Apua, taaskaan en ossaa:)

Lonti x 2

2008-06-06 08:22:05

Tässä olis taas pikku mesevirus ongelma..
Tällanen tuli hjt:llä scannatessa.
Voisitko vähän auttaa meitä?

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 8:09:58, on 6.6.2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16640)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
C:\WINDOWS\System32\wltrysvc.exe
C:\WINDOWS\System32\bcmwltry.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\acs.exe
C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
C:\Program Files\Norton AntiVirus\navapsvc.exe
C:\Program Files\Norton AntiVirus\IWP\NPFMntor.exe
C:\Program Files\CyberLink\Shared Files\RichVideo.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Program Files\Atheros\ACU.exe
C:\WINDOWS\system32\WLTRAY.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\WINDOWS\system32\igfxtray.exe
C:\WINDOWS\system32\hkcmd.exe
C:\Program Files\Launch Manager\LaunchAp.exe
C:\Program Files\Launch Manager\PowerKey.exe
C:\Program Files\Launch Manager\HotkeyApp.exe
C:\Program Files\Launch Manager\OSDCtrl.exe
C:\Program Files\Launch Manager\Wbutton.exe
C:\acer\epm\epm-dm.exe
C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe
C:\Program Files\Winamp\winampa.exe
C:\PROGRA~1\AVG\AVG8\avgtray.exe
C:\WINDOWS\system32\rundll32.exe
C:\WINDOWS\system32\ctfmon.exe
C:\PROGRA~1\AVG\AVG8\avgrsx.exe
C:\Program Files\MSN Messenger\MsnMsgr.Exe
C:\Program Files\Winamp Remote\bin\OrbTray.exe
C:\Program Files\Logitech\SetPoint\SetPoint.exe
C:\PROGRA~1\AVG\AVG8\avgemc.exe
C:\Program Files\Common Files\Logitech\KhalShared\KHALMNPR.EXE
C:\Program Files\Common Files\Symantec Shared\Security Console\NSCSRVCE.EXE
C:\Program Files\Winamp Remote\bin\Orb.exe
C:\Program Files\Mobile Partner\Mobile Partner.exe
C:\Program Files\Internet Explorer\iexplore.exe
c:\program files\winamp toolbar\WinampTbServer.exe
C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLLoginProxy.exe
C:\Program Files\Java\jre1.6.0_02\bin\jucheck.exe
C:\Program Files\Norton AntiVirus\NAVW32.EXE
C:\Program Files\WinRAR\WinRAR.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.superjymy.fi/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
O2 - BHO: (no name) - {06E12C36-760F-4D92-8509-5E5DBF12C423} - C:\WINDOWS\system32\jkkHYpmk.dll (file missing)
O2 - BHO: (no name) - {0EF680CB-95FA-48FE-8F8A-DE63F6C0FE36} - C:\WINDOWS\system32\fccCuVLB.dll (file missing)
O2 - BHO: {675505c6-d999-512b-0884-afefac927545} - {545729ca-fefa-4880-b215-999d6c505576} - C:\WINDOWS\system32\gqumnkfx.dll
O2 - BHO: (no name) - {5688C5C9-D3C7-485D-8CCA-C22720538FF2} - C:\WINDOWS\system32\efcBqnli.dll (file missing)
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: AVG Security Toolbar - {A057A204-BACC-4D26-9990-79A187E2698E} - C:\PROGRA~1\AVG\AVG8\AVGTOO~1.DLL
O2 - BHO: NAV Helper - {A8F38D8D-E480-4D52-B7A2-731BB6995FDD} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: Norton AntiVirus - {C4069E3A-68F1-403E-B40E-20066696354B} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: Winamp Toolbar - {EBF2BA02-9094-4c5a-858B-BB198F3D8DE2} - C:\Program Files\Winamp Toolbar\winamptb.dll
O3 - Toolbar: AVG Security Toolbar - {A057A204-BACC-4D26-9990-79A187E2698E} - C:\PROGRA~1\AVG\AVG8\AVGTOO~1.DLL
O4 - HKLM\..\Run: [SynTPLpr] C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [ACU] "C:\Program Files\Atheros\ACU.exe" -nogui
O4 - HKLM\..\Run: [Broadcom Wireless Manager UI] C:\WINDOWS\system32\WLTRAY
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [LaunchAp] "C:\Program Files\Launch Manager\LaunchAp.exe"
O4 - HKLM\..\Run: [PowerKey] "C:\Program Files\Launch Manager\PowerKey.exe"
O4 - HKLM\..\Run: [LManager] "C:\Program Files\Launch Manager\HotkeyApp.exe"
O4 - HKLM\..\Run: [CtrlVol] "C:\Program Files\Launch Manager\CtrlVol.exe"
O4 - HKLM\..\Run: [LMgrOSD] "C:\Program Files\Launch Manager\OSDCtrl.exe"
O4 - HKLM\..\Run: [Wbutton] "C:\Program Files\Launch Manager\Wbutton.exe"
O4 - HKLM\..\Run: [EPM-DM] c:\acer\epm\epm-dm.exe
O4 - HKLM\..\Run: [ePowerManagement] C:\Acer\ePM\ePM.exe boot
O4 - HKLM\..\Run: [RemoteControl] "C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe"
O4 - HKLM\..\Run: [LanguageShortcut] "C:\Program Files\CyberLink\PowerDVD\Language\Language.exe"
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [Kernel and Hardware Abstraction Layer] KHALMNPR.EXE
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe"
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [WinampAgent] C:\Program Files\Winamp\winampa.exe
O4 - HKLM\..\Run: [Windows UDP Control] winudspm.exe
O4 - HKLM\..\Run: [Windows svchost] service.exe
O4 - HKLM\..\Run: [AVG8_TRAY] C:\PROGRA~1\AVG\AVG8\avgtray.exe
O4 - HKLM\..\Run: [MSN] C:\Windows\mservice.exe
O4 - HKLM\..\Run: [BM5babca48] Rundll32.exe "C:\WINDOWS\system32\svjrieii.dll",s
O4 - HKLM\..\Run: [5898f9d4] rundll32.exe "C:\WINDOWS\system32\uukltwhg.dll",b
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [Orb] "C:\Program Files\Winamp Remote\bin\OrbTray.exe" /background
O4 - Global Startup: Logitech SetPoint.lnk = C:\Program Files\Logitech\SetPoint\SetPoint.exe
O8 - Extra context menu item: &Winamp Toolbar Search - C:\Documents and Settings\All Users\Application Data\Winamp Toolbar\ieToolbar\resources\en-US\local\search.html
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {5C6698D9-7BE4-4122-8EC5-291D84DBD4A0} (Facebook Photo Uploader 4 Control) - http://upload.facebook.com/controls/FacebookPhotoUploader3.cab
O16 - DPF: {5F8469B4-B055-49DD-83F7-62B522420ECC} (Facebook Photo Uploader Control) - http://upload.facebook.com/controls/FacebookPhotoUploader.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{DBF43578-B928-4311-B8C4-6447CCE77FA1}: NameServer = 217.78.192.22 217.78.192.78
O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG8\avgpp.dll
O20 - AppInit_DLLs: avgrsstx.dll
O20 - Winlogon Notify: jkkHYpmk - jkkHYpmk.dll (file missing)
O23 - Service: Atheros Configuration Service (ACS) - Unknown owner - C:\WINDOWS\system32\acs.exe
O23 - Service: Automattinen LiveUpdate-ajastustoiminto - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
O23 - Service: AVG8 E-mail Scanner (avg8emc) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgemc.exe
O23 - Service: AVG8 WatchDog (avg8wd) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
O23 - Service: Norton AntiVirus Auto-Protect -palvelu (navapsvc) - Symantec Corporation - C:\Program Files\Norton AntiVirus\navapsvc.exe
O23 - Service: Norton AntiVirus Firewall Monitor Service (NPFMntor) - Symantec Corporation - C:\Program Files\Norton AntiVirus\IWP\NPFMntor.exe
O23 - Service: Norton Protection Center Service (NSCService) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\Security Console\NSCSRVCE.EXE
O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - C:\Program Files\CyberLink\Shared Files\RichVideo.exe
O23 - Service: Symantec AVScan (SAVScan) - Symantec Corporation - C:\Program Files\Norton AntiVirus\SAVScan.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: SPBBCSvc - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
O23 - Service: Broadcom Wireless LAN Tray Service (wltrysvc) - Unknown owner - C:\WINDOWS\System32\wltrysvc.exe

--
End of file - 10476 bytes

213

Äänestä

Vastaukset

FixFix
2008-06-06 14:47:04
tällä

1.Lataa combofix.exe työpöydällesi yhdestä, kahdesta klinkistä:
http://download.bleepingcomputer.com/sUBs/ComboFix.exe
http://subs.geekstogo.com/ComboFix.exe

2. Tuplaklikkaa combofix.exe tiedostoa ja seuraa ohjeistuksia.
3. Kun työkalu on valmis, se tuottaa lokin. Lähetä tämä loki viesti ketjuusi.
Huom! Älä klikkaile combofixin ikkunaa käytön aikana. Tämä saattaa aiheuttaa ohjelman jumiutumisen.

*****

laita tuon combofix raportti
scannaa uusi hjt:n loki tuon jälkeen
- lonti x 2
  2008-06-06 15:21:01
  Tämmönen..
  
  ComboFix 08-06-05.3 - Jenna 2008-06-06 15:10:00.2 - NTFSx86
  Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1033.18.548 [GMT 3:00]
  Running from: C:\Documents and Settings\Jenna\Desktop\ComboFix.exe
  
  [color=red][b]WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !![/b][/color]
  .
  
  ((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
  .
  
  C:\f.exe
  .
  ---- Previous Run -------
  .
  C:\bot.exe
  C:\WINDOWS\BM5babca48.xml
  C:\WINDOWS\cookies.ini
  C:\WINDOWS\pskt.ini
  C:\WINDOWS\service.exe
  C:\WINDOWS\system32\amxxfunh.ini
  C:\WINDOWS\system32\BLVuCccf.ini
  C:\WINDOWS\system32\BLVuCccf.ini2
  C:\WINDOWS\system32\firmdfmg.ini
  C:\WINDOWS\system32\ghwtlkuu.ini
  C:\WINDOWS\system32\ilnqBcfe.ini
  C:\WINDOWS\system32\ilnqBcfe.ini2
  C:\WINDOWS\system32\jvbtgwcb.dll
  C:\WINDOWS\system32\lebnoxio.ini
  C:\WINDOWS\system32\mcrh.tmp
  C:\WINDOWS\system32\msjhhrpl.dll
  C:\WINDOWS\system32\suhpxtpv.ini
  C:\WINDOWS\system32\xoofints.ini
  C:\WINDOWS\system32\yfqyxafb.ini
  C:\WINDOWS\system32\ygrdfasu.ini
  
  .
  ((((((((((((((((((((((((( Files Created from 2008-05-06 to 2008-06-06 )))))))))))))))))))))))))))))))
  .
  
  2008-06-06 15:02 . 2008-06-06 15:10   354   ---hs----   C:\WINDOWS\system32\ghwtlkuu.ini
  2008-06-06 08:09 . 2008-06-06 08:09   396,288   --a------   C:\Program Files\HijackThis.exe
  2008-06-06 00:24 . 2008-06-06 00:24   49,156   --a------   C:\fs.exe
  2008-06-06 00:20 . 2008-06-06 00:26   117,248   --a------   C:\WINDOWS\system32\uukltwhg.dll
  2008-06-06 00:15 . 2008-06-06 00:17   4,217   --a------   C:\Documents and Settings\Jenna\f.exe
  2008-06-05 23:18 . 2008-06-05 23:28   133,120   --a------   C:\WINDOWS\system32\gqumnkfx.dll
  2008-06-04 22:00 . 2008-06-04 22:00   86,528   --a------   C:\Documents and Settings\Jenna\stp.exe
  2008-06-04 21:14 . 2008-06-04 21:14   3,424   --a------   C:\is155400.exe
  2008-06-03 18:36 . 2008-06-03 18:36   86,548   --a------   C:\Documents and Settings\Jenna\setupa.exe
  2008-06-03 16:43 . 2008-06-03 19:54   4,217   --a------   C:\WINDOWS\is154890.exe
  2008-06-03 16:24 . 2008-06-03 16:43      d--------   C:\Documents and Settings\Jenna\Contacts
  2008-06-02 22:33 . 2008-06-03 18:18   96,950   --a------   C:\Documents and Settings\Jenna\setup.exe
  2008-06-02 22:29 . 2008-06-02 22:29   97,116   --a------   C:\WINDOWS\DC5177176.zip
  2008-06-02 00:21 . 2008-06-06 14:57      d--h-----   C:\$AVG8.VAULT$
  2008-06-01 23:51 . 2008-06-05 17:25      d--------   C:\WINDOWS\system32\drivers\Avg
  2008-06-01 23:51 . 2008-06-01 23:51      d--------   C:\Documents and Settings\Jenna\Application Data\AVGTOOLBAR
  2008-06-01 23:51 . 2008-06-01 23:51   96,520   --a------   C:\WINDOWS\system32\drivers\avgldx86.sys
  2008-06-01 23:51 . 2008-06-01 23:51   75,272   --a------   C:\WINDOWS\system32\drivers\avgtdix.sys
  2008-06-01 23:51 . 2008-06-01 23:51   10,520   --a------   C:\WINDOWS\system32\avgrsstx.dll
  2008-06-01 23:50 . 2008-06-01 23:50      d--------   C:\Program Files\AVG
  2008-06-01 23:50 . 2008-06-01 23:50      d--------   C:\Documents and Settings\All Users\Application Data\avg8
  2008-06-01 23:49 . 2008-06-02 10:14      d--------   C:\WINDOWS\SxsCaPendDel
  
  .
  (((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
  .
  2008-06-06 10:40   ---------   d-----w   C:\Documents and Settings\Jenna\Application Data\LimeWire
  2008-06-06 05:09   10,478   ----a-w   C:\Program Files\hijackthis.log
  2008-06-05 14:12   ---------   d-----w   C:\Program Files\Common Files\Symantec Shared
  2008-06-05 13:55   ---------   d-----w   C:\Documents and Settings\All Users\Application Data\OrbNetworks
  2008-06-03 20:24   86,548   ----a-w   C:\WINDOWS\Fonts\setupa.exe
  2008-06-01 14:26   ---------   d-----w   C:\Program Files\Winamp Remote
  2008-03-27 08:12   151,583   ----a-w   C:\WINDOWS\system32\msjint40.dll
  2008-03-19 09:47   1,845,248   ----a-w   C:\WINDOWS\system32\win32k.sys
  .
  
