kone hidastunut, sammuilee, palomuuri käynnistettävä aina uudelleen...

elikkäs sammuu 20-60sekunnin päästä kun työpöytä on valmistunut ja tekee aina saman kolme kertaa ja sitten wörkkii, ja palomuuri ei käynnisty automaattisesti vaikka se on laitettu aukeamaan kylläkään tällä hetkellä ei ole kun windowsin oma palomuuri ku f-securen tiedostot on korruptoituneita ja vaikka mitä muuta paskaa esiintyy koneessa on jo kolmas kerta vuoden sisällä kun uudelleen joutunut ajamaan koko p***an

ettäs aattelin kokeilla jos tästä olis apuu...

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 16:59:21, on 11.2.2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\Analog Devices\SoundMAX\SMax4PNP.exe
C:\Program Files\Analog Devices\SoundMAX\smax4.exe
C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\MSN Messenger\MsnMsgr.Exe
C:\Program Files\DNA\btdna.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\TGTSoft\StyleXP\StyleXP.exe
C:\Program Files\DAEMON Tools\daemon.exe
C:\WINDOWS\system32\tcpsvcs.exe
C:\WINDOWS\System32\snmp.exe
C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\dllhost.exe
C:\WINDOWS\system32\dllhost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\MSN Messenger\usnsvc.exe
H:\Program Files\Bit Torrent\BitTorrent\bittorrent.exe
C:\WINDOWS\system32\NOTEPAD.EXE
C:\WINDOWS\system32\NOTEPAD.EXE
D:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Linkit
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: TGTSoft Explorer Toolbar Changer - {C333CF63-767F-4831-94AC-E683D962C63C} - C:\Program Files\TGTSoft\StyleXP\TGT_BHO.dll
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [PRONoMgr.exe] C:\Program Files\Intel\NCS\PROSet\PRONoMgr.exe
O4 - HKLM\..\Run: [Ptipbmf] rundll32.exe ptipbmf.dll,SetWriteCacheMode
O4 - HKLM\..\Run: [F-Secure Manager] "e:\program files\Common\FSM32.EXE" /splash
O4 - HKLM\..\Run: [iTunesHelper] "H:\i Tunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [SoundMAXPnP] C:\Program Files\Analog Devices\SoundMAX\SMax4PNP.exe
O4 - HKLM\..\Run: [SoundMAX] "C:\Program Files\Analog Devices\SoundMAX\smax4.exe" /tray
O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O4 - HKLM\..\Run: [NBKeyScan] "C:\Program Files\Nero\Nero8\Nero BackItUp\NBKeyScan.exe"
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [BitTorrent DNA] "C:\Program Files\DNA\btdna.exe"
O4 - HKCU\..\Run: [drvsyskit] C:\WINDOWS\system32\drivers\hldrrr.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [STYLEXP] C:\Program Files\TGTSoft\StyleXP\StyleXP.exe -Hide
O4 - HKCU\..\Run: [DAEMON Tools] "C:\Program Files\DAEMON Tools\daemon.exe" -lang 1033
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Paikallinen palve')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Verkkopalve')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://www.update.microsoft.com/mic...ls/en/x86/client/muweb_site.cab?1202406414718
O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: F-Secure BackWeb LAN Access - Unknown owner - e:\program files\BackWeb\7681197\Program\fsbwlan.exe
O23 - Service: F-Secure Network Request Broker - F-Secure Corporation - e:\program files\Common\FNRB32.EXE
O23 - Service: F-Secure Authentication Agent (FSAA) - F-Secure Corporation. All Rights Reserved. - e:\program files\Common\FSAA.EXE
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPod-palvelu (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Intel NCS NetService (NetSvc) - Intel(R) Corporation - C:\Program Files\Intel\NCS\Sync\NetSvc.exe
O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe

kiitos jo etukäteen...

 

Escan
Ohjeet tuolla sivulla.
http://koti.mbnet.fi/pattaya1/escanmwav.htm
lataa tuosta
http://www.spywareinfo.dk/download/mwav.exe
päivitä tuosta
http://koti.mbnet.fi/pattaya1/lataus/Mwav.bat
laita täpit merkkauksien mukaan
http://koti.mbnet.fi/pattaya1/eScan6.jpg

scannaa

jos ala luukkuun tulee jotain niin kopioi se näin:
Käytä komentoa Ctrl+A.
Kopioi rivit komennolla Ctrl+C.
Liitä rivit komennolla Ctrl+V.

Laita virus log tänne.

 

juu tulihan tota tekstiä vähän nolottaa kyl näyttää miten paljon..


