1. Tämä sivusto käyttää keksejä (cookie). Jatkamalla sivuston käyttämistä hyväksyt keksien käyttämisen. Lue lisää.

svehost.exe yrittää päästä nettiin

Viestiketju Virukset ja haittaohjelmat - HijackThis -logit -osiossa. Ketjun avasi bouncher 23.08.2007.

  1. bouncher

    bouncher Member

    Liittynyt:
    30.08.2005
    Viestejä:
    78
    Kiitokset:
    0
    Pisteet:
    16
    Onko varma virus tuo svehost.exe ja kuinka suoritetaan varma poisto?

    Merkkasin sen huutomerkeillä tonne lokiin!!!!!

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\Program Files\DigitalPersona\Bin\DPWinLct.exe
    C:\WINDOWS\system32\spoolsv.exe
    C:\Program Files\DigitalPersona\Bin\DpHost.exe
    C:\Program Files\F-Secure\Anti-Virus\fsgk32st.exe
    C:\Program Files\F-Secure\Anti-Virus\FSGK32.EXE
    C:\Program Files\F-Secure\Common\FSMA32.EXE
    C:\WINDOWS\system32\nvsvc32.exe
    C:\Program Files\F-Secure\Common\FSMB32.EXE
    C:\WINDOWS\system32\svchost.exe
    C:\Program Files\F-Secure\Common\FCH32.EXE
    C:\Program Files\DigitalPersona\Bin\DPFUSMgr.exe
    C:\Program Files\F-Secure\Common\FAMEH32.EXE
    C:\Program Files\F-Secure\Anti-Virus\fsqh.exe
    C:\Program Files\F-Secure\FSAUA\program\fsaua.exe
    C:\Program Files\F-Secure\Anti-Virus\fssm32.exe
    C:\Program Files\F-Secure\FWES\Program\fsdfwd.exe
    C:\Program Files\F-Secure\FSAUA\program\fsus.exe
    C:\WINDOWS\Explorer.EXE
    C:\Program Files\Analog Devices\Core\smax4pnp.exe
    C:\Program Files\Analog Devices\SoundMAX\Smax4.exe
    C:\WINDOWS\system32\RUNDLL32.EXE
    C:\Program Files\F-Secure\Common\FSM32.EXE
    C:\WINDOWS\system32\svehost.exe
    C:\WINDOWS\system32\ctfmon.exe
    C:\Program Files\F-Secure\FSGUI\fsguidll.exe
    C:\Program Files\F-Secure\Anti-Virus\fsav32.exe
    C:\WINDOWS\system32\wuauclt.exe
    C:\Documents and Settings\\Työpöytä\scanner.exe.exe
    \?\C:\WINDOWS\system32\WBEM\WMIADAP.EXE

    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.ess.fi/
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
    R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
    R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://windowsupdate.microsoft.com/
    R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Linkit
    O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
    O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
    O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_10\bin\ssv.dll
    O2 - BHO: AcroIEToolbarHelper Class - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll
    O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll
    O4 - HKLM\..\Run: [SoundMAXPnP] C:\Program Files\Analog Devices\Core\smax4pnp.exe
    O4 - HKLM\..\Run: [SoundMAX] "C:\Program Files\Analog Devices\SoundMAX\Smax4.exe" /tray
    O4 - HKLM\..\Run: [JMB36X Configure] C:\WINDOWS\system32\JMRaidTool.exe boot
    O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
    O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
    O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
    O4 - HKLM\..\Run: [F-Secure Manager] "C:\Program Files\F-Secure\Common\FSM32.EXE" /splash
    O4 - HKLM\..\Run: [F-Secure TNB] "C:\Program Files\F-Secure\FSGUI\TNBUtil.exe" /CHECKALL /WAITFORSW
    O4 - HKLM\..\Run: [Microsoft Updates] svehost.exe !!!!!!!!!!!!!!!!!!!!
    O4 - HKLM\..\RunServices: [Microsoft Updates] svehost.exe !!!!!!!!!!!!!!!!!!!!!!!!!!
    O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
    O8 - Extra context menu item: Convert link target to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
    O8 - Extra context menu item: Convert link target to existing PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
    O8 - Extra context menu item: Convert selected links to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
    O8 - Extra context menu item: Convert selected links to existing PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
    O8 - Extra context menu item: Convert selection to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
    O8 - Extra context menu item: Convert selection to existing PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
    O8 - Extra context menu item: Convert to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
    O8 - Extra context menu item: Convert to existing PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
    O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
    O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_10\bin\ssv.dll
    O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_10\bin\ssv.dll
    O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)
    O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)
    O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
    O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
    O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O10 - Unknown file in Winsock LSP: c:\program files\f-secure\fsps\program\fslsp.dll
    O10 - Unknown file in Winsock LSP: c:\program files\f-secure\fsps\program\fslsp.dll
    O10 - Unknown file in Winsock LSP: c:\program files\f-secure\fsps\program\fslsp.dll
    O10 - Unknown file in Winsock LSP: c:\program files\f-secure\fsps\program\fslsp.dll
    O10 - Unknown file in Winsock LSP: c:\program files\f-secure\fsps\program\fslsp.dll
    O10 - Unknown file in Winsock LSP: c:\program files\f-secure\fsps\program\fslsp.dll
    O10 - Unknown file in Winsock LSP: c:\program files\f-secure\fsps\program\fslsp.dll
    O10 - Unknown file in Winsock LSP: c:\program files\f-secure\fsps\program\fslsp.dll
    O10 - Unknown file in Winsock LSP: c:\program files\f-secure\fsps\program\fslsp.dll
    O10 - Unknown file in Winsock LSP: c:\program files\f-secure\fsps\program\fslsp.dll
    O10 - Unknown file in Winsock LSP: c:\program files\f-secure\fsps\program\fslsp.dll
    O10 - Unknown file in Winsock LSP: c:\program files\f-secure\fsps\program\fslsp.dll
    O11 - Options group: [INTERNATIONAL] International*
    O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://download.bitdefender.com/resources/scan8/oscan8.cab
    O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1167994320218
    O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
    O20 - Winlogon Notify: DPWLN - C:\WINDOWS\system32\DPWLEvHd.dll
    O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\
    O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
    O23 - Service: Windows XP FUS Manager (DPFUSMgr) - DigitalPersona, Inc. - C:\Program Files\DigitalPersona\Bin\DPFUSMgr.exe
    O23 - Service: Biometric Authentication Service (DpHost) - DigitalPersona, Inc. - C:\Program Files\DigitalPersona\Bin\DpHost.exe
    O23 - Service: FSGKHS (F-Secure Gatekeeper Handler Starter) - F-Secure Corporation - C:\Program Files\F-Secure\Anti-Virus\fsgk32st.exe
    O23 - Service: F-Secure Automatic Update Agent (FSAUA) - F-Secure Corporation - C:\Program Files\F-Secure\FSAUA\program\fsaua.exe
    O23 - Service: F-Secure Anti-Virus Firewall Daemon (FSDFWD) - F-Secure Corporation - C:\Program Files\F-Secure\FWES\Program\fsdfwd.exe
    O23 - Service: F-Secure Management Agent (FSMA) - F-Secure Corporation - C:\Program Files\F-Secure\Common\FSMA32.EXE
    O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
    O23 - Service: PCLEPCI - Pinnacle Systems GmbH - C:\WINDOWS\system32\drivers\pclepci.sys
    O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
    O23 - Service: ServiceLayer - Nokia. - C:\Program Files\PC Connectivity Solution\ServiceLayer.exe
     
  2.  
  3. yamaneko

    yamaneko Senior member

    Liittynyt:
    22.09.2005
    Viestejä:
    5,093
    Kiitokset:
    1
    Pisteet:
    118
    1.
    1. Lataa combofix.exe työpöydällesi jommastakummasta linkistä:
    combofix.exe
    combofix.exe

    2. Tuplaklikkaa combofix.exe tiedostoa ja seuraa ohjeistuksia.
    3. Kun työkalu on valmis, se tuottaa lokin. (C:\ComboFix.txt) Lähetä tämä loki viesti ketjuusi.
    Huom! Älä klikkaile combofixin ikkunaa käytön aikana. Tämä saattaa aiheuttaa ohjelman jumiutumisen.

    2.
    Lataa SDFix by AndyManchesta ja tallenna se työpöydällesi.

    Käynnistä koneesi vikasietotilaan ja valitse tavallinen käyttäjätilisi:[*]Käynnistä tietokone
    [*]Kun kuulet koneen piippaavan, paina F8, kuitenkin ennen Windowsin logon esiintuloa
    [*]Seuraavaksi pitäisi ilmestyä valikko
    [*]Valitse valikosta vikasietotila.

    [*] Kun vikasietotilassa, pura tiedoston SDFix.zip sisältö (SDFix.exe) työpöydälle. Tuplakilikkaa työpöydälle ilmestynyttä sdfix.exe tiedostoa. Tiedosto purkaantuu ja asentaa itsensä siihen levyasemaan, minne on käyttöjärjestelmä on asennettu ja juureen ilmestyy kansio SDFix, ESIM C:\SDFix
    [*] Avaa SDFix-kansio ja tuplaklikkaa tiedostoa RunThis.bat käynnistääksesi ohjelman.
    [*] Paina Y käynnistääksesi skriptin.
    [*] Työkalu puhdistaa troijalaisen palvelut ja tekee myös joitakin korjauksia rekisteriin. Lopuksi se pyytää käynnistämään koneen uudelleen, "Press any key to Reboot".
    [*] Paina mitä tahansa näppäintä ja kone käynnistyy uudelleen.
    [*] Käynnistyminen kestää normaalia kauemmin sillä SDFix puhdistaa konetta.
    [*] Kun kone on käynnistynyt ja työpöytä latautunut, SDFix kertoo että puhdistus on suoritettu, "Finished".
    [*] Paina sitten mitä tahansa näppäintä sulkeaksesi skriptin ja ladataksesi pikakuvakkeet työpöydälle.
    [*] Lopuksi avaa SDFix kansio ja kopioi & liitä tiedoston Report.txt sisältö viestiketjuusi uuden HijackThis lokin kera.

    3.
    Siirrä Hijackthis omaan kansioonsa, esim. C:\Hijackthis. Tämä on tärkeää, jotta Hijackthis toimisi oikein. Ota uusi loki ja postita yhdessä ComboFix.txt kanssa tänne.
     
