Onko varma virus tuo svehost.exe ja kuinka suoritetaan varma poisto? Merkkasin sen huutomerkeillä tonne lokiin!!!!! Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\DigitalPersona\Bin\DPWinLct.exe C:\WINDOWS\system32\spoolsv.exe C:\Program Files\DigitalPersona\Bin\DpHost.exe C:\Program Files\F-Secure\Anti-Virus\fsgk32st.exe C:\Program Files\F-Secure\Anti-Virus\FSGK32.EXE C:\Program Files\F-Secure\Common\FSMA32.EXE C:\WINDOWS\system32\nvsvc32.exe C:\Program Files\F-Secure\Common\FSMB32.EXE C:\WINDOWS\system32\svchost.exe C:\Program Files\F-Secure\Common\FCH32.EXE C:\Program Files\DigitalPersona\Bin\DPFUSMgr.exe C:\Program Files\F-Secure\Common\FAMEH32.EXE C:\Program Files\F-Secure\Anti-Virus\fsqh.exe C:\Program Files\F-Secure\FSAUA\program\fsaua.exe C:\Program Files\F-Secure\Anti-Virus\fssm32.exe C:\Program Files\F-Secure\FWES\Program\fsdfwd.exe C:\Program Files\F-Secure\FSAUA\program\fsus.exe C:\WINDOWS\Explorer.EXE C:\Program Files\Analog Devices\Core\smax4pnp.exe C:\Program Files\Analog Devices\SoundMAX\Smax4.exe C:\WINDOWS\system32\RUNDLL32.EXE C:\Program Files\F-Secure\Common\FSM32.EXE C:\WINDOWS\system32\svehost.exe C:\WINDOWS\system32\ctfmon.exe C:\Program Files\F-Secure\FSGUI\fsguidll.exe C:\Program Files\F-Secure\Anti-Virus\fsav32.exe C:\WINDOWS\system32\wuauclt.exe C:\Documents and Settings\\Työpöytä\scanner.exe.exe \?\C:\WINDOWS\system32\WBEM\WMIADAP.EXE R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.ess.fi/ R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://windowsupdate.microsoft.com/ R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Linkit O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_10\bin\ssv.dll O2 - BHO: AcroIEToolbarHelper Class - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll O4 - HKLM\..\Run: [SoundMAXPnP] C:\Program Files\Analog Devices\Core\smax4pnp.exe O4 - HKLM\..\Run: [SoundMAX] "C:\Program Files\Analog Devices\SoundMAX\Smax4.exe" /tray O4 - HKLM\..\Run: [JMB36X Configure] C:\WINDOWS\system32\JMRaidTool.exe boot O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup O4 - HKLM\..\Run: [nwiz] nwiz.exe /install O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit O4 - HKLM\..\Run: [F-Secure Manager] "C:\Program Files\F-Secure\Common\FSM32.EXE" /splash O4 - HKLM\..\Run: [F-Secure TNB] "C:\Program Files\F-Secure\FSGUI\TNBUtil.exe" /CHECKALL /WAITFORSW O4 - HKLM\..\Run: [Microsoft Updates] svehost.exe !!!!!!!!!!!!!!!!!!!! O4 - HKLM\..\RunServices: [Microsoft Updates] svehost.exe !!!!!!!!!!!!!!!!!!!!!!!!!! O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe O8 - Extra context menu item: Convert link target to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html O8 - Extra context menu item: Convert link target to existing PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html O8 - Extra context menu item: Convert selected links to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECaptureSelLinks.html O8 - Extra context menu item: Convert selected links to existing PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppendSelLinks.html O8 - Extra context menu item: Convert selection to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html O8 - Extra context menu item: Convert selection to existing PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html O8 - Extra context menu item: Convert to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html O8 - Extra context menu item: Convert to existing PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000 O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_10\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_10\bin\ssv.dll O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing) O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing) O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing) O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing) O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O10 - Unknown file in Winsock LSP: c:\program files\f-secure\fsps\program\fslsp.dll O10 - Unknown file in Winsock LSP: c:\program files\f-secure\fsps\program\fslsp.dll O10 - Unknown file in Winsock LSP: c:\program files\f-secure\fsps\program\fslsp.dll O10 - Unknown file in Winsock LSP: c:\program files\f-secure\fsps\program\fslsp.dll O10 - Unknown file in Winsock LSP: c:\program files\f-secure\fsps\program\fslsp.dll O10 - Unknown file in Winsock LSP: c:\program files\f-secure\fsps\program\fslsp.dll O10 - Unknown file in Winsock LSP: c:\program files\f-secure\fsps\program\fslsp.dll O10 - Unknown file in Winsock LSP: c:\program files\f-secure\fsps\program\fslsp.dll O10 - Unknown file in Winsock LSP: c:\program files\f-secure\fsps\program\fslsp.dll O10 - Unknown file in Winsock LSP: c:\program files\f-secure\fsps\program\fslsp.dll O10 - Unknown file in Winsock LSP: c:\program files\f-secure\fsps\program\fslsp.dll O10 - Unknown file in Winsock LSP: c:\program files\f-secure\fsps\program\fslsp.dll O11 - Options group: [INTERNATIONAL] International* O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://download.bitdefender.com/resources/scan8/oscan8.cab O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1167994320218 O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab O20 - Winlogon Notify: DPWLN - C:\WINDOWS\system32\DPWLEvHd.dll O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\ O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe O23 - Service: Windows XP FUS Manager (DPFUSMgr) - DigitalPersona, Inc. - C:\Program Files\DigitalPersona\Bin\DPFUSMgr.exe O23 - Service: Biometric Authentication Service (DpHost) - DigitalPersona, Inc. - C:\Program Files\DigitalPersona\Bin\DpHost.exe O23 - Service: FSGKHS (F-Secure Gatekeeper Handler Starter) - F-Secure Corporation - C:\Program Files\F-Secure\Anti-Virus\fsgk32st.exe O23 - Service: F-Secure Automatic Update Agent (FSAUA) - F-Secure Corporation - C:\Program Files\F-Secure\FSAUA\program\fsaua.exe O23 - Service: F-Secure Anti-Virus Firewall Daemon (FSDFWD) - F-Secure Corporation - C:\Program Files\F-Secure\FWES\Program\fsdfwd.exe O23 - Service: F-Secure Management Agent (FSMA) - F-Secure Corporation - C:\Program Files\F-Secure\Common\FSMA32.EXE O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe O23 - Service: PCLEPCI - Pinnacle Systems GmbH - C:\WINDOWS\system32\drivers\pclepci.sys O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe O23 - Service: ServiceLayer - Nokia. - C:\Program Files\PC Connectivity Solution\ServiceLayer.exe
1. 1. Lataa combofix.exe työpöydällesi jommastakummasta linkistä: combofix.exe combofix.exe 2. Tuplaklikkaa combofix.exe tiedostoa ja seuraa ohjeistuksia. 3. Kun työkalu on valmis, se tuottaa lokin. (C:\ComboFix.txt) Lähetä tämä loki viesti ketjuusi. Huom! Älä klikkaile combofixin ikkunaa käytön aikana. Tämä saattaa aiheuttaa ohjelman jumiutumisen. 2. Lataa SDFix by AndyManchesta ja tallenna se työpöydällesi. Käynnistä koneesi vikasietotilaan ja valitse tavallinen käyttäjätilisi:[*]Käynnistä tietokone [*]Kun kuulet koneen piippaavan, paina F8, kuitenkin ennen Windowsin logon esiintuloa [*]Seuraavaksi pitäisi ilmestyä valikko [*]Valitse valikosta vikasietotila. [*] Kun vikasietotilassa, pura tiedoston SDFix.zip sisältö (SDFix.exe) työpöydälle. Tuplakilikkaa työpöydälle ilmestynyttä sdfix.exe tiedostoa. Tiedosto purkaantuu ja asentaa itsensä siihen levyasemaan, minne on käyttöjärjestelmä on asennettu ja juureen ilmestyy kansio SDFix, ESIM C:\SDFix [*] Avaa SDFix-kansio ja tuplaklikkaa tiedostoa RunThis.bat käynnistääksesi ohjelman. [*] Paina Y käynnistääksesi skriptin. [*] Työkalu puhdistaa troijalaisen palvelut ja tekee myös joitakin korjauksia rekisteriin. Lopuksi se pyytää käynnistämään koneen uudelleen, "Press any key to Reboot". [*] Paina mitä tahansa näppäintä ja kone käynnistyy uudelleen. [*] Käynnistyminen kestää normaalia kauemmin sillä SDFix puhdistaa konetta. [*] Kun kone on käynnistynyt ja työpöytä latautunut, SDFix kertoo että puhdistus on suoritettu, "Finished". [*] Paina sitten mitä tahansa näppäintä sulkeaksesi skriptin ja ladataksesi pikakuvakkeet työpöydälle. [*] Lopuksi avaa SDFix kansio ja kopioi & liitä tiedoston Report.txt sisältö viestiketjuusi uuden HijackThis lokin kera. 3. Siirrä Hijackthis omaan kansioonsa, esim. C:\Hijackthis. Tämä on tärkeää, jotta Hijackthis toimisi oikein. Ota uusi loki ja postita yhdessä ComboFix.txt kanssa tänne.