File C:\Documents and Settings\Kone\Local Settings\Temp\ErrorSafeScannerSetup.exe tagged as not-a-virusownloader.Win32.WinFixer.t. No Action Taken.
File C:\Documents and Settings\NiCoReTTe\Application Data\m\shared\-.Symantec.Norton.Internet.Security.2006.Multilanguage.-.Crak.zip infected by "Trojan-Downloader.Win32.Bagle.jp" Virus. Action Taken: File Deleted.
File C:\Documents and Settings\NiCoReTTe\Application Data\m\shared\15 Slide Puzzle 1.5.zip infected by "Trojan-Downloader.Win32.Bagle.jp" Virus. Action Taken: File Deleted.
File C:\Documents and Settings\NiCoReTTe\Application Data\m\shared\1DNest 3.3.zip infected by "Trojan-Downloader.Win32.Bagle.jp" Virus. Action Taken: File Deleted.
File C:\Documents and Settings\NiCoReTTe\Application Data\m\shared\1st Screen Lock 7.3 Key.zip infected by "Trojan-Downloader.Win32.Bagle.jp" Virus. Action Taken: File Deleted.
File C:\Documents and Settings\NiCoReTTe\Application Data\m\shared\3D Earth ScreenSaver 2.zip infected by "Trojan-Downloader.Win32.Bagle.jp" Virus. Action Taken: File Deleted.
File C:\Documents and Settings\NiCoReTTe\Application Data\m\shared\3D Motion ScreenSaver 1.zip infected by "Trojan-Downloader.Win32.Bagle.jp" Virus. Action Taken: File Deleted.
File C:\Documents and Settings\NiCoReTTe\Application Data\m\shared\642-691 Practice Exam Testing Engine Software 1.0.zip infected by "Trojan-Downloader.Win32.Bagle.jp" Virus. Action Taken: File Deleted.
File C:\Documents and Settings\NiCoReTTe\Application Data\m\shared\A-Lex Enligsh Dictionary 1.65.zip infected by "Trojan-Downloader.Win32.Bagle.jp" Virus. Action Taken: File Deleted.
File C:\Documents and Settings\NiCoReTTe\Application Data\m\shared\ABCWebWizard Website Design Software 1.0.zip infected by "Trojan-Downloader.Win32.Bagle.jp" Virus. Action Taken: File Deleted.
File C:\Documents and Settings\NiCoReTTe\Application Data\m\shared\ABF Favorite Folders 1.31 [Crack].zip infected by "Trojan-Downloader.Win32.Bagle.jp" Virus. Action Taken: File Deleted.
File C:\Documents and Settings\NiCoReTTe\Application Data\m\shared\Access Data Transfer Assistant 2000 3.zip infected by "Trojan-Downloader.Win32.Bagle.jp" Virus. Action Taken: File Deleted.
File C:\Documents and Settings\NiCoReTTe\Application Data\m\shared\Account Pro 8.3.120.zip infected by "Trojan-Downloader.Win32.Bagle.jp" Virus. Action Taken: File Deleted.
File C:\Documents and Settings\NiCoReTTe\Application Data\m\shared\Active Keyboard 3.11.zip infected by "Trojan-Downloader.Win32.Bagle.jp" Virus. Action Taken: File Deleted.
File C:\Documents and Settings\NiCoReTTe\Application Data\m\shared\ActualDoc Professional 3.5.zip infected by "Trojan-Downloader.Win32.Bagle.jp" Virus. Action Taken: File Deleted.
File C:\Documents and Settings\NiCoReTTe\Application Data\m\shared\Adobe Acrobat Professional and Standard Update 7.0.3.zip infected by "Trojan-Downloader.Win32.Bagle.jp" Virus. Action Taken: File Deleted.
File C:\Documents and Settings\NiCoReTTe\Application Data\m\shared\Advanced HTTP Request Automaton 1.1.zip infected by "Trojan-Downloader.Win32.Bagle.jp" Virus. Action Taken: File Deleted.
File C:\Documents and Settings\NiCoReTTe\Application Data\m\shared\Adware Killer 6.0.3 (KeyGen).zip infected by "Trojan-Downloader.Win32.Bagle.jp" Virus. Action Taken: File Deleted.
File C:\Documents and Settings\NiCoReTTe\Application Data\m\shared\AGIS Mapping 1.72.zip infected by "Trojan-Downloader.Win32.Bagle.jp" Virus. Action Taken: File Deleted.
File C:\Documents and Settings\NiCoReTTe\Application Data\m\shared\Aimersoft DVD to WMV Converter 1.0.21 [Key+Serial].zip infected by "Trojan-Downloader.Win32.Bagle.jp" Virus. Action Taken: File Deleted.
File C:\Documents and Settings\NiCoReTTe\Application Data\m\shared\AllSubmitter 2.6.zip infected by "Trojan-Downloader.Win32.Bagle.jp" Virus. Action Taken: File Deleted.
File C:\Documents and Settings\NiCoReTTe\Application Data\m\shared\Amor WMV to AVI MPEG VCD DVD Converter 2.3.9 (With Crack).zip infected by "Trojan-Downloader.Win32.Bagle.jp" Virus. Action Taken: File Deleted.
File C:\Documents and Settings\NiCoReTTe\Application Data\m\shared\AmphiSoft Photo Detailer 1.1.zip infected by "Trojan-Downloader.Win32.Bagle.jp" Virus. Action Taken: File Deleted.
File C:\Documents and Settings\NiCoReTTe\Application Data\m\shared\Arelis 4.1.zip infected by "Trojan-Downloader.Win32.Bagle.jp" Virus. Action Taken: File Deleted.
File C:\Documents and Settings\NiCoReTTe\Application Data\m\shared\AsciiDataset 2004.3.zip infected by "Trojan-Downloader.Win32.Bagle.jp" Virus. Action Taken: File Deleted.
File C:\Documents and Settings\NiCoReTTe\Application Data\m\shared\Ashampoo ClipFisher 1.01 [Key+Serial].zip infected by "Trojan-Downloader.Win32.Bagle.jp" Virus. Action Taken: File Deleted.
File C:\Documents and Settings\NiCoReTTe\Application Data\m\shared\Auction Data Retriever 1.5.zip infected by "Trojan-Downloader.Win32.Bagle.jp" Virus. Action Taken: File Deleted.
File C:\Documents and Settings\NiCoReTTe\Application Data\m\shared\Avarzia Future Download Manager 1.zip infected by "Trojan-Downloader.Win32.Bagle.jp" Virus. Action Taken: File Deleted.
File C:\Documents and Settings\NiCoReTTe\Application Data\m\shared\AZZ Cardfile 4.0 Beta c KeyGen.zip infected by "Trojan-Downloader.Win32.Bagle.jp" Virus. Action Taken: File Deleted.
File C:\Documents and Settings\NiCoReTTe\Application Data\m\shared\Baby FTP Server 1.24.zip infected by "Trojan-Downloader.Win32.Bagle.jp" Virus. Action Taken: File Deleted.
File C:\Documents and Settings\NiCoReTTe\Application Data\m\shared\Babya Presenter Standard 3.0.zip infected by "Trojan-Downloader.Win32.Bagle.jp" Virus. Action Taken: File Deleted.
File C:\Documents and Settings\NiCoReTTe\Application Data\m\shared\Baseball Scoreboard 1.0.zip infected by "Trojan-Downloader.Win32.Bagle.jp" Virus. Action Taken: File Deleted.
File C:\Documents and Settings\NiCoReTTe\Application Data\m\shared\Battlefield 1942 - Benghazi map.zip infected by "Trojan-Downloader.Win32.Bagle.jp" Virus. Action Taken: File Deleted.
File C:\Documents and Settings\NiCoReTTe\Application Data\m\shared\BirdWatch 1.zip infected by "Trojan-Downloader.Win32.Bagle.jp" Virus. Action Taken: File Deleted.
File C:\Documents and Settings\NiCoReTTe\Application Data\m\shared\Brilliant Database SDK 5.1 RC1 (KeyGen).zip infected by "Trojan-Downloader.Win32.Bagle.jp" Virus. Action Taken: File Deleted.
File C:\Documents and Settings\NiCoReTTe\Application Data\m\shared\Budget Calculator 1.0.zip infected by "Trojan-Downloader.Win32.Bagle.jp" Virus. Action Taken: File Deleted.
File C:\Documents and Settings\NiCoReTTe\Application Data\m\shared\BusRunner 1.1.zip infected by "Trojan-Downloader.Win32.Bagle.jp" Virus. Action Taken: File Deleted.
File C:\Documents and Settings\NiCoReTTe\Application Data\m\shared\Buzzsaw On-The-Fly Defragmenter 1.zip infected by "Trojan-Downloader.Win32.Bagle.jp" Virus. Action Taken: File Deleted.
File C:\Documents and Settings\NiCoReTTe\Application Data\m\shared\CacheBoost Professional Edition 4.00.zip infected by "Trojan-Downloader.Win32.Bagle.jp" Virus. Action Taken: File Deleted.
File C:\Documents and Settings\NiCoReTTe\Application Data\m\shared\Carl the Caveman Christmas Adventures 1.1.zip infected by "Trojan-Downloader.Win32.Bagle.jp" Virus. Action Taken: File Deleted.
File C:\Documents and Settings\NiCoReTTe\Application Data\m\shared\CD ROM Drive Remote Disabler 2.zip infected by "Trojan-Downloader.Win32.Bagle.jp" Virus. Action Taken: File Deleted.
File C:\Documents and Settings\NiCoReTTe\Application Data\m\shared\Chicken 1.0.zip infected by "Trojan-Downloader.Win32.Bagle.jp" Virus. Action Taken: File Deleted.
File C:\Documents and Settings\NiCoReTTe\Application Data\m\shared\ColorPop 1.0 Key.zip infected by "Trojan-Downloader.Win32.Bagle.jp" Virus. Action Taken: File Deleted.
File C:\Documents and Settings\NiCoReTTe\Application Data\m\shared\ColorSafe 1.5.zip infected by "Trojan-Downloader.Win32.Bagle.jp" Virus. Action Taken: File Deleted.
File C:\Documents and Settings\NiCoReTTe\Application Data\m\shared\ConfigInspector 1.zip infected by "Trojan-Downloader.Win32.Bagle.jp" Virus. Action Taken: File Deleted.
File C:\Documents and Settings\NiCoReTTe\Application Data\m\shared\Convert BMP to JPG 3.60.zip infected by "Trojan-Downloader.Win32.Bagle.jp" Virus. Action Taken: File Deleted.
File C:\Documents and Settings\NiCoReTTe\Application Data\m\shared\Cosmic Voyage 3.5 KeyGen.zip infected by "Trojan-Downloader.Win32.Bagle.jp" Virus. Action Taken: File Deleted.
File C:\Documents and Settings\NiCoReTTe\Application Data\m\shared\CS-Cart shopping cart software 1.3.4.zip infected by "Trojan-Downloader.Win32.Bagle.jp" Virus. Action Taken: File Deleted.
File C:\Documents and Settings\NiCoReTTe\Application Data\m\shared\CSockSrvr Class 1.0.2.4.zip infected by "Trojan-Downloader.Win32.Bagle.jp" Virus. Action Taken: File Deleted.
File C:\Documents and Settings\NiCoReTTe\Application Data\m\shared\CT Cookie Spy 1.zip infected by "Trojan-Downloader.Win32.Bagle.jp" Virus. Action Taken: File Deleted.
File C:\Documents and Settings\NiCoReTTe\Application Data\m\shared\Data Tracker for Baseball 1.0.zip infected by "Trojan-Downloader.Win32.Bagle.jp" Virus. Action Taken: File Deleted.
File C:\Documents and Settings\NiCoReTTe\Application Data\m\shared\Data-XRay 2.0.zip infected by "Trojan-Downloader.Win32.Bagle.jp" Virus. Action Taken: File Deleted.
File C:\Documents and Settings\NiCoReTTe\Application Data\m\shared\DeadLine Calculator 1.0.zip infected by "Trojan-Downloader.Win32.Bagle.jp" Virus. Action Taken: File Deleted.
File C:\Documents and Settings\NiCoReTTe\Application Data\m\shared\Describe 6.1.8.1148n EE.zip infected by "Trojan-Downloader.Win32.Bagle.jp" Virus. Action Taken: File Deleted.
File C:\Documents and Settings\NiCoReTTe\Application Data\m\shared\DesktopCoral 1.07.zip infected by "Trojan-Downloader.Win32.Bagle.jp" Virus. Action Taken: File Deleted.
File C:\Documents and Settings\NiCoReTTe\Application Data\m\shared\Diatonically Speaking 1.4.zip infected by "Trojan-Downloader.Win32.Bagle.jp" Virus. Action Taken: File Deleted.
File C:\Documents and Settings\NiCoReTTe\Application Data\m\shared\Digital Funeral Planner 3.0.5 [Key].zip infected by "Trojan-Downloader.Win32.Bagle.jp" Virus. Action Taken: File Deleted.
File C:\Documents and Settings\NiCoReTTe\Application Data\m\shared\Dragnifier 2.5.zip infected by "Trojan-Downloader.Win32.Bagle.jp" Virus. Action Taken: File Deleted.
File C:\Documents and Settings\NiCoReTTe\Application Data\m\shared\eBoard 1.0 (Key+Serial).zip infected by "Trojan-Downloader.Win32.Bagle.jp" Virus. Action Taken: File Deleted.
File C:\Documents and Settings\NiCoReTTe\Application Data\m\shared\Eclipse SDK 3.1.2.zip infected by "Trojan-Downloader.Win32.Bagle.jp" Virus. Action Taken: File Deleted.
File C:\Documents and Settings\NiCoReTTe\Application Data\m\shared\Elf Girl Sim Date RPG 1.zip infected by "Trojan-Downloader.Win32.Bagle.jp" Virus. Action Taken: File Deleted.
File C:\Documents and Settings\NiCoReTTe\Application Data\m\shared\eLife Coupler 3.5.zip infected by "Trojan-Downloader.Win32.Bagle.jp" Virus. Action Taken: File Deleted.
File C:\Documents and Settings\NiCoReTTe\Application Data\m\shared\Elite Clock Screensaver 1.5.15.zip infected by "Trojan-Downloader.Win32.Bagle.jp" Virus. Action Taken: File Deleted.
File C:\Documents and Settings\NiCoReTTe\Application Data\m\shared\Express Timesync 3.4 build 1207.zip infected by "Trojan-Downloader.Win32.Bagle.jp" Virus. Action Taken: File Deleted.
File C:\Documents and Settings\NiCoReTTe\Application Data\m\shared\Fantastic Ocean 3D Screensaver 1.0 [Patch].zip infected by "Trojan-Downloader.Win32.Bagle.jp" Virus. Action Taken: File Deleted.
File C:\Documents and Settings\NiCoReTTe\Application Data\m\shared\FantasyDVD Player Platinum 9.37 Build 708 (Key+Serial).zip infected by "Trojan-Downloader.Win32.Bagle.jp" Virus. Action Taken: File Deleted.
File C:\Documents and Settings\NiCoReTTe\Application Data\m\shared\FavKeeper 1.1.zip infected by "Trojan-Downloader.Win32.Bagle.jp" Virus. Action Taken: File Deleted.
File C:\Documents and Settings\NiCoReTTe\Application Data\m\shared\Firefly 1.0.24.zip infected by "Trojan-Downloader.Win32.Bagle.jp" Virus. Action Taken: File Deleted.
File C:\Documents and Settings\NiCoReTTe\Application Data\m\shared\flat assembler 1.67.7.zip infected by "Trojan-Downloader.Win32.Bagle.jp" Virus. Action Taken: File Deleted.
File C:\Documents and Settings\NiCoReTTe\Application Data\m\shared\FormArtist 3.5.zip infected by "Trojan-Downloader.Win32.Bagle.jp" Virus. Action Taken: File Deleted.
File C:\Documents and Settings\NiCoReTTe\Application Data\m\shared\Genie Eyes-Only 1.0 Build 1.0.214.1.zip infected by "Trojan-Downloader.Win32.Bagle.jp" Virus. Action Taken: File Deleted.
File C:\Documents and Settings\NiCoReTTe\Application Data\m\shared\Glaos 1.1.zip infected by "Trojan-Downloader.Win32.Bagle.jp" Virus. Action Taken: File Deleted.
File C:\Documents and Settings\NiCoReTTe\Application Data\m\shared\Google Notebook 1.0.2.4.zip infected by "Trojan-Downloader.Win32.Bagle.jp" Virus. Action Taken: File Deleted.
File C:\Documents and Settings\NiCoReTTe\Application Data\m\shared\Grandma's Little Real Estate Helper 1.0 [With Crack].zip infected by "Trojan-Downloader.Win32.Bagle.jp" Virus. Action Taken: File Deleted.
File C:\Documents and Settings\NiCoReTTe\Application Data\m\shared\Guitar Chords Library 5.7.zip infected by "Trojan-Downloader.Win32.Bagle.jp" Virus. Action Taken: File Deleted.
File C:\Documents and Settings\NiCoReTTe\Application Data\m\shared\HAL 7.zip infected by "Trojan-Downloader.Win32.Bagle.jp" Virus. Action Taken: File Deleted.
File C:\Documents and Settings\NiCoReTTe\Application Data\m\shared\Heliocode Doc@Hand Document Server 1.0.2 Key.zip infected by "Trojan-Downloader.Win32.Bagle.jp" Virus. Action Taken: File Deleted.
File C:\Documents and Settings\NiCoReTTe\Application Data\m\shared\Hidden & Dangerous 2 patch 1.03.zip infected by "Trojan-Downloader.Win32.Bagle.jp" Virus. Action Taken: File Deleted.
File C:\Documents and Settings\NiCoReTTe\Application Data\m\shared\HiddenFinder 1.3.02 build 386.zip infected by "Trojan-Downloader.Win32.Bagle.jp" Virus. Action Taken: File Deleted.
File C:\Documents and Settings\NiCoReTTe\Application Data\m\shared\HP0-803 Practice Exam Testing Engine Software 1.0 (Patch).zip infected by "Trojan-Downloader.Win32.Bagle.jp" Virus. Action Taken: File Deleted.
File C:\Documents and Settings\NiCoReTTe\Application Data\m\shared\iAutoArtwork 2.64 [With Crack].zip infected by "Trojan-Downloader.Win32.Bagle.jp" Virus. Action Taken: File Deleted.
File C:\Documents and Settings\NiCoReTTe\Application Data\m\shared\ICQ Snif 2.0.zip infected by "Trojan-Downloader.Win32.Bagle.jp" Virus. Action Taken: File Deleted.
File C:\Documents and Settings\NiCoReTTe\Application Data\m\shared\IE5skinner 1.3.zip infected by "Trojan-Downloader.Win32.Bagle.jp" Virus. Action Taken: File Deleted.
File C:\Documents and Settings\NiCoReTTe\Application Data\m\shared\Internet- The Browser 1.zip infected by "Trojan-Downloader.Win32.Bagle.jp" Virus. Action Taken: File Deleted.
File C:\Documents and Settings\NiCoReTTe\Application Data\m\shared\IView Lite Inventory Manager 3.0 Serial.zip infected by "Trojan-Downloader.Win32.Bagle.jp" Virus. Action Taken: File Deleted.
File C:\Documents and Settings\NiCoReTTe\Application Data\m\shared\JC WebAnswers 1.0.zip infected by "Trojan-Downloader.Win32.Bagle.jp" Virus. Action Taken: File Deleted.
File C:\Documents and Settings\NiCoReTTe\Application Data\m\shared\JPEGtoASCII 1.0.0.zip infected by "Trojan-Downloader.Win32.Bagle.jp" Virus. Action Taken: File Deleted.
File C:\Documents and Settings\NiCoReTTe\Application Data\m\shared\JustFTP 3.0.zip infected by "Trojan-Downloader.Win32.Bagle.jp" Virus. Action Taken: File Deleted.
File C:\Documents and Settings\NiCoReTTe\Application Data\m\shared\Kaan Barbarian's Blade v03.11.03 patch.zip infected by "Trojan-Downloader.Win32.Bagle.jp" Virus. Action Taken: File Deleted.
File C:\Documents and Settings\NiCoReTTe\Application Data\m\shared\Kaspersky.Antivirus.Personal.5.0.156.En.Español.Crack.Llave.De.Licencia.zip infected by "Trojan-Downloader.Win32.Bagle.jp" Virus. Action Taken: File Deleted.
File C:\Documents and Settings\NiCoReTTe\Application Data\m\shared\Kaspersky.AVP.Anti-Virus.Personal.Pro.v4.5.0.58.+.KEY.[Español].[Spanish].zip infected by "Trojan-Downloader.Win32.Bagle.jp" Virus. Action Taken: File Deleted.
File C:\Documents and Settings\NiCoReTTe\Application Data\m\shared\Kaspersky_2006.6.0.0297b.zip infected by "Trojan-Downloader.Win32.Bagle.jp" Virus. Action Taken: File Deleted.
