|
|
|
Keskustelualueet
Keskustelualueet
|
|
|
kone hidastelee hjt logi
|
|
|
vlaspa
Newbie
|
20. helmikuuta 2008 @ 16:57 |
Linkki tähän viestiin
|
Voisko joku vilkasta hjt logia
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 16:54:20, on 20.2.2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\wltrysvc.exe
C:\WINDOWS\System32\bcmwltry.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\PROGRA~1\F-Secure\BackWeb\7681197\Program\SERVIC~1.EXE
C:\Program Files\F-Secure\Anti-Virus\fsgk32st.exe
C:\Program Files\F-Secure\BackWeb\7681197\program\fsbwsys.exe
C:\Program Files\F-Secure\Anti-Virus\FSGK32.EXE
C:\Program Files\F-Secure\Common\FSMA32.EXE
C:\Program Files\F-Secure\Anti-Virus\fssm32.exe
C:\Program Files\F-Secure\Common\FSMB32.EXE
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\Program Files\F-Secure\Common\FCH32.EXE
C:\Program Files\F-Secure\Common\FAMEH32.EXE
C:\WINDOWS\Explorer.EXE
C:\Program Files\F-Secure\Common\FNRB32.EXE
C:\Program Files\F-Secure\FWES\Program\fsdfwd.exe
C:\Program Files\F-Secure\Common\FIH32.EXE
C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\WINDOWS\system32\WLTRAY.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
C:\Program Files\Launch Manager\LaunchAp.exe
C:\Program Files\Launch Manager\PowerKey.exe
C:\Program Files\Launch Manager\HotkeyApp.exe
C:\Program Files\Launch Manager\CtrlVol.exe
C:\Program Files\Launch Manager\OSDCtrl.exe
C:\Program Files\Launch Manager\Wbutton.exe
C:\Program Files\Arcade\PCMService.exe
C:\Program Files\F-Secure\Common\FSM32.EXE
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\RF Wireless Mouse\cm20.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\Ahead\InCD\InCD.exe
C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
C:\PROGRA~1\Nokia\NOKIAP~1\LAUNCH~1.EXE
C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe
C:\Program Files\HP\hpcoretech\hpcmpmgr.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Winamp\winampa.exe
C:\Program Files\F-Secure\Anti-Virus\fsav32.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\acer\eRecovery\Monitor.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\F-Secure\BackWeb\7681197\Program\F-Secure Automatic Update.exe
C:\Program Files\Microsoft ActiveSync\WCESCOMM.EXE
C:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe
C:\Program Files\Common Files\PCSuite\Services\ServiceLayer.exe
C:\Program Files\Winamp Remote\bin\OrbTray.exe
C:\Program Files\F-Secure\FSGUI\fsguiexe.exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\PROGRA~1\COMMON~1\Nokia\MPAPI\MPAPI3s.exe
C:\WINDOWS\Twain_32\CA561A\SnapDetect.exe
C:\PROGRA~1\Yahoo!\MESSEN~1\ymsgr_tray.exe
C:\Program Files\HP\Digital Imaging\bin\hpqgalry.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Documents and Settings\LASZLO\Local Settings\Temporary Internet Files\Content.IE5\YTDU7M5W\HiJackThis_v2.0.2[1].exe
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://us.rd.yahoo.com/customize/ie/defa...rch/search.html
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://us.rd.yahoo.com/customize/ie/defa...//www.yahoo.com
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.fi/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.yahoo.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://us.rd.yahoo.com/customize/ie/defa...//www.yahoo.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://us.rd.yahoo.com/customize/ie/defa...rch/search.html
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://us.rd.yahoo.com/customize/ie/defa...//www.yahoo.com
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://us.rd.yahoo.com/customize/ie/defa...//www.yahoo.com
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Microsoft Internet Explorer - toimittaja Sonera Internet
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Linkit
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\PROGRA~1\YAHOO!\Companion\Installs\cpn0\yt.dll
O2 - BHO: &Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\PROGRA~1\YAHOO!\Companion\Installs\cpn0\yt.dll
O2 - BHO: Adobe PDF Reader -linkkiavustaja - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: Yahoo! IE Services Button - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: ST - {9394EDE7-C8B5-483E-8773-474BF36AF6E4} - C:\Program Files\MSN Apps\ST\01.03.0000.1005\en-xu\stmain.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll
O2 - BHO: MSNToolBandBHO - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Apps\MSN Toolbar\MSN Toolbar\01.02.5000.1021\fi\msntb.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\PROGRA~1\YAHOO!\Companion\Installs\cpn0\yt.dll
O4 - HKLM\..\Run: [preload] C:\Windows\RUNXMLPL.exe
O4 - HKLM\..\Run: [SynTPLpr] C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [Broadcom Wireless Manager UI] C:\WINDOWS\system32\WLTRAY
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [LaunchAp] C:\Program Files\Launch Manager\LaunchAp.exe
O4 - HKLM\..\Run: [PowerKey] "C:\Program Files\Launch Manager\PowerKey.exe"
O4 - HKLM\..\Run: [LManager] C:\Program Files\Launch Manager\HotkeyApp.exe
O4 - HKLM\..\Run: [CtrlVol] C:\Program Files\Launch Manager\CtrlVol.exe
O4 - HKLM\..\Run: [LMgrOSD] C:\Program Files\Launch Manager\OSDCtrl.exe
O4 - HKLM\..\Run: [Wbutton] "C:\Program Files\Launch Manager\Wbutton.exe"
O4 - HKLM\..\Run: [PCMService] "C:\Program Files\Arcade\PCMService.exe"
O4 - HKLM\..\Run: [eRecoveryService] C:\Windows\System32\Check.exe
O4 - HKLM\..\Run: [F-Secure Manager] "C:\Program Files\F-Secure\Common\FSM32.EXE" /splash
O4 - HKLM\..\Run: [F-Secure TNB] "C:\Program Files\F-Secure\TNB\TNBUtil.exe" /CHECKALL /WAITFORSW
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [Start RF Wireless Mouse] C:\Program Files\RF Wireless Mouse\cm20.exe
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [NeroCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [InCD] C:\Program Files\Ahead\InCD\InCD.exe
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [PCSuiteTrayApplication] C:\PROGRA~1\Nokia\NOKIAP~1\LAUNCH~1.EXE -startup
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe"
O4 - HKLM\..\Run: [HP Component Manager] "C:\Program Files\HP\hpcoretech\hpcmpmgr.exe"
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [WinampAgent] C:\Program Files\Winamp\winampa.exe
O4 - HKLM\..\Run: [Windows Internet Manager] svchost.exe
O4 - HKLM\..\Run: [Windows Services Manager] svchost.exe
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [H/PC Connection Agent] "C:\Program Files\Microsoft ActiveSync\WCESCOMM.EXE"
O4 - HKCU\..\Run: [PcSync] C:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe /NoDialog
O4 - HKCU\..\Run: [Yahoo! Pager] "C:\PROGRA~1\Yahoo!\MESSEN~1\YAHOOM~1.EXE" -quiet
O4 - HKCU\..\Run: [Orb] "C:\Program Files\Winamp Remote\bin\OrbTray.exe" /background
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Paikallinen palve')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Verkkopalve')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O4 - Global Startup: HP Image Zone -pikakäynnistys.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqthb08.exe
O4 - Global Startup: SnapDetect.lnk = ?
O8 - Extra context menu item: &Google Search - res://c:\program files\google\GoogleToolbar2.dll/cmsearch.html
O8 - Extra context menu item: &Translate English Word - res://c:\program files\google\GoogleToolbar2.dll/cmwordtrans.html
O8 - Extra context menu item: Backward Links - res://c:\program files\google\GoogleToolbar2.dll/cmbacklinks.html
O8 - Extra context menu item: Cached Snapshot of Page - res://c:\program files\google\GoogleToolbar2.dll/cmcache.html
O8 - Extra context menu item: Similar Pages - res://c:\program files\google\GoogleToolbar2.dll/cmsimilar.html
O8 - Extra context menu item: Translate Page into English - res://c:\program files\google\GoogleToolbar2.dll/cmtrans.html
O8 - Extra context menu item: Vie Microsoft E&xceliin - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra button: Matkaviestimen suosikkien luominen - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - C:\Program Files\Microsoft ActiveSync\inetrepl.dll
O9 - Extra button: (no name) - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\Program Files\Microsoft ActiveSync\inetrepl.dll
O9 - Extra 'Tools' menuitem: Matkaviestimen suosikkien luominen... - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\Program Files\Microsoft ActiveSync\inetrepl.dll
O9 - Extra button: Yahoo! Services - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O14 - IERESET.INF: START_PAGE_URL=http://www.soneraplaza.fi
O16 - DPF: {00B71CFB-6864-4346-A978-C0A14556272C} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab31267.cab
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (Installation Support) - C:\Program Files\Yahoo!\Common\Yinsthelper.dll
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/Mes...nt.cab31267.cab
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/msnmessengersetupdownloader.cab
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O23 - Service: Notebook Manager Service (anbmService) - OSA Technologies Inc. - C:\Acer\eManager\anbmServ.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: AVG Anti-Spyware Guard - Anti-Malware Development a.s. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: F-Secure Automatic Update (BackWeb Plug-in - 7681197) - Unknown owner - C:\PROGRA~1\F-Secure\BackWeb\7681197\Program\SERVIC~1.EXE
O23 - Service: F-Secure Gatekeeper Handler Starter - F-Secure Corp. - C:\Program Files\F-Secure\Anti-Virus\fsgk32st.exe
O23 - Service: F-Secure Network Request Broker - F-Secure Corporation - C:\Program Files\F-Secure\Common\FNRB32.EXE
O23 - Service: fsbwsys - F-Secure Corp. - C:\Program Files\F-Secure\BackWeb\7681197\program\fsbwsys.exe
O23 - Service: F-Secure Anti-Virus Firewall Daemon (FSDFWD) - F-Secure Corporation - C:\Program Files\F-Secure\FWES\Program\fsdfwd.exe
O23 - Service: F-Secure Management Agent (FSMA) - F-Secure Corporation - C:\Program Files\F-Secure\Common\FSMA32.EXE
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: ServiceLayer - Nokia. - C:\Program Files\Common Files\PCSuite\Services\ServiceLayer.exe
O23 - Service: Broadcom Wireless LAN Tray Service (wltrysvc) - Unknown owner - C:\WINDOWS\System32\wltrysvc.exe
--
End of file - 13382 bytes
|
|
Hujo
Suspended permanently
|
21. helmikuuta 2008 @ 13:16 |
Linkki tähän viestiin
|
Lataa SDFix by AndyManchesta ja tallenna se työpöydällesi.
