon viimeisen ohjeen mukaan. En saanut "raahattua" sitä muistion sisältöä tuonne combofixiin tai sitten en ymmärtänyt mitä pitää tehdä. Niinpä tuli klikattua tuota combofixiä ja se tarkasti koneen uudelleen ja tässä loki. Oli kuiteknin nopeampi tarkistus kuin eilen, mutta en tiedä onko sillä merkitystä.

        Kiva jos vielä ehdit(te) antaa tästä vinkkiä.

        ComboFix 08-06-05.3 - Omistaja 2008-06-06 20:21:58.3 - NTFSx86
        Running from: C:\Documents and Settings\Omistaja\Työpöytä\ComboFix2.exe
        * Resident AV is active

        .

        ((((( Tiedostot, jotka on luotu seuraavalla aikavälillä: 2008-05-06 to 2008-06-06 )))))))))))))))))
        .

        2008-06-05 01:38 . 2008-03-25 02:37   69,632   --a------   C:\WINDOWS\system32\javacpl.cpl
        2008-06-05 00:20 . 2008-06-05 00:20      d--------   C:\Program Files\Malwarebytes' Anti-Malware
        2008-06-05 00:20 . 2008-06-05 00:20      d--------   C:\Documents and Settings\Omistaja\Application Data\Malwarebytes
        2008-06-05 00:20 . 2008-06-05 00:20      d--------   C:\Documents and Settings\All Users\Application Data\Malwarebytes
        2008-06-05 00:20 . 2008-05-30 01:06   34,296   --a------   C:\WINDOWS\system32\drivers\mbamcatchme.sys
        2008-06-05 00:20 . 2008-05-30 01:06   15,864   --a------   C:\WINDOWS\system32\drivers\mbam.sys
        2008-06-04 23:53 . 2008-06-04 23:53      d--------   C:\WINDOWS\ERUNT
        2008-06-03 23:25 . 2008-06-03 23:25      d--------   C:\Program Files\Sun
        2008-05-30 16:27 . 2008-05-30 22:09   86,498   --a------   C:\setup.0xe
        2008-05-30 16:27 . 2008-05-30 19:03   60,132   --a------   C:\dci.0xe
        2008-05-29 19:41 . 2008-05-30 18:16   96,768   --a------   C:\is154890.0xe
        2008-05-29 17:40 . 2008-05-29 18:12   56,832   --a------   C:\fa.0om
        2008-05-29 17:16 . 2008-05-29 17:16   40,960   --a------   C:\ddc.0xe
        2008-05-29 17:09 . 2008-05-29 17:08   56,832   -r-hs----   C:\WINDOWS\winudspm.0xe
        2008-05-27 13:48 . 2008-05-27 13:49      d--------   C:\WINDOWS\system32\Artemis Fowl dir

        .
        (((((((((((((((((((((((((((((((((((( Find3M-raportti ))))))))))))))))))))))))))))))))))))))))))))))))))))))
        .
        2008-06-06 04:30   ---------   d---a-w   C:\Documents and Settings\All Users\Application Data\TEMP
        2008-06-04 22:38   ---------   d-----w   C:\Program Files\Java
        2008-05-27 10:48   202,240   ----a-w   C:\WINDOWS\system32\Artemis Fowl.scr
        2008-05-14 20:33   ---------   d-----w   C:\Documents and Settings\All Users\Application Data\Microsoft Help
        2008-04-27 14:13   ---------   d-----w   C:\Documents and Settings\Omistaja\Application Data\YAMAHA
        2008-04-27 14:08   ---------   d-----w   C:\Program Files\YAMAHA
        2008-04-27 14:08   ---------   d-----w   C:\Documents and Settings\All Users\Application Data\YAMAHA
        2008-04-21 17:16   ---------   d-----w   C:\Documents and Settings\All Users\Application Data\Musicnotes
        2008-04-21 17:09   ---------   d-----w   C:\Program Files\Musicnotes
        2008-03-25 04:51   621,344   ----a-w   C:\WINDOWS\system32\mswstr10.dll
        2008-03-25 04:51   166,688   ----a-w   C:\WINDOWS\system32\msjint40.dll
        2008-03-20 08:09   1,845,504   ----a-w   C:\WINDOWS\system32\win32k.sys
        2006-09-28 10:19   40,744   ----a-w   C:\Documents and Settings\Omistaja\Application Data\GDIPFONTCACHEV1.DAT
        .

        ((((((((((((((((((((((((((((( snapshot@2008-06-06_ 0.14.20.09 )))))))))))))))))))))))))))))))))))))))))
        .
        - 2008-06-05 20:49:25   2,048   --s-a-w   C:\WINDOWS\bootstat.dat
        2008-06-06 04:30:14   2,048   --s-a-w   C:\WINDOWS\bootstat.dat
        2008-06-06 04:30:32   16,384   ----atw   C:\WINDOWS\Temp\Perflib_Perfdata_818.dat
        .
        (((((((((((((((((((((((((((((( Rekisterin käynnistyskohteet )))))))))))))))))))))))))))))))))))))))))))))
        .
        .
        REGEDIT4
        *Huom* Tyhjiä arvoja ja laillisia oletusarvoja ei näytetä

        [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
        "F-Secure TNB"="C:\Program Files\F-Secure Internet Security\FSGUI\TNBUtil.exe" [2007-05-25 16:11 740208]
        "ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-09-15 02:12 15360]
        "BackupNotify"="c:\Program Files\HP\Digital Imaging\bin\backupnotify.exe" [2004-01-09 02:34 32768]
        "CTSyncU.exe"="C:\Program Files\Creative\Sync Manager Unicode\CTSyncU.exe" [2007-07-17 12:03 868352]
        "CreativeTaskScheduler"="C:\Program Files\Creative\Shared Files\CTSched.exe" [2006-11-17 04:42 53341]
        "Acme.PCHButton"="C:\PROGRA~1\HPPAVI~1\Pavilion\XPHWWBS4\plugin\bin\PCHButton.exe" [2004-01-01 12:18 159744]

        [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
        "NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2004-02-23 22:43 3026944]
        "F-Secure Manager"="C:\Program Files\F-Secure Internet Security\Common\FSM32.exe" [2007-05-25 16:12 183208]
        "F-Secure TNB"="C:\Program Files\F-Secure Internet Security\FSGUI\TNBUtil.exe" [2007-05-25 16:11 740208]
        "iTunesHelper"="C:\Program Files\iTunes\iTunesHelper.exe" [2007-08-15 20:15 271672]
        "SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_06\bin\jusched.exe" [2008-03-25 04:28 144784]

        [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
        "Picasa Media Detector"="C:\Program Files\Picasa2\PicasaMediaDetector.exe" [2007-09-28 04:17 443968]

        C:\Documents and Settings\Omistaja\K„ynnist„-valikko\Ohjelmat\K„ynnistys\
        OneNote 2007 -n„ytt”leikkeet ja Launcher.lnk - C:\Program Files\Microsoft Office\Office12\ONENOTEM.EXE [2006-10-26 20:24:54 98632]

        [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer]
        "NoResolveSearch"= 1 (0x1)

        [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
        "EnableFirewall"= 0 (0x0)

        [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
        "%windir%\\system32\\sessmgr.exe"=
        "C:\\Program Files\\iMesh\\Client\\iMeshClient.exe"=
        "C:\\Program Files\\Messenger\\msmsgs.exe"=
        "C:\\Program Files\\Google\\Google Talk\\googletalk.exe"=
        "C:\\Program Files\\Last.fm\\LastFM.exe"=
        "C:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE"=
        "C:\\Program Files\\Microsoft Office\\Office12\\GROOVE.EXE"=
        "C:\\Program Files\\Microsoft Office\\Office12\\ONENOTE.EXE"=
        "C:\\Program Files\\iTunes\\iTunes.exe"=
        "C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
        "C:\\Program Files\\Windows Live\\Messenger\\livecall.exe"=

        R0 FSFW;F-Secure Firewall Driver;C:\WINDOWS\system32\drivers\fsdfw.sys [2008-03-17 17:50]
        R0 sonyhcb;Sony Digital Imaging Base;C:\WINDOWS\system32\DRIVERS\sonyhcb.sys [2001-11-05 09:23]
        R1 F-Secure HIPS;F-Secure HIPS;C:\Program Files\F-Secure Internet Security\HIPS\fshs.sys [2008-02-13 18:14]
        R2 HDDlife HDD Access service;HDDlife HDD Access service;"C:\Program Files\Common Files\BinarySense\hldasvc.exe" [2007-08-09 14:23]
        R3 F-Secure Gatekeeper;F-Secure Gatekeeper;C:\Program Files\F-Secure Internet Security\Anti-Virus\minifilter\fsgk.sys [2007-05-25 16:08]
        S3 sonyhcs;Sony Digital Imaging Video;C:\WINDOWS\system32\DRIVERS\sonyhcs.sys [2001-11-05 09:23]
        S4 F-Secure Filter;F-Secure File System Filter;C:\Program Files\F-Secure Internet Security\Anti-Virus\Win2K\FSfilter.sys [2007-05-25 16:09]
        S4 F-Secure Recognizer;F-Secure File System Recognizer;C:\Program Files\F-Secure Internet Security\Anti-Virus\Win2K\FSrec.sys [2007-05-25 16:09]

        .
        'Ajoitetut tehtävät'-kansion sisältö
        "2008-05-19 11:16:03 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job"
        - C:\Program Files\Apple Software Update\SoftwareUpdate.exe
        "2008-06-06 04:31:10 C:\WINDOWS\Tasks\Scheduled scanning task.job"
        - C:\PROGRA~1\F-SECU~1\ANTI-V~1\fsav.exeQ /HARD /POLICY /SCHED /NOBREAK /REPORT=C:\PROGRA~1\F-SECU~1\ANTI-V~1\report.txt
        "2008-06-06 17:19:01 C:\WINDOWS\Tasks\Tarkistetaan Windows Live -työkalurivin päivitykset.job"
        - C:\Program Files\Windows Live Toolbar\MSNTBUP.EXE
        .
        **************************************************************************

        catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
        Rootkit scan 2008-06-06 20:29:11
        Windows 5.1.2600 Service Pack 2 NTFS

        scanning hidden processes ...

        scanning hidden autostart entries ...

        scanning hidden files ...

        scan completed successfully
        hidden files: 0

        **************************************************************************
        .
        Completion time: 2008-06-06 20:40:27
        ComboFix-quarantined-files.txt 2008-06-06 17:40:14
        ComboFix2.txt 2008-06-05 21:14:45

        Pre-Run: 82,330,705,920 tavua vapaana
        Post-Run: 82,322,403,328 tavua vapaana

        115   --- E O F ---   2008-05-28 16:33:51

        Avaa Muistio ja kopioi/liitä quoteboxin sisältö sinne:

        [quote]

        File::
        C:\setup.0xe
        C:\dci.0xe
        C:\is154890.0xe
        C:\fa.0om
        C:\ddc.0xe
        C:\WINDOWS\winudspm.0xe

        [/quote]

        Tallenna se nimellä CFScript.txt

        Sitten raahaa CFScript ComboFix.exeen kuten alla.
        [img]http://users.pandora.be/bluepatchy/miekiemoes/images/CFScript.gif[/img]

        Käynnistä tietokone uudelleen pyydettäessä ja lähetä combofix.txt-tiedoston sisältö tänne.

      • ..........
        Vanha rouva kirjoitti:

        En osannut toimia tuon viimeisen ohjeen mukaan. En saanut "raahattua" sitä muistion sisältöä tuonne combofixiin tai sitten en ymmärtänyt mitä pitää tehdä. Niinpä tuli klikattua tuota combofixiä ja se tarkasti koneen uudelleen ja tässä loki. Oli kuiteknin nopeampi tarkistus kuin eilen, mutta en tiedä onko sillä merkitystä.

        Kiva jos vielä ehdit(te) antaa tästä vinkkiä.

        ComboFix 08-06-05.3 - Omistaja 2008-06-06 20:21:58.3 - NTFSx86
        Running from: C:\Documents and Settings\Omistaja\Työpöytä\ComboFix2.exe
        * Resident AV is active

        .

        ((((( Tiedostot, jotka on luotu seuraavalla aikavälillä: 2008-05-06 to 2008-06-06 )))))))))))))))))
        .

        2008-06-05 01:38 . 2008-03-25 02:37   69,632   --a------   C:\WINDOWS\system32\javacpl.cpl
        2008-06-05 00:20 . 2008-06-05 00:20      d--------   C:\Program Files\Malwarebytes' Anti-Malware
        2008-06-05 00:20 . 2008-06-05 00:20      d--------   C:\Documents and Settings\Omistaja\Application Data\Malwarebytes
        2008-06-05 00:20 . 2008-06-05 00:20      d--------   C:\Documents and Settings\All Users\Application Data\Malwarebytes
        2008-06-05 00:20 . 2008-05-30 01:06   34,296   --a------   C:\WINDOWS\system32\drivers\mbamcatchme.sys
        2008-06-05 00:20 . 2008-05-30 01:06   15,864   --a------   C:\WINDOWS\system32\drivers\mbam.sys
        2008-06-04 23:53 . 2008-06-04 23:53      d--------   C:\WINDOWS\ERUNT
        2008-06-03 23:25 . 2008-06-03 23:25      d--------   C:\Program Files\Sun
        2008-05-30 16:27 . 2008-05-30 22:09   86,498   --a------   C:\setup.0xe
        2008-05-30 16:27 . 2008-05-30 19:03   60,132   --a------   C:\dci.0xe
        2008-05-29 19:41 . 2008-05-30 18:16   96,768   --a------   C:\is154890.0xe
        2008-05-29 17:40 . 2008-05-29 18:12   56,832   --a------   C:\fa.0om
        2008-05-29 17:16 . 2008-05-29 17:16   40,960   --a------   C:\ddc.0xe
        2008-05-29 17:09 . 2008-05-29 17:08   56,832   -r-hs----   C:\WINDOWS\winudspm.0xe
        2008-05-27 13:48 . 2008-05-27 13:49      d--------   C:\WINDOWS\system32\Artemis Fowl dir

        .
        (((((((((((((((((((((((((((((((((((( Find3M-raportti ))))))))))))))))))))))))))))))))))))))))))))))))))))))
        .
        2008-06-06 04:30   ---------   d---a-w   C:\Documents and Settings\All Users\Application Data\TEMP
        2008-06-04 22:38   ---------   d-----w   C:\Program Files\Java
        2008-05-27 10:48   202,240   ----a-w   C:\WINDOWS\system32\Artemis Fowl.scr
        2008-05-14 20:33   ---------   d-----w   C:\Documents and Settings\All Users\Application Data\Microsoft Help
        2008-04-27 14:13   ---------   d-----w   C:\Documents and Settings\Omistaja\Application Data\YAMAHA
        2008-04-27 14:08   ---------   d-----w   C:\Program Files\YAMAHA
        2008-04-27 14:08   ---------   d-----w   C:\Documents and Settings\All Users\Application Data\YAMAHA
        2008-04-21 17:16   ---------   d-----w   C:\Documents and Settings\All Users\Application Data\Musicnotes
        2008-04-21 17:09   ---------   d-----w   C:\Program Files\Musicnotes
        2008-03-25 04:51   621,344   ----a-w   C:\WINDOWS\system32\mswstr10.dll
        2008-03-25 04:51   166,688   ----a-w   C:\WINDOWS\system32\msjint40.dll
        2008-03-20 08:09   1,845,504   ----a-w   C:\WINDOWS\system32\win32k.sys
        2006-09-28 10:19   40,744   ----a-w   C:\Documents and Settings\Omistaja\Application Data\GDIPFONTCACHEV1.DAT
        .

        ((((((((((((((((((((((((((((( snapshot@2008-06-06_ 0.14.20.09 )))))))))))))))))))))))))))))))))))))))))
        .
        - 2008-06-05 20:49:25   2,048   --s-a-w   C:\WINDOWS\bootstat.dat
        2008-06-06 04:30:14   2,048   --s-a-w   C:\WINDOWS\bootstat.dat
        2008-06-06 04:30:32   16,384   ----atw   C:\WINDOWS\Temp\Perflib_Perfdata_818.dat
        .
        (((((((((((((((((((((((((((((( Rekisterin käynnistyskohteet )))))))))))))))))))))))))))))))))))))))))))))
        .
        .
        REGEDIT4
        *Huom* Tyhjiä arvoja ja laillisia oletusarvoja ei näytetä

        [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
        "F-Secure TNB"="C:\Program Files\F-Secure Internet Security\FSGUI\TNBUtil.exe" [2007-05-25 16:11 740208]
        "ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-09-15 02:12 15360]
        "BackupNotify"="c:\Program Files\HP\Digital Imaging\bin\backupnotify.exe" [2004-01-09 02:34 32768]
        "CTSyncU.exe"="C:\Program Files\Creative\Sync Manager Unicode\CTSyncU.exe" [2007-07-17 12:03 868352]
        "CreativeTaskScheduler"="C:\Program Files\Creative\Shared Files\CTSched.exe" [2006-11-17 04:42 53341]
        "Acme.PCHButton"="C:\PROGRA~1\HPPAVI~1\Pavilion\XPHWWBS4\plugin\bin\PCHButton.exe" [2004-01-01 12:18 159744]

        [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
        "NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2004-02-23 22:43 3026944]
        "F-Secure Manager"="C:\Program Files\F-Secure Internet Security\Common\FSM32.exe" [2007-05-25 16:12 183208]
        "F-Secure TNB"="C:\Program Files\F-Secure Internet Security\FSGUI\TNBUtil.exe" [2007-05-25 16:11 740208]
        "iTunesHelper"="C:\Program Files\iTunes\iTunesHelper.exe" [2007-08-15 20:15 271672]
        "SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_06\bin\jusched.exe" [2008-03-25 04:28 144784]

        [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
        "Picasa Media Detector"="C:\Program Files\Picasa2\PicasaMediaDetector.exe" [2007-09-28 04:17 443968]

        C:\Documents and Settings\Omistaja\K„ynnist„-valikko\Ohjelmat\K„ynnistys\
        OneNote 2007 -n„ytt”leikkeet ja Launcher.lnk - C:\Program Files\Microsoft Office\Office12\ONENOTEM.EXE [2006-10-26 20:24:54 98632]

        [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer]
        "NoResolveSearch"= 1 (0x1)

        [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
        "EnableFirewall"= 0 (0x0)

        [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
        "%windir%\\system32\\sessmgr.exe"=
        "C:\\Program Files\\iMesh\\Client\\iMeshClient.exe"=
        "C:\\Program Files\\Messenger\\msmsgs.exe"=
        "C:\\Program Files\\Google\\Google Talk\\googletalk.exe"=
        "C:\\Program Files\\Last.fm\\LastFM.exe"=
        "C:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE"=
        "C:\\Program Files\\Microsoft Office\\Office12\\GROOVE.EXE"=
        "C:\\Program Files\\Microsoft Office\\Office12\\ONENOTE.EXE"=
        "C:\\Program Files\\iTunes\\iTunes.exe"=
        "C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
        "C:\\Program Files\\Windows Live\\Messenger\\livecall.exe"=

        R0 FSFW;F-Secure Firewall Driver;C:\WINDOWS\system32\drivers\fsdfw.sys [2008-03-17 17:50]
        R0 sonyhcb;Sony Digital Imaging Base;C:\WINDOWS\system32\DRIVERS\sonyhcb.sys [2001-11-05 09:23]
        R1 F-Secure HIPS;F-Secure HIPS;C:\Program Files\F-Secure Internet Security\HIPS\fshs.sys [2008-02-13 18:14]
        R2 HDDlife HDD Access service;HDDlife HDD Access service;"C:\Program Files\Common Files\BinarySense\hldasvc.exe" [2007-08-09 14:23]
        R3 F-Secure Gatekeeper;F-Secure Gatekeeper;C:\Program Files\F-Secure Internet Security\Anti-Virus\minifilter\fsgk.sys [2007-05-25 16:08]
        S3 sonyhcs;Sony Digital Imaging Video;C:\WINDOWS\system32\DRIVERS\sonyhcs.sys [2001-11-05 09:23]
        S4 F-Secure Filter;F-Secure File System Filter;C:\Program Files\F-Secure Internet Security\Anti-Virus\Win2K\FSfilter.sys [2007-05-25 16:09]
        S4 F-Secure Recognizer;F-Secure File System Recognizer;C:\Program Files\F-Secure Internet Security\Anti-Virus\Win2K\FSrec.sys [2007-05-25 16:09]

        .
        'Ajoitetut tehtävät'-kansion sisältö
        "2008-05-19 11:16:03 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job"
        - C:\Program Files\Apple Software Update\SoftwareUpdate.exe
        "2008-06-06 04:31:10 C:\WINDOWS\Tasks\Scheduled scanning task.job"
        - C:\PROGRA~1\F-SECU~1\ANTI-V~1\fsav.exeQ /HARD /POLICY /SCHED /NOBREAK /REPORT=C:\PROGRA~1\F-SECU~1\ANTI-V~1\report.txt
        "2008-06-06 17:19:01 C:\WINDOWS\Tasks\Tarkistetaan Windows Live -työkalurivin päivitykset.job"
        - C:\Program Files\Windows Live Toolbar\MSNTBUP.EXE
        .
        **************************************************************************

        catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
        Rootkit scan 2008-06-06 20:29:11
        Windows 5.1.2600 Service Pack 2 NTFS

        scanning hidden processes ...

        scanning hidden autostart entries ...

        scanning hidden files ...

        scan completed successfully
        hidden files: 0

        **************************************************************************
        .
        Completion time: 2008-06-06 20:40:27
        ComboFix-quarantined-files.txt 2008-06-06 17:40:14
        ComboFix2.txt 2008-06-05 21:14:45

        Pre-Run: 82,330,705,920 tavua vapaana
        Post-Run: 82,322,403,328 tavua vapaana

        115   --- E O F ---   2008-05-28 16:33:51

        Työpöydällä hiiren kursori muistion päälle ja painat vasenta painiketta hiirestä koko ajan ja vedät sen kuvakkeen combon kuvakkeen päälle ja irroitat.