  4. bouncher

    bouncher Member

    Liittynyt:
    30.08.2005
    Viestejä:
    78
    Kiitokset:
    0
    Pisteet:
    16
    Tässä tuo combofixin loki:

    ((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))


    C:\WINDOWS\system32\drivers\npf.sys
    C:\WINDOWS\system32\packet.dll
    C:\WINDOWS\system32\svehost.exe
    C:\WINDOWS\system32\wpcap.dll


    ((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))


    -------\NPF


    ((((((((((((((((((((((((( Files Created from 2007-07-23 to 2007-08-23 )))))))))))))))))))))))))))))))


    2007-08-24 01:10 51,200 --a------ C:\WINDOWS\nircmd.exe
    2007-08-22 17:20 25,600 --a------ C:\WINDOWS\system32\borlndmm.dll
    2007-08-22 17:20 1,497,088 --a------ C:\WINDOWS\system32\cc3250mt.dll
    2007-08-22 17:20 <KANSIO> d-------- C:\Program Files\BitrateView
    2007-08-22 17:19 299,520 --a------ C:\WINDOWS\uninst.exe
    2007-08-22 17:19 <KANSIO> d-------- C:\DOCUME~1\HENRIS~1\WINDOWS
    2007-08-21 10:30 <KANSIO> d-------- C:\Program Files\PC Connectivity Solution
    2007-08-21 10:30 <KANSIO> d-------- C:\Program Files\Common Files\PCSuite
    2007-08-21 10:30 <KANSIO> d-------- C:\Program Files\Common Files\Nokia
    2007-08-21 10:29 8,320 --a------ C:\WINDOWS\system32\drivers\nmwcdc.sys
    2007-08-21 10:29 65,536 --a------ C:\WINDOWS\system32\nmwcdcocls.dll
    2007-08-21 10:29 137,216 --a------ C:\WINDOWS\system32\drivers\nmwcd.sys
    2007-08-21 10:29 12,288 --a------ C:\WINDOWS\system32\drivers\nmwcdcm.sys
    2007-08-21 10:29 12,288 --a------ C:\WINDOWS\system32\drivers\nmwcdcj.sys
    2007-08-21 10:29 <KANSIO> d-------- C:\Program Files\Nokia
    2007-08-21 10:28 <KANSIO> d-------- C:\DOCUME~1\ALLUSE~1\APPLIC~1\Installations
    2007-08-21 09:45 <KANSIO> d-------- C:\DOCUME~1\ALLUSE~1\APPLIC~1\Nokia
    2007-08-19 17:04 <KANSIO> d-------- C:\Program Files\MediaInfo
    2007-08-19 16:59 <KANSIO> d-------- C:\Program Files\XviD Bitrate Calculator
    2007-08-15 22:07 <KANSIO> d-------- C:\Program Files\MSXML 6.0
    2007-08-09 15:51 <KANSIO> d-------- C:\Program Files\SlySoft
    2007-08-03 22:04 <KANSIO> d-------- C:\Program Files\Maketorrent 2
    2007-08-03 15:54 <KANSIO> d-------- C:\Program Files\uTorrent
    2007-08-03 15:54 <KANSIO> d-------- C:\DOCUME~1\No name~1\APPLIC~1\uTorrent
    2007-07-31 16:36 <KANSIO> d-------- C:\Program Files\PhotoWatermark Professional 7
    2007-07-31 14:17 <KANSIO> d-------- C:\OziExplorer
    2007-07-27 08:25 <KANSIO> d-------- C:\Program Files\MSXML 4.0
    2007-07-26 13:31 82,432 --a------ C:\WINDOWS\system32\msxml4r.dll
    2007-07-26 13:31 44,544 --a------ C:\WINDOWS\system32\msxml4a.dll
    2007-07-26 13:31 401,408 --a------ C:\WINDOWS\system32\pvmjpg30.dll
    2007-07-26 13:31 1,712,128 --a------ C:\WINDOWS\system32\GDIPLUS.DLL
    2007-07-26 13:30 930,992 --------- C:\WINDOWS\system32\Ltr13n.dll
    2007-07-26 13:30 884,736 --------- C:\WINDOWS\system32\LMUIRes.dll
    2007-07-26 13:30 73,728 --------- C:\WINDOWS\system32\MMAviAx.dll
    2007-07-26 13:30 70,144 --------- C:\WINDOWS\system32\lfbmp13s.dll
    2007-07-26 13:30 64,512 --------- C:\WINDOWS\system32\lftga13s.dll
    2007-07-26 13:30 453,120 --------- C:\WINDOWS\system32\ltkrn13n.dll
    2007-07-26 13:30 41,984 --a------ C:\WINDOWS\system32\cacheX.dll
    2007-07-26 13:30 409,600 --------- C:\WINDOWS\system32\LFCMP13s.DLL
    2007-07-26 13:30 393,216 --------- C:\WINDOWS\system32\LFCMP13n.DLL
    2007-07-26 13:30 32,768 --------- C:\WINDOWS\system32\MLPagAx.dll
    2007-07-26 13:30 306,352 --------- C:\WINDOWS\system32\Ltrio13n.dll
    2007-07-26 13:30 30,208 --------- C:\WINDOWS\system32\lfbmp13n.dll
    2007-07-26 13:30 24,576 --------- C:\WINDOWS\system32\lftga13n.dll
    2007-07-26 13:30 233,472 --------- C:\WINDOWS\system32\DiskIO.dll
    2007-07-26 13:30 2,079,232 --------- C:\WINDOWS\system32\LTCLR13s.dll
    2007-07-26 13:30 184,320 --------- C:\WINDOWS\system32\RALMain.dll
    2007-07-26 13:30 153,088 --------- C:\WINDOWS\system32\ltfil13n.DLL
    2007-07-26 13:30 126,976 --------- C:\WINDOWS\system32\AVIPrAx.dll
    2007-07-26 13:30 12,288 --------- C:\WINDOWS\system32\LMLRes.dll
    2007-07-26 13:30 110,080 --------- C:\WINDOWS\system32\lfpsd13s.dll
    2007-07-26 13:30 1,693,696 --------- C:\WINDOWS\system32\LTCLR13n.dll
    2007-07-26 13:30 1,013,248 --------- C:\WINDOWS\system32\Ltwvc13n.dll
    2007-07-26 13:28 <KANSIO> d-------- C:\WINDOWS\RegisteredPackages
    2007-07-26 13:27 <KANSIO> d-------- C:\WINDOWS\system32\URTTEMP
    2007-07-26 13:26 95 --a------ C:\AUTOEXEC.BAT
    2007-07-26 13:26 84,992 --a------ C:\WINDOWS\system32\ATL70.DLL
    2007-07-26 13:26 57,856 --a------ C:\WINDOWS\system32\masd32.dll
    2007-07-26 13:26 27,648 --a------ C:\WINDOWS\system32\ma32.dll
    2007-07-26 13:26 196,096 --a------ C:\WINDOWS\system32\macd32.dll
    2007-07-26 13:26 138,752 --a------ C:\WINDOWS\system32\mase32.dll
    2007-07-26 13:26 136,192 --a------ C:\WINDOWS\system32\mamc32.dll
    2007-07-26 13:25 974,848 --a------ C:\WINDOWS\system32\MFC70.DLL
    2007-07-26 13:25 964,608 --a------ C:\WINDOWS\system32\MFC70U.DLL
    2007-07-26 13:25 54,784 --a------ C:\WINDOWS\system32\MSVCI70.DLL
    2007-07-26 13:25 49,152 --a------ C:\WINDOWS\system32\PCLEGetGuid.dll
    2007-07-26 13:25 487,424 --a------ C:\WINDOWS\system32\MSVCP70.DLL
    2007-07-26 13:25 41,219 --a------ C:\WINDOWS\RSETPATH.exe
    2007-07-26 13:25 171,520 --a------ C:\WINDOWS\system32\drivers\MarvinBus.sys
    2007-07-26 13:25 14,165 --a------ C:\WINDOWS\system32\drivers\Pclepci.sys
    2007-07-26 13:24 <KANSIO> d-------- C:\Program Files\Pinnacle
    2007-07-26 13:24 <KANSIO> d-------- C:\DOCUME~1\ALLUSE~1\APPLIC~1\Pinnacle Studio
    2007-07-26 13:21 <KANSIO> d-------- C:\DOCUME~1\No name~1\APPLIC~1\InstallShield
    2007-07-26 13:21 <KANSIO> d-------- C:\DOCUME~1\ALLUSE~1\APPLIC~1\Pinnacle
    2007-07-24 22:06 51,040 --a------ C:\WINDOWS\system32\drivers\fsdfw.sys
    2007-07-24 22:06 30,016 --a------ C:\WINDOWS\system32\drivers\fsndis5.sys
    2007-07-24 22:06 <KANSIO> d-------- C:\DOCUME~1\ALLUSE~1\APPLIC~1\F-Secure
    2007-07-24 22:05 <KANSIO> d-------- C:\Program Files\F-Secure
    2007-07-24 18:10 43,520 --a------ C:\WINDOWS\system32\CmdLineExt03.dll
    2007-07-24 18:02 8,320 --a------ C:\WINDOWS\system32\drivers\grmnusb.sys
    2007-07-24 18:02 18,432 --a------ C:\WINDOWS\system32\drivers\grmngen.sys
    2007-07-24 18:02 <KANSIO> d-------- C:\Garmin


    (((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))

    2007-08-21 10:33 --------- d-------- C:\DOCUME~1\HENRIS~1\APPLIC~1\Nokia
    2007-08-21 10:30 --------- d-------- C:\Program Files\DIFX
    2007-08-15 15:38 --------- d-------- C:\Program Files\Mozilla Thunderbird
    2007-08-13 17:56 --------- d-------- C:\Program Files\ImTOO
    2007-08-04 22:38 --------- d-------- C:\Program Files\RogueRemover
    2007-07-31 14:37 --------- d--h----- C:\Program Files\InstallShield Installation Information
    2007-07-22 21:48 --------- d-------- C:\Program Files\Absolute Uninstaller
    2007-07-22 21:18 --------- d-------- C:\Program Files\util
    2007-07-22 21:18 --------- d-------- C:\Program Files\Setup
    2007-07-22 21:18 --------- d-------- C:\Program Files\HP
    2007-07-22 21:17 --------- d-------- C:\Program Files\fin
    2007-07-22 21:17 --------- d-------- C:\Program Files\drivers
    2007-07-22 21:17 --------- d-------- C:\Program Files\common
    2007-07-22 21:05 --------- d-------- C:\Program Files\Eraser
    2007-07-22 20:24 --------- d-------- C:\DOCUME~1\No name~1\APPLIC~1\GlarySoft
    2007-07-18 18:10 --------- d-------- C:\DOCUME~1\No name1\APPLIC~1\Help
    2007-07-18 16:09 --------- d-------- C:\DOCUME~1\No name~1\APPLIC~1\PC Suite
    2007-07-11 23:00 --------- d-------- C:\Program Files\BandwidthMeterPro
    2007-07-11 23:00 --------- d-------- C:\DOCUME~1\No name~1\APPLIC~1\BWMeterPro
    2007-07-02 10:40 --------- d-------- C:\Program Files\SpywareBlaster
    2007-07-01 19:33 --------- d-------- C:\Program Files\Active Data Recovery Services
    2007-06-26 09:09 1104896 --a------ C:\WINDOWS\system32\msxml3.dll
    2007-06-19 16:32 282112 --a------ C:\WINDOWS\system32\gdi32.dll
    2007-06-13 16:22 1033728 --a------ C:\WINDOWS\explorer.exe
    2006-06-23 09:48 32768 -ra------ C:\WINDOWS\inf\UpdateUSB.exe


    ((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))


    *Note* empty entries & legit default entries are not shown

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "SoundMAXPnP"="C:\Program Files\Analog Devices\Core\smax4pnp.exe" [2006-05-01 05:07]
    "SoundMAX"="C:\Program Files\Analog Devices\SoundMAX\Smax4.exe" [2006-04-10 10:19]
    "JMB36X Configure"="C:\WINDOWS\system32\JMRaidTool.exe" [2006-07-12 12:47]
    "NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2006-08-11 22:43]
    "nwiz"="nwiz.exe" [2006-08-11 22:43 C:\WINDOWS\system32\nwiz.exe]
    "NvMediaCenter"="C:\WINDOWS\system32\NvMcTray.dll" [2006-08-11 22:43]
    "F-Secure Manager"="C:\Program Files\F-Secure\Common\FSM32.exe" [2007-05-28 12:19]
    "F-Secure TNB"="C:\Program Files\F-Secure\FSGUI\TNBUtil.exe" [2007-05-28 12:18]
    "Microsoft Updates"="svehost.exe" []

    [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "CTFMON.EXE"="C:\WINDOWS\system32\ctfmon.exe" [2006-03-02 15:00]

    [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\runservices]
    "Microsoft Updates"=svehost.exe

    [HKEY_USERS\.default\software\microsoft\windows\currentversion\run]
    "Nokia.PCSync"=C:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe /NoDialog

    [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\DPWLN ]
    C:\WINDOWS\system32\DPWLEvHd.dll 2004-09-08 16:45 102400 C:\WINDOWS\system32\DPWLEvHd.dll

    [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]
    "Notification Packages"= scecli DPPWDFLT