File C:\Documents and Settings\NiCoReTTe\Application Data\m\shared\Keyroid 1.0.5.zip infected by "Trojan-Downloader.Win32.Bagle.jp" Virus. Action Taken: File Deleted.
File C:\Documents and Settings\NiCoReTTe\Application Data\m\shared\King James Bible for Palm 3.51e015.zip infected by "Trojan-Downloader.Win32.Bagle.jp" Virus. Action Taken: File Deleted.
File C:\Documents and Settings\NiCoReTTe\Application Data\m\shared\Kit Builders and Resellers Source Book 1.0.zip infected by "Trojan-Downloader.Win32.Bagle.jp" Virus. Action Taken: File Deleted.
File C:\Documents and Settings\NiCoReTTe\Application Data\m\shared\Leemo 1.07.zip infected by "Trojan-Downloader.Win32.Bagle.jp" Virus. Action Taken: File Deleted.
File C:\Documents and Settings\NiCoReTTe\Application Data\m\shared\Linear Regression 1.00 (Serial).zip infected by "Trojan-Downloader.Win32.Bagle.jp" Virus. Action Taken: File Deleted.
File C:\Documents and Settings\NiCoReTTe\Application Data\m\shared\LingvoSoft Picture Dictionary 2007 German - Portuguese 1.1.18 (Key).zip infected by "Trojan-Downloader.Win32.Bagle.jp" Virus. Action Taken: File Deleted.
File C:\Documents and Settings\NiCoReTTe\Application Data\m\shared\LingvoSoft Talking Picture Dictionary 2007 Vietnamese - Chinese Mandarin Traditional 1.1.20.zip infected by "Trojan-Downloader.Win32.Bagle.jp" Virus. Action Taken: File Deleted.
File C:\Documents and Settings\NiCoReTTe\Application Data\m\shared\LockAnEXE 1.21.zip infected by "Trojan-Downloader.Win32.Bagle.jp" Virus. Action Taken: File Deleted.
File C:\Documents and Settings\NiCoReTTe\Application Data\m\shared\Luxena dbExpress driver for Informix Pro 1.2.4 (With Crack).zip infected by "Trojan-Downloader.Win32.Bagle.jp" Virus. Action Taken: File Deleted.
File C:\Documents and Settings\NiCoReTTe\Application Data\m\shared\Maintenance Parts Bin 7.4.7 (Serial).zip infected by "Trojan-Downloader.Win32.Bagle.jp" Virus. Action Taken: File Deleted.
File C:\Documents and Settings\NiCoReTTe\Application Data\m\shared\Manual.de.McAfee.Firewall.Español.zip infected by "Trojan-Downloader.Win32.Bagle.jp" Virus. Action Taken: File Deleted.
File C:\Documents and Settings\NiCoReTTe\Application Data\m\shared\McAfee.Personal.Firewall.Plus.v4.8.0.4-ROR.ShareReactor.zip infected by "Trojan-Downloader.Win32.Bagle.jp" Virus. Action Taken: File Deleted.
File C:\Documents and Settings\NiCoReTTe\Application Data\m\shared\ME Weights 3.0.zip infected by "Trojan-Downloader.Win32.Bagle.jp" Virus. Action Taken: File Deleted.
File C:\Documents and Settings\NiCoReTTe\Application Data\m\shared\Mellosoftron 3.4 (Key+Serial).zip infected by "Trojan-Downloader.Win32.Bagle.jp" Virus. Action Taken: File Deleted.
File C:\Documents and Settings\NiCoReTTe\Application Data\m\shared\Message Exporter 1.1 (KeyGen).zip infected by "Trojan-Downloader.Win32.Bagle.jp" Virus. Action Taken: File Deleted.
File C:\Documents and Settings\NiCoReTTe\Application Data\m\shared\MessagePoint Enterprise Edition 1.0 [Cracked].zip infected by "Trojan-Downloader.Win32.Bagle.jp" Virus. Action Taken: File Deleted.
File C:\Documents and Settings\NiCoReTTe\Application Data\m\shared\MessengerLog Pro 6.26.zip infected by "Trojan-Downloader.Win32.Bagle.jp" Virus. Action Taken: File Deleted.
File C:\Documents and Settings\NiCoReTTe\Application Data\m\shared\Microsoft Plus! PhotoStory LE 2.0.zip infected by "Trojan-Downloader.Win32.Bagle.jp" Virus. Action Taken: File Deleted.
File C:\Documents and Settings\NiCoReTTe\Application Data\m\shared\MileMate 3.0.zip infected by "Trojan-Downloader.Win32.Bagle.jp" Virus. Action Taken: File Deleted.
File C:\Documents and Settings\NiCoReTTe\Application Data\m\shared\MiM Lite B (Eng) 1.zip infected by "Trojan-Downloader.Win32.Bagle.jp" Virus. Action Taken: File Deleted.
File C:\Documents and Settings\NiCoReTTe\Application Data\m\shared\miniWEBedit 1.1.9 [Serial].zip infected by "Trojan-Downloader.Win32.Bagle.jp" Virus. Action Taken: File Deleted.
File C:\Documents and Settings\NiCoReTTe\Application Data\m\shared\miOOt Live Chat 3.0.1 (Key+Serial).zip infected by "Trojan-Downloader.Win32.Bagle.jp" Virus. Action Taken: File Deleted.
File C:\Documents and Settings\NiCoReTTe\Application Data\m\shared\mIRC 6.21.zip infected by "Trojan-Downloader.Win32.Bagle.jp" Virus. Action Taken: File Deleted.
File C:\Documents and Settings\NiCoReTTe\Application Data\m\shared\Missing Since January patch.zip infected by "Trojan-Downloader.Win32.Bagle.jp" Virus. Action Taken: File Deleted.
File C:\Documents and Settings\NiCoReTTe\Application Data\m\shared\MLP-Map 1.0.zip infected by "Trojan-Downloader.Win32.Bagle.jp" Virus. Action Taken: File Deleted.
File C:\Documents and Settings\NiCoReTTe\Application Data\m\shared\Mortgage Prelude 2.4.zip infected by "Trojan-Downloader.Win32.Bagle.jp" Virus. Action Taken: File Deleted.
File C:\Documents and Settings\NiCoReTTe\Application Data\m\shared\MouseAround 1.zip infected by "Trojan-Downloader.Win32.Bagle.jp" Virus. Action Taken: File Deleted.
File C:\Documents and Settings\NiCoReTTe\Application Data\m\shared\Multiquence 2.54 [Key].zip infected by "Trojan-Downloader.Win32.Bagle.jp" Virus. Action Taken: File Deleted.
File C:\Documents and Settings\NiCoReTTe\Application Data\m\shared\MusiGenesis 1.2.5 [Key].zip infected by "Trojan-Downloader.Win32.Bagle.jp" Virus. Action Taken: File Deleted.
File C:\Documents and Settings\NiCoReTTe\Application Data\m\shared\My Flexible Dictaphone 1.6 [KeyGen].zip infected by "Trojan-Downloader.Win32.Bagle.jp" Virus. Action Taken: File Deleted.
File C:\Documents and Settings\NiCoReTTe\Application Data\m\shared\MySQL Developer 1.00 KeyGen.zip infected by "Trojan-Downloader.Win32.Bagle.jp" Virus. Action Taken: File Deleted.
File C:\Documents and Settings\NiCoReTTe\Application Data\m\shared\NCN Chat 1.0.0829.zip infected by "Trojan-Downloader.Win32.Bagle.jp" Virus. Action Taken: File Deleted.
File C:\Documents and Settings\NiCoReTTe\Application Data\m\shared\NetShell Suite 2.0.zip infected by "Trojan-Downloader.Win32.Bagle.jp" Virus. Action Taken: File Deleted.
File C:\Documents and Settings\NiCoReTTe\Application Data\m\shared\NOD32_2007.en(vista.ready).zip infected by "Trojan-Downloader.Win32.Bagle.jp" Virus. Action Taken: File Deleted.
File C:\Documents and Settings\NiCoReTTe\Application Data\m\shared\Nod32_v2.12.4.manual.plugin.(crack_de_por_vida)[español-spanish]by_Inaki84.zip infected by "Trojan-Downloader.Win32.Bagle.jp" Virus. Action Taken: File Deleted.
File C:\Documents and Settings\NiCoReTTe\Application Data\m\shared\Nucleus Kernel Digital Media Recovery Software 4.02 [With Crack].zip infected by "Trojan-Downloader.Win32.Bagle.jp" Virus. Action Taken: File Deleted.
File C:\Documents and Settings\NiCoReTTe\Application Data\m\shared\ODBscript.zip infected by "Trojan-Downloader.Win32.Bagle.jp" Virus. Action Taken: File Deleted.
File C:\Documents and Settings\NiCoReTTe\Application Data\m\shared\Ogg Encoder Decoder v1.2.8b Patch.zip infected by "Trojan-Downloader.Win32.Bagle.jp" Virus. Action Taken: File Deleted.
File C:\Documents and Settings\NiCoReTTe\Application Data\m\shared\OGphoto Autumn Screensaver 3.2.zip infected by "Trojan-Downloader.Win32.Bagle.jp" Virus. Action Taken: File Deleted.
File C:\Documents and Settings\NiCoReTTe\Application Data\m\shared\OleClean 1.5.zip infected by "Trojan-Downloader.Win32.Bagle.jp" Virus. Action Taken: File Deleted.
File C:\Documents and Settings\NiCoReTTe\Application Data\m\shared\Omniquad Set Me Up 3.6j.zip infected by "Trojan-Downloader.Win32.Bagle.jp" Virus. Action Taken: File Deleted.
File C:\Documents and Settings\NiCoReTTe\Application Data\m\shared\Online Icon Set 2007.2 KeyGen.zip infected by "Trojan-Downloader.Win32.Bagle.jp" Virus. Action Taken: File Deleted.
File C:\Documents and Settings\NiCoReTTe\Application Data\m\shared\Oracle2Excel 2006.zip infected by "Trojan-Downloader.Win32.Bagle.jp" Virus. Action Taken: File Deleted.
File C:\Documents and Settings\NiCoReTTe\Application Data\m\shared\OrganizeMe 1.1.zip infected by "Trojan-Downloader.Win32.Bagle.jp" Virus. Action Taken: File Deleted.
File C:\Documents and Settings\NiCoReTTe\Application Data\m\shared\Oriens JPEG2000 Professional 1.3.160.zip infected by "Trojan-Downloader.Win32.Bagle.jp" Virus. Action Taken: File Deleted.
File C:\Documents and Settings\NiCoReTTe\Application Data\m\shared\Outline3D Offline Version 4.5 [Patch].zip infected by "Trojan-Downloader.Win32.Bagle.jp" Virus. Action Taken: File Deleted.
File C:\Documents and Settings\NiCoReTTe\Application Data\m\shared\Paddle Battle 1.2.zip infected by "Trojan-Downloader.Win32.Bagle.jp" Virus. Action Taken: File Deleted.
File C:\Documents and Settings\NiCoReTTe\Application Data\m\shared\Paloma 1.00.5612.zip infected by "Trojan-Downloader.Win32.Bagle.jp" Virus. Action Taken: File Deleted.
File C:\Documents and Settings\NiCoReTTe\Application Data\m\shared\Panda_EnterpriSecure_with_TruPrevent_Technologies_3.06.10.zip infected by "Trojan-Downloader.Win32.Bagle.jp" Virus. Action Taken: File Deleted.
File C:\Documents and Settings\NiCoReTTe\Application Data\m\shared\PathfinderIII 1.3 [Patch].zip infected by "Trojan-Downloader.Win32.Bagle.jp" Virus. Action Taken: File Deleted.
File C:\Documents and Settings\NiCoReTTe\Application Data\m\shared\PC Alarm Clock 3.zip infected by "Trojan-Downloader.Win32.Bagle.jp" Virus. Action Taken: File Deleted.
File C:\Documents and Settings\NiCoReTTe\Application Data\m\shared\PC Spy Keylogger 2.35 Key.zip infected by "Trojan-Downloader.Win32.Bagle.jp" Virus. Action Taken: File Deleted.
File C:\Documents and Settings\NiCoReTTe\Application Data\m\shared\PC Tools AntiVirus 3.1 [KeyGen].zip infected by "Trojan-Downloader.Win32.Bagle.jp" Virus. Action Taken: File Deleted.
File C:\Documents and Settings\NiCoReTTe\Application Data\m\shared\PDFDrucker 1.2.zip infected by "Trojan-Downloader.Win32.Bagle.jp" Virus. Action Taken: File Deleted.
File C:\Documents and Settings\NiCoReTTe\Application Data\m\shared\PlacesBar Editor 1.0.zip infected by "Trojan-Downloader.Win32.Bagle.jp" Virus. Action Taken: File Deleted.
File C:\Documents and Settings\NiCoReTTe\Application Data\m\shared\Plot2EMF 4.2.1012.zip infected by "Trojan-Downloader.Win32.Bagle.jp" Virus. Action Taken: File Deleted.
File C:\Documents and Settings\NiCoReTTe\Application Data\m\shared\PNG Utilities Plugin 1.8.1.zip infected by "Trojan-Downloader.Win32.Bagle.jp" Virus. Action Taken: File Deleted.
File C:\Documents and Settings\NiCoReTTe\Application Data\m\shared\PocketPC Battery Monitor 1.zip infected by "Trojan-Downloader.Win32.Bagle.jp" Virus. Action Taken: File Deleted.
File C:\Documents and Settings\NiCoReTTe\Application Data\m\shared\PocketPC Themes 1.0.zip infected by "Trojan-Downloader.Win32.Bagle.jp" Virus. Action Taken: File Deleted.
File C:\Documents and Settings\NiCoReTTe\Application Data\m\shared\Prescription Pad 2.7 (Key).zip infected by "Trojan-Downloader.Win32.Bagle.jp" Virus. Action Taken: File Deleted.
File C:\Documents and Settings\NiCoReTTe\Application Data\m\shared\Print Wide HTML 1.0.0.zip infected by "Trojan-Downloader.Win32.Bagle.jp" Virus. Action Taken: File Deleted.
File C:\Documents and Settings\NiCoReTTe\Application Data\m\shared\Proxel Lens Corrector 1.0.3.zip infected by "Trojan-Downloader.Win32.Bagle.jp" Virus. Action Taken: File Deleted.
File C:\Documents and Settings\NiCoReTTe\Application Data\m\shared\QuickRecord 2.zip infected by "Trojan-Downloader.Win32.Bagle.jp" Virus. Action Taken: File Deleted.
File C:\Documents and Settings\NiCoReTTe\Application Data\m\shared\RemoteComputer 8.21a.zip infected by "Trojan-Downloader.Win32.Bagle.jp" Virus. Action Taken: File Deleted.
File C:\Documents and Settings\NiCoReTTe\Application Data\m\shared\Renju Master 1.01.zip infected by "Trojan-Downloader.Win32.Bagle.jp" Virus. Action Taken: File Deleted.
File C:\Documents and Settings\NiCoReTTe\Application Data\m\shared\Rewind WordWeb 1.0.zip infected by "Trojan-Downloader.Win32.Bagle.jp" Virus. Action Taken: File Deleted.
File C:\Documents and Settings\NiCoReTTe\Application Data\m\shared\Root Finder 1.zip infected by "Trojan-Downloader.Win32.Bagle.jp" Virus. Action Taken: File Deleted.
File C:\Documents and Settings\NiCoReTTe\Application Data\m\shared\Rpv Business Reports 5.2.zip infected by "Trojan-Downloader.Win32.Bagle.jp" Virus. Action Taken: File Deleted.
File C:\Documents and Settings\NiCoReTTe\Application Data\m\shared\Screen Booty 1.1 [Crack].zip infected by "Trojan-Downloader.Win32.Bagle.jp" Virus. Action Taken: File Deleted.
File C:\Documents and Settings\NiCoReTTe\Application Data\m\shared\Secure IE 2004.zip infected by "Trojan-Downloader.Win32.Bagle.jp" Virus. Action Taken: File Deleted.
File C:\Documents and Settings\NiCoReTTe\Application Data\m\shared\Selected Links 1.2.zip infected by "Trojan-Downloader.Win32.Bagle.jp" Virus. Action Taken: File Deleted.
File C:\Documents and Settings\NiCoReTTe\Application Data\m\shared\Serial Data Player 1.5.zip infected by "Trojan-Downloader.Win32.Bagle.jp" Virus. Action Taken: File Deleted.
File C:\Documents and Settings\NiCoReTTe\Application Data\m\shared\SheerPower 4GL 3.5.zip infected by "Trojan-Downloader.Win32.Bagle.jp" Virus. Action Taken: File Deleted.
File C:\Documents and Settings\NiCoReTTe\Application Data\m\shared\SimpleDesktop 2.9r.zip infected by "Trojan-Downloader.Win32.Bagle.jp" Virus. Action Taken: File Deleted.
File C:\Documents and Settings\NiCoReTTe\Application Data\m\shared\Site-Max Search 1.3.zip infected by "Trojan-Downloader.Win32.Bagle.jp" Virus. Action Taken: File Deleted.
File C:\Documents and Settings\NiCoReTTe\Application Data\m\shared\Slawdog DOJO Media Player 2003.zip infected by "Trojan-Downloader.Win32.Bagle.jp" Virus. Action Taken: File Deleted.
File C:\Documents and Settings\NiCoReTTe\Application Data\m\shared\Smartworks - Project Planner 4.8.zip infected by "Trojan-Downloader.Win32.Bagle.jp" Virus. Action Taken: File Deleted.
File C:\Documents and Settings\NiCoReTTe\Application Data\m\shared\Smtp.NET 3.0.zip infected by "Trojan-Downloader.Win32.Bagle.jp" Virus. Action Taken: File Deleted.
File C:\Documents and Settings\NiCoReTTe\Application Data\m\shared\Socket Server 32 2.1.zip infected by "Trojan-Downloader.Win32.Bagle.jp" Virus. Action Taken: File Deleted.
File C:\Documents and Settings\NiCoReTTe\Application Data\m\shared\StudioSchool Pro 3.3.zip infected by "Trojan-Downloader.Win32.Bagle.jp" Virus. Action Taken: File Deleted.
File C:\Documents and Settings\NiCoReTTe\Application Data\m\shared\SuDiX Core 4.zip infected by "Trojan-Downloader.Win32.Bagle.jp" Virus. Action Taken: File Deleted.
File C:\Documents and Settings\NiCoReTTe\Application Data\m\shared\Super Webcam Recorder 2.zip infected by "Trojan-Downloader.Win32.Bagle.jp" Virus. Action Taken: File Deleted.
File C:\Documents and Settings\NiCoReTTe\Application Data\m\shared\SureData ToolKit 4.6.10.zip infected by "Trojan-Downloader.Win32.Bagle.jp" Virus. Action Taken: File Deleted.
File C:\Documents and Settings\NiCoReTTe\Application Data\m\shared\Symantec_Norton_PartitionMagic_v8.05.(Build.1371)_Multilanguage_Full_Cover_Bootable.zip infected by "Trojan-Downloader.Win32.Bagle.jp" Virus. Action Taken: File Deleted.
File C:\Documents and Settings\NiCoReTTe\Application Data\m\shared\T-Boss 2.3 (Key+Serial).zip infected by "Trojan-Downloader.Win32.Bagle.jp" Virus. Action Taken: File Deleted.
File C:\Documents and Settings\NiCoReTTe\Application Data\m\shared\TCP Properties Monitor 1.0.zip infected by "Trojan-Downloader.Win32.Bagle.jp" Virus. Action Taken: File Deleted.
File C:\Documents and Settings\NiCoReTTe\Application Data\m\shared\Texturizer 1.92 (Crack).zip infected by "Trojan-Downloader.Win32.Bagle.jp" Virus. Action Taken: File Deleted.
File C:\Documents and Settings\NiCoReTTe\Application Data\m\shared\The Great Puzzle 0100.zip infected by "Trojan-Downloader.Win32.Bagle.jp" Virus. Action Taken: File Deleted.
File C:\Documents and Settings\NiCoReTTe\Application Data\m\shared\The Inquirer 1.0.zip infected by "Trojan-Downloader.Win32.Bagle.jp" Virus. Action Taken: File Deleted.
File C:\Documents and Settings\NiCoReTTe\Application Data\m\shared\The Love Calculator 0.7.zip infected by "Trojan-Downloader.Win32.Bagle.jp" Virus. Action Taken: File Deleted.
File C:\Documents and Settings\NiCoReTTe\Application Data\m\shared\TNJ True Backup 2.38.zip infected by "Trojan-Downloader.Win32.Bagle.jp" Virus. Action Taken: File Deleted.
File C:\Documents and Settings\NiCoReTTe\Application Data\m\shared\Top Spin demo.zip infected by "Trojan-Downloader.Win32.Bagle.jp" Virus. Action Taken: File Deleted.