  ((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
  .
  .
  *Note* empty entries & legit default entries are not shown
  REGEDIT4
  
  [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{0EF680CB-95FA-48FE-8F8A-DE63F6C0FE36}]
           C:\WINDOWS\system32\fccCuVLB.dll
  
  [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{545729ca-fefa-4880-b215-999d6c505576}]
  2008-06-05 23:28   133120   --a------   C:\WINDOWS\system32\gqumnkfx.dll
  
  [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{5688C5C9-D3C7-485D-8CCA-C22720538FF2}]
           C:\WINDOWS\system32\efcBqnli.dll
  
  [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{A057A204-BACC-4D26-9990-79A187E2698E}]
  2008-06-01 23:51   2050816   --a------   C:\PROGRA~1\AVG\AVG8\AVGTOO~1.DLL
  
  [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
  "{EBF2BA02-9094-4C5A-858B-BB198F3D8DE2}"= "C:\Program Files\Winamp Toolbar\winamptb.dll" [2007-12-13 19:49 1185120]
  "{A057A204-BACC-4D26-9990-79A187E2698E}"= "C:\PROGRA~1\AVG\AVG8\AVGTOO~1.DLL" [2008-06-01 23:51 2050816]
  
  [HKEY_CLASSES_ROOT\clsid\{ebf2ba02-9094-4c5a-858b-bb198f3d8de2}]
  [HKEY_CLASSES_ROOT\WINAMPTB.AOLToolBand.1]
  [HKEY_CLASSES_ROOT\TypeLib\{538CD77C-BFDD-49b0-9562-77419CAB89D1}]
  [HKEY_CLASSES_ROOT\WINAMPTB.AOLToolBand]
  
  [HKEY_CLASSES_ROOT\clsid\{a057a204-bacc-4d26-9990-79a187e2698e}]
  [HKEY_CLASSES_ROOT\avgtoolbar.AVGTOOLBAR]
  
  [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser]
  "{EBF2BA02-9094-4C5A-858B-BB198F3D8DE2}"= C:\Program Files\Winamp Toolbar\winamptb.dll [2007-12-13 19:49 1185120]
  
  [HKEY_CLASSES_ROOT\clsid\{ebf2ba02-9094-4c5a-858b-bb198f3d8de2}]
  [HKEY_CLASSES_ROOT\WINAMPTB.AOLToolBand.1]
  [HKEY_CLASSES_ROOT\TypeLib\{538CD77C-BFDD-49b0-9562-77419CAB89D1}]
  [HKEY_CLASSES_ROOT\WINAMPTB.AOLToolBand]
  
  [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
  "ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 15:00 15360]
  "MsnMsgr"="C:\Program Files\MSN Messenger\MsnMsgr.exe" [2007-01-19 12:55 5674352]
  "Orb"="C:\Program Files\Winamp Remote\bin\OrbTray.exe" [2008-01-07 23:02 495616]
  
  [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
  "SynTPLpr"="C:\Program Files\Synaptics\SynTP\SynTPLpr.exe" [2005-02-04 11:12 102490]
  "SynTPEnh"="C:\Program Files\Synaptics\SynTP\SynTPEnh.exe" [2005-02-04 11:11 708698]
  "ACU"="C:\Program Files\Atheros\ACU.exe" [2005-01-31 08:05 253952]
  "Broadcom Wireless Manager UI"="C:\WINDOWS\system32\WLTRAY" [ ]
  "SoundMan"="SOUNDMAN.EXE" [2005-04-15 11:01 77824 C:\WINDOWS\SOUNDMAN.EXE]
  "IgfxTray"="C:\WINDOWS\system32\igfxtray.exe" [2005-01-23 10:36 155648]
  "HotKeysCmds"="C:\WINDOWS\system32\hkcmd.exe" [2005-01-23 10:31 126976]
  "LaunchAp"="C:\Program Files\Launch Manager\LaunchAp.exe" [2005-03-30 15:29 32768]
  "PowerKey"="C:\Program Files\Launch Manager\PowerKey.exe" [2002-08-30 15:02 94208]
  "LManager"="C:\Program Files\Launch Manager\HotkeyApp.exe" [2005-06-06 11:52 69632]
  "CtrlVol"="C:\Program Files\Launch Manager\CtrlVol.exe" [2003-09-16 14:28 20480]
  "LMgrOSD"="C:\Program Files\Launch Manager\OSDCtrl.exe" [2005-06-06 14:18 241664]
  "Wbutton"="C:\Program Files\Launch Manager\Wbutton.exe" [2005-06-21 11:51 81920]
  "EPM-DM"="c:\acer\epm\epm-dm.exe" [2005-06-01 14:17 192512]
  "ePowerManagement"="C:\Acer\ePM\ePM.exe" [2005-03-15 10:03 2893824]
  "RemoteControl"="C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe" [2006-12-06 18:37 69216]
  "LanguageShortcut"="C:\Program Files\CyberLink\PowerDVD\Language\Language.exe" [2006-12-05 22:55 54832]
  "ccApp"="C:\Program Files\Common Files\Symantec Shared\ccApp.exe" [2005-09-17 02:27 52848]
  "Kernel and Hardware Abstraction Layer"="KHALMNPR.EXE" [2007-04-11 15:32 56080 C:\WINDOWS\KHALMNPR.Exe]
  "SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe" [2007-07-12 04:00 132496]
  "Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-01-11 23:16 39792]
  "WinampAgent"="C:\Program Files\Winamp\winampa.exe" [2008-01-16 01:54 37376]
  "Windows UDP Control"="winudspm.exe" []
  "Windows svchost"="service.exe" []
  "AVG8_TRAY"="C:\PROGRA~1\AVG\AVG8\avgtray.exe" [2008-06-01 23:50 1177368]
  "BM5babca48"="C:\WINDOWS\system32\svjrieii.dll" [ ]
  "5898f9d4"="C:\WINDOWS\system32\uukltwhg.dll" [2008-06-06 00:26 117248]
  
  C:\Documents and Settings\All Users\Start Menu\Programs\Startup\
  Logitech SetPoint.lnk - C:\Program Files\Logitech\SetPoint\SetPoint.exe [2007-07-18 19:02:20 692224]
  
  [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\jkkHYpmk]
  jkkHYpmk.dll
  
  [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
  "AppInit_DLLs"=avgrsstx.dll
  
  [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WdfLoadGroup]
  @=""
  
  [HKEY_LOCAL_MACHINE\software\microsoft\security center]
  "AntiVirusDisableNotify"=dword:00000001
  
  [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
  "DisableMonitoring"=dword:00000001
  
  [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
  "DisableMonitoring"=dword:00000001
  
  [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
  "EnableFirewall"= 0 (0x0)
  
  [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
  "%windir%\\system32\\sessmgr.exe"=
  "%windir%\\Network Diagnostic\\xpnetdiag.exe"=
  "C:\\Program Files\\MSN Messenger\\msnmsgr.exe"=
  "C:\\Program Files\\MSN Messenger\\livecall.exe"=
  "C:\\Program Files\\LimeWire\\LimeWire.exe"=
  "C:\\Program Files\\Winamp Remote\\bin\\Orb.exe"=
  "C:\\Program Files\\Winamp Remote\\bin\\OrbTray.exe"=
  "C:\\Program Files\\Winamp Remote\\bin\\OrbStreamerClient.exe"=
  "C:\\Program Files\\AVG\\AVG8\\avgupd.exe"=
  "C:\\Program Files\\AVG\\AVG8\\avgemc.exe"=
  
  R1 AvgLdx86;AVG AVI Loader Driver x86;C:\WINDOWS\system32\Drivers\avgldx86.sys [2008-06-01 23:51]
  R1 Hotkey;Hotkey;C:\WINDOWS\system32\drivers\Hotkey.sys [2003-04-28 11:27]
  R2 {95808DC4-FA4A-4c74-92FE-5B863F82066B};{95808DC4-FA4A-4c74-92FE-5B863F82066B};C:\Program Files\CyberLink\PowerDVD\[u]0[/u]00.fcl [2006-11-02 16:51]
  R2 Automattinen LiveUpdate-ajastustoiminto;Automattinen LiveUpdate-ajastustoiminto;"C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe" [2006-08-03 17:58]
  R2 avg8emc;AVG8 E-mail Scanner;C:\PROGRA~1\AVG\AVG8\avgemc.exe [2008-06-01 23:50]
  R2 avg8wd;AVG8 WatchDog;C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe [2008-06-01 23:50]
  R2 AvgTdiX;AVG8 Network Redirector;C:\WINDOWS\system32\Drivers\avgtdix.sys [2008-06-01 23:51]
  R2 EpmPsd;Acer EPM Power Scheme Driver;C:\WINDOWS\system32\drivers\epm-psd.sys [2004-07-19 13:10]
  R2 EpmShd;Acer EPM System Hardware Driver;C:\WINDOWS\system32\drivers\epm-shd.sys [2005-04-07 18:08]
  R3 POWERKEY;POWERKEY;C:\Program Files\Launch Manager\POWERKEY.sys [2000-12-19 18:29]
  S1 Wbutton;Wbutton;C:\WINDOWS\system32\drivers\Wbutton.sys []
  
  [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{26fd6930-d0fc-11dc-a256-0014a45100e1}]
  \Shell\AutoRun\command - E:\AutoRun.exe
  
  [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{e5132110-ca9b-11dc-a24d-0014a45100e1}]
  \Shell\AutoRun\command - E:\AutoRun.exe
  
  .
  Contents of the 'Scheduled Tasks' folder
  "2008-05-23 17:31:21 C:\WINDOWS\Tasks\Norton AntiVirus - Suorita täydellinen järjestelmäntarkistus - Jenna.job"
  - C:\PROGRA~1\NORTON~1\Navw32.exeh/TASK:
  .
  **************************************************************************
  
  catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
  Rootkit scan 2008-06-06 15:12:17
  Windows 5.1.2600 Service Pack 2 NTFS
  
  scanning hidden processes ...
  
  scanning hidden autostart entries ...
  
  scanning hidden files ...
  
  C:\DOCUME~1\Jenna\LOCALS~1\Temp\5c101802-f403-4359-956a-fef991229344.tmp 0 bytes
  
  scan completed successfully
  hidden files: 1
  
  **************************************************************************
  
  [HKEY_LOCAL_MACHINE\system\ControlSet001\Services\{95808DC4-FA4A-4c74-92FE-5B863F82066B}]
  "ImagePath"="\??\C:\Program Files\CyberLink\PowerDVD\[u]0[/u]00.fcl"
  .
  Completion time: 2008-06-06 15:13:15
  ComboFix-quarantined-files.txt 2008-06-06 12:13:07
  
  Pre-Run: 67,139,383,296 bytes free
  Post-Run: 67,130,298,368 bytes free
  
  193   --- E O F ---   2008-05-27 20:46:23
  
  Ja tämmönen..
  
  Logfile of Trend Micro HijackThis v2.0.2
  Scan saved at 15:18:40, on 6.6.2008
  Platform: Windows XP SP2 (WinNT 5.01.2600)
  MSIE: Internet Explorer v7.00 (7.00.6000.16640)
  Boot mode: Normal
  
  Running processes:
  C:\WINDOWS\System32\smss.exe
  C:\WINDOWS\system32\winlogon.exe
  C:\WINDOWS\system32\services.exe
  C:\WINDOWS\system32\lsass.exe
  C:\WINDOWS\system32\svchost.exe
  C:\WINDOWS\System32\svchost.exe
  C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
  C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
  C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
  C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
  C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
  C:\WINDOWS\System32\wltrysvc.exe
  C:\WINDOWS\System32\bcmwltry.exe
  C:\WINDOWS\system32\spoolsv.exe
  C:\WINDOWS\system32\acs.exe
  C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
  C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
  C:\Program Files\Norton AntiVirus\navapsvc.exe
  C:\Program Files\Norton AntiVirus\IWP\NPFMntor.exe
  C:\Program Files\CyberLink\Shared Files\RichVideo.exe
  C:\WINDOWS\system32\svchost.exe
  C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
  C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
  C:\PROGRA~1\AVG\AVG8\avgemc.exe
  C:\WINDOWS\system32\WLTRAY.exe
  C:\WINDOWS\SOUNDMAN.EXE
  C:\WINDOWS\system32\igfxtray.exe
  C:\WINDOWS\system32\hkcmd.exe
  C:\Program Files\Launch Manager\LaunchAp.exe
  C:\Program Files\Launch Manager\PowerKey.exe
  C:\Program Files\Launch Manager\HotkeyApp.exe
  C:\Program Files\Launch Manager\OSDCtrl.exe
  C:\Program Files\Launch Manager\Wbutton.exe
  C:\acer\epm\epm-dm.exe
  C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe
  C:\Program Files\Common Files\Symantec Shared\ccApp.exe
  C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe
  C:\Program Files\Winamp\winampa.exe
  C:\PROGRA~1\AVG\AVG8\avgtray.exe
  C:\WINDOWS\system32\ctfmon.exe
  C:\Program Files\MSN Messenger\MsnMsgr.Exe
  C:\Program Files\Winamp Remote\bin\OrbTray.exe
  C:\Program Files\Logitech\SetPoint\SetPoint.exe
  C:\Program Files\Winamp Remote\bin\Orb.exe
  C:\Program Files\Common Files\Logitech\KhalShared\KHALMNPR.EXE
  C:\Program Files\Common Files\Symantec Shared\Security Console\NSCSRVCE.EXE
  C:\Program Files\AVG\AVG8\avgrsx.exe
  C:\Program Files\AVG\AVG8\avgrsx.exe
  C:\Program Files\AVG\AVG8\avgrsx.exe
  C:\WINDOWS\explorer.exe
  C:\Program Files\internet explorer\iexplore.exe
  c:\program files\winamp toolbar\WinampTbServer.exe
  C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLLoginProxy.exe
  C:\Program Files\Mobile Partner\Mobile Partner.exe
  C:\WINDOWS\system32\wuauclt.exe
  C:\Program Files\Messenger\msmsgs.exe
  C:\Program Files\HijackThis.exe
  