Tässä tuo combofixin loki: ((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) C:\WINDOWS\system32\drivers\npf.sys C:\WINDOWS\system32\packet.dll C:\WINDOWS\system32\svehost.exe C:\WINDOWS\system32\wpcap.dll ((((((((((((((((((((((((((((((((((((((( Drivers/Services ))))))))))))))))))))))))))))))))))))))))))))))))) -------\NPF ((((((((((((((((((((((((( Files Created from 2007-07-23 to 2007-08-23 ))))))))))))))))))))))))))))))) 2007-08-24 01:10 51,200 --a------ C:\WINDOWS\nircmd.exe 2007-08-22 17:20 25,600 --a------ C:\WINDOWS\system32\borlndmm.dll 2007-08-22 17:20 1,497,088 --a------ C:\WINDOWS\system32\cc3250mt.dll 2007-08-22 17:20 <KANSIO> d-------- C:\Program Files\BitrateView 2007-08-22 17:19 299,520 --a------ C:\WINDOWS\uninst.exe 2007-08-22 17:19 <KANSIO> d-------- C:\DOCUME~1\HENRIS~1\WINDOWS 2007-08-21 10:30 <KANSIO> d-------- C:\Program Files\PC Connectivity Solution 2007-08-21 10:30 <KANSIO> d-------- C:\Program Files\Common Files\PCSuite 2007-08-21 10:30 <KANSIO> d-------- C:\Program Files\Common Files\Nokia 2007-08-21 10:29 8,320 --a------ C:\WINDOWS\system32\drivers\nmwcdc.sys 2007-08-21 10:29 65,536 --a------ C:\WINDOWS\system32\nmwcdcocls.dll 2007-08-21 10:29 137,216 --a------ C:\WINDOWS\system32\drivers\nmwcd.sys 2007-08-21 10:29 12,288 --a------ C:\WINDOWS\system32\drivers\nmwcdcm.sys 2007-08-21 10:29 12,288 --a------ C:\WINDOWS\system32\drivers\nmwcdcj.sys 2007-08-21 10:29 <KANSIO> d-------- C:\Program Files\Nokia 2007-08-21 10:28 <KANSIO> d-------- C:\DOCUME~1\ALLUSE~1\APPLIC~1\Installations 2007-08-21 09:45 <KANSIO> d-------- C:\DOCUME~1\ALLUSE~1\APPLIC~1\Nokia 2007-08-19 17:04 <KANSIO> d-------- C:\Program Files\MediaInfo 2007-08-19 16:59 <KANSIO> d-------- C:\Program Files\XviD Bitrate Calculator 2007-08-15 22:07 <KANSIO> d-------- C:\Program Files\MSXML 6.0 2007-08-09 15:51 <KANSIO> d-------- C:\Program Files\SlySoft 2007-08-03 22:04 <KANSIO> d-------- C:\Program Files\Maketorrent 2 2007-08-03 15:54 <KANSIO> d-------- C:\Program Files\uTorrent 2007-08-03 15:54 <KANSIO> d-------- C:\DOCUME~1\No name~1\APPLIC~1\uTorrent 2007-07-31 16:36 <KANSIO> d-------- C:\Program Files\PhotoWatermark Professional 7 2007-07-31 14:17 <KANSIO> d-------- C:\OziExplorer 2007-07-27 08:25 <KANSIO> d-------- C:\Program Files\MSXML 4.0 2007-07-26 13:31 82,432 --a------ C:\WINDOWS\system32\msxml4r.dll 2007-07-26 13:31 44,544 --a------ C:\WINDOWS\system32\msxml4a.dll 2007-07-26 13:31 401,408 --a------ C:\WINDOWS\system32\pvmjpg30.dll 2007-07-26 13:31 1,712,128 --a------ C:\WINDOWS\system32\GDIPLUS.DLL 2007-07-26 13:30 930,992 --------- C:\WINDOWS\system32\Ltr13n.dll 2007-07-26 13:30 884,736 --------- C:\WINDOWS\system32\LMUIRes.dll 2007-07-26 13:30 73,728 --------- C:\WINDOWS\system32\MMAviAx.dll 2007-07-26 13:30 70,144 --------- C:\WINDOWS\system32\lfbmp13s.dll 2007-07-26 13:30 64,512 --------- C:\WINDOWS\system32\lftga13s.dll 2007-07-26 13:30 453,120 --------- C:\WINDOWS\system32\ltkrn13n.dll 2007-07-26 13:30 41,984 --a------ C:\WINDOWS\system32\cacheX.dll 2007-07-26 13:30 409,600 --------- C:\WINDOWS\system32\LFCMP13s.DLL 2007-07-26 13:30 393,216 --------- C:\WINDOWS\system32\LFCMP13n.DLL 2007-07-26 13:30 32,768 --------- C:\WINDOWS\system32\MLPagAx.dll 2007-07-26 13:30 306,352 --------- C:\WINDOWS\system32\Ltrio13n.dll 2007-07-26 13:30 30,208 --------- C:\WINDOWS\system32\lfbmp13n.dll 2007-07-26 13:30 24,576 --------- C:\WINDOWS\system32\lftga13n.dll 2007-07-26 13:30 233,472 --------- C:\WINDOWS\system32\DiskIO.dll 2007-07-26 13:30 2,079,232 --------- C:\WINDOWS\system32\LTCLR13s.dll 2007-07-26 13:30 184,320 --------- C:\WINDOWS\system32\RALMain.dll 2007-07-26 13:30 153,088 --------- C:\WINDOWS\system32\ltfil13n.DLL 2007-07-26 13:30 126,976 --------- C:\WINDOWS\system32\AVIPrAx.dll 2007-07-26 13:30 12,288 --------- C:\WINDOWS\system32\LMLRes.dll 2007-07-26 13:30 110,080 --------- C:\WINDOWS\system32\lfpsd13s.dll 2007-07-26 13:30 1,693,696 --------- C:\WINDOWS\system32\LTCLR13n.dll 2007-07-26 13:30 1,013,248 --------- C:\WINDOWS\system32\Ltwvc13n.dll 2007-07-26 13:28 <KANSIO> d-------- C:\WINDOWS\RegisteredPackages 2007-07-26 13:27 <KANSIO> d-------- C:\WINDOWS\system32\URTTEMP 2007-07-26 13:26 95 --a------ C:\AUTOEXEC.BAT 2007-07-26 13:26 84,992 --a------ C:\WINDOWS\system32\ATL70.DLL 2007-07-26 13:26 57,856 --a------ C:\WINDOWS\system32\masd32.dll 2007-07-26 13:26 27,648 --a------ C:\WINDOWS\system32\ma32.dll 2007-07-26 13:26 196,096 --a------ C:\WINDOWS\system32\macd32.dll 2007-07-26 13:26 138,752 --a------ C:\WINDOWS\system32\mase32.dll 2007-07-26 13:26 136,192 --a------ C:\WINDOWS\system32\mamc32.dll 2007-07-26 13:25 974,848 --a------ C:\WINDOWS\system32\MFC70.DLL 2007-07-26 13:25 964,608 --a------ C:\WINDOWS\system32\MFC70U.DLL 2007-07-26 13:25 54,784 --a------ C:\WINDOWS\system32\MSVCI70.DLL 2007-07-26 13:25 49,152 --a------ C:\WINDOWS\system32\PCLEGetGuid.dll 2007-07-26 13:25 487,424 --a------ C:\WINDOWS\system32\MSVCP70.DLL 2007-07-26 13:25 41,219 --a------ C:\WINDOWS\RSETPATH.exe 2007-07-26 13:25 171,520 --a------ C:\WINDOWS\system32\drivers\MarvinBus.sys 2007-07-26 13:25 14,165 --a------ C:\WINDOWS\system32\drivers\Pclepci.sys 2007-07-26 13:24 <KANSIO> d-------- C:\Program Files\Pinnacle 2007-07-26 13:24 <KANSIO> d-------- C:\DOCUME~1\ALLUSE~1\APPLIC~1\Pinnacle Studio 2007-07-26 13:21 <KANSIO> d-------- C:\DOCUME~1\No name~1\APPLIC~1\InstallShield 2007-07-26 13:21 <KANSIO> d-------- C:\DOCUME~1\ALLUSE~1\APPLIC~1\Pinnacle 2007-07-24 22:06 51,040 --a------ C:\WINDOWS\system32\drivers\fsdfw.sys 2007-07-24 22:06 30,016 --a------ C:\WINDOWS\system32\drivers\fsndis5.sys 2007-07-24 22:06 <KANSIO> d-------- C:\DOCUME~1\ALLUSE~1\APPLIC~1\F-Secure 2007-07-24 22:05 <KANSIO> d-------- C:\Program Files\F-Secure 2007-07-24 18:10 43,520 --a------ C:\WINDOWS\system32\CmdLineExt03.dll 2007-07-24 18:02 8,320 --a------ C:\WINDOWS\system32\drivers\grmnusb.sys 2007-07-24 18:02 18,432 --a------ C:\WINDOWS\system32\drivers\grmngen.sys 2007-07-24 18:02 <KANSIO> d-------- C:\Garmin (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) 2007-08-21 10:33 --------- d-------- C:\DOCUME~1\HENRIS~1\APPLIC~1\Nokia 2007-08-21 10:30 --------- d-------- C:\Program Files\DIFX 2007-08-15 15:38 --------- d-------- C:\Program Files\Mozilla Thunderbird 2007-08-13 17:56 --------- d-------- C:\Program Files\ImTOO 2007-08-04 22:38 --------- d-------- C:\Program Files\RogueRemover 2007-07-31 14:37 --------- d--h----- C:\Program Files\InstallShield Installation Information 2007-07-22 21:48 --------- d-------- C:\Program Files\Absolute Uninstaller 2007-07-22 21:18 --------- d-------- C:\Program Files\util 2007-07-22 21:18 --------- d-------- C:\Program Files\Setup 2007-07-22 21:18 --------- d-------- C:\Program Files\HP 2007-07-22 21:17 --------- d-------- C:\Program Files\fin 2007-07-22 21:17 --------- d-------- C:\Program Files\drivers 2007-07-22 21:17 --------- d-------- C:\Program Files\common 2007-07-22 21:05 --------- d-------- C:\Program Files\Eraser 2007-07-22 20:24 --------- d-------- C:\DOCUME~1\No name~1\APPLIC~1\GlarySoft 2007-07-18 18:10 --------- d-------- C:\DOCUME~1\No name1\APPLIC~1\Help 2007-07-18 16:09 --------- d-------- C:\DOCUME~1\No name~1\APPLIC~1\PC Suite 2007-07-11 23:00 --------- d-------- C:\Program Files\BandwidthMeterPro 2007-07-11 23:00 --------- d-------- C:\DOCUME~1\No name~1\APPLIC~1\BWMeterPro 2007-07-02 10:40 --------- d-------- C:\Program Files\SpywareBlaster 2007-07-01 19:33 --------- d-------- C:\Program Files\Active Data Recovery Services 2007-06-26 09:09 1104896 --a------ C:\WINDOWS\system32\msxml3.dll 2007-06-19 16:32 282112 --a------ C:\WINDOWS\system32\gdi32.dll 2007-06-13 16:22 1033728 --a------ C:\WINDOWS\explorer.exe 2006-06-23 09:48 32768 -ra------ C:\WINDOWS\inf\UpdateUSB.exe ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) *Note* empty entries & legit default entries are not shown [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "SoundMAXPnP"="C:\Program Files\Analog Devices\Core\smax4pnp.exe" [2006-05-01 05:07] "SoundMAX"="C:\Program Files\Analog Devices\SoundMAX\Smax4.exe" [2006-04-10 10:19] "JMB36X Configure"="C:\WINDOWS\system32\JMRaidTool.exe" [2006-07-12 12:47] "NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2006-08-11 22:43] "nwiz"="nwiz.exe" [2006-08-11 22:43 C:\WINDOWS\system32\nwiz.exe] "NvMediaCenter"="C:\WINDOWS\system32\NvMcTray.dll" [2006-08-11 22:43] "F-Secure Manager"="C:\Program Files\F-Secure\Common\FSM32.exe" [2007-05-28 12:19] "F-Secure TNB"="C:\Program Files\F-Secure\FSGUI\TNBUtil.exe" [2007-05-28 12:18] "Microsoft Updates"="svehost.exe" [] [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="C:\WINDOWS\system32\ctfmon.exe" [2006-03-02 15:00] [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\runservices] "Microsoft Updates"=svehost.exe [HKEY_USERS\.default\software\microsoft\windows\currentversion\run] "Nokia.PCSync"=C:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe /NoDialog [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\DPWLN ] C:\WINDOWS\system32\DPWLEvHd.dll 2004-09-08 16:45 102400 C:\WINDOWS\system32\DPWLEvHd.dll [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa] "Notification Packages"= scecli DPPWDFLT [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Acrobat Assistant 7.0] "C:\Program Files\Adobe\Acrobat 7.0\Distillr\Acrotray.exe" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BandwidthMeterPro] C:\Program Files\BandwidthMeterPro\BWMeterPro.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CloneCDTray] "C:\Program Files\SlySoft\CloneCD\CloneCDTray.exe" /s [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DAEMON Tools] "C:\Program Files\DAEMON Tools\daemon.exe" -lang 1033 [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DPAgnt] C:\Program Files\DigitalPersona\Bin\DPAgnt.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Eraser] C:\Program Files\Eraser\eraser.exe -hide [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LaunchList] C:\Program Files\Pinnacle\Studio 11\LaunchList2.