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Acrobat Assistant 7.0]
    "C:\Program Files\Adobe\Acrobat 7.0\Distillr\Acrotray.exe"

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BandwidthMeterPro]
    C:\Program Files\BandwidthMeterPro\BWMeterPro.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CloneCDTray]
    "C:\Program Files\SlySoft\CloneCD\CloneCDTray.exe" /s

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DAEMON Tools]
    "C:\Program Files\DAEMON Tools\daemon.exe" -lang 1033

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DPAgnt]
    C:\Program Files\DigitalPersona\Bin\DPAgnt.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Eraser]
    C:\Program Files\Eraser\eraser.exe -hide

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LaunchList]
    C:\Program Files\Pinnacle\Studio 11\LaunchList2.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS]
    "C:\Program Files\Messenger\msmsgs.exe" /background

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck]
    C:\WINDOWS\system32\NeroCheck.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PCSuiteTrayApplication]
    C:\Program Files\Nokia\Nokia PC Suite 6\LaunchApplication.exe -startup

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RemoteControl]
    "C:\Program Files\CyberLink DVD Solution\PowerDVD\PDVDServ.exe"

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SpybotSD TeaTimer]
    C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
    C:\Program Files\Java\jre1.5.0_10\bin\jusched.exe

    [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run-]
    "Eraser"=C:\Program Files\Eraser\eraser.exe -hide

    R0 FSFW;F-Secure Firewall Driver;C:\WINDOWS\system32\drivers\fsdfw.sys
    R0 JGOGO;JMicron Hot-Plug Driver;C:\WINDOWS\system32\DRIVERS\JGOGO.sys
    R0 JRAID;JRAID;C:\WINDOWS\system32\DRIVERS\jraid.sys
    R1 F-Secure HIPS;F-Secure HIPS;\??\C:\Program Files\F-Secure\HIPS\fshs.sys
    R3 F-Secure Gatekeeper;F-Secure Gatekeeper;\??\C:\Program Files\F-Secure\Anti-Virus\minifilter\fsgk.sys
    R3 SenFiltService;SenFilt Service;C:\WINDOWS\system32\drivers\Senfilt.sys
    S3 dpK0Bx01;Fingerprint Reader Filter Driver;C:\WINDOWS\system32\DRIVERS\dpK0Bx01.sys
    S3 grmnusb;grmnusb;C:\WINDOWS\system32\drivers\grmnusb.sys
    S3 iMSPQMn;iMSPQMn;\??\C:\DOCUME~1\No name~1\LOCALS~1\Temp\iMSPQMn.sys
    S3 TFBULK;Topfield USB client driver;C:\WINDOWS\system32\drivers\TfBulk.sys
    S3 UsbdpFP;Fingerprint Reader Class Driver;C:\WINDOWS\system32\DRIVERS\UsbdpFP.sys
    S4 F-Secure Filter;F-Secure File System Filter;\??\C:\Program Files\F-Secure\Anti-Virus\Win2K\FSfilter.sys
    S4 F-Secure Recognizer;F-Secure File System Recognizer;\??\C:\Program Files\F-Secure\Anti-Virus\Win2K\FSrec.sys


    [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{c55828c4-9cb2-11db-8f22-806d6172696f}]
    AutoRun\command- D:\ASUSACPI.exe


    Contents of the 'Scheduled Tasks' folder
    2007-08-23 06:00:00 C:\WINDOWS\Tasks\excscd2.job - K:\BitComet lataukset\Elite.XC.Strikeforce.2007.PPV.DSR.XviD-OMiCRON\excscd2.avi

    **************************************************************************

    catchme 0.3.1061 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
    Rootkit scan 2007-08-24 01:20:11
    Windows 5.1.2600 Service Pack 2 NTFS

    scanning hidden processes ...

    scanning hidden autostart entries ...

    scanning hidden files ...

    scan completed successfully
    hidden files: 0

    **************************************************************************

    Completion time: 2007-08-24 1:20:45 - machine was rebooted
    C:\ComboFix-quarantined-files.txt ... 2007-08-24 01:20
     
  5. yamaneko

    yamaneko Senior member

    Liittynyt:
    22.09.2005
    Viestejä:
    5,093
    Kiitokset:
    1
    Pisteet:
    118
    Laitathan sitten myös Sdfixin report.txt ja uusi Sdfixin jälkeen otettu Hjt -loki (kuten alkup. ohje oli) :)
     
  6. bouncher

    bouncher Member

    Liittynyt:
    30.08.2005
    Viestejä:
    78
    Kiitokset:
    0
    Pisteet:
    16
    Tässä nämä molemmat lokit. Näyttäis että madot on poistettu, eikö?

    Microsoft Windows XP [versio 5.1.2600]

    Running From: C:\SDFix

    Safe Mode:
    Checking Services:


    Restoring Windows Registry Values
    Restoring Windows Default Hosts File

    Rebooting...


    Normal Mode:
    Checking Files:

    No Trojan Files Found




    Removing Temp Files...

    ADS Check:

    C:\WINDOWS
    No streams found.

    C:\WINDOWS\system32
    No streams found.

    C:\WINDOWS\system32\svchost.exe
    No streams found.

    C:\WINDOWS\system32\ntoskrnl.exe
    No streams found.



    Final Check:

    Remaining Services:
    ------------------



    Authorized Application Key Export:

    [HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
    "C:\\Program Files\\uTorrent\\uTorrent.exe"="C:\\Program Files\\uTorrent\\uTorrent.exe:*:Enabled:æTorrent"

    [HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]

    Remaining Files:
    ---------------


    Files with Hidden Attributes:

    C:\Program Files\Windows Media Player\mplayer2.exe
    C:\Program Files\Windows Media Player\wmplayer.exe
    C:\WINDOWS\system32\config\SAM.tmp.LOG
    C:\WINDOWS\system32\config\SECURITY.tmp.LOG

    Finished
    --------------------------------------------------------------------------------------------------------------------------------------------
    Logfile of HijackThis v1.99.1
    Scan saved at 10:39:30, on 24.8.2007
    Platform: Windows XP SP2 (WinNT 5.01.2600)
    MSIE: Internet Explorer v7.00 (7.00.6000.16512)

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\Program Files\DigitalPersona\Bin\DPWinLct.exe
    C:\WINDOWS\system32\spoolsv.exe
    C:\Program Files\DigitalPersona\Bin\DpHost.exe
    C:\Program Files\F-Secure\Anti-Virus\fsgk32st.exe
    C:\Program Files\F-Secure\Common\FSMA32.EXE
    C:\Program Files\F-Secure\Anti-Virus\FSGK32.EXE
    C:\WINDOWS\system32\nvsvc32.exe
    C:\Program Files\F-Secure\Common\FSMB32.EXE
    C:\WINDOWS\system32\svchost.exe
    C:\Program Files\F-Secure\Common\FCH32.EXE
    C:\Program Files\DigitalPersona\Bin\DPFUSMgr.exe
    C:\Program Files\F-Secure\Anti-Virus\fsqh.exe
    C:\Program Files\F-Secure\Common\FAMEH32.EXE
    C:\Program Files\F-Secure\FSAUA\program\fsaua.exe
    C:\Program Files\F-Secure\Anti-Virus\fssm32.exe
    C:\Program Files\F-Secure\FWES\Program\fsdfwd.exe
    C:\Program Files\F-Secure\FSAUA\program\fsus.exe
    C:\WINDOWS\Explorer.EXE
    C:\Program Files\F-Secure\Anti-Virus\fsav32.exe
    C:\WINDOWS\system32\wuauclt.exe
    C:\WINDOWS\system32\notepad.exe
    C:\Program Files\Analog Devices\Core\smax4pnp.exe
    C:\Program Files\Analog Devices\SoundMAX\Smax4.exe
    C:\WINDOWS\system32\RUNDLL32.EXE
    C:\Program Files\F-Secure\Common\FSM32.EXE
    C:\WINDOWS\system32\ctfmon.exe
    C:\Program Files\F-Secure\FSGUI\fsguidll.exe
    C:\WINDOWS\system32\notepad.exe
    C:\Uusi kansio\scanner.exe.exe

    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.ess.fi/
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
    R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://windowsupdate.microsoft.com/
    R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Linkit
    O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
    O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
    O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_10\bin\ssv.dll
    O2 - BHO: AcroIEToolbarHelper Class - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll
    O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll
    O4 - HKLM\..\Run: [SoundMAXPnP] C:\Program Files\Analog Devices\Core\smax4pnp.exe
    O4 - HKLM\..\Run: [SoundMAX] "C:\Program Files\Analog Devices\SoundMAX\Smax4.exe" /tray
    O4 - HKLM\..\Run: [JMB36X Configure] C:\WINDOWS\system32\JMRaidTool.exe boot
    O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
    O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
    O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
    O4 - HKLM\..\Run: [F-Secure Manager] "C:\Program Files\F-Secure\Common\FSM32.EXE" /splash
    O4 - HKLM\..\Run: [F-Secure TNB] "C:\Program Files\F-Secure\FSGUI\TNBUtil.exe" /CHECKALL /WAITFORSW
    O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
    O8 - Extra context menu item: Convert link target to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
    O8 - Extra context menu item: Convert link target to existing PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
    O8 - Extra context menu item: Convert selected links to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
    O8 - Extra context menu item: Convert selected links to existing PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
    O8 - Extra context menu item: Convert selection to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
    O8 - Extra context menu item: Convert selection to existing PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
    O8 - Extra context menu item: Convert to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
    O8 - Extra context menu item: Convert to existing PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
    O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
    O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_10\bin\ssv.dll
    O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_10\bin\ssv.dll
    O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)
    O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)
    O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
    O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
    O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O10 - Unknown file in Winsock LSP: c:\program files\f-secure\fsps\program\fslsp.dll
    O10 - Unknown file in Winsock LSP: c:\program files\f-secure\fsps\program\fslsp.dll
    O10 - Unknown file in Winsock LSP: c:\program files\f-secure\fsps\program\fslsp.dll
    O10 - Unknown file in Winsock LSP: c:\program files\f-secure\fsps\program\fslsp.dll
    O10 - Unknown file in Winsock LSP: c:\program files\f-secure\fsps\program\fslsp.dll
    O10 - Unknown file in Winsock LSP: c:\program files\f-secure\fsps\program\fslsp.dll
    O10 - Unknown file in Winsock LSP: c:\program files\f-secure\fsps\program\fslsp.dll
    O10 - Unknown file in Winsock LSP: c:\program files\f-secure\fsps\program\fslsp.dll
    O10 - Unknown file in Winsock LSP: c:\program files\f-secure\fsps\program\fslsp.dll
    O10 - Unknown file in Winsock LSP: c:\program files\f-secure\fsps\program\fslsp.dll
    O10 - Unknown file in Winsock LSP: c:\program files\f-secure\fsps\program\fslsp.dll
    O10 - Unknown file in Winsock LSP: c:\program files\f-secure\fsps\program\fslsp.dll
    O11 - Options group: [INTERNATIONAL] International*
    O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://download.bitdefender.com/resources/scan8/oscan8.cab
    O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1167994320218
    O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
    O20 - Winlogon Notify: DPWLN - C:\WINDOWS\system32\DPWLEvHd.dll
    O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\
    O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
    O23 - Service: Windows XP FUS Manager (DPFUSMgr) - DigitalPersona, Inc. - C:\Program Files\DigitalPersona\Bin\DPFUSMgr.exe
    O23 - Service: Biometric Authentication Service (DpHost) - DigitalPersona, Inc. - C:\Program Files\DigitalPersona\Bin\DpHost.exe
    O23 - Service: FSGKHS (F-Secure Gatekeeper Handler Starter) - F-Secure Corporation - C:\Program Files\F-Secure\Anti-Virus\fsgk32st.exe
    O23 - Service: F-Secure Automatic Update Agent (FSAUA) - F-Secure Corporation - C:\Program Files\F-Secure\FSAUA\program\fsaua.exe
    O23 - Service: F-Secure Anti-Virus Firewall Daemon (FSDFWD) - F-Secure Corporation - C:\Program Files\F-Secure\FWES\Program\fsdfwd.exe
    O23 - Service: F-Secure Management Agent (FSMA) - F-Secure Corporation - C:\Program Files\F-Secure\Common\FSMA32.EXE
    O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
    O23 - Service: PCLEPCI - Pinnacle Systems GmbH - C:\WINDOWS\system32\drivers\pclepci.sys
    O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
    O23 - Service: ServiceLayer - Nokia. - C:\Program Files\PC Connectivity Solution\ServiceLayer.exe
     
  7. yamaneko

    yamaneko Senior member

    Liittynyt:
    22.09.2005
    Viestejä:
    5,093
    Kiitokset:
    1
    Pisteet:
    118
    1.
    Ota ensin rekisteristä näin varmuuskopio:

    Suorita -> regedit -> ok. Sitten Tiedosto -> Vie. Kirjoita sille joku nimi ja sitten Tallenna(ja laita muistiin, mihin tallensit sen).

