|
|
|
Keskustelualueet
Keskustelualueet
|
|
|
HJT logi --pientä ongelmaa...
|
|
|
etzka326
Senior Member
|
3. toukokuuta 2008 @ 18:14 |
Linkki tähän viestiin
|
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 18:13:26, on 3.5.2008
Platform: Windows Vista SP1 (WinNT 6.00.1905)
MSIE: Internet Explorer v7.00 (7.00.6001.18000)
Boot mode: Normal
Running processes:
C:\Windows\system32\Dwm.exe
C:\Windows\system32\taskeng.exe
C:\Windows\Explorer.EXE
C:\Windows\RtHDVCpl.exe
C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe
C:\Program Files\Grisoft\AVG7\avgcc.exe
C:\Windows\System32\rundll32.exe
C:\Windows\ehome\ehtray.exe
C:\Program Files\Windows Media Player\wmpnscfg.exe
C:\Windows\System32\rundll32.exe
C:\Windows\ehome\ehmsas.exe
C:\Windows\System32\mobsync.exe
C:\Program Files\Internet Explorer\ieuser.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLLoginProxy.exe
C:\Windows\system32\Macromed\Flash\FlashUtil9e.exe
C:\Windows\system32\conime.exe
C:\Program Files\Windows Live\Messenger\msnmsgr.exe
T:\Program Files\Trend Micro\HijackThis\HijackThis.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.fi/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = localhost
O2 - BHO: Adobe PDF Reader -linkkiavustaja - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Windows Liven kirjautumisapuohjelma - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Windows Live Toolbar Helper - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
O3 - Toolbar: Windows Live Toolbar - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
O4 - HKLM\..\Run: [RtHDVCpl] RtHDVCpl.exe
O4 - HKLM\..\Run: [recinfo919] c:\RecInfo\RecInfo.exe
O4 - HKLM\..\Run: [F-Secure TNB] "E:\Program Files\Sonera Tietoturva\FSGUI\TNBUtil.exe" /CHECKALL /WAITFORSW
O4 - HKLM\..\Run: [amd_dc_opt] C:\Program Files\AMD\Dual-Core Optimizer\amd_dc_opt.exe
O4 - HKLM\..\Run: [MSConfig] "C:\Windows\system32\msconfig.exe" /auto
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe"
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVG7\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [Skytel] Skytel.exe
O4 - HKLM\..\Run: [NvSvc] RUNDLL32.EXE C:\Windows\system32\nvsvc.dll,nvsvcStart
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\Windows\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\Windows\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [CamWizard] C:\Program Files\Common Files\Logitech\QCDRV\BIN\CamWizrd.exe
O4 - HKCU\..\Run: [ehTray.exe] C:\Windows\ehome\ehTray.exe
O4 - HKCU\..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe
O4 - HKUS\S-1-5-18\..\Run: [Nokia.PCSync] "C:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe" /NoDialog (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [Nokia.PCSync] "C:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe" /NoDialog (User 'Default user')
O4 - Startup: Adobe Gamma.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O8 - Extra context menu item: &Windows Live Search - res://C:\Program Files\Windows Live Toolbar\msntb.dll/search.htm
O8 - Extra context menu item: V&ie Microsoft Exceliin - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra button: Lähetä OneNoteen - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: Läh&etä OneNoteen - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search && Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O13 - Gopher Prefix:
O16 - DPF: {39B0684F-D7BF-4743-B050-FDC3F48F7E3B} (CDownloadCtrl Object) - http://www.fileplanet.com/fpdlmgr/cabs/FPDC_2.3.6.108.cab
O16 - DPF: {67DABFBF-D0AB-41FA-9C46-CC0F21721616} (DivXBrowserPlugin Object) - http://download.divx.com/player/DivXBrowserPlugin.cab
O16 - DPF: {74DBCB52-F298-4110-951D-AD2FF67BC8AB} (NVIDIA Smart Scan) - http://www.nvidia.com/content/DriverDown...iaSmartScan.cab
O16 - DPF: {BDBDE413-7B1C-4C68-A8FF-C5B2B4090876} (F-Secure Online Scanner 3.3) - http://support.f-secure.com/ols/fscax.cab
O20 - Winlogon Notify: avgwlntf - C:\Windows\SYSTEM32\avgwlntf.dll
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
O23 - Service: AVG7 Resident Shield Service (AvgCoreSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgrssvc.exe
O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
O23 - Service: PnkBstrA - Unknown owner - C:\Windows\system32\PnkBstrA.exe
O23 - Service: ServiceLayer - Nokia. - C:\Program Files\PC Connectivity Solution\ServiceLayer.exe
O23 - Service: Fujitsu Siemens Computers Diagnostic Testhandler (TestHandler) - Fujitsu Siemens Computers - C:\firststeps\OnlineDiagnostic\TestManager\TestHandler.exe
--
End of file - 6923 bytes
|
|
Hujo
Suspended permanently
|
4. toukokuuta 2008 @ 11:38 |
Linkki tähän viestiin
|
1.Lataa combofix.exe työpöydällesi yhdestä linkistä:
combofix1
combofix2
2. Tuplaklikkaa combofix.exe tiedostoa ja seuraa ohjeistuksia.
3. Kun työkalu on valmis, se tuottaa lokin. Lähetä tämä loki viesti ketjuusi.
Huom! Älä klikkaile combofixin ikkunaa käytön aikana. Tämä saattaa aiheuttaa ohjelman jumiutumisen.
=========
Lataa Malwarebytes' Anti-Malware työpöydällesi.
1. Tuplaklikkaa mbam-setup.exe ja seuraa ohjeita asentaaksesi ohjelman.
2. Lopuksi varmistu, että seuraavat on valittu: Update Malwarebytes', Anti-Malwareja
Launch Malwarebytes' Anti-Malware ja sen jälkeen klikkaaFinish.
3. Jos päivitys löytyy. ohjelma lataa ja asentaa uusimman version.
4. Kun ohjelma on latautunut, valitse Perform full scan ja klikkaa Scan.
5. Kun skanni on valmis, klikkaa OK ja sitten Show Results nähdäksesi tulokset.
6. Varmistu, että kaikki on merkitty ja klikkaa Remove Selected.
7. Tämän jälkeen loki avautuu muistioon. Tallenna se paikkaan, josta löydät sen helposti. Loki
löytyy myös täältä: C:\Documents and Settings\Käyttäjänimi\Application
Data\Malwarebytes\Malwarebytes' Anti-Malware\Logs\log-päiväys.txt
8. Lähetä lokin sisältö seuraavassa viestissäsi.
Voiko tietsikka koskaan toimia?
|
|
etzka326
Senior Member
|
4. toukokuuta 2008 @ 13:05 |
Linkki tähän viestiin
|
Tässä ensin COMBO LOGI:ComboFix 08-05-01.3 - Ezka 2008-05-04 12:51:51.2 - NTFSx86
Microsoft® Windows Vista? Home Premium 6.0.6001.1.1252.1.1035.18.2084 [GMT 3:00]
Running from: C:\Users\Ezka\Desktop\ComboFix.exe
* Created a new restore point
.
((((( Tiedostot, jotka on luotu seuraavalla aikavälillä: 2008-04-04 to 2008-05-04 )))))))))))))))))
.
