HJT, apua kaivataan!

Kone sekaisin, ja kokoajan vain pahenee. Tuossa nuo lokit valmiiksi, tulkkausta vailla.

HJT LOKI:

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 15:06:59, on 14.6.2008
Platform: Windows Vista (WinNT 6.00.1904)
MSIE: Internet Explorer v7.00 (7.00.6000.16681)
Boot mode: Normal

Running processes:
C:\Windows\system32\taskeng.exe
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Program Files\Grisoft\AVG7\avgcc.exe
C:\Windows\RtHDVCpl.exe
C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe
C:\Windows\System32\rundll32.exe
C:\Windows\ehome\ehtray.exe
C:\Program Files\Windows Media Player\wmpnscfg.exe
C:\Program Files\PowerStrip\PStrip.exe
C:\Windows\ehome\ehmsas.exe
C:\Windows\system32\wbem\unsecapp.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Grisoft\AVG7\avgw.exe
C:\Windows\system32\wuauclt.exe
C:\Users\Henkka\Desktop\LADATUT\Firefox\HiJackThis_v2.0.2.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.ask.com?o=1607
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O1 - Hosts: ::1 localhost
O2 - BHO: Adobe PDF Reader -linkkiavustaja - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O2 - BHO: Windows Liven kirjautumisapuohjelma - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVG7\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [RtHDVCpl] RtHDVCpl.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe"
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\Windows\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\Windows\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKCU\..\Run: [ehTray.exe] C:\Windows\ehome\ehTray.exe
O4 - HKCU\..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe
O4 - HKUS\S-1-5-18\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'Default user')
O4 - Startup: Adobe Gamma.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Startup: PowerStrip.lnk = C:\Program Files\PowerStrip\PStrip.exe
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O13 - Gopher Prefix:
O20 - Winlogon Notify: avgwlntf - C:\Windows\SYSTEM32\avgwlntf.dll
O22 - SharedTaskScheduler: Windows DreamScene - {E31004D1-A431-41B8-826F-E902F9D95C81} - C:\Windows\System32\DreamScene.dll
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
O23 - Service: AVG7 Resident Shield Service (AvgCoreSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgrssvc.exe
O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
O23 - Service: Bonjour-palvelu (Bonjour Service) - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: InCD Helper (InCDsrv) - Nero AG - C:\Program Files\Nero\Nero 7\InCD\InCDsrv.exe
O23 - Service: iPod-palvelu (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe
O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe
O23 - Service: NVIDIA Display Driver Service (nvsvc) - NVIDIA Corporation - C:\Windows\system32\nvvsvc.exe
O23 - Service: PnkBstrA - Unknown owner - C:\Windows\system32\PnkBstrA.exe
O23 - Service: Steam Client Service - Valve Corporation - C:\Program Files\Common Files\Steam\SteamService.exe

--
End of file - 4931 bytes


MALVAREBYTES LOKI:

Malwarebytes' Anti-Malware 1.17
Tietokantaversio: 848

19:35:13 12.6.2008
mbam-log-6-12-2008 (19-35-06).txt

Tarkistustyyppi: Täysi tarkistus (C:\|)
Tarkistetut kohteet: 214111
Kulunut aika: 41 minute(s), 56 second(s)

Saastuneita muistiprosesseja: 0
Saastuneita muistimoduuleja: 0
Saastuneita rekisteriavaimia: 15
Saastuneita rekisteriarvoja: 1
Saastuneita rekisterikohteita: 0
Saastuneita hakemistoja: 0
Saastuneita tiedostoja: 1

Saastuneita muistiprosesseja:
(Haitallisia kohteita ei löydetty)

Saastuneita muistimoduuleja:
(Haitallisia kohteita ei löydetty)

Saastuneita rekisteriavaimia:
HKEY_CLASSES_ROOT\Interface\{cf54be1c-9359-4395-8533-1657cf209cfe} (Adware.MyWebSearch) -> No action taken.
HKEY_CLASSES_ROOT\Typelib\{d518921a-4a03-425e-9873-b9a71756821e} (Adware.MyWebSearch) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{59c7fc09-1c83-4648-b3e6-003d2bbc7481} (Adware.MyWebSearch) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{68af847f-6e91-45dd-9b68-d6a12c30e5d7} (Adware.MyWebSearch) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{9170b96c-28d4-4626-8358-27e6caeef907} (Adware.MyWebSearch) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{d1a71fa0-ff48-48dd-9b6d-7a13a3e42127} (Adware.MyWebSearch) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{ddb1968e-ead6-40fd-8dae-ff14757f60c7} (Adware.MyWebSearch) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{f138d901-86f0-4383-99b6-9cdd406036da} (Adware.MyWebSearch) -> No action taken.
HKEY_CLASSES_ROOT\CLSID\{147a976f-eee1-4377-8ea7-4716e4cdd239} (Adware.MyWebSearch) -> No action taken.
HKEY_CLASSES_ROOT\Interface\{2e9937fc-cf2f-4f56-af54-5a6a3dd375cc} (Adware.MyWebSearch) -> No action taken.
HKEY_CLASSES_ROOT\Interface\{741de825-a6f0-4497-9aa6-8023cf9b0fff} (Adware.MyWebSearch) -> No action taken.
HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\SearchScopes\{56256a51-b582-467e-b8d4-7786eda79ae0} (Adware.MyWebSearch) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\RunDll32Policy\f3ScrCtr.dll (Adware.MyWay) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Multimedia\WMPlayer\Schemes\f3pss (Adware.MyWebSearch) -> No action taken.
HKEY_CURRENT_USER\Software\MyWebSearch (Adware.MyWebSearch) -> No action taken.

Saastuneita rekisteriarvoja:
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\run\WinSys2 (Trojan.Agent) -> No action taken.

Saastuneita rekisterikohteita:
(Haitallisia kohteita ei löydetty)

Saastuneita hakemistoja:
(Haitallisia kohteita ei löydetty)

Saastuneita tiedostoja:
C:\Windows\System32\startup.exe (Trojan.Agent) -> No action taken.


COMBOFIX LOKI:

ComboFix 08-06-11.3 - Henkka 2008-06-13 11:43:04.1 - NTFSx86
Microsoft® Windows Vista™ Ultimate 6.0.6000.0.1252.1.1035.18.1104 [GMT 3:00]
Running from: C:\Users\Henkka\Desktop\LADATUT\Firefox\ComboFix.exe
* Created a new restore point
.

(((((((((((((((((((((((((((((((((((((( Muut poistot ))))))))))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\Windows\Fonts\CALIBRIB.TTF

.
((((( Tiedostot, jotka on luotu seuraavalla aikavälillä: 2008-05-13 to 2008-06-13 )))))))))))))))))
.

2008-06-11 20:29 . 2008-06-11 20:29 <KANSIO> d-------- C:\Program Files\PowerStrip
2008-06-11 20:17 . 2008-06-11 20:17 <KANSIO> d-------- C:\Program Files\Malwarebytes' Anti-Malware
2008-06-11 20:17 . 2008-06-10 19:02 34,296 --a------ C:\Windows\System32\drivers\mbamcatchme.sys
2008-06-11 20:17 . 2008-06-10 19:02 15,864 --a------ C:\Windows\System32\drivers\mbam.sys
2008-06-11 20:03 . 2008-06-11 20:03 <KANSIO> d-------- C:\Windows\nvidia icons
2008-06-11 19:57 . 2008-06-11 19:57 <KANSIO> d-------- C:\ATI
2008-06-11 19:26 . 2008-06-12 13:27 254,417,929 --a------ C:\Windows\MEMORY.DMP
2008-06-11 19:14 . 2008-06-11 19:14 <KANSIO> d-------- C:\Users\Henkka\AppData\Roaming\Malwarebytes
2008-06-11 19:14 . 2008-06-11 19:14 <KANSIO> d-------- C:\Users\All Users\Malwarebytes
2008-06-11 19:14 . 2008-06-11 19:14 <KANSIO> d-------- C:\ProgramData\Malwarebytes
2008-06-11 03:10 . 2008-04-26 11:02 1,327,104 --a------ C:\Windows\System32\quartz.dll
2008-06-11 03:10 . 2008-05-10 04:21 113,664 --a------ C:\Windows\System32\drivers\rmcast.sys
2008-06-11 03:10 . 2008-05-10 06:30 14,848 --a------ C:\Windows\System32\wshrm.dll
2008-06-05 19:39 . 2008-06-05 19:39 <KANSIO> d-------- C:\Program Files\Apple Software Update
2008-06-05 12:16 . 2008-06-05 13:44 <KANSIO> d-------- C:\Program Files\BSplayer
2008-06-05 12:16 . 2008-06-05 12:16 <KANSIO> d-------- C:\Program Files\AdVantage
2008-06-02 16:52 . 2008-06-02 16:52 54,156 --ah----- C:\Windows\QTFont.qfn
2008-06-02 16:52 . 2008-06-02 16:52 1,409 --a------ C:\Windows\QTFont.for
2008-06-01 14:18 . 2008-06-09 13:07 <KANSIO> d-------- C:\Users\Lotta\Shared
2008-06-01 14:17 . 2008-06-01 14:45 <KANSIO> d-------- C:\Users\Lotta\AppData\Roaming\FrostWire
2008-06-01 14:10 . 2008-06-01 14:10 268 --ah----- C:\sqmdata02.sqm
2008-06-01 14:10 . 2008-06-01 14:10 244 --ah----- C:\sqmnoopt02.sqm
2008-05-29 16:45 . 2008-06-10 22:49 <KANSIO> d-------- C:\Users\Henkka\Contacts
2008-05-29 16:09 . 2008-05-29 17:15 <KANSIO> d-------- C:\Users\Henkka\AppData\Roaming\FrostWire
2008-05-29 16:09 . 2008-06-01 18:27 <KANSIO> d-------- C:\Program Files\FrostWire
2008-05-29 13:19 . 2008-05-29 13:19 <KANSIO> d-------- C:\Users\All Users\Adobe Systems
2008-05-29 13:19 . 2008-05-29 13:19 <KANSIO> d-------- C:\ProgramData\Adobe Systems
2008-05-29 13:10 . 2008-05-29 13:10 <KANSIO> d-------- C:\Program Files\Common Files\Adobe Systems Shared
2008-05-29 03:05 . 2008-05-29 03:05 268 --ah----- C:\sqmdata01.sqm
2008-05-29 03:05 . 2008-05-29 03:05 244 --ah----- C:\sqmnoopt01.sqm
2008-05-28 05:44 . 2008-03-08 03:37 4,247,552 --a------ C:\Windows\System32\GameUXLegacyGDFs.dll
2008-05-28 05:44 . 2008-03-08 07:30 1,686,528 --a------ C:\Windows\System32\gameux.dll
2008-05-23 14:00 . 2008-05-23 14:00 268 --ah----- C:\sqmdata00.sqm
2008-05-23 14:00 . 2008-05-23 14:00 244 --ah----- C:\sqmnoopt00.sqm
2008-05-21 19:33 . 2008-06-12 12:48 49 --a------ C:\Windows\NeroDigital.ini
2008-05-17 17:07 . 2008-05-17 17:07 <KANSIO> d-------- C:\games
2008-05-16 23:38 . 2008-05-16 23:38 <KANSIO> d-------- C:\Program Files\CCleaner
2008-05-15 16:39 . 2008-05-15 16:39 <KANSIO> d-------- C:\perflogs

.
(((((((((((((((((((((((((((((((((((( Find3M-raportti ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-06-13 07:53 --------- d-----w C:\Users\Henkka\AppData\Roaming\AVG7
2008-06-13 05:34 --------- d-----w C:\Users\Tiina\AppData\Roaming\OpenOffice.org2
2008-06-13 05:00 --------- d-----w C:\Users\Tiina\AppData\Roaming\AVG7
2008-06-13 05:00 --------- d-----w C:\Users\Harri\AppData\Roaming\AVG7
2008-06-12 16:39 --------- d-----w C:\Users\Harri\AppData\Roaming\OpenOffice.org2
2008-06-12 10:41 --------- d-----w C:\Users\Henkka\AppData\Roaming\dvdcss
2008-06-12 10:16 --------- d-----w C:\Users\Henkka\AppData\Roaming\uTorrent
2008-06-11 17:18 --------- d-----w C:\Users\Henkka\AppData\Roaming\mIRC
2008-06-11 17:14 --------- d-----w C:\Program Files\Steam
2008-06-11 17:11 --------- d-----w C:\Program Files\Common Files\Steam
2008-06-11 17:08 --------- d-----w C:\ProgramData\NVIDIA
2008-06-11 15:54 --------- d-----w C:\Program Files\Windows Mail
2008-06-11 05:00 --------- d-----w C:\Users\Lotta\AppData\Roaming\AVG7
2008-06-10 10:13 --------- d-----w C:\Users\Henkka\AppData\Roaming\OpenOffice.org2
2008-06-09 09:39 --------- d-----w C:\Users\Lotta\AppData\Roaming\OpenOffice.org2
2008-06-01 16:10 --------- d-----w C:\Program Files\mIRC
2008-05-29 14:18 --------- d-----w C:\Program Files\DC++
2008-05-29 13:09 --------- d-----w C:\Program Files\LimeWire
2008-05-29 10:11 --------- d-----w C:\Program Files\Common Files\Adobe
2008-05-26 18:11 --------- d-----w C:\Program Files\Pokerihuone
2008-05-22 14:25 --------- d-----w C:\Users\Lotta\AppData\Roaming\LimeWire
2008-05-16 20:48 --------- d-----w C:\Program Files\EA Sports
2008-05-16 20:46 --------- d-----w C:\Program Files\EA Games
2008-05-16 20:43 --------- d--h--w C:\Program Files\InstallShield Installation Information
2008-05-10 18:55 --------- d-----w C:\Users\Henkka\AppData\Roaming\LimeWire
2008-04-30 14:27 442,368 ----a-w C:\Windows\System32\nvuninst.exe
2008-04-27 14:15 --------- d-----w C:\Program Files\Canon
2008-04-27 13:12 --------- d-----w C:\Users\Henkka\AppData\Roaming\Ubisoft
2008-04-27 13:09 --------- d-----w C:\ProgramData\Ubisoft
2008-04-26 08:42 --------- d-----w C:\Program Files\Ubisoft
2008-04-25 17:53 --------- d-----w C:\Program Files\Audiosurf
2008-04-25 04:23 826,368 ----a-w C:\Windows\System32\wininet.dll
2008-04-25 04:23 56,320 ----a-w C:\Windows\System32\iesetup.dll
2008-04-25 04:23 52,736 ----a-w C:\Windows\AppPatch\iebrshim.dll
2008-04-25 04:22 26,624 ----a-w C:\Windows\System32\ieUnatt.exe
2008-04-24 15:07 73,216 ----a-w C:\Windows\ST6UNST.EXE
2008-04-24 15:07 249,856 ------w C:\Windows\Setup1.exe
2008-04-23 13:25 --------- d-----w C:\Users\Henkka\AppData\Roaming\FileZilla
2008-04-19 12:37 --------- d-----w C:\Program Files\Elävät Kirjat
2008-04-19 12:37 --------- d-----w C:\Program Files\EK
2008-04-19 12:08 --------- d-----w C:\Program Files\Diablo II
2008-04-19 12:04 43,520 ----a-w C:\Windows\System32\CmdLineExt03.dll
2008-04-15 16:43 --------- d-----w C:\Program Files\iTunes
2008-04-15 16:43 --------- d-----w C:\Program Files\iPod
2008-04-15 16:42 --------- d-----w C:\Program Files\QuickTime
2007-12-24 22:04 22,328 ----a-w C:\Users\Henkka\AppData\Roaming\PnkBstrK.sys
2007-12-14 17:39 174 --sha-w C:\Program Files\desktop.ini
.

(((((((((((((((((((((((((((((( Rekisterin käynnistyskohteet )))))))))))))))))))))))))))))))))))))))))))))
.
.
REGEDIT4
*Huom* Tyhjiä arvoja ja laillisia oletusarvoja ei näytetä

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ehTray.exe"="C:\Windows\ehome\ehTray.exe" [2006-11-02 15:34 125440]
"WMPNSCFG"="C:\Program Files\Windows Media Player\WMPNSCFG.exe" [2006-11-02 15:33 201728]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"AVG7_CC"="C:\PROGRA~1\Grisoft\AVG7\avgcc.exe" [2008-04-15 17:41 579584]
"RtHDVCpl"="RtHDVCpl.exe" [2007-03-23 14:04 4423680 C:\Windows\RtHDVCpl.exe]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe" [2008-02-22 05:25 144784]
"NvCplDaemon"="C:\Windows\system32\NvCpl.dll" [2008-05-02 22:46 13535776]
"NvMediaCenter"="C:\Windows\system32\NvMcTray.dll" [2008-05-02 22:46 92704]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"AVG7_Run"="C:\PROGRA~1\Grisoft\AVG7\avgw.exe" [2007-12-14 20:44 219136]

C:\Users\Henkka\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
Adobe Gamma.lnk - C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [2005-03-16 19:16:50 113664]
PowerStrip.lnk - C:\Program Files\PowerStrip\PStrip.exe [2008-06-02 19:50:00 732408]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\system]
"LogonHoursAction"= 2 (0x2)
"DontDisplayLogonHoursWarnings"= 1 (0x1)

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\avgwlntf]
avgwlntf.dll 2007-12-14 20:44 9216 C:\Windows\System32\avgwlntf.dll

[HKLM\~\startupfolder\C:^Users^Henkka^AppData^Roaming^Microsoft^Windows^Start Menu^Programs^Startup^Last.fm Helper.lnk]
path=C:\Users\Henkka\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Last.fm Helper.lnk
backup=C:\Windows\pss\Last.fm Helper.lnk.Startup
backupExtension=.Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher]
--a------ 2008-01-11 22:16 39792 C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DAEMON Tools Lite]
--a------ 2008-01-17 19:51 486856 C:\Program Files\DAEMON Tools Lite\daemon.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\InCD]
--a------ 2007-05-15 16:55 1057328 C:\Program Files\Nero\Nero 7\InCD\InCD.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper]
--a------ 2008-03-30 10:36 267048 C:\Program Files\iTunes\iTunesHelper.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck]
--a------ 2007-03-01 16:57 153136 C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
--a------ 2008-03-28 23:37 413696 C:\Program Files\QuickTime\QTTask.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SecurDisc]
--a------ 2007-05-15 16:55 1628208 C:\Program Files\Nero\Nero 7\InCD\NBHGui.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\tvjbmonitor]
--a------ 2006-12-26 18:08 53248 C:\Program Files\MMEDIA\TV Jukebox 3.0\tvjbMonitor.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WinampAgent]
C:\Program Files\Winamp\winampa.exe

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Svc\S-1-5-21-2288889983-3666411893-3590199007-1000]
"EnableNotificationsRef"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\FirewallRules]
"{97EC9346-283B-4D38-B976-D1E47A4A3E83}"= C:\Program Files\Windows Live\Messenger\livecall.exe:Windows Live Messenger (Phone)
"TCP Query User{7974046A-0FC0-47B1-9141-812645F426D5}C:\\program files\\mirc\\mirc.exe"= UDP:C:\program files\mirc\mirc.exe:mIRC
"UDP Query User{E3D464D6-953A-4C2E-BF1D-CDAB70DF8C4A}C:\\program files\\mirc\\mirc.exe"= TCP:C:\program files\mirc\mirc.exe:mIRC
"TCP Query User{97AA655B-5A12-4327-9DD4-386A45F44429}C:\\program files\\steam\\steamapps\\hnkk\\counter-strike\\hl.exe"= UDP:C:\program files\steam\steamapps\hnkk\counter-strike\hl.exe:Half-Life Launcher
"UDP Query User{E76FDB83-0295-49A7-8F79-AF2E09FF1B21}C:\\program files\\steam\\steamapps\\hnkk\\counter-strike\\hl.exe"= TCP:C:\program files\steam\steamapps\hnkk\counter-strike\hl.exe:Half-Life Launcher
"TCP Query User{51A5C65E-1D8A-4BA9-87C0-6F28BAD162DE}C:\\program files\\wolfenstein - enemy territory\\et.exe"= UDP:C:\program files\wolfenstein - enemy territory\et.exe:ET
"UDP Query User{70FC1D58-4C03-4DAA-9808-DB04A8E4423E}C:\\program files\\wolfenstein - enemy territory\\et.exe"= TCP:C:\program files\wolfenstein - enemy territory\et.exe:ET
"TCP Query User{2E0625A8-B2DB-4C2A-A89A-FB1AB146248D}C:\\program files\\the all-seeing eye\\eye.exe"= UDP:C:\program files\the all-seeing eye\eye.exe:Yahoo! All-Seeing Eye
"UDP Query User{51888159-E2F8-4DFE-A283-C5DBBC23E760}C:\\program files\\the all-seeing eye\\eye.exe"= TCP:C:\program files\the all-seeing eye\eye.exe:Yahoo! All-Seeing Eye
"TCP Query User{9FD05F55-891D-4DC3-A940-1A3D98C46C04}C:\\ijji\\english\\gunz\\gunz.exe"= UDP:C:\ijji\english\gunz\gunz.exe:Gunz
"UDP Query User{1F9F5747-FD56-467E-B75F-7677918F328C}C:\\ijji\\english\\gunz\\gunz.exe"= TCP:C:\ijji\english\gunz\gunz.exe:Gunz
"TCP Query User{7B1E9094-96E3-4021-8D3A-04D97A4C72C9}C:\\program files\\dc++\\dcplusplus.exe"= UDP:C:\program files\dc++\dcplusplus.exeC++
"UDP Query User{0959F4FC-45DF-4091-89AC-249EB9E56AF8}C:\\program files\\dc++\\dcplusplus.exe"= TCP:C:\program files\dc++\dcplusplus.exeC++
"{18F26EA3-480C-49EE-92A7-BF7F7A283D8E}"= UDP:C:\Program Files\Electronic Arts\Crytek\Crysis\Bin32\Crysis.exe:Crysis_32
"{9B33D492-2B61-4992-B640-FEB3E86193F3}"= TCP:C:\Program Files\Electronic Arts\Crytek\Crysis\Bin32\Crysis.exe:Crysis_32
"{25AD2C1F-E0E7-473D-9E98-4F664C593CAC}"= UDP:C:\Program Files\Electronic Arts\Crytek\Crysis\Bin32\CrysisDedicatedServer.exe:CrysisDedicatedServer_32
"{9D39EC9F-B849-4960-AE66-3F6A22302FA5}"= TCP:C:\Program Files\Electronic Arts\Crytek\Crysis\Bin32\CrysisDedicatedServer.exe:CrysisDedicatedServer_32
"{04186A89-3891-4826-8F74-C1A0719D4066}"= UDP:C:\Windows\System32\PnkBstrA.exenkBstrA
"{3C629100-A34B-4CCF-BBC9-DD7C7D95FE4E}"= TCP:C:\Windows\System32\PnkBstrA.exenkBstrA
"{D5C767FE-08D0-4AAA-A7F8-26639271F981}"= UDP:C:\Windows\System32\PnkBstrB.exenkBstrB
"{ADC1ED70-DF5A-4F90-B441-893EA963C40E}"= TCP:C:\Windows\System32\PnkBstrB.exenkBstrB
"{3BADFB8F-C1E0-4EF2-999F-7A342A7167C2}"= UDP:C:\Program Files\2K Games\Firaxis Games\Sid Meier's Civilization 4 Complete\Civilization4.exe:Sid Meier's Civilization 4 Complete
"{8E6F881B-F8EB-490E-9385-A2F298D41421}"= TCP:C:\Program Files\2K Games\Firaxis Games\Sid Meier's Civilization 4 Complete\Civilization4.exe:Sid Meier's Civilization 4 Complete
"{A6A119C3-B77C-45C9-9163-14B0AC41D37A}"= UDP:C:\Program Files\2K Games\Firaxis Games\Sid Meier's Civilization 4 Complete\Warlords\Civ4Warlords.exe:Sid Meier's Civilization 4: Warlords
"{12876641-FF77-4180-8DDC-1C59ADA453F9}"= TCP:C:\Program Files\2K Games\Firaxis Games\Sid Meier's Civilization 4 Complete\Warlords\Civ4Warlords.exe:Sid Meier's Civilization 4: Warlords
"{A0A0FD90-06F4-412E-8E0E-253B8DF63C90}"= UDP:C:\Program Files\2K Games\Firaxis Games\Sid Meier's Civilization 4 Complete\Beyond the Sword\Civ4BeyondSword.exe:Sid Meier's Civilization 4: Beyond the Sword
"{31A7B6D3-7112-4BEF-A57B-027ADE05F16A}"= TCP:C:\Program Files\2K Games\Firaxis Games\Sid Meier's Civilization 4 Complete\Beyond the Sword\Civ4BeyondSword.exe:Sid Meier's Civilization 4: Beyond the Sword
"TCP Query User{6A3762AA-2D45-4C87-B390-8A15EC973FF1}C:\\program files\\utorrent\\utorrent.exe"= UDP:C:\program files\utorrent\utorrent.exe:uTorrent
"UDP Query User{94EB9222-B30C-499D-94A3-DD8F5F9ECF6F}C:\\program files\\utorrent\\utorrent.exe"= TCP:C:\program files\utorrent\utorrent.exe:uTorrent
"TCP Query User{D9DE7F0D-A7D4-4AED-924B-B856BFD40998}C:\\program files\\steam\\steamapps\\hnkk\\ricochet\\hl.exe"= UDP:C:\program files\steam\steamapps\hnkk\ricochet\hl.exe:Half-Life Launcher
"UDP Query User{CE439899-2C82-49EE-8C79-A5B8B8301C58}C:\\program files\\steam\\steamapps\\hnkk\\ricochet\\hl.exe"= TCP:C:\program files\steam\steamapps\hnkk\ricochet\hl.exe:Half-Life Launcher
"{DCA97472-32BA-4445-99CB-A7883C6F6EB8}"= UDP:C:\Program Files\Bonjour\mDNSResponder.exe:Bonjour
"{71EF5FDB-79B6-4F40-A064-C500C768D21B}"= TCP:C:\Program Files\Bonjour\mDNSResponder.exe:Bonjour
"TCP Query User{C5E09EB2-49C5-44B9-8BE7-153A730BCFA8}C:\\program files\\steam\\steamapps\\battery55\\counter-strike\\hl.exe"= UDP:C:\program files\steam\steamapps\battery55\counter-strike\hl.exe:Half-Life Launcher
"UDP Query User{847B04DB-C439-4094-9F93-0DCAC41FFED5}C:\\program files\\steam\\steamapps\\battery55\\counter-strike\\hl.exe"= TCP:C:\program files\steam\steamapps\battery55\counter-strike\hl.exe:Half-Life Launcher
"TCP Query User{E2C875F7-0B42-4B9F-A83A-64421FC42C3D}C:\\program files\\ea games\\ultima online mondain's legacy\\client.exe"= UDP:C:\program files\ea games\ultima online mondain's legacy\client.exe:client
"UDP Query User{E93AF1A7-D3E1-4843-8CBB-C2E112BBF009}C:\\program files\\ea games\\ultima online mondain's legacy\\client.exe"= TCP:C:\program files\ea games\ultima online mondain's legacy\client.exe:client
"TCP Query User{61519A35-CE25-4BEE-AE84-213E0326F6F6}C:\\program files\\pokerihuone\\jre\\bin\\javaw.exe"= UDP:C:\program files\pokerihuone\jre\bin\javaw.exe:Java(TM) 2 Platform Standard Edition binary
"UDP Query User{05B784B9-D99C-4816-AB1F-1D4F4C4A9B20}C:\\program files\\pokerihuone\\jre\\bin\\javaw.exe"= TCP:C:\program files\pokerihuone\jre\bin\javaw.exe:Java(TM) 2 Platform Standard Edition binary
"{B7E3976F-3EF2-470F-945B-B6EC326B63E5}"= UDP:C:\Program Files\iTunes\iTunes.exe:iTunes
"{DCC0933D-58E3-4E57-9CFB-60A46EC7E597}"= TCP:C:\Program Files\iTunes\iTunes.exe:iTunes
"{AF10E89C-30EB-44C4-A07E-942FFF05F4B3}"= UDP:C:\Program Files\Ubisoft\Assassin's Creed\AssassinsCreed_Dx9.exe:Assassin's Creed Dx9
"{BA90B2AB-87B7-4686-86B0-A33F09845D14}"= TCP:C:\Program Files\Ubisoft\Assassin's Creed\AssassinsCreed_Dx9.exe:Assassin's Creed Dx9
"{34F9F1A2-5931-4B1E-A668-8835227F8D2C}"= UDP:C:\Program Files\Ubisoft\Assassin's Creed\AssassinsCreed_Dx10.exe:Assassin's Creed Dx10
"{61CD2A17-7E18-4732-B714-C7F6B403998B}"= TCP:C:\Program Files\Ubisoft\Assassin's Creed\AssassinsCreed_Dx10.exe:Assassin's Creed Dx10
"{A9701197-AEA0-411F-8B55-2445A17C1B8E}"= UDP:C:\Program Files\Ubisoft\Assassin's Creed\AssassinsCreed_Launcher.exe:Assassin's Creed Update
"{68B7DB46-B944-445E-8510-2FEECCC537FE}"= TCP:C:\Program Files\Ubisoft\Assassin's Creed\AssassinsCreed_Launcher.exe:Assassin's Creed Update
"{53224DE0-1F0A-4781-974E-C64144A1FF73}"= UDP:C:\Program Files\FrostWire\FrostWire.exe:LimeWire
"{70CE8CDB-7716-478C-9CCB-65A18C0384F4}"= TCP:C:\Program Files\FrostWire\FrostWire.exe:LimeWire

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\RestrictedServices\Static\System]
"DFSR-1"= RPort=5722|UDP:%SystemRoot%\system32\svchost.exe|Svc=DFSR:Allow inbound TCP traffic|

R0 AtiPcie;ATI PCI Express (3GIO) Filter;C:\Windows\system32\DRIVERS\AtiPcie.sys [2006-10-30 18:23]
R1 PStrip;PStrip;C:\Windows\system32\drivers\pstrip.sys [2007-07-15 04:37]
R3 AvgWFP;AVG7 Firewall Driver x86;C:\Windows\system32\Drivers\avgwfp.sys [2008-03-13 16:10]
S3 3xHybrid;Pinnacle PCTV 100i-110i-300i-310i-MCE;C:\Windows\system32\DRIVERS\3xHybrid.sys [2006-11-22 09:53]
S3 mod7700;DiBcom based TV tuner device;C:\Windows\system32\DRIVERS\mod7700.sys [2007-02-20 13:26]
S3 MODRC;Ultima Infrared Receiver;C:\Windows\system32\DRIVERS\modrc.sys [2007-02-06 13:10]
S3 Ph3xIB32;Philips 713x Inbox PCI TV Card;C:\Windows\system32\DRIVERS\Ph3xIB32.sys [2007-04-03 11:43]
S3 Steam Client Service;Steam Client Service;C:\Program Files\Common Files\Steam\SteamService.exe [2008-06-11 20:11]
S3 stusb2ir;USB 2.0 IrDA Bridge;C:\Windows\system32\DRIVERS\stusb2ir.sys [2006-11-02 10:30]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{2a208f47-aa4d-11dc-b651-806e6f6e6963}]
\shell\AutoRun\command - D:\Aloita.exe
\shell\Avaa\Command - D:\Aloita.exe

*Newly Created Service* - CATCHME
.
**************************************************************************

catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-06-13 11:48:27
Windows 6.0.6000 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
Completion time: 2008-06-13 11:49:57
ComboFix-quarantined-files.txt 2008-06-13 08:49:24

Pre-Run: 155,029,295,104 tavua vapaana
Post-Run: 155,156,148,224 tavua vapaana

229 --- E O F --- 2008-06-11 15:49:22

 

Poista tämän niminen ohjelma AdVantage .

Millä tavalla kone on sekaisin?

 

Resoluutio on 1024x768 eikä sitä saa isommaksi edes power-stripillä, vaikka ennen oli 1600x1200. Kaikille nettisivustoille ei aina pääse ja usein hidas yhteys.

Kiitos nyt jo avusta.

 

aja Malwarebytes' Anti-Malware uudelleen

5. Kun skanni on valmis, klikkaa OK ja sitten Show Results nähdäksesi tulokset.
6. Varmistu, että kaikki on merkitty ja klikkaa Remove Selected.

jäänyt tekemättä

 

Ei ollu tässä mitään, mutta semmonen juttu, että piti suorittaa tuo ohjelma vikasietotilassa kun muuten heitti aina jossain 150000 kohteen kohalla bluescreeniä?

E: Suurin ongelma siis tällä hetkellä tuo resoluutio. En tiedä johtuuko jostain haittaohjelmasta, mutta luulen niin.

Loki:

Malwarebytes' Anti-Malware 1.17
Tietokantaversio: 848

17:55:37 14.6.2008
mbam-log-6-14-2008 (17-55-37).txt

Tarkistustyyppi: Täysi tarkistus (C:\|)
Tarkistetut kohteet: 206963
Kulunut aika: 40 minute(s), 30 second(s)

Saastuneita muistiprosesseja: 0
Saastuneita muistimoduuleja: 0
Saastuneita rekisteriavaimia: 0
Saastuneita rekisteriarvoja: 0
Saastuneita rekisterikohteita: 0
Saastuneita hakemistoja: 0
Saastuneita tiedostoja: 0

Saastuneita muistiprosesseja:
(Haitallisia kohteita ei löydetty)

Saastuneita muistimoduuleja:
(Haitallisia kohteita ei löydetty)

Saastuneita rekisteriavaimia:
(Haitallisia kohteita ei löydetty)

Saastuneita rekisteriarvoja:
(Haitallisia kohteita ei löydetty)

Saastuneita rekisterikohteita:
(Haitallisia kohteita ei löydetty)

Saastuneita hakemistoja:
(Haitallisia kohteita ei löydetty)

Saastuneita tiedostoja:
(Haitallisia kohteita ei löydetty)

 

scannaa uusi combofix loki

 

Tuossa uusi:

ComboFix 08-06-11.3 - Henkka 2008-06-15 0:36:23.2 - NTFSx86
Running from: C:\Users\Henkka\Desktop\LADATUT\Firefox\ComboFix.exe
.

((((( Tiedostot, jotka on luotu seuraavalla aikavälillä: 2008-05-14 to 2008-06-14 )))))))))))))))))
.