    Sitten tallenna tämä alla oleva tekstinpätkä nimellä fix.reg vaikka muistiossa ja vaikka työpöydälle (tallennusmuoto kaikki tiedostot)

    Tuplaklikkaa ja paina kyllä ja ok. Älä käynnistä konetta vielä uudestaan, vaan siirry seuraavaan kohtaan ohjeissa.


    2.
    Tallenna nämä ohjeet tekstitiedostoon tai tulosta nämä, muuten et pääse niihin käsiksi vikasietotilasta

    Lataa AVG Anti-Spyware 7.5 ja tallenna ohjelma työpöydällesi.
    [*]Kun olet ladannut ohjelman, kaksoisklikkaa asennuohjelman pikakuvaketta työpöydälläsi, asennus alkaa.
    [*]Asennuksen jälkeen täytyy ohjelma käynnistää ja sen tunnisteet päivittää.
    [*]Käynnistä AVG Anti-Spyware.
    [*]Klikkaa "Update" kuvaketta päävalikossa. Sen jälkeen klikkaa "Update now" painiketta.
    [*]Sitten klikkaa "Start Update" kuvaketta jolloin päivitys alkaa.

    [*]Kun päivitykset on ladattu, klikkaa "Scanner" kuvaketta ikkunan ylälaidassa. Valitse sitten "Settings" välilehti.
    [*]Kun "Settings" valikko on auennut, klikkaa "Recommended actions" ja sitten valitse "Quarantine".
    [*]Sitten "Reports" valikon alta:
    [*]Laita täppi kohtaan "Automatically generate report after every scan"
    [*]Ota täppi pois kohdasta"Only if threats were found"

    [*]Sitten klikkaa "Shield" kuvaketta ikkunan ylälaidassa
    [*]"Resident shield is", muuta tila active:sta inactive:ksi
    [*]Sulje ohjelma, ÄLÄ skannaa vielä.
    Käynnistä koneesi vikasietotilaan, Ohje!

    HUOM! Älä käytä muita ohjelmia AVG skannauksen aikana, tämä saattaa häiritä skannausta.
    [*]Kun vikasietotilassa, käynnistä AVG Anti-Spyware.
    [*]Klikkaa "Scanner" kuvaketta ikkunan ylälaidassa ja valitse "Scan" välilehti. Sitten klikkaa "Complete System Scan".
    [*]AVG aloittaa nyt tietokoneen skannaamisen, ole kärsivällinen sillä skannaus vie aikaa.

    Kun skannaus on valmis:
    TÄRKEÄÄ : Älä klikkaa "Save Scan Report" ennen kuin klikkaat "Apply all Actions"
    [*]Varmistu, että Set all elements to: näyttää Quarantine (1), jos ei, klikkaa linkkiä ja valitse Quarantine popup-valikosta.
    [*]Sinulta kysytään mitä tehdä jos infektioita löytyi, valitse silloin "Apply all actions"
    [​IMG]
    [*]Sitten klikkaa "Reports" kuvaketta ohjelma yläosasta.
    [*]Klikkaa "Save report as" painiketta ikkunan vasemmassa alalaidassa ja tallenna raportti työpöydälle.
    [*]Sulje ohjelma, käynnistä kone normaalisti ja lähetä AVG Anti-Spyware:n raportti viestikejuusi.
     
  8. bouncher

    bouncher Member

    Liittynyt:
    30.08.2005
    Viestejä:
    78
    Kiitokset:
    0
    Pisteet:
    16
    Tein AVG scannauksen mutta tein vahingossa väärinpäin(Hyvistä ohjeista huolimatta.. hätäilyä..) tuom quarantine - Save report - jutun mutta ohjelma löysi ulkoiselta kovolta seuraavat pöpöt: Logger.Delf.wh ja Trojan.small. Ko. pöpöt on nyt karanteenissa, tai laitoin koko kansiot karanteeniin jossa nuo olivat. Ajanko AVG:n uudestaan vai kuinka edetään?
     
  9. yamaneko

    yamaneko Senior member

    Liittynyt:
    22.09.2005
    Viestejä:
    5,093
    Kiitokset:
    1
    Pisteet:
    118
    Eipä tuo niin haittaa. Päivitä vielä Java.

    Javan päivitys ja välimuistin tyhjennys:

    1. Klikkaa Käynnistä -> Ohjauspaneeli ja tupla-klikkaa Lisää tai poista sovellus Ohjauspaneelissa.
    2. Etsi listasta kaikki entiset Java versiosi. (J2SE Runtime Environment.... )
    Niissä pitäisi olla seuraava kuva vieressä: [​IMG]
    3. Valitse kaikki entiset Java versiosi ja valitse Poista.
    4. Asenna uusin Java päivitys seuraavasta linkistä..
    5. Käynnistä kone uudelleen asennuksen jälkeen:

    http://java.sun.com/javase/downloads/index.jsp

    Rullaa alas kohteeseen Java Runtime Environment (JRE) 6u2

    Paina Download

    Ruksaa Accept, ota offline installation, tallenna vaikka työpöydälle ja asenna se.

    6. Käynnistyksen jälkeen, mene takaisin Ohjauspaneeliin ja avaa Java asetuksesi (Muita Ohjauspaneelin asetuksia -> Java kahvikuppi).

    7. General Settings -osion alla, vedä liukusäädintä (Disk Space) pienemmälle, ja klikkaa Delete Files -nappia.

    (Jotkut javapohjaiset ohjelmat saattavat tarvita enemmän levytilaa.
    Jos huomaat säädön pienentämisen jälkeen koneessa hitautta, siirrä liukusäädintä isommalle
    ).

    8. Varmista että kaikki kaksi valintaa ovat rastitettuja:

    [*]Applications and Applets

    [*]Trace and Log Files



    Ja paina OK -nappia

    9. Klikkaa OK "Temporary Files Settings" -ikkunassasi.
    Huomaa: Tämä poistaa kaikki ladatut sovellukset ja appletit VÄLIMUISTISTA.

    10. Klikkaa OK jättääksesi Java asetusikkunasi.
     
  10. bouncher

    bouncher Member

    Liittynyt:
    30.08.2005
    Viestejä:
    78
    Kiitokset:
    0
    Pisteet:
    16
    Homma tehty tarkasti ohjeiden mukaisesti. Onko vielä jotain tekemistä, vai onko kone puhdas?
     
  11. bouncher

    bouncher Member

    Liittynyt:
    30.08.2005
    Viestejä:
    78
    Kiitokset:
    0
    Pisteet:
    16
    Pikkuisena bonuksena tässä kaiken keskellä, koneeni ilmoitti käynnistyksen yhteydessä CPU FAN ERROR mutta nyt taas toimii kun vähän heilautti konetta.
     
  12. yamaneko

    yamaneko Senior member

    Liittynyt:
    22.09.2005
    Viestejä:
    5,093
    Kiitokset:
    1
    Pisteet:
    118
    Katsotaan vielä varmuuden vuoksi online skannerilla kone läpi, ja sitten vielä uusi hjt niin voidaan olla sitten varmoja. :) Eli

    1.
    Skannaa koneesi Kaspersky Online Skannerilla

    Sinulta kysytään sallitko ActiveX -komponentin asentamisen Kasperskyltä, klikkaa Kyllä.
    [*] Ohjelma käynnistyy ja aloittaa viimeisimpien tunnistetiedostojen lataamisen.
    [*] Kun skanneri on asennettu ja tunnistetiedot ladattu, klikkaa Next.
    [*] Klikkaa nyt asetuksia, Scan Settings
    [*] Tarkista asetuksista, että seuraavat ovat valittuina:

    o Scan using the following Anti-Virus database:

    + Extended (Jos valittavissa, muuten valitse Standard)

    o Scan Options:

    + Scan Archives
    + Scan Mail Bases

    [*] Klikkaa OK
    [*] Nyt valitse "select a target to scan" otsikon alta Oma Tietokone, My Computer
    [*] Skannaus vie aikaa, joten ole kärsivällinen. Kun skannaus on valmis saat ilmoituksen, jos koneesi on saastunut.
    [*] Klikkaa nyt Save as Text-painiketta.
    [*] Tallenna tiedosto työpöydällesi.
    [*] Kopioi ja Liitä tiedoston sisältö seuraavaan vastaukseesi.

    2.
    Uusi Hijackthis -loki
     
  13. Hujo

    Hujo Guest

    fixsaa tuo pois

    O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\
     
  14. bouncher

    bouncher Member

    Liittynyt:
    30.08.2005
    Viestejä:
    78
    Kiitokset:
    0
    Pisteet:
    16
    Ei löytäny kaspersky mitään. Mitäs tarkoittaa tuo Hujon kommentti:

    fixsaa tuo pois
    O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\

    Friday, August 24, 2007 8:10:43 PM
    Operating System: Microsoft Windows XP Home Edition, Service Pack 2 (Build 2600)
    Kaspersky Online Scanner version: 5.0.93.0
    Kaspersky Anti-Virus database last update: 24/08/2007
    Kaspersky Anti-Virus database records: 389566
    Scan Settings
    Scan using the following antivirus database extended
    Scan Archives true
    Scan Mail Bases true
    Scan Target My Computer
    C:\
    D:\
    E:\
    F:\
    G:\
    H:\
    I:\
    Scan Statistics
    Total number of scanned objects 46472
    Number of viruses found 0
    Number of infected objects 0
    Number of suspicious objects 0
    Duration of the scan process 00:28:13