2008-05-04 12:49 . 2008-05-04 12:49 <KANSIO> d-------- C:\Users\All Users\Malwarebytes
2008-05-04 12:49 . 2008-05-04 12:49 <KANSIO> d-------- C:\ProgramData\Malwarebytes
2008-05-04 12:49 . 2008-05-04 12:49 <KANSIO> d-------- C:\Program Files\Malwarebytes' Anti-Malware
2008-05-03 15:06 . 2008-05-03 15:06 39 --a------ C:\Windows\WININIT.INI
2008-05-03 15:04 . 2008-05-03 15:04 <KANSIO> d-------- C:\Program Files\Microsoft CAPICOM 2.1.0.2
2008-05-03 14:08 . 2005-05-27 10:01 53,248 -ra------ C:\Windows\System32\InstMed.exe
2008-05-03 14:07 . 1999-04-23 22:22 933,888 --a------ C:\Windows\System32\MFC44a29.rra
2008-05-03 13:47 . 2008-05-03 15:07 <KANSIO> d-------- C:\Program Files\Logitech
2008-05-03 13:47 . 1999-04-23 22:22 933,888 --a------ C:\Windows\System32\MFC413de.rra
2008-05-03 13:47 . 2008-05-03 13:47 81,920 --------- C:\Windows\bwUnin-6.1.4.68-8876480L.exe
2008-05-03 13:47 . 2003-03-18 21:44 65,536 --a------ C:\Windows\System32\MFC71DEU.DLL
2008-05-03 13:47 . 2003-03-18 21:44 61,440 --a------ C:\Windows\System32\MFC71ITA.DLL
2008-05-03 13:47 . 2003-03-18 21:44 61,440 --a------ C:\Windows\System32\MFC71ESP.DLL
2008-05-03 13:47 . 2003-03-18 21:44 57,344 --a------ C:\Windows\System32\MFC71ENU.DLL
2008-05-03 13:47 . 2003-03-18 21:44 49,152 --a------ C:\Windows\System32\MFC71KOR.DLL
2008-05-03 13:47 . 2003-03-18 21:44 49,152 --a------ C:\Windows\System32\MFC71JPN.DLL
2008-05-03 13:47 . 2003-03-18 21:44 45,056 --a------ C:\Windows\System32\MFC71CHT.DLL
2008-05-03 13:47 . 2003-03-18 21:44 40,960 --a------ C:\Windows\System32\MFC71CHS.DLL
2008-05-03 13:43 . 2005-05-27 12:23 2,180,096 --a------ C:\Windows\System32\drivers\lvsvf2.sys
2008-05-03 13:43 . 2005-05-27 12:32 1,317,152 --a------ C:\Windows\System32\drivers\lvcm.sys
2008-05-03 13:43 . 2005-05-27 12:36 372,736 --a------ C:\Windows\System32\LVUI2RC.dll
2008-05-03 13:43 . 2005-05-27 12:29 204,800 --a------ C:\Windows\System32\LVUI2.dll
2008-05-03 13:43 . 2005-05-27 12:26 204,800 --a------ C:\Windows\System32\lvcodec2.dll
2008-05-03 13:43 . 2005-05-27 12:19 106,496 --a------ C:\Windows\System32\lvcoinst.dll
2008-05-03 13:43 . 2005-05-27 12:31 22,016 --a------ C:\Windows\System32\drivers\LVUSBSta.sys
2008-05-03 13:43 . 2005-05-27 12:10 9,255 --a------ C:\Windows\System32\lvcoinst.ini
2008-05-03 11:18 . 2008-05-03 11:18 <KANSIO> d-------- C:\Program Files\directx
2008-05-02 19:39 . 2008-05-02 19:47 21,840 --a----t- C:\Windows\System32\SIntfNT.dll
2008-05-02 19:39 . 2008-05-02 19:47 17,212 --a----t- C:\Windows\System32\SIntf32.dll
2008-05-02 19:39 . 2008-05-02 19:47 12,067 --a----t- C:\Windows\System32\SIntf16.dll
2008-05-02 19:21 . 2008-05-03 09:46 <KANSIO> d-------- C:\Users\Ezka\AppData\Roaming\Hamachi
2008-05-02 19:21 . 2008-05-02 19:21 25,280 --a------ C:\Windows\System32\drivers\hamachi.sys
2008-05-01 20:27 . 2008-05-01 20:27 524,288 --ahs---- C:\Users\Vieras\NTUSER.DAT{50666d75-179e-11dd-bc2f-e9a0ab412266}.TMContainer00000000000000000002.regtrans-ms
2008-05-01 20:27 . 2008-05-04 12:51 524,288 --ahs---- C:\Users\Vieras\NTUSER.DAT{50666d75-179e-11dd-bc2f-e9a0ab412266}.TMContainer00000000000000000001.regtrans-ms
2008-05-01 20:27 . 2008-05-04 12:51 65,536 --ahs---- C:\Users\Vieras\NTUSER.DAT{50666d75-179e-11dd-bc2f-e9a0ab412266}.TM.blf
2008-05-01 11:10 . 2008-05-01 11:10 <KANSIO> d-------- C:\Users\Ezka\AppData\Roaming\Ubisoft
2008-05-01 11:10 . 2008-05-01 11:10 <KANSIO> d-------- C:\Users\All Users\Ubisoft
2008-05-01 11:10 . 2008-05-01 11:10 <KANSIO> d-------- C:\ProgramData\Ubisoft
2008-04-26 18:31 . 2008-04-26 18:31 <KANSIO> d-------- C:\Users\Aiti\AppData\Roaming\Talkback
2008-04-17 21:09 . 2008-04-17 21:09 0 --ah----- C:\Windows\System32\drivers\Msft_User_PCCSWpdDriver_01_05_00.Wdf
2008-04-17 21:08 . 2008-04-17 21:08 0 --ah----- C:\Windows\System32\drivers\Msft_Kernel_ccdcmb_01005.Wdf
2008-04-17 21:03 . 2008-04-17 21:03 <KANSIO> d-------- C:\Program Files\Common Files\PCSuite
2008-04-17 21:02 . 2008-04-17 21:02 <KANSIO> d----c--- C:\Windows\System32\DRVSTORE
2008-04-17 21:02 . 2008-04-17 21:02 <KANSIO> d-------- C:\Program Files\PC Connectivity Solution
2008-04-17 21:02 . 2007-09-17 15:53 21,632 --a------ C:\Windows\System32\drivers\pccsmcfd.sys
2008-04-17 14:16 . 2008-05-04 12:32 <KANSIO> d-------- C:\Users\All Users\TrackMania
2008-04-17 14:16 . 2008-05-04 12:32 <KANSIO> d-------- C:\ProgramData\TrackMania
2008-04-16 16:16 . 2008-04-16 16:16 0 --ah----- C:\Windows\System32\drivers\Msft_User_WpdFs_01_00_00.Wdf
2008-04-16 16:04 . 2008-04-16 16:04 <KANSIO> d-------- C:\PerfLogs
2008-04-16 15:44 . 2008-04-16 15:22 152,576 --a------ C:\Windows\System32\SPWizUI.dll
2008-04-16 15:44 . 2008-04-16 15:22 47,560 --a------ C:\Windows\System32\SPReview.exe
2008-04-16 15:31 . 2008-01-18 23:33 193,024 --a------ C:\Windows\System32\recdisc.exe
2008-04-16 15:31 . 2008-01-18 23:36 6,656 --a------ C:\Windows\System32\sdspres.dll
2008-04-16 15:30 . 2008-01-18 23:33 599,552 --a------ C:\Windows\System32\vsp1cln.exe