File C:\Documents and Settings\NiCoReTTe\Application Data\m\shared\TradeTrakker 2.74 (Serial).zip infected by "Trojan-Downloader.Win32.Bagle.jp" Virus. Action Taken: File Deleted.
File C:\Documents and Settings\NiCoReTTe\Application Data\m\shared\Txt2PDF 3.0 Cracked.zip infected by "Trojan-Downloader.Win32.Bagle.jp" Virus. Action Taken: File Deleted.
File C:\Documents and Settings\NiCoReTTe\Application Data\m\shared\Unreal Tournament 2003 - Battle Islands CTF map.zip infected by "Trojan-Downloader.Win32.Bagle.jp" Virus. Action Taken: File Deleted.
File C:\Documents and Settings\NiCoReTTe\Application Data\m\shared\Unreal Tournament 2003 - Gael II deathmatch map.zip infected by "Trojan-Downloader.Win32.Bagle.jp" Virus. Action Taken: File Deleted.
File C:\Documents and Settings\NiCoReTTe\Application Data\m\shared\Unreal Tournament 2003 - Outpost 33 Final CTF map.zip infected by "Trojan-Downloader.Win32.Bagle.jp" Virus. Action Taken: File Deleted.
File C:\Documents and Settings\NiCoReTTe\Application Data\m\shared\Unreal Tournament 2004 NeoTokyo mod.zip infected by "Trojan-Downloader.Win32.Bagle.jp" Virus. Action Taken: File Deleted.
File C:\Documents and Settings\NiCoReTTe\Application Data\m\shared\VideoCap ActiveX Control 2.2.zip infected by "Trojan-Downloader.Win32.Bagle.jp" Virus. Action Taken: File Deleted.
File C:\Documents and Settings\NiCoReTTe\Application Data\m\shared\VMN Storage 3.72.zip infected by "Trojan-Downloader.Win32.Bagle.jp" Virus. Action Taken: File Deleted.
File C:\Documents and Settings\NiCoReTTe\Application Data\m\shared\WBJB Now On 1.0.zip infected by "Trojan-Downloader.Win32.Bagle.jp" Virus. Action Taken: File Deleted.
File C:\Documents and Settings\NiCoReTTe\Application Data\m\shared\White Pages Grabber 1.21 (Key+Serial).zip infected by "Trojan-Downloader.Win32.Bagle.jp" Virus. Action Taken: File Deleted.
File C:\Documents and Settings\NiCoReTTe\Application Data\m\shared\WinSpy 3.1 Key.zip infected by "Trojan-Downloader.Win32.Bagle.jp" Virus. Action Taken: File Deleted.
File C:\Documents and Settings\NiCoReTTe\Application Data\m\shared\WMSmart 1.2.4.zip infected by "Trojan-Downloader.Win32.Bagle.jp" Virus. Action Taken: File Deleted.
File C:\Documents and Settings\NiCoReTTe\Application Data\m\shared\WordBanker English-Chinese(Traditional) 5.1.0 (Serial).zip infected by "Trojan-Downloader.Win32.Bagle.jp" Virus. Action Taken: File Deleted.
File C:\Documents and Settings\NiCoReTTe\Application Data\m\shared\Zoom Function 0.95.zip infected by "Trojan-Downloader.Win32.Bagle.jp" Virus. Action Taken: File Deleted.
File C:\Documents and Settings\NiCoReTTe\Application Data\m\shared\Zune Music Recovery 2.0.1.5.zip infected by "Trojan-Downloader.Win32.Bagle.jp" Virus. Action Taken: File Deleted.
File C:\Documents and Settings\NiCoReTTe\Local Settings\Temp\NERO14399\Toolbar.exe tagged as not-a-virus:AdTool.Win32.MyWebSearch.bm. No Action Taken.
File C:\Documents and Settings\NiCoReTTe\Työpöytä\väliaikaista\setupxv.exe tagged as not-a-virus:FraudTool.Win32.AntiSpyware.c. No Action Taken.
File C:\System Volume Information\_restore{578D9108-E629-4564-9264-A9E01313D6AE}\RP226\A0076620.exe tagged as not-a-virus:AdWare.Win32.Gator.3202. No Action Taken.
File C:\System Volume Information\_restore{578D9108-E629-4564-9264-A9E01313D6AE}\RP226\A0076773.exe tagged as not-a-virus:AdWare.Win32.WebSearch.r. No Action Taken.
File C:\System Volume Information\_restore{8D41684B-F365-4A5A-B04B-C4BEAA140313}\RP24\A0004657.exe infected by "Email-Worm.Win32.Bagle.of" Virus. Action Taken: File Deleted.
File C:\System Volume Information\_restore{8D41684B-F365-4A5A-B04B-C4BEAA140313}\RP24\A0004737.sys infected by "Trojan-Downloader.Win32.Bagle.hu" Virus. Action Taken: File Deleted.
File C:\System Volume Information\_restore{8D41684B-F365-4A5A-B04B-C4BEAA140313}\RP24\A0004754.sys infected by "Trojan-Downloader.Win32.Bagle.hu" Virus. Action Taken: File Deleted.
File C:\System Volume Information\_restore{8D41684B-F365-4A5A-B04B-C4BEAA140313}\RP24\A0004770.sys infected by "Trojan-Downloader.Win32.Bagle.hu" Virus. Action Taken: File Deleted.
File C:\System Volume Information\_restore{8D41684B-F365-4A5A-B04B-C4BEAA140313}\RP26\A0005059.exe infected by "Trojan.NSIS.StartPage.c" Virus. Action Taken: File Deleted.
File C:\System Volume Information\_restore{8D41684B-F365-4A5A-B04B-C4BEAA140313}\RP26\A0005301.exe infected by "Email-Worm.Win32.Bagle.of" Virus. Action Taken: File to be deleted on reboot.
File C:\System Volume Information\_restore{8D41684B-F365-4A5A-B04B-C4BEAA140313}\RP26\A0005309.sys infected by "Trojan-Downloader.Win32.Bagle.hu" Virus. Action Taken: File to be deleted on reboot.
File C:\System Volume Information\_restore{8D41684B-F365-4A5A-B04B-C4BEAA140313}\RP27\A0005330.sys infected by "Trojan-Downloader.Win32.Bagle.hu" Virus. Action Taken: File to be deleted on reboot.
File C:\System Volume Information\_restore{8D41684B-F365-4A5A-B04B-C4BEAA140313}\RP27\A0005454.exe infected by "Email-Worm.Win32.Bagle.of" Virus. Action Taken: File to be deleted on reboot.
File C:\System Volume Information\_restore{8D41684B-F365-4A5A-B04B-C4BEAA140313}\RP27\A0005468.exe infected by "Trojan-Downloader.Win32.Bagle.hi" Virus. Action Taken: File Deleted.
File C:\System Volume Information\_restore{8D41684B-F365-4A5A-B04B-C4BEAA140313}\RP27\A0005475.sys infected by "Trojan-Downloader.Win32.Bagle.hu" Virus. Action Taken: File Deleted.
File C:\System Volume Information\_restore{8D41684B-F365-4A5A-B04B-C4BEAA140313}\RP27\A0005480.dll tagged as not-a-virus:AdTool.Win32.WhenU.r. No Action Taken.
File C:\System Volume Information\_restore{8D41684B-F365-4A5A-B04B-C4BEAA140313}\RP27\A0005481.exe tagged as not-a-virus:AdTool.Win32.WhenU.t. No Action Taken.
File C:\System Volume Information\_restore{8D41684B-F365-4A5A-B04B-C4BEAA140313}\RP27\A0005483.exe infected by "Email-Worm.Win32.Bagle.of" Virus. Action Taken: File Deleted.
File C:\System Volume Information\_restore{8D41684B-F365-4A5A-B04B-C4BEAA140313}\RP27\A0005541.exe infected by "Email-Worm.Win32.Bagle.of" Virus. Action Taken: File Deleted.
File C:\System Volume Information\_restore{8D41684B-F365-4A5A-B04B-C4BEAA140313}\RP27\A0005551.exe infected by "Email-Worm.Win32.Bagle.of" Virus. Action Taken: File Deleted.
File C:\System Volume Information\_restore{8D41684B-F365-4A5A-B04B-C4BEAA140313}\RP27\A0005564.sys infected by "Trojan-Downloader.Win32.Bagle.hu" Virus. Action Taken: File Deleted.
File C:\System Volume Information\_restore{8D41684B-F365-4A5A-B04B-C4BEAA140313}\RP29\A0007557.sys infected by "Trojan-Downloader.Win32.Bagle.hu" Virus. Action Taken: File Deleted.
File C:\System Volume Information\_restore{8D41684B-F365-4A5A-B04B-C4BEAA140313}\RP29\A0007559.exe infected by "Email-Worm.Win32.Bagle.of" Virus. Action Taken: File Deleted.
File C:\System Volume Information\_restore{8D41684B-F365-4A5A-B04B-C4BEAA140313}\RP30\A0007892.exe infected by "Email-Worm.Win32.Bagle.of" Virus. Action Taken: File Deleted.
File C:\System Volume Information\_restore{8D41684B-F365-4A5A-B04B-C4BEAA140313}\RP30\A0009904.sys infected by "Trojan-Downloader.Win32.Bagle.hu" Virus. Action Taken: File Deleted.
File C:\System Volume Information\_restore{8D41684B-F365-4A5A-B04B-C4BEAA140313}\RP30\A0009907.exe infected by "Email-Worm.Win32.Bagle.of" Virus. Action Taken: File Deleted.
File C:\System Volume Information\_restore{8D41684B-F365-4A5A-B04B-C4BEAA140313}\RP30\A0009928.exe infected by "Email-Worm.Win32.Bagle.of" Virus. Action Taken: File Deleted.
File C:\System Volume Information\_restore{8D41684B-F365-4A5A-B04B-C4BEAA140313}\RP30\A0009937.sys infected by "Trojan-Downloader.Win32.Bagle.hu" Virus. Action Taken: File Deleted.
File C:\System Volume Information\_restore{8D41684B-F365-4A5A-B04B-C4BEAA140313}\RP30\A0010011.sys infected by "Trojan-Downloader.Win32.Bagle.hu" Virus. Action Taken: File Deleted.
File C:\System Volume Information\_restore{8D41684B-F365-4A5A-B04B-C4BEAA140313}\RP31\A0010151.sys infected by "Trojan-Downloader.Win32.Bagle.hu" Virus. Action Taken: File Deleted.
File C:\System Volume Information\_restore{8D41684B-F365-4A5A-B04B-C4BEAA140313}\RP31\A0010170.sys infected by "Trojan-Downloader.Win32.Bagle.hu" Virus. Action Taken: File Deleted.
File C:\System Volume Information\_restore{8D41684B-F365-4A5A-B04B-C4BEAA140313}\RP31\A0010176.exe infected by "Email-Worm.Win32.Bagle.of" Virus. Action Taken: File Deleted.
File C:\System Volume Information\_restore{8D41684B-F365-4A5A-B04B-C4BEAA140313}\RP32\A0010272.exe infected by "Email-Worm.Win32.Bagle.of" Virus. Action Taken: File Deleted.
File C:\System Volume Information\_restore{8D41684B-F365-4A5A-B04B-C4BEAA140313}\RP32\A0010273.exe infected by "Email-Worm.Win32.Bagle.of" Virus. Action Taken: File Deleted.
File C:\System Volume Information\_restore{8D41684B-F365-4A5A-B04B-C4BEAA140313}\RP32\A0010334.exe infected by "Email-Worm.Win32.Bagle.of" Virus. Action Taken: File Deleted.
File C:\System Volume Information\_restore{8D41684B-F365-4A5A-B04B-C4BEAA140313}\RP32\A0010335.exe infected by "Email-Worm.Win32.Bagle.of" Virus. Action Taken: File Deleted.
File C:\System Volume Information\_restore{8D41684B-F365-4A5A-B04B-C4BEAA140313}\RP32\A0011157.exe infected by "Email-Worm.Win32.Bagle.of" Virus. Action Taken: File Deleted.
File C:\System Volume Information\_restore{8D41684B-F365-4A5A-B04B-C4BEAA140313}\RP32\A0011158.exe infected by "Email-Worm.Win32.Bagle.of" Virus. Action Taken: File Deleted.
File C:\System Volume Information\_restore{8D41684B-F365-4A5A-B04B-C4BEAA140313}\RP32\A0012169.sys infected by "Trojan-Downloader.Win32.Bagle.hu" Virus. Action Taken: File Deleted.
File C:\System Volume Information\_restore{8D41684B-F365-4A5A-B04B-C4BEAA140313}\RP32\A0014307.sys infected by "Trojan-Downloader.Win32.Bagle.hu" Virus. Action Taken: File Deleted.
File C:\System Volume Information\_restore{8D41684B-F365-4A5A-B04B-C4BEAA140313}\RP33\A0014468.exe infected by "Trojan-Downloader.Win32.Bagle.hi" Virus. Action Taken: File Deleted.
File C:\System Volume Information\_restore{8D41684B-F365-4A5A-B04B-C4BEAA140313}\RP33\A0014469.exe infected by "Trojan-Downloader.Win32.Bagle.hi" Virus. Action Taken: File Deleted.
File C:\System Volume Information\_restore{8D41684B-F365-4A5A-B04B-C4BEAA140313}\RP33\A0014470.exe infected by "Trojan-PSW.Win32.Agent.xd" Virus. Action Taken: File Deleted.
File C:\System Volume Information\_restore{8D41684B-F365-4A5A-B04B-C4BEAA140313}\RP33\A0014471.exe infected by "Trojan-PSW.Win32.Agent.xd" Virus. Action Taken: File Deleted.
File C:\System Volume Information\_restore{8D41684B-F365-4A5A-B04B-C4BEAA140313}\RP33\A0014472.exe infected by "Trojan-PSW.Win32.Agent.xd" Virus. Action Taken: File Deleted.
File C:\System Volume Information\_restore{8D41684B-F365-4A5A-B04B-C4BEAA140313}\RP33\A0014473.exe infected by "Trojan-PSW.Win32.Agent.xd" Virus. Action Taken: File Deleted.
File C:\System Volume Information\_restore{8D41684B-F365-4A5A-B04B-C4BEAA140313}\RP33\A0014474.exe infected by "Trojan-PSW.Win32.Agent.xd" Virus. Action Taken: File Deleted.
File C:\System Volume Information\_restore{8D41684B-F365-4A5A-B04B-C4BEAA140313}\RP33\A0014475.exe infected by "Trojan-PSW.Win32.Agent.xd" Virus. Action Taken: File Deleted.
File C:\System Volume Information\_restore{8D41684B-F365-4A5A-B04B-C4BEAA140313}\RP33\A0014476.exe infected by "Trojan-PSW.Win32.Agent.xd" Virus. Action Taken: File Deleted.
File C:\System Volume Information\_restore{8D41684B-F365-4A5A-B04B-C4BEAA140313}\RP33\A0014477.exe infected by "Email-Worm.Win32.Bagle.of" Virus. Action Taken: File Deleted.
File C:\System Volume Information\_restore{8D41684B-F365-4A5A-B04B-C4BEAA140313}\RP33\A0014478.exe infected by "Trojan-PSW.Win32.Agent.xd" Virus. Action Taken: File Deleted.
File C:\System Volume Information\_restore{8D41684B-F365-4A5A-B04B-C4BEAA140313}\RP33\A0014479.exe infected by "Email-Worm.Win32.Bagle.of" Virus. Action Taken: File Deleted.
File C:\System Volume Information\_restore{8D41684B-F365-4A5A-B04B-C4BEAA140313}\RP33\A0014480.exe infected by "Email-Worm.Win32.Bagle.of" Virus. Action Taken: File Deleted.
File C:\System Volume Information\_restore{8D41684B-F365-4A5A-B04B-C4BEAA140313}\RP33\A0014481.exe infected by "Trojan-PSW.Win32.Agent.xd" Virus. Action Taken: File Deleted.
File C:\System Volume Information\_restore{8D41684B-F365-4A5A-B04B-C4BEAA140313}\RP33\A0014482.exe infected by "Email-Worm.Win32.Bagle.of" Virus. Action Taken: File Deleted.
File C:\System Volume Information\_restore{8D41684B-F365-4A5A-B04B-C4BEAA140313}\RP33\A0014483.exe infected by "Email-Worm.Win32.Bagle.of" Virus. Action Taken: File Deleted.
File C:\System Volume Information\_restore{8D41684B-F365-4A5A-B04B-C4BEAA140313}\RP33\A0014484.exe infected by "Email-Worm.Win32.Bagle.of" Virus. Action Taken: File Deleted.
File C:\System Volume Information\_restore{8D41684B-F365-4A5A-B04B-C4BEAA140313}\RP33\A0014485.exe infected by "Trojan-PSW.Win32.Agent.xd" Virus. Action Taken: File Deleted.
File C:\System Volume Information\_restore{8D41684B-F365-4A5A-B04B-C4BEAA140313}\RP33\A0014486.exe infected by "Email-Worm.Win32.Bagle.of" Virus. Action Taken: File Deleted.
File C:\System Volume Information\_restore{8D41684B-F365-4A5A-B04B-C4BEAA140313}\RP33\A0014487.exe infected by "Email-Worm.Win32.Bagle.of" Virus. Action Taken: File Deleted.
File C:\System Volume Information\_restore{8D41684B-F365-4A5A-B04B-C4BEAA140313}\RP33\A0014488.exe infected by "Email-Worm.Win32.Bagle.of" Virus. Action Taken: File Deleted.
File C:\System Volume Information\_restore{8D41684B-F365-4A5A-B04B-C4BEAA140313}\RP33\A0014489.exe infected by "Trojan-PSW.Win32.Agent.xd" Virus. Action Taken: File Deleted.
File C:\System Volume Information\_restore{8D41684B-F365-4A5A-B04B-C4BEAA140313}\RP33\A0014490.exe infected by "Trojan-PSW.Win32.Agent.xd" Virus. Action Taken: File Deleted.
File C:\System Volume Information\_restore{8D41684B-F365-4A5A-B04B-C4BEAA140313}\RP33\A0014491.exe infected by "Trojan-PSW.Win32.Agent.xd" Virus. Action Taken: File Deleted.
File C:\System Volume Information\_restore{8D41684B-F365-4A5A-B04B-C4BEAA140313}\RP33\A0014492.exe infected by "Trojan-PSW.Win32.Agent.xd" Virus. Action Taken: File Deleted.
File C:\System Volume Information\_restore{8D41684B-F365-4A5A-B04B-C4BEAA140313}\RP33\A0014493.exe infected by "Email-Worm.Win32.Bagle.of" Virus. Action Taken: File Deleted.
File C:\System Volume Information\_restore{8D41684B-F365-4A5A-B04B-C4BEAA140313}\RP33\A0014494.exe infected by "Email-Worm.Win32.Bagle.of" Virus. Action Taken: File Deleted.
File C:\System Volume Information\_restore{8D41684B-F365-4A5A-B04B-C4BEAA140313}\RP33\A0014495.exe infected by "Trojan-PSW.Win32.Agent.xd" Virus. Action Taken: File Deleted.
File C:\System Volume Information\_restore{8D41684B-F365-4A5A-B04B-C4BEAA140313}\RP33\A0014496.exe infected by "Trojan-PSW.Win32.Agent.xd" Virus. Action Taken: File Deleted.
File C:\System Volume Information\_restore{8D41684B-F365-4A5A-B04B-C4BEAA140313}\RP33\A0014497.exe infected by "Email-Worm.Win32.Bagle.of" Virus. Action Taken: File Deleted.
File C:\System Volume Information\_restore{8D41684B-F365-4A5A-B04B-C4BEAA140313}\RP33\A0014498.exe infected by "Email-Worm.Win32.Bagle.of" Virus. Action Taken: File Deleted.
File C:\System Volume Information\_restore{8D41684B-F365-4A5A-B04B-C4BEAA140313}\RP33\A0014499.exe infected by "Email-Worm.Win32.Bagle.of" Virus. Action Taken: File Deleted.
File C:\System Volume Information\_restore{8D41684B-F365-4A5A-B04B-C4BEAA140313}\RP33\A0014500.exe infected by "Trojan-PSW.Win32.Agent.xd" Virus. Action Taken: File Deleted.
File C:\System Volume Information\_restore{8D41684B-F365-4A5A-B04B-C4BEAA140313}\RP33\A0014501.exe infected by "Email-Worm.Win32.Bagle.of" Virus. Action Taken: File Deleted.
File C:\System Volume Information\_restore{8D41684B-F365-4A5A-B04B-C4BEAA140313}\RP33\A0014502.exe infected by "Trojan-PSW.Win32.Agent.xd" Virus. Action Taken: File Deleted.
File C:\System Volume Information\_restore{8D41684B-F365-4A5A-B04B-C4BEAA140313}\RP33\A0014503.exe infected by "Trojan-PSW.Win32.Agent.xd" Virus. Action Taken: File Deleted.
File C:\System Volume Information\_restore{8D41684B-F365-4A5A-B04B-C4BEAA140313}\RP33\A0014504.exe infected by "Trojan.Win32.Pakes.bwy" Virus. Action Taken: File Deleted.
File C:\System Volume Information\_restore{8D41684B-F365-4A5A-B04B-C4BEAA140313}\RP33\A0014505.exe infected by "Trojan-PSW.Win32.Agent.xd" Virus. Action Taken: File Deleted.
File C:\System Volume Information\_restore{8D41684B-F365-4A5A-B04B-C4BEAA140313}\RP33\A0014506.exe infected by "Trojan-PSW.Win32.Agent.xd" Virus. Action Taken: File Deleted.
File C:\System Volume Information\_restore{8D41684B-F365-4A5A-B04B-C4BEAA140313}\RP33\A0014507.exe infected by "Trojan-PSW.Win32.Agent.xd" Virus. Action Taken: File Deleted.