Käynnistä koneesi vikasietotilaan:
sammuta ja käynnistä
käynnistyksen yhteydessä hakkaa F8 nappia
valitse nuolinäppäimellä vikasietotila
paina enter ja enter
valitse käyttäjätilisi
paina kyllä
Jossakin koneissa hakataan F8:sin sijasta F5:tä
" Kun vikasietotilassa, pura tiedoston SDFix.zip sisältö (SDFix kansio) työpöydällesi. Työpöydälle pitäisi ilmestyä kansio nimeltä SDFix.
" Avaa SDFix-kansio ja tuplaklikkaa tiedostoa RunThis.bat käynnistääksesi ohjelman.
" Paina Y käynnistääksesi skriptin.
" Työkalu puhdistaa troijalaisen palvelut ja tekee myös joitakin korjauksia rekisteriin. Lopuksi se pyytää käynnistämään koneen uudelleen, "Press any key to Reboot".
" Paina mitä tahansa näppäintä ja kone käynnistyy uudelleen.
" Käynnistyminen kestää normaalia kauemmin sillä SDFix puhdistaa konetta.
" Kun kone on käynnistynyt ja työpöytä latautunut, SDFix kertoo että puhdistus on suoritettu, "Finished".
" Paina sitten mitä tahansa näppäintä sulkeaksesi skriptin ja ladataksesi pikakuvakkeet työpöydälle.
" Lopuksi avaa SDFix kansio (työpöydällä) ja kopioi & liitä tiedoston Report.txt sisältö viestiketjuusi uuden HijackThis:n lokin kera.
Voiko tietsikka koskaan toimia?
|
|
vlaspa
Newbie
|
29. helmikuuta 2008 @ 19:09 |
Linkki tähän viestiin
|
SDfix raportti ja hjt-logi
SDFix: Version 1.149
Run by LASZLO on pe 29.02.2008 at 18:30
Microsoft Windows XP [versio 5.1.2600]
Running From: C:\Documents and Settings\LASZLO\Ty?p?yt?\SDFix
Checking Services :
Restoring Windows Registry Values
Restoring Windows Default Hosts File
Rebooting
Checking Files :
Trojan Files Found:
C:\Program Files\Accoona\tbquiesce.exe - Deleted
C:\WINDOWS\svchost.exe - Deleted
Folder C:\Program Files\Accoona - Removed
Removing Temp Files
ADS Check :
Final Check :
catchme 0.3.1344.2 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-02-29 18:43:13
Windows 5.1.2600 Service Pack 2 FAT NTAPI
scanning hidden processes ...
scanning hidden services ...
scanning hidden autostart entries ...
scanning hidden files ...
scan completed successfully
hidden processes: 0
hidden services: 0
hidden files: 0
Remaining Services :
Authorized Application Key Export:
[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
"%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"C:\\Program Files\\F-Secure\\BackWeb\\7681197\\program\\F-Secure Automatic Update.exe"="C:\\Program Files\\F-Secure\\BackWeb\\7681197\\program\\F-Secure Automatic Update.exe:*:Enabled:F-Secure Automatic Update"
"C:\\Program Files\\Messenger\\msmsgs.exe"="C:\\Program Files\\Messenger\\msmsgs.exe:*:Enabled:Windows Messenger"
"C:\\Program Files\\Microsoft ActiveSync\\wcescomm.exe"="C:\\Program Files\\Microsoft ActiveSync\\wcescomm.exe:*:Enabled:ActiveSync Connection Manager"
"C:\\Program Files\\Microsoft ActiveSync\\WCESMgr.exe"="C:\\Program Files\\Microsoft ActiveSync\\WCESMgr.exe:*:Enabled:ActiveSync Application"
"C:\\Program Files\\MSN Messenger\\msnmsgr.exe"="C:\\Program Files\\MSN Messenger\\msnmsgr.exe:*:Enabled:Windows Live Messenger 8.1"
"C:\\Program Files\\MSN Messenger\\livecall.exe"="C:\\Program Files\\MSN Messenger\\livecall.exe:*:Enabled:Windows Live Messenger 8.1 (Phone)"
"C:\\Program Files\\Skype\\Phone\\Skype.exe"="C:\\Program Files\\Skype\\Phone\\Skype.exe:*:Enabled:Skype"
"C:\\Program Files\\Yahoo!\\Messenger\\YahooMessenger.exe"="C:\\Program Files\\Yahoo!\\Messenger\\YahooMessenger.exe:*:Enabled:Yahoo! Messenger"
"C:\\Program Files\\Yahoo!\\Messenger\\YServer.exe"="C:\\Program Files\\Yahoo!\\Messenger\\YServer.exe:*:Enabled:Yahoo! FT Server"
"C:\\Program Files\\Winamp Remote\\bin\\Orb.exe"="C:\\Program Files\\Winamp Remote\\bin\\Orb.exe:*:Enabled:Orb"
"C:\\Program Files\\Winamp Remote\\bin\\OrbTray.exe"="C:\\Program Files\\Winamp Remote\\bin\\OrbTray.exe:*:Enabled:OrbTray"
"C:\\Program Files\\Winamp Remote\\bin\\OrbStreamerClient.exe"="C:\\Program Files\\Winamp Remote\\bin\\OrbStreamerClient.exe:*:Enabled:Orb Stream Client"
[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
"%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"C:\\Program Files\\MSN Messenger\\msnmsgr.exe"="C:\\Program Files\\MSN Messenger\\msnmsgr.exe:*:Enabled:Windows Live Messenger 8.1"
"C:\\Program Files\\MSN Messenger\\livecall.exe"="C:\\Program Files\\MSN Messenger\\livecall.exe:*:Enabled:Windows Live Messenger 8.1 (Phone)"
Remaining Files :
File Backups: - C:\DOCUME~1\LASZLO\Ty?p?yt?\SDFix\backups\backups.zip
Files with Hidden Attributes :
Wed 13 Apr 2005 1,024 ...HR --- "C:\WINDOWS\system32\NTICDMK7.dll"
Wed 13 Apr 2005 1,024 ...HR --- "C:\WINDOWS\system32\NTIMPEG2.dll"
Wed 13 Apr 2005 1,024 ...HR --- "C:\WINDOWS\system32\NTIMP3.dll"
Wed 13 Apr 2005 1,024 ...HR --- "C:\WINDOWS\system32\NTIFCD3.dll"
Wed 13 Apr 2005 1,024 ...HR --- "C:\WINDOWS\system32\NTIBUN4.dll"
Wed 3 May 2006 163,328 ..SHR --- "C:\WINDOWS\system32\flvDX.dll"
Tue 30 May 2006 4,348 ..SH. --- "C:\Documents and Settings\All Users\DRM\DRMv1.bak"
Sun 21 Jan 2007 72,704 ..SHR --- "C:\Program Files\eRightSoft\SUPER\Setup.exe"
Sun 26 Jun 2005 616,448 ..SHR --- "C:\Program Files\eRightSoft\SUPER\cygwin1.dll"
Tue 21 Jun 2005 45,568 ..SHR --- "C:\Program Files\eRightSoft\SUPER\cygz.dll"
Fri 27 Oct 2006 16,384 A.SHR --- "C:\Program Files\eRightSoft\SUPER\_Setup.dll"
Wed 23 Jan 2008 0 A..H. --- "C:\WINDOWS\SoftwareDistribution\Download\f7db876e78b88fd8276fd7d29cb7e4eb\BIT153.tmp"
Thu 15 Nov 2007 0 A..H. --- "C:\WINDOWS\SoftwareDistribution\Download\28daf2e1f8ef97b772dfdbad9c3d0bd9\BITF.tmp"
Sun 18 Nov 2007 0 A.SH. --- "C:\Documents and Settings\All Users\DRM\Cache\Indiv01.tmp"
Sat 1 Dec 2007 0 A.SH. --- "C:\Documents and Settings\All Users\DRM\Cache\Indiv02.tmp"
Tue 4 Jun 2002 84,992 ...HR --- "C:\Program Files\eRightSoft\SUPER\mencoder\14_43260.dll"
Tue 4 Jun 2002 44,032 ...HR --- "C:\Program Files\eRightSoft\SUPER\mencoder\28_83260.dll"
Tue 10 Dec 2002 73,766 ...HR --- "C:\Program Files\eRightSoft\SUPER\mencoder\atrc3260.dll"
Tue 10 Dec 2002 65,575 ...HR --- "C:\Program Files\eRightSoft\SUPER\mencoder\cook3260.dll"
Sun 9 Jun 2002 36,864 ...HR --- "C:\Program Files\eRightSoft\SUPER\mencoder\ddnt3260.dll"
Tue 4 Jun 2002 20,480 ...HR --- "C:\Program Files\eRightSoft\SUPER\mencoder\dnet3260.dll"
Tue 10 Dec 2002 102,437 ...HR --- "C:\Program Files\eRightSoft\SUPER\mencoder\drv13260.dll"
Tue 10 Dec 2002 176,165 ...HR --- "C:\Program Files\eRightSoft\SUPER\mencoder\drv23260.dll"
Tue 10 Dec 2002 208,935 ...HR --- "C:\Program Files\eRightSoft\SUPER\mencoder\drv33260.dll"
Tue 10 Dec 2002 217,127 ...HR --- "C:\Program Files\eRightSoft\SUPER\mencoder\drv43260.dll"
Sun 9 Jun 2002 40,448 ...HR --- "C:\Program Files\eRightSoft\SUPER\mencoder\dspr3260.dll"
Sun 4 Nov 2001 225,280 ...HR --- "C:\Program Files\eRightSoft\SUPER\mencoder\ivvideo.dll"
Tue 10 Apr 2001 225,280 ...HR --- "C:\Program Files\eRightSoft\SUPER\mencoder\qtmlClient.dll"
Fri 20 Feb 2004 232,960 ...HR --- "C:\Program Files\eRightSoft\SUPER\mencoder\raac.dll"
Sun 9 Jun 2002 525,824 ...HR --- "C:\Program Files\eRightSoft\SUPER\mencoder\rnco3260.dll"
Tue 10 Dec 2002 245,805 ...HR --- "C:\Program Files\eRightSoft\SUPER\mencoder\rnlt3260.dll"
Tue 10 Dec 2002 45,093 ...HR --- "C:\Program Files\eRightSoft\SUPER\mencoder\rv103260.dll"
Tue 10 Dec 2002 98,341 ...HR --- "C:\Program Files\eRightSoft\SUPER\mencoder\rv203260.dll"
Tue 10 Dec 2002 94,247 ...HR --- "C:\Program Files\eRightSoft\SUPER\mencoder\rv303260.dll"
Tue 10 Dec 2002 90,151 ...HR --- "C:\Program Files\eRightSoft\SUPER\mencoder\rv403260.dll"
Tue 10 Dec 2002 102,439 ...HR --- "C:\Program Files\eRightSoft\SUPER\mencoder\sipr3260.dll"
Sun 9 Jun 2002 49,152 ...HR --- "C:\Program Files\eRightSoft\SUPER\mencoder\tokr3260.dll"