2008-04-16 15:30 . 2008-01-18 23:36 142,336 --a------ C:\Windows\System32\spp.dll
2008-04-16 15:30 . 2008-01-18 23:36 28,160 --a------ C:\Windows\System32\sxproxy.dll
2008-04-16 15:23 . 2008-01-18 23:33 44,032 --a------ C:\Windows\System32\cbsra.exe
2008-04-16 15:22 . 2008-04-16 15:22 <KANSIO> d-------- C:\9fc81d5d98f2850c41f166b216d04b2a
2008-04-16 15:22 . 2008-04-16 15:45 196,608 --a------ C:\Windows\SPInstall.etl
2008-04-13 16:37 . 2008-04-13 16:37 <KANSIO> d-------- C:\Users\Ezka\AppData\Roaming\fretsonfire
2008-04-12 20:02 . 2008-05-03 12:26 <KANSIO> d-------- C:\Users\Aiti\AppData\Roaming\AVG7
2008-04-09 18:19 . 2008-05-04 10:53 <KANSIO> d-------- C:\Users\Ezka\AppData\Roaming\AVG7
2008-04-09 18:19 . 2008-04-09 18:19 524,288 --ahs---- C:\Users\Vieras\NTUSER.DAT{ffaf4afa-0643-11dd-a08c-8ed7a34e3f66}.TMContainer00000000000000000002.regtrans-ms
2008-04-09 18:19 . 2008-05-01 20:27 524,288 --ahs---- C:\Users\Vieras\NTUSER.DAT{ffaf4afa-0643-11dd-a08c-8ed7a34e3f66}.TMContainer00000000000000000001.regtrans-ms
2008-04-09 18:19 . 2008-04-09 18:19 524,288 --ahs---- C:\Users\Aiti\NTUSER.DAT{ffaf4af8-0643-11dd-a08c-8ed7a34e3f66}.TMContainer00000000000000000002.regtrans-ms
2008-04-09 18:19 . 2008-05-04 12:51 524,288 --ahs---- C:\Users\Aiti\NTUSER.DAT{ffaf4af8-0643-11dd-a08c-8ed7a34e3f66}.TMContainer00000000000000000001.regtrans-ms
2008-04-09 18:19 . 2008-05-01 20:27 65,536 --ahs---- C:\Users\Vieras\NTUSER.DAT{ffaf4afa-0643-11dd-a08c-8ed7a34e3f66}.TM.blf
2008-04-09 18:19 . 2008-05-04 12:51 65,536 --ahs---- C:\Users\Aiti\NTUSER.DAT{ffaf4af8-0643-11dd-a08c-8ed7a34e3f66}.TM.blf
2008-04-09 18:18 . 2008-04-10 09:51 53,768 --a------ C:\Windows\System32\drivers\avgwfp.sys
2008-04-09 18:18 . 2008-04-09 18:18 9,216 --a------ C:\Windows\System32\avgwlntf.dll
2008-04-09 16:29 . 2008-04-09 16:29 524,288 --ahs---- C:\Users\Vieras\NTUSER.DAT{4810db0a-0635-11dd-a59d-b6dc96fc3366}.TMContainer00000000000000000002.regtrans-ms
2008-04-09 16:29 . 2008-04-09 16:29 524,288 --ahs---- C:\Users\Vieras\NTUSER.DAT{4810db0a-0635-11dd-a59d-b6dc96fc3366}.TMContainer00000000000000000001.regtrans-ms
2008-04-09 16:29 . 2008-04-09 16:29 65,536 --ahs---- C:\Users\Vieras\NTUSER.DAT{4810db0a-0635-11dd-a59d-b6dc96fc3366}.TM.blf
2008-04-07 18:39 . 2008-04-07 18:41 524,288 --ahs---- C:\Users\Aiti\NTUSER.DAT{68fef1f9-04b6-11dd-9d8e-ca7b4ee13579}.TMContainer00000000000000000002.regtrans-ms
2008-04-07 18:39 . 2008-04-07 18:41 524,288 --ahs---- C:\Users\Aiti\NTUSER.DAT{68fef1f9-04b6-11dd-9d8e-ca7b4ee13579}.TMContainer00000000000000000001.regtrans-ms
2008-04-07 18:39 . 2008-04-07 18:41 65,536 --ahs---- C:\Users\Aiti\NTUSER.DAT{68fef1f9-04b6-11dd-9d8e-ca7b4ee13579}.TM.blf
2008-04-07 14:25 . 2008-04-09 18:23 <KANSIO> d-------- C:\Users\All Users\Avg7
2008-04-07 14:25 . 2008-04-09 18:23 <KANSIO> d-------- C:\ProgramData\Avg7
2008-04-07 14:24 . 2008-04-07 14:25 524,288 --ahs---- C:\Users\Vieras\NTUSER.DAT{f95c19f8-045b-11dd-9cfc-c5f319b8f064}.TMContainer00000000000000000002.regtrans-ms
2008-04-07 14:24 . 2008-04-07 14:25 524,288 --ahs---- C:\Users\Vieras\NTUSER.DAT{f95c19f8-045b-11dd-9cfc-c5f319b8f064}.TMContainer00000000000000000001.regtrans-ms
2008-04-07 14:24 . 2008-04-07 14:25 524,288 --ahs---- C:\Users\Aiti\NTUSER.DAT{f95c19f4-045b-11dd-9cfc-c5f319b8f064}.TMContainer00000000000000000002.regtrans-ms
2008-04-07 14:24 . 2008-04-07 14:25 524,288 --ahs---- C:\Users\Aiti\NTUSER.DAT{f95c19f4-045b-11dd-9cfc-c5f319b8f064}.TMContainer00000000000000000001.regtrans-ms
2008-04-07 14:24 . 2008-04-07 14:25 65,536 --ahs---- C:\Users\Vieras\NTUSER.DAT{f95c19f8-045b-11dd-9cfc-c5f319b8f064}.TM.blf
2008-04-07 14:24 . 2008-04-07 14:25 65,536 --ahs---- C:\Users\Aiti\NTUSER.DAT{f95c19f4-045b-11dd-9cfc-c5f319b8f064}.TM.blf
2008-04-07 08:34 . 2008-04-29 15:30 <KANSIO> dr-h----- C:\$VAULT$.AVG
2008-04-07 07:54 . 2008-04-07 07:54 524,288 --ahs---- C:\Users\Vieras\NTUSER.DAT{f95c1908-045b-11dd-9cfc-c5f319b8f064}.TMContainer00000000000000000002.regtrans-ms
2008-04-07 07:54 . 2008-04-07 07:54 524,288 --ahs---- C:\Users\Vieras\NTUSER.DAT{f95c1908-045b-11dd-9cfc-c5f319b8f064}.TMContainer00000000000000000001.regtrans-ms
2008-04-07 07:54 . 2008-04-07 07:54 524,288 --ahs---- C:\Users\Aiti\NTUSER.DAT{f95c1904-045b-11dd-9cfc-c5f319b8f064}.TMContainer00000000000000000002.regtrans-ms
2008-04-07 07:54 . 2008-04-07 07:54 524,288 --ahs---- C:\Users\Aiti\NTUSER.DAT{f95c1904-045b-11dd-9cfc-c5f319b8f064}.TMContainer00000000000000000001.regtrans-ms
2008-04-07 07:54 . 2008-04-07 07:54 65,536 --ahs---- C:\Users\Vieras\NTUSER.DAT{f95c1908-045b-11dd-9cfc-c5f319b8f064}.TM.blf
2008-04-07 07:54 . 2008-04-07 07:54 65,536 --ahs---- C:\Users\Aiti\NTUSER.DAT{f95c1904-045b-11dd-9cfc-c5f319b8f064}.TM.blf
2008-04-06 19:08 . 2008-04-06 19:08 <KANSIO> d-------- C:\Program Files\Common Files\Logitech
2008-04-06 19:06 . 1998-10-29 17:45 306,688 --a------ C:\Windows\IsUninst.exe
2008-04-06 19:06 . 2008-05-03 15:31 2,112 --a------ C:\Windows\_delis32.ini
.