2008-06-14 15:08 . 2008-04-23 07:27 1,244,672 --a------ C:\Windows\System32\mcmde.dll
2008-06-14 15:08 . 2008-04-23 07:27 428,032 --a------ C:\Windows\System32\EncDec.dll
2008-06-14 15:08 . 2008-04-23 07:27 292,352 --a------ C:\Windows\System32\psisdecd.dll
2008-06-14 15:08 . 2008-04-23 07:26 218,624 --a------ C:\Windows\System32\psisrndr.ax
2008-06-14 15:08 . 2008-04-23 07:26 80,896 --a------ C:\Windows\System32\MSNP.ax
2008-06-14 15:08 . 2008-04-23 07:26 68,608 --a------ C:\Windows\System32\Mpeg2Data.ax
2008-06-14 15:08 . 2008-04-23 07:26 57,856 --a------ C:\Windows\System32\MSDvbNP.ax
2008-06-11 20:29 . 2008-06-11 20:29 <KANSIO> d-------- C:\Program Files\PowerStrip
2008-06-11 20:17 . 2008-06-11 20:17 <KANSIO> d-------- C:\Program Files\Malwarebytes' Anti-Malware
2008-06-11 20:17 . 2008-06-10 19:02 34,296 --a------ C:\Windows\System32\drivers\mbamcatchme.sys
2008-06-11 20:17 . 2008-06-10 19:02 15,864 --a------ C:\Windows\System32\drivers\mbam.sys
2008-06-11 20:03 . 2008-06-11 20:03 <KANSIO> d-------- C:\Windows\nvidia icons
2008-06-11 19:57 . 2008-06-11 19:57 <KANSIO> d-------- C:\ATI
2008-06-11 19:26 . 2008-06-14 16:36 204,020,745 --a------ C:\Windows\MEMORY.DMP
2008-06-11 19:14 . 2008-06-11 19:14 <KANSIO> d-------- C:\Users\Henkka\AppData\Roaming\Malwarebytes
2008-06-11 19:14 . 2008-06-11 19:14 <KANSIO> d-------- C:\Users\All Users\Malwarebytes
2008-06-11 19:14 . 2008-06-11 19:14 <KANSIO> d-------- C:\ProgramData\Malwarebytes
2008-06-11 03:10 . 2008-04-26 11:02 1,327,104 --a------ C:\Windows\System32\quartz.dll
2008-06-11 03:10 . 2008-05-10 04:21 113,664 --a------ C:\Windows\System32\drivers\rmcast.sys
2008-06-11 03:10 . 2008-05-10 06:30 14,848 --a------ C:\Windows\System32\wshrm.dll
2008-06-05 19:39 . 2008-06-05 19:39 <KANSIO> d-------- C:\Program Files\Apple Software Update
2008-06-05 12:16 . 2008-06-05 13:44 <KANSIO> d-------- C:\Program Files\BSplayer
2008-06-02 16:52 . 2008-06-02 16:52 54,156 --ah----- C:\Windows\QTFont.qfn
2008-06-02 16:52 . 2008-06-02 16:52 1,409 --a------ C:\Windows\QTFont.for
2008-06-01 14:18 . 2008-06-09 13:07 <KANSIO> d-------- C:\Users\Lotta\Shared
2008-06-01 14:17 . 2008-06-01 14:45 <KANSIO> d-------- C:\Users\Lotta\AppData\Roaming\FrostWire
2008-06-01 14:10 . 2008-06-01 14:10 268 --ah----- C:\sqmdata02.sqm
2008-06-01 14:10 . 2008-06-01 14:10 244 --ah----- C:\sqmnoopt02.sqm
2008-05-29 16:45 . 2008-06-10 22:49 <KANSIO> d-------- C:\Users\Henkka\Contacts
2008-05-29 16:09 . 2008-05-29 17:15 <KANSIO> d-------- C:\Users\Henkka\AppData\Roaming\FrostWire
2008-05-29 16:09 . 2008-06-01 18:27 <KANSIO> d-------- C:\Program Files\FrostWire
2008-05-29 13:19 . 2008-05-29 13:19 <KANSIO> d-------- C:\Users\All Users\Adobe Systems
2008-05-29 13:19 . 2008-05-29 13:19 <KANSIO> d-------- C:\ProgramData\Adobe Systems
2008-05-29 13:10 . 2008-05-29 13:10 <KANSIO> d-------- C:\Program Files\Common Files\Adobe Systems Shared
2008-05-29 03:05 . 2008-05-29 03:05 268 --ah----- C:\sqmdata01.sqm
2008-05-29 03:05 . 2008-05-29 03:05 244 --ah----- C:\sqmnoopt01.sqm
2008-05-28 05:44 . 2008-03-08 03:37 4,247,552 --a------ C:\Windows\System32\GameUXLegacyGDFs.dll
2008-05-28 05:44 . 2008-03-08 07:30 1,686,528 --a------ C:\Windows\System32\gameux.dll
2008-05-23 14:00 . 2008-05-23 14:00 268 --ah----- C:\sqmdata00.sqm
2008-05-23 14:00 . 2008-05-23 14:00 244 --ah----- C:\sqmnoopt00.sqm
2008-05-21 19:33 . 2008-06-15 00:32 49 --a------ C:\Windows\NeroDigital.ini
2008-05-17 17:07 . 2008-06-13 12:24 <KANSIO> d-------- C:\games
2008-05-16 23:38 . 2008-05-16 23:38 <KANSIO> d-------- C:\Program Files\CCleaner
2008-05-15 16:39 . 2008-05-15 16:39 <KANSIO> d-------- C:\perflogs

.
(((((((((((((((((((((((((((((((((((( Find3M-raportti ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-06-14 12:36 --------- d-----w C:\Users\Henkka\AppData\Roaming\OpenOffice.org2
2008-06-14 12:01 --------- d-----w C:\Users\Henkka\AppData\Roaming\AVG7
2008-06-14 06:23 --------- d-----w C:\Users\Harri\AppData\Roaming\OpenOffice.org2
2008-06-14 06:03 --------- d-----w C:\Users\Tiina\AppData\Roaming\OpenOffice.org2
2008-06-14 06:03 --------- d-----w C:\Users\Tiina\AppData\Roaming\AVG7
2008-06-13 09:23 --------- d-----w C:\Program Files\Steam
2008-06-13 05:00 --------- d-----w C:\Users\Harri\AppData\Roaming\AVG7
2008-06-12 10:41 --------- d-----w C:\Users\Henkka\AppData\Roaming\dvdcss
2008-06-12 10:16 --------- d-----w C:\Users\Henkka\AppData\Roaming\uTorrent
2008-06-11 17:18 --------- d-----w C:\Users\Henkka\AppData\Roaming\mIRC
2008-06-11 17:11 --------- d-----w C:\Program Files\Common Files\Steam
2008-06-11 17:08 --------- d-----w C:\ProgramData\NVIDIA
2008-06-11 15:54 --------- d-----w C:\Program Files\Windows Mail
2008-06-11 05:00 --------- d-----w C:\Users\Lotta\AppData\Roaming\AVG7
2008-06-09 09:39 --------- d-----w C:\Users\Lotta\AppData\Roaming\OpenOffice.org2
2008-06-01 16:10 --------- d-----w C:\Program Files\mIRC
2008-05-29 14:18 --------- d-----w C:\Program Files\DC++
2008-05-29 13:09 --------- d-----w C:\Program Files\LimeWire
2008-05-29 10:11 --------- d-----w C:\Program Files\Common Files\Adobe
2008-05-26 18:11 --------- d-----w C:\Program Files\Pokerihuone
2008-05-22 14:25 --------- d-----w C:\Users\Lotta\AppData\Roaming\LimeWire
2008-05-16 20:48 --------- d-----w C:\Program Files\EA Sports
2008-05-16 20:46 --------- d-----w C:\Program Files\EA Games
2008-05-16 20:43 --------- d--h--w C:\Program Files\InstallShield Installation Information
2008-05-10 18:55 --------- d-----w C:\Users\Henkka\AppData\Roaming\LimeWire
2008-04-30 14:27 442,368 ----a-w C:\Windows\System32\nvuninst.exe
2008-04-27 14:15 --------- d-----w C:\Program Files\Canon
2008-04-27 13:12 --------- d-----w C:\Users\Henkka\AppData\Roaming\Ubisoft
2008-04-27 13:09 --------- d-----w C:\ProgramData\Ubisoft
2008-04-26 08:42 --------- d-----w C:\Program Files\Ubisoft
2008-04-25 17:53 --------- d-----w C:\Program Files\Audiosurf
2008-04-25 04:23 826,368 ----a-w C:\Windows\System32\wininet.dll
2008-04-25 04:23 56,320 ----a-w C:\Windows\System32\iesetup.dll
2008-04-25 04:23 52,736 ----a-w C:\Windows\AppPatch\iebrshim.dll
2008-04-25 04:22 26,624 ----a-w C:\Windows\System32\ieUnatt.exe
2008-04-24 15:07 73,216 ----a-w C:\Windows\ST6UNST.EXE
2008-04-24 15:07 249,856 ------w C:\Windows\Setup1.exe
2008-04-23 13:25 --------- d-----w C:\Users\Henkka\AppData\Roaming\FileZilla
2008-04-19 12:37 --------- d-----w C:\Program Files\Elävät Kirjat
2008-04-19 12:37 --------- d-----w C:\Program Files\EK
2008-04-19 12:08 --------- d-----w C:\Program Files\Diablo II
2008-04-19 12:04 43,520 ----a-w C:\Windows\System32\CmdLineExt03.dll
2008-04-15 16:43 --------- d-----w C:\Program Files\iTunes
2008-04-15 16:43 --------- d-----w C:\Program Files\iPod
2008-04-15 16:42 --------- d-----w C:\Program Files\QuickTime
2007-12-24 22:04 22,328 ----a-w C:\Users\Henkka\AppData\Roaming\PnkBstrK.sys
2007-12-14 17:39 174 --sha-w C:\Program Files\desktop.ini
.