Sat 23 Apr 2005 511,424 A..H. --- "C:\Documents and Settings\LASZLO\Ty?p?yt?\Garmin_Mapsource_Finland_Topo-kartat\Garmin_Mapsource_Finland_Topo-kartat\Topo_cd_18\40Comupd.exe"
Sat 23 Apr 2005 168,448 A..H. --- "C:\Documents and Settings\LASZLO\Ty?p?yt?\Garmin_Mapsource_Finland_Topo-kartat\Garmin_Mapsource_Finland_Topo-kartat\Topo_cd_18\Setup.exe"
Sat 23 Apr 2005 118,784 A..H. --- "C:\Documents and Settings\LASZLO\Ty?p?yt?\Garmin_Mapsource_Finland_Topo-kartat\Garmin_Mapsource_Finland_Topo-kartat\Topo_cd_18\autorun.exe"
Sat 23 Apr 2005 511,424 A..H. --- "C:\Documents and Settings\LASZLO\Ty?p?yt?\Garmin_Mapsource_Finland_Topo-kartat\Garmin_Mapsource_Finland_Topo-kartat\Topo_cd_17\40Comupd.exe"
Sat 23 Apr 2005 168,448 A..H. --- "C:\Documents and Settings\LASZLO\Ty?p?yt?\Garmin_Mapsource_Finland_Topo-kartat\Garmin_Mapsource_Finland_Topo-kartat\Topo_cd_17\Setup.exe"
Sat 23 Apr 2005 118,784 A..H. --- "C:\Documents and Settings\LASZLO\Ty?p?yt?\Garmin_Mapsource_Finland_Topo-kartat\Garmin_Mapsource_Finland_Topo-kartat\Topo_cd_17\autorun.exe"
Sat 23 Apr 2005 1,162,240 A..H. --- "C:\Documents and Settings\LASZLO\Ty?p?yt?\Garmin_Mapsource_Finland_Topo-kartat\Garmin_Mapsource_Finland_Topo-kartat\Topo_cd_16\Setup.exe"
Sat 23 Apr 2005 1,162,240 A..H. --- "C:\Documents and Settings\LASZLO\Ty?p?yt?\Garmin_Mapsource_Finland_Topo-kartat\Garmin_Mapsource_Finland_Topo-kartat\Topo_cd_16\Setup_original.exe"
Sat 23 Apr 2005 28,672 A..H. --- "C:\Documents and Settings\LASZLO\Ty?p?yt?\Garmin_Mapsource_Finland_Topo-kartat\Garmin_Mapsource_Finland_Topo-kartat\Topo_cd_16\USBPort.dll"
Sat 23 Apr 2005 511,424 A..H. --- "C:\Documents and Settings\LASZLO\Ty?p?yt?\Garmin_Mapsource_Finland_Topo-kartat\Garmin_Mapsource_Finland_Topo-kartat\Topo_cd_15\40Comupd.exe"
Sat 23 Apr 2005 168,448 A..H. --- "C:\Documents and Settings\LASZLO\Ty?p?yt?\Garmin_Mapsource_Finland_Topo-kartat\Garmin_Mapsource_Finland_Topo-kartat\Topo_cd_15\Setup.exe"
Sat 23 Apr 2005 118,784 A..H. --- "C:\Documents and Settings\LASZLO\Ty?p?yt?\Garmin_Mapsource_Finland_Topo-kartat\Garmin_Mapsource_Finland_Topo-kartat\Topo_cd_15\autorun.exe"
Sat 23 Apr 2005 511,424 A..H. --- "C:\Documents and Settings\LASZLO\Ty?p?yt?\Garmin_Mapsource_Finland_Topo-kartat\Garmin_Mapsource_Finland_Topo-kartat\Topo_cd_14\40Comupd.exe"
Sat 23 Apr 2005 168,448 A..H. --- "C:\Documents and Settings\LASZLO\Ty?p?yt?\Garmin_Mapsource_Finland_Topo-kartat\Garmin_Mapsource_Finland_Topo-kartat\Topo_cd_14\Setup.exe"
Sat 23 Apr 2005 118,784 A..H. --- "C:\Documents and Settings\LASZLO\Ty?p?yt?\Garmin_Mapsource_Finland_Topo-kartat\Garmin_Mapsource_Finland_Topo-kartat\Topo_cd_14\autorun.exe"
Sat 23 Apr 2005 511,424 A..H. --- "C:\Documents and Settings\LASZLO\Ty?p?yt?\Garmin_Mapsource_Finland_Topo-kartat\Garmin_Mapsource_Finland_Topo-kartat\Topo_9\40Comupd.exe"
Sat 23 Apr 2005 168,448 A..H. --- "C:\Documents and Settings\LASZLO\Ty?p?yt?\Garmin_Mapsource_Finland_Topo-kartat\Garmin_Mapsource_Finland_Topo-kartat\Topo_9\Setup.exe"
Sat 23 Apr 2005 118,784 A..H. --- "C:\Documents and Settings\LASZLO\Ty?p?yt?\Garmin_Mapsource_Finland_Topo-kartat\Garmin_Mapsource_Finland_Topo-kartat\Topo_9\autorun.exe"
Sat 23 Apr 2005 511,424 A..H. --- "C:\Documents and Settings\LASZLO\Ty?p?yt?\Garmin_Mapsource_Finland_Topo-kartat\Garmin_Mapsource_Finland_Topo-kartat\Topo_8\40Comupd.exe"
Sat 23 Apr 2005 168,448 A..H. --- "C:\Documents and Settings\LASZLO\Ty?p?yt?\Garmin_Mapsource_Finland_Topo-kartat\Garmin_Mapsource_Finland_Topo-kartat\Topo_8\Setup.exe"
Sat 23 Apr 2005 118,784 A..H. --- "C:\Documents and Settings\LASZLO\Ty?p?yt?\Garmin_Mapsource_Finland_Topo-kartat\Garmin_Mapsource_Finland_Topo-kartat\Topo_8\autorun.exe"
Sat 23 Apr 2005 511,424 A..H. --- "C:\Documents and Settings\LASZLO\Ty?p?yt?\Garmin_Mapsource_Finland_Topo-kartat\Garmin_Mapsource_Finland_Topo-kartat\Topo_7\40Comupd.exe"
Sat 23 Apr 2005 168,448 A..H. --- "C:\Documents and Settings\LASZLO\Ty?p?yt?\Garmin_Mapsource_Finland_Topo-kartat\Garmin_Mapsource_Finland_Topo-kartat\Topo_7\Setup.exe"
Sat 23 Apr 2005 118,784 A..H. --- "C:\Documents and Settings\LASZLO\Ty?p?yt?\Garmin_Mapsource_Finland_Topo-kartat\Garmin_Mapsource_Finland_Topo-kartat\Topo_7\autorun.exe"
Sat 23 Apr 2005 511,424 A..H. --- "C:\Documents and Settings\LASZLO\Ty?p?yt?\Garmin_Mapsource_Finland_Topo-kartat\Garmin_Mapsource_Finland_Topo-kartat\Topo_6\40Comupd.exe"
Sat 23 Apr 2005 168,448 A..H. --- "C:\Documents and Settings\LASZLO\Ty?p?yt?\Garmin_Mapsource_Finland_Topo-kartat\Garmin_Mapsource_Finland_Topo-kartat\Topo_6\Setup.exe"
Sat 23 Apr 2005 118,784 A..H. --- "C:\Documents and Settings\LASZLO\Ty?p?yt?\Garmin_Mapsource_Finland_Topo-kartat\Garmin_Mapsource_Finland_Topo-kartat\Topo_6\autorun.exe"
Sat 23 Apr 2005 511,424 A..H. --- "C:\Documents and Settings\LASZLO\Ty?p?yt?\Garmin_Mapsource_Finland_Topo-kartat\Garmin_Mapsource_Finland_Topo-kartat\Topo_5\40Comupd.exe"
Sat 23 Apr 2005 168,448 A..H. --- "C:\Documents and Settings\LASZLO\Ty?p?yt?\Garmin_Mapsource_Finland_Topo-kartat\Garmin_Mapsource_Finland_Topo-kartat\Topo_5\Setup.exe"
Sat 23 Apr 2005 118,784 A..H. --- "C:\Documents and Settings\LASZLO\Ty?p?yt?\Garmin_Mapsource_Finland_Topo-kartat\Garmin_Mapsource_Finland_Topo-kartat\Topo_5\autorun.exe"
Sat 23 Apr 2005 511,424 A..H. --- "C:\Documents and Settings\LASZLO\Ty?p?yt?\Garmin_Mapsource_Finland_Topo-kartat\Garmin_Mapsource_Finland_Topo-kartat\Topo_4\40Comupd.exe"
Sat 23 Apr 2005 168,448 A..H. --- "C:\Documents and Settings\LASZLO\Ty?p?yt?\Garmin_Mapsource_Finland_Topo-kartat\Garmin_Mapsource_Finland_Topo-kartat\Topo_4\Setup.exe"
Sat 23 Apr 2005 118,784 A..H. --- "C:\Documents and Settings\LASZLO\Ty?p?yt?\Garmin_Mapsource_Finland_Topo-kartat\Garmin_Mapsource_Finland_Topo-kartat\Topo_4\autorun.exe"
Sat 23 Apr 2005 511,424 A..H. --- "C:\Documents and Settings\LASZLO\Ty?p?yt?\Garmin_Mapsource_Finland_Topo-kartat\Garmin_Mapsource_Finland_Topo-kartat\Topo_3\40Comupd.exe"
Sat 23 Apr 2005 168,448 A..H. --- "C:\Documents and Settings\LASZLO\Ty?p?yt?\Garmin_Mapsource_Finland_Topo-kartat\Garmin_Mapsource_Finland_Topo-kartat\Topo_3\Setup.exe"
Sat 23 Apr 2005 118,784 A..H. --- "C:\Documents and Settings\LASZLO\Ty?p?yt?\Garmin_Mapsource_Finland_Topo-kartat\Garmin_Mapsource_Finland_Topo-kartat\Topo_3\autorun.exe"
Sat 23 Apr 2005 511,424 A..H. --- "C:\Documents and Settings\LASZLO\Ty?p?yt?\Garmin_Mapsource_Finland_Topo-kartat\Garmin_Mapsource_Finland_Topo-kartat\Topo_2\40Comupd.exe"
Sat 23 Apr 2005 168,448 A..H. --- "C:\Documents and Settings\LASZLO\Ty?p?yt?\Garmin_Mapsource_Finland_Topo-kartat\Garmin_Mapsource_Finland_Topo-kartat\Topo_2\Setup.exe"
Sat 23 Apr 2005 118,784 A..H. --- "C:\Documents and Settings\LASZLO\Ty?p?yt?\Garmin_Mapsource_Finland_Topo-kartat\Garmin_Mapsource_Finland_Topo-kartat\Topo_2\autorun.exe"
Sat 23 Apr 2005 511,424 A..H. --- "C:\Documents and Settings\LASZLO\Ty?p?yt?\Garmin_Mapsource_Finland_Topo-kartat\Garmin_Mapsource_Finland_Topo-kartat\Topo_13\40Comupd.exe"
Sat 23 Apr 2005 168,448 A..H. --- "C:\Documents and Settings\LASZLO\Ty?p?yt?\Garmin_Mapsource_Finland_Topo-kartat\Garmin_Mapsource_Finland_Topo-kartat\Topo_13\Setup.exe"
Sat 23 Apr 2005 118,784 A..H. --- "C:\Documents and Settings\LASZLO\Ty?p?yt?\Garmin_Mapsource_Finland_Topo-kartat\Garmin_Mapsource_Finland_Topo-kartat\Topo_13\autorun.exe"
Sat 23 Apr 2005 511,424 A..H. --- "C:\Documents and Settings\LASZLO\Ty?p?yt?\Garmin_Mapsource_Finland_Topo-kartat\Garmin_Mapsource_Finland_Topo-kartat\Topo_12\40Comupd.exe"
Sat 23 Apr 2005 168,448 A..H. --- "C:\Documents and Settings\LASZLO\Ty?p?yt?\Garmin_Mapsource_Finland_Topo-kartat\Garmin_Mapsource_Finland_Topo-kartat\Topo_12\Setup.exe"