(((((((((((((((((((((((((((((((((((( Find3M-raportti ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-05-04 09:51 --------- d-----w C:\Users\Ezka\AppData\Roaming\uTorrent
2008-05-03 12:31 --------- d--h--w C:\Program Files\InstallShield Installation Information
2008-05-01 16:46 717,296 ----a-w C:\Windows\system32\drivers\sptd.sys
2008-04-30 13:09 --------- d-----w C:\Users\Ezka\AppData\Roaming\IGN_DLM
2008-04-27 10:59 --------- d-----w C:\Users\Ezka\AppData\Roaming\MP3Rocket
2008-04-27 07:35 --------- d---a-w C:\ProgramData\TEMP
2008-04-26 15:32 --------- d-----w C:\ProgramData\WLInstaller
2008-04-17 18:03 --------- d-----w C:\Program Files\Common Files\Nokia
2008-04-17 18:01 --------- d-----w C:\Program Files\Nokia
2008-04-17 18:00 --------- d-----w C:\ProgramData\Installations
2008-04-16 13:14 174 --sha-w C:\Program Files\desktop.ini
2008-04-16 13:08 --------- d-----w C:\Program Files\Windows Sidebar
2008-04-16 13:08 --------- d-----w C:\Program Files\Windows Photo Gallery
2008-04-16 13:08 --------- d-----w C:\Program Files\Windows Mail
2008-04-16 13:08 --------- d-----w C:\Program Files\Windows Journal
2008-04-16 13:08 --------- d-----w C:\Program Files\Windows Collaboration
2008-04-16 13:08 --------- d-----w C:\Program Files\Windows Calendar
2008-04-16 13:07 --------- d-----w C:\Program Files\Windows Defender
2008-04-16 13:03 --------- d-----w C:\ProgramData\NVIDIA
2008-04-16 12:49 82,432 ----a-w C:\Windows\System32\axaltocm.dll
2008-04-16 12:49 101,888 ----a-w C:\Windows\System32\ifxcardm.dll
2008-04-15 13:13 22,328 ----a-w C:\Windows\system32\drivers\PnkBstrK.sys
2008-04-15 13:12 107,832 ----a-w C:\Windows\System32\PnkBstrB.exe
2008-04-11 19:43 413,696 ----a-w C:\Windows\System32\wrap_oal.dll
2008-04-11 19:43 110,592 ----a-w C:\Windows\System32\OpenAL32.dll
2008-04-10 04:16 --------- d-----w C:\ProgramData\Microsoft Help
2008-04-09 15:18 --------- d-----w C:\ProgramData\Grisoft
2008-04-09 12:17 --------- d-----w C:\ProgramData\fssg
2008-04-05 08:49 --------- d-----w C:\Program Files\iolo
2008-04-05 08:48 --------- d-----w C:\ProgramData\iolo
2008-04-05 08:25 --------- d-----w C:\Program Files\Sonera
2008-03-28 18:07 --------- d-----w C:\Program Files\Java
2008-03-28 18:06 --------- d-----w C:\Program Files\Common Files\Java
2008-03-26 13:53 --------- d-----w C:\Users\Ezka\AppData\Roaming\Apple Computer
2008-03-26 13:47 --------- d-----w C:\Program Files\Safari
2008-03-26 13:39 --------- d-----w C:\Program Files\iTunes
2008-03-26 13:39 --------- d-----w C:\Program Files\iPod
2008-03-26 13:38 --------- d-----w C:\ProgramData\Apple Computer
2008-03-26 13:38 --------- d-----w C:\Program Files\QuickTime
2008-03-26 13:36 --------- d-----w C:\Program Files\Common Files\Apple
2008-03-25 13:42 --------- d-----w C:\Program Files\RivaTuner v2.08
2008-03-24 15:37 --------- d-----w C:\Program Files\Lavalys
2008-03-23 14:08 --------- d-----w C:\Users\Aiti\AppData\Roaming\vlc
2008-03-23 11:03 --------- d-----w C:\Users\Aiti\AppData\Roaming\DivX
2008-03-21 15:16 307,968 ----a-w C:\Windows\System32\TuneUpDefragService.exe
2008-03-21 15:15 --------- d-----w C:\Users\Ezka\AppData\Roaming\TuneUp Software
2008-03-21 15:15 --------- d-----w C:\ProgramData\TuneUp Software
2008-03-21 15:15 --------- d-----w C:\Program Files\TuneUp Utilities 2008
2008-03-21 15:11 --------- d-----w C:\Program Files\Common Files\Wise Installation Wizard
2008-03-18 13:25 --------- d-----w C:\Users\Ezka\AppData\Roaming\vlc
2008-03-18 13:18 --------- d-----w C:\Program Files\VideoLAN
2008-03-17 12:10 60,064 ----a-w C:\Windows\system32\drivers\fsdfw.sys
2008-03-15 12:44 --------- d-----w C:\Users\Ezka\AppData\Roaming\DivX
2008-03-15 12:42 --------- d-----w C:\Program Files\DivX
2008-03-15 12:42 --------- d-----w C:\Program Files\Common Files\PX Storage Engine
2008-03-12 14:27 --------- d-----w C:\Program Files\Microsoft Silverlight
2008-03-09 14:29 669,184 ----a-w C:\Windows\System32\pbsvc.exe
2008-03-09 14:29 22,328 ----a-w C:\Users\Ezka\AppData\Roaming\PnkBstrK.sys
2008-03-09 14:28 --------- d-----w C:\ProgramData\Media Center Programs
2008-03-09 11:50 --------- d-----w C:\Program Files\Common Files\Adobe
2008-03-08 19:37 --------- d-----w C:\Program Files\AMD
2008-03-08 18:31 --------- d-----w C:\Program Files\Google
2008-03-08 15:09 --------- d-----w C:\Users\Ezka\AppData\Roaming\InstallShield Installation Information
2008-03-08 15:06 --------- d-----w C:\Users\Ezka\AppData\Roaming\Microsoft Game Studios
2008-03-08 15:06 --------- d-----w C:\ProgramData\Microsoft Games
2008-03-08 15:06 --------- d-----w C:\Program Files\Microsoft Games
2008-03-07 14:33 66,872 ----a-w C:\Windows\System32\PnkBstrA.exe
2008-03-06 18:00 --------- d-----w C:\Program Files\FreeRIP3
2008-03-06 17:57 --------- d-----w C:\ProgramData\Spybot - Search & Destroy