  R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.superjymy.fi/
  R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
  R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
  R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
  R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
  O2 - BHO: (no name) - {0EF680CB-95FA-48FE-8F8A-DE63F6C0FE36} - C:\WINDOWS\system32\fccCuVLB.dll (file missing)
  O2 - BHO: {675505c6-d999-512b-0884-afefac927545} - {545729ca-fefa-4880-b215-999d6c505576} - C:\WINDOWS\system32\gqumnkfx.dll
  O2 - BHO: (no name) - {5688C5C9-D3C7-485D-8CCA-C22720538FF2} - C:\WINDOWS\system32\efcBqnli.dll (file missing)
  O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
  O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
  O2 - BHO: AVG Security Toolbar - {A057A204-BACC-4D26-9990-79A187E2698E} - C:\PROGRA~1\AVG\AVG8\AVGTOO~1.DLL
  O2 - BHO: NAV Helper - {A8F38D8D-E480-4D52-B7A2-731BB6995FDD} - C:\Program Files\Norton AntiVirus\NavShExt.dll
  O3 - Toolbar: Norton AntiVirus - {C4069E3A-68F1-403E-B40E-20066696354B} - C:\Program Files\Norton AntiVirus\NavShExt.dll
  O3 - Toolbar: Winamp Toolbar - {EBF2BA02-9094-4c5a-858B-BB198F3D8DE2} - C:\Program Files\Winamp Toolbar\winamptb.dll
  O3 - Toolbar: AVG Security Toolbar - {A057A204-BACC-4D26-9990-79A187E2698E} - C:\PROGRA~1\AVG\AVG8\AVGTOO~1.DLL
  O4 - HKLM\..\Run: [SynTPLpr] C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
  O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
  O4 - HKLM\..\Run: [ACU] "C:\Program Files\Atheros\ACU.exe" -nogui
  O4 - HKLM\..\Run: [Broadcom Wireless Manager UI] C:\WINDOWS\system32\WLTRAY
  O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
  O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\system32\igfxtray.exe
  O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe
  O4 - HKLM\..\Run: [LaunchAp] "C:\Program Files\Launch Manager\LaunchAp.exe"
  O4 - HKLM\..\Run: [PowerKey] "C:\Program Files\Launch Manager\PowerKey.exe"
  O4 - HKLM\..\Run: [LManager] "C:\Program Files\Launch Manager\HotkeyApp.exe"
  O4 - HKLM\..\Run: [CtrlVol] "C:\Program Files\Launch Manager\CtrlVol.exe"
  O4 - HKLM\..\Run: [LMgrOSD] "C:\Program Files\Launch Manager\OSDCtrl.exe"
  O4 - HKLM\..\Run: [Wbutton] "C:\Program Files\Launch Manager\Wbutton.exe"
  O4 - HKLM\..\Run: [EPM-DM] c:\acer\epm\epm-dm.exe
  O4 - HKLM\..\Run: [ePowerManagement] C:\Acer\ePM\ePM.exe boot
  O4 - HKLM\..\Run: [RemoteControl] "C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe"
  O4 - HKLM\..\Run: [LanguageShortcut] "C:\Program Files\CyberLink\PowerDVD\Language\Language.exe"
  O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
  O4 - HKLM\..\Run: [Kernel and Hardware Abstraction Layer] KHALMNPR.EXE
  O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe"
  O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
  O4 - HKLM\..\Run: [WinampAgent] C:\Program Files\Winamp\winampa.exe
  O4 - HKLM\..\Run: [Windows UDP Control] winudspm.exe
  O4 - HKLM\..\Run: [Windows svchost] service.exe
  O4 - HKLM\..\Run: [AVG8_TRAY] C:\PROGRA~1\AVG\AVG8\avgtray.exe
  O4 - HKLM\..\Run: [BM5babca48] Rundll32.exe "C:\WINDOWS\system32\svjrieii.dll",s
  O4 - HKLM\..\Run: [5898f9d4] rundll32.exe "C:\WINDOWS\system32\uukltwhg.dll",b
  O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
  O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
  O4 - HKCU\..\Run: [Orb] "C:\Program Files\Winamp Remote\bin\OrbTray.exe" /background
  O4 - Global Startup: Logitech SetPoint.lnk = C:\Program Files\Logitech\SetPoint\SetPoint.exe
  O8 - Extra context menu item: &Winamp Toolbar Search - C:\Documents and Settings\All Users\Application Data\Winamp Toolbar\ieToolbar\resources\en-US\local\search.html
  O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
  O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
  O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
  O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
  O16 - DPF: {5C6698D9-7BE4-4122-8EC5-291D84DBD4A0} (Facebook Photo Uploader 4 Control) - http://upload.facebook.com/controls/FacebookPhotoUploader3.cab
  O16 - DPF: {5F8469B4-B055-49DD-83F7-62B522420ECC} (Facebook Photo Uploader Control) - http://upload.facebook.com/controls/FacebookPhotoUploader.cab
  O17 - HKLM\System\CCS\Services\Tcpip\..\{DBF43578-B928-4311-B8C4-6447CCE77FA1}: NameServer = 217.78.192.22 217.78.192.78
  O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG8\avgpp.dll
  O20 - AppInit_DLLs: avgrsstx.dll
  O20 - Winlogon Notify: jkkHYpmk - jkkHYpmk.dll (file missing)
  O23 - Service: Atheros Configuration Service (ACS) - Unknown owner - C:\WINDOWS\system32\acs.exe
  O23 - Service: Automattinen LiveUpdate-ajastustoiminto - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
  O23 - Service: AVG8 E-mail Scanner (avg8emc) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgemc.exe
  O23 - Service: AVG8 WatchDog (avg8wd) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
  O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
  O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
  O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
  O23 - Service: Norton AntiVirus Auto-Protect -palvelu (navapsvc) - Symantec Corporation - C:\Program Files\Norton AntiVirus\navapsvc.exe
  O23 - Service: Norton AntiVirus Firewall Monitor Service (NPFMntor) - Symantec Corporation - C:\Program Files\Norton AntiVirus\IWP\NPFMntor.exe
  O23 - Service: Norton Protection Center Service (NSCService) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\Security Console\NSCSRVCE.EXE
  O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - C:\Program Files\CyberLink\Shared Files\RichVideo.exe
  O23 - Service: Symantec AVScan (SAVScan) - Symantec Corporation - C:\Program Files\Norton AntiVirus\SAVScan.exe
  O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
  O23 - Service: SPBBCSvc - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
  O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
  O23 - Service: Broadcom Wireless LAN Tray Service (wltrysvc) - Unknown owner - C:\WINDOWS\System32\wltrysvc.exe
  
  --
  End of file - 10080 bytes
- FixFix
  2008-06-06 15:41:06
  lonti x 2 kirjoitti:
  Tämmönen..
  
  ComboFix 08-06-05.3 - Jenna 2008-06-06 15:10:00.2 - NTFSx86
  Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1033.18.548 [GMT 3:00]
  Running from: C:\Documents and Settings\Jenna\Desktop\ComboFix.exe
  
  [color=red][b]WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !![/b][/color]
  .
  
  ((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
  .
  
  C:\f.exe
  .
  ---- Previous Run -------
  .
  C:\bot.exe
  C:\WINDOWS\BM5babca48.xml
  C:\WINDOWS\cookies.ini
  C:\WINDOWS\pskt.ini
  C:\WINDOWS\service.exe
  C:\WINDOWS\system32\amxxfunh.ini
  C:\WINDOWS\system32\BLVuCccf.ini
  C:\WINDOWS\system32\BLVuCccf.ini2
  C:\WINDOWS\system32\firmdfmg.ini
  C:\WINDOWS\system32\ghwtlkuu.ini
  C:\WINDOWS\system32\ilnqBcfe.ini
  C:\WINDOWS\system32\ilnqBcfe.ini2
  C:\WINDOWS\system32\jvbtgwcb.dll
  C:\WINDOWS\system32\lebnoxio.ini
  C:\WINDOWS\system32\mcrh.tmp
  C:\WINDOWS\system32\msjhhrpl.dll
  C:\WINDOWS\system32\suhpxtpv.ini
  C:\WINDOWS\system32\xoofints.ini
  C:\WINDOWS\system32\yfqyxafb.ini
  C:\WINDOWS\system32\ygrdfasu.ini
  
  .
  ((((((((((((((((((((((((( Files Created from 2008-05-06 to 2008-06-06 )))))))))))))))))))))))))))))))
  .
  
  2008-06-06 15:02 . 2008-06-06 15:10   354   ---hs----   C:\WINDOWS\system32\ghwtlkuu.ini
  2008-06-06 08:09 . 2008-06-06 08:09   396,288   --a------   C:\Program Files\HijackThis.exe
  2008-06-06 00:24 . 2008-06-06 00:24   49,156   --a------   C:\fs.exe
  2008-06-06 00:20 . 2008-06-06 00:26   117,248   --a------   C:\WINDOWS\system32\uukltwhg.dll
  2008-06-06 00:15 . 2008-06-06 00:17   4,217   --a------   C:\Documents and Settings\Jenna\f.exe
  2008-06-05 23:18 . 2008-06-05 23:28   133,120   --a------   C:\WINDOWS\system32\gqumnkfx.dll
  2008-06-04 22:00 . 2008-06-04 22:00   86,528   --a------   C:\Documents and Settings\Jenna\stp.exe
  2008-06-04 21:14 . 2008-06-04 21:14   3,424   --a------   C:\is155400.exe
  2008-06-03 18:36 . 2008-06-03 18:36   86,548   --a------   C:\Documents and Settings\Jenna\setupa.exe
  2008-06-03 16:43 . 2008-06-03 19:54   4,217   --a------   C:\WINDOWS\is154890.exe
  2008-06-03 16:24 . 2008-06-03 16:43      d--------   C:\Documents and Settings\Jenna\Contacts
  2008-06-02 22:33 . 2008-06-03 18:18   96,950   --a------   C:\Documents and Settings\Jenna\setup.exe
  2008-06-02 22:29 . 2008-06-02 22:29   97,116   --a------   C:\WINDOWS\DC5177176.zip
  2008-06-02 00:21 . 2008-06-06 14:57      d--h-----   C:\$AVG8.VAULT$
  2008-06-01 23:51 . 2008-06-05 17:25      d--------   C:\WINDOWS\system32\drivers\Avg
  2008-06-01 23:51 . 2008-06-01 23:51      d--------   C:\Documents and Settings\Jenna\Application Data\AVGTOOLBAR
  2008-06-01 23:51 . 2008-06-01 23:51   96,520   --a------   C:\WINDOWS\system32\drivers\avgldx86.sys
  2008-06-01 23:51 . 2008-06-01 23:51   75,272   --a------   C:\WINDOWS\system32\drivers\avgtdix.sys
  2008-06-01 23:51 . 2008-06-01 23:51   10,520   --a------   C:\WINDOWS\system32\avgrsstx.dll
  2008-06-01 23:50 . 2008-06-01 23:50      d--------   C:\Program Files\AVG
  2008-06-01 23:50 . 2008-06-01 23:50      d--------   C:\Documents and Settings\All Users\Application Data\avg8
  2008-06-01 23:49 . 2008-06-02 10:14      d--------   C:\WINDOWS\SxsCaPendDel
  
  .
  (((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
  .
  2008-06-06 10:40   ---------   d-----w   C:\Documents and Settings\Jenna\Application Data\LimeWire
  2008-06-06 05:09   10,478   ----a-w   C:\Program Files\hijackthis.log
  2008-06-05 14:12   ---------   d-----w   C:\Program Files\Common Files\Symantec Shared
  2008-06-05 13:55   ---------   d-----w   C:\Documents and Settings\All Users\Application Data\OrbNetworks
  2008-06-03 20:24   86,548   ----a-w   C:\WINDOWS\Fonts\setupa.exe
  2008-06-01 14:26   ---------   d-----w   C:\Program Files\Winamp Remote
  2008-03-27 08:12   151,583   ----a-w   C:\WINDOWS\system32\msjint40.dll
  2008-03-19 09:47   1,845,248   ----a-w   C:\WINDOWS\system32\win32k.sys
  .
  