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PCSuiteTrayApplication] C:\Program Files\Nokia\Nokia PC Suite 6\LaunchApplication.exe -startup [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RemoteControl] "C:\Program Files\CyberLink DVD Solution\PowerDVD\PDVDServ.exe" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_10\bin\jusched.exe [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run-] "Eraser"=C:\Program Files\Eraser\eraser.exe -hide R0 FSFW;F-Secure Firewall Driver;C:\WINDOWS\system32\drivers\fsdfw.sys R0 JGOGO;JMicron Hot-Plug Driver;C:\WINDOWS\system32\DRIVERS\JGOGO.sys R0 JRAID;JRAID;C:\WINDOWS\system32\DRIVERS\jraid.sys R1 F-Secure HIPS;F-Secure HIPS;\??\C:\Program Files\F-Secure\HIPS\fshs.sys R3 F-Secure Gatekeeper;F-Secure Gatekeeper;\??\C:\Program Files\F-Secure\Anti-Virus\minifilter\fsgk.sys R3 SenFiltService;SenFilt Service;C:\WINDOWS\system32\drivers\Senfilt.sys S3 dpK0Bx01;Fingerprint Reader Filter Driver;C:\WINDOWS\system32\DRIVERS\dpK0Bx01.sys S3 grmnusb;grmnusb;C:\WINDOWS\system32\drivers\grmnusb.sys S3 iMSPQMn;iMSPQMn;\??\C:\DOCUME~1\No name~1\LOCALS~1\Temp\iMSPQMn.sys S3 TFBULK;Topfield USB client driver;C:\WINDOWS\system32\drivers\TfBulk.sys S3 UsbdpFP;Fingerprint Reader Class Driver;C:\WINDOWS\system32\DRIVERS\UsbdpFP.sys S4 F-Secure Filter;F-Secure File System Filter;\??\C:\Program Files\F-Secure\Anti-Virus\Win2K\FSfilter.sys S4 F-Secure Recognizer;F-Secure File System Recognizer;\??\C:\Program Files\F-Secure\Anti-Virus\Win2K\FSrec.sys [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{c55828c4-9cb2-11db-8f22-806d6172696f}] AutoRun\command- D:\ASUSACPI.exe Contents of the 'Scheduled Tasks' folder 2007-08-23 06:00:00 C:\WINDOWS\Tasks\excscd2.job - K:\BitComet lataukset\Elite.XC.Strikeforce.2007.PPV.DSR.XviD-OMiCRON\excscd2.avi ************************************************************************** catchme 0.3.1061 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2007-08-24 01:20:11 Windows 5.1.2600 Service Pack 2 NTFS scanning hidden processes ... scanning hidden autostart entries ... scanning hidden files ... scan completed successfully hidden files: 0 ************************************************************************** Completion time: 2007-08-24 1:20:45 - machine was rebooted C:\ComboFix-quarantined-files.txt ... 2007-08-24 01:20
Laitathan sitten myös Sdfixin report.txt ja uusi Sdfixin jälkeen otettu Hjt -loki (kuten alkup. ohje oli)
Tässä nämä molemmat lokit. Näyttäis että madot on poistettu, eikö? Microsoft Windows XP [versio 5.1.2600] Running From: C:\SDFix Safe Mode: Checking Services: Restoring Windows Registry Values Restoring Windows Default Hosts File Rebooting... Normal Mode: Checking Files: No Trojan Files Found Removing Temp Files... ADS Check: C:\WINDOWS No streams found. C:\WINDOWS\system32 No streams found. C:\WINDOWS\system32\svchost.exe No streams found. C:\WINDOWS\system32\ntoskrnl.exe No streams found. Final Check: Remaining Services: ------------------ Authorized Application Key Export: [HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list] "C:\\Program Files\\uTorrent\\uTorrent.exe"="C:\\Program Files\\uTorrent\\uTorrent.exe:*:Enabled:æTorrent" [HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list] Remaining Files: --------------- Files with Hidden Attributes: C:\Program Files\Windows Media Player\mplayer2.exe C:\Program Files\Windows Media Player\wmplayer.exe C:\WINDOWS\system32\config\SAM.tmp.LOG C:\WINDOWS\system32\config\SECURITY.tmp.LOG Finished -------------------------------------------------------------------------------------------------------------------------------------------- Logfile of HijackThis v1.99.1 Scan saved at 10:39:30, on 24.8.2007 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v7.00 (7.00.6000.16512) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\DigitalPersona\Bin\DPWinLct.exe C:\WINDOWS\system32\spoolsv.exe C:\Program Files\DigitalPersona\Bin\DpHost.exe C:\Program Files\F-Secure\Anti-Virus\fsgk32st.exe C:\Program Files\F-Secure\Common\FSMA32.EXE C:\Program Files\F-Secure\Anti-Virus\FSGK32.EXE C:\WINDOWS\system32\nvsvc32.exe C:\Program Files\F-Secure\Common\FSMB32.EXE C:\WINDOWS\system32\svchost.exe C:\Program Files\F-Secure\Common\FCH32.EXE C:\Program Files\DigitalPersona\Bin\DPFUSMgr.exe C:\Program Files\F-Secure\Anti-Virus\fsqh.exe C:\Program Files\F-Secure\Common\FAMEH32.EXE C:\Program Files\F-Secure\FSAUA\program\fsaua.exe C:\Program Files\F-Secure\Anti-Virus\fssm32.exe C:\Program Files\F-Secure\FWES\Program\fsdfwd.exe C:\Program Files\F-Secure\FSAUA\program\fsus.exe C:\WINDOWS\Explorer.EXE C:\Program Files\F-Secure\Anti-Virus\fsav32.exe C:\WINDOWS\system32\wuauclt.exe C:\WINDOWS\system32\notepad.exe C:\Program Files\Analog Devices\Core\smax4pnp.exe C:\Program Files\Analog Devices\SoundMAX\Smax4.exe C:\WINDOWS\system32\RUNDLL32.EXE C:\Program Files\F-Secure\Common\FSM32.EXE C:\WINDOWS\system32\ctfmon.exe C:\Program Files\F-Secure\FSGUI\fsguidll.exe C:\WINDOWS\system32\notepad.exe C:\Uusi kansio\scanner.exe.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.ess.fi/ R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://windowsupdate.microsoft.com/ R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Linkit O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_10\bin\ssv.dll O2 - BHO: AcroIEToolbarHelper Class - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll O4 - HKLM\..\Run: [SoundMAXPnP] C:\Program Files\Analog Devices\Core\smax4pnp.exe O4 - HKLM\..\Run: [SoundMAX] "C:\Program Files\Analog Devices\SoundMAX\Smax4.exe" /tray O4 - HKLM\..\Run: [JMB36X Configure] C:\WINDOWS\system32\JMRaidTool.exe boot O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup O4 - HKLM\..\Run: [nwiz] nwiz.exe /install O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit O4 - HKLM\..\Run: [F-Secure Manager] "C:\Program Files\F-Secure\Common\FSM32.EXE" /splash O4 - HKLM\..\Run: [F-Secure TNB] "C:\Program Files\F-Secure\FSGUI\TNBUtil.exe" /CHECKALL /WAITFORSW O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe O8 - Extra context menu item: Convert link target to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html O8 - Extra context menu item: Convert link target to existing PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html O8 - Extra context menu item: Convert selected links to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECaptureSelLinks.html O8 - Extra context menu item: Convert selected links to existing PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppendSelLinks.html O8 - Extra context menu item: Convert selection to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html O8 - Extra context menu item: Convert selection to existing PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html O8 - Extra context menu item: Convert to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html O8 - Extra context menu item: Convert to existing PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000 O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_10\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_10\bin\ssv.dll O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing) O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing) O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing) O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing) O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O10 - Unknown file in Winsock LSP: c:\program files\f-secure\fsps\program\fslsp.dll O10 - Unknown file in Winsock LSP: c:\program files\f-secure\fsps\program\fslsp.dll O10 - Unknown file in Winsock LSP: c:\program files\f-secure\fsps\program\fslsp.dll O10 - Unknown file in Winsock LSP: c:\program files\f-secure\fsps\program\fslsp.dll O10 - Unknown file in Winsock LSP: c:\program files\f-secure\fsps\program\fslsp.dll O10 - Unknown file in Winsock LSP: c:\program files\f-secure\fsps\program\fslsp.dll O10 - Unknown file in Winsock LSP: c:\program files\f-secure\fsps\program\fslsp.dll O10 - Unknown file in Winsock LSP: c:\program files\f-secure\fsps\program\fslsp.dll O10 - Unknown file in Winsock LSP: c:\program files\f-secure\fsps\program\fslsp.dll O10 - Unknown file in Winsock LSP: c:\program files\f-secure\fsps\program\fslsp.dll O10 - Unknown file in Winsock LSP: c:\program files\f-secure\fsps\program\fslsp.dll O10 - Unknown file in Winsock LSP: c:\program files\f-secure\fsps\program\fslsp.dll O11 - Options group: [INTERNATIONAL] International* O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://download.bitdefender.com/resources/scan8/oscan8.cab O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1167994320218 O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab O20 - Winlogon Notify: DPWLN - C:\WINDOWS\system32\DPWLEvHd.dll O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\ O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe O23 - Service: Windows XP FUS Manager (DPFUSMgr) - DigitalPersona, Inc. - C:\Program Files\DigitalPersona\Bin\DPFUSMgr.exe O23 - Service: Biometric Authentication Service (DpHost) - DigitalPersona, Inc. - C:\Program Files\DigitalPersona\Bin\DpHost.exe O23 - Service: FSGKHS (F-Secure Gatekeeper Handler Starter) - F-Secure Corporation - C:\Program Files\F-Secure\Anti-Virus\fsgk32st.exe O23 - Service: F-Secure Automatic Update Agent (FSAUA) - F-Secure Corporation - C:\Program Files\F-Secure\FSAUA\program\fsaua.exe O23 - Service: F-Secure Anti-Virus Firewall Daemon (FSDFWD) - F-Secure Corporation - C:\Program Files\F-Secure\FWES\Program\fsdfwd.exe O23 - Service: F-Secure Management Agent (FSMA) - F-Secure Corporation - C:\Program Files\F-Secure\Common\FSMA32.EXE O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe O23 - Service: PCLEPCI - Pinnacle Systems GmbH - C:\WINDOWS\system32\drivers\pclepci.sys O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe O23 - Service: ServiceLayer - Nokia. - C:\Program Files\PC Connectivity Solution\ServiceLayer.exe
