Lokini

Mitä tästä voisi poistaa:

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 19:28:24, on 25.12.2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Unable to get Internet Explorer version!
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\System32\igfxtray.exe
C:\WINDOWS\System32\hkcmd.exe
C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe
C:\WINDOWS\system32\LVCOMSX.EXE
C:\Program Files\Logitech\Video\LogiTray.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\program files\quicktime\QTTask.exe
C:\PROGRA~1\Nokia\NOKIAP~1\LAUNCH~1.EXE
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\MSN Messenger\msnmsgr.exe
C:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe
C:\Program Files\WinZip\WZQKPICK.EXE
C:\Program Files\Logitech\Video\FxSvr2.exe
C:\Program Files\DMTS\BIN\e3DMTSMediaServer.exe
C:\Program Files\DMTS\BIN\e3DMTSServer.exe
C:\Program Files\Sunbelt Software\Personal Firewall 4\kpf4ss.exe
C:\PROGRA~1\EFFICI~1\ENTERN~1\app\pppoeservice.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Sunbelt Software\Personal Firewall 4\kpf4gui.exe
C:\Program Files\Common Files\PCSuite\Services\ServiceLayer.exe
C:\Program Files\Sunbelt Software\Personal Firewall 4\kpf4gui.exe
C:\Program Files\Java\jre1.6.0_01\bin\jucheck.exe
C:\Program Files\MSN Messenger\usnsvc.exe
C:\WINDOWS\system32\wscntfy.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer,SearchURL = http://searchmiracle.com/sp.php
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://fi.msn.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.defaulthomepage.info
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,SearchAssistant = http://www.websearch.com/ie.aspx?tb_id=50168
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\WINDOWS\qkjcr.dll/sp.html#12345%resultposition.net
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = res://C:\WINDOWS\qkjcr.dll/sp.html#12345%resultposition.net
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = dna Internet Explorer
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Linkit
O2 - BHO: (no name) - {0032CCFA-D80B-DABE-C53B-7E94CD4E0B9D} - (no file)
O2 - BHO: (no name) - {0652BFB3-DCA0-6EB5-0121-05A3DF7367B8} - (no file)
O2 - BHO: (no name) - {086A2B10-CBD6-9425-CAB7-630B339588D1} - (no file)
O2 - BHO: (no name) - {0C0D4791-72DA-02C9-E150-61A802FCA1A8} - (no file)
O2 - BHO: (no name) - {0DD30D6F-BC85-BE03-AAC4-BC866E10846D} - (no file)
O2 - BHO: (no name) - {0DD6CC69-5395-A956-5AE5-C69B4D006EC2} - (no file)
O2 - BHO: (no name) - {1676763F-15C3-F5F2-9C0B-0631705661ED} - (no file)
O2 - BHO: (no name) - {16A47DFB-0B7B-6D1B-05B7-210FEB83CF1C} - (no file)
O2 - BHO: (no name) - {18EDCB89-9926-E8C7-904E-EFC35DCB82D5} - (no file)
O2 - BHO: (no name) - {1EDBFE12-619A-B05D-D81A-42593402A991} - (no file)
O2 - BHO: (no name) - {202DAC62-070A-52D5-F993-6D64D764A5EA} - (no file)
O2 - BHO: (no name) - {2299D671-FC69-27B9-F4B4-AC5172A9786E} - (no file)
O2 - BHO: (no name) - {22D6C587-4D57-6C41-8B40-18989B320034} - (no file)
O2 - BHO: (no name) - {24A47C18-4C17-2AC4-710A-F949DD49082D} - (no file)
O2 - BHO: (no name) - {27C3B6F5-A963-CB77-223E-46F47D8B7709} - (no file)
O2 - BHO: (no name) - {2846032F-8EA0-4EFF-E13E-006290501796} - (no file)
O2 - BHO: (no name) - {288E8A17-EDA8-0E96-CAED-9600B30FF9A5} - (no file)
O2 - BHO: (no name) - {2AA6A6A5-5956-39DD-EADF-D656474D57D6} - (no file)
O2 - BHO: (no name) - {2FEF5742-62AD-6879-1397-ED822907A8BC} - (no file)
O2 - BHO: (no name) - {306F8479-A75A-9D8E-3C63-AD58B0678A6A} - (no file)
O2 - BHO: (no name) - {30A9ADD5-7E61-D29C-8F16-BC8A3DD7C359} - (no file)
O2 - BHO: (no name) - {321F7904-194F-9A0F-04B0-2C3F916C8D1D} - (no file)
O2 - BHO: (no name) - {38F6B10B-D771-3C5C-0291-568F76485423} - (no file)
O2 - BHO: (no name) - {3A0FF4A6-6F8C-C3EC-7A99-26044BF8D2A8} - (no file)
O2 - BHO: (no name) - {3CE36D52-D914-5BA5-C0E2-3F53AE992ABB} - (no file)
O2 - BHO: (no name) - {3E94D258-D83D-C2FC-C50B-C3BD6EF0FC9C} - (no file)
O2 - BHO: (no name) - {41A1C99D-6518-E377-31A3-89E5DBCEC51A} - (no file)
O2 - BHO: (no name) - {483BB598-6B58-345A-9D87-E58BE73678B1} - (no file)
O2 - BHO: (no name) - {4907C9FA-B308-2D69-C19A-9B28CC732FD5} - (no file)
O2 - BHO: (no name) - {4D85109F-9B1A-EFDF-B061-FEADDEDF9ACB} - (no file)
O2 - BHO: (no name) - {53C9AB6D-6031-E16B-125B-94A3A319C53F} - (no file)
O2 - BHO: (no name) - {58BE2EE0-27B6-C905-F9B4-65D8FE8B1DC9} - (no file)
O2 - BHO: (no name) - {593520BA-C478-E0A8-7C1F-ACFF8F9C2EE2} - (no file)
O2 - BHO: (no name) - {5AEDA511-0157-5F17-AC3D-A3D8D05DFE0C} - (no file)
O2 - BHO: (no name) - {602DB26D-2A43-19C2-A0B3-6D5486BCC728} - (no file)
O2 - BHO: (no name) - {61BA9713-4C7D-321C-7CDA-2D19B793429D} - (no file)
O2 - BHO: (no name) - {627C24F9-6820-8569-82C7-CE4F9DCD1EDA} - (no file)
O2 - BHO: (no name) - {646C57CD-B620-5ABD-0600-A30E3EA96595} - (no file)
O2 - BHO: (no name) - {6728F0D9-78EF-A265-D7BD-034EEB9FEA0B} - (no file)
O2 - BHO: (no name) - {67852D6B-C5A1-E2D1-3727-9D903FF50A97} - (no file)
O2 - BHO: (no name) - {68BA8E7B-48F1-E65F-C86B-FB26EE5902B5} - (no file)
O2 - BHO: (no name) - {69C2D265-3B93-BC0A-676E-D0FD27DA5AC6} - (no file)
O2 - BHO: (no name) - {6E0F0093-EF04-1478-FE8A-D4B3176F0CE3} - (no file)
O2 - BHO: (no name) - {6F4AA1CD-0529-44EE-B9DA-6790B9FEE37D} - (no file)
O2 - BHO: (no name) - {73A0B877-8957-66D4-B512-A5E6B2821E0C} - (no file)
O2 - BHO: (no name) - {7869AA49-B066-89FC-E5A0-AA47596F235C} - (no file)
O2 - BHO: (no name) - {7A318DE9-62B5-FF57-A970-C3C5DEFD3476} - (no file)
O2 - BHO: (no name) - {7A9255F3-6C7E-1DF9-4197-04A41E0B4D35} - (no file)
O2 - BHO: (no name) - {7CE5DA5D-F491-C0B6-884D-D9D4A9E4C7E4} - (no file)
O2 - BHO: (no name) - {80DAA425-DA60-3DA0-927D-F4CE735B581F} - (no file)
O2 - BHO: (no name) - {846E0BB2-4B7E-3DCA-BD80-7211A3EE88C4} - (no file)
O2 - BHO: (no name) - {8601EBC1-771F-266D-EE13-367627EBB1C8} - (no file)
O2 - BHO: (no name) - {8CA0C19A-072F-E5BB-47B2-C2B1F0E69C3B} - (no file)
O2 - BHO: (no name) - {8EA257CF-EDDF-09CA-1536-29E313C464B0} - (no file)
O2 - BHO: (no name) - {8F547B81-9875-B29A-2CDD-894B09440339} - (no file)
O2 - BHO: (no name) - {90839338-C0AA-11B0-7B9F-AC49064480E4} - (no file)
O2 - BHO: (no name) - {90BA9555-264A-4FB1-7251-DD5A22605A95} - (no file)
O2 - BHO: (no name) - {932F05AE-5941-1C8D-8A0A-AF1CA446E213} - (no file)
O2 - BHO: (no name) - {9B4B2B54-76F6-F3EA-12C8-5C2E5C112D23} - (no file)
O2 - BHO: (no name) - {A21F48DC-4264-EDA7-91A1-61769CB74D7A} - (no file)
O2 - BHO: (no name) - {A3ABABDA-544D-9E70-AE96-BE2F5DCF0B5A} - (no file)
O2 - BHO: (no name) - {A65F11A0-3D1B-37FD-F86D-9AB8607151F1} - (no file)
O2 - BHO: (no name) - {A6BF6993-7E8F-9CEB-1B08-1684CC14C18F} - (no file)
O2 - BHO: (no name) - {B764800B-F1F8-8788-4C16-55E92C3AB819} - (no file)
O2 - BHO: (no name) - {B78A3B74-89E9-5BA8-08EF-3977908BA3A0} - (no file)
O2 - BHO: (no name) - {BA997092-5DFF-A91F-6516-A449FC336452} - (no file)
O2 - BHO: (no name) - {C207C0FE-A804-D46C-81D2-A2A37FC7ED6B} - (no file)
O2 - BHO: (no name) - {C486F978-8D65-4A98-0179-CD984597B279} - (no file)
O2 - BHO: (no name) - {C50E4BE1-5DBD-CF1C-E7DB-13BABB1AE884} - (no file)
O2 - BHO: (no name) - {C526847B-FEE3-1038-3C38-9D537D50C2E2} - (no file)
O2 - BHO: (no name) - {C7339624-BDA9-0FBB-8706-46F6CC80401F} - (no file)
O2 - BHO: (no name) - {C75F302C-5DED-C090-F779-5337D7567BC3} - (no file)
O2 - BHO: (no name) - {C8BD785F-EB60-D323-EF30-B49C0D77C3C9} - (no file)
O2 - BHO: (no name) - {C8D54406-6EF3-7F0E-38BB-D6313B9FD92D} - (no file)
O2 - BHO: (no name) - {C970DB1E-CFEB-B341-5FA1-C2EE692D7DE2} - (no file)
O2 - BHO: (no name) - {CC5B5524-AEF5-F97F-E4E0-90901289B58D} - (no file)
O2 - BHO: (no name) - {D262910D-9F97-CA3A-15AA-9A5DEF559433} - (no file)
O2 - BHO: (no name) - {D58CC2B4-EB82-B5B9-733C-C5EBB3479058} - (no file)
O2 - BHO: (no name) - {D8010B5A-E220-B876-B855-D2861F450A0C} - (no file)
O2 - BHO: (no name) - {D907E5C7-7927-96F9-E4D0-07D10F017866} - (no file)
O2 - BHO: (no name) - {D9529B1E-58BD-C16B-D9B2-14013AC2FD84} - (no file)
O2 - BHO: (no name) - {DD2786BE-3BE2-FC80-F475-561735175B9A} - (no file)
O2 - BHO: (no name) - {DF7AF568-EF3E-A828-A764-D93713B760D7} - (no file)
O2 - BHO: (no name) - {E449D7C3-56B4-A3C0-3D0E-9B4733929115} - (no file)
O2 - BHO: (no name) - {E464D507-70C1-E654-A743-720591F1BB59} - (no file)
O2 - BHO: (no name) - {E67AAEA4-63EA-88A3-538E-D852FAE59639} - (no file)
O2 - BHO: (no name) - {E9657FD2-2FA2-A768-AE41-168F3181BC64} - (no file)
O2 - BHO: (no name) - {EB8B1EA0-A145-1D54-2B42-5843DD823A38} - (no file)
O2 - BHO: (no name) - {ED773C7F-04E4-55BD-4C88-E5F4D8E57CAA} - (no file)
O2 - BHO: (no name) - {EE33BD6D-AA1B-2FDF-2890-E084563E9868} - (no file)
O2 - BHO: (no name) - {F3C35F31-DCAA-23E8-21EA-00AC5AD3470E} - (no file)
O2 - BHO: (no name) - {F3C3DC70-25D1-3C6C-E10B-C6BF822AC5DA} - (no file)
O2 - BHO: (no name) - {F7AC6D6E-CC2C-9312-B04A-BE6B29FCC68C} - (no file)
O2 - BHO: (no name) - {F800B528-4FAF-AC2B-99E6-CC7371F0E741} - (no file)
O2 - BHO: (no name) - {FBA69C0B-86A6-19AD-2AF4-F5150E5C1CAE} - (no file)
O2 - BHO: (no name) - {FC381A47-95AC-8A69-D7B5-D90C1513C5E7} - (no file)
O2 - BHO: (no name) - {FCEBB27B-4E18-DA71-68DF-31397091EAF8} - (no file)
O2 - BHO: (no name) - {FD36CB53-F43E-C115-ED98-E1F307C77FD6} - (no file)
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\System32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\System32\hkcmd.exe
O4 - HKLM\..\Run: [SafeGuard Popup Blocker Updater (required)] regsvr32 /s C:\WINDOWS\System32\sfg6714.dll
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe"
O4 - HKLM\..\Run: [MSNMSGRS1] C:\swed.bat
O4 - HKLM\..\Run: [LVCOMSX] C:\WINDOWS\system32\LVCOMSX.EXE
O4 - HKLM\..\Run: [LogitechVideoRepair] C:\Program Files\Logitech\Video\ISStart.exe
O4 - HKLM\..\Run: [LogitechVideoTray] C:\Program Files\Logitech\Video\LogiTray.exe
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\program files\quicktime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [MSN Messanger] msnmsng.exe
O4 - HKLM\..\Run: [Microsoft media services] winmplayer.exe
O4 - HKLM\..\Run: [Media Load] msn32.exe
O4 - HKLM\..\Run: [Win32 USB2 Driver] win32usb.exe
O4 - HKLM\..\Run: [msconfig service] MSupdate32.exe
O4 - HKLM\..\Run: [Windows Download Manager] DllHost32.exe
O4 - HKLM\..\Run: [NTFSSAPI] ntfsapi.exe
O4 - HKLM\..\Run: [WinampAgent] C:\Program Files\Winamp\winampa.exe
O4 - HKLM\..\Run: [PCSuiteTrayApplication] C:\PROGRA~1\Nokia\NOKIAP~1\LAUNCH~1.EXE -startup
O4 - HKLM\..\RunServices: [MSN Messanger] msnmsng.exe
O4 - HKLM\..\RunServices: [Microsoft media services] winmplayer.exe
O4 - HKLM\..\RunServices: [Media Load] msn32.exe
O4 - HKLM\..\RunServices: [Win32 USB2 Driver] win32usb.exe
O4 - HKLM\..\RunServices: [msconfig service] MSupdate32.exe
O4 - HKLM\..\RunServices: [Windows Download Manager] DllHost32.exe
O4 - HKLM\..\RunServices: [NTFSSAPI] ntfsapi.exe
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background
O4 - HKCU\..\Run: [PcSync] C:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe /NoDialog
O4 - HKCU\..\Run: [MP4 Player] "C:\Program Files\MP4 Player\mp4Player.exe" hmw
O4 - HKCU\..\Run: [updateMgr] "C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe" AcRdB7_0_8
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Paikallinen palve')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Verkkopalve')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\Run: [Microsoft Update Machine] wuamgrd.exe (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\Run: [Microsoft IE] IEXPLORE.EXE (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\Run: [MSN Messanger] msnmsng.exe (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\Run: [starter] scvhosting.exe (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\Run: [winguard] wingrd32.exe (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\Run: [Windows Lmhost Util] lmhost.exe (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\Run: [Win32 USB2 Driver] win32usb.exe (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\Run: [MicrosoftUpdate] syshelper.exe (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\Run: [Microsoft Task Monitor] taskmger.exe (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\Run: [Windows Messenger] msmsgs.exe (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\Run: [Sysino] lsess.exe (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\Run: [Nvidia CTRL Panel] ncsvc32.exe (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\RunOnce: [Windows Lmhost Util] lmhost.exe (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\RunServices: [MSN Messanger] msnmsng.exe (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
O4 - HKUS\.DEFAULT\..\RunOnce: [Windows Lmhost Util] lmhost.exe (User 'Default user')
O4 - HKUS\.DEFAULT\..\RunServices: [MSN Messanger] msnmsng.exe (User 'Default user')
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: WinZip Quick Pick.lnk = C:\Program Files\WinZip\WZQKPICK.EXE
O8 - Extra context menu item: Web Rebates - file://C:\Program Files\Web_Rebates\Sy1150\Tp1150\scri1150a.htm
O8 - Extra context menu item: Web Savings - file://C:\Program Files\WebSavingsfromEbates\System\Temp\ebateswebsavings_script0.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\npjpi160_01.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\npjpi160_01.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O15 - Trusted Zone: *.blazefind.com
O15 - Trusted Zone: *.clickspring.net
O15 - Trusted Zone: *.crazywinnings.com
O15 - Trusted Zone: *.flingstone.com
O15 - Trusted Zone: *.mt-download.com
O15 - Trusted Zone: *.my-internet.info
O15 - Trusted Zone: *.searchmiracle.com
O15 - Trusted Zone: *.skoobidoo.com
O15 - Trusted Zone: *.slotchbar.com
O15 - Trusted Zone: *.topconverting.com
O15 - Trusted Zone: *.windupdates.com
O15 - Trusted Zone: *.ysbweb.com
O15 - Trusted Zone: *.blazefind.com (HKLM)
O15 - Trusted Zone: *.clickspring.net (HKLM)
O15 - Trusted Zone: *.crazywinnings.com (HKLM)
O15 - Trusted Zone: *.flingstone.com (HKLM)
O15 - Trusted Zone: *.mt-download.com (HKLM)
O15 - Trusted Zone: *.my-internet.info (HKLM)
O15 - Trusted Zone: *.searchmiracle.com (HKLM)
O15 - Trusted Zone: *.skoobidoo.com (HKLM)
O15 - Trusted Zone: *.slotchbar.com (HKLM)
O15 - Trusted Zone: *.topconverting.com (HKLM)
O15 - Trusted Zone: *.windupdates.com (HKLM)
O15 - Trusted Zone: *.ysbweb.com (HKLM)
O15 - Trusted IP range: 67.19.185.246
O15 - Trusted IP range: 67.19.185.246 (HKLM)
O16 - DPF: RaptisoftGameLoader - http://www.miniclip.com/hamsterball/raptisoftgameloader.cab
O16 - DPF: v2cab - http://searchmiracle.com/cab/v2cab.cab
O16 - DPF: v3cab - http://searchmiracle.com/cab/1.cab
O16 - DPF: {00000EF1-0786-4633-87C6-1AA7A44296DA} - http://www.addictivetechnologies.net/DM0/cab/ATPartners.cab
O16 - DPF: {0594AF7E-573B-40DF-8165-E47AB2EAEFE8} - http://akamai.downloadv3.com/binaries/P2EClient/EGAUTH_1019_EN_XP.cab
O16 - DPF: {0E4796D6-A990-4372-9069-72FBDB4AE868} - http://www.one2one.com/static/class/one2oneSvc.cab
O16 - DPF: {15AD4789-CDB4-47E1-A9DA-992EE8E6BAD6} - http://static.windupdates.com/cab/ClickYesToContinue/ie/bridge-c3.cab
O16 - DPF: {1D4DB7D2-6EC9-47A3-BD87-1E41684E07BB} - http://ak.imgfarm.com/images/nocache/funwebproducts/ei/SmileyCentralInitialSetup1.0.0.8.cab
O16 - DPF: {2AEEAC34-FD74-4142-B891-4B05C0C03C87} - http://akamai.downloadv3.com/binaries/DialHTML/EGCOMSERVICE_1046_pack_XP.cab
O16 - DPF: {3468FCFD-E656-47CF-838D-A350F84EB1CC} - http://activex.microsoft.com/objects/ocget.dll
O16 - DPF: {469C7080-8EC8-43A6-AD97-45848113743C} - http://akamai.downloadv3.com/binaries/IA/nethv32_EN_XP.cab
O16 - DPF: {5C3A9EA6-4068-46B8-8B5A-692FB10607B1} - http://www.grupomarineda.net/auto/DialerData.cab
O16 - DPF: {706F3805-27D7-478D-80E5-E25D2BB030B3} - http://www.advnt01.com/dialer/internazionale_ver3.CAB
O16 - DPF: {7589EEE6-E336-11D4-8A7E-EE1D971D9B47} - http://secure.aconti.net/acontix/goodthinxx.cab
O16 - DPF: {771A1334-6B08-4A6B-AEDC-CF994BA2CEBE} - http://www.ysbweb.com/ist/softwares/v4.0/ysb_regular.cab
O16 - DPF: {79849612-A98F-45B8-95E9-4D13C7B6B35C} - http://static.topconverting.com/activex/loader2.ocx
O16 - DPF: {91433D86-9F27-402C-B5E3-DEBDD122C339} - http://www.netvenda.com/sites/games-intl/fi/games4.cab
O16 - DPF: {91BE8DAC-957E-416C-B735-E2B63CDB915B} (MyEMessengerSetup Control) - http://www.myemessenger.com/activex/MyEMessengerSetupProject.cab
O16 - DPF: {9EB320CE-BE1D-4304-A081-4B4665414BEF} - http://www.mt-download.com/MediaTicketsInstaller.cab
O16 - DPF: {A5B4176A-5347-4CEC-AB75-26947BB34183} (InstaladorBetyByte Control) - http://www.redzone.fi/uploads/cab/instaladorbetybyteuk.cab
O16 - DPF: {A5DC33CE-214B-4C26-8596-8A45456C9EB8} (RNGCIECtl Class) - http://activex.microsoft.com/objects/ocget.dll
O16 - DPF: {AD7FAFB0-16D6-40C3-AF27-585D6E6453FD} -
O16 - DPF: {B942A249-D1E7-4C11-98AE-FCB76B08747F} (RealArcadeRdxIE Class) - http://games-dl.real.com/gameconsole/Bundler/CAB/RealArcadeRdxIE.cab
O16 - DPF: {DDFFA75A-E81D-4454-89FC-B9FD0631E726} - http://www.bundleware.com/activeX/BM2/BM2.dll
O16 - DPF: {EFB22865-F3BC-4309-ADFA-C8E078A7F762} - http://www.sponsoradulto.com/en/SysWebTelecom.cab
O16 - DPF: {FE4BBEA8-1EFD-4B8A-BD1B-341CCDBEEAA6} - http://ads.dealhelper.com/updates/DealHelperNew.cab
O16 - DPF: {FE5D6722-826F-11D5-A24E-0060B0F1A5AE} (Tukati Launcher) - http://www.tukati.com/software/4/1.7.20.20/tukati.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{39D78B64-F1D5-4C55-8DB8-2759D59EBBE4}: NameServer = 213.139.190.3 212.50.131.153
O20 - AppInit_DLLs: C:\PROGRA~1\Google\GOOGLE~2\GOEC62~1.DLL
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: e-3 DMTS Media Server (e3DMTSMediaServer) - Unknown owner - C:\Program Files\DMTS\BIN\e3DMTSMediaServer.exe
O23 - Service: e-3 DMTS Server (e3DMTSServer) - Unknown owner - C:\Program Files\DMTS\BIN\e3DMTSServer.exe
O23 - Service: GoogleDesktopManager - Google - C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
O23 - Service: Sunbelt Kerio Personal Firewall 4 (KPF4) - Sunbelt Software - C:\Program Files\Sunbelt Software\Personal Firewall 4\kpf4ss.exe
O23 - Service: Norman API-hooking helper (NipSvc) - Unknown owner - C:\NORMAN\Nvc\BIN\nipsvc.exe (file missing)
O23 - Service: PPPoE Service (PPPoEService) - Unknown owner - C:\PROGRA~1\EFFICI~1\ENTERN~1\app\pppoeservice.exe
O23 - Service: ServiceLayer - Nokia. - C:\Program Files\Common Files\PCSuite\Services\ServiceLayer.exe