Sat 23 Apr 2005 118,784 A..H. --- "C:\Documents and Settings\LASZLO\Ty?p?yt?\Garmin_Mapsource_Finland_Topo-kartat\Garmin_Mapsource_Finland_Topo-kartat\Topo_12\autorun.exe"
Sat 23 Apr 2005 511,424 A..H. --- "C:\Documents and Settings\LASZLO\Ty?p?yt?\Garmin_Mapsource_Finland_Topo-kartat\Garmin_Mapsource_Finland_Topo-kartat\Topo_11\40Comupd.exe"
Sat 23 Apr 2005 168,448 A..H. --- "C:\Documents and Settings\LASZLO\Ty?p?yt?\Garmin_Mapsource_Finland_Topo-kartat\Garmin_Mapsource_Finland_Topo-kartat\Topo_11\Setup.exe"
Sat 23 Apr 2005 118,784 A..H. --- "C:\Documents and Settings\LASZLO\Ty?p?yt?\Garmin_Mapsource_Finland_Topo-kartat\Garmin_Mapsource_Finland_Topo-kartat\Topo_11\autorun.exe"
Sat 23 Apr 2005 417,792 A..H. --- "C:\Documents and Settings\LASZLO\Ty?p?yt?\Garmin_Mapsource_Finland_Topo-kartat\Garmin_Mapsource_Finland_Topo-kartat\Topo_cd_18\Spanish\MapSource_Lang.dll"
Sat 23 Apr 2005 421,888 A..H. --- "C:\Documents and Settings\LASZLO\Ty?p?yt?\Garmin_Mapsource_Finland_Topo-kartat\Garmin_Mapsource_Finland_Topo-kartat\Topo_cd_18\Italian\MapSource_Lang.dll"
Sat 23 Apr 2005 421,888 A..H. --- "C:\Documents and Settings\LASZLO\Ty?p?yt?\Garmin_Mapsource_Finland_Topo-kartat\Garmin_Mapsource_Finland_Topo-kartat\Topo_cd_18\German\MapSource_Lang.dll"
Sat 23 Apr 2005 421,888 A..H. --- "C:\Documents and Settings\LASZLO\Ty?p?yt?\Garmin_Mapsource_Finland_Topo-kartat\Garmin_Mapsource_Finland_Topo-kartat\Topo_cd_18\French\MapSource_Lang.dll"
Sat 23 Apr 2005 397,312 A..H. --- "C:\Documents and Settings\LASZLO\Ty?p?yt?\Garmin_Mapsource_Finland_Topo-kartat\Garmin_Mapsource_Finland_Topo-kartat\Topo_cd_18\English\MapSource_Lang.dll"
Sat 23 Apr 2005 417,792 A..H. --- "C:\Documents and Settings\LASZLO\Ty?p?yt?\Garmin_Mapsource_Finland_Topo-kartat\Garmin_Mapsource_Finland_Topo-kartat\Topo_cd_17\Spanish\MapSource_Lang.dll"
Sat 23 Apr 2005 421,888 A..H. --- "C:\Documents and Settings\LASZLO\Ty?p?yt?\Garmin_Mapsource_Finland_Topo-kartat\Garmin_Mapsource_Finland_Topo-kartat\Topo_cd_17\Italian\MapSource_Lang.dll"
Sat 23 Apr 2005 421,888 A..H. --- "C:\Documents and Settings\LASZLO\Ty?p?yt?\Garmin_Mapsource_Finland_Topo-kartat\Garmin_Mapsource_Finland_Topo-kartat\Topo_cd_17\German\MapSource_Lang.dll"
Sat 23 Apr 2005 421,888 A..H. --- "C:\Documents and Settings\LASZLO\Ty?p?yt?\Garmin_Mapsource_Finland_Topo-kartat\Garmin_Mapsource_Finland_Topo-kartat\Topo_cd_17\French\MapSource_Lang.dll"
Sat 23 Apr 2005 397,312 A..H. --- "C:\Documents and Settings\LASZLO\Ty?p?yt?\Garmin_Mapsource_Finland_Topo-kartat\Garmin_Mapsource_Finland_Topo-kartat\Topo_cd_17\English\MapSource_Lang.dll"
Sat 23 Apr 2005 511,424 A..H. --- "C:\Documents and Settings\LASZLO\Ty?p?yt?\Garmin_Mapsource_Finland_Topo-kartat\Garmin_Mapsource_Finland_Topo-kartat\Topo_cd_16\GPS_AT\40Comupd.exe"
Sat 23 Apr 2005 168,448 A..H. --- "C:\Documents and Settings\LASZLO\Ty?p?yt?\Garmin_Mapsource_Finland_Topo-kartat\Garmin_Mapsource_Finland_Topo-kartat\Topo_cd_16\GPS_AT\Setup.exe"
Sat 23 Apr 2005 118,784 A..H. --- "C:\Documents and Settings\LASZLO\Ty?p?yt?\Garmin_Mapsource_Finland_Topo-kartat\Garmin_Mapsource_Finland_Topo-kartat\Topo_cd_16\GPS_AT\autorun.exe"
Sat 23 Apr 2005 417,792 A..H. --- "C:\Documents and Settings\LASZLO\Ty?p?yt?\Garmin_Mapsource_Finland_Topo-kartat\Garmin_Mapsource_Finland_Topo-kartat\Topo_cd_15\Spanish\MapSource_Lang.dll"
Sat 23 Apr 2005 421,888 A..H. --- "C:\Documents and Settings\LASZLO\Ty?p?yt?\Garmin_Mapsource_Finland_Topo-kartat\Garmin_Mapsource_Finland_Topo-kartat\Topo_cd_15\Italian\MapSource_Lang.dll"
Sat 23 Apr 2005 421,888 A..H. --- "C:\Documents and Settings\LASZLO\Ty?p?yt?\Garmin_Mapsource_Finland_Topo-kartat\Garmin_Mapsource_Finland_Topo-kartat\Topo_cd_15\German\MapSource_Lang.dll"
Sat 23 Apr 2005 421,888 A..H. --- "C:\Documents and Settings\LASZLO\Ty?p?yt?\Garmin_Mapsource_Finland_Topo-kartat\Garmin_Mapsource_Finland_Topo-kartat\Topo_cd_15\French\MapSource_Lang.dll"
Sat 23 Apr 2005 397,312 A..H. --- "C:\Documents and Settings\LASZLO\Ty?p?yt?\Garmin_Mapsource_Finland_Topo-kartat\Garmin_Mapsource_Finland_Topo-kartat\Topo_cd_15\English\MapSource_Lang.dll"
Sat 23 Apr 2005 417,792 A..H. --- "C:\Documents and Settings\LASZLO\Ty?p?yt?\Garmin_Mapsource_Finland_Topo-kartat\Garmin_Mapsource_Finland_Topo-kartat\Topo_cd_14\Spanish\MapSource_Lang.dll"
Sat 23 Apr 2005 421,888 A..H. --- "C:\Documents and Settings\LASZLO\Ty?p?yt?\Garmin_Mapsource_Finland_Topo-kartat\Garmin_Mapsource_Finland_Topo-kartat\Topo_cd_14\Italian\MapSource_Lang.dll"
Sat 23 Apr 2005 421,888 A..H. --- "C:\Documents and Settings\LASZLO\Ty?p?yt?\Garmin_Mapsource_Finland_Topo-kartat\Garmin_Mapsource_Finland_Topo-kartat\Topo_cd_14\German\MapSource_Lang.dll"
Sat 23 Apr 2005 421,888 A..H. --- "C:\Documents and Settings\LASZLO\Ty?p?yt?\Garmin_Mapsource_Finland_Topo-kartat\Garmin_Mapsource_Finland_Topo-kartat\Topo_cd_14\French\MapSource_Lang.dll"
Sat 23 Apr 2005 397,312 A..H. --- "C:\Documents and Settings\LASZLO\Ty?p?yt?\Garmin_Mapsource_Finland_Topo-kartat\Garmin_Mapsource_Finland_Topo-kartat\Topo_cd_14\English\MapSource_Lang.dll"
Sat 23 Apr 2005 417,792 A..H. --- "C:\Documents and Settings\LASZLO\Ty?p?yt?\Garmin_Mapsource_Finland_Topo-kartat\Garmin_Mapsource_Finland_Topo-kartat\Topo_9\Spanish\MapSource_Lang.dll"
Sat 23 Apr 2005 421,888 A..H. --- "C:\Documents and Settings\LASZLO\Ty?p?yt?\Garmin_Mapsource_Finland_Topo-kartat\Garmin_Mapsource_Finland_Topo-kartat\Topo_9\Italian\MapSource_Lang.dll"
Sat 23 Apr 2005 421,888 A..H. --- "C:\Documents and Settings\LASZLO\Ty?p?yt?\Garmin_Mapsource_Finland_Topo-kartat\Garmin_Mapsource_Finland_Topo-kartat\Topo_9\German\MapSource_Lang.dll"
Sat 23 Apr 2005 421,888 A..H. --- "C:\Documents and Settings\LASZLO\Ty?p?yt?\Garmin_Mapsource_Finland_Topo-kartat\Garmin_Mapsource_Finland_Topo-kartat\Topo_9\French\MapSource_Lang.dll"
Sat 23 Apr 2005 397,312 A..H. --- "C:\Documents and Settings\LASZLO\Ty?p?yt?\Garmin_Mapsource_Finland_Topo-kartat\Garmin_Mapsource_Finland_Topo-kartat\Topo_9\English\MapSource_Lang.dll"
Sat 23 Apr 2005 417,792 A..H. --- "C:\Documents and Settings\LASZLO\Ty?p?yt?\Garmin_Mapsource_Finland_Topo-kartat\Garmin_Mapsource_Finland_Topo-kartat\Topo_8\Spanish\MapSource_Lang.dll"
Sat 23 Apr 2005 421,888 A..H. --- "C:\Documents and Settings\LASZLO\Ty?p?yt?\Garmin_Mapsource_Finland_Topo-kartat\Garmin_Mapsource_Finland_Topo-kartat\Topo_8\Italian\MapSource_Lang.dll"
Sat 23 Apr 2005 421,888 A..H. --- "C:\Documents and Settings\LASZLO\Ty?p?yt?\Garmin_Mapsource_Finland_Topo-kartat\Garmin_Mapsource_Finland_Topo-kartat\Topo_8\German\MapSource_Lang.dll"
Sat 23 Apr 2005 421,888 A..H. --- "C:\Documents and Settings\LASZLO\Ty?p?yt?\Garmin_Mapsource_Finland_Topo-kartat\Garmin_Mapsource_Finland_Topo-kartat\Topo_8\French\MapSource_Lang.dll"
Sat 23 Apr 2005 397,312 A..H. --- "C:\Documents and Settings\LASZLO\Ty?p?yt?\Garmin_Mapsource_Finland_Topo-kartat\Garmin_Mapsource_Finland_Topo-kartat\Topo_8\English\MapSource_Lang.dll"
Sat 23 Apr 2005 385,024 A..H. --- "C:\Documents and Settings\LASZLO\Ty?p?yt?\Garmin_Mapsource_Finland_Topo-kartat\Garmin_Mapsource_Finland_Topo-kartat\Topo_7\Spanish\MapSource_Lang.dll"
Sat 23 Apr 2005 393,216 A..H. --- "C:\Documents and Settings\LASZLO\Ty?p?yt?\Garmin_Mapsource_Finland_Topo-kartat\Garmin_Mapsource_Finland_Topo-kartat\Topo_7\Italian\MapSource_Lang.dll"
Sat 23 Apr 2005 393,216 A..H. --- "C:\Documents and Settings\LASZLO\Ty?p?yt?\Garmin_Mapsource_Finland_Topo-kartat\Garmin_Mapsource_Finland_Topo-kartat\Topo_7\German\MapSource_Lang.dll"
Sat 23 Apr 2005 389,120 A..H. --- "C:\Documents and Settings\LASZLO\Ty?p?yt?\Garmin_Mapsource_Finland_Topo-kartat\Garmin_Mapsource_Finland_Topo-kartat\Topo_7\French\MapSource_Lang.dll"
