AfterDawn.com Mainosta sivuillamme
User Käyttäjä Salasana  
  Puuttuuko tunnus? Liity jäseneksi nyt!.
Salasana hukassa? Klikkaa tästä. 		 
  Etusivu   Uutiset   Oppaat   Ohjelmat   Sanasto   Laitevertailu   Profiilit   Keskustelu  
 Yksityisviestit     Luo uusi yksityisviesti     Kaikki uudet viestit     Ilman vastauksia olevat viestiketjut     Hae viestejä
sunnuntai 16.11.2025 / 17:04
Hae keskustelualueilta:        In English   Suomeksi   På svenska
afterdawn.com > keskustelu > yleistä keskustelua tietokoneista > virukset ja haittaohjelmat - hijackthis -logit > hjt-logi täällä on joku........
Näytä aiheet
 
Keskustelualueet
Keskustelualueet
HJT-logi täällä on joku........
  Siirry:
 
Kirjoittaja Viesti
Sivu:<123>
tonikokko
Member
_ 		14. joulukuuta 2008 @ 21:38 _ Linkki tähän viestiin    Lähetä käyttäjälle yksityisviesti   
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 21:37:50, on 14.12.2008
Platform: Windows Vista SP1 (WinNT 6.00.1905)
MSIE: Internet Explorer v7.00 (7.00.6001.18000)
Boot mode: Normal

Running processes:
C:\Windows\System32\smss.exe
C:\Windows\system32\csrss.exe
C:\Windows\system32\wininit.exe
C:\Windows\system32\csrss.exe
C:\Windows\system32\services.exe
C:\Windows\system32\lsass.exe
C:\Windows\system32\lsm.exe
C:\Windows\system32\winlogon.exe
C:\Windows\system32\svchost.exe
C:\Program Files\Norman\Npm\Bin\eLogsvc.exe
C:\Windows\system32\svchost.exe
C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe
C:\Windows\system32\svchost.exe
C:\Windows\system32\SLsvc.exe
C:\Windows\system32\svchost.exe
C:\Program Files\Norman\Npm\Bin\Zanda.exe
C:\Program Files\Norman\npm\bin\nvoy.exe
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Windows\system32\svchost.exe
C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
C:\Windows\System32\spoolsv.exe
C:\Windows\system32\taskeng.exe
C:\Windows\system32\svchost.exe
C:\Program Files\BUFFALO\clientmgrv\bin\BWH32S.exe
C:\Program Files\HP\QuickPlay\Kernel\TV\CLCapSvc.exe
C:\Program Files\Common Files\LightScribe\LSSrvc.exe
C:\Program Files\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\sqlservr.exe
C:\Windows\system32\svchost.exe
C:\Program Files\Microsoft SQL Server\90\Shared\sqlbrowser.exe
C:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe
C:\Windows\system32\svchost.exe
C:\Windows\System32\svchost.exe
C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\DRIVERS\xaudio.exe
C:\Program Files\Hewlett-Packard\Shared\hpqwmiex.exe
C:\Windows\system32\WUDFHost.exe
C:\Windows\system32\taskeng.exe
C:\Program Files\Norman\Npm\bin\NJEEVES.EXE
C:\Program Files\Norman\Npm\bin\NVCSCHED.EXE
C:\Program Files\Norman\nse\bin\NSESVC.EXE
C:\Program Files\Norman\Nvc\bin\nvcoas.exe
C:\Program Files\Windows Defender\MSASCui.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Program Files\HP\QuickPlay\QPService.exe
C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\QLBCTRL.exe
C:\Program Files\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe
C:\Program Files\Hewlett-Packard\HP Wireless Assistant\WiFiMsg.exe
C:\Program Files\Norman\Npm\Bin\Zlh.exe
C:\Windows\System32\rundll32.exe
C:\Program Files\Windows Sidebar\sidebar.exe
C:\Windows\ehome\ehtray.exe
C:\Program Files\MSN Messenger\msnmsgr.exe
C:\Program Files\BUFFALO\clientmgrv\bin\cmvMain.exe
C:\Windows\System32\rundll32.exe
C:\Windows\system32\wbem\wmiprvse.exe
C:\Windows\ehome\ehmsas.exe
C:\Program Files\Norman\Nvc\Bin\Nip.exe
C:\Program Files\Norman\Nvc\Bin\cclaw.exe
C:\Windows\ehome\ehsched.exe
C:\Windows\ehome\ehRecvr.exe
C:\Program Files\Hewlett-Packard\HP Health Check\hphc_service.exe
C:\Windows\system32\wbem\unsecapp.exe
C:\Program Files\Synaptics\SynTP\SynTPHelper.exe
C:\Program Files\Hewlett-Packard\Shared\HpqToaster.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Winamp\winamp.exe
C:\Windows\system32\SearchProtocolHost.exe
C:\Windows\system32\SearchFilterHost.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
C:\Windows\system32\wbem\wmiprvse.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.daemon-search.com/startpage

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://ie.redirect.hp.com/svs/rdr?TYPE=3...ilion&pf=laptop
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://home.sweetim.com
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O1 - Hosts: ::1 localhost
O2 - BHO: Adobe PDF Reader -linkkiavustaja - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - (no file)
O2 - BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O3 - Toolbar: (no name) - {BC4FFE41-DE9F-46fa-B455-AAD49B9F9938} - (no file)
O4 - HKLM\..\Run: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [QPService] "C:\Program Files\HP\QuickPlay\QPService.exe"
O4 - HKLM\..\Run: [QlbCtrl] %ProgramFiles%\Hewlett-Packard\HP Quick Launch Buttons\QlbCtrl.exe /Start
O4 - HKLM\..\Run: [HP Health Check Scheduler] C:\Program Files\Hewlett-Packard\HP Health Check\HPHC_Scheduler.exe
O4 - HKLM\..\Run: [hpWirelessAssistant] %ProgramFiles%\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe
O4 - HKLM\..\Run: [WAWifiMessage] %ProgramFiles%\Hewlett-Packard\HP Wireless Assistant\WiFiMsg.exe
O4 - HKLM\..\Run: [Norman ZANDA] "C:\Program Files\Norman\Npm\Bin\ZLH.EXE" /LOAD /SPLASH
O4 - HKLM\..\Run: [NvSvc] RUNDLL32.EXE C:\Windows\system32\nvsvc.dll,nvsvcStart
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\Windows\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\Windows\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKLM\..\RunOnce: [Launcher] %WINDIR%\SMINST\launcher.exe
O4 - HKCU\..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun
O4 - HKCU\..\Run: [ehTray.exe] C:\Windows\ehome\ehTray.exe
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'Paikallinen palvelu')
O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'Paikallinen palvelu')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'Verkkopalvelu')
O4 - Global Startup: ClientManagerV.lnk = C:\Program Files\BUFFALO\clientmgrv\bin\cmvMain.exe
O8 - Extra context menu item: Vie Microsoft E&xceliin - res://C:\PROGRA~1\MICROS~3\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: Oheistiedot - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\OFFICE11\REFIEBAR.DLL
O16 - DPF: {20A60F0D-9AFA-4515-A0FD-83BD84642501} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab56986.cab
O16 - DPF: {5C051655-FCD5-4969-9182-770EA5AA5565} (Solitaire Showdown Class) - http://messenger.zone.msn.com/binary/Sol...wn.cab56986.cab
O16 - DPF: {67DABFBF-D0AB-41FA-9C46-CC0F21721616} - http://download.divx.com/player/DivXBrowserPlugin.cab
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/Mes...nt.cab56907.cab
O20 - AppInit_DLLs:
O23 - Service: Lavasoft Ad-Aware Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
O23 - Service: ArcSoft Connect Daemon (ACDaemon) - Unknown owner - C:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ACService.exe (file missing)
O23 - Service: Automaattinen LiveUpdate-ajastustoiminto - Unknown owner - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe (file missing)
O23 - Service: BWH32S - BUFFALO INC. - C:\Program Files\BUFFALO\clientmgrv\bin\BWH32S.exe
O23 - Service: CyberLink Background Capture Service (CBCS) (CLCapSvc) - Unknown owner - C:\Program Files\HP\QuickPlay\Kernel\TV\CLCapSvc.exe
O23 - Service: CyberLink Task Scheduler (CTS) (CLSched) - Unknown owner - C:\Program Files\HP\QuickPlay\Kernel\TV\CLSched.exe
O23 - Service: Norman eLogger service 6 (eLoggerSvc6) - Norman ASA - C:\Program Files\Norman\Npm\Bin\eLogsvc.exe
O23 - Service: HP Health Check Service - Hewlett-Packard - C:\Program Files\Hewlett-Packard\HP Health Check\hphc_service.exe
O23 - Service: hpqwmiex - Hewlett-Packard Development Company, L.P. - C:\Program Files\Hewlett-Packard\Shared\hpqwmiex.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe
O23 - Service: Norman NJeeves - Norman ASA - C:\Program Files\Norman\Npm\bin\NJEEVES.EXE
O23 - Service: Norman ZANDA - Norman ASA - C:\Program Files\Norman\Npm\Bin\Zanda.exe
O23 - Service: Norman Scanner Engine Service (nsesvc) - Norman ASA - C:\Program Files\Norman\nse\bin\NSESVC.EXE
O23 - Service: Norman Virus Control on-access component (nvcoas) - Norman ASA - C:\Program Files\Norman\Nvc\bin\nvcoas.exe
O23 - Service: Norman Virus Control Scheduler (NVCScheduler) - Norman ASA - C:\Program Files\Norman\Npm\bin\NVCSCHED.EXE
O23 - Service: Norman's Very Own supplY of resources (NVOY) - Norman ASA - C:\Program Files\Norman\npm\bin\nvoy.exe
O23 - Service: RoxMediaDB9 - Sonic Solutions - C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxMediaDB9.exe
O23 - Service: stllssvr - MicroVision Development, Inc. - C:\Program Files\Common Files\SureThing Shared\stllssvr.exe
O23 - Service: XAudioService - Conexant Systems, Inc. - C:\Windows\system32\DRIVERS\xaudio.exe

--
End of file - 9993 bytes

[ + lainaa]
Toni
Hujo
Suspended permanently
_ 		14. joulukuuta 2008 @ 22:04 _ Linkki tähän viestiin    Lähetä käyttäjälle yksityisviesti   
scannaa hjt:llä merkkaa paina Fix checked

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.daemon-search.com/startpage
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://home.sweetim.com
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O3 - Toolbar: (no name) - {BC4FFE41-DE9F-46fa-B455-AAD49B9F9938} - (no file)
O20 - AppInit_DLLs:
O23 - Service: Automaattinen LiveUpdate-ajastustoiminto - Unknown owner - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe (file missing)

===============

Mene käynnistä -> suorita -> services.msc -> ok
etsi alla oleva servise

O23 - Service: Automaattinen LiveUpdate-ajastustoiminto - Unknown owner - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe (file missing)

tuplaklikkaa sitä
laita seis
alasvetovalikosta ei käytössä
käytä ja ok

==============

Lataa Tästä Ccleaner
CCleaner v 2.14.750.- Standard Build, ÄLÄ aseenna Yahoo toolbaria!
Asennuksessa poista merkki/rasti kohdasta "asenna Yahoo! toolbar/työkalupalkki".
Asennuksen jälkeen aukaise CCleaneri.
Valitse vasemmalta pystyrivistä Options.
Valitse viereisestä pystyrivistä Settings.
Language kohtaan valitse Suomi.

Puhdistaja
Valitse vasemmalta pystyrivistä Puhdistaja.
Paina alhaalta Tutki.
Nyt CCleaneri tutkii, mitä voidaan poistaa (tempit, cookiessit jne.).
Kun tutkiminen on valmis, paina Aja CCleaner.
Nyt CCleaneri poistaa löydetyt tempit, cookiessit jne.

Rekisterin virheiden korjaus
Valitse vasemmalta pystyrivistä Rekisteri.
Paina alhaalta Etsi rekisterin virheitä.
Kun etsintä on valmis ja olet varma, että haluat korjata ne rivit jotka ovat merkattuja, niin paina Korjaa valitut rekisterin virheet.
Sinulta kysytään "haluatko varmuuskopioida muutokset rekisteriin", paina Kyllä. Tallenna varmuuskopio vaikka "Omat tiedostot" -kansioon.
Klikkaa uudesta aukeavasta ikkunasta Korjaa kaikki valitut virheet.
Saat vielä varmistus kysymyksen, paina Ok.
Kun virheet on korjattu, paina Sulje.
Nyt voit sulkea CCleanerin painamalla oikealta ylhäältä punaista rastia.


[ + lainaa]
Voiko tietsikka koskaan toimia?
tonikokko
Member
_ 		14. joulukuuta 2008 @ 22:16 _ Linkki tähän viestiin    Lähetä käyttäjälle yksityisviesti   
Juu mitä seuraavaksi?
[ + lainaa]
Toni
Hujo
Suspended permanently
_ 		14. joulukuuta 2008 @ 22:25 _ Linkki tähän viestiin    Lähetä käyttäjälle yksityisviesti   
Malwarebytes' Anti-Malware <-- päivitä ja aja täysi scannaus
[ + lainaa]
Voiko tietsikka koskaan toimia?
tonikokko
Member
_ 		14. joulukuuta 2008 @ 22:57 _ Linkki tähän viestiin    Lähetä käyttäjälle yksityisviesti   
Huomenna tarkistan.
Nyt alan nukkuu.
Huomenna skannaan Malware bytesil.
[ + lainaa]
Toni
tonikokko
Member
_ 		15. joulukuuta 2008 @ 15:06 _ Linkki tähän viestiin    Lähetä käyttäjälle yksityisviesti   
Malwarebytes' Anti-Malware 1.31
Tietokantaversio: 1501
Windows 6.0.6001 Service Pack 1

15.12.2008 14:51:57
mbam-log-2008-12-15 (14-51-57).txt

Tarkistustyyppi: Täysi tarkistus (C:\|)
Tarkistetut kohteet: 175940
Kulunut aika: 1 hour(s), 19 minute(s), 16 second(s)

Saastuneita muistiprosesseja: 0
Saastuneita muistimoduuleja: 0
Saastuneita rekisteriavaimia: 0
Saastuneita rekisteriarvoja: 0
Saastuneita rekisterikohteita: 0
Saastuneita hakemistoja: 0
Saastuneita tiedostoja: 0

Saastuneita muistiprosesseja:
(Haitallisia kohteita ei löydetty)

Saastuneita muistimoduuleja:
(Haitallisia kohteita ei löydetty)

Saastuneita rekisteriavaimia:
(Haitallisia kohteita ei löydetty)

Saastuneita rekisteriarvoja:
(Haitallisia kohteita ei löydetty)

Saastuneita rekisterikohteita:
(Haitallisia kohteita ei löydetty)

Saastuneita hakemistoja:
(Haitallisia kohteita ei löydetty)

Saastuneita tiedostoja:
(Haitallisia kohteita ei löydetty)

[ + lainaa]
Toni
Hujo
Suspended permanently
_ 		15. joulukuuta 2008 @ 17:33 _ Linkki tähän viestiin    Lähetä käyttäjälle yksityisviesti   
combofix loki

scannaa viimsenä uusi hjt:n loki
[ + lainaa]
Voiko tietsikka koskaan toimia?
tonikokko
Member
_ 		15. joulukuuta 2008 @ 19:38 _ Linkki tähän viestiin    Lähetä käyttäjälle yksityisviesti   
Combofix ohjelmaa en oikein uskalla käyttää ku siinä kuuluu se iso piippaus ääni kun se on mennyt pois jostain komentorivi ikkunasta.

Kertoisitko tarkat combofix ohjeet?
[ + lainaa]
Toni
Hujo
Suspended permanently
_ 		15. joulukuuta 2008 @ 19:59 _ Linkki tähän viestiin    Lähetä käyttäjälle yksityisviesti   
kirjoita suorita luukkuun

Combofix /u

paina Ok

=============

aja tuo sdfix
[ + lainaa]
Voiko tietsikka koskaan toimia?
tonikokko
Member
_ 		15. joulukuuta 2008 @ 21:30 _ Linkki tähän viestiin    Lähetä käyttäjälle yksityisviesti   
mikä ihmeen SDfix ja ai windowsin suorita kohtaan combofix /u?
[ + lainaa]
Toni
Hujo
Suspended permanently
_ 		15. joulukuuta 2008 @ 21:39 _ Linkki tähän viestiin    Lähetä käyttäjälle yksityisviesti   
Lainaus:
windowsin suorita kohtaan combofix /u
juu näin ja klikkaat OK

=====================

juu ei mitään sdfixsiä täähän on vista

====================

Scannaa koneesi Kaspersky Online Scannerin

Ohjelman käynnistyessä kysytään sallitaanko ActiveX -komponentin asentamisen Kasperskyltä, klikkaa Kyllä.
" Ohjelma käynnistyy ja aloittaa viimeisimpien tunnistetiedostojen lataamisen.
" Kun skanneri on asennettu ja tunnistetiedot ladattu, klikkaa Next.
" Klikkaa nyt asetuksia, Scan Settings
" Tarkista asetuksista, että seuraavat ovat valittuina:
o Scan using the following Anti-Virus database:
+ Extended (Jos valittavissa, muuten valitse Standard)
o Scan Options:
+ Scan Archives
+ Scan Mail Bases
" Klikkaa OK
" Nyt valitse "select a target to scan" otsikon alta Oma Tietokone, My Computer
" Skannaus vie aikaa, joten ole kärsivällinen. Kun skannaus on valmis saat ilmoituksen, jos koneesi on saastunut.
" Klikkaa nyt Save as Text-painiketta.
" Tallenna tiedosto työpöydällesi.
" Mikäli haluat jatkaa asian käsittelyä foorumissa niin kopioi tiedoston sisältö viestiisi.

[ + lainaa]
Voiko tietsikka koskaan toimia?
tonikokko
Member
_ 		15. joulukuuta 2008 @ 21:48 _ Linkki tähän viestiin    Lähetä käyttäjälle yksityisviesti   
http://www.youtube.com/watch?v=P4OlfpTz6-8 teenkö tuossa vähgän niinkuin tuo ihminen? ja sitte laitan tänne sen login.
[ + lainaa]
Toni
Hujo
Suspended permanently
_ 		15. joulukuuta 2008 @ 22:08 _ Linkki tähän viestiin    Lähetä käyttäjälle yksityisviesti   
suorita. kyllä. jes. älä kiellä.
[ + lainaa]
Voiko tietsikka koskaan toimia?
tonikokko
Member
_ 		15. joulukuuta 2008 @ 22:10 _ Linkki tähän viestiin    Lähetä käyttäjälle yksityisviesti   
ok
[ + lainaa]
Toni
tonikokko
Member
_ 		15. joulukuuta 2008 @ 22:13 _ Linkki tähän viestiin    Lähetä käyttäjälle yksityisviesti   
ComboFix 08-12-15.01 - Toni Kokko 2008-12-15 22:16:56.1 - NTFSx86
Microsoft® Windows Vista? Home Premium 6.0.6001.1.1252.1.1035.18.1982.850 [GMT 2:00]
Sijainti: c:\users\Toni Kokko\Desktop\ComboFix.exe
* Uusi palautuspiste luotu
* Resident AV is active

.

((((( Tiedostot, jotka on luotu seuraavalla aikavälillä: 2008-11-15 to 2008-12-15 )))))))))))))))))
.

2008-12-14 20:48 . 2008-12-14 20:48 <KANSIO> d-------- c:\program files\Java
2008-12-14 20:48 . 2008-12-14 20:48 410,984 --a------ c:\windows\System32\deploytk.dll
2008-12-14 17:41 . 2008-12-14 17:42 <KANSIO> d-------- c:\users\Toni Kokko\AppData\Roaming\U3
2008-12-11 23:08 . 2008-12-14 17:56 <KANSIO> d-------- c:\users\Toni Kokko\.SunDownloadManager
2008-12-11 15:00 . 2008-12-11 15:00 249,592 --a------ c:\windows\System32\cssdll32.dll
2008-12-11 14:56 . 2008-12-14 20:24 <KANSIO> d-------- c:\users\Toni Kokko\AppData\Roaming\Comodo
2008-12-11 14:55 . 2008-12-14 20:24 <KANSIO> d-------- c:\users\All Users\comodo
2008-12-11 14:55 . 2008-12-14 20:24 <KANSIO> d-------- c:\programdata\comodo
2008-12-11 14:55 . 2008-12-14 20:24 <KANSIO> d-------- c:\program files\COMODO
2008-12-10 23:23 . 2008-12-10 23:23 <KANSIO> d-------- c:\users\Toni Kokko\AppData\Roaming\ImgBurn
2008-12-10 23:19 . 2008-12-10 23:19 <KANSIO> d-------- c:\program files\ImgBurn
2008-12-10 20:52 . 2008-12-10 20:52 <KANSIO> d-------- c:\temp\Windows XP Professional (English)
2008-12-10 16:01 . 2008-10-22 03:22 2,048 --a------ c:\windows\System32\tzres.dll
2008-12-10 14:55 . 2008-12-10 18:41 <KANSIO> d-------- c:\users\Toni Kokko\AppData\Roaming\SUPERAntiSpyware.com
2008-12-10 14:55 . 2008-12-10 14:55 <KANSIO> d-------- c:\users\All Users\SUPERAntiSpyware.com
2008-12-10 14:55 . 2008-12-10 14:55 <KANSIO> d-------- c:\programdata\SUPERAntiSpyware.com
2008-12-10 14:55 . 2008-12-10 18:41 <KANSIO> d-------- c:\program files\SUPERAntiSpyware
2008-12-09 21:05 . 2008-12-09 21:05 <KANSIO> d-------- c:\program files\Trend Micro
2008-12-08 20:36 . 2008-12-10 14:13 <KANSIO> d--h----- C:\$AVG8.VAULT$
2008-12-08 19:25 . 2008-12-10 19:06 <KANSIO> d-------- c:\users\All Users\avg8
2008-12-08 19:25 . 2008-12-10 19:06 <KANSIO> d-------- c:\programdata\avg8
2008-12-08 18:53 . 2008-12-08 18:53 <KANSIO> d-------- c:\users\All Users\Kaspersky Lab Setup Files
2008-12-08 18:53 . 2008-12-08 18:53 <KANSIO> d-------- c:\programdata\Kaspersky Lab Setup Files
2008-12-07 23:57 . 2008-12-07 23:57 <KANSIO> d-------- c:\windows\Sun
2008-12-02 21:43 . 2008-12-02 21:43 <KANSIO> d-------- c:\users\Toni Kokko\AppData\Roaming\Malwarebytes
2008-12-02 21:43 . 2008-12-02 21:43 <KANSIO> d-------- c:\users\All Users\Malwarebytes
2008-12-02 21:43 . 2008-12-02 21:43 <KANSIO> d-------- c:\programdata\Malwarebytes
2008-12-02 21:43 . 2008-12-14 22:54 <KANSIO> d-------- c:\program files\Malwarebytes' Anti-Malware
2008-12-02 21:43 . 2008-12-03 19:52 38,496 --a------ c:\windows\System32\drivers\mbamswissarmy.sys
2008-12-02 21:43 . 2008-12-03 19:52 15,504 --a------ c:\windows\System32\drivers\mbam.sys
2008-11-26 19:39 . 2008-10-21 07:25 1,645,568 --a------ c:\windows\System32\connect.dll
2008-11-26 19:39 . 2008-08-28 05:40 712,704 --a------ c:\windows\System32\WindowsCodecs.dll
2008-11-26 19:39 . 2008-08-28 05:40 425,472 --a------ c:\windows\System32\PhotoMetadataHandler.dll
2008-11-26 19:39 . 2008-08-28 05:40 347,136 --a------ c:\windows\System32\WindowsCodecsExt.dll
2008-11-26 19:39 . 2008-10-22 05:57 241,152 --a------ c:\windows\System32\PortableDeviceApi.dll
2008-11-24 22:36 . 2008-11-24 22:37 <KANSIO> d-------- c:\users\All Users\Lavasoft
2008-11-24 22:36 . 2008-11-24 22:37 <KANSIO> d-------- c:\programdata\Lavasoft
2008-11-24 22:36 . 2008-11-24 22:36 <KANSIO> d-------- c:\program files\Lavasoft
2008-11-24 22:35 . 2008-12-10 18:41 <KANSIO> d-------- c:\program files\Common Files\Wise Installation Wizard
2008-11-23 22:55 . 2008-11-23 22:55 <KANSIO> d-------- c:\users\All Users\Grisoft
2008-11-23 22:55 . 2008-11-23 22:55 <KANSIO> d-------- c:\programdata\Grisoft
2008-11-23 22:44 . 2008-11-23 22:44 <KANSIO> dr------- c:\windows\System32\config\systemprofile\Videos
2008-11-23 22:44 . 2008-11-23 22:44 <KANSIO> dr------- c:\windows\System32\config\systemprofile\Pictures
2008-11-23 22:44 . 2008-11-23 22:44 <KANSIO> dr------- c:\windows\System32\config\systemprofile\Downloads
2008-11-23 22:44 . 2008-11-23 22:44 <KANSIO> dr------- c:\windows\System32\config\systemprofile\Documents
2008-11-23 20:15 . 2008-11-23 20:15 52,736 --a------ c:\windows\ipuninst.exe
2008-11-23 19:50 . 2008-11-23 19:50 <KANSIO> d-------- c:\program files\Alcohol Soft
2008-11-20 22:44 . 2008-11-20 22:44 42,320 --a------ c:\windows\System32\xfcodec.dll
2008-11-17 16:27 . 2008-11-17 16:27 <KANSIO> d-------- c:\program files\CCleaner
2008-11-15 11:39 . 2008-10-16 23:13 1,809,944 --a------ c:\windows\System32\wuaueng.dll
2008-11-15 11:39 . 2008-10-16 22:56 1,524,736 --a------ c:\windows\System32\wucltux.dll
2008-11-15 11:39 . 2008-10-16 23:09 51,224 --a------ c:\windows\System32\wuauclt.exe
2008-11-15 11:39 . 2008-10-16 23:09 43,544 --a------ c:\windows\System32\wups2.dll
2008-11-15 11:38 . 2008-10-16 23:12 561,688 --a------ c:\windows\System32\wuapi.dll
2008-11-15 11:38 . 2008-10-16 14:08 162,064 --a------ c:\windows\System32\wuwebv.dll
2008-11-15 11:38 . 2008-10-16 22:55 83,456 --a------ c:\windows\System32\wudriver.dll
2008-11-15 11:38 . 2008-10-16 23:08 34,328 --a------ c:\windows\System32\wups.dll
2008-11-15 11:38 . 2008-10-16 13:56 31,232 --a------ c:\windows\System32\wuapp.exe

.
(((((((((((((((((((((((((((((((((((( Find3M-raportti ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-12-15 19:24 28,314 ----a-w c:\users\Toni Kokko\AppData\Roaming\nvModes.dat
2008-12-15 18:35 --------- d-----w c:\program files\Steam
2008-12-15 18:01 --------- d-----w c:\users\Toni Kokko\AppData\Roaming\Xfire
2008-12-15 05:19 --------- d-----w c:\programdata\Xfire
2008-12-15 05:12 --------- d-----w c:\program files\World of Warcraft
2008-12-14 20:19 --------- d-----w c:\program files\Norman
2008-12-14 18:21 --------- d-----w c:\users\Toni Kokko\AppData\Roaming\uTorrent
2008-12-14 18:05 --------- d--h--w c:\program files\InstallShield Installation Information
2008-12-14 16:33 --------- d-----w c:\users\Toni Kokko\AppData\Roaming\mIRC
2008-12-10 14:50 --------- d-----w c:\program files\Windows Mail
2008-12-10 13:35 --------- d-----w c:\program files\mIRC
2008-12-08 17:06 --------- d-----w c:\program files\Common Files\Symantec Shared
2008-12-08 17:03 --------- d-----w c:\programdata\Symantec
2008-12-08 07:23 --------- d-----w c:\program files\MSN Messenger
2008-12-07 17:31 --------- d-----w c:\program files\RevConnect
2008-12-03 20:31 --------- d-----w c:\program files\WhatPulse
2008-11-27 18:33 --------- d-----w c:\program files\Xfire
2008-11-24 09:59 --------- d-----w c:\program files\Google
2008-11-23 21:22 --------- d-----w c:\users\Toni Kokko\AppData\Roaming\BSplayer
2008-11-23 21:22 --------- d-----w c:\program files\Webteh
2008-11-23 20:27 --------- d-----w c:\programdata\Team MediaPortal
2008-11-23 20:27 --------- d-----w c:\program files\Team MediaPortal
2008-11-23 19:15 --------- d-----w c:\program files\Common Files\ArcSoft
2008-11-23 17:18 717,296 ----a-w c:\windows\system32\drivers\sptd.sys
2008-11-22 18:33 --------- d-----w c:\program files\SystemRequirementsLab
2008-11-22 18:31 --------- d-----w c:\users\Toni Kokko\AppData\Roaming\SystemRequirementsLab
2008-11-15 20:11 --------- d-----w c:\program files\Common Files\Steam
2008-11-13 16:21 --------- d-----w c:\users\Toni Kokko\AppData\Roaming\Skype
2008-11-03 14:00 --------- d-----w c:\programdata\Blizzard
2008-11-02 18:36 --------- d-----w c:\program files\Common Files\Blizzard Entertainment
2008-11-01 19:22 --------- d-----w c:\programdata\ArcSoft
2008-11-01 16:15 --------- d-----w c:\program files\Microsoft SQL Server
2008-11-01 07:40 30 ----a-w c:\users\Toni Kokko\jagex_runescape_preferences.dat
2008-11-01 03:44 541,696 ----a-w c:\windows\AppPatch\AcLayers.dll
2008-11-01 03:44 52,736 ----a-w c:\windows\AppPatch\iebrshim.dll
2008-11-01 03:44 460,288 ----a-w c:\windows\AppPatch\AcSpecfc.dll
2008-11-01 03:44 28,672 ----a-w c:\windows\System32\Apphlpdm.dll
2008-11-01 03:44 2,154,496 ----a-w c:\windows\AppPatch\AcGenral.dll
2008-11-01 03:44 173,056 ----a-w c:\windows\AppPatch\AcXtrnal.dll
2008-11-01 01:21 4,240,384 ----a-w c:\windows\System32\GameUXLegacyGDFs.dll
2008-10-31 20:12 --------- d-----w c:\users\Toni Kokko\AppData\Roaming\Ventrilo
2008-10-31 19:17 --------- d-----w c:\users\Toni Kokko\AppData\Roaming\ArcSoft
2008-10-31 16:40 --------- d-----w c:\program files\mpgconv
2008-10-31 16:12 --------- d-----w c:\program files\Microsoft.NET
2008-10-31 15:08 --------- d-----w c:\program files\ProgDVB
2008-10-29 06:29 2,927,104 ----a-w c:\windows\explorer.exe
2008-10-22 15:44 --------- d-----w c:\program files\Microsoft Silverlight
2008-10-21 05:25 296,960 ----a-w c:\windows\System32\gdi32.dll
2008-10-20 13:27 --------- d-----w c:\users\Toni Kokko\AppData\Roaming\fretsonfire
2008-10-17 17:20 --------- d-----w c:\program files\uTorrent
2008-10-17 11:15 --------- d-----w c:\program files\xchat
2008-10-17 11:14 --------- d-----w c:\program files\Frets on Fire
2008-10-17 11:10 --------- d-----w c:\program files\Audacity
2008-10-16 04:47 827,392 ----a-w c:\windows\System32\wininet.dll
2008-10-09 16:54 28,672 ----a-w c:\windows\System32\AF15BDAEX.dll
2008-09-30 14:43 1,286,152 ----a-w c:\windows\System32\msxml4.dll
2008-09-18 05:09 3,601,464 ----a-w c:\windows\System32\ntkrnlpa.exe
2008-09-18 05:09 3,549,240 ----a-w c:\windows\System32\ntoskrnl.exe
2008-09-18 04:56 147,456 ----a-w c:\windows\System32\Faultrep.dll
2008-09-18 04:56 125,952 ----a-w c:\windows\System32\wersvc.dll
2008-09-18 02:16 2,032,640 ----a-w c:\windows\System32\win32k.sys
2008-05-24 06:35 174 --sha-w c:\program files\desktop.ini
2007-11-12 15:12 856 ----a-w c:\users\Toni Kokko\AppData\Roaming\wklnhst.dat
2005-07-05 14:47 777 ----a-w c:\program files\trial_setup.ini
2005-07-05 14:47 5,133,312 ----a-w c:\program files\trial_setup.msi
2005-07-05 14:47 40,448 ----a-w c:\program files\trial_setup.exe
2007-10-28 17:48 16,384 --sha-w c:\windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat
2007-10-28 17:48 32,768 --sha-w c:\windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat
2007-10-28 17:48 16,384 --sha-w c:\windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Cookies\index.dat
2007-08-30 15:12 16 --sha-w c:\windows\SMINST\HPCD.sys
.