((((((((((((((((((((((((((((( snapshot@2008-06-13_11.49.03,81 )))))))))))))))))))))))))))))))))))))))))
.
- 2006-11-02 12:34:21 136,192 ----a-w C:\Windows\assembly\GAC_32\mcupdate\6.0.6000.0__31bf3856ad364e35\mcupdate.exe
+ 2008-04-23 04:28:09 136,704 ----a-w C:\Windows\assembly\GAC_32\mcupdate\6.0.6000.0__31bf3856ad364e35\mcupdate.exe
- 2008-01-10 05:51:27 864,256 ----a-w C:\Windows\assembly\GAC_MSIL\ehepg\6.0.6000.0__31bf3856ad364e35\ehepg.dll
+ 2008-04-23 04:27:53 864,256 ----a-w C:\Windows\assembly\GAC_MSIL\ehepg\6.0.6000.0__31bf3856ad364e35\ehepg.dll
- 2008-01-10 05:51:29 135,168 ----a-w C:\Windows\assembly\GAC_MSIL\ehexthost\6.0.6000.0__31bf3856ad364e35\ehexthost.exe
+ 2008-04-23 04:27:55 135,168 ----a-w C:\Windows\assembly\GAC_MSIL\ehexthost\6.0.6000.0__31bf3856ad364e35\ehexthost.exe
- 2008-01-10 05:51:30 77,824 ----a-w C:\Windows\assembly\GAC_MSIL\ehiExtens\6.0.6000.0__31bf3856ad364e35\ehiExtens.dll
+ 2008-04-23 04:27:56 77,824 ----a-w C:\Windows\assembly\GAC_MSIL\ehiExtens\6.0.6000.0__31bf3856ad364e35\ehiExtens.dll
- 2008-01-10 05:51:34 4,370,432 ----a-w C:\Windows\assembly\GAC_MSIL\ehshell\6.0.6000.0__31bf3856ad364e35\ehshell.dll
+ 2008-04-23 04:27:59 4,374,528 ----a-w C:\Windows\assembly\GAC_MSIL\ehshell\6.0.6000.0__31bf3856ad364e35\ehshell.dll
- 2008-01-10 05:51:50 1,196,032 ----a-w C:\Windows\assembly\GAC_MSIL\Microsoft.MediaCenter.Shell\6.0.6000.0__31bf3856ad364e35\Microsoft.MediaCenter.Shell.dll
+ 2008-04-23 04:28:14 1,196,032 ----a-w C:\Windows\assembly\GAC_MSIL\Microsoft.MediaCenter.Shell\6.0.6000.0__31bf3856ad364e35\Microsoft.MediaCenter.Shell.dll
- 2008-01-10 05:51:51 2,342,912 ----a-w C:\Windows\assembly\GAC_MSIL\Microsoft.MediaCenter.UI\6.0.6000.0__31bf3856ad364e35\Microsoft.MediaCenter.UI.dll
+ 2008-04-23 04:28:14 2,342,912 ----a-w C:\Windows\assembly\GAC_MSIL\Microsoft.MediaCenter.UI\6.0.6000.0__31bf3856ad364e35\Microsoft.MediaCenter.UI.dll
- 2008-01-10 05:51:50 217,088 ----a-w C:\Windows\assembly\GAC_MSIL\Microsoft.MediaCenter\6.0.6000.0__31bf3856ad364e35\Microsoft.MediaCenter.dll
+ 2008-04-23 04:28:13 217,088 ----a-w C:\Windows\assembly\GAC_MSIL\Microsoft.MediaCenter\6.0.6000.0__31bf3856ad364e35\Microsoft.MediaCenter.dll
+ 2008-06-14 13:35:03 2,469,888 ----a-w C:\Windows\assembly\NativeImages_v2.0.50727_32\ehepg\3e10833eb7f83e11eec3a970f528ac8d\ehepg.ni.dll
+ 2008-06-14 13:35:12 274,432 ----a-w C:\Windows\assembly\NativeImages_v2.0.50727_32\ehExtHost\c11ea9504a5e5464b1850f98d3d381f1\ehExtHost.ni.exe
+ 2008-06-14 13:35:11 6,115,328 ----a-w C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.MediaCent#\6871abee28a9ed5eb7a878013664eb52\Microsoft.MediaCenter.UI.ni.dll
- 2008-06-12 16:37:09 67,584 --s-a-w C:\Windows\bootstat.dat
+ 2008-06-14 21:33:48 67,584 --s-a-w C:\Windows\bootstat.dat
- 2008-01-10 05:50:47 21,504 ----a-w C:\Windows\ehome\ehdebug.dll
+ 2008-04-23 04:27:00 21,504 ----a-w C:\Windows\ehome\ehdebug.dll
- 2008-01-10 05:51:27 864,256 ----a-w C:\Windows\ehome\ehepg.dll
+ 2008-04-23 04:27:53 864,256 ----a-w C:\Windows\ehome\ehepg.dll
- 2008-01-10 05:51:29 135,168 ----a-w C:\Windows\ehome\ehexthost.exe
+ 2008-04-23 04:27:55 135,168 ----a-w C:\Windows\ehome\ehexthost.exe
- 2006-11-02 12:34:20 372,224 ----a-w C:\Windows\ehome\ehglid.dll
+ 2008-04-23 04:27:00 372,224 ----a-w C:\Windows\ehome\ehglid.dll
- 2008-01-10 05:51:30 77,824 ----a-w C:\Windows\ehome\ehiExtens.dll
+ 2008-04-23 04:27:56 77,824 ----a-w C:\Windows\ehome\ehiExtens.dll
- 2008-01-10 05:50:47 103,936 ----a-w C:\Windows\ehome\ehPresenter.dll
+ 2008-04-23 04:27:00 105,472 ----a-w C:\Windows\ehome\ehPresenter.dll
- 2008-01-10 05:50:47 252,416 ----a-w C:\Windows\ehome\ehReplay.dll
+ 2008-04-23 04:27:00 252,416 ----a-w C:\Windows\ehome\ehReplay.dll
- 2008-01-10 05:46:17 10,094,080 ----a-w C:\Windows\ehome\ehres.dll
+ 2008-04-23 04:22:35 10,094,080 ----a-w C:\Windows\ehome\ehres.dll
- 2008-01-10 05:51:34 4,370,432 ----a-w C:\Windows\ehome\ehshell.dll
+ 2008-04-23 04:27:59 4,374,528 ----a-w C:\Windows\ehome\ehshell.dll
- 2008-01-10 05:50:47 18,944 ----a-w C:\Windows\ehome\ehtrace.dll
+ 2008-04-23 04:27:00 18,944 ----a-w C:\Windows\ehome\ehtrace.dll
- 2008-01-10 05:50:47 517,120 ----a-w C:\Windows\ehome\ehui.dll
+ 2008-04-23 04:27:00 517,632 ----a-w C:\Windows\ehome\ehui.dll
- 2008-01-10 05:50:47 1,497,600 ----a-w C:\Windows\ehome\ehuihlp.dll
+ 2008-04-23 04:27:00 1,497,600 ----a-w C:\Windows\ehome\ehuihlp.dll
- 2008-01-10 05:50:48 6,656 ----a-w C:\Windows\ehome\McrMgr.dll
+ 2008-04-23 04:27:01 6,656 ----a-w C:\Windows\ehome\McrMgr.dll
- 2008-01-10 05:50:25 173,056 ----a-w C:\Windows\ehome\McrMgr.exe
+ 2008-04-23 04:26:31 173,056 ----a-w C:\Windows\ehome\McrMgr.exe
- 2006-11-02 12:34:21 136,192 ----a-w C:\Windows\ehome\mcupdate.exe
+ 2008-04-23 04:28:09 136,704 ----a-w C:\Windows\ehome\mcupdate.exe
- 2008-01-10 05:51:50 217,088 ----a-w C:\Windows\ehome\Microsoft.MediaCenter.dll
+ 2008-04-23 04:28:13 217,088 ----a-w C:\Windows\ehome\Microsoft.MediaCenter.dll
- 2008-01-10 05:51:50 1,196,032 ----a-w C:\Windows\ehome\Microsoft.MediaCenter.Shell.dll
+ 2008-04-23 04:28:14 1,196,032 ----a-w C:\Windows\ehome\Microsoft.MediaCenter.Shell.dll
- 2008-01-10 05:51:51 2,342,912 ----a-w C:\Windows\ehome\Microsoft.MediaCenter.UI.dll
+ 2008-04-23 04:28:14 2,342,912 ----a-w C:\Windows\ehome\Microsoft.MediaCenter.UI.dll
- 2008-06-12 16:37:10 2,048 --sha-w C:\Windows\ServiceProfiles\LocalService\AppData\Local\lastalive0.dat
+ 2008-06-14 21:33:49 2,048 --sha-w C:\Windows\ServiceProfiles\LocalService\AppData\Local\lastalive0.dat
- 2008-06-12 16:37:10 2,048 --sha-w C:\Windows\ServiceProfiles\LocalService\AppData\Local\lastalive1.dat
+ 2008-06-14 21:33:49 2,048 --sha-w C:\Windows\ServiceProfiles\LocalService\AppData\Local\lastalive1.dat
- 2008-06-12 16:39:30 262,144 --sha-w C:\Windows\ServiceProfiles\LocalService\NTUSER.DAT
+ 2008-06-14 21:35:43 262,144 --sha-w C:\Windows\ServiceProfiles\LocalService\NTUSER.DAT
+ 2008-06-14 21:35:43 262,144 ---ha-w C:\Windows\ServiceProfiles\LocalService\ntuser.dat.LOG1
- 2008-06-13 08:32:18 16,384 --sha-w C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat
+ 2008-06-14 12:21:23 16,384 --sha-w C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat
- 2008-06-13 08:32:18 32,768 --sha-w C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat
+ 2008-06-14 12:21:23 32,768 --sha-w C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat
- 2008-06-13 07:10:15 16,384 --sha-w C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\Cookies\index.dat
+ 2008-06-14 12:22:49 16,384 --sha-w C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\Cookies\index.dat
- 2008-06-13 07:10:15 16,384 --sha-w C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\History\History.IE5\index.dat
+ 2008-06-14 12:22:49 16,384 --sha-w C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\History\History.IE5\index.dat
- 2008-06-13 07:10:15 32,768 --sha-w C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\Temporary Internet Files\Content.IE5\index.dat
+ 2008-06-14 12:22:49 32,768 --sha-w C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\Temporary Internet Files\Content.IE5\index.dat
- 2008-06-13 08:32:18 16,384 --sha-w C:\Windows\ServiceProfiles\NetworkService\AppData\Roaming\Microsoft\Windows\Cookies\index.dat
+ 2008-06-14 12:21:23 16,384 --sha-w C:\Windows\ServiceProfiles\NetworkService\AppData\Roaming\Microsoft\Windows\Cookies\index.dat
- 2008-06-12 16:50:29 262,144 --sha-w C:\Windows\ServiceProfiles\NetworkService\NTUSER.DAT
+ 2008-06-14 21:35:38 262,144 --sha-w C:\Windows\ServiceProfiles\NetworkService\NTUSER.DAT
+ 2008-06-14 21:35:38 262,144 ---ha-w C:\Windows\ServiceProfiles\NetworkService\ntuser.dat.LOG1
- 2008-06-12 16:37:10 16,384 --sha-w C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat
+ 2008-06-14 12:42:59 16,384 --sha-w C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat
- 2008-06-12 16:37:10 32,768 --sha-w C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat
+ 2008-06-14 12:42:59 32,768 --sha-w C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat
- 2008-06-12 16:37:10 16,384 --sha-w C:\Windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\index.dat
+ 2008-06-14 12:42:59 16,384 --sha-w C:\Windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\index.dat
- 2008-06-12 16:42:33 107,416 ----a-w C:\Windows\System32\perfc009.dat
+ 2008-06-14 06:06:00 107,416 ----a-w C:\Windows\System32\perfc009.dat
- 2008-06-12 16:42:33 88,416 ----a-w C:\Windows\System32\perfc00B.dat
+ 2008-06-14 06:06:00 88,416 ----a-w C:\Windows\System32\perfc00B.dat
- 2008-06-12 16:42:33 618,272 ----a-w C:\Windows\System32\perfh009.dat
+ 2008-06-14 06:06:00 618,272 ----a-w C:\Windows\System32\perfh009.dat
- 2008-06-12 16:42:33 467,808 ----a-w C:\Windows\System32\perfh00B.dat
+ 2008-06-14 06:06:00 467,808 ----a-w C:\Windows\System32\perfh00B.dat
- 2008-06-11 15:57:21 6,291,456 ----a-w C:\Windows\System32\SMI\Store\Machine\SCHEMA.DAT
+ 2008-06-14 13:14:33 6,291,456 ----a-w C:\Windows\System32\SMI\Store\Machine\SCHEMA.DAT
- 2008-06-12 10:30:46 7,068 ----a-w C:\Windows\System32\WDI\{86432a0b-3c7d-4ddf-a89c-172faa90485d}\S-1-5-21-2288889983-3666411893-3590199007-1000_UserData.bin
+ 2008-06-14 21:36:36 7,328 ----a-w C:\Windows\System32\WDI\{86432a0b-3c7d-4ddf-a89c-172faa90485d}\S-1-5-21-2288889983-3666411893-3590199007-1000_UserData.bin
- 2008-06-12 16:40:22 62,848 ----a-w C:\Windows\System32\WDI\BootPerformanceDiagnostics_SystemData.bin
+ 2008-06-14 21:36:36 63,256 ----a-w C:\Windows\System32\WDI\BootPerformanceDiagnostics_SystemData.bin
- 2008-06-12 16:40:20 31,770 ----a-w C:\Windows\System32\WDI\ShutdownPerformanceDiagnostics_SystemData.bin
+ 2008-06-14 13:17:16 31,870 ----a-w C:\Windows\System32\WDI\ShutdownPerformanceDiagnostics_SystemData.bin
- 2008-06-06 12:17:04 312,954 ----a-w C:\Windows\System32\WDI\SuspendPerformanceDiagnostics_SystemData_S3.bin
+ 2008-06-14 06:02:50 315,152 ----a-w C:\Windows\System32\WDI\SuspendPerformanceDiagnostics_SystemData_S3.bin
- 2008-06-11 15:46:52 29,296,453 ----a-w C:\Windows\winsxs\ManifestCache\6.0.6001.18000_001c50b5_blobs.bin
+ 2008-06-14 12:04:30 30,411,305 ----a-w C:\Windows\winsxs\ManifestCache\6.0.6001.18000_001c50b5_blobs.bin
+ 2008-04-23 04:27:53 864,256 ----a-w C:\Windows\winsxs\msil_ehepg_31bf3856ad364e35_6.0.6000.16679_none_d97a4d2ed1f284d2\ehepg.dll
+ 2008-04-23 14:12:49 864,256 ----a-w C:\Windows\winsxs\msil_ehepg_31bf3856ad364e35_6.0.6000.20821_none_da31f92beaeecb56\ehepg.dll
+ 2008-04-23 04:27:55 135,168 ----a-w C:\Windows\winsxs\msil_ehexthost_31bf3856ad364e35_6.0.6000.16679_none_bcbfc9e4c1e1e81d\ehexthost.exe
+ 2008-04-23 14:12:50 135,168 ----a-w C:\Windows\winsxs\msil_ehexthost_31bf3856ad364e35_6.0.6000.20821_none_bd7775e1dade2ea1\ehexthost.exe
+ 2008-04-23 04:27:56 77,824 ----a-w C:\Windows\winsxs\msil_ehiextens_31bf3856ad364e35_6.0.6000.16679_none_fba2d0c909e74612\ehiExtens.dll
+ 2008-04-23 14:12:51 77,824 ----a-w C:\Windows\winsxs\msil_ehiextens_31bf3856ad364e35_6.0.6000.20821_none_fc5a7cc622e38c96\ehiExtens.dll
+ 2008-04-23 04:27:59 4,374,528 ----a-w C:\Windows\winsxs\msil_ehshell_31bf3856ad364e35_6.0.6000.16679_none_896d686f44a61324\ehshell.dll
+ 2008-04-23 14:12:55 4,382,720 ----a-w C:\Windows\winsxs\msil_ehshell_31bf3856ad364e35_6.0.6000.20821_none_8a25146c5da259a8\ehshell.dll
+ 2008-04-23 04:44:14 4,046,848 ----a-w C:\Windows\winsxs\msil_ehshell_31bf3856ad364e35_6.0.6001.18061_none_8b5674b141cbbd6c\ehshell.dll
+ 2008-04-23 04:36:58 4,046,848 ----a-w C:\Windows\winsxs\msil_ehshell_31bf3856ad364e35_6.0.6001.22165_none_8be412a45ae5c292\ehshell.dll
+ 2008-04-23 04:28:14 1,196,032 ----a-w C:\Windows\winsxs\msil_microsoft.mediacenter.shell_31bf3856ad364e35_6.0.6000.16679_none_4e6b0c2698ea89ba\Microsoft.MediaCenter.Shell.dll
+ 2008-04-23 14:13:09 1,269,760 ----a-w C:\Windows\winsxs\msil_microsoft.mediacenter.shell_31bf3856ad364e35_6.0.6000.20821_none_4f22b823b1e6d03e\Microsoft.MediaCenter.Shell.dll
+ 2008-04-23 04:28:14 2,342,912 ----a-w C:\Windows\winsxs\msil_microsoft.mediacenter.ui_31bf3856ad364e35_6.0.6000.16679_none_30f95ad65a3e86d4\Microsoft.MediaCenter.UI.dll
+ 2008-04-23 14:13:09 2,351,104 ----a-w C:\Windows\winsxs\msil_microsoft.mediacenter.ui_31bf3856ad364e35_6.0.6000.20821_none_31b106d3733acd58\Microsoft.MediaCenter.UI.dll
+ 2008-04-23 04:45:00 1,957,888 ----a-w C:\Windows\winsxs\msil_microsoft.mediacenter.ui_31bf3856ad364e35_6.0.6001.18061_none_32e267185764311c\Microsoft.MediaCenter.UI.dll
+ 2008-04-23 04:37:38 1,957,888 ----a-w C:\Windows\winsxs\msil_microsoft.mediacenter.ui_31bf3856ad364e35_6.0.6001.22165_none_3370050b707e3642\Microsoft.MediaCenter.UI.dll
+ 2008-04-23 04:28:13 217,088 ----a-w C:\Windows\winsxs\msil_microsoft.mediacenter_31bf3856ad364e35_6.0.6000.16679_none_2354b3c9cf56f2ea\Microsoft.MediaCenter.dll
+ 2008-04-23 14:13:08 217,088 ----a-w C:\Windows\winsxs\msil_microsoft.mediacenter_31bf3856ad364e35_6.0.6000.20821_none_240c5fc6e853396e\Microsoft.MediaCenter.dll
+ 2008-04-23 04:28:09 136,704 ----a-w C:\Windows\winsxs\x86_mcupdate_31bf3856ad364e35_6.0.6000.16679_none_c673e63faed8754d\mcupdate.exe
+ 2008-04-23 14:13:03 136,704 ----a-w C:\Windows\winsxs\x86_mcupdate_31bf3856ad364e35_6.0.6000.20821_none_c72b923cc7d4bbd1\mcupdate.exe
+ 2008-04-23 04:44:47 140,288 ----a-w C:\Windows\winsxs\x86_mcupdate_31bf3856ad364e35_6.0.6001.18061_none_c85cf281abfe1f95\mcupdate.exe
+ 2008-04-23 04:37:28 140,288 ----a-w C:\Windows\winsxs\x86_mcupdate_31bf3856ad364e35_6.0.6001.22165_none_c8ea9074c51824bb\mcupdate.exe
+ 2008-04-23 04:27:00 252,416 ----a-w C:\Windows\winsxs\x86_microsoft-windows-ehome-devices-ehreplay_31bf3856ad364e35_6.0.6000.16679_none_128e8c93a2bce482\ehReplay.dll
+ 2008-04-23 05:11:36 254,464 ----a-w C:\Windows\winsxs\x86_microsoft-windows-ehome-devices-ehreplay_31bf3856ad364e35_6.0.6000.20821_none_13463890bbb92b06\ehReplay.dll
+ 2008-04-23 04:42:33 254,464 ----a-w C:\Windows\winsxs\x86_microsoft-windows-ehome-devices-ehreplay_31bf3856ad364e35_6.0.6001.18061_none_147798d59fe28eca\ehReplay.dll
+ 2008-04-23 04:30:25 254,464 ----a-w C:\Windows\winsxs\x86_microsoft-windows-ehome-devices-ehreplay_31bf3856ad364e35_6.0.6001.22165_none_150536c8b8fc93f0\ehReplay.dll
+ 2008-04-23 04:27:01 6,656 ----a-w C:\Windows\winsxs\x86_microsoft-windows-ehome-devices-mcrmgr_31bf3856ad364e35_6.0.6000.16679_none_3200fce9dd0448e0\McrMgr.dll
+ 2008-04-23 04:26:31 173,056 ----a-w C:\Windows\winsxs\x86_microsoft-windows-ehome-devices-mcrmgr_31bf3856ad364e35_6.0.6000.16679_none_3200fce9dd0448e0\McrMgr.exe
+ 2008-04-23 05:11:51 6,656 ----a-w C:\Windows\winsxs\x86_microsoft-windows-ehome-devices-mcrmgr_31bf3856ad364e35_6.0.6000.20821_none_32b8a8e6f6008f64\McrMgr.dll
+ 2008-04-23 03:56:48 172,544 ----a-w C:\Windows\winsxs\x86_microsoft-windows-ehome-devices-mcrmgr_31bf3856ad364e35_6.0.6000.20821_none_32b8a8e6f6008f64\McrMgr.exe
+ 2008-04-23 04:27:00 21,504 ----a-w C:\Windows\winsxs\x86_microsoft-windows-ehome-ehdebug_31bf3856ad364e35_6.0.6000.16679_none_2db4cba1854c2050\ehdebug.dll
+ 2008-04-23 05:11:35 21,504 ----a-w C:\Windows\winsxs\x86_microsoft-windows-ehome-ehdebug_31bf3856ad364e35_6.0.6000.20821_none_2e6c779e9e4866d4\ehdebug.dll
+ 2008-04-23 04:27:00 372,224 ----a-w C:\Windows\winsxs\x86_microsoft-windows-ehome-ehglid_31bf3856ad364e35_6.0.6000.16679_none_2d12eef96d2c252b\ehglid.dll
+ 2008-04-23 05:11:35 372,736 ----a-w C:\Windows\winsxs\x86_microsoft-windows-ehome-ehglid_31bf3856ad364e35_6.0.6000.20821_none_2dca9af686286baf\ehglid.dll
+ 2008-04-23 04:42:33 373,248 ----a-w C:\Windows\winsxs\x86_microsoft-windows-ehome-ehglid_31bf3856ad364e35_6.0.6001.18061_none_2efbfb3b6a51cf73\ehglid.dll
+ 2008-04-23 04:30:24 373,248 ----a-w C:\Windows\winsxs\x86_microsoft-windows-ehome-ehglid_31bf3856ad364e35_6.0.6001.22165_none_2f89992e836bd499\ehglid.dll
+ 2008-04-23 04:27:00 105,472 ----a-w C:\Windows\winsxs\x86_microsoft-windows-ehome-ehpresenter_31bf3856ad364e35_6.0.6000.16679_none_249fac1865043b1f\ehPresenter.dll
+ 2008-04-23 05:11:36 105,472 ----a-w C:\Windows\winsxs\x86_microsoft-windows-ehome-ehpresenter_31bf3856ad364e35_6.0.6000.20821_none_255758157e0081a3\ehPresenter.dll
+ 2008-04-23 04:42:33 105,472 ----a-w C:\Windows\winsxs\x86_microsoft-windows-ehome-ehpresenter_31bf3856ad364e35_6.0.6001.18061_none_2688b85a6229e567\ehPresenter.dll
+ 2008-04-23 04:30:25 105,472 ----a-w C:\Windows\winsxs\x86_microsoft-windows-ehome-ehpresenter_31bf3856ad364e35_6.0.6001.22165_none_2716564d7b43ea8d\ehPresenter.dll
+ 2008-04-23 04:22:35 10,094,080 ----a-w C:\Windows\winsxs\x86_microsoft-windows-ehome-ehres_31bf3856ad364e35_6.0.6000.16679_none_4fe31875538242d1\ehres.dll
+ 2008-04-23 05:11:36 10,103,808 ----a-w C:\Windows\winsxs\x86_microsoft-windows-ehome-ehres_31bf3856ad364e35_6.0.6000.20821_none_509ac4726c7e8955\ehres.dll
+ 2008-04-23 04:27:00 18,944 ----a-w C:\Windows\winsxs\x86_microsoft-windows-ehome-ehtrace_31bf3856ad364e35_6.0.6000.16679_none_3693dda116ea05e6\ehtrace.dll
+ 2008-04-23 05:11:36 18,944 ----a-w C:\Windows\winsxs\x86_microsoft-windows-ehome-ehtrace_31bf3856ad364e35_6.0.6000.20821_none_374b899e2fe64c6a\ehtrace.dll
+ 2008-04-23 04:27:00 517,632 ----a-w C:\Windows\winsxs\x86_microsoft-windows-ehome-ehui_31bf3856ad364e35_6.0.6000.16679_none_cc9b30cbcc71d8eb\ehui.dll
+ 2008-04-23 05:11:36 521,216 ----a-w C:\Windows\winsxs\x86_microsoft-windows-ehome-ehui_31bf3856ad364e35_6.0.6000.20821_none_cd52dcc8e56e1f6f\ehui.dll
+ 2008-04-23 04:42:33 522,240 ----a-w C:\Windows\winsxs\x86_microsoft-windows-ehome-ehui_31bf3856ad364e35_6.0.6001.18061_none_ce843d0dc9978333\ehui.dll
+ 2008-04-23 04:30:33 522,240 ----a-w C:\Windows\winsxs\x86_microsoft-windows-ehome-ehui_31bf3856ad364e35_6.0.6001.22165_none_cf11db00e2b18859\ehui.dll
+ 2008-04-23 04:27:00 1,497,600 ----a-w C:\Windows\winsxs\x86_microsoft-windows-ehome-ehuihlp_31bf3856ad364e35_6.0.6000.16679_none_39e223022e478d8d\ehuihlp.dll
+ 2008-04-23 05:11:36 1,498,112 ----a-w C:\Windows\winsxs\x86_microsoft-windows-ehome-ehuihlp_31bf3856ad364e35_6.0.6000.20821_none_3a99ceff4743d411\ehuihlp.dll
+ 2008-04-23 04:27:01 1,244,672 ----a-w C:\Windows\winsxs\x86_microsoft-windows-m..mediadeliveryengine_31bf3856ad364e35_6.0.6000.16679_none_3d017dbd628e4075\mcmde.dll
+ 2008-04-23 05:11:51 1,244,672 ----a-w C:\Windows\winsxs\x86_microsoft-windows-m..mediadeliveryengine_31bf3856ad364e35_6.0.6000.20821_none_3db929ba7b8a86f9\mcmde.dll
+ 2008-04-23 04:27:00 428,032 ----a-w C:\Windows\winsxs\x86_microsoft-windows-tvencdec_31bf3856ad364e35_6.0.6000.16679_none_de4f2af09170b787\EncDec.dll
+ 2008-04-23 05:11:36 428,032 ----a-w C:\Windows\winsxs\x86_microsoft-windows-tvencdec_31bf3856ad364e35_6.0.6000.20821_none_df06d6edaa6cfe0b\EncDec.dll
+ 2008-04-23 04:42:37 428,544 ----a-w C:\Windows\winsxs\x86_microsoft-windows-tvencdec_31bf3856ad364e35_6.0.6001.18061_none_e03837328e9661cf\EncDec.dll
+ 2008-04-23 04:34:41 428,544 ----a-w C:\Windows\winsxs\x86_microsoft-windows-tvencdec_31bf3856ad364e35_6.0.6001.22165_none_e0c5d525a7b066f5\EncDec.dll
+ 2008-04-23 04:27:04 292,352 ----a-w C:\Windows\winsxs\x86_microsoft-windows-v..e-filters-tvdigital_31bf3856ad364e35_6.0.6000.16679_none_d9d44caa5a19bb32\psisdecd.dll
+ 2008-04-23 05:12:30 292,352 ----a-w C:\Windows\winsxs\x86_microsoft-windows-v..e-filters-tvdigital_31bf3856ad364e35_6.0.6000.20821_none_da8bf8a7731601b6\psisdecd.dll
+ 2008-04-23 04:42:37 293,376 ----a-w C:\Windows\winsxs\x86_microsoft-windows-v..e-filters-tvdigital_31bf3856ad364e35_6.0.6001.18061_none_dbbd58ec573f657a\psisdecd.dll
+ 2008-04-23 04:34:47 293,376 ----a-w C:\Windows\winsxs\x86_microsoft-windows-v..e-filters-tvdigital_31bf3856ad364e35_6.0.6001.22165_none_dc4af6df70596aa0\psisdecd.dll
.
-- Snapshot reset to current date --
.
(((((((((((((((((((((((((((((( Rekisterin käynnistyskohteet )))))))))))))))))))))))))))))))))))))))))))))
.
.
REGEDIT4
*Huom* Tyhjiä arvoja ja laillisia oletusarvoja ei näytetä