1. Ota ensin rekisteristä näin varmuuskopio: Suorita -> regedit -> ok. Sitten Tiedosto -> Vie. Kirjoita sille joku nimi ja sitten Tallenna(ja laita muistiin, mihin tallensit sen). Sitten tallenna tämä alla oleva tekstinpätkä nimellä fix.reg vaikka muistiossa ja vaikka työpöydälle (tallennusmuoto kaikki tiedostot) Tuplaklikkaa ja paina kyllä ja ok. Älä käynnistä konetta vielä uudestaan, vaan siirry seuraavaan kohtaan ohjeissa. 2. Tallenna nämä ohjeet tekstitiedostoon tai tulosta nämä, muuten et pääse niihin käsiksi vikasietotilasta Lataa AVG Anti-Spyware 7.5 ja tallenna ohjelma työpöydällesi. [*]Kun olet ladannut ohjelman, kaksoisklikkaa asennuohjelman pikakuvaketta työpöydälläsi, asennus alkaa. [*]Asennuksen jälkeen täytyy ohjelma käynnistää ja sen tunnisteet päivittää. [*]Käynnistä AVG Anti-Spyware. [*]Klikkaa "Update" kuvaketta päävalikossa. Sen jälkeen klikkaa "Update now" painiketta. [*]Sitten klikkaa "Start Update" kuvaketta jolloin päivitys alkaa. [*]Kun päivitykset on ladattu, klikkaa "Scanner" kuvaketta ikkunan ylälaidassa. Valitse sitten "Settings" välilehti. [*]Kun "Settings" valikko on auennut, klikkaa "Recommended actions" ja sitten valitse "Quarantine". [*]Sitten "Reports" valikon alta: [*]Laita täppi kohtaan "Automatically generate report after every scan" [*]Ota täppi pois kohdasta"Only if threats were found" [*]Sitten klikkaa "Shield" kuvaketta ikkunan ylälaidassa [*]"Resident shield is", muuta tila active:sta inactive:ksi [*]Sulje ohjelma, ÄLÄ skannaa vielä. Käynnistä koneesi vikasietotilaan, Ohje! HUOM! Älä käytä muita ohjelmia AVG skannauksen aikana, tämä saattaa häiritä skannausta. [*]Kun vikasietotilassa, käynnistä AVG Anti-Spyware. [*]Klikkaa "Scanner" kuvaketta ikkunan ylälaidassa ja valitse "Scan" välilehti. Sitten klikkaa "Complete System Scan". [*]AVG aloittaa nyt tietokoneen skannaamisen, ole kärsivällinen sillä skannaus vie aikaa. Kun skannaus on valmis: TÄRKEÄÄ : Älä klikkaa "Save Scan Report" ennen kuin klikkaat "Apply all Actions" [*]Varmistu, että Set all elements to: näyttää Quarantine (1), jos ei, klikkaa linkkiä ja valitse Quarantine popup-valikosta. [*]Sinulta kysytään mitä tehdä jos infektioita löytyi, valitse silloin "Apply all actions" [*]Sitten klikkaa "Reports" kuvaketta ohjelma yläosasta. [*]Klikkaa "Save report as" painiketta ikkunan vasemmassa alalaidassa ja tallenna raportti työpöydälle. [*]Sulje ohjelma, käynnistä kone normaalisti ja lähetä AVG Anti-Spyware:n raportti viestikejuusi.
Tein AVG scannauksen mutta tein vahingossa väärinpäin(Hyvistä ohjeista huolimatta.. hätäilyä..) tuom quarantine - Save report - jutun mutta ohjelma löysi ulkoiselta kovolta seuraavat pöpöt: Logger.Delf.wh ja Trojan.small. Ko. pöpöt on nyt karanteenissa, tai laitoin koko kansiot karanteeniin jossa nuo olivat. Ajanko AVG:n uudestaan vai kuinka edetään?
Eipä tuo niin haittaa. Päivitä vielä Java. Javan päivitys ja välimuistin tyhjennys: 1. Klikkaa Käynnistä -> Ohjauspaneeli ja tupla-klikkaa Lisää tai poista sovellus Ohjauspaneelissa. 2. Etsi listasta kaikki entiset Java versiosi. (J2SE Runtime Environment.... ) Niissä pitäisi olla seuraava kuva vieressä: 3. Valitse kaikki entiset Java versiosi ja valitse Poista. 4. Asenna uusin Java päivitys seuraavasta linkistä.. 5. Käynnistä kone uudelleen asennuksen jälkeen: http://java.sun.com/javase/downloads/index.jsp Rullaa alas kohteeseen Java Runtime Environment (JRE) 6u2 Paina Download Ruksaa Accept, ota offline installation, tallenna vaikka työpöydälle ja asenna se. 6. Käynnistyksen jälkeen, mene takaisin Ohjauspaneeliin ja avaa Java asetuksesi (Muita Ohjauspaneelin asetuksia -> Java kahvikuppi). 7. General Settings -osion alla, vedä liukusäädintä (Disk Space) pienemmälle, ja klikkaa Delete Files -nappia. (Jotkut javapohjaiset ohjelmat saattavat tarvita enemmän levytilaa. Jos huomaat säädön pienentämisen jälkeen koneessa hitautta, siirrä liukusäädintä isommalle). 8. Varmista että kaikki kaksi valintaa ovat rastitettuja: [*]Applications and Applets [*]Trace and Log Files Ja paina OK -nappia 9. Klikkaa OK "Temporary Files Settings" -ikkunassasi. Huomaa: Tämä poistaa kaikki ladatut sovellukset ja appletit VÄLIMUISTISTA. 10. Klikkaa OK jättääksesi Java asetusikkunasi.
Pikkuisena bonuksena tässä kaiken keskellä, koneeni ilmoitti käynnistyksen yhteydessä CPU FAN ERROR mutta nyt taas toimii kun vähän heilautti konetta.
Katsotaan vielä varmuuden vuoksi online skannerilla kone läpi, ja sitten vielä uusi hjt niin voidaan olla sitten varmoja. Eli 1. Skannaa koneesi Kaspersky Online Skannerilla Sinulta kysytään sallitko ActiveX -komponentin asentamisen Kasperskyltä, klikkaa Kyllä. [*] Ohjelma käynnistyy ja aloittaa viimeisimpien tunnistetiedostojen lataamisen. [*] Kun skanneri on asennettu ja tunnistetiedot ladattu, klikkaa Next. [*] Klikkaa nyt asetuksia, Scan Settings [*] Tarkista asetuksista, että seuraavat ovat valittuina: o Scan using the following Anti-Virus database: + Extended (Jos valittavissa, muuten valitse Standard) o Scan Options: + Scan Archives + Scan Mail Bases [*] Klikkaa OK [*] Nyt valitse "select a target to scan" otsikon alta Oma Tietokone, My Computer [*] Skannaus vie aikaa, joten ole kärsivällinen. Kun skannaus on valmis saat ilmoituksen, jos koneesi on saastunut. [*] Klikkaa nyt Save as Text-painiketta. [*] Tallenna tiedosto työpöydällesi. [*] Kopioi ja Liitä tiedoston sisältö seuraavaan vastaukseesi. 2. Uusi Hijackthis -loki
Ei löytäny kaspersky mitään. Mitäs tarkoittaa tuo Hujon kommentti: fixsaa tuo pois O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\ Friday, August 24, 2007 8:10:43 PM Operating System: Microsoft Windows XP Home Edition, Service Pack 2 (Build 2600) Kaspersky Online Scanner version: 5.0.93.0 Kaspersky Anti-Virus database last update: 24/08/2007 Kaspersky Anti-Virus database records: 389566 Scan Settings Scan using the following antivirus database extended Scan Archives true Scan Mail Bases true Scan Target My Computer C:\ D:\ E:\ F:\ G:\ H:\ I:\ Scan Statistics Total number of scanned objects 46472 Number of viruses found 0 Number of infected objects 0 Number of suspicious objects 0 Duration of the scan process 00:28:13 Infected Object Name Virus Name Last Action C:\Documents and Settings\All Users\Application Data\F-Secure\logs\FSMA\fsma.log Object is locked skipped C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\008c3f90593abcc7f28a3d80b4228c2b_1656dad2-3084-4ff9-9a20-03f1b02f2fa3 Object is locked skipped C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\01ae144423d746adddadddbf5ffb4353_1656dad2-3084-4ff9-9a20-03f1b02f2fa3 Object is locked skipped C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\023f9109b9e25d87c49a573b286fac8c_1656dad2-3084-4ff9-9a20-03f1b02f2fa3 Object is locked skipped C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\039df8e58ca09d798ac2c2390263b3e7_1656dad2-3084-4ff9-9a20-03f1b02f2fa3 Object is locked skipped C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\03de7135cc3855ad045fc66d1bde25f4_1656dad2-3084-4ff9-9a20-03f1b02f2fa3 Object is locked skipped C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\03ee1d62cc740d7c95a42e0df1684349_1656dad2-3084-4ff9-9a20-03f1b02f2fa3 Object is locked skipped C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\03eeed91b5a8ca28a52a4fd79a0f676f_1656dad2-3084-4ff9-9a20-03f1b02f2fa3 Object is locked skipped C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\03fd2095ab451ac34645d1cffd573cb8_1656dad2-3084-4ff9-9a20-03f1b02f2fa3 Object is locked skipped C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\04ef3d746e604616b8b8750f84a914f9_1656dad2-3084-4ff9-9a20-03f1b02f2fa3 Object is locked skipped C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\0618e1bda30fb22c89e87a31a377f681_1656dad2-3084-4ff9-9a20-03f1b02f2fa3 Object is locked skipped C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\0689ac21ddd927abc5ca249e54964212_1656dad2-3084-4ff9-9a20-03f1b02f2fa3 Object is locked skipped C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\08f75551bfc58ef961ede5e7ec8f94d5_1656dad2-3084-4ff9-9a20-03f1b02f2fa3 Object is locked skipped C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\096ad9a6efa5385a7bddb4e2c9a3fbc7_1656dad2-3084-4ff9-9a20-03f1b02f2fa3 Object is locked skipped C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\0a73834e170edee2662b36dee0d5c350_1656dad2-3084-4ff9-9a20-03f1b02f2fa3 Object is locked skipped C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\0ae66c18f095c9d63ff26aa7344a1f65_1656dad2-3084-4ff9-9a20-03f1b02f2fa3 Object is locked skipped C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\0ed1d32a54b6dd0dc12ebc5a50a6300a_1656dad2-3084-4ff9-9a20-03f1b02f2fa3 Object is locked skipped C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\1277cadbc651ef1273d8135a98168f0c_1656dad2-3084-4ff9-9a20-03f1b02f2fa3 Object is locked skipped C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\128a43595cfc915f88dd3c03585921e7_1656dad2-3084-4ff9-9a20-03f1b02f2fa3 Object is locked skipped C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\12f5ad89e62ee10b8a054bf9969df9ec_1656dad2-3084-4ff9-9a20-03f1b02f2fa3 Object is locked skipped C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\13bc8f51eda80d89597891235f464830_1656dad2-3084-4ff9-9a20-03f1b02f2fa3 Object is locked skipped C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\140f359f868130b5aa07ea04840fda60_1656dad2-3084-4ff9-9a20-03f1b02f2fa3 Object is locked skipped C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\1452ef7d5a7993053281a3516ae15917_1656dad2-3084-4ff9-9a20-03f1b02f2fa3 Object is locked skipped C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\195ed5622e5f9765e76748993d1c1428_1656dad2-3084-4ff9-9a20-03f1b02f2fa3 Object is locked skipped C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\1fd7394d7bcdf9ba12582da25942b3b1_1656dad2-3084-4ff9-9a20-03f1b02f2fa3 Object is locked skipped C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\2098cf1db2b406e0b9ad82107df91cfc_1656dad2-3084-4ff9-9a20-03f1b02f2fa3 Object is locked skipped C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\215755a279eb5a022835f0c544ed13b9_1656dad2-3084-4ff9-9a20-03f1b02f2fa3 Object is locked skipped C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\24fff1cf0f98a1804ad89c13077a56fc_1656dad2-3084-4ff9-9a20-03f1b02f2fa3 Object is locked skipped