2008-03-06 17:05 --------- d-----w C:\ProgramData\Lavasoft
2008-03-06 17:01 --------- d-----w C:\Program Files\Lavasoft
2008-03-06 16:58 --------- d-----w C:\Program Files\Spybot - Search & Destroy
2008-03-06 08:14 831,048 ----a-w C:\Windows\System32\WudfUpdate_01005.dll
2008-03-05 14:03 479,752 ----a-w C:\Windows\System32\XAudio2_0.dll
2008-03-05 14:03 238,088 ----a-w C:\Windows\System32\xactengine3_0.dll
2008-03-05 14:00 25,608 ----a-w C:\Windows\System32\X3DAudio1_3.dll
2008-03-05 13:56 3,786,760 ----a-w C:\Windows\System32\D3DX9_37.dll
2008-03-05 13:56 1,420,824 ----a-w C:\Windows\System32\D3DCompiler_37.dll
2008-03-04 16:16 53,248 ----a-w C:\Windows\System32\unrar.dll
2008-03-04 16:15 4,358,144 ----a-w C:\Windows\uncsetup.exe
2008-03-01 18:33 1,568,889 ----a-w C:\Users\Ezka\P-660HW-D1_3.40(AGL.4)C0.zip
2008-03-01 08:51 651,896 ----a-w C:\Users\Ezka\Metacafe4Windows.exe
2008-02-29 07:14 19,000 ----a-w C:\Windows\System32\kd1394.dll
2008-02-29 07:11 988,216 ----a-w C:\Windows\System32\winload.exe
2008-02-29 07:11 927,288 ----a-w C:\Windows\System32\winresume.exe
2008-02-29 06:53 46,592 ----a-w C:\Windows\System32\setbcdlocale.dll
2008-02-29 06:53 40,960 ----a-w C:\Windows\System32\srclient.dll
2008-02-29 06:53 378,368 ----a-w C:\Windows\System32\srcore.dll
2008-02-29 06:35 6,656 ----a-w C:\Windows\System32\kbd106n.dll
2008-02-29 04:21 2,032,128 ----a-w C:\Windows\System32\win32k.sys
2008-02-29 04:12 318,464 ----a-w C:\Windows\System32\rstrui.exe
2008-02-29 04:12 14,848 ----a-w C:\Windows\System32\srdelayed.exe
2008-02-27 11:15 28,416 ----a-w C:\Windows\System32\uxtuneup.dll
2008-02-27 11:15 16,640 ----a-w C:\Windows\System32\authuitu.dll
2008-02-22 05:05 615,992 ----a-w C:\Windows\System32\ci.dll
2008-02-22 05:01 826,880 ----a-w C:\Windows\System32\wininet.dll
2008-02-22 04:57 295,936 ----a-w C:\Windows\System32\gdi32.dll
2008-02-21 02:05 524,288 ----a-w C:\Windows\System32\DivXsm.exe
2008-02-21 02:05 3,596,288 ----a-w C:\Windows\System32\qt-dx331.dll
2008-02-21 02:05 200,704 ----a-w C:\Windows\System32\ssldivx.dll
.
(((((((((((((((((((((((((((((( Rekisterin käynnistyskohteet )))))))))))))))))))))))))))))))))))))))))))))
.
.
REGEDIT4
*Huom* Tyhjiä arvoja ja laillisia oletusarvoja ei näytetä
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ehTray.exe"="C:\Windows\ehome\ehTray.exe" [2008-01-18 23:33 125952]
"WMPNSCFG"="C:\Program Files\Windows Media Player\WMPNSCFG.exe" [2008-01-18 23:33 202240]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"RtHDVCpl"="RtHDVCpl.exe" [2007-10-01 12:53 4702208 C:\Windows\RtHDVCpl.exe]
"recinfo919"="c:\RecInfo\RecInfo.exe" [2007-10-23 15:52 2764800]
"F-Secure TNB"="E:\Program Files\Sonera Tietoturva\FSGUI\TNBUtil.exe" [ ]
"amd_dc_opt"="C:\Program Files\AMD\Dual-Core Optimizer\amd_dc_opt.exe" [2007-07-23 12:06 77824]
"MSConfig"="C:\Windows\system32\msconfig.exe" [2008-01-18 23:33 227840]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe" [2008-02-22 05:25 144784]
"AVG7_CC"="C:\PROGRA~1\Grisoft\AVG7\avgcc.exe" [2008-04-15 15:17 579584]
"Skytel"="Skytel.exe" [2007-08-03 14:22 1826816 C:\Windows\SkyTel.exe]
"NvSvc"="C:\Windows\system32\nvsvc.dll" [2008-03-04 12:02 92704]
"NvCplDaemon"="C:\Windows\system32\NvCpl.dll" [2008-03-04 12:02 8530464]
"NvMediaCenter"="C:\Windows\system32\NvMcTray.dll" [2008-03-04 12:02 88608]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"Nokia.PCSync"="C:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe" [2008-03-26 18:41 1232896]
"AVG7_Run"="C:\PROGRA~1\Grisoft\AVG7\avgw.exe" [2008-04-09 18:18 219136]
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"EnableUIADesktopToggle"= 0 (0x0)
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\avgwlntf]
avgwlntf.dll 2008-04-09 18:18 9216 C:\Windows\System32\avgwlntf.dll
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"VIDC.X264"= x264vfw.dll
"VIDC.3iv2"= 3ivxVfWCodec.dll
"VIDC.VP31"= vp31vfw.dll
"msacm.l3fhg"= mp3fhg.acm
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CamWizard]
--a------ 2005-05-13 16:42 184320 C:\Program Files\Common Files\Logitech\QCDRV\BIN\CamWizrd.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\igndlm.exe]
E:\Program Files\Download Manager\DLM.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper]
--a------ 2008-02-19 14:10 267048 C:\Program Files\iTunes\iTunesHelper.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck]
--a------ 2007-02-26 21:46 153136 C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PC Suite Tray]
E:\Program Files\Nokia\Nokia PC Suite 6\PCSuite.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
--a------ 2008-02-01 00:13 385024 C:\Program Files\QuickTime\QTTask.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Windows Defender]
--a------ 2008-01-18 23:38 1008184 C:\Program Files\Windows Defender\MSASCui.exe