    Infected Object Name Virus Name Last Action
    C:\Documents and Settings\All Users\Application Data\F-Secure\logs\FSMA\fsma.log Object is locked skipped
    C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\008c3f90593abcc7f28a3d80b4228c2b_1656dad2-3084-4ff9-9a20-03f1b02f2fa3 Object is locked skipped
    C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\01ae144423d746adddadddbf5ffb4353_1656dad2-3084-4ff9-9a20-03f1b02f2fa3 Object is locked skipped
    C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\023f9109b9e25d87c49a573b286fac8c_1656dad2-3084-4ff9-9a20-03f1b02f2fa3 Object is locked skipped
    C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\039df8e58ca09d798ac2c2390263b3e7_1656dad2-3084-4ff9-9a20-03f1b02f2fa3 Object is locked skipped
    C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\03de7135cc3855ad045fc66d1bde25f4_1656dad2-3084-4ff9-9a20-03f1b02f2fa3 Object is locked skipped
    C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\03ee1d62cc740d7c95a42e0df1684349_1656dad2-3084-4ff9-9a20-03f1b02f2fa3 Object is locked skipped
    C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\03eeed91b5a8ca28a52a4fd79a0f676f_1656dad2-3084-4ff9-9a20-03f1b02f2fa3 Object is locked skipped
    C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\03fd2095ab451ac34645d1cffd573cb8_1656dad2-3084-4ff9-9a20-03f1b02f2fa3 Object is locked skipped
    C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\04ef3d746e604616b8b8750f84a914f9_1656dad2-3084-4ff9-9a20-03f1b02f2fa3 Object is locked skipped
    C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\0618e1bda30fb22c89e87a31a377f681_1656dad2-3084-4ff9-9a20-03f1b02f2fa3 Object is locked skipped
    C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\0689ac21ddd927abc5ca249e54964212_1656dad2-3084-4ff9-9a20-03f1b02f2fa3 Object is locked skipped
    C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\08f75551bfc58ef961ede5e7ec8f94d5_1656dad2-3084-4ff9-9a20-03f1b02f2fa3 Object is locked skipped
    C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\096ad9a6efa5385a7bddb4e2c9a3fbc7_1656dad2-3084-4ff9-9a20-03f1b02f2fa3 Object is locked skipped
    C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\0a73834e170edee2662b36dee0d5c350_1656dad2-3084-4ff9-9a20-03f1b02f2fa3 Object is locked skipped
    C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\0ae66c18f095c9d63ff26aa7344a1f65_1656dad2-3084-4ff9-9a20-03f1b02f2fa3 Object is locked skipped
    C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\0ed1d32a54b6dd0dc12ebc5a50a6300a_1656dad2-3084-4ff9-9a20-03f1b02f2fa3 Object is locked skipped
    C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\1277cadbc651ef1273d8135a98168f0c_1656dad2-3084-4ff9-9a20-03f1b02f2fa3 Object is locked skipped
    C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\128a43595cfc915f88dd3c03585921e7_1656dad2-3084-4ff9-9a20-03f1b02f2fa3 Object is locked skipped
    C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\12f5ad89e62ee10b8a054bf9969df9ec_1656dad2-3084-4ff9-9a20-03f1b02f2fa3 Object is locked skipped
    C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\13bc8f51eda80d89597891235f464830_1656dad2-3084-4ff9-9a20-03f1b02f2fa3 Object is locked skipped
    C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\140f359f868130b5aa07ea04840fda60_1656dad2-3084-4ff9-9a20-03f1b02f2fa3 Object is locked skipped
    C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\1452ef7d5a7993053281a3516ae15917_1656dad2-3084-4ff9-9a20-03f1b02f2fa3 Object is locked skipped
    C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\195ed5622e5f9765e76748993d1c1428_1656dad2-3084-4ff9-9a20-03f1b02f2fa3 Object is locked skipped
    C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\1fd7394d7bcdf9ba12582da25942b3b1_1656dad2-3084-4ff9-9a20-03f1b02f2fa3 Object is locked skipped
    C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\2098cf1db2b406e0b9ad82107df91cfc_1656dad2-3084-4ff9-9a20-03f1b02f2fa3 Object is locked skipped
    C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\215755a279eb5a022835f0c544ed13b9_1656dad2-3084-4ff9-9a20-03f1b02f2fa3 Object is locked skipped
    C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\24fff1cf0f98a1804ad89c13077a56fc_1656dad2-3084-4ff9-9a20-03f1b02f2fa3 Object is locked skipped
    C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\25aba6ef298d829725a50c178909ecc9_1656dad2-3084-4ff9-9a20-03f1b02f2fa3 Object is locked skipped
    C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\269d58919a6b3248e821c7c5bae9d841_1656dad2-3084-4ff9-9a20-03f1b02f2fa3 Object is locked skipped
    C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\28179fb22818b20d7abbe18477b03079_1656dad2-3084-4ff9-9a20-03f1b02f2fa3 Object is locked skipped
    C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\2870fa5c793358dcbca40f15ee3d6b51_1656dad2-3084-4ff9-9a20-03f1b02f2fa3 Object is locked skipped
    C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\29c7f4c69ef40c178fc405acafd90395_1656dad2-3084-4ff9-9a20-03f1b02f2fa3 Object is locked skipped
    C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\2a3e09ac1fe577d4ad8e05808ba817c0_1656dad2-3084-4ff9-9a20-03f1b02f2fa3 Object is locked skipped
    C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\2cc0c3554482cd61e07e89873dcfaa81_1656dad2-3084-4ff9-9a20-03f1b02f2fa3 Object is locked skipped
    C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\2d83245797850d8fcbb085cbf9d07af9_1656dad2-3084-4ff9-9a20-03f1b02f2fa3 Object is locked skipped
    C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\2e25484a4b98207cff92dc7760cda4dd_1656dad2-3084-4ff9-9a20-03f1b02f2fa3 Object is locked skipped
    C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\3027b176e0a813e39952dac7320f2aae_1656dad2-3084-4ff9-9a20-03f1b02f2fa3 Object is locked skipped
    C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\324a7df5673d749448e55c6fcd4384b3_1656dad2-3084-4ff9-9a20-03f1b02f2fa3 Object is locked skipped
    C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\33005096d750a7b402e579fbd07c879c_1656dad2-3084-4ff9-9a20-03f1b02f2fa3 Object is locked skipped
    C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\336ff50ccad6b5d425418433ced5741c_1656dad2-3084-4ff9-9a20-03f1b02f2fa3 Object is locked skipped
    C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\34dcf00c5410892108f9aa92ceb9950b_1656dad2-3084-4ff9-9a20-03f1b02f2fa3 Object is locked skipped
    C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\354ba03fbec8b2b0943c7a8a20c76736_1656dad2-3084-4ff9-9a20-03f1b02f2fa3 Object is locked skipped
    C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\367bf5c1d62a4a8d46b5ac691eec4401_1656dad2-3084-4ff9-9a20-03f1b02f2fa3 Object is locked skipped
    C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\380f0f27df222861553d16366123d1ac_1656dad2-3084-4ff9-9a20-03f1b02f2fa3 Object is locked skipped
    C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\389acb907c427708226697d144a69ccf_1656dad2-3084-4ff9-9a20-03f1b02f2fa3 Object is locked skipped
    C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\3913e93020b2f2bd746f7cbe7ce00141_1656dad2-3084-4ff9-9a20-03f1b02f2fa3 Object is locked skipped
    C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\39ead292fd06c6cadfb82b461e32c5b7_1656dad2-3084-4ff9-9a20-03f1b02f2fa3 Object is locked skipped
    C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\3d1a747428bb57aad0aaf10346275584_1656dad2-3084-4ff9-9a20-03f1b02f2fa3 Object is locked skipped
    C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\3f0f9978da6ef93eab8973fb45500514_1656dad2-3084-4ff9-9a20-03f1b02f2fa3 Object is locked skipped
    C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\3f1a76c6f9e1b4103e5da9a7eb1266fb_1656dad2-3084-4ff9-9a20-03f1b02f2fa3 Object is locked skipped
    C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\3f9e371d1834846719bcb95ea99b62d4_1656dad2-3084-4ff9-9a20-03f1b02f2fa3 Object is locked skipped
    C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\3ff107c19be45cb769135b23cdcfae20_1656dad2-3084-4ff9-9a20-03f1b02f2fa3 Object is locked skipped
    C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\3ffa027fd15832785cee8ec1b6a1a2c8_1656dad2-3084-4ff9-9a20-03f1b02f2fa3 Object is locked skipped
    C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\436a5f4708bca7da43ad940d4eeda41d_1656dad2-3084-4ff9-9a20-03f1b02f2fa3 Object is locked skipped
    C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\443bc3995e07bcfeb0b56591da00311d_1656dad2-3084-4ff9-9a20-03f1b02f2fa3 Object is locked skipped
    C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\44d7d4e1d6884aa4ecb3459cdfc7ca29_1656dad2-3084-4ff9-9a20-03f1b02f2fa3 Object is locked skipped
    C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\4741fb7369607b9e9014cc5c33b1e8e5_1656dad2-3084-4ff9-9a20-03f1b02f2fa3 Object is locked skipped
    C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\4a96f06fa00e3ae530b94f702e379a8d_1656dad2-3084-4ff9-9a20-03f1b02f2fa3 Object is locked skipped
    C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\4e45f02457b4cefcdd4c38a58a9bf8fb_1656dad2-3084-4ff9-9a20-03f1b02f2fa3 Object is locked skipped
    C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\4f6e36fb96b1f365fde7447215e4f543_1656dad2-3084-4ff9-9a20-03f1b02f2fa3 Object is locked skipped
    C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\50fdcab6fcce70b8663dca976a9962b8_1656dad2-3084-4ff9-9a20-03f1b02f2fa3 Object is locked skipped
    C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\53b91156d4c7f47e3d09da916186adbf_1656dad2-3084-4ff9-9a20-03f1b02f2fa3 Object is locked skipped
    C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\5430de42f3b7d37f171cf3d86ae94970_1656dad2-3084-4ff9-9a20-03f1b02f2fa3 Object is locked skipped
    C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\55596d3a0fab59bb392478b21cf2b7e6_1656dad2-3084-4ff9-9a20-03f1b02f2fa3 Object is locked skipped
    C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\56e78e515cdce16267a264f8fe636739_1656dad2-3084-4ff9-9a20-03f1b02f2fa3 Object is locked skipped
    C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\59b0138822bb3bea96df9e6d292ad151_1656dad2-3084-4ff9-9a20-03f1b02f2fa3 Object is locked skipped
    C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\5c6fad0b014f5f93457f4e1df513f187_1656dad2-3084-4ff9-9a20-03f1b02f2fa3 Object is locked skipped
    C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\5cef2c4a483483c374c28abb9e1c75fb_1656dad2-3084-4ff9-9a20-03f1b02f2fa3 Object is locked skipped
    C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\5d6178c9fc149d3123e253e07c9de4a8_1656dad2-3084-4ff9-9a20-03f1b02f2fa3 Object is locked skipped
    C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\5e679f8bc2d5318613779915c4c843dd_1656dad2-3084-4ff9-9a20-03f1b02f2fa3 Object is locked skipped
    C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\5fa2fa3e04334197f9a904d70ee61235_1656dad2-3084-4ff9-9a20-03f1b02f2fa3 Object is locked skipped
    C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\61c2baf28090da83e90f7e16a5fc4ba0_1656dad2-3084-4ff9-9a20-03f1b02f2fa3 Object is locked skipped
    C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\62b727831dd3f7dd102f476bba710ad0_1656dad2-3084-4ff9-9a20-03f1b02f2fa3 Object is locked skipped
    C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\64f5c8ee1fb219e9e9b064e3ed4056dc_1656dad2-3084-4ff9-9a20-03f1b02f2fa3 Object is locked skipped
    C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\6533ec25668d8447ea5b4d38820a9604_1656dad2-3084-4ff9-9a20-03f1b02f2fa3 Object is locked skipped
    C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\65406927338e9491978e42986cdd6a06_1656dad2-3084-4ff9-9a20-03f1b02f2fa3 Object is locked skipped
    C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\668019ee9f8f03449e01681a0d102884_1656dad2-3084-4ff9-9a20-03f1b02f2fa3 Object is locked skipped
    C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\670c7a4218d8366d15e64cf92ee8c0c7_1656dad2-3084-4ff9-9a20-03f1b02f2fa3 Object is locked skipped
    C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\6b34152cf87b5e19daea46160444c5ab_1656dad2-3084-4ff9-9a20-03f1b02f2fa3 Object is locked skipped
    C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\6bd78cfa026d357f0abda8e01c3f6d42_1656dad2-3084-4ff9-9a20-03f1b02f2fa3 Object is locked skipped