  ((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
  .
  .
  *Note* empty entries & legit default entries are not shown
  REGEDIT4
  
  [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{0EF680CB-95FA-48FE-8F8A-DE63F6C0FE36}]
           C:\WINDOWS\system32\fccCuVLB.dll
  
  [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{545729ca-fefa-4880-b215-999d6c505576}]
  2008-06-05 23:28   133120   --a------   C:\WINDOWS\system32\gqumnkfx.dll
  
  [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{5688C5C9-D3C7-485D-8CCA-C22720538FF2}]
           C:\WINDOWS\system32\efcBqnli.dll
  
  [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{A057A204-BACC-4D26-9990-79A187E2698E}]
  2008-06-01 23:51   2050816   --a------   C:\PROGRA~1\AVG\AVG8\AVGTOO~1.DLL
  
  [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
  "{EBF2BA02-9094-4C5A-858B-BB198F3D8DE2}"= "C:\Program Files\Winamp Toolbar\winamptb.dll" [2007-12-13 19:49 1185120]
  "{A057A204-BACC-4D26-9990-79A187E2698E}"= "C:\PROGRA~1\AVG\AVG8\AVGTOO~1.DLL" [2008-06-01 23:51 2050816]
  
  [HKEY_CLASSES_ROOT\clsid\{ebf2ba02-9094-4c5a-858b-bb198f3d8de2}]
  [HKEY_CLASSES_ROOT\WINAMPTB.AOLToolBand.1]
  [HKEY_CLASSES_ROOT\TypeLib\{538CD77C-BFDD-49b0-9562-77419CAB89D1}]
  [HKEY_CLASSES_ROOT\WINAMPTB.AOLToolBand]
  
  [HKEY_CLASSES_ROOT\clsid\{a057a204-bacc-4d26-9990-79a187e2698e}]
  [HKEY_CLASSES_ROOT\avgtoolbar.AVGTOOLBAR]
  
  [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser]
  "{EBF2BA02-9094-4C5A-858B-BB198F3D8DE2}"= C:\Program Files\Winamp Toolbar\winamptb.dll [2007-12-13 19:49 1185120]
  
  [HKEY_CLASSES_ROOT\clsid\{ebf2ba02-9094-4c5a-858b-bb198f3d8de2}]
  [HKEY_CLASSES_ROOT\WINAMPTB.AOLToolBand.1]
  [HKEY_CLASSES_ROOT\TypeLib\{538CD77C-BFDD-49b0-9562-77419CAB89D1}]
  [HKEY_CLASSES_ROOT\WINAMPTB.AOLToolBand]
  
  [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
  "ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 15:00 15360]
  "MsnMsgr"="C:\Program Files\MSN Messenger\MsnMsgr.exe" [2007-01-19 12:55 5674352]
  "Orb"="C:\Program Files\Winamp Remote\bin\OrbTray.exe" [2008-01-07 23:02 495616]
  
  [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
  "SynTPLpr"="C:\Program Files\Synaptics\SynTP\SynTPLpr.exe" [2005-02-04 11:12 102490]
  "SynTPEnh"="C:\Program Files\Synaptics\SynTP\SynTPEnh.exe" [2005-02-04 11:11 708698]
  "ACU"="C:\Program Files\Atheros\ACU.exe" [2005-01-31 08:05 253952]
  "Broadcom Wireless Manager UI"="C:\WINDOWS\system32\WLTRAY" [ ]
  "SoundMan"="SOUNDMAN.EXE" [2005-04-15 11:01 77824 C:\WINDOWS\SOUNDMAN.EXE]
  "IgfxTray"="C:\WINDOWS\system32\igfxtray.exe" [2005-01-23 10:36 155648]
  "HotKeysCmds"="C:\WINDOWS\system32\hkcmd.exe" [2005-01-23 10:31 126976]
  "LaunchAp"="C:\Program Files\Launch Manager\LaunchAp.exe" [2005-03-30 15:29 32768]
  "PowerKey"="C:\Program Files\Launch Manager\PowerKey.exe" [2002-08-30 15:02 94208]
  "LManager"="C:\Program Files\Launch Manager\HotkeyApp.exe" [2005-06-06 11:52 69632]
  "CtrlVol"="C:\Program Files\Launch Manager\CtrlVol.exe" [2003-09-16 14:28 20480]
  "LMgrOSD"="C:\Program Files\Launch Manager\OSDCtrl.exe" [2005-06-06 14:18 241664]
  "Wbutton"="C:\Program Files\Launch Manager\Wbutton.exe" [2005-06-21 11:51 81920]
  "EPM-DM"="c:\acer\epm\epm-dm.exe" [2005-06-01 14:17 192512]
  "ePowerManagement"="C:\Acer\ePM\ePM.exe" [2005-03-15 10:03 2893824]
  "RemoteControl"="C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe" [2006-12-06 18:37 69216]
  "LanguageShortcut"="C:\Program Files\CyberLink\PowerDVD\Language\Language.exe" [2006-12-05 22:55 54832]
  "ccApp"="C:\Program Files\Common Files\Symantec Shared\ccApp.exe" [2005-09-17 02:27 52848]
  "Kernel and Hardware Abstraction Layer"="KHALMNPR.EXE" [2007-04-11 15:32 56080 C:\WINDOWS\KHALMNPR.Exe]
  "SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe" [2007-07-12 04:00 132496]
  "Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-01-11 23:16 39792]
  "WinampAgent"="C:\Program Files\Winamp\winampa.exe" [2008-01-16 01:54 37376]
  "Windows UDP Control"="winudspm.exe" []
  "Windows svchost"="service.exe" []
  "AVG8_TRAY"="C:\PROGRA~1\AVG\AVG8\avgtray.exe" [2008-06-01 23:50 1177368]
  "BM5babca48"="C:\WINDOWS\system32\svjrieii.dll" [ ]
  "5898f9d4"="C:\WINDOWS\system32\uukltwhg.dll" [2008-06-06 00:26 117248]
  
  C:\Documents and Settings\All Users\Start Menu\Programs\Startup\
  Logitech SetPoint.lnk - C:\Program Files\Logitech\SetPoint\SetPoint.exe [2007-07-18 19:02:20 692224]
  
  [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\jkkHYpmk]
  jkkHYpmk.dll
  
  [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
  "AppInit_DLLs"=avgrsstx.dll
  
  [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WdfLoadGroup]
  @=""
  
  [HKEY_LOCAL_MACHINE\software\microsoft\security center]
  "AntiVirusDisableNotify"=dword:00000001
  
  [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
  "DisableMonitoring"=dword:00000001
  
  [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
  "DisableMonitoring"=dword:00000001
  
  [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
  "EnableFirewall"= 0 (0x0)
  
  [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
  "%windir%\\system32\\sessmgr.exe"=
  "%windir%\\Network Diagnostic\\xpnetdiag.exe"=
  "C:\\Program Files\\MSN Messenger\\msnmsgr.exe"=
  "C:\\Program Files\\MSN Messenger\\livecall.exe"=
  "C:\\Program Files\\LimeWire\\LimeWire.exe"=
  "C:\\Program Files\\Winamp Remote\\bin\\Orb.exe"=
  "C:\\Program Files\\Winamp Remote\\bin\\OrbTray.exe"=
  "C:\\Program Files\\Winamp Remote\\bin\\OrbStreamerClient.exe"=
  "C:\\Program Files\\AVG\\AVG8\\avgupd.exe"=
  "C:\\Program Files\\AVG\\AVG8\\avgemc.exe"=
  
  R1 AvgLdx86;AVG AVI Loader Driver x86;C:\WINDOWS\system32\Drivers\avgldx86.sys [2008-06-01 23:51]
  R1 Hotkey;Hotkey;C:\WINDOWS\system32\drivers\Hotkey.sys [2003-04-28 11:27]
  R2 {95808DC4-FA4A-4c74-92FE-5B863F82066B};{95808DC4-FA4A-4c74-92FE-5B863F82066B};C:\Program Files\CyberLink\PowerDVD\[u]0[/u]00.fcl [2006-11-02 16:51]
  R2 Automattinen LiveUpdate-ajastustoiminto;Automattinen LiveUpdate-ajastustoiminto;"C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe" [2006-08-03 17:58]
  R2 avg8emc;AVG8 E-mail Scanner;C:\PROGRA~1\AVG\AVG8\avgemc.exe [2008-06-01 23:50]
  R2 avg8wd;AVG8 WatchDog;C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe [2008-06-01 23:50]
  R2 AvgTdiX;AVG8 Network Redirector;C:\WINDOWS\system32\Drivers\avgtdix.sys [2008-06-01 23:51]
  R2 EpmPsd;Acer EPM Power Scheme Driver;C:\WINDOWS\system32\drivers\epm-psd.sys [2004-07-19 13:10]
  R2 EpmShd;Acer EPM System Hardware Driver;C:\WINDOWS\system32\drivers\epm-shd.sys [2005-04-07 18:08]
  R3 POWERKEY;POWERKEY;C:\Program Files\Launch Manager\POWERKEY.sys [2000-12-19 18:29]
  S1 Wbutton;Wbutton;C:\WINDOWS\system32\drivers\Wbutton.sys []
  
  [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{26fd6930-d0fc-11dc-a256-0014a45100e1}]
  \Shell\AutoRun\command - E:\AutoRun.exe
  
  [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{e5132110-ca9b-11dc-a24d-0014a45100e1}]
  \Shell\AutoRun\command - E:\AutoRun.exe
  
  .
  Contents of the 'Scheduled Tasks' folder
  "2008-05-23 17:31:21 C:\WINDOWS\Tasks\Norton AntiVirus - Suorita täydellinen järjestelmäntarkistus - Jenna.job"
  - C:\PROGRA~1\NORTON~1\Navw32.exeh/TASK:
  .
  **************************************************************************
  
  catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
  Rootkit scan 2008-06-06 15:12:17
  Windows 5.1.2600 Service Pack 2 NTFS
  
  scanning hidden processes ...
  
  scanning hidden autostart entries ...
  
  scanning hidden files ...
  
  C:\DOCUME~1\Jenna\LOCALS~1\Temp\5c101802-f403-4359-956a-fef991229344.tmp 0 bytes
  
  scan completed successfully
  hidden files: 1
  
  **************************************************************************
  
  [HKEY_LOCAL_MACHINE\system\ControlSet001\Services\{95808DC4-FA4A-4c74-92FE-5B863F82066B}]
  "ImagePath"="\??\C:\Program Files\CyberLink\PowerDVD\[u]0[/u]00.fcl"
  .
  Completion time: 2008-06-06 15:13:15
  ComboFix-quarantined-files.txt 2008-06-06 12:13:07
  
  Pre-Run: 67,139,383,296 bytes free
  Post-Run: 67,130,298,368 bytes free
  
  193   --- E O F ---   2008-05-27 20:46:23
  
  Ja tämmönen..
  
  Logfile of Trend Micro HijackThis v2.0.2
  Scan saved at 15:18:40, on 6.6.2008
  Platform: Windows XP SP2 (WinNT 5.01.2600)
  MSIE: Internet Explorer v7.00 (7.00.6000.16640)
  Boot mode: Normal
  
  Running processes:
  C:\WINDOWS\System32\smss.exe
  C:\WINDOWS\system32\winlogon.exe
  C:\WINDOWS\system32\services.exe
  C:\WINDOWS\system32\lsass.exe
  C:\WINDOWS\system32\svchost.exe
  C:\WINDOWS\System32\svchost.exe
  C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
  C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
  C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
  C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
  C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
  C:\WINDOWS\System32\wltrysvc.exe
  C:\WINDOWS\System32\bcmwltry.exe
  C:\WINDOWS\system32\spoolsv.exe
  C:\WINDOWS\system32\acs.exe
  C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
  C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
  C:\Program Files\Norton AntiVirus\navapsvc.exe
  C:\Program Files\Norton AntiVirus\IWP\NPFMntor.exe
  C:\Program Files\CyberLink\Shared Files\RichVideo.exe
  C:\WINDOWS\system32\svchost.exe
  C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
  C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
  C:\PROGRA~1\AVG\AVG8\avgemc.exe
  C:\WINDOWS\system32\WLTRAY.exe
  C:\WINDOWS\SOUNDMAN.EXE
  C:\WINDOWS\system32\igfxtray.exe
  C:\WINDOWS\system32\hkcmd.exe
  C:\Program Files\Launch Manager\LaunchAp.exe
  C:\Program Files\Launch Manager\PowerKey.exe
  C:\Program Files\Launch Manager\HotkeyApp.exe
  C:\Program Files\Launch Manager\OSDCtrl.exe
  C:\Program Files\Launch Manager\Wbutton.exe
  C:\acer\epm\epm-dm.exe
  C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe
  C:\Program Files\Common Files\Symantec Shared\ccApp.exe
  C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe
  C:\Program Files\Winamp\winampa.exe
  C:\PROGRA~1\AVG\AVG8\avgtray.exe
  C:\WINDOWS\system32\ctfmon.exe
  C:\Program Files\MSN Messenger\MsnMsgr.Exe
  C:\Program Files\Winamp Remote\bin\OrbTray.exe
  C:\Program Files\Logitech\SetPoint\SetPoint.exe
  C:\Program Files\Winamp Remote\bin\Orb.exe
  C:\Program Files\Common Files\Logitech\KhalShared\KHALMNPR.EXE
  C:\Program Files\Common Files\Symantec Shared\Security Console\NSCSRVCE.EXE
  C:\Program Files\AVG\AVG8\avgrsx.exe
  C:\Program Files\AVG\AVG8\avgrsx.exe
  C:\Program Files\AVG\AVG8\avgrsx.exe
  C:\WINDOWS\explorer.exe
  C:\Program Files\internet explorer\iexplore.exe
  c:\program files\winamp toolbar\WinampTbServer.exe
  C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLLoginProxy.exe
  C:\Program Files\Mobile Partner\Mobile Partner.exe
  C:\WINDOWS\system32\wuauclt.exe
  C:\Program Files\Messenger\msmsgs.exe
  C:\Program Files\HijackThis.exe
  