File C:\System Volume Information\_restore{8D41684B-F365-4A5A-B04B-C4BEAA140313}\RP33\A0014508.exe infected by "Trojan-PSW.Win32.Agent.xd" Virus. Action Taken: File Deleted.
File C:\System Volume Information\_restore{8D41684B-F365-4A5A-B04B-C4BEAA140313}\RP33\A0014509.exe infected by "Trojan-PSW.Win32.Agent.xd" Virus. Action Taken: File Deleted.
File C:\System Volume Information\_restore{8D41684B-F365-4A5A-B04B-C4BEAA140313}\RP33\A0014510.exe infected by "Trojan-PSW.Win32.Agent.xd" Virus. Action Taken: File Deleted.
File C:\System Volume Information\_restore{8D41684B-F365-4A5A-B04B-C4BEAA140313}\RP33\A0014511.exe infected by "Email-Worm.Win32.Bagle.of" Virus. Action Taken: File Deleted.
File C:\System Volume Information\_restore{8D41684B-F365-4A5A-B04B-C4BEAA140313}\RP33\A0014512.exe infected by "Email-Worm.Win32.Bagle.of" Virus. Action Taken: File Deleted.
File C:\System Volume Information\_restore{8D41684B-F365-4A5A-B04B-C4BEAA140313}\RP33\A0014513.exe infected by "Email-Worm.Win32.Bagle.of" Virus. Action Taken: File Deleted.
File C:\System Volume Information\_restore{8D41684B-F365-4A5A-B04B-C4BEAA140313}\RP33\A0014514.exe infected by "Email-Worm.Win32.Bagle.of" Virus. Action Taken: File Deleted.
File C:\System Volume Information\_restore{8D41684B-F365-4A5A-B04B-C4BEAA140313}\RP33\A0014515.exe infected by "Email-Worm.Win32.Bagle.of" Virus. Action Taken: File Deleted.
File C:\System Volume Information\_restore{8D41684B-F365-4A5A-B04B-C4BEAA140313}\RP33\A0014516.exe infected by "Email-Worm.Win32.Bagle.of" Virus. Action Taken: File Deleted.
File C:\System Volume Information\_restore{8D41684B-F365-4A5A-B04B-C4BEAA140313}\RP33\A0014517.exe infected by "Email-Worm.Win32.Bagle.of" Virus. Action Taken: File Deleted.
File C:\System Volume Information\_restore{8D41684B-F365-4A5A-B04B-C4BEAA140313}\RP33\A0014518.exe infected by "Trojan-PSW.Win32.Agent.xd" Virus. Action Taken: File Deleted.
File C:\System Volume Information\_restore{8D41684B-F365-4A5A-B04B-C4BEAA140313}\RP33\A0014519.exe infected by "Email-Worm.Win32.Bagle.of" Virus. Action Taken: File Deleted.
File C:\System Volume Information\_restore{8D41684B-F365-4A5A-B04B-C4BEAA140313}\RP33\A0014520.exe infected by "Trojan-PSW.Win32.Agent.xd" Virus. Action Taken: File Deleted.
File C:\System Volume Information\_restore{8D41684B-F365-4A5A-B04B-C4BEAA140313}\RP33\A0014521.exe infected by "Trojan-PSW.Win32.Agent.xd" Virus. Action Taken: File Deleted.
File C:\System Volume Information\_restore{8D41684B-F365-4A5A-B04B-C4BEAA140313}\RP33\A0014522.exe infected by "Trojan-PSW.Win32.Agent.xd" Virus. Action Taken: File Deleted.
File C:\System Volume Information\_restore{8D41684B-F365-4A5A-B04B-C4BEAA140313}\RP33\A0014523.exe infected by "Trojan-PSW.Win32.Agent.xd" Virus. Action Taken: File Deleted.
File C:\System Volume Information\_restore{8D41684B-F365-4A5A-B04B-C4BEAA140313}\RP33\A0014524.exe infected by "Trojan-PSW.Win32.Agent.xd" Virus. Action Taken: File Deleted.
File C:\System Volume Information\_restore{8D41684B-F365-4A5A-B04B-C4BEAA140313}\RP33\A0014525.exe infected by "Email-Worm.Win32.Bagle.of" Virus. Action Taken: File Deleted.
File C:\System Volume Information\_restore{8D41684B-F365-4A5A-B04B-C4BEAA140313}\RP33\A0014526.exe infected by "Trojan-PSW.Win32.Agent.xd" Virus. Action Taken: File Deleted.
File C:\System Volume Information\_restore{8D41684B-F365-4A5A-B04B-C4BEAA140313}\RP33\A0014527.exe infected by "Trojan-PSW.Win32.Agent.xd" Virus. Action Taken: File Deleted.
File C:\System Volume Information\_restore{8D41684B-F365-4A5A-B04B-C4BEAA140313}\RP33\A0014528.exe infected by "Email-Worm.Win32.Bagle.of" Virus. Action Taken: File Deleted.
File C:\System Volume Information\_restore{8D41684B-F365-4A5A-B04B-C4BEAA140313}\RP33\A0014529.exe infected by "Trojan-PSW.Win32.Agent.xd" Virus. Action Taken: File Deleted.
File C:\System Volume Information\_restore{8D41684B-F365-4A5A-B04B-C4BEAA140313}\RP33\A0014530.exe infected by "Trojan-PSW.Win32.Agent.xd" Virus. Action Taken: File Deleted.
File C:\System Volume Information\_restore{8D41684B-F365-4A5A-B04B-C4BEAA140313}\RP33\A0014531.exe infected by "Trojan-PSW.Win32.Agent.xd" Virus. Action Taken: File Deleted.
File C:\System Volume Information\_restore{8D41684B-F365-4A5A-B04B-C4BEAA140313}\RP33\A0014532.exe infected by "Email-Worm.Win32.Bagle.of" Virus. Action Taken: File Deleted.
File C:\System Volume Information\_restore{8D41684B-F365-4A5A-B04B-C4BEAA140313}\RP33\A0014533.exe infected by "Trojan-PSW.Win32.Agent.xd" Virus. Action Taken: File Deleted.
File C:\System Volume Information\_restore{8D41684B-F365-4A5A-B04B-C4BEAA140313}\RP33\A0014534.exe infected by "Trojan-PSW.Win32.Agent.xd" Virus. Action Taken: File Deleted.
File C:\System Volume Information\_restore{8D41684B-F365-4A5A-B04B-C4BEAA140313}\RP33\A0014535.exe infected by "Email-Worm.Win32.Bagle.of" Virus. Action Taken: File Deleted.
File C:\System Volume Information\_restore{8D41684B-F365-4A5A-B04B-C4BEAA140313}\RP33\A0014536.exe infected by "Trojan-PSW.Win32.Agent.xd" Virus. Action Taken: File Deleted.
File C:\System Volume Information\_restore{8D41684B-F365-4A5A-B04B-C4BEAA140313}\RP33\A0014537.exe infected by "Email-Worm.Win32.Bagle.of" Virus. Action Taken: File Deleted.
File C:\System Volume Information\_restore{8D41684B-F365-4A5A-B04B-C4BEAA140313}\RP33\A0014538.exe infected by "Trojan-PSW.Win32.Agent.xd" Virus. Action Taken: File Deleted.
File C:\System Volume Information\_restore{8D41684B-F365-4A5A-B04B-C4BEAA140313}\RP33\A0014539.exe infected by "Email-Worm.Win32.Bagle.of" Virus. Action Taken: File Deleted.
File C:\System Volume Information\_restore{8D41684B-F365-4A5A-B04B-C4BEAA140313}\RP33\A0014540.exe infected by "Email-Worm.Win32.Bagle.of" Virus. Action Taken: File Deleted.
File C:\System Volume Information\_restore{8D41684B-F365-4A5A-B04B-C4BEAA140313}\RP33\A0014541.exe infected by "Email-Worm.Win32.Bagle.of" Virus. Action Taken: File Deleted.
File C:\System Volume Information\_restore{8D41684B-F365-4A5A-B04B-C4BEAA140313}\RP33\A0014542.exe infected by "Trojan-PSW.Win32.Agent.xd" Virus. Action Taken: File Deleted.
File C:\System Volume Information\_restore{8D41684B-F365-4A5A-B04B-C4BEAA140313}\RP33\A0014543.exe infected by "Trojan-PSW.Win32.Agent.xd" Virus. Action Taken: File Deleted.
File C:\System Volume Information\_restore{8D41684B-F365-4A5A-B04B-C4BEAA140313}\RP33\A0014544.sys infected by "Trojan-Downloader.Win32.Bagle.hu" Virus. Action Taken: File Deleted.
File C:\System Volume Information\_restore{8D41684B-F365-4A5A-B04B-C4BEAA140313}\RP33\A0014545.exe infected by "Email-Worm.Win32.Bagle.of" Virus. Action Taken: File Deleted.
File C:\System Volume Information\_restore{8D41684B-F365-4A5A-B04B-C4BEAA140313}\RP33\A0015156.exe infected by "Trojan-Downloader.Win32.Bagle.hi" Virus. Action Taken: File Deleted.
File C:\System Volume Information\_restore{8D41684B-F365-4A5A-B04B-C4BEAA140313}\RP34\A0015316.rbf tagged as not-a-virus:FraudTool.Win32.AntiSpyware.b. No Action Taken.
File C:\System Volume Information\_restore{8D41684B-F365-4A5A-B04B-C4BEAA140313}\RP6\A0001396.sys infected by "Trojan-Downloader.Win32.Bagle.hu" Virus. Action Taken: File Deleted.
File C:\System Volume Information\_restore{8D41684B-F365-4A5A-B04B-C4BEAA140313}\RP6\A0001445.exe infected by "Trojan-Downloader.Win32.Bagle.hi" Virus. Action Taken: File Deleted.
File C:\System Volume Information\_restore{8D41684B-F365-4A5A-B04B-C4BEAA140313}\RP6\A0001447.sys infected by "Trojan-Downloader.Win32.Bagle.hu" Virus. Action Taken: File Deleted.
File C:\System Volume Information\_restore{8D41684B-F365-4A5A-B04B-C4BEAA140313}\RP7\A0001547.sys infected by "Trojan-Downloader.Win32.Bagle.hu" Virus. Action Taken: File Deleted.
File C:\System Volume Information\_restore{8D41684B-F365-4A5A-B04B-C4BEAA140313}\RP7\A0001572.sys infected by "Trojan-Downloader.Win32.Bagle.hu" Virus. Action Taken: File Deleted.
File C:\System Volume Information\_restore{8D41684B-F365-4A5A-B04B-C4BEAA140313}\RP7\A0001591.sys infected by "Trojan-Downloader.Win32.Bagle.hu" Virus. Action Taken: File Deleted.
File C:\System Volume Information\_restore{8D41684B-F365-4A5A-B04B-C4BEAA140313}\RP8\A0001634.sys infected by "Trojan-Downloader.Win32.Bagle.hu" Virus. Action Taken: File Deleted.
File C:\System Volume Information\_restore{8D41684B-F365-4A5A-B04B-C4BEAA140313}\RP9\A0001820.sys infected by "Trojan-Downloader.Win32.Bagle.hu" Virus. Action Taken: File Deleted.
File C:\System Volume Information\_restore{8D41684B-F365-4A5A-B04B-C4BEAA140313}\RP9\A0001834.sys infected by "Trojan-Downloader.Win32.Bagle.hu" Virus. Action Taken: File Deleted.
File C:\System Volume Information\_restore{DD21BD16-4E1A-4571-84F2-4369C3EBF8E1}\RP1\A0000011.exe infected by "Trojan-Downloader.Win32.Adload.fy" Virus. Action Taken: File Deleted.
File C:\System Volume Information\_restore{DD21BD16-4E1A-4571-84F2-4369C3EBF8E1}\RP14\A0012373.exe tagged as not-a-virus:AdTool.Win32.WhenU.a. No Action Taken.
File C:\System Volume Information\_restore{DD21BD16-4E1A-4571-84F2-4369C3EBF8E1}\RP14\A0012374.exe tagged as not-a-virus:AdTool.Win32.WhenU.a. No Action Taken.
File C:\System Volume Information\_restore{DD21BD16-4E1A-4571-84F2-4369C3EBF8E1}\RP14\A0012375.exe tagged as not-a-virus:AdTool.Win32.WhenU.a. No Action Taken.
File C:\System Volume Information\_restore{DD21BD16-4E1A-4571-84F2-4369C3EBF8E1}\RP15\A0013413.exe tagged as not-a-virus:AdWare.Win32.Mostofate.r. No Action Taken.
File C:\System Volume Information\_restore{DD21BD16-4E1A-4571-84F2-4369C3EBF8E1}\RP15\A0013414.exe tagged as not-a-virus:AdWare.Win32.Mostofate.r. No Action Taken.
File C:\WINDOWS\system32\drivers\down\132593.exe infected by "Email-Worm.Win32.Bagle.of" Virus. Action Taken: File Deleted.
File C:\WINDOWS\system32\drivers\down\142796.exe infected by "Email-Worm.Win32.Bagle.of" Virus. Action Taken: File Deleted.
File C:\WINDOWS\system32\drivers\down\14613343.exe infected by "Email-Worm.Win32.Bagle.of" Virus. Action Taken: File Deleted.
File C:\WINDOWS\system32\drivers\down\146312.exe infected by "Email-Worm.Win32.Bagle.of" Virus. Action Taken: File Deleted.
File C:\WINDOWS\system32\drivers\down\14643671.exe infected by "Email-Worm.Win32.Bagle.of" Virus. Action Taken: File Deleted.
File C:\WINDOWS\system32\drivers\down\146677203.exe infected by "Email-Worm.Win32.Bagle.of" Virus. Action Taken: File Deleted.
File C:\WINDOWS\system32\drivers\down\14828718.exe infected by "Email-Worm.Win32.Bagle.of" Virus. Action Taken: File Deleted.
File C:\WINDOWS\system32\drivers\down\14830906.exe infected by "Email-Worm.Win32.Bagle.of" Virus. Action Taken: File Deleted.
File C:\WINDOWS\system32\drivers\down\148468.exe infected by "Email-Worm.Win32.Bagle.of" Virus. Action Taken: File Deleted.
File C:\WINDOWS\system32\drivers\down\153531.exe infected by "Email-Worm.Win32.Bagle.of" Virus. Action Taken: File Deleted.
File C:\WINDOWS\system32\drivers\down\169703.exe infected by "Email-Worm.Win32.Bagle.of" Virus. Action Taken: File Deleted.
File C:\WINDOWS\system32\drivers\down\29225265.exe infected by "Email-Worm.Win32.Bagle.of" Virus. Action Taken: File Deleted.
File C:\WINDOWS\system32\drivers\down\29389593.exe infected by "Email-Worm.Win32.Bagle.of" Virus. Action Taken: File Deleted.
File C:\WINDOWS\system32\drivers\down\29391562.exe infected by "Email-Worm.Win32.Bagle.of" Virus. Action Taken: File Deleted.
File C:\WINDOWS\system32\drivers\down\29446187.exe infected by "Email-Worm.Win32.Bagle.of" Virus. Action Taken: File Deleted.
File C:\WINDOWS\system32\drivers\down\356162671.exe infected by "Email-Worm.Win32.Bagle.of" Virus. Action Taken: File Deleted.
File C:\WINDOWS\system32\drivers\down\356173078.exe infected by "Email-Worm.Win32.Bagle.of" Virus. Action Taken: File Deleted.
File C:\WINDOWS\system32\drivers\down\370767468.exe infected by "Email-Worm.Win32.Bagle.of" Virus. Action Taken: File Deleted.
File C:\WINDOWS\system32\drivers\down\385262250.exe infected by "Email-Worm.Win32.Bagle.of" Virus. Action Taken: File Deleted.
File C:\WINDOWS\system32\drivers\down\43801843.exe infected by "Email-Worm.Win32.Bagle.of" Virus. Action Taken: File Deleted.
File C:\WINDOWS\system32\drivers\down\56937.exe infected by "Email-Worm.Win32.Bagle.of" Virus. Action Taken: File Deleted.
File C:\WINDOWS\system32\drivers\down\59890.exe infected by "Email-Worm.Win32.Bagle.of" Virus. Action Taken: File Deleted.
File C:\WINDOWS\system32\drivers\down\63218.exe infected by "Email-Worm.Win32.Bagle.of" Virus. Action Taken: File Deleted.
File C:\WINDOWS\system32\drivers\down\67000.exe infected by "Email-Worm.Win32.Bagle.of" Virus. Action Taken: File Deleted.
File C:\WINDOWS\system32\drivers\down\67609.exe infected by "Email-Worm.Win32.Bagle.of" Virus. Action Taken: File Deleted.
File C:\WINDOWS\system32\drivers\down\68890.exe infected by "Email-Worm.Win32.Bagle.of" Virus. Action Taken: File Deleted.
File C:\WINDOWS\system32\drivers\down\71281.exe infected by "Email-Worm.Win32.Bagle.of" Virus. Action Taken: File Deleted.
File C:\WINDOWS\system32\drivers\down\76906.exe infected by "Email-Worm.Win32.Bagle.of" Virus. Action Taken: File Deleted.
File D:\Documents and Settings\Kone\Local Settings\Temp\NeroDemo12550\Toolbar.exe tagged as not-a-virus:AdTool.Win32.MyWebSearch.bm. No Action Taken.
File D:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\OPERST6V\upgrade[1].cab tagged as not-a-virus:AdWare.Win32.NewDotNet.l. No Action Taken.
File D:\Program Files\NewDotNet\nncore.dll tagged as not-a-virus:AdWare.Win32.NewDotNet.l. No Action Taken.
File D:\System Volume Information\_restore{578D9108-E629-4564-9264-A9E01313D6AE}\RP226\A0077037.exe tagged as not-a-virus:AdWare.Win32.SaveNow.ag. No Action Taken.
File D:\System Volume Information\_restore{578D9108-E629-4564-9264-A9E01313D6AE}\RP226\A0078209.scr infected by "Trojan-Downloader.Win32.Banload.eky" Virus. Action Taken: File to be deleted on reboot.
File D:\System Volume Information\_restore{578D9108-E629-4564-9264-A9E01313D6AE}\RP266\A0087386.exe tagged as not-a-virus:AdWare.Win32.OneStep.c. No Action Taken.
File D:\System Volume Information\_restore{8D41684B-F365-4A5A-B04B-C4BEAA140313}\RP33\A0014464.exe infected by "Backdoor.Win32.Pakes" Virus. Action Taken: File to be renamed on reboot.
File D:\System Volume Information\_restore{8D41684B-F365-4A5A-B04B-C4BEAA140313}\RP33\A0014465.exe tagged as not-a-virus:AdTool.Win32.WhenU.a. No Action Taken.
File D:\System Volume Information\_restore{8D41684B-F365-4A5A-B04B-C4BEAA140313}\RP33\A0014467.exe infected by "Backdoor.Win32.Pakes" Virus. Action Taken: File to be renamed on reboot.
File D:\WINDOWS\system32\drivers\hldrrr.exe infected by "Trojan-Downloader.Win32.Bagle.hi" Virus. Action Taken: File to be deleted on reboot.
File D:\WINDOWS\system32\drivers\srosa.sys infected by "Trojan-Downloader.Win32.Bagle.hu" Virus. Action Taken: File to be deleted on reboot.
File D:\WINDOWS\system32\wintems.exe infected by "Trojan-Downloader.Win32.Bagle.ho" Virus. Action Taken: File to be deleted on reboot.
File D:\WINDOWS\Temp\NN_7.tmp\upgrade.exe tagged as not-a-virus:AdWare.Win32.NewDotNet.l. No Action Taken.
File H:\ohjelmat\sälää\kansiot\tekstinmuokkaus\ss2r2.exe tagged as not-a-virus:AdWare.Win32.SaveNow.ag. No Action Taken.
File H:\System Volume Information\_restore{578D9108-E629-4564-9264-A9E01313D6AE}\RP229\A0078767.EXE infected by "Trojan.Win32.Inject.ba" Virus. Action Taken: File to be deleted on reboot.
File H:\System Volume Information\_restore{578D9108-E629-4564-9264-A9E01313D6AE}\RP266\A0087325.exe infected by "Trojan-Downloader.Win32.Bagle.hi" Virus. Action Taken: File to be deleted on reboot.
File H:\System Volume Information\_restore{8D41684B-F365-4A5A-B04B-C4BEAA140313}\RP17\A0003281.exe infected by "Trojan-Downloader.Win32.Bagle.hi" Virus. Action Taken: File Deleted.
File H:\System Volume Information\_restore{8D41684B-F365-4A5A-B04B-C4BEAA140313}\RP33\A0014463.exe infected by "Trojan-Downloader.Win32.Bagle.hi" Virus. Action Taken: File Deleted.
File H:\System Volume Information\_restore{8D41684B-F365-4A5A-B04B-C4BEAA140313}\RP7\A0001507.exe infected by "Trojan-Downloader.Win32.Bagle.hi" Virus. Action Taken: File Deleted.
File H:\torrent\vasta tulleet\paskalava\Style XP 3.19 [Serial].zip infected by "Trojan-Downloader.Win32.Bagle.hi" Virus. Action Taken: File Deleted.
File H:\torrent\vasta tulleet\paskalava\tiedostot\Toolbar Icon Set 2007.2 Key+Serial.zip infected by "Trojan-Downloader.Win32.Bagle.hi" Virus. Action Taken: File Deleted.
File H:\torrent\vasta tulleet\paskalava\Uusi kansio\Style XP 3.19 [Serial].zip infected by "Trojan-Downloader.Win32.Bagle.hh" Virus. Action Taken: File Deleted.