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ehTray.exe"="C:\Windows\ehome\ehTray.exe" [2006-11-02 15:34 125440]
"WMPNSCFG"="C:\Program Files\Windows Media Player\WMPNSCFG.exe" [2006-11-02 15:33 201728]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"AVG7_CC"="C:\PROGRA~1\Grisoft\AVG7\avgcc.exe" [2008-04-15 17:41 579584]
"RtHDVCpl"="RtHDVCpl.exe" [2007-03-23 14:04 4423680 C:\Windows\RtHDVCpl.exe]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe" [2008-02-22 05:25 144784]
"NvCplDaemon"="C:\Windows\system32\NvCpl.dll" [2008-05-02 22:46 13535776]
"NvMediaCenter"="C:\Windows\system32\NvMcTray.dll" [2008-05-02 22:46 92704]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"AVG7_Run"="C:\PROGRA~1\Grisoft\AVG7\avgw.exe" [2007-12-14 20:44 219136]

C:\Users\Henkka\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
Adobe Gamma.lnk - C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [2005-03-16 19:16:50 113664]
PowerStrip.lnk - C:\Program Files\PowerStrip\PStrip.exe [2008-06-02 19:50:00 732408]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\system]
"LogonHoursAction"= 2 (0x2)
"DontDisplayLogonHoursWarnings"= 1 (0x1)

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\avgwlntf]
avgwlntf.dll 2007-12-14 20:44 9216 C:\Windows\System32\avgwlntf.dll

[HKLM\~\startupfolder\C:^Users^Henkka^AppData^Roaming^Microsoft^Windows^Start Menu^Programs^Startup^Last.fm Helper.lnk]
path=C:\Users\Henkka\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Last.fm Helper.lnk
backup=C:\Windows\pss\Last.fm Helper.lnk.Startup
backupExtension=.Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher]
--a------ 2008-01-11 22:16 39792 C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DAEMON Tools Lite]
--a------ 2008-01-17 19:51 486856 C:\Program Files\DAEMON Tools Lite\daemon.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\InCD]
--a------ 2007-05-15 16:55 1057328 C:\Program Files\Nero\Nero 7\InCD\InCD.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper]
--a------ 2008-03-30 10:36 267048 C:\Program Files\iTunes\iTunesHelper.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck]
--a------ 2007-03-01 16:57 153136 C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
--a------ 2008-03-28 23:37 413696 C:\Program Files\QuickTime\QTTask.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SecurDisc]
--a------ 2007-05-15 16:55 1628208 C:\Program Files\Nero\Nero 7\InCD\NBHGui.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\tvjbmonitor]
--a------ 2006-12-26 18:08 53248 C:\Program Files\MMEDIA\TV Jukebox 3.0\tvjbMonitor.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WinampAgent]
C:\Program Files\Winamp\winampa.exe

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Svc\S-1-5-21-2288889983-3666411893-3590199007-1000]
"EnableNotificationsRef"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\FirewallRules]
"{97EC9346-283B-4D38-B976-D1E47A4A3E83}"= C:\Program Files\Windows Live\Messenger\livecall.exe:Windows Live Messenger (Phone)
"TCP Query User{7974046A-0FC0-47B1-9141-812645F426D5}C:\\program files\\mirc\\mirc.exe"= UDP:C:\program files\mirc\mirc.exe:mIRC
"UDP Query User{E3D464D6-953A-4C2E-BF1D-CDAB70DF8C4A}C:\\program files\\mirc\\mirc.exe"= TCP:C:\program files\mirc\mirc.exe:mIRC
"TCP Query User{97AA655B-5A12-4327-9DD4-386A45F44429}C:\\program files\\steam\\steamapps\\hnkk\\counter-strike\\hl.exe"= UDP:C:\program files\steam\steamapps\hnkk\counter-strike\hl.exe:Half-Life Launcher
"UDP Query User{E76FDB83-0295-49A7-8F79-AF2E09FF1B21}C:\\program files\\steam\\steamapps\\hnkk\\counter-strike\\hl.exe"= TCP:C:\program files\steam\steamapps\hnkk\counter-strike\hl.exe:Half-Life Launcher
"TCP Query User{51A5C65E-1D8A-4BA9-87C0-6F28BAD162DE}C:\\program files\\wolfenstein - enemy territory\\et.exe"= UDP:C:\program files\wolfenstein - enemy territory\et.exe:ET
"UDP Query User{70FC1D58-4C03-4DAA-9808-DB04A8E4423E}C:\\program files\\wolfenstein - enemy territory\\et.exe"= TCP:C:\program files\wolfenstein - enemy territory\et.exe:ET
"TCP Query User{2E0625A8-B2DB-4C2A-A89A-FB1AB146248D}C:\\program files\\the all-seeing eye\\eye.exe"= UDP:C:\program files\the all-seeing eye\eye.exe:Yahoo! All-Seeing Eye
"UDP Query User{51888159-E2F8-4DFE-A283-C5DBBC23E760}C:\\program files\\the all-seeing eye\\eye.exe"= TCP:C:\program files\the all-seeing eye\eye.exe:Yahoo! All-Seeing Eye
"TCP Query User{9FD05F55-891D-4DC3-A940-1A3D98C46C04}C:\\ijji\\english\\gunz\\gunz.exe"= UDP:C:\ijji\english\gunz\gunz.exe:Gunz
"UDP Query User{1F9F5747-FD56-467E-B75F-7677918F328C}C:\\ijji\\english\\gunz\\gunz.exe"= TCP:C:\ijji\english\gunz\gunz.exe:Gunz
"TCP Query User{7B1E9094-96E3-4021-8D3A-04D97A4C72C9}C:\\program files\\dc++\\dcplusplus.exe"= UDP:C:\program files\dc++\dcplusplus.exeC++
"UDP Query User{0959F4FC-45DF-4091-89AC-249EB9E56AF8}C:\\program files\\dc++\\dcplusplus.exe"= TCP:C:\program files\dc++\dcplusplus.exeC++
"{18F26EA3-480C-49EE-92A7-BF7F7A283D8E}"= UDP:C:\Program Files\Electronic Arts\Crytek\Crysis\Bin32\Crysis.exe:Crysis_32
"{9B33D492-2B61-4992-B640-FEB3E86193F3}"= TCP:C:\Program Files\Electronic Arts\Crytek\Crysis\Bin32\Crysis.exe:Crysis_32
"{25AD2C1F-E0E7-473D-9E98-4F664C593CAC}"= UDP:C:\Program Files\Electronic Arts\Crytek\Crysis\Bin32\CrysisDedicatedServer.exe:CrysisDedicatedServer_32
"{9D39EC9F-B849-4960-AE66-3F6A22302FA5}"= TCP:C:\Program Files\Electronic Arts\Crytek\Crysis\Bin32\CrysisDedicatedServer.exe:CrysisDedicatedServer_32
"{04186A89-3891-4826-8F74-C1A0719D4066}"= UDP:C:\Windows\System32\PnkBstrA.exenkBstrA
"{3C629100-A34B-4CCF-BBC9-DD7C7D95FE4E}"= TCP:C:\Windows\System32\PnkBstrA.exenkBstrA
"{D5C767FE-08D0-4AAA-A7F8-26639271F981}"= UDP:C:\Windows\System32\PnkBstrB.exenkBstrB
"{ADC1ED70-DF5A-4F90-B441-893EA963C40E}"= TCP:C:\Windows\System32\PnkBstrB.exenkBstrB
"{3BADFB8F-C1E0-4EF2-999F-7A342A7167C2}"= UDP:C:\Program Files\2K Games\Firaxis Games\Sid Meier's Civilization 4 Complete\Civilization4.exe:Sid Meier's Civilization 4 Complete
"{8E6F881B-F8EB-490E-9385-A2F298D41421}"= TCP:C:\Program Files\2K Games\Firaxis Games\Sid Meier's Civilization 4 Complete\Civilization4.exe:Sid Meier's Civilization 4 Complete
"{A6A119C3-B77C-45C9-9163-14B0AC41D37A}"= UDP:C:\Program Files\2K Games\Firaxis Games\Sid Meier's Civilization 4 Complete\Warlords\Civ4Warlords.exe:Sid Meier's Civilization 4: Warlords
"{12876641-FF77-4180-8DDC-1C59ADA453F9}"= TCP:C:\Program Files\2K Games\Firaxis Games\Sid Meier's Civilization 4 Complete\Warlords\Civ4Warlords.exe:Sid Meier's Civilization 4: Warlords
"{A0A0FD90-06F4-412E-8E0E-253B8DF63C90}"= UDP:C:\Program Files\2K Games\Firaxis Games\Sid Meier's Civilization 4 Complete\Beyond the Sword\Civ4BeyondSword.exe:Sid Meier's Civilization 4: Beyond the Sword
"{31A7B6D3-7112-4BEF-A57B-027ADE05F16A}"= TCP:C:\Program Files\2K Games\Firaxis Games\Sid Meier's Civilization 4 Complete\Beyond the Sword\Civ4BeyondSword.exe:Sid Meier's Civilization 4: Beyond the Sword
"TCP Query User{6A3762AA-2D45-4C87-B390-8A15EC973FF1}C:\\program files\\utorrent\\utorrent.exe"= UDP:C:\program files\utorrent\utorrent.exe:uTorrent
"UDP Query User{94EB9222-B30C-499D-94A3-DD8F5F9ECF6F}C:\\program files\\utorrent\\utorrent.exe"= TCP:C:\program files\utorrent\utorrent.exe:uTorrent
"TCP Query User{D9DE7F0D-A7D4-4AED-924B-B856BFD40998}C:\\program files\\steam\\steamapps\\hnkk\\ricochet\\hl.exe"= UDP:C:\program files\steam\steamapps\hnkk\ricochet\hl.exe:Half-Life Launcher
"UDP Query User{CE439899-2C82-49EE-8C79-A5B8B8301C58}C:\\program files\\steam\\steamapps\\hnkk\\ricochet\\hl.exe"= TCP:C:\program files\steam\steamapps\hnkk\ricochet\hl.exe:Half-Life Launcher
"{DCA97472-32BA-4445-99CB-A7883C6F6EB8}"= UDP:C:\Program Files\Bonjour\mDNSResponder.exe:Bonjour
"{71EF5FDB-79B6-4F40-A064-C500C768D21B}"= TCP:C:\Program Files\Bonjour\mDNSResponder.exe:Bonjour
"TCP Query User{C5E09EB2-49C5-44B9-8BE7-153A730BCFA8}C:\\program files\\steam\\steamapps\\battery55\\counter-strike\\hl.exe"= UDP:C:\program files\steam\steamapps\battery55\counter-strike\hl.exe:Half-Life Launcher
"UDP Query User{847B04DB-C439-4094-9F93-0DCAC41FFED5}C:\\program files\\steam\\steamapps\\battery55\\counter-strike\\hl.exe"= TCP:C:\program files\steam\steamapps\battery55\counter-strike\hl.exe:Half-Life Launcher
"TCP Query User{E2C875F7-0B42-4B9F-A83A-64421FC42C3D}C:\\program files\\ea games\\ultima online mondain's legacy\\client.exe"= UDP:C:\program files\ea games\ultima online mondain's legacy\client.exe:client
"UDP Query User{E93AF1A7-D3E1-4843-8CBB-C2E112BBF009}C:\\program files\\ea games\\ultima online mondain's legacy\\client.exe"= TCP:C:\program files\ea games\ultima online mondain's legacy\client.exe:client
"TCP Query User{61519A35-CE25-4BEE-AE84-213E0326F6F6}C:\\program files\\pokerihuone\\jre\\bin\\javaw.exe"= UDP:C:\program files\pokerihuone\jre\bin\javaw.exe:Java(TM) 2 Platform Standard Edition binary
"UDP Query User{05B784B9-D99C-4816-AB1F-1D4F4C4A9B20}C:\\program files\\pokerihuone\\jre\\bin\\javaw.exe"= TCP:C:\program files\pokerihuone\jre\bin\javaw.exe:Java(TM) 2 Platform Standard Edition binary
"{B7E3976F-3EF2-470F-945B-B6EC326B63E5}"= UDP:C:\Program Files\iTunes\iTunes.exe:iTunes
"{DCC0933D-58E3-4E57-9CFB-60A46EC7E597}"= TCP:C:\Program Files\iTunes\iTunes.exe:iTunes
"{AF10E89C-30EB-44C4-A07E-942FFF05F4B3}"= UDP:C:\Program Files\Ubisoft\Assassin's Creed\AssassinsCreed_Dx9.exe:Assassin's Creed Dx9
"{BA90B2AB-87B7-4686-86B0-A33F09845D14}"= TCP:C:\Program Files\Ubisoft\Assassin's Creed\AssassinsCreed_Dx9.exe:Assassin's Creed Dx9
"{34F9F1A2-5931-4B1E-A668-8835227F8D2C}"= UDP:C:\Program Files\Ubisoft\Assassin's Creed\AssassinsCreed_Dx10.exe:Assassin's Creed Dx10
"{61CD2A17-7E18-4732-B714-C7F6B403998B}"= TCP:C:\Program Files\Ubisoft\Assassin's Creed\AssassinsCreed_Dx10.exe:Assassin's Creed Dx10
"{A9701197-AEA0-411F-8B55-2445A17C1B8E}"= UDP:C:\Program Files\Ubisoft\Assassin's Creed\AssassinsCreed_Launcher.exe:Assassin's Creed Update
"{68B7DB46-B944-445E-8510-2FEECCC537FE}"= TCP:C:\Program Files\Ubisoft\Assassin's Creed\AssassinsCreed_Launcher.exe:Assassin's Creed Update
"{53224DE0-1F0A-4781-974E-C64144A1FF73}"= UDP:C:\Program Files\FrostWire\FrostWire.exe:LimeWire
"{70CE8CDB-7716-478C-9CCB-65A18C0384F4}"= TCP:C:\Program Files\FrostWire\FrostWire.exe:LimeWire

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\RestrictedServices\Static\System]
"DFSR-1"= RPort=5722|UDP:%SystemRoot%\system32\svchost.exe|Svc=DFSR:Allow inbound TCP traffic|

R0 AtiPcie;ATI PCI Express (3GIO) Filter;C:\Windows\system32\DRIVERS\AtiPcie.sys [2006-10-30 18:23]
R1 PStrip;PStrip;C:\Windows\system32\drivers\pstrip.sys [2007-07-15 04:37]
R3 AvgWFP;AVG7 Firewall Driver x86;C:\Windows\system32\Drivers\avgwfp.sys [2008-03-13 16:10]
S3 3xHybrid;Pinnacle PCTV 100i-110i-300i-310i-MCE;C:\Windows\system32\DRIVERS\3xHybrid.sys [2006-11-22 09:53]
S3 mod7700;DiBcom based TV tuner device;C:\Windows\system32\DRIVERS\mod7700.sys [2007-02-20 13:26]
S3 MODRC;Ultima Infrared Receiver;C:\Windows\system32\DRIVERS\modrc.sys [2007-02-06 13:10]
S3 Ph3xIB32;Philips 713x Inbox PCI TV Card;C:\Windows\system32\DRIVERS\Ph3xIB32.sys [2007-04-03 11:43]
S3 Steam Client Service;Steam Client Service;C:\Program Files\Common Files\Steam\SteamService.exe [2008-06-13 12:16]
S3 stusb2ir;USB 2.0 IrDA Bridge;C:\Windows\system32\DRIVERS\stusb2ir.sys [2006-11-02 10:30]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{2a208f47-aa4d-11dc-b651-806e6f6e6963}]
\shell\AutoRun\command - D:\Aloita.exe
\shell\Avaa\Command - D:\Aloita.exe

.
**************************************************************************

catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-06-15 00:40:34
Windows 6.0.6000 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...


**************************************************************************
.
Completion time: 2008-06-15 0:42:13
ComboFix-quarantined-files.txt 2008-06-14 21:41:10
ComboFix2.txt 2008-06-13 08:49:58

Pre-Run: 153,659,064,320 tavua vapaana
Post-Run: 153,627,181,056 tavua vapaana

397 --- E O F --- 2008-06-14 12:43:15

 

Lataa: RegSeeker.zip työpöydälle:

Pura zip C:\RegSeeker\ kansioon. Sieltä käynnistät RegSeeker.exe ohjelman.
Oikeasa yläkulmassa on Languages.... linkki, josta valitset Suomenkielen.
Vasemmasta alakulmasta ruksit Luo vrmuuskopio ja sitten linkki Puhdista rekisteri
Ruksit kaikkiin muihin kohtiin paitsi "Käyttökelvottomat.." sitten "OK" (odotat hetken).
Ruutuun ilmestyy lista epäkelvoista rekisterimerkinnöistä, jotka alapalkista Valitse kohdasta
klikkaat Valitse kaikki jolloin valitut saavat keltaisen pohjavärin.
Alapalkin Toiminnot linkistä klikkaat Poista valitut kohteet
Ponnahdusikkunaan "Kaikki valitut kohteet poistetaan ? vastaat "OK".
Seuraavaan Ponnahdusikkunaan "Varmuuskopiot" vastaat "OK".
Klikaa vasemmalta Lopeta RegSeeker ja käynnistä koneesi uudelleen.

 

Tuossa uusi:

ComboFix 08-06-11.3 - Henkka 2008-06-15 0:36:23.2 - NTFSx86
Running from: C:\Users\Henkka\Desktop\LADATUT\Firefox\ComboFix.exe
.

((((( Tiedostot, jotka on luotu seuraavalla aikavälillä: 2008-05-14 to 2008-06-14 )))))))))))))))))
.