  R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.superjymy.fi/
  R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
  R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
  R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
  R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
  O2 - BHO: (no name) - {0EF680CB-95FA-48FE-8F8A-DE63F6C0FE36} - C:\WINDOWS\system32\fccCuVLB.dll (file missing)
  O2 - BHO: {675505c6-d999-512b-0884-afefac927545} - {545729ca-fefa-4880-b215-999d6c505576} - C:\WINDOWS\system32\gqumnkfx.dll
  O2 - BHO: (no name) - {5688C5C9-D3C7-485D-8CCA-C22720538FF2} - C:\WINDOWS\system32\efcBqnli.dll (file missing)
  O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
  O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
  O2 - BHO: AVG Security Toolbar - {A057A204-BACC-4D26-9990-79A187E2698E} - C:\PROGRA~1\AVG\AVG8\AVGTOO~1.DLL
  O2 - BHO: NAV Helper - {A8F38D8D-E480-4D52-B7A2-731BB6995FDD} - C:\Program Files\Norton AntiVirus\NavShExt.dll
  O3 - Toolbar: Norton AntiVirus - {C4069E3A-68F1-403E-B40E-20066696354B} - C:\Program Files\Norton AntiVirus\NavShExt.dll
  O3 - Toolbar: Winamp Toolbar - {EBF2BA02-9094-4c5a-858B-BB198F3D8DE2} - C:\Program Files\Winamp Toolbar\winamptb.dll
  O3 - Toolbar: AVG Security Toolbar - {A057A204-BACC-4D26-9990-79A187E2698E} - C:\PROGRA~1\AVG\AVG8\AVGTOO~1.DLL
  O4 - HKLM\..\Run: [SynTPLpr] C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
  O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
  O4 - HKLM\..\Run: [ACU] "C:\Program Files\Atheros\ACU.exe" -nogui
  O4 - HKLM\..\Run: [Broadcom Wireless Manager UI] C:\WINDOWS\system32\WLTRAY
  O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
  O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\system32\igfxtray.exe
  O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe
  O4 - HKLM\..\Run: [LaunchAp] "C:\Program Files\Launch Manager\LaunchAp.exe"
  O4 - HKLM\..\Run: [PowerKey] "C:\Program Files\Launch Manager\PowerKey.exe"
  O4 - HKLM\..\Run: [LManager] "C:\Program Files\Launch Manager\HotkeyApp.exe"
  O4 - HKLM\..\Run: [CtrlVol] "C:\Program Files\Launch Manager\CtrlVol.exe"
  O4 - HKLM\..\Run: [LMgrOSD] "C:\Program Files\Launch Manager\OSDCtrl.exe"
  O4 - HKLM\..\Run: [Wbutton] "C:\Program Files\Launch Manager\Wbutton.exe"
  O4 - HKLM\..\Run: [EPM-DM] c:\acer\epm\epm-dm.exe
  O4 - HKLM\..\Run: [ePowerManagement] C:\Acer\ePM\ePM.exe boot
  O4 - HKLM\..\Run: [RemoteControl] "C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe"
  O4 - HKLM\..\Run: [LanguageShortcut] "C:\Program Files\CyberLink\PowerDVD\Language\Language.exe"
  O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
  O4 - HKLM\..\Run: [Kernel and Hardware Abstraction Layer] KHALMNPR.EXE
  O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe"
  O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
  O4 - HKLM\..\Run: [WinampAgent] C:\Program Files\Winamp\winampa.exe
  O4 - HKLM\..\Run: [Windows UDP Control] winudspm.exe
  O4 - HKLM\..\Run: [Windows svchost] service.exe
  O4 - HKLM\..\Run: [AVG8_TRAY] C:\PROGRA~1\AVG\AVG8\avgtray.exe
  O4 - HKLM\..\Run: [BM5babca48] Rundll32.exe "C:\WINDOWS\system32\svjrieii.dll",s
  O4 - HKLM\..\Run: [5898f9d4] rundll32.exe "C:\WINDOWS\system32\uukltwhg.dll",b
  O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
  O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
  O4 - HKCU\..\Run: [Orb] "C:\Program Files\Winamp Remote\bin\OrbTray.exe" /background
  O4 - Global Startup: Logitech SetPoint.lnk = C:\Program Files\Logitech\SetPoint\SetPoint.exe
  O8 - Extra context menu item: &Winamp Toolbar Search - C:\Documents and Settings\All Users\Application Data\Winamp Toolbar\ieToolbar\resources\en-US\local\search.html
  O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
  O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
  O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
  O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
  O16 - DPF: {5C6698D9-7BE4-4122-8EC5-291D84DBD4A0} (Facebook Photo Uploader 4 Control) - http://upload.facebook.com/controls/FacebookPhotoUploader3.cab
  O16 - DPF: {5F8469B4-B055-49DD-83F7-62B522420ECC} (Facebook Photo Uploader Control) - http://upload.facebook.com/controls/FacebookPhotoUploader.cab
  O17 - HKLM\System\CCS\Services\Tcpip\..\{DBF43578-B928-4311-B8C4-6447CCE77FA1}: NameServer = 217.78.192.22 217.78.192.78
  O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG8\avgpp.dll
  O20 - AppInit_DLLs: avgrsstx.dll
  O20 - Winlogon Notify: jkkHYpmk - jkkHYpmk.dll (file missing)
  O23 - Service: Atheros Configuration Service (ACS) - Unknown owner - C:\WINDOWS\system32\acs.exe
  O23 - Service: Automattinen LiveUpdate-ajastustoiminto - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
  O23 - Service: AVG8 E-mail Scanner (avg8emc) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgemc.exe
  O23 - Service: AVG8 WatchDog (avg8wd) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
  O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
  O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
  O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
  O23 - Service: Norton AntiVirus Auto-Protect -palvelu (navapsvc) - Symantec Corporation - C:\Program Files\Norton AntiVirus\navapsvc.exe
  O23 - Service: Norton AntiVirus Firewall Monitor Service (NPFMntor) - Symantec Corporation - C:\Program Files\Norton AntiVirus\IWP\NPFMntor.exe
  O23 - Service: Norton Protection Center Service (NSCService) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\Security Console\NSCSRVCE.EXE
  O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - C:\Program Files\CyberLink\Shared Files\RichVideo.exe
  O23 - Service: Symantec AVScan (SAVScan) - Symantec Corporation - C:\Program Files\Norton AntiVirus\SAVScan.exe
  O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
  O23 - Service: SPBBCSvc - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
  O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
  O23 - Service: Broadcom Wireless LAN Tray Service (wltrysvc) - Unknown owner - C:\WINDOWS\System32\wltrysvc.exe
  
  --
  End of file - 10080 bytes
  käy
  
  Avaa Muistio ja kopioi/liitä quoteboxin sisältö sinne:
  
  [quote]
  
  File::
  C:\is155400.exe
  C:\WINDOWS\system32\fccCuVLB.dll
  C:\WINDOWS\system32\efcBqnli.dll
  C:\WINDOWS\system32\svjrieii.dll
  C:\WINDOWS\system32\uukltwhg.dll
  C:\WINDOWS\system32\gqumnkfx.dll
  C:\WINDOWS\winudspm.exe
  C:\WINDOWS\service.exe
  
  [/quote]
  
  Tallenna se nimellä CFScript.txt
  
  Sitten raahaa CFScript ComboFix.exeen kuten alla.
  [img]http://users.pandora.be/bluepatchy/miekiemoes/images/CFScript.gif[/img]
  
  Käynnistä tietokone uudelleen pyydettäessä ja lähetä combofix.txt-tiedoston sisältö tänne.
  
  *******
  
  scannaa hjt:llä merkkaa paina Fix checked
  
  O2 - BHO: (no name) - {0EF680CB-95FA-48FE-8F8A-DE63F6C0FE36} - C:\WINDOWS\system32\fccCuVLB.dll (file missing)
  O2 - BHO: {675505c6-d999-512b-0884-afefac927545} - {545729ca-fefa-4880-b215-999d6c505576} - C:\WINDOWS\system32\gqumnkfx.dll
  O2 - BHO: (no name) - {5688C5C9-D3C7-485D-8CCA-C22720538FF2} - C:\WINDOWS\system32\efcBqnli.dll (file missing)
  O4 - HKLM\..\Run: [WinampAgent] C:\Program Files\Winamp\winampa.exe
  O4 - HKLM\..\Run: [Windows UDP Control] winudspm.exe
  O4 - HKLM\..\Run: [BM5babca48] Rundll32.exe "C:\WINDOWS\system32\svjrieii.dll",s
  O4 - HKLM\..\Run: [5898f9d4] rundll32.exe "C:\WINDOWS\system32\uukltwhg.dll",b
  O20 - Winlogon Notify: jkkHYpmk - jkkHYpmk.dll (file missing)
  
  **********
  
  sulla näkyy koneella olevan
  virustorjuntoja liikaa
  avg8 ja norton kupaa noista käytät
- lonti x 2
  2008-06-12 18:55:15
  FixFix kirjoitti:
  käy
  
  Avaa Muistio ja kopioi/liitä quoteboxin sisältö sinne:
  
  [quote]
  
  File::
  C:\is155400.exe
  C:\WINDOWS\system32\fccCuVLB.dll
  C:\WINDOWS\system32\efcBqnli.dll
  C:\WINDOWS\system32\svjrieii.dll
  C:\WINDOWS\system32\uukltwhg.dll
  C:\WINDOWS\system32\gqumnkfx.dll
  C:\WINDOWS\winudspm.exe
  C:\WINDOWS\service.exe
  
  [/quote]
  
  Tallenna se nimellä CFScript.txt
  
  Sitten raahaa CFScript ComboFix.exeen kuten alla.
  [img]http://users.pandora.be/bluepatchy/miekiemoes/images/CFScript.gif[/img]
  
  Käynnistä tietokone uudelleen pyydettäessä ja lähetä combofix.txt-tiedoston sisältö tänne.
  
  *******
  
  scannaa hjt:llä merkkaa paina Fix checked
  
  O2 - BHO: (no name) - {0EF680CB-95FA-48FE-8F8A-DE63F6C0FE36} - C:\WINDOWS\system32\fccCuVLB.dll (file missing)
  O2 - BHO: {675505c6-d999-512b-0884-afefac927545} - {545729ca-fefa-4880-b215-999d6c505576} - C:\WINDOWS\system32\gqumnkfx.dll
  O2 - BHO: (no name) - {5688C5C9-D3C7-485D-8CCA-C22720538FF2} - C:\WINDOWS\system32\efcBqnli.dll (file missing)
  O4 - HKLM\..\Run: [WinampAgent] C:\Program Files\Winamp\winampa.exe
  O4 - HKLM\..\Run: [Windows UDP Control] winudspm.exe
  O4 - HKLM\..\Run: [BM5babca48] Rundll32.exe "C:\WINDOWS\system32\svjrieii.dll",s
  O4 - HKLM\..\Run: [5898f9d4] rundll32.exe "C:\WINDOWS\system32\uukltwhg.dll",b
  O20 - Winlogon Notify: jkkHYpmk - jkkHYpmk.dll (file missing)
  
  **********
  
  sulla näkyy koneella olevan
  virustorjuntoja liikaa
  avg8 ja norton kupaa noista käytät
  Tämmönen tuli ku ajoin uudestaan combon..
  
  ComboFix 08-06-05.3 - Jenna 2008-06-12 18:44:24.4 - NTFSx86
  Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1033.18.344 [GMT 3:00]
  Running from: C:\Documents and Settings\Jenna\Desktop\ComboFix.exe
  Command switches used :: C:\Documents and Settings\Jenna\Desktop\CFScript.txt
  * Created a new restore point
  
  [color=red][b]WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !![/b][/color]
  
  FILE ::
  C:\is155400.exe
  C:\WINDOWS\service.exe
  C:\WINDOWS\system32\efcBqnli.dll
  C:\WINDOWS\system32\fccCuVLB.dll
  C:\WINDOWS\system32\gqumnkfx.dll
  C:\WINDOWS\system32\svjrieii.dll
  C:\WINDOWS\system32\uukltwhg.dll
  C:\WINDOWS\winudspm.exe
  .
  
  ((((((((((((((((((((((((( Files Created from 2008-05-12 to 2008-06-12 )))))))))))))))))))))))))))))))
  .
  
  2008-06-11 19:19 . 2008-04-14 14:01   272,128   ---------   C:\WINDOWS\system32\drivers\bthport.sys
  2008-06-11 19:19 . 2008-04-14 14:01   272,128   -----c---   C:\WINDOWS\system32\dllcache\bthport.sys
  2008-06-11 11:53 . 2008-06-11 11:53      d--------   C:\Program Files\backups
  2008-06-06 15:02 . 2008-06-06 15:10   354   ---hs----   C:\WINDOWS\system32\ghwtlkuu.ini
  2008-06-06 08:09 . 2008-06-06 08:09   396,288   --a------   C:\Program Files\HijackThis.exe
  2008-06-06 00:24 . 2008-06-06 00:24   49,156   --a------   C:\fs.exe
  2008-06-06 00:15 . 2008-06-06 00:17   4,217   --a------   C:\Documents and Settings\Jenna\f.exe
  2008-06-04 22:00 . 2008-06-04 22:00   86,528   --a------   C:\Documents and Settings\Jenna\stp.exe
  2008-06-03 18:36 . 2008-06-03 18:36   86,548   --a------   C:\Documents and Settings\Jenna\setupa.exe
  2008-06-03 16:43 . 2008-06-03 19:54   4,217   --a------   C:\WINDOWS\is154890.exe
  2008-06-03 16:24 . 2008-06-10 22:37      d--------   C:\Documents and Settings\Jenna\Contacts
  2008-06-02 22:33 . 2008-06-03 18:18   96,950   --a------   C:\Documents and Settings\Jenna\setup.exe
  2008-06-02 22:29 . 2008-06-02 22:29   97,116   --a------   C:\WINDOWS\DC5177176.zip
  2008-06-02 00:21 . 2008-06-11 11:10      d--h-----   C:\$AVG8.VAULT$
  2008-06-01 23:51 . 2008-06-11 22:59      d--------   C:\WINDOWS\system32\drivers\Avg
  2008-06-01 23:51 . 2008-06-01 23:51      d--------   C:\Documents and Settings\Jenna\Application Data\AVGTOOLBAR
  2008-06-01 23:51 . 2008-06-01 23:51   96,520   --a------   C:\WINDOWS\system32\drivers\avgldx86.sys
  2008-06-01 23:51 . 2008-06-01 23:51   75,272   --a------   C:\WINDOWS\system32\drivers\avgtdix.sys
  2008-06-01 23:51 . 2008-06-01 23:51   10,520   --a------   C:\WINDOWS\system32\avgrsstx.dll
  2008-06-01 23:50 . 2008-06-01 23:50      d--------   C:\Program Files\AVG
  2008-06-01 23:50 . 2008-06-01 23:50      d--------   C:\Documents and Settings\All Users\Application Data\avg8
  2008-06-01 23:49 . 2008-06-02 10:14      d--------   C:\WINDOWS\SxsCaPendDel
  
  .
  (((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
  .
  2008-06-12 14:54   ---------   d-----w   C:\Documents and Settings\Jenna\Application Data\LimeWire
  2008-06-12 14:22   ---------   d-----w   C:\Program Files\Common Files\Symantec Shared
  2008-06-11 08:48   10,017   ----a-w   C:\Program Files\hijackthis.log
  2008-06-05 13:55   ---------   d-----w   C:\Documents and Settings\All Users\Application Data\OrbNetworks
  2008-06-03 20:24   86,548   ----a-w   C:\WINDOWS\Fonts\setupa.exe
  2008-06-01 14:26   ---------   d-----w   C:\Program Files\Winamp Remote
  2008-05-08 12:28   202,752   ----a-w   C:\WINDOWS\system32\drivers\rmcast.sys
  2008-05-07 05:18   1,287,680   ----a-w   C:\WINDOWS\system32\quartz.dll
  2008-04-23 04:16   826,368   ----a-w   C:\WINDOWS\system32\wininet.dll
  2008-03-27 08:12   151,583   ----a-w   C:\WINDOWS\system32\msjint40.dll
  2008-03-19 09:47   1,845,248   ----a-w   C:\WINDOWS\system32\win32k.sys
  .
  