 

Lataa SmitfraudFix (c) S!Ri
Pura sisältö (kansio nimeltä SmitfraudFix) työpöydällesi:

Avaa SmitfraudFix kansio ja tupla-klikkaa smitfraudfix.cmd
Valitse optio #1 - Search kirjoittamalla 1 ja painamalla "Enter"; tekstitiedosto avautuu, joka listaa tarttuneet tiedostot (jos olemassa).
Postita tämän tekstitiedoston sisältö viestiketjuusi.

Huomaa : process.exe filun tunnistaa jotkut Anti-virus ohjelmat (AntiVir, Dr.Web, Kaspersky) "Haittakaluna"; se ei ole virus, vaan ohjelma joka pysäyttää prosesseja. A/V ohjelmat eivät pysty tunnistamaan hyvän ja pahan käytön tälläisten ohjelmian väliltä, silloin ne saattavat varoittaa käyttäjää.

=============

Lataa SDFix by AndyManchesta ja tallenna se työpöydällesi.

Käynnistä koneesi vikasietotilaan:

sammuta ja käynnistä
käynnistyksen yhteydessä hakkaa F8 nappia
valitse nuolinäppäimellä vikasietotila
paina enter ja enter
valitse käyttäjätilisi
paina kyllä

Jossakin koneissa hakataan F8:sin sijasta F5:tä

" Kun vikasietotilassa, pura tiedoston SDFix.zip sisältö (SDFix kansio) työpöydällesi. Työpöydälle pitäisi ilmestyä kansio nimeltä SDFix.
" Avaa SDFix-kansio ja tuplaklikkaa tiedostoa RunThis.bat käynnistääksesi ohjelman.
" Paina Y käynnistääksesi skriptin.
" Työkalu puhdistaa troijalaisen palvelut ja tekee myös joitakin korjauksia rekisteriin. Lopuksi se pyytää käynnistämään koneen uudelleen, "Press any key to Reboot".
" Paina mitä tahansa näppäintä ja kone käynnistyy uudelleen.
" Käynnistyminen kestää normaalia kauemmin sillä SDFix puhdistaa konetta.
" Kun kone on käynnistynyt ja työpöytä latautunut, SDFix kertoo että puhdistus on suoritettu, "Finished".
" Paina sitten mitä tahansa näppäintä sulkeaksesi skriptin ja ladataksesi pikakuvakkeet työpöydälle.
" Lopuksi avaa SDFix kansio (työpöydällä) ja kopioi & liitä tiedoston Report.txt sisältö viestiketjuusi uuden HijackThis:n lokin kera.

========

Ohje AVG:n Anti-Spyware 7.5:n käyttöön
Huom! Tässä ohjeessa sammutetaan tuo reaaliaikasuojaus (Shield). Näin vältetään tilanteet joissa suojaus estäisi esim HijackThis:n työkalun toimintaa.

Tallenna nämä ohjeet tekstitiedostoon tai tulosta nämä, muuten et pääse niihin käsiksi vikasietotilasta

Lataa AVG:n Anti-Spyware 7.5:n
ja tallenna ohjelma työpöydällesi.
o Kun olet ladannut ohjelman, kaksoisklikkaa asennuohjelman pikakuvaketta työpöydälläsi, asennus alkaa.
o Asennuksen jälkeen täytyy ohjelma käynnistää ja sen tunnisteet päivittää.
o Käynnistä AVG:n Anti-Spyware.
o Klikkaa "Update" kuvaketta päävalikossa. Sen jälkeen klikkaa "Update now" painiketta.

o Sitten klikkaa "Start Update" kuvaketta jolloin päivitys alkaa.

o Kun päivitykset on ladattu, klikkaa "Scanner" kuvaketta ikkunan ylälaidassa. Valitse sitten "Settings" välilehti.
o Kun "Settings" valikko on auennut, klikkaa "Recommended actions" ja sitten valitse "Quarantine".

o Sitten "Reports" valikon alta:
o Laita täppi kohtaan "Automatically generate report after every scan"
o Ota täppi pois kohdasta"Only if threats were found"

o Sitten klikkaa "Shield" kuvaketta ikkunan ylälaidassa
o "Resident shield is", muuta tila active:sta inactive:ksi
o Sulje ohjelma, ÄLÄ skannaa vielä.

Käynnistä koneesi vikasietotilaan,
sammuta ja käynnistä
käynnistyksen yhteydessä naputtele F8
valitse nuoli näppäimellä vikasietotila
paina enter ja enter

Toisissa koneissa paukutetaan F8:sin sijasta F5:tä

HUOM! Älä käytä muita ohjelmia AVG:n skannauksen aikana, tämä saattaa häiritä skannausta.
o Kun vikasietotilassa, käynnistä AVG:n Anti-Spyware.
o Klikkaa "Scanner" kuvaketta ikkunan ylälaidassa ja valitse "Scan" välilehti. Sitten klikkaa "Complete System Scan".
o Ewido aloittaa nyt tietokoneen skannaamisen, ole kärsivällinen sillä skannaus vie aikaa.

Kun skannaus on valmis:
TÄRKEÄÄ : Älä klikkaa "Save Scan Report" ennen kuin klikkaat "Apply all Actions"
o Varmistu, että Set all elements to: näyttää Quarantine (1), jos ei, klikkaa linkkiä ja valitse Quarantine popup-valikosta.
o Sinulta kysytään mitä tehdä jos infektioita löytyi, valitse silloin "Apply all actions"

o Sitten klikkaa "Reports" kuvaketta ohjelma yläosasta.
o Klikkaa "Save report as" painiketta ikkunan vasemmassa alalaidassa ja tallenna raportti työpöydälle.
o Sulje ohjelma, käynnistä kone normaalisti ja lähetä AVG:n raportti viestikejuusi.

=============

1.Lataa combofix.exe työpöydällesi jommastakummasta linkistä:
combofix1
combofix2

2. Tuplaklikkaa combofix.exe tiedostoa ja seuraa ohjeistuksia.
3. Kun työkalu on valmis, se tuottaa lokin. Lähetä tämä loki viesti ketjuusi.
Huom! Älä klikkaile combofixin ikkunaa käytön aikana. Tämä saattaa aiheuttaa ohjelman jumiutumisen.

 

SmitFraudFix v2.288

Scan done at 20:35:02,39, to 14.02.2008
Run from C:\Documents and Settings\NiCoReTTe\Ty”p”yt„\SmitfraudFix
OS: Microsoft Windows XP [versio 5.1.2600] - Windows_NT
The filesystem type is NTFS
Fix run in normal mode

»»»»»»»»»»»»»»»»»»»»»»»» Process

C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\QuickTime\qttask.exe
H:\i Tunes\iTunesHelper.exe
C:\Program Files\Analog Devices\SoundMAX\SMax4PNP.exe
C:\Program Files\Analog Devices\SoundMAX\smax4.exe
C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\MSN Messenger\MsnMsgr.Exe
C:\Program Files\DNA\btdna.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\DAEMON Tools\daemon.exe
C:\Program Files\WinZip\WZQKPICK.EXE
C:\Program Files\COMODO\Firewall\cmdagent.exe
C:\WINDOWS\system32\tcpsvcs.exe
C:\WINDOWS\system32\msiexec.exe
C:\WINDOWS\System32\snmp.exe
C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\dllhost.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\WINDOWS\system32\dllhost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\COMODO\Firewall\cfpconfg.exe
C:\Program Files\Mozilla Firefox 3 Beta 3\firefox.exe
C:\WINDOWS\system32\cmd.exe

»»»»»»»»»»»»»»»»»»»»»»»» hosts


»»»»»»»»»»»»»»»»»»»»»»»» C:\


»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS


»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\system


»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\Web


»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\system32


»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\system32\LogFiles


»»»»»»»»»»»»»»»»»»»»»»»» C:\Documents and Settings\NiCoReTTe


»»»»»»»»»»»»»»»»»»»»»»»» C:\Documents and Settings\NiCoReTTe\Application Data


»»»»»»»»»»»»»»»»»»»»»»»» Start Menu


»»»»»»»»»»»»»»»»»»»»»»»»


»»»»»»»»»»»»»»»»»»»»»»»» Desktop


»»»»»»»»»»»»»»»»»»»»»»»» C:\Program Files


»»»»»»»»»»»»»»»»»»»»»»»» Corrupted keys


»»»»»»»»»»»»»»»»»»»»»»»» Desktop Components

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Desktop\Components\0]
"Source"="About:Home"
"SubscribedURL"="About:Home"
"FriendlyName"="Nykyinen kotisivu"


»»»»»»»»»»»»»»»»»»»»»»»» IEDFix
!!!Attention, following keys are not inevitably infected!!!

IEDFix
Credits: Malware Analysis & Diagnostic
Code: S!Ri


»»»»»»»»»»»»»»»»»»»»»»»» VACFix
!!!Attention, following keys are not inevitably infected!!!

VACFix
Credits: Malware Analysis & Diagnostic
Code: S!Ri


»»»»»»»»»»»»»»»»»»»»»»»» Sharedtaskscheduler
!!!Attention, following keys are not inevitably infected!!!

SrchSTS.exe by S!Ri
Search SharedTaskScheduler's .dll


»»»»»»»»»»»»»»»»»»»»»»»» AppInit_DLLs
!!!Attention, following keys are not inevitably infected!!!

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
"AppInit_DLLs"=" C:\\WINDOWS\\system32\\guard32.dll"
"LoadAppInit_DLLs"=dword:00000001


»»»»»»»»»»»»»»»»»»»»»»»» Winlogon.System
!!!Attention, following keys are not inevitably infected!!!

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon]
"System"=""


»»»»»»»»»»»»»»»»»»»»»»»» Rustock



»»»»»»»»»»»»»»»»»»»»»»»» DNS

Description: Intel(R) PRO/1000 CT Network Connection - Paketinajoituksen miniportti
DNS Server Search Order: 192.168.0.254

HKLM\SYSTEM\CCS\Services\Tcpip\..\{846574C3-AB94-4E62-A35A-AD1D739D533A}: DhcpNameServer=192.168.0.254
HKLM\SYSTEM\CS1\Services\Tcpip\..\{846574C3-AB94-4E62-A35A-AD1D739D533A}: DhcpNameServer=192.168.0.254
HKLM\SYSTEM\CS2\Services\Tcpip\..\{846574C3-AB94-4E62-A35A-AD1D739D533A}: DhcpNameServer=192.168.0.254
HKLM\SYSTEM\CCS\Services\Tcpip\Parameters: DhcpNameServer=192.168.0.254
HKLM\SYSTEM\CS1\Services\Tcpip\Parameters: DhcpNameServer=192.168.0.254
HKLM\SYSTEM\CS2\Services\Tcpip\Parameters: DhcpNameServer=192.168.0.254


»»»»»»»»»»»»»»»»»»»»»»»» Scanning for wininet.dll infection


»»»»»»»»»»»»»»»»»»»»»»»» End

 

Printtaa ohjeet ulos

Käynnistä koneesi vikasietotilaan ja valitse tavallinen käyttäjätilisi.

Vikasietotilaan:

sammuta ja käynnistä
käynnistyksen yhteydessä hakkaa F8 nappia
valitse nuolinäppäimellä vikasietotila
paina enter ja enter
valitse käyttäjätilisi
paina kyllä

Jossakin koneissa hakataan F8:sin sijasta F5:tä

Kun vikasietotilassa, avaa SmitfraudFix kansio ja tupla-klikkaa smitfraudfix.cmd
Valitse optio #2 - Clean kirjoittamalla 2 ja painamalla "Enter" poistaaksesi tarttuneet tiedostot.

Sinulta kysytään: "Registry cleaning - Do you want to clean the registry ?"; vastaa "Yes" kirjoittamalla Y ja paina "Enter" poistaaksesi työpöydän taustakuvan ja puhdistaaksesi tarttuneet rekisteriavaimet.

Työkalu tarkistaa jos wininet.dll on tarttunut. Sinua saatetaan pyytää korvaamaan tarttunut .dll (jos löytyy); vastaa "Yes" kirjoittamalla Y ja painamalla "Enter".

Työkalun saattaa tarvita käynnistää kone uudelleen; jos ei tee niin, käynnistä normaaliin Windowsiin.
Tekstitiedosto ilmestyy, puhdistusprosessin jäljiltä; kopioi & liitä tämän raportin tulokset vastaukseesi.
Raportti löytyy paikalliselta levyltäsi, useimmiten C:\rapport.txt.

Varoitus : Ajamalla optio 2:n EI-tarttuneessa tietokoneessa, poistaa sinun työpöytäsi taustakuvan.