C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\25aba6ef298d829725a50c178909ecc9_1656dad2-3084-4ff9-9a20-03f1b02f2fa3 Object is locked skipped C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\269d58919a6b3248e821c7c5bae9d841_1656dad2-3084-4ff9-9a20-03f1b02f2fa3 Object is locked skipped C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\28179fb22818b20d7abbe18477b03079_1656dad2-3084-4ff9-9a20-03f1b02f2fa3 Object is locked skipped C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\2870fa5c793358dcbca40f15ee3d6b51_1656dad2-3084-4ff9-9a20-03f1b02f2fa3 Object is locked skipped C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\29c7f4c69ef40c178fc405acafd90395_1656dad2-3084-4ff9-9a20-03f1b02f2fa3 Object is locked skipped C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\2a3e09ac1fe577d4ad8e05808ba817c0_1656dad2-3084-4ff9-9a20-03f1b02f2fa3 Object is locked skipped C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\2cc0c3554482cd61e07e89873dcfaa81_1656dad2-3084-4ff9-9a20-03f1b02f2fa3 Object is locked skipped C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\2d83245797850d8fcbb085cbf9d07af9_1656dad2-3084-4ff9-9a20-03f1b02f2fa3 Object is locked skipped C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\2e25484a4b98207cff92dc7760cda4dd_1656dad2-3084-4ff9-9a20-03f1b02f2fa3 Object is locked skipped C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\3027b176e0a813e39952dac7320f2aae_1656dad2-3084-4ff9-9a20-03f1b02f2fa3 Object is locked skipped C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\324a7df5673d749448e55c6fcd4384b3_1656dad2-3084-4ff9-9a20-03f1b02f2fa3 Object is locked skipped C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\33005096d750a7b402e579fbd07c879c_1656dad2-3084-4ff9-9a20-03f1b02f2fa3 Object is locked skipped C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\336ff50ccad6b5d425418433ced5741c_1656dad2-3084-4ff9-9a20-03f1b02f2fa3 Object is locked skipped C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\34dcf00c5410892108f9aa92ceb9950b_1656dad2-3084-4ff9-9a20-03f1b02f2fa3 Object is locked skipped C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\354ba03fbec8b2b0943c7a8a20c76736_1656dad2-3084-4ff9-9a20-03f1b02f2fa3 Object is locked skipped C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\367bf5c1d62a4a8d46b5ac691eec4401_1656dad2-3084-4ff9-9a20-03f1b02f2fa3 Object is locked skipped C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\380f0f27df222861553d16366123d1ac_1656dad2-3084-4ff9-9a20-03f1b02f2fa3 Object is locked skipped C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\389acb907c427708226697d144a69ccf_1656dad2-3084-4ff9-9a20-03f1b02f2fa3 Object is locked skipped C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\3913e93020b2f2bd746f7cbe7ce00141_1656dad2-3084-4ff9-9a20-03f1b02f2fa3 Object is locked skipped C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\39ead292fd06c6cadfb82b461e32c5b7_1656dad2-3084-4ff9-9a20-03f1b02f2fa3 Object is locked skipped C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\3d1a747428bb57aad0aaf10346275584_1656dad2-3084-4ff9-9a20-03f1b02f2fa3 Object is locked skipped C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\3f0f9978da6ef93eab8973fb45500514_1656dad2-3084-4ff9-9a20-03f1b02f2fa3 Object is locked skipped C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\3f1a76c6f9e1b4103e5da9a7eb1266fb_1656dad2-3084-4ff9-9a20-03f1b02f2fa3 Object is locked skipped C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\3f9e371d1834846719bcb95ea99b62d4_1656dad2-3084-4ff9-9a20-03f1b02f2fa3 Object is locked skipped C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\3ff107c19be45cb769135b23cdcfae20_1656dad2-3084-4ff9-9a20-03f1b02f2fa3 Object is locked skipped C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\3ffa027fd15832785cee8ec1b6a1a2c8_1656dad2-3084-4ff9-9a20-03f1b02f2fa3 Object is locked skipped C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\436a5f4708bca7da43ad940d4eeda41d_1656dad2-3084-4ff9-9a20-03f1b02f2fa3 Object is locked skipped C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\443bc3995e07bcfeb0b56591da00311d_1656dad2-3084-4ff9-9a20-03f1b02f2fa3 Object is locked skipped C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\44d7d4e1d6884aa4ecb3459cdfc7ca29_1656dad2-3084-4ff9-9a20-03f1b02f2fa3 Object is locked skipped C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\4741fb7369607b9e9014cc5c33b1e8e5_1656dad2-3084-4ff9-9a20-03f1b02f2fa3 Object is locked skipped C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\4a96f06fa00e3ae530b94f702e379a8d_1656dad2-3084-4ff9-9a20-03f1b02f2fa3 Object is locked skipped C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\4e45f02457b4cefcdd4c38a58a9bf8fb_1656dad2-3084-4ff9-9a20-03f1b02f2fa3 Object is locked skipped C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\4f6e36fb96b1f365fde7447215e4f543_1656dad2-3084-4ff9-9a20-03f1b02f2fa3 Object is locked skipped C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\50fdcab6fcce70b8663dca976a9962b8_1656dad2-3084-4ff9-9a20-03f1b02f2fa3 Object is locked skipped C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\53b91156d4c7f47e3d09da916186adbf_1656dad2-3084-4ff9-9a20-03f1b02f2fa3 Object is locked skipped C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\5430de42f3b7d37f171cf3d86ae94970_1656dad2-3084-4ff9-9a20-03f1b02f2fa3 Object is locked skipped C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\55596d3a0fab59bb392478b21cf2b7e6_1656dad2-3084-4ff9-9a20-03f1b02f2fa3 Object is locked skipped C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\56e78e515cdce16267a264f8fe636739_1656dad2-3084-4ff9-9a20-03f1b02f2fa3 Object is locked skipped C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\59b0138822bb3bea96df9e6d292ad151_1656dad2-3084-4ff9-9a20-03f1b02f2fa3 Object is locked skipped C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\5c6fad0b014f5f93457f4e1df513f187_1656dad2-3084-4ff9-9a20-03f1b02f2fa3 Object is locked skipped C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\5cef2c4a483483c374c28abb9e1c75fb_1656dad2-3084-4ff9-9a20-03f1b02f2fa3 Object is locked skipped C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\5d6178c9fc149d3123e253e07c9de4a8_1656dad2-3084-4ff9-9a20-03f1b02f2fa3 Object is locked skipped C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\5e679f8bc2d5318613779915c4c843dd_1656dad2-3084-4ff9-9a20-03f1b02f2fa3 Object is locked skipped C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\5fa2fa3e04334197f9a904d70ee61235_1656dad2-3084-4ff9-9a20-03f1b02f2fa3 Object is locked skipped C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\61c2baf28090da83e90f7e16a5fc4ba0_1656dad2-3084-4ff9-9a20-03f1b02f2fa3 Object is locked skipped C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\62b727831dd3f7dd102f476bba710ad0_1656dad2-3084-4ff9-9a20-03f1b02f2fa3 Object is locked skipped C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\64f5c8ee1fb219e9e9b064e3ed4056dc_1656dad2-3084-4ff9-9a20-03f1b02f2fa3 Object is locked skipped C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\6533ec25668d8447ea5b4d38820a9604_1656dad2-3084-4ff9-9a20-03f1b02f2fa3 Object is locked skipped C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\65406927338e9491978e42986cdd6a06_1656dad2-3084-4ff9-9a20-03f1b02f2fa3 Object is locked skipped C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\668019ee9f8f03449e01681a0d102884_1656dad2-3084-4ff9-9a20-03f1b02f2fa3 Object is locked skipped C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\670c7a4218d8366d15e64cf92ee8c0c7_1656dad2-3084-4ff9-9a20-03f1b02f2fa3 Object is locked skipped C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\6b34152cf87b5e19daea46160444c5ab_1656dad2-3084-4ff9-9a20-03f1b02f2fa3 Object is locked skipped C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\6bd78cfa026d357f0abda8e01c3f6d42_1656dad2-3084-4ff9-9a20-03f1b02f2fa3 Object is locked skipped C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\6c84bf6bda72d08fa73bc463e752d142_1656dad2-3084-4ff9-9a20-03f1b02f2fa3 Object is locked skipped C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\6e5a587395ff93e5f98008583405aaec_1656dad2-3084-4ff9-9a20-03f1b02f2fa3 Object is locked skipped C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\70a30059611abf63a9604597ab6377db_1656dad2-3084-4ff9-9a20-03f1b02f2fa3 Object is locked skipped C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\71f10b0b5e917dadcc3078035866b945_1656dad2-3084-4ff9-9a20-03f1b02f2fa3 Object is locked skipped C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\72af5619fdd0c089f6dc422049894645_1656dad2-3084-4ff9-9a20-03f1b02f2fa3 Object is locked skipped C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\751a678c6645a57e0060be0a24eb8fd0_1656dad2-3084-4ff9-9a20-03f1b02f2fa3 Object is locked skipped C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\778dc122776ff648d3fd9a6464016ef5_1656dad2-3084-4ff9-9a20-03f1b02f2fa3 Object is locked skipped C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\7a61521aa01c6505d34e839888869972_1656dad2-3084-4ff9-9a20-03f1b02f2fa3 Object is locked skipped C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\7a6923a0b56e8c41253721dcbf36e192_1656dad2-3084-4ff9-9a20-03f1b02f2fa3 Object is locked skipped C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\7b24cb11ca4815934911d3cf57ddf9d4_1656dad2-3084-4ff9-9a20-03f1b02f2fa3 Object is locked skipped C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\7bffd962ed148914eb547b0ebdaab74e_1656dad2-3084-4ff9-9a20-03f1b02f2fa3 Object is locked skipped C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\7dbebfe5b3aa75a0f837d9d3e66397fe_1656dad2-3084-4ff9-9a20-03f1b02f2fa3 Object is locked skipped C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\8010e609e81558a0c4d747f4055af943_1656dad2-3084-4ff9-9a20-03f1b02f2fa3 Object is locked skipped C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\829400e0269264dae5baf355244015c4_1656dad2-3084-4ff9-9a20-03f1b02f2fa3 Object is locked skipped C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\82a902265f40dba9d2989ab317f97633_1656dad2-3084-4ff9-9a20-03f1b02f2fa3 Object is locked skipped C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\84440c1a2f94bc4cefbbd35f17bf5d51_1656dad2-3084-4ff9-9a20-03f1b02f2fa3 Object is locked skipped C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\88c4b1c460e33acc21455b5f63618288_1656dad2-3084-4ff9-9a20-03f1b02f2fa3 Object is locked skipped C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\8a2f0e5c8823e189aa6b5b551d9000b6_1656dad2-3084-4ff9-9a20-03f1b02f2fa3 Object is locked skipped C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\8aac52eadc98be689bced14428c9c7c1_1656dad2-3084-4ff9-9a20-03f1b02f2fa3 Object is locked skipped C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\8b1b300ea745128abad02d827acca46d_1656dad2-3084-4ff9-9a20-03f1b02f2fa3 Object is locked skipped C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\8b26ab41b71943d3b907f93c780fa993_1656dad2-3084-4ff9-9a20-03f1b02f2fa3 Object is locked skipped C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\8b8dfe1518e32d48e94b25beecd721e5_1656dad2-3084-4ff9-9a20-03f1b02f2fa3 Object is locked skipped C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\8d0851d93597780980ac3dba32f935e4_1656dad2-3084-4ff9-9a20-03f1b02f2fa3 Object is locked skipped C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\8e0e27948cc3a1bf4d72cf74062e2c42_1656dad2-3084-4ff9-9a20-03f1b02f2fa3 Object is locked skipped C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\8f32de9d6b343e2e8e7e3da109bae925_1656dad2-3084-4ff9-9a20-03f1b02f2fa3 Object is locked skipped C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\8f4e581c9757b7c90e365ca1e27c879a_1656dad2-3084-4ff9-9a20-03f1b02f2fa3 Object is locked skipped C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\9049e72f1d99afad653bc80e41357d27_1656dad2-3084-4ff9-9a20-03f1b02f2fa3 Object is locked skipped C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\904f2a6569ae784a4f2e3c66a738a123_1656dad2-3084-4ff9-9a20-03f1b02f2fa3 Object is locked skipped C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\907de13529f311370d99a2e0bd781fc4_1656dad2-3084-4ff9-9a20-03f1b02f2fa3 Object is locked skipped C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\90d1bdd6b30ae3651718f7f619545d0c_1656dad2-3084-4ff9-9a20-03f1b02f2fa3 Object is locked skipped C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\9294d1bfea4293285dae6ba65374cfe3_1656dad2-3084-4ff9-9a20-03f1b02f2fa3 Object is locked skipped C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\92e3320d6e8136f0b38500e5c1312a0e_1656dad2-3084-4ff9-9a20-03f1b02f2fa3 Object is locked skipped C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\9537c4160c5f074f394f1864ef360f55_1656dad2-3084-4ff9-9a20-03f1b02f2fa3 Object is locked skipped C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\955c74523b07beb58e862ad3f79a56a2_1656dad2-3084-4ff9-9a20-03f1b02f2fa3 Object is locked skipped C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\95aef84e613743d27f1b543cbc1aa6e9_1656dad2-3084-4ff9-9a20-03f1b02f2fa3 Object is locked skipped C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\95d13e1b474c071683070b7e85048493_1656dad2-3084-4ff9-9a20-03f1b02f2fa3 Object is locked skipped C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\9649a4ad92efd33a9def299eb9e14173_1656dad2-3084-4ff9-9a20-03f1b02f2fa3 Object is locked skipped C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\97a1d9cc13b804935fc8a33715af9cd9_1656dad2-3084-4ff9-9a20-03f1b02f2fa3 Object is locked skipped C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\9ca168add48bb5adf1bd6117f945e69b_1656dad2-3084-4ff9-9a20-03f1b02f2fa3 Object is locked skipped C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\9cfb1fc7d4cc6d226ffea1d89df5ca9e_1656dad2-3084-4ff9-9a20-03f1b02f2fa3 Object is locked skipped C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\9fa441589a8726f6c5ce68b30dcd5f56_1656dad2-3084-4ff9-9a20-03f1b02f2fa3 Object is locked skipped C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\a0b904e51b844616cebbca5a4a906f9d_1656dad2-3084-4ff9-9a20-03f1b02f2fa3 Object is locked skipped C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\a4c3a742be5992c0e90ad5c227bb41b8_1656dad2-3084-4ff9-9a20-03f1b02f2fa3 Object is locked skipped C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\a7204112bfc666ee19c585535a22367d_1656dad2-3084-4ff9-9a20-03f1b02f2fa3 Object is locked skipped C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\a7c2afc423adbada4c24e393995cf4c1_1656dad2-3084-4ff9-9a20-03f1b02f2fa3 Object is locked skipped C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\a8373352444a973dc86408443f397ccb_1656dad2-3084-4ff9-9a20-03f1b02f2fa3 Object is locked skipped C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\a845d92470dd895847afd806c3d7f6e6_1656dad2-3084-4ff9-9a20-03f1b02f2fa3 Object is locked skipped C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\aa3e7e356490c7c5e322a52244e3d8e8_1656dad2-3084-4ff9-9a20-03f1b02f2fa3 Object is locked skipped C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\aabaf0afe7cf09fcea27224abd972a53_1656dad2-3084-4ff9-9a20-03f1b02f2fa3 Object is locked skipped C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\ae7a11d636c3eb72cdd2622dec1c8a1c_1656dad2-3084-4ff9-9a20-03f1b02f2fa3 Object is locked skipped C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\af219cb432cd51e3b2b74e69170fee59_1656dad2-3084-4ff9-9a20-03f1b02f2fa3 Object is locked skipped C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\b0f60bbdc43605d7a07908df6a446a02_1656dad2-3084-4ff9-9a20-03f1b02f2fa3 Object is locked skipped C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\b340578785d96f39a589a3d4b2f52ea5_1656dad2-3084-4ff9-9a20-03f1b02f2fa3 Object is locked skipped C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\b3cbd4601030632bde5ec5f6b2028b7e_1656dad2-3084-4ff9-9a20-03f1b02f2fa3 Object is locked skipped C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\b418f23e59189e763202295e40b3d418_1656dad2-3084-4ff9-9a20-03f1b02f2fa3 Object is locked skipped C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\b51c89eee8ef3f22699b19e660a83917_1656dad2-3084-4ff9-9a20-03f1b02f2fa3 Object is locked skipped C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\b5fad386592926288a610f034fd527bb_1656dad2-3084-4ff9-9a20-03f1b02f2fa3 Object is locked skipped C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\b6f114c1ef9106c0f8d23811cce2077c_1656dad2-3084-4ff9-9a20-03f1b02f2fa3 Object is locked skipped C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\b816aefd494742cf0cff731dc6d0ab74_1656dad2-3084-4ff9-9a20-03f1b02f2fa3 Object is locked skipped C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\b908176d17622abdb9f480098f25d7f8_1656dad2-3084-4ff9-9a20-03f1b02f2fa3 Object is locked skipped C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\b9895a504ff0ab770520dc63e7678476_1656dad2-3084-4ff9-9a20-03f1b02f2fa3 Object is locked skipped C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\ba43e9e5689af3ce4882091872451383_1656dad2-3084-4ff9-9a20-03f1b02f2fa3 Object is locked skipped C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\ba691855c14d24a22c0d095abfc2d81b_1656dad2-3084-4ff9-9a20-03f1b02f2fa3 Object is locked skipped C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\bb3da194d76fd19f3455418e6ec983fe_1656dad2-3084-4ff9-9a20-03f1b02f2fa3 Object is locked skipped C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\bc3a221838d0de0f6529d3045363556b_1656dad2-3084-4ff9-9a20-03f1b02f2fa3 Object is locked skipped C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\c1ddf5c0d16693bb0f39d8480b875259_1656dad2-3084-4ff9-9a20-03f1b02f2fa3 Object is locked skipped C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\c1e217688aef3c314738bd47c2683878_1656dad2-3084-4ff9-9a20-03f1b02f2fa3 Object is locked skipped C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\c2491df7331450c061c808e9ec0c8696_1656dad2-3084-4ff9-9a20-03f1b02f2fa3 Object is locked skipped C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\c2f2f13b8992a9461d1a65137417b15c_1656dad2-3084-4ff9-9a20-03f1b02f2fa3 Object is locked skipped C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\c3df0c16199385a2193c1cca9b13e579_1656dad2-3084-4ff9-9a20-03f1b02f2fa3 Object is locked skipped C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\c86fdcfa362e8e74d5afa93d1e7a5c39_1656dad2-3084-4ff9-9a20-03f1b02f2fa3 Object is locked skipped C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\c8c209a900a3134aab89297f8cc4df68_1656dad2-3084-4ff9-9a20-03f1b02f2fa3 Object is locked skipped C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\c93f91f969656c84cbfaadbbf2d2ee42_1656dad2-3084-4ff9-9a20-03f1b02f2fa3 Object is locked skipped C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\c995e88634e818becc9da9b106dafbb3_1656dad2-3084-4ff9-9a20-03f1b02f2fa3 Object is locked skipped C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\ca1a7c3d35b729e3b52dd38be61d703f_1656dad2-3084-4ff9-9a20-03f1b02f2fa3 Object is locked skipped C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\caeb7814064779223481e48cca53bfba_1656dad2-3084-4ff9-9a20-03f1b02f2fa3 Object is locked skipped C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\cb5454036262fa4c33919aa6fac3ce57_1656dad2-3084-4ff9-9a20-03f1b02f2fa3 Object is locked skipped C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\cbfa344f345b0b25dc3d00dae7fcc2c2_1656dad2-3084-4ff9-9a20-03f1b02f2fa3 Object is locked skipped C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\cdc246a71abeb860e4972a7205782d26_1656dad2-3084-4ff9-9a20-03f1b02f2fa3 Object is locked skipped C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\cfa4e67a937f549bbfed0dba9512c146_1656dad2-3084-4ff9-9a20-03f1b02f2fa3 Object is locked skipped C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\d0df7556bfd9e1d463b7f27ba58891f3_1656dad2-3084-4ff9-9a20-03f1b02f2fa3 Object is locked skipped C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\d2624fa51358ff306608a5d1c3743dfa_1656dad2-3084-4ff9-9a20-03f1b02f2fa3 