(((((((((((((((((((((((((((((( Rekisterin käynnistyskohteet )))))))))))))))))))))))))))))))))))))))))))))
.
.
*Huom* Tyhjiä arvoja ja laillisia oletusarvoja ei näytetä
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Sidebar"="c:\program files\Windows Sidebar\sidebar.exe" [2008-01-18 1233920]
"ehTray.exe"="c:\windows\ehome\ehTray.exe" [2008-01-18 125952]
"msnmsgr"="c:\program files\MSN Messenger\msnmsgr.exe" [2007-01-19 5674352]
"Google Update"="c:\users\Toni Kokko\AppData\Local\Google\Update\GoogleUpdate.exe" [2008-12-15 133104]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2008-03-28 1045800]
"QPService"="c:\program files\HP\QuickPlay\QPService.exe" [2007-04-23 176128]
"QlbCtrl"="c:\program files\Hewlett-Packard\HP Quick Launch Buttons\QlbCtrl.exe" [2007-02-13 159744]
"HP Health Check Scheduler"="c:\program files\Hewlett-Packard\HP Health Check\HPHC_Scheduler.exe" [2007-03-12 50696]
"hpWirelessAssistant"="c:\program files\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe" [2007-03-01 472776]
"WAWifiMessage"="c:\program files\Hewlett-Packard\HP Wireless Assistant\WiFiMsg.exe" [2007-01-10 317128]
"Norman ZANDA"="c:\program files\Norman\Npm\Bin\ZLH.EXE" [2008-06-02 277616]
"NvSvc"="c:\windows\system32\nvsvc.dll" [2007-11-07 86016]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2007-11-07 8534560]
"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2007-11-07 81920]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2008-12-14 136600]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce]
"Launcher"="c:\windows\SMINST\launcher.exe" [2006-11-07 44128]

c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
ClientManagerV.lnk - c:\program files\BUFFALO\clientmgrv\bin\cmvMain.exe [2008-10-07 138808]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"EnableUIADesktopToggle"= 0 (0x0)

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"AppInit_DLLs"=

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"vidc.ffds"= c:\program files\ffdshow\ffdshow.ax
"VIDC.XFR1"= xfcodec.dll

[HKLM\~\startupfolder\C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^Adobe Gamma Loader.lnk]
path=c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\Adobe Gamma Loader.lnk
backup=c:\windows\pss\Adobe Gamma Loader.lnk.CommonStartup
backupExtension=.CommonStartup

[HKLM\~\startupfolder\C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^TMMonitor.lnk]
path=c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\TMMonitor.lnk
backup=c:\windows\pss\TMMonitor.lnk.CommonStartup
backupExtension=.CommonStartup

[HKLM\~\startupfolder\C:^Users^Toni Kokko^AppData^Roaming^Microsoft^Windows^Start Menu^Programs^Startup^Xfire.lnk]
path=c:\users\Toni Kokko\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Xfire.lnk
backup=c:\windows\pss\Xfire.lnk.Startup
backupExtension=.Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher]
--a------ 2008-01-11 21:16 39792 c:\program files\Adobe\Reader 8.0\Reader\reader_sl.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\msnmsgr]
--a------ 2007-01-19 11:55 5674352 c:\program files\MSN Messenger\msnmsgr.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Skype]
--a------ 2006-07-13 23:41 20034600 c:\program files\Skype\Phone\Skype.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WhatPulse]
--a------ 2006-08-21 19:48 665600 c:\program files\WhatPulse\WhatPulse.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WinampAgent]
--a------ 2008-08-04 01:02 36352 c:\program files\Winamp\winampa.exe

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\FirewallRules]
"TCP Query User{0E60E5F2-C916-49E0-95D4-2E627F9B6584}c:\\program files\\msn messenger\\msnmsgr.exe"= UDP:c:\program files\msn messenger\msnmsgr.exe:Messenger
"UDP Query User{4C2E6A0D-F273-4BDA-83C8-F765026B7793}c:\\program files\\msn messenger\\msnmsgr.exe"= TCP:c:\program files\msn messenger\msnmsgr.exe:Messenger
"{D544B387-58C0-408C-A260-FD2D4E311490}"= UDP:c:\program files\Atari\Neverwinter Nights 2\nwn2main.exe:Neverwinter Nights 2 Main
"{8EA83D06-8F05-4EF9-80CA-755B77E5AFF8}"= TCP:c:\program files\Atari\Neverwinter Nights 2\nwn2main.exe:Neverwinter Nights 2 Main
"{AFD50BC0-ADB8-48FD-89BA-EB04869FB04A}"= UDP:c:\program files\Atari\Neverwinter Nights 2\nwn2main_amdxp.exe:Neverwinter Nights 2 AMD
"{BE23AB97-F9AB-4DE6-A39D-6E559FC93900}"= TCP:c:\program files\Atari\Neverwinter Nights 2\nwn2main_amdxp.exe:Neverwinter Nights 2 AMD
"{D66B4CF5-C554-4AEB-A86E-AD7DB85A46A8}"= UDP:c:\program files\Atari\Neverwinter Nights 2\nwupdate.exe:Neverwinter Nights 2 Updater
"{CE2B4A9D-8D3E-493A-85E2-75A59E58922D}"= TCP:c:\program files\Atari\Neverwinter Nights 2\nwupdate.exe:Neverwinter Nights 2 Updater
"{9963DB7F-22C2-473D-9917-DC1D1E408B72}"= UDP:c:\program files\Atari\Neverwinter Nights 2\nwn2server.exe:Neverwinter Nights 2 Server
"{244AD98B-9023-47F0-AD1E-29BC7685E96A}"= TCP:c:\program files\Atari\Neverwinter Nights 2\nwn2server.exe:Neverwinter Nights 2 Server
"TCP Query User{F489A6A9-FE85-4FA6-85CF-E59E6DAF3156}c:\\program files\\xfire\\xfire.exe"= UDP:c:\program files\xfire\xfire.exe:Xfire
"UDP Query User{7D9956B7-71D1-4FC4-9CE6-832F85DAB2F3}c:\\program files\\xfire\\xfire.exe"= TCP:c:\program files\xfire\xfire.exe:Xfire
"TCP Query User{C1771924-088B-4479-9E4F-08E43FFECB97}c:\\program files\\msn messenger\\livecall.exe"= UDP:c:\program files\msn messenger\livecall.exe:Windows Live Call
"UDP Query User{F792272E-B764-4CFD-B2F1-C8B157A42A87}c:\\program files\\msn messenger\\livecall.exe"= TCP:c:\program files\msn messenger\livecall.exe:Windows Live Call
"TCP Query User{FF66BB09-91AA-4DE6-AF98-A53FD47C99A4}c:\\program files\\emule\\emule.exe"= UDP:c:\program files\emule\emule.exe:eMule
"UDP Query User{331EAEE3-D7AB-4DFB-B4A2-144FCF3159A8}c:\\program files\\emule\\emule.exe"= TCP:c:\program files\emule\emule.exe:eMule
"TCP Query User{9A954996-511F-4135-8468-ECB0BCE6021C}c:\\users\\toni kokko\\desktop\\nes\\nestc042\\nestcl95.exe"= UDP:c:\users\toni kokko\desktop\nes\nestc042\nestcl95.exe:nestcl95.exe
"UDP Query User{F76BA4B4-2BB9-409B-AE4E-4EB7BB4117F2}c:\\users\\toni kokko\\desktop\\nes\\nestc042\\nestcl95.exe"= TCP:c:\users\toni kokko\desktop\nes\nestc042\nestcl95.exe:nestcl95.exe
"TCP Query User{CCCA7D9E-957F-41C2-9E95-BF5A9D165A8B}c:\\users\\toni kokko\\desktop\\utorrent.exe"= UDP:c:\users\toni kokko\desktop\utorrent.exe:utorrent.exe
"UDP Query User{A5D6125A-F900-48E3-B961-6D3FEC8C95E5}c:\\users\\toni kokko\\desktop\\utorrent.exe"= TCP:c:\users\toni kokko\desktop\utorrent.exe:utorrent.exe
"TCP Query User{74C37976-832D-4749-804A-AD0500E05A5A}c:\\neverwinternights\\nwn\\nwmain.exe"= UDP:c:\neverwinternights\nwn\nwmain.exe:Neverwinter Nights
"UDP Query User{800E3D01-47D1-4313-BFD1-B33D07152FC3}c:\\neverwinternights\\nwn\\nwmain.exe"= TCP:c:\neverwinternights\nwn\nwmain.exe:Neverwinter Nights
"TCP Query User{E34D9D43-0DBD-438C-9399-F8EFF49FE563}c:\\program files\\mozilla firefox\\firefox.exe"= UDP:c:\program files\mozilla firefox\firefox.exe:Firefox
"UDP Query User{5801BA1E-24E1-4DAA-B511-AFB0979D09E9}c:\\program files\\mozilla firefox\\firefox.exe"= TCP:c:\program files\mozilla firefox\firefox.exe:Firefox
"{4DEA1078-B4EF-46F8-8AE7-B438930E46EF}"= UDP:c:\program files\BitTorrent\bittorrent.exe:BitTorrent
"{FDBCB264-4CDB-4991-AD93-DE1FADBEE8BF}"= TCP:c:\program files\BitTorrent\bittorrent.exe:BitTorrent
"TCP Query User{450ACF7E-B1DD-4791-8D62-03446A1DCE2A}c:\\program files\\byond\\bin\\byond.exe"= UDP:c:\program files\byond\bin\byond.exe:byond
"UDP Query User{D1B4E27F-BC0E-4084-A91F-84E9117CC3A0}c:\\program files\\byond\\bin\\byond.exe"= TCP:c:\program files\byond\bin\byond.exe:byond
"TCP Query User{30F015A4-F3E8-4A45-BAA0-C14ACA1208CB}c:\\program files\\utorrent\\utorrent.exe"= UDP:c:\program files\utorrent\utorrent.exe:uTorrent
"UDP Query User{DB869AB6-C57A-45A4-9C81-A6635D2B3780}c:\\program files\\utorrent\\utorrent.exe"= TCP:c:\program files\utorrent\utorrent.exe:uTorrent
"TCP Query User{6D1C176D-F5CB-4456-9837-7333E5D352A9}c:\\program files\\counter-strike 1.6\\hl.exe"= UDP:c:\program files\counter-strike 1.6\hl.exe:Half-Life Launcher
"UDP Query User{0F745B67-F537-4EAD-B14E-6597D2C8D17E}c:\\program files\\counter-strike 1.6\\hl.exe"= TCP:c:\program files\counter-strike 1.6\hl.exe:Half-Life Launcher
"TCP Query User{D677DB5E-40A0-43E1-8D41-7D2419599383}c:\\program files\\ea games\\medal of honor pacific assault(tm) mpdemo2\\mohpa_mpdemo.exe"= UDP:c:\program files\ea games\medal of honor pacific assault(tm) mpdemo2\mohpa_mpdemo.exe:Medal of Honor Pacific Assault(tm)
"UDP Query User{458AC2B1-2FAC-4B4B-84F5-583EB41A645D}c:\\program files\\ea games\\medal of honor pacific assault(tm) mpdemo2\\mohpa_mpdemo.exe"= TCP:c:\program files\ea games\medal of honor pacific assault(tm) mpdemo2\mohpa_mpdemo.exe:Medal of Honor Pacific Assault(tm)
"TCP Query User{5EFC87C6-F824-46C0-B522-289B9521117F}c:\\program files\\ea games\\medal of honor pacific assault(tm) mpdemo2\\mohpa_mpdemo_server.exe"= UDP:c:\program files\ea games\medal of honor pacific assault(tm) mpdemo2\mohpa_mpdemo_server.exe:Medal of Honor Pacific Assault(tm)
"UDP Query User{5170532E-4D95-4AC3-8CB3-43BDD42DF486}c:\\program files\\ea games\\medal of honor pacific assault(tm) mpdemo2\\mohpa_mpdemo_server.exe"= TCP:c:\program files\ea games\medal of honor pacific assault(tm) mpdemo2\mohpa_mpdemo_server.exe:Medal of Honor Pacific Assault(tm)
"TCP Query User{C3BEF026-E9E6-49AF-8692-82BA32F08404}c:\\program files\\wolfenstein - enemy territory\\et.exe"= UDP:c:\program files\wolfenstein - enemy territory\et.exe:ET
"UDP Query User{5D2F2AEB-CEDA-4639-A9D0-F0C577D93D08}c:\\program files\\wolfenstein - enemy territory\\et.exe"= TCP:c:\program files\wolfenstein - enemy territory\et.exe:ET
"TCP Query User{13F890DE-490E-4B0B-A087-A1602366A068}c:\\program files\\wolfenstein - enemy territory\\etded.exe"= UDP:c:\program files\wolfenstein - enemy territory\etded.exe:ETDED
"UDP Query User{B91B82C8-9DF3-4DD9-944C-FE795C320114}c:\\program files\\wolfenstein - enemy territory\\etded.exe"= TCP:c:\program files\wolfenstein - enemy territory\etded.exe:ETDED
"{28350A57-E35F-4F9C-B726-7B3C68A588E3}"= UDP:c:\users\Public\Documents\Blizzard Entertainment\World of Warcraft\WoW-2.3.0.7561-to-2.3.2.7741-enGB-downloader.exe:Blizzard Downloader
"{76E61FE2-B81C-4A09-983A-D667AD863C44}"= TCP:c:\users\Public\Documents\Blizzard Entertainment\World of Warcraft\WoW-2.3.0.7561-to-2.3.2.7741-enGB-downloader.exe:Blizzard Downloader
"TCP Query User{6F5B6C21-B17E-4BA6-BACF-63340EF3162E}c:\\program files\\microsoft games\\halo\\halo.exe"= UDP:c:\program files\microsoft games\halo\halo.exe:Halo
"UDP Query User{47B278DD-D9A1-41DF-BA07-E2CA5916589E}c:\\program files\\microsoft games\\halo\\halo.exe"= TCP:c:\program files\microsoft games\halo\halo.exe:Halo
"TCP Query User{84C8EEEE-5646-45A6-9B3E-7BB1B421C0B7}c:\\users\\toni kokko\\desktop\\installer-22999-864-counter-strike.exe"= UDP:c:\users\toni kokko\desktop\installer-22999-864-counter-strike.exe:installer-22999-864-counter-strike.exe
"UDP Query User{96AF4C29-27B9-470A-898F-C74BDE0FA4B5}c:\\users\\toni kokko\\desktop\\installer-22999-864-counter-strike.exe"= TCP:c:\users\toni kokko\desktop\installer-22999-864-counter-strike.exe:installer-22999-864-counter-strike.exe
"TCP Query User{619080D8-8BD2-43BE-9D6D-20EF595F124B}c:\\program files\\jazz jackrabbit 2\\jazz2.exe"= UDP:c:\program files\jazz jackrabbit 2\jazz2.exe:Jazz Jackrabbit 2
"UDP Query User{E21B1754-AC24-4590-A3EC-7AD436050300}c:\\program files\\jazz jackrabbit 2\\jazz2.exe"= TCP:c:\program files\jazz jackrabbit 2\jazz2.exe:Jazz Jackrabbit 2
"{C430DAF0-70C6-4A09-9149-FE39258CC3E7}"= UDP:94:VRS Recording System Web Control Panel
"{5E1865ED-1E02-40B5-BD48-464808564702}"= TCP:8000:Axon Virtual PBX RTP Incoming Audio (UDP)
"{48B844C8-8091-454D-A500-3829598B8619}"= TCP:8001:Axon Virtual PBX RTP Incoming Audio (UDP)
"{D5122966-424E-4973-B4E8-621466F124FA}"= TCP:8002:Axon Virtual PBX RTP Incoming Audio (UDP)
"{14CA1EB7-06AF-4992-8F33-CA8A2A6907A1}"= TCP:8003:Axon Virtual PBX RTP Incoming Audio (UDP)
"{07144F0D-652E-4938-A4A6-7AB816714FFA}"= TCP:8004:Axon Virtual PBX RTP Incoming Audio (UDP)
"{10771593-3459-4E97-946D-393D93FCBD84}"= UDP:81:Axon Virtual PBX Web Server
"TCP Query User{DC46209A-4D4D-424A-8B56-2D92080081FA}c:\\program files\\condition zero\\hlds.exe"= UDP:c:\program files\condition zero\hlds.exe:HLDS Launcher
"UDP Query User{34072C27-AA45-49B3-938D-BE4BC547EAA6}c:\\program files\\condition zero\\hlds.exe"= TCP:c:\program files\condition zero\hlds.exe:HLDS Launcher
"TCP Query User{3C767F74-CB7D-4D9F-8EE2-50E472BA6FA5}c:\\program files\\skype\\phone\\skype.exe"= UDP:c:\program files\skype\phone\skype.exe:Skype. The whole world can talk for free.
"UDP Query User{DC78D1AA-837C-46A6-96FD-5D6B2A1BBECA}c:\\program files\\skype\\phone\\skype.exe"= TCP:c:\program files\skype\phone\skype.exe:Skype. The whole world can talk for free.
"TCP Query User{AA2D2F5E-039A-4DD4-885B-C2D14B1A31A2}c:\\program files\\condition zero\\hlds.exe"= UDP:c:\program files\condition zero\hlds.exe:HLDS Launcher
"UDP Query User{0DBC3F9B-298F-4C44-8502-7B0DAA696F75}c:\\program files\\condition zero\\hlds.exe"= TCP:c:\program files\condition zero\hlds.exe:HLDS Launcher
"TCP Query User{D7AD1479-5F64-4930-83C8-2927AB9E0F13}c:\\program files\\steam\\steamapps\\tonikokko\\dedicated server\\hlds.exe"= UDP:c:\program files\steam\steamapps\tonikokko\dedicated server\hlds.exe:HLDS Launcher
"UDP Query User{F3C82F4E-374B-44B6-97CB-56D0293C4BA9}c:\\program files\\steam\\steamapps\\tonikokko\\dedicated server\\hlds.exe"= TCP:c:\program files\steam\steamapps\tonikokko\dedicated server\hlds.exe:HLDS Launcher
"TCP Query User{1EC6E41B-CDBA-49BF-B50B-42CDDB39E83D}c:\\program files\\css\\hl2.exe"= UDP:c:\program files\css\hl2.exe:hl2
"UDP Query User{A7391A47-23E6-4F58-ACEC-DD126FFE456F}c:\\program files\\css\\hl2.exe"= TCP:c:\program files\css\hl2.exe:hl2
"TCP Query User{5B91D1B4-4D0D-4392-B877-7605B8FE1A0C}c:\\program files\\css\\srcds.exe"= UDP:c:\program files\css\srcds.exe:srcds
"UDP Query User{B0D44996-1DFD-4C13-9FB0-FB239079A96A}c:\\program files\\css\\srcds.exe"= TCP:c:\program files\css\srcds.exe:srcds
"TCP Query User{A9F96E00-45E6-49C4-A318-F1A387CFC15E}c:\\program files\\steam\\steamapps\\tonikokko\\counter-strike\\hl.exe"= UDP:c:\program files\steam\steamapps\tonikokko\counter-strike\hl.exe:Half-Life Launcher
"UDP Query User{52B86BB3-139B-41C0-9A76-7E0ACD830A9F}c:\\program files\\steam\\steamapps\\tonikokko\\counter-strike\\hl.exe"= TCP:c:\program files\steam\steamapps\tonikokko\counter-strike\hl.exe:Half-Life Launcher
"TCP Query User{352C5FB1-A302-4D84-A303-94FC6280B1D8}c:\\program files\\steam\\steamapps\\tonikokko\\condition zero deleted scenes\\hl.exe"= UDP:c:\program files\steam\steamapps\tonikokko\condition zero deleted scenes\hl.exe:Half-Life Launcher
"UDP Query User{B5482BF4-55AD-420C-A6AB-F7B0D353C806}c:\\program files\\steam\\steamapps\\tonikokko\\condition zero deleted scenes\\hl.exe"= TCP:c:\program files\steam\steamapps\tonikokko\condition zero deleted scenes\hl.exe:Half-Life Launcher
"TCP Query User{8F8E66C1-9816-4E0E-95E3-78DC8B2BD9FD}c:\\program files\\steam\\steamapps\\tonikokko\\deathmatch classic\\hl.exe"= UDP:c:\program files\steam\steamapps\tonikokko\deathmatch classic\hl.exe:Half-Life Launcher
"UDP Query User{C4018428-4558-4595-A0C3-49A90D49A7B9}c:\\program files\\steam\\steamapps\\tonikokko\\deathmatch classic\\hl.exe"= TCP:c:\program files\steam\steamapps\tonikokko\deathmatch classic\hl.exe:Half-Life Launcher
"TCP Query User{DCFA1FCE-D408-47CD-8571-0105ACFA2916}c:\\program files\\steam\\steamapps\\tonikokko\\day of defeat\\hl.exe"= UDP:c:\program files\steam\steamapps\tonikokko\day of defeat\hl.exe:Half-Life Launcher
"UDP Query User{62519076-C4D5-4189-AFA3-FB99447E71D0}c:\\program files\\steam\\steamapps\\tonikokko\\day of defeat\\hl.exe"= TCP:c:\program files\steam\steamapps\tonikokko\day of defeat\hl.exe:Half-Life Launcher
"TCP Query User{0036597C-6744-46E1-87AB-B5DA7022EA80}c:\\program files\\steam\\steamapps\\tonikokko\\counter-strike\\hl.exe"= UDP:c:\program files\steam\steamapps\tonikokko\counter-strike\hl.exe:Half-Life Launcher
"UDP Query User{663FFDC6-AE4E-48C0-A372-E2D9606A88CA}c:\\program files\\steam\\steamapps\\tonikokko\\counter-strike\\hl.exe"= TCP:c:\program files\steam\steamapps\tonikokko\counter-strike\hl.exe:Half-Life Launcher
"TCP Query User{CA0AAE20-34D5-4F87-9E3A-BDFB0BDB4D71}c:\\program files\\steam\\steamapps\\tonikokko\\ricochet\\hl.exe"= UDP:c:\program files\steam\steamapps\tonikokko\ricochet\hl.exe:Half-Life Launcher
"UDP Query User{0CD7D344-BF25-4DBC-BB9F-A077320A0F5C}c:\\program files\\steam\\steamapps\\tonikokko\\ricochet\\hl.exe"= TCP:c:\program files\steam\steamapps\tonikokko\ricochet\hl.exe:Half-Life Launcher
"TCP Query User{A91F8163-967F-4925-AADE-F07576322012}c:\\program files\\steam\\steamapps\\tonikokko\\condition zero deleted scenes\\hl.exe"= UDP:c:\program files\steam\steamapps\tonikokko\condition zero deleted scenes\hl.exe:Half-Life Launcher
"UDP Query User{28567FE8-4FFA-485F-9801-A152048863F2}c:\\program files\\steam\\steamapps\\tonikokko\\condition zero deleted scenes\\hl.exe"= TCP:c:\program files\steam\steamapps\tonikokko\condition zero deleted scenes\hl.exe:Half-Life Launcher
"TCP Query User{E9852CC0-029E-4A0C-8096-FD6ECFAB0A90}c:\\program files\\steam\\steamapps\\tonikokko\\dedicated server\\hlds.exe"= UDP:c:\program files\steam\steamapps\tonikokko\dedicated server\hlds.exe:HLDS Launcher
"UDP Query User{0C665345-3CA8-457E-81C9-6BC344EC98A4}c:\\program files\\steam\\steamapps\\tonikokko\\dedicated server\\hlds.exe"= TCP:c:\program files\steam\steamapps\tonikokko\dedicated server\hlds.exe:HLDS Launcher
"TCP Query User{687C75CE-4F7D-40F5-8C14-87714F9F9416}c:\\program files\\warcraft iii\\war3.exe"= UDP:c:\program files\warcraft iii\war3.exe:war3
"UDP Query User{7D83C4AA-B864-4BB7-8ECA-0879524333EC}c:\\program files\\warcraft iii\\war3.exe"= TCP:c:\program files\warcraft iii\war3.exe:war3
"TCP Query User{01937352-B3E0-4023-A301-3C31B8535E5D}c:\\program files\\free internet tv\\internettv.exe"= UDP:c:\program files\free internet tv\internettv.exe:Free Internet TV
"UDP Query User{1BD9AA70-B7FD-479B-B7F9-B827DD9D7ECB}c:\\program files\\free internet tv\\internettv.exe"= TCP:c:\program files\free internet tv\internettv.exe:Free Internet TV
"TCP Query User{CC790F40-F1A4-425E-9896-B90D44EA42DB}c:\\program files\\imesh applications\\imesh\\imesh.exe"= UDP:c:\program files\imesh applications\imesh\imesh.exe:iMesh
"UDP Query User{5FA2CC62-D1E6-48F4-A379-97881541C956}c:\\program files\\imesh applications\\imesh\\imesh.exe"= TCP:c:\program files\imesh applications\imesh\imesh.exe:iMesh
"{8D434BBF-7B9D-4766-95C6-6BB933BFB15D}"= c:\program files\MSN Messenger\livecall.exe:Windows Live Messenger 8.1 (Phone)
"TCP Query User{424FA59B-44ED-4B85-90AA-433062FB3C35}c:\\program files\\steam\\steamapps\\tonikokko\\half-life 2 deathmatch\\hl2.exe"= UDP:c:\program files\steam\steamapps\tonikokko\half-life 2 deathmatch\hl2.exe:hl2
"UDP Query User{3F7F8D91-AF39-4FB4-918E-106C2CDCCC38}c:\\program files\\steam\\steamapps\\tonikokko\\half-life 2 deathmatch\\hl2.exe"= TCP:c:\program files\steam\steamapps\tonikokko\half-life 2 deathmatch\hl2.exe:hl2
"TCP Query User{B96D695D-8CC8-4D07-A5DD-791BD6310D28}c:\\program files\\steam\\steamapps\\tonikokko\\source dedicated server\\srcds.exe"= UDP:c:\program files\steam\steamapps\tonikokko\source dedicated server\srcds.exe:srcds
"UDP Query User{19313382-DAC4-4AA3-8867-F5146EA31C8D}c:\\program files\\steam\\steamapps\\tonikokko\\source dedicated server\\srcds.exe"= TCP:c:\program files\steam\steamapps\tonikokko\source dedicated server\srcds.exe:srcds
"TCP Query User{91DC95F0-E22E-4614-9B14-F6BEAD27C789}c:\\program files\\steam\\steamapps\\tonikokko\\team fortress 2\\hl2.exe"= UDP:c:\program files\steam\steamapps\tonikokko\team fortress 2\hl2.exe:hl2
"UDP Query User{C105F45B-E023-42E8-8B91-3CC995C607C8}c:\\program files\\steam\\steamapps\\tonikokko\\team fortress 2\\hl2.exe"= TCP:c:\program files\steam\steamapps\tonikokko\team fortress 2\hl2.exe:hl2
"TCP Query User{44BB0EE4-F377-469A-B4D6-D80175D9CECA}c:\\program files\\steam\\steamapps\\common\\trackmania nations forever\\tmforever.exe"= UDP:c:\program files\steam\steamapps\common\trackmania nations forever\tmforever.exe:TmForever
"UDP Query User{91B64548-43FD-4AED-B58F-8FBC4770020B}c:\\program files\\steam\\steamapps\\common\\trackmania nations forever\\tmforever.exe"= TCP:c:\program files\steam\steamapps\common\trackmania nations forever\tmforever.exe:TmForever
"TCP Query User{4BC51E23-3733-41AC-9162-923CB1A596DB}c:\\program files\\gamespy arcade\\aphex.exe"= UDP:c:\program files\gamespy arcade\aphex.exe:GameSpy Arcade
"UDP Query User{6C88CB19-9F83-4819-BA76-DC7374CC48B2}c:\\program files\\gamespy arcade\\aphex.exe"= TCP:c:\program files\gamespy arcade\aphex.exe:GameSpy Arcade
"TCP Query User{756DFC95-D7CB-480C-8032-848E784C0710}c:\\program files\\steam\\steamapps\\tonikokko\\day of defeat source\\hl2.exe"= UDP:c:\program files\steam\steamapps\tonikokko\day of defeat source\hl2.exe:hl2
"UDP Query User{0554D116-1219-42FC-9796-E62DB27BBDAE}c:\\program files\\steam\\steamapps\\tonikokko\\day of defeat source\\hl2.exe"= TCP:c:\program files\steam\steamapps\tonikokko\day of defeat source\hl2.exe:hl2
"TCP Query User{79DA9B44-7689-4B4E-8547-36F63DFCC028}c:\\users\\toni kokko\\appdata\\local\\temp\\wzse1.tmp\\symnrt.exe"= UDP:c:\users\toni kokko\appdata\local\temp\wzse1.tmp\symnrt.exe:symnrt.exe
"UDP Query User{C3336B92-104F-40A9-872B-0AAE6917CC4E}c:\\users\\toni kokko\\appdata\\local\\temp\\wzse1.tmp\\symnrt.exe"= TCP:c:\users\toni kokko\appdata\local\temp\wzse1.tmp\symnrt.exe:symnrt.exe
"TCP Query User{3F2C2531-6397-40DC-BBD1-7DE0D99FD42A}c:\\program files\\xchat\\xchat.exe"= UDP:c:\program files\xchat\xchat.exe:XChat IRC Client
"UDP Query User{48B44EDE-07F6-4F3F-9219-93D4073BD322}c:\\program files\\xchat\\xchat.exe"= TCP:c:\program files\xchat\xchat.exe:XChat IRC Client
"TCP Query User{1807DC00-4740-4285-BAEB-7A470FA25F6A}c:\\program files\\steam\\steamapps\\avigga\\source dedicated server\\srcds.exe"= UDP:c:\program files\steam\steamapps\avigga\source dedicated server\srcds.exe:srcds
"UDP Query User{BD3881C9-8577-4878-AE50-71EA1E2F7981}c:\\program files\\steam\\steamapps\\avigga\\source dedicated server\\srcds.exe"= TCP:c:\program files\steam\steamapps\avigga\source dedicated server\srcds.exe:srcds
"TCP Query User{632A9822-2366-4C5F-9946-BCF45217B019}c:\\program files\\swarmplayer\\swarmplayer.exe"= UDP:c:\program files\swarmplayer\swarmplayer.exe:swarmplayer
"UDP Query User{D770F340-9627-4C5A-BC38-EE624EC0EF76}c:\\program files\\swarmplayer\\swarmplayer.exe"= TCP:c:\program files\swarmplayer\swarmplayer.exe:swarmplayer
"TCP Query User{7025C92C-326F-4C80-9A40-235F04872E01}c:\\program files\\mirc\\mirc.exe"= UDP:c:\program files\mirc\mirc.exe:mIRC
"UDP Query User{0B0B6EFB-3F50-4C76-B1BB-5FA2C9C64DBE}c:\\program files\\mirc\\mirc.exe"= TCP:c:\program files\mirc\mirc.exe:mIRC
"{F22F34CA-F474-47F7-833D-8C7E3F512871}"= UDP:c:\program files\uTorrent\uTorrent.exe:µTorrent (TCP-In)
"{85F9CF5B-1363-454B-BDA0-88D6D5BCE2BF}"= TCP:c:\program files\uTorrent\uTorrent.exe:µTorrent (UDP-In)
"TCP Query User{D0677DA9-934F-4B03-A63A-71F8AD9CE7F5}c:\\program files\\steam\\steamapps\\avigga\\team fortress 2\\hl2.exe"= UDP:c:\program files\steam\steamapps\avigga\team fortress 2\hl2.exe:hl2
"UDP Query User{C6A4E485-9C63-46C1-9603-D10E6AFC14BB}c:\\program files\\steam\\steamapps\\avigga\\team fortress 2\\hl2.exe"= TCP:c:\program files\steam\steamapps\avigga\team fortress 2\hl2.exe:hl2
"TCP Query User{8BA66BAE-D314-44B6-A811-C5A824532414}c:\\program files\\steam\\steamapps\\avigga\\half-life 2\\hl2.exe"= UDP:c:\program files\steam\steamapps\avigga\half-life 2\hl2.exe:hl2
"UDP Query User{6C2708B7-E72C-41D1-A6DD-E8C1D4D866D5}c:\\program files\\steam\\steamapps\\avigga\\half-life 2\\hl2.exe"= TCP:c:\program files\steam\steamapps\avigga\half-life 2\hl2.exe:hl2
"{C59E32F3-0600-4929-83DD-328BB51CC2C4}"= UDP:c:\program files\World of Warcraft\WoW-2.3.3.7799-to-2.4.0.8089-enGB-downloader.exe:Blizzard Downloader
"{F92C8592-E8E1-4274-ADC1-E04D4EDDA2BB}"= TCP:c:\program files\World of Warcraft\WoW-2.3.3.7799-to-2.4.0.8089-enGB-downloader.exe:Blizzard Downloader
"{228A0F0F-7A6F-4DE6-863A-0C6800D88497}"= UDP:c:\users\Public\Documents\Blizzard Entertainment\World of Warcraft\WoW-2.4.3-to-3.0.2-enGB-Win-Final-downloader.exe:Blizzard Downloader
"{A5049911-5EDC-493D-95BF-668F714F538B}"= TCP:c:\users\Public\Documents\Blizzard Entertainment\World of Warcraft\WoW-2.4.3-to-3.0.2-enGB-Win-Final-downloader.exe:Blizzard Downloader
"TCP Query User{EFF679D8-A571-41C8-9097-6D009425FFF8}c:\\program files\\world of warcraft\\world of warcraft\\world of warcraft\\repair.exe"= UDP:c:\program files\world of warcraft\world of warcraft\world of warcraft\repair.exe:Blizzard Repair Utility
"UDP Query User{C6DD3040-93B6-4B22-9AA3-AC0041DF3E95}c:\\program files\\world of warcraft\\world of warcraft\\world of warcraft\\repair.exe"= TCP:c:\program files\world of warcraft\world of warcraft\world of warcraft\repair.exe:Blizzard Repair Utility
"{8F16C087-9E09-476E-9653-28B6D03710FB}"= UDP:c:\users\Public\Documents\Blizzard Entertainment\World of Warcraft\WoW-3.0.2.9056-to-3.0.3.9183-enGB-downloader.exe:Blizzard Downloader
"{30D23163-90AF-455E-BBFB-2A7A9D8A6950}"= TCP:c:\users\Public\Documents\Blizzard Entertainment\World of Warcraft\WoW-3.0.2.9056-to-3.0.3.9183-enGB-downloader.exe:Blizzard Downloader
"{4ED71020-8DAB-461E-A011-FF9054A4F98F}"= UDP:3724:Blizzard Downloader: 3724
"TCP Query User{A48F3969-7B98-4FEF-A123-7729F99FB69C}c:\\users\\toni kokko\\desktop\\lierox_v0.56_pack_1.9\\lierox v0.56 pack 1.9\\lierox.exe"= UDP:c:\users\toni kokko\desktop\lierox_v0.56_pack_1.9\lierox v0.56 pack 1.9\lierox.exe:lierox.exe
"UDP Query User{9FDDD62B-6350-4110-AF53-4737FD530DBF}c:\\users\\toni kokko\\desktop\\lierox_v0.56_pack_1.9\\lierox v0.56 pack 1.9\\lierox.exe"= TCP:c:\users\toni kokko\desktop\lierox_v0.56_pack_1.9\lierox v0.56 pack 1.9\lierox.exe:lierox.exe
"TCP Query User{D5ECF7FC-3CA4-4EBF-94E6-CE7E719C438D}c:\\users\\toni kokko\\desktop\\lierox_v0.56_pack_1.9\\lierox v0.56 pack 1.9\\lierox.exe"= UDP:c:\users\toni kokko\desktop\lierox_v0.56_pack_1.9\lierox v0.56 pack 1.9\lierox.exe:lierox.exe
"UDP Query User{CEC1032E-1DF7-4CF6-B0BD-4B9ECFB8A640}c:\\users\\toni kokko\\desktop\\lierox_v0.56_pack_1.9\\lierox v0.56 pack 1.9\\lierox.exe"= TCP:c:\users\toni kokko\desktop\lierox_v0.56_pack_1.9\lierox v0.56 pack 1.9\lierox.exe:lierox.exe
"{77FAE065-C5AB-4851-A183-EE612AF46CC8}"= c:\program files\MSN Messenger\livecall.exe:Windows Live Messenger 8.1 (Phone)
"{25634C9B-2C05-450D-B0AA-03952E3E3D3D}"= c:\program files\MSN Messenger\livecall.exe:Windows Live Messenger 8.1 (Phone)
"{66E0E986-796C-4553-8F29-3580DF0903B8}"= UDP:c:\program files\Malwarebytes' Anti-Malware\mbam.exe:Malwarebytes' Anti-Malware
"{A052AC37-EA62-4011-B0FD-D1A0946168DA}"= TCP:c:\program files\Malwarebytes' Anti-Malware\mbam.exe:Malwarebytes' Anti-Malware
"TCP Query User{C415CF1E-6660-4D46-80CE-899F0502C701}c:\\program files\\emule\\emule.exe"= Disabled:UDP:c:\program files\emule\emule.exe:eMule
"UDP Query User{BCA21BF4-4166-4BB1-B95C-DA5C6CFDA864}c:\\program files\\emule\\emule.exe"= Disabled:TCP:c:\program files\emule\emule.exe:eMule
"TCP Query User{26751923-DEFB-4A76-B360-5EE6BD2F1E8C}c:\\program files\\imesh applications\\imesh\\imesh.exe"= Disabled:UDP:c:\program files\imesh applications\imesh\imesh.exe:iMesh
"UDP Query User{19B221A2-173E-4CE8-A4F5-DAD2A22BA0C5}c:\\program files\\imesh applications\\imesh\\imesh.exe"= Disabled:TCP:c:\program files\imesh applications\imesh\imesh.exe:iMesh
"{4A3E76A5-F956-422C-A8B5-78D8DCE2B678}"= c:\program files\MSN Messenger\livecall.exe:Windows Live Messenger 8.1 (Phone)
"{42161E04-D772-488E-A978-0F12110F6EF8}"= UDP:c:\users\Toni Kokko\AppData\Local\Temp\WZSE0.TMP\SymNRT.exe:Norton Removal Tool
"{C468BB28-F1EE-41BE-ADB4-0BCE04554273}"= TCP:c:\users\Toni Kokko\AppData\Local\Temp\WZSE0.TMP\SymNRT.exe:Norton Removal Tool
"{633A8E51-2411-4FDE-B3CC-9DC01825D5C2}"= UDP:c:\windows\System32\WindowsAnytimeUpgrade.exe:Windows Anytime Upgrade
"{2C14C3C3-87EE-41D3-A496-4AA3D1483D3F}"= TCP:c:\windows\System32\WindowsAnytimeUpgrade.exe:Windows Anytime Upgrade