--
End of file - 20379 bytes

 

Scannaa hjt:llä merkkaa paina Fix checked

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
O2 - BHO: (no name) - {0032CCFA-D80B-DABE-C53B-7E94CD4E0B9D} - (no file)
O2 - BHO: (no name) - {0652BFB3-DCA0-6EB5-0121-05A3DF7367B8} - (no file)
O2 - BHO: (no name) - {086A2B10-CBD6-9425-CAB7-630B339588D1} - (no file)
O2 - BHO: (no name) - {0C0D4791-72DA-02C9-E150-61A802FCA1A8} - (no file)
O2 - BHO: (no name) - {0DD30D6F-BC85-BE03-AAC4-BC866E10846D} - (no file)
O2 - BHO: (no name) - {0DD6CC69-5395-A956-5AE5-C69B4D006EC2} - (no file)
O2 - BHO: (no name) - {1676763F-15C3-F5F2-9C0B-0631705661ED} - (no file)
O2 - BHO: (no name) - {16A47DFB-0B7B-6D1B-05B7-210FEB83CF1C} - (no file)
O2 - BHO: (no name) - {18EDCB89-9926-E8C7-904E-EFC35DCB82D5} - (no file)
O2 - BHO: (no name) - {1EDBFE12-619A-B05D-D81A-42593402A991} - (no file)
O2 - BHO: (no name) - {202DAC62-070A-52D5-F993-6D64D764A5EA} - (no file)
O2 - BHO: (no name) - {2299D671-FC69-27B9-F4B4-AC5172A9786E} - (no file)
O2 - BHO: (no name) - {22D6C587-4D57-6C41-8B40-18989B320034} - (no file)
O2 - BHO: (no name) - {24A47C18-4C17-2AC4-710A-F949DD49082D} - (no file)
O2 - BHO: (no name) - {27C3B6F5-A963-CB77-223E-46F47D8B7709} - (no file)
O2 - BHO: (no name) - {2846032F-8EA0-4EFF-E13E-006290501796} - (no file)
O2 - BHO: (no name) - {288E8A17-EDA8-0E96-CAED-9600B30FF9A5} - (no file)
O2 - BHO: (no name) - {2AA6A6A5-5956-39DD-EADF-D656474D57D6} - (no file)
O2 - BHO: (no name) - {2FEF5742-62AD-6879-1397-ED822907A8BC} - (no file)
O2 - BHO: (no name) - {306F8479-A75A-9D8E-3C63-AD58B0678A6A} - (no file)
O2 - BHO: (no name) - {30A9ADD5-7E61-D29C-8F16-BC8A3DD7C359} - (no file)
O2 - BHO: (no name) - {321F7904-194F-9A0F-04B0-2C3F916C8D1D} - (no file)
O2 - BHO: (no name) - {38F6B10B-D771-3C5C-0291-568F76485423} - (no file)
O2 - BHO: (no name) - {3A0FF4A6-6F8C-C3EC-7A99-26044BF8D2A8} - (no file)
O2 - BHO: (no name) - {3CE36D52-D914-5BA5-C0E2-3F53AE992ABB} - (no file)
O2 - BHO: (no name) - {3E94D258-D83D-C2FC-C50B-C3BD6EF0FC9C} - (no file)
O2 - BHO: (no name) - {41A1C99D-6518-E377-31A3-89E5DBCEC51A} - (no file)
O2 - BHO: (no name) - {483BB598-6B58-345A-9D87-E58BE73678B1} - (no file)
O2 - BHO: (no name) - {4907C9FA-B308-2D69-C19A-9B28CC732FD5} - (no file)
O2 - BHO: (no name) - {4D85109F-9B1A-EFDF-B061-FEADDEDF9ACB} - (no file)
O2 - BHO: (no name) - {53C9AB6D-6031-E16B-125B-94A3A319C53F} - (no file)
O2 - BHO: (no name) - {58BE2EE0-27B6-C905-F9B4-65D8FE8B1DC9} - (no file)
O2 - BHO: (no name) - {593520BA-C478-E0A8-7C1F-ACFF8F9C2EE2} - (no file)
O2 - BHO: (no name) - {5AEDA511-0157-5F17-AC3D-A3D8D05DFE0C} - (no file)
O2 - BHO: (no name) - {602DB26D-2A43-19C2-A0B3-6D5486BCC728} - (no file)
O2 - BHO: (no name) - {61BA9713-4C7D-321C-7CDA-2D19B793429D} - (no file)
O2 - BHO: (no name) - {627C24F9-6820-8569-82C7-CE4F9DCD1EDA} - (no file)
O2 - BHO: (no name) - {646C57CD-B620-5ABD-0600-A30E3EA96595} - (no file)
O2 - BHO: (no name) - {6728F0D9-78EF-A265-D7BD-034EEB9FEA0B} - (no file)
O2 - BHO: (no name) - {67852D6B-C5A1-E2D1-3727-9D903FF50A97} - (no file)
O2 - BHO: (no name) - {68BA8E7B-48F1-E65F-C86B-FB26EE5902B5} - (no file)
O2 - BHO: (no name) - {69C2D265-3B93-BC0A-676E-D0FD27DA5AC6} - (no file)
O2 - BHO: (no name) - {6E0F0093-EF04-1478-FE8A-D4B3176F0CE3} - (no file)
O2 - BHO: (no name) - {6F4AA1CD-0529-44EE-B9DA-6790B9FEE37D} - (no file)
O2 - BHO: (no name) - {73A0B877-8957-66D4-B512-A5E6B2821E0C} - (no file)
O2 - BHO: (no name) - {7869AA49-B066-89FC-E5A0-AA47596F235C} - (no file)
O2 - BHO: (no name) - {7A318DE9-62B5-FF57-A970-C3C5DEFD3476} - (no file)
O2 - BHO: (no name) - {7A9255F3-6C7E-1DF9-4197-04A41E0B4D35} - (no file)
O2 - BHO: (no name) - {7CE5DA5D-F491-C0B6-884D-D9D4A9E4C7E4} - (no file)
O2 - BHO: (no name) - {80DAA425-DA60-3DA0-927D-F4CE735B581F} - (no file)
O2 - BHO: (no name) - {846E0BB2-4B7E-3DCA-BD80-7211A3EE88C4} - (no file)
O2 - BHO: (no name) - {8601EBC1-771F-266D-EE13-367627EBB1C8} - (no file)
O2 - BHO: (no name) - {8CA0C19A-072F-E5BB-47B2-C2B1F0E69C3B} - (no file)
O2 - BHO: (no name) - {8EA257CF-EDDF-09CA-1536-29E313C464B0} - (no file)
O2 - BHO: (no name) - {8F547B81-9875-B29A-2CDD-894B09440339} - (no file)
O2 - BHO: (no name) - {90839338-C0AA-11B0-7B9F-AC49064480E4} - (no file)
O2 - BHO: (no name) - {90BA9555-264A-4FB1-7251-DD5A22605A95} - (no file)
O2 - BHO: (no name) - {932F05AE-5941-1C8D-8A0A-AF1CA446E213} - (no file)
O2 - BHO: (no name) - {9B4B2B54-76F6-F3EA-12C8-5C2E5C112D23} - (no file)
O2 - BHO: (no name) - {A21F48DC-4264-EDA7-91A1-61769CB74D7A} - (no file)
O2 - BHO: (no name) - {A3ABABDA-544D-9E70-AE96-BE2F5DCF0B5A} - (no file)
O2 - BHO: (no name) - {A65F11A0-3D1B-37FD-F86D-9AB8607151F1} - (no file)
O2 - BHO: (no name) - {A6BF6993-7E8F-9CEB-1B08-1684CC14C18F} - (no file)
O2 - BHO: (no name) - {B764800B-F1F8-8788-4C16-55E92C3AB819} - (no file)
O2 - BHO: (no name) - {B78A3B74-89E9-5BA8-08EF-3977908BA3A0} - (no file)
O2 - BHO: (no name) - {BA997092-5DFF-A91F-6516-A449FC336452} - (no file)
O2 - BHO: (no name) - {C207C0FE-A804-D46C-81D2-A2A37FC7ED6B} - (no file)
O2 - BHO: (no name) - {C486F978-8D65-4A98-0179-CD984597B279} - (no file)
O2 - BHO: (no name) - {C50E4BE1-5DBD-CF1C-E7DB-13BABB1AE884} - (no file)
O2 - BHO: (no name) - {C526847B-FEE3-1038-3C38-9D537D50C2E2} - (no file)
O2 - BHO: (no name) - {C7339624-BDA9-0FBB-8706-46F6CC80401F} - (no file)
O2 - BHO: (no name) - {C75F302C-5DED-C090-F779-5337D7567BC3} - (no file)
O2 - BHO: (no name) - {C8BD785F-EB60-D323-EF30-B49C0D77C3C9} - (no file)
O2 - BHO: (no name) - {C8D54406-6EF3-7F0E-38BB-D6313B9FD92D} - (no file)
O2 - BHO: (no name) - {C970DB1E-CFEB-B341-5FA1-C2EE692D7DE2} - (no file)
O2 - BHO: (no name) - {CC5B5524-AEF5-F97F-E4E0-90901289B58D} - (no file)
O2 - BHO: (no name) - {D262910D-9F97-CA3A-15AA-9A5DEF559433} - (no file)
O2 - BHO: (no name) - {D58CC2B4-EB82-B5B9-733C-C5EBB3479058} - (no file)
O2 - BHO: (no name) - {D8010B5A-E220-B876-B855-D2861F450A0C} - (no file)
O2 - BHO: (no name) - {D907E5C7-7927-96F9-E4D0-07D10F017866} - (no file)
O2 - BHO: (no name) - {D9529B1E-58BD-C16B-D9B2-14013AC2FD84} - (no file)
O2 - BHO: (no name) - {DD2786BE-3BE2-FC80-F475-561735175B9A} - (no file)
O2 - BHO: (no name) - {DF7AF568-EF3E-A828-A764-D93713B760D7} - (no file)
O2 - BHO: (no name) - {E449D7C3-56B4-A3C0-3D0E-9B4733929115} - (no file)
O2 - BHO: (no name) - {E464D507-70C1-E654-A743-720591F1BB59} - (no file)
O2 - BHO: (no name) - {E67AAEA4-63EA-88A3-538E-D852FAE59639} - (no file)
O2 - BHO: (no name) - {E9657FD2-2FA2-A768-AE41-168F3181BC64} - (no file)
O2 - BHO: (no name) - {EB8B1EA0-A145-1D54-2B42-5843DD823A38} - (no file)
O2 - BHO: (no name) - {ED773C7F-04E4-55BD-4C88-E5F4D8E57CAA} - (no file)
O2 - BHO: (no name) - {EE33BD6D-AA1B-2FDF-2890-E084563E9868} - (no file)
O2 - BHO: (no name) - {F3C35F31-DCAA-23E8-21EA-00AC5AD3470E} - (no file)
O2 - BHO: (no name) - {F3C3DC70-25D1-3C6C-E10B-C6BF822AC5DA} - (no file)
O2 - BHO: (no name) - {F7AC6D6E-CC2C-9312-B04A-BE6B29FCC68C} - (no file)
O2 - BHO: (no name) - {F800B528-4FAF-AC2B-99E6-CC7371F0E741} - (no file)
O2 - BHO: (no name) - {FBA69C0B-86A6-19AD-2AF4-F5150E5C1CAE} - (no file)
O2 - BHO: (no name) - {FC381A47-95AC-8A69-D7B5-D90C1513C5E7} - (no file)
O2 - BHO: (no name) - {FCEBB27B-4E18-DA71-68DF-31397091EAF8} - (no file)
O2 - BHO: (no name) - {FD36CB53-F43E-C115-ED98-E1F307C77FD6} - (no file)
O15 - Trusted Zone: *.blazefind.com
O15 - Trusted Zone: *.clickspring.net
O15 - Trusted Zone: *.crazywinnings.com
O15 - Trusted Zone: *.flingstone.com
O15 - Trusted Zone: *.mt-download.com
O15 - Trusted Zone: *.my-internet.info
O15 - Trusted Zone: *.searchmiracle.com
O15 - Trusted Zone: *.skoobidoo.com
O15 - Trusted Zone: *.slotchbar.com
O15 - Trusted Zone: *.topconverting.com
O15 - Trusted Zone: *.windupdates.com
O15 - Trusted Zone: *.ysbweb.com
O15 - Trusted Zone: *.blazefind.com (HKLM)
O15 - Trusted Zone: *.clickspring.net (HKLM)
O15 - Trusted Zone: *.crazywinnings.com (HKLM)
O15 - Trusted Zone: *.flingstone.com (HKLM)
O15 - Trusted Zone: *.mt-download.com (HKLM)
O15 - Trusted Zone: *.my-internet.info (HKLM)
O15 - Trusted Zone: *.searchmiracle.com (HKLM)
O15 - Trusted Zone: *.skoobidoo.com (HKLM)
O15 - Trusted Zone: *.slotchbar.com (HKLM)
O15 - Trusted Zone: *.topconverting.com (HKLM)
O15 - Trusted Zone: *.windupdates.com (HKLM)
O15 - Trusted Zone: *.ysbweb.com (HKLM)
O15 - Trusted IP range: 67.19.185.246
O15 - Trusted IP range: 67.19.185.246 (HKLM)
O23 - Service: Norman API-hooking helper (NipSvc) - Unknown owner - C:\NORMAN\Nvc\BIN\nipsvc.exe (file missing)


Käynnistä > suorita > kirjoitta alla olevat ja jokaisen rivin jälkeen paina ok

sc stop NipSvc (paina ok)
sc delete NipSvc (paina ok)

===================
Lataa SDFix by AndyManchesta ja tallenna se työpöydällesi.

Käynnistä koneesi vikasietotilaan ja valitse tavallinen käyttäjätilisi:
" Käynnistä tietokone
" Kun kuulet koneen piippaavan, paina F8, kuitenkin ennen Windowsin logon esiintuloa
" Seuraavaksi pitäisi ilmestyä valikko
" Valitse valikosta vikasietotila.