2008-06-14 15:08 . 2008-04-23 07:27 1,244,672 --a------ C:\Windows\System32\mcmde.dll
2008-06-14 15:08 . 2008-04-23 07:27 428,032 --a------ C:\Windows\System32\EncDec.dll
2008-06-14 15:08 . 2008-04-23 07:27 292,352 --a------ C:\Windows\System32\psisdecd.dll
2008-06-14 15:08 . 2008-04-23 07:26 218,624 --a------ C:\Windows\System32\psisrndr.ax
2008-06-14 15:08 . 2008-04-23 07:26 80,896 --a------ C:\Windows\System32\MSNP.ax
2008-06-14 15:08 . 2008-04-23 07:26 68,608 --a------ C:\Windows\System32\Mpeg2Data.ax
2008-06-14 15:08 . 2008-04-23 07:26 57,856 --a------ C:\Windows\System32\MSDvbNP.ax
2008-06-11 20:29 . 2008-06-11 20:29 <KANSIO> d-------- C:\Program Files\PowerStrip
2008-06-11 20:17 . 2008-06-11 20:17 <KANSIO> d-------- C:\Program Files\Malwarebytes' Anti-Malware
2008-06-11 20:17 . 2008-06-10 19:02 34,296 --a------ C:\Windows\System32\drivers\mbamcatchme.sys
2008-06-11 20:17 . 2008-06-10 19:02 15,864 --a------ C:\Windows\System32\drivers\mbam.sys
2008-06-11 20:03 . 2008-06-11 20:03 <KANSIO> d-------- C:\Windows\nvidia icons
2008-06-11 19:57 . 2008-06-11 19:57 <KANSIO> d-------- C:\ATI
2008-06-11 19:26 . 2008-06-14 16:36 204,020,745 --a------ C:\Windows\MEMORY.DMP
2008-06-11 19:14 . 2008-06-11 19:14 <KANSIO> d-------- C:\Users\Henkka\AppData\Roaming\Malwarebytes
2008-06-11 19:14 . 2008-06-11 19:14 <KANSIO> d-------- C:\Users\All Users\Malwarebytes
2008-06-11 19:14 . 2008-06-11 19:14 <KANSIO> d-------- C:\ProgramData\Malwarebytes
2008-06-11 03:10 . 2008-04-26 11:02 1,327,104 --a------ C:\Windows\System32\quartz.dll
2008-06-11 03:10 . 2008-05-10 04:21 113,664 --a------ C:\Windows\System32\drivers\rmcast.sys
2008-06-11 03:10 . 2008-05-10 06:30 14,848 --a------ C:\Windows\System32\wshrm.dll
2008-06-05 19:39 . 2008-06-05 19:39 <KANSIO> d-------- C:\Program Files\Apple Software Update
2008-06-05 12:16 . 2008-06-05 13:44 <KANSIO> d-------- C:\Program Files\BSplayer
2008-06-02 16:52 . 2008-06-02 16:52 54,156 --ah----- C:\Windows\QTFont.qfn
2008-06-02 16:52 . 2008-06-02 16:52 1,409 --a------ C:\Windows\QTFont.for
2008-06-01 14:18 . 2008-06-09 13:07 <KANSIO> d-------- C:\Users\Lotta\Shared
2008-06-01 14:17 . 2008-06-01 14:45 <KANSIO> d-------- C:\Users\Lotta\AppData\Roaming\FrostWire
2008-06-01 14:10 . 2008-06-01 14:10 268 --ah----- C:\sqmdata02.sqm
2008-06-01 14:10 . 2008-06-01 14:10 244 --ah----- C:\sqmnoopt02.sqm
2008-05-29 16:45 . 2008-06-10 22:49 <KANSIO> d-------- C:\Users\Henkka\Contacts
2008-05-29 16:09 . 2008-05-29 17:15 <KANSIO> d-------- C:\Users\Henkka\AppData\Roaming\FrostWire
2008-05-29 16:09 . 2008-06-01 18:27 <KANSIO> d-------- C:\Program Files\FrostWire
2008-05-29 13:19 . 2008-05-29 13:19 <KANSIO> d-------- C:\Users\All Users\Adobe Systems
2008-05-29 13:19 . 2008-05-29 13:19 <KANSIO> d-------- C:\ProgramData\Adobe Systems
2008-05-29 13:10 . 2008-05-29 13:10 <KANSIO> d-------- C:\Program Files\Common Files\Adobe Systems Shared
2008-05-29 03:05 . 2008-05-29 03:05 268 --ah----- C:\sqmdata01.sqm
2008-05-29 03:05 . 2008-05-29 03:05 244 --ah----- C:\sqmnoopt01.sqm
2008-05-28 05:44 . 2008-03-08 03:37 4,247,552 --a------ C:\Windows\System32\GameUXLegacyGDFs.dll
2008-05-28 05:44 . 2008-03-08 07:30 1,686,528 --a------ C:\Windows\System32\gameux.dll
2008-05-23 14:00 . 2008-05-23 14:00 268 --ah----- C:\sqmdata00.sqm
2008-05-23 14:00 . 2008-05-23 14:00 244 --ah----- C:\sqmnoopt00.sqm
2008-05-21 19:33 . 2008-06-15 00:32 49 --a------ C:\Windows\NeroDigital.ini
2008-05-17 17:07 . 2008-06-13 12:24 <KANSIO> d-------- C:\games
2008-05-16 23:38 . 2008-05-16 23:38 <KANSIO> d-------- C:\Program Files\CCleaner
2008-05-15 16:39 . 2008-05-15 16:39 <KANSIO> d-------- C:\perflogs

.
(((((((((((((((((((((((((((((((((((( Find3M-raportti ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-06-14 12:36 --------- d-----w C:\Users\Henkka\AppData\Roaming\OpenOffice.org2
2008-06-14 12:01 --------- d-----w C:\Users\Henkka\AppData\Roaming\AVG7
2008-06-14 06:23 --------- d-----w C:\Users\Harri\AppData\Roaming\OpenOffice.org2
2008-06-14 06:03 --------- d-----w C:\Users\Tiina\AppData\Roaming\OpenOffice.org2
2008-06-14 06:03 --------- d-----w C:\Users\Tiina\AppData\Roaming\AVG7
2008-06-13 09:23 --------- d-----w C:\Program Files\Steam
2008-06-13 05:00 --------- d-----w C:\Users\Harri\AppData\Roaming\AVG7
2008-06-12 10:41 --------- d-----w C:\Users\Henkka\AppData\Roaming\dvdcss
2008-06-12 10:16 --------- d-----w C:\Users\Henkka\AppData\Roaming\uTorrent
2008-06-11 17:18 --------- d-----w C:\Users\Henkka\AppData\Roaming\mIRC
2008-06-11 17:11 --------- d-----w C:\Program Files\Common Files\Steam
2008-06-11 17:08 --------- d-----w C:\ProgramData\NVIDIA
2008-06-11 15:54 --------- d-----w C:\Program Files\Windows Mail
2008-06-11 05:00 --------- d-----w C:\Users\Lotta\AppData\Roaming\AVG7
2008-06-09 09:39 --------- d-----w C:\Users\Lotta\AppData\Roaming\OpenOffice.org2
2008-06-01 16:10 --------- d-----w C:\Program Files\mIRC
2008-05-29 14:18 --------- d-----w C:\Program Files\DC++
2008-05-29 13:09 --------- d-----w C:\Program Files\LimeWire
2008-05-29 10:11 --------- d-----w C:\Program Files\Common Files\Adobe
2008-05-26 18:11 --------- d-----w C:\Program Files\Pokerihuone
2008-05-22 14:25 --------- d-----w C:\Users\Lotta\AppData\Roaming\LimeWire
2008-05-16 20:48 --------- d-----w C:\Program Files\EA Sports
2008-05-16 20:46 --------- d-----w C:\Program Files\EA Games
2008-05-16 20:43 --------- d--h--w C:\Program Files\InstallShield Installation Information
2008-05-10 18:55 --------- d-----w C:\Users\Henkka\AppData\Roaming\LimeWire
2008-04-30 14:27 442,368 ----a-w C:\Windows\System32\nvuninst.exe
2008-04-27 14:15 --------- d-----w C:\Program Files\Canon
2008-04-27 13:12 --------- d-----w C:\Users\Henkka\AppData\Roaming\Ubisoft
2008-04-27 13:09 --------- d-----w C:\ProgramData\Ubisoft
2008-04-26 08:42 --------- d-----w C:\Program Files\Ubisoft
2008-04-25 17:53 --------- d-----w C:\Program Files\Audiosurf
2008-04-25 04:23 826,368 ----a-w C:\Windows\System32\wininet.dll
2008-04-25 04:23 56,320 ----a-w C:\Windows\System32\iesetup.dll
2008-04-25 04:23 52,736 ----a-w C:\Windows\AppPatch\iebrshim.dll
2008-04-25 04:22 26,624 ----a-w C:\Windows\System32\ieUnatt.exe
2008-04-24 15:07 73,216 ----a-w C:\Windows\ST6UNST.EXE
2008-04-24 15:07 249,856 ------w C:\Windows\Setup1.exe
2008-04-23 13:25 --------- d-----w C:\Users\Henkka\AppData\Roaming\FileZilla
2008-04-19 12:37 --------- d-----w C:\Program Files\Elävät Kirjat
2008-04-19 12:37 --------- d-----w C:\Program Files\EK
2008-04-19 12:08 --------- d-----w C:\Program Files\Diablo II
2008-04-19 12:04 43,520 ----a-w C:\Windows\System32\CmdLineExt03.dll
2008-04-15 16:43 --------- d-----w C:\Program Files\iTunes
2008-04-15 16:43 --------- d-----w C:\Program Files\iPod
2008-04-15 16:42 --------- d-----w C:\Program Files\QuickTime
2007-12-24 22:04 22,328 ----a-w C:\Users\Henkka\AppData\Roaming\PnkBstrK.sys
2007-12-14 17:39 174 --sha-w C:\Program Files\desktop.ini
.

