Malwarebytes' Anti-Malware 1.11
Database version: 676
Scan type: Full Scan (C:\|D:\|E:\|)
Objects scanned: 377263
Time elapsed: 2 hour(s), 30 minute(s), 30 second(s)
Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 0
Memory Processes Infected:
(No malicious items detected)
Memory Modules Infected:
(No malicious items detected)
Registry Keys Infected:
(No malicious items detected)
Registry Values Infected:
(No malicious items detected)
Registry Data Items Infected:
(No malicious items detected)
Folders Infected:
(No malicious items detected)
Files Infected:
(No malicious items detected)
ComboFix 08-04-22.5 - Ahti 2008-04-24 16:18:09.1 - NTFSx86
Microsoft® Windows Vista™ Home Premium 6.0.6001.1.1252.1.1035.18.2023 [GMT 3:00]
Running from: C:\Users\Ahti\Documents\ComboFix.exe
* Created a new restore point
* Resident AV is active
.
(((((((((((((((((((((((((((((((((((((( Muut poistot ))))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
C:\Windows\Downloaded Program Files\setup.inf
.
((((( Tiedostot, jotka on luotu seuraavalla aikavälillä: 2008-03-24 to 2008-04-24 )))))))))))))))))
.
2008-04-23 16:14 . 2008-04-23 16:14 <KANSIO> d-------- C:\Program Files\Ultra Utility
2008-04-23 14:46 . 2008-04-23 14:46 <KANSIO> d-------- C:\Program Files\Trend Micro
2008-04-22 20:56 . 2008-04-22 20:56 429,568 --a------ C:\Windows\System32\fmod64.dll
2008-04-22 20:56 . 2008-04-22 20:56 161,280 --a------ C:\Windows\System32\fmod.dll
2008-04-22 16:18 . 2008-04-22 16:18 <KANSIO> d-------- C:\Users\Ahti\AppData\Roaming\Grisoft
2008-04-22 16:17 . 2008-04-22 16:17 <KANSIO> d-------- C:\Users\All Users\Grisoft
2008-04-22 16:17 . 2008-04-22 16:17 <KANSIO> d-------- C:\ProgramData\Grisoft
2008-04-22 16:17 . 2007-05-30 15:10 10,872 --a------ C:\Windows\System32\drivers\AvgAsCln.sys
2008-04-22 07:46 . 2008-04-22 07:46 0 --ah----- C:\Windows\System32\drivers\Msft_User_WpdFs_01_00_00.Wdf
2008-04-20 12:29 . 2008-04-20 12:29 <KANSIO> d-------- C:\Windows\JA+2.3
mod with JA+ Pluginv1.3
2008-04-20 11:46 . 2008-04-20 11:47 <KANSIO> d-------- C:\Users\All Users\OrbNetworks
2008-04-20 11:46 . 2008-04-20 11:47 <KANSIO> d-------- C:\ProgramData\OrbNetworks
2008-04-20 11:46 . 2008-04-20 11:46 <KANSIO> d-------- C:\Program Files\Winamