Mesevirus tuli uudestaan. Mukana Combofix & hjt:n lokit

Discussion in 'Virukset ja haittaohjelmat - HijackThis -logit' started by Topeelius, Jun 2, 2008.

Thread Status:
Not open for further replies.
  1. Topeelius

    Topeelius Member

    Joined:
    Jun 12, 2013
    Messages:
    21
    Likes Received:
    0
    Trophy Points:
    11
    Nonni

    Kerran jo poistin meseviruksen mutta sehän on tullu uudestaan. ilmeisesti jotain filuja kuitenkin jäi koneelle. Kyllä sielä ainakin
    Vundo.exe:ä on mutta jos joku viitsisi vielä tarkistaa mitkä kaikki filut pitää poistaa niin saatais kerralla puhdasta :).

    Tässä Combofix - loki:

    2008-05-30 03:00 . 2008-06-01 23:23 <KANSIO> d-------- C:\Program Files\mIRC
    2008-05-30 01:58 . 2008-05-30 01:58 <KANSIO> d-------- C:\Program Files\Malwarebytes' Anti-Malware
    2008-05-30 01:58 . 2008-05-30 01:58 <KANSIO> d-------- C:\Documents and Settings\Topi Heikkilä\Application Data\Malwarebytes
    2008-05-30 01:58 . 2008-05-30 01:58 <KANSIO> d-------- C:\Documents and Settings\All Users\Application Data\Malwarebytes
    2008-05-30 01:58 . 2008-05-05 20:46 27,048 --a------ C:\WINDOWS\system32\drivers\mbamcatchme.sys
    2008-05-30 01:58 . 2008-05-05 20:46 15,864 --a------ C:\WINDOWS\system32\drivers\mbam.sys
    2008-05-30 01:03 . 2008-05-30 01:03 <KANSIO> d-------- C:\Program Files\Trend Micro
    2008-05-29 20:42 . 2008-05-29 20:42 249,496 --a------ C:\sexy.exe
    2008-05-29 20:18 . 2008-05-29 20:18 86,340 --a------ C:\img.com
    2008-05-29 19:38 . 2008-05-29 19:38 40,960 --a------ C:\dsdc.exe
    2008-05-29 15:35 . 2008-05-29 22:51 60,132 --a------ C:\ddc.exe
    2008-05-29 15:14 . 2008-05-29 18:12 56,832 --a------ C:\fa.com
    2008-05-28 23:47 . 2008-05-28 23:47 369 --a------ C:\vundoFIX.exe
    2008-05-28 20:26 . 2008-05-28 20:26 40,960 --a------ C:\dczi.exe
    2008-05-28 19:27 . 2008-05-28 20:10 56,832 --a------ C:\sxy1.com
    2008-05-28 19:21 . 2008-05-28 19:21 56,832 --a------ C:\sxy.com
    2008-05-28 01:47 . 2008-05-28 01:47 <KANSIO> d-------- C:\WINDOWS\nvidia icons
    2008-05-28 01:47 . 2008-05-28 01:49 <KANSIO> d-------- C:\WINDOWS\NV48324800.TMP
    2008-05-28 01:47 . 2008-05-02 22:46 182,347 --a------ C:\WINDOWS\system32\nvapps.nvb
    2008-05-28 01:46 . 2008-05-28 01:46 <KANSIO> d-------- C:\NVIDIA
    2008-05-28 01:46 . 2008-04-30 17:27 442,368 --a------ C:\WINDOWS\system32\NVUNINST.EXE
    2008-05-27 23:36 . 2008-05-27 23:36 40,960 --a------ C:\dcis.exe
    2008-05-27 23:25 . 2008-05-28 13:48 40,960 --a------ C:\dciz.exe
    2008-05-27 19:07 . 2008-05-27 20:38 40,960 --a------ C:\dchi.exe
    2008-05-27 18:53 . 2008-05-29 16:29 3,422 --a------ C:\dci.exe
    2008-05-19 13:57 . 2008-06-01 23:33 <KANSIO> d-------- C:\Program Files\SystemRequirementsLab
    2008-05-19 13:56 . 2008-05-19 13:57 <KANSIO> d-------- C:\Documents and Settings\Topi Heikkilä\Application Data\SystemRequirementsLab
    2008-05-13 02:01 . 2008-05-13 02:01 <KANSIO> d-------- C:\Documents and Settings\All Users\Application Data\media center programs
    2008-05-13 01:13 . 2008-05-13 01:13 <KANSIO> d-------- C:\Documents and Settings\All Users\Application Data\Funcom

    .
    (((((((((((((((((((((((((((((((((((( Find3M-raportti ))))))))))))))))))))))))))))))))))))))))))))))))))))))
    .
    2008-06-02 06:12 --------- d-----w C:\Documents and Settings\Topi Heikkilä\Application Data\OpenOffice.org2
    2008-06-02 06:12 --------- d-----w C:\Documents and Settings\Topi Heikkilä\Application Data\nView_Wallpaper
    2008-06-02 06:12 --------- d-----w C:\Documents and Settings\Topi Heikkilä\Application Data\Hamachi
    2008-06-01 23:18 --------- d-----w C:\Documents and Settings\Topi Heikkilä\Application Data\mIRC
    2008-06-01 20:39 --------- d-----w C:\Program Files\SpeedFan
    2008-06-01 19:41 --------- d-----w C:\Documents and Settings\Topi Heikkilä\Application Data\uTorrent
    2008-05-30 00:22 --------- d-----w C:\Program Files\Windows Live
    2008-05-30 00:20 --------- d-----w C:\Documents and Settings\All Users\Application Data\WLInstaller
    2008-05-28 20:47 369 ----a-w C:\vundoFIX.exe
    2008-05-25 11:18 --------- d-----w C:\Documents and Settings\All Users\Application Data\nView_Profiles
    2008-05-14 17:01 --------- d-----w C:\Documents and Settings\All Users\Application Data\Microsoft Help
    2008-05-05 21:13 43,520 ----a-w C:\WINDOWS\system32\CmdLineExt03.dll
    2008-04-28 19:47 --------- d-----w C:\Program Files\OpenOffice.org 2.3
    2008-04-10 20:13 --------- d-----w C:\Documents and Settings\Topi Heikkilä\Application Data\Syntrillium
    2008-03-25 04:51 621,344 ----a-w C:\WINDOWS\system32\mswstr10.dll
    2008-03-25 04:51 166,688 ----a-w C:\WINDOWS\system32\msjint40.dll
    2008-03-20 08:09 1,845,504 ----a-w C:\WINDOWS\system32\win32k.sys
    2008-03-05 13:03 479,752 ----a-w C:\WINDOWS\system32\XAudio2_0.dll
    2008-03-05 13:03 238,088 ----a-w C:\WINDOWS\system32\xactengine3_0.dll
    2008-03-05 13:00 25,608 ----a-w C:\WINDOWS\system32\X3DAudio1_3.dll
    2008-03-05 12:56 3,786,760 ----a-w C:\WINDOWS\system32\D3DX9_37.dll
    2008-03-05 12:56 1,420,824 ----a-w C:\WINDOWS\system32\D3DCompiler_37.dll
    2007-12-09 11:21 22,328 ------w C:\Documents and Settings\Topi Heikkilä\Application Data\PnkBstrK.sys
    2006-06-23 06:48 32,768 ------r C:\WINDOWS\inf\UpdateUSB.exe
    .