((((((((((((((((((((((((((((( snapshot@2008-06-13_11.49.03,81 )))))))))))))))))))))))))))))))))))))))))
.
- 2006-11-02 12:34:21 136,192 ----a-w C:\Windows\assembly\GAC_32\mcupdate\6.0.6000.0__31bf3856ad364e35\mcupdate.exe
+ 2008-04-23 04:28:09 136,704 ----a-w C:\Windows\assembly\GAC_32\mcupdate\6.0.6000.0__31bf3856ad364e35\mcupdate.exe
- 2008-01-10 05:51:27 864,256 ----a-w C:\Windows\assembly\GAC_MSIL\ehepg\6.0.6000.0__31bf3856ad364e35\ehepg.dll
+ 2008-04-23 04:27:53 864,256 ----a-w C:\Windows\assembly\GAC_MSIL\ehepg\6.0.6000.0__31bf3856ad364e35\ehepg.dll
- 2008-01-10 05:51:29 135,168 ----a-w C:\Windows\assembly\GAC_MSIL\ehexthost\6.0.6000.0__31bf3856ad364e35\ehexthost.exe
+ 2008-04-23 04:27:55 135,168 ----a-w C:\Windows\assembly\GAC_MSIL\ehexthost\6.0.6000.0__31bf3856ad364e35\ehexthost.exe
- 2008-01-10 05:51:30 77,824 ----a-w C:\Windows\assembly\GAC_MSIL\ehiExtens\6.0.6000.0__31bf3856ad364e35\ehiExtens.dll
+ 2008-04-23 04:27:56 77,824 ----a-w C:\Windows\assembly\GAC_MSIL\ehiExtens\6.0.6000.0__31bf3856ad364e35\ehiExtens.dll
- 2008-01-10 05:51:34 4,370,432 ----a-w C:\Windows\assembly\GAC_MSIL\ehshell\6.0.6000.0__31bf3856ad364e35\ehshell.dll
+ 2008-04-23 04:27:59 4,374,528 ----a-w C:\Windows\assembly\GAC_MSIL\ehshell\6.0.6000.0__31bf3856ad364e35\ehshell.dll
- 2008-01-10 05:51:50 1,196,032 ----a-w C:\Windows\assembly\GAC_MSIL\Microsoft.MediaCenter.Shell\6.0.6000.0__31bf3856ad364e35\Microsoft.MediaCenter.Shell.dll
+ 2008-04-23 04:28:14 1,196,032 ----a-w C:\Windows\assembly\GAC_MSIL\Microsoft.MediaCenter.Shell\6.0.6000.0__31bf3856ad364e35\Microsoft.MediaCenter.Shell.dll
- 2008-01-10 05:51:51 2,342,912 ----a-w C:\Windows\assembly\GAC_MSIL\Microsoft.MediaCenter.UI\6.0.6000.0__31bf3856ad364e35\Microsoft.MediaCenter.UI.dll
+ 2008-04-23 04:28:14 2,342,912 ----a-w C:\Windows\assembly\GAC_MSIL\Microsoft.MediaCenter.UI\6.0.6000.0__31bf3856ad364e35\Microsoft.MediaCenter.UI.dll
- 2008-01-10 05:51:50 217,088 ----a-w C:\Windows\assembly\GAC_MSIL\Microsoft.MediaCenter\6.0.6000.0__31bf3856ad364e35\Microsoft.MediaCenter.dll
+ 2008-04-23 04:28:13 217,088 ----a-w C:\Windows\assembly\GAC_MSIL\Microsoft.MediaCenter\6.0.6000.0__31bf3856ad364e35\Microsoft.MediaCenter.dll
+ 2008-06-14 13:35:03 2,469,888 ----a-w C:\Windows\assembly\NativeImages_v2.0.50727_32\ehepg\3e10833eb7f83e11eec3a970f528ac8d\ehepg.ni.dll
+ 2008-06-14 13:35:12 274,432 ----a-w C:\Windows\assembly\NativeImages_v2.0.50727_32\ehExtHost\c11ea9504a5e5464b1850f98d3d381f1\ehExtHost.ni.exe
+ 2008-06-14 13:35:11 6,115,328 ----a-w C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.MediaCent#\6871abee28a9ed5eb7a878013664eb52\Microsoft.MediaCenter.UI.ni.dll
- 2008-06-12 16:37:09 67,584 --s-a-w C:\Windows\bootstat.dat
+ 2008-06-14 21:33:48 67,584 --s-a-w C:\Windows\bootstat.dat
- 2008-01-10 05:50:47 21,504 ----a-w C:\Windows\ehome\ehdebug.dll
+ 2008-04-23 04:27:00 21,504 ----a-w C:\Windows\ehome\ehdebug.dll
- 2008-01-10 05:51:27 864,256 ----a-w C:\Windows\ehome\ehepg.dll
+ 2008-04-23 04:27:53 864,256 ----a-w C:\Windows\ehome\ehepg.dll
- 2008-01-10 05:51:29 135,168 ----a-w C:\Windows\ehome\ehexthost.exe
+ 2008-04-23 04:27:55 135,168 ----a-w C:\Windows\ehome\ehexthost.exe
- 2006-11-02 12:34:20 372,224 ----a-w C:\Windows\ehome\ehglid.dll
+ 2008-04-23 04:27:00 372,224 ----a-w C:\Windows\ehome\ehglid.dll
- 2008-01-10 05:51:30 77,824 ----a-w C:\Windows\ehome\ehiExtens.dll
+ 2008-04-23 04:27:56 77,824 ----a-w C:\Windows\ehome\ehiExtens.dll
- 2008-01-10 05:50:47 103,936 ----a-w C:\Windows\ehome\ehPresenter.dll
+ 2008-04-23 04:27:00 105,472 ----a-w C:\Windows\ehome\ehPresenter.dll
- 2008-01-10 05:50:47 252,416 ----a-w C:\Windows\ehome\ehReplay.dll
+ 2008-04-23 04:27:00 252,416 ----a-w C:\Windows\ehome\ehReplay.dll
- 2008-01-10 05:46:17 10,094,080 ----a-w C:\Windows\ehome\ehres.dll
+ 2008-04-23 04:22:35 10,094,080 ----a-w C:\Windows\ehome\ehres.dll
- 2008-01-10 05:51:34 4,370,432 ----a-w C:\Windows\ehome\ehshell.dll
+ 2008-04-23 04:27:59 4,374,528 ----a-w C:\Windows\ehome\ehshell.dll
- 2008-01-10 05:50:47 18,944 ----a-w C:\Windows\ehome\ehtrace.dll
+ 2008-04-23 04:27:00 18,944 ----a-w C:\Windows\ehome\ehtrace.dll
- 2008-01-10 05:50:47 517,120 ----a-w C:\Windows\ehome\ehui.dll
+ 2008-04-23 04:27:00 517,632 ----a-w C:\Windows\ehome\ehui.dll
- 2008-01-10 05:50:47 1,497,600 ----a-w C:\Windows\ehome\ehuihlp.dll
+ 2008-04-23 04:27:00 1,497,600 ----a-w C:\Windows\ehome\ehuihlp.dll
- 2008-01-10 05:50:48 6,656 ----a-w C:\Windows\ehome\McrMgr.dll
+ 2008-04-23 04:27:01 6,656 ----a-w C:\Windows\ehome\McrMgr.dll
- 2008-01-10 05:50:25 173,056 ----a-w C:\Windows\ehome\McrMgr.exe
+ 2008-04-23 04:26:31 173,056 ----a-w C:\Windows\ehome\McrMgr.exe
- 2006-11-02 12:34:21 136,192 ----a-w C:\Windows\ehome\mcupdate.exe
+ 2008-04-23 04:28:09 136,704 ----a-w C:\Windows\ehome\mcupdate.exe
- 2008-01-10 05:51:50 217,088 ----a-w C:\Windows\ehome\Microsoft.MediaCenter.dll
+ 2008-04-23 04:28:13 217,088 ----a-w C:\Windows\ehome\Microsoft.MediaCenter.dll
- 2008-01-10 05:51:50 1,196,032 ----a-w C:\Windows\ehome\Microsoft.MediaCenter.Shell.dll
+ 2008-04-23 04:28:14 1,196,032 ----a-w C:\Windows\ehome\Microsoft.MediaCenter.Shell.dll
- 2008-01-10 05:51:51 2,342,912 ----a-w C:\Windows\ehome\Microsoft.MediaCenter.UI.dll
+ 2008-04-23 04:28:14 2,342,912 ----a-w C:\Windows\ehome\Microsoft.MediaCenter.UI.dll
- 2008-06-12 16:37:10 2,048 --sha-w C:\Windows\ServiceProfiles\LocalService\AppData\Local\lastalive0.dat
+ 2008-06-14 21:33:49 2,048 --sha-w C:\Windows\ServiceProfiles\LocalService\AppData\Local\lastalive0.dat
- 2008-06-12 16:37:10 2,048 --sha-w C:\Windows\ServiceProfiles\LocalService\AppData\Local\lastalive1.dat
+ 2008-06-14 21:33:49 2,048 --sha-w C:\Windows\ServiceProfiles\LocalService\AppData\Local\lastalive1.dat
- 2008-06-12 16:39:30 262,144 --sha-w C:\Windows\ServiceProfiles\LocalService\NTUSER.DAT
+ 2008-06-14 21:35:43 262,144 --sha-w C:\Windows\ServiceProfiles\LocalService\NTUSER.DAT
+ 2008-06-14 21:35:43 262,144 ---ha-w C:\Windows\ServiceProfiles\LocalService\ntuser.dat.LOG1
- 2008-06-13 08:32:18 16,384 --sha-w C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat
+ 2008-06-14 12:21:23 16,384 --sha-w C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat
- 2008-06-13 08:32:18 32,768 --sha-w C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat
+ 2008-06-14 12:21:23 32,768 --sha-w C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat
- 2008-06-13 07:10:15 16,384 --sha-w C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\Cookies\index.dat
+ 2008-06-14 12:22:49 16,384 --sha-w C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\Cookies\index.dat
- 2008-06-13 07:10:15 16,384 --sha-w C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\History\History.IE5\index.dat
+ 2008-06-14 12:22:49 16,384 --sha-w C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\History\History.IE5\index.dat
- 2008-06-13 07:10:15 32,768 --sha-w C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\Temporary Internet Files\Content.IE5\index.dat
+ 2008-06-14 12:22:49 32,768 --sha-w C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\Temporary Internet Files\Content.IE5\index.dat
- 2008-06-13 08:32:18 16,384 --sha-w C:\Windows\ServiceProfiles\NetworkService\AppData\Roaming\Microsoft\Windows\Cookies\index.dat
+ 2008-06-14 12:21:23 16,384 --sha-w C:\Windows\ServiceProfiles\NetworkService\AppData\Roaming\Microsoft\Windows\Cookies\index.dat
- 2008-06-12 16:50:29 262,144 --sha-w C:\Windows\ServiceProfiles\NetworkService\NTUSER.DAT
+ 2008-06-14 21:35:38 262,144 --sha-w C:\Windows\ServiceProfiles\NetworkService\NTUSER.DAT
+ 2008-06-14 21:35:38 262,144 ---ha-w C:\Windows\ServiceProfiles\NetworkService\ntuser.dat.LOG1
- 2008-06-12 16:37:10 16,384 --sha-w C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat
+ 2008-06-14 12:42:59 16,384 --sha-w C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat
- 2008-06-12 16:37:10 32,768 --sha-w C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat
+ 2008-06-14 12:42:59 32,768 --sha-w C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat
- 2008-06-12 16:37:10 16,384 --sha-w C:\Windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\index.dat
+ 2008-06-14 12:42:59 16,384 --sha-w C:\Windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\index.dat
- 2008-06-12 16:42:33 107,416 ----a-w C:\Windows\System32\perfc009.dat
+ 2008-06-14 06:06:00 107,416 ----a-w C:\Windows\System32\perfc009.dat
- 2008-06-12 16:42:33 88,416 ----a-w C:\Windows\System32\perfc00B.dat
+ 2008-06-14 06:06:00 88,416 ----a-w C:\Windows\System32\perfc00B.dat
- 2008-06-12 16:42:33 618,272 ----a-w C:\Windows\System32\perfh009.dat
+ 2008-06-14 06:06:00 618,272 ----a-w C:\Windows\System32\perfh009.dat
- 2008-06-12 16:42:33 467,808 ----a-w C:\Windows\System32\perfh00B.dat
+ 2008-06-14 06:06:00 467,808 ----a-w C:\Windows\System32\perfh00B.dat
- 2008-06-11 15:57:21 6,291,456 ----a-w C:\Windows\System32\SMI\Store\Machine\SCHEMA.DAT
+ 2008-06-14 13:14:33 6,291,456 ----a-w C:\Windows\System32\SMI\Store\Machine\SCHEMA.DAT
- 2008-06-12 10:30:46 7,068 ----a-w C:\Windows\System32\WDI\{86432a0b-3c7d-4ddf-a89c-172faa90485d}\S-1-5-21-2288889983-3666411893-3590199007-1000_UserData.bin
+ 2008-06-14 21:36:36 7,328 ----a-w C:\Windows\System32\WDI\{86432a0b-3c7d-4ddf-a89c-172faa90485d}\S-1-5-21-2288889983-3666411893-3590199007-1000_UserData.bin
- 2008-06-12 16:40:22 62,848 ----a-w C:\Windows\System32\WDI\BootPerformanceDiagnostics_SystemData.bin
+ 2008-06-14 21:36:36 63,256 ----a-w C:\Windows\System32\WDI\BootPerformanceDiagnostics_SystemData.bin
- 2008-06-12 16:40:20 31,770 ----a-w C:\Windows\System32\WDI\ShutdownPerformanceDiagnostics_SystemData.bin
+ 2008-06-14 13:17:16 31,870 ----a-w C:\Windows\System32\WDI\ShutdownPerformanceDiagnostics_SystemData.bin
- 2008-06-06 12:17:04 312,954 ----a-w C:\Windows\System32\WDI\SuspendPerformanceDiagnostics_SystemData_S3.bin
+ 2008-06-14 06:02:50 315,152 ----a-w C:\Windows\System32\WDI\SuspendPerformanceDiagnostics_SystemData_S3.bin
- 2008-06-11 15:46:52 29,296,453 ----a-w C:\Windows\winsxs\ManifestCache\6.0.6001.18000_001c50b5_blobs.bin
+ 2008-06-14 12:04:30 30,411,305 ----a-w C:\Windows\winsxs\ManifestCache\6.0.6001.18000_001c50b5_blobs.bin
+ 2008-04-23 04:27:53 864,256 ----a-w C:\Windows\winsxs\msil_ehepg_31bf3856ad364e35_6.0.6000.16679_none_d97a4d2ed1f284d2\ehepg.dll
+ 2008-04-23 14:12:49 864,256 ----a-w C:\Windows\winsxs\msil_ehepg_31bf3856ad364e35_6.0.6000.20821_none_da31f92beaeecb56\ehepg.dll
+ 2008-04-23 04:27:55 135,168 ----a-w C:\Windows\winsxs\msil_ehexthost_31bf3856ad364e35_6.0.6000.16679_none_bcbfc9e4c1e1e81d\ehexthost.exe
+ 2008-04-23 14:12:50 135,168 ----a-w C:\Windows\winsxs\msil_ehexthost_31bf3856ad364e35_6.0.6000.20821_none_bd7775e1dade2ea1\ehexthost.exe
+ 2008-04-23 04:27:56 77,824 ----a-w C:\Windows\winsxs\msil_ehiextens_31bf3856ad364e35_6.0.6000.16679_none_fba2d0c909e74612\ehiExtens.dll
+ 2008-04-23 14:12:51 77,824 ----a-w C:\Windows\winsxs\msil_ehiextens_31bf3856ad364e35_6.0.6000.20821_none_fc5a7cc622e38c96\ehiExtens.dll
+ 2008-04-23 04:27:59 4,374,528 ----a-w C:\Windows\winsxs\msil_ehshell_31bf3856ad364e35_6.0.6000.16679_none_896d686f44a61324\ehshell.dll
+ 2008-04-23 14:12:55 4,382,720 ----a-w C:\Windows\winsxs\msil_ehshell_31bf3856ad364e35_6.0.6000.20821_none_8a25146c5da259a8\ehshell.dll
+ 2008-04-23 04:44:14 4,046,848 ----a-w C:\Windows\winsxs\msil_ehshell_31bf3856ad364e35_6.0.6001.18061_none_8b5674b141cbbd6c\ehshell.dll
+ 2008-04-23 04:36:58 4,046,848 ----a-w C:\Windows\winsxs\msil_ehshell_31bf3856ad364e35_6.0.6001.22165_none_8be412a45ae5c292\ehshell.dll
+ 2008-04-23 04:28:14 1,196,032 ----a-w C:\Windows\winsxs\msil_microsoft.mediacenter.shell_31bf3856ad364e35_6.0.6000.16679_none_4e6b0c2698ea89ba\Microsoft.MediaCenter.Shell.dll
+ 2008-04-23 14:13:09 1,269,760 ----a-w C:\Windows\winsxs\msil_microsoft.mediacenter.shell_31bf3856ad364e35_6.0.6000.20821_none_4f22b823b1e6d03e\Microsoft.MediaCenter.Shell.dll
+ 2008-04-23 04:28:14 2,342,912 ----a-w C:\Windows\winsxs\msil_microsoft.mediacenter.ui_31bf3856ad364e35_6.0.6000.16679_none_30f95ad65a3e86d4\Microsoft.MediaCenter.UI.dll
+ 2008-04-23 14:13:09 2,351,104 ----a-w C:\Windows\winsxs\msil_microsoft.mediacenter.ui_31bf3856ad364e35_6.0.6000.20821_none_31b106d3733acd58\Microsoft.MediaCenter.UI.dll
+ 2008-04-23 04:45:00 1,957,888 ----a-w C:\Windows\winsxs\msil_microsoft.mediacenter.ui_31bf3856ad364e35_6.0.6001.18061_none_32e267185764311c\Microsoft.MediaCenter.UI.dll
+ 2008-04-23 04:37:38 1,957,888 ----a-w C:\Windows\winsxs\msil_microsoft.mediacenter.ui_31bf3856ad364e35_6.0.6001.22165_none_3370050b707e3642\Microsoft.MediaCenter.UI.dll
+ 2008-04-23 04:28:13 217,088 ----a-w C:\Windows\winsxs\msil_microsoft.mediacenter_31bf3856ad364e35_6.0.6000.16679_none_2354b3c9cf56f2ea\Microsoft.MediaCenter.dll
+ 2008-04-23 14:13:08 217,088 ----a-w C:\Windows\winsxs\msil_microsoft.mediacenter_31bf3856ad364e35_6.0.6000.20821_none_240c5fc6e853396e\Microsoft.MediaCenter.dll
+ 2008-04-23 04:28:09 136,704 ----a-w C:\Windows\winsxs\x86_mcupdate_31bf3856ad364e35_6.0.6000.16679_none_c673e63faed8754d\mcupdate.exe
+ 2008-04-23 14:13:03 136,704 ----a-w C:\Windows\winsxs\x86_mcupdate_31bf3856ad364e35_6.0.6000.20821_none_c72b923cc7d4bbd1\mcupdate.exe
+ 2008-04-23 04:44:47 140,288 ----a-w C:\Windows\winsxs\x86_mcupdate_31bf3856ad364e35_6.0.6001.18061_none_c85cf281abfe1f95\mcupdate.exe
+ 2008-04-23 04:37:28 140,288 ----a-w C:\Windows\winsxs\x86_mcupdate_31bf3856ad364e35_6.0.6001.22165_none_c8ea9074c51824bb\mcupdate.exe
+ 2008-04-23 04:27:00 252,416 ----a-w C:\Windows\winsxs\x86_microsoft-windows-ehome-devices-ehreplay_31bf3856ad364e35_6.0.6000.16679_none_128e8c93a2bce482\ehReplay.dll
+ 2008-04-23 05:11:36 254,464 ----a-w C:\Windows\winsxs\x86_microsoft-windows-ehome-devices-ehreplay_31bf3856ad364e35_6.0.6000.20821_none_13463890bbb92b06\ehReplay.dll
+ 2008-04-23 04:42:33 254,464 ----a-w C:\Windows\winsxs\x86_microsoft-windows-ehome-devices-ehreplay_31bf3856ad364e35_6.0.6001.18061_none_147798d59fe28eca\ehReplay.dll
+ 2008-04-23 04:30:25 254,464 ----a-w C:\Windows\winsxs\x86_microsoft-windows-ehome-devices-ehreplay_31bf3856ad364e35_6.0.6001.22165_none_150536c8b8fc93f0\ehReplay.dll
+ 2008-04-23 04:27:01 6,656 ----a-w C:\Windows\winsxs\x86_microsoft-windows-ehome-devices-mcrmgr_31bf3856ad364e35_6.0.6000.16679_none_3200fce9dd0448e0\McrMgr.dll
+ 2008-04-23 04:26:31 173,056 ----a-w C:\Windows\winsxs\x86_microsoft-windows-ehome-devices-mcrmgr_31bf3856ad364e35_6.0.6000.16679_none_3200fce9dd0448e0\McrMgr.exe
+ 2008-04-23 05:11:51 6,656 ----a-w C:\Windows\winsxs\x86_microsoft-windows-ehome-devices-mcrmgr_31bf3856ad364e35_6.0.6000.20821_none_32b8a8e6f6008f64\McrMgr.dll
+ 2008-04-23 03:56:48 172,544 ----a-w C:\Windows\winsxs\x86_microsoft-windows-ehome-devices-mcrmgr_31bf3856ad364e35_6.0.6000.20821_none_32b8a8e6f6008f64\McrMgr.exe
+ 2008-04-23 04:27:00 21,504 ----a-w C:\Windows\winsxs\x86_microsoft-windows-ehome-ehdebug_31bf3856ad364e35_6.0.6000.16679_none_2db4cba1854c2050\ehdebug.dll
+ 2008-04-23 05:11:35 21,504 ----a-w C:\Windows\winsxs\x86_microsoft-windows-ehome-ehdebug_31bf3856ad364e35_6.0.6000.20821_none_2e6c779e9e4866d4\ehdebug.dll
+ 2008-04-23 04:27:00 372,224 ----a-w C:\Windows\winsxs\x86_microsoft-windows-ehome-ehglid_31bf3856ad364e35_6.0.6000.16679_none_2d12eef96d2c252b\ehglid.dll
+ 2008-04-23 05:11:35 372,736 ----a-w C:\Windows\winsxs\x86_microsoft-windows-ehome-ehglid_31bf3856ad364e35_6.0.6000.20821_none_2dca9af686286baf\ehglid.dll
+ 2008-04-23 04:42:33 373,248 ----a-w C:\Windows\winsxs\x86_microsoft-windows-ehome-ehglid_31bf3856ad364e35_6.0.6001.18061_none_2efbfb3b6a51cf73\ehglid.dll
+ 2008-04-23 04:30:24 373,248 ----a-w C:\Windows\winsxs\x86_microsoft-windows-ehome-ehglid_31bf3856ad364e35_6.0.6001.22165_none_2f89992e836bd499\ehglid.dll
+ 2008-04-23 04:27:00 105,472 ----a-w C:\Windows\winsxs\x86_microsoft-windows-ehome-ehpresenter_31bf3856ad364e35_6.0.6000.16679_none_249fac1865043b1f\ehPresenter.dll
+ 2008-04-23 05:11:36 105,472 ----a-w C:\Windows\winsxs\x86_microsoft-windows-ehome-ehpresenter_31bf3856ad364e35_6.0.6000.20821_none_255758157e0081a3\ehPresenter.dll
+ 2008-04-23 04:42:33 105,472 ----a-w C:\Windows\winsxs\x86_microsoft-windows-ehome-ehpresenter_31bf3856ad364e35_6.0.6001.18061_none_2688b85a6229e567\ehPresenter.dll
+ 2008-04-23 04:30:25 105,472 ----a-w C:\Windows\winsxs\x86_microsoft-windows-ehome-ehpresenter_31bf3856ad364e35_6.0.6001.22165_none_2716564d7b43ea8d\ehPresenter.dll
+ 2008-04-23 04:22:35 10,094,080 ----a-w C:\Windows\winsxs\x86_microsoft-windows-ehome-ehres_31bf3856ad364e35_6.0.6000.16679_none_4fe31875538242d1\ehres.dll
+ 2008-04-23 05:11:36 10,103,808 ----a-w C:\Windows\winsxs\x86_microsoft-windows-ehome-ehres_31bf3856ad364e35_6.0.6000.20821_none_509ac4726c7e8955\ehres.dll
+ 2008-04-23 04:27:00 18,944 ----a-w C:\Windows\winsxs\x86_microsoft-windows-ehome-ehtrace_31bf3856ad364e35_6.0.6000.16679_none_3693dda116ea05e6\ehtrace.dll
+ 2008-04-23 05:11:36 18,944 ----a-w C:\Windows\winsxs\x86_microsoft-windows-ehome-ehtrace_31bf3856ad364e35_6.0.6000.20821_none_374b899e2fe64c6a\ehtrace.dll
+ 2008-04-23 04:27:00 517,632 ----a-w C:\Windows\winsxs\x86_microsoft-windows-ehome-ehui_31bf3856ad364e35_6.0.6000.16679_none_cc9b30cbcc71d8eb\ehui.dll
+ 2008-04-23 05:11:36 521,216 ----a-w C:\Windows\winsxs\x86_microsoft-windows-ehome-ehui_31bf3856ad364e35_6.0.6000.20821_none_cd52dcc8e56e1f6f\ehui.dll
+ 2008-04-23 04:42:33 522,240 ----a-w C:\Windows\winsxs\x86_microsoft-windows-ehome-ehui_31bf3856ad364e35_6.0.6001.18061_none_ce843d0dc9978333\ehui.dll
+ 2008-04-23 04:30:33 522,240 ----a-w C:\Windows\winsxs\x86_microsoft-windows-ehome-ehui_31bf3856ad364e35_6.0.6001.22165_none_cf11db00e2b18859\ehui.dll
+ 2008-04-23 04:27:00 1,497,600 ----a-w C:\Windows\winsxs\x86_microsoft-windows-ehome-ehuihlp_31bf3856ad364e35_6.0.6000.16679_none_39e223022e478d8d\ehuihlp.dll
+ 2008-04-23 05:11:36 1,498,112 ----a-w C:\Windows\winsxs\x86_microsoft-windows-ehome-ehuihlp_31bf3856ad364e35_6.0.6000.20821_none_3a99ceff4743d411\ehuihlp.dll
+ 2008-04-23 04:27:01 1,244,672 ----a-w C:\Windows\winsxs\x86_microsoft-windows-m..mediadeliveryengine_31bf3856ad364e35_6.0.6000.16679_none_3d017dbd628e4075\mcmde.dll
+ 2008-04-23 05:11:51 1,244,672 ----a-w C:\Windows\winsxs\x86_microsoft-windows-m..mediadeliveryengine_31bf3856ad364e35_6.0.6000.20821_none_3db929ba7b8a86f9\mcmde.dll
+ 2008-04-23 04:27:00 428,032 ----a-w C:\Windows\winsxs\x86_microsoft-windows-tvencdec_31bf3856ad364e35_6.0.6000.16679_none_de4f2af09170b787\EncDec.dll
+ 2008-04-23 05:11:36 428,032 ----a-w C:\Windows\winsxs\x86_microsoft-windows-tvencdec_31bf3856ad364e35_6.0.6000.20821_none_df06d6edaa6cfe0b\EncDec.dll
+ 2008-04-23 04:42:37 428,544 ----a-w C:\Windows\winsxs\x86_microsoft-windows-tvencdec_31bf3856ad364e35_6.0.6001.18061_none_e03837328e9661cf\EncDec.dll
+ 2008-04-23 04:34:41 428,544 ----a-w C:\Windows\winsxs\x86_microsoft-windows-tvencdec_31bf3856ad364e35_6.0.6001.22165_none_e0c5d525a7b066f5\EncDec.dll
+ 2008-04-23 04:27:04 292,352 ----a-w C:\Windows\winsxs\x86_microsoft-windows-v..e-filters-tvdigital_31bf3856ad364e35_6.0.6000.16679_none_d9d44caa5a19bb32\psisdecd.dll
+ 2008-04-23 05:12:30 292,352 ----a-w C:\Windows\winsxs\x86_microsoft-windows-v..e-filters-tvdigital_31bf3856ad364e35_6.0.6000.20821_none_da8bf8a7731601b6\psisdecd.dll
+ 2008-04-23 04:42:37 293,376 ----a-w C:\Windows\winsxs\x86_microsoft-windows-v..e-filters-tvdigital_31bf3856ad364e35_6.0.6001.18061_none_dbbd58ec573f657a\psisdecd.dll
+ 2008-04-23 04:34:47 293,376 ----a-w C:\Windows\winsxs\x86_microsoft-windows-v..e-filters-tvdigital_31bf3856ad364e35_6.0.6001.22165_none_dc4af6df70596aa0\psisdecd.dll
.
-- Snapshot reset to current date --
.
(((((((((((((((((((((((((((((( Rekisterin käynnistyskohteet )))))))))))))))))))))))))))))))))))))))))))))
.
.
REGEDIT4
*Huom* Tyhjiä arvoja ja laillisia oletusarvoja ei näytetä