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Svc\S-1-5-21-332621374-1900857233-3605568749-1000]
"EnableNotificationsRef"=dword:00000005
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\FirewallRules]
"{86CDBB66-BC8B-451D-8E6E-F474F38AC052}"= UDP:C:\Program Files\Microsoft Office\Office12\ONENOTE.EXE:Microsoft Office OneNote
"{D80FDAEC-251F-49B2-9463-2F58DC92E289}"= TCP:C:\Program Files\Microsoft Office\Office12\ONENOTE.EXE:Microsoft Office OneNote
"{A87687EC-A822-4CDD-8566-9B7A26094B8E}"= UDP:D:\PELIT\Electronic Arts\Crytek\Crysis SP Demo\Bin32\Crysis.exe:Crysis_32_sp_demo
"{D3F461DD-698A-4314-B755-6EDFDD6A6C33}"= TCP:D:\PELIT\Electronic Arts\Crytek\Crysis SP Demo\Bin32\Crysis.exe:Crysis_32_sp_demo
"{9FF213A0-2DD8-416D-814E-C0FAC2F79613}"= UDP:D:\PELIT\THQ\S.T.A.L.K.E.R. - Shadow of Chernobyl\bin\XR_3DA.exe:S.T.A.L.K.E.R. - Shadow of Chernobyl (CLI)
"{AD8AEA3C-D981-451D-9E24-325121AEBA6F}"= TCP:D:\PELIT\THQ\S.T.A.L.K.E.R. - Shadow of Chernobyl\bin\XR_3DA.exe:S.T.A.L.K.E.R. - Shadow of Chernobyl (CLI)
"{13FCD21A-1B21-41F8-A8FA-76B0681A292C}"= UDP:D:\PELIT\THQ\S.T.A.L.K.E.R. - Shadow of Chernobyl\bin\dedicated\XR_3DA.exe:S.T.A.L.K.E.R. - Shadow of Chernobyl (SRV)
"{0723B84C-B28A-4CC0-BB9E-40A98A444EDB}"= TCP:D:\PELIT\THQ\S.T.A.L.K.E.R. - Shadow of Chernobyl\bin\dedicated\XR_3DA.exe:S.T.A.L.K.E.R. - Shadow of Chernobyl (SRV)
"{AF3B243B-EF96-480A-B1A4-4182DB600B56}"= C:\Program Files\Windows Live\Messenger\livecall.exe:Windows Live Messenger (Phone)
"{E908A133-3CD0-4208-83E0-2870E074CFAB}"= UDP:D:\PELIT\EA GAMES\Battlefield 2\BF2.exe:Battlefield 2
"{FD98D057-7F81-43AB-BC89-8530754A1D1F}"= TCP:D:\PELIT\EA GAMES\Battlefield 2\BF2.exe:Battlefield 2
"{25762E4E-0AC8-411D-AC8C-A1133CEFE5E4}"= UDP:D:\PELIT\Unreal Tournament 3 Demo\Binaries\UT3Demo.exe:Unreal Tournament 3 Demo
"{C1778E0E-664C-4AE3-8FA2-E44F9ED122DB}"= TCP:D:\PELIT\Unreal Tournament 3 Demo\Binaries\UT3Demo.exe:Unreal Tournament 3 Demo
"{F2192CF2-C239-4D9C-886F-A1D634885803}"= UDP:16969:BitComet 16969 TCP
"{F60C91D4-9C45-448C-90A3-19B67C21C3ED}"= TCP:16969:BitComet 16969 UDP
"{78D3F9A3-AADE-4473-9E53-D680C3C8AE0F}"= UDP:9336:BitComet 9336 TCP
"{CE0AC8A1-0751-4703-8AF8-D6455D6F078E}"= TCP:9336:BitComet 9336 UDP
"TCP Query User{CBC9B237-E44B-42CA-B490-191ED9FCC79E}D:\\pelit\\america's army\\system\\armyops.exe"= UDP:D:\pelit\america's army\system\armyops.exe:ArmyOps
"UDP Query User{593DABF5-31F3-486D-8C5C-E0431D7ED99E}D:\\pelit\\america's army\\system\\armyops.exe"= TCP:D:\pelit\america's army\system\armyops.exe:ArmyOps
"TCP Query User{E9DE1D66-CA30-433B-B06E-1F6CA6AA169F}C:\\users\\ezka\\desktop\\utorrent.exe"= UDP:C:\users\ezka\desktop\utorrent.exe:utorrent.exe
"UDP Query User{4A8D2846-9545-4A26-8765-D52DD2E7DFA6}C:\\users\\ezka\\desktop\\utorrent.exe"= TCP:C:\users\ezka\desktop\utorrent.exe:utorrent.exe
"TCP Query User{8AB0AEEC-F8B4-4F70-B421-DCEDF0C26E7A}D:\\pelit\\steam\\steamapps\\etzka333\\half-life 2 deathmatch\\hl2.exe"= UDP:D:\pelit\steam\steamapps\etzka333\half-life 2 deathmatch\hl2.exe:hl2
"UDP Query User{3F71303D-C49F-4C95-9AED-43BB73C6707E}D:\\pelit\\steam\\steamapps\\etzka333\\half-life 2 deathmatch\\hl2.exe"= TCP:D:\pelit\steam\steamapps\etzka333\half-life 2 deathmatch\hl2.exe:hl2
"TCP Query User{84B04250-8A73-411B-B448-26C86D6A31A2}C:\\program files\\java\\jre1.6.0_03\\bin\\javaw.exe"= UDP:C:\program files\java\jre1.6.0_03\bin\javaw.exe:Java(TM) Platform SE binary
"UDP Query User{106968E6-3F62-454C-8F4B-557A796ED2D8}C:\\program files\\java\\jre1.6.0_03\\bin\\javaw.exe"= TCP:C:\program files\java\jre1.6.0_03\bin\javaw.exe:Java(TM) Platform SE binary
"{A292E65D-B0A8-4817-A656-9B772F390EA5}"= UDP:C:\Program Files\Messenger\Msmsgs.exe:Windows Messenger
"{01A8ABD7-8EFB-43CC-9AB9-40513F8670CD}"= TCP:C:\Program Files\Messenger\Msmsgs.exe:Windows Messenger
"{F55229CF-F5E8-4B83-9218-582F6369391B}"= C:\Program Files\Windows Live\Messenger\livecall.exe:Windows Live Messenger (Phone)
"{D280E26C-F92B-4800-A8FE-B97974516923}"= UDP:C:\Windows\System32\PnkBstrA.exe:PnkBstrA
"{C38041B1-03C4-442B-BE6D-9997666F1D7E}"= TCP:C:\Windows\System32\PnkBstrA.exe:PnkBstrA
"{CE884FC8-A62C-468D-9710-164880807A4B}"= UDP:C:\Windows\System32\PnkBstrB.exe:PnkBstrB
"{74836543-086D-49E6-88B8-7B35AF37DE49}"= TCP:C:\Windows\System32\PnkBstrB.exe:PnkBstrB
"{865AEDD1-7503-4801-9D71-A8BEC0447EDF}"= UDP:D:\PELIT\Electronic Arts\Crytek\Crysis\Bin32\Crysis.exe:Crysis_32
"{CEAB9948-E3A6-4103-8A57-AFFB9DC2AE1A}"= TCP:D:\PELIT\Electronic Arts\Crytek\Crysis\Bin32\Crysis.exe:Crysis_32
"{7E00EC66-82C5-4A61-BE92-034112BF7158}"= UDP:D:\PELIT\Electronic Arts\Crytek\Crysis\Bin32\CrysisDedicatedServer.exe:CrysisDedicatedServer_32
"{BC506A33-0C58-455E-92A5-DA2A4707832C}"= TCP:D:\PELIT\Electronic Arts\Crytek\Crysis\Bin32\CrysisDedicatedServer.exe:CrysisDedicatedServer_32
"{31D4E799-D7CF-4024-A938-20064E9D6C0F}"= UDP:C:\Program Files\iTunes\iTunes.exe:iTunes