Object is locked skipped C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\d2a36922132f1f62058a57a64f6c1b4c_1656dad2-3084-4ff9-9a20-03f1b02f2fa3 Object is locked skipped C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\d2c6e8d83d96aad5e57d09b9fce65a84_1656dad2-3084-4ff9-9a20-03f1b02f2fa3 Object is locked skipped C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\d49cf3a41f78fa522903cee6ff8f2486_1656dad2-3084-4ff9-9a20-03f1b02f2fa3 Object is locked skipped C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\d689b0e3f7817999fddd712ac4f2321a_1656dad2-3084-4ff9-9a20-03f1b02f2fa3 Object is locked skipped C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\d7c33ecc00c0a4bf22eeb8edd9f810ca_1656dad2-3084-4ff9-9a20-03f1b02f2fa3 Object is locked skipped C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\d882da0803bae5acb1a3a18c712b73c2_1656dad2-3084-4ff9-9a20-03f1b02f2fa3 Object is locked skipped C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\da993345b94c9c98312335379a1b9c32_1656dad2-3084-4ff9-9a20-03f1b02f2fa3 Object is locked skipped C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\daf4843a3b714d7884174dc53fb4ecf1_1656dad2-3084-4ff9-9a20-03f1b02f2fa3 Object is locked skipped C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\df245f4bc1acfec7f06ebb56615e116e_1656dad2-3084-4ff9-9a20-03f1b02f2fa3 Object is locked skipped C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\df28ca0ea6a8249db11443823f99600b_1656dad2-3084-4ff9-9a20-03f1b02f2fa3 Object is locked skipped C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\e07d5031b8a70e1d56f874530940abba_1656dad2-3084-4ff9-9a20-03f1b02f2fa3 Object is locked skipped C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\e17ab8a8496bbaa5668f2b58126ee750_1656dad2-3084-4ff9-9a20-03f1b02f2fa3 Object is locked skipped C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\e1dd5624a22452c4694d6574f06ee363_1656dad2-3084-4ff9-9a20-03f1b02f2fa3 Object is locked skipped C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\e33b18fcde650977ddda3c3bb520e7a7_1656dad2-3084-4ff9-9a20-03f1b02f2fa3 Object is locked skipped C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\e42d5afec0adc8532783c04caec18f66_1656dad2-3084-4ff9-9a20-03f1b02f2fa3 Object is locked skipped C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\e42fe1e4da577c7875d799312540da35_1656dad2-3084-4ff9-9a20-03f1b02f2fa3 Object is locked skipped C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\e79bb14c2292a89cde2557c5e44e3192_1656dad2-3084-4ff9-9a20-03f1b02f2fa3 Object is locked skipped C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\e7ad12e9f8244b0bfa9a3c49ae568d89_1656dad2-3084-4ff9-9a20-03f1b02f2fa3 Object is locked skipped C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\e8d04245be3b1fc50803a54e99f01afd_1656dad2-3084-4ff9-9a20-03f1b02f2fa3 Object is locked skipped C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\ea4c1a07b0f5ecb65b0828a43d1bcfce_1656dad2-3084-4ff9-9a20-03f1b02f2fa3 Object is locked skipped C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\eb6eabf569a15602b448e606dd682bc3_1656dad2-3084-4ff9-9a20-03f1b02f2fa3 Object is locked skipped C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\ebf10539565a898655e55f1d430db7e2_1656dad2-3084-4ff9-9a20-03f1b02f2fa3 Object is locked skipped C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\ec228ddd99d0448cb3490556257251e6_1656dad2-3084-4ff9-9a20-03f1b02f2fa3 Object is locked skipped C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\ecfd84992f9da25a591729be24ebfe1c_1656dad2-3084-4ff9-9a20-03f1b02f2fa3 Object is locked skipped C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\eded7fbcf58076a0b9089e631875759b_1656dad2-3084-4ff9-9a20-03f1b02f2fa3 Object is locked skipped C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\ee7fbf8fa08cf5186af1adfc36b6770f_1656dad2-3084-4ff9-9a20-03f1b02f2fa3 Object is locked skipped C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\efc29764668cf7c785e2dc7208393480_1656dad2-3084-4ff9-9a20-03f1b02f2fa3 Object is locked skipped C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\f05a8deb9dae4b0ce89739825b195adb_1656dad2-3084-4ff9-9a20-03f1b02f2fa3 Object is locked skipped C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\f0b856495ad9a8f01f3bf7de62f788c4_1656dad2-3084-4ff9-9a20-03f1b02f2fa3 Object is locked skipped C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\f0f57f78df7053c46f0a25ce97d2ef2b_1656dad2-3084-4ff9-9a20-03f1b02f2fa3 Object is locked skipped C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\f249ab340f1926d498a27df03254d534_1656dad2-3084-4ff9-9a20-03f1b02f2fa3 Object is locked skipped C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\f5343eb60d7b9869fe8fd367f2cab8b3_1656dad2-3084-4ff9-9a20-03f1b02f2fa3 Object is locked skipped C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\f78cc995724f8ac2cd0ea5bc1ffa38da_1656dad2-3084-4ff9-9a20-03f1b02f2fa3 Object is locked skipped C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\fafed71339ce6a658e612eba13c4adbd_1656dad2-3084-4ff9-9a20-03f1b02f2fa3 Object is locked skipped C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\fb4fff406f5e4aa8c5c3bd1fbc207a9e_1656dad2-3084-4ff9-9a20-03f1b02f2fa3 Object is locked skipped C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\fd1382db5d6996d1511418b4f04a4ce2_1656dad2-3084-4ff9-9a20-03f1b02f2fa3 Object is locked skipped C:\Documents and Settings\No name \Application Data\Mozilla\Firefox\Profiles\e5b0s7xu.default\cert8.db Object is locked skipped C:\Documents and Settings\No name \Application Data\Mozilla\Firefox\Profiles\e5b0s7xu.default\formhistory.dat Object is locked skipped C:\Documents and Settings\No name \Application Data\Mozilla\Firefox\Profiles\e5b0s7xu.default\history.dat Object is locked skipped C:\Documents and Settings\No name \Application Data\Mozilla\Firefox\Profiles\e5b0s7xu.default\key3.db Object is locked skipped C:\Documents and Settings\No name \Application Data\Mozilla\Firefox\Profiles\e5b0s7xu.default\parent.lock Object is locked skipped C:\Documents and Settings\No name \Application Data\Mozilla\Firefox\Profiles\e5b0s7xu.default\search.sqlite Object is locked skipped C:\Documents and Settings\No name \Application Data\Mozilla\Firefox\Profiles\e5b0s7xu.default\urlclassifier2.sqlite Object is locked skipped C:\Documents and Settings\No name \Cookies\index.dat Object is locked skipped C:\Documents and Settings\No name \Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped C:\Documents and Settings\No name \Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped C:\Documents and Settings\No name \Local Settings\Application Data\Mozilla\Firefox\Profiles\e5b0s7xu.default\Cache\_CACHE_001_ Object is locked skipped C:\Documents and Settings\No name \Local Settings\Application Data\Mozilla\Firefox\Profiles\e5b0s7xu.default\Cache\_CACHE_002_ Object is locked skipped C:\Documents and Settings\No name \Local Settings\Application Data\Mozilla\Firefox\Profiles\e5b0s7xu.default\Cache\_CACHE_003_ Object is locked skipped C:\Documents and Settings\No name \Local Settings\Application Data\Mozilla\Firefox\Profiles\e5b0s7xu.default\Cache\_CACHE_MAP_ Object is locked skipped C:\Documents and Settings\No name \Local Settings\Sivuhistoria\History.IE5\index.dat Object is locked skipped C:\Documents and Settings\No name \Local Settings\Temporary Internet Files\AntiPhishing\B3BB5BBA-E7D5-40AB-A041-A5B1C0B26C8F.dat Object is locked skipped C:\Documents and Settings\No name \Local Settings\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped C:\Documents and Settings\No name \NTUSER.DAT Object is locked skipped C:\Documents and Settings\No name \ntuser.dat.LOG Object is locked skipped C:\Documents and Settings\LocalService\Cookies\index.dat Object is locked skipped C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped C:\Documents and Settings\LocalService\Local Settings\Sivuhistoria\History.IE5\index.dat Object is locked skipped C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped C:\Documents and Settings\LocalService\NTUSER.DAT Object is locked skipped C:\Documents and Settings\LocalService\ntuser.dat.LOG Object is locked skipped C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped C:\Documents and Settings\NetworkService\NTUSER.DAT Object is locked skipped C:\Documents and Settings\NetworkService\ntuser.dat.LOG Object is locked skipped C:\Program Files\F-Secure\Anti-Virus\dbupdate.log Object is locked skipped C:\Program Files\F-Secure\Anti-Virus\deleteme_msg.log Object is locked skipped C:\Program Files\F-Secure\Anti-Virus\fsqh.exe.Qrt.log Object is locked skipped C:\Program Files\F-Secure\Anti-Virus\perf.dat Object is locked skipped C:\Program Files\F-Secure\Anti-Virus\power.dat Object is locked skipped C:\Program Files\F-Secure\Common\policy.bpf Object is locked skipped C:\Program Files\F-Secure\Common\policy.ipf Object is locked skipped C:\Program Files\F-Secure\FSAUA\fsbwupst.log Object is locked skipped C:\Program Files\F-Secure\FSAUA\program\fsaua.dbg Object is locked skipped C:\Program Files\F-Secure\FSAUA\program\fsaua.log Object is locked skipped C:\Program Files\F-Secure\Spam Control\log\fs_sa_log.txt Object is locked skipped C:\System Volume Information\MountPointManagerRemoteDatabase Object is locked skipped C:\System Volume Information\_restore{B8963C60-0E31-461A-9B36-84FB536FC5CA}\RP208\change.log Object is locked skipped C:\WINDOWS\Debug\PASSWD.LOG Object is locked skipped C:\WINDOWS\SchedLgU.Txt Object is locked skipped C:\WINDOWS\SoftwareDistribution\ReportingEvents.log Object is locked skipped C:\WINDOWS\Sti_Trace.log Object is locked skipped C:\WINDOWS\system32\CatRoot2\edb.log Object is locked skipped C:\WINDOWS\system32\CatRoot2\tmp.edb Object is locked skipped C:\WINDOWS\system32\config\AppEvent.Evt Object is locked skipped C:\WINDOWS\system32\config\default Object is locked skipped C:\WINDOWS\system32\config\default.LOG Object is locked skipped C:\WINDOWS\system32\config\Internet.evt Object is locked skipped C:\WINDOWS\system32\config\SAM Object is locked skipped C:\WINDOWS\system32\config\SAM.LOG Object is locked skipped C:\WINDOWS\system32\config\SecEvent.Evt Object is locked skipped C:\WINDOWS\system32\config\SECURITY Object is locked skipped C:\WINDOWS\system32\config\SECURITY.LOG Object is locked skipped C:\WINDOWS\system32\config\software Object is locked skipped C:\WINDOWS\system32\config\software.LOG Object is locked skipped C:\WINDOWS\system32\config\SysEvent.Evt Object is locked skipped C:\WINDOWS\system32\config\system Object is locked skipped C:\WINDOWS\system32\config\system.LOG Object is locked skipped C:\WINDOWS\system32\drivers\sptd.sys Object is locked skipped C:\WINDOWS\system32\h323log.txt Object is locked skipped C:\WINDOWS\system32\wbem\Repository\FS\INDEX.BTR Object is locked skipped C:\WINDOWS\system32\wbem\Repository\FS\INDEX.MAP Object is locked skipped C:\WINDOWS\system32\wbem\Repository\FS\MAPPING.VER Object is locked skipped C:\WINDOWS\system32\wbem\Repository\FS\MAPPING1.MAP Object is locked skipped C:\WINDOWS\system32\wbem\Repository\FS\MAPPING2.MAP Object is locked skipped C:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.DATA Object is locked skipped C:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.MAP Object is locked skipped C:\WINDOWS\Temp\AVP14EE.tmp Object is locked skipped C:\WINDOWS\Temp\AVP14EF.tmp Object is locked skipped C:\WINDOWS\Temp\AVP14F2.tmp Object is locked skipped C:\WINDOWS\Temp\AVP14F3.tmp Object is locked skipped C:\WINDOWS\wiadebug.log Object is locked skipped C:\WINDOWS\wiaservc.log Object is locked skipped C:\WINDOWS\WindowsUpdate.log Object is locked skipped I:\System Volume Information\MountPointManagerRemoteDatabase Object is locked skipped Scan process completed. ------------------------------------------------------------------------ HJT loki: Logfile of HijackThis v1.99.1 Scan saved at 20:24:57, on 24.8.2007 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v7.00 (7.00.6000.16512) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\DigitalPersona\Bin\DPWinLct.exe C:\WINDOWS\system32\spoolsv.exe C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe C:\Program Files\DigitalPersona\Bin\DpHost.exe C:\Program Files\F-Secure\Anti-Virus\fsgk32st.exe C:\Program Files\F-Secure\Common\FSMA32.EXE C:\Program Files\F-Secure\Anti-Virus\FSGK32.EXE C:\WINDOWS\system32\nvsvc32.exe C:\Program Files\F-Secure\Common\FSMB32.EXE C:\WINDOWS\system32\svchost.exe C:\Program Files\F-Secure\Common\FCH32.EXE C:\Program Files\DigitalPersona\Bin\DPFUSMgr.exe C:\Program Files\F-Secure\Anti-Virus\fsqh.exe C:\Program Files\F-Secure\Common\FAMEH32.EXE C:\Program Files\F-Secure\FSAUA\program\fsaua.exe C:\Program Files\F-Secure\Anti-Virus\fssm32.exe C:\Program Files\F-Secure\FWES\Program\fsdfwd.exe C:\Program Files\F-Secure\FSAUA\program\fsus.exe C:\WINDOWS\Explorer.EXE C:\Program Files\F-Secure\Anti-Virus\fsav32.exe C:\Program Files\Analog Devices\Core\smax4pnp.exe C:\Program Files\Analog Devices\SoundMAX\Smax4.exe C:\WINDOWS\system32\RUNDLL32.EXE C:\Program Files\F-Secure\Common\FSM32.EXE C:\Program Files\F-Secure\FSGUI\fsguidll.exe C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe C:\WINDOWS\system32\ctfmon.exe C:\Program Files\Mozilla Firefox\firefox.exe C:\Uusi kansio\scanner.exe.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.ess.fi/ R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://windowsupdate.microsoft.com/ R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Linkit O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll O2 - BHO: AcroIEToolbarHelper Class - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll O4 - HKLM\..\Run: [SoundMAXPnP] C:\Program Files\Analog Devices\Core\smax4pnp.exe O4 - HKLM\..\Run: [SoundMAX] "C:\Program Files\Analog Devices\SoundMAX\Smax4.exe" /tray O4 - HKLM\..\Run: [JMB36X Configure] C:\WINDOWS\system32\JMRaidTool.exe boot O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup O4 - HKLM\..\Run: [nwiz] nwiz.exe /install O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit O4 - HKLM\..\Run: [F-Secure Manager] "C:\Program Files\F-Secure\Common\FSM32.EXE" /splash O4 - HKLM\..\Run: [F-Secure TNB] "C:\Program Files\F-Secure\FSGUI\TNBUtil.exe" /CHECKALL /WAITFORSW O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe" O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe O8 - Extra context menu item: Convert link target to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html O8 - Extra context menu item: Convert link target to existing PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html O8 - Extra context menu item: Convert selected links to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECaptureSelLinks.html O8 - Extra context menu item: Convert selected links to existing PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppendSelLinks.html O8 - Extra context menu item: Convert selection to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html O8 - Extra context menu item: Convert selection to existing PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html O8 - Extra context menu item: Convert to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html O8 - Extra context menu item: Convert to existing PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000 O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing) O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing) O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing) O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing) O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O10 - Unknown file in Winsock LSP: c:\program files\f-secure\fsps\program\fslsp.dll O10 - Unknown file in Winsock LSP: c:\program files\f-secure\fsps\program\fslsp.dll O10 - Unknown file in Winsock LSP: c:\program files\f-secure\fsps\program\fslsp.dll O10 - Unknown file in Winsock LSP: c:\program files\f-secure\fsps\program\fslsp.dll O10 - Unknown file in Winsock LSP: c:\program files\f-secure\fsps\program\fslsp.dll O10 - Unknown file in Winsock LSP: c:\program files\f-secure\fsps\program\fslsp.dll O10 - Unknown file in Winsock LSP: c:\program files\f-secure\fsps\program\fslsp.dll O10 - Unknown file in Winsock LSP: c:\program files\f-secure\fsps\program\fslsp.dll O10 - Unknown file in Winsock LSP: c:\program files\f-secure\fsps\program\fslsp.dll O10 - Unknown file in Winsock LSP: c:\program files\f-secure\fsps\program\fslsp.dll O10 - Unknown file in Winsock LSP: c:\program files\f-secure\fsps\program\fslsp.dll O10 - Unknown file in Winsock LSP: c:\program files\f-secure\fsps\program\fslsp.dll O11 - Options group: [INTERNATIONAL] International* O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/kos/english/kavwebscan_unicode.cab O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://download.bitdefender.com/resources/scan8/oscan8.cab O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1167994320218 O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab O20 - Winlogon Notify: DPWLN - C:\WINDOWS\system32\DPWLEvHd.dll O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\ O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe O23 - Service: Windows XP FUS Manager (DPFUSMgr) - DigitalPersona, Inc. - C:\Program Files\DigitalPersona\Bin\DPFUSMgr.exe O23 - Service: Biometric Authentication Service (DpHost) - DigitalPersona, Inc. - C:\Program Files\DigitalPersona\Bin\DpHost.exe O23 - Service: FSGKHS (F-Secure Gatekeeper Handler Starter) - F-Secure Corporation - C:\Program Files\F-Secure\Anti-Virus\fsgk32st.exe O23 - Service: F-Secure Automatic Update Agent (FSAUA) - F-Secure Corporation - C:\Program Files\F-Secure\FSAUA\program\fsaua.exe O23 - Service: F-Secure Anti-Virus Firewall Daemon (FSDFWD) - F-Secure Corporation - C:\Program Files\F-Secure\FWES\Program\fsdfwd.exe O23 - Service: F-Secure Management Agent (FSMA) - F-Secure Corporation - C:\Program Files\F-Secure\Common\FSMA32.EXE O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe O23 - Service: PCLEPCI - Pinnacle Systems GmbH - C:\WINDOWS\system32\drivers\pclepci.sys O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe O23 - Service: ServiceLayer - Nokia. - C:\Program Files\PC Connectivity Solution\ServiceLayer.exe
Hujo tarkoitti että, käynnistä Hijackthis ja valitse Do a system scan only Valitse seuraava rivi: O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\ Valitse lopuksi Fix checked Nyt kun olet puhdas, seuraavaksi pari vinkkiä kuinka pienennetään saastumisriskiä. Kaikista on saatavilla joko suomenkielinen versio sekä/tai suomenkielinen opas. -> Taistele vastaan!!-> Malware Complaints Sivusto antaa haittaohjelmien uhreille mahdollisuuden kertoa tarinansa ja tehdä valituksen asiasta. Taistellaan yhdessä haittaohjelmien tekijöitä vastaan! -> Tyhjennä järjestelmänpalautus -> Ohjeet Tyhjennä järjestelmänpalautuskansio ja luo uusi palautuspiste. Tämä puhdistaa palautuskansion mahdollisista haittaohjelmajäännöksistä. -> Käytä CCleaneria -> CCleaner Lataa ja asenna CCleaner. Puhdista väliaikaistiedostot ja -kansiot ohjelmalla säännöllisesti. -> Käytä Ad-Awarea -> Ad-Aware Lataa ja asenna Ad-Aware. Päivitä se ja skannaa konettasi sillä säännöllisesti. Opas saatavilla suomeksi! Nimimerkki Ad-Awaren opas -> Käytä AVG Anti-Spywarea -> AVG Anti-Spyware Lataa ja asenna AVG Anti-Spyware. Päivitä se ja skannaa konettasi sillä säännöllisesti Opas saatavilla suomeksi! (Ewido ulkoasulla) Nimimerkki Axelin opas -> Asenna SpywareBlaster -> SpywareBlaster SpywareBlaster estää haittaohjelmia asentumasta koneellesi. Ei kuluta muistia! Opas saatavilla suomeksi! Nimimerkki Ad-Awaren opas -> Asenna MVPS Hosts tiedosto -> MVPS Hosts Estää koneesi yhteyden haitallisiin sivustoihin. Opas saatavilla suomeksi! Nimimerkki Axelin opas -> Vaihda selaimesi Firefoxiin -> Firefox Firefox on nopeampi, turvallisempi ja parempi selain kuin Internet Explorer. -> Pidä järjestelmäsi ajantasalla. -> Windows Update Vieraile Windows Updatessa säännöllisesti. -> Pidä palomuuri ja virustorjunta ajantasalla Päivitä ja skannaa koneesi säännöllisesti virustorjuntaohjelmallasi. Pysy puhtaana