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ehTray.exe"="C:\Windows\ehome\ehTray.exe" [2006-11-02 15:34 125440]
"WMPNSCFG"="C:\Program Files\Windows Media Player\WMPNSCFG.exe" [2006-11-02 15:33 201728]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"AVG7_CC"="C:\PROGRA~1\Grisoft\AVG7\avgcc.exe" [2008-04-15 17:41 579584]
"RtHDVCpl"="RtHDVCpl.exe" [2007-03-23 14:04 4423680 C:\Windows\RtHDVCpl.exe]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe" [2008-02-22 05:25 144784]
"NvCplDaemon"="C:\Windows\system32\NvCpl.dll" [2008-05-02 22:46 13535776]
"NvMediaCenter"="C:\Windows\system32\NvMcTray.dll" [2008-05-02 22:46 92704]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"AVG7_Run"="C:\PROGRA~1\Grisoft\AVG7\avgw.exe" [2007-12-14 20:44 219136]

C:\Users\Henkka\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
Adobe Gamma.lnk - C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [2005-03-16 19:16:50 113664]
PowerStrip.lnk - C:\Program Files\PowerStrip\PStrip.exe [2008-06-02 19:50:00 732408]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\system]
"LogonHoursAction"= 2 (0x2)
"DontDisplayLogonHoursWarnings"= 1 (0x1)

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\avgwlntf]
avgwlntf.dll 2007-12-14 20:44 9216 C:\Windows\System32\avgwlntf.dll

[HKLM\~\startupfolder\C:^Users^Henkka^AppData^Roaming^Microsoft^Windows^Start Menu^Programs^Startup^Last.fm Helper.lnk]
path=C:\Users\Henkka\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Last.fm Helper.lnk
backup=C:\Windows\pss\Last.fm Helper.lnk.Startup
backupExtension=.Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher]
--a------ 2008-01-11 22:16 39792 C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DAEMON Tools Lite]
--a------ 2008-01-17 19:51 486856 C:\Program Files\DAEMON Tools Lite\daemon.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\InCD]
--a------ 2007-05-15 16:55 1057328 C:\Program Files\Nero\Nero 7\InCD\InCD.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper]
--a------ 2008-03-30 10:36 267048 C:\Program Files\iTunes\iTunesHelper.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck]
--a------ 2007-03-01 16:57 153136 C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
--a------ 2008-03-28 23:37 413696 C:\Program Files\QuickTime\QTTask.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SecurDisc]
--a------ 2007-05-15 16:55 1628208 C:\Program Files\Nero\Nero 7\InCD\NBHGui.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\tvjbmonitor]
--a------ 2006-12-26 18:08 53248 C:\Program Files\MMEDIA\TV Jukebox 3.0\tvjbMonitor.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WinampAgent]
C:\Program Files\Winamp\winampa.exe

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Svc\S-1-5-21-2288889983-3666411893-3590199007-1000]
"EnableNotificationsRef"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\FirewallRules]
"{97EC9346-283B-4D38-B976-D1E47A4A3E83}"= C:\Program Files\Windows Live\Messenger\livecall.exe:Windows Live Messenger (Phone)
"TCP Query User{7974046A-0FC0-47B1-9141-812645F426D5}C:\\program files\\mirc\\mirc.exe"= UDP:C:\program files\mirc\mirc.exe:mIRC
"UDP Query User{E3D464D6-953A-4C2E-BF1D-CDAB70DF8C4A}C:\\program files\\mirc\\mirc.exe"= TCP:C:\program files\mirc\mirc.exe:mIRC
"TCP Query User{97AA655B-5A12-4327-9DD4-386A45F44429}C:\\program files\\steam\\steamapps\\hnkk\\counter-strike\\hl.exe"= UDP:C:\program files\steam\steamapps\hnkk\counter-strike\hl.exe:Half-Life Launcher
"UDP Query User{E76FDB83-0295-49A7-8F79-AF2E09FF1B21}C:\\program files\\steam\\steamapps\\hnkk\\counter-strike\\hl.exe"= TCP:C:\program files\steam\steamapps\hnkk\counter-strike\hl.exe:Half-Life Launcher
"TCP Query User{51A5C65E-1D8A-4BA9-87C0-6F28BAD162DE}C:\\program files\\wolfenstein - enemy territory\\et.exe"= UDP:C:\program files\wolfenstein - enemy territory\et.exe:ET
"UDP Query User{70FC1D58-4C03-4DAA-9808-DB04A8E4423E}C:\\program files\\wolfenstein - enemy territory\\et.exe"= TCP:C:\program files\wolfenstein - enemy territory\et.exe:ET
"TCP Query User{2E0625A8-B2DB-4C2A-A89A-FB1AB146248D}C:\\program files\\the all-seeing eye\\eye.exe"= UDP:C:\program files\the all-seeing eye\eye.exe:Yahoo! All-Seeing Eye
"UDP Query User{51888159-E2F8-4DFE-A283-C5DBBC23E760}C:\\program files\\the all-seeing eye\\eye.exe"= TCP:C:\program files\the all-seeing eye\eye.exe:Yahoo! All-Seeing Eye
"TCP Query User{9FD05F55-891D-4DC3-A940-1A3D98C46C04}C:\\ijji\\english\\gunz\\gunz.exe"= UDP:C:\ijji\english\gunz\gunz.exe:Gunz
"UDP Query User{1F9F5747-FD56-467E-B75F-7677918F328C}C:\\ijji\\english\\gunz\\gunz.exe"= TCP:C:\ijji\english\gunz\gunz.exe:Gunz
"TCP Query User{7B1E9094-96E3-4021-8D3A-04D97A4C72C9}C:\\program files\\dc++\\dcplusplus.exe"= UDP:C:\program files\dc++\dcplusplus.exeC++
"UDP Query User{0959F4FC-45DF-4091-89AC-249EB9E56AF8}C:\\program files\\dc++\\dcplusplus.exe"= TCP:C:\program files\dc++\dcplusplus.exeC++
"{18F26EA3-480C-49EE-92A7-BF7F7A283D8E}"= UDP:C:\Program Files\Electronic Arts\Crytek\Crysis\Bin32\Crysis.exe:Crysis_32
"{9B33D492-2B61-4992-B640-FEB3E86193F3}"= TCP:C:\Program Files\Electronic Arts\Crytek\Crysis\Bin32\Crysis.exe:Crysis_32
"{25AD2C1F-E0E7-473D-9E98-4F664C593CAC}"= UDP:C:\Program Files\Electronic Arts\Crytek\Crysis\Bin32\CrysisDedicatedServer.exe:CrysisDedicatedServer_32
"{9D39EC9F-B849-4960-AE66-3F6A22302FA5}"= TCP:C:\Program Files\Electronic Arts\Crytek\Crysis\Bin32\CrysisDedicatedServer.exe:CrysisDedicatedServer_32
"{04186A89-3891-4826-8F74-C1A0719D4066}"= UDP:C:\Windows\System32\PnkBstrA.exenkBstrA
"{3C629100-A34B-4CCF-BBC9-DD7C7D95FE4E}"= TCP:C:\Windows\System32\PnkBstrA.exenkBstrA
"{D5C767FE-08D0-4AAA-A7F8-26639271F981}"= UDP:C:\Windows\System32\PnkBstrB.exenkBstrB
"{ADC1ED70-DF5A-4F90-B441-893EA963C40E}"= TCP:C:\Windows\System32\PnkBstrB.exenkBstrB
"{3BADFB8F-C1E0-4EF2-999F-7A342A7167C2}"= UDP:C:\Program Files\2K Games\Firaxis Games\Sid Meier's Civilization 4 Complete\Civilization4.exe:Sid Meier's Civilization 4 Complete
"{8E6F881B-F8EB-490E-9385-A2F298D41421}"= TCP:C:\Program Files\2K Games\Firaxis Games\Sid Meier's Civilization 4 Complete\Civilization4.exe:Sid Meier's Civilization 4 Complete
"{A6A119C3-B77C-45C9-9163-14B0AC41D37A}"= UDP:C:\Program Files\2K Games\Firaxis Games\Sid Meier's Civilization 4 Complete\Warlords\Civ4Warlords.exe:Sid Meier's Civilization 4: Warlords
"{12876641-FF77-4180-8DDC-1C59ADA453F9}"= TCP:C:\Program Files\2K Games\Firaxis Games\Sid Meier's Civilization 4 Complete\Warlords\Civ4Warlords.exe:Sid Meier's Civilization 4: Warlords
"{A0A0FD90-06F4-412E-8E0E-253B8DF63C90}"= UDP:C:\Program Files\2K Games\Firaxis Games\Sid Meier's Civilization 4 Complete\Beyond the Sword\Civ4BeyondSword.exe:Sid Meier's Civilization 4: Beyond the Sword
"{31A7B6D3-7112-4BEF-A57B-027ADE05F16A}"= TCP:C:\Program Files\2K Games\Firaxis Games\Sid Meier's Civilization 4 Complete\Beyond the Sword\Civ4BeyondSword.exe:Sid Meier's Civilization 4: Beyond the Sword
"TCP Query User{6A3762AA-2D45-4C87-B390-8A15EC973FF1}C:\\program files\\utorrent\\utorrent.exe"= UDP:C:\program files\utorrent\utorrent.exe:uTorrent
"UDP Query User{94EB9222-B30C-499D-94A3-DD8F5F9ECF6F}C:\\program files\\utorrent\\utorrent.exe"= TCP:C:\program files\utorrent\utorrent.exe:uTorrent
"TCP Query User{D9DE7F0D-A7D4-4AED-924B-B856BFD40998}C:\\program files\\steam\\steamapps\\hnkk\\ricochet\\hl.exe"= UDP:C:\program files\steam\steamapps\hnkk\ricochet\hl.exe:Half-Life Launcher
"UDP Query User{CE439899-2C82-49EE-8C79-A5B8B8301C58}C:\\program files\\steam\\steamapps\\hnkk\\ricochet\\hl.exe"= TCP:C:\program files\steam\steamapps\hnkk\ricochet\hl.exe:Half-Life Launcher
"{DCA97472-32BA-4445-99CB-A7883C6F6EB8}"= UDP:C:\Program Files\Bonjour\mDNSResponder.exe:Bonjour
"{71EF5FDB-79B6-4F40-A064-C500C768D21B}"= TCP:C:\Program Files\Bonjour\mDNSResponder.exe:Bonjour
"TCP Query User{C5E09EB2-49C5-44B9-8BE7-153A730BCFA8}C:\\program files\\steam\\steamapps\\battery55\\counter-strike\\hl.exe"= UDP:C:\program files\steam\steamapps\battery55\counter-strike\hl.exe:Half-Life Launcher
"UDP Query User{847B04DB-C439-4094-9F93-0DCAC41FFED5}C:\\program files\\steam\\steamapps\\battery55\\counter-strike\\hl.exe"= TCP:C:\program files\steam\steamapps\battery55\counter-strike\hl.exe:Half-Life Launcher
"TCP Query User{E2C875F7-0B42-4B9F-A83A-64421FC42C3D}C:\\program files\\ea games\\ultima online mondain's legacy\\client.exe"= UDP:C:\program files\ea games\ultima online mondain's legacy\client.exe:client
"UDP Query User{E93AF1A7-D3E1-4843-8CBB-C2E112BBF009}C:\\program files\\ea games\\ultima online mondain's legacy\\client.exe"= TCP:C:\program files\ea games\ultima online mondain's legacy\client.exe:client
"TCP Query User{61519A35-CE25-4BEE-AE84-213E0326F6F6}C:\\program files\\pokerihuone\\jre\\bin\\javaw.exe"= UDP:C:\program files\pokerihuone\jre\bin\javaw.exe:Java(TM) 2 Platform Standard Edition binary
"UDP Query User{05B784B9-D99C-4816-AB1F-1D4F4C4A9B20}C:\\program files\\pokerihuone\\jre\\bin\\javaw.exe"= TCP:C:\program files\pokerihuone\jre\bin\javaw.exe:Java(TM) 2 Platform Standard Edition binary
"{B7E3976F-3EF2-470F-945B-B6EC326B63E5}"= UDP:C:\Program Files\iTunes\iTunes.exe:iTunes
"{DCC0933D-58E3-4E57-9CFB-60A46EC7E597}"= TCP:C:\Program Files\iTunes\iTunes.exe:iTunes
"{AF10E89C-30EB-44C4-A07E-942FFF05F4B3}"= UDP:C:\Program Files\Ubisoft\Assassin's Creed\AssassinsCreed_Dx9.exe:Assassin's Creed Dx9
"{BA90B2AB-87B7-4686-86B0-A33F09845D14}"= TCP:C:\Program Files\Ubisoft\Assassin's Creed\AssassinsCreed_Dx9.exe:Assassin's Creed Dx9
"{34F9F1A2-5931-4B1E-A668-8835227F8D2C}"= UDP:C:\Program Files\Ubisoft\Assassin's Creed\AssassinsCreed_Dx10.exe:Assassin's Creed Dx10
"{61CD2A17-7E18-4732-B714-C7F6B403998B}"= TCP:C:\Program Files\Ubisoft\Assassin's Creed\AssassinsCreed_Dx10.exe:Assassin's Creed Dx10
"{A9701197-AEA0-411F-8B55-2445A17C1B8E}"= UDP:C:\Program Files\Ubisoft\Assassin's Creed\AssassinsCreed_Launcher.exe:Assassin's Creed Update
"{68B7DB46-B944-445E-8510-2FEECCC537FE}"= TCP:C:\Program Files\Ubisoft\Assassin's Creed\AssassinsCreed_Launcher.exe:Assassin's Creed Update
"{53224DE0-1F0A-4781-974E-C64144A1FF73}"= UDP:C:\Program Files\FrostWire\FrostWire.exe:LimeWire
"{70CE8CDB-7716-478C-9CCB-65A18C0384F4}"= TCP:C:\Program Files\FrostWire\FrostWire.exe:LimeWire

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\RestrictedServices\Static\System]
"DFSR-1"= RPort=5722|UDP:%SystemRoot%\system32\svchost.exe|Svc=DFSR:Allow inbound TCP traffic|

R0 AtiPcie;ATI PCI Express (3GIO) Filter;C:\Windows\system32\DRIVERS\AtiPcie.sys [2006-10-30 18:23]
R1 PStrip;PStrip;C:\Windows\system32\drivers\pstrip.sys [2007-07-15 04:37]
R3 AvgWFP;AVG7 Firewall Driver x86;C:\Windows\system32\Drivers\avgwfp.sys [2008-03-13 16:10]
S3 3xHybrid;Pinnacle PCTV 100i-110i-300i-310i-MCE;C:\Windows\system32\DRIVERS\3xHybrid.sys [2006-11-22 09:53]
S3 mod7700;DiBcom based TV tuner device;C:\Windows\system32\DRIVERS\mod7700.sys [2007-02-20 13:26]
S3 MODRC;Ultima Infrared Receiver;C:\Windows\system32\DRIVERS\modrc.sys [2007-02-06 13:10]
S3 Ph3xIB32;Philips 713x Inbox PCI TV Card;C:\Windows\system32\DRIVERS\Ph3xIB32.sys [2007-04-03 11:43]
S3 Steam Client Service;Steam Client Service;C:\Program Files\Common Files\Steam\SteamService.exe [2008-06-13 12:16]
S3 stusb2ir;USB 2.0 IrDA Bridge;C:\Windows\system32\DRIVERS\stusb2ir.sys [2006-11-02 10:30]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{2a208f47-aa4d-11dc-b651-806e6f6e6963}]
\shell\AutoRun\command - D:\Aloita.exe
\shell\Avaa\Command - D:\Aloita.exe

.
**************************************************************************

catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-06-15 00:40:34
Windows 6.0.6000 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...


**************************************************************************
.
Completion time: 2008-06-15 0:42:13
ComboFix-quarantined-files.txt 2008-06-14 21:41:10
ComboFix2.txt 2008-06-13 08:49:58

Pre-Run: 153,659,064,320 tavua vapaana
Post-Run: 153,627,181,056 tavua vapaana

397 --- E O F --- 2008-06-14 12:43:15

 

mites kone toimii

 

Muuten toimii ihan kivasti, mutta edelleen ongelmana on tuo resoluutiohomma, eli se tuskin on haittaohjelmasta. Ihmettelen vain, että miten se on tullut kun kerran kun uudelleenkäynnistin koneen niin reso oli tosiaan tuo 1024x768, ja sitä ei siis saa vaihdettua isommaksi.

Toisena ongelmana havaitsin, että käynnistäessäni konetta, niin ennen Vistan käyttäjätilien valitsemista, näyttö sanoo "No signal" tjsp. ja sammuu eikä näytä mitään n. 15 sekuntiin vaikka näytön laittaisikin päälle.

Kiitos kuitenkin siitä, että muuten kone toimii hyvin.

 

Koitappas asentaan näyttiksen ajurit uudestaan.

http://www.nvidia.com/Download/index.aspx?lang=en-us

 

Asensin jo kerran aiemmin ja nyt jo uudestaan. Tulos: ei auttanut. En tiedä mikä tätä läjää vaivaa.

E: tuli vaan mieleen, että tuli muuten samalla kerralla tuo resojuttu kun olin käynyt täällä.
Ihmettelen vaan jos tuolta on tullut, kun laitoin tuolta jotain "Spam email" kun se oli palomuurintestausohjelma ja linkki oli täällä virukset ja haittaohjelmat> Antivirus/Spyware/Siivous/ (ilmaisia,Freeware).

 

Käytin myös palomuurintestauksessn leaktest-ohjelmaa, eikai siitä ole mitään haittaa kun tuo reso ei halua toimia...