    (((((((((((((((((((((((((((((( Rekisterin käynnistyskohteet )))))))))))))))))))))))))))))))))))))))))))))
    .
    .
    REGEDIT4
    *Huom* Tyhjiä arvoja ja laillisia oletusarvoja ei näytetä

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
    "{AD6E6555-FB2C-47D4-8339-3E2965509877}"= "C:\PROGRA~1\TerraTec\TERRAT~1\THCDES~1.DLL" [2007-11-07 11:20 527360]

    [HKEY_CLASSES_ROOT\clsid\{ad6e6555-fb2c-47d4-8339-3e2965509877}]

    [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "CTFMON.EXE"="C:\WINDOWS\system32\ctfmon.exe" [2004-09-14 16:12 15360]
    "BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe" [2007-06-01 11:21 153136]
    "Steam"="D:\Pelit\HalfLife2\\Steam.exe" [2008-03-28 12:29 1271032]
    "MSMSGS"="C:\Program Files\Messenger\msmsgs.exe" [2004-10-13 19:24 1694208]
    "msnmsgr"="C:\Program Files\Windows Live\Messenger\MsnMsgr.exe" [2007-10-18 11:34 5724184]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "SoundMAXPnP"="C:\Program Files\Analog Devices\Core\smax4pnp.exe" [2006-12-18 16:34 868352]
    "WinampAgent"="C:\Program Files\Winamp\winampa.exe" [2007-12-20 18:16 37376]
    "avast!"="C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe" [2008-05-16 02:19 79224]
    "Kernel and Hardware Abstraction Layer"="KHALMNPR.EXE" [2007-04-11 16:32 56080 C:\WINDOWS\KHALMNPR.Exe]
    "Launch LGDCore"="C:\Program Files\Logitech\G-series Software\LGDCore.exe" [2006-03-06 18:31 1122304]
    "Launch LCDMon"="C:\Program Files\Logitech\G-series Software\LCDMon.exe" [2006-03-06 18:14 497152]
    "TerraTec Remote Control"="C:\Program Files\Common Files\TerraTec\Remote\TTTvRc.exe" [2007-11-23 16:46 1097728]
    "NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2008-05-02 22:46 13529088]
    "nwiz"="nwiz.exe" [2008-05-02 22:46 1630208 C:\WINDOWS\system32\nwiz.exe]
    "iTunesHelper"="F:\Ohjelmia\iTunes\iTunesHelper.exe" [2008-02-19 14:10 267048]
    "NvMediaCenter"="C:\WINDOWS\system32\NvMcTray.dll" [2008-05-02 22:46 86016]

    [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
    "CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2004-09-14 16:12 15360]

    C:\Documents and Settings\Topi Heikkil„\K„ynnist„-valikko\Ohjelmat\K„ynnistys\
    hamachi.lnk - F:\Hamachi\hamachi.exe [2008-01-27 22:20:18 624416]
    OpenOffice.org 2.3.lnk - C:\Program Files\OpenOffice.org 2.3\program\quickstart.exe [2007-08-17 21:57:56 393216]

    C:\Documents and Settings\All Users\K„ynnist„-valikko\Ohjelmat\K„ynnistys\
    APC UPS Status.lnk - C:\Program Files\APC\APC PowerChute Personal Edition\Display.exe [2007-11-28 01:32:42 221247]
    Logitech Desktop Messenger.lnk - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe [2007-11-29 02:03:59 67128]
    Logitech SetPoint.lnk - C:\Program Files\Logitech\SetPoint\SetPoint.exe [2007-11-29 02:02:13 692224]
    Microsoft Office.lnk - C:\Program Files\Microsoft Office\Office10\OSA.EXE [2001-02-13 02:01:04 83360]
    Service Manager.lnk - C:\Program Files\Microsoft SQL Server\80\Tools\Binn\sqlmangr.exe [2000-08-06 02:03:20 69632]
    ZyXEL G-302 v3 Utility.lnk - C:\Program Files\ZyXEL\G-302v3\G-302v3.exe [2007-11-28 19:35:34 12894720]

    [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
    "vidc.asv2"= asusasv2.dll
    "VIDC.YV12"= yv12vfw.dll

    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WdfLoadGroup]
    @=""

    [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
    "%windir%\\system32\\sessmgr.exe"=
    "C:\\Program Files\\uTorrent\\uTorrent.exe"=
    "C:\\Program Files\\TerraTec\\TerraTec Home Cinema\\CinergyDvrHelper.exe"=
    "C:\\Program Files\\TerraTec\\TerraTec Home Cinema\\tvtvSetup\\tvtv_Wizard.exe"=
    "C:\\Program Files\\TerraTec\\TerraTec Home Cinema\\CinergyDvr.exe"=
    "C:\\Program Files\\TerraTec\\TerraTec Home Cinema\\CinergyDvrUpdate\\CinergyDvrUp_date.exe"=
    "D:\\Pelit\\WoW\\World of Warcraft\\WoW-2.3.0-enGB-downloader.exe"=
    "D:\\Pelit\\WoW\\World of Warcraft\\Launcher.exe"=
    "C:\\Program Files\\Alwil Software\\Avast4\\ashAvast.exe"=
    "D:\\Pelit\\HalfLife2\\Steam.exe"=
    "C:\\Program Files\\ZyXEL\\G-302v3\\G-302v3.exe"=
    "C:\\Program Files\\APC\\APC PowerChute Personal Edition\\PowerChute.exe"=
    "C:\\Program Files\\Logitech\\Desktop Messenger\\8876480\\Program\\LogitechDesktopMessenger.exe"=
    "C:\\Program Files\\mIRC\\mirc.exe"=
    "D:\\Pelit\\HalfLife2\\SteamApps\\kungfutse\\counter-strike source\\hl2.exe"=
    "D:\\Pelit\\HalfLife2\\SteamApps\\kungfutse\\half-life 2 deathmatch\\hl2.exe"=
    "C:\\Program Files\\GameSpy Arcade\\Aphex.exe"=
    "C:\\WINDOWS\\system32\\PnkBstrA.exe"=
    "C:\\WINDOWS\\system32\\PnkBstrB.exe"=
    "C:\\Program Files\\AdventNet\\ME\\AppManager8\\working\\jre\\bin\\javaw.exe"=
    "C:\\Program Files\\AdventNet\\ME\\AppManager8\\working\\mysql\\bin\\mysqld-nt.exe"=
    "C:\\Program Files\\AdventNet\\ME\\AppManager8\\working\\jre\\bin\\rmiregistry.exe"=
    "F:\\FlatOut 2\\FlatOut2.exe"=
    "F:\\Hamachi\\hamachi.exe"=
    "C:\\Program Files\\Microsoft Office\\Office12\\ONENOTE.EXE"=
    "F:\\Ohjelmia\\iTunes\\iTunes.exe"=
    "F:\\Wc3\\Warcraft III\\Frozen Throne.exe"=
    "D:\\Pelit\\Diablo II\\Diablo II\\Diablo II.exe"=
    "C:\\Program Files\\Bonjour\\mDNSResponder.exe"=
    "D:\\Pelit\\WoW\\World of Warcraft\\BackgroundDownloader.exe"=
    "F:\\Wc3\\Warcraft III\\Warcraft III.exe"=
    "C:\\Program Files\\Messenger\\msmsgs.exe"=
    "C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
    "C:\\Program Files\\Windows Live\\Messenger\\livecall.exe"=

    [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
    "3724:TCP"= 3724:TCP:Blizzard Downloader: 3724

    R1 aswSP;avast! Self Protection;C:\WINDOWS\system32\drivers\aswSP.sys [2008-05-16 02:20]
    R2 aswFsBlk;aswFsBlk;C:\WINDOWS\system32\DRIVERS\aswFsBlk.sys [2008-05-16 02:16]
    S3 asusgsb;ASUS Virtual Video Capture Device Driver;C:\WINDOWS\system32\drivers\asusgsb.sys [2007-07-12 11:03]
    S3 ASUSVRC;ASUSTeK Virtual Capture Device;C:\WINDOWS\system32\DRIVERS\AsusVRC.sys [2007-01-29 18:12]
    S3 mod7700;Cinergy DT USB XS Diversity Capture Service;C:\WINDOWS\system32\DRIVERS\mod7700.sys [2007-10-03 17:21]
    S3 MODRC;Cinergy DT USB XS Diversity IR Service;C:\WINDOWS\system32\DRIVERS\modrc.sys [2007-07-11 11:06]
    S3 SjyPkt;SjyPkt;C:\WINDOWS\System32\Drivers\SjyPkt.sys [2002-10-02 12:57]
    S3 UltraMonMirror;UltraMonMirror;C:\WINDOWS\system32\DRIVERS\UltraMonMirror.sys []
    S3 Video3D;ASUS Video3D Service;C:\WINDOWS\system32\Drivers\Video3D32.sys []

    .
    **************************************************************************

    catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
    Rootkit scan 2008-06-02 09:48:56
    Windows 5.1.2600 Service Pack 2 NTFS

    scanning hidden processes ...

    scanning hidden autostart entries ...

    scanning hidden files ...

    scan completed successfully
    hidden files: 0

    **************************************************************************

    Ja sitten vielä hjt - loki:

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
    C:\Program Files\Alwil Software\Avast4\ashServ.exe
    C:\WINDOWS\system32\spoolsv.exe
    C:\Program Files\APC\APC PowerChute Personal Edition\mainserv.exe
    C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
    C:\Program Files\Bonjour\mDNSResponder.exe
    C:\Program Files\Analog Devices\Core\smax4pnp.exe
    C:\Program Files\Winamp\winampa.exe
    C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
    C:\Program Files\Microsoft SQL Server\MSSQL\Binn\sqlservr.exe
    C:\Program Files\Logitech\G-series Software\LGDCore.exe
    C:\Program Files\Logitech\G-series Software\LCDMon.exe
    C:\Program Files\Common Files\TerraTec\Remote\TTTvRc.exe
    F:\Ohjelmia\iTunes\iTunesHelper.exe
    C:\WINDOWS\system32\RUNDLL32.EXE
    C:\Program Files\Analog Devices\SoundMAX\smax4.exe
    C:\WINDOWS\system32\ctfmon.exe
    C:\Program Files\Logitech\G-series Software\Applets\LCDPop3\LCDPOP3.exe
    C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe
    C:\Program Files\Logitech\G-series Software\Applets\LCDMedia.exe
    C:\Program Files\Logitech\G-series Software\Applets\LCDClock.exe
    C:\WINDOWS\system32\rundll32.exe
    D:\Pelit\HalfLife2\Steam.exe
    C:\Program Files\Messenger\msmsgs.exe
    C:\WINDOWS\system32\nvsvc32.exe
    C:\WINDOWS\system32\PnkBstrA.exe
    C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe
    C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe
    C:\Program Files\Logitech\SetPoint\SetPoint.exe
    C:\Program Files\Microsoft SQL Server\80\Tools\Binn\sqlmangr.exe
    C:\Program Files\APC\APC PowerChute Personal Edition\apcsystray.exe
    F:\Hamachi\hamachi.exe
    C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
    C:\Program Files\OpenOffice.org 2.3\program\soffice.exe
    C:\Program Files\Common Files\Logitech\KhalShared\KHALMNPR.EXE
    C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
    C:\Program Files\OpenOffice.org 2.3\program\soffice.BIN
    C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe
    C:\Program Files\Common Files\Ahead\Lib\NMIndexStoreSvr.exe
    C:\Program Files\iPod\bin\iPodService.exe
    C:\Program Files\Windows Live\Messenger\usnsvc.exe
    C:\WINDOWS\system32\notepad.exe
    C:\WINDOWS\explorer.exe
    C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
    C:\WINDOWS\system32\NOTEPAD.EXE

    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.fi/
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
    R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
    R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Linkit
    O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
    O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
    O2 - BHO: Windows Liven kirjautumisapuohjelma - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
    O3 - Toolbar: &TerraTec Home Cinema - {AD6E6555-FB2C-47D4-8339-3E2965509877} - C:\PROGRA~1\TerraTec\TERRAT~1\THCDES~1.DLL
    O4 - HKLM\..\Run: [SoundMAXPnP] C:\Program Files\Analog Devices\Core\smax4pnp.exe
    O4 - HKLM\..\Run: [WinampAgent] "C:\Program Files\Winamp\winampa.exe"
    O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
    O4 - HKLM\..\Run: [Kernel and Hardware Abstraction Layer] KHALMNPR.EXE
    O4 - HKLM\..\Run: [Launch LGDCore] "C:\Program Files\Logitech\G-series Software\LGDCore.exe" /SHOWHIDE
    O4 - HKLM\..\Run: [Launch LCDMon] "C:\Program Files\Logitech\G-series Software\LCDMon.exe"
    O4 - HKLM\..\Run: [TerraTec Remote Control] "C:\Program Files\Common Files\TerraTec\Remote\TTTvRc.exe"
    O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
    O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
    O4 - HKLM\..\Run: [iTunesHelper] "F:\Ohjelmia\iTunes\iTunesHelper.exe"
    O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
    O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
    O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe"
    O4 - HKCU\..\Run: [Steam] D:\Pelit\HalfLife2\\Steam.exe -silent
    O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
    O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background
    O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Paikallinen palve')
    O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Verkkopalve')
    O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
    O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
    O4 - Startup: hamachi.lnk = F:\Hamachi\hamachi.exe
    O4 - Startup: OpenOffice.org 2.3.lnk = C:\Program Files\OpenOffice.org 2.3\program\quickstart.exe
    O4 - Global Startup: APC UPS Status.lnk = ?
    O4 - Global Startup: Logitech Desktop Messenger.lnk = C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe
    O4 - Global Startup: Logitech SetPoint.lnk = C:\Program Files\Logitech\SetPoint\SetPoint.exe
    O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
    O4 - Global Startup: Service Manager.lnk = C:\Program Files\Microsoft SQL Server\80\Tools\Binn\sqlmangr.exe
    O4 - Global Startup: ZyXEL G-302 v3 Utility.lnk = C:\Program Files\ZyXEL\G-302v3\G-302v3.exe
    O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
    O8 - Extra context menu item: V&ie Microsoft Exceliin - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
    O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
    O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
    O9 - Extra button: Lähetä OneNoteen - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
    O9 - Extra 'Tools' menuitem: Läh&etä OneNoteen - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
    O9 - Extra button: Bonjour - {7F9DB11C-E358-4ca6-A83D-ACC663939424} - C:\Program Files\Bonjour\ExplorerPlugin.dll
    O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O16 - DPF: {20A60F0D-9AFA-4515-A0FD-83BD84642501} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab56986.cab
    O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
    O18 - Protocol: bwfile-8876480 - {9462A756-7B47-47BC-8C80-C34B9B80B32B} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\GAPlugProtocol-8876480.dll
    O23 - Service: APC UPS Service - American Power Conversion Corporation - C:\Program Files\APC\APC PowerChute Personal Edition\mainserv.exe
    O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
    O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
    O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
    O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
    O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
    O23 - Service: Bonjour-palvelu (Bonjour Service) - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
    O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
    O23 - Service: iPod-palvelu (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
    O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe
    O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe
    O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
    O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\system32\PnkBstrA.exe

    --
    End of file - 9467 bytes

    Kiitos sille joka viitsii tarkistaa.
     
    Topeelius, Jun 2, 2008
    #1
Thread Status:
Not open for further replies.

Share This Page