  ((((((((((((((((((((((((((((( snapshot@2008-06-06_15.05.47.81 )))))))))))))))))))))))))))))))))))))))))
  .
  - 2008-06-06 12:00:30   2,048   --s-a-w   C:\WINDOWS\bootstat.dat
  2008-06-12 14:11:14   2,048   --s-a-w   C:\WINDOWS\bootstat.dat
  2008-04-14 11:01:02   272,128   ------w   C:\WINDOWS\Driver Cache\i386\bthport.sys
  2008-03-01 13:06:20   124,928   -c----w   C:\WINDOWS\ie7updates\KB950759-IE7\advpack.dll
  2008-03-01 13:06:21   347,136   -c----w   C:\WINDOWS\ie7updates\KB950759-IE7\dxtmsft.dll
  2008-03-01 13:06:21   214,528   -c----w   C:\WINDOWS\ie7updates\KB950759-IE7\dxtrans.dll
  2008-03-01 13:06:21   133,120   -c----w   C:\WINDOWS\ie7updates\KB950759-IE7\extmgr.dll
  2008-03-01 13:06:21   63,488   -c----w   C:\WINDOWS\ie7updates\KB950759-IE7\icardie.dll
  2008-02-29 08:55:23   70,656   -c----w   C:\WINDOWS\ie7updates\KB950759-IE7\ie4uinit.exe
  2008-03-01 13:06:21   153,088   -c----w   C:\WINDOWS\ie7updates\KB950759-IE7\ieakeng.dll
  2008-03-01 13:06:21   230,400   -c----w   C:\WINDOWS\ie7updates\KB950759-IE7\ieaksie.dll
  2008-02-15 05:44:25   161,792   -c----w   C:\WINDOWS\ie7updates\KB950759-IE7\ieakui.dll
  2008-03-01 13:06:22   383,488   -c----w   C:\WINDOWS\ie7updates\KB950759-IE7\ieapfltr.dll
  2008-03-01 13:06:22   384,512   -c----w   C:\WINDOWS\ie7updates\KB950759-IE7\iedkcs32.dll
  2008-03-01 13:06:24   6,066,176   -c----w   C:\WINDOWS\ie7updates\KB950759-IE7\ieframe.dll
  2008-03-01 13:06:24   44,544   -c----w   C:\WINDOWS\ie7updates\KB950759-IE7\iernonce.dll
  2008-03-01 13:06:25   267,776   -c----w   C:\WINDOWS\ie7updates\KB950759-IE7\iertutil.dll
  2008-02-22 10:00:51   13,824   -c----w   C:\WINDOWS\ie7updates\KB950759-IE7\ieudinit.exe
  2008-02-29 08:55:46   625,664   -c----w   C:\WINDOWS\ie7updates\KB950759-IE7\iexplore.exe
  2008-03-01 13:06:25   27,648   -c----w   C:\WINDOWS\ie7updates\KB950759-IE7\jsproxy.dll
  2008-03-01 13:06:26   459,264   -c----w   C:\WINDOWS\ie7updates\KB950759-IE7\msfeeds.dll
  2008-03-01 13:06:26   52,224   -c----w   C:\WINDOWS\ie7updates\KB950759-IE7\msfeedsbs.dll
  2008-03-01 15:36:30   3,591,680   -c----w   C:\WINDOWS\ie7updates\KB950759-IE7\mshtml.dll
  2008-03-01 13:06:28   478,208   -c----w   C:\WINDOWS\ie7updates\KB950759-IE7\mshtmled.dll
  2008-03-01 13:06:28   193,024   -c----w   C:\WINDOWS\ie7updates\KB950759-IE7\msrating.dll
  2008-03-01 13:06:29   671,232   -c----w   C:\WINDOWS\ie7updates\KB950759-IE7\mstime.dll
  2008-03-01 13:06:29   102,912   -c----w   C:\WINDOWS\ie7updates\KB950759-IE7\occache.dll
  2008-03-01 13:06:29   44,544   -c----w   C:\WINDOWS\ie7updates\KB950759-IE7\pngfilt.dll
  2007-03-06 01:22:39   213,216   -c----w   C:\WINDOWS\ie7updates\KB950759-IE7\spuninst\spuninst.exe
  2007-03-06 01:23:51   371,424   -c----w   C:\WINDOWS\ie7updates\KB950759-IE7\spuninst\updspapi.dll
  2008-03-01 13:06:29   105,984   -c----w   C:\WINDOWS\ie7updates\KB950759-IE7\url.dll
  2008-03-01 13:06:30   1,159,680   -c----w   C:\WINDOWS\ie7updates\KB950759-IE7\urlmon.dll
  2008-03-01 13:06:30   233,472   -c----w   C:\WINDOWS\ie7updates\KB950759-IE7\webcheck.dll
  2008-03-01 13:06:31   826,368   -c----w   C:\WINDOWS\ie7updates\KB950759-IE7\wininet.dll
  - 2008-03-01 13:06:20   124,928   ----a-w   C:\WINDOWS\system32\advpack.dll
  2008-04-23 04:16:28   124,928   ----a-w   C:\WINDOWS\system32\advpack.dll
  - 2008-03-01 13:06:20   124,928   -c--a-w   C:\WINDOWS\system32\dllcache\advpack.dll
  2008-04-23 04:16:28   124,928   -c--a-w   C:\WINDOWS\system32\dllcache\advpack.dll
  - 2008-03-01 13:06:21   347,136   -c--a-w   C:\WINDOWS\system32\dllcache\dxtmsft.dll
  2008-04-23 04:16:28   347,136   -c--a-w   C:\WINDOWS\system32\dllcache\dxtmsft.dll
  - 2008-03-01 13:06:21   214,528   -c--a-w   C:\WINDOWS\system32\dllcache\dxtrans.dll
  2008-04-23 04:16:28   214,528   -c--a-w   C:\WINDOWS\system32\dllcache\dxtrans.dll
  - 2008-03-01 13:06:21   133,120   -c--a-w   C:\WINDOWS\system32\dllcache\extmgr.dll
  2008-04-23 04:16:28   133,120   -c--a-w   C:\WINDOWS\system32\dllcache\extmgr.dll
  - 2008-03-01 13:06:21   63,488   -c----w   C:\WINDOWS\system32\dllcache\icardie.dll
  2008-04-23 04:16:28   63,488   -c----w   C:\WINDOWS\system32\dllcache\icardie.dll
  - 2008-02-29 08:55:23   70,656   -c--a-w   C:\WINDOWS\system32\dllcache\ie4uinit.exe
  2008-04-22 07:39:58   70,656   -c--a-w   C:\WINDOWS\system32\dllcache\ie4uinit.exe
  - 2008-03-01 13:06:21   153,088   -c--a-w   C:\WINDOWS\system32\dllcache\ieakeng.dll
  2008-04-23 04:16:28   153,088   -c--a-w   C:\WINDOWS\system32\dllcache\ieakeng.dll
  - 2008-03-01 13:06:21   230,400   -c--a-w   C:\WINDOWS\system32\dllcache\ieaksie.dll
  2008-04-23 04:16:28   230,400   -c--a-w   C:\WINDOWS\system32\dllcache\ieaksie.dll
  - 2008-02-15 05:44:25   161,792   -c--a-w   C:\WINDOWS\system32\dllcache\ieakui.dll
  2008-04-20 05:07:51   161,792   -c--a-w   C:\WINDOWS\system32\dllcache\ieakui.dll
  - 2008-03-01 13:06:22   383,488   -c----w   C:\WINDOWS\system32\dllcache\ieapfltr.dll
  2008-04-23 04:16:28   383,488   -c----w   C:\WINDOWS\system32\dllcache\ieapfltr.dll
  - 2008-03-01 13:06:22   384,512   -c--a-w   C:\WINDOWS\system32\dllcache\iedkcs32.dll
  2008-04-23 04:16:28   384,512   -c--a-w   C:\WINDOWS\system32\dllcache\iedkcs32.dll
  - 2008-03-01 13:06:24   6,066,176   -c----w   C:\WINDOWS\system32\dllcache\ieframe.dll
  2008-04-23 04:16:28   6,066,176   -c----w   C:\WINDOWS\system32\dllcache\ieframe.dll
  - 2008-03-01 13:06:24   44,544   -c--a-w   C:\WINDOWS\system32\dllcache\iernonce.dll
  2008-04-23 04:16:28   44,544   -c--a-w   C:\WINDOWS\system32\dllcache\iernonce.dll
  - 2008-03-01 13:06:25   267,776   -c----w   C:\WINDOWS\system32\dllcache\iertutil.dll
  2008-04-23 04:16:28   267,776   -c----w   C:\WINDOWS\system32\dllcache\iertutil.dll
  - 2008-02-22 10:00:51   13,824   -c----w   C:\WINDOWS\system32\dllcache\ieudinit.exe
  2008-04-22 07:39:58   13,824   -c----w   C:\WINDOWS\system32\dllcache\ieudinit.exe
  - 2008-02-29 08:55:46   625,664   -c--a-w   C:\WINDOWS\system32\dllcache\iexplore.exe
  2008-04-22 07:40:18   625,664   -c--a-w   C:\WINDOWS\system32\dllcache\iexplore.exe
  - 2008-03-01 13:06:25   27,648   -c--a-w   C:\WINDOWS\system32\dllcache\jsproxy.dll
  2008-04-23 04:16:28   27,648   -c--a-w   C:\WINDOWS\system32\dllcache\jsproxy.dll
  - 2008-03-01 13:06:26   459,264   -c----w   C:\WINDOWS\system32\dllcache\msfeeds.dll
  2008-04-23 04:16:28   459,264   -c----w   C:\WINDOWS\system32\dllcache\msfeeds.dll
  - 2008-03-01 13:06:26   52,224   -c----w   C:\WINDOWS\system32\dllcache\msfeedsbs.dll
  2008-04-23 04:16:28   52,224   -c----w   C:\WINDOWS\system32\dllcache\msfeedsbs.dll
  - 2008-03-01 15:36:30   3,591,680   -c--a-w   C:\WINDOWS\system32\dllcache\mshtml.dll
  2008-04-23 19:16:30   3,591,680   -c--a-w   C:\WINDOWS\system32\dllcache\mshtml.dll
  - 2008-03-01 13:06:28   478,208   -c--a-w   C:\WINDOWS\system32\dllcache\mshtmled.dll
  2008-04-23 04:16:28   478,208   -c--a-w   C:\WINDOWS\system32\dllcache\mshtmled.dll
  - 2008-03-01 13:06:28   193,024   -c--a-w   C:\WINDOWS\system32\dllcache\msrating.dll
  2008-04-23 04:16:28   193,024   -c--a-w   C:\WINDOWS\system32\dllcache\msrating.dll
  - 2008-03-01 13:06:29   671,232   -c--a-w   C:\WINDOWS\system32\dllcache\mstime.dll
  2008-04-23 04:16:28   671,232   -c--a-w   C:\WINDOWS\system32\dllcache\mstime.dll
  - 2008-03-01 13:06:29   102,912   -c--a-w   C:\WINDOWS\system32\dllcache\occache.dll
  2008-04-23 04:16:28   102,912   -c--a-w   C:\WINDOWS\system32\dllcache\occache.dll
  - 2008-03-01 13:06:29   44,544   -c--a-w   C:\WINDOWS\system32\dllcache\pngfilt.dll
  2008-04-23 04:16:28   44,544   -c--a-w   C:\WINDOWS\system32\dllcache\pngfilt.dll
  - 2007-10-29 22:43:03   1,287,680   -c--a-w   C:\WINDOWS\system32\dllcache\quartz.dll
  2008-05-07 05:18:48   1,287,680   -c--a-w   C:\WINDOWS\system32\dllcache\quartz.dll
  - 2006-07-13 08:48:58   202,240   -c--a-w   C:\WINDOWS\system32\dllcache\rmcast.sys
  2008-05-08 12:28:49   202,752   -c--a-w   C:\WINDOWS\system32\dllcache\rmcast.sys
  - 2008-03-01 13:06:29   105,984   -c--a-w   C:\WINDOWS\system32\dllcache\url.dll
  2008-04-23 04:16:28   105,984   -c--a-w   C:\WINDOWS\system32\dllcache\url.dll
  - 2008-03-01 13:06:30   1,159,680   -c--a-w   C:\WINDOWS\system32\dllcache\urlmon.dll
  2008-04-23 04:16:29   1,159,680   -c--a-w   C:\WINDOWS\system32\dllcache\urlmon.dll
  - 2008-03-01 13:06:30   233,472   -c--a-w   C:\WINDOWS\system32\dllcache\webcheck.dll
  2008-04-23 04:16:29   233,472   -c--a-w   C:\WINDOWS\system32\dllcache\webcheck.dll
  - 2008-03-01 13:06:31   826,368   -c--a-w   C:\WINDOWS\system32\dllcache\wininet.dll
  2008-04-23 04:16:29   826,368   -c--a-w   C:\WINDOWS\system32\dllcache\wininet.dll
  - 2008-03-01 13:06:21   347,136   ----a-w   C:\WINDOWS\system32\dxtmsft.dll
  2008-04-23 04:16:28   347,136   ----a-w   C:\WINDOWS\system32\dxtmsft.dll
  - 2008-03-01 13:06:21   214,528   ----a-w   C:\WINDOWS\system32\dxtrans.dll
  2008-04-23 04:16:28   214,528   ----a-w   C:\WINDOWS\system32\dxtrans.dll
  - 2008-03-01 13:06:21   133,120   ----a-w   C:\WINDOWS\system32\extmgr.dll
  2008-04-23 04:16:28   133,120   ----a-w   C:\WINDOWS\system32\extmgr.dll
  - 2008-03-01 13:06:21   63,488   ----a-w   C:\WINDOWS\system32\icardie.dll
  2008-04-23 04:16:28   63,488   ----a-w   C:\WINDOWS\system32\icardie.dll
  - 2008-02-29 08:55:23   70,656   ----a-w   C:\WINDOWS\system32\ie4uinit.exe
  2008-04-22 07:39:58   70,656   ----a-w   C:\WINDOWS\system32\ie4uinit.exe
  - 2008-03-01 13:06:21   153,088   ----a-w   C:\WINDOWS\system32\ieakeng.dll
  2008-04-23 04:16:28   153,088   ----a-w   C:\WINDOWS\system32\ieakeng.dll
  - 2008-03-01 13:06:21   230,400   ----a-w   C:\WINDOWS\system32\ieaksie.dll
  2008-04-23 04:16:28   230,400   ----a-w   C:\WINDOWS\system32\ieaksie.dll
  - 2008-02-15 05:44:25   161,792   ----a-w   C:\WINDOWS\system32\ieakui.dll
  2008-04-20 05:07:51   161,792   ----a-w   C:\WINDOWS\system32\ieakui.dll
  - 2008-03-01 13:06:22   383,488   ----a-w   C:\WINDOWS\system32\ieapfltr.dll
  2008-04-23 04:16:28   383,488   ----a-w   C:\WINDOWS\system32\ieapfltr.dll
  - 2008-03-01 13:06:22   384,512   ----a-w   C:\WINDOWS\system32\iedkcs32.dll
  2008-04-23 04:16:28   384,512   ----a-w   C:\WINDOWS\system32\iedkcs32.dll
  - 2008-03-01 13:06:24   6,066,176   ----a-w   C:\WINDOWS\system32\ieframe.dll
  2008-04-23 04:16:28   6,066,176   ----a-w   C:\WINDOWS\system32\ieframe.dll
  - 2008-03-01 13:06:24   44,544   ----a-w   C:\WINDOWS\system32\iernonce.dll
  2008-04-23 04:16:28   44,544   ----a-w   C:\WINDOWS\system32\iernonce.dll
  - 2008-03-01 13:06:25   267,776   ----a-w   C:\WINDOWS\system32\iertutil.dll
  2008-04-23 04:16:28   267,776   ----a-w   C:\WINDOWS\system32\iertutil.dll
  - 2008-02-22 10:00:51   13,824   ----a-w   C:\WINDOWS\system32\ieudinit.exe
  2008-04-22 07:39:58   13,824   ----a-w   C:\WINDOWS\system32\ieudinit.exe
  - 2008-03-01 13:06:25   27,648   ----a-w   C:\WINDOWS\system32\jsproxy.dll
  2008-04-23 04:16:28   27,648   ----a-w   C:\WINDOWS\system32\jsproxy.dll
  - 2008-05-09 21:35:04   16,863,864   ----a-w   C:\WINDOWS\system32\MRT.exe
  2008-05-29 23:35:11   17,486,968   ----a-w   C:\WINDOWS\system32\MRT.exe
  - 2008-03-01 13:06:26   459,264   ----a-w   C:\WINDOWS\system32\msfeeds.dll
  2008-04-23 04:16:28   459,264   ----a-w   C:\WINDOWS\system32\msfeeds.dll
  - 2008-03-01 13:06:26   52,224   ----a-w   C:\WINDOWS\system32\msfeedsbs.dll
  2008-04-23 04:16:28   52,224   ----a-w   C:\WINDOWS\system32\msfeedsbs.dll
  - 2008-03-01 15:36:30   3,591,680   ----a-w   C:\WINDOWS\system32\mshtml.dll
  2008-04-23 19:16:30   3,591,680   ----a-w   C:\WINDOWS\system32\mshtml.dll
  - 2008-03-01 13:06:28   478,208   ----a-w   C:\WINDOWS\system32\mshtmled.dll
  2008-04-23 04:16:28   478,208   ----a-w   C:\WINDOWS\system32\mshtmled.dll
  - 2008-03-01 13:06:28   193,024   ----a-w   C:\WINDOWS\system32\msrating.dll
  2008-04-23 04:16:28   193,024   ----a-w   C:\WINDOWS\system32\msrating.dll
  - 2008-03-01 13:06:29   671,232   ----a-w   C:\WINDOWS\system32\mstime.dll
  2008-04-23 04:16:28   671,232   ----a-w   C:\WINDOWS\system32\mstime.dll
  - 2008-03-01 13:06:29   102,912   ----a-w   C:\WINDOWS\system32\occache.dll
  2008-04-23 04:16:28   102,912   ----a-w   C:\WINDOWS\system32\occache.dll
  - 2008-03-01 13:06:29   44,544   ----a-w   C:\WINDOWS\system32\pngfilt.dll
  2008-04-23 04:16:28   44,544   ----a-w   C:\WINDOWS\system32\pngfilt.dll
  - 2006-10-08 18:51:14   14,640   ----a-w   C:\WINDOWS\system32\spmsg.dll
  2007-11-30 11:18:51   17,272   ------w   C:\WINDOWS\system32\spmsg.dll
  - 2008-03-01 13:06:29   105,984   ----a-w   C:\WINDOWS\system32\url.dll
  2008-04-23 04:16:28   105,984   ----a-w   C:\WINDOWS\system32\url.dll
  - 2008-03-01 13:06:30   1,159,680   ----a-w   C:\WINDOWS\system32\urlmon.dll
  2008-04-23 04:16:29   1,159,680   ----a-w   C:\WINDOWS\system32\urlmon.dll
  - 2008-03-01 13:06:30   233,472   ----a-w   C:\WINDOWS\system32\webcheck.dll
  2008-04-23 04:16:29   233,472   ----a-w   C:\WINDOWS\system32\webcheck.dll
  .
  -- Snapshot reset to current date --
  .
  ((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
  .
  .
  *Note* empty entries & legit default entries are not shown
  REGEDIT4
  
