Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 18:13:26, on 3.5.2008 Platform: Windows Vista SP1 (WinNT 6.00.1905) MSIE: Internet Explorer v7.00 (7.00.6001.18000) Boot mode: Normal Running processes: C:\Windows\system32\Dwm.exe C:\Windows\system32\taskeng.exe C:\Windows\Explorer.EXE C:\Windows\RtHDVCpl.exe C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe C:\Program Files\Grisoft\AVG7\avgcc.exe C:\Windows\System32\rundll32.exe C:\Windows\ehome\ehtray.exe C:\Program Files\Windows Media Player\wmpnscfg.exe C:\Windows\System32\rundll32.exe C:\Windows\ehome\ehmsas.exe C:\Windows\System32\mobsync.exe C:\Program Files\Internet Explorer\ieuser.exe C:\Program Files\Internet Explorer\iexplore.exe C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLLoginProxy.exe C:\Windows\system32\Macromed\Flash\FlashUtil9e.exe C:\Windows\system32\conime.exe C:\Program Files\Windows Live\Messenger\msnmsgr.exe T:\Program Files\Trend Micro\HijackThis\HijackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.fi/ R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157 R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = localhost O2 - BHO: Adobe PDF Reader -linkkiavustaja - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file) O2 - BHO: Windows Liven kirjautumisapuohjelma - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll O2 - BHO: Windows Live Toolbar Helper - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll O3 - Toolbar: Windows Live Toolbar - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll O4 - HKLM\..\Run: [RtHDVCpl] RtHDVCpl.exe O4 - HKLM\..\Run: [recinfo919] c:\RecInfo\RecInfo.exe O4 - HKLM\..\Run: [F-Secure TNB] "E:\Program Files\Sonera Tietoturva\FSGUI\TNBUtil.exe" /CHECKALL /WAITFORSW O4 - HKLM\..\Run: [amd_dc_opt] C:\Program Files\AMD\Dual-Core Optimizer\amd_dc_opt.exe O4 - HKLM\..\Run: [MSConfig] "C:\Windows\system32\msconfig.exe" /auto O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe" O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVG7\avgcc.exe /STARTUP O4 - HKLM\..\Run: [Skytel] Skytel.exe O4 - HKLM\..\Run: [NvSvc] RUNDLL32.EXE C:\Windows\system32\nvsvc.dll,nvsvcStart O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\Windows\system32\NvCpl.dll,NvStartup O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\Windows\system32\NvMcTray.dll,NvTaskbarInit O4 - HKLM\..\Run: [CamWizard] C:\Program Files\Common Files\Logitech\QCDRV\BIN\CamWizrd.exe O4 - HKCU\..\Run: [ehTray.exe] C:\Windows\ehome\ehTray.exe O4 - HKCU\..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe O4 - HKUS\S-1-5-18\..\Run: [Nokia.PCSync] "C:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe" /NoDialog (User 'SYSTEM') O4 - HKUS\S-1-5-18\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'SYSTEM') O4 - HKUS\.DEFAULT\..\Run: [Nokia.PCSync] "C:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe" /NoDialog (User 'Default user') O4 - Startup: Adobe Gamma.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe O8 - Extra context menu item: &Windows Live Search - res://C:\Program Files\Windows Live Toolbar\msntb.dll/search.htm O8 - Extra context menu item: V&ie Microsoft Exceliin - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000 O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll O9 - Extra button: Lähetä OneNoteen - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll O9 - Extra 'Tools' menuitem: Läh&etä OneNoteen - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll O9 - Extra 'Tools' menuitem: Spybot - Search && Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll O13 - Gopher Prefix: O16 - DPF: {39B0684F-D7BF-4743-B050-FDC3F48F7E3B} (CDownloadCtrl Object) - http://www.fileplanet.com/fpdlmgr/cabs/FPDC_2.3.6.108.cab O16 - DPF: {67DABFBF-D0AB-41FA-9C46-CC0F21721616} (DivXBrowserPlugin Object) - http://download.divx.com/player/DivXBrowserPlugin.cab O16 - DPF: {74DBCB52-F298-4110-951D-AD2FF67BC8AB} (NVIDIA Smart Scan) - http://www.nvidia.com/content/DriverDownload/nforce/NvidiaSmartScan.cab O16 - DPF: {BDBDE413-7B1C-4C68-A8FF-C5B2B4090876} (F-Secure Online Scanner 3.3) - http://support.f-secure.com/ols/fscax.cab O20 - Winlogon Notify: avgwlntf - C:\Windows\SYSTEM32\avgwlntf.dll O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe O23 - Service: AVG7 Resident Shield Service (AvgCoreSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgrssvc.exe O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgemc.exe O23 - Service: PnkBstrA - Unknown owner - C:\Windows\system32\PnkBstrA.exe O23 - Service: ServiceLayer - Nokia. - C:\Program Files\PC Connectivity Solution\ServiceLayer.exe O23 - Service: Fujitsu Siemens Computers Diagnostic Testhandler (TestHandler) - Fujitsu Siemens Computers - C:\firststeps\OnlineDiagnostic\TestManager\TestHandler.exe -- End of file - 6923 bytes
1.Lataa combofix.exe työpöydällesi yhdestä linkistä: combofix1 combofix2 2. Tuplaklikkaa combofix.exe tiedostoa ja seuraa ohjeistuksia. 3. Kun työkalu on valmis, se tuottaa lokin. Lähetä tämä loki viesti ketjuusi. Huom! Älä klikkaile combofixin ikkunaa käytön aikana. Tämä saattaa aiheuttaa ohjelman jumiutumisen. ========= Lataa Malwarebytes' Anti-Malware työpöydällesi. 1. Tuplaklikkaa mbam-setup.exe ja seuraa ohjeita asentaaksesi ohjelman. 2. Lopuksi varmistu, että seuraavat on valittu: Update Malwarebytes', Anti-Malwareja Launch Malwarebytes' Anti-Malware ja sen jälkeen klikkaaFinish. 3. Jos päivitys löytyy. ohjelma lataa ja asentaa uusimman version. 4. Kun ohjelma on latautunut, valitse Perform full scan ja klikkaa Scan. 5. Kun skanni on valmis, klikkaa OK ja sitten Show Results nähdäksesi tulokset. 6. Varmistu, että kaikki on merkitty ja klikkaa Remove Selected. 7. Tämän jälkeen loki avautuu muistioon. Tallenna se paikkaan, josta löydät sen helposti. Loki löytyy myös täältä: C:\Documents and Settings\Käyttäjänimi\Application Data\Malwarebytes\Malwarebytes' Anti-Malware\Logs\log-päiväys.txt 8. Lähetä lokin sisältö seuraavassa viestissäsi.
Tässä ensin COMBO LOGI:ComboFix 08-05-01.3 - Ezka 2008-05-04 12:51:51.2 - NTFSx86 Microsoft® Windows Vista™ Home Premium 6.0.6001.1.1252.1.1035.18.2084 [GMT 3:00] Running from: C:\Users\Ezka\Desktop\ComboFix.exe * Created a new restore point . ((((( Tiedostot, jotka on luotu seuraavalla aikavälillä: 2008-04-04 to 2008-05-04 ))))))))))))))))) . 2008-05-04 12:49 . 2008-05-04 12:49 <KANSIO> d-------- C:\Users\All Users\Malwarebytes 2008-05-04 12:49 . 2008-05-04 12:49 <KANSIO> d-------- C:\ProgramData\Malwarebytes 2008-05-04 12:49 . 2008-05-04 12:49 <KANSIO> d-------- C:\Program Files\Malwarebytes' Anti-Malware 2008-05-03 15:06 . 2008-05-03 15:06 39 --a------ C:\Windows\WININIT.INI 2008-05-03 15:04 . 2008-05-03 15:04 <KANSIO> d-------- C:\Program Files\Microsoft CAPICOM 2.1.0.2 2008-05-03 14:08 . 2005-05-27 10:01 53,248 -ra------ C:\Windows\System32\InstMed.exe 2008-05-03 14:07 . 1999-04-23 22:22 933,888 --a------ C:\Windows\System32\MFC44a29.rra 2008-05-03 13:47 . 2008-05-03 15:07 <KANSIO> d-------- C:\Program Files\Logitech 2008-05-03 13:47 . 1999-04-23 22:22 933,888 --a------ C:\Windows\System32\MFC413de.rra 2008-05-03 13:47 . 2008-05-03 13:47 81,920 --------- C:\Windows\bwUnin-6.1.4.68-8876480L.exe 2008-05-03 13:47 . 2003-03-18 21:44 65,536 --a------ C:\Windows\System32\MFC71DEU.DLL 2008-05-03 13:47 . 2003-03-18 21:44 61,440 --a------ C:\Windows\System32\MFC71ITA.DLL 2008-05-03 13:47 . 2003-03-18 21:44 61,440 --a------ C:\Windows\System32\MFC71ESP.DLL 2008-05-03 13:47 . 2003-03-18 21:44 57,344 --a------ C:\Windows\System32\MFC71ENU.DLL 2008-05-03 13:47 . 2003-03-18 21:44 49,152 --a------ C:\Windows\System32\MFC71KOR.DLL 2008-05-03 13:47 . 2003-03-18 21:44 49,152 --a------ C:\Windows\System32\MFC71JPN.DLL 2008-05-03 13:47 . 2003-03-18 21:44 45,056 --a------ C:\Windows\System32\MFC71CHT.DLL 2008-05-03 13:47 . 2003-03-18 21:44 40,960 --a------ C:\Windows\System32\MFC71CHS.DLL 2008-05-03 13:43 . 2005-05-27 12:23 2,180,096 --a------ C:\Windows\System32\drivers\lvsvf2.sys 2008-05-03 13:43 . 2005-05-27 12:32 1,317,152 --a------ C:\Windows\System32\drivers\lvcm.sys 2008-05-03 13:43 . 2005-05-27 12:36 372,736 --a------ C:\Windows\System32\LVUI2RC.dll 2008-05-03 13:43 . 2005-05-27 12:29 204,800 --a------ C:\Windows\System32\LVUI2.dll 2008-05-03 13:43 . 2005-05-27 12:26 204,800 --a------ C:\Windows\System32\lvcodec2.dll 2008-05-03 13:43 . 2005-05-27 12:19 106,496 --a------ C:\Windows\System32\lvcoinst.dll 2008-05-03 13:43 . 2005-05-27 12:31 22,016 --a------ C:\Windows\System32\drivers\LVUSBSta.sys 2008-05-03 13:43 . 2005-05-27 12:10 9,255 --a------ C:\Windows\System32\lvcoinst.ini 2008-05-03 11:18 . 2008-05-03 11:18 <KANSIO> d-------- C:\Program Files\directx 2008-05-02 19:39 . 2008-05-02 19:47 21,840 --a----t- C:\Windows\System32\SIntfNT.dll 2008-05-02 19:39 . 2008-05-02 19:47 17,212 --a----t- C:\Windows\System32\SIntf32.dll 2008-05-02 19:39 . 2008-05-02 19:47 12,067 --a----t- C:\Windows\System32\SIntf16.dll 2008-05-02 19:21 . 2008-05-03 09:46 <KANSIO> d-------- C:\Users\Ezka\AppData\Roaming\Hamachi 2008-05-02 19:21 . 2008-05-02 19:21 25,280 --a------ C:\Windows\System32\drivers\hamachi.sys 2008-05-01 20:27 . 2008-05-01 20:27 524,288 --ahs---- C:\Users\Vieras\NTUSER.DAT{50666d75-179e-11dd-bc2f-e9a0ab412266}.TMContainer00000000000000000002.regtrans-ms 2008-05-01 20:27 . 2008-05-04 12:51 524,288 --ahs---- C:\Users\Vieras\NTUSER.DAT{50666d75-179e-11dd-bc2f-e9a0ab412266}.TMContainer00000000000000000001.regtrans-ms 2008-05-01 20:27 . 2008-05-04 12:51 65,536 --ahs---- C:\Users\Vieras\NTUSER.DAT{50666d75-179e-11dd-bc2f-e9a0ab412266}.TM.blf 2008-05-01 11:10 . 2008-05-01 11:10 <KANSIO> d-------- C:\Users\Ezka\AppData\Roaming\Ubisoft 2008-05-01 11:10 . 2008-05-01 11:10 <KANSIO> d-------- C:\Users\All Users\Ubisoft 2008-05-01 11:10 . 2008-05-01 11:10 <KANSIO> d-------- C:\ProgramData\Ubisoft 2008-04-26 18:31 . 2008-04-26 18:31 <KANSIO> d-------- C:\Users\Aiti\AppData\Roaming\Talkback 2008-04-17 21:09 . 2008-04-17 21:09 0 --ah----- C:\Windows\System32\drivers\Msft_User_PCCSWpdDriver_01_05_00.Wdf 2008-04-17 21:08 . 2008-04-17 21:08 0 --ah----- C:\Windows\System32\drivers\Msft_Kernel_ccdcmb_01005.Wdf 2008-04-17 21:03 . 2008-04-17 21:03 <KANSIO> d-------- C:\Program Files\Common Files\PCSuite 2008-04-17 21:02 . 2008-04-17 21:02 <KANSIO> d----c--- C:\Windows\System32\DRVSTORE 2008-04-17 21:02 . 2008-04-17 21:02 <KANSIO> d-------- C:\Program Files\PC Connectivity Solution 2008-04-17 21:02 . 2007-09-17 15:53 21,632 --a------ C:\Windows\System32\drivers\pccsmcfd.sys 2008-04-17 14:16 . 2008-05-04 12:32 <KANSIO> d-------- C:\Users\All Users\TrackMania 2008-04-17 14:16 . 2008-05-04 12:32 <KANSIO> d-------- C:\ProgramData\TrackMania 2008-04-16 16:16 . 2008-04-16 16:16 0 --ah----- C:\Windows\System32\drivers\Msft_User_WpdFs_01_00_00.Wdf 2008-04-16 16:04 . 2008-04-16 16:04 <KANSIO> d-------- C:\PerfLogs 2008-04-16 15:44 . 2008-04-16 15:22 152,576 --a------ C:\Windows\System32\SPWizUI.dll 2008-04-16 15:44 . 2008-04-16 15:22 47,560 --a------ C:\Windows\System32\SPReview.exe 2008-04-16 15:31 . 2008-01-18 23:33 193,024 --a------ C:\Windows\System32\recdisc.exe 2008-04-16 15:31 . 2008-01-18 23:36 6,656 --a------ C:\Windows\System32\sdspres.dll 2008-04-16 15:30 . 2008-01-18 23:33 599,552 --a------ C:\Windows\System32\vsp1cln.exe 2008-04-16 15:30 . 2008-01-18 23:36 142,336 --a------ C:\Windows\System32\spp.dll 2008-04-16 15:30 . 2008-01-18 23:36 28,160 --a------ C:\Windows\System32\sxproxy.dll 2008-04-16 15:23 . 2008-01-18 23:33 44,032 --a------ C:\Windows\System32\cbsra.exe 2008-04-16 15:22 . 2008-04-16 15:22 <KANSIO> d-------- C:\9fc81d5d98f2850c41f166b216d04b2a 2008-04-16 15:22 . 2008-04-16 15:45 196,608 --a------ C:\Windows\SPInstall.etl 2008-04-13 16:37 . 2008-04-13 16:37 <KANSIO> d-------- C:\Users\Ezka\AppData\Roaming\fretsonfire 2008-04-12 20:02 . 2008-05-03 12:26 <KANSIO> d-------- C:\Users\Aiti\AppData\Roaming\AVG7 2008-04-09 18:19 . 2008-05-04 10:53 <KANSIO> d-------- C:\Users\Ezka\AppData\Roaming\AVG7 2008-04-09 18:19 . 2008-04-09 18:19 524,288 --ahs---- C:\Users\Vieras\NTUSER.DAT{ffaf4afa-0643-11dd-a08c-8ed7a34e3f66}.TMContainer00000000000000000002.regtrans-ms 2008-04-09 18:19 . 2008-05-01 20:27 524,288 --ahs---- C:\Users\Vieras\NTUSER.DAT{ffaf4afa-0643-11dd-a08c-8ed7a34e3f66}.TMContainer00000000000000000001.regtrans-ms 2008-04-09 18:19 . 2008-04-09 18:19 524,288 --ahs---- C:\Users\Aiti\NTUSER.DAT{ffaf4af8-0643-11dd-a08c-8ed7a34e3f66}.TMContainer00000000000000000002.regtrans-ms 2008-04-09 18:19 . 2008-05-04 12:51 524,288 --ahs---- C:\Users\Aiti\NTUSER.DAT{ffaf4af8-0643-11dd-a08c-8ed7a34e3f66}.TMContainer00000000000000000001.regtrans-ms 2008-04-09 18:19 . 2008-05-01 20:27 65,536 --ahs---- C:\Users\Vieras\NTUSER.DAT{ffaf4afa-0643-11dd-a08c-8ed7a34e3f66}.TM.blf 2008-04-09 18:19 . 2008-05-04 12:51 65,536 --ahs---- C:\Users\Aiti\NTUSER.DAT{ffaf4af8-0643-11dd-a08c-8ed7a34e3f66}.TM.blf 2008-04-09 18:18 . 2008-04-10 09:51 53,768 --a------ C:\Windows\System32\drivers\avgwfp.sys 2008-04-09 18:18 . 2008-04-09 18:18 9,216 --a------ C:\Windows\System32\avgwlntf.dll 2008-04-09 16:29 . 2008-04-09 16:29 524,288 --ahs---- C:\Users\Vieras\NTUSER.DAT{4810db0a-0635-11dd-a59d-b6dc96fc3366}.TMContainer00000000000000000002.regtrans-ms 2008-04-09 16:29 . 2008-04-09 16:29 524,288 --ahs---- C:\Users\Vieras\NTUSER.DAT{4810db0a-0635-11dd-a59d-b6dc96fc3366}.TMContainer00000000000000000001.regtrans-ms 2008-04-09 16:29 . 2008-04-09 16:29 65,536 --ahs---- C:\Users\Vieras\NTUSER.DAT{4810db0a-0635-11dd-a59d-b6dc96fc3366}.TM.blf 2008-04-07 18:39 . 2008-04-07 18:41 524,288 --ahs---- C:\Users\Aiti\NTUSER.DAT{68fef1f9-04b6-11dd-9d8e-ca7b4ee13579}.TMContainer00000000000000000002.regtrans-ms 2008-04-07 18:39 . 2008-04-07 18:41 524,288 --ahs---- C:\Users\Aiti\NTUSER.DAT{68fef1f9-04b6-11dd-9d8e-ca7b4ee13579}.TMContainer00000000000000000001.regtrans-ms 2008-04-07 18:39 . 2008-04-07 18:41 65,536 --ahs---- C:\Users\Aiti\NTUSER.DAT{68fef1f9-04b6-11dd-9d8e-ca7b4ee13579}.TM.blf 2008-04-07 14:25 . 2008-04-09 18:23 <KANSIO> d-------- C:\Users\All Users\Avg7 2008-04-07 14:25 . 2008-04-09 18:23 <KANSIO> d-------- C:\ProgramData\Avg7 2008-04-07 14:24 . 2008-04-07 14:25 524,288 --ahs---- C:\Users\Vieras\NTUSER.DAT{f95c19f8-045b-11dd-9cfc-c5f319b8f064}.TMContainer00000000000000000002.regtrans-ms 2008-04-07 14:24 . 2008-04-07 14:25 524,288 --ahs---- C:\Users\Vieras\NTUSER.DAT{f95c19f8-045b-11dd-9cfc-c5f319b8f064}.TMContainer00000000000000000001.regtrans-ms 2008-04-07 14:24 . 2008-04-07 14:25 524,288 --ahs---- C:\Users\Aiti\NTUSER.DAT{f95c19f4-045b-11dd-9cfc-c5f319b8f064}.TMContainer00000000000000000002.regtrans-ms 2008-04-07 14:24 . 2008-04-07 14:25 524,288 --ahs---- C:\Users\Aiti\NTUSER.DAT{f95c19f4-045b-11dd-9cfc-c5f319b8f064}.TMContainer00000000000000000001.regtrans-ms 2008-04-07 14:24 . 2008-04-07 14:25 65,536 --ahs---- C:\Users\Vieras\NTUSER.DAT{f95c19f8-045b-11dd-9cfc-c5f319b8f064}.TM.blf 2008-04-07 14:24 . 