" Kun vikasietotilassa, pura tiedoston SDFix.zip sisältö (SDFix kansio) työpöydällesi. Työpöydälle pitäisi ilmestyä kansio nimeltä SDFix.
" Avaa SDFix-kansio ja tuplaklikkaa tiedostoa RunThis.bat käynnistääksesi ohjelman.
" Paina Y käynnistääksesi skriptin.
" Työkalu puhdistaa troijalaisen palvelut ja tekee myös joitakin korjauksia rekisteriin. Lopuksi se pyytää käynnistämään koneen uudelleen, "Press any key to Reboot".
" Paina mitä tahansa näppäintä ja kone käynnistyy uudelleen.
" Käynnistyminen kestää normaalia kauemmin sillä SDFix puhdistaa konetta.
" Kun kone on käynnistynyt ja työpöytä latautunut, SDFix kertoo että puhdistus on suoritettu, "Finished".
" Paina sitten mitä tahansa näppäintä sulkeaksesi skriptin ja ladataksesi pikakuvakkeet työpöydälle.
" Lopuksi avaa SDFix kansio (työpöydällä) ja kopioi & liitä tiedoston Report.txt sisältö viestiketjuusi uuden HijackThis:n lokin kera.

===================

 

Tässä tuo report -muistio:

SDFix: Version 1.119

Run by Mira Savilaakso on ke 26.12.2007 at 19:36

Microsoft Windows XP [versio 5.1.2600]

Running From: C:\DOCUME~1\MIRASA~1\TYPYT~1\SDFix

Safe Mode:
Checking Services:


Restoring Windows Registry Values
Restoring Windows Default Hosts File

Rebooting...


Normal Mode:
Checking Files:

Trojan Files Found:

C:\WINDOWS\SYSTEM32\ADDWU32.EXE - Deleted
C:\WINDOWS\SYSTEM32\ADDXC32.EXE - Deleted
C:\WINDOWS\SYSTEM32\ADDYH32.EXE - Deleted
C:\WINDOWS\SYSTEM32\APIDC.EXE - Deleted
C:\WINDOWS\SYSTEM32\APIGO.EXE - Deleted
C:\WINDOWS\SYSTEM32\APIYW.EXE - Deleted
C:\WINDOWS\SYSTEM32\APPBR.EXE - Deleted
C:\WINDOWS\SYSTEM32\APPCD32.EXE - Deleted
C:\WINDOWS\SYSTEM32\APPLC32.EXE - Deleted
C:\WINDOWS\SYSTEM32\APPTA32.EXE - Deleted
C:\WINDOWS\SYSTEM32\APPUB.EXE - Deleted
C:\WINDOWS\SYSTEM32\APPXV.EXE - Deleted
C:\WINDOWS\SYSTEM32\ATLAV.EXE - Deleted
C:\WINDOWS\SYSTEM32\ATLCJ.EXE - Deleted
C:\WINDOWS\SYSTEM32\ATLDV32.EXE - Deleted
C:\WINDOWS\SYSTEM32\ATLKM.EXE - Deleted
C:\WINDOWS\SYSTEM32\ATLMN.EXE - Deleted
C:\WINDOWS\SYSTEM32\ATLUV32.EXE - Deleted
C:\WINDOWS\SYSTEM32\CRCA.EXE - Deleted
C:\WINDOWS\SYSTEM32\CRHI.EXE - Deleted
C:\WINDOWS\SYSTEM32\CRJN.EXE - Deleted
C:\WINDOWS\SYSTEM32\CRKI32.EXE - Deleted
C:\WINDOWS\SYSTEM32\CRPU32.EXE - Deleted
C:\WINDOWS\SYSTEM32\CRUL32.EXE - Deleted
C:\WINDOWS\SYSTEM32\CRUQ.EXE - Deleted
C:\WINDOWS\SYSTEM32\CRVZ32.EXE - Deleted
C:\WINDOWS\SYSTEM32\D3CB.EXE - Deleted
C:\WINDOWS\SYSTEM32\D3DC32.EXE - Deleted
C:\WINDOWS\SYSTEM32\D3DW.EXE - Deleted
C:\WINDOWS\SYSTEM32\D3OU32.EXE - Deleted
C:\WINDOWS\SYSTEM32\D3TF32.EXE - Deleted
C:\WINDOWS\SYSTEM32\D3US32.EXE - Deleted
C:\WINDOWS\SYSTEM32\D3YR.EXE - Deleted
C:\WINDOWS\SYSTEM32\FTPUPD.EXE - Deleted
C:\WINDOWS\SYSTEM32\IEAG.EXE - Deleted
C:\WINDOWS\SYSTEM32\IEIA32.EXE - Deleted
C:\WINDOWS\SYSTEM32\IEMS32.EXE - Deleted
C:\WINDOWS\SYSTEM32\IEMY.EXE - Deleted
C:\WINDOWS\SYSTEM32\IERU.EXE - Deleted
C:\WINDOWS\SYSTEM32\IEVA32.EXE - Deleted
C:\WINDOWS\SYSTEM32\IEYL32.EXE - Deleted
C:\WINDOWS\SYSTEM32\IPFI.EXE - Deleted
C:\WINDOWS\SYSTEM32\IPGS.EXE - Deleted
C:\WINDOWS\SYSTEM32\IPKA.EXE - Deleted
C:\WINDOWS\SYSTEM32\IPQM.EXE - Deleted
C:\WINDOWS\SYSTEM32\IPRI.EXE - Deleted
C:\WINDOWS\SYSTEM32\IPXO32.EXE - Deleted
C:\WINDOWS\SYSTEM32\IPZY32.EXE - Deleted
C:\WINDOWS\SYSTEM32\JAVACJ.EXE - Deleted
C:\WINDOWS\SYSTEM32\JAVAHH32.EXE - Deleted
C:\WINDOWS\SYSTEM32\JAVAPP32.EXE - Deleted
C:\WINDOWS\SYSTEM32\JAVASQ.EXE - Deleted
C:\WINDOWS\SYSTEM32\JAVAVL.EXE - Deleted
C:\WINDOWS\SYSTEM32\JAVAVR.EXE - Deleted
C:\WINDOWS\SYSTEM32\JAVAVW32.EXE - Deleted
C:\WINDOWS\SYSTEM32\MFCCI32.EXE - Deleted
C:\WINDOWS\SYSTEM32\MFCII.EXE - Deleted
C:\WINDOWS\SYSTEM32\MFCKS32.EXE - Deleted
C:\WINDOWS\SYSTEM32\MFCLO32.EXE - Deleted
C:\WINDOWS\SYSTEM32\MFCMK32.EXE - Deleted
C:\WINDOWS\SYSTEM32\MFCMN.EXE - Deleted
C:\WINDOWS\SYSTEM32\MFCTX32.EXE - Deleted
C:\WINDOWS\SYSTEM32\MSFF32.EXE - Deleted
C:\WINDOWS\SYSTEM32\MSIR.EXE - Deleted
C:\WINDOWS\SYSTEM32\MSJX32.EXE - Deleted
C:\WINDOWS\SYSTEM32\MSNX32.EXE - Deleted
C:\WINDOWS\SYSTEM32\MSSA32.EXE - Deleted
C:\WINDOWS\SYSTEM32\MSTG32.EXE - Deleted
C:\WINDOWS\SYSTEM32\MSUA32.EXE - Deleted
C:\WINDOWS\SYSTEM32\MSVR.EXE - Deleted
C:\WINDOWS\SYSTEM32\MSWN.EXE - Deleted
C:\WINDOWS\SYSTEM32\NETCL.EXE - Deleted
C:\WINDOWS\SYSTEM32\NETCLNF.EXE - Deleted
C:\WINDOWS\SYSTEM32\NETRU.EXE - Deleted
C:\WINDOWS\SYSTEM32\NETTA32.EXE - Deleted
C:\WINDOWS\SYSTEM32\NETUD32.EXE - Deleted
C:\WINDOWS\SYSTEM32\NETVM32.EXE - Deleted
C:\WINDOWS\SYSTEM32\NETWQ.EXE - Deleted
C:\WINDOWS\SYSTEM32\NETWS32.EXE - Deleted
C:\WINDOWS\SYSTEM32\NETYC.EXE - Deleted
C:\WINDOWS\SYSTEM32\NETYE32.EXE - Deleted
C:\WINDOWS\SYSTEM32\NTBG32.EXE - Deleted
C:\WINDOWS\SYSTEM32\NTCO32.EXE - Deleted
C:\WINDOWS\SYSTEM32\NTDS32.EXE - Deleted
C:\WINDOWS\SYSTEM32\NTFV.EXE - Deleted
C:\WINDOWS\SYSTEM32\NTVB.EXE - Deleted
C:\WINDOWS\SYSTEM32\SDKPB.EXE - Deleted
C:\WINDOWS\SYSTEM32\SDKST32.EXE - Deleted
C:\WINDOWS\SYSTEM32\SDKTO.EXE - Deleted
C:\WINDOWS\SYSTEM32\SDKZM32.EXE - Deleted
C:\WINDOWS\SYSTEM32\SYSLG32.EXE - Deleted
C:\WINDOWS\SYSTEM32\SYSLN.EXE - Deleted
C:\WINDOWS\SYSTEM32\SYSMF32.EXE - Deleted
C:\WINDOWS\SYSTEM32\SYSMJ32.EXE - Deleted
C:\WINDOWS\SYSTEM32\SYSTT.EXE - Deleted
C:\WINDOWS\SYSTEM32\SYSZR32.EXE - Deleted
C:\WINDOWS\SYSTEM32\WINCA32.EXE - Deleted
C:\WINDOWS\SYSTEM32\WINDT32.EXE - Deleted
C:\WINDOWS\SYSTEM32\WINEB32.EXE - Deleted
C:\WINDOWS\SYSTEM32\WINKF.EXE - Deleted
C:\WINDOWS\SYSTEM32\WINLT32.EXE - Deleted
C:\WINDOWS\SYSTEM32\WINQV.EXE - Deleted
C:\WINDOWS\SYSTEM32\WINQY32.EXE - Deleted
C:\WINDOWS\SYSTEM32\WINUQ.EXE - Deleted
C:\WINDOWS\SYSTEM32\WINYT32.EXE - Deleted
C:\WINDOWS\SYSTEM32\WINZQ.EXE - Deleted
C:\WINDOWS\SYSTEM32\AAIQR.DLL - Deleted
C:\WINDOWS\SYSTEM32\ADDEI.DLL - Deleted
C:\WINDOWS\SYSTEM32\ADDPY32.DLL - Deleted
C:\WINDOWS\SYSTEM32\ADWQH.DLL - Deleted
C:\WINDOWS\SYSTEM32\APIGP32.DLL - Deleted
C:\WINDOWS\SYSTEM32\APITF.DLL - Deleted
C:\WINDOWS\SYSTEM32\APIUO32.DLL - Deleted
C:\WINDOWS\SYSTEM32\APPEK.DLL - Deleted
C:\WINDOWS\SYSTEM32\ATLEE32.DLL - Deleted
C:\WINDOWS\SYSTEM32\ATLIK32.DLL - Deleted
C:\WINDOWS\SYSTEM32\ATLWH32.DLL - Deleted
C:\WINDOWS\SYSTEM32\AVZGA.DLL - Deleted
C:\WINDOWS\SYSTEM32\BJUGA.DLL - Deleted
C:\WINDOWS\SYSTEM32\BMZCB.DLL - Deleted
C:\WINDOWS\SYSTEM32\CBXES.DLL - Deleted
C:\WINDOWS\SYSTEM32\CGMTQ.DLL - Deleted
C:\WINDOWS\SYSTEM32\CMVMG.DLL - Deleted
C:\WINDOWS\SYSTEM32\CNEVS.DLL - Deleted
C:\WINDOWS\SYSTEM32\CREQ.DLL - Deleted
C:\WINDOWS\SYSTEM32\CRIU.DLL - Deleted
C:\WINDOWS\SYSTEM32\CRKT32.DLL - Deleted
C:\WINDOWS\SYSTEM32\CRUB.DLL - Deleted
C:\WINDOWS\SYSTEM32\D3EN32.DLL - Deleted
C:\WINDOWS\SYSTEM32\D3KR.DLL - Deleted
C:\WINDOWS\SYSTEM32\D3LE32.DLL - Deleted
C:\WINDOWS\SYSTEM32\D3PF.DLL - Deleted
C:\WINDOWS\SYSTEM32\DEXRY.DLL - Deleted
C:\WINDOWS\SYSTEM32\DULDZ.DLL - Deleted
C:\WINDOWS\SYSTEM32\GGYZO.DLL - Deleted
C:\WINDOWS\SYSTEM32\GZOHK.DLL - Deleted
C:\WINDOWS\SYSTEM32\HPUUL.DLL - Deleted
C:\WINDOWS\SYSTEM32\IEMM32.DLL - Deleted
C:\WINDOWS\SYSTEM32\IPJE32.DLL - Deleted
C:\WINDOWS\SYSTEM32\JAVAQR.DLL - Deleted
C:\WINDOWS\SYSTEM32\JDBVZ.DLL - Deleted
C:\WINDOWS\SYSTEM32\JFFFN.DLL - Deleted
C:\WINDOWS\SYSTEM32\JIEXH.DLL - Deleted
C:\WINDOWS\SYSTEM32\JYSKI.DLL - Deleted
C:\WINDOWS\SYSTEM32\MFCFS32.DLL - Deleted
C:\WINDOWS\SYSTEM32\MFCIG.DLL - Deleted
C:\WINDOWS\SYSTEM32\MSAQ32.DLL - Deleted
C:\WINDOWS\SYSTEM32\MSSK32.DLL - Deleted
C:\WINDOWS\SYSTEM32\MXITO.DLL - Deleted
C:\WINDOWS\SYSTEM32\NETKL.DLL - Deleted
C:\WINDOWS\SYSTEM32\NETRT32.DLL - Deleted
C:\WINDOWS\SYSTEM32\NETXS32.DLL - Deleted
C:\WINDOWS\SYSTEM32\NIKMN.DLL - Deleted
C:\WINDOWS\SYSTEM32\NKZHF.DLL - Deleted
C:\WINDOWS\SYSTEM32\NRPMS.DLL - Deleted
C:\WINDOWS\SYSTEM32\NXPLA.DLL - Deleted
C:\WINDOWS\SYSTEM32\ODBUW.DLL - Deleted
C:\WINDOWS\SYSTEM32\ONBCW.DLL - Deleted
C:\WINDOWS\SYSTEM32\PWMDC.DLL - Deleted
C:\WINDOWS\SYSTEM32\QKOXV.DLL - Deleted
C:\WINDOWS\SYSTEM32\QOGRR.DLL - Deleted
C:\WINDOWS\SYSTEM32\QOILO.DLL - Deleted
C:\WINDOWS\SYSTEM32\QPPPL.DLL - Deleted
C:\WINDOWS\SYSTEM32\ROEMM.DLL - Deleted
C:\WINDOWS\SYSTEM32\SDKEU.DLL - Deleted
C:\WINDOWS\SYSTEM32\SDKFU32.DLL - Deleted
C:\WINDOWS\SYSTEM32\SDKND.DLL - Deleted
C:\WINDOWS\SYSTEM32\SLNPQ.DLL - Deleted
C:\WINDOWS\SYSTEM32\SYSCN32.DLL - Deleted
C:\WINDOWS\SYSTEM32\SYSCP.DLL - Deleted
C:\WINDOWS\SYSTEM32\SYSKG.DLL - Deleted
C:\WINDOWS\SYSTEM32\TOECM.DLL - Deleted
C:\WINDOWS\SYSTEM32\TQLFB.DLL - Deleted
C:\WINDOWS\SYSTEM32\TQQQK.DLL - Deleted
C:\WINDOWS\SYSTEM32\TTDAX.DLL - Deleted
C:\WINDOWS\SYSTEM32\UEFFH.DLL - Deleted
C:\WINDOWS\SYSTEM32\UKGYY.DLL - Deleted
C:\WINDOWS\SYSTEM32\UUVPE.DLL - Deleted
C:\WINDOWS\SYSTEM32\VGXFY.DLL - Deleted
C:\WINDOWS\SYSTEM32\VRVXA.DLL - Deleted
C:\WINDOWS\SYSTEM32\VTHZI.DLL - Deleted
C:\WINDOWS\SYSTEM32\WISBW.DLL - Deleted
C:\WINDOWS\SYSTEM32\WNTLV.DLL - Deleted
C:\WINDOWS\SYSTEM32\WVGYX.DLL - Deleted
C:\WINDOWS\SYSTEM32\XJNUC.DLL - Deleted
C:\WINDOWS\SYSTEM32\XXRNR.DLL - Deleted
C:\WINDOWS\system32\a - Deleted
C:\WINDOWS\system32\CONFIG\SYSTEM~1\APPLIC~1\INSTALL.DAT - Deleted
C:\WINDOWS\system32\drivers\etc\hosts.bho - Deleted
C:\WINDOWS\system32\ntfsdi.txt - Deleted
C:\WINDOWS\system32\sahagent1019.exe - Deleted
C:\WINDOWS\system32\TFTP1028 - Deleted
C:\WINDOWS\system32\TFTP1036 - Deleted
C:\WINDOWS\system32\TFTP1052 - Deleted
C:\WINDOWS\system32\TFTP1060 - Deleted
C:\WINDOWS\system32\TFTP1064 - Deleted
C:\WINDOWS\system32\TFTP1072 - Deleted
C:\WINDOWS\system32\TFTP108 - Deleted
C:\WINDOWS\system32\TFTP1080 - Deleted
C:\WINDOWS\system32\TFTP1084 - Deleted
C:\WINDOWS\system32\TFTP1104 - Deleted
C:\WINDOWS\system32\TFTP1108 - Deleted
C:\WINDOWS\system32\TFTP1128 - Deleted
C:\WINDOWS\system32\TFTP1140 - Deleted
C:\WINDOWS\system32\TFTP1152 - Deleted
C:\WINDOWS\system32\TFTP1156 - Deleted
C:\WINDOWS\system32\TFTP1164 - Deleted
C:\WINDOWS\system32\TFTP1188 - Deleted
C:\WINDOWS\system32\TFTP1196 - Deleted
C:\WINDOWS\system32\TFTP1208 - Deleted
C:\WINDOWS\system32\TFTP1232 - Deleted
C:\WINDOWS\system32\TFTP1236 - Deleted
C:\WINDOWS\system32\TFTP1240 - Deleted
C:\WINDOWS\system32\TFTP1252 - Deleted
C:\WINDOWS\system32\TFTP1256 - Deleted
C:\WINDOWS\system32\TFTP1260 - Deleted
C:\WINDOWS\system32\TFTP1288 - Deleted
C:\WINDOWS\system32\TFTP1312 - Deleted
C:\WINDOWS\system32\TFTP1328 - Deleted
C:\WINDOWS\system32\TFTP1344 - Deleted
C:\WINDOWS\system32\TFTP1348 - Deleted
C:\WINDOWS\system32\TFTP136 - Deleted
C:\WINDOWS\system32\TFTP1360 - Deleted
C:\WINDOWS\system32\TFTP1372 - Deleted
C:\WINDOWS\system32\TFTP1384 - Deleted
C:\WINDOWS\system32\TFTP1396 - Deleted
C:\WINDOWS\system32\TFTP1420 - Deleted
C:\WINDOWS\system32\TFTP1428 - Deleted
C:\WINDOWS\system32\TFTP1432 - Deleted
C:\WINDOWS\system32\TFTP1440 - Deleted
C:\WINDOWS\system32\TFTP1452 - Deleted
C:\WINDOWS\system32\TFTP1464 - Deleted
C:\WINDOWS\system32\TFTP1480 - Deleted
C:\WINDOWS\system32\TFTP1488 - Deleted
C:\WINDOWS\system32\TFTP1496 - Deleted
C:\WINDOWS\system32\TFTP1544 - Deleted
C:\WINDOWS\system32\TFTP1548 - Deleted
C:\WINDOWS\system32\TFTP156 - Deleted
C:\WINDOWS\system32\TFTP1580 - Deleted
C:\WINDOWS\system32\TFTP1616 - Deleted
C:\WINDOWS\system32\TFTP1632 - Deleted
C:\WINDOWS\system32\TFTP1644 - Deleted
C:\WINDOWS\system32\TFTP168 - Deleted
C:\WINDOWS\system32\TFTP1704 - Deleted
C:\WINDOWS\system32\TFTP1708 - Deleted
C:\WINDOWS\system32\TFTP172 - Deleted
C:\WINDOWS\system32\TFTP1740 - Deleted
C:\WINDOWS\system32\TFTP1752 - Deleted
C:\WINDOWS\system32\TFTP1792 - Deleted
C:\WINDOWS\system32\TFTP1796 - Deleted
C:\WINDOWS\system32\TFTP180 - Deleted
C:\WINDOWS\system32\TFTP1800 - Deleted
C:\WINDOWS\system32\TFTP1824 - Deleted
C:\WINDOWS\system32\TFTP1872 - Deleted
C:\WINDOWS\system32\TFTP1880 - Deleted
C:\WINDOWS\system32\TFTP1904 - Deleted
C:\WINDOWS\system32\TFTP1908 - Deleted
C:\WINDOWS\system32\TFTP1940 - Deleted
C:\WINDOWS\system32\TFTP1960 - Deleted
C:\WINDOWS\system32\TFTP1968 - Deleted
C:\WINDOWS\system32\TFTP2020 - Deleted
C:\WINDOWS\system32\TFTP2028 - Deleted
C:\WINDOWS\system32\TFTP2032 - Deleted
C:\WINDOWS\system32\TFTP204 - Deleted
C:\WINDOWS\system32\TFTP2052 - Deleted
C:\WINDOWS\system32\TFTP2056 - Deleted
C:\WINDOWS\system32\TFTP2060 - Deleted
C:\WINDOWS\system32\TFTP2068 - Deleted
C:\WINDOWS\system32\TFTP2108 - Deleted
C:\WINDOWS\system32\TFTP2120 - Deleted
C:\WINDOWS\system32\TFTP2128 - Deleted
C:\WINDOWS\system32\TFTP2156 - Deleted
C:\WINDOWS\system32\TFTP2164 - Deleted
C:\WINDOWS\system32\TFTP2172 - Deleted
C:\WINDOWS\system32\TFTP2204 - Deleted
C:\WINDOWS\system32\TFTP2208 - Deleted
C:\WINDOWS\system32\TFTP2212 - Deleted
C:\WINDOWS\system32\TFTP2220 - Deleted
C:\WINDOWS\system32\TFTP2228 - Deleted
C:\WINDOWS\system32\TFTP2232 - Deleted
C:\WINDOWS\system32\TFTP224 - Deleted
C:\WINDOWS\system32\TFTP2240 - Deleted
C:\WINDOWS\system32\TFTP2248 - Deleted
C:\WINDOWS\system32\TFTP2252 - Deleted
C:\WINDOWS\system32\TFTP2272 - Deleted
C:\WINDOWS\system32\TFTP2284 - Deleted
C:\WINDOWS\system32\TFTP2288 - Deleted
C:\WINDOWS\system32\TFTP2308 - Deleted
C:\WINDOWS\system32\TFTP2312 - Deleted
C:\WINDOWS\system32\TFTP2316 - Deleted
C:\WINDOWS\system32\TFTP232 - Deleted
C:\WINDOWS\system32\TFTP2320 - Deleted
C:\WINDOWS\system32\TFTP2340 - Deleted
C:\WINDOWS\system32\TFTP2352 - Deleted
C:\WINDOWS\system32\TFTP2364 - Deleted
C:\WINDOWS\system32\TFTP2368 - Deleted
C:\WINDOWS\system32\TFTP2372 - Deleted
C:\WINDOWS\system32\TFTP2376 - Deleted
C:\WINDOWS\system32\TFTP2388 - Deleted
C:\WINDOWS\system32\TFTP2392 - Deleted
C:\WINDOWS\system32\TFTP2396 - Deleted
C:\WINDOWS\system32\TFTP240 - Deleted
C:\WINDOWS\system32\TFTP2408 - Deleted
C:\WINDOWS\system32\TFTP2412 - Deleted
C:\WINDOWS\system32\TFTP2428 - Deleted
C:\WINDOWS\system32\TFTP2444 - Deleted
C:\WINDOWS\system32\TFTP2448 - Deleted
C:\WINDOWS\system32\TFTP2468 - Deleted
C:\WINDOWS\system32\TFTP2472 - Deleted
C:\WINDOWS\system32\TFTP248 - Deleted
C:\WINDOWS\system32\TFTP2480 - Deleted
C:\WINDOWS\system32\TFTP2496 - Deleted
C:\WINDOWS\system32\TFTP2512 - Deleted
C:\WINDOWS\system32\TFTP2516 - Deleted
C:\WINDOWS\system32\TFTP2524 - Deleted
C:\WINDOWS\system32\TFTP2540 - Deleted
C:\WINDOWS\system32\TFTP2544 - Deleted
C:\WINDOWS\system32\TFTP2556 - Deleted
C:\WINDOWS\system32\TFTP2564 - Deleted
C:\WINDOWS\system32\TFTP2568 - Deleted
C:\WINDOWS\system32\TFTP2572 - Deleted
C:\WINDOWS\system32\TFTP2576 - Deleted
C:\WINDOWS\system32\TFTP2600 - Deleted
C:\WINDOWS\system32\TFTP2608 - Deleted
C:\WINDOWS\system32\TFTP2628 - Deleted
C:\WINDOWS\system32\TFTP2636 - Deleted
C:\WINDOWS\system32\TFTP2640 - Deleted
C:\WINDOWS\system32\TFTP2668 - Deleted
C:\WINDOWS\system32\TFTP2676 - Deleted
C:\WINDOWS\system32\TFTP2688 - Deleted
C:\WINDOWS\system32\TFTP2708 - Deleted
C:\WINDOWS\system32\TFTP2716 - Deleted
C:\WINDOWS\system32\TFTP2732 - Deleted
C:\WINDOWS\system32\TFTP2736 - Deleted
C:\WINDOWS\system32\TFTP2748 - Deleted
C:\WINDOWS\system32\TFTP2756 - Deleted
C:\WINDOWS\system32\TFTP2768 - Deleted
C:\WINDOWS\system32\TFTP2772 - Deleted
C:\WINDOWS\system32\TFTP2780 - Deleted
C:\WINDOWS\system32\TFTP2788 - Deleted
C:\WINDOWS\system32\TFTP2796 - Deleted
C:\WINDOWS\system32\TFTP280 - Deleted
C:\WINDOWS\system32\TFTP2804 - Deleted
C:\WINDOWS\system32\TFTP2808 - Deleted
C:\WINDOWS\system32\TFTP2812 - Deleted
C:\WINDOWS\system32\TFTP2828 - Deleted
C:\WINDOWS\system32\TFTP2832 - Deleted
C:\WINDOWS\system32\TFTP2844 - Deleted
C:\WINDOWS\system32\TFTP2860 - Deleted
C:\WINDOWS\system32\TFTP2864 - Deleted
C:\WINDOWS\system32\TFTP2868 - Deleted
C:\WINDOWS\system32\TFTP2872 - Deleted
C:\WINDOWS\system32\TFTP2876 - Deleted
C:\WINDOWS\system32\TFTP2880 - Deleted
C:\WINDOWS\system32\TFTP2896 - Deleted
C:\WINDOWS\system32\TFTP2904 - Deleted
C:\WINDOWS\system32\TFTP2908 - Deleted
C:\WINDOWS\system32\TFTP2912 - Deleted
C:\WINDOWS\system32\TFTP2920 - Deleted
C:\WINDOWS\system32\TFTP2928 - Deleted
C:\WINDOWS\system32\TFTP2940 - Deleted
C:\WINDOWS\system32\TFTP2948 - Deleted
C:\WINDOWS\system32\TFTP2952 - Deleted
C:\WINDOWS\system32\TFTP2960 - Deleted
C:\WINDOWS\system32\TFTP2976 - Deleted
C:\WINDOWS\system32\TFTP2984 - Deleted
C:\WINDOWS\system32\TFTP2996 - Deleted
C:\WINDOWS\system32\TFTP300 - Deleted
C:\WINDOWS\system32\TFTP3004 - Deleted
C:\WINDOWS\system32\TFTP3008 - Deleted
C:\WINDOWS\system32\TFTP3012 - Deleted
C:\WINDOWS\system32\TFTP3024 - Deleted
C:\WINDOWS\system32\TFTP3028 - Deleted
C:\WINDOWS\system32\TFTP3032 - Deleted
C:\WINDOWS\system32\TFTP3040 - Deleted
C:\WINDOWS\system32\TFTP3044 - Deleted
C:\WINDOWS\system32\TFTP3048 - Deleted
C:\WINDOWS\system32\TFTP3052 - Deleted
C:\WINDOWS\system32\TFTP3056 - Deleted
C:\WINDOWS\system32\TFTP3060 - Deleted
C:\WINDOWS\system32\TFTP3072 - Deleted
C:\WINDOWS\system32\TFTP3076 - Deleted
C:\WINDOWS\system32\TFTP3088 - Deleted
C:\WINDOWS\system32\TFTP3100 - Deleted
C:\WINDOWS\system32\TFTP3116 - Deleted
C:\WINDOWS\system32\TFTP3140 - Deleted
C:\WINDOWS\system32\TFTP3152 - Deleted
C:\WINDOWS\system32\TFTP3164 - Deleted
C:\WINDOWS\system32\TFTP3172 - Deleted
C:\WINDOWS\system32\TFTP3176 - Deleted
C:\WINDOWS\system32\TFTP3196 - Deleted
C:\WINDOWS\system32\TFTP3212 - Deleted
C:\WINDOWS\system32\TFTP3228 - Deleted
C:\WINDOWS\system32\TFTP3240 - Deleted
C:\WINDOWS\system32\TFTP3244 - Deleted
C:\WINDOWS\system32\TFTP3248 - Deleted
C:\WINDOWS\system32\TFTP3260 - Deleted
C:\WINDOWS\system32\TFTP3272 - Deleted
C:\WINDOWS\system32\TFTP3284 - Deleted
C:\WINDOWS\system32\TFTP3296 - Deleted
C:\WINDOWS\system32\TFTP3300 - Deleted
C:\WINDOWS\system32\TFTP3316 - Deleted
C:\WINDOWS\system32\TFTP3320 - Deleted
C:\WINDOWS\system32\TFTP3324 - Deleted
C:\WINDOWS\system32\TFTP3328 - Deleted
C:\WINDOWS\system32\TFTP3332 - Deleted
C:\WINDOWS\system32\TFTP3336 - Deleted
C:\WINDOWS\system32\TFTP3364 - Deleted
C:\WINDOWS\system32\TFTP3376 - Deleted
C:\WINDOWS\system32\TFTP3380 - Deleted
C:\WINDOWS\system32\TFTP3384 - Deleted
C:\WINDOWS\system32\TFTP3388 - Deleted
C:\WINDOWS\system32\TFTP3396 - Deleted
C:\WINDOWS\system32\TFTP3400 - Deleted
C:\WINDOWS\system32\TFTP3408 - Deleted
C:\WINDOWS\system32\TFTP3420 - Deleted
C:\WINDOWS\system32\TFTP3432 - Deleted
C:\WINDOWS\system32\TFTP344 - Deleted
C:\WINDOWS\system32\TFTP3440 - Deleted
C:\WINDOWS\system32\TFTP3448 - Deleted
C:\WINDOWS\system32\TFTP3456 - Deleted
C:\WINDOWS\system32\TFTP3460 - Deleted
C:\WINDOWS\system32\TFTP3464 - Deleted
C:\WINDOWS\system32\TFTP3468 - Deleted
C:\WINDOWS\system32\TFTP3472 - Deleted
C:\WINDOWS\system32\TFTP3476 - Deleted
C:\WINDOWS\system32\TFTP3480 - Deleted
C:\WINDOWS\system32\TFTP3484 - Deleted
C:\WINDOWS\system32\TFTP3496 - Deleted
C:\WINDOWS\system32\TFTP3508 - Deleted
C:\WINDOWS\system32\TFTP3512 - Deleted
C:\WINDOWS\system32\TFTP3516 - Deleted
C:\WINDOWS\system32\TFTP3520 - Deleted
C:\WINDOWS\system32\TFTP3532 - Deleted
C:\WINDOWS\system32\TFTP3536 - Deleted
C:\WINDOWS\system32\TFTP3540 - Deleted
C:\WINDOWS\system32\TFTP3548 - Deleted
C:\WINDOWS\system32\TFTP3564 - Deleted
C:\WINDOWS\system32\TFTP3572 - Deleted
C:\WINDOWS\system32\TFTP3632 - Deleted
C:\WINDOWS\system32\TFTP364 - Deleted
C:\WINDOWS\system32\TFTP3648 - Deleted
C:\WINDOWS\system32\TFTP3652 - Deleted
C:\WINDOWS\system32\TFTP3656 - Deleted
C:\WINDOWS\system32\TFTP3664 - Deleted
C:\WINDOWS\system32\TFTP3680 - Deleted
C:\WINDOWS\system32\TFTP3688 - Deleted
C:\WINDOWS\system32\TFTP3692 - Deleted
C:\WINDOWS\system32\TFTP3700 - Deleted
C:\WINDOWS\system32\TFTP3704 - Deleted
C:\WINDOWS\system32\TFTP3724 - Deleted
C:\WINDOWS\system32\TFTP3728 - Deleted
C:\WINDOWS\system32\TFTP3732 - Deleted
C:\WINDOWS\system32\TFTP3744 - Deleted
C:\WINDOWS\system32\TFTP3748 - Deleted
C:\WINDOWS\system32\TFTP3772 - Deleted
C:\WINDOWS\system32\TFTP3776 - Deleted
C:\WINDOWS\system32\TFTP3780 - Deleted
C:\WINDOWS\system32\TFTP3800 - Deleted
C:\WINDOWS\system32\TFTP3804 - Deleted
C:\WINDOWS\system32\TFTP3812 - Deleted
C:\WINDOWS\system32\TFTP3824 - Deleted
C:\WINDOWS\system32\TFTP3828 - Deleted
C:\WINDOWS\system32\TFTP384 - Deleted
C:\WINDOWS\system32\TFTP3848 - Deleted
C:\WINDOWS\system32\TFTP3856 - Deleted
C:\WINDOWS\system32\TFTP3860 - Deleted
C:\WINDOWS\system32\TFTP3864 - Deleted
C:\WINDOWS\system32\TFTP3868 - Deleted
C:\WINDOWS\system32\TFTP3876 - Deleted
C:\WINDOWS\system32\TFTP3884 - Deleted
C:\WINDOWS\system32\TFTP3888 - Deleted
C:\WINDOWS\system32\TFTP3892 - Deleted
C:\WINDOWS\system32\TFTP3900 - Deleted
C:\WINDOWS\system32\TFTP3916 - Deleted
C:\WINDOWS\system32\TFTP392 - Deleted
C:\WINDOWS\system32\TFTP3920 - Deleted
C:\WINDOWS\system32\TFTP3924 - Deleted
C:\WINDOWS\system32\TFTP3940 - Deleted
C:\WINDOWS\system32\TFTP3944 - Deleted
C:\WINDOWS\system32\TFTP3952 - Deleted
C:\WINDOWS\system32\TFTP396 - Deleted
C:\WINDOWS\system32\TFTP3964 - Deleted
C:\WINDOWS\system32\TFTP3992 - Deleted
C:\WINDOWS\system32\TFTP3996 - Deleted
C:\WINDOWS\system32\TFTP4000 - Deleted
C:\WINDOWS\system32\TFTP4004 - Deleted
C:\WINDOWS\system32\TFTP4012 - Deleted
C:\WINDOWS\system32\TFTP4016 - Deleted
C:\WINDOWS\system32\TFTP4020 - Deleted
C:\WINDOWS\system32\TFTP4024 - Deleted
C:\WINDOWS\system32\TFTP4040 - Deleted
C:\WINDOWS\system32\TFTP4044 - Deleted
C:\WINDOWS\system32\TFTP4052 - Deleted
C:\WINDOWS\system32\TFTP4056 - Deleted
C:\WINDOWS\system32\TFTP4068 - Deleted
C:\WINDOWS\system32\TFTP4072 - Deleted
C:\WINDOWS\system32\TFTP4080 - Deleted
C:\WINDOWS\system32\TFTP4084 - Deleted
C:\WINDOWS\system32\TFTP4092 - Deleted
C:\WINDOWS\system32\TFTP412 - Deleted
C:\WINDOWS\system32\TFTP4128 - Deleted
C:\WINDOWS\system32\TFTP416 - Deleted
C:\WINDOWS\system32\TFTP4404 - Deleted
C:\WINDOWS\system32\TFTP4412 - Deleted
C:\WINDOWS\system32\TFTP4416 - Deleted
C:\WINDOWS\system32\TFTP4456 - Deleted
C:\WINDOWS\system32\TFTP4504 - Deleted
C:\WINDOWS\system32\TFTP4508 - Deleted
C:\WINDOWS\system32\TFTP4552 - Deleted
C:\WINDOWS\system32\TFTP456 - Deleted
C:\WINDOWS\system32\TFTP4572 - Deleted
C:\WINDOWS\system32\TFTP4588 - Deleted
C:\WINDOWS\system32\TFTP464 - Deleted
C:\WINDOWS\system32\TFTP472 - Deleted
C:\WINDOWS\system32\TFTP4748 - Deleted
C:\WINDOWS\system32\TFTP4756 - Deleted
C:\WINDOWS\system32\TFTP4760 - Deleted
C:\WINDOWS\system32\TFTP4772 - Deleted
C:\WINDOWS\system32\TFTP480 - Deleted
C:\WINDOWS\system32\TFTP484 - Deleted
C:\WINDOWS\system32\TFTP4868 - Deleted
C:\WINDOWS\system32\TFTP488 - Deleted
C:\WINDOWS\system32\TFTP496 - Deleted
C:\WINDOWS\system32\TFTP504 - Deleted
C:\WINDOWS\system32\TFTP5064 - Deleted
C:\WINDOWS\system32\TFTP508 - Deleted
C:\WINDOWS\system32\TFTP5148 - Deleted
C:\WINDOWS\system32\TFTP5228 - Deleted
C:\WINDOWS\system32\TFTP5248 - Deleted
C:\WINDOWS\system32\TFTP5264 - Deleted
C:\WINDOWS\system32\TFTP528 - Deleted
C:\WINDOWS\system32\TFTP5304 - Deleted
C:\WINDOWS\system32\TFTP5420 - Deleted
C:\WINDOWS\system32\TFTP5496 - Deleted
C:\WINDOWS\system32\TFTP5516 - Deleted
C:\WINDOWS\system32\TFTP5520 - Deleted
C:\WINDOWS\system32\TFTP5532 - Deleted
C:\WINDOWS\system32\TFTP5560 - Deleted
C:\WINDOWS\system32\TFTP5580 - Deleted
C:\WINDOWS\system32\TFTP5624 - Deleted
C:\WINDOWS\system32\TFTP5792 - Deleted
C:\WINDOWS\system32\TFTP580 - Deleted
C:\WINDOWS\system32\TFTP588 - Deleted
C:\WINDOWS\system32\TFTP5884 - Deleted
C:\WINDOWS\system32\TFTP604 - Deleted
C:\WINDOWS\system32\TFTP6048 - Deleted
C:\WINDOWS\system32\TFTP6124 - Deleted
C:\WINDOWS\system32\TFTP652 - Deleted
C:\WINDOWS\system32\TFTP656 - Deleted
C:\WINDOWS\system32\TFTP668 - Deleted
C:\WINDOWS\system32\TFTP772 - Deleted
C:\WINDOWS\system32\TFTP780 - Deleted
C:\WINDOWS\system32\TFTP792 - Deleted
C:\WINDOWS\system32\TFTP800 - Deleted
C:\WINDOWS\system32\TFTP816 - Deleted
C:\WINDOWS\system32\TFTP824 - Deleted
C:\WINDOWS\system32\TFTP968 - Deleted
C:\WINDOWS\system32\TFTP988 - Deleted
C:\WINDOWS\system32\TFTP992 - Deleted
C:\WINDOWS\system32\TFTP996 - Deleted




Removing Temp Files...