Sat 23 Apr 2005 372,736 A..H. --- "C:\Documents and Settings\LASZLO\Ty?p?yt?\Garmin_Mapsource_Finland_Topo-kartat\Garmin_Mapsource_Finland_Topo-kartat\Topo_7\English\MapSource_Lang.dll"
Sat 23 Apr 2005 385,024 A..H. --- "C:\Documents and Settings\LASZLO\Ty?p?yt?\Garmin_Mapsource_Finland_Topo-kartat\Garmin_Mapsource_Finland_Topo-kartat\Topo_6\Spanish\MapSource_Lang.dll"
Sat 23 Apr 2005 393,216 A..H. --- "C:\Documents and Settings\LASZLO\Ty?p?yt?\Garmin_Mapsource_Finland_Topo-kartat\Garmin_Mapsource_Finland_Topo-kartat\Topo_6\Italian\MapSource_Lang.dll"
Sat 23 Apr 2005 393,216 A..H. --- "C:\Documents and Settings\LASZLO\Ty?p?yt?\Garmin_Mapsource_Finland_Topo-kartat\Garmin_Mapsource_Finland_Topo-kartat\Topo_6\German\MapSource_Lang.dll"
Sat 23 Apr 2005 389,120 A..H. --- "C:\Documents and Settings\LASZLO\Ty?p?yt?\Garmin_Mapsource_Finland_Topo-kartat\Garmin_Mapsource_Finland_Topo-kartat\Topo_6\French\MapSource_Lang.dll"
Sat 23 Apr 2005 372,736 A..H. --- "C:\Documents and Settings\LASZLO\Ty?p?yt?\Garmin_Mapsource_Finland_Topo-kartat\Garmin_Mapsource_Finland_Topo-kartat\Topo_6\English\MapSource_Lang.dll"
Sat 23 Apr 2005 385,024 A..H. --- "C:\Documents and Settings\LASZLO\Ty?p?yt?\Garmin_Mapsource_Finland_Topo-kartat\Garmin_Mapsource_Finland_Topo-kartat\Topo_5\Spanish\MapSource_Lang.dll"
Sat 23 Apr 2005 393,216 A..H. --- "C:\Documents and Settings\LASZLO\Ty?p?yt?\Garmin_Mapsource_Finland_Topo-kartat\Garmin_Mapsource_Finland_Topo-kartat\Topo_5\Italian\MapSource_Lang.dll"
Sat 23 Apr 2005 393,216 A..H. --- "C:\Documents and Settings\LASZLO\Ty?p?yt?\Garmin_Mapsource_Finland_Topo-kartat\Garmin_Mapsource_Finland_Topo-kartat\Topo_5\German\MapSource_Lang.dll"
Sat 23 Apr 2005 389,120 A..H. --- "C:\Documents and Settings\LASZLO\Ty?p?yt?\Garmin_Mapsource_Finland_Topo-kartat\Garmin_Mapsource_Finland_Topo-kartat\Topo_5\French\MapSource_Lang.dll"
Sat 23 Apr 2005 372,736 A..H. --- "C:\Documents and Settings\LASZLO\Ty?p?yt?\Garmin_Mapsource_Finland_Topo-kartat\Garmin_Mapsource_Finland_Topo-kartat\Topo_5\English\MapSource_Lang.dll"
Sat 23 Apr 2005 385,024 A..H. --- "C:\Documents and Settings\LASZLO\Ty?p?yt?\Garmin_Mapsource_Finland_Topo-kartat\Garmin_Mapsource_Finland_Topo-kartat\Topo_4\Spanish\MapSource_Lang.dll"
Sat 23 Apr 2005 393,216 A..H. --- "C:\Documents and Settings\LASZLO\Ty?p?yt?\Garmin_Mapsource_Finland_Topo-kartat\Garmin_Mapsource_Finland_Topo-kartat\Topo_4\Italian\MapSource_Lang.dll"
Sat 23 Apr 2005 393,216 A..H. --- "C:\Documents and Settings\LASZLO\Ty?p?yt?\Garmin_Mapsource_Finland_Topo-kartat\Garmin_Mapsource_Finland_Topo-kartat\Topo_4\German\MapSource_Lang.dll"
Sat 23 Apr 2005 389,120 A..H. --- "C:\Documents and Settings\LASZLO\Ty?p?yt?\Garmin_Mapsource_Finland_Topo-kartat\Garmin_Mapsource_Finland_Topo-kartat\Topo_4\French\MapSource_Lang.dll"
Sat 23 Apr 2005 372,736 A..H. --- "C:\Documents and Settings\LASZLO\Ty?p?yt?\Garmin_Mapsource_Finland_Topo-kartat\Garmin_Mapsource_Finland_Topo-kartat\Topo_4\English\MapSource_Lang.dll"
Sat 23 Apr 2005 385,024 A..H. --- "C:\Documents and Settings\LASZLO\Ty?p?yt?\Garmin_Mapsource_Finland_Topo-kartat\Garmin_Mapsource_Finland_Topo-kartat\Topo_3\Spanish\MapSource_Lang.dll"
Sat 23 Apr 2005 393,216 A..H. --- "C:\Documents and Settings\LASZLO\Ty?p?yt?\Garmin_Mapsource_Finland_Topo-kartat\Garmin_Mapsource_Finland_Topo-kartat\Topo_3\Italian\MapSource_Lang.dll"
Sat 23 Apr 2005 393,216 A..H. --- "C:\Documents and Settings\LASZLO\Ty?p?yt?\Garmin_Mapsource_Finland_Topo-kartat\Garmin_Mapsource_Finland_Topo-kartat\Topo_3\German\MapSource_Lang.dll"
Sat 23 Apr 2005 389,120 A..H. --- "C:\Documents and Settings\LASZLO\Ty?p?yt?\Garmin_Mapsource_Finland_Topo-kartat\Garmin_Mapsource_Finland_Topo-kartat\Topo_3\French\MapSource_Lang.dll"
Sat 23 Apr 2005 372,736 A..H. --- "C:\Documents and Settings\LASZLO\Ty?p?yt?\Garmin_Mapsource_Finland_Topo-kartat\Garmin_Mapsource_Finland_Topo-kartat\Topo_3\English\MapSource_Lang.dll"
Sat 23 Apr 2005 385,024 A..H. --- "C:\Documents and Settings\LASZLO\Ty?p?yt?\Garmin_Mapsource_Finland_Topo-kartat\Garmin_Mapsource_Finland_Topo-kartat\Topo_2\Spanish\MapSource_Lang.dll"
Sat 23 Apr 2005 393,216 A..H. --- "C:\Documents and Settings\LASZLO\Ty?p?yt?\Garmin_Mapsource_Finland_Topo-kartat\Garmin_Mapsource_Finland_Topo-kartat\Topo_2\Italian\MapSource_Lang.dll"
Sat 23 Apr 2005 393,216 A..H. --- "C:\Documents and Settings\LASZLO\Ty?p?yt?\Garmin_Mapsource_Finland_Topo-kartat\Garmin_Mapsource_Finland_Topo-kartat\Topo_2\German\MapSource_Lang.dll"
Sat 23 Apr 2005 389,120 A..H. --- "C:\Documents and Settings\LASZLO\Ty?p?yt?\Garmin_Mapsource_Finland_Topo-kartat\Garmin_Mapsource_Finland_Topo-kartat\Topo_2\French\MapSource_Lang.dll"
Sat 23 Apr 2005 372,736 A..H. --- "C:\Documents and Settings\LASZLO\Ty?p?yt?\Garmin_Mapsource_Finland_Topo-kartat\Garmin_Mapsource_Finland_Topo-kartat\Topo_2\English\MapSource_Lang.dll"
Sat 23 Apr 2005 417,792 A..H. --- "C:\Documents and Settings\LASZLO\Ty?p?yt?\Garmin_Mapsource_Finland_Topo-kartat\Garmin_Mapsource_Finland_Topo-kartat\Topo_13\Spanish\MapSource_Lang.dll"
Sat 23 Apr 2005 421,888 A..H. --- "C:\Documents and Settings\LASZLO\Ty?p?yt?\Garmin_Mapsource_Finland_Topo-kartat\Garmin_Mapsource_Finland_Topo-kartat\Topo_13\Italian\MapSource_Lang.dll"
Sat 23 Apr 2005 421,888 A..H. --- "C:\Documents and Settings\LASZLO\Ty?p?yt?\Garmin_Mapsource_Finland_Topo-kartat\Garmin_Mapsource_Finland_Topo-kartat\Topo_13\German\MapSource_Lang.dll"
Sat 23 Apr 2005 421,888 A..H. --- "C:\Documents and Settings\LASZLO\Ty?p?yt?\Garmin_Mapsource_Finland_Topo-kartat\Garmin_Mapsource_Finland_Topo-kartat\Topo_13\French\MapSource_Lang.dll"
Sat 23 Apr 2005 397,312 A..H. --- "C:\Documents and Settings\LASZLO\Ty?p?yt?\Garmin_Mapsource_Finland_Topo-kartat\Garmin_Mapsource_Finland_Topo-kartat\Topo_13\English\MapSource_Lang.dll"
Sat 23 Apr 2005 417,792 A..H. --- "C:\Documents and Settings\LASZLO\Ty?p?yt?\Garmin_Mapsource_Finland_Topo-kartat\Garmin_Mapsource_Finland_Topo-kartat\Topo_12\Spanish\MapSource_Lang.dll"
Sat 23 Apr 2005 421,888 A..H. --- "C:\Documents and Settings\LASZLO\Ty?p?yt?\Garmin_Mapsource_Finland_Topo-kartat\Garmin_Mapsource_Finland_Topo-kartat\Topo_12\Italian\MapSource_Lang.dll"
Sat 23 Apr 2005 421,888 A..H. --- "C:\Documents and Settings\LASZLO\Ty?p?yt?\Garmin_Mapsource_Finland_Topo-kartat\Garmin_Mapsource_Finland_Topo-kartat\Topo_12\German\MapSource_Lang.dll"
Sat 23 Apr 2005 421,888 A..H. --- "C:\Documents and Settings\LASZLO\Ty?p?yt?\Garmin_Mapsource_Finland_Topo-kartat\Garmin_Mapsource_Finland_Topo-kartat\Topo_12\French\MapSource_Lang.dll"
Sat 23 Apr 2005 397,312 A..H. --- "C:\Documents and Settings\LASZLO\Ty?p?yt?\Garmin_Mapsource_Finland_Topo-kartat\Garmin_Mapsource_Finland_Topo-kartat\Topo_12\English\MapSource_Lang.dll"
Sat 23 Apr 2005 417,792 A..H. --- "C:\Documents and Settings\LASZLO\Ty?p?yt?\Garmin_Mapsource_Finland_Topo-kartat\Garmin_Mapsource_Finland_Topo-kartat\Topo_11\Spanish\MapSource_Lang.dll"
Sat 23 Apr 2005 421,888 A..H. --- "C:\Documents and Settings\LASZLO\Ty?p?yt?\Garmin_Mapsource_Finland_Topo-kartat\Garmin_Mapsource_Finland_Topo-kartat\Topo_11\Italian\MapSource_Lang.dll"
Sat 23 Apr 2005 421,888 A..H. --- "C:\Documents and Settings\LASZLO\Ty?p?yt?\Garmin_Mapsource_Finland_Topo-kartat\Garmin_Mapsource_Finland_Topo-kartat\Topo_11\German\MapSource_Lang.dll"
Sat 23 Apr 2005 421,888 A..H. --- "C:\Documents and Settings\LASZLO\Ty?p?yt?\Garmin_Mapsource_Finland_Topo-kartat\Garmin_Mapsource_Finland_Topo-kartat\Topo_11\French\MapSource_Lang.dll"
Sat 23 Apr 2005 397,312 A..H. --- "C:\Documents and Settings\LASZLO\Ty?p?yt?\Garmin_Mapsource_Finland_Topo-kartat\Garmin_Mapsource_Finland_Topo-kartat\Topo_11\English\MapSource_Lang.dll"