      • FixFix
        Vanha rouva kirjoitti:

        En osannut toimia tuon viimeisen ohjeen mukaan. En saanut "raahattua" sitä muistion sisältöä tuonne combofixiin tai sitten en ymmärtänyt mitä pitää tehdä. Niinpä tuli klikattua tuota combofixiä ja se tarkasti koneen uudelleen ja tässä loki. Oli kuiteknin nopeampi tarkistus kuin eilen, mutta en tiedä onko sillä merkitystä.

        Kiva jos vielä ehdit(te) antaa tästä vinkkiä.

        ComboFix 08-06-05.3 - Omistaja 2008-06-06 20:21:58.3 - NTFSx86
        Running from: C:\Documents and Settings\Omistaja\Työpöytä\ComboFix2.exe
        * Resident AV is active

        .

        ((((( Tiedostot, jotka on luotu seuraavalla aikavälillä: 2008-05-06 to 2008-06-06 )))))))))))))))))
        .

        2008-06-05 01:38 . 2008-03-25 02:37   69,632   --a------   C:\WINDOWS\system32\javacpl.cpl
        2008-06-05 00:20 . 2008-06-05 00:20      d--------   C:\Program Files\Malwarebytes' Anti-Malware
        2008-06-05 00:20 . 2008-06-05 00:20      d--------   C:\Documents and Settings\Omistaja\Application Data\Malwarebytes
        2008-06-05 00:20 . 2008-06-05 00:20      d--------   C:\Documents and Settings\All Users\Application Data\Malwarebytes
        2008-06-05 00:20 . 2008-05-30 01:06   34,296   --a------   C:\WINDOWS\system32\drivers\mbamcatchme.sys
        2008-06-05 00:20 . 2008-05-30 01:06   15,864   --a------   C:\WINDOWS\system32\drivers\mbam.sys
        2008-06-04 23:53 . 2008-06-04 23:53      d--------   C:\WINDOWS\ERUNT
        2008-06-03 23:25 . 2008-06-03 23:25      d--------   C:\Program Files\Sun
        2008-05-30 16:27 . 2008-05-30 22:09   86,498   --a------   C:\setup.0xe
        2008-05-30 16:27 . 2008-05-30 19:03   60,132   --a------   C:\dci.0xe
        2008-05-29 19:41 . 2008-05-30 18:16   96,768   --a------   C:\is154890.0xe
        2008-05-29 17:40 . 2008-05-29 18:12   56,832   --a------   C:\fa.0om
        2008-05-29 17:16 . 2008-05-29 17:16   40,960   --a------   C:\ddc.0xe
        2008-05-29 17:09 . 2008-05-29 17:08   56,832   -r-hs----   C:\WINDOWS\winudspm.0xe
        2008-05-27 13:48 . 2008-05-27 13:49      d--------   C:\WINDOWS\system32\Artemis Fowl dir

        .
        (((((((((((((((((((((((((((((((((((( Find3M-raportti ))))))))))))))))))))))))))))))))))))))))))))))))))))))
        .
        2008-06-06 04:30   ---------   d---a-w   C:\Documents and Settings\All Users\Application Data\TEMP
        2008-06-04 22:38   ---------   d-----w   C:\Program Files\Java
        2008-05-27 10:48   202,240   ----a-w   C:\WINDOWS\system32\Artemis Fowl.scr
        2008-05-14 20:33   ---------   d-----w   C:\Documents and Settings\All Users\Application Data\Microsoft Help
        2008-04-27 14:13   ---------   d-----w   C:\Documents and Settings\Omistaja\Application Data\YAMAHA
        2008-04-27 14:08   ---------   d-----w   C:\Program Files\YAMAHA
        2008-04-27 14:08   ---------   d-----w   C:\Documents and Settings\All Users\Application Data\YAMAHA
        2008-04-21 17:16   ---------   d-----w   C:\Documents and Settings\All Users\Application Data\Musicnotes
        2008-04-21 17:09   ---------   d-----w   C:\Program Files\Musicnotes
        2008-03-25 04:51   621,344   ----a-w   C:\WINDOWS\system32\mswstr10.dll
        2008-03-25 04:51   166,688   ----a-w   C:\WINDOWS\system32\msjint40.dll
        2008-03-20 08:09   1,845,504   ----a-w   C:\WINDOWS\system32\win32k.sys
        2006-09-28 10:19   40,744   ----a-w   C:\Documents and Settings\Omistaja\Application Data\GDIPFONTCACHEV1.DAT
        .

        ((((((((((((((((((((((((((((( snapshot@2008-06-06_ 0.14.20.09 )))))))))))))))))))))))))))))))))))))))))
        .
        - 2008-06-05 20:49:25   2,048   --s-a-w   C:\WINDOWS\bootstat.dat
        2008-06-06 04:30:14   2,048   --s-a-w   C:\WINDOWS\bootstat.dat
        2008-06-06 04:30:32   16,384   ----atw   C:\WINDOWS\Temp\Perflib_Perfdata_818.dat
        .
        (((((((((((((((((((((((((((((( Rekisterin käynnistyskohteet )))))))))))))))))))))))))))))))))))))))))))))
        .
        .
        REGEDIT4
        *Huom* Tyhjiä arvoja ja laillisia oletusarvoja ei näytetä

        [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
        "F-Secure TNB"="C:\Program Files\F-Secure Internet Security\FSGUI\TNBUtil.exe" [2007-05-25 16:11 740208]
        "ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-09-15 02:12 15360]
        "BackupNotify"="c:\Program Files\HP\Digital Imaging\bin\backupnotify.exe" [2004-01-09 02:34 32768]
        "CTSyncU.exe"="C:\Program Files\Creative\Sync Manager Unicode\CTSyncU.exe" [2007-07-17 12:03 868352]
        "CreativeTaskScheduler"="C:\Program Files\Creative\Shared Files\CTSched.exe" [2006-11-17 04:42 53341]
        "Acme.PCHButton"="C:\PROGRA~1\HPPAVI~1\Pavilion\XPHWWBS4\plugin\bin\PCHButton.exe" [2004-01-01 12:18 159744]

        [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
        "NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2004-02-23 22:43 3026944]
        "F-Secure Manager"="C:\Program Files\F-Secure Internet Security\Common\FSM32.exe" [2007-05-25 16:12 183208]
        "F-Secure TNB"="C:\Program Files\F-Secure Internet Security\FSGUI\TNBUtil.exe" [2007-05-25 16:11 740208]
        "iTunesHelper"="C:\Program Files\iTunes\iTunesHelper.exe" [2007-08-15 20:15 271672]
        "SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_06\bin\jusched.exe" [2008-03-25 04:28 144784]

        [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
        "Picasa Media Detector"="C:\Program Files\Picasa2\PicasaMediaDetector.exe" [2007-09-28 04:17 443968]

        C:\Documents and Settings\Omistaja\K„ynnist„-valikko\Ohjelmat\K„ynnistys\
        OneNote 2007 -n„ytt”leikkeet ja Launcher.lnk - C:\Program Files\Microsoft Office\Office12\ONENOTEM.EXE [2006-10-26 20:24:54 98632]

        [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer]
        "NoResolveSearch"= 1 (0x1)

        [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
        "EnableFirewall"= 0 (0x0)

        [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
        "%windir%\\system32\\sessmgr.exe"=
        "C:\\Program Files\\iMesh\\Client\\iMeshClient.exe"=
        "C:\\Program Files\\Messenger\\msmsgs.exe"=
        "C:\\Program Files\\Google\\Google Talk\\googletalk.exe"=
        "C:\\Program Files\\Last.fm\\LastFM.exe"=
        "C:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE"=
        "C:\\Program Files\\Microsoft Office\\Office12\\GROOVE.EXE"=
        "C:\\Program Files\\Microsoft Office\\Office12\\ONENOTE.EXE"=
        "C:\\Program Files\\iTunes\\iTunes.exe"=
        "C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
        "C:\\Program Files\\Windows Live\\Messenger\\livecall.exe"=

        R0 FSFW;F-Secure Firewall Driver;C:\WINDOWS\system32\drivers\fsdfw.sys [2008-03-17 17:50]
        R0 sonyhcb;Sony Digital Imaging Base;C:\WINDOWS\system32\DRIVERS\sonyhcb.sys [2001-11-05 09:23]
        R1 F-Secure HIPS;F-Secure HIPS;C:\Program Files\F-Secure Internet Security\HIPS\fshs.sys [2008-02-13 18:14]
        R2 HDDlife HDD Access service;HDDlife HDD Access service;"C:\Program Files\Common Files\BinarySense\hldasvc.exe" [2007-08-09 14:23]
        R3 F-Secure Gatekeeper;F-Secure Gatekeeper;C:\Program Files\F-Secure Internet Security\Anti-Virus\minifilter\fsgk.sys [2007-05-25 16:08]
        S3 sonyhcs;Sony Digital Imaging Video;C:\WINDOWS\system32\DRIVERS\sonyhcs.sys [2001-11-05 09:23]
        S4 F-Secure Filter;F-Secure File System Filter;C:\Program Files\F-Secure Internet Security\Anti-Virus\Win2K\FSfilter.sys [2007-05-25 16:09]
        S4 F-Secure Recognizer;F-Secure File System Recognizer;C:\Program Files\F-Secure Internet Security\Anti-Virus\Win2K\FSrec.sys [2007-05-25 16:09]

        .
        'Ajoitetut tehtävät'-kansion sisältö
        "2008-05-19 11:16:03 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job"
        - C:\Program Files\Apple Software Update\SoftwareUpdate.exe
        "2008-06-06 04:31:10 C:\WINDOWS\Tasks\Scheduled scanning task.job"
        - C:\PROGRA~1\F-SECU~1\ANTI-V~1\fsav.exeQ /HARD /POLICY /SCHED /NOBREAK /REPORT=C:\PROGRA~1\F-SECU~1\ANTI-V~1\report.txt
        "2008-06-06 17:19:01 C:\WINDOWS\Tasks\Tarkistetaan Windows Live -työkalurivin päivitykset.job"
        - C:\Program Files\Windows Live Toolbar\MSNTBUP.EXE
        .
        **************************************************************************

        catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
        Rootkit scan 2008-06-06 20:29:11
        Windows 5.1.2600 Service Pack 2 NTFS

        scanning hidden processes ...

        scanning hidden autostart entries ...

        scanning hidden files ...

        scan completed successfully
        hidden files: 0

        **************************************************************************
        .
        Completion time: 2008-06-06 20:40:27
        ComboFix-quarantined-files.txt 2008-06-06 17:40:14
        ComboFix2.txt 2008-06-05 21:14:45

        Pre-Run: 82,330,705,920 tavua vapaana
        Post-Run: 82,322,403,328 tavua vapaana

        115   --- E O F ---   2008-05-28 16:33:51

        Malwarebytes' Anti-Malware

        ja sitten scannaat sen jälkeen uuden combofix loki

      • Vanha rouva
        FixFix kirjoitti:

        Malwarebytes' Anti-Malware

        ja sitten scannaat sen jälkeen uuden combofix loki

        Tässä tää loki. Laitan sen toisen pian perään. En saanut siirettyä sitä quoteboxin sisältöä combofixiin, koska ne vain vaihtoivat paikkaa. Ehkä en osannut tehdä sitä CFScripti.txt -juttua oikein...