    C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\6c84bf6bda72d08fa73bc463e752d142_1656dad2-3084-4ff9-9a20-03f1b02f2fa3 Object is locked skipped
    C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\6e5a587395ff93e5f98008583405aaec_1656dad2-3084-4ff9-9a20-03f1b02f2fa3 Object is locked skipped
    C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\70a30059611abf63a9604597ab6377db_1656dad2-3084-4ff9-9a20-03f1b02f2fa3 Object is locked skipped
    C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\71f10b0b5e917dadcc3078035866b945_1656dad2-3084-4ff9-9a20-03f1b02f2fa3 Object is locked skipped
    C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\72af5619fdd0c089f6dc422049894645_1656dad2-3084-4ff9-9a20-03f1b02f2fa3 Object is locked skipped
    C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\751a678c6645a57e0060be0a24eb8fd0_1656dad2-3084-4ff9-9a20-03f1b02f2fa3 Object is locked skipped
    C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\778dc122776ff648d3fd9a6464016ef5_1656dad2-3084-4ff9-9a20-03f1b02f2fa3 Object is locked skipped
    C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\7a61521aa01c6505d34e839888869972_1656dad2-3084-4ff9-9a20-03f1b02f2fa3 Object is locked skipped
    C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\7a6923a0b56e8c41253721dcbf36e192_1656dad2-3084-4ff9-9a20-03f1b02f2fa3 Object is locked skipped
    C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\7b24cb11ca4815934911d3cf57ddf9d4_1656dad2-3084-4ff9-9a20-03f1b02f2fa3 Object is locked skipped
    C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\7bffd962ed148914eb547b0ebdaab74e_1656dad2-3084-4ff9-9a20-03f1b02f2fa3 Object is locked skipped
    C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\7dbebfe5b3aa75a0f837d9d3e66397fe_1656dad2-3084-4ff9-9a20-03f1b02f2fa3 Object is locked skipped
    C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\8010e609e81558a0c4d747f4055af943_1656dad2-3084-4ff9-9a20-03f1b02f2fa3 Object is locked skipped
    C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\829400e0269264dae5baf355244015c4_1656dad2-3084-4ff9-9a20-03f1b02f2fa3 Object is locked skipped
    C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\82a902265f40dba9d2989ab317f97633_1656dad2-3084-4ff9-9a20-03f1b02f2fa3 Object is locked skipped
    C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\84440c1a2f94bc4cefbbd35f17bf5d51_1656dad2-3084-4ff9-9a20-03f1b02f2fa3 Object is locked skipped
    C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\88c4b1c460e33acc21455b5f63618288_1656dad2-3084-4ff9-9a20-03f1b02f2fa3 Object is locked skipped
    C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\8a2f0e5c8823e189aa6b5b551d9000b6_1656dad2-3084-4ff9-9a20-03f1b02f2fa3 Object is locked skipped
    C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\8aac52eadc98be689bced14428c9c7c1_1656dad2-3084-4ff9-9a20-03f1b02f2fa3 Object is locked skipped
    C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\8b1b300ea745128abad02d827acca46d_1656dad2-3084-4ff9-9a20-03f1b02f2fa3 Object is locked skipped
    C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\8b26ab41b71943d3b907f93c780fa993_1656dad2-3084-4ff9-9a20-03f1b02f2fa3 Object is locked skipped
    C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\8b8dfe1518e32d48e94b25beecd721e5_1656dad2-3084-4ff9-9a20-03f1b02f2fa3 Object is locked skipped
    C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\8d0851d93597780980ac3dba32f935e4_1656dad2-3084-4ff9-9a20-03f1b02f2fa3 Object is locked skipped
    C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\8e0e27948cc3a1bf4d72cf74062e2c42_1656dad2-3084-4ff9-9a20-03f1b02f2fa3 Object is locked skipped
    C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\8f32de9d6b343e2e8e7e3da109bae925_1656dad2-3084-4ff9-9a20-03f1b02f2fa3 Object is locked skipped
    C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\8f4e581c9757b7c90e365ca1e27c879a_1656dad2-3084-4ff9-9a20-03f1b02f2fa3 Object is locked skipped
    C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\9049e72f1d99afad653bc80e41357d27_1656dad2-3084-4ff9-9a20-03f1b02f2fa3 Object is locked skipped
    C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\904f2a6569ae784a4f2e3c66a738a123_1656dad2-3084-4ff9-9a20-03f1b02f2fa3 Object is locked skipped
    C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\907de13529f311370d99a2e0bd781fc4_1656dad2-3084-4ff9-9a20-03f1b02f2fa3 Object is locked skipped
    C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\90d1bdd6b30ae3651718f7f619545d0c_1656dad2-3084-4ff9-9a20-03f1b02f2fa3 Object is locked skipped
    C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\9294d1bfea4293285dae6ba65374cfe3_1656dad2-3084-4ff9-9a20-03f1b02f2fa3 Object is locked skipped
    C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\92e3320d6e8136f0b38500e5c1312a0e_1656dad2-3084-4ff9-9a20-03f1b02f2fa3 Object is locked skipped
    C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\9537c4160c5f074f394f1864ef360f55_1656dad2-3084-4ff9-9a20-03f1b02f2fa3 Object is locked skipped
    C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\955c74523b07beb58e862ad3f79a56a2_1656dad2-3084-4ff9-9a20-03f1b02f2fa3 Object is locked skipped
    C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\95aef84e613743d27f1b543cbc1aa6e9_1656dad2-3084-4ff9-9a20-03f1b02f2fa3 Object is locked skipped
    C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\95d13e1b474c071683070b7e85048493_1656dad2-3084-4ff9-9a20-03f1b02f2fa3 Object is locked skipped
    C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\9649a4ad92efd33a9def299eb9e14173_1656dad2-3084-4ff9-9a20-03f1b02f2fa3 Object is locked skipped
    C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\97a1d9cc13b804935fc8a33715af9cd9_1656dad2-3084-4ff9-9a20-03f1b02f2fa3 Object is locked skipped
    C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\9ca168add48bb5adf1bd6117f945e69b_1656dad2-3084-4ff9-9a20-03f1b02f2fa3 Object is locked skipped
    C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\9cfb1fc7d4cc6d226ffea1d89df5ca9e_1656dad2-3084-4ff9-9a20-03f1b02f2fa3 Object is locked skipped
    C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\9fa441589a8726f6c5ce68b30dcd5f56_1656dad2-3084-4ff9-9a20-03f1b02f2fa3 Object is locked skipped
    C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\a0b904e51b844616cebbca5a4a906f9d_1656dad2-3084-4ff9-9a20-03f1b02f2fa3 Object is locked skipped
    C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\a4c3a742be5992c0e90ad5c227bb41b8_1656dad2-3084-4ff9-9a20-03f1b02f2fa3 Object is locked skipped
    C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\a7204112bfc666ee19c585535a22367d_1656dad2-3084-4ff9-9a20-03f1b02f2fa3 Object is locked skipped
    C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\a7c2afc423adbada4c24e393995cf4c1_1656dad2-3084-4ff9-9a20-03f1b02f2fa3 Object is locked skipped
    C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\a8373352444a973dc86408443f397ccb_1656dad2-3084-4ff9-9a20-03f1b02f2fa3 Object is locked skipped
    C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\a845d92470dd895847afd806c3d7f6e6_1656dad2-3084-4ff9-9a20-03f1b02f2fa3 Object is locked skipped
    C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\aa3e7e356490c7c5e322a52244e3d8e8_1656dad2-3084-4ff9-9a20-03f1b02f2fa3 Object is locked skipped
    C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\aabaf0afe7cf09fcea27224abd972a53_1656dad2-3084-4ff9-9a20-03f1b02f2fa3 Object is locked skipped
    C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\ae7a11d636c3eb72cdd2622dec1c8a1c_1656dad2-3084-4ff9-9a20-03f1b02f2fa3 Object is locked skipped
    C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\af219cb432cd51e3b2b74e69170fee59_1656dad2-3084-4ff9-9a20-03f1b02f2fa3 Object is locked skipped
    C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\b0f60bbdc43605d7a07908df6a446a02_1656dad2-3084-4ff9-9a20-03f1b02f2fa3 Object is locked skipped
    C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\b340578785d96f39a589a3d4b2f52ea5_1656dad2-3084-4ff9-9a20-03f1b02f2fa3 Object is locked skipped
    C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\b3cbd4601030632bde5ec5f6b2028b7e_1656dad2-3084-4ff9-9a20-03f1b02f2fa3 Object is locked skipped
    C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\b418f23e59189e763202295e40b3d418_1656dad2-3084-4ff9-9a20-03f1b02f2fa3 Object is locked skipped
    C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\b51c89eee8ef3f22699b19e660a83917_1656dad2-3084-4ff9-9a20-03f1b02f2fa3 Object is locked skipped
    C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\b5fad386592926288a610f034fd527bb_1656dad2-3084-4ff9-9a20-03f1b02f2fa3 Object is locked skipped
    C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\b6f114c1ef9106c0f8d23811cce2077c_1656dad2-3084-4ff9-9a20-03f1b02f2fa3 Object is locked skipped
    C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\b816aefd494742cf0cff731dc6d0ab74_1656dad2-3084-4ff9-9a20-03f1b02f2fa3 Object is locked skipped
    C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\b908176d17622abdb9f480098f25d7f8_1656dad2-3084-4ff9-9a20-03f1b02f2fa3 Object is locked skipped
    C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\b9895a504ff0ab770520dc63e7678476_1656dad2-3084-4ff9-9a20-03f1b02f2fa3 Object is locked skipped
    C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\ba43e9e5689af3ce4882091872451383_1656dad2-3084-4ff9-9a20-03f1b02f2fa3 Object is locked skipped
    C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\ba691855c14d24a22c0d095abfc2d81b_1656dad2-3084-4ff9-9a20-03f1b02f2fa3 Object is locked skipped
    C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\bb3da194d76fd19f3455418e6ec983fe_1656dad2-3084-4ff9-9a20-03f1b02f2fa3 Object is locked skipped
    C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\bc3a221838d0de0f6529d3045363556b_1656dad2-3084-4ff9-9a20-03f1b02f2fa3 Object is locked skipped
    C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\c1ddf5c0d16693bb0f39d8480b875259_1656dad2-3084-4ff9-9a20-03f1b02f2fa3 Object is locked skipped
    C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\c1e217688aef3c314738bd47c2683878_1656dad2-3084-4ff9-9a20-03f1b02f2fa3 Object is locked skipped
    C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\c2491df7331450c061c808e9ec0c8696_1656dad2-3084-4ff9-9a20-03f1b02f2fa3 Object is locked skipped
    C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\c2f2f13b8992a9461d1a65137417b15c_1656dad2-3084-4ff9-9a20-03f1b02f2fa3 Object is locked skipped
    C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\c3df0c16199385a2193c1cca9b13e579_1656dad2-3084-4ff9-9a20-03f1b02f2fa3 Object is locked skipped
    C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\c86fdcfa362e8e74d5afa93d1e7a5c39_1656dad2-3084-4ff9-9a20-03f1b02f2fa3 Object is locked skipped
    C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\c8c209a900a3134aab89297f8cc4df68_1656dad2-3084-4ff9-9a20-03f1b02f2fa3 Object is locked skipped
    C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\c93f91f969656c84cbfaadbbf2d2ee42_1656dad2-3084-4ff9-9a20-03f1b02f2fa3 Object is locked skipped
    C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\c995e88634e818becc9da9b106dafbb3_1656dad2-3084-4ff9-9a20-03f1b02f2fa3 Object is locked skipped
    C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\ca1a7c3d35b729e3b52dd38be61d703f_1656dad2-3084-4ff9-9a20-03f1b02f2fa3 Object is locked skipped
    C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\caeb7814064779223481e48cca53bfba_1656dad2-3084-4ff9-9a20-03f1b02f2fa3 Object is locked skipped
    C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\cb5454036262fa4c33919aa6fac3ce57_1656dad2-3084-4ff9-9a20-03f1b02f2fa3 Object is locked skipped
    C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\cbfa344f345b0b25dc3d00dae7fcc2c2_1656dad2-3084-4ff9-9a20-03f1b02f2fa3 Object is locked skipped
    C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\cdc246a71abeb860e4972a7205782d26_1656dad2-3084-4ff9-9a20-03f1b02f2fa3 Object is locked skipped
    C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\cfa4e67a937f549bbfed0dba9512c146_1656dad2-3084-4ff9-9a20-03f1b02f2fa3 Object is locked skipped
    C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\d0df7556bfd9e1d463b7f27ba58891f3_1656dad2-3084-4ff9-9a20-03f1b02f2fa3 Object is locked skipped