Sat 23 Apr 2005 417,792 A..H. --- "C:\Documents and Settings\LASZLO\Ty?p?yt?\Garmin_Mapsource_Finland_Topo-kartat\Garmin_Mapsource_Finland_Topo-kartat\Topo_cd_16\GPS_AT\Spanish\MapSource_Lang.dll"
Sat 23 Apr 2005 421,888 A..H. --- "C:\Documents and Settings\LASZLO\Ty?p?yt?\Garmin_Mapsource_Finland_Topo-kartat\Garmin_Mapsource_Finland_Topo-kartat\Topo_cd_16\GPS_AT\Italian\MapSource_Lang.dll"
Sat 23 Apr 2005 421,888 A..H. --- "C:\Documents and Settings\LASZLO\Ty?p?yt?\Garmin_Mapsource_Finland_Topo-kartat\Garmin_Mapsource_Finland_Topo-kartat\Topo_cd_16\GPS_AT\German\MapSource_Lang.dll"
Sat 23 Apr 2005 421,888 A..H. --- "C:\Documents and Settings\LASZLO\Ty?p?yt?\Garmin_Mapsource_Finland_Topo-kartat\Garmin_Mapsource_Finland_Topo-kartat\Topo_cd_16\GPS_AT\French\MapSource_Lang.dll"
Sat 23 Apr 2005 397,312 A..H. --- "C:\Documents and Settings\LASZLO\Ty?p?yt?\Garmin_Mapsource_Finland_Topo-kartat\Garmin_Mapsource_Finland_Topo-kartat\Topo_cd_16\GPS_AT\English\MapSource_Lang.dll"
Finished!
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 18:53:38, on 29.2.2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\wltrysvc.exe
C:\WINDOWS\System32\bcmwltry.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\PROGRA~1\F-Secure\BackWeb\7681197\Program\SERVIC~1.EXE
C:\Program Files\F-Secure\Anti-Virus\fsgk32st.exe
C:\Program Files\F-Secure\BackWeb\7681197\program\fsbwsys.exe
C:\Program Files\F-Secure\Anti-Virus\FSGK32.EXE
C:\Program Files\F-Secure\Common\FSMA32.EXE
C:\Program Files\F-Secure\Anti-Virus\fssm32.exe
C:\Program Files\F-Secure\Common\FSMB32.EXE
C:\WINDOWS\system32\svchost.exe
C:\Program Files\F-Secure\Common\FCH32.EXE
C:\Program Files\F-Secure\Common\FAMEH32.EXE
C:\Program Files\F-Secure\Common\FNRB32.EXE
C:\Program Files\F-Secure\FWES\Program\fsdfwd.exe
C:\Program Files\F-Secure\Common\FIH32.EXE
C:\WINDOWS\System32\svchost.exe
C:\Program Files\F-Secure\Anti-Virus\fsav32.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\WINDOWS\system32\WLTRAY.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
C:\Program Files\Launch Manager\LaunchAp.exe
C:\Program Files\Launch Manager\PowerKey.exe
C:\Program Files\Launch Manager\HotkeyApp.exe
C:\Program Files\Launch Manager\CtrlVol.exe
C:\Program Files\Launch Manager\OSDCtrl.exe
C:\Program Files\Launch Manager\Wbutton.exe
C:\Program Files\F-Secure\BackWeb\7681197\Program\F-Secure Automatic Update.exe
C:\Program Files\Arcade\PCMService.exe
C:\Program Files\F-Secure\Common\FSM32.EXE
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\RF Wireless Mouse\cm20.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\F-Secure\FSGUI\fsguiexe.exe
C:\Program Files\Ahead\InCD\InCD.exe
C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
C:\PROGRA~1\Nokia\NOKIAP~1\LAUNCH~1.EXE
C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe
C:\Program Files\HP\hpcoretech\hpcmpmgr.exe
C:\Program Files\Common Files\PCSuite\Services\ServiceLayer.exe
C:\Program Files\acer\eRecovery\Monitor.exe
C:\Program Files\Winamp\winampa.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\Microsoft ActiveSync\WCESCOMM.EXE
C:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe
C:\Program Files\Winamp Remote\bin\OrbTray.exe
C:\PROGRA~1\COMMON~1\Nokia\MPAPI\MPAPI3s.exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\WINDOWS\Twain_32\CA561A\SnapDetect.exe
C:\PROGRA~1\Yahoo!\MESSEN~1\ymsgr_tray.exe
C:\Program Files\HP\Digital Imaging\bin\hpqgalry.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Documents and Settings\LASZLO\Työpöytä\HiJackThis_v2.0.2.exe
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://us.rd.yahoo.com/customize/ie/defa...rch/search.html
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://us.rd.yahoo.com/customize/ie/defa...//www.yahoo.com
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.fi/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.yahoo.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://us.rd.yahoo.com/customize/ie/defa...//www.yahoo.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://us.rd.yahoo.com/customize/ie/defa...rch/search.html
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://us.rd.yahoo.com/customize/ie/defa...//www.yahoo.com
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://us.rd.yahoo.com/customize/ie/defa...//www.yahoo.com
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Microsoft Internet Explorer - toimittaja Sonera Internet
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Linkit
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\PROGRA~1\YAHOO!\Companion\Installs\cpn0\yt.dll
O2 - BHO: &Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\PROGRA~1\YAHOO!\Companion\Installs\cpn0\yt.dll
O2 - BHO: Adobe PDF Reader -linkkiavustaja - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: Yahoo! IE Services Button - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: ST - {9394EDE7-C8B5-483E-8773-474BF36AF6E4} - C:\Program Files\MSN Apps\ST\01.03.0000.1005\en-xu\stmain.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll
O2 - BHO: MSNToolBandBHO - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Apps\MSN Toolbar\MSN Toolbar\01.02.5000.1021\fi\msntb.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\PROGRA~1\YAHOO!\Companion\Installs\cpn0\yt.dll
O4 - HKLM\..\Run: [preload] C:\Windows\RUNXMLPL.exe
O4 - HKLM\..\Run: [SynTPLpr] C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [Broadcom Wireless Manager UI] C:\WINDOWS\system32\WLTRAY
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [LaunchAp] C:\Program Files\Launch Manager\LaunchAp.exe
O4 - HKLM\..\Run: [PowerKey] "C:\Program Files\Launch Manager\PowerKey.exe"
O4 - HKLM\..\Run: [LManager] C:\Program Files\Launch Manager\HotkeyApp.exe
O4 - HKLM\..\Run: [CtrlVol] C:\Program Files\Launch Manager\CtrlVol.exe
O4 - HKLM\..\Run: [LMgrOSD] C:\Program Files\Launch Manager\OSDCtrl.exe
O4 - HKLM\..\Run: [Wbutton] "C:\Program Files\Launch Manager\Wbutton.exe"
O4 - HKLM\..\Run: [PCMService] "C:\Program Files\Arcade\PCMService.exe"
O4 - HKLM\..\Run: [eRecoveryService] C:\Windows\System32\Check.exe
O4 - HKLM\..\Run: [F-Secure Manager] "C:\Program Files\F-Secure\Common\FSM32.EXE" /splash
O4 - HKLM\..\Run: [F-Secure TNB] "C:\Program Files\F-Secure\TNB\TNBUtil.exe" /CHECKALL /WAITFORSW
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [Start RF Wireless Mouse] C:\Program Files\RF Wireless Mouse\cm20.exe
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [NeroCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [InCD] C:\Program Files\Ahead\InCD\InCD.exe
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [PCSuiteTrayApplication] C:\PROGRA~1\Nokia\NOKIAP~1\LAUNCH~1.EXE -startup
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe"
O4 - HKLM\..\Run: [HP Component Manager] "C:\Program Files\HP\hpcoretech\hpcmpmgr.exe"
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [WinampAgent] C:\Program Files\Winamp\winampa.exe
O4 - HKLM\..\Run: [Windows Services Manager] svchost.exe
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [H/PC Connection Agent] "C:\Program Files\Microsoft ActiveSync\WCESCOMM.EXE"
O4 - HKCU\..\Run: [PcSync] C:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe /NoDialog
O4 - HKCU\..\Run: [Yahoo! Pager] "C:\PROGRA~1\Yahoo!\MESSEN~1\YAHOOM~1.EXE" -quiet
O4 - HKCU\..\Run: [Orb] "C:\Program Files\Winamp Remote\bin\OrbTray.exe" /background
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Paikallinen palve')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Verkkopalve')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O4 - Global Startup: HP Image Zone -pikakäynnistys.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqthb08.exe
O4 - Global Startup: SnapDetect.lnk = ?