==========

sitten vain listaa alas päin

 

HijackThis:

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 23:21:50, on 14.2.2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\QuickTime\qttask.exe
H:\i Tunes\iTunesHelper.exe
C:\Program Files\Analog Devices\SoundMAX\SMax4PNP.exe
C:\Program Files\Analog Devices\SoundMAX\smax4.exe
C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
C:\Program Files\COMODO\Firewall\cfp.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\MSN Messenger\MsnMsgr.Exe
C:\Program Files\DNA\btdna.exe
C:\Program Files\TGTSoft\StyleXP\StyleXP.exe
C:\Program Files\DAEMON Tools\daemon.exe
C:\Program Files\WinZip\WZQKPICK.EXE
C:\Program Files\COMODO\Firewall\cmdagent.exe
C:\WINDOWS\system32\tcpsvcs.exe
C:\WINDOWS\system32\msiexec.exe
C:\WINDOWS\System32\snmp.exe
C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\dllhost.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\WINDOWS\system32\dllhost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\explorer.exe
C:\WINDOWS\NOTEPAD.EXE
C:\Program Files\Mozilla Firefox 3 Beta 3\firefox.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Linkit
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: TGTSoft Explorer Toolbar Changer - {C333CF63-767F-4831-94AC-E683D962C63C} - C:\Program Files\TGTSoft\StyleXP\TGT_BHO.dll
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [Ptipbmf] rundll32.exe ptipbmf.dll,SetWriteCacheMode
O4 - HKLM\..\Run: [iTunesHelper] "H:\i Tunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [SoundMAXPnP] C:\Program Files\Analog Devices\SoundMAX\SMax4PNP.exe
O4 - HKLM\..\Run: [SoundMAX] "C:\Program Files\Analog Devices\SoundMAX\smax4.exe" /tray
O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O4 - HKLM\..\Run: [COMODO Firewall Pro] "C:\Program Files\COMODO\Firewall\cfp.exe" -h
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [BitTorrent DNA] "C:\Program Files\DNA\btdna.exe"
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [STYLEXP] C:\Program Files\TGTSoft\StyleXP\StyleXP.exe -Hide
O4 - HKCU\..\Run: [DAEMON Tools] "C:\Program Files\DAEMON Tools\daemon.exe" -lang 1033
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Paikallinen palve')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Verkkopalve')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O4 - Global Startup: WinZip Quick Pick.lnk = C:\Program Files\WinZip\WZQKPICK.EXE
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://www.update.microsoft.com/mic...ls/en/x86/client/muweb_site.cab?1202406414718
O20 - AppInit_DLLs: C:\WINDOWS\system32\guard32.dll
O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: COMODO Firewall Pro Helper Service (cmdAgent) - COMODO - C:\Program Files\COMODO\Firewall\cmdagent.exe
O23 - Service: F-Secure BackWeb LAN Access - Unknown owner - e:\program files\BackWeb\7681197\Program\fsbwlan.exe
O23 - Service: F-Secure Network Request Broker - F-Secure Corporation - e:\program files\Common\FNRB32.EXE
O23 - Service: F-Secure Authentication Agent (FSAA) - F-Secure Corporation. All Rights Reserved. - e:\program files\Common\FSAA.EXE
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPod-palvelu (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Intel NCS NetService (NetSvc) - Intel(R) Corporation - C:\Program Files\Intel\NCS\Sync\NetSvc.exe
O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe

--
End of file - 5492 bytes

SFF:

SmitFraudFix v2.288

Scan done at 23:15:22,06, to 14.02.2008
Run from C:\Documents and Settings\NiCoReTTe\Ty”p”yt„\SmitfraudFix
OS: Microsoft Windows XP [versio 5.1.2600] - Windows_NT
The filesystem type is NTFS
Fix run in normal mode

»»»»»»»»»»»»»»»»»»»»»»»» SharedTaskScheduler Before SmitFraudFix
!!!Attention, following keys are not inevitably infected!!!

SrchSTS.exe by S!Ri
Search SharedTaskScheduler's .dll

»»»»»»»»»»»»»»»»»»»»»»»» Killing process


»»»»»»»»»»»»»»»»»»»»»»»» hosts


127.0.0.1 localhost

»»»»»»»»»»»»»»»»»»»»»»»» VACFix

VACFix
Credits: Malware Analysis & Diagnostic
Code: S!Ri


»»»»»»»»»»»»»»»»»»»»»»»» Winsock2 Fix

S!Ri's WS2Fix: LSP not Found.


»»»»»»»»»»»»»»»»»»»»»»»» Generic Renos Fix

GenericRenosFix by S!Ri


»»»»»»»»»»»»»»»»»»»»»»»» Deleting infected files


»»»»»»»»»»»»»»»»»»»»»»»» IEDFix

IEDFix
Credits: Malware Analysis & Diagnostic
Code: S!Ri


»»»»»»»»»»»»»»»»»»»»»»»» DNS

Description: Intel(R) PRO/1000 CT Network Connection - Paketinajoituksen miniportti
DNS Server Search Order: 192.168.0.254

HKLM\SYSTEM\CCS\Services\Tcpip\..\{846574C3-AB94-4E62-A35A-AD1D739D533A}: DhcpNameServer=192.168.0.254
HKLM\SYSTEM\CS1\Services\Tcpip\..\{846574C3-AB94-4E62-A35A-AD1D739D533A}: DhcpNameServer=192.168.0.254
HKLM\SYSTEM\CS2\Services\Tcpip\..\{846574C3-AB94-4E62-A35A-AD1D739D533A}: DhcpNameServer=192.168.0.254
HKLM\SYSTEM\CCS\Services\Tcpip\Parameters: DhcpNameServer=192.168.0.254
HKLM\SYSTEM\CS1\Services\Tcpip\Parameters: DhcpNameServer=192.168.0.254
HKLM\SYSTEM\CS2\Services\Tcpip\Parameters: DhcpNameServer=192.168.0.254


»»»»»»»»»»»»»»»»»»»»»»»» Deleting Temp Files


»»»»»»»»»»»»»»»»»»»»»»»» Winlogon.System
!!!Attention, following keys are not inevitably infected!!!

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon]
"System"=""


»»»»»»»»»»»»»»»»»»»»»»»» Registry Cleaning

Registry Cleaning done.

»»»»»»»»»»»»»»»»»»»»»»»» SharedTaskScheduler After SmitFraudFix
!!!Attention, following keys are not inevitably infected!!!

SrchSTS.exe by S!Ri
Search SharedTaskScheduler's .dll


»»»»»»»»»»»»»»»»»»»»»»»» End

 

ok ... onkos toi AVG:n Anti-Spyware 7.5:n menty tuolla vikasiedossa lävitse.

 

tässäpä tän AVG:n tulokset

---------------------------------------------------------
AVG Anti-Spyware - Scan Report
---------------------------------------------------------

+ Created at: 0:53:21 15.2.2008

+ Scan result:



D:\System Volume Information\_restore{8D41684B-F365-4A5A-B04B-C4BEAA140313}\RP34\A0016326.exe -> Downloader.Bagle.ho : Cleaned with backup (quarantined).
C:\Documents and Settings\NiCoReTTe\Cookies\nicorette@advertising[2].txt -> TrackingCookie.Advertising : Cleaned.
C:\Documents and Settings\NiCoReTTe\Cookies\nicorette@atdmt[2].txt -> TrackingCookie.Atdmt : Cleaned.
C:\Documents and Settings\NiCoReTTe\Cookies\nicorette@statistik-gallup[1].txt -> TrackingCookie.Statistik-gallup : Cleaned.


::Report end

 

Nyt ei nolota enään vai

1. Klikkaa käynnistä > Oma tietokone oikean puoleisella hiiren napilla
2. Valitse ominaisuudet
3. Valitse järjestelmän palauttaminen välilehti
4. Ruksi eteen ¤ poista järjestelmän palauttaminen kaikissa asemissa
5. Paina Käytä
6. Paina ok
7. Sammuta ja käynnistä
8. Ota ruksi pois ¤ poista järjestelmän palauttaminen kaikissa asemissa
9. Käytä ja OK

=============

scannaa uusi hjt:n loki

 

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 8:40:09, on 15.2.2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\QuickTime\qttask.exe
H:\i Tunes\iTunesHelper.exe
C:\Program Files\Analog Devices\SoundMAX\SMax4PNP.exe
C:\Program Files\Analog Devices\SoundMAX\smax4.exe
C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
C:\Program Files\COMODO\Firewall\cfp.exe
E:\program files\Common\FSM32.EXE
E:\program files\FSGUI\TNBUtil.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\MSN Messenger\MsnMsgr.Exe
C:\Program Files\DNA\btdna.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\TGTSoft\StyleXP\StyleXP.exe
C:\Program Files\DAEMON Tools\daemon.exe
C:\Program Files\WinZip\WZQKPICK.EXE
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\Program Files\COMODO\Firewall\cmdagent.exe
e:\program files\Anti-Virus\fsgk32st.exe
e:\program files\Anti-Virus\FSGK32.EXE
C:\WINDOWS\system32\tcpsvcs.exe
C:\WINDOWS\System32\snmp.exe
C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\dllhost.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\WINDOWS\system32\dllhost.exe
e:\program files\Anti-Virus\fssm32.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Mozilla Firefox 3 Beta 3\firefox.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Linkit
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: TGTSoft Explorer Toolbar Changer - {C333CF63-767F-4831-94AC-E683D962C63C} - C:\Program Files\TGTSoft\StyleXP\TGT_BHO.dll
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [Ptipbmf] rundll32.exe ptipbmf.dll,SetWriteCacheMode
O4 - HKLM\..\Run: [iTunesHelper] "H:\i Tunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [SoundMAXPnP] C:\Program Files\Analog Devices\SoundMAX\SMax4PNP.exe
O4 - HKLM\..\Run: [SoundMAX] "C:\Program Files\Analog Devices\SoundMAX\smax4.exe" /tray
O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [COMODO Firewall Pro] "C:\Program Files\COMODO\Firewall\cfp.exe" -h
O4 - HKLM\..\Run: [F-Secure Manager] "e:\program files\Common\FSM32.EXE" /splash
O4 - HKLM\..\Run: [F-Secure TNB] "e:\program files\FSGUI\TNBUtil.exe" /CHECKALL /WAITFORSW
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [BitTorrent DNA] "C:\Program Files\DNA\btdna.exe"
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [STYLEXP] C:\Program Files\TGTSoft\StyleXP\StyleXP.exe -Hide
O4 - HKCU\..\Run: [DAEMON Tools] "C:\Program Files\DAEMON Tools\daemon.exe" -lang 1033
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Paikallinen palve')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Verkkopalve')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O4 - Global Startup: WinZip Quick Pick.lnk = C:\Program Files\WinZip\WZQKPICK.EXE
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://www.update.microsoft.com/mic...ls/en/x86/client/muweb_site.cab?1202406414718
O20 - AppInit_DLLs: C:\WINDOWS\system32\guard32.dll
O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: COMODO Firewall Pro Helper Service (cmdAgent) - COMODO - C:\Program Files\COMODO\Firewall\cmdagent.exe
O23 - Service: F-Secure BackWeb LAN Access - Unknown owner - e:\program files\BackWeb\7681197\Program\fsbwlan.exe
O23 - Service: FSGKHS (F-Secure Gatekeeper Handler Starter) - F-Secure Corporation - e:\program files\Anti-Virus\fsgk32st.exe
O23 - Service: F-Secure Network Request Broker - F-Secure Corporation - e:\program files\Common\FNRB32.EXE
O23 - Service: F-Secure Automatic Update Agent (FSAUA) - F-Secure Corporation - e:\program files\FSAUA\program\fsaua.exe
O23 - Service: F-Secure Anti-Virus Firewall Daemon (FSDFWD) - F-Secure Corporation - e:\program files\FWES\Program\fsdfwd.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPod-palvelu (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Intel NCS NetService (NetSvc) - Intel(R) Corporation - C:\Program Files\Intel\NCS\Sync\NetSvc.exe
O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe

--
End of file - 6206 bytes

 

Lataa tuolta http://www.ccleaner.com/download/builds.aspx
CCleaner v2.03.532- Standard Build, ÄLÄ aseenna Yahoo toolbaria!

laita asetukset näin:
Valinnat --> Lisäasetukset --> Ota ruksi pois kohdasta Poista vain yli 48 tuntia vanhat tilapäistiedostot.

aja Puhdistaja > tutki nappi > aja ccleaner nappi oikea alakulma
aja Virheet > etsi rekisteri virheitä nappi > Korjaa rekisteri virheet. nappi

==========

Lataa: RegSeeker.zip työpöydälle:

Pura zip C:\RegSeeker\ kansioon. Sieltä käynnistät RegSeeker.exe ohjelman.
Oikeasa yläkulmassa on Languages.... linkki, josta valitset Suomenkielen.
Vasemmasta alakulmasta ruksit Luo vrmuuskopio ja sitten linkki Puhdista rekisteri
Ruksit kaikkiin muihin kohtiin paitsi "Käyttökelvottomat.." sitten "OK" (odotat hetken).
Ruutuun ilmestyy lista epäkelvoista rekisterimerkinnöistä, jotka alapalkista Valitse kohdasta
klikkaat Valitse kaikki jolloin valitut saavat keltaisen pohjavärin.
Alapalkin Toiminnot linkistä klikkaat Poista valitut kohteet
Ponnahdusikkunaan "Kaikki valitut kohteet poistetaan ? vastaat "OK".
Seuraavaan Ponnahdusikkunaan "Varmuuskopiot" vastaat "OK".
Klikaa vasemmalta Lopeta RegSeeker ja käynnistä koneesi uudelleen.

========

laita tuo combofix loki ja uusi hjt:n loki

 

ComboFix 08-02-15.1 - NiCoReTTe 2008-02-17 22:05:21.2 - NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1035.18.671 [GMT 2:00]
Running from: C:\Documents and Settings\NiCoReTTe\Työpöytä\ComboFix.exe

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.
The following files were disabled during the run:
C:\WINDOWS\system32\guard32.dll


((((( Tiedostot, jotka on luotu seuraavalla aikavälillä: 2008-01-17 to 2008-02-17 )))))))))))))))))
.