2008-04-07 14:25 65,536 --ahs---- C:\Users\Aiti\NTUSER.DAT{f95c19f4-045b-11dd-9cfc-c5f319b8f064}.TM.blf 2008-04-07 08:34 . 2008-04-29 15:30 <KANSIO> dr-h----- C:\$VAULT$.AVG 2008-04-07 07:54 . 2008-04-07 07:54 524,288 --ahs---- C:\Users\Vieras\NTUSER.DAT{f95c1908-045b-11dd-9cfc-c5f319b8f064}.TMContainer00000000000000000002.regtrans-ms 2008-04-07 07:54 . 2008-04-07 07:54 524,288 --ahs---- C:\Users\Vieras\NTUSER.DAT{f95c1908-045b-11dd-9cfc-c5f319b8f064}.TMContainer00000000000000000001.regtrans-ms 2008-04-07 07:54 . 2008-04-07 07:54 524,288 --ahs---- C:\Users\Aiti\NTUSER.DAT{f95c1904-045b-11dd-9cfc-c5f319b8f064}.TMContainer00000000000000000002.regtrans-ms 2008-04-07 07:54 . 2008-04-07 07:54 524,288 --ahs---- C:\Users\Aiti\NTUSER.DAT{f95c1904-045b-11dd-9cfc-c5f319b8f064}.TMContainer00000000000000000001.regtrans-ms 2008-04-07 07:54 . 2008-04-07 07:54 65,536 --ahs---- C:\Users\Vieras\NTUSER.DAT{f95c1908-045b-11dd-9cfc-c5f319b8f064}.TM.blf 2008-04-07 07:54 . 2008-04-07 07:54 65,536 --ahs---- C:\Users\Aiti\NTUSER.DAT{f95c1904-045b-11dd-9cfc-c5f319b8f064}.TM.blf 2008-04-06 19:08 . 2008-04-06 19:08 <KANSIO> d-------- C:\Program Files\Common Files\Logitech 2008-04-06 19:06 . 1998-10-29 17:45 306,688 --a------ C:\Windows\IsUninst.exe 2008-04-06 19:06 . 2008-05-03 15:31 2,112 --a------ C:\Windows\_delis32.ini . (((((((((((((((((((((((((((((((((((( Find3M-raportti )))))))))))))))))))))))))))))))))))))))))))))))))))))) . 2008-05-04 09:51 --------- d-----w C:\Users\Ezka\AppData\Roaming\uTorrent 2008-05-03 12:31 --------- d--h--w C:\Program Files\InstallShield Installation Information 2008-05-01 16:46 717,296 ----a-w C:\Windows\system32\drivers\sptd.sys 2008-04-30 13:09 --------- d-----w C:\Users\Ezka\AppData\Roaming\IGN_DLM 2008-04-27 10:59 --------- d-----w C:\Users\Ezka\AppData\Roaming\MP3Rocket 2008-04-27 07:35 --------- d---a-w C:\ProgramData\TEMP 2008-04-26 15:32 --------- d-----w C:\ProgramData\WLInstaller 2008-04-17 18:03 --------- d-----w C:\Program Files\Common Files\Nokia 2008-04-17 18:01 --------- d-----w C:\Program Files\Nokia 2008-04-17 18:00 --------- d-----w C:\ProgramData\Installations 2008-04-16 13:14 174 --sha-w C:\Program Files\desktop.ini 2008-04-16 13:08 --------- d-----w C:\Program Files\Windows Sidebar 2008-04-16 13:08 --------- d-----w C:\Program Files\Windows Photo Gallery 2008-04-16 13:08 --------- d-----w C:\Program Files\Windows Mail 2008-04-16 13:08 --------- d-----w C:\Program Files\Windows Journal 2008-04-16 13:08 --------- d-----w C:\Program Files\Windows Collaboration 2008-04-16 13:08 --------- d-----w C:\Program Files\Windows Calendar 2008-04-16 13:07 --------- d-----w C:\Program Files\Windows Defender 2008-04-16 13:03 --------- d-----w C:\ProgramData\NVIDIA 2008-04-16 12:49 82,432 ----a-w C:\Windows\System32\axaltocm.dll 2008-04-16 12:49 101,888 ----a-w C:\Windows\System32\ifxcardm.dll 2008-04-15 13:13 22,328 ----a-w C:\Windows\system32\drivers\PnkBstrK.sys 2008-04-15 13:12 107,832 ----a-w C:\Windows\System32\PnkBstrB.exe 2008-04-11 19:43 413,696 ----a-w C:\Windows\System32\wrap_oal.dll 2008-04-11 19:43 110,592 ----a-w C:\Windows\System32\OpenAL32.dll 2008-04-10 04:16 --------- d-----w C:\ProgramData\Microsoft Help 2008-04-09 15:18 --------- d-----w C:\ProgramData\Grisoft 2008-04-09 12:17 --------- d-----w C:\ProgramData\fssg 2008-04-05 08:49 --------- d-----w C:\Program Files\iolo 2008-04-05 08:48 --------- d-----w C:\ProgramData\iolo 2008-04-05 08:25 --------- d-----w C:\Program Files\Sonera 2008-03-28 18:07 --------- d-----w C:\Program Files\Java 2008-03-28 18:06 --------- d-----w C:\Program Files\Common Files\Java 2008-03-26 13:53 --------- d-----w C:\Users\Ezka\AppData\Roaming\Apple Computer 2008-03-26 13:47 --------- d-----w C:\Program Files\Safari 2008-03-26 13:39 --------- d-----w C:\Program Files\iTunes 2008-03-26 13:39 --------- d-----w C:\Program Files\iPod 2008-03-26 13:38 --------- d-----w C:\ProgramData\Apple Computer 2008-03-26 13:38 --------- d-----w C:\Program Files\QuickTime 2008-03-26 13:36 --------- d-----w C:\Program Files\Common Files\Apple 2008-03-25 13:42 --------- d-----w C:\Program Files\RivaTuner v2.08 2008-03-24 15:37 --------- d-----w C:\Program Files\Lavalys 2008-03-23 14:08 --------- d-----w C:\Users\Aiti\AppData\Roaming\vlc 2008-03-23 11:03 --------- d-----w C:\Users\Aiti\AppData\Roaming\DivX 2008-03-21 15:16 307,968 ----a-w C:\Windows\System32\TuneUpDefragService.exe 2008-03-21 15:15 --------- d-----w C:\Users\Ezka\AppData\Roaming\TuneUp Software 2008-03-21 15:15 --------- d-----w C:\ProgramData\TuneUp Software 2008-03-21 15:15 --------- d-----w C:\Program Files\TuneUp Utilities 2008 2008-03-21 15:11 --------- d-----w C:\Program Files\Common Files\Wise Installation Wizard 2008-03-18 13:25 --------- d-----w C:\Users\Ezka\AppData\Roaming\vlc 2008-03-18 13:18 --------- d-----w C:\Program Files\VideoLAN 2008-03-17 12:10 60,064 ----a-w C:\Windows\system32\drivers\fsdfw.sys 2008-03-15 12:44 --------- d-----w C:\Users\Ezka\AppData\Roaming\DivX 2008-03-15 12:42 --------- d-----w