    C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\d2624fa51358ff306608a5d1c3743dfa_1656dad2-3084-4ff9-9a20-03f1b02f2fa3 Object is locked skipped
    C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\d2a36922132f1f62058a57a64f6c1b4c_1656dad2-3084-4ff9-9a20-03f1b02f2fa3 Object is locked skipped
    C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\d2c6e8d83d96aad5e57d09b9fce65a84_1656dad2-3084-4ff9-9a20-03f1b02f2fa3 Object is locked skipped
    C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\d49cf3a41f78fa522903cee6ff8f2486_1656dad2-3084-4ff9-9a20-03f1b02f2fa3 Object is locked skipped
    C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\d689b0e3f7817999fddd712ac4f2321a_1656dad2-3084-4ff9-9a20-03f1b02f2fa3 Object is locked skipped
    C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\d7c33ecc00c0a4bf22eeb8edd9f810ca_1656dad2-3084-4ff9-9a20-03f1b02f2fa3 Object is locked skipped
    C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\d882da0803bae5acb1a3a18c712b73c2_1656dad2-3084-4ff9-9a20-03f1b02f2fa3 Object is locked skipped
    C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\da993345b94c9c98312335379a1b9c32_1656dad2-3084-4ff9-9a20-03f1b02f2fa3 Object is locked skipped
    C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\daf4843a3b714d7884174dc53fb4ecf1_1656dad2-3084-4ff9-9a20-03f1b02f2fa3 Object is locked skipped
    C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\df245f4bc1acfec7f06ebb56615e116e_1656dad2-3084-4ff9-9a20-03f1b02f2fa3 Object is locked skipped
    C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\df28ca0ea6a8249db11443823f99600b_1656dad2-3084-4ff9-9a20-03f1b02f2fa3 Object is locked skipped
    C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\e07d5031b8a70e1d56f874530940abba_1656dad2-3084-4ff9-9a20-03f1b02f2fa3 Object is locked skipped
    C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\e17ab8a8496bbaa5668f2b58126ee750_1656dad2-3084-4ff9-9a20-03f1b02f2fa3 Object is locked skipped
    C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\e1dd5624a22452c4694d6574f06ee363_1656dad2-3084-4ff9-9a20-03f1b02f2fa3 Object is locked skipped
    C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\e33b18fcde650977ddda3c3bb520e7a7_1656dad2-3084-4ff9-9a20-03f1b02f2fa3 Object is locked skipped
    C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\e42d5afec0adc8532783c04caec18f66_1656dad2-3084-4ff9-9a20-03f1b02f2fa3 Object is locked skipped
    C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\e42fe1e4da577c7875d799312540da35_1656dad2-3084-4ff9-9a20-03f1b02f2fa3 Object is locked skipped
    C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\e79bb14c2292a89cde2557c5e44e3192_1656dad2-3084-4ff9-9a20-03f1b02f2fa3 Object is locked skipped
    C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\e7ad12e9f8244b0bfa9a3c49ae568d89_1656dad2-3084-4ff9-9a20-03f1b02f2fa3 Object is locked skipped
    C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\e8d04245be3b1fc50803a54e99f01afd_1656dad2-3084-4ff9-9a20-03f1b02f2fa3 Object is locked skipped
    C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\ea4c1a07b0f5ecb65b0828a43d1bcfce_1656dad2-3084-4ff9-9a20-03f1b02f2fa3 Object is locked skipped
    C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\eb6eabf569a15602b448e606dd682bc3_1656dad2-3084-4ff9-9a20-03f1b02f2fa3 Object is locked skipped
    C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\ebf10539565a898655e55f1d430db7e2_1656dad2-3084-4ff9-9a20-03f1b02f2fa3 Object is locked skipped
    C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\ec228ddd99d0448cb3490556257251e6_1656dad2-3084-4ff9-9a20-03f1b02f2fa3 Object is locked skipped
    C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\ecfd84992f9da25a591729be24ebfe1c_1656dad2-3084-4ff9-9a20-03f1b02f2fa3 Object is locked skipped
    C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\eded7fbcf58076a0b9089e631875759b_1656dad2-3084-4ff9-9a20-03f1b02f2fa3 Object is locked skipped
    C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\ee7fbf8fa08cf5186af1adfc36b6770f_1656dad2-3084-4ff9-9a20-03f1b02f2fa3 Object is locked skipped
    C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\efc29764668cf7c785e2dc7208393480_1656dad2-3084-4ff9-9a20-03f1b02f2fa3 Object is locked skipped
    C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\f05a8deb9dae4b0ce89739825b195adb_1656dad2-3084-4ff9-9a20-03f1b02f2fa3 Object is locked skipped
    C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\f0b856495ad9a8f01f3bf7de62f788c4_1656dad2-3084-4ff9-9a20-03f1b02f2fa3 Object is locked skipped
    C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\f0f57f78df7053c46f0a25ce97d2ef2b_1656dad2-3084-4ff9-9a20-03f1b02f2fa3 Object is locked skipped
    C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\f249ab340f1926d498a27df03254d534_1656dad2-3084-4ff9-9a20-03f1b02f2fa3 Object is locked skipped
    C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\f5343eb60d7b9869fe8fd367f2cab8b3_1656dad2-3084-4ff9-9a20-03f1b02f2fa3 Object is locked skipped
    C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\f78cc995724f8ac2cd0ea5bc1ffa38da_1656dad2-3084-4ff9-9a20-03f1b02f2fa3 Object is locked skipped
    C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\fafed71339ce6a658e612eba13c4adbd_1656dad2-3084-4ff9-9a20-03f1b02f2fa3 Object is locked skipped
    C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\fb4fff406f5e4aa8c5c3bd1fbc207a9e_1656dad2-3084-4ff9-9a20-03f1b02f2fa3 Object is locked skipped
    C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\fd1382db5d6996d1511418b4f04a4ce2_1656dad2-3084-4ff9-9a20-03f1b02f2fa3 Object is locked skipped
    C:\Documents and Settings\No name \Application Data\Mozilla\Firefox\Profiles\e5b0s7xu.default\cert8.db Object is locked skipped
    C:\Documents and Settings\No name \Application Data\Mozilla\Firefox\Profiles\e5b0s7xu.default\formhistory.dat Object is locked skipped
    C:\Documents and Settings\No name \Application Data\Mozilla\Firefox\Profiles\e5b0s7xu.default\history.dat Object is locked skipped
    C:\Documents and Settings\No name \Application Data\Mozilla\Firefox\Profiles\e5b0s7xu.default\key3.db Object is locked skipped
    C:\Documents and Settings\No name \Application Data\Mozilla\Firefox\Profiles\e5b0s7xu.default\parent.lock Object is locked skipped
    C:\Documents and Settings\No name \Application Data\Mozilla\Firefox\Profiles\e5b0s7xu.default\search.sqlite Object is locked skipped
    C:\Documents and Settings\No name \Application Data\Mozilla\Firefox\Profiles\e5b0s7xu.default\urlclassifier2.sqlite Object is locked skipped
    C:\Documents and Settings\No name \Cookies\index.dat Object is locked skipped
    C:\Documents and Settings\No name \Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped
    C:\Documents and Settings\No name \Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped
    C:\Documents and Settings\No name \Local Settings\Application Data\Mozilla\Firefox\Profiles\e5b0s7xu.default\Cache\_CACHE_001_ Object is locked skipped
    C:\Documents and Settings\No name \Local Settings\Application Data\Mozilla\Firefox\Profiles\e5b0s7xu.default\Cache\_CACHE_002_ Object is locked skipped
    C:\Documents and Settings\No name \Local Settings\Application Data\Mozilla\Firefox\Profiles\e5b0s7xu.default\Cache\_CACHE_003_ Object is locked skipped
    C:\Documents and Settings\No name \Local Settings\Application Data\Mozilla\Firefox\Profiles\e5b0s7xu.default\Cache\_CACHE_MAP_ Object is locked skipped
    C:\Documents and Settings\No name \Local Settings\Sivuhistoria\History.IE5\index.dat Object is locked skipped
    C:\Documents and Settings\No name \Local Settings\Temporary Internet Files\AntiPhishing\B3BB5BBA-E7D5-40AB-A041-A5B1C0B26C8F.dat Object is locked skipped
    C:\Documents and Settings\No name \Local Settings\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped
    C:\Documents and Settings\No name \NTUSER.DAT Object is locked skipped
    C:\Documents and Settings\No name \ntuser.dat.LOG Object is locked skipped
    C:\Documents and Settings\LocalService\Cookies\index.dat Object is locked skipped
    C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped
    C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped
    C:\Documents and Settings\LocalService\Local Settings\Sivuhistoria\History.IE5\index.dat Object is locked skipped
    C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped
    C:\Documents and Settings\LocalService\NTUSER.DAT Object is locked skipped
    C:\Documents and Settings\LocalService\ntuser.dat.LOG Object is locked skipped
    C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped
    C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped
    C:\Documents and Settings\NetworkService\NTUSER.DAT Object is locked skipped
    C:\Documents and Settings\NetworkService\ntuser.dat.LOG Object is locked skipped
    C:\Program Files\F-Secure\Anti-Virus\dbupdate.log Object is locked skipped
    C:\Program Files\F-Secure\Anti-Virus\deleteme_msg.log Object is locked skipped
    C:\Program Files\F-Secure\Anti-Virus\fsqh.exe.Qrt.log Object is locked skipped
    C:\Program Files\F-Secure\Anti-Virus\perf.dat Object is locked skipped
    C:\Program Files\F-Secure\Anti-Virus\power.dat Object is locked skipped
    C:\Program Files\F-Secure\Common\policy.bpf Object is locked skipped
    C:\Program Files\F-Secure\Common\policy.ipf Object is locked skipped
    C:\Program Files\F-Secure\FSAUA\fsbwupst.log Object is locked skipped
    C:\Program Files\F-Secure\FSAUA\program\fsaua.dbg Object is locked skipped
    C:\Program Files\F-Secure\FSAUA\program\fsaua.log Object is locked skipped
    C:\Program Files\F-Secure\Spam Control\log\fs_sa_log.txt Object is locked skipped
    C:\System Volume Information\MountPointManagerRemoteDatabase Object is locked skipped
    C:\System Volume Information\_restore{B8963C60-0E31-461A-9B36-84FB536FC5CA}\RP208\change.log Object is locked skipped
    C:\WINDOWS\Debug\PASSWD.LOG Object is locked skipped
    C:\WINDOWS\SchedLgU.Txt Object is locked skipped
    C:\WINDOWS\SoftwareDistribution\ReportingEvents.log Object is locked skipped
    C:\WINDOWS\Sti_Trace.log Object is locked skipped
    C:\WINDOWS\system32\CatRoot2\edb.log Object is locked skipped
    C:\WINDOWS\system32\CatRoot2\tmp.edb Object is locked skipped
    C:\WINDOWS\system32\config\AppEvent.Evt Object is locked skipped
    C:\WINDOWS\system32\config\default Object is locked skipped
    C:\WINDOWS\system32\config\default.LOG Object is locked skipped
    C:\WINDOWS\system32\config\Internet.evt Object is locked skipped
    C:\WINDOWS\system32\config\SAM Object is locked skipped
    C:\WINDOWS\system32\config\SAM.LOG Object is locked skipped
    C:\WINDOWS\system32\config\SecEvent.Evt Object is locked skipped
    C:\WINDOWS\system32\config\SECURITY Object is locked skipped
    C:\WINDOWS\system32\config\SECURITY.LOG Object is locked skipped
    C:\WINDOWS\system32\config\software Object is locked skipped
    C:\WINDOWS\system32\config\software.LOG Object is locked skipped
    C:\WINDOWS\system32\config\SysEvent.Evt Object is locked skipped
    C:\WINDOWS\system32\config\system Object is locked skipped
    C:\WINDOWS\system32\config\system.LOG Object is locked skipped
    C:\WINDOWS\system32\drivers\sptd.sys Object is locked skipped
    C:\WINDOWS\system32\h323log.txt Object is locked skipped
    C:\WINDOWS\system32\wbem\Repository\FS\INDEX.BTR Object is locked skipped
    C:\WINDOWS\system32\wbem\Repository\FS\INDEX.MAP Object is locked skipped
    C:\WINDOWS\system32\wbem\Repository\FS\MAPPING.VER Object is locked skipped
    C:\WINDOWS\system32\wbem\Repository\FS\MAPPING1.MAP Object is locked skipped
    C:\WINDOWS\system32\wbem\Repository\FS\MAPPING2.MAP Object is locked skipped
    C:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.DATA Object is locked skipped
    C:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.MAP Object is locked skipped
    C:\WINDOWS\Temp\AVP14EE.tmp Object is locked skipped
    C:\WINDOWS\Temp\AVP14EF.tmp Object is locked skipped
    C:\WINDOWS\Temp\AVP14F2.tmp Object is locked skipped
    C:\WINDOWS\Temp\AVP14F3.tmp Object is locked skipped
    C:\WINDOWS\wiadebug.log Object is locked skipped
    C:\WINDOWS\wiaservc.log Object is locked skipped
    C:\WINDOWS\WindowsUpdate.log Object is locked skipped
    I:\System Volume Information\MountPointManagerRemoteDatabase Object is locked skipped
    Scan process completed.