"{CE9C6782-7771-4ECE-B2CA-20F488220B26}"= TCP:C:\Program Files\iTunes\iTunes.exe:iTunes
"{6502CC3C-CED2-4C8B-B033-78A9F7B879A2}"= UDP:32459:utorrent
"{0B6A2D11-2CBE-4267-8858-1F611C390FD0}"= UDP:C:\Windows\System32\wuapp.exe:wuapp
"{97C7A4EE-30DA-4666-B0AB-8F187B305EA9}"= TCP:C:\Windows\System32\wuapp.exe:wuapp
"{DF0E2772-7757-4A7E-BD30-205388824C1B}"= UDP:C:\Users\Ezka\Program Files\uTorrent\uTorrent.exe:µTorrent
"{2C6BDEF8-5844-4279-9F24-851FAB7B0C2F}"= TCP:C:\Users\Ezka\Program Files\uTorrent\uTorrent.exe:µTorrent
"TCP Query User{213B5FD8-DE0C-465B-98AB-CF502338C0B9}T:\\pelit\\microsoft games\\age of empires ii\\age2_x1\\age2_x1.exe"= UDP:T:\pelit\microsoft games\age of empires ii\age2_x1\age2_x1.exe:Age of Empires II Expansion
"UDP Query User{880802C2-5CD6-441F-8EC3-3132A2FF2377}T:\\pelit\\microsoft games\\age of empires ii\\age2_x1\\age2_x1.exe"= TCP:T:\pelit\microsoft games\age of empires ii\age2_x1\age2_x1.exe:Age of Empires II Expansion
"TCP Query User{08187B8D-CE37-4A08-AF72-635B0E9E7CC3}C:\\program files\\internet explorer\\iexplore.exe"= UDP:C:\program files\internet explorer\iexplore.exe:Internet Explorer
"UDP Query User{9197BCD7-3D0F-4236-9657-CB11F0D41F75}C:\\program files\\internet explorer\\iexplore.exe"= TCP:C:\program files\internet explorer\iexplore.exe:Internet Explorer
"TCP Query User{0FB71936-76BB-407A-8B61-34BE93ED76DE}D:\\pelit\\sierra\\fearcombat\\fpupdate.exe"= UDP:D:\pelit\sierra\fearcombat\fpupdate.exe:fpupdate
"UDP Query User{4B871549-95D5-4773-958E-909332145F91}D:\\pelit\\sierra\\fearcombat\\fpupdate.exe"= TCP:D:\pelit\sierra\fearcombat\fpupdate.exe:fpupdate
"{21A38AB3-C330-4456-A7D9-AA349470A362}"= UDP:D:\PELIT\Sierra\FEARCombat\FEARMP.exe:FEAR Combat
"{39042C6A-A823-4955-AAF1-9070B69DC0F7}"= TCP:D:\PELIT\Sierra\FEARCombat\FEARMP.exe:FEAR Combat
"TCP Query User{F25FF411-974D-41BC-BC04-7628006FD39C}L:\\microsoft games\\age of empires ii\\age2_x1\\age2_x1.exe"= UDP:L:\microsoft games\age of empires ii\age2_x1\age2_x1.exe:Age of Empires II Expansion
"UDP Query User{9EC3C728-B695-4E53-BA1E-A7F054644443}L:\\microsoft games\\age of empires ii\\age2_x1\\age2_x1.exe"= TCP:L:\microsoft games\age of empires ii\age2_x1\age2_x1.exe:Age of Empires II Expansion
"TCP Query User{5CE3A08C-C210-4C42-9B07-9663A7422F79}D:\\pelit\\tmnationsforever\\tmforever.exe"= UDP:D:\pelit\tmnationsforever\tmforever.exe:TmForever
"UDP Query User{A320AF7B-E514-4038-8E8B-7BE7642F33E1}D:\\pelit\\tmnationsforever\\tmforever.exe"= TCP:D:\pelit\tmnationsforever\tmforever.exe:TmForever
"{97CDFF95-ABCD-4317-AC01-640FF715F771}"= C:\Program Files\Windows Live\Messenger\livecall.exe:Windows Live Messenger (Phone)
"TCP Query User{D844A791-2BC3-483D-BDCE-BB5C9A3712DC}C:\\users\\ezka\\desktop\\wow-2.4.1.8125-to-0.4.2.8209-engb-downloader.exe"= UDP:C:\users\ezka\desktop\wow-2.4.1.8125-to-0.4.2.8209-engb-downloader.exe:wow-2.4.1.8125-to-0.4.2.8209-engb-downloader.exe
"UDP Query User{98792957-0710-43DC-86E1-BE558330B851}C:\\users\\ezka\\desktop\\wow-2.4.1.8125-to-0.4.2.8209-engb-downloader.exe"= TCP:C:\users\ezka\desktop\wow-2.4.1.8125-to-0.4.2.8209-engb-downloader.exe:wow-2.4.1.8125-to-0.4.2.8209-engb-downloader.exe
"TCP Query User{FAC8F833-9E81-4A66-8E21-416A03DCF711}C:\\program files\\java\\jre1.6.0_05\\bin\\javaw.exe"= UDP:C:\program files\java\jre1.6.0_05\bin\javaw.exe:Java(TM) Platform SE binary
"UDP Query User{8C108847-5AE6-48EB-86ED-0D325ECBAFBB}C:\\program files\\java\\jre1.6.0_05\\bin\\javaw.exe"= TCP:C:\program files\java\jre1.6.0_05\bin\javaw.exe:Java(TM) Platform SE binary
"TCP Query User{835E533E-B9F8-48D8-9A6C-351AA572497F}E:\\tmnationsforever\\tmforever.exe"= UDP:E:\tmnationsforever\tmforever.exe:TmForever
"UDP Query User{EA8A0FBD-6404-487E-AA4E-D580CADB8203}E:\\tmnationsforever\\tmforever.exe"= TCP:E:\tmnationsforever\tmforever.exe:TmForever
"TCP Query User{3C993BCF-4AFE-4663-9C06-C18F20E9B21C}D:\\pelit\\tmnationsforever\\tmforever.exe"= UDP:D:\pelit\tmnationsforever\tmforever.exe:TmForever
"UDP Query User{301A4CC0-DE78-4F5D-AC63-914A45A25C67}D:\\pelit\\tmnationsforever\\tmforever.exe"= TCP:D:\pelit\tmnationsforever\tmforever.exe:TmForever
"TCP Query User{4FE29F94-3F52-4C07-974F-ACA31B5D6A10}C:\\users\\ezka\\program files\\utorrent\\utorrent.exe"= UDP:C:\users\ezka\program files\utorrent\utorrent.exe:utorrent.exe
"UDP Query User{6954CE92-C733-4529-A18B-0BC296466BB4}C:\\users\\ezka\\program files\\utorrent\\utorrent.exe"= TCP:C:\users\ezka\program files\utorrent\utorrent.exe:utorrent.exe
"{56195B86-8837-4D4E-A496-08FCDC261641}"= UDP:6112:Utor2
"{ACB9EEEC-1092-4060-BAF0-C4CF3F7A0566}"= TCP:6112:Utor2
"TCP Query User{6F19102D-DF5E-4057-8D1F-A1385C9439A8}C:\\program files\\logitech\\desktop messenger\\8876480\\program\\backweb-8876480.exe"= UDP:C:\program files\logitech\desktop messenger\8876480\program\backweb-8876480.exe:Logitech Desktop Messenger