O8 - Extra context menu item: &Google Search - res://c:\program files\google\GoogleToolbar2.dll/cmsearch.html
O8 - Extra context menu item: &Translate English Word - res://c:\program files\google\GoogleToolbar2.dll/cmwordtrans.html
O8 - Extra context menu item: Backward Links - res://c:\program files\google\GoogleToolbar2.dll/cmbacklinks.html
O8 - Extra context menu item: Cached Snapshot of Page - res://c:\program files\google\GoogleToolbar2.dll/cmcache.html
O8 - Extra context menu item: Similar Pages - res://c:\program files\google\GoogleToolbar2.dll/cmsimilar.html
O8 - Extra context menu item: Translate Page into English - res://c:\program files\google\GoogleToolbar2.dll/cmtrans.html
O8 - Extra context menu item: Vie Microsoft E&xceliin - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra button: Matkaviestimen suosikkien luominen - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - C:\Program Files\Microsoft ActiveSync\inetrepl.dll
O9 - Extra button: (no name) - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\Program Files\Microsoft ActiveSync\inetrepl.dll
O9 - Extra 'Tools' menuitem: Matkaviestimen suosikkien luominen... - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\Program Files\Microsoft ActiveSync\inetrepl.dll
O9 - Extra button: Yahoo! Services - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O14 - IERESET.INF: START_PAGE_URL=http://www.soneraplaza.fi
O16 - DPF: {00B71CFB-6864-4346-A978-C0A14556272C} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab31267.cab
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (Installation Support) - C:\Program Files\Yahoo!\Common\Yinsthelper.dll
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/Mes...nt.cab31267.cab
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/msnmessengersetupdownloader.cab
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O23 - Service: Notebook Manager Service (anbmService) - OSA Technologies Inc. - C:\Acer\eManager\anbmServ.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: AVG Anti-Spyware Guard - Anti-Malware Development a.s. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: F-Secure Automatic Update (BackWeb Plug-in - 7681197) - Unknown owner - C:\PROGRA~1\F-Secure\BackWeb\7681197\Program\SERVIC~1.EXE
O23 - Service: F-Secure Gatekeeper Handler Starter - F-Secure Corp. - C:\Program Files\F-Secure\Anti-Virus\fsgk32st.exe
O23 - Service: F-Secure Network Request Broker - F-Secure Corporation - C:\Program Files\F-Secure\Common\FNRB32.EXE
O23 - Service: fsbwsys - F-Secure Corp. - C:\Program Files\F-Secure\BackWeb\7681197\program\fsbwsys.exe
O23 - Service: F-Secure Anti-Virus Firewall Daemon (FSDFWD) - F-Secure Corporation - C:\Program Files\F-Secure\FWES\Program\fsdfwd.exe
O23 - Service: F-Secure Management Agent (FSMA) - F-Secure Corporation - C:\Program Files\F-Secure\Common\FSMA32.EXE
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: ServiceLayer - Nokia. - C:\Program Files\Common Files\PCSuite\Services\ServiceLayer.exe
O23 - Service: Broadcom Wireless LAN Tray Service (wltrysvc) - Unknown owner - C:\WINDOWS\System32\wltrysvc.exe
--
End of file - 13204 bytes
|
|
Hujo
Suspended permanently
|
29. helmikuuta 2008 @ 19:27 |
Linkki tähän viestiin
|
1.Lataa combofix.exe työpöydällesi yhdestä linkistä:
combofix1
combofix2
2. Tuplaklikkaa combofix.exe tiedostoa ja seuraa ohjeistuksia.
3. Kun työkalu on valmis, se tuottaa lokin. Lähetä tämä loki viesti ketjuusi.
Huom! Älä klikkaile combofixin ikkunaa käytön aikana. Tämä saattaa aiheuttaa ohjelman jumiutumisen.
Voiko tietsikka koskaan toimia?
|
|
vlaspa
Newbie
|
1. maaliskuuta 2008 @ 08:39 |
Linkki tähän viestiin
|
Compofix raportti
ComboFix 08-03-01 - LASZLO 2008-03-01 8:23:23.1 - FAT32x86
Running from: C:\Documents and Settings\LASZLO\Työpöytä\ComboFix.exe
* Created a new restore point
WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.
((((( Tiedostot, jotka on luotu seuraavalla aikavälillä: 2008-02-01 to 2008-03-01 )))))))))))))))))
.
2008-02-29 18:26 . 2008-02-29 18:26 <KANSIO> d-------- C:\WINDOWS\ERUNT
2008-02-28 22:23 . 2008-02-28 22:23 <KANSIO> d--hs---- C:\FOUND.004
2008-02-22 20:01 . 2008-02-22 20:01 268 --ah----- C:\sqmdata14.sqm
2008-02-22 20:01 . 2008-02-22 20:01 244 --ah----- C:\sqmnoopt14.sqm
2008-02-02 13:27 . 2008-02-02 13:27 <KANSIO> d-------- C:\Program Files\vanBasco's Karaoke Player
.
(((((((((((((((((((((((((((((((((((( Find3M-raportti ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-02-28 19:06 102,400 ----a-w C:\WINDOWS\DUMPf504.tmp
2008-01-20 09:31 --------- d-----w C:\Documents and Settings\Tanja\Application Data\Yahoo!
2008-01-12 09:58 --------- d-----w C:\Program Files\Winamp Remote
2008-01-12 09:58 --------- d-----w C:\Documents and Settings\All Users\Application Data\OrbNetworks
2008-01-07 16:56 --------- d-----w C:\Documents and Settings\LASZLO\Application Data\Yahoo!
2008-01-06 13:41 --------- d-----w C:\Documents and Settings\All Users\Application Data\Yahoo!
2008-01-06 11:47 32 ----a-w C:\Documents and Settings\All Users\Application Data\ezsid.dat
2008-01-06 11:47 --------- d-----w C:\Documents and Settings\LASZLO\Application Data\skypePM
2008-01-06 11:46 --------- d-----w C:\Program Files\Skype
2008-01-06 11:46 --------- d-----w C:\Program Files\Common Files\Skype
2007-12-18 09:51 179,584 ----a-w C:\WINDOWS\system32\dllcache\mrxdav.sys
2007-12-07 14:37 3,080,192 ----a-w C:\WINDOWS\system32\dllcache\mshtml.dll
2007-12-06 13:07 18,432 ----a-w C:\WINDOWS\system32\dllcache\iedw.exe
2007-12-04 18:41 550,912 ----a-w C:\WINDOWS\system32\dllcache\oleaut32.dll
2007-12-04 18:41 550,912 ------w C:\WINDOWS\system32\oleaut32.dll
2006-08-13 15:15 32,080 ----a-w C:\Documents and Settings\Tanja\Application Data\GDIPFONTCACHEV1.DAT
2006-01-31 19:09 32,080 ----a-w C:\Documents and Settings\LASZLO\Application Data\GDIPFONTCACHEV1.DAT
2006-05-03 10:06 163,328 --sh--r C:\WINDOWS\system32\flvDX.dll
.
(((((((((((((((((((((((((((((( Rekisterin käynnistyskohteet )))))))))))))))))))))))))))))))))))))))))))))
.
.