        Malwarebytes' Anti-Malware 1.14
        Tietokantaversio: 826

        10:07:34 7.6.2008
        mbam-log-6-7-2008 (10-07-34).txt

        Tarkistustyyppi: Täysi tarkistus (C:\|D:\|)
        Tarkistetut kohteet: 137909
        Kulunut aika: 1 hour(s), 32 minute(s), 35 second(s)

        Saastuneita muistiprosesseja: 0
        Saastuneita muistimoduuleja: 0
        Saastuneita rekisteriavaimia: 0
        Saastuneita rekisteriarvoja: 0
        Saastuneita rekisterikohteita: 0
        Saastuneita hakemistoja: 0
        Saastuneita tiedostoja: 12

        Saastuneita muistiprosesseja:
        (Haitallisia kohteita ei löydetty)

        Saastuneita muistimoduuleja:
        (Haitallisia kohteita ei löydetty)

        Saastuneita rekisteriavaimia:
        (Haitallisia kohteita ei löydetty)

        Saastuneita rekisteriarvoja:
        (Haitallisia kohteita ei löydetty)

        Saastuneita rekisterikohteita:
        (Haitallisia kohteita ei löydetty)

        Saastuneita hakemistoja:
        (Haitallisia kohteita ei löydetty)

        Saastuneita tiedostoja:
        C:\dci.0xe (Backdoor.Bot) -> Quarantined and deleted successfully.
        C:\ddc.0xe (Backdoor.Bot) -> Quarantined and deleted successfully.
        C:\fa.0om (Backdoor.Bot) -> Quarantined and deleted successfully.
        C:\setup.0xe (Backdoor.Bot) -> Quarantined and deleted successfully.
        C:\Documents and Settings\Omistaja\setup.0xe (Backdoor.Bot) -> Quarantined and deleted successfully.
        C:\System Volume Information\_restore{EF7B9B72-035F-42A2-BDC2-6E27BDB1C4B7}\RP272\A0025288.0xe (Backdoor.Bot) -> Quarantined and deleted successfully.
        C:\System Volume Information\_restore{EF7B9B72-035F-42A2-BDC2-6E27BDB1C4B7}\RP275\A0025418.0xe (Backdoor.Bot) -> Quarantined and deleted successfully.
        C:\System Volume Information\_restore{EF7B9B72-035F-42A2-BDC2-6E27BDB1C4B7}\RP275\A0025419.0om (Backdoor.Bot) -> Quarantined and deleted successfully.
        C:\System Volume Information\_restore{EF7B9B72-035F-42A2-BDC2-6E27BDB1C4B7}\RP275\A0025420.0xe (Backdoor.Bot) -> Quarantined and deleted successfully.
        C:\System Volume Information\_restore{EF7B9B72-035F-42A2-BDC2-6E27BDB1C4B7}\RP275\A0025421.0xe (Backdoor.Bot) -> Quarantined and deleted successfully.
        C:\System Volume Information\_restore{EF7B9B72-035F-42A2-BDC2-6E27BDB1C4B7}\RP275\A0025422.0xe (Backdoor.Bot) -> Quarantined and deleted successfully.
        C:\WINDOWS\winudspm.0xe (Backdoor.Bot) -> Quarantined and deleted successfully.

      • FixFix
        Vanha rouva kirjoitti:

        Tässä tää loki. Laitan sen toisen pian perään. En saanut siirettyä sitä quoteboxin sisältöä combofixiin, koska ne vain vaihtoivat paikkaa. Ehkä en osannut tehdä sitä CFScripti.txt -juttua oikein...


        Malwarebytes' Anti-Malware 1.14
        Tietokantaversio: 826

        10:07:34 7.6.2008
        mbam-log-6-7-2008 (10-07-34).txt

        Tarkistustyyppi: Täysi tarkistus (C:\|D:\|)
        Tarkistetut kohteet: 137909
        Kulunut aika: 1 hour(s), 32 minute(s), 35 second(s)

        Saastuneita muistiprosesseja: 0
        Saastuneita muistimoduuleja: 0
        Saastuneita rekisteriavaimia: 0
        Saastuneita rekisteriarvoja: 0
        Saastuneita rekisterikohteita: 0
        Saastuneita hakemistoja: 0
        Saastuneita tiedostoja: 12

        Saastuneita muistiprosesseja:
        (Haitallisia kohteita ei löydetty)

        Saastuneita muistimoduuleja:
        (Haitallisia kohteita ei löydetty)

        Saastuneita rekisteriavaimia:
        (Haitallisia kohteita ei löydetty)

        Saastuneita rekisteriarvoja:
        (Haitallisia kohteita ei löydetty)

        Saastuneita rekisterikohteita:
        (Haitallisia kohteita ei löydetty)

        Saastuneita hakemistoja:
        (Haitallisia kohteita ei löydetty)

        Saastuneita tiedostoja:
        C:\dci.0xe (Backdoor.Bot) -> Quarantined and deleted successfully.
        C:\ddc.0xe (Backdoor.Bot) -> Quarantined and deleted successfully.
        C:\fa.0om (Backdoor.Bot) -> Quarantined and deleted successfully.
        C:\setup.0xe (Backdoor.Bot) -> Quarantined and deleted successfully.
        C:\Documents and Settings\Omistaja\setup.0xe (Backdoor.Bot) -> Quarantined and deleted successfully.
        C:\System Volume Information\_restore{EF7B9B72-035F-42A2-BDC2-6E27BDB1C4B7}\RP272\A0025288.0xe (Backdoor.Bot) -> Quarantined and deleted successfully.
        C:\System Volume Information\_restore{EF7B9B72-035F-42A2-BDC2-6E27BDB1C4B7}\RP275\A0025418.0xe (Backdoor.Bot) -> Quarantined and deleted successfully.
        C:\System Volume Information\_restore{EF7B9B72-035F-42A2-BDC2-6E27BDB1C4B7}\RP275\A0025419.0om (Backdoor.Bot) -> Quarantined and deleted successfully.
        C:\System Volume Information\_restore{EF7B9B72-035F-42A2-BDC2-6E27BDB1C4B7}\RP275\A0025420.0xe (Backdoor.Bot) -> Quarantined and deleted successfully.
        C:\System Volume Information\_restore{EF7B9B72-035F-42A2-BDC2-6E27BDB1C4B7}\RP275\A0025421.0xe (Backdoor.Bot) -> Quarantined and deleted successfully.
        C:\System Volume Information\_restore{EF7B9B72-035F-42A2-BDC2-6E27BDB1C4B7}\RP275\A0025422.0xe (Backdoor.Bot) -> Quarantined and deleted successfully.
        C:\WINDOWS\winudspm.0xe (Backdoor.Bot) -> Quarantined and deleted successfully.

        otas uudelleen vielä combofix scannaus

        ja uusi hjt:n loki

      • Vanha rouva
        FixFix kirjoitti:

        otas uudelleen vielä combofix scannaus

        ja uusi hjt:n loki

        Combofix tässä (ja HJT:N ajan seuraavaksi):

        ComboFix 08-06-05.3 - Omistaja 2008-06-07 10:13:14.4 - NTFSx86
        Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1035.18.152 [GMT 3:00]
        Running from: C:\Documents and Settings\Omistaja\Työpöytä\ComboFix2.exe
        * Resident AV is active

        .

        (((((((((((((((((((((((((((((((((((((( Muut poistot ))))))))))))))))))))))))))))))))))))))))))))))))))))))))
        .

        D:\Autorun.inf

        .
        ((((( Tiedostot, jotka on luotu seuraavalla aikavälillä: 2008-05-07 to 2008-06-07 )))))))))))))))))
        .

        2008-06-07 00:00 . 2008-06-07 00:00      d--------   C:\Documents and Settings\LocalService\Työpöytä
        2008-06-05 01:38 . 2008-03-25 02:37   69,632   --a------   C:\WINDOWS\system32\javacpl.cpl
        2008-06-05 00:20 . 2008-06-05 00:20      d--------   C:\Program Files\Malwarebytes' Anti-Malware
        2008-06-05 00:20 . 2008-06-05 00:20      d--------   C:\Documents and Settings\Omistaja\Application Data\Malwarebytes
        2008-06-05 00:20 . 2008-06-05 00:20      d--------   C:\Documents and Settings\All Users\Application Data\Malwarebytes
        2008-06-05 00:20 . 2008-05-30 01:06   34,296   --a------   C:\WINDOWS\system32\drivers\mbamcatchme.sys
        2008-06-05 00:20 . 2008-05-30 01:06   15,864   --a------   C:\WINDOWS\system32\drivers\mbam.sys
        2008-06-04 23:53 . 2008-06-04 23:53      d--------   C:\WINDOWS\ERUNT
        2008-06-03 23:25 . 2008-06-03 23:25      d--------   C:\Program Files\Sun
        2008-05-27 13:48 . 2008-05-27 13:49      d--------   C:\WINDOWS\system32\Artemis Fowl dir

        .
        (((((((((((((((((((((((((((((((((((( Find3M-raportti ))))))))))))))))))))))))))))))))))))))))))))))))))))))
        .
        2008-06-06 04:30   ---------   d---a-w   C:\Documents and Settings\All Users\Application Data\TEMP
        2008-06-04 22:38   ---------   d-----w   C:\Program Files\Java
        2008-05-27 10:48   202,240   ----a-w   C:\WINDOWS\system32\Artemis Fowl.scr
        2008-05-14 20:33   ---------   d-----w   C:\Documents and Settings\All Users\Application Data\Microsoft Help
        2008-04-27 14:13   ---------   d-----w   C:\Documents and Settings\Omistaja\Application Data\YAMAHA
        2008-04-27 14:08   ---------   d-----w   C:\Program Files\YAMAHA
        2008-04-27 14:08   ---------   d-----w   C:\Documents and Settings\All Users\Application Data\YAMAHA
        2008-04-21 17:16   ---------   d-----w   C:\Documents and Settings\All Users\Application Data\Musicnotes
        2008-04-21 17:09   ---------   d-----w   C:\Program Files\Musicnotes
        2008-03-25 04:51   621,344   ----a-w   C:\WINDOWS\system32\mswstr10.dll
        2008-03-25 04:51   166,688   ----a-w   C:\WINDOWS\system32\msjint40.dll
        2008-03-20 08:09   1,845,504   ----a-w   C:\WINDOWS\system32\win32k.sys
        2006-09-28 10:19   40,744   ----a-w   C:\Documents and Settings\Omistaja\Application Data\GDIPFONTCACHEV1.DAT
        .