2008-02-17 21:50 . 2008-02-17 21:50 <KANSIO> d-------- C:\RegSeeker
2008-02-17 21:41 . 2008-02-17 21:43 <KANSIO> d-------- C:\Program Files\CCleaner
2008-02-15 02:29 . 2008-02-15 02:29 <KANSIO> d-------- C:\Program Files\MSXML 4.0
2008-02-15 01:44 . 2008-02-15 01:44 <KANSIO> d-------- C:\Documents and Settings\All Users.WINDOWS\Application Data\F-Secure
2008-02-15 01:39 . 2008-02-15 01:41 <KANSIO> d-------- C:\Documents and Settings\All Users.WINDOWS\Application Data\fssg
2008-02-15 01:33 . 2005-06-28 10:21 22,752 --a------ C:\WINDOWS\system32\spupdsvc.exe
2008-02-14 23:32 . 2008-02-14 23:32 <KANSIO> d-------- C:\Documents and Settings\NiCoReTTe\Application Data\Grisoft
2008-02-14 23:32 . 2008-02-14 23:32 <KANSIO> d-------- C:\Documents and Settings\All Users.WINDOWS\Application Data\Grisoft
2008-02-14 23:32 . 2007-05-30 14:10 10,872 --a------ C:\WINDOWS\system32\drivers\AvgAsCln.sys
2008-02-14 20:35 . 2008-02-14 23:15 2,590 --a------ C:\WINDOWS\system32\tmp.reg
2008-02-14 20:07 . 2008-02-14 20:17 <KANSIO> d-------- C:\escheck
2008-02-14 19:12 . 2008-02-14 19:12 0 --a------ C:\23990098.$$$
2008-02-13 22:56 . 2008-02-17 22:03 <KANSIO> d-------- C:\Program Files\Mozilla Firefox 3 Beta 3
2008-02-13 22:36 . 2008-02-13 22:55 <KANSIO> d-------- C:\Downloads
2008-02-13 22:36 . 2008-02-13 22:54 <KANSIO> d-------- C:\Bases
2008-02-13 22:35 . 2008-02-13 23:16 <KANSIO> d-------- C:\kaspersky
2008-02-12 22:15 . 2008-02-12 22:25 <KANSIO> d-------- C:\Uusi kansio
2008-02-12 07:54 . 2008-02-12 07:54 <KANSIO> d-------- C:\Program Files\COMODO
2008-02-12 07:54 . 2008-02-12 07:54 <KANSIO> d-------- C:\Documents and Settings\NiCoReTTe\Application Data\Comodo
2008-02-12 07:54 . 2008-02-12 07:58 <KANSIO> d-------- C:\Documents and Settings\All Users.WINDOWS\Application Data\comodo
2008-02-12 07:54 . 2008-02-13 22:18 139,008 --a------ C:\WINDOWS\system32\guard32.dll.vir
2008-02-12 07:54 . 2008-02-13 22:18 83,704 --a------ C:\WINDOWS\system32\drivers\cmdGuard.sys
2008-02-12 07:54 . 2008-02-13 22:18 23,800 --a------ C:\WINDOWS\system32\drivers\cmdhlp.sys
2008-02-12 07:51 . 2008-02-12 07:52 15,079,680 --a------ C:\Program Files\CFP_Setup_3.0.16.295_XP_Vista_x32.exe
2008-02-11 21:22 . 2005-06-30 23:01 <KANSIO> d-------- C:\Program Files\F.Secure Anti.Virus Client Security v5.56.Build.11160.Final+crack=
2008-02-11 17:31 . 2008-02-11 17:31 <KANSIO> d-------- C:\Program Files\Opera 9.5 beta
2008-02-11 16:36 . 2007-07-30 19:19 271,224 --a------ C:\WINDOWS\system32\mucltui.dll
2008-02-11 16:36 . 2007-07-30 19:18 30,072 --a------ C:\WINDOWS\system32\mucltui.dll.mui
2008-02-10 23:00 . 2008-02-10 23:00 0 --a------ C:\WINDOWS\Irremote.ini
2008-02-10 22:39 . 2008-02-10 22:39 <KANSIO> d-------- C:\Documents and Settings\NiCoReTTe\Application Data\Nero
2008-02-10 22:37 . 2008-02-10 22:37 <KANSIO> d-------- C:\Program Files\Nero
2008-02-10 22:37 . 2008-02-15 18:48 <KANSIO> d-------- C:\Program Files\Common Files\Nero
2008-02-10 22:37 . 2008-02-15 18:45 <KANSIO> d-------- C:\Documents and Settings\All Users.WINDOWS\Application Data\Nero
2008-02-10 20:11 . 2008-02-10 20:11 335 --a------ C:\WINDOWS\mozregistry.dat
2008-02-10 16:17 . 2008-02-10 16:17 <KANSIO> d-------- C:\Documents and Settings\NiCoReTTe\Application Data\Vso
2008-02-10 15:46 . 2008-02-10 15:47 <KANSIO> d-------- C:\Program Files\DAEMON Tools
2008-02-07 19:21 . 2008-02-17 22:01 <KANSIO> d-------- C:\WINDOWS\system32\NtmsData
2008-02-05 19:33 . 2008-02-05 19:33 244 --ah----- C:\sqmnoopt03.sqm
2008-02-05 19:33 . 2008-02-05 19:33 232 --ah----- C:\sqmdata03.sqm
2008-02-03 17:08 . 2008-02-03 17:08 244 --ah----- C:\sqmnoopt02.sqm
2008-02-03 17:08 . 2008-02-03 17:08 232 --ah----- C:\sqmdata02.sqm
2008-01-27 19:51 . 2008-01-27 19:51 <KANSIO> d-------- C:\Documents and Settings\All Users.WINDOWS\Application Data\SBT
2008-01-27 19:50 . 2008-01-27 19:50 <KANSIO> d-------- C:\Program Files\Snapshot Viewer
2008-01-27 19:46 . 2008-01-27 19:46 <KANSIO> d-------- C:\Program Files\Common Files\Wise Installation Wizard
2008-01-27 19:46 . 2008-01-27 19:47 <KANSIO> d-------- C:\Documents and Settings\All Users.WINDOWS\Application Data\Lavasoft
2008-01-27 18:55 . 2008-01-27 18:55 <KANSIO> d-------- C:\WINDOWS\system32\Samsung_USB_Drivers
2008-01-27 18:55 . 2008-01-27 18:55 <KANSIO> d-------- C:\WINDOWS\system32\Samsung PC Studio Codecs
2008-01-27 18:55 . 2008-01-27 18:55 <KANSIO> d-------- C:\Program Files\Samsung
2008-01-27 18:55 . 2006-03-21 15:49 2,729,472 --a------ C:\WINDOWS\system32\fun_avcodec.dll
2008-01-27 18:55 . 2006-04-18 16:32 684,032 --a------ C:\WINDOWS\system32\fun_mp4_enc.dll
2008-01-27 18:55 . 2006-04-25 16:29 675,840 --a------ C:\WINDOWS\system32\FunDecFilter.ax
2008-01-27 18:55 . 2006-04-25 16:30 532,480 --a------ C:\WINDOWS\system32\FunEncFilter.ax
2008-01-27 18:55 . 2003-02-21 18:42 348,160 --a------ C:\WINDOWS\system32\msvcr71.dll
2008-01-27 18:55 . 2006-04-24 13:46 77,824 --a------ C:\WINDOWS\system32\fun_mp4_dec.dll
2008-01-27 18:55 . 2005-08-28 20:51 766 --a------ C:\WINDOWS\system32\Uninstall.ico
2008-01-27 18:10 . 2008-01-27 19:46 <KANSIO> d-------- C:\Program Files\Lavasoft
2008-01-27 17:51 . 2008-01-27 17:51 <KANSIO> d-------- C:\Program Files\Promise
2008-01-27 17:51 . 2003-01-27 15:05 45,056 --a------ C:\WINDOWS\system32\ptistp.dll
2008-01-27 17:50 . 2008-02-11 16:51 <KANSIO> d-------- C:\Program Files\Trend Micro
2008-01-27 17:50 . 2008-01-27 17:50 <KANSIO> d-------- C:\Documents and Settings\NiCoReTTe\WINDOWS
2008-01-27 17:50 . 2008-01-27 17:50 127 --a------ C:\WINDOWS\_delis43.ini
2008-01-27 17:49 . 2008-01-27 17:49 <KANSIO> d-------- C:\Program Files\ASUS
2008-01-27 17:42 . 2008-01-27 17:42 <KANSIO> d-------- C:\WINDOWS\Internet Logs
2008-01-27 17:42 . 2008-01-27 17:42 <KANSIO> d-------- C:\Program Files\Zone Labs
2008-01-27 17:35 . 2007-02-28 18:02 2,138,624 --a------ C:\WINDOWS\system32\ntoskrnl.exe
2008-01-27 17:35 . 2007-02-28 18:02 2,138,624 --a--c--- C:\WINDOWS\system32\dllcache\ntkrnlmp.exe
2008-01-27 16:58 . 2008-01-27 19:52 413 --a------ C:\WINDOWS\ODBC.INI
2008-01-27 16:51 . 2008-01-27 16:51 <KANSIO> d-------- C:\Documents and Settings\NiCoReTTe\Application Data\Microsoft Web Folders

.
(((((((((((((((((((((((((((((((((((( Find3M-raportti ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-02-17 19:59 --------- d-----w C:\Documents and Settings\NiCoReTTe\Application Data\DNA
2008-02-15 00:15 --------- d-----w C:\Documents and Settings\NiCoReTTe\Application Data\BitTorrent
2008-02-12 20:41 --------- d-----w C:\Documents and Settings\NiCoReTTe\Application Data\m
2008-02-10 14:17 --------- d-----w C:\Documents and Settings\NiCoReTTe\Application Data\Vso
2008-02-10 13:41 685,816 ----a-w C:\WINDOWS\system32\drivers\sptd.sys
2008-01-27 16:55 --------- d--h--w C:\Program Files\InstallShield Installation Information
2008-01-27 16:49 --------- d-----w C:\Program Files\Common Files\InstallShield
2008-01-09 17:35 --------- d-----w C:\Program Files\Common Files\Adobe
2008-01-08 15:09 --------- d-----w C:\Documents and Settings\All Users.WINDOWS\Application Data\DVD Shrink
2008-01-04 21:06 --------- d-----w C:\Program Files\ATI Technologies
2008-01-03 17:21 --------- d-----w C:\Documents and Settings\NiCoReTTe\Application Data\vlc
2008-01-03 16:48 --------- d-----w C:\Program Files\TGTSoft
2008-01-03 15:49 --------- d-----w C:\Program Files\DNA
2008-01-03 15:18 --------- d-----w C:\Documents and Settings\NiCoReTTe\Application Data\eMule
2008-01-03 15:16 --------- d-----w C:\Program Files\MSN Messenger
2008-01-03 14:43 --------- d-----w C:\Program Files\Analog Devices
2008-01-03 14:23 --------- d-----w C:\Documents and Settings\NiCoReTTe\Application Data\Apple Computer
2008-01-03 14:17 81,920 ------r C:\WINDOWS\bwUnin-6.1.4.55-7681197L.exe
2008-01-03 14:02 --------- d-----w C:\Program Files\Intel
2008-01-03 13:55 --------- d-----w C:\Program Files\QuickTime
2008-01-03 13:55 --------- d-----w C:\Program Files\iPod
2008-01-03 13:55 --------- d-----w C:\Documents and Settings\All Users.WINDOWS\Application Data\Apple Computer
2008-01-03 13:54 --------- d-----w C:\Program Files\Apple Software Update
2008-01-02 17:31 --------- d-----w C:\Program Files\microsoft frontpage
2007-12-18 09:51 179,584 ----a-w C:\WINDOWS\system32\drivers\mrxdav.sys
2007-12-14 09:32 12,632 ----a-w C:\WINDOWS\system32\lsdelete.exe
2007-12-13 17:09 972,072 ----a-w C:\WINDOWS\UNNeroMediaHome.exe
2007-12-07 02:14 824,832 ----a-w C:\WINDOWS\system32\wininet.dll
2007-12-04 18:41 550,912 ----a-w C:\WINDOWS\system32\oleaut32.dll
2007-12-04 07:59 972,072 ----a-w C:\WINDOWS\UNRecode.exe
2007-12-03 16:04 95,600 ----a-w C:\WINDOWS\system32\NeroCo.dll
2004-11-05 11:31 1,597,440 ----a-w C:\Documents and Settings\Kone\Application Data\SecureTraveler.exe
.

(((((((((((((((((((((((((((((( Rekisterin käynnistyskohteet )))))))))))))))))))))))))))))))))))))))))))))
.
.
REGEDIT4
*Huom* Tyhjiä arvoja ja laillisia oletusarvoja ei näytetä

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\ctfmon.exe" [2004-09-15 14:00 15360]
"MsnMsgr"="C:\Program Files\MSN Messenger\MsnMsgr.exe" [2007-01-19 12:55 5674352]
"BitTorrent DNA"="C:\Program Files\DNA\btdna.exe" [2008-02-12 07:48 287040]
"MSMSGS"="C:\Program Files\Messenger\msmsgs.exe" [2004-10-13 18:24 1694208]
"STYLEXP"="C:\Program Files\TGTSoft\StyleXP\StyleXP.exe" [2005-08-18 15:15 1359872]
"IndxStoreSvr_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="C:\Program Files\Common Files\Nero\Lib\NMIndexStoreSvr.exe" [2007-12-13 19:10 1688872]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2007-02-16 10:54 282624]
"Ptipbmf"="ptipbmf.dll" [2003-06-20 09:06 118784 C:\WINDOWS\system32\ptipbmf.dll]
"iTunesHelper"="H:\i Tunes\iTunesHelper.exe" [2007-03-14 19:05 257088]
"SoundMAXPnP"="C:\Program Files\Analog Devices\SoundMAX\SMax4PNP.exe" [2003-05-29 16:28 790528]
"SoundMAX"="C:\Program Files\Analog Devices\SoundMAX\smax4.exe" [2003-05-30 09:42 585728]
"ATIPTA"="C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe" [2003-06-05 12:35 335872]
"COMODO Firewall Pro"="C:\Program Files\COMODO\Firewall\cfp.exe" [2008-02-13 22:03 1500928]
"F-Secure Manager"="e:\program files\Common\FSM32.exe" [2008-02-15 01:42 172081]
"F-Secure TNB"="e:\program files\FSGUI\TNBUtil.exe" [2008-02-15 01:43 724992]
"NeroFilterCheck"="C:\Program Files\Common Files\Nero\Lib\NeroCheck.exe" [2007-03-01 14:57 153136]
"NBKeyScan"="C:\Program Files\Nero\Nero8\Nero BackItUp\NBKeyScan.exe" [2007-12-03 14:21 2213160]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2004-09-15 14:00 15360]

C:\Documents and Settings\All Users.WINDOWS\K„ynnist„-valikko\Ohjelmat\K„ynnistys\
Adobe Gamma Loader.lnk - C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [2008-01-09 19:36:07 113664]
Microsoft Office.lnk - C:\Program Files\Microsoft Office\Office\OSA9.EXE [2000-01-21 09:15:54 65588]
WinZip Quick Pick.lnk - C:\Program Files\WinZip\WZQKPICK.EXE [2008-02-11 21:31:13 118784]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"EnableLUA"= 0 (0x0)

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"AppInit_DLLs"= C:\WINDOWS\system32\guard32.dll

R1 cmdGuard;COMODO Firewall Pro Sandbox Driver;C:\WINDOWS\system32\DRIVERS\cmdguard.sys [2008-02-13 22:18]
R1 cmdHlp;COMODO Firewall Pro Helper Driver;C:\WINDOWS\system32\DRIVERS\cmdhlp.sys [2008-02-13 22:18]
R1 F-Secure HIPS;F-Secure HIPS;e:\program files\HIPS\fshs.sys [2008-02-15 01:43]
S4 PCC_PFW;PC-Cillin Personal Firewall;C:\WINDOWS\system32\Drivers\PCC_PFW.sys []

.
'Ajoitetut tehtävät'-kansion sisältö
"2008-01-21 12:23:00 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job"
- C:\Program Files\Apple Software Update\SoftwareUpdate.exe
.
**************************************************************************

catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-02-17 22:07:44
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
--------------------- DLLs Loaded Under Running Processes ---------------------

PROCESS: C:\WINDOWS\system32\winlogon.exe
-> C:\WINDOWS\system32\guard32.dll

PROCESS: C:\WINDOWS\system32\lsass.exe [5.01.2600.2180]
-> C:\WINDOWS\system32\guard32.dll
.
Completion time: 2008-02-17 22:08:47
ComboFix-quarantined-files.txt 2008-02-17 20:08:42
ComboFix2.txt 2008-02-14 23:29:36
.
2008-02-15 18:02:25 --- E O F ---


Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 22:12:38, on 17.2.2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16608)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\QuickTime\qttask.exe
H:\i Tunes\iTunesHelper.exe
C:\Program Files\Analog Devices\SoundMAX\SMax4PNP.exe
C:\Program Files\Analog Devices\SoundMAX\smax4.exe
C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
C:\Program Files\COMODO\Firewall\cfp.exe
E:\program files\Common\FSM32.EXE
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\MSN Messenger\MsnMsgr.Exe
C:\Program Files\DNA\btdna.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\Common Files\Nero\Lib\NMIndexStoreSvr.exe
C:\Program Files\WinZip\WZQKPICK.EXE
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\Program Files\COMODO\Firewall\cmdagent.exe
C:\WINDOWS\system32\tcpsvcs.exe
C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe
C:\WINDOWS\System32\snmp.exe
C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\dllhost.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Common Files\Nero\Lib\NMIndexingService.exe
C:\WINDOWS\system32\dllhost.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\explorer.exe
C:\Program Files\Mozilla Firefox 3 Beta 3\firefox.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Linkit
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file)
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: CoTGT_BHO Class - {C333CF63-767F-4831-94AC-E683D962C63C} - C:\Program Files\TGTSoft\StyleXP\TGT_BHO.dll
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [Ptipbmf] rundll32.exe ptipbmf.dll,SetWriteCacheMode
O4 - HKLM\..\Run: [iTunesHelper] "H:\i Tunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [SoundMAXPnP] C:\Program Files\Analog Devices\SoundMAX\SMax4PNP.exe
O4 - HKLM\..\Run: [SoundMAX] "C:\Program Files\Analog Devices\SoundMAX\smax4.exe" /tray
O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [COMODO Firewall Pro] "C:\Program Files\COMODO\Firewall\cfp.exe" -h
O4 - HKLM\..\Run: [F-Secure Manager] "e:\program files\Common\FSM32.EXE" /splash
O4 - HKLM\..\Run: [F-Secure TNB] "e:\program files\FSGUI\TNBUtil.exe" /CHECKALL /WAITFORSW
O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Common Files\Nero\Lib\NeroCheck.exe
O4 - HKLM\..\Run: [NBKeyScan] "C:\Program Files\Nero\Nero8\Nero BackItUp\NBKeyScan.exe"
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [BitTorrent DNA] "C:\Program Files\DNA\btdna.exe"
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [STYLEXP] C:\Program Files\TGTSoft\StyleXP\StyleXP.exe -Hide
O4 - HKCU\..\Run: [IndxStoreSvr_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Common Files\Nero\Lib\NMIndexStoreSvr.exe" ASO-616B5711-6DAE-4795-A05F-39A1E5104020
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Paikallinen palve')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Verkkopalve')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O4 - Global Startup: WinZip Quick Pick.lnk = C:\Program Files\WinZip\WZQKPICK.EXE
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://www.update.microsoft.com/mic...ls/en/x86/client/muweb_site.cab?1202406414718
O20 - AppInit_DLLs: C:\WINDOWS\system32\guard32.dll
O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: COMODO Firewall Pro Helper Service (cmdAgent) - COMODO - C:\Program Files\COMODO\Firewall\cmdagent.exe
O23 - Service: F-Secure Automatic Update Agent (FSAUA) - F-Secure Corporation - e:\program files\FSAUA\program\fsaua.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPod-palvelu (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Nero BackItUp Scheduler 3 - Nero AG - C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe
O23 - Service: Intel NCS NetService (NetSvc) - Intel(R) Corporation - C:\Program Files\Intel\NCS\Sync\NetSvc.exe
O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Nero\Lib\NMIndexingService.exe
O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe

--
End of file - 6963 bytes

 

joo o epähuomiossa ton yahoon asensin mut poistin kyl heti ku huomasin ...

 

Jokos kone pysyy päällä kerrasta

 

juuh kyllä nyt pysyy.. kiitosta tästä