    ------------------------------------------------------------------------

    HJT loki:

    Logfile of HijackThis v1.99.1
    Scan saved at 20:24:57, on 24.8.2007
    Platform: Windows XP SP2 (WinNT 5.01.2600)
    MSIE: Internet Explorer v7.00 (7.00.6000.16512)

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\Program Files\DigitalPersona\Bin\DPWinLct.exe
    C:\WINDOWS\system32\spoolsv.exe
    C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
    C:\Program Files\DigitalPersona\Bin\DpHost.exe
    C:\Program Files\F-Secure\Anti-Virus\fsgk32st.exe
    C:\Program Files\F-Secure\Common\FSMA32.EXE
    C:\Program Files\F-Secure\Anti-Virus\FSGK32.EXE
    C:\WINDOWS\system32\nvsvc32.exe
    C:\Program Files\F-Secure\Common\FSMB32.EXE
    C:\WINDOWS\system32\svchost.exe
    C:\Program Files\F-Secure\Common\FCH32.EXE
    C:\Program Files\DigitalPersona\Bin\DPFUSMgr.exe
    C:\Program Files\F-Secure\Anti-Virus\fsqh.exe
    C:\Program Files\F-Secure\Common\FAMEH32.EXE
    C:\Program Files\F-Secure\FSAUA\program\fsaua.exe
    C:\Program Files\F-Secure\Anti-Virus\fssm32.exe
    C:\Program Files\F-Secure\FWES\Program\fsdfwd.exe
    C:\Program Files\F-Secure\FSAUA\program\fsus.exe
    C:\WINDOWS\Explorer.EXE
    C:\Program Files\F-Secure\Anti-Virus\fsav32.exe
    C:\Program Files\Analog Devices\Core\smax4pnp.exe
    C:\Program Files\Analog Devices\SoundMAX\Smax4.exe
    C:\WINDOWS\system32\RUNDLL32.EXE
    C:\Program Files\F-Secure\Common\FSM32.EXE
    C:\Program Files\F-Secure\FSGUI\fsguidll.exe
    C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe
    C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe
    C:\WINDOWS\system32\ctfmon.exe
    C:\Program Files\Mozilla Firefox\firefox.exe
    C:\Uusi kansio\scanner.exe.exe

    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.ess.fi/
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
    R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://windowsupdate.microsoft.com/
    R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Linkit
    O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
    O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
    O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
    O2 - BHO: AcroIEToolbarHelper Class - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll
    O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll
    O4 - HKLM\..\Run: [SoundMAXPnP] C:\Program Files\Analog Devices\Core\smax4pnp.exe
    O4 - HKLM\..\Run: [SoundMAX] "C:\Program Files\Analog Devices\SoundMAX\Smax4.exe" /tray
    O4 - HKLM\..\Run: [JMB36X Configure] C:\WINDOWS\system32\JMRaidTool.exe boot
    O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
    O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
    O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
    O4 - HKLM\..\Run: [F-Secure Manager] "C:\Program Files\F-Secure\Common\FSM32.EXE" /splash
    O4 - HKLM\..\Run: [F-Secure TNB] "C:\Program Files\F-Secure\FSGUI\TNBUtil.exe" /CHECKALL /WAITFORSW
    O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
    O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe"
    O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
    O8 - Extra context menu item: Convert link target to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
    O8 - Extra context menu item: Convert link target to existing PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
    O8 - Extra context menu item: Convert selected links to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
    O8 - Extra context menu item: Convert selected links to existing PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
    O8 - Extra context menu item: Convert selection to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
    O8 - Extra context menu item: Convert selection to existing PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
    O8 - Extra context menu item: Convert to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
    O8 - Extra context menu item: Convert to existing PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
    O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
    O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
    O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
    O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)
    O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)
    O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
    O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
    O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O10 - Unknown file in Winsock LSP: c:\program files\f-secure\fsps\program\fslsp.dll
    O10 - Unknown file in Winsock LSP: c:\program files\f-secure\fsps\program\fslsp.dll
    O10 - Unknown file in Winsock LSP: c:\program files\f-secure\fsps\program\fslsp.dll
    O10 - Unknown file in Winsock LSP: c:\program files\f-secure\fsps\program\fslsp.dll
    O10 - Unknown file in Winsock LSP: c:\program files\f-secure\fsps\program\fslsp.dll
    O10 - Unknown file in Winsock LSP: c:\program files\f-secure\fsps\program\fslsp.dll
    O10 - Unknown file in Winsock LSP: c:\program files\f-secure\fsps\program\fslsp.dll
    O10 - Unknown file in Winsock LSP: c:\program files\f-secure\fsps\program\fslsp.dll
    O10 - Unknown file in Winsock LSP: c:\program files\f-secure\fsps\program\fslsp.dll
    O10 - Unknown file in Winsock LSP: c:\program files\f-secure\fsps\program\fslsp.dll
    O10 - Unknown file in Winsock LSP: c:\program files\f-secure\fsps\program\fslsp.dll
    O10 - Unknown file in Winsock LSP: c:\program files\f-secure\fsps\program\fslsp.dll
    O11 - Options group: [INTERNATIONAL] International*
    O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/kos/english/kavwebscan_unicode.cab
    O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://download.bitdefender.com/resources/scan8/oscan8.cab
    O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1167994320218
    O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
    O20 - Winlogon Notify: DPWLN - C:\WINDOWS\system32\DPWLEvHd.dll
    O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\
    O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
    O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
    O23 - Service: Windows XP FUS Manager (DPFUSMgr) - DigitalPersona, Inc. - C:\Program Files\DigitalPersona\Bin\DPFUSMgr.exe
    O23 - Service: Biometric Authentication Service (DpHost) - DigitalPersona, Inc. - C:\Program Files\DigitalPersona\Bin\DpHost.exe
    O23 - Service: FSGKHS (F-Secure Gatekeeper Handler Starter) - F-Secure Corporation - C:\Program Files\F-Secure\Anti-Virus\fsgk32st.exe
    O23 - Service: F-Secure Automatic Update Agent (FSAUA) - F-Secure Corporation - C:\Program Files\F-Secure\FSAUA\program\fsaua.exe
    O23 - Service: F-Secure Anti-Virus Firewall Daemon (FSDFWD) - F-Secure Corporation - C:\Program Files\F-Secure\FWES\Program\fsdfwd.exe
    O23 - Service: F-Secure Management Agent (FSMA) - F-Secure Corporation - C:\Program Files\F-Secure\Common\FSMA32.EXE
    O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
    O23 - Service: PCLEPCI - Pinnacle Systems GmbH - C:\WINDOWS\system32\drivers\pclepci.sys
    O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
    O23 - Service: ServiceLayer - Nokia. - C:\Program Files\PC Connectivity Solution\ServiceLayer.exe
     
  15. yamaneko

    yamaneko Senior member

    Liittynyt:
    22.09.2005
    Viestejä:
    5,093
    Kiitokset:
    1
    Pisteet:
    118
    Hujo tarkoitti että, käynnistä Hijackthis ja valitse Do a system scan only
    Valitse seuraava rivi:

    O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\

    Valitse lopuksi Fix checked

    Nyt kun olet puhdas, seuraavaksi pari vinkkiä kuinka pienennetään saastumisriskiä. Kaikista on saatavilla joko suomenkielinen versio sekä/tai suomenkielinen opas.

    -> Taistele vastaan!!-> Malware Complaints
    Sivusto antaa haittaohjelmien uhreille mahdollisuuden kertoa tarinansa ja tehdä valituksen asiasta. Taistellaan yhdessä haittaohjelmien tekijöitä vastaan!

    -> Tyhjennä järjestelmänpalautus -> Ohjeet
    Tyhjennä järjestelmänpalautuskansio ja luo uusi palautuspiste. Tämä puhdistaa palautuskansion mahdollisista haittaohjelmajäännöksistä.

    -> Käytä CCleaneria -> CCleaner
    Lataa ja asenna CCleaner. Puhdista väliaikaistiedostot ja -kansiot ohjelmalla säännöllisesti.

    -> Käytä Ad-Awarea -> Ad-Aware
    Lataa ja asenna Ad-Aware. Päivitä se ja skannaa konettasi sillä säännöllisesti.
    Opas saatavilla suomeksi! Nimimerkki Ad-Awaren opas

    -> Käytä AVG Anti-Spywarea -> AVG Anti-Spyware
    Lataa ja asenna AVG Anti-Spyware. Päivitä se ja skannaa konettasi sillä säännöllisesti
    Opas saatavilla suomeksi! (Ewido ulkoasulla) Nimimerkki Axelin opas

    -> Asenna SpywareBlaster -> SpywareBlaster
    SpywareBlaster estää haittaohjelmia asentumasta koneellesi. Ei kuluta muistia!
    Opas saatavilla suomeksi! Nimimerkki Ad-Awaren opas

    -> Asenna MVPS Hosts tiedosto -> MVPS Hosts
    Estää koneesi yhteyden haitallisiin sivustoihin.
    Opas saatavilla suomeksi! Nimimerkki Axelin opas

    -> Vaihda selaimesi Firefoxiin -> Firefox
    Firefox on nopeampi, turvallisempi ja parempi selain kuin Internet Explorer.

    -> Pidä järjestelmäsi ajantasalla. -> Windows Update
    Vieraile Windows Updatessa säännöllisesti.

    -> Pidä palomuuri ja virustorjunta ajantasalla
    Päivitä ja skannaa koneesi säännöllisesti virustorjuntaohjelmallasi.

    Pysy puhtaana ;)
     
    Viimeksi muokattu: 24.08.2007
  16. bouncher

    bouncher Member

    Liittynyt:
    30.08.2005
    Viestejä:
    78
    Kiitokset:
    0
    Pisteet:
    16
    Kiitos suuresti yamaneko!! Kahvit olen velkaa.. jotenkin..jossain!!
     

Jaa tämä sivu