        ((((((((((((((((((((((((((((( snapshot@2008-06-06_ 0.14.20.09 )))))))))))))))))))))))))))))))))))))))))
        .
        - 2008-06-05 20:49:25   2,048   --s-a-w   C:\WINDOWS\bootstat.dat
        2008-06-06 04:30:14   2,048   --s-a-w   C:\WINDOWS\bootstat.dat
        2008-06-06 04:30:32   16,384   ----atw   C:\WINDOWS\Temp\Perflib_Perfdata_818.dat
        .
        (((((((((((((((((((((((((((((( Rekisterin käynnistyskohteet )))))))))))))))))))))))))))))))))))))))))))))
        .
        .
        REGEDIT4
        *Huom* Tyhjiä arvoja ja laillisia oletusarvoja ei näytetä

        [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
        "F-Secure TNB"="C:\Program Files\F-Secure Internet Security\FSGUI\TNBUtil.exe" [2007-05-25 16:11 740208]
        "ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-09-15 02:12 15360]
        "BackupNotify"="c:\Program Files\HP\Digital Imaging\bin\backupnotify.exe" [2004-01-09 02:34 32768]
        "CTSyncU.exe"="C:\Program Files\Creative\Sync Manager Unicode\CTSyncU.exe" [2007-07-17 12:03 868352]
        "CreativeTaskScheduler"="C:\Program Files\Creative\Shared Files\CTSched.exe" [2006-11-17 04:42 53341]
        "Acme.PCHButton"="C:\PROGRA~1\HPPAVI~1\Pavilion\XPHWWBS4\plugin\bin\PCHButton.exe" [2004-01-01 12:18 159744]

        [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
        "NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2004-02-23 22:43 3026944]
        "F-Secure Manager"="C:\Program Files\F-Secure Internet Security\Common\FSM32.exe" [2007-05-25 16:12 183208]
        "F-Secure TNB"="C:\Program Files\F-Secure Internet Security\FSGUI\TNBUtil.exe" [2007-05-25 16:11 740208]
        "iTunesHelper"="C:\Program Files\iTunes\iTunesHelper.exe" [2007-08-15 20:15 271672]
        "SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_06\bin\jusched.exe" [2008-03-25 04:28 144784]

        [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
        "Picasa Media Detector"="C:\Program Files\Picasa2\PicasaMediaDetector.exe" [2007-09-28 04:17 443968]

        C:\Documents and Settings\Omistaja\K„ynnist„-valikko\Ohjelmat\K„ynnistys\
        OneNote 2007 -n„ytt”leikkeet ja Launcher.lnk - C:\Program Files\Microsoft Office\Office12\ONENOTEM.EXE [2006-10-26 20:24:54 98632]

        [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer]
        "NoResolveSearch"= 1 (0x1)

        [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
        "EnableFirewall"= 0 (0x0)

        [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
        "%windir%\\system32\\sessmgr.exe"=
        "C:\\Program Files\\iMesh\\Client\\iMeshClient.exe"=
        "C:\\Program Files\\Messenger\\msmsgs.exe"=
        "C:\\Program Files\\Google\\Google Talk\\googletalk.exe"=
        "C:\\Program Files\\Last.fm\\LastFM.exe"=
        "C:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE"=
        "C:\\Program Files\\Microsoft Office\\Office12\\GROOVE.EXE"=
        "C:\\Program Files\\Microsoft Office\\Office12\\ONENOTE.EXE"=
        "C:\\Program Files\\iTunes\\iTunes.exe"=
        "C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
        "C:\\Program Files\\Windows Live\\Messenger\\livecall.exe"=

        R0 FSFW;F-Secure Firewall Driver;C:\WINDOWS\system32\drivers\fsdfw.sys [2008-03-17 17:50]
        R0 sonyhcb;Sony Digital Imaging Base;C:\WINDOWS\system32\DRIVERS\sonyhcb.sys [2001-11-05 09:23]
        R1 F-Secure HIPS;F-Secure HIPS;C:\Program Files\F-Secure Internet Security\HIPS\fshs.sys [2008-02-13 18:14]
        R2 HDDlife HDD Access service;HDDlife HDD Access service;"C:\Program Files\Common Files\BinarySense\hldasvc.exe" [2007-08-09 14:23]
        R3 F-Secure Gatekeeper;F-Secure Gatekeeper;C:\Program Files\F-Secure Internet Security\Anti-Virus\minifilter\fsgk.sys [2007-05-25 16:08]
        S3 sonyhcs;Sony Digital Imaging Video;C:\WINDOWS\system32\DRIVERS\sonyhcs.sys [2001-11-05 09:23]
        S4 F-Secure Filter;F-Secure File System Filter;C:\Program Files\F-Secure Internet Security\Anti-Virus\Win2K\FSfilter.sys [2007-05-25 16:09]
        S4 F-Secure Recognizer;F-Secure File System Recognizer;C:\Program Files\F-Secure Internet Security\Anti-Virus\Win2K\FSrec.sys [2007-05-25 16:09]

        *Newly Created Service* - FSBL
        .
        'Ajoitetut tehtävät'-kansion sisältö
        "2008-05-19 11:16:03 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job"
        - C:\Program Files\Apple Software Update\SoftwareUpdate.exe
        "2008-06-07 00:33:32 C:\WINDOWS\Tasks\Scheduled scanning task.job"
        - C:\PROGRA~1\F-SECU~1\ANTI-V~1\fsav.exeQ /HARD /POLICY /SCHED /NOBREAK /REPORT=C:\PROGRA~1\F-SECU~1\ANTI-V~1\report.txt
        "2008-06-07 07:19:02 C:\WINDOWS\Tasks\Tarkistetaan Windows Live -työkalurivin päivitykset.job"
        - C:\Program Files\Windows Live Toolbar\MSNTBUP.EXE
        .
        **************************************************************************

        catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
        Rootkit scan 2008-06-07 10:18:48
        Windows 5.1.2600 Service Pack 2 NTFS

        scanning hidden processes ...

        scanning hidden autostart entries ...

        scanning hidden files ...

        scan completed successfully
        hidden files: 0

        **************************************************************************
        .
        Completion time: 2008-06-07 10:30:00
        ComboFix-quarantined-files.txt 2008-06-07 07:29:35
        ComboFix2.txt 2008-06-06 17:40:29
        ComboFix3.txt 2008-06-05 21:14:45

        Pre-Run: 82,328,604,672 tavua vapaana
        Post-Run: 82,321,584,128 tavua vapaana

        117   --- E O F ---   2008-05-28 16:33:51

      • Vanha rouva
        Vanha rouva kirjoitti:

        Combofix tässä (ja HJT:N ajan seuraavaksi):

        ComboFix 08-06-05.3 - Omistaja 2008-06-07 10:13:14.4 - NTFSx86
        Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1035.18.152 [GMT 3:00]
        Running from: C:\Documents and Settings\Omistaja\Työpöytä\ComboFix2.exe
        * Resident AV is active

        .

        (((((((((((((((((((((((((((((((((((((( Muut poistot ))))))))))))))))))))))))))))))))))))))))))))))))))))))))
        .

        D:\Autorun.inf

        .
        ((((( Tiedostot, jotka on luotu seuraavalla aikavälillä: 2008-05-07 to 2008-06-07 )))))))))))))))))
        .

        2008-06-07 00:00 . 2008-06-07 00:00      d--------   C:\Documents and Settings\LocalService\Työpöytä
        2008-06-05 01:38 . 2008-03-25 02:37   69,632   --a------   C:\WINDOWS\system32\javacpl.cpl
        2008-06-05 00:20 . 2008-06-05 00:20      d--------   C:\Program Files\Malwarebytes' Anti-Malware
        2008-06-05 00:20 . 2008-06-05 00:20      d--------   C:\Documents and Settings\Omistaja\Application Data\Malwarebytes
        2008-06-05 00:20 . 2008-06-05 00:20      d--------   C:\Documents and Settings\All Users\Application Data\Malwarebytes
        2008-06-05 00:20 . 2008-05-30 01:06   34,296   --a------   C:\WINDOWS\system32\drivers\mbamcatchme.sys
        2008-06-05 00:20 . 2008-05-30 01:06   15,864   --a------   C:\WINDOWS\system32\drivers\mbam.sys
        2008-06-04 23:53 . 2008-06-04 23:53      d--------   C:\WINDOWS\ERUNT
        2008-06-03 23:25 . 2008-06-03 23:25      d--------   C:\Program Files\Sun
        2008-05-27 13:48 . 2008-05-27 13:49      d--------   C:\WINDOWS\system32\Artemis Fowl dir

        .
        (((((((((((((((((((((((((((((((((((( Find3M-raportti ))))))))))))))))))))))))))))))))))))))))))))))))))))))
        .
        2008-06-06 04:30   ---------   d---a-w   C:\Documents and Settings\All Users\Application Data\TEMP
        2008-06-04 22:38   ---------   d-----w   C:\Program Files\Java
        2008-05-27 10:48   202,240   ----a-w   C:\WINDOWS\system32\Artemis Fowl.scr
        2008-05-14 20:33   ---------   d-----w   C:\Documents and Settings\All Users\Application Data\Microsoft Help
        2008-04-27 14:13   ---------   d-----w   C:\Documents and Settings\Omistaja\Application Data\YAMAHA
        2008-04-27 14:08   ---------   d-----w   C:\Program Files\YAMAHA
        2008-04-27 14:08   ---------   d-----w   C:\Documents and Settings\All Users\Application Data\YAMAHA
        2008-04-21 17:16   ---------   d-----w   C:\Documents and Settings\All Users\Application Data\Musicnotes
        2008-04-21 17:09   ---------   d-----w   C:\Program Files\Musicnotes
        2008-03-25 04:51   621,344   ----a-w   C:\WINDOWS\system32\mswstr10.dll
        2008-03-25 04:51   166,688   ----a-w   C:\WINDOWS\system32\msjint40.dll
        2008-03-20 08:09   1,845,504   ----a-w   C:\WINDOWS\system32\win32k.sys
        2006-09-28 10:19   40,744   ----a-w   C:\Documents and Settings\Omistaja\Application Data\GDIPFONTCACHEV1.DAT
        .