"UDP Query User{3D94E9FC-DF22-42A4-9071-43F9C81AC38F}C:\\program files\\logitech\\desktop messenger\\8876480\\program\\backweb-8876480.exe"= TCP:C:\program files\logitech\desktop messenger\8876480\program\backweb-8876480.exe:Logitech Desktop Messenger
"TCP Query User{DB3B61DB-1D6E-463B-B290-F5D14BEB50A0}C:\\program files\\java\\jre1.6.0_05\\bin\\javaw.exe"= UDP:C:\program files\java\jre1.6.0_05\bin\javaw.exe:Java(TM) Platform SE binary
"UDP Query User{6E154437-BAA0-4C3A-9749-8529BF743B5C}C:\\program files\\java\\jre1.6.0_05\\bin\\javaw.exe"= TCP:C:\program files\java\jre1.6.0_05\bin\javaw.exe:Java(TM) Platform SE binary
R0 AtiPcie;ATI PCI Express (3GIO) Filter;C:\Windows\system32\DRIVERS\AtiPcie.sys [2006-10-30 12:22]
R1 ElRawDisk;ElRawDisk;C:\Windows\system32\drivers\elrawdsk.sys [2007-09-20 14:12]
R1 FSES;F-Secure Email Scanning Driver;C:\Windows\system32\drivers\fses.sys [2007-04-26 20:08]
R2 TestHandler;Fujitsu Siemens Computers Diagnostic Testhandler;C:\firststeps\OnlineDiagnostic\TestManager\TestHandler.exe [2006-12-08 21:52]
R2 UxTuneUp;TuneUp Theme Extension;C:\Windows\System32\svchost.exe [2008-01-18 23:33]
R3 AvgWFP;AVG7 Firewall Driver x86;C:\Windows\system32\Drivers\avgwfp.sys [2008-04-10 09:51]
S3 ADM8511;USB To Fast Ethernet/ HomePNA Adapter;C:\Windows\system32\DRIVERS\NETUSB.SYS [2001-10-24 17:43]
S3 PCASp50;PCASp50 NDIS Protocol Driver;C:\Windows\system32\Drivers\PCASp50.sys [2004-05-17 09:15]
S3 pccsmcfd;PCCS Mode Change Filter Driver;C:\Windows\system32\DRIVERS\pccsmcfd.sys [2007-09-17 15:53]
S3 upperdev;upperdev;C:\Windows\system32\DRIVERS\usbser_lowerflt.sys [2007-11-29 10:39]
S3 UsbserFilt;UsbserFilt;C:\Windows\system32\DRIVERS\usbser_lowerfltj.sys [2007-11-29 10:39]
S4 nvrd32;NVIDIA nForce RAID Driver;C:\Windows\system32\drivers\nvrd32.sys [2007-07-02 18:37]
S4 Steam Client Service;Steam Client Service;C:\Program Files\Common Files\Steam\SteamService.exe [2008-03-02 13:20]
S4 TuneUp.Defrag;TuneUp Drive Defrag Service;C:\Windows\System32\TuneUpDefragService.exe [2008-03-21 18:16]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
bthsvcs REG_MULTI_SZ BthServ
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost - NetSvcs
UxTuneUp
.
'Ajoitetut tehtävät'-kansion sisältö
"2008-05-04 09:31:44 C:\Windows\Tasks\1-Click Maintenance.job"
- C:\Program Files\TuneUp Utilities 2008\OneClickStarter.exe
"2008-05-02 14:00:00 C:\Windows\Tasks\Scheduled scanning task.job"
- E:\PROGRA~1\SONERA~1\ANTI-V~1\fsav.exeQ /HARD /POLICY /SCHED /NOBREAK /REPORT=E:\PROGRA~1\SONERA~1\ANTI-V~1\report.txt
"2008-04-13 19:00:00 C:\Windows\Tasks\SmartDefrag.job"
- C:\Program Files\IObit\IObit SmartDefrag\schedule.exe
"2007-12-22 09:03:25 C:\Windows\Tasks\Tarkistetaan Windows Live -työkalurivin päivitykset.job"
- C:\Program Files\Windows Live Toolbar\MSNTBUP.EXE
.
**************************************************************************
catchme 0.3.1353 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-05-04 12:54:08
Windows 6.0.6001 Service Pack 1 NTFS
scanning hidden processes ...
scanning hidden autostart entries ...
scanning hidden files ...
scan completed successfully
hidden files: 0
**************************************************************************
.
Completion time: 2008-05-04 12:55:02
ComboFix-quarantined-files.txt 2008-05-04 09:54:53
ComboFix2.txt 2008-03-30 17:15:49
Pre-Run: 223,083,945,984 tavua vapaana
Post-Run: 223,043,407,872 tavua vapaana
371 --- E O F --- 2008-05-03 12:04:19
|
|
Hujo
Suspended permanently
|
4. toukokuuta 2008 @ 13:30 |
Linkki tähän viestiin
|
|
sitten Malwarebytes' Anti-Malware ajo
Voiko tietsikka koskaan toimia?
|
|
etzka326
Senior Member
|
4. toukokuuta 2008 @ 14:52 |
Linkki tähän viestiin
|
|
Malwarebytes' Anti-Malware 1.11
Tietokantaversio: 714
Tarkistustyyppi: Täysi tarkistus (C:\|D:\|T:\|)
Tarkistetut kohteet: 195648
Kulunut aika: 1 hour(s), 31 minute(s), 6 second(s)
Saastuneita muistiprosesseja: 0
Saastuneita muistimoduuleja: 0
Saastuneita rekisteriavaimia: 0
Saastuneita rekisteriarvoja: 0
Saastuneita rekisterikohteita: 0
Saastuneita hakemistoja: 0
Saastuneita tiedostoja: 0
Saastuneita muistiprosesseja:
(Haitallisia kohteita ei löydetty)
Saastuneita muistimoduuleja:
(Haitallisia kohteita ei löydetty)
Saastuneita rekisteriavaimia:
(Haitallisia kohteita ei löydetty)
Saastuneita rekisteriarvoja:
(Haitallisia kohteita ei löydetty)
Saastuneita rekisterikohteita:
(Haitallisia kohteita ei löydetty)
Saastuneita hakemistoja:
(Haitallisia kohteita ei löydetty)
Saastuneita tiedostoja:
(Haitallisia kohteita ei löydetty)
|
|
Hujo
Suspended permanently
|
4. toukokuuta 2008 @ 16:33 |
Linkki tähän viestiin
|
|
OK...
Voiko tietsikka koskaan toimia?
|
|
Mainos
|
|
|
|
etzka326
Senior Member
|
4. toukokuuta 2008 @ 17:37 |
Linkki tähän viestiin
|
|
ELi? :)
|
|