ADS Check:

C:\WINDOWS
No streams found.

C:\WINDOWS\system32
No streams found.

C:\WINDOWS\system32\svchost.exe
No streams found.

C:\WINDOWS\system32\ntoskrnl.exe
No streams found.



Final Check:

catchme 0.3.1333.2 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2007-12-26 20:04:52
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden services & system hive ...

scanning hidden registry entries ...

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\\x00ffc\xd3w\2]
"b049C053C7D38EE4AB9A00CB3B5D2472"="C?\Program Files\Common Files\Microsoft Shared\Web Folders\PUBPLACE.HTT"

scanning hidden files ...

scan completed successfully
hidden processes: 0
hidden services: 0
hidden files: 0


Remaining Services:
------------------



Authorized Application Key Export:

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
"%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabledxpsp2res.dll,-22019"
"C:\\WINDOWS\\system32\\javaw.exe"="C:\\WINDOWS\\system32\\javaw.exe:*isabled:javaw"
"C:\\Program Files\\oDC\\oDC.exe"="C:\\Program Files\\oDC\\oDC.exe:*:EnabledDC"
"C:\\Program Files\\Internet Explorer\\iexplore.exe"="C:\\Program Files\\Internet Explorer\\iexplore.exe:*:Enabled:Internet Explorer"
"C:\\WINDOWS\\system32\\usmt\\migwiz.exe"="C:\\WINDOWS\\system32\\usmt\\migwiz.exe:*isabled:Ohjattu tiedostojen ja asetusten siirt„minen"
"C:\\Program Files\\Messenger\\msmsgs.exe"="C:\\Program Files\\Messenger\\msmsgs.exe:*:Enabled:Windows Messenger"
"C:\\Program Files\\XiRCON\\Xircon.exe"="C:\\Program Files\\XiRCON\\Xircon.exe:*:Enabled:XiRCON IRC Client"
"C:\\Program Files\\mIRC\\mirc.exe"="C:\\Program Files\\mIRC\\mirc.exe:*:Enabled:mIRC"
"C:\\WINDOWS\\system32\\LEXPPS.EXE"="C:\\WINDOWS\\system32\\LEXPPS.EXE:*isabled:LEXPPS.EXE"
"C:\\Program Files\\DC++\\DCPlusPlus.exe"="C:\\Program Files\\DC++\\DCPlusPlus.exe:*:EnabledC++"
"C:\\Program Files\\Illusion Softworks\\Hidden & Dangerous 2 Sabre Squadron Demo\\HD2_SS_demo.exe"="C:\\Program Files\\Illusion Softworks\\Hidden & Dangerous 2 Sabre Squadron Demo\\HD2_SS_demo.exe:*isabled:HD2_SS_demo"
"C:\\Program Files\\Small Rockets\\Red Ace Squadron\\acenet_client_release.exe"="C:\\Program Files\\Small Rockets\\Red Ace Squadron\\acenet_client_release.exe:*isabled:acenet_client_release"
"C:\\WINDOWS\\system32\\ZoneLabs\\vsmon.exe"="C:\\WINDOWS\\system32\\ZoneLabs\\vsmon.exe:*isabled:TrueVector Service"
"C:\\games\\paintball2\\paintball2.exe"="C:\\games\\paintball2\\paintball2.exe:*:Enabledaintball2"
"C:\\Program Files\\RevConnect\\DCPlusPlus.exe"="C:\\Program Files\\RevConnect\\DCPlusPlus.exe:*:EnabledC++"
"C:\\Program Files\\Sunbelt Software\\Personal Firewall 4\\kpf4gui.exe"="C:\\Program Files\\Sunbelt Software\\Personal Firewall 4\\kpf4gui.exe:*:Enabled:Sunbelt Kerio Personal Firewall 4 - GUI"
"C:\\Program Files\\EA GAMES\\Battlefield 2 Demo\\Bf2_w32ded.exe"="C:\\Program Files\\EA GAMES\\Battlefield 2 Demo\\Bf2_w32ded.exe:*isabled:Bf2_w32ded"
"C:\\Program Files\\GameSpy Arcade\\Aphex.exe"="C:\\Program Files\\GameSpy Arcade\\Aphex.exe:*isabled:GameSpy Arcade"
"C:\\Program Files\\Mozilla Firefox\\firefox.exe"="C:\\Program Files\\Mozilla Firefox\\firefox.exe:*:Enabled:Firefox"
"C:\\Program Files\\MSN Messenger\\msncall.exe"="C:\\Program Files\\MSN Messenger\\msncall.exe:*:Enabled:Windows Live Messenger 8.0 (Phone)"
"C:\\Program Files\\BitTorrent\\bittorrent.exe"="C:\\Program Files\\BitTorrent\\bittorrent.exe:*:Enabled:BitTorrent"
"C:\\Program Files\\MSN Messenger\\msnmsgr.exe"="C:\\Program Files\\MSN Messenger\\msnmsgr.exe:*:Enabled:Windows Live Messenger 8.1"
"C:\\Program Files\\MSN Messenger\\livecall.exe"="C:\\Program Files\\MSN Messenger\\livecall.exe:*:Enabled:Windows Live Messenger 8.1 (Phone)"
"C:\\Program Files\\Skype\\Phone\\Skype.exe"="C:\\Program Files\\Skype\\Phone\\Skype.exe:*:Enabled:Skype"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
"%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabledxpsp2res.dll,-22019"
"C:\\Program Files\\MSN Messenger\\msncall.exe"="C:\\Program Files\\MSN Messenger\\msncall.exe:*:Enabled:Windows Live Messenger 8.0 (Phone)"
"C:\\Program Files\\MSN Messenger\\msnmsgr.exe"="C:\\Program Files\\MSN Messenger\\msnmsgr.exe:*:Enabled:Windows Live Messenger 8.1"
"C:\\Program Files\\MSN Messenger\\livecall.exe"="C:\\Program Files\\MSN Messenger\\livecall.exe:*:Enabled:Windows Live Messenger 8.1 (Phone)"

Remaining Files:
---------------

File Backups: - C:\DOCUME~1\MIRASA~1\TYPYT~1\SDFix\backups\backups.zip

Files with Hidden Attributes:

Sat 3 Jul 2004 69,632 ..SHR --- "C:\Program Files\TimeSync\Setup.exe"
Mon 27 Dec 2004 56 ..SHR --- "C:\WINDOWS\system32\89931FC656.sys"
Thu 20 Dec 2007 13,304 A.SH. --- "C:\WINDOWS\system32\KGyGaAvL.sys"
Sat 22 Oct 2005 1,024 ...HR --- "C:\WINDOWS\system32\NTICDMK7.dll"
Sat 22 Oct 2005 1,024 ...HR --- "C:\WINDOWS\system32\NTIMPEG2.dll"
Tue 23 Dec 2003 4,348 ..SH. --- "C:\Documents and Settings\All Users\DRM\DRMv1.bak"
Tue 23 Dec 2003 401 ..SH. --- "C:\Documents and Settings\All Users\DRM\DRMv11.bak"
Fri 5 Mar 2004 401 ..SH. --- "C:\Documents and Settings\All Users\DRM\DRMv12.bak"
Sat 4 Dec 2004 400 A.SH. --- "C:\Documents and Settings\All Users\DRM\v2ks.bla.bak"
Sat 4 Dec 2004 48 A.SH. --- "C:\Documents and Settings\All Users\DRM\v2ks.sec.bak"
Tue 23 Dec 2003 4,348 A..H. --- "C:\Documents and Settings\jari\Mallit\Omat tiedostot\Omat musiikkitiedostot\K„ytt”oikeuden varmuuskopio\drmv1key.bak"
Mon 5 Feb 2007 401 A..H. --- "C:\Documents and Settings\jari\Mallit\Omat tiedostot\Omat musiikkitiedostot\K„ytt”oikeuden varmuuskopio\drmv1lic.bak"
Sat 4 Dec 2004 400 A..H. --- "C:\Documents and Settings\jari\Mallit\Omat tiedostot\Omat musiikkitiedostot\K„ytt”oikeuden varmuuskopio\drmv2key.bak"
Mon 5 Feb 2007 1,536 A..H. --- "C:\Documents and Settings\jari\Mallit\Omat tiedostot\Omat musiikkitiedostot\K„ytt”oikeuden varmuuskopio\drmv2lic.bak"

Finished!

 

scannaa uusi hjt:n loki

 

Siinä:

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 20:38:54, on 26.12.2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Unable to get Internet Explorer version!
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\DMTS\BIN\e3DMTSMediaServer.exe
C:\Program Files\DMTS\BIN\e3DMTSServer.exe
C:\Program Files\Sunbelt Software\Personal Firewall 4\kpf4ss.exe
C:\PROGRA~1\EFFICI~1\ENTERN~1\app\pppoeservice.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Sunbelt Software\Personal Firewall 4\kpf4gui.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\Program Files\Sunbelt Software\Personal Firewall 4\kpf4gui.exe
C:\WINDOWS\System32\igfxtray.exe
C:\WINDOWS\System32\hkcmd.exe
C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe
C:\WINDOWS\system32\LVCOMSX.EXE
C:\Program Files\Logitech\Video\LogiTray.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\program files\quicktime\QTTask.exe
C:\Program Files\Winamp\winampa.exe
C:\PROGRA~1\Nokia\NOKIAP~1\LAUNCH~1.EXE
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\MSN Messenger\msnmsgr.exe
C:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe
C:\Program Files\Logitech\Video\FxSvr2.exe
C:\Program Files\MP4 Player\mp4Player.exe
C:\Program Files\Common Files\PCSuite\Services\ServiceLayer.exe
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\Program Files\WinZip\WZQKPICK.EXE
C:\Program Files\Java\jre1.6.0_01\bin\jucheck.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer,SearchURL = http://searchmiracle.com/sp.php
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.defaulthomepage.info
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,SearchAssistant = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = about:blank
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = about:blank
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = dna Internet Explorer
O2 - BHO: (no name) - {0032CCFA-D80B-DABE-C53B-7E94CD4E0B9D} - (no file)
O2 - BHO: (no name) - {0652BFB3-DCA0-6EB5-0121-05A3DF7367B8} - (no file)
O2 - BHO: (no name) - {086A2B10-CBD6-9425-CAB7-630B339588D1} - (no file)
O2 - BHO: (no name) - {0C0D4791-72DA-02C9-E150-61A802FCA1A8} - (no file)
O2 - BHO: (no name) - {0DD30D6F-BC85-BE03-AAC4-BC866E10846D} - (no file)
O2 - BHO: (no name) - {0DD6CC69-5395-A956-5AE5-C69B4D006EC2} - (no file)
O2 - BHO: (no name) - {1676763F-15C3-F5F2-9C0B-0631705661ED} - (no file)
O2 - BHO: (no name) - {16A47DFB-0B7B-6D1B-05B7-210FEB83CF1C} - (no file)
O2 - BHO: (no name) - {18EDCB89-9926-E8C7-904E-EFC35DCB82D5} - (no file)
O2 - BHO: (no name) - {1EDBFE12-619A-B05D-D81A-42593402A991} - (no file)
O2 - BHO: (no name) - {202DAC62-070A-52D5-F993-6D64D764A5EA} - (no file)
O2 - BHO: (no name) - {2299D671-FC69-27B9-F4B4-AC5172A9786E} - (no file)
O2 - BHO: (no name) - {22D6C587-4D57-6C41-8B40-18989B320034} - (no file)
O2 - BHO: (no name) - {24A47C18-4C17-2AC4-710A-F949DD49082D} - (no file)
O2 - BHO: (no name) - {27C3B6F5-A963-CB77-223E-46F47D8B7709} - (no file)
O2 - BHO: (no name) - {2846032F-8EA0-4EFF-E13E-006290501796} - (no file)
O2 - BHO: (no name) - {288E8A17-EDA8-0E96-CAED-9600B30FF9A5} - (no file)
O2 - BHO: (no name) - {2AA6A6A5-5956-39DD-EADF-D656474D57D6} - (no file)
O2 - BHO: (no name) - {2FEF5742-62AD-6879-1397-ED822907A8BC} - (no file)
O2 - BHO: (no name) - {306F8479-A75A-9D8E-3C63-AD58B0678A6A} - (no file)
O2 - BHO: (no name) - {30A9ADD5-7E61-D29C-8F16-BC8A3DD7C359} - (no file)
O2 - BHO: (no name) - {321F7904-194F-9A0F-04B0-2C3F916C8D1D} - (no file)
O2 - BHO: (no name) - {38F6B10B-D771-3C5C-0291-568F76485423} - (no file)
O2 - BHO: (no name) - {3A0FF4A6-6F8C-C3EC-7A99-26044BF8D2A8} - (no file)
O2 - BHO: (no name) - {3CE36D52-D914-5BA5-C0E2-3F53AE992ABB} - (no file)
O2 - BHO: (no name) - {3E94D258-D83D-C2FC-C50B-C3BD6EF0FC9C} - (no file)
O2 - BHO: (no name) - {41A1C99D-6518-E377-31A3-89E5DBCEC51A} - (no file)
O2 - BHO: (no name) - {483BB598-6B58-345A-9D87-E58BE73678B1} - (no file)
O2 - BHO: (no name) - {4907C9FA-B308-2D69-C19A-9B28CC732FD5} - (no file)
O2 - BHO: (no name) - {4D85109F-9B1A-EFDF-B061-FEADDEDF9ACB} - (no file)
O2 - BHO: (no name) - {53C9AB6D-6031-E16B-125B-94A3A319C53F} - (no file)
O2 - BHO: (no name) - {58BE2EE0-27B6-C905-F9B4-65D8FE8B1DC9} - (no file)
O2 - BHO: (no name) - {593520BA-C478-E0A8-7C1F-ACFF8F9C2EE2} - (no file)
O2 - BHO: (no name) - {5AEDA511-0157-5F17-AC3D-A3D8D05DFE0C} - (no file)
O2 - BHO: (no name) - {602DB26D-2A43-19C2-A0B3-6D5486BCC728} - (no file)
O2 - BHO: (no name) - {61BA9713-4C7D-321C-7CDA-2D19B793429D} - (no file)
O2 - BHO: (no name) - {627C24F9-6820-8569-82C7-CE4F9DCD1EDA} - (no file)
O2 - BHO: (no name) - {646C57CD-B620-5ABD-0600-A30E3EA96595} - (no file)
O2 - BHO: (no name) - {6728F0D9-78EF-A265-D7BD-034EEB9FEA0B} - (no file)
O2 - BHO: (no name) - {67852D6B-C5A1-E2D1-3727-9D903FF50A97} - (no file)
O2 - BHO: (no name) - {68BA8E7B-48F1-E65F-C86B-FB26EE5902B5} - (no file)
O2 - BHO: (no name) - {69C2D265-3B93-BC0A-676E-D0FD27DA5AC6} - (no file)
O2 - BHO: (no name) - {6E0F0093-EF04-1478-FE8A-D4B3176F0CE3} - (no file)
O2 - BHO: (no name) - {6F4AA1CD-0529-44EE-B9DA-6790B9FEE37D} - (no file)
O2 - BHO: (no name) - {73A0B877-8957-66D4-B512-A5E6B2821E0C} - (no file)
O2 - BHO: (no name) - {7869AA49-B066-89FC-E5A0-AA47596F235C} - (no file)
O2 - BHO: (no name) - {7A318DE9-62B5-FF57-A970-C3C5DEFD3476} - (no file)
O2 - BHO: (no name) - {7A9255F3-6C7E-1DF9-4197-04A41E0B4D35} - (no file)
O2 - BHO: (no name) - {7CE5DA5D-F491-C0B6-884D-D9D4A9E4C7E4} - (no file)
O2 - BHO: (no name) - {80DAA425-DA60-3DA0-927D-F4CE735B581F} - (no file)
O2 - BHO: (no name) - {846E0BB2-4B7E-3DCA-BD80-7211A3EE88C4} - (no file)
O2 - BHO: (no name) - {8601EBC1-771F-266D-EE13-367627EBB1C8} - (no file)
O2 - BHO: (no name) - {8CA0C19A-072F-E5BB-47B2-C2B1F0E69C3B} - (no file)
O2 - BHO: (no name) - {8EA257CF-EDDF-09CA-1536-29E313C464B0} - (no file)
O2 - BHO: (no name) - {8F547B81-9875-B29A-2CDD-894B09440339} - (no file)
O2 - BHO: (no name) - {90839338-C0AA-11B0-7B9F-AC49064480E4} - (no file)
O2 - BHO: (no name) - {90BA9555-264A-4FB1-7251-DD5A22605A95} - (no file)
O2 - BHO: (no name) - {932F05AE-5941-1C8D-8A0A-AF1CA446E213} - (no file)
O2 - BHO: (no name) - {9B4B2B54-76F6-F3EA-12C8-5C2E5C112D23} - (no file)
O2 - BHO: (no name) - {A21F48DC-4264-EDA7-91A1-61769CB74D7A} - (no file)
O2 - BHO: (no name) - {A3ABABDA-544D-9E70-AE96-BE2F5DCF0B5A} - (no file)
O2 - BHO: (no name) - {A65F11A0-3D1B-37FD-F86D-9AB8607151F1} - (no file)
O2 - BHO: (no name) - {A6BF6993-7E8F-9CEB-1B08-1684CC14C18F} - (no file)
O2 - BHO: (no name) - {B764800B-F1F8-8788-4C16-55E92C3AB819} - (no file)
O2 - BHO: (no name) - {B78A3B74-89E9-5BA8-08EF-3977908BA3A0} - (no file)
O2 - BHO: (no name) - {BA997092-5DFF-A91F-6516-A449FC336452} - (no file)
O2 - BHO: (no name) - {C207C0FE-A804-D46C-81D2-A2A37FC7ED6B} - (no file)
O2 - BHO: (no name) - {C486F978-8D65-4A98-0179-CD984597B279} - (no file)
O2 - BHO: (no name) - {C50E4BE1-5DBD-CF1C-E7DB-13BABB1AE884} - (no file)
O2 - BHO: (no name) - {C526847B-FEE3-1038-3C38-9D537D50C2E2} - (no file)
O2 - BHO: (no name) - {C7339624-BDA9-0FBB-8706-46F6CC80401F} - (no file)
O2 - BHO: (no name) - {C75F302C-5DED-C090-F779-5337D7567BC3} - (no file)
O2 - BHO: (no name) - {C8BD785F-EB60-D323-EF30-B49C0D77C3C9} - (no file)
O2 - BHO: (no name) - {C8D54406-6EF3-7F0E-38BB-D6313B9FD92D} - (no file)
O2 - BHO: (no name) - {C970DB1E-CFEB-B341-5FA1-C2EE692D7DE2} - (no file)
O2 - BHO: (no name) - {CC5B5524-AEF5-F97F-E4E0-90901289B58D} - (no file)
O2 - BHO: (no name) - {D262910D-9F97-CA3A-15AA-9A5DEF559433} - (no file)
O2 - BHO: (no name) - {D58CC2B4-EB82-B5B9-733C-C5EBB3479058} - (no file)
O2 - BHO: (no name) - {D8010B5A-E220-B876-B855-D2861F450A0C} - (no file)
O2 - BHO: (no name) - {D907E5C7-7927-96F9-E4D0-07D10F017866} - (no file)
O2 - BHO: (no name) - {D9529B1E-58BD-C16B-D9B2-14013AC2FD84} - (no file)
O2 - BHO: (no name) - {DD2786BE-3BE2-FC80-F475-561735175B9A} - (no file)
O2 - BHO: (no name) - {DF7AF568-EF3E-A828-A764-D93713B760D7} - (no file)
O2 - BHO: (no name) - {E449D7C3-56B4-A3C0-3D0E-9B4733929115} - (no file)
O2 - BHO: (no name) - {E464D507-70C1-E654-A743-720591F1BB59} - (no file)
O2 - BHO: (no name) - {E67AAEA4-63EA-88A3-538E-D852FAE59639} - (no file)
O2 - BHO: (no name) - {E9657FD2-2FA2-A768-AE41-168F3181BC64} - (no file)
O2 - BHO: (no name) - {EB8B1EA0-A145-1D54-2B42-5843DD823A38} - (no file)
O2 - BHO: (no name) - {ED773C7F-04E4-55BD-4C88-E5F4D8E57CAA} - (no file)
O2 - BHO: (no name) - {EE33BD6D-AA1B-2FDF-2890-E084563E9868} - (no file)
O2 - BHO: (no name) - {F3C35F31-DCAA-23E8-21EA-00AC5AD3470E} - (no file)
O2 - BHO: (no name) - {F3C3DC70-25D1-3C6C-E10B-C6BF822AC5DA} - (no file)
O2 - BHO: (no name) - {F7AC6D6E-CC2C-9312-B04A-BE6B29FCC68C} - (no file)
O2 - BHO: (no name) - {F800B528-4FAF-AC2B-99E6-CC7371F0E741} - (no file)
O2 - BHO: (no name) - {FBA69C0B-86A6-19AD-2AF4-F5150E5C1CAE} - (no file)
O2 - BHO: (no name) - {FC381A47-95AC-8A69-D7B5-D90C1513C5E7} - (no file)
O2 - BHO: (no name) - {FCEBB27B-4E18-DA71-68DF-31397091EAF8} - (no file)
O2 - BHO: (no name) - {FD36CB53-F43E-C115-ED98-E1F307C77FD6} - (no file)
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\System32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\System32\hkcmd.exe
O4 - HKLM\..\Run: [SafeGuard Popup Blocker Updater (required)] regsvr32 /s C:\WINDOWS\System32\sfg6714.dll
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe"
O4 - HKLM\..\Run: [MSNMSGRS1] C:\swed.bat
O4 - HKLM\..\Run: [LVCOMSX] C:\WINDOWS\system32\LVCOMSX.EXE
O4 - HKLM\..\Run: [LogitechVideoRepair] C:\Program Files\Logitech\Video\ISStart.exe
O4 - HKLM\..\Run: [LogitechVideoTray] C:\Program Files\Logitech\Video\LogiTray.exe
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\program files\quicktime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [Microsoft media services] winmplayer.exe
O4 - HKLM\..\Run: [Media Load] msn32.exe
O4 - HKLM\..\Run: [msconfig service] MSupdate32.exe
O4 - HKLM\..\Run: [Windows Download Manager] DllHost32.exe
O4 - HKLM\..\Run: [NTFSSAPI] ntfsapi.exe
O4 - HKLM\..\Run: [WinampAgent] C:\Program Files\Winamp\winampa.exe
O4 - HKLM\..\Run: [PCSuiteTrayApplication] C:\PROGRA~1\Nokia\NOKIAP~1\LAUNCH~1.EXE -startup
O4 - HKLM\..\RunServices: [Microsoft media services] winmplayer.exe
O4 - HKLM\..\RunServices: [Media Load] msn32.exe
O4 - HKLM\..\RunServices: [msconfig service] MSupdate32.exe
O4 - HKLM\..\RunServices: [Windows Download Manager] DllHost32.exe
O4 - HKLM\..\RunServices: [NTFSSAPI] ntfsapi.exe
O4 - HKLM\..\RunOnce: [SpybotDeletingE9840] "C:\Program Files\Spybot - Search & Destroy\SDDelFile.exe" "C:\WINDOWS\system32\6fo4svc.dll"
O4 - HKLM\..\RunOnce: [SpybotDeletingE3663] "C:\Program Files\Spybot - Search & Destroy\SDDelFile.exe" "C:\WINDOWS\system32\6fo4svc.dll"
O4 - HKLM\..\RunOnce: [SpybotDeletingE5894] "C:\Program Files\Spybot - Search & Destroy\SDDelFile.exe" "C:\WINDOWS\system32\6fo4svc.dll"
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background
O4 - HKCU\..\Run: [PcSync] C:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe /NoDialog
O4 - HKCU\..\Run: [MP4 Player] "C:\Program Files\MP4 Player\mp4Player.exe" hmw
O4 - HKCU\..\Run: [updateMgr] "C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe" AcRdB7_0_8
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKCU\..\RunOnce: [SpybotDeletingF4864] "C:\Program Files\Spybot - Search & Destroy\SDDelFile.exe" "C:\WINDOWS\system32\6fo4svc.dll"
O4 - HKCU\..\RunOnce: [SpybotDeletingF7302] "C:\Program Files\Spybot - Search & Destroy\SDDelFile.exe" "C:\WINDOWS\system32\6fo4svc.dll"
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Paikallinen palve')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Verkkopalve')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\Run: [MSN Messanger] msnmsng.exe (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\Run: [winguard] wingrd32.exe (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\Run: [Windows Lmhost Util] lmhost.exe (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\Run: [Win32 USB2 Driver] win32usb.exe (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\Run: [MicrosoftUpdate] syshelper.exe (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\Run: [Microsoft Task Monitor] taskmger.exe (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\Run: [Windows Messenger] msmsgs.exe (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\Run: [Sysino] lsess.exe (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\Run: [Nvidia CTRL Panel] ncsvc32.exe (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\RunOnce: [Windows Lmhost Util] lmhost.exe (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\RunServices: [MSN Messanger] msnmsng.exe (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
O4 - HKUS\.DEFAULT\..\RunOnce: [Windows Lmhost Util] lmhost.exe (User 'Default user')
O4 - HKUS\.DEFAULT\..\RunServices: [MSN Messanger] msnmsng.exe (User 'Default user')
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: WinZip Quick Pick.lnk = C:\Program Files\WinZip\WZQKPICK.EXE
O8 - Extra context menu item: Web Savings - file://C:\Program Files\WebSavingsfromEbates\System\Temp\ebateswebsavings_script0.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\npjpi160_01.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\npjpi160_01.dll
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search && Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: RaptisoftGameLoader - http://www.miniclip.com/hamsterball/raptisoftgameloader.cab
O16 - DPF: v2cab - http://searchmiracle.com/cab/v2cab.cab
O16 - DPF: v3cab - http://searchmiracle.com/cab/1.cab
O16 - DPF: {00000EF1-0786-4633-87C6-1AA7A44296DA} - http://www.addictivetechnologies.net/DM0/cab/ATPartners.cab
O16 - DPF: {0594AF7E-573B-40DF-8165-E47AB2EAEFE8} - http://akamai.downloadv3.com/binaries/P2EClient/EGAUTH_1019_EN_XP.cab
O16 - DPF: {0E4796D6-A990-4372-9069-72FBDB4AE868} - http://www.one2one.com/static/class/one2oneSvc.cab
O16 - DPF: {15AD4789-CDB4-47E1-A9DA-992EE8E6BAD6} - http://static.windupdates.com/cab/ClickYesToContinue/ie/bridge-c3.cab
O16 - DPF: {1D4DB7D2-6EC9-47A3-BD87-1E41684E07BB} - http://ak.imgfarm.com/images/nocache/funwebproducts/ei/SmileyCentralInitialSetup1.0.0.8.cab
O16 - DPF: {2AEEAC34-FD74-4142-B891-4B05C0C03C87} - http://akamai.downloadv3.com/binaries/DialHTML/EGCOMSERVICE_1046_pack_XP.cab
O16 - DPF: {3468FCFD-E656-47CF-838D-A350F84EB1CC} - http://activex.microsoft.com/objects/ocget.dll
O16 - DPF: {469C7080-8EC8-43A6-AD97-45848113743C} - http://akamai.downloadv3.com/binaries/IA/nethv32_EN_XP.cab
O16 - DPF: {5C3A9EA6-4068-46B8-8B5A-692FB10607B1} - http://www.grupomarineda.net/auto/DialerData.cab
O16 - DPF: {706F3805-27D7-478D-80E5-E25D2BB030B3} - http://www.advnt01.com/dialer/internazionale_ver3.CAB
O16 - DPF: {7589EEE6-E336-11D4-8A7E-EE1D971D9B47} - http://secure.aconti.net/acontix/goodthinxx.cab
O16 - DPF: {771A1334-6B08-4A6B-AEDC-CF994BA2CEBE} - http://www.ysbweb.com/ist/softwares/v4.0/ysb_regular.cab
O16 - DPF: {79849612-A98F-45B8-95E9-4D13C7B6B35C} - http://static.topconverting.com/activex/loader2.ocx
O16 - DPF: {91433D86-9F27-402C-B5E3-DEBDD122C339} - http://www.netvenda.com/sites/games-intl/fi/games4.cab
O16 - DPF: {91BE8DAC-957E-416C-B735-E2B63CDB915B} (MyEMessengerSetup Control) - http://www.myemessenger.com/activex/MyEMessengerSetupProject.cab
O16 - DPF: {9EB320CE-BE1D-4304-A081-4B4665414BEF} - http://www.mt-download.com/MediaTicketsInstaller.cab
O16 - DPF: {A5B4176A-5347-4CEC-AB75-26947BB34183} (InstaladorBetyByte Control) - http://www.redzone.fi/uploads/cab/instaladorbetybyteuk.cab
O16 - DPF: {A5DC33CE-214B-4C26-8596-8A45456C9EB8} (RNGCIECtl Class) - http://activex.microsoft.com/objects/ocget.dll
O16 - DPF: {B942A249-D1E7-4C11-98AE-FCB76B08747F} (RealArcadeRdxIE Class) - http://games-dl.real.com/gameconsole/Bundler/CAB/RealArcadeRdxIE.cab
O16 - DPF: {FE4BBEA8-1EFD-4B8A-BD1B-341CCDBEEAA6} - http://ads.dealhelper.com/updates/DealHelperNew.cab
O16 - DPF: {FE5D6722-826F-11D5-A24E-0060B0F1A5AE} (Tukati Launcher) - http://www.tukati.com/software/4/1.7.20.20/tukati.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{39D78B64-F1D5-4C55-8DB8-2759D59EBBE4}: NameServer = 213.139.190.3 212.50.131.153
O20 - AppInit_DLLs: C:\PROGRA~1\Google\GOOGLE~2\GOEC62~1.DLL
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: e-3 DMTS Media Server (e3DMTSMediaServer) - Unknown owner - C:\Program Files\DMTS\BIN\e3DMTSMediaServer.exe
O23 - Service: e-3 DMTS Server (e3DMTSServer) - Unknown owner - C:\Program Files\DMTS\BIN\e3DMTSServer.exe
O23 - Service: GoogleDesktopManager - Google - C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
O23 - Service: Sunbelt Kerio Personal Firewall 4 (KPF4) - Sunbelt Software - C:\Program Files\Sunbelt Software\Personal Firewall 4\kpf4ss.exe
O23 - Service: PPPoE Service (PPPoEService) - Unknown owner - C:\PROGRA~1\EFFICI~1\ENTERN~1\app\pppoeservice.exe
O23 - Service: ServiceLayer - Nokia. - C:\Program Files\Common Files\PCSuite\Services\ServiceLayer.exe

--
End of file - 19105 bytes

 

Ota nuo pois päältä

1. Käynnistä Spybot-S&D Edistyneessä tilassa
2. Jos se ei ole Edistyneessä tilassa, mene Tila-valikkoon ja valitse Edistynyt tila
3. Klikkaa vasemmalla Työkalut
4. Klikkaa listassa Pysyvä suojaus
5. Ota rasti pois kohdasta "Pysyvä TeaTimer" ja paina OK.
6. Käynnistä kone uudelleen.


Avaa Windows Defender.
Klikkaa Tools ja General Settings.
Selaa alas ja ota rasti pois Turn on real-time protection (recommended)-kohdasta.
Tämän jälkeen klikkaa Save ja sulje Windows Defender.