  [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{A057A204-BACC-4D26-9990-79A187E2698E}]
  2008-06-01 23:51   2050816   --a------   C:\PROGRA~1\AVG\AVG8\AVGTOO~1.DLL
  
  [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
  "{EBF2BA02-9094-4C5A-858B-BB198F3D8DE2}"= "C:\Program Files\Winamp Toolbar\winamptb.dll" [2007-12-13 19:49 1185120]
  "{A057A204-BACC-4D26-9990-79A187E2698E}"= "C:\PROGRA~1\AVG\AVG8\AVGTOO~1.DLL" [2008-06-01 23:51 2050816]
  
  [HKEY_CLASSES_ROOT\clsid\{ebf2ba02-9094-4c5a-858b-bb198f3d8de2}]
  [HKEY_CLASSES_ROOT\WINAMPTB.AOLToolBand.1]
  [HKEY_CLASSES_ROOT\TypeLib\{538CD77C-BFDD-49b0-9562-77419CAB89D1}]
  [HKEY_CLASSES_ROOT\WINAMPTB.AOLToolBand]
  
  [HKEY_CLASSES_ROOT\clsid\{a057a204-bacc-4d26-9990-79a187e2698e}]
  [HKEY_CLASSES_ROOT\avgtoolbar.AVGTOOLBAR]
  
  [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser]
  "{EBF2BA02-9094-4C5A-858B-BB198F3D8DE2}"= C:\Program Files\Winamp Toolbar\winamptb.dll [2007-12-13 19:49 1185120]
  
  [HKEY_CLASSES_ROOT\clsid\{ebf2ba02-9094-4c5a-858b-bb198f3d8de2}]
  [HKEY_CLASSES_ROOT\WINAMPTB.AOLToolBand.1]
  [HKEY_CLASSES_ROOT\TypeLib\{538CD77C-BFDD-49b0-9562-77419CAB89D1}]
  [HKEY_CLASSES_ROOT\WINAMPTB.AOLToolBand]
  
  [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
  "ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 15:00 15360]
  "MsnMsgr"="C:\Program Files\MSN Messenger\MsnMsgr.exe" [2007-01-19 12:55 5674352]
  "Orb"="C:\Program Files\Winamp Remote\bin\OrbTray.exe" [2008-01-07 23:02 495616]
  
  [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
  "SynTPLpr"="C:\Program Files\Synaptics\SynTP\SynTPLpr.exe" [2005-02-04 11:12 102490]
  "SynTPEnh"="C:\Program Files\Synaptics\SynTP\SynTPEnh.exe" [2005-02-04 11:11 708698]
  "ACU"="C:\Program Files\Atheros\ACU.exe" [2005-01-31 08:05 253952]
  "Broadcom Wireless Manager UI"="C:\WINDOWS\system32\WLTRAY" [ ]
  "SoundMan"="SOUNDMAN.EXE" [2005-04-15 11:01 77824 C:\WINDOWS\SOUNDMAN.EXE]
  "IgfxTray"="C:\WINDOWS\system32\igfxtray.exe" [2005-01-23 10:36 155648]
  "HotKeysCmds"="C:\WINDOWS\system32\hkcmd.exe" [2005-01-23 10:31 126976]
  "LaunchAp"="C:\Program Files\Launch Manager\LaunchAp.exe" [2005-03-30 15:29 32768]
  "PowerKey"="C:\Program Files\Launch Manager\PowerKey.exe" [2002-08-30 15:02 94208]
  "LManager"="C:\Program Files\Launch Manager\HotkeyApp.exe" [2005-06-06 11:52 69632]
  "CtrlVol"="C:\Program Files\Launch Manager\CtrlVol.exe" [2003-09-16 14:28 20480]
  "LMgrOSD"="C:\Program Files\Launch Manager\OSDCtrl.exe" [2005-06-06 14:18 241664]
  "Wbutton"="C:\Program Files\Launch Manager\Wbutton.exe" [2005-06-21 11:51 81920]
  "EPM-DM"="c:\acer\epm\epm-dm.exe" [2005-06-01 14:17 192512]
  "ePowerManagement"="C:\Acer\ePM\ePM.exe" [2005-03-15 10:03 2893824]
  "RemoteControl"="C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe" [2006-12-06 18:37 69216]
  "LanguageShortcut"="C:\Program Files\CyberLink\PowerDVD\Language\Language.exe" [2006-12-05 22:55 54832]
  "ccApp"="C:\Program Files\Common Files\Symantec Shared\ccApp.exe" [2005-09-17 02:27 52848]
  "Kernel and Hardware Abstraction Layer"="KHALMNPR.EXE" [2007-04-11 15:32 56080 C:\WINDOWS\KHALMNPR.Exe]
  "SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe" [2007-07-12 04:00 132496]
  "Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-01-11 23:16 39792]
  "Windows svchost"="service.exe" []
  "AVG8_TRAY"="C:\PROGRA~1\AVG\AVG8\avgtray.exe" [2008-06-01 23:50 1177368]
  
  C:\Documents and Settings\All Users\Start Menu\Programs\Startup\
  Logitech SetPoint.lnk - C:\Program Files\Logitech\SetPoint\SetPoint.exe [2007-07-18 19:02:20 692224]
  
  [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
  "AppInit_DLLs"=avgrsstx.dll
  
  [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WdfLoadGroup]
  @=""
  
  [HKEY_LOCAL_MACHINE\software\microsoft\security center]
  "AntiVirusDisableNotify"=dword:00000001
  
  [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
  "DisableMonitoring"=dword:00000001
  
  [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
  "DisableMonitoring"=dword:00000001
  
  [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
  "EnableFirewall"= 0 (0x0)
  
  [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
  "%windir%\\system32\\sessmgr.exe"=
  "%windir%\\Network Diagnostic\\xpnetdiag.exe"=
  "C:\\Program Files\\MSN Messenger\\msnmsgr.exe"=
  "C:\\Program Files\\MSN Messenger\\livecall.exe"=
  "C:\\Program Files\\LimeWire\\LimeWire.exe"=
  "C:\\Program Files\\Winamp Remote\\bin\\Orb.exe"=
  "C:\\Program Files\\Winamp Remote\\bin\\OrbTray.exe"=
  "C:\\Program Files\\Winamp Remote\\bin\\OrbStreamerClient.exe"=
  "C:\\Program Files\\AVG\\AVG8\\avgupd.exe"=
  "C:\\Program Files\\AVG\\AVG8\\avgemc.exe"=
  
  R1 AvgLdx86;AVG AVI Loader Driver x86;C:\WINDOWS\system32\Drivers\avgldx86.sys [2008-06-01 23:51]
  R1 Hotkey;Hotkey;C:\WINDOWS\system32\drivers\Hotkey.sys [2003-04-28 11:27]
  R2 {95808DC4-FA4A-4c74-92FE-5B863F82066B};{95808DC4-FA4A-4c74-92FE-5B863F82066B};C:\Program Files\CyberLink\PowerDVD\[u]0[/u]00.fcl [2006-11-02 16:51]
  R2 Automattinen LiveUpdate-ajastustoiminto;Automattinen LiveUpdate-ajastustoiminto;"C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe" [2006-08-03 17:58]
  R2 avg8emc;AVG8 E-mail Scanner;C:\PROGRA~1\AVG\AVG8\avgemc.exe [2008-06-01 23:50]
  R2 avg8wd;AVG8 WatchDog;C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe [2008-06-01 23:50]
  R2 AvgTdiX;AVG8 Network Redirector;C:\WINDOWS\system32\Drivers\avgtdix.sys [2008-06-01 23:51]
  R2 EpmPsd;Acer EPM Power Scheme Driver;C:\WINDOWS\system32\drivers\epm-psd.sys [2004-07-19 13:10]
  R2 EpmShd;Acer EPM System Hardware Driver;C:\WINDOWS\system32\drivers\epm-shd.sys [2005-04-07 18:08]
  R3 POWERKEY;POWERKEY;C:\Program Files\Launch Manager\POWERKEY.sys [2000-12-19 18:29]
  S1 Wbutton;Wbutton;C:\WINDOWS\system32\drivers\Wbutton.sys []
  
  [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{26fd6930-d0fc-11dc-a256-0014a45100e1}]
  \Shell\AutoRun\command - E:\AutoRun.exe
  
  [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{e5132110-ca9b-11dc-a24d-0014a45100e1}]
  \Shell\AutoRun\command - E:\AutoRun.exe
  
  .
  Contents of the 'Scheduled Tasks' folder
  "2008-06-06 23:35:56 C:\WINDOWS\Tasks\Norton AntiVirus - Suorita täydellinen järjestelmäntarkistus - Jenna.job"
  - C:\PROGRA~1\NORTON~1\Navw32.exeh/TASK:
  .
  **************************************************************************
  
  catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
  Rootkit scan 2008-06-12 18:47:50
  Windows 5.1.2600 Service Pack 2 NTFS
  
  scanning hidden processes ...
  
  scanning hidden autostart entries ...
  
  scanning hidden files ...
  
  scan completed successfully
  hidden files: 0
  
  **************************************************************************
  
  [HKEY_LOCAL_MACHINE\system\ControlSet001\Services\{95808DC4-FA4A-4c74-92FE-5B863F82066B}]
  "ImagePath"="\??\C:\Program Files\CyberLink\PowerDVD\[u]0[/u]00.fcl"
  .
  Completion time: 2008-06-12 18:49:48
  ComboFix-quarantined-files.txt 2008-06-12 15:49:34
  ComboFix2.txt 2008-06-11 08:43:08
  ComboFix3.txt 2008-06-06 12:13:16
  
  Pre-Run: 66,910,429,184 bytes free
  Post-Run: 66,925,199,360 bytes free
  
  328   --- E O F ---   2008-06-11 21:01:04
  
  Ja tällanen sitte ku poistin ne mitä pyysit..
  