        ((((((((((((((((((((((((((((( snapshot@2008-06-06_ 0.14.20.09 )))))))))))))))))))))))))))))))))))))))))
        .
        - 2008-06-05 20:49:25   2,048   --s-a-w   C:\WINDOWS\bootstat.dat
        2008-06-06 04:30:14   2,048   --s-a-w   C:\WINDOWS\bootstat.dat
        2008-06-06 04:30:32   16,384   ----atw   C:\WINDOWS\Temp\Perflib_Perfdata_818.dat
        .
        (((((((((((((((((((((((((((((( Rekisterin käynnistyskohteet )))))))))))))))))))))))))))))))))))))))))))))
        .
        .
        REGEDIT4
        *Huom* Tyhjiä arvoja ja laillisia oletusarvoja ei näytetä

        [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
        "F-Secure TNB"="C:\Program Files\F-Secure Internet Security\FSGUI\TNBUtil.exe" [2007-05-25 16:11 740208]
        "ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-09-15 02:12 15360]
        "BackupNotify"="c:\Program Files\HP\Digital Imaging\bin\backupnotify.exe" [2004-01-09 02:34 32768]
        "CTSyncU.exe"="C:\Program Files\Creative\Sync Manager Unicode\CTSyncU.exe" [2007-07-17 12:03 868352]
        "CreativeTaskScheduler"="C:\Program Files\Creative\Shared Files\CTSched.exe" [2006-11-17 04:42 53341]
        "Acme.PCHButton"="C:\PROGRA~1\HPPAVI~1\Pavilion\XPHWWBS4\plugin\bin\PCHButton.exe" [2004-01-01 12:18 159744]

        [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
        "NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2004-02-23 22:43 3026944]
        "F-Secure Manager"="C:\Program Files\F-Secure Internet Security\Common\FSM32.exe" [2007-05-25 16:12 183208]
        "F-Secure TNB"="C:\Program Files\F-Secure Internet Security\FSGUI\TNBUtil.exe" [2007-05-25 16:11 740208]
        "iTunesHelper"="C:\Program Files\iTunes\iTunesHelper.exe" [2007-08-15 20:15 271672]
        "SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_06\bin\jusched.exe" [2008-03-25 04:28 144784]

        [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
        "Picasa Media Detector"="C:\Program Files\Picasa2\PicasaMediaDetector.exe" [2007-09-28 04:17 443968]

        C:\Documents and Settings\Omistaja\K„ynnist„-valikko\Ohjelmat\K„ynnistys\
        OneNote 2007 -n„ytt”leikkeet ja Launcher.lnk - C:\Program Files\Microsoft Office\Office12\ONENOTEM.EXE [2006-10-26 20:24:54 98632]

        [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer]
        "NoResolveSearch"= 1 (0x1)

        [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
        "EnableFirewall"= 0 (0x0)

        [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
        "%windir%\\system32\\sessmgr.exe"=
        "C:\\Program Files\\iMesh\\Client\\iMeshClient.exe"=
        "C:\\Program Files\\Messenger\\msmsgs.exe"=
        "C:\\Program Files\\Google\\Google Talk\\googletalk.exe"=
        "C:\\Program Files\\Last.fm\\LastFM.exe"=
        "C:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE"=
        "C:\\Program Files\\Microsoft Office\\Office12\\GROOVE.EXE"=
        "C:\\Program Files\\Microsoft Office\\Office12\\ONENOTE.EXE"=
        "C:\\Program Files\\iTunes\\iTunes.exe"=
        "C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
        "C:\\Program Files\\Windows Live\\Messenger\\livecall.exe"=

        R0 FSFW;F-Secure Firewall Driver;C:\WINDOWS\system32\drivers\fsdfw.sys [2008-03-17 17:50]
        R0 sonyhcb;Sony Digital Imaging Base;C:\WINDOWS\system32\DRIVERS\sonyhcb.sys [2001-11-05 09:23]
        R1 F-Secure HIPS;F-Secure HIPS;C:\Program Files\F-Secure Internet Security\HIPS\fshs.sys [2008-02-13 18:14]
        R2 HDDlife HDD Access service;HDDlife HDD Access service;"C:\Program Files\Common Files\BinarySense\hldasvc.exe" [2007-08-09 14:23]
        R3 F-Secure Gatekeeper;F-Secure Gatekeeper;C:\Program Files\F-Secure Internet Security\Anti-Virus\minifilter\fsgk.sys [2007-05-25 16:08]
        S3 sonyhcs;Sony Digital Imaging Video;C:\WINDOWS\system32\DRIVERS\sonyhcs.sys [2001-11-05 09:23]
        S4 F-Secure Filter;F-Secure File System Filter;C:\Program Files\F-Secure Internet Security\Anti-Virus\Win2K\FSfilter.sys [2007-05-25 16:09]
        S4 F-Secure Recognizer;F-Secure File System Recognizer;C:\Program Files\F-Secure Internet Security\Anti-Virus\Win2K\FSrec.sys [2007-05-25 16:09]

        *Newly Created Service* - FSBL
        .
        'Ajoitetut tehtävät'-kansion sisältö
        "2008-05-19 11:16:03 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job"
        - C:\Program Files\Apple Software Update\SoftwareUpdate.exe
        "2008-06-07 00:33:32 C:\WINDOWS\Tasks\Scheduled scanning task.job"
        - C:\PROGRA~1\F-SECU~1\ANTI-V~1\fsav.exeQ /HARD /POLICY /SCHED /NOBREAK /REPORT=C:\PROGRA~1\F-SECU~1\ANTI-V~1\report.txt
        "2008-06-07 07:19:02 C:\WINDOWS\Tasks\Tarkistetaan Windows Live -työkalurivin päivitykset.job"
        - C:\Program Files\Windows Live Toolbar\MSNTBUP.EXE
        .
        **************************************************************************

        catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
        Rootkit scan 2008-06-07 10:18:48
        Windows 5.1.2600 Service Pack 2 NTFS

        scanning hidden processes ...

        scanning hidden autostart entries ...

        scanning hidden files ...

        scan completed successfully
        hidden files: 0

        **************************************************************************
        .
        Completion time: 2008-06-07 10:30:00
        ComboFix-quarantined-files.txt 2008-06-07 07:29:35
        ComboFix2.txt 2008-06-06 17:40:29
        ComboFix3.txt 2008-06-05 21:14:45

        Pre-Run: 82,328,604,672 tavua vapaana
        Post-Run: 82,321,584,128 tavua vapaana

        117   --- E O F ---   2008-05-28 16:33:51

        Tää HJT tuli nopeasti. Ole hyvä:


        Logfile of Trend Micro HijackThis v2.0.2
        Scan saved at 10:33:52, on 7.6.2008
        Platform: Windows XP SP2 (WinNT 5.01.2600)
        MSIE: Internet Explorer v7.00 (7.00.6000.16640)
        Boot mode: Normal

        Running processes:
        C:\WINDOWS\System32\smss.exe
        C:\WINDOWS\system32\winlogon.exe
        C:\WINDOWS\system32\services.exe
        C:\WINDOWS\system32\lsass.exe
        C:\WINDOWS\system32\svchost.exe
        C:\WINDOWS\System32\svchost.exe
        C:\WINDOWS\system32\svchost.exe
        C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
        C:\WINDOWS\system32\spoolsv.exe
        C:\Program Files\F-Secure Internet Security\Common\FSM32.EXE
        C:\Program Files\iTunes\iTunesHelper.exe
        C:\Program Files\Java\jre1.6.0_06\bin\jusched.exe
        C:\WINDOWS\system32\ctfmon.exe
        C:\Program Files\Creative\Sync Manager Unicode\CTSyncU.exe
        C:\Program Files\Creative\Shared Files\CTSched.exe
        C:\PROGRA~1\HPPAVI~1\Pavilion\XPHWWBS4\plugin\bin\PCHButton.exe
        C:\Program Files\Microsoft Office\Office12\ONENOTEM.EXE
        C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
        C:\WINDOWS\system32\CTsvcCDA.exe
        C:\Program Files\F-Secure Internet Security\Anti-Virus\fsgk32st.exe
        C:\Program Files\F-Secure Internet Security\Common\FSMA32.EXE
        C:\Program Files\F-Secure Internet Security\Anti-Virus\FSGK32.EXE
        C:\Program Files\Common Files\BinarySense\hldasvc.exe
        C:\Program Files\F-Secure Internet Security\Common\FSMB32.EXE
        C:\Program Files\Common Files\BinarySense\hldasvc.exe
        C:\WINDOWS\System32\nvsvc32.exe
        C:\WINDOWS\System32\svchost.exe
        C:\Program Files\F-Secure Internet Security\Common\FCH32.EXE
        C:\WINDOWS\system32\MsPMSPSv.exe
        C:\Program Files\F-Secure Internet Security\Common\FAMEH32.EXE
        C:\Program Files\F-Secure Internet Security\Anti-Virus\fsqh.exe
        C:\Program Files\F-Secure Internet Security\FSPC\fspc.exe
        C:\Program Files\F-Secure Internet Security\FSGUI\fsguidll.exe
        C:\Program Files\iPod\bin\iPodService.exe
        C:\Program Files\F-Secure Internet Security\Anti-Virus\fssm32.exe
        C:\Program Files\F-Secure Internet Security\FWES\Program\fsdfwd.exe
        C:\Program Files\F-Secure Internet Security\Anti-Virus\fsav32.exe
        C:\WINDOWS\Samsung\ComSMMgr\ssmmgr.exe
        C:\WINDOWS\explorer.exe
        C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