C:\Program Files\DivX 2008-03-15 12:42 --------- d-----w C:\Program Files\Common Files\PX Storage Engine 2008-03-12 14:27 --------- d-----w C:\Program Files\Microsoft Silverlight 2008-03-09 14:29 669,184 ----a-w C:\Windows\System32\pbsvc.exe 2008-03-09 14:29 22,328 ----a-w C:\Users\Ezka\AppData\Roaming\PnkBstrK.sys 2008-03-09 14:28 --------- d-----w C:\ProgramData\Media Center Programs 2008-03-09 11:50 --------- d-----w C:\Program Files\Common Files\Adobe 2008-03-08 19:37 --------- d-----w C:\Program Files\AMD 2008-03-08 18:31 --------- d-----w C:\Program Files\Google 2008-03-08 15:09 --------- d-----w C:\Users\Ezka\AppData\Roaming\InstallShield Installation Information 2008-03-08 15:06 --------- d-----w C:\Users\Ezka\AppData\Roaming\Microsoft Game Studios 2008-03-08 15:06 --------- d-----w C:\ProgramData\Microsoft Games 2008-03-08 15:06 --------- d-----w C:\Program Files\Microsoft Games 2008-03-07 14:33 66,872 ----a-w C:\Windows\System32\PnkBstrA.exe 2008-03-06 18:00 --------- d-----w C:\Program Files\FreeRIP3 2008-03-06 17:57 --------- d-----w C:\ProgramData\Spybot - Search & Destroy 2008-03-06 17:05 --------- d-----w C:\ProgramData\Lavasoft 2008-03-06 17:01 --------- d-----w C:\Program Files\Lavasoft 2008-03-06 16:58 --------- d-----w C:\Program Files\Spybot - Search & Destroy 2008-03-06 08:14 831,048 ----a-w C:\Windows\System32\WudfUpdate_01005.dll 2008-03-05 14:03 479,752 ----a-w C:\Windows\System32\XAudio2_0.dll 2008-03-05 14:03 238,088 ----a-w C:\Windows\System32\xactengine3_0.dll 2008-03-05 14:00 25,608 ----a-w C:\Windows\System32\X3DAudio1_3.dll 2008-03-05 13:56 3,786,760 ----a-w C:\Windows\System32\D3DX9_37.dll 2008-03-05 13:56 1,420,824 ----a-w C:\Windows\System32\D3DCompiler_37.dll 2008-03-04 16:16 53,248 ----a-w C:\Windows\System32\unrar.dll 2008-03-04 16:15 4,358,144 ----a-w C:\Windows\uncsetup.exe 2008-03-01 18:33 1,568,889 ----a-w C:\Users\Ezka\P-660HW-D1_3.40(AGL.4)C0.zip 2008-03-01 08:51 651,896 ----a-w C:\Users\Ezka\Metacafe4Windows.exe 2008-02-29 07:14 19,000 ----a-w C:\Windows\System32\kd1394.dll 2008-02-29 07:11 988,216 ----a-w C:\Windows\System32\winload.exe 2008-02-29 07:11 927,288 ----a-w C:\Windows\System32\winresume.exe 2008-02-29 06:53 46,592 ----a-w C:\Windows\System32\setbcdlocale.dll 2008-02-29 06:53 40,960 ----a-w C:\Windows\System32\srclient.dll 2008-02-29 06:53 378,368 ----a-w C:\Windows\System32\srcore.dll 2008-02-29 06:35 6,656 ----a-w C:\Windows\System32\kbd106n.dll 2008-02-29 04:21 2,032,128 ----a-w C:\Windows\System32\win32k.sys 2008-02-29 04:12 318,464 ----a-w C:\Windows\System32\rstrui.exe 2008-02-29 04:12 14,848 ----a-w C:\Windows\System32\srdelayed.exe 2008-02-27 11:15 28,416 ----a-w C:\Windows\System32\uxtuneup.dll 2008-02-27 11:15 16,640 ----a-w C:\Windows\System32\authuitu.dll 2008-02-22 05:05 615,992 ----a-w C:\Windows\System32\ci.dll 2008-02-22 05:01 826,880 ----a-w C:\Windows\System32\wininet.dll 2008-02-22 04:57 295,936 ----a-w C:\Windows\System32\gdi32.dll 2008-02-21 02:05 524,288 ----a-w C:\Windows\System32\DivXsm.exe 2008-02-21 02:05 3,596,288 ----a-w C:\Windows\System32\qt-dx331.dll 2008-02-21 02:05 200,704 ----a-w C:\Windows\System32\ssldivx.dll . (((((((((((((((((((((((((((((( Rekisterin käynnistyskohteet ))))))))))))))))))))))))))))))))))))))))))))) . . REGEDIT4 *Huom* Tyhjiä arvoja ja laillisia oletusarvoja ei näytetä [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "ehTray.exe"="C:\Windows\ehome\ehTray.exe" [2008-01-18 23:33 125952] "WMPNSCFG"="C:\Program Files\Windows Media Player\WMPNSCFG.exe" [2008-01-18 23:33 202240] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "RtHDVCpl"="RtHDVCpl.exe" [2007-10-01 12:53 4702208 C:\Windows\RtHDVCpl.exe] "recinfo919"="c:\RecInfo\RecInfo.exe" [2007-10-23 15:52 2764800] "F-Secure TNB"="E:\Program Files\Sonera Tietoturva\FSGUI\TNBUtil.exe" [ ] "amd_dc_opt"="C:\Program Files\AMD\Dual-Core Optimizer\amd_dc_opt.exe" [2007-07-23 12:06 77824] "MSConfig"="C:\Windows\system32\msconfig.exe" [2008-01-18 23:33 227840] "SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe" [2008-02-22 05:25 144784] "AVG7_CC"="C:\PROGRA~1\Grisoft\AVG7\avgcc.exe" [2008-04-15 15:17 579584] "Skytel"="Skytel.exe" [2007-08-03 14:22 1826816 C:\Windows\SkyTel.exe] "NvSvc"="C:\Windows\system32\nvsvc.dll" [2008-03-04 12:02 92704] "NvCplDaemon"="C:\Windows\system32\NvCpl.dll" [2008-03-04 12:02 8530464] "NvMediaCenter"="C:\Windows\system32\NvMcTray.dll" [2008-03-04 12:02 88608] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] "Nokia.PCSync"="C:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe" [2008-03-26 18:41 1232896] "AVG7_Run"="C:\PROGRA~1\Grisoft\AVG7\avgw.exe" [2008-04-09 18:18 219136] [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system] "EnableUIADesktopToggle"= 0 (0x0) [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\avgwlntf] avgwlntf.dll 2008-04-09 18:18 9216 C:\Windows\System32\avgwlntf.dll [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32] "VIDC.X264"= x264vfw.dll "VIDC.3iv2"= 3ivxVfWCodec.dll "VIDC.VP31"= vp31vfw.dll "msacm.l3fhg"= mp3fhg.acm [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CamWizard] --a------ 2005-05-13 16:42 184320 C:\Program Files\Common Files\Logitech\QCDRV\BIN\CamWizrd.