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\StandardProfile\AuthorizedApplications\List]
"c:\\Program Files\\BitTorrent\\bittorrent.exe"= c:\program files\BitTorrent\bittorrent.exe:*:Enabled:BitTorrent
"c:\\Program Files\\xchat\\xchat.exe"= c:\program files\xchat\xchat.exe:*:Enabled:XChat IRC Client

R2 BWH32S;BWH32S;"c:\program files\BUFFALO\clientmgrv\bin\BWH32S.exe" [2008-10-07 57912]
R2 Ndiskio;Ndiskio;\??\c:\program files\Norman\Nse\bin\NDISKIO.SYS [2007-09-30 20448]
R2 NVOY;Norman's Very Own supplY of resources;"c:\program files\Norman\npm\bin\nvoy.exe" [2008-03-24 121912]
R3 nsesvc;Norman Scanner Engine Service;"c:\program files\Norman\nse\bin\NSESVC.EXE" -daemon [2008-06-26 322616]
R3 NvcMFlt;NvcMFlt;c:\windows\system32\DRIVERS\nvcv32mf.sys [2008-09-04 19512]
R3 nvcoas;Norman Virus Control on-access component;"c:\program files\Norman\Nvc\bin\nvcoas.exe" [2008-03-24 191544]
R3 NVCScheduler;Norman Virus Control Scheduler;"c:\program files\Norman\Npm\bin\NVCSCHED.EXE" [2008-03-24 154680]
R3 WLIU2KG125S;BUFFALO WLI-U2-KG125S Wireless LAN Adapter Driver;c:\windows\system32\DRIVERS\usb8023.sys [2008-05-24 15872]
S3 Bufeap;BUFFALO EAP Driver;c:\windows\system32\DRIVERS\bufeap.sys [2008-10-07 14848]
S3 netr73;RT73 USB Wireless LAN Card Driver for Vista;c:\windows\system32\DRIVERS\netr73.sys [2007-05-11 329728]
S3 StickCap;Digital TV DVB-T USB Stick adapter service;c:\windows\system32\Drivers\stickcap.sys [2008-10-22 15744]
S3 stickload;Digital TV stick firmware loader service;c:\windows\system32\DRIVERS\stickload.sys [2008-10-22 17024]
S4 Automaattinen LiveUpdate-ajastustoiminto;Automaattinen LiveUpdate-ajastustoiminto;"c:\program files\Symantec\LiveUpdate\ALUSchedulerSvc.exe" []

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\G]
\shell\AutoRun\command - G:\LaunchU3.exe -a

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{222a7df5-b2c2-11dc-9225-001b247c1e44}]
\shell\AutoRun\command - E:\Setup.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{7c0e6525-c9f4-11dd-9cb1-001601cfc4c2}]
\shell\AutoRun\command - G:\LaunchU3.exe -a

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{96238bad-7562-11dc-93fe-001b247c1e44}]
\shell\AutoRun\command - E:\setup.exe /autorun
\shell\directx\command - e:\directx\dxsetup.exe
\shell\setup\command - E:\setup.exe

*Newly Created Service* - MBAMSWISSARMY
.
'Ajoitetut tehtävät'-kansion sisältö

2008-12-15 c:\windows\Tasks\GoogleUpdateTaskUser.job
- c:\users\Toni Kokko\AppData\Local\Google\Update\GoogleUpdate.exe [2008-12-15 21:39]

2008-12-15 c:\windows\Tasks\User_Feed_Synchronization-{C68C7EA6-5ACB-42EA-BD75-B52875D630F3}.job
- c:\windows\system32\msfeedssync.exe [2008-01-18 22:33]
.
- - - - POISTETUT JÄMÄRIVIT - - - -

MSConfigStartUp-ArcSoft Connection Service - c:\program files\Common Files\ArcSoft\Connection Service\Bin\ACDaemon.exe
MSConfigStartUp-SweetIM - c:\program files\Macrogaming\SweetIM\SweetIM.exe



**************************************************************************

catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-12-15 22:22:33
Windows 6.0.6001 Service Pack 1 NTFS

tarkistaa piilotettuja prosesseja ...

tarkistaa piilotettuja käynnistysarvoja ...

tarkistaa piilotettuja tiedostoja ...

tarkistus on valmis
piilotetut tiedostot: 0

**************************************************************************
.
--------------------- Prosesseihin ladatut DLLt ---------------------

- - - - - - - > 'Explorer.exe'(2360)
c:\program files\Norman\nvc\bin\Niphk.dll
.
Valmistumisajankohta: 2008-12-15 22:29:46
ComboFix-quarantined-files.txt 2008-12-15 20:29:38

Ennen ajoa: 39 070 318 592 tavua vapaana
Ajon jälkeen: 42,293,612,544 tavua vapaana

402 --- E O F --- 2008-12-15 20:08:06


[ + lainaa]
Toni

Viestiä on muokattu lähettämisen jälkeen. Viimeisin muokkaus 15. joulukuuta 2008 @ 22:36
Hujo
Suspended permanently
_ 		15. joulukuuta 2008 @ 23:49 _ Linkki tähän viestiin    Lähetä käyttäjälle yksityisviesti   
Avaa Muistio ja kopioi/liitä lainauksen sisältö sinne:

Lainaus:
Folder::
c:\programdata\Grisoft
c:\users\All Users\Grisoft
C:\$AVG8.VAULT$
c:\programdata\avg8
c:\users\All Users\avg8
c:\users\Toni Kokko\AppData\Roaming\SUPERAntiSpyware.com
c:\users\All Users\SUPERAntiSpyware.com
c:\programdata\SUPERAntiSpyware.com
c:\program files\SUPERAntiSpyware
c:\program files\Common Files\Symantec Shared
c:\programdata\Symantec
Registry::
[-HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
[-HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]

Tallenna se nimellä CFScript.txt

Sitten raahaa CFScript ComboFix.exeen kuten alla.



Käynnistä tietokone uudelleen pyydettäessä ja lähetä combofix.txt-tiedoston sisältö tänne.

=================

Luo poistolista:
? Avaa HiJackThis
? Klikkaa "Configure" valintaa oikealla alhaalla
? Klikkaa "Misc Tools"
? Klikkaa boxia joka sanoo "Uninstall Manager"
? Klikkaa valintaa "Save list"
? Kopioi ja liitä kyseinen lista muistiosta ketjuusi

[ + lainaa]
Voiko tietsikka koskaan toimia?
tonikokko
Member
_ 		16. joulukuuta 2008 @ 16:19 _ Linkki tähän viestiin    Lähetä käyttäjälle yksityisviesti   
Tässä on Combofix logi.

ComboFix 08-12-15.01 - Toni Kokko 2008-12-16 16:00:02.2 - NTFSx86
Microsoft® Windows Vista? Home Premium 6.0.6001.1.1252.1.1035.18.1982.1006 [GMT 2:00]
Sijainti: c:\users\Toni Kokko\Desktop\ComboFix.exe
Käytetyt komentorivivalitsimet :: c:\users\Toni Kokko\Desktop\CFScript.txt
* Uusi palautuspiste luotu
* Resident AV is active

.

(((((((((((((((((((((((((((((((((((((( Muut poistot ))))))))))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\$AVG8.VAULT$
c:\$avg8.vault$\V_00000001.fil
c:\$avg8.vault$\V_00000002.fil
c:\$avg8.vault$\V_00000003.fil
c:\$avg8.vault$\V_00000004.fil
c:\$avg8.vault$\V_00000005.fil
c:\$avg8.vault$\V_00000006.fil
c:\$avg8.vault$\vvfolder.idx
c:\program files\Common Files\Symantec Shared
c:\program files\Common Files\Symantec Shared\CCPD-LC\symlcrst.dll
c:\program files\SUPERAntiSpyware
c:\programdata\avg8
c:\programdata\avg8\Cfg\krnl.cfg
c:\programdata\avg8\Cfg\mail.cfg
c:\programdata\avg8\Cfg\scan.cfg
c:\programdata\avg8\Cfg\sched.cfg
c:\programdata\avg8\Cfg\update.cfg
c:\programdata\avg8\Cfg\user.cfg
c:\programdata\avg8\Log\avgcfg.log.lock
c:\programdata\avg8\Log\avgcore.log
c:\programdata\avg8\Log\avgcore.log.1
c:\programdata\avg8\Log\avgcore.log.2
c:\programdata\avg8\Log\avgcore.log.3
c:\programdata\avg8\Log\avgcore.log.4
c:\programdata\avg8\Log\avgcore.log.5
c:\programdata\avg8\Log\avgcore.log.6
c:\programdata\avg8\Log\avgcore.log.lock
c:\programdata\avg8\Log\avglng.log
c:\programdata\avg8\Log\avglng.log.lock
c:\programdata\avg8\Log\avgrs.log
c:\programdata\avg8\Log\avgrs.log.lock
c:\programdata\avg8\Log\avgscan.log
c:\programdata\avg8\Log\avgscan.log.lock
c:\programdata\avg8\Log\avgsched.log.lock
c:\programdata\avg8\Log\avgsrm.log
c:\programdata\avg8\Log\avgsrm.log.lock
c:\programdata\avg8\Log\avgui.log
c:\programdata\avg8\Log\avgui.log.lock
c:\programdata\avg8\Log\avgupd.log
c:\programdata\avg8\Log\avgupd.log.lock
c:\programdata\avg8\Log\avgwd.log.lock
c:\programdata\avg8\Log\avgwdsvc.log
c:\programdata\avg8\Log\avgwdsvc.log.lock
c:\programdata\avg8\Log\avildr.log
c:\programdata\avg8\Log\commonpriv.log
c:\programdata\avg8\Log\commonpriv.log.lock
c:\programdata\avg8\Log\history.xml
c:\programdata\avg8\scanlogs\I_00000001.log
c:\programdata\avg8\scanlogs\I_00000005.log
c:\programdata\avg8\scanlogs\I_00000006.log
c:\programdata\avg8\scanlogs\I_00000007.log
c:\programdata\avg8\scanlogs\I_00000008.log
c:\programdata\avg8\scanlogs\I_00000009.log
c:\programdata\avg8\scanlogs\I_00000010.log
c:\programdata\avg8\scanlogs\I_00000011.log
c:\programdata\avg8\scanlogs\I_00000012.log
c:\programdata\avg8\scanlogs\srm.idx
c:\programdata\avg8\update\backup\incavi.avm
c:\programdata\avg8\update\backup\microavi.avg
c:\programdata\avg8\update\backup\sb2.dat
c:\programdata\avg8\update\backup\sc.dat
c:\programdata\avg8\update\prepare\sc.dat.prepare
c:\programdata\Grisoft
c:\programdata\Grisoft\AVG Anti-Spyware 7.5\Downloads\help.dll
c:\programdata\SUPERAntiSpyware.com
c:\programdata\Symantec
c:\programdata\Symantec\ErrLogs\{830D8CBD-C668-49e2-A969-C2C2106332E0}18f726fd.zip
c:\programdata\Symantec\ErrLogs\{830D8CBD-C668-49e2-A969-C2C2106332E0}1e46ccf9.zip
c:\programdata\Symantec\ErrLogs\{830D8CBD-C668-49e2-A969-C2C2106332E0}77ef3ed6.zip
c:\programdata\Symantec\ErrLogs\{830D8CBD-C668-49e2-A969-C2C2106332E0}cea97e10.zip
c:\programdata\Symantec\ErrLogs\{830D8CBD-C668-49e2-A969-C2C2106332E0}d31c070.zip
c:\programdata\Symantec\ErrLogs\{830D8CBD-C668-49e2-A969-C2C2106332E0}ecdfe384.zip
c:\programdata\Symantec\ErrLogs\{830D8CBD-C668-49e2-A969-C2C2106332E0}fd71ca00.zip
c:\users\All Users\avg8\Cfg\krnl.cfg
c:\users\All Users\avg8\Cfg\mail.cfg
c:\users\All Users\avg8\Cfg\scan.cfg
c:\users\All Users\avg8\Cfg\sched.cfg
c:\users\All Users\avg8\Cfg\update.cfg
c:\users\All Users\avg8\Cfg\user.cfg
c:\users\All Users\avg8\Log\avgcfg.log.lock
c:\users\All Users\avg8\Log\avgcore.log
c:\users\All Users\avg8\Log\avgcore.log.1
c:\users\All Users\avg8\Log\avgcore.log.2
c:\users\All Users\avg8\Log\avgcore.log.3
c:\users\All Users\avg8\Log\avgcore.log.4
c:\users\All Users\avg8\Log\avgcore.log.5
c:\users\All Users\avg8\Log\avgcore.log.6
c:\users\All Users\avg8\Log\avgcore.log.lock
c:\users\All Users\avg8\Log\avglng.log
c:\users\All Users\avg8\Log\avglng.log.lock
c:\users\All Users\avg8\Log\avgrs.log
c:\users\All Users\avg8\Log\avgrs.log.lock
c:\users\All Users\avg8\Log\avgscan.log
c:\users\All Users\avg8\Log\avgscan.log.lock
c:\users\All Users\avg8\Log\avgsched.log.lock
c:\users\All Users\avg8\Log\avgsrm.log
c:\users\All Users\avg8\Log\avgsrm.log.lock
c:\users\All Users\avg8\Log\avgui.log
c:\users\All Users\avg8\Log\avgui.log.lock
c:\users\All Users\avg8\Log\avgupd.log
c:\users\All Users\avg8\Log\avgupd.log.lock
c:\users\All Users\avg8\Log\avgwd.log.lock
c:\users\All Users\avg8\Log\avgwdsvc.log
c:\users\All Users\avg8\Log\avgwdsvc.log.lock
c:\users\All Users\avg8\Log\avildr.log
c:\users\All Users\avg8\Log\commonpriv.log
c:\users\All Users\avg8\Log\commonpriv.log.lock
c:\users\All Users\avg8\Log\history.xml
c:\users\All Users\avg8\scanlogs\I_00000001.log
c:\users\All Users\avg8\scanlogs\I_00000005.log
c:\users\All Users\avg8\scanlogs\I_00000006.log
c:\users\All Users\avg8\scanlogs\I_00000007.log
c:\users\All Users\avg8\scanlogs\I_00000008.log
c:\users\All Users\avg8\scanlogs\I_00000009.log
c:\users\All Users\avg8\scanlogs\I_00000010.log
c:\users\All Users\avg8\scanlogs\I_00000011.log
c:\users\All Users\avg8\scanlogs\I_00000012.log
c:\users\All Users\avg8\scanlogs\srm.idx
c:\users\All Users\avg8\update\backup\incavi.avm
c:\users\All Users\avg8\update\backup\microavi.avg
c:\users\All Users\avg8\update\backup\sb2.dat
c:\users\All Users\avg8\update\backup\sc.dat
c:\users\All Users\avg8\update\prepare\sc.dat.prepare
c:\users\All Users\Grisoft\AVG Anti-Spyware 7.5\Downloads\help.dll
c:\users\Toni Kokko\AppData\Roaming\SUPERAntiSpyware.com

.
((((( Tiedostot, jotka on luotu seuraavalla aikavälillä: 2008-11-16 to 2008-12-16 )))))))))))))))))
.

2008-12-14 20:48 . 2008-12-14 20:48 <KANSIO> d-------- c:\program files\Java
2008-12-14 20:48 . 2008-12-14 20:48 410,984 --a------ c:\windows\System32\deploytk.dll
2008-12-14 17:41 . 2008-12-14 17:42 <KANSIO> d-------- c:\users\Toni Kokko\AppData\Roaming\U3
2008-12-11 23:08 . 2008-12-14 17:56 <KANSIO> d-------- c:\users\Toni Kokko\.SunDownloadManager
2008-12-11 22:37 . 2008-12-11 22:37 42,320 --a------ c:\windows\System32\xfcodec.dll
2008-12-11 15:00 . 2008-12-11 15:00 249,592 --a------ c:\windows\System32\cssdll32.dll
2008-12-11 14:56 . 2008-12-14 20:24 <KANSIO> d-------- c:\users\Toni Kokko\AppData\Roaming\Comodo
2008-12-11 14:55 . 2008-12-14 20:24 <KANSIO> d-------- c:\users\All Users\comodo
2008-12-11 14:55 . 2008-12-14 20:24 <KANSIO> d-------- c:\programdata\comodo
2008-12-11 14:55 . 2008-12-14 20:24 <KANSIO> d-------- c:\program files\COMODO
2008-12-10 23:23 . 2008-12-10 23:23 <KANSIO> d-------- c:\users\Toni Kokko\AppData\Roaming\ImgBurn
2008-12-10 23:19 . 2008-12-10 23:19 <KANSIO> d-------- c:\program files\ImgBurn
2008-12-10 20:52 . 2008-12-10 20:52 <KANSIO> d-------- c:\temp\Windows XP Professional (English)
2008-12-10 16:01 . 2008-10-22 03:22 2,048 --a------ c:\windows\System32\tzres.dll
2008-12-09 21:05 . 2008-12-09 21:05 <KANSIO> d-------- c:\program files\Trend Micro
2008-12-08 18:53 . 2008-12-08 18:53 <KANSIO> d-------- c:\users\All Users\Kaspersky Lab Setup Files
2008-12-08 18:53 . 2008-12-08 18:53 <KANSIO> d-------- c:\programdata\Kaspersky Lab Setup Files
2008-12-07 23:57 . 2008-12-07 23:57 <KANSIO> d-------- c:\windows\Sun
2008-12-02 21:43 . 2008-12-02 21:43 <KANSIO> d-------- c:\users\Toni Kokko\AppData\Roaming\Malwarebytes
2008-12-02 21:43 . 2008-12-02 21:43 <KANSIO> d-------- c:\users\All Users\Malwarebytes
2008-12-02 21:43 . 2008-12-02 21:43 <KANSIO> d-------- c:\programdata\Malwarebytes
2008-12-02 21:43 . 2008-12-14 22:54 <KANSIO> d-------- c:\program files\Malwarebytes' Anti-Malware
2008-12-02 21:43 . 2008-12-03 19:52 38,496 --a------ c:\windows\System32\drivers\mbamswissarmy.sys
2008-12-02 21:43 . 2008-12-03 19:52 15,504 --a------ c:\windows\System32\drivers\mbam.sys
2008-11-26 19:39 . 2008-10-21 07:25 1,645,568 --a------ c:\windows\System32\connect.dll
2008-11-26 19:39 . 2008-08-28 05:40 712,704 --a------ c:\windows\System32\WindowsCodecs.dll
2008-11-26 19:39 . 2008-08-28 05:40 425,472 --a------ c:\windows\System32\PhotoMetadataHandler.dll
2008-11-26 19:39 . 2008-08-28 05:40 347,136 --a------ c:\windows\System32\WindowsCodecsExt.dll
2008-11-26 19:39 . 2008-10-22 05:57 241,152 --a------ c:\windows\System32\PortableDeviceApi.dll
2008-11-24 22:36 . 2008-11-24 22:37 <KANSIO> d-------- c:\users\All Users\Lavasoft
2008-11-24 22:36 . 2008-11-24 22:37 <KANSIO> d-------- c:\programdata\Lavasoft
2008-11-24 22:36 . 2008-11-24 22:36 <KANSIO> d-------- c:\program files\Lavasoft
2008-11-24 22:35 . 2008-12-10 18:41 <KANSIO> d-------- c:\program files\Common Files\Wise Installation Wizard
2008-11-23 22:44 . 2008-11-23 22:44 <KANSIO> dr------- c:\windows\System32\config\systemprofile\Videos
2008-11-23 22:44 . 2008-11-23 22:44 <KANSIO> dr------- c:\windows\System32\config\systemprofile\Pictures
2008-11-23 22:44 . 2008-11-23 22:44 <KANSIO> dr------- c:\windows\System32\config\systemprofile\Downloads
2008-11-23 22:44 . 2008-11-23 22:44 <KANSIO> dr------- c:\windows\System32\config\systemprofile\Documents
2008-11-23 20:15 . 2008-11-23 20:15 52,736 --a------ c:\windows\ipuninst.exe
2008-11-23 19:50 . 2008-11-23 19:50 <KANSIO> d-------- c:\program files\Alcohol Soft
2008-11-17 16:27 . 2008-11-17 16:27 <KANSIO> d-------- c:\program files\CCleaner

.
(((((((((((((((((((((((((((((((((((( Find3M-raportti ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-12-16 09:14 28,314 ----a-w c:\users\Toni Kokko\AppData\Roaming\nvModes.dat
2008-12-16 09:05 --------- d-----w c:\users\Toni Kokko\AppData\Roaming\Xfire
2008-12-16 09:05 --------- d-----w c:\programdata\Xfire
2008-12-16 09:05 --------- d-----w c:\program files\Xfire
2008-12-16 09:02 --------- d-----w c:\program files\Steam
2008-12-15 05:12 --------- d-----w c:\program files\World of Warcraft
2008-12-14 20:19 --------- d-----w c:\program files\Norman
2008-12-14 18:21 --------- d-----w c:\users\Toni Kokko\AppData\Roaming\uTorrent
2008-12-14 18:05 --------- d--h--w c:\program files\InstallShield Installation Information
2008-12-14 16:33 --------- d-----w c:\users\Toni Kokko\AppData\Roaming\mIRC
2008-12-10 14:50 --------- d-----w c:\program files\Windows Mail
2008-12-10 13:35 --------- d-----w c:\program files\mIRC
2008-12-08 07:23 --------- d-----w c:\program files\MSN Messenger
2008-12-07 17:31 --------- d-----w c:\program files\RevConnect
2008-12-03 20:31 --------- d-----w c:\program files\WhatPulse
2008-11-24 09:59 --------- d-----w c:\program files\Google
2008-11-23 21:22 --------- d-----w c:\users\Toni Kokko\AppData\Roaming\BSplayer
2008-11-23 21:22 --------- d-----w c:\program files\Webteh
2008-11-23 20:27 --------- d-----w c:\programdata\Team MediaPortal
2008-11-23 20:27 --------- d-----w c:\program files\Team MediaPortal
2008-11-23 19:15 --------- d-----w c:\program files\Common Files\ArcSoft
2008-11-23 17:18 717,296 ----a-w c:\windows\system32\drivers\sptd.sys
2008-11-22 18:33 --------- d-----w c:\program files\SystemRequirementsLab
2008-11-22 18:31 --------- d-----w c:\users\Toni Kokko\AppData\Roaming\SystemRequirementsLab
2008-11-15 20:11 --------- d-----w c:\program files\Common Files\Steam
2008-11-13 16:21 --------- d-----w c:\users\Toni Kokko\AppData\Roaming\Skype
2008-11-03 14:00 --------- d-----w c:\programdata\Blizzard
2008-11-02 18:36 --------- d-----w c:\program files\Common Files\Blizzard Entertainment
2008-11-01 19:22 --------- d-----w c:\programdata\ArcSoft
2008-11-01 16:15 --------- d-----w c:\program files\Microsoft SQL Server
2008-11-01 07:40 30 ----a-w c:\users\Toni Kokko\jagex_runescape_preferences.dat
2008-11-01 03:44 541,696 ----a-w c:\windows\AppPatch\AcLayers.dll
2008-11-01 03:44 52,736 ----a-w c:\windows\AppPatch\iebrshim.dll
2008-11-01 03:44 460,288 ----a-w c:\windows\AppPatch\AcSpecfc.dll
2008-11-01 03:44 28,672 ----a-w c:\windows\System32\Apphlpdm.dll
2008-11-01 03:44 2,154,496 ----a-w c:\windows\AppPatch\AcGenral.dll
2008-11-01 03:44 173,056 ----a-w c:\windows\AppPatch\AcXtrnal.dll
2008-11-01 01:21 4,240,384 ----a-w c:\windows\System32\GameUXLegacyGDFs.dll
2008-10-31 20:12 --------- d-----w c:\users\Toni Kokko\AppData\Roaming\Ventrilo
2008-10-31 19:17 --------- d-----w c:\users\Toni Kokko\AppData\Roaming\ArcSoft
2008-10-31 16:40 --------- d-----w c:\program files\mpgconv
2008-10-31 16:12 --------- d-----w c:\program files\Microsoft.NET
2008-10-31 15:08 --------- d-----w c:\program files\ProgDVB
2008-10-29 06:29 2,927,104 ----a-w c:\windows\explorer.exe
2008-10-22 15:44 --------- d-----w c:\program files\Microsoft Silverlight
2008-10-21 05:25 296,960 ----a-w c:\windows\System32\gdi32.dll
2008-10-20 13:27 --------- d-----w c:\users\Toni Kokko\AppData\Roaming\fretsonfire
2008-10-17 17:20 --------- d-----w c:\program files\uTorrent
2008-10-17 11:15 --------- d-----w c:\program files\xchat
2008-10-17 11:14 --------- d-----w c:\program files\Frets on Fire
2008-10-17 11:10 --------- d-----w c:\program files\Audacity
2008-10-16 21:13 1,809,944 ----a-w c:\windows\System32\wuaueng.dll
2008-10-16 21:12 561,688 ----a-w c:\windows\System32\wuapi.dll
2008-10-16 21:09 51,224 ----a-w c:\windows\System32\wuauclt.exe
2008-10-16 21:09 43,544 ----a-w c:\windows\System32\wups2.dll
2008-10-16 21:08 34,328 ----a-w c:\windows\System32\wups.dll
2008-10-16 20:56 1,524,736 ----a-w c:\windows\System32\wucltux.dll
2008-10-16 20:55 83,456 ----a-w c:\windows\System32\wudriver.dll
2008-10-16 12:08 162,064 ----a-w c:\windows\System32\wuwebv.dll
2008-10-16 11:56 31,232 ----a-w c:\windows\System32\wuapp.exe
2008-10-16 04:47 827,392 ----a-w c:\windows\System32\wininet.dll
2008-10-09 16:54 28,672 ----a-w c:\windows\System32\AF15BDAEX.dll
2008-09-30 14:43 1,286,152 ----a-w c:\windows\System32\msxml4.dll
2008-09-18 05:09 3,601,464 ----a-w c:\windows\System32\ntkrnlpa.exe
2008-09-18 05:09 3,549,240 ----a-w c:\windows\System32\ntoskrnl.exe
2008-09-18 04:56 147,456 ----a-w c:\windows\System32\Faultrep.dll
2008-09-18 04:56 125,952 ----a-w c:\windows\System32\wersvc.dll
2008-09-18 02:16 2,032,640 ----a-w c:\windows\System32\win32k.sys
2008-05-24 06:35 174 --sha-w c:\program files\desktop.ini
2007-11-12 15:12 856 ----a-w c:\users\Toni Kokko\AppData\Roaming\wklnhst.dat
2005-07-05 14:47 777 ----a-w c:\program files\trial_setup.ini
2005-07-05 14:47 5,133,312 ----a-w c:\program files\trial_setup.msi
2005-07-05 14:47 40,448 ----a-w c:\program files\trial_setup.exe
2007-10-28 17:48 16,384 --sha-w c:\windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat
2007-10-28 17:48 32,768 --sha-w c:\windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat
2007-10-28 17:48 16,384 --sha-w c:\windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Cookies\index.dat
2007-08-30 15:12 16 --sha-w c:\windows\SMINST\HPCD.sys
.

((((((((((((((((((((((((((((( snapshot@2008-12-15_22.23.28,00 )))))))))))))))))))))))))))))))))))))))))
.
- 2008-12-15 17:36:07 262,144 --sha-w c:\windows\ServiceProfiles\NetworkService\NTUSER.DAT
+ 2008-12-15 20:22:47 262,144 --sha-w c:\windows\ServiceProfiles\NetworkService\NTUSER.DAT
+ 2008-12-15 20:22:47 262,144 ---ha-w c:\windows\ServiceProfiles\NetworkService\ntuser.dat.LOG1
- 2008-12-15 14:21:23 489,176 ----a-w c:\windows\System32\WDI\SuspendPerformanceDiagnostics_SystemData_S3.bin
+ 2008-12-16 13:07:15 492,322 ----a-w c:\windows\System32\WDI\SuspendPerformanceDiagnostics_SystemData_S3.bin
.
(((((((((((((((((((((((((((((( Rekisterin käynnistyskohteet )))))))))))))))))))))))))))))))))))))))))))))
.
.
*Huom* Tyhjiä arvoja ja laillisia oletusarvoja ei näytetä
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Sidebar"="c:\program files\Windows Sidebar\sidebar.exe" [2008-01-18 1233920]
"ehTray.exe"="c:\windows\ehome\ehTray.exe" [2008-01-18 125952]
"msnmsgr"="c:\program files\MSN Messenger\msnmsgr.exe" [2007-01-19 5674352]
"Google Update"="c:\users\Toni Kokko\AppData\Local\Google\Update\GoogleUpdate.exe" [2008-12-15 133104]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2008-03-28 1045800]
"QPService"="c:\program files\HP\QuickPlay\QPService.exe" [2007-04-23 176128]
"QlbCtrl"="c:\program files\Hewlett-Packard\HP Quick Launch Buttons\QlbCtrl.exe" [2007-02-13 159744]
"HP Health Check Scheduler"="c:\program files\Hewlett-Packard\HP Health Check\HPHC_Scheduler.exe" [2007-03-12 50696]
"hpWirelessAssistant"="c:\program files\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe" [2007-03-01 472776]
"WAWifiMessage"="c:\program files\Hewlett-Packard\HP Wireless Assistant\WiFiMsg.exe" [2007-01-10 317128]
"Norman ZANDA"="c:\program files\Norman\Npm\Bin\ZLH.EXE" [2008-06-02 277616]
"NvSvc"="c:\windows\system32\nvsvc.dll" [2007-11-07 86016]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2007-11-07 8534560]
"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2007-11-07 81920]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2008-12-14 136600]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce]
"Launcher"="c:\windows\SMINST\launcher.exe" [2006-11-07 44128]

c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
ClientManagerV.lnk - c:\program files\BUFFALO\clientmgrv\bin\cmvMain.exe [2008-10-07 138808]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"EnableUIADesktopToggle"= 0 (0x0)

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"AppInit_DLLs"=

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"vidc.ffds"= c:\program files\ffdshow\ffdshow.ax
"VIDC.XFR1"= xfcodec.dll

[HKLM\~\startupfolder\C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^Adobe Gamma Loader.lnk]
path=c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\Adobe Gamma Loader.lnk
backup=c:\windows\pss\Adobe Gamma Loader.lnk.CommonStartup
backupExtension=.CommonStartup

[HKLM\~\startupfolder\C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^TMMonitor.lnk]
path=c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\TMMonitor.lnk
backup=c:\windows\pss\TMMonitor.lnk.CommonStartup
backupExtension=.CommonStartup

[HKLM\~\startupfolder\C:^Users^Toni Kokko^AppData^Roaming^Microsoft^Windows^Start Menu^Programs^Startup^Xfire.lnk]
path=c:\users\Toni Kokko\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Xfire.lnk
backup=c:\windows\pss\Xfire.lnk.Startup
backupExtension=.Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher]
--a------ 2008-01-11 21:16 39792 c:\program files\Adobe\Reader 8.0\Reader\reader_sl.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\msnmsgr]
--a------ 2007-01-19 11:55 5674352 c:\program files\MSN Messenger\msnmsgr.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Skype]
--a------ 2006-07-13 23:41 20034600 c:\program files\Skype\Phone\Skype.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WhatPulse]
--a------ 2006-08-21 19:48 665600 c:\program files\WhatPulse\WhatPulse.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WinampAgent]
--a------ 2008-08-04 01:02 36352 c:\program files\Winamp\winampa.exe

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]
"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\FirewallRules]
"TCP Query User{0E60E5F2-C916-49E0-95D4-2E627F9B6584}c:\\program files\\msn messenger\\msnmsgr.exe"= UDP:c:\program files\msn messenger\msnmsgr.exe:Messenger
"UDP Query User{4C2E6A0D-F273-4BDA-83C8-F765026B7793}c:\\program files\\msn messenger\\msnmsgr.exe"= TCP:c:\program files\msn messenger\msnmsgr.exe:Messenger
"{D544B387-58C0-408C-A260-FD2D4E311490}"= UDP:c:\program files\Atari\Neverwinter Nights 2\nwn2main.exe:Neverwinter Nights 2 Main
"{8EA83D06-8F05-4EF9-80CA-755B77E5AFF8}"= TCP:c:\program files\Atari\Neverwinter Nights 2\nwn2main.exe:Neverwinter Nights 2 Main
"{AFD50BC0-ADB8-48FD-89BA-EB04869FB04A}"= UDP:c:\program files\Atari\Neverwinter Nights 2\nwn2main_amdxp.exe:Neverwinter Nights 2 AMD
"{BE23AB97-F9AB-4DE6-A39D-6E559FC93900}"= TCP:c:\program files\Atari\Neverwinter Nights 2\nwn2main_amdxp.exe:Neverwinter Nights 2 AMD
"{D66B4CF5-C554-4AEB-A86E-AD7DB85A46A8}"= UDP:c:\program files\Atari\Neverwinter Nights 2\nwupdate.exe:Neverwinter Nights 2 Updater
"{CE2B4A9D-8D3E-493A-85E2-75A59E58922D}"= TCP:c:\program files\Atari\Neverwinter Nights 2\nwupdate.exe:Neverwinter Nights 2 Updater
"{9963DB7F-22C2-473D-9917-DC1D1E408B72}"= UDP:c:\program files\Atari\Neverwinter Nights 2\nwn2server.exe:Neverwinter Nights 2 Server
"{244AD98B-9023-47F0-AD1E-29BC7685E96A}"= TCP:c:\program files\Atari\Neverwinter Nights 2\nwn2server.exe:Neverwinter Nights 2 Server
"TCP Query User{F489A6A9-FE85-4FA6-85CF-E59E6DAF3156}c:\\program files\\xfire\\xfire.exe"= UDP:c:\program files\xfire\xfire.exe:Xfire
"UDP Query User{7D9956B7-71D1-4FC4-9CE6-832F85DAB2F3}c:\\program files\\xfire\\xfire.exe"= TCP:c:\program files\xfire\xfire.exe:Xfire
"TCP Query User{C1771924-088B-4479-9E4F-08E43FFECB97}c:\\program files\\msn messenger\\livecall.exe"= UDP:c:\program files\msn messenger\livecall.exe:Windows Live Call
"UDP Query User{F792272E-B764-4CFD-B2F1-C8B157A42A87}c:\\program files\\msn messenger\\livecall.exe"= TCP:c:\program files\msn messenger\livecall.exe:Windows Live Call
"TCP Query User{FF66BB09-91AA-4DE6-AF98-A53FD47C99A4}c:\\program files\\emule\\emule.exe"= UDP:c:\program files\emule\emule.exe:eMule
"UDP Query User{331EAEE3-D7AB-4DFB-B4A2-144FCF3159A8}c:\\program files\\emule\\emule.exe"= TCP:c:\program files\emule\emule.exe:eMule
"TCP Query User{9A954996-511F-4135-8468-ECB0BCE6021C}c:\\users\\toni kokko\\desktop\\nes\\nestc042\\nestcl95.exe"= UDP:c:\users\toni kokko\desktop\nes\nestc042\nestcl95.exe:nestcl95.exe
"UDP Query User{F76BA4B4-2BB9-409B-AE4E-4EB7BB4117F2}c:\\users\\toni kokko\\desktop\\nes\\nestc042\\nestcl95.exe"= TCP:c:\users\toni kokko\desktop\nes\nestc042\nestcl95.exe:nestcl95.exe
"TCP Query User{CCCA7D9E-957F-41C2-9E95-BF5A9D165A8B}c:\\users\\toni kokko\\desktop\\utorrent.exe"= UDP:c:\users\toni kokko\desktop\utorrent.exe:utorrent.exe
"UDP Query User{A5D6125A-F900-48E3-B961-6D3FEC8C95E5}c:\\users\\toni kokko\\desktop\\utorrent.exe"= TCP:c:\users\toni kokko\desktop\utorrent.exe:utorrent.exe
"TCP Query User{74C37976-832D-4749-804A-AD0500E05A5A}c:\\neverwinternights\\nwn\\nwmain.exe"= UDP:c:\neverwinternights\nwn\nwmain.exe:Neverwinter Nights
"UDP Query User{800E3D01-47D1-4313-BFD1-B33D07152FC3}c:\\neverwinternights\\nwn\\nwmain.exe"= TCP:c:\neverwinternights\nwn\nwmain.exe:Neverwinter Nights
"TCP Query User{E34D9D43-0DBD-438C-9399-F8EFF49FE563}c:\\program files\\mozilla firefox\\firefox.exe"= UDP:c:\program files\mozilla firefox\firefox.exe:Firefox
"UDP Query User{5801BA1E-24E1-4DAA-B511-AFB0979D09E9}c:\\program files\\mozilla firefox\\firefox.exe"= TCP:c:\program files\mozilla firefox\firefox.exe:Firefox
"{4DEA1078-B4EF-46F8-8AE7-B438930E46EF}"= UDP:c:\program files\BitTorrent\bittorrent.exe:BitTorrent
"{FDBCB264-4CDB-4991-AD93-DE1FADBEE8BF}"= TCP:c:\program files\BitTorrent\bittorrent.exe:BitTorrent
"TCP Query User{450ACF7E-B1DD-4791-8D62-03446A1DCE2A}c:\\program files\\byond\\bin\\byond.exe"= UDP:c:\program files\byond\bin\byond.exe:byond
"UDP Query User{D1B4E27F-BC0E-4084-A91F-84E9117CC3A0}c:\\program files\\byond\\bin\\byond.exe"= TCP:c:\program files\byond\bin\byond.exe:byond
"TCP Query User{30F015A4-F3E8-4A45-BAA0-C14ACA1208CB}c:\\program files\\utorrent\\utorrent.exe"= UDP:c:\program files\utorrent\utorrent.exe:uTorrent
"UDP Query User{DB869AB6-C57A-45A4-9C81-A6635D2B3780}c:\\program files\\utorrent\\utorrent.exe"= TCP:c:\program files\utorrent\utorrent.exe:uTorrent
"TCP Query User{6D1C176D-F5CB-4456-9837-7333E5D352A9}c:\\program files\\counter-strike 1.6\\hl.exe"= UDP:c:\program files\counter-strike 1.6\hl.exe:Half-Life Launcher
"UDP Query User{0F745B67-F537-4EAD-B14E-6597D2C8D17E}c:\\program files\\counter-strike 1.6\\hl.exe"= TCP:c:\program files\counter-strike 1.6\hl.exe:Half-Life Launcher
"TCP Query User{D677DB5E-40A0-43E1-8D41-7D2419599383}c:\\program files\\ea games\\medal of honor pacific assault(tm) mpdemo2\\mohpa_mpdemo.exe"= UDP:c:\program files\ea games\medal of honor pacific assault(tm) mpdemo2\mohpa_mpdemo.exe:Medal of Honor Pacific Assault(tm)
"UDP Query User{458AC2B1-2FAC-4B4B-84F5-583EB41A645D}c:\\program files\\ea games\\medal of honor pacific assault(tm) mpdemo2\\mohpa_mpdemo.exe"= TCP:c:\program files\ea games\medal of honor pacific assault(tm) mpdemo2\mohpa_mpdemo.exe:Medal of Honor Pacific Assault(tm)
"TCP Query User{5EFC87C6-F824-46C0-B522-289B9521117F}c:\\program files\\ea games\\medal of honor pacific assault(tm) mpdemo2\\mohpa_mpdemo_server.exe"= UDP:c:\program files\ea games\medal of honor pacific assault(tm) mpdemo2\mohpa_mpdemo_server.exe:Medal of Honor Pacific Assault(tm)
"UDP Query User{5170532E-4D95-4AC3-8CB3-43BDD42DF486}c:\\program files\\ea games\\medal of honor pacific assault(tm) mpdemo2\\mohpa_mpdemo_server.exe"= TCP:c:\program files\ea games\medal of honor pacific assault(tm) mpdemo2\mohpa_mpdemo_server.exe:Medal of Honor Pacific Assault(tm)
"TCP Query User{C3BEF026-E9E6-49AF-8692-82BA32F08404}c:\\program files\\wolfenstein - enemy territory\\et.exe"= UDP:c:\program files\wolfenstein - enemy territory\et.exe:ET
"UDP Query User{5D2F2AEB-CEDA-4639-A9D0-F0C577D93D08}c:\\program files\\wolfenstein - enemy territory\\et.exe"= TCP:c:\program files\wolfenstein - enemy territory\et.exe:ET
"TCP Query User{13F890DE-490E-4B0B-A087-A1602366A068}c:\\program files\\wolfenstein - enemy territory\\etded.exe"= UDP:c:\program files\wolfenstein - enemy territory\etded.exe:ETDED
"UDP Query User{B91B82C8-9DF3-4DD9-944C-FE795C320114}c:\\program files\\wolfenstein - enemy territory\\etded.exe"= TCP:c:\program files\wolfenstein - enemy territory\etded.exe:ETDED
"{28350A57-E35F-4F9C-B726-7B3C68A588E3}"= UDP:c:\users\Public\Documents\Blizzard Entertainment\World of Warcraft\WoW-2.3.0.7561-to-2.3.2.7741-enGB-downloader.exe:Blizzard Downloader
"{76E61FE2-B81C-4A09-983A-D667AD863C44}"= TCP:c:\users\Public\Documents\Blizzard Entertainment\World of Warcraft\WoW-2.3.0.7561-to-2.3.2.7741-enGB-downloader.exe:Blizzard Downloader
"TCP Query User{6F5B6C21-B17E-4BA6-BACF-63340EF3162E}c:\\program files\\microsoft games\\halo\\halo.exe"= UDP:c:\program files\microsoft games\halo\halo.exe:Halo
"UDP Query User{47B278DD-D9A1-41DF-BA07-E2CA5916589E}c:\\program files\\microsoft games\\halo\\halo.exe"= TCP:c:\program files\microsoft games\halo\halo.exe:Halo
"TCP Query User{84C8EEEE-5646-45A6-9B3E-7BB1B421C0B7}c:\\users\\toni kokko\\desktop\\installer-22999-864-counter-strike.exe"= UDP:c:\users\toni kokko\desktop\installer-22999-864-counter-strike.exe:installer-22999-864-counter-strike.exe
"UDP Query User{96AF4C29-27B9-470A-898F-C74BDE0FA4B5}c:\\users\\toni kokko\\desktop\\installer-22999-864-counter-strike.exe"= TCP:c:\users\toni kokko\desktop\installer-22999-864-counter-strike.exe:installer-22999-864-counter-strike.exe
"TCP Query User{619080D8-8BD2-43BE-9D6D-20EF595F124B}c:\\program files\\jazz jackrabbit 2\\jazz2.exe"= UDP:c:\program files\jazz jackrabbit 2\jazz2.exe:Jazz Jackrabbit 2
"UDP Query User{E21B1754-AC24-4590-A3EC-7AD436050300}c:\\program files\\jazz jackrabbit 2\\jazz2.exe"= TCP:c:\program files\jazz jackrabbit 2\jazz2.exe:Jazz Jackrabbit 2
"{C430DAF0-70C6-4A09-9149-FE39258CC3E7}"= UDP:94:VRS Recording System Web Control Panel
"{5E1865ED-1E02-40B5-BD48-464808564702}"= TCP:8000:Axon Virtual PBX RTP Incoming Audio (UDP)
"{48B844C8-8091-454D-A500-3829598B8619}"= TCP:8001:Axon Virtual PBX RTP Incoming Audio (UDP)
"{D5122966-424E-4973-B4E8-621466F124FA}"= TCP:8002:Axon Virtual PBX RTP Incoming Audio (UDP)
"{14CA1EB7-06AF-4992-8F33-CA8A2A6907A1}"= TCP:8003:Axon Virtual PBX RTP Incoming Audio (UDP)
"{07144F0D-652E-4938-A4A6-7AB816714FFA}"= TCP:8004:Axon Virtual PBX RTP Incoming Audio (UDP)
"{10771593-3459-4E97-946D-393D93FCBD84}"= UDP:81:Axon Virtual PBX Web Server
"TCP Query User{DC46209A-4D4D-424A-8B56-2D92080081FA}c:\\program files\\condition zero\\hlds.exe"= UDP:c:\program files\condition zero\hlds.exe:HLDS Launcher
"UDP Query User{34072C27-AA45-49B3-938D-BE4BC547EAA6}c:\\program files\\condition zero\\hlds.exe"= TCP:c:\program files\condition zero\hlds.exe:HLDS Launcher
"TCP Query User{3C767F74-CB7D-4D9F-8EE2-50E472BA6FA5}c:\\program files\\skype\\phone\\skype.exe"= UDP:c:\program files\skype\phone\skype.exe:Skype. The whole world can talk for free.
"UDP Query User{DC78D1AA-837C-46A6-96FD-5D6B2A1BBECA}c:\\program files\\skype\\phone\\skype.exe"= TCP:c:\program files\skype\phone\skype.exe:Skype. The whole world can talk for free.
"TCP Query User{AA2D2F5E-039A-4DD4-885B-C2D14B1A31A2}c:\\program files\\condition zero\\hlds.exe"= UDP:c:\program files\condition zero\hlds.exe:HLDS Launcher
"UDP Query User{0DBC3F9B-298F-4C44-8502-7B0DAA696F75}c:\\program files\\condition zero\\hlds.exe"= TCP:c:\program files\condition zero\hlds.exe:HLDS Launcher
"TCP Query User{D7AD1479-5F64-4930-83C8-2927AB9E0F13}c:\\program files\\steam\\steamapps\\tonikokko\\dedicated server\\hlds.exe"= UDP:c:\program files\steam\steamapps\tonikokko\dedicated server\hlds.exe:HLDS Launcher
"UDP Query User{F3C82F4E-374B-44B6-97CB-56D0293C4BA9}c:\\program files\\steam\\steamapps\\tonikokko\\dedicated server\\hlds.exe"= TCP:c:\program files\steam\steamapps\tonikokko\dedicated server\hlds.exe:HLDS Launcher
"TCP Query User{1EC6E41B-CDBA-49BF-B50B-42CDDB39E83D}c:\\program files\\css\\hl2.exe"= UDP:c:\program files\css\hl2.exe:hl2
"UDP Query User{A7391A47-23E6-4F58-ACEC-DD126FFE456F}c:\\program files\\css\\hl2.exe"= TCP:c:\program files\css\hl2.exe:hl2
"TCP Query User{5B91D1B4-4D0D-4392-B877-7605B8FE1A0C}c:\\program files\\css\\srcds.exe"= UDP:c:\program files\css\srcds.exe:srcds
"UDP Query User{B0D44996-1DFD-4C13-9FB0-FB239079A96A}c:\\program files\\css\\srcds.exe"= TCP:c:\program files\css\srcds.exe:srcds
"TCP Query User{A9F96E00-45E6-49C4-A318-F1A387CFC15E}c:\\program files\\steam\\steamapps\\tonikokko\\counter-strike\\hl.exe"= UDP:c:\program files\steam\steamapps\tonikokko\counter-strike\hl.exe:Half-Life Launcher
"UDP Query User{52B86BB3-139B-41C0-9A76-7E0ACD830A9F}c:\\program files\\steam\\steamapps\\tonikokko\\counter-strike\\hl.exe"= TCP:c:\program files\steam\steamapps\tonikokko\counter-strike\hl.exe:Half-Life Launcher
"TCP Query User{352C5FB1-A302-4D84-A303-94FC6280B1D8}c:\\program files\\steam\\steamapps\\tonikokko\\condition zero deleted scenes\\hl.exe"= UDP:c:\program files\steam\steamapps\tonikokko\condition zero deleted scenes\hl.exe:Half-Life Launcher
"UDP Query User{B5482BF4-55AD-420C-A6AB-F7B0D353C806}c:\\program files\\steam\\steamapps\\tonikokko\\condition zero deleted scenes\\hl.exe"= TCP:c:\program files\steam\steamapps\tonikokko\condition zero deleted scenes\hl.exe:Half-Life Launcher
"TCP Query User{8F8E66C1-9816-4E0E-95E3-78DC8B2BD9FD}c:\\program files\\steam\\steamapps\\tonikokko\\deathmatch classic\\hl.exe"= UDP:c:\program files\steam\steamapps\tonikokko\deathmatch classic\hl.exe:Half-Life Launcher
"UDP Query User{C4018428-4558-4595-A0C3-49A90D49A7B9}c:\\program files\\steam\\steamapps\\tonikokko\\deathmatch classic\\hl.exe"= TCP:c:\program files\steam\steamapps\tonikokko\deathmatch classic\hl.exe:Half-Life Launcher
"TCP Query User{DCFA1FCE-D408-47CD-8571-0105ACFA2916}c:\\program files\\steam\\steamapps\\tonikokko\\day of defeat\\hl.exe"= UDP:c:\program files\steam\steamapps\tonikokko\day of defeat\hl.exe:Half-Life Launcher
"UDP Query User{62519076-C4D5-4189-AFA3-FB99447E71D0}c:\\program files\\steam\\steamapps\\tonikokko\\day of defeat\\hl.exe"= TCP:c:\program files\steam\steamapps\tonikokko\day of defeat\hl.exe:Half-Life Launcher
"TCP Query User{0036597C-6744-46E1-87AB-B5DA7022EA80}c:\\program files\\steam\\steamapps\\tonikokko\\counter-strike\\hl.exe"= UDP:c:\program files\steam\steamapps\tonikokko\counter-strike\hl.exe:Half-Life Launcher
"UDP Query User{663FFDC6-AE4E-48C0-A372-E2D9606A88CA}c:\\program files\\steam\\steamapps\\tonikokko\\counter-strike\\hl.exe"= TCP:c:\program files\steam\steamapps\tonikokko\counter-strike\hl.exe:Half-Life Launcher
"TCP Query User{CA0AAE20-34D5-4F87-9E3A-BDFB0BDB4D71}c:\\program files\\steam\\steamapps\\tonikokko\\ricochet\\hl.exe"= UDP:c:\program files\steam\steamapps\tonikokko\ricochet\hl.exe:Half-Life Launcher
"UDP Query User{0CD7D344-BF25-4DBC-BB9F-A077320A0F5C}c:\\program files\\steam\\steamapps\\tonikokko\\ricochet\\hl.exe"= TCP:c:\program files\steam\steamapps\tonikokko\ricochet\hl.exe:Half-Life Launcher
"TCP Query User{A91F8163-967F-4925-AADE-F07576322012}c:\\program files\\steam\\steamapps\\tonikokko\\condition zero deleted scenes\\hl.exe"= UDP:c:\program files\steam\steamapps\tonikokko\condition zero deleted scenes\hl.exe:Half-Life Launcher
"UDP Query User{28567FE8-4FFA-485F-9801-A152048863F2}c:\\program files\\steam\\steamapps\\tonikokko\\condition zero deleted scenes\\hl.exe"= TCP:c:\program files\steam\steamapps\tonikokko\condition zero deleted scenes\hl.exe:Half-Life Launcher
"TCP Query User{E9852CC0-029E-4A0C-8096-FD6ECFAB0A90}c:\\program files\\steam\\steamapps\\tonikokko\\dedicated server\\hlds.exe"= UDP:c:\program files\steam\steamapps\tonikokko\dedicated server\hlds.exe:HLDS Launcher
"UDP Query User{0C665345-3CA8-457E-81C9-6BC344EC98A4}c:\\program files\\steam\\steamapps\\tonikokko\\dedicated server\\hlds.exe"= TCP:c:\program files\steam\steamapps\tonikokko\dedicated server\hlds.exe:HLDS Launcher
"TCP Query User{687C75CE-4F7D-40F5-8C14-87714F9F9416}c:\\program files\\warcraft iii\\war3.exe"= UDP:c:\program files\warcraft iii\war3.exe:war3
"UDP Query User{7D83C4AA-B864-4BB7-8ECA-0879524333EC}c:\\program files\\warcraft iii\\war3.exe"= TCP:c:\program files\warcraft iii\war3.exe:war3
"TCP Query User{01937352-B3E0-4023-A301-3C31B8535E5D}c:\\program files\\free internet tv\\internettv.exe"= UDP:c:\program files\free internet tv\internettv.exe:Free Internet TV
"UDP Query User{1BD9AA70-B7FD-479B-B7F9-B827DD9D7ECB}c:\\program files\\free internet tv\\internettv.exe"= TCP:c:\program files\free internet tv\internettv.exe:Free Internet TV
"TCP Query User{CC790F40-F1A4-425E-9896-B90D44EA42DB}c:\\program files\\imesh applications\\imesh\\imesh.exe"= UDP:c:\program files\imesh applications\imesh\imesh.exe:iMesh
"UDP Query User{5FA2CC62-D1E6-48F4-A379-97881541C956}c:\\program files\\imesh applications\\imesh\\imesh.exe"= TCP:c:\program files\imesh applications\imesh\imesh.exe:iMesh
"{8D434BBF-7B9D-4766-95C6-6BB933BFB15D}"= c:\program files\MSN Messenger\livecall.exe:Windows Live Messenger 8.1 (Phone)
"TCP Query User{424FA59B-44ED-4B85-90AA-433062FB3C35}c:\\program files\\steam\\steamapps\\tonikokko\\half-life 2 deathmatch\\hl2.exe"= UDP:c:\program files\steam\steamapps\tonikokko\half-life 2 deathmatch\hl2.exe:hl2
"UDP Query User{3F7F8D91-AF39-4FB4-918E-106C2CDCCC38}c:\\program files\\steam\\steamapps\\tonikokko\\half-life 2 deathmatch\\hl2.exe"= TCP:c:\program files\steam\steamapps\tonikokko\half-life 2 deathmatch\hl2.exe:hl2
"TCP Query User{B96D695D-8CC8-4D07-A5DD-791BD6310D28}c:\\program files\\steam\\steamapps\\tonikokko\\source dedicated server\\srcds.exe"= UDP:c:\program files\steam\steamapps\tonikokko\source dedicated server\srcds.exe:srcds
"UDP Query User{19313382-DAC4-4AA3-8867-F5146EA31C8D}c:\\program files\\steam\\steamapps\\tonikokko\\source dedicated server\\srcds.exe"= TCP:c:\program files\steam\steamapps\tonikokko\source dedicated server\srcds.exe:srcds
"TCP Query User{91DC95F0-E22E-4614-9B14-F6BEAD27C789}c:\\program files\\steam\\steamapps\\tonikokko\\team fortress 2\\hl2.exe"= UDP:c:\program files\steam\steamapps\tonikokko\team fortress 2\hl2.exe:hl2
"UDP Query User{C105F45B-E023-42E8-8B91-3CC995C607C8}c:\\program files\\steam\\steamapps\\tonikokko\\team fortress 2\\hl2.exe"= TCP:c:\program files\steam\steamapps\tonikokko\team fortress 2\hl2.exe:hl2
"TCP Query User{44BB0EE4-F377-469A-B4D6-D80175D9CECA}c:\\program files\\steam\\steamapps\\common\\trackmania nations forever\\tmforever.exe"= UDP:c:\program files\steam\steamapps\common\trackmania nations forever\tmforever.exe:TmForever
"UDP Query User{91B64548-43FD-4AED-B58F-8FBC4770020B}c:\\program files\\steam\\steamapps\\common\\trackmania nations forever\\tmforever.exe"= TCP:c:\program files\steam\steamapps\common\trackmania nations forever\tmforever.exe:TmForever
"TCP Query User{4BC51E23-3733-41AC-9162-923CB1A596DB}c:\\program files\\gamespy arcade\\aphex.exe"= UDP:c:\program files\gamespy arcade\aphex.exe:GameSpy Arcade
"UDP Query User{6C88CB19-9F83-4819-BA76-DC7374CC48B2}c:\\program files\\gamespy arcade\\aphex.exe"= TCP:c:\program files\gamespy arcade\aphex.exe:GameSpy Arcade
"TCP Query User{756DFC95-D7CB-480C-8032-848E784C0710}c:\\program files\\steam\\steamapps\\tonikokko\\day of defeat source\\hl2.exe"= UDP:c:\program files\steam\steamapps\tonikokko\day of defeat source\hl2.exe:hl2
"UDP Query User{0554D116-1219-42FC-9796-E62DB27BBDAE}c:\\program files\\steam\\steamapps\\tonikokko\\day of defeat source\\hl2.exe"= TCP:c:\program files\steam\steamapps\tonikokko\day of defeat source\hl2.exe:hl2
"TCP Query User{79DA9B44-7689-4B4E-8547-36F63DFCC028}c:\\users\\toni kokko\\appdata\\local\\temp\\wzse1.tmp\\symnrt.exe"= UDP:c:\users\toni kokko\appdata\local\temp\wzse1.tmp\symnrt.exe:symnrt.exe
"UDP Query User{C3336B92-104F-40A9-872B-0AAE6917CC4E}c:\\users\\toni kokko\\appdata\\local\\temp\\wzse1.tmp\\symnrt.exe"= TCP:c:\users\toni kokko\appdata\local\temp\wzse1.tmp\symnrt.exe:symnrt.exe
"TCP Query User{3F2C2531-6397-40DC-BBD1-7DE0D99FD42A}c:\\program files\\xchat\\xchat.exe"= UDP:c:\program files\xchat\xchat.exe:XChat IRC Client
"UDP Query User{48B44EDE-07F6-4F3F-9219-93D4073BD322}c:\\program files\\xchat\\xchat.exe"= TCP:c:\program files\xchat\xchat.exe:XChat IRC Client
"TCP Query User{1807DC00-4740-4285-BAEB-7A470FA25F6A}c:\\program files\\steam\\steamapps\\avigga\\source dedicated server\\srcds.exe"= UDP:c:\program files\steam\steamapps\avigga\source dedicated server\srcds.exe:srcds
"UDP Query User{BD3881C9-8577-4878-AE50-71EA1E2F7981}c:\\program files\\steam\\steamapps\\avigga\\source dedicated server\\srcds.exe"= TCP:c:\program files\steam\steamapps\avigga\source dedicated server\srcds.exe:srcds
"TCP Query User{632A9822-2366-4C5F-9946-BCF45217B019}c:\\program files\\swarmplayer\\swarmplayer.exe"= UDP:c:\program files\swarmplayer\swarmplayer.exe:swarmplayer
"UDP Query User{D770F340-9627-4C5A-BC38-EE624EC0EF76}c:\\program files\\swarmplayer\\swarmplayer.exe"= TCP:c:\program files\swarmplayer\swarmplayer.exe:swarmplayer
"TCP Query User{7025C92C-326F-4C80-9A40-235F04872E01}c:\\program files\\mirc\\mirc.exe"= UDP:c:\program files\mirc\mirc.exe:mIRC
"UDP Query User{0B0B6EFB-3F50-4C76-B1BB-5FA2C9C64DBE}c:\\program files\\mirc\\mirc.exe"= TCP:c:\program files\mirc\mirc.exe:mIRC
"{F22F34CA-F474-47F7-833D-8C7E3F512871}"= UDP:c:\program files\uTorrent\uTorrent.exe:µTorrent (TCP-In)
"{85F9CF5B-1363-454B-BDA0-88D6D5BCE2BF}"= TCP:c:\program files\uTorrent\uTorrent.exe:µTorrent (UDP-In)
"TCP Query User{D0677DA9-934F-4B03-A63A-71F8AD9CE7F5}c:\\program files\\steam\\steamapps\\avigga\\team fortress 2\\hl2.exe"= UDP:c:\program files\steam\steamapps\avigga\team fortress 2\hl2.exe:hl2
"UDP Query User{C6A4E485-9C63-46C1-9603-D10E6AFC14BB}c:\\program files\\steam\\steamapps\\avigga\\team fortress 2\\hl2.exe"= TCP:c:\program files\steam\steamapps\avigga\team fortress 2\hl2.exe:hl2
"TCP Query User{8BA66BAE-D314-44B6-A811-C5A824532414}c:\\program files\\steam\\steamapps\\avigga\\half-life 2\\hl2.exe"= UDP:c:\program files\steam\steamapps\avigga\half-life 2\hl2.exe:hl2
"UDP Query User{6C2708B7-E72C-41D1-A6DD-E8C1D4D866D5}c:\\program files\\steam\\steamapps\\avigga\\half-life 2\\hl2.exe"= TCP:c:\program files\steam\steamapps\avigga\half-life 2\hl2.exe:hl2
"{C59E32F3-0600-4929-83DD-328BB51CC2C4}"= UDP:c:\program files\World of Warcraft\WoW-2.3.3.7799-to-2.4.0.8089-enGB-downloader.exe:Blizzard Downloader
"{F92C8592-E8E1-4274-ADC1-E04D4EDDA2BB}"= TCP:c:\program files\World of Warcraft\WoW-2.3.3.7799-to-2.4.0.8089-enGB-downloader.exe:Blizzard Downloader
"{228A0F0F-7A6F-4DE6-863A-0C6800D88497}"= UDP:c:\users\Public\Documents\Blizzard Entertainment\World of Warcraft\WoW-2.4.3-to-3.0.2-enGB-Win-Final-downloader.exe:Blizzard Downloader
"{A5049911-5EDC-493D-95BF-668F714F538B}"= TCP:c:\users\Public\Documents\Blizzard Entertainment\World of Warcraft\WoW-2.4.3-to-3.0.2-enGB-Win-Final-downloader.exe:Blizzard Downloader
"TCP Query User{EFF679D8-A571-41C8-9097-6D009425FFF8}c:\\program files\\world of warcraft\\world of warcraft\\world of warcraft\\repair.exe"= UDP:c:\program files\world of warcraft\world of warcraft\world of warcraft\repair.exe:Blizzard Repair Utility
"UDP Query User{C6DD3040-93B6-4B22-9AA3-AC0041DF3E95}c:\\program files\\world of warcraft\\world of warcraft\\world of warcraft\\repair.exe"= TCP:c:\program files\world of warcraft\world of warcraft\world of warcraft\repair.exe:Blizzard Repair Utility
"{8F16C087-9E09-476E-9653-28B6D03710FB}"= UDP:c:\users\Public\Documents\Blizzard Entertainment\World of Warcraft\WoW-3.0.2.9056-to-3.0.3.9183-enGB-downloader.exe:Blizzard Downloader
"{30D23163-90AF-455E-BBFB-2A7A9D8A6950}"= TCP:c:\users\Public\Documents\Blizzard Entertainment\World of Warcraft\WoW-3.0.2.9056-to-3.0.3.9183-enGB-downloader.exe:Blizzard Downloader
"{4ED71020-8DAB-461E-A011-FF9054A4F98F}"= UDP:3724:Blizzard Downloader: 3724
"TCP Query User{A48F3969-7B98-4FEF-A123-7729F99FB69C}c:\\users\\toni kokko\\desktop\\lierox_v0.56_pack_1.9\\lierox v0.56 pack 1.9\\lierox.exe"= UDP:c:\users\toni kokko\desktop\lierox_v0.56_pack_1.9\lierox v0.56 pack 1.9\lierox.exe:lierox.exe
"UDP Query User{9FDDD62B-6350-4110-AF53-4737FD530DBF}c:\\users\\toni kokko\\desktop\\lierox_v0.56_pack_1.9\\lierox v0.56 pack 1.9\\lierox.exe"= TCP:c:\users\toni kokko\desktop\lierox_v0.56_pack_1.9\lierox v0.56 pack 1.9\lierox.exe:lierox.exe
"TCP Query User{D5ECF7FC-3CA4-4EBF-94E6-CE7E719C438D}c:\\users\\toni kokko\\desktop\\lierox_v0.56_pack_1.9\\lierox v0.56 pack 1.9\\lierox.exe"= UDP:c:\users\toni kokko\desktop\lierox_v0.56_pack_1.9\lierox v0.56 pack 1.9\lierox.exe:lierox.exe
"UDP Query User{CEC1032E-1DF7-4CF6-B0BD-4B9ECFB8A640}c:\\users\\toni kokko\\desktop\\lierox_v0.56_pack_1.9\\lierox v0.56 pack 1.9\\lierox.exe"= TCP:c:\users\toni kokko\desktop\lierox_v0.56_pack_1.9\lierox v0.56 pack 1.9\lierox.exe:lierox.exe
"{77FAE065-C5AB-4851-A183-EE612AF46CC8}"= c:\program files\MSN Messenger\livecall.exe:Windows Live Messenger 8.1 (Phone)
"{25634C9B-2C05-450D-B0AA-03952E3E3D3D}"= c:\program files\MSN Messenger\livecall.exe:Windows Live Messenger 8.1 (Phone)
"{66E0E986-796C-4553-8F29-3580DF0903B8}"= UDP:c:\program files\Malwarebytes' Anti-Malware\mbam.exe:Malwarebytes' Anti-Malware
"{A052AC37-EA62-4011-B0FD-D1A0946168DA}"= TCP:c:\program files\Malwarebytes' Anti-Malware\mbam.exe:Malwarebytes' Anti-Malware
"TCP Query User{C415CF1E-6660-4D46-80CE-899F0502C701}c:\\program files\\emule\\emule.exe"= Disabled:UDP:c:\program files\emule\emule.exe:eMule
"UDP Query User{BCA21BF4-4166-4BB1-B95C-DA5C6CFDA864}c:\\program files\\emule\\emule.exe"= Disabled:TCP:c:\program files\emule\emule.exe:eMule
"TCP Query User{26751923-DEFB-4A76-B360-5EE6BD2F1E8C}c:\\program files\\imesh applications\\imesh\\imesh.exe"= Disabled:UDP:c:\program files\imesh applications\imesh\imesh.exe:iMesh
"UDP Query User{19B221A2-173E-4CE8-A4F5-DAD2A22BA0C5}c:\\program files\\imesh applications\\imesh\\imesh.exe"= Disabled:TCP:c:\program files\imesh applications\imesh\imesh.exe:iMesh
"{4A3E76A5-F956-422C-A8B5-78D8DCE2B678}"= c:\program files\MSN Messenger\livecall.exe:Windows Live Messenger 8.1 (Phone)
"{42161E04-D772-488E-A978-0F12110F6EF8}"= UDP:c:\users\Toni Kokko\AppData\Local\Temp\WZSE0.TMP\SymNRT.exe:Norton Removal Tool
"{C468BB28-F1EE-41BE-ADB4-0BCE04554273}"= TCP:c:\users\Toni Kokko\AppData\Local\Temp\WZSE0.TMP\SymNRT.exe:Norton Removal Tool
"{633A8E51-2411-4FDE-B3CC-9DC01825D5C2}"= UDP:c:\windows\System32\WindowsAnytimeUpgrade.exe:Windows Anytime Upgrade
"{2C14C3C3-87EE-41D3-A496-4AA3D1483D3F}"= TCP:c:\windows\System32\WindowsAnytimeUpgrade.exe:Windows Anytime Upgrade

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\StandardProfile\AuthorizedApplications\List]
"c:\\Program Files\\BitTorrent\\bittorrent.exe"= c:\program files\BitTorrent\bittorrent.exe:*:Enabled:BitTorrent
"c:\\Program Files\\xchat\\xchat.exe"= c:\program files\xchat\xchat.exe:*:Enabled:XChat IRC Client

R2 BWH32S;BWH32S;"c:\program files\BUFFALO\clientmgrv\bin\BWH32S.exe" [2008-10-07 57912]
R2 Ndiskio;Ndiskio;\??\c:\program files\Norman\Nse\bin\NDISKIO.SYS [2007-09-30 20448]
R2 NVOY;Norman's Very Own supplY of resources;"c:\program files\Norman\npm\bin\nvoy.exe" [2008-03-24 121912]
R3 nsesvc;Norman Scanner Engine Service;"c:\program files\Norman\nse\bin\NSESVC.EXE" -daemon [2008-06-26 322616]
R3 NvcMFlt;NvcMFlt;c:\windows\system32\DRIVERS\nvcv32mf.sys [2008-09-04 19512]
R3 nvcoas;Norman Virus Control on-access component;"c:\program files\Norman\Nvc\bin\nvcoas.exe" [2008-03-24 191544]
R3 NVCScheduler;Norman Virus Control Scheduler;"c:\program files\Norman\Npm\bin\NVCSCHED.EXE" [2008-03-24 154680]
R3 WLIU2KG125S;BUFFALO WLI-U2-KG125S Wireless LAN Adapter Driver;c:\windows\system32\DRIVERS\usb8023.sys [2008-05-24 15872]
S3 Bufeap;BUFFALO EAP Driver;c:\windows\system32\DRIVERS\bufeap.sys [2008-10-07 14848]
S3 netr73;RT73 USB Wireless LAN Card Driver for Vista;c:\windows\system32\DRIVERS\netr73.sys [2007-05-11 329728]
S3 StickCap;Digital TV DVB-T USB Stick adapter service;c:\windows\system32\Drivers\stickcap.sys [2008-10-22 15744]
S3 stickload;Digital TV stick firmware loader service;c:\windows\system32\DRIVERS\stickload.sys [2008-10-22 17024]
S4 Automaattinen LiveUpdate-ajastustoiminto;Automaattinen LiveUpdate-ajastustoiminto;"c:\program files\Symantec\LiveUpdate\ALUSchedulerSvc.exe" []

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\G]
\shell\AutoRun\command - G:\LaunchU3.exe -a

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{222a7df5-b2c2-11dc-9225-001b247c1e44}]
\shell\AutoRun\command - E:\Setup.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{7c0e6525-c9f4-11dd-9cb1-001601cfc4c2}]
\shell\AutoRun\command - G:\LaunchU3.exe -a

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{96238bad-7562-11dc-93fe-001b247c1e44}]
\shell\AutoRun\command - E:\setup.exe /autorun
\shell\directx\command - e:\directx\dxsetup.exe
\shell\setup\command - E:\setup.exe

*Newly Created Service* - CATCHME
*Newly Created Service* - MBAMSWISSARMY
.
'Ajoitetut tehtävät'-kansion sisältö

2008-12-16 c:\windows\Tasks\GoogleUpdateTaskUser.job
- c:\users\Toni Kokko\AppData\Local\Google\Update\GoogleUpdate.exe [2008-12-15 21:39]

2008-12-15 c:\windows\Tasks\User_Feed_Synchronization-{C68C7EA6-5ACB-42EA-BD75-B52875D630F3}.job
- c:\windows\system32\msfeedssync.exe [2008-01-18 22:33]
.

**************************************************************************

catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-12-16 16:06:21
Windows 6.0.6001 Service Pack 1 NTFS

tarkistaa piilotettuja prosesseja ...

tarkistaa piilotettuja käynnistysarvoja ...

tarkistaa piilotettuja tiedostoja ...

tarkistus on valmis
piilotetut tiedostot: 0

**************************************************************************
.
Valmistumisajankohta: 2008-12-16 16:13:15
ComboFix-quarantined-files.txt 2008-12-16 14:13:10
ComboFix2.txt 2008-12-15 20:29:49

Ennen ajoa: 42 238 464 000 tavua vapaana
Ajon jälkeen: 41,562,828,800 tavua vapaana

519 --- E O F --- 2008-12-15 20:08:06


[ + lainaa]
Toni
Hujo
Suspended permanently
_ 		16. joulukuuta 2008 @ 16:31 _ Linkki tähän viestiin    Lähetä käyttäjälle yksityisviesti   
scannaa uusi hjt:n loki
[ + lainaa]
Voiko tietsikka koskaan toimia?
tonikokko
Member
_ 		16. joulukuuta 2008 @ 18:28 _ Linkki tähän viestiin    Lähetä käyttäjälle yksityisviesti   
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 21:37:50, on 14.12.2008
Platform: Windows Vista SP1 (WinNT 6.00.1905)
MSIE: Internet Explorer v7.00 (7.00.6001.18000)
Boot mode: Normal

Running processes:
C:\Windows\System32\smss.exe
C:\Windows\system32\csrss.exe
C:\Windows\system32\wininit.exe
C:\Windows\system32\csrss.exe
C:\Windows\system32\services.exe
C:\Windows\system32\lsass.exe
C:\Windows\system32\lsm.exe
C:\Windows\system32\winlogon.exe
C:\Windows\system32\svchost.exe
C:\Program Files\Norman\Npm\Bin\eLogsvc.exe
C:\Windows\system32\svchost.exe
C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe
C:\Windows\system32\svchost.exe
C:\Windows\system32\SLsvc.exe
C:\Windows\system32\svchost.exe
C:\Program Files\Norman\Npm\Bin\Zanda.exe
C:\Program Files\Norman\npm\bin\nvoy.exe
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Windows\system32\svchost.exe
C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
C:\Windows\System32\spoolsv.exe
C:\Windows\system32\taskeng.exe
C:\Windows\system32\svchost.exe
C:\Program Files\BUFFALO\clientmgrv\bin\BWH32S.exe
C:\Program Files\HP\QuickPlay\Kernel\TV\CLCapSvc.exe
C:\Program Files\Common Files\LightScribe\LSSrvc.exe
C:\Program Files\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\sqlservr.exe
C:\Windows\system32\svchost.exe
C:\Program Files\Microsoft SQL Server\90\Shared\sqlbrowser.exe
C:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe
C:\Windows\system32\svchost.exe
C:\Windows\System32\svchost.exe
C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\DRIVERS\xaudio.exe
C:\Program Files\Hewlett-Packard\Shared\hpqwmiex.exe
C:\Windows\system32\WUDFHost.exe
C:\Windows\system32\taskeng.exe
C:\Program Files\Norman\Npm\bin\NJEEVES.EXE
C:\Program Files\Norman\Npm\bin\NVCSCHED.EXE
C:\Program Files\Norman\nse\bin\NSESVC.EXE
C:\Program Files\Norman\Nvc\bin\nvcoas.exe
C:\Program Files\Windows Defender\MSASCui.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Program Files\HP\QuickPlay\QPService.exe
C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\QLBCTRL.exe
C:\Program Files\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe
C:\Program Files\Hewlett-Packard\HP Wireless Assistant\WiFiMsg.exe
C:\Program Files\Norman\Npm\Bin\Zlh.exe
C:\Windows\System32\rundll32.exe
C:\Program Files\Windows Sidebar\sidebar.exe
C:\Windows\ehome\ehtray.exe
C:\Program Files\MSN Messenger\msnmsgr.exe
C:\Program Files\BUFFALO\clientmgrv\bin\cmvMain.exe
C:\Windows\System32\rundll32.exe
C:\Windows\system32\wbem\wmiprvse.exe
C:\Windows\ehome\ehmsas.exe
C:\Program Files\Norman\Nvc\Bin\Nip.exe
C:\Program Files\Norman\Nvc\Bin\cclaw.exe
C:\Windows\ehome\ehsched.exe
C:\Windows\ehome\ehRecvr.exe
C:\Program Files\Hewlett-Packard\HP Health Check\hphc_service.exe
C:\Windows\system32\wbem\unsecapp.exe
C:\Program Files\Synaptics\SynTP\SynTPHelper.exe
C:\Program Files\Hewlett-Packard\Shared\HpqToaster.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Winamp\winamp.exe
C:\Windows\system32\SearchProtocolHost.exe
C:\Windows\system32\SearchFilterHost.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
C:\Windows\system32\wbem\wmiprvse.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.daemon-search.com/startpage

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://ie.redirect.hp.com/svs/rdr?TYPE=3...ilion&pf=laptop
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://home.sweetim.com
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O1 - Hosts: ::1 localhost
O2 - BHO: Adobe PDF Reader -linkkiavustaja - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - (no file)
O2 - BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O3 - Toolbar: (no name) - {BC4FFE41-DE9F-46fa-B455-AAD49B9F9938} - (no file)
O4 - HKLM\..\Run: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [QPService] "C:\Program Files\HP\QuickPlay\QPService.exe"
O4 - HKLM\..\Run: [QlbCtrl] %ProgramFiles%\Hewlett-Packard\HP Quick Launch Buttons\QlbCtrl.exe /Start
O4 - HKLM\..\Run: [HP Health Check Scheduler] C:\Program Files\Hewlett-Packard\HP Health Check\HPHC_Scheduler.exe
O4 - HKLM\..\Run: [hpWirelessAssistant] %ProgramFiles%\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe
O4 - HKLM\..\Run: [WAWifiMessage] %ProgramFiles%\Hewlett-Packard\HP Wireless Assistant\WiFiMsg.exe
O4 - HKLM\..\Run: [Norman ZANDA] "C:\Program Files\Norman\Npm\Bin\ZLH.EXE" /LOAD /SPLASH
O4 - HKLM\..\Run: [NvSvc] RUNDLL32.EXE C:\Windows\system32\nvsvc.dll,nvsvcStart
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\Windows\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\Windows\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKLM\..\RunOnce: [Launcher] %WINDIR%\SMINST\launcher.exe
O4 - HKCU\..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun
O4 - HKCU\..\Run: [ehTray.exe] C:\Windows\ehome\ehTray.exe
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'Paikallinen palvelu')
O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'Paikallinen palvelu')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'Verkkopalvelu')
O4 - Global Startup: ClientManagerV.lnk = C:\Program Files\BUFFALO\clientmgrv\bin\cmvMain.exe
O8 - Extra context menu item: Vie Microsoft E&xceliin - res://C:\PROGRA~1\MICROS~3\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: Oheistiedot - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\OFFICE11\REFIEBAR.DLL
O16 - DPF: {20A60F0D-9AFA-4515-A0FD-83BD84642501} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab56986.cab
O16 - DPF: {5C051655-FCD5-4969-9182-770EA5AA5565} (Solitaire Showdown Class) - http://messenger.zone.msn.com/binary/Sol...wn.cab56986.cab
O16 - DPF: {67DABFBF-D0AB-41FA-9C46-CC0F21721616} - http://download.divx.com/player/DivXBrowserPlugin.cab
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/Mes...nt.cab56907.cab
O20 - AppInit_DLLs:
O23 - Service: Lavasoft Ad-Aware Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
O23 - Service: ArcSoft Connect Daemon (ACDaemon) - Unknown owner - C:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ACService.exe (file missing)
O23 - Service: Automaattinen LiveUpdate-ajastustoiminto - Unknown owner - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe (file missing)
O23 - Service: BWH32S - BUFFALO INC. - C:\Program Files\BUFFALO\clientmgrv\bin\BWH32S.exe
O23 - Service: CyberLink Background Capture Service (CBCS) (CLCapSvc) - Unknown owner - C:\Program Files\HP\QuickPlay\Kernel\TV\CLCapSvc.exe
O23 - Service: CyberLink Task Scheduler (CTS) (CLSched) - Unknown owner - C:\Program Files\HP\QuickPlay\Kernel\TV\CLSched.exe
O23 - Service: Norman eLogger service 6 (eLoggerSvc6) - Norman ASA - C:\Program Files\Norman\Npm\Bin\eLogsvc.exe
O23 - Service: HP Health Check Service - Hewlett-Packard - C:\Program Files\Hewlett-Packard\HP Health Check\hphc_service.exe
O23 - Service: hpqwmiex - Hewlett-Packard Development Company, L.P. - C:\Program Files\Hewlett-Packard\Shared\hpqwmiex.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe
O23 - Service: Norman NJeeves - Norman ASA - C:\Program Files\Norman\Npm\bin\NJEEVES.EXE
O23 - Service: Norman ZANDA - Norman ASA - C:\Program Files\Norman\Npm\Bin\Zanda.exe
O23 - Service: Norman Scanner Engine Service (nsesvc) - Norman ASA - C:\Program Files\Norman\nse\bin\NSESVC.EXE
O23 - Service: Norman Virus Control on-access component (nvcoas) - Norman ASA - C:\Program Files\Norman\Nvc\bin\nvcoas.exe
O23 - Service: Norman Virus Control Scheduler (NVCScheduler) - Norman ASA - C:\Program Files\Norman\Npm\bin\NVCSCHED.EXE
O23 - Service: Norman's Very Own supplY of resources (NVOY) - Norman ASA - C:\Program Files\Norman\npm\bin\nvoy.exe
O23 - Service: RoxMediaDB9 - Sonic Solutions - C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxMediaDB9.exe
O23 - Service: stllssvr - MicroVision Development, Inc. - C:\Program Files\Common Files\SureThing Shared\stllssvr.exe
O23 - Service: XAudioService - Conexant Systems, Inc. - C:\Windows\system32\DRIVERS\xaudio.exe

--
End of file - 9993 bytes


[ + lainaa]
Toni
Hujo
Suspended permanently
_ 		16. joulukuuta 2008 @ 18:35 _ Linkki tähän viestiin    Lähetä käyttäjälle yksityisviesti   
sama loki kuin yllä poista vanhat lokit ennen uuden ottoa.
[ + lainaa]
Voiko tietsikka koskaan toimia?
tonikokko
Member
_ 		16. joulukuuta 2008 @ 19:15 _ Linkki tähän viestiin    Lähetä käyttäjälle yksityisviesti   
Tässä HJT logi ja poisto logi.

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 19:12:36, on 16.12.2008
Platform: Windows Vista SP1 (WinNT 6.00.1905)
MSIE: Internet Explorer v7.00 (7.00.6001.18000)
Boot mode: Normal

Running processes:
C:\Windows\System32\smss.exe
C:\Windows\system32\csrss.exe
C:\Windows\system32\wininit.exe
C:\Windows\system32\csrss.exe
C:\Windows\system32\services.exe
C:\Windows\system32\lsass.exe
C:\Windows\system32\lsm.exe
C:\Windows\system32\winlogon.exe
C:\Windows\system32\svchost.exe
C:\Program Files\Norman\Npm\Bin\eLogsvc.exe
C:\Windows\system32\svchost.exe
C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe
C:\Windows\system32\svchost.exe
C:\Windows\system32\SLsvc.exe
C:\Windows\system32\svchost.exe
C:\Program Files\Norman\Npm\Bin\Zanda.exe
C:\Program Files\Norman\npm\bin\nvoy.exe
C:\Windows\system32\Dwm.exe
C:\Windows\system32\svchost.exe
C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
C:\Windows\System32\spoolsv.exe
C:\Windows\system32\taskeng.exe
C:\Windows\system32\svchost.exe
C:\Program Files\BUFFALO\clientmgrv\bin\BWH32S.exe
C:\Program Files\HP\QuickPlay\Kernel\TV\CLCapSvc.exe
C:\Program Files\Common Files\LightScribe\LSSrvc.exe
C:\Program Files\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\sqlservr.exe
C:\Windows\system32\svchost.exe
C:\Program Files\Microsoft SQL Server\90\Shared\sqlbrowser.exe
C:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe
C:\Windows\system32\svchost.exe
C:\Windows\System32\svchost.exe
C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\DRIVERS\xaudio.exe
C:\Program Files\Hewlett-Packard\Shared\hpqwmiex.exe
C:\Windows\system32\taskeng.exe
C:\Program Files\Norman\Npm\bin\NVCSCHED.EXE
C:\Program Files\Norman\Npm\bin\NJEEVES.EXE
C:\Program Files\Windows Defender\MSASCui.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Program Files\HP\QuickPlay\QPService.exe
C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\QLBCTRL.exe
C:\Program Files\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe
C:\Program Files\Hewlett-Packard\HP Wireless Assistant\WiFiMsg.exe
C:\Program Files\Norman\Npm\Bin\Zlh.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\Windows\ehome\ehtray.exe
C:\Program Files\BUFFALO\clientmgrv\bin\cmvMain.exe
C:\Windows\system32\wbem\wmiprvse.exe
C:\Windows\ehome\ehmsas.exe
C:\Windows\ehome\ehsched.exe
C:\Program Files\Hewlett-Packard\Shared\HpqToaster.exe
C:\Windows\ehome\ehRecvr.exe
C:\Program Files\Synaptics\SynTP\SynTPHelper.exe
C:\Program Files\Hewlett-Packard\HP Health Check\hphc_service.exe
C:\Program Files\Windows Media Player\wmplayer.exe
C:\Program Files\Hewlett-Packard\HP Health Check\HPHC_Scheduler.exe
C:\Windows\system32\WUDFHost.exe
C:\Users\Toni Kokko\AppData\Local\Google\Update\GoogleUpdate.exe
C:\Program Files\Norman\nse\bin\NSESVC.EXE
C:\Program Files\Norman\Nvc\Bin\Nip.exe
C:\Program Files\Norman\Nvc\bin\nvcoas.exe
C:\Program Files\Norman\Nvc\Bin\cclaw.exe
C:\Program Files\Xfire\Xfire.exe
C:\Program Files\Xfire\Xfire.exe
C:\Windows\system32\conime.exe
C:\Windows\Explorer.exe
C:\Windows\system32\wbem\unsecapp.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Users\Toni Kokko\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\Toni Kokko\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\Toni Kokko\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
C:\Windows\system32\SearchProtocolHost.exe
C:\Windows\system32\SearchFilterHost.exe
C:\Windows\system32\wbem\wmiprvse.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://home.sweetim.com
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O1 - Hosts: ::1 localhost
O2 - BHO: Adobe PDF Reader -linkkiavustaja - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - (no file)
O2 - BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O3 - Toolbar: (no name) - {BC4FFE41-DE9F-46fa-B455-AAD49B9F9938} - (no file)
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [QPService] "C:\Program Files\HP\QuickPlay\QPService.exe"
O4 - HKLM\..\Run: [QlbCtrl] %ProgramFiles%\Hewlett-Packard\HP Quick Launch Buttons\QlbCtrl.exe /Start
O4 - HKLM\..\Run: [HP Health Check Scheduler] C:\Program Files\Hewlett-Packard\HP Health Check\HPHC_Scheduler.exe
O4 - HKLM\..\Run: [hpWirelessAssistant] %ProgramFiles%\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe
O4 - HKLM\..\Run: [WAWifiMessage] %ProgramFiles%\Hewlett-Packard\HP Wireless Assistant\WiFiMsg.exe
O4 - HKLM\..\Run: [Norman ZANDA] "C:\Program Files\Norman\Npm\Bin\ZLH.EXE" /LOAD /SPLASH
O4 - HKLM\..\Run: [NvSvc] RUNDLL32.EXE C:\Windows\system32\nvsvc.dll,nvsvcStart
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\Windows\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\Windows\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKLM\..\RunOnce: [Launcher] %WINDIR%\SMINST\launcher.exe
O4 - HKCU\..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun
O4 - HKCU\..\Run: [ehTray.exe] C:\Windows\ehome\ehTray.exe
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background
O4 - HKCU\..\Run: [Google Update] "C:\Users\Toni Kokko\AppData\Local\Google\Update\GoogleUpdate.exe" /c
O4 - Global Startup: ClientManagerV.lnk = C:\Program Files\BUFFALO\clientmgrv\bin\cmvMain.exe
O8 - Extra context menu item: Vie Microsoft E&xceliin - res://C:\PROGRA~1\MICROS~3\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: Oheistiedot - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\OFFICE11\REFIEBAR.DLL
O16 - DPF: {20A60F0D-9AFA-4515-A0FD-83BD84642501} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab56986.cab
O16 - DPF: {5C051655-FCD5-4969-9182-770EA5AA5565} (Solitaire Showdown Class) - http://messenger.zone.msn.com/binary/Sol...wn.cab56986.cab
O16 - DPF: {67DABFBF-D0AB-41FA-9C46-CC0F21721616} - http://download.divx.com/player/DivXBrowserPlugin.cab
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/Mes...nt.cab56907.cab
O20 - AppInit_DLLs:
O23 - Service: Lavasoft Ad-Aware Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
O23 - Service: ArcSoft Connect Daemon (ACDaemon) - Unknown owner - C:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ACService.exe (file missing)
O23 - Service: BWH32S - BUFFALO INC. - C:\Program Files\BUFFALO\clientmgrv\bin\BWH32S.exe
O23 - Service: CyberLink Background Capture Service (CBCS) (CLCapSvc) - Unknown owner - C:\Program Files\HP\QuickPlay\Kernel\TV\CLCapSvc.exe
O23 - Service: CyberLink Task Scheduler (CTS) (CLSched) - Unknown owner - C:\Program Files\HP\QuickPlay\Kernel\TV\CLSched.exe
O23 - Service: Norman eLogger service 6 (eLoggerSvc6) - Norman ASA - C:\Program Files\Norman\Npm\Bin\eLogsvc.exe
O23 - Service: HP Health Check Service - Hewlett-Packard - C:\Program Files\Hewlett-Packard\HP Health Check\hphc_service.exe
O23 - Service: hpqwmiex - Hewlett-Packard Development Company, L.P. - C:\Program Files\Hewlett-Packard\Shared\hpqwmiex.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe
O23 - Service: Norman NJeeves - Norman ASA - C:\Program Files\Norman\Npm\bin\NJEEVES.EXE
O23 - Service: Norman ZANDA - Norman ASA - C:\Program Files\Norman\Npm\Bin\Zanda.exe
O23 - Service: Norman Scanner Engine Service (nsesvc) - Norman ASA - C:\Program Files\Norman\nse\bin\NSESVC.EXE
O23 - Service: Norman Virus Control on-access component (nvcoas) - Norman ASA - C:\Program Files\Norman\Nvc\bin\nvcoas.exe
O23 - Service: Norman Virus Control Scheduler (NVCScheduler) - Norman ASA - C:\Program Files\Norman\Npm\bin\NVCSCHED.EXE
O23 - Service: Norman's Very Own supplY of resources (NVOY) - Norman ASA - C:\Program Files\Norman\npm\bin\nvoy.exe
O23 - Service: RoxMediaDB9 - Sonic Solutions - C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxMediaDB9.exe
O23 - Service: stllssvr - MicroVision Development, Inc. - C:\Program Files\Common Files\SureThing Shared\stllssvr.exe
O23 - Service: XAudioService - Conexant Systems, Inc. - C:\Windows\system32\DRIVERS\xaudio.exe

--
End of file - 9444 bytes

Tässä unistall list

AC3Filter (remove only)
Ad-Aware
Adobe Acrobat and Reader 8.1.2 Security Update 1 (KB403742)
Adobe Flash Player 9 ActiveX
Adobe Flash Player Plugin
Adobe Reader 8.1.2 - Suomi
Adobe Shockwave Player 11
Alarm 2.0.4
ASIO4ALL
BUFFALO Client Manager V
CCleaner (remove only)
Condition Zero
Conexant HD Audio
Counter-Strike
Counter-Strike: Source
Counter-Strike: Source
Day of Defeat
Dedicated Server
ESU for Microsoft Vista
ffdshow (remove only)
GDR 3068 for SQL Server Database Services 2005 ENU (KB948109)
Half-Life 2
Half-Life 2: Deathmatch
Half-Life 2: Episode One
Half-Life 2: Episode Two
HDAUDIO Soft Data Fax Modem with SmartCP
Heroes II Gold
Heroes of Might and Magic IV
Heroes of Might and Magic® III Complete
Hewlett-Packard Active Check
Hewlett-Packard Asset Agent
HijackThis 2.0.2
HP Active Support Library
HP Active Support Library 32 bit components
HP Customer Experience Enhancements
HP Doc Viewer
HP Easy Setup - Frontend
HP Help and Support
HP Photosmart Essential 2.0
HP Quick Launch Buttons 6.20 B1
HP QuickPlay 3.2
HP Update
HP User Guides 0057
HP Wireless Assistant
IL Download Manager
ImgBurn
Insurgency
InterVideo FilterSDK for AMT
Java 2 SDK, SE v1.4.1_01
Java(TM) 6 Update 11
Malwarebytes' Anti-Malware
Microsoft MSDN 2005 Express Edition - ENU
Microsoft Office Professional Edition 2003
Microsoft SAPI 5.1 Voices for Windows XP
Microsoft Silverlight
Microsoft SQL Server 2005
Microsoft SQL Server 2005 Express Edition (SQLEXPRESS)
Microsoft SQL Server Native Client
Microsoft SQL Server Setup Support Files (English)
Microsoft SQL Server VSS Writer
Microsoft Visual Basic 2005 Express Edition - ENU
Microsoft Visual Basic 2005 Express Edition - ENU
Microsoft Visual Basic 2005 Express Edition - ENU Service Pack 1 (KB926747)
Microsoft Visual C++ 2005 Redistributable
Microsoft Works
mIRC
Mozilla Firefox (3.0.4)
MSCU for Microsoft Vista
MSXML 4.0 SP2 (KB936181)
MSXML 4.0 SP2 (KB941833)
MSXML 4.0 SP2 (KB954430)
MSXML 4.0 SP2 Parser and SDK
Network Play System (Patching)
Norman Virus Control
NVIDIA Drivers
Peggle Deluxe Demo
Peggle Extreme
RevConnect
Roxio Activation Module
Roxio Creator Audio
Roxio Creator Basic v9
Roxio Creator Copy
Roxio Creator Data
Roxio Creator EasyArchive
Roxio Creator Tools
Roxio Express Labeler 3
Roxio MyDVD Basic v9
Security Update for CAPICOM (KB931906)
Security Update for CAPICOM (KB931906)
Skype 2.5
SmartAudio
Source Dedicated Server
Steam
Synaptics Pointing Device Driver
System Requirements Lab
The Sims
The Sims Deluxe Edition
Uninstall 1.0.0.0
Update for Microsoft Visual Basic 2005 Express Edition - ENU (KB932232)
VCRedistSetup
Winamp
Windows Live Messenger
Windows Media Player Firefox Plugin
WinRAR-pakkausohjelma
Visual Basic 4 (32 bit) Runtime Modules
VobSub v2.23 (Remove Only)
Xfire (remove only)



[ + lainaa]
Toni
Hujo
Suspended permanently
_ 		16. joulukuuta 2008 @ 20:28 _ Linkki tähän viestiin    Lähetä käyttäjälle yksityisviesti   
poista lisää poista sovelutuksesta

scannaa hjt:llä merkkaa paina Fix checked

O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - (no file)
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O3 - Toolbar: (no name) - {BC4FFE41-DE9F-46fa-B455-AAD49B9F9938} - (no file)
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O20 - AppInit_DLLs:

====================

Lataa Atribunen ATF Cleaner

Ohjeet;

Tupla-klikkaa ATF-Cleaner.exe käynnistääksesi ohjelman.Main:n alla valitse: Select All
Klikkaa Empty Selected valintaa.
Jos käytät FireFoxia selaimenasi Klikkaa Firefox yläpuolelta ja valitse: Select All
Klikkaa Empty Selected valintaa.
HUOMIO: Jos haluaisit pitää tallennetut salasanasi, klikkaa No kun se sitä kysyy.
Jos käytät Operaa selaimenasiKlikkaa Opera yläpuolelta ja valitse: Select All
Klikkaa Empty Selected valintaa taas.
HUOMIO: Jos haluaisit pitää tallennetut salasanasi, klikkaa No kun se sitä kysyy.
Klikkaa Exit päävalikosta sulkeaksesi ohjelman.
Teknistä tukea tulee jos tupla-klikkaat sähköpostiosoitetta joka sijaitsee jokaisen menun alapuolella kyseisessä työkalussa. (Huomatkaa että se tuki on sitten englanniksi)

=================

scannaa hjt:llä merkkaa paina Fix checked

O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - (no file)
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O3 - Toolbar: (no name) - {BC4FFE41-DE9F-46fa-B455-AAD49B9F9938} - (no file)
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O20 - AppInit_DLLs:

================

Avaa Muistio ja kopioi/liitä lainauksen sisältö sinne:

Lainaus:
Folder::
c:\users\Toni Kokko\AppData\Roaming\Comodo
c:\users\All Users\comodo
c:\programdata\comodo
c:\program files\COMODO

Tallenna se nimellä CFScript.txt

Sitten raahaa CFScript ComboFix.exeen kuten alla.



Käynnistä tietokone uudelleen pyydettäessä ja lähetä combofix.txt-tiedoston sisältö tänne.

[ + lainaa]
Voiko tietsikka koskaan toimia?
tonikokko
Member
_ 		17. joulukuuta 2008 @ 13:13 _ Linkki tähän viestiin    Lähetä käyttäjälle yksityisviesti   
ComboFix 08-12-15.01 - Toni Kokko 2008-12-17 12:38:12.3 - NTFSx86
Microsoft® Windows Vista? Home Premium 6.0.6001.1.1252.1.1035.18.1982.907 [GMT 2:00]
Sijainti: c:\users\Toni Kokko\Desktop\ComboFix.exe
Käytetyt komentorivivalitsimet :: c:\users\Toni Kokko\Desktop\CFScript.txt
* Uusi palautuspiste luotu
* Resident AV is active

.

(((((((((((((((((((((((((((((((((((((( Muut poistot ))))))))))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\program files\COMODO
c:\program files\COMODO\SafeSurf\cssurf.exe
c:\programdata\comodo
c:\programdata\comodo\common\Pending\PendingList.txt
c:\users\All Users\comodo\common\Pending\PendingList.txt
c:\users\Toni Kokko\AppData\Roaming\Comodo

.
((((( Tiedostot, jotka on luotu seuraavalla aikavälillä: 2008-11-17 to 2008-12-17 )))))))))))))))))
.

2008-12-14 20:48 . 2008-12-14 20:48 <KANSIO> d-------- c:\program files\Java
2008-12-14 20:48 . 2008-12-14 20:48 410,984 --a------ c:\windows\System32\deploytk.dll
2008-12-14 17:41 . 2008-12-14 17:42 <KANSIO> d-------- c:\users\Toni Kokko\AppData\Roaming\U3
2008-12-11 23:08 . 2008-12-14 17:56 <KANSIO> d-------- c:\users\Toni Kokko\.SunDownloadManager
2008-12-11 22:37 . 2008-12-11 22:37 42,320 --a------ c:\windows\System32\xfcodec.dll
2008-12-11 15:00 . 2008-12-11 15:00 249,592 --a------ c:\windows\System32\cssdll32.dll
2008-12-10 23:23 . 2008-12-10 23:23 <KANSIO> d-------- c:\users\Toni Kokko\AppData\Roaming\ImgBurn
2008-12-10 23:19 . 2008-12-10 23:19 <KANSIO> d-------- c:\program files\ImgBurn
2008-12-10 20:52 . 2008-12-10 20:52 <KANSIO> d-------- c:\temp\Windows XP Professional (English)
2008-12-10 16:01 . 2008-10-22 03:22 2,048 --a------ c:\windows\System32\tzres.dll
2008-12-09 21:05 . 2008-12-09 21:05 <KANSIO> d-------- c:\program files\Trend Micro
2008-12-08 18:53 . 2008-12-08 18:53 <KANSIO> d-------- c:\users\All Users\Kaspersky Lab Setup Files
2008-12-08 18:53 . 2008-12-08 18:53 <KANSIO> d-------- c:\programdata\Kaspersky Lab Setup Files
2008-12-07 23:57 . 2008-12-07 23:57 <KANSIO> d-------- c:\windows\Sun
2008-12-02 21:43 . 2008-12-02 21:43 <KANSIO> d-------- c:\users\Toni Kokko\AppData\Roaming\Malwarebytes
2008-12-02 21:43 . 2008-12-02 21:43 <KANSIO> d-------- c:\users\All Users\Malwarebytes
2008-12-02 21:43 . 2008-12-02 21:43 <KANSIO> d-------- c:\programdata\Malwarebytes
2008-12-02 21:43 . 2008-12-14 22:54 <KANSIO> d-------- c:\program files\Malwarebytes' Anti-Malware
2008-12-02 21:43 . 2008-12-03 19:52 38,496 --a------ c:\windows\System32\drivers\mbamswissarmy.sys
2008-12-02 21:43 . 2008-12-03 19:52 15,504 --a------ c:\windows\System32\drivers\mbam.sys
2008-11-26 19:39 . 2008-10-21 07:25 1,645,568 --a------ c:\windows\System32\connect.dll
2008-11-26 19:39 . 2008-08-28 05:40 712,704 --a------ c:\windows\System32\WindowsCodecs.dll
2008-11-26 19:39 . 2008-08-28 05:40 425,472 --a------ c:\windows\System32\PhotoMetadataHandler.dll
2008-11-26 19:39 . 2008-08-28 05:40 347,136 --a------ c:\windows\System32\WindowsCodecsExt.dll
2008-11-26 19:39 . 2008-10-22 05:57 241,152 --a------ c:\windows\System32\PortableDeviceApi.dll
2008-11-24 22:36 . 2008-11-24 22:37 <KANSIO> d-------- c:\users\All Users\Lavasoft
2008-11-24 22:36 . 2008-11-24 22:37 <KANSIO> d-------- c:\programdata\Lavasoft
2008-11-24 22:36 . 2008-11-24 22:36 <KANSIO> d-------- c:\program files\Lavasoft
2008-11-24 22:35 . 2008-12-10 18:41 <KANSIO> d-------- c:\program files\Common Files\Wise Installation Wizard
2008-11-23 22:44 . 2008-11-23 22:44 <KANSIO> dr------- c:\windows\System32\config\systemprofile\Videos
2008-11-23 22:44 . 2008-11-23 22:44 <KANSIO> dr------- c:\windows\System32\config\systemprofile\Pictures
2008-11-23 22:44 . 2008-11-23 22:44 <KANSIO> dr------- c:\windows\System32\config\systemprofile\Downloads
2008-11-23 22:44 . 2008-11-23 22:44 <KANSIO> dr------- c:\windows\System32\config\systemprofile\Documents
2008-11-23 20:15 . 2008-11-23 20:15 52,736 --a------ c:\windows\ipuninst.exe
2008-11-23 19:50 . 2008-11-23 19:50 <KANSIO> d-------- c:\program files\Alcohol Soft
2008-11-17 16:27 . 2008-11-17 16:27 <KANSIO> d-------- c:\program files\CCleaner

.
(((((((((((((((((((((((((((((((((((( Find3M-raportti ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-12-17 05:45 --------- d-----w c:\programdata\Xfire
2008-12-17 04:49 --------- d-----w c:\program files\Steam
2008-12-16 09:14 28,314 ----a-w c:\users\Toni Kokko\AppData\Roaming\nvModes.dat
2008-12-16 09:05 --------- d-----w c:\users\Toni Kokko\AppData\Roaming\Xfire
2008-12-16 09:05 --------- d-----w c:\program files\Xfire
2008-12-15 05:12 --------- d-----w c:\program files\World of Warcraft
2008-12-14 20:19 --------- d-----w c:\program files\Norman
2008-12-14 18:21 --------- d-----w c:\users\Toni Kokko\AppData\Roaming\uTorrent
2008-12-14 18:05 --------- d--h--w c:\program files\InstallShield Installation Information
2008-12-14 16:33 --------- d-----w c:\users\Toni Kokko\AppData\Roaming\mIRC
2008-12-10 14:50 --------- d-----w c:\program files\Windows Mail
2008-12-10 13:35 --------- d-----w c:\program files\mIRC
2008-12-08 07:23 --------- d-----w c:\program files\MSN Messenger
2008-12-07 17:31 --------- d-----w c:\program files\RevConnect
2008-12-03 20:31 --------- d-----w c:\program files\WhatPulse
2008-11-24 09:59 --------- d-----w c:\program files\Google
2008-11-23 21:22 --------- d-----w c:\users\Toni Kokko\AppData\Roaming\BSplayer
2008-11-23 21:22 --------- d-----w c:\program files\Webteh
2008-11-23 20:27 --------- d-----w c:\programdata\Team MediaPortal
2008-11-23 20:27 --------- d-----w c:\program files\Team MediaPortal
2008-11-23 19:15 --------- d-----w c:\program files\Common Files\ArcSoft
2008-11-23 17:18 717,296 ----a-w c:\windows\system32\drivers\sptd.sys
2008-11-22 18:33 --------- d-----w c:\program files\SystemRequirementsLab
2008-11-22 18:31 --------- d-----w c:\users\Toni Kokko\AppData\Roaming\SystemRequirementsLab
2008-11-15 20:11 --------- d-----w c:\program files\Common Files\Steam
2008-11-13 16:21 --------- d-----w c:\users\Toni Kokko\AppData\Roaming\Skype
2008-11-03 14:00 --------- d-----w c:\programdata\Blizzard
2008-11-02 18:36 --------- d-----w c:\program files\Common Files\Blizzard Entertainment
2008-11-01 19:22 --------- d-----w c:\programdata\ArcSoft
2008-11-01 16:15 --------- d-----w c:\program files\Microsoft SQL Server
2008-11-01 07:40 30 ----a-w c:\users\Toni Kokko\jagex_runescape_preferences.dat
2008-11-01 03:44 541,696 ----a-w c:\windows\AppPatch\AcLayers.dll
2008-11-01 03:44 52,736 ----a-w c:\windows\AppPatch\iebrshim.dll
2008-11-01 03:44 460,288 ----a-w c:\windows\AppPatch\AcSpecfc.dll
2008-11-01 03:44 28,672 ----a-w c:\windows\System32\Apphlpdm.dll
2008-11-01 03:44 2,154,496 ----a-w c:\windows\AppPatch\AcGenral.dll
2008-11-01 03:44 173,056 ----a-w c:\windows\AppPatch\AcXtrnal.dll
2008-11-01 01:21 4,240,384 ----a-w c:\windows\System32\GameUXLegacyGDFs.dll
2008-10-31 20:12 --------- d-----w c:\users\Toni Kokko\AppData\Roaming\Ventrilo
2008-10-31 19:17 --------- d-----w c:\users\Toni Kokko\AppData\Roaming\ArcSoft
2008-10-31 16:40 --------- d-----w c:\program files\mpgconv
2008-10-31 16:12 --------- d-----w c:\program files\Microsoft.NET
2008-10-31 15:08 --------- d-----w c:\program files\ProgDVB
2008-10-29 06:29 2,927,104 ----a-w c:\windows\explorer.exe
2008-10-22 15:44 --------- d-----w c:\program files\Microsoft Silverlight
2008-10-21 05:25 296,960 ----a-w c:\windows\System32\gdi32.dll
2008-10-20 13:27 --------- d-----w c:\users\Toni Kokko\AppData\Roaming\fretsonfire
2008-10-17 17:20 --------- d-----w c:\program files\uTorrent
2008-10-17 11:15 --------- d-----w c:\program files\xchat
2008-10-17 11:14 --------- d-----w c:\program files\Frets on Fire
2008-10-17 11:10 --------- d-----w c:\program files\Audacity
2008-10-16 21:13 1,809,944 ----a-w c:\windows\System32\wuaueng.dll
2008-10-16 21:12 561,688 ----a-w c:\windows\System32\wuapi.dll
2008-10-16 21:09 51,224 ----a-w c:\windows\System32\wuauclt.exe
2008-10-16 21:09 43,544 ----a-w c:\windows\System32\wups2.dll
2008-10-16 21:08 34,328 ----a-w c:\windows\System32\wups.dll
2008-10-16 20:56 1,524,736 ----a-w c:\windows\System32\wucltux.dll
2008-10-16 20:55 83,456 ----a-w c:\windows\System32\wudriver.dll
2008-10-16 12:08 162,064 ----a-w c:\windows\System32\wuwebv.dll
2008-10-16 11:56 31,232 ----a-w c:\windows\System32\wuapp.exe
2008-10-16 04:47 827,392 ----a-w c:\windows\System32\wininet.dll
2008-10-09 16:54 28,672 ----a-w c:\windows\System32\AF15BDAEX.dll
2008-09-30 14:43 1,286,152 ----a-w c:\windows\System32\msxml4.dll
2008-09-18 05:09 3,601,464 ----a-w c:\windows\System32\ntkrnlpa.exe
2008-09-18 05:09 3,549,240 ----a-w c:\windows\System32\ntoskrnl.exe
2008-09-18 04:56 147,456 ----a-w c:\windows\System32\Faultrep.dll
2008-09-18 04:56 125,952 ----a-w c:\windows\System32\wersvc.dll
2008-09-18 02:16 2,032,640 ----a-w c:\windows\System32\win32k.sys
2008-05-24 06:35 174 --sha-w c:\program files\desktop.ini
2007-11-12 15:12 856 ----a-w c:\users\Toni Kokko\AppData\Roaming\wklnhst.dat
2005-07-05 14:47 777 ----a-w c:\program files\trial_setup.ini
2005-07-05 14:47 5,133,312 ----a-w c:\program files\trial_setup.msi
2005-07-05 14:47 40,448 ----a-w c:\program files\trial_setup.exe
2007-10-28 17:48 16,384 --sha-w c:\windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat
2007-10-28 17:48 32,768 --sha-w c:\windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat
2007-10-28 17:48 16,384 --sha-w c:\windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Cookies\index.dat
2007-08-30 15:12 16 --sha-w c:\windows\SMINST\HPCD.sys
.

((((((((((((((((((((((((((((( snapshot@2008-12-15_22.23.28,00 )))))))))))))))))))))))))))))))))))))))))
.
- 2008-12-15 17:36:07 262,144 --sha-w c:\windows\ServiceProfiles\NetworkService\NTUSER.DAT
+ 2008-12-15 20:22:47 262,144 --sha-w c:\windows\ServiceProfiles\NetworkService\NTUSER.DAT
+ 2008-12-15 20:22:47 262,144 ---ha-w c:\windows\ServiceProfiles\NetworkService\ntuser.dat.LOG1
- 2008-12-11 14:30:51 430,472 ----a-w c:\windows\SoftwareDistribution\Download\Install\mpas-d.exe
+ 2008-12-17 10:28:44 2,456 ----a-w c:\windows\System32\networklist\icons\{A19B1C67-A399-4F4C-816A-2C34D3E3760F}_24.bin
+ 2008-12-17 10:28:44 4,280 ----a-w c:\windows\System32\networklist\icons\{A19B1C67-A399-4F4C-816A-2C34D3E3760F}_32.bin
+ 2008-12-17 10:28:44 9,560 ----a-w c:\windows\System32\networklist\icons\{A19B1C67-A399-4F4C-816A-2C34D3E3760F}_48.bin
- 2008-12-15 14:21:23 489,176 ----a-w c:\windows\System32\WDI\SuspendPerformanceDiagnostics_SystemData_S3.bin
+ 2008-12-16 16:19:52 493,682 ----a-w c:\windows\System32\WDI\SuspendPerformanceDiagnostics_SystemData_S3.bin
.
(((((((((((((((((((((((((((((( Rekisterin käynnistyskohteet )))))))))))))))))))))))))))))))))))))))))))))
.
.
*Huom* Tyhjiä arvoja ja laillisia oletusarvoja ei näytetä
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Sidebar"="c:\program files\Windows Sidebar\sidebar.exe" [2008-01-18 1233920]
"ehTray.exe"="c:\windows\ehome\ehTray.exe" [2008-01-18 125952]
"msnmsgr"="c:\program files\MSN Messenger\msnmsgr.exe" [2007-01-19 5674352]
"Google Update"="c:\users\Toni Kokko\AppData\Local\Google\Update\GoogleUpdate.exe" [2008-12-15 133104]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2008-03-28 1045800]
"QPService"="c:\program files\HP\QuickPlay\QPService.exe" [2007-04-23 176128]
"QlbCtrl"="c:\program files\Hewlett-Packard\HP Quick Launch Buttons\QlbCtrl.exe" [2007-02-13 159744]
"HP Health Check Scheduler"="c:\program files\Hewlett-Packard\HP Health Check\HPHC_Scheduler.exe" [2007-03-12 50696]
"hpWirelessAssistant"="c:\program files\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe" [2007-03-01 472776]
"WAWifiMessage"="c:\program files\Hewlett-Packard\HP Wireless Assistant\WiFiMsg.exe" [2007-01-10 317128]
"Norman ZANDA"="c:\program files\Norman\Npm\Bin\ZLH.EXE" [2008-06-02 277616]
"NvSvc"="c:\windows\system32\nvsvc.dll" [2007-11-07 86016]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2007-11-07 8534560]
"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2007-11-07 81920]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2008-12-14 136600]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce]
"Launcher"="c:\windows\SMINST\launcher.exe" [2006-11-07 44128]

c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
ClientManagerV.lnk - c:\program files\BUFFALO\clientmgrv\bin\cmvMain.exe [2008-10-07 138808]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"EnableUIADesktopToggle"= 0 (0x0)

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"AppInit_DLLs"=

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"vidc.ffds"= c:\program files\ffdshow\ffdshow.ax
"VIDC.XFR1"= xfcodec.dll

[HKLM\~\startupfolder\C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^Adobe Gamma Loader.lnk]
path=c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\Adobe Gamma Loader.lnk
backup=c:\windows\pss\Adobe Gamma Loader.lnk.CommonStartup
backupExtension=.CommonStartup

[HKLM\~\startupfolder\C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^TMMonitor.lnk]
path=c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\TMMonitor.lnk
backup=c:\windows\pss\TMMonitor.lnk.CommonStartup
backupExtension=.CommonStartup

[HKLM\~\startupfolder\C:^Users^Toni Kokko^AppData^Roaming^Microsoft^Windows^Start Menu^Programs^Startup^Xfire.lnk]
path=c:\users\Toni Kokko\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Xfire.lnk
backup=c:\windows\pss\Xfire.lnk.Startup
backupExtension=.Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher]
--a------ 2008-01-11 21:16 39792 c:\program files\Adobe\Reader 8.0\Reader\reader_sl.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\msnmsgr]
--a------ 2007-01-19 11:55 5674352 c:\program files\MSN Messenger\msnmsgr.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Skype]
--a------ 2006-07-13 23:41 20034600 c:\program files\Skype\Phone\Skype.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WhatPulse]
--a------ 2006-08-21 19:48 665600 c:\program files\WhatPulse\WhatPulse.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WinampAgent]
--a------ 2008-08-04 01:02 36352 c:\program files\Winamp\winampa.exe

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]
"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\FirewallRules]
"TCP Query User{0E60E5F2-C916-49E0-95D4-2E627F9B6584}c:\\program files\\msn messenger\\msnmsgr.exe"= UDP:c:\program files\msn messenger\msnmsgr.exe:Messenger
"UDP Query User{4C2E6A0D-F273-4BDA-83C8-F765026B7793}c:\\program files\\msn messenger\\msnmsgr.exe"= TCP:c:\program files\msn messenger\msnmsgr.exe:Messenger
"{D544B387-58C0-408C-A260-FD2D4E311490}"= UDP:c:\program files\Atari\Neverwinter Nights 2\nwn2main.exe:Neverwinter Nights 2 Main
"{8EA83D06-8F05-4EF9-80CA-755B77E5AFF8}"= TCP:c:\program files\Atari\Neverwinter Nights 2\nwn2main.exe:Neverwinter Nights 2 Main
"{AFD50BC0-ADB8-48FD-89BA-EB04869FB04A}"= UDP:c:\program files\Atari\Neverwinter Nights 2\nwn2main_amdxp.exe:Neverwinter Nights 2 AMD
"{BE23AB97-F9AB-4DE6-A39D-6E559FC93900}"= TCP:c:\program files\Atari\Neverwinter Nights 2\nwn2main_amdxp.exe:Neverwinter Nights 2 AMD
"{D66B4CF5-C554-4AEB-A86E-AD7DB85A46A8}"= UDP:c:\program files\Atari\Neverwinter Nights 2\nwupdate.exe:Neverwinter Nights 2 Updater
"{CE2B4A9D-8D3E-493A-85E2-75A59E58922D}"= TCP:c:\program files\Atari\Neverwinter Nights 2\nwupdate.exe:Neverwinter Nights 2 Updater
"{9963DB7F-22C2-473D-9917-DC1D1E408B72}"= UDP:c:\program files\Atari\Neverwinter Nights 2\nwn2server.exe:Neverwinter Nights 2 Server
"{244AD98B-9023-47F0-AD1E-29BC7685E96A}"= TCP:c:\program files\Atari\Neverwinter Nights 2\nwn2server.exe:Neverwinter Nights 2 Server
"TCP Query User{F489A6A9-FE85-4FA6-85CF-E59E6DAF3156}c:\\program files\\xfire\\xfire.exe"= UDP:c:\program files\xfire\xfire.exe:Xfire
"UDP Query User{7D9956B7-71D1-4FC4-9CE6-832F85DAB2F3}c:\\program files\\xfire\\xfire.exe"= TCP:c:\program files\xfire\xfire.exe:Xfire
"TCP Query User{C1771924-088B-4479-9E4F-08E43FFECB97}c:\\program files\\msn messenger\\livecall.exe"= UDP:c:\program files\msn messenger\livecall.exe:Windows Live Call
"UDP Query User{F792272E-B764-4CFD-B2F1-C8B157A42A87}c:\\program files\\msn messenger\\livecall.exe"= TCP:c:\program files\msn messenger\livecall.exe:Windows Live Call
"TCP Query User{FF66BB09-91AA-4DE6-AF98-A53FD47C99A4}c:\\program files\\emule\\emule.exe"= UDP:c:\program files\emule\emule.exe:eMule
"UDP Query User{331EAEE3-D7AB-4DFB-B4A2-144FCF3159A8}c:\\program files\\emule\\emule.exe"= TCP:c:\program files\emule\emule.exe:eMule
"TCP Query User{9A954996-511F-4135-8468-ECB0BCE6021C}c:\\users\\toni kokko\\desktop\\nes\\nestc042\\nestcl95.exe"= UDP:c:\users\toni kokko\desktop\nes\nestc042\nestcl95.exe:nestcl95.exe
"UDP Query User{F76BA4B4-2BB9-409B-AE4E-4EB7BB4117F2}c:\\users\\toni kokko\\desktop\\nes\\nestc042\\nestcl95.exe"= TCP:c:\users\toni kokko\desktop\nes\nestc042\nestcl95.exe:nestcl95.exe
"TCP Query User{CCCA7D9E-957F-41C2-9E95-BF5A9D165A8B}c:\\users\\toni kokko\\desktop\\utorrent.exe"= UDP:c:\users\toni kokko\desktop\utorrent.exe:utorrent.exe
"UDP Query User{A5D6125A-F900-48E3-B961-6D3FEC8C95E5}c:\\users\\toni kokko\\desktop\\utorrent.exe"= TCP:c:\users\toni kokko\desktop\utorrent.exe:utorrent.exe
"TCP Query User{74C37976-832D-4749-804A-AD0500E05A5A}c:\\neverwinternights\\nwn\\nwmain.exe"= UDP:c:\neverwinternights\nwn\nwmain.exe:Neverwinter Nights
"UDP Query User{800E3D01-47D1-4313-BFD1-B33D07152FC3}c:\\neverwinternights\\nwn\\nwmain.exe"= TCP:c:\neverwinternights\nwn\nwmain.exe:Neverwinter Nights
"TCP Query User{E34D9D43-0DBD-438C-9399-F8EFF49FE563}c:\\program files\\mozilla firefox\\firefox.exe"= UDP:c:\program files\mozilla firefox\firefox.exe:Firefox
"UDP Query User{5801BA1E-24E1-4DAA-B511-AFB0979D09E9}c:\\program files\\mozilla firefox\\firefox.exe"= TCP:c:\program files\mozilla firefox\firefox.exe:Firefox
"{4DEA1078-B4EF-46F8-8AE7-B438930E46EF}"= UDP:c:\program files\BitTorrent\bittorrent.exe:BitTorrent
"{FDBCB264-4CDB-4991-AD93-DE1FADBEE8BF}"= TCP:c:\program files\BitTorrent\bittorrent.exe:BitTorrent
"TCP Query User{450ACF7E-B1DD-4791-8D62-03446A1DCE2A}c:\\program files\\byond\\bin\\byond.exe"= UDP:c:\program files\byond\bin\byond.exe:byond
"UDP Query User{D1B4E27F-BC0E-4084-A91F-84E9117CC3A0}c:\\program files\\byond\\bin\\byond.exe"= TCP:c:\program files\byond\bin\byond.exe:byond
"TCP Query User{30F015A4-F3E8-4A45-BAA0-C14ACA1208CB}c:\\program files\\utorrent\\utorrent.exe"= UDP:c:\program files\utorrent\utorrent.exe:uTorrent
"UDP Query User{DB869AB6-C57A-45A4-9C81-A6635D2B3780}c:\\program files\\utorrent\\utorrent.exe"= TCP:c:\program files\utorrent\utorrent.exe:uTorrent
"TCP Query User{6D1C176D-F5CB-4456-9837-7333E5D352A9}c:\\program files\\counter-strike 1.6\\hl.exe"= UDP:c:\program files\counter-strike 1.6\hl.exe:Half-Life Launcher
"UDP Query User{0F745B67-F537-4EAD-B14E-6597D2C8D17E}c:\\program files\\counter-strike 1.6\\hl.exe"= TCP:c:\program files\counter-strike 1.6\hl.exe:Half-Life Launcher
"TCP Query User{D677DB5E-40A0-43E1-8D41-7D2419599383}c:\\program files\\ea games\\medal of honor pacific assault(tm) mpdemo2\\mohpa_mpdemo.exe"= UDP:c:\program files\ea games\medal of honor pacific assault(tm) mpdemo2\mohpa_mpdemo.exe:Medal of Honor Pacific Assault(tm)
"UDP Query User{458AC2B1-2FAC-4B4B-84F5-583EB41A645D}c:\\program files\\ea games\\medal of honor pacific assault(tm) mpdemo2\\mohpa_mpdemo.exe"= TCP:c:\program files\ea games\medal of honor pacific assault(tm) mpdemo2\mohpa_mpdemo.exe:Medal of Honor Pacific Assault(tm)
"TCP Query User{5EFC87C6-F824-46C0-B522-289B9521117F}c:\\program files\\ea games\\medal of honor pacific assault(tm) mpdemo2\\mohpa_mpdemo_server.exe"= UDP:c:\program files\ea games\medal of honor pacific assault(tm) mpdemo2\mohpa_mpdemo_server.exe:Medal of Honor Pacific Assault(tm)
"UDP Query User{5170532E-4D95-4AC3-8CB3-43BDD42DF486}c:\\program files\\ea games\\medal of honor pacific assault(tm) mpdemo2\\mohpa_mpdemo_server.exe"= TCP:c:\program files\ea games\medal of honor pacific assault(tm) mpdemo2\mohpa_mpdemo_server.exe:Medal of Honor Pacific Assault(tm)
"TCP Query User{C3BEF026-E9E6-49AF-8692-82BA32F08404}c:\\program files\\wolfenstein - enemy territory\\et.exe"= UDP:c:\program files\wolfenstein - enemy territory\et.exe:ET
"UDP Query User{5D2F2AEB-CEDA-4639-A9D0-F0C577D93D08}c:\\program files\\wolfenstein - enemy territory\\et.exe"= TCP:c:\program files\wolfenstein - enemy territory\et.exe:ET
"TCP Query User{13F890DE-490E-4B0B-A087-A1602366A068}c:\\program files\\wolfenstein - enemy territory\\etded.exe"= UDP:c:\program files\wolfenstein - enemy territory\etded.exe:ETDED
"UDP Query User{B91B82C8-9DF3-4DD9-944C-FE795C320114}c:\\program files\\wolfenstein - enemy territory\\etded.exe"= TCP:c:\program files\wolfenstein - enemy territory\etded.exe:ETDED
"{28350A57-E35F-4F9C-B726-7B3C68A588E3}"= UDP:c:\users\Public\Documents\Blizzard Entertainment\World of Warcraft\WoW-2.3.0.7561-to-2.3.2.7741-enGB-downloader.exe:Blizzard Downloader
"{76E61FE2-B81C-4A09-983A-D667AD863C44}"= TCP:c:\users\Public\Documents\Blizzard Entertainment\World of Warcraft\WoW-2.3.0.7561-to-2.3.2.7741-enGB-downloader.exe:Blizzard Downloader
"TCP Query User{6F5B6C21-B17E-4BA6-BACF-63340EF3162E}c:\\program files\\microsoft games\\halo\\halo.exe"= UDP:c:\program files\microsoft games\halo\halo.exe:Halo
"UDP Query User{47B278DD-D9A1-41DF-BA07-E2CA5916589E}c:\\program files\\microsoft games\\halo\\halo.exe"= TCP:c:\program files\microsoft games\halo\halo.exe:Halo
"TCP Query User{84C8EEEE-5646-45A6-9B3E-7BB1B421C0B7}c:\\users\\toni kokko\\desktop\\installer-22999-864-counter-strike.exe"= UDP:c:\users\toni kokko\desktop\installer-22999-864-counter-strike.exe:installer-22999-864-counter-strike.exe
"UDP Query User{96AF4C29-27B9-470A-898F-C74BDE0FA4B5}c:\\users\\toni kokko\\desktop\\installer-22999-864-counter-strike.exe"= TCP:c:\users\toni kokko\desktop\installer-22999-864-counter-strike.exe:installer-22999-864-counter-strike.exe
"TCP Query User{619080D8-8BD2-43BE-9D6D-20EF595F124B}c:\\program files\\jazz jackrabbit 2\\jazz2.exe"= UDP:c:\program files\jazz jackrabbit 2\jazz2.exe:Jazz Jackrabbit 2
"UDP Query User{E21B1754-AC24-4590-A3EC-7AD436050300}c:\\program files\\jazz jackrabbit 2\\jazz2.exe"= TCP:c:\program files\jazz jackrabbit 2\jazz2.exe:Jazz Jackrabbit 2
"{C430DAF0-70C6-4A09-9149-FE39258CC3E7}"= UDP:94:VRS Recording System Web Control Panel
"{5E1865ED-1E02-40B5-BD48-464808564702}"= TCP:8000:Axon Virtual PBX RTP Incoming Audio (UDP)
"{48B844C8-8091-454D-A500-3829598B8619}"= TCP:8001:Axon Virtual PBX RTP Incoming Audio (UDP)
"{D5122966-424E-4973-B4E8-621466F124FA}"= TCP:8002:Axon Virtual PBX RTP Incoming Audio (UDP)
"{14CA1EB7-06AF-4992-8F33-CA8A2A6907A1}"= TCP:8003:Axon Virtual PBX RTP Incoming Audio (UDP)
"{07144F0D-652E-4938-A4A6-7AB816714FFA}"= TCP:8004:Axon Virtual PBX RTP Incoming Audio (UDP)
"{10771593-3459-4E97-946D-393D93FCBD84}"= UDP:81:Axon Virtual PBX Web Server
"TCP Query User{DC46209A-4D4D-424A-8B56-2D92080081FA}c:\\program files\\condition zero\\hlds.exe"= UDP:c:\program files\condition zero\hlds.exe:HLDS Launcher
"UDP Query User{34072C27-AA45-49B3-938D-BE4BC547EAA6}c:\\program files\\condition zero\\hlds.exe"= TCP:c:\program files\condition zero\hlds.exe:HLDS Launcher
"TCP Query User{3C767F74-CB7D-4D9F-8EE2-50E472BA6FA5}c:\\program files\\skype\\phone\\skype.exe"= UDP:c:\program files\skype\phone\skype.exe:Skype. The whole world can talk for free.
"UDP Query User{DC78D1AA-837C-46A6-96FD-5D6B2A1BBECA}c:\\program files\\skype\\phone\\skype.exe"= TCP:c:\program files\skype\phone\skype.exe:Skype. The whole world can talk for free.
"TCP Query User{AA2D2F5E-039A-4DD4-885B-C2D14B1A31A2}c:\\program files\\condition zero\\hlds.exe"= UDP:c:\program files\condition zero\hlds.exe:HLDS Launcher
"UDP Query User{0DBC3F9B-298F-4C44-8502-7B0DAA696F75}c:\\program files\\condition zero\\hlds.exe"= TCP:c:\program files\condition zero\hlds.exe:HLDS Launcher
"TCP Query User{D7AD1479-5F64-4930-83C8-2927AB9E0F13}c:\\program files\\steam\\steamapps\\tonikokko\\dedicated server\\hlds.exe"= UDP:c:\program files\steam\steamapps\tonikokko\dedicated server\hlds.exe:HLDS Launcher
"UDP Query User{F3C82F4E-374B-44B6-97CB-56D0293C4BA9}c:\\program files\\steam\\steamapps\\tonikokko\\dedicated server\\hlds.exe"= TCP:c:\program files\steam\steamapps\tonikokko\dedicated server\hlds.exe:HLDS Launcher
"TCP Query User{1EC6E41B-CDBA-49BF-B50B-42CDDB39E83D}c:\\program files\\css\\hl2.exe"= UDP:c:\program files\css\hl2.exe:hl2
"UDP Query User{A7391A47-23E6-4F58-ACEC-DD126FFE456F}c:\\program files\\css\\hl2.exe"= TCP:c:\program files\css\hl2.exe:hl2
"TCP Query User{5B91D1B4-4D0D-4392-B877-7605B8FE1A0C}c:\\program files\\css\\srcds.exe"= UDP:c:\program files\css\srcds.exe:srcds
"UDP Query User{B0D44996-1DFD-4C13-9FB0-FB239079A96A}c:\\program files\\css\\srcds.exe"= TCP:c:\program files\css\srcds.exe:srcds
"TCP Query User{A9F96E00-45E6-49C4-A318-F1A387CFC15E}c:\\program files\\steam\\steamapps\\tonikokko\\counter-strike\\hl.exe"= UDP:c:\program files\steam\steamapps\tonikokko\counter-strike\hl.exe:Half-Life Launcher
"UDP Query User{52B86BB3-139B-41C0-9A76-7E0ACD830A9F}c:\\program files\\steam\\steamapps\\tonikokko\\counter-strike\\hl.exe"= TCP:c:\program files\steam\steamapps\tonikokko\counter-strike\hl.exe:Half-Life Launcher
"TCP Query User{352C5FB1-A302-4D84-A303-94FC6280B1D8}c:\\program files\\steam\\steamapps\\tonikokko\\condition zero deleted scenes\\hl.exe"= UDP:c:\program files\steam\steamapps\tonikokko\condition zero deleted scenes\hl.exe:Half-Life Launcher
"UDP Query User{B5482BF4-55AD-420C-A6AB-F7B0D353C806}c:\\program files\\steam\\steamapps\\tonikokko\\condition zero deleted scenes\\hl.exe"= TCP:c:\program files\steam\steamapps\tonikokko\condition zero deleted scenes\hl.exe:Half-Life Launcher
"TCP Query User{8F8E66C1-9816-4E0E-95E3-78DC8B2BD9FD}c:\\program files\\steam\\steamapps\\tonikokko\\deathmatch classic\\hl.exe"= UDP:c:\program files\steam\steamapps\tonikokko\deathmatch classic\hl.exe:Half-Life Launcher
"UDP Query User{C4018428-4558-4595-A0C3-49A90D49A7B9}c:\\program files\\steam\\steamapps\\tonikokko\\deathmatch classic\\hl.exe"= TCP:c:\program files\steam\steamapps\tonikokko\deathmatch classic\hl.exe:Half-Life Launcher
"TCP Query User{DCFA1FCE-D408-47CD-8571-0105ACFA2916}c:\\program files\\steam\\steamapps\\tonikokko\\day of defeat\\hl.exe"= UDP:c:\program files\steam\steamapps\tonikokko\day of defeat\hl.exe:Half-Life Launcher
"UDP Query User{62519076-C4D5-4189-AFA3-FB99447E71D0}c:\\program files\\steam\\steamapps\\tonikokko\\day of defeat\\hl.exe"= TCP:c:\program files\steam\steamapps\tonikokko\day of defeat\hl.exe:Half-Life Launcher
"TCP Query User{0036597C-6744-46E1-87AB-B5DA7022EA80}c:\\program files\\steam\\steamapps\\tonikokko\\counter-strike\\hl.exe"= UDP:c:\program files\steam\steamapps\tonikokko\counter-strike\hl.exe:Half-Life Launcher
"UDP Query User{663FFDC6-AE4E-48C0-A372-E2D9606A88CA}c:\\program files\\steam\\steamapps\\tonikokko\\counter-strike\\hl.exe"= TCP:c:\program files\steam\steamapps\tonikokko\counter-strike\hl.exe:Half-Life Launcher
"TCP Query User{CA0AAE20-34D5-4F87-9E3A-BDFB0BDB4D71}c:\\program files\\steam\\steamapps\\tonikokko\\ricochet\\hl.exe"= UDP:c:\program files\steam\steamapps\tonikokko\ricochet\hl.exe:Half-Life Launcher
"UDP Query User{0CD7D344-BF25-4DBC-BB9F-A077320A0F5C}c:\\program files\\steam\\steamapps\\tonikokko\\ricochet\\hl.exe"= TCP:c:\program files\steam\steamapps\tonikokko\ricochet\hl.exe:Half-Life Launcher
"TCP Query User{A91F8163-967F-4925-AADE-F07576322012}c:\\program files\\steam\\steamapps\\tonikokko\\condition zero deleted scenes\\hl.exe"= UDP:c:\program files\steam\steamapps\tonikokko\condition zero deleted scenes\hl.exe:Half-Life Launcher
"UDP Query User{28567FE8-4FFA-485F-9801-A152048863F2}c:\\program files\\steam\\steamapps\\tonikokko\\condition zero deleted scenes\\hl.exe"= TCP:c:\program files\steam\steamapps\tonikokko\condition zero deleted scenes\hl.exe:Half-Life Launcher
"TCP Query User{E9852CC0-029E-4A0C-8096-FD6ECFAB0A90}c:\\program files\\steam\\steamapps\\tonikokko\\dedicated server\\hlds.exe"= UDP:c:\program files\steam\steamapps\tonikokko\dedicated server\hlds.exe:HLDS Launcher
"UDP Query User{0C665345-3CA8-457E-81C9-6BC344EC98A4}c:\\program files\\steam\\steamapps\\tonikokko\\dedicated server\\hlds.exe"= TCP:c:\program files\steam\steamapps\tonikokko\dedicated server\hlds.exe:HLDS Launcher
"TCP Query User{687C75CE-4F7D-40F5-8C14-87714F9F9416}c:\\program files\\warcraft iii\\war3.exe"= UDP:c:\program files\warcraft iii\war3.exe:war3
"UDP Query User{7D83C4AA-B864-4BB7-8ECA-0879524333EC}c:\\program files\\warcraft iii\\war3.exe"= TCP:c:\program files\warcraft iii\war3.exe:war3
"TCP Query User{01937352-B3E0-4023-A301-3C31B8535E5D}c:\\program files\\free internet tv\\internettv.exe"= UDP:c:\program files\free internet tv\internettv.exe:Free Internet TV
"UDP Query User{1BD9AA70-B7FD-479B-B7F9-B827DD9D7ECB}c:\\program files\\free internet tv\\internettv.exe"= TCP:c:\program files\free internet tv\internettv.exe:Free Internet TV
"TCP Query User{CC790F40-F1A4-425E-9896-B90D44EA42DB}c:\\program files\\imesh applications\\imesh\\imesh.exe"= UDP:c:\program files\imesh applications\imesh\imesh.exe:iMesh
"UDP Query User{5FA2CC62-D1E6-48F4-A379-97881541C956}c:\\program files\\imesh applications\\imesh\\imesh.exe"= TCP:c:\program files\imesh applications\imesh\imesh.exe:iMesh
"{8D434BBF-7B9D-4766-95C6-6BB933BFB15D}"= c:\program files\MSN Messenger\livecall.exe:Windows Live Messenger 8.1 (Phone)
"TCP Query User{424FA59B-44ED-4B85-90AA-433062FB3C35}c:\\program files\\steam\\steamapps\\tonikokko\\half-life 2 deathmatch\\hl2.exe"= UDP:c:\program files\steam\steamapps\tonikokko\half-life 2 deathmatch\hl2.exe:hl2
"UDP Query User{3F7F8D91-AF39-4FB4-918E-106C2CDCCC38}c:\\program files\\steam\\steamapps\\tonikokko\\half-life 2 deathmatch\\hl2.exe"= TCP:c:\program files\steam\steamapps\tonikokko\half-life 2 deathmatch\hl2.exe:hl2
"TCP Query User{B96D695D-8CC8-4D07-A5DD-791BD6310D28}c:\\program files\\steam\\steamapps\\tonikokko\\source dedicated server\\srcds.exe"= UDP:c:\program files\steam\steamapps\tonikokko\source dedicated server\srcds.exe:srcds
"UDP Query User{19313382-DAC4-4AA3-8867-F5146EA31C8D}c:\\program files\\steam\\steamapps\\tonikokko\\source dedicated server\\srcds.exe"= TCP:c:\program files\steam\steamapps\tonikokko\source dedicated server\srcds.exe:srcds
"TCP Query User{91DC95F0-E22E-4614-9B14-F6BEAD27C789}c:\\program files\\steam\\steamapps\\tonikokko\\team fortress 2\\hl2.exe"= UDP:c:\program files\steam\steamapps\tonikokko\team fortress 2\hl2.exe:hl2
"UDP Query User{C105F45B-E023-42E8-8B91-3CC995C607C8}c:\\program files\\steam\\steamapps\\tonikokko\\team fortress 2\\hl2.exe"= TCP:c:\program files\steam\steamapps\tonikokko\team fortress 2\hl2.exe:hl2
"TCP Query User{44BB0EE4-F377-469A-B4D6-D80175D9CECA}c:\\program files\\steam\\steamapps\\common\\trackmania nations forever\\tmforever.exe"= UDP:c:\program files\steam\steamapps\common\trackmania nations forever\tmforever.exe:TmForever
"UDP Query User{91B64548-43FD-4AED-B58F-8FBC4770020B}c:\\program files\\steam\\steamapps\\common\\trackmania nations forever\\tmforever.exe"= TCP:c:\program files\steam\steamapps\common\trackmania nations forever\tmforever.exe:TmForever
"TCP Query User{4BC51E23-3733-41AC-9162-923CB1A596DB}c:\\program files\\gamespy arcade\\aphex.exe"= UDP:c:\program files\gamespy arcade\aphex.exe:GameSpy Arcade
"UDP Query User{6C88CB19-9F83-4819-BA76-DC7374CC48B2}c:\\program files\\gamespy arcade\\aphex.exe"= TCP:c:\program files\gamespy arcade\aphex.exe:GameSpy Arcade
"TCP Query User{756DFC95-D7CB-480C-8032-848E784C0710}c:\\program files\\steam\\steamapps\\tonikokko\\day of defeat source\\hl2.exe"= UDP:c:\program files\steam\steamapps\tonikokko\day of defeat source\hl2.exe:hl2
"UDP Query User{0554D116-1219-42FC-9796-E62DB27BBDAE}c:\\program files\\steam\\steamapps\\tonikokko\\day of defeat source\\hl2.exe"= TCP:c:\program files\steam\steamapps\tonikokko\day of defeat source\hl2.exe:hl2
"TCP Query User{79DA9B44-7689-4B4E-8547-36F63DFCC028}c:\\users\\toni kokko\\appdata\\local\\temp\\wzse1.tmp\\symnrt.exe"= UDP:c:\users\toni kokko\appdata\local\temp\wzse1.tmp\symnrt.exe:symnrt.exe
"UDP Query User{C3336B92-104F-40A9-872B-0AAE6917CC4E}c:\\users\\toni kokko\\appdata\\local\\temp\\wzse1.tmp\\symnrt.exe"= TCP:c:\users\toni kokko\appdata\local\temp\wzse1.tmp\symnrt.exe:symnrt.exe
"TCP Query User{3F2C2531-6397-40DC-BBD1-7DE0D99FD42A}c:\\program files\\xchat\\xchat.exe"= UDP:c:\program files\xchat\xchat.exe:XChat IRC Client
"UDP Query User{48B44EDE-07F6-4F3F-9219-93D4073BD322}c:\\program files\\xchat\\xchat.exe"= TCP:c:\program files\xchat\xchat.exe:XChat IRC Client
"TCP Query User{1807DC00-4740-4285-BAEB-7A470FA25F6A}c:\\program files\\steam\\steamapps\\avigga\\source dedicated server\\srcds.exe"= UDP:c:\program files\steam\steamapps\avigga\source dedicated server\srcds.exe:srcds
"UDP Query User{BD3881C9-8577-4878-AE50-71EA1E2F7981}c:\\program files\\steam\\steamapps\\avigga\\source dedicated server\\srcds.exe"= TCP:c:\program files\steam\steamapps\avigga\source dedicated server\srcds.exe:srcds
"TCP Query User{632A9822-2366-4C5F-9946-BCF45217B019}c:\\program files\\swarmplayer\\swarmplayer.exe"= UDP:c:\program files\swarmplayer\swarmplayer.exe:swarmplayer
"UDP Query User{D770F340-9627-4C5A-BC38-EE624EC0EF76}c:\\program files\\swarmplayer\\swarmplayer.exe"= TCP:c:\program files\swarmplayer\swarmplayer.exe:swarmplayer
"TCP Query User{7025C92C-326F-4C80-9A40-235F04872E01}c:\\program files\\mirc\\mirc.exe"= UDP:c:\program files\mirc\mirc.exe:mIRC
"UDP Query User{0B0B6EFB-3F50-4C76-B1BB-5FA2C9C64DBE}c:\\program files\\mirc\\mirc.exe"= TCP:c:\program files\mirc\mirc.exe:mIRC
"{F22F34CA-F474-47F7-833D-8C7E3F512871}"= UDP:c:\program files\uTorrent\uTorrent.exe:µTorrent (TCP-In)
"{85F9CF5B-1363-454B-BDA0-88D6D5BCE2BF}"= TCP:c:\program files\uTorrent\uTorrent.exe:µTorrent (UDP-In)
"TCP Query User{D0677DA9-934F-4B03-A63A-71F8AD9CE7F5}c:\\program files\\steam\\steamapps\\avigga\\team fortress 2\\hl2.exe"= UDP:c:\program files\steam\steamapps\avigga\team fortress 2\hl2.exe:hl2
"UDP Query User{C6A4E485-9C63-46C1-9603-D10E6AFC14BB}c:\\program files\\steam\\steamapps\\avigga\\team fortress 2\\hl2.exe"= TCP:c:\program files\steam\steamapps\avigga\team fortress 2\hl2.exe:hl2
"TCP Query User{8BA66BAE-D314-44B6-A811-C5A824532414}c:\\program files\\steam\\steamapps\\avigga\\half-life 2\\hl2.exe"= UDP:c:\program files\steam\steamapps\avigga\half-life 2\hl2.exe:hl2
"UDP Query User{6C2708B7-E72C-41D1-A6DD-E8C1D4D866D5}c:\\program files\\steam\\steamapps\\avigga\\half-life 2\\hl2.exe"= TCP:c:\program files\steam\steamapps\avigga\half-life 2\hl2.exe:hl2
"{C59E32F3-0600-4929-83DD-328BB51CC2C4}"= UDP:c:\program files\World of Warcraft\WoW-2.3.3.7799-to-2.4.0.8089-enGB-downloader.exe:Blizzard Downloader
"{F92C8592-E8E1-4274-ADC1-E04D4EDDA2BB}"= TCP:c:\program files\World of Warcraft\WoW-2.3.3.7799-to-2.4.0.8089-enGB-downloader.exe:Blizzard Downloader
"{228A0F0F-7A6F-4DE6-863A-0C6800D88497}"= UDP:c:\users\Public\Documents\Blizzard Entertainment\World of Warcraft\WoW-2.4.3-to-3.0.2-enGB-Win-Final-downloader.exe:Blizzard Downloader
"{A5049911-5EDC-493D-95BF-668F714F538B}"= TCP:c:\users\Public\Documents\Blizzard Entertainment\World of Warcraft\WoW-2.4.3-to-3.0.2-enGB-Win-Final-downloader.exe:Blizzard Downloader
"TCP Query User{EFF679D8-A571-41C8-9097-6D009425FFF8}c:\\program files\\world of warcraft\\world of warcraft\\world of warcraft\\repair.exe"= UDP:c:\program files\world of warcraft\world of warcraft\world of warcraft\repair.exe:Blizzard Repair Utility
"UDP Query User{C6DD3040-93B6-4B22-9AA3-AC0041DF3E95}c:\\program files\\world of warcraft\\world of warcraft\\world of warcraft\\repair.exe"= TCP:c:\program files\world of warcraft\world of warcraft\world of warcraft\repair.exe:Blizzard Repair Utility
"{8F16C087-9E09-476E-9653-28B6D03710FB}"= UDP:c:\users\Public\Documents\Blizzard Entertainment\World of Warcraft\WoW-3.0.2.9056-to-3.0.3.9183-enGB-downloader.exe:Blizzard Downloader
"{30D23163-90AF-455E-BBFB-2A7A9D8A6950}"= TCP:c:\users\Public\Documents\Blizzard Entertainment\World of Warcraft\WoW-3.0.2.9056-to-3.0.3.9183-enGB-downloader.exe:Blizzard Downloader
"{4ED71020-8DAB-461E-A011-FF9054A4F98F}"= UDP:3724:Blizzard Downloader: 3724
"TCP Query User{A48F3969-7B98-4FEF-A123-7729F99FB69C}c:\\users\\toni kokko\\desktop\\lierox_v0.56_pack_1.9\\lierox v0.56 pack 1.9\\lierox.exe"= UDP:c:\users\toni kokko\desktop\lierox_v0.56_pack_1.9\lierox v0.56 pack 1.9\lierox.exe:lierox.exe
"UDP Query User{9FDDD62B-6350-4110-AF53-4737FD530DBF}c:\\users\\toni kokko\\desktop\\lierox_v0.56_pack_1.9\\lierox v0.56 pack 1.9\\lierox.exe"= TCP:c:\users\toni kokko\desktop\lierox_v0.56_pack_1.9\lierox v0.56 pack 1.9\lierox.exe:lierox.exe
"TCP Query User{D5ECF7FC-3CA4-4EBF-94E6-CE7E719C438D}c:\\users\\toni kokko\\desktop\\lierox_v0.56_pack_1.9\\lierox v0.56 pack 1.9\\lierox.exe"= UDP:c:\users\toni kokko\desktop\lierox_v0.56_pack_1.9\lierox v0.56 pack 1.9\lierox.exe:lierox.exe
"UDP Query User{CEC1032E-1DF7-4CF6-B0BD-4B9ECFB8A640}c:\\users\\toni kokko\\desktop\\lierox_v0.56_pack_1.9\\lierox v0.56 pack 1.9\\lierox.exe"= TCP:c:\users\toni kokko\desktop\lierox_v0.56_pack_1.9\lierox v0.56 pack 1.9\lierox.exe:lierox.exe
"{77FAE065-C5AB-4851-A183-EE612AF46CC8}"= c:\program files\MSN Messenger\livecall.exe:Windows Live Messenger 8.1 (Phone)
"{25634C9B-2C05-450D-B0AA-03952E3E3D3D}"= c:\program files\MSN Messenger\livecall.exe:Windows Live Messenger 8.1 (Phone)
"{66E0E986-796C-4553-8F29-3580DF0903B8}"= UDP:c:\program files\Malwarebytes' Anti-Malware\mbam.exe:Malwarebytes' Anti-Malware
"{A052AC37-EA62-4011-B0FD-D1A0946168DA}"= TCP:c:\program files\Malwarebytes' Anti-Malware\mbam.exe:Malwarebytes' Anti-Malware
"TCP Query User{C415CF1E-6660-4D46-80CE-899F0502C701}c:\\program files\\emule\\emule.exe"= Disabled:UDP:c:\program files\emule\emule.exe:eMule
"UDP Query User{BCA21BF4-4166-4BB1-B95C-DA5C6CFDA864}c:\\program files\\emule\\emule.exe"= Disabled:TCP:c:\program files\emule\emule.exe:eMule
"TCP Query User{26751923-DEFB-4A76-B360-5EE6BD2F1E8C}c:\\program files\\imesh applications\\imesh\\imesh.exe"= Disabled:UDP:c:\program files\imesh applications\imesh\imesh.exe:iMesh
"UDP Query User{19B221A2-173E-4CE8-A4F5-DAD2A22BA0C5}c:\\program files\\imesh applications\\imesh\\imesh.exe"= Disabled:TCP:c:\program files\imesh applications\imesh\imesh.exe:iMesh
"{4A3E76A5-F956-422C-A8B5-78D8DCE2B678}"= c:\program files\MSN Messenger\livecall.exe:Windows Live Messenger 8.1 (Phone)
"{42161E04-D772-488E-A978-0F12110F6EF8}"= UDP:c:\users\Toni Kokko\AppData\Local\Temp\WZSE0.TMP\SymNRT.exe:Norton Removal Tool
"{C468BB28-F1EE-41BE-ADB4-0BCE04554273}"= TCP:c:\users\Toni Kokko\AppData\Local\Temp\WZSE0.TMP\SymNRT.exe:Norton Removal Tool
"{633A8E51-2411-4FDE-B3CC-9DC01825D5C2}"= UDP:c:\windows\System32\WindowsAnytimeUpgrade.exe:Windows Anytime Upgrade
"{2C14C3C3-87EE-41D3-A496-4AA3D1483D3F}"= TCP:c:\windows\System32\WindowsAnytimeUpgrade.exe:Windows Anytime Upgrade