  Logfile of Trend Micro HijackThis v2.0.2
  Scan saved at 18:52:44, on 12.6.2008
  Platform: Windows XP SP2 (WinNT 5.01.2600)
  MSIE: Internet Explorer v7.00 (7.00.6000.16674)
  Boot mode: Normal
  
  Running processes:
  C:\WINDOWS\System32\smss.exe
  C:\WINDOWS\system32\winlogon.exe
  C:\WINDOWS\system32\services.exe
  C:\WINDOWS\system32\lsass.exe
  C:\WINDOWS\system32\svchost.exe
  C:\WINDOWS\System32\svchost.exe
  C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
  C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
  C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
  C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
  C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
  C:\WINDOWS\System32\wltrysvc.exe
  C:\WINDOWS\System32\bcmwltry.exe
  C:\WINDOWS\system32\spoolsv.exe
  C:\WINDOWS\system32\acs.exe
  C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
  C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
  C:\Program Files\Norton AntiVirus\navapsvc.exe
  C:\Program Files\Norton AntiVirus\IWP\NPFMntor.exe
  C:\Program Files\CyberLink\Shared Files\RichVideo.exe
  C:\WINDOWS\system32\svchost.exe
  C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
  C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
  C:\WINDOWS\system32\WLTRAY.exe
  C:\WINDOWS\SOUNDMAN.EXE
  C:\WINDOWS\system32\igfxtray.exe
  C:\WINDOWS\system32\hkcmd.exe
  C:\Program Files\Launch Manager\LaunchAp.exe
  C:\Program Files\Launch Manager\PowerKey.exe
  C:\Program Files\Launch Manager\HotkeyApp.exe
  C:\Program Files\Launch Manager\OSDCtrl.exe
  C:\Program Files\Launch Manager\Wbutton.exe
  C:\acer\epm\epm-dm.exe
  C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe
  C:\Program Files\Common Files\Symantec Shared\ccApp.exe
  C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe
  C:\PROGRA~1\AVG\AVG8\avgtray.exe
  C:\WINDOWS\system32\ctfmon.exe
  C:\Program Files\MSN Messenger\MsnMsgr.Exe
  C:\Program Files\Winamp Remote\bin\OrbTray.exe
  C:\Program Files\Logitech\SetPoint\SetPoint.exe
  C:\PROGRA~1\AVG\AVG8\avgrsx.exe
  C:\Program Files\Common Files\Logitech\KhalShared\KHALMNPR.EXE
  C:\PROGRA~1\AVG\AVG8\avgemc.exe
  C:\Program Files\Winamp Remote\bin\Orb.exe
  C:\Program Files\Common Files\Symantec Shared\Security Console\NSCSRVCE.EXE
  C:\Program Files\Mobile Partner\Mobile Partner.exe
  C:\Program Files\MSN Messenger\usnsvc.exe
  C:\Program Files\LimeWire\LimeWire.exe
  C:\WINDOWS\explorer.exe
  C:\WINDOWS\system32\notepad.exe
  C:\Program Files\Internet Explorer\IEXPLORE.EXE
  c:\program files\winamp toolbar\WinampTbServer.exe
  C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLLoginProxy.exe
  C:\Program Files\Messenger\msmsgs.exe
  C:\Program Files\HijackThis.exe
  
  R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.superjymy.fi/
  R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
  R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
  R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
  R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
  O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
  O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
  O2 - BHO: AVG Security Toolbar - {A057A204-BACC-4D26-9990-79A187E2698E} - C:\PROGRA~1\AVG\AVG8\AVGTOO~1.DLL
  O2 - BHO: NAV Helper - {A8F38D8D-E480-4D52-B7A2-731BB6995FDD} - C:\Program Files\Norton AntiVirus\NavShExt.dll
  O3 - Toolbar: Norton AntiVirus - {C4069E3A-68F1-403E-B40E-20066696354B} - C:\Program Files\Norton AntiVirus\NavShExt.dll
  O3 - Toolbar: Winamp Toolbar - {EBF2BA02-9094-4c5a-858B-BB198F3D8DE2} - C:\Program Files\Winamp Toolbar\winamptb.dll
  O3 - Toolbar: AVG Security Toolbar - {A057A204-BACC-4D26-9990-79A187E2698E} - C:\PROGRA~1\AVG\AVG8\AVGTOO~1.DLL
  O4 - HKLM\..\Run: [SynTPLpr] C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
  O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
  O4 - HKLM\..\Run: [ACU] "C:\Program Files\Atheros\ACU.exe" -nogui
  O4 - HKLM\..\Run: [Broadcom Wireless Manager UI] C:\WINDOWS\system32\WLTRAY
  O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
  O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\system32\igfxtray.exe
  O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe
  O4 - HKLM\..\Run: [LaunchAp] "C:\Program Files\Launch Manager\LaunchAp.exe"
  O4 - HKLM\..\Run: [PowerKey] "C:\Program Files\Launch Manager\PowerKey.exe"
  O4 - HKLM\..\Run: [LManager] "C:\Program Files\Launch Manager\HotkeyApp.exe"
  O4 - HKLM\..\Run: [CtrlVol] "C:\Program Files\Launch Manager\CtrlVol.exe"
  O4 - HKLM\..\Run: [LMgrOSD] "C:\Program Files\Launch Manager\OSDCtrl.exe"
  O4 - HKLM\..\Run: [Wbutton] "C:\Program Files\Launch Manager\Wbutton.exe"
  O4 - HKLM\..\Run: [EPM-DM] c:\acer\epm\epm-dm.exe
  O4 - HKLM\..\Run: [ePowerManagement] C:\Acer\ePM\ePM.exe boot
  O4 - HKLM\..\Run: [RemoteControl] "C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe"
  O4 - HKLM\..\Run: [LanguageShortcut] "C:\Program Files\CyberLink\PowerDVD\Language\Language.exe"
  O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
  O4 - HKLM\..\Run: [Kernel and Hardware Abstraction Layer] KHALMNPR.EXE
  O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe"
  O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
  O4 - HKLM\..\Run: [Windows svchost] service.exe
  O4 - HKLM\..\Run: [AVG8_TRAY] C:\PROGRA~1\AVG\AVG8\avgtray.exe
  O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
  O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
  O4 - HKCU\..\Run: [Orb] "C:\Program Files\Winamp Remote\bin\OrbTray.exe" /background
  O4 - Global Startup: Logitech SetPoint.lnk = C:\Program Files\Logitech\SetPoint\SetPoint.exe
  O8 - Extra context menu item: &Winamp Toolbar Search - C:\Documents and Settings\All Users\Application Data\Winamp Toolbar\ieToolbar\resources\en-US\local\search.html
  O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
  O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
  O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
  O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
  O16 - DPF: {5C6698D9-7BE4-4122-8EC5-291D84DBD4A0} (Facebook Photo Uploader 4 Control) - http://upload.facebook.com/controls/FacebookPhotoUploader3.cab
  O16 - DPF: {5F8469B4-B055-49DD-83F7-62B522420ECC} (Facebook Photo Uploader Control) - http://upload.facebook.com/controls/FacebookPhotoUploader.cab
  O17 - HKLM\System\CCS\Services\Tcpip\..\{DBF43578-B928-4311-B8C4-6447CCE77FA1}: NameServer = 217.78.192.22 217.78.192.78
  O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG8\avgpp.dll
  O20 - AppInit_DLLs: avgrsstx.dll
  O23 - Service: Atheros Configuration Service (ACS) - Unknown owner - C:\WINDOWS\system32\acs.exe
  O23 - Service: Automattinen LiveUpdate-ajastustoiminto - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
  O23 - Service: AVG8 E-mail Scanner (avg8emc) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgemc.exe
  O23 - Service: AVG8 WatchDog (avg8wd) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
  O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
  O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
  O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
  O23 - Service: Norton AntiVirus Auto-Protect -palvelu (navapsvc) - Symantec Corporation - C:\Program Files\Norton AntiVirus\navapsvc.exe
  O23 - Service: Norton AntiVirus Firewall Monitor Service (NPFMntor) - Symantec Corporation - C:\Program Files\Norton AntiVirus\IWP\NPFMntor.exe
  O23 - Service: Norton Protection Center Service (NSCService) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\Security Console\NSCSRVCE.EXE
  O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - C:\Program Files\CyberLink\Shared Files\RichVideo.exe
  O23 - Service: Symantec AVScan (SAVScan) - Symantec Corporation - C:\Program Files\Norton AntiVirus\SAVScan.exe
  O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
  O23 - Service: SPBBCSvc - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
  O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
  O23 - Service: Broadcom Wireless LAN Tray Service (wltrysvc) - Unknown owner - C:\WINDOWS\System32\wltrysvc.exe
  
  --
  End of file - 9348 bytes

Ketjusta on poistettu 0 sääntöjenvastaista viestiä.

Takaisin ylös

Luetuimmat keskustelut

Miksi jollain jää "talvi päälle"
Huvittaa kastoa ullkona jotain vahempaa äijää joka pukeutuu edelleen kun olisi +5 astetta lämmittä vaikka on helle keli
16.05.2024 12:52Maailman menoa
325
3203
Mitä et hyväksy miehessä/naisessa josta olet kiinnostunut?
Itse en halua, että miehellä olisi lapsia!
16.05.2024 20:33Ikävä
223
1994
Se katse silloin
Oli hetki, jolloin katseemme kohtasivat. Oli talvi vielä. Kerta toisensa jälkeen palaan tuohon jaettuun katseeseen. Tunt
16.05.2024 17:57Ikävä
59
1612
Tiesitkö? Farmi Suomi Kirsikka Simberg on tämän julkkisnaisen tytär - Katso tyrmäävät mallikuvat!
Oho, aikamoinen ylläri. Tiesitkö?! Kirsikka Simberg on yksi tämän kauden Farmi Suomi -kisaajista. Hänellä ei ole tuttu t
16.05.2024 09:29Suomalaiset julkkikset
5
1427
Kaipaaville
Kerro sun tunteesi ja ajatukset tähän jos et uskalla irl!
16.05.2024 21:47Ikävä
82
1309
Tuhdit oluet kauppoihin. Miksi vastustaa?
8% oluet kauppoihin mutta mikä siinä on että osa politikoista vstustaa ? Kauppa kuitenkin hinnoittelee vahvan oluen ni
16.05.2024 07:23Maailman menoa
284
1243
Miten haluaisit
Että reagoisin jos näkisin sinut nyt?
16.05.2024 20:47Ikävä
81
1074
Sinua tulen kyllä ikävöimään pitkään nainen
mutta oli pakko tehdä päätös oman mielenrauhan vuoksi. Toivottavasti saat elämältä kaiken mitä haluat.
16.05.2024 20:22Ikävä
52
1061
Tärkeä kysymys!
Haluatko sinä, mies, minut?
17.05.2024 19:06Ikävä
80
1001
Asiallinen lähestyminen
Mitä on asiallinen lähestyminen?? Tietääkö tai tajuaako kukaan, varsinkaan miehet??? Eilen NELJÄNNEN kerran jouduin isk
17.05.2024 15:01Sinkut
146
878

Apua, taaskaan en ossaa:)

Vastaukset

lonti x 2 kirjoitti:

FixFix kirjoitti:

Luetuimmat keskustelut

Miksi jollain jää "talvi päälle"

Mitä et hyväksy miehessä/naisessa josta olet kiinnostunut?

Se katse silloin

Tiesitkö? Farmi Suomi Kirsikka Simberg on tämän julkkisnaisen tytär - Katso tyrmäävät mallikuvat!

Kaipaaville

Tuhdit oluet kauppoihin. Miksi vastustaa?

Miten haluaisit

Sinua tulen kyllä ikävöimään pitkään nainen

Tärkeä kysymys!

Asiallinen lähestyminen

Suomen Pallolitto: Tasoryhmät lasten jalkapallossa - Erätauko-tilaisuus ma 20.5.2024

Jennika Vikman avoimena - Isosisko Erika Vikman ohjeisti napakasti Tähdet, tähdet -kisaan: "Älä.."

Tähdet, tähdet -tippuja Sara Chafak uskoo tähän yliluonnolliseen: "Se on niinkin yksinkertaista..."

Tiesitkö? Farmi Suomi Kirsikka Simberg on tämän julkkisnaisen tytär - Katso tyrmäävät mallikuvat!

Tuhdit oluet kauppoihin. Miksi vastustaa?

Miksi jollain jää "talvi päälle"

Seiska: Teemu Roivainen paljastaa, miten käytti Selviytyjät 30 000 voittorahat: "Menivät..."

Tuhoaako tekoäly maailman?

Miksi koulut pakottavat

Oi, mikä upea luksusmökki! Hanna Kinnunen avaa ovet Lapin huvilalle - Katso kuvat tästä!