        R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.fi/
        R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
        R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
        R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iesearch&locale=FI_FI&c=Q304&bd=pavilion&pf=desktop
        R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
        R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Linkit
        O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\PROGRA~1\MICROS~2\Office12\GRA8E1~1.DLL
        O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_06\bin\ssv.dll
        O2 - BHO: Windows Liven kirjautumisapuohjelma - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
        O2 - BHO: (no name) - {AA58ED58-01DD-4d91-8333-CF10577473F7} - (no file)
        O2 - BHO: Windows Live Toolbar Helper - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
        O3 - Toolbar: HP-näkymä - {B2847E28-5D7D-4DEB-8B67-05D28BCF79F5} - c:\program files\hp\digital imaging\bin\hpdtlk02.dll
        O3 - Toolbar: (no name) - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - (no file)
        O3 - Toolbar: Windows Live Toolbar - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
        O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
        O4 - HKLM\..\Run: [F-Secure Manager] "C:\Program Files\F-Secure Internet Security\Common\FSM32.EXE" /splash
        O4 - HKLM\..\Run: [F-Secure TNB] "C:\Program Files\F-Secure Internet Security\FSGUI\TNBUtil.exe" /CHECKALL /WAITFORSW
        O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
        O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_06\bin\jusched.exe"
        O4 - HKCU\..\Run: [F-Secure TNB] "C:\Program Files\F-Secure Internet Security\FSGUI\TNBUtil.exe" /CHECKALL /WAITFORSW
        O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
        O4 - HKCU\..\Run: [BackupNotify] c:\Program Files\HP\Digital Imaging\bin\backupnotify.exe
        O4 - HKCU\..\Run: [CTSyncU.exe] "C:\Program Files\Creative\Sync Manager Unicode\CTSyncU.exe"
        O4 - HKCU\..\Run: [CreativeTaskScheduler] "C:\Program Files\Creative\Shared Files\CTSched.exe" /logon
        O4 - HKCU\..\Run: [Acme.PCHButton] C:\PROGRA~1\HPPAVI~1\Pavilion\XPHWWBS4\plugin\bin\PCHButton.exe
        O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Paikallinen palve')
        O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Verkkopalve')
        O4 - HKUS\S-1-5-18\..\Run: [Picasa Media Detector] C:\Program Files\Picasa2\PicasaMediaDetector.exe (User 'SYSTEM')
        O4 - HKUS\.DEFAULT\..\Run: [Picasa Media Detector] C:\Program Files\Picasa2\PicasaMediaDetector.exe (User 'Default user')
        O4 - Startup: OneNote 2007 -näyttöleikkeet ja Launcher.lnk = C:\Program Files\Microsoft Office\Office12\ONENOTEM.EXE
        O8 - Extra context menu item: &Google Search - res://C:\Program Files\Google\GoogleToolbar1.dll/cmsearch.html
        O8 - Extra context menu item: &Translate English Word - res://C:\Program Files\Google\GoogleToolbar1.dll/cmwordtrans.html
        O8 - Extra context menu item: &Windows Live Search - res://C:\Program Files\Windows Live Toolbar\msntb.dll/search.htm
        O8 - Extra context menu item: Backward Links - res://C:\Program Files\Google\GoogleToolbar1.dll/cmbacklinks.html
        O8 - Extra context menu item: Cached Snapshot of Page - res://C:\Program Files\Google\GoogleToolbar1.dll/cmcache.html
        O8 - Extra context menu item: Similar Pages - res://C:\Program Files\Google\GoogleToolbar1.dll/cmsimilar.html
        O8 - Extra context menu item: Translate Page into English - res://C:\Program Files\Google\GoogleToolbar1.dll/cmtrans.html
        O8 - Extra context menu item: V&ie Microsoft Exceliin - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
        O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_06\bin\ssv.dll
        O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_06\bin\ssv.dll
        O9 - Extra button: Lapsilukko... - {200DB664-75B5-47c0-8B45-A44ACCF73C00} - C:\Program Files\F-Secure Internet Security\FSPC\fspcmsie.dll
        O9 - Extra button: (no name) - {200DB664-75B5-47c0-8B45-A44ACCF73F01} - C:\Program Files\F-Secure Internet Security\FSPC\fspcmsie.dll
        O9 - Extra 'Tools' menuitem: Lapsilukko... - {200DB664-75B5-47c0-8B45-A44ACCF73F01} - C:\Program Files\F-Secure Internet Security\FSPC\fspcmsie.dll
        O9 - Extra button: (no name) - {200DB664-75B5-47c0-8B45-A44ACCF73F02} - C:\Program Files\F-Secure Internet Security\FSPC\fspcmsie.dll
        O9 - Extra 'Tools' menuitem: &Keskeytä Web-sivujen suodatus - {200DB664-75B5-47c0-8B45-A44ACCF73F02} - C:\Program Files\F-Secure Internet Security\FSPC\fspcmsie.dll
        O9 - Extra button: (no name) - {200DB664-75B5-47c0-8B45-A44ACCF73F03} - C:\Program Files\F-Secure Internet Security\FSPC\fspcmsie.dll
        O9 - Extra 'Tools' menuitem: &Kiellä tämä Web-sivusto - {200DB664-75B5-47c0-8B45-A44ACCF73F03} - C:\Program Files\F-Secure Internet Security\FSPC\fspcmsie.dll
        O9 - Extra button: (no name) - {200DB664-75B5-47c0-8B45-A44ACCF73F04} - C:\Program Files\F-Secure Internet Security\FSPC\fspcmsie.dll
        O9 - Extra 'Tools' menuitem: &Salli tämä Web-sivusto - {200DB664-75B5-47c0-8B45-A44ACCF73F04} - C:\Program Files\F-Secure Internet Security\FSPC\fspcmsie.dll
        O9 - Extra button: Lisää tämä blogiin - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
        O9 - Extra 'Tools' menuitem: &Lisää tämä blogiin tuotteessa Windows Live Writer - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
        O9 - Extra button: Lähetä OneNoteen - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
        O9 - Extra 'Tools' menuitem: Läh&etä OneNoteen - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
        O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
        O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
        O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
        O16 - DPF: {1239CC52-59EF-4DFA-8C61-90FFA846DF7E} (Musicnotes Viewer) - http://www.musicnotes.com/download/mnviewer.cab
        O16 - DPF: {20A60F0D-9AFA-4515-A0FD-83BD84642501} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab56986.cab
        O16 - DPF: {2917297F-F02B-4B9D-81DF-494B6333150B} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineSweeper.cab31267.cab
        O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://spaces.msn.com//PhotoUpload/MsnPUpld.cab
        O16 - DPF: {5C051655-FCD5-4969-9182-770EA5AA5565} (Solitaire Showdown Class) - http://messenger.zone.msn.com/binary/SolitaireShowdown.cab56986.cab
        O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsClient.cab31267.cab
        O16 - DPF: {A8F2B9BD-A6A0-486A-9744-18920D898429} (ScorchPlugin Class) - http://www.sibelius.com/download/software/win/ActiveXPlugin.cab
        O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/msnmessengersetupdownloader.cab
        O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (MSN Games - Installer) - http://messenger.zone.msn.com/binary/ZIntro.cab56649.cab
        O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
        O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
        O16 - DPF: {F58E1CEF-A068-4C15-BA5E-587CAF3EE8C6} (MSN Chat Control 4.5) - http://chat.msn.com/controls/msnchat45.cab
        O16 - DPF: {F5A7706B-B9C0-4C89-A715-7A0C6B05DD48} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineSweeper.cab56986.cab
        O16 - DPF: {F6ACF75C-C32C-447B-9BEF-46B766368D29} (Creative Software AutoUpdate Support Package) - http://www.creative.com/su2/CTL_V02002/ocx/15034/CTPID.cab
        O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\PROGRA~1\MICROS~2\Office12\GR99D3~1.DLL
        O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft AB - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
        O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
        O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\system32\CTsvcCDA.exe
        O23 - Service: F-Secure Gatekeeper Handler Starter - F-Secure Corporation - C:\Program Files\F-Secure Internet Security\Anti-Virus\fsgk32st.exe
        O23 - Service: F-Secure Automatic Update Agent (FSAUA) - F-Secure Corporation - C:\Program Files\F-Secure Internet Security\FSAUA\program\fsaua.exe
        O23 - Service: F-Secure Anti-Virus Firewall Daemon (FSDFWD) - F-Secure Corporation - C:\Program Files\F-Secure Internet Security\FWES\Program\fsdfwd.exe
        O23 - Service: FSMA - F-Secure Corporation - C:\Program Files\F-Secure Internet Security\Common\FSMA32.EXE
        O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
        O23 - Service: HDDlife HDD Access service - BinarySense, Inc. - C:\Program Files\Common Files\BinarySense\hldasvc.exe
        O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
        O23 - Service: iPod-palvelu (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
        O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe

        --
        End of file - 12566 bytes

      • FixFix
        Vanha rouva kirjoitti:

        Tää HJT tuli nopeasti. Ole hyvä:


        Logfile of Trend Micro HijackThis v2.0.2
        Scan saved at 10:33:52, on 7.6.2008
        Platform: Windows XP SP2 (WinNT 5.01.2600)
        MSIE: Internet Explorer v7.00 (7.00.6000.16640)
        Boot mode: Normal

        Running processes:
        C:\WINDOWS\System32\smss.exe
        C:\WINDOWS\system32\winlogon.exe
        C:\WINDOWS\system32\services.exe
        C:\WINDOWS\system32\lsass.exe
        C:\WINDOWS\system32\svchost.exe
        C:\WINDOWS\System32\svchost.exe
        C:\WINDOWS\system32\svchost.exe
        C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
        C:\WINDOWS\system32\spoolsv.exe
        C:\Program Files\F-Secure Internet Security\Common\FSM32.EXE
        C:\Program Files\iTunes\iTunesHelper.exe
        C:\Program Files\Java\jre1.6.0_06\bin\jusched.exe
        C:\WINDOWS\system32\ctfmon.exe
        C:\Program Files\Creative\Sync Manager Unicode\CTSyncU.exe
        C:\Program Files\Creative\Shared Files\CTSched.exe
        C:\PROGRA~1\HPPAVI~1\Pavilion\XPHWWBS4\plugin\bin\PCHButton.exe
        C:\Program Files\Microsoft Office\Office12\ONENOTEM.EXE
        C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
        C:\WINDOWS\system32\CTsvcCDA.exe
        C:\Program Files\F-Secure Internet Security\Anti-Virus\fsgk32st.exe
        C:\Program Files\F-Secure Internet Security\Common\FSMA32.EXE
        C:\Program Files\F-Secure Internet Security\Anti-Virus\FSGK32.EXE
        C:\Program Files\Common Files\BinarySense\hldasvc.exe
        C:\Program Files\F-Secure Internet Security\Common\FSMB32.EXE
        C:\Program Files\Common Files\BinarySense\hldasvc.exe
        C:\WINDOWS\System32\nvsvc32.exe
        C:\WINDOWS\System32\svchost.exe
        C:\Program Files\F-Secure Internet Security\Common\FCH32.EXE
        C:\WINDOWS\system32\MsPMSPSv.exe
        C:\Program Files\F-Secure Internet Security\Common\FAMEH32.EXE
        C:\Program Files\F-Secure Internet Security\Anti-Virus\fsqh.exe
        C:\Program Files\F-Secure Internet Security\FSPC\fspc.exe
        C:\Program Files\F-Secure Internet Security\FSGUI\fsguidll.exe
        C:\Program Files\iPod\bin\iPodService.exe
        C:\Program Files\F-Secure Internet Security\Anti-Virus\fssm32.exe
        C:\Program Files\F-Secure Internet Security\FWES\Program\fsdfwd.exe
        C:\Program Files\F-Secure Internet Security\Anti-Virus\fsav32.exe
        C:\WINDOWS\Samsung\ComSMMgr\ssmmgr.exe
        C:\WINDOWS\explorer.exe
        C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