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\igndlm.exe] E:\Program Files\Download Manager\DLM.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper] --a------ 2008-02-19 14:10 267048 C:\Program Files\iTunes\iTunesHelper.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck] --a------ 2007-02-26 21:46 153136 C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PC Suite Tray] E:\Program Files\Nokia\Nokia PC Suite 6\PCSuite.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task] --a------ 2008-02-01 00:13 385024 C:\Program Files\QuickTime\QTTask.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Windows Defender] --a------ 2008-01-18 23:38 1008184 C:\Program Files\Windows Defender\MSASCui.exe [HKEY_LOCAL_MACHINE\software\microsoft\security center\Svc\S-1-5-21-332621374-1900857233-3605568749-1000] "EnableNotificationsRef"=dword:00000005 [HKLM\~\services\sharedaccess\parameters\firewallpolicy\FirewallRules] "{86CDBB66-BC8B-451D-8E6E-F474F38AC052}"= UDP:C:\Program Files\Microsoft Office\Office12\ONENOTE.EXE:Microsoft Office OneNote "{D80FDAEC-251F-49B2-9463-2F58DC92E289}"= TCP:C:\Program Files\Microsoft Office\Office12\ONENOTE.EXE:Microsoft Office OneNote "{A87687EC-A822-4CDD-8566-9B7A26094B8E}"= UDP:\PELIT\Electronic Arts\Crytek\Crysis SP Demo\Bin32\Crysis.exe:Crysis_32_sp_demo "{D3F461DD-698A-4314-B755-6EDFDD6A6C33}"= TCP:\PELIT\Electronic Arts\Crytek\Crysis SP Demo\Bin32\Crysis.exe:Crysis_32_sp_demo "{9FF213A0-2DD8-416D-814E-C0FAC2F79613}"= UDP:\PELIT\THQ\S.T.A.L.K.E.R. - Shadow of Chernobyl\bin\XR_3DA.exe:S.T.A.L.K.E.R. - Shadow of Chernobyl (CLI) "{AD8AEA3C-D981-451D-9E24-325121AEBA6F}"= TCP:\PELIT\THQ\S.T.A.L.K.E.R. - Shadow of Chernobyl\bin\XR_3DA.exe:S.T.A.L.K.E.R. - Shadow of Chernobyl (CLI) "{13FCD21A-1B21-41F8-A8FA-76B0681A292C}"= UDP:\PELIT\THQ\S.T.A.L.K.E.R. - Shadow of Chernobyl\bin\dedicated\XR_3DA.exe:S.T.A.L.K.E.R. - Shadow of Chernobyl (SRV) "{0723B84C-B28A-4CC0-BB9E-40A98A444EDB}"= TCP:\PELIT\THQ\S.T.A.L.K.E.R. - Shadow of Chernobyl\bin\dedicated\XR_3DA.exe:S.T.A.L.K.E.R. - Shadow of Chernobyl (SRV) "{AF3B243B-EF96-480A-B1A4-4182DB600B56}"= C:\Program Files\Windows Live\Messenger\livecall.exe:Windows Live Messenger (Phone) "{E908A133-3CD0-4208-83E0-2870E074CFAB}"= UDP:\PELIT\EA GAMES\Battlefield 2\BF2.exe:Battlefield 2 "{FD98D057-7F81-43AB-BC89-8530754A1D1F}"= TCP:\PELIT\EA GAMES\Battlefield 2\BF2.exe:Battlefield 2 "{25762E4E-0AC8-411D-AC8C-A1133CEFE5E4}"= UDP:\PELIT\Unreal Tournament 3 Demo\Binaries\UT3Demo.exe:Unreal Tournament 3 Demo "{C1778E0E-664C-4AE3-8FA2-E44F9ED122DB}"= TCP:\PELIT\Unreal Tournament 3 Demo\Binaries\UT3Demo.exe:Unreal Tournament 3 Demo "{F2192CF2-C239-4D9C-886F-A1D634885803}"= UDP:16969:BitComet 16969 TCP "{F60C91D4-9C45-448C-90A3-19B67C21C3ED}"= TCP:16969:BitComet 16969 UDP "{78D3F9A3-AADE-4473-9E53-D680C3C8AE0F}"= UDP:9336:BitComet 9336 TCP "{CE0AC8A1-0751-4703-8AF8-D6455D6F078E}"= TCP:9336:BitComet 9336 UDP "TCP Query User{CBC9B237-E44B-42CA-B490-191ED9FCC79E}D:\\pelit\\america's army\\system\\armyops.exe"= UDP:\pelit\america's army\system\armyops.exe:ArmyOps "UDP Query User{593DABF5-31F3-486D-8C5C-E0431D7ED99E}D:\\pelit\\america's army\\system\\armyops.exe"= TCP:\pelit\america's army\system\armyops.exe:ArmyOps "TCP Query User{E9DE1D66-CA30-433B-B06E-1F6CA6AA169F}C:\\users\\ezka\\desktop\\utorrent.exe"= UDP:C:\users\ezka\desktop\utorrent.exe:utorrent.exe "UDP Query User{4A8D2846-9545-4A26-8765-D52DD2E7DFA6}C:\\users\\ezka\\desktop\\utorrent.exe"= TCP:C:\users\ezka\desktop\utorrent.exe:utorrent.exe "TCP Query User{8AB0AEEC-F8B4-4F70-B421-DCEDF0C26E7A}D:\\pelit\\steam\\steamapps\\etzka333\\half-life 2 deathmatch\\hl2.exe"= UDP:\pelit\steam\steamapps\etzka333\half-life 2 deathmatch\hl2.exe:hl2 "UDP Query User{3F71303D-C49F-4C95-9AED-43BB73C6707E}D:\\pelit\\steam\\steamapps\\etzka333\\half-life 2 deathmatch\\hl2.exe"= TCP:\pelit\steam\steamapps\etzka333\half-life 2 deathmatch\hl2.exe:hl2 "TCP Query User{84B04250-8A73-411B-B448-26C86D6A31A2}C:\\program files\\java\\jre1.6.0_03\\bin\\javaw.exe"= UDP:C:\program files\java\jre1.6.0_03\bin\javaw.exe:Java(TM) Platform SE binary "UDP Query User{106968E6-3F62-454C-8F4B-557A796ED2D8}C:\\program files\\java\\jre1.6.0_03\\bin\\javaw.exe"= TCP:C:\program files\java\jre1.6.0_03\bin\javaw.exe:Java(TM) Platform SE binary "{A292E65D-B0A8-4817-A656-9B772F390EA5}"= UDP:C:\Program Files\Messenger\Msmsgs.exe:Windows Messenger "{01A8ABD7-8EFB-43CC-9AB9-40513F8670CD}"= TCP:C:\Program Files\Messenger\Msmsgs.exe:Windows Messenger "{F55229CF-F5E8-4B83-9218-582F6369391B}"= C:\Program Files\Windows Live\Messenger\livecall.exe:Windows Live Messenger (Phone) "{D280E26C-F92B-4800-A8FE-B97974516923}"= UDP:C:\Windows\System32\PnkBstrA.exenkBstrA "{C38041B1-03C4-442B-BE6D-9997666F1D7E}"= TCP:C:\Windows\System32\PnkBstrA.exenkBstrA "{CE884FC8-A62C-468D-9710-164880807A4B}"= UDP:C:\Windows\System32\PnkBstrB.exenkBstrB "{74836543-086D-49E6-88B8-7B35AF37DE49}"= TCP:C:\Windows\System32\PnkBstrB.exenkBstrB "{865AEDD1-7503-4801-9D71-A8BEC0447EDF}"= UDP:\PELIT\Electronic Arts\Crytek\Crysis\Bin32\Crysis.exe:Crysis_32 "{CEAB9948-E3A6-4103-8A57-AFFB9DC2AE1A}"= TCP:\PELIT\Electronic Arts\Crytek\Crysis\Bin32\Crysis.exe:Crysis_32 "{7E00EC66-82C5-4A61-BE92-034112BF7158}"= UDP:\PELIT\Electronic Arts\Crytek\Crysis\Bin32\CrysisDedicatedServer.exe:CrysisDedicatedServer_32 "{BC506A33-0C58-455E-92A5-DA2A4707832C}"= TCP:\PELIT\Electronic Arts\Crytek\Crysis\Bin32\CrysisDedicatedServer.exe:CrysisDedicatedServer_32 "{31D4E799-D7CF-4024-A938-20064E9D6C0F}"= UDP:C:\Program Files\iTunes\iTunes.exe:iTunes "{CE9C6782-7771-4ECE-B2CA-20F488220B26}"= TCP:C:\Program Files\iTunes\iTunes.exe:iTunes "{6502CC3C-CED2-4C8B-B033-78A9F7B879A2}"= UDP:32459:utorrent "{0B6A2D11-2CBE-4267-8858-1F611C390FD0}"= UDP:C:\Windows\System32\wuapp.exe:wuapp "{97C7A4EE-30DA-4666-B0AB-8F187B305EA9}"= TCP:C:\Windows\System32\wuapp.exe:wuapp "{DF0E2772-7757-4A7E-BD30-205388824C1B}"= UDP:C:\Users\Ezka\Program Files\uTorrent\uTorrent.exe:µTorrent "{2C6BDEF8-5844-4279-9F24-851FAB7B0C2F}"= TCP:C:\Users\Ezka\Program Files\uTorrent\uTorrent.exe:µTorrent "TCP Query User{213B5FD8-DE0C-465B-98AB-CF502338C0B9}T:\\pelit\\microsoft games\\age of empires ii\\age2_x1\\age2_x1.exe"= UDP:T:\pelit\microsoft games\age of empires ii\age2_x1\age2_x1.exe:Age of Empires II Expansion "UDP Query User{880802C2-5CD6-441F-8EC3-3132A2FF2377}T:\\pelit\\microsoft games\\age of empires ii\\age2_x1\\age2_x1.exe"= TCP:T:\pelit\microsoft games\age of empires ii\age2_x1\age2_x1.exe:Age of Empires II Expansion "TCP Query User{08187B8D-CE37-4A08-AF72-635B0E9E7CC3}C:\\program files\\internet explorer\\iexplore.exe"= UDP:C:\program files\internet explorer\iexplore.exe:Internet Explorer "UDP Query User{9197BCD7-3D0F-4236-9657-CB11F0D41F75}C:\\program files\\internet explorer\\iexplore.exe"= TCP:C:\program files\internet explorer\iexplore.exe:Internet Explorer "TCP Query User{0FB71936-76BB-407A-8B61-34BE93ED76DE}D:\\pelit\\sierra\\fearcombat\\fpupdate.exe"= UDP:\pelit\sierra\fearcombat\fpupdate.exe:fpupdate "UDP Query User{4B871549-95D5-4773-958E-909332145F91}D:\\pelit\\sierra\\fearcombat\\fpupdate.exe"= TCP:\pelit\sierra\fearcombat\fpupdate.exe:fpupdate "{21A38AB3-C330-4456-A7D9-AA349470A362}"= UDP:\PELIT\Sierra\FEARCombat\FEARMP.exe:FEAR Combat "{39042C6A-A823-4955-AAF1-9070B69DC0F7}"= TCP:\PELIT\Sierra\FEARCombat\FEARMP.exe:FEAR Combat "TCP Query User{F25FF411-974D-41BC-BC04-7628006FD39C}L:\\microsoft games\\age of empires ii\\age2_x1\\age2_x1.exe"= UDP:L:\microsoft games\age of empires ii\age2_x1\age2_x1.exe:Age of Empires II Expansion "UDP Query User{9EC3C728-B695-4E53-BA1E-A7F054644443}L:\\microsoft games\\age of empires ii\\age2_x1\\age2_x1.exe"= TCP:L:\microsoft games\age of empires ii\age2_x1\age2_x1.exe:Age of Empires II Expansion "TCP Query User{5CE3A08C-C210-4C42-9B07-9663A7422F79}D:\\pelit\\tmnationsforever\\tmforever.exe"= UDP:\pelit\tmnationsforever\tmforever.exe:TmForever "UDP Query User{A320AF7B-E514-4038-8E8B-7BE7642F33E1}D:\\pelit\\tmnationsforever\\tmforever.exe"= TCP:\pelit\tmnationsforever\tmforever.exe:TmForever "{97CDFF95-ABCD-4317-AC01-640FF715F771}"= C:\Program Files\Windows Live\Messenger\livecall.exe:Windows Live Messenger (Phone) "TCP Query User{D844A791-2BC3-483D-BDCE-BB5C9A3712DC}C:\\users\\ezka\\desktop\\wow-2.4.1.8125-to-0.4.2.8209-engb-downloader.exe"= UDP:C:\users\ezka\desktop\wow-2.4.1.8125-to-0.4.2.8209-engb-downloader.exe:wow-2.4.1.8125-to-0.4.2.8209-engb-downloader.exe "UDP Query User{98792957-0710-43DC-86E1-BE558330B851}C:\\users\\ezka\\desktop\\wow-2.4.1.8125-to-0.4.2.8209-engb-downloader.exe"= TCP:C:\users\ezka\desktop\wow-2.4.1.8125-to-0.4.2.8209-engb-downloader.exe:wow-2.4.1.8125-to-0.4.2.8209-engb-downloader.exe "TCP Query User{FAC8F833-9E81-4A66-8E21-416A03DCF711}C:\\program files\\java\\jre1.6.0_05\\bin\\javaw.exe"= UDP:C:\program files\java\jre1.6.0_05\bin\javaw.exe:Java(TM) Platform SE binary "UDP Query User{8C108847-5AE6-48EB-86ED-0D325ECBAFBB}C:\\program files\\java\\jre1.6.0_05\\bin\\javaw.exe"= TCP:C:\program files\java\jre1.6.0_05\bin\javaw.exe:Java(TM) Platform SE binary "TCP Query User{835E533E-B9F8-48D8-9A6C-351AA572497F}E:\\tmnationsforever\\tmforever.exe"= UDP:E:\tmnationsforever\tmforever.exe:TmForever "UDP Query User{EA8A0FBD-6404-487E-AA4E-D580CADB8203}E:\\tmnationsforever\\tmforever.exe"= TCP:E:\tmnationsforever\tmforever.exe:TmForever "TCP Query User{3C993BCF-4AFE-4663-9C06-C18F20E9B21C}D:\\pelit\\tmnationsforever\\tmforever.exe"= UDP:\pelit\tmnationsforever\tmforever.exe:TmForever "UDP Query User{301A4CC0-DE78-4F5D-AC63-914A45A25C67}D:\\pelit\\tmnationsforever\\tmforever.exe"= TCP:\pelit\tmnationsforever\tmforever.exe:TmForever "TCP Query User{4FE29F94-3F52-4C07-974F-ACA31B5D6A10}C:\\users\\ezka\\program files\\utorrent\\utorrent.exe"= UDP:C:\users\ezka\program files\utorrent\utorrent.exe:utorrent.exe "UDP Query User{6954CE92-C733-4529-A18B-0BC296466BB4}C:\\users\\ezka\\program files\\utorrent\\utorrent.exe"= TCP:C:\users\ezka\program files\utorrent\utorrent.exe:utorrent.exe "{56195B86-8837-4D4E-A496-08FCDC261641}"= UDP:6112:Utor2 "{ACB9EEEC-1092-4060-BAF0-C4CF3F7A0566}"= TCP:6112:Utor2 "TCP Query User{6F19102D-DF5E-4057-8D1F-A1385C9439A8}C:\\program files\\logitech\\desktop messenger\\8876480\\program\\backweb-8876480.exe"= UDP:C:\program files\logitech\desktop messenger\8876480\program\backweb-8876480.exe:Logitech Desktop Messenger "UDP Query User{3D94E9FC-DF22-42A4-9071-43F9C81AC38F}C:\\program files\\logitech\\desktop messenger\\8876480\\program\\backweb-8876480.exe"= TCP:C:\program files\logitech\desktop messenger\8876480\program\backweb-8876480.exe:Logitech Desktop Messenger "TCP Query User{DB3B61DB-1D6E-463B-B290-F5D14BEB50A0}C:\\program files\\java\\jre1.6.0_05\\bin\\javaw.exe"= UDP:C:\program files\java\jre1.6.0_05\bin\javaw.exe:Java(TM) Platform SE binary "UDP Query User{6E154437-BAA0-4C3A-9749-8529BF743B5C}C:\\program files\\java\\jre1.6.0_05\\bin\\javaw.exe"= TCP:C:\program files\java\jre1.6.0_05\bin\javaw.exe:Java(TM) Platform SE binary R0 AtiPcie;ATI PCI Express (3GIO) Filter;C:\Windows\system32\DRIVERS\AtiPcie.sys [2006-10-30 12:22] R1 ElRawDisk;ElRawDisk;C:\Windows\system32\drivers\elrawdsk.sys [2007-09-20 14:12] R1 FSES;F-Secure Email Scanning Driver;C:\Windows\system32\drivers\fses.sys [2007-04-26 20:08] R2 TestHandler;Fujitsu Siemens Computers Diagnostic Testhandler;C:\firststeps\OnlineDiagnostic\TestManager\TestHandler.exe [2006-12-08 21:52] R2 UxTuneUp;TuneUp Theme Extension;C:\Windows\System32\svchost.exe [2008-01-18 23:33] R3 AvgWFP;AVG7 Firewall Driver x86;C:\Windows\system32\Drivers\avgwfp.sys [2008-04-10 09:51] S3 ADM8511;USB To Fast Ethernet/ HomePNA Adapter;C:\Windows\system32\DRIVERS\NETUSB.SYS [2001-10-24 17:43] S3 PCASp50;PCASp50 NDIS Protocol Driver;C:\Windows\system32\Drivers\PCASp50.sys [2004-05-17 09:15] S3 pccsmcfd;PCCS Mode Change Filter Driver;C:\Windows\system32\DRIVERS\pccsmcfd.sys [2007-09-17 15:53] S3 upperdev;upperdev;C:\Windows\system32\DRIVERS\usbser_lowerflt.sys [2007-11-29 10:39] S3 UsbserFilt;UsbserFilt;C:\Windows\system32\DRIVERS\usbser_lowerfltj.sys [2007-11-29 10:39] S4 nvrd32;NVIDIA nForce RAID Driver;C:\Windows\system32\drivers\nvrd32.sys [2007-07-02 18:37] S4 Steam Client Service;Steam Client Service;C:\Program Files\Common Files\Steam\SteamService.exe [2008-03-02 13:20] S4 TuneUp.Defrag;TuneUp Drive Defrag Service;C:\Windows\System32\TuneUpDefragService.exe [2008-03-21 18:16] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost] bthsvcs REG_MULTI_SZ BthServ HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost - NetSvcs UxTuneUp . 'Ajoitetut tehtävät'-kansion sisältö "2008-05-04 09:31:44 C:\Windows\Tasks\1-Click Maintenance.job" - C:\Program Files\TuneUp Utilities 2008\OneClickStarter.exe "2008-05-02 14:00:00 C:\Windows\Tasks\Scheduled scanning task.job" - E:\PROGRA~1\SONERA~1\ANTI-V~1\fsav.exeQ /HARD /POLICY /SCHED /NOBREAK /REPORT=E:\PROGRA~1\SONERA~1\ANTI-V~1\report.txt "2008-04-13 19:00:00 C:\Windows\Tasks\SmartDefrag.job" - C:\Program Files\IObit\IObit SmartDefrag\schedule.exe "2007-12-22 09:03:25 C:\Windows\Tasks\Tarkistetaan Windows Live -työkalurivin päivitykset.job" - C:\Program Files\Windows Live Toolbar\MSNTBUP.EXE . ************************************************************************** catchme 0.3.1353 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2008-05-04 12:54:08 Windows 6.0.6001 Service Pack 1 NTFS scanning hidden processes ... scanning hidden autostart entries ... scanning hidden files ... scan completed successfully hidden files: 0 ************************************************************************** . Completion time: 2008-05-04 12:55:02 ComboFix-quarantined-files.txt 2008-05-04 09:54:53 ComboFix2.txt 2008-03-30 17:15:49 Pre-Run: 223,083,945,984 tavua vapaana Post-Run: 223,043,407,872 tavua vapaana 371 --- E O F --- 2008-05-03 12:04:19
Malwarebytes' Anti-Malware 1.11 Tietokantaversio: 714 Tarkistustyyppi: Täysi tarkistus (C:\|D:\|T:\|) Tarkistetut kohteet: 195648 Kulunut aika: 1 hour(s), 31 minute(s), 6 second(s) Saastuneita muistiprosesseja: 0 Saastuneita muistimoduuleja: 0 Saastuneita rekisteriavaimia: 0 Saastuneita rekisteriarvoja: 0 Saastuneita rekisterikohteita: 0 Saastuneita hakemistoja: 0 Saastuneita tiedostoja: 0 Saastuneita muistiprosesseja: (Haitallisia kohteita ei löydetty) Saastuneita muistimoduuleja: (Haitallisia kohteita ei löydetty) Saastuneita rekisteriavaimia: (Haitallisia kohteita ei löydetty) Saastuneita rekisteriarvoja: (Haitallisia kohteita ei löydetty) Saastuneita rekisterikohteita: (Haitallisia kohteita ei löydetty) Saastuneita hakemistoja: (Haitallisia kohteita ei löydetty) Saastuneita tiedostoja: (Haitallisia kohteita ei löydetty)