REGEDIT4
*Huom* Tyhjiä arvoja ja laillisia oletusarvoja ei näytetä
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\ctfmon.exe" [2004-09-15 16:00 15360]
"MSMSGS"="C:\Program Files\Messenger\msmsgs.exe" [2004-10-13 18:24 1694208]
"H/PC Connection Agent"="C:\Program Files\Microsoft ActiveSync\WCESCOMM.EXE" [2005-01-19 15:16 405583]
"PcSync"="C:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe" [2006-04-11 17:52 1409024]
"Yahoo! Pager"="C:\PROGRA~1\Yahoo!\MESSEN~1\YAHOOM~1.exe" [2007-08-30 17:43 4670704]
"Orb"="C:\Program Files\Winamp Remote\bin\OrbTray.exe" [2008-01-07 22:02 495616]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"preload"="C:\Windows\RUNXMLPL.exe" [2004-04-20 16:49 40960]
"SynTPLpr"="C:\Program Files\Synaptics\SynTP\SynTPLpr.exe" [2004-10-05 16:25 98394]
"SynTPEnh"="C:\Program Files\Synaptics\SynTP\SynTPEnh.exe" [2004-10-05 16:24 688218]
"Broadcom Wireless Manager UI"="C:\WINDOWS\system32\WLTRAY" [ ]
"SoundMan"="SOUNDMAN.EXE" [2005-02-23 18:13 77824 C:\WINDOWS\SOUNDMAN.EXE]
"ATIPTA"="C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe" [2005-04-05 21:05 339968]
"LaunchAp"="C:\Program Files\Launch Manager\LaunchAp.exe" [2005-03-30 15:29 32768]
"PowerKey"="C:\Program Files\Launch Manager\PowerKey.exe" [2002-08-30 15:02 94208]
"LManager"="C:\Program Files\Launch Manager\HotkeyApp.exe" [2005-03-29 11:08 61440]
"CtrlVol"="C:\Program Files\Launch Manager\CtrlVol.exe" [2004-01-28 17:48 184320]
"LMgrOSD"="C:\Program Files\Launch Manager\OSDCtrl.exe" [2004-10-11 10:47 245760]
"Wbutton"="C:\Program Files\Launch Manager\Wbutton.exe" [2005-03-03 17:39 77824]
"PCMService"="C:\Program Files\Arcade\PCMService.exe" [2005-03-09 18:59 49152]
"eRecoveryService"="C:\Windows\System32\Check.exe" [2005-03-23 10:01 245760]
"F-Secure Manager"="C:\Program Files\F-Secure\Common\FSM32.exe" [2004-09-09 11:03 118832]
"F-Secure TNB"="C:\Program Files\F-Secure\TNB\TNBUtil.exe" [2004-05-27 10:57 684032]
"QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2005-07-18 21:07 77824]
"Start RF Wireless Mouse"="C:\Program Files\RF Wireless Mouse\cm20.exe" [2004-03-06 10:08 73728]
"TkBellExe"="C:\Program Files\Common Files\Real\Update_OB\realsched.exe" [2006-02-28 17:51 180269]
"NeroCheck"="C:\WINDOWS\system32\NeroCheck.exe" [2001-07-09 10:50 155648]
"InCD"="C:\Program Files\Ahead\InCD\InCD.exe" [2002-09-12 19:13 1101824]
"HP Software Update"="C:\Program Files\HP\HP Software Update\HPWuSchd2.exe" [2005-02-16 23:11 49152]
"PCSuiteTrayApplication"="C:\PROGRA~1\Nokia\NOKIAP~1\LAUNCH~1.exe" [2006-04-26 08:29 237568]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe" [2007-09-25 01:11 132496]
"HP Component Manager"="C:\Program Files\HP\hpcoretech\hpcmpmgr.exe" [2004-05-12 15:18 241664]
"Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2007-10-10 19:51 39792]
"WinampAgent"="C:\Program Files\Winamp\winampa.exe" [2007-12-20 17:16 37376]
"Windows Services Manager"="svchost.exe" [2004-09-15 16:00 14336 C:\WINDOWS\system32\svchost.exe]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2004-09-15 16:00 15360]
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"C:\\Program Files\\F-Secure\\BackWeb\\7681197\\program\\F-Secure Automatic Update.exe"=
"C:\\Program Files\\Messenger\\msmsgs.exe"=
"C:\\Program Files\\Microsoft ActiveSync\\wcescomm.exe"=
"C:\\Program Files\\Microsoft ActiveSync\\WCESMgr.exe"=
"C:\\Program Files\\MSN Messenger\\msnmsgr.exe"=
"C:\\Program Files\\MSN Messenger\\livecall.exe"=
"C:\\Program Files\\Skype\\Phone\\Skype.exe"=
"C:\\Program Files\\Yahoo!\\Messenger\\YahooMessenger.exe"=
"C:\\Program Files\\Yahoo!\\Messenger\\YServer.exe"=
"C:\\Program Files\\Winamp Remote\\bin\\Orb.exe"=
"C:\\Program Files\\Winamp Remote\\bin\\OrbTray.exe"=
"C:\\Program Files\\Winamp Remote\\bin\\OrbStreamerClient.exe"=
R0 BsStor;InCD Storage Helper Driver;C:\WINDOWS\system32\DRIVERS\bsstor.sys [2002-06-06 01:07]
R0 FSFW;F-Secure Firewall Driver;C:\WINDOWS\system32\drivers\fsdfw.sys [2004-09-17 16:52]
R1 Hotkey;Hotkey;C:\WINDOWS\system32\drivers\Hotkey.sys [2003-04-28 11:27]
R2 BackWeb Plug-in - 7681197;F-Secure Automatic Update;C:\PROGRA~1\F-Secure\BackWeb\7681197\Program\SERVIC~1.EXE [2005-07-14 14:32]
R2 BsUDF;InCD UDF Driver;C:\WINDOWS\system32\drivers\BsUDF.sys [2002-09-13 14:35]
R2 F-Secure Filter;F-Secure File System Filter;C:\Program Files\F-Secure\Anti-Virus\Win2K\FSfilter.sys [2004-09-10 18:14]
R2 F-Secure Gatekeeper;F-Secure Gatekeeper;C:\Program Files\F-Secure\Anti-Virus\Win2K\FSgk.sys [2004-09-10 18:14]
R2 F-Secure Recognizer;F-Secure File System Recognizer;C:\Program Files\F-Secure\Anti-Virus\Win2K\FSrec.sys [2003-02-06 14:32]
R3 HSFHWATI;HSFHWATI;C:\WINDOWS\system32\DRIVERS\HSFHWATI.sys [2004-12-15 15:18]
R3 int15.sys;int15.sys;C:\Program Files\acer\eRecovery\int15.sys [2005-01-13 14:46]
R3 POWERKEY;POWERKEY;C:\Program Files\Launch Manager\POWERKEY.sys [2000-12-19 18:29]
S1 Wbutton;Wbutton;C:\WINDOWS\system32\drivers\Wbutton.sys []
S3 k600bus;Sony Ericsson 600i driver (WDM);C:\WINDOWS\system32\DRIVERS\k600bus.sys [2005-05-11 14:12]
S3 k600mdfl;Sony Ericsson 600i USB WMC Modem Filter;C:\WINDOWS\system32\DRIVERS\k600mdfl.sys [2005-05-11 14:12]
S3 k600mdm;Sony Ericsson 600i USB WMC Modem Drivers;C:\WINDOWS\system32\DRIVERS\k600mdm.sys [2005-05-11 14:12]
S3 k600mgmt;Sony Ericsson 600i USB WMC Device Management Drivers;C:\WINDOWS\system32\DRIVERS\k600mgmt.sys [2005-05-11 14:12]
S3 k600obex;Sony Ericsson 600i USB WMC OBEX Interface Drivers;C:\WINDOWS\system32\DRIVERS\k600obex.sys [2005-05-11 14:12]
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{08160ece-232c-11dc-a949-000ae4e0eb10}]
\Shell\AutoRun\command - F:\AutoRun.exe
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{14d826b2-a42b-11dc-a9f4-cf70bdd52b4f}]
\Shell\AutoRun\command - F:\AutoRun.exe
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{14d826b4-a42b-11dc-a9f4-000ae4e0eb10}]
\Shell\AutoRun\command - F:\AutoRun.exe
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{14d826b5-a42b-11dc-a9f4-000ae4e0eb10}]
\Shell\AutoRun\command - F:\AutoRun.exe
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{33a8d8c6-2ad6-11dc-a956-000ae4e0eb10}]
\Shell\AutoRun\command - F:\AutoRun.exe
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{8e67c4b4-a666-11dc-a9f5-000ae4e0eb10}]
\Shell\AutoRun\command - F:\AutoRun.exe
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{e0dd8bad-ddb8-11da-a802-000ae4e0eb10}]
\Shell\AutoRun\command - H:\SetupCN.exe
.
**************************************************************************
catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-03-01 08:29:48
Windows 5.1.2600 Service Pack 2 FAT NTAPI
scanning hidden processes ...
scanning hidden autostart entries ...
scanning hidden files ...
scan completed successfully
hidden files: 0
**************************************************************************
.
--------------------- DLLs Loaded Under Running Processes ---------------------
PROCESS: C:\WINDOWS\explorer.exe [6.00.2900.3156]
-> C:\Program Files\RF Wireless Mouse\NoEdge.dll
.
------------------------ Other Running Processes ------------------------
.
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\System32\wltrysvc.exe
C:\WINDOWS\System32\bcmwltry.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\Program Files\F-Secure\Anti-Virus\fsgk32st.exe
C:\Program Files\F-Secure\BackWeb\7681197\program\fsbwsys.exe
C:\Program Files\F-Secure\Anti-Virus\FSGK32.EXE
C:\Program Files\F-Secure\Common\FSMA32.EXE
C:\Program Files\F-Secure\Anti-Virus\fssm32.exe
C:\Program Files\F-Secure\Common\FSMB32.EXE
C:\Program Files\F-Secure\Common\FCH32.EXE
C:\Program Files\F-Secure\Common\FAMEH32.EXE
C:\Program Files\F-Secure\Common\FNRB32.EXE
C:\Program Files\F-Secure\FWES\Program\fsdfwd.exe
C:\Program Files\F-Secure\Common\FIH32.EXE
C:\Program Files\F-Secure\Anti-Virus\fsav32.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\Program Files\F-Secure\BackWeb\7681197\Program\F-Secure Automatic Update.exe
C:\WINDOWS\system32\WLTRAY.exe
C:\Program Files\F-Secure\FSGUI\fsguiexe.exe
C:\Program Files\acer\eRecovery\Monitor.exe
C:\Program Files\Common Files\PCSuite\Services\ServiceLayer.exe
C:\PROGRA~1\COMMON~1\Nokia\MPAPI\MPAPI3s.exe
.
**************************************************************************
.
Completion time: 2008-03-01 8:32:51 - machine was rebooted
ComboFix-quarantined-files.txt 2008-03-01 06:32:46
.
2008-02-14 22:43:24 --- E O F ---
|
|
Mainos
|
|
|
|
Hujo
Suspended permanently
|
1. maaliskuuta 2008 @ 11:27 |
Linkki tähän viestiin
|
Voiko tietsikka koskaan toimia?
Viestiä on muokattu lähettämisen jälkeen. Viimeisin muokkaus 1. maaliskuuta 2008 @ 11:39
|
|