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\StandardProfile\AuthorizedApplications\List]
"c:\\Program Files\\BitTorrent\\bittorrent.exe"= c:\program files\BitTorrent\bittorrent.exe:*:Enabled:BitTorrent
"c:\\Program Files\\xchat\\xchat.exe"= c:\program files\xchat\xchat.exe:*:Enabled:XChat IRC Client

R2 BWH32S;BWH32S;"c:\program files\BUFFALO\clientmgrv\bin\BWH32S.exe" [2008-10-07 57912]
R2 Ndiskio;Ndiskio;\??\c:\program files\Norman\Nse\bin\NDISKIO.SYS [2007-09-30 20448]
R2 NVOY;Norman's Very Own supplY of resources;"c:\program files\Norman\npm\bin\nvoy.exe" [2008-03-24 121912]
R3 nsesvc;Norman Scanner Engine Service;"c:\program files\Norman\nse\bin\NSESVC.EXE" -daemon [2008-06-26 322616]
R3 NvcMFlt;NvcMFlt;c:\windows\system32\DRIVERS\nvcv32mf.sys [2008-09-04 19512]
R3 nvcoas;Norman Virus Control on-access component;"c:\program files\Norman\Nvc\bin\nvcoas.exe" [2008-03-24 191544]
R3 NVCScheduler;Norman Virus Control Scheduler;"c:\program files\Norman\Npm\bin\NVCSCHED.EXE" [2008-03-24 154680]
R3 WLIU2KG125S;BUFFALO WLI-U2-KG125S Wireless LAN Adapter Driver;c:\windows\system32\DRIVERS\usb8023.sys [2008-05-24 15872]
S3 Bufeap;BUFFALO EAP Driver;c:\windows\system32\DRIVERS\bufeap.sys [2008-10-07 14848]
S3 netr73;RT73 USB Wireless LAN Card Driver for Vista;c:\windows\system32\DRIVERS\netr73.sys [2007-05-11 329728]
S3 StickCap;Digital TV DVB-T USB Stick adapter service;c:\windows\system32\Drivers\stickcap.sys [2008-10-22 15744]
S3 stickload;Digital TV stick firmware loader service;c:\windows\system32\DRIVERS\stickload.sys [2008-10-22 17024]
S4 Automaattinen LiveUpdate-ajastustoiminto;Automaattinen LiveUpdate-ajastustoiminto;"c:\program files\Symantec\LiveUpdate\ALUSchedulerSvc.exe" []

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\G]
\shell\AutoRun\command - G:\LaunchU3.exe -a

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{222a7df5-b2c2-11dc-9225-001b247c1e44}]
\shell\AutoRun\command - E:\Setup.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{7c0e6525-c9f4-11dd-9cb1-001601cfc4c2}]
\shell\AutoRun\command - G:\LaunchU3.exe -a

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{96238bad-7562-11dc-93fe-001b247c1e44}]
\shell\AutoRun\command - E:\setup.exe /autorun
\shell\directx\command - e:\directx\dxsetup.exe
\shell\setup\command - E:\setup.exe

*Newly Created Service* - CATCHME
*Newly Created Service* - MBAMSWISSARMY
.
'Ajoitetut tehtävät'-kansion sisältö

2008-12-16 c:\windows\Tasks\GoogleUpdateTaskUser.job
- c:\users\Toni Kokko\AppData\Local\Google\Update\GoogleUpdate.exe [2008-12-15 21:39]

2008-12-16 c:\windows\Tasks\User_Feed_Synchronization-{C68C7EA6-5ACB-42EA-BD75-B52875D630F3}.job
- c:\windows\system32\msfeedssync.exe [2008-01-18 22:33]
.

**************************************************************************

catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-12-17 12:44:10
Windows 6.0.6001 Service Pack 1 NTFS

tarkistaa piilotettuja prosesseja ...

tarkistaa piilotettuja käynnistysarvoja ...

tarkistaa piilotettuja tiedostoja ...

tarkistus on valmis
piilotetut tiedostot: 0

**************************************************************************
.
Valmistumisajankohta: 2008-12-17 13:08:10
ComboFix-quarantined-files.txt 2008-12-17 11:08:04
ComboFix2.txt 2008-12-16 14:13:18
ComboFix3.txt 2008-12-15 20:29:49

Ennen ajoa: 40 766 910 464 tavua vapaana
Ajon jälkeen: 40,290,422,784 tavua vapaana

401 --- E O F --- 2008-12-17 10:12:03


[ + lainaa]
Toni
Hujo
Suspended permanently
_ 		17. joulukuuta 2008 @ 14:22 _ Linkki tähän viestiin    Lähetä käyttäjälle yksityisviesti   
Kirjoita suorita luukkuun

ComboFix /u

Paina OK

===============

scannaa uusi hjt:n loki
[ + lainaa]
Voiko tietsikka koskaan toimia?
Mainos
_ 		__
 
_
tonikokko
Member
_ 		17. joulukuuta 2008 @ 14:37 _ Linkki tähän viestiin    Lähetä käyttäjälle yksityisviesti   
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 14:36:06, on 17.12.2008
Platform: Windows Vista SP1 (WinNT 6.00.1905)
MSIE: Internet Explorer v7.00 (7.00.6001.18000)
Boot mode: Normal

Running processes:
C:\Windows\System32\smss.exe
C:\Windows\system32\csrss.exe
C:\Windows\system32\wininit.exe
C:\Windows\system32\csrss.exe
C:\Windows\system32\services.exe
C:\Windows\system32\lsass.exe
C:\Windows\system32\lsm.exe
C:\Windows\system32\winlogon.exe
C:\Windows\system32\svchost.exe
C:\Program Files\Norman\Npm\Bin\eLogsvc.exe
C:\Windows\system32\svchost.exe
C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe
C:\Windows\system32\svchost.exe
C:\Windows\system32\SLsvc.exe
C:\Windows\system32\svchost.exe
C:\Program Files\Norman\Npm\Bin\Zanda.exe
C:\Program Files\Norman\npm\bin\nvoy.exe
C:\Windows\system32\Dwm.exe
C:\Windows\system32\svchost.exe
C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
C:\Windows\System32\spoolsv.exe
C:\Windows\system32\taskeng.exe
C:\Windows\system32\svchost.exe
C:\Program Files\BUFFALO\clientmgrv\bin\BWH32S.exe
C:\Program Files\HP\QuickPlay\Kernel\TV\CLCapSvc.exe
C:\Program Files\Common Files\LightScribe\LSSrvc.exe
C:\Program Files\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\sqlservr.exe
C:\Windows\system32\svchost.exe
C:\Program Files\Microsoft SQL Server\90\Shared\sqlbrowser.exe
C:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe
C:\Windows\system32\svchost.exe
C:\Windows\System32\svchost.exe
C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\DRIVERS\xaudio.exe
C:\Program Files\Hewlett-Packard\Shared\hpqwmiex.exe
C:\Windows\system32\taskeng.exe
C:\Program Files\Norman\Npm\bin\NVCSCHED.EXE
C:\Program Files\Norman\Npm\bin\NJEEVES.EXE
C:\Program Files\Windows Defender\MSASCui.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Program Files\HP\QuickPlay\QPService.exe
C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\QLBCTRL.exe
C:\Program Files\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe
C:\Program Files\Hewlett-Packard\HP Wireless Assistant\WiFiMsg.exe
C:\Program Files\Norman\Npm\Bin\Zlh.exe
C:\Windows\ehome\ehtray.exe
C:\Program Files\BUFFALO\clientmgrv\bin\cmvMain.exe
C:\Windows\system32\wbem\wmiprvse.exe
C:\Windows\ehome\ehmsas.exe
C:\Windows\ehome\ehsched.exe
C:\Program Files\Hewlett-Packard\Shared\HpqToaster.exe
C:\Windows\ehome\ehRecvr.exe
C:\Program Files\Synaptics\SynTP\SynTPHelper.exe
C:\Program Files\Hewlett-Packard\HP Health Check\hphc_service.exe
C:\Program Files\Windows Media Player\wmplayer.exe
C:\Program Files\Hewlett-Packard\HP Health Check\HPHC_Scheduler.exe
C:\Users\Toni Kokko\AppData\Local\Google\Update\GoogleUpdate.exe
C:\Program Files\Xfire\Xfire.exe
C:\Program Files\Xfire\Xfire.exe
C:\Windows\system32\taskeng.exe
C:\Windows\system32\WUDFHost.exe
C:\Program Files\Norman\nse\bin\NSESVC.EXE
C:\Program Files\Norman\Nvc\Bin\Nip.exe
C:\Program Files\Norman\Nvc\bin\nvcoas.exe
C:\Program Files\Norman\Nvc\Bin\cclaw.exe
C:\Windows\system32\conime.exe
C:\Windows\Explorer.exe
C:\Windows\system32\wbem\unsecapp.exe
C:\Program Files\Steam\Steam.exe
C:\Users\Toni Kokko\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\Toni Kokko\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\Toni Kokko\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
C:\Windows\system32\SearchProtocolHost.exe
C:\Windows\system32\SearchFilterHost.exe
C:\Windows\system32\wbem\wmiprvse.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://home.sweetim.com
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O1 - Hosts: ::1 localhost
O2 - BHO: Adobe PDF Reader -linkkiavustaja - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - (no file)
O2 - BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O3 - Toolbar: (no name) - {BC4FFE41-DE9F-46fa-B455-AAD49B9F9938} - (no file)
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [QPService] "C:\Program Files\HP\QuickPlay\QPService.exe"
O4 - HKLM\..\Run: [QlbCtrl] %ProgramFiles%\Hewlett-Packard\HP Quick Launch Buttons\QlbCtrl.exe /Start
O4 - HKLM\..\Run: [HP Health Check Scheduler] C:\Program Files\Hewlett-Packard\HP Health Check\HPHC_Scheduler.exe
O4 - HKLM\..\Run: [hpWirelessAssistant] %ProgramFiles%\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe
O4 - HKLM\..\Run: [WAWifiMessage] %ProgramFiles%\Hewlett-Packard\HP Wireless Assistant\WiFiMsg.exe
O4 - HKLM\..\Run: [Norman ZANDA] "C:\Program Files\Norman\Npm\Bin\ZLH.EXE" /LOAD /SPLASH
O4 - HKLM\..\Run: [NvSvc] RUNDLL32.EXE C:\Windows\system32\nvsvc.dll,nvsvcStart
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\Windows\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\Windows\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKLM\..\RunOnce: [Launcher] %WINDIR%\SMINST\launcher.exe
O4 - HKCU\..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun
O4 - HKCU\..\Run: [ehTray.exe] C:\Windows\ehome\ehTray.exe
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background
O4 - HKCU\..\Run: [Google Update] "C:\Users\Toni Kokko\AppData\Local\Google\Update\GoogleUpdate.exe" /c
O4 - Global Startup: ClientManagerV.lnk = C:\Program Files\BUFFALO\clientmgrv\bin\cmvMain.exe
O8 - Extra context menu item: Vie Microsoft E&xceliin - res://C:\PROGRA~1\MICROS~3\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: Oheistiedot - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\OFFICE11\REFIEBAR.DLL
O16 - DPF: {20A60F0D-9AFA-4515-A0FD-83BD84642501} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab56986.cab
O16 - DPF: {5C051655-FCD5-4969-9182-770EA5AA5565} (Solitaire Showdown Class) - http://messenger.zone.msn.com/binary/Sol...wn.cab56986.cab
O16 - DPF: {67DABFBF-D0AB-41FA-9C46-CC0F21721616} - http://download.divx.com/player/DivXBrowserPlugin.cab
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/Mes...nt.cab56907.cab
O20 - AppInit_DLLs:
O23 - Service: Lavasoft Ad-Aware Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
O23 - Service: ArcSoft Connect Daemon (ACDaemon) - Unknown owner - C:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ACService.exe (file missing)
O23 - Service: BWH32S - BUFFALO INC. - C:\Program Files\BUFFALO\clientmgrv\bin\BWH32S.exe
O23 - Service: CyberLink Background Capture Service (CBCS) (CLCapSvc) - Unknown owner - C:\Program Files\HP\QuickPlay\Kernel\TV\CLCapSvc.exe
O23 - Service: CyberLink Task Scheduler (CTS) (CLSched) - Unknown owner - C:\Program Files\HP\QuickPlay\Kernel\TV\CLSched.exe
O23 - Service: Norman eLogger service 6 (eLoggerSvc6) - Norman ASA - C:\Program Files\Norman\Npm\Bin\eLogsvc.exe
O23 - Service: HP Health Check Service - Hewlett-Packard - C:\Program Files\Hewlett-Packard\HP Health Check\hphc_service.exe
O23 - Service: hpqwmiex - Hewlett-Packard Development Company, L.P. - C:\Program Files\Hewlett-Packard\Shared\hpqwmiex.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe
O23 - Service: Norman NJeeves - Norman ASA - C:\Program Files\Norman\Npm\bin\NJEEVES.EXE
O23 - Service: Norman ZANDA - Norman ASA - C:\Program Files\Norman\Npm\Bin\Zanda.exe
O23 - Service: Norman Scanner Engine Service (nsesvc) - Norman ASA - C:\Program Files\Norman\nse\bin\NSESVC.EXE
O23 - Service: Norman Virus Control on-access component (nvcoas) - Norman ASA - C:\Program Files\Norman\Nvc\bin\nvcoas.exe
O23 - Service: Norman Virus Control Scheduler (NVCScheduler) - Norman ASA - C:\Program Files\Norman\Npm\bin\NVCSCHED.EXE
O23 - Service: Norman's Very Own supplY of resources (NVOY) - Norman ASA - C:\Program Files\Norman\npm\bin\nvoy.exe
O23 - Service: RoxMediaDB9 - Sonic Solutions - C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxMediaDB9.exe
O23 - Service: stllssvr - MicroVision Development, Inc. - C:\Program Files\Common Files\SureThing Shared\stllssvr.exe
O23 - Service: XAudioService - Conexant Systems, Inc. - C:\Windows\system32\DRIVERS\xaudio.exe

--
End of file - 9421 bytes


[ + lainaa]
Toni
 
Sivu:<123>
afterdawn.com > keskustelu > yleistä keskustelua tietokoneista > virukset ja haittaohjelmat - hijackthis -logit > hjt-logi täällä on joku........
 

Apua ongelmiin: AfterDawnin keskustelualueet | AfterDawnin Vastaukset
Uutiset: IT-alan uutiset | Uutisia puhelimista
Musiikkia: MP3Lizard.com
Tuotearviot: Laitevertailu | Vertaa puhelimia | Vertaa kännykkäliittymiä
Pelit: Pelitiedostot, pelidemot ja trailerit
Ohjelmat: download.fi | AfterDawnin ohjelma-alueet
International: AfterDawn in English | Software downloads | Free, legal MP3s | AfterDawn på svenska
RSS -syötteet: AfterDawnin uutiset | Uusimmat ohjelmapäivitykset | Keskustelualueiden viestit
Tietoja: Tietoa AfterDawn Oy:stä | Mainosta sivuillamme | Sivuston käyttöehdot ja tietoja yksityisyydensuojasta
Ota yhteyttä: Lähetä palautetta | Ota yhteyttä mainosmyyntiimme
 
  © 1999-2025 AfterDawn Oy