        R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.fi/
        R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
        R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
        R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iesearch&locale=FI_FI&c=Q304&bd=pavilion&pf=desktop
        R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
        R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Linkit
        O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\PROGRA~1\MICROS~2\Office12\GRA8E1~1.DLL
        O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_06\bin\ssv.dll
        O2 - BHO: Windows Liven kirjautumisapuohjelma - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
        O2 - BHO: (no name) - {AA58ED58-01DD-4d91-8333-CF10577473F7} - (no file)
        O2 - BHO: Windows Live Toolbar Helper - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
        O3 - Toolbar: HP-näkymä - {B2847E28-5D7D-4DEB-8B67-05D28BCF79F5} - c:\program files\hp\digital imaging\bin\hpdtlk02.dll
        O3 - Toolbar: (no name) - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - (no file)
        O3 - Toolbar: Windows Live Toolbar - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
        O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
        O4 - HKLM\..\Run: [F-Secure Manager] "C:\Program Files\F-Secure Internet Security\Common\FSM32.EXE" /splash
        O4 - HKLM\..\Run: [F-Secure TNB] "C:\Program Files\F-Secure Internet Security\FSGUI\TNBUtil.exe" /CHECKALL /WAITFORSW
        O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
        O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_06\bin\jusched.exe"
        O4 - HKCU\..\Run: [F-Secure TNB] "C:\Program Files\F-Secure Internet Security\FSGUI\TNBUtil.exe" /CHECKALL /WAITFORSW
        O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
        O4 - HKCU\..\Run: [BackupNotify] c:\Program Files\HP\Digital Imaging\bin\backupnotify.exe
        O4 - HKCU\..\Run: [CTSyncU.exe] "C:\Program Files\Creative\Sync Manager Unicode\CTSyncU.exe"
        O4 - HKCU\..\Run: [CreativeTaskScheduler] "C:\Program Files\Creative\Shared Files\CTSched.exe" /logon
        O4 - HKCU\..\Run: [Acme.PCHButton] C:\PROGRA~1\HPPAVI~1\Pavilion\XPHWWBS4\plugin\bin\PCHButton.exe
        O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Paikallinen palve')
        O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Verkkopalve')
        O4 - HKUS\S-1-5-18\..\Run: [Picasa Media Detector] C:\Program Files\Picasa2\PicasaMediaDetector.exe (User 'SYSTEM')
        O4 - HKUS\.DEFAULT\..\Run: [Picasa Media Detector] C:\Program Files\Picasa2\PicasaMediaDetector.exe (User 'Default user')
        O4 - Startup: OneNote 2007 -näyttöleikkeet ja Launcher.lnk = C:\Program Files\Microsoft Office\Office12\ONENOTEM.EXE
        O8 - Extra context menu item: &Google Search - res://C:\Program Files\Google\GoogleToolbar1.dll/cmsearch.html
        O8 - Extra context menu item: &Translate English Word - res://C:\Program Files\Google\GoogleToolbar1.dll/cmwordtrans.html
        O8 - Extra context menu item: &Windows Live Search - res://C:\Program Files\Windows Live Toolbar\msntb.dll/search.htm
        O8 - Extra context menu item: Backward Links - res://C:\Program Files\Google\GoogleToolbar1.dll/cmbacklinks.html
        O8 - Extra context menu item: Cached Snapshot of Page - res://C:\Program Files\Google\GoogleToolbar1.dll/cmcache.html
        O8 - Extra context menu item: Similar Pages - res://C:\Program Files\Google\GoogleToolbar1.dll/cmsimilar.html
        O8 - Extra context menu item: Translate Page into English - res://C:\Program Files\Google\GoogleToolbar1.dll/cmtrans.html
        O8 - Extra context menu item: V&ie Microsoft Exceliin - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
        O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_06\bin\ssv.dll
        O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_06\bin\ssv.dll
        O9 - Extra button: Lapsilukko... - {200DB664-75B5-47c0-8B45-A44ACCF73C00} - C:\Program Files\F-Secure Internet Security\FSPC\fspcmsie.dll
        O9 - Extra button: (no name) - {200DB664-75B5-47c0-8B45-A44ACCF73F01} - C:\Program Files\F-Secure Internet Security\FSPC\fspcmsie.dll
        O9 - Extra 'Tools' menuitem: Lapsilukko... - {200DB664-75B5-47c0-8B45-A44ACCF73F01} - C:\Program Files\F-Secure Internet Security\FSPC\fspcmsie.dll
        O9 - Extra button: (no name) - {200DB664-75B5-47c0-8B45-A44ACCF73F02} - C:\Program Files\F-Secure Internet Security\FSPC\fspcmsie.dll
        O9 - Extra 'Tools' menuitem: &Keskeytä Web-sivujen suodatus - {200DB664-75B5-47c0-8B45-A44ACCF73F02} - C:\Program Files\F-Secure Internet Security\FSPC\fspcmsie.dll
        O9 - Extra button: (no name) - {200DB664-75B5-47c0-8B45-A44ACCF73F03} - C:\Program Files\F-Secure Internet Security\FSPC\fspcmsie.dll
        O9 - Extra 'Tools' menuitem: &Kiellä tämä Web-sivusto - {200DB664-75B5-47c0-8B45-A44ACCF73F03} - C:\Program Files\F-Secure Internet Security\FSPC\fspcmsie.dll
        O9 - Extra button: (no name) - {200DB664-75B5-47c0-8B45-A44ACCF73F04} - C:\Program Files\F-Secure Internet Security\FSPC\fspcmsie.dll
        O9 - Extra 'Tools' menuitem: &Salli tämä Web-sivusto - {200DB664-75B5-47c0-8B45-A44ACCF73F04} - C:\Program Files\F-Secure Internet Security\FSPC\fspcmsie.dll
        O9 - Extra button: Lisää tämä blogiin - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
        O9 - Extra 'Tools' menuitem: &Lisää tämä blogiin tuotteessa Windows Live Writer - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
        O9 - Extra button: Lähetä OneNoteen - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
        O9 - Extra 'Tools' menuitem: Läh&etä OneNoteen - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
        O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
        O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
        O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
        O16 - DPF: {1239CC52-59EF-4DFA-8C61-90FFA846DF7E} (Musicnotes Viewer) - http://www.musicnotes.com/download/mnviewer.cab
        O16 - DPF: {20A60F0D-9AFA-4515-A0FD-83BD84642501} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab56986.cab
        O16 - DPF: {2917297F-F02B-4B9D-81DF-494B6333150B} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineSweeper.cab31267.cab
        O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://spaces.msn.com//PhotoUpload/MsnPUpld.cab
        O16 - DPF: {5C051655-FCD5-4969-9182-770EA5AA5565} (Solitaire Showdown Class) - http://messenger.zone.msn.com/binary/SolitaireShowdown.cab56986.cab
        O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsClient.cab31267.cab
        O16 - DPF: {A8F2B9BD-A6A0-486A-9744-18920D898429} (ScorchPlugin Class) - http://www.sibelius.com/download/software/win/ActiveXPlugin.cab
        O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/msnmessengersetupdownloader.cab
        O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (MSN Games - Installer) - http://messenger.zone.msn.com/binary/ZIntro.cab56649.cab
        O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
        O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
        O16 - DPF: {F58E1CEF-A068-4C15-BA5E-587CAF3EE8C6} (MSN Chat Control 4.5) - http://chat.msn.com/controls/msnchat45.cab
        O16 - DPF: {F5A7706B-B9C0-4C89-A715-7A0C6B05DD48} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineSweeper.cab56986.cab
        O16 - DPF: {F6ACF75C-C32C-447B-9BEF-46B766368D29} (Creative Software AutoUpdate Support Package) - http://www.creative.com/su2/CTL_V02002/ocx/15034/CTPID.cab
        O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\PROGRA~1\MICROS~2\Office12\GR99D3~1.DLL
        O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft AB - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
        O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
        O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\system32\CTsvcCDA.exe
        O23 - Service: F-Secure Gatekeeper Handler Starter - F-Secure Corporation - C:\Program Files\F-Secure Internet Security\Anti-Virus\fsgk32st.exe
        O23 - Service: F-Secure Automatic Update Agent (FSAUA) - F-Secure Corporation - C:\Program Files\F-Secure Internet Security\FSAUA\program\fsaua.exe
        O23 - Service: F-Secure Anti-Virus Firewall Daemon (FSDFWD) - F-Secure Corporation - C:\Program Files\F-Secure Internet Security\FWES\Program\fsdfwd.exe
        O23 - Service: FSMA - F-Secure Corporation - C:\Program Files\F-Secure Internet Security\Common\FSMA32.EXE
        O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
        O23 - Service: HDDlife HDD Access service - BinarySense, Inc. - C:\Program Files\Common Files\BinarySense\hldasvc.exe
        O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
        O23 - Service: iPod-palvelu (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
        O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe

        --
        End of file - 12566 bytes

        scannaa hjt:llä merkkaa paina Fix checked

        O2 - BHO: (no name) - {AA58ED58-01DD-4d91-8333-CF10577473F7} - (no file)
        O3 - Toolbar: (no name) - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - (no file)

        ******

        1. Klikkaa käynnistä > Oma tietokone oikean puoleisella hiiren napilla
        2. Valitse ominaisuudet
        3. Valitse järjestelmän palauttaminen välilehti
        4. Ruksi eteen ¤ poista järjestelmän palauttaminen kaikissa asemissa
        5. Paina Käytä
        6. Paina ok
        7. Sammuta ja käynnistä
        8. Ota ruksi pois ¤ poista järjestelmän palauttaminen kaikissa asemissa
        9. Käytä ja OK


        ================

        Sitten ei muuta kuin hyvää päivän jatkoa

      • Vanha rouva
        FixFix kirjoitti:

        scannaa hjt:llä merkkaa paina Fix checked

        O2 - BHO: (no name) - {AA58ED58-01DD-4d91-8333-CF10577473F7} - (no file)
        O3 - Toolbar: (no name) - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - (no file)

        ******

        1. Klikkaa käynnistä > Oma tietokone oikean puoleisella hiiren napilla
        2. Valitse ominaisuudet
        3. Valitse järjestelmän palauttaminen välilehti
        4. Ruksi eteen ¤ poista järjestelmän palauttaminen kaikissa asemissa
        5. Paina Käytä
        6. Paina ok
        7. Sammuta ja käynnistä
        8. Ota ruksi pois ¤ poista järjestelmän palauttaminen kaikissa asemissa
        9. Käytä ja OK


        ================

        Sitten ei muuta kuin hyvää päivän jatkoa

        Tehty tuo viimeinenkin juttu. En yhtään tiedä, mitä olen koko aikana tehnyt ;-), mutta jos olen sinun avullasi ja neuvoillasi saanut koneeni putsattua, niin suuret kiitokset sinulle ja myös .....:lle.Hienoa, että on olemassa ihmisiä, jotka neuvovat ja auttavat muita.

        Hyvät päivän jatkot myös sinulle!

    Ketjusta on poistettu 0 sääntöjenvastaista viestiä.

    Takaisin ylös

    Luetuimmat keskustelut

    1. Kotkalainen Demari Riku Pirinen vangittu Saksassa lapsipornosta

      https://www.kymensanomat.fi/paikalliset/8081054 Kotkalainen Demari Riku Pirinen vangittu Saksassa lapsipornon hallussapi
      Kotka
      128
      3170

    2. Vanhalle ukon rähjälle

      Satutit mua niin paljon kun erottiin. Oletko todella niin itsekäs että kuvittelet että huolisin sut kaiken tapahtuneen
      Ikävä
      38
      2523

    3. Olen tosi outo....

      Päättelen palstajuttujen perusteella mitä mieltä minun kaipauksen kohde minusta on. Joskus kuvittelen tänne selkeitä tap
      Ikävä
      30
      2435

    4. Maisa on SALAKUVATTU huumepoliisinsa kanssa!

      https://www.seiska.fi/vain-seiskassa/ensimmainen-yhteiskuva-maisa-torpan-ja-poliisikullan-lahiorakkaus-roihuaa/1525663
      Kotimaiset julkkisjuorut
      113
      2198

    5. Oletko sä luovuttanut

      Mun suhteeni
      Ikävä
      114
      1700

    6. Nurmossa kuoli 2 Lasta..

      Autokolarissa. Näin kertovat iltapäivälehdet juuri nyt. 22.11. Ja aina ennen Joulua näitä tulee. . .
      Seinäjoki
      27
      1468

    7. Hommaatko kinkkua jouluksi?

      Itse tein pakastimeen n. 3Kg:n murekkeen sienillä ja juustokuorrutuksella. Voihan se olla, että jonkun pienen, valmiin k
      Sinkut
      173
      1410

    8. Mikko Koivu yrittää pestä mustan valkoiseksi

      Ilmeisesti huomannut, että Helenan tukijoukot kasvaa kasvamistaan. Riistakamera paljasti hiljattain kylmän totuuden Mi
      Kotimaiset julkkisjuorut
      291
      1277

    9. Aatteleppa ite!

      Jos ei oltaisikaan nyt NATOssa, olisimme puolueettomana sivustakatsojia ja elelisimme tyytyväisenä rauhassa maassamme.
      Maailman menoa
      292
      1248

    10. Onko se ikä

      Alkanut haitata?
      Ikävä
      63
      1090
    Aihe
    TietosuojaselosteKäyttöehdotEvästeasetuksetSäännöt