=================

Scannaa hjt:llä merkkaa paina Fix checked

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,SearchAssistant = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = about:blank
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = about:blank
O2 - BHO: (no name) - {0032CCFA-D80B-DABE-C53B-7E94CD4E0B9D} - (no file)
O2 - BHO: (no name) - {0652BFB3-DCA0-6EB5-0121-05A3DF7367B8} - (no file)
O2 - BHO: (no name) - {086A2B10-CBD6-9425-CAB7-630B339588D1} - (no file)
O2 - BHO: (no name) - {0C0D4791-72DA-02C9-E150-61A802FCA1A8} - (no file)
O2 - BHO: (no name) - {0DD30D6F-BC85-BE03-AAC4-BC866E10846D} - (no file)
O2 - BHO: (no name) - {0DD6CC69-5395-A956-5AE5-C69B4D006EC2} - (no file)
O2 - BHO: (no name) - {1676763F-15C3-F5F2-9C0B-0631705661ED} - (no file)
O2 - BHO: (no name) - {16A47DFB-0B7B-6D1B-05B7-210FEB83CF1C} - (no file)
O2 - BHO: (no name) - {18EDCB89-9926-E8C7-904E-EFC35DCB82D5} - (no file)
O2 - BHO: (no name) - {1EDBFE12-619A-B05D-D81A-42593402A991} - (no file)
O2 - BHO: (no name) - {202DAC62-070A-52D5-F993-6D64D764A5EA} - (no file)
O2 - BHO: (no name) - {2299D671-FC69-27B9-F4B4-AC5172A9786E} - (no file)
O2 - BHO: (no name) - {22D6C587-4D57-6C41-8B40-18989B320034} - (no file)
O2 - BHO: (no name) - {24A47C18-4C17-2AC4-710A-F949DD49082D} - (no file)
O2 - BHO: (no name) - {27C3B6F5-A963-CB77-223E-46F47D8B7709} - (no file)
O2 - BHO: (no name) - {2846032F-8EA0-4EFF-E13E-006290501796} - (no file)
O2 - BHO: (no name) - {288E8A17-EDA8-0E96-CAED-9600B30FF9A5} - (no file)
O2 - BHO: (no name) - {2AA6A6A5-5956-39DD-EADF-D656474D57D6} - (no file)
O2 - BHO: (no name) - {2FEF5742-62AD-6879-1397-ED822907A8BC} - (no file)
O2 - BHO: (no name) - {306F8479-A75A-9D8E-3C63-AD58B0678A6A} - (no file)
O2 - BHO: (no name) - {30A9ADD5-7E61-D29C-8F16-BC8A3DD7C359} - (no file)
O2 - BHO: (no name) - {321F7904-194F-9A0F-04B0-2C3F916C8D1D} - (no file)
O2 - BHO: (no name) - {38F6B10B-D771-3C5C-0291-568F76485423} - (no file)
O2 - BHO: (no name) - {3A0FF4A6-6F8C-C3EC-7A99-26044BF8D2A8} - (no file)
O2 - BHO: (no name) - {3CE36D52-D914-5BA5-C0E2-3F53AE992ABB} - (no file)
O2 - BHO: (no name) - {3E94D258-D83D-C2FC-C50B-C3BD6EF0FC9C} - (no file)
O2 - BHO: (no name) - {41A1C99D-6518-E377-31A3-89E5DBCEC51A} - (no file)
O2 - BHO: (no name) - {483BB598-6B58-345A-9D87-E58BE73678B1} - (no file)
O2 - BHO: (no name) - {4907C9FA-B308-2D69-C19A-9B28CC732FD5} - (no file)
O2 - BHO: (no name) - {4D85109F-9B1A-EFDF-B061-FEADDEDF9ACB} - (no file)
O2 - BHO: (no name) - {53C9AB6D-6031-E16B-125B-94A3A319C53F} - (no file)
O2 - BHO: (no name) - {58BE2EE0-27B6-C905-F9B4-65D8FE8B1DC9} - (no file)
O2 - BHO: (no name) - {593520BA-C478-E0A8-7C1F-ACFF8F9C2EE2} - (no file)
O2 - BHO: (no name) - {5AEDA511-0157-5F17-AC3D-A3D8D05DFE0C} - (no file)
O2 - BHO: (no name) - {602DB26D-2A43-19C2-A0B3-6D5486BCC728} - (no file)
O2 - BHO: (no name) - {61BA9713-4C7D-321C-7CDA-2D19B793429D} - (no file)
O2 - BHO: (no name) - {627C24F9-6820-8569-82C7-CE4F9DCD1EDA} - (no file)
O2 - BHO: (no name) - {646C57CD-B620-5ABD-0600-A30E3EA96595} - (no file)
O2 - BHO: (no name) - {6728F0D9-78EF-A265-D7BD-034EEB9FEA0B} - (no file)
O2 - BHO: (no name) - {67852D6B-C5A1-E2D1-3727-9D903FF50A97} - (no file)
O2 - BHO: (no name) - {68BA8E7B-48F1-E65F-C86B-FB26EE5902B5} - (no file)
O2 - BHO: (no name) - {69C2D265-3B93-BC0A-676E-D0FD27DA5AC6} - (no file)
O2 - BHO: (no name) - {6E0F0093-EF04-1478-FE8A-D4B3176F0CE3} - (no file)
O2 - BHO: (no name) - {6F4AA1CD-0529-44EE-B9DA-6790B9FEE37D} - (no file)
O2 - BHO: (no name) - {73A0B877-8957-66D4-B512-A5E6B2821E0C} - (no file)
O2 - BHO: (no name) - {7869AA49-B066-89FC-E5A0-AA47596F235C} - (no file)
O2 - BHO: (no name) - {7A318DE9-62B5-FF57-A970-C3C5DEFD3476} - (no file)
O2 - BHO: (no name) - {7A9255F3-6C7E-1DF9-4197-04A41E0B4D35} - (no file)
O2 - BHO: (no name) - {7CE5DA5D-F491-C0B6-884D-D9D4A9E4C7E4} - (no file)
O2 - BHO: (no name) - {80DAA425-DA60-3DA0-927D-F4CE735B581F} - (no file)
O2 - BHO: (no name) - {846E0BB2-4B7E-3DCA-BD80-7211A3EE88C4} - (no file)
O2 - BHO: (no name) - {8601EBC1-771F-266D-EE13-367627EBB1C8} - (no file)
O2 - BHO: (no name) - {8CA0C19A-072F-E5BB-47B2-C2B1F0E69C3B} - (no file)
O2 - BHO: (no name) - {8EA257CF-EDDF-09CA-1536-29E313C464B0} - (no file)
O2 - BHO: (no name) - {8F547B81-9875-B29A-2CDD-894B09440339} - (no file)
O2 - BHO: (no name) - {90839338-C0AA-11B0-7B9F-AC49064480E4} - (no file)
O2 - BHO: (no name) - {90BA9555-264A-4FB1-7251-DD5A22605A95} - (no file)
O2 - BHO: (no name) - {932F05AE-5941-1C8D-8A0A-AF1CA446E213} - (no file)
O2 - BHO: (no name) - {9B4B2B54-76F6-F3EA-12C8-5C2E5C112D23} - (no file)
O2 - BHO: (no name) - {A21F48DC-4264-EDA7-91A1-61769CB74D7A} - (no file)
O2 - BHO: (no name) - {A3ABABDA-544D-9E70-AE96-BE2F5DCF0B5A} - (no file)
O2 - BHO: (no name) - {A65F11A0-3D1B-37FD-F86D-9AB8607151F1} - (no file)
O2 - BHO: (no name) - {A6BF6993-7E8F-9CEB-1B08-1684CC14C18F} - (no file)
O2 - BHO: (no name) - {B764800B-F1F8-8788-4C16-55E92C3AB819} - (no file)
O2 - BHO: (no name) - {B78A3B74-89E9-5BA8-08EF-3977908BA3A0} - (no file)
O2 - BHO: (no name) - {BA997092-5DFF-A91F-6516-A449FC336452} - (no file)
O2 - BHO: (no name) - {C207C0FE-A804-D46C-81D2-A2A37FC7ED6B} - (no file)
O2 - BHO: (no name) - {C486F978-8D65-4A98-0179-CD984597B279} - (no file)
O2 - BHO: (no name) - {C50E4BE1-5DBD-CF1C-E7DB-13BABB1AE884} - (no file)
O2 - BHO: (no name) - {C526847B-FEE3-1038-3C38-9D537D50C2E2} - (no file)
O2 - BHO: (no name) - {C7339624-BDA9-0FBB-8706-46F6CC80401F} - (no file)
O2 - BHO: (no name) - {C75F302C-5DED-C090-F779-5337D7567BC3} - (no file)
O2 - BHO: (no name) - {C8BD785F-EB60-D323-EF30-B49C0D77C3C9} - (no file)
O2 - BHO: (no name) - {C8D54406-6EF3-7F0E-38BB-D6313B9FD92D} - (no file)
O2 - BHO: (no name) - {C970DB1E-CFEB-B341-5FA1-C2EE692D7DE2} - (no file)
O2 - BHO: (no name) - {CC5B5524-AEF5-F97F-E4E0-90901289B58D} - (no file)
O2 - BHO: (no name) - {D262910D-9F97-CA3A-15AA-9A5DEF559433} - (no file)
O2 - BHO: (no name) - {D58CC2B4-EB82-B5B9-733C-C5EBB3479058} - (no file)
O2 - BHO: (no name) - {D8010B5A-E220-B876-B855-D2861F450A0C} - (no file)
O2 - BHO: (no name) - {D907E5C7-7927-96F9-E4D0-07D10F017866} - (no file)
O2 - BHO: (no name) - {D9529B1E-58BD-C16B-D9B2-14013AC2FD84} - (no file)
O2 - BHO: (no name) - {DD2786BE-3BE2-FC80-F475-561735175B9A} - (no file)
O2 - BHO: (no name) - {DF7AF568-EF3E-A828-A764-D93713B760D7} - (no file)
O2 - BHO: (no name) - {E449D7C3-56B4-A3C0-3D0E-9B4733929115} - (no file)
O2 - BHO: (no name) - {E464D507-70C1-E654-A743-720591F1BB59} - (no file)
O2 - BHO: (no name) - {E67AAEA4-63EA-88A3-538E-D852FAE59639} - (no file)
O2 - BHO: (no name) - {E9657FD2-2FA2-A768-AE41-168F3181BC64} - (no file)
O2 - BHO: (no name) - {EB8B1EA0-A145-1D54-2B42-5843DD823A38} - (no file)
O2 - BHO: (no name) - {ED773C7F-04E4-55BD-4C88-E5F4D8E57CAA} - (no file)
O2 - BHO: (no name) - {EE33BD6D-AA1B-2FDF-2890-E084563E9868} - (no file)
O2 - BHO: (no name) - {F3C35F31-DCAA-23E8-21EA-00AC5AD3470E} - (no file)
O2 - BHO: (no name) - {F3C3DC70-25D1-3C6C-E10B-C6BF822AC5DA} - (no file)
O2 - BHO: (no name) - {F7AC6D6E-CC2C-9312-B04A-BE6B29FCC68C} - (no file)
O2 - BHO: (no name) - {F800B528-4FAF-AC2B-99E6-CC7371F0E741} - (no file)
O2 - BHO: (no name) - {FBA69C0B-86A6-19AD-2AF4-F5150E5C1CAE} - (no file)
O2 - BHO: (no name) - {FC381A47-95AC-8A69-D7B5-D90C1513C5E7} - (no file)
O2 - BHO: (no name) - {FCEBB27B-4E18-DA71-68DF-31397091EAF8} - (no file)
O2 - BHO: (no name) - {FD36CB53-F43E-C115-ED98-E1F307C77FD6} - (no file)
O4 - HKLM\..\Run: [MSNMSGRS1] C:\swed.bat
O4 - HKLM\..\Run: [Microsoft media services] winmplayer.exe
O4 - HKLM\..\Run: [Media Load] msn32.exe
O4 - HKLM\..\Run: [msconfig service] MSupdate32.exe
O4 - HKLM\..\RunServices: [Microsoft media services] winmplayer.exe
O4 - HKLM\..\RunServices: [Media Load] msn32.exe
O4 - HKLM\..\RunServices: [msconfig service] MSupdate32.exe
O4 - HKUS\S-1-5-18\..\Run: [MSN Messanger] msnmsng.exe (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\Run: [winguard] wingrd32.exe (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\Run: [Win32 USB2 Driver] win32usb.exe (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\Run: [MicrosoftUpdate] syshelper.exe (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\Run: [Sysino] lsess.exe (User 'SYSTEM')
O16 - DPF: RaptisoftGameLoader - http://www.miniclip.com/hamsterball/raptisoftgameloader.cab
O16 - DPF: {15AD4789-CDB4-47E1-A9DA-992EE8E6BAD6} - http://static.windupdates.com/cab/ClickY...e/bridge-c3.cab
O16 - DPF: {1D4DB7D2-6EC9-47A3-BD87-1E41684E07BB} - http://ak.imgfarm.com/images/nocache/fun...etup1.0.0.8.cab
O16 - DPF: {79849612-A98F-45B8-95E9-4D13C7B6B35C} - http://static.topconverting.com/activex/loader2.ocx[/color]

================

1.Lataa combofix.exe työpöydällesi jommastakummasta linkistä:
combofix1
combofix2

2. Tuplaklikkaa combofix.exe tiedostoa ja seuraa ohjeistuksia.
3. Kun työkalu on valmis, se tuottaa lokin. Lähetä tämä loki viesti ketjuusi.
Huom! Älä klikkaile combofixin ikkunaa käytön aikana. Tämä saattaa aiheuttaa ohjelman jumiutumisen.

===============

scannaa uusi hjt:n loki
laita myös combofix raportti

 

Tässä hjt loki:

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 22:07:29, on 26.12.2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Unable to get Internet Explorer version!
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\cmd.exe
C:\WINDOWS\System32\igfxtray.exe
C:\WINDOWS\System32\hkcmd.exe
C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe
C:\WINDOWS\system32\LVCOMSX.EXE
C:\Program Files\Logitech\Video\LogiTray.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\program files\quicktime\QTTask.exe
C:\Program Files\Winamp\winampa.exe
C:\PROGRA~1\Nokia\NOKIAP~1\LAUNCH~1.EXE
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\MSN Messenger\msnmsgr.exe
C:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe
C:\Program Files\MP4 Player\mp4Player.exe
C:\Program Files\DMTS\BIN\e3DMTSMediaServer.exe
C:\Program Files\WinZip\WZQKPICK.EXE
C:\Program Files\DMTS\BIN\e3DMTSServer.exe
C:\Program Files\Sunbelt Software\Personal Firewall 4\kpf4ss.exe
C:\PROGRA~1\EFFICI~1\ENTERN~1\app\pppoeservice.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Logitech\Video\FxSvr2.exe
C:\Program Files\Sunbelt Software\Personal Firewall 4\kpf4gui.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\Program Files\Common Files\PCSuite\Services\ServiceLayer.exe
C:\Program Files\Sunbelt Software\Personal Firewall 4\kpf4gui.exe
C:\Program Files\Java\jre1.6.0_01\bin\jucheck.exe
C:\WINDOWS\system32\notepad.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer,SearchURL = http://searchmiracle.com/sp.php
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.defaulthomepage.info
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\System32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\System32\hkcmd.exe
O4 - HKLM\..\Run: [SafeGuard Popup Blocker Updater (required)] regsvr32 /s C:\WINDOWS\System32\sfg6714.dll
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe"
O4 - HKLM\..\Run: [LVCOMSX] C:\WINDOWS\system32\LVCOMSX.EXE
O4 - HKLM\..\Run: [LogitechVideoRepair] C:\Program Files\Logitech\Video\ISStart.exe
O4 - HKLM\..\Run: [LogitechVideoTray] C:\Program Files\Logitech\Video\LogiTray.exe
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\program files\quicktime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [Windows Download Manager] DllHost32.exe
O4 - HKLM\..\Run: [NTFSSAPI] ntfsapi.exe
O4 - HKLM\..\Run: [WinampAgent] C:\Program Files\Winamp\winampa.exe
O4 - HKLM\..\Run: [PCSuiteTrayApplication] C:\PROGRA~1\Nokia\NOKIAP~1\LAUNCH~1.EXE -startup
O4 - HKLM\..\RunServices: [Windows Download Manager] DllHost32.exe
O4 - HKLM\..\RunServices: [NTFSSAPI] ntfsapi.exe
O4 - HKLM\..\RunOnce: [SpybotDeletingE7105] "C:\Program Files\Spybot - Search & Destroy\SDDelFile.exe" "C:\WINDOWS\system32\6fo4svc.dll"
O4 - HKLM\..\RunOnce: [SpybotDeletingE741] "C:\Program Files\Spybot - Search & Destroy\SDDelFile.exe" "C:\WINDOWS\system32\6fo4svc.dll"
O4 - HKLM\..\RunOnce: [SpybotDeletingE4484] "C:\Program Files\Spybot - Search & Destroy\SDDelFile.exe" "C:\WINDOWS\system32\6fo4svc.dll"
O4 - HKLM\..\RunOnce: [SpybotDeletingE887] "C:\Program Files\Spybot - Search & Destroy\SDDelFile.exe" "C:\WINDOWS\system32\6fo4svc.dll"
O4 - HKLM\..\RunOnce: [SpybotDeletingE7789] "C:\Program Files\Spybot - Search & Destroy\SDDelFile.exe" "C:\WINDOWS\system32\6fo4svc.dll"
O4 - HKLM\..\RunOnce: [SpybotDeletingE7225] "C:\Program Files\Spybot - Search & Destroy\SDDelFile.exe" "C:\WINDOWS\system32\6fo4svc.dll"
O4 - HKLM\..\RunOnce: [SpybotDeletingE4589] "C:\Program Files\Spybot - Search & Destroy\SDDelFile.exe" "C:\WINDOWS\system32\6fo4svc.dll"
O4 - HKLM\..\RunOnce: [SpybotDeletingE2307] "C:\Program Files\Spybot - Search & Destroy\SDDelFile.exe" "C:\WINDOWS\system32\6fo4svc.dll"
O4 - HKLM\..\RunOnce: [SpybotDeletingE4492] "C:\Program Files\Spybot - Search & Destroy\SDDelFile.exe" "C:\WINDOWS\system32\6fo4svc.dll"
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background
O4 - HKCU\..\Run: [PcSync] C:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe /NoDialog
O4 - HKCU\..\Run: [MP4 Player] "C:\Program Files\MP4 Player\mp4Player.exe" hmw
O4 - HKCU\..\Run: [updateMgr] "C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe" AcRdB7_0_8
O4 - HKCU\..\RunOnce: [SpybotDeletingF2804] "C:\Program Files\Spybot - Search & Destroy\SDDelFile.exe" "C:\WINDOWS\system32\6fo4svc.dll"
O4 - HKCU\..\RunOnce: [SpybotDeletingF2846] "C:\Program Files\Spybot - Search & Destroy\SDDelFile.exe" "C:\WINDOWS\system32\6fo4svc.dll"
O4 - HKCU\..\RunOnce: [SpybotDeletingF8565] "C:\Program Files\Spybot - Search & Destroy\SDDelFile.exe" "C:\WINDOWS\system32\6fo4svc.dll"
O4 - HKCU\..\RunOnce: [SpybotDeletingF9167] "C:\Program Files\Spybot - Search & Destroy\SDDelFile.exe" "C:\WINDOWS\system32\6fo4svc.dll"
O4 - HKCU\..\RunOnce: [SpybotDeletingF2111] "C:\Program Files\Spybot - Search & Destroy\SDDelFile.exe" "C:\WINDOWS\system32\6fo4svc.dll"
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Paikallinen palve')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Verkkopalve')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\Run: [Windows Lmhost Util] lmhost.exe (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\Run: [Win32 USB2 Driver] win32usb.exe (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\Run: [Microsoft Task Monitor] taskmger.exe (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\Run: [Windows Messenger] msmsgs.exe (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\Run: [Nvidia CTRL Panel] ncsvc32.exe (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\RunOnce: [Windows Lmhost Util] lmhost.exe (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\RunServices: [MSN Messanger] msnmsng.exe (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
O4 - HKUS\.DEFAULT\..\RunOnce: [Windows Lmhost Util] lmhost.exe (User 'Default user')
O4 - HKUS\.DEFAULT\..\RunServices: [MSN Messanger] msnmsng.exe (User 'Default user')
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: WinZip Quick Pick.lnk = C:\Program Files\WinZip\WZQKPICK.EXE
O8 - Extra context menu item: Web Savings - file://C:\Program Files\WebSavingsfromEbates\System\Temp\ebateswebsavings_script0.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\npjpi160_01.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\npjpi160_01.dll
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search && Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: v2cab - http://searchmiracle.com/cab/v2cab.cab
O16 - DPF: v3cab - http://searchmiracle.com/cab/1.cab
O16 - DPF: {00000EF1-0786-4633-87C6-1AA7A44296DA} - http://www.addictivetechnologies.net/DM0/cab/ATPartners.cab
O16 - DPF: {0E4796D6-A990-4372-9069-72FBDB4AE868} - http://www.one2one.com/static/class/one2oneSvc.cab
O16 - DPF: {3468FCFD-E656-47CF-838D-A350F84EB1CC} - http://activex.microsoft.com/objects/ocget.dll
O16 - DPF: {5C3A9EA6-4068-46B8-8B5A-692FB10607B1} - http://www.grupomarineda.net/auto/DialerData.cab
O16 - DPF: {706F3805-27D7-478D-80E5-E25D2BB030B3} - http://www.advnt01.com/dialer/internazionale_ver3.CAB
O16 - DPF: {7589EEE6-E336-11D4-8A7E-EE1D971D9B47} - http://secure.aconti.net/acontix/goodthinxx.cab
O16 - DPF: {771A1334-6B08-4A6B-AEDC-CF994BA2CEBE} - http://www.ysbweb.com/ist/softwares/v4.0/ysb_regular.cab
O16 - DPF: {91433D86-9F27-402C-B5E3-DEBDD122C339} - http://www.netvenda.com/sites/games-intl/fi/games4.cab
O16 - DPF: {91BE8DAC-957E-416C-B735-E2B63CDB915B} (MyEMessengerSetup Control) - http://www.myemessenger.com/activex/MyEMessengerSetupProject.cab
O16 - DPF: {9EB320CE-BE1D-4304-A081-4B4665414BEF} - http://www.mt-download.com/MediaTicketsInstaller.cab
O16 - DPF: {A5B4176A-5347-4CEC-AB75-26947BB34183} (InstaladorBetyByte Control) - http://www.redzone.fi/uploads/cab/instaladorbetybyteuk.cab
O16 - DPF: {A5DC33CE-214B-4C26-8596-8A45456C9EB8} (RNGCIECtl Class) - http://activex.microsoft.com/objects/ocget.dll
O16 - DPF: {B942A249-D1E7-4C11-98AE-FCB76B08747F} (RealArcadeRdxIE Class) - http://games-dl.real.com/gameconsole/Bundler/CAB/RealArcadeRdxIE.cab
O16 - DPF: {FE4BBEA8-1EFD-4B8A-BD1B-341CCDBEEAA6} - http://ads.dealhelper.com/updates/DealHelperNew.cab
O16 - DPF: {FE5D6722-826F-11D5-A24E-0060B0F1A5AE} (Tukati Launcher) - http://www.tukati.com/software/4/1.7.20.20/tukati.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{39D78B64-F1D5-4C55-8DB8-2759D59EBBE4}: NameServer = 213.139.190.3 212.50.131.153
O20 - AppInit_DLLs: C:\PROGRA~1\Google\GOOGLE~2\GOEC62~1.DLL
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: e-3 DMTS Media Server (e3DMTSMediaServer) - Unknown owner - C:\Program Files\DMTS\BIN\e3DMTSMediaServer.exe
O23 - Service: e-3 DMTS Server (e3DMTSServer) - Unknown owner - C:\Program Files\DMTS\BIN\e3DMTSServer.exe
O23 - Service: GoogleDesktopManager - Google - C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
O23 - Service: Sunbelt Kerio Personal Firewall 4 (KPF4) - Sunbelt Software - C:\Program Files\Sunbelt Software\Personal Firewall 4\kpf4ss.exe
O23 - Service: PPPoE Service (PPPoEService) - Unknown owner - C:\PROGRA~1\EFFICI~1\ENTERN~1\app\pppoeservice.exe
O23 - Service: ServiceLayer - Nokia. - C:\Program Files\Common Files\PCSuite\Services\ServiceLayer.exe

--
End of file - 11177 bytes


Ja Combofix:

ComboFix 07-12-21.4 - jari 2007-12-26 21:42:08.1 - NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1035.18.66 [GMT 1:00]
Running from: C:\Documents and Settings\jari\Työpöytä\ComboFix.exe
* Created a new restore point
.

(((((((((((((((((((((((((((((((((((((( Muut poistot ))))))))))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\Documents and Settings\All Users\Application Data.\nsv
C:\Documents and Settings\All Users\Application Data.\nsv\keys.dat
C:\Documents and Settings\All Users\Application Data.\nsv\wmv0104.dbd
C:\Documents and Settings\All Users\Application Data.\nsv\wmv0106.ddx
C:\Documents and Settings\All Users\Application Data.\nsv\wmv0204.ddx
C:\Documents and Settings\All Users\Application Data.\nsv\wmv0315.ddx
C:\Documents and Settings\All Users\Application Data.\nsv\wmv0412.ddx
C:\Documents and Settings\All Users\Application Data.\nsv\wmv0504.ddx
C:\Documents and Settings\All Users\Application Data.\nsv\wmv0904.ddx
C:\Documents and Settings\All Users\Application Data.\nsv\wmv1125.ddx
C:\Documents and Settings\All Users\Application Data.\nsv\wmv1204.ddx
C:\Documents and Settings\All Users\Application Data.\nsv\wmv1215.dbd
C:\Documents and Settings\All Users\Application Data.\nsv\wmv1909.ddx
C:\Documents and Settings\All Users\Application Data.\nsv\wmv1920.dbd
C:\Documents and Settings\All Users\Application Data.\nsv\wmv2007.dbd
C:\Documents and Settings\All Users\Application Data.\picsvr
C:\Documents and Settings\All Users\Application Data.\picsvr\picsvr.inf
C:\Documents and Settings\All Users\Application Data.\picsvr\picsvrsh.inf
C:\Documents and Settings\jari\Application Data\DOBE~1
C:\Documents and Settings\jari\Application Data\drvcleaner.exe
C:\Documents and Settings\jari\Application Data\Install.dat
C:\Documents and Settings\jari\Application Data\YMBOLS~1
C:\lswmv.ini
C:\Program Files\Common Files\oe
C:\Program Files\Common Files\oe\uninstallwa.exe
C:\Program Files\pedevice
C:\Program Files\pedevice\communication.xml
C:\Program Files\pedevice\Domain.Watchlist.txt
C:\Program Files\pedevice\Downloader.exe
C:\Program Files\pedevice\fixit2.exe
C:\Program Files\pedevice\pae-options.xml
C:\Program Files\pedevice\pae_url.xml
C:\Program Files\pedevice\PeDev.dll
C:\Program Files\pedevice\PeDev.exe
C:\Program Files\pedevice\pedevPS.dll
C:\Program Files\pedevice\Preparation.dll
C:\Program Files\pedevice\search.watchlist.txt
C:\Program Files\PestTrap
C:\Program Files\PestTrap\PestTrap.exe
C:\Program Files\PestTrap\Uninstall.exe
C:\setup.exe
C:\WINDOWS\asks~1
C:\WINDOWS\Downloaded Program Files.\egauth.inf
C:\WINDOWS\Downloaded Program Files.\egcomservice_pack.inf
C:\WINDOWS\Downloaded Program Files.\nethv32.inf
C:\WINDOWS\system32\eglivecam.dll
C:\WINDOWS\system32\fnts~1
C:\WINDOWS\system32\kbwaz.log
C:\WINDOWS\system32\mantec~1
C:\WINDOWS\system32\mseggrpid.dll
C:\WINDOWS\system32\nsvsvc
C:\WINDOWS\system32\nsvsvc\License.txt
C:\WINDOWS\system32\picsvr
C:\WINDOWS\system32\pppatc~1
C:\WINDOWS\system32\scurit~1
C:\WINDOWS\system32\wcpsvtr.exe
C:\WINDOWS\tmlpcert2005

.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))

.
-------\LEGACY_MSDIRECTX


((((( Tiedostot, jotka on luotu seuraavalla aikav„lill„: 2007-11-26 to 2007-12-26 )))))))))))))))))
.

2007-12-26 19:34 . 2007-12-26 19:34 <KANSIO> d-------- C:\WINDOWS\ERUNT
2007-12-26 18:44 . 2007-12-26 18:44 <KANSIO> d--h----- C:\Documents and Settings\All Users\Application Data\vmss
2007-12-26 12:45 . 2007-12-26 19:31 334 --a------ C:\WINDOWS\system32\drivers\fwdrv.err
2007-12-25 20:35 . 2007-12-25 20:35 <KANSIO> d-------- C:\Program Files\IObit
2007-12-25 19:20 . 2007-12-25 19:20 <KANSIO> d-------- C:\Program Files\Trend Micro
2007-12-25 18:11 . 2007-12-25 18:11 161 --a--c--- C:\Delme.bat
2007-12-23 21:25 . 2007-12-23 21:25 <KANSIO> d-------- C:\Program Files\Common Files\EasyInfo
2007-12-22 19:35 . 2007-12-22 19:35 <KANSIO> d-------- C:\Program Files\Artweaver 0.4
2007-12-22 19:35 . 2007-12-22 19:35 <KANSIO> d-------- C:\Documents and Settings\jari\Application Data\Artweaver
2007-12-19 19:25 . 2007-12-19 19:25 <KANSIO> d-------- C:\Program Files\Corel
2007-12-11 16:18 . 2007-12-25 18:11 <KANSIO> d-------- C:\Program Files\VentriloMIX
2007-12-11 16:18 . 2007-12-11 16:22 <KANSIO> d-------- C:\Documents and Settings\jari\Application Data\Ventrilo

.
(((((((((((((((((((((((((((((((((((( Find3M-raportti ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2007-12-26 20:57 --------- d-----w C:\Documents and Settings\jari\Application Data\AdobeUM
2007-12-26 20:20 --------- d-----w C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy
2007-12-26 17:44 --------- d--h--w C:\Documents and Settings\All Users\Application Data\vmss
2007-12-25 19:26 --------- d-----w C:\Program Files\Common Files\Java
2007-12-25 17:15 --------- d-----w C:\Program Files\Jasc Software Inc
2007-12-25 07:34 --------- d-----w C:\Program Files\RevConnect
2007-12-17 15:21 --------- d-----w C:\Program Files\MP3 CD Converter
2007-12-14 11:21 --------- d-----w C:\Documents and Settings\jari\Application Data\gtk-2.0
2007-12-04 14:56 93,264 ----a-w C:\WINDOWS\system32\drivers\aswmon.sys
2007-12-04 14:55 94,544 ----a-w C:\WINDOWS\system32\drivers\aswmon2.sys
2007-12-04 14:53 23,152 ----a-w C:\WINDOWS\system32\drivers\aswRdr.sys
2007-12-04 14:51 42,912 ----a-w C:\WINDOWS\system32\drivers\aswTdi.sys
2007-12-04 14:49 26,624 ----a-w C:\WINDOWS\system32\drivers\aavmker4.sys
2007-12-03 21:26 --------- d-----w C:\Program Files\Total Video Converter
2007-11-13 10:25 20,480 ----a-w C:\WINDOWS\system32\drivers\secdrv.sys
2006-09-20 19:35 33 ----a-w C:\Documents and Settings\jari\Application Data\tvmuknwrd.dll
2006-09-20 19:34 0 ----a-w C:\Documents and Settings\jari\Application Data\tvmknwrd.dll
2005-11-05 18:16 475,138 ----a-w C:\Documents and Settings\Mira Savilaakso\Application Data\tvmknwrd.dll
2004-10-03 17:38 146 ----a-w C:\Documents and Settings\jari\2.reg
2004-10-03 17:35 262 ----a-w C:\Documents and Settings\jari\5.reg
2004-10-03 17:35 193 ----a-w C:\Documents and Settings\jari\4.reg
2004-10-03 17:35 147 ----a-w C:\Documents and Settings\jari\3.reg
2004-10-03 17:35 140 ----a-w C:\Documents and Settings\jari\6.reg
2004-10-01 01:49 58 ----a-w C:\Documents and Settings\jari\swe.bat
2004-12-27 15:03 56 --sh--r C:\WINDOWS\system32\89931FC656.sys
2006-07-07 11:02 36,761 --sha-w C:\WINDOWS\system32\stsohcvs.dat
.

(((((((((((((((((((((((((((((( Rekisterin k„ynnistyskohteet )))))))))))))))))))))))))))))))))))))))))))))
.
.
REGEDIT4
*Huom* Tyhji„ arvoja ja laillisia oletusarvoja ei n„ytet„

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\ctfmon.exe" [2004-09-15 00:12]
"msnmsgr"="C:\Program Files\MSN Messenger\msnmsgr.exe" [2007-01-19 11:55]
"PcSync"="C:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe" [2006-06-27 15:21]
"MP4 Player"="C:\Program Files\MP4 Player\mp4Player.exe" [2007-09-19 14:00]
"updateMgr"="C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe" [2006-03-30 16:45]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce]
"SpybotDeletingF2804"="C:\Program Files\Spybot - Search & Destroy\SDDelFile.exe" [2007-09-24 11:17]
"SpybotDeletingF2846"="C:\Program Files\Spybot - Search & Destroy\SDDelFile.exe" [2007-09-24 11:17]
"SpybotDeletingF8565"="C:\Program Files\Spybot - Search & Destroy\SDDelFile.exe" [2007-09-24 11:17]
"SpybotDeletingF9167"="C:\Program Files\Spybot - Search & Destroy\SDDelFile.exe" [2007-09-24 11:17]
"SpybotDeletingF2111"="C:\Program Files\Spybot - Search & Destroy\SDDelFile.exe" [2007-09-24 11:17]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"IgfxTray"="C:\WINDOWS\System32\igfxtray.exe" [2003-04-06 23:19]
"HotKeysCmds"="C:\WINDOWS\System32\hkcmd.exe" [2003-04-06 23:07]
"SafeGuard Popup Blocker Updater (required)"="regsvr32 /s C:\WINDOWS\System32\sfg6714.dll" []
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe" [2007-03-14 02:43]
"LVCOMSX"="C:\WINDOWS\system32\LVCOMSX.EXE" [2004-12-14 17:19]
"LogitechVideoRepair"="C:\Program Files\Logitech\Video\ISStart.exe" [2004-12-14 17:57]
"LogitechVideoTray"="C:\Program Files\Logitech\Video\LogiTray.exe" [2004-12-14 17:51]
"avast!"="C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe" [2007-12-04 14:00]
"QuickTime Task"="C:\program files\quicktime\QTTask.exe" [2007-06-29 05:24]
"Windows Download Manager"="DllHost32.exe" []
"NTFSSAPI"="ntfsapi.exe" []
"WinampAgent"="C:\Program Files\Winamp\winampa.exe" [2006-10-25 06:37]
"PCSuiteTrayApplication"="C:\PROGRA~1\Nokia\NOKIAP~1\LAUNCH~1.exe" [2006-06-15 11:36]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce]
"SpybotDeletingE7105"="C:\Program Files\Spybot - Search & Destroy\SDDelFile.exe" [2007-09-24 11:17]
"SpybotDeletingE741"="C:\Program Files\Spybot - Search & Destroy\SDDelFile.exe" [2007-09-24 11:17]
"SpybotDeletingE4484"="C:\Program Files\Spybot - Search & Destroy\SDDelFile.exe" [2007-09-24 11:17]
"SpybotDeletingE887"="C:\Program Files\Spybot - Search & Destroy\SDDelFile.exe" [2007-09-24 11:17]
"SpybotDeletingE7789"="C:\Program Files\Spybot - Search & Destroy\SDDelFile.exe" [2007-09-24 11:17]
"SpybotDeletingE7225"="C:\Program Files\Spybot - Search & Destroy\SDDelFile.exe" [2007-09-24 11:17]
"SpybotDeletingE4589"="C:\Program Files\Spybot - Search & Destroy\SDDelFile.exe" [2007-09-24 11:17]
"SpybotDeletingE2307"="C:\Program Files\Spybot - Search & Destroy\SDDelFile.exe" [2007-09-24 11:17]
"SpybotDeletingE4492"="C:\Program Files\Spybot - Search & Destroy\SDDelFile.exe" [2007-09-24 11:17]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServices]
"Windows Download Manager"="DllHost32.exe" []
"NTFSSAPI"="ntfsapi.exe" []

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\System32\CTFMON.EXE" [2004-09-15 00:12]
"WindowsRegKeys update"="winsysi.exe" []
"Microsoft IE"="IEXPLORE.EXE" []
"Windows Lmhost Util"="lmhost.exe" []
"Win32 USB2 Driver"="win32usb.exe" []
"Microsoft Task Monitor"="taskmger.exe" []
"Windows Messenger"="msmsgs.exe" []
"Nvidia CTRL Panel"="ncsvc32.exe" []
"msnmsgr"="C:\Program Files\MSN Messenger\msnmsgr.exe" [2007-01-19 11:55]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce]
"Windows Lmhost Util"="lmhost.exe" []
"starter"="scvhosting.exe" []
"MicrosoftUpdate"="syshelper.exe" []
"Win32 USB2 Driver"="win32usb.exe" []
"Microsoft IE"="IEXPLORE.EXE" []
"Windows Messenger"="msmsgs.exe" []
"Sysino"="lsess.exe" []
"Nvidia CTRL Panel"="ncsvc32.exe" []

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunServices]
"MSN Messanger"="msnmsng.exe" []

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"AppInit_DLLs"=C:\PROGRA~1\Google\GOOGLE~2\GOEC62~1.DLL

R0 BsStor;InCD Storage Helper Driver;C:\WINDOWS\system32\DRIVERS\bsstor.sys [2002-06-06 00:07]
R1 fwdrv;Firewall Driver;C:\WINDOWS\system32\drivers\fwdrv.sys [2005-12-15 17:13]
R1 khips;Kerio HIPS Driver;C:\WINDOWS\system32\drivers\khips.sys [2005-12-15 17:01]
R1 XPROTECTOR;XPROTECTOR;C:\WINDOWS\system32\drivers\Oreans.sys [2005-05-28 18:55]
R2 BsUDF;InCD UDF Driver;C:\WINDOWS\system32\drivers\BsUDF.sys [2003-01-15 18:02]
R2 e3DMTSMediaServer;e-3 DMTS Media Server;C:\Program Files\DMTS\BIN\e3DMTSMediaServer.exe [2004-06-08 12:05]
R2 e3DMTSServer;e-3 DMTS Server;C:\Program Files\DMTS\BIN\e3DMTSServer.exe [2004-03-22 10:59]
R2 PPPoEService;PPPoE Service;C:\PROGRA~1\EFFICI~1\ENTERN~1\app\pppoeservice.exe [2000-07-11 09:48]
R3 NTSPPPOE;Efficient Networks Enternet P.P.P.o.E LAN Miniport Driver;C:\WINDOWS\system32\DRIVERS\ntspppoe.sys [2002-03-06 10:44]
S3 RAWESR;RAWESR;C:\PROGRA~1\EFFICI~1\ENTERN~1\app\RAWESR.SYS [2002-03-06 10:39]
S3 TAPBIND;TAPBIND;C:\PROGRA~1\EFFICI~1\ENTERN~1\app\TAPBIND1.SYS [2002-03-06 10:42]
S4 NetFxUpdate_v1.1.4322;Microsoft .NET Framework v1.1.4322 Update;C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\netfxupdate.exe [2007-01-15 16:11]

.
**************************************************************************

catchme 0.3.1333 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2007-12-26 21:56:45
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
Completion time: 2007-12-26 22:03:30 - machine was rebooted
.
2007-12-22 06:33:07 --- E O F ---

 

scannaa hjt:llä merkkaa paina Fix checked

O4 - HKLM\..\Run: [SafeGuard Popup Blocker Updater (required)] regsvr32 /s C:\WINDOWS\System32\sfg6714.dll
O4 - HKLM\..\RunServices: [Windows Download Manager] DllHost32.exe
O4 - HKUS\S-1-5-18\..\Run: [Win32 USB2 Driver] win32usb.exe (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\Run: [Windows Messenger] msmsgs.exe (User 'SYSTEM')
O16 - DPF: {00000EF1-0786-4633-87C6-1AA7A44296DA} - http://www.addictivetechnologies.net/DM0/cab/ATPartners.cab
O16 - DPF: v2cab - http://searchmiracle.com/cab/v2cab.cab
O16 - DPF: v3cab - http://searchmiracle.com/cab/1.cab
O16 - DPF: {00000EF1-0786-4633-87C6-1AA7A44296DA} - http://www.addictivetechnologies.net/DM0/cab/ATPartners.cab
O16 - DPF: {0E4796D6-A990-4372-9069-72FBDB4AE868} - http://www.one2one.com/static/class/one2oneSvc.cab
O16 - DPF: {3468FCFD-E656-47CF-838D-A350F84EB1CC} - http://activex.microsoft.com/objects/ocget.dll
O16 - DPF: {5C3A9EA6-4068-46B8-8B5A-692FB10607B1} - http://www.grupomarineda.net/auto/DialerData.cab
O16 - DPF: {706F3805-27D7-478D-80E5-E25D2BB030B3} - http://www.advnt01.com/dialer/internazionale_ver3.CAB
O16 - DPF: {7589EEE6-E336-11D4-8A7E-EE1D971D9B47} - http://secure.aconti.net/acontix/goodthinxx.cab
O16 - DPF: {771A1334-6B08-4A6B-AEDC-CF994BA2CEBE} - http://www.ysbweb.com/ist/softwares/v4.0/ysb_regular.cab
O16 - DPF: {91433D86-9F27-402C-B5E3-DEBDD122C339} - http://www.netvenda.com/sites/games-intl/fi/games4.cab
O16 - DPF: {9EB320CE-BE1D-4304-A081-4B4665414BEF} - http://www.mt-download.com/MediaTicketsInstaller.cab
O16 - DPF: {FE4BBEA8-1EFD-4B8A-BD1B-341CCDBEEAA6} - http://ads.dealhelper.com/updates/DealHelperNew.cab[/color]

====================
aja tuo SDFix uudestaan sen ohjeen mukaan

====================

Lataa VundoFix.exe työpöydällesi.

Tupla-klikkaa VundoFix.exe ajaaksesi sen.
Klikkaa Scan for Vundo valintaa.
Kun skannaus on valmis, klikkaa Remove Vundo valintaa.
Sinulta kysytään haluatko poistaa filut - klikkaa YES.
Kun olet klikannut yes, työpöytäsi tyhjenee kun se alkaa poistamaan Vundoa.
Kun se on valmis, fiksi ilmoittaa käynnistäväsi koneesi uudelleen, klikkaa OK.
Postita C:\vundofix.txt lokin sekä tuoreen HijackThis lokin sisältö.

Huomaa: Se on mahdollista että VundoFix löysi tiedoston jota se ei pystynyt poistamaan.
Tässä tilanteessa, VundoFix ajaa itsensä rebootissa, seuraa vain yläpuolelle olevia ohjeita alkaen kohdasta "Klikkaa Scan for Vundo valintaa." kun VundoFix ilmaantuu uudelleenkäynnistyksen yhteydessä.

=============

laita lokit ja uusi hjt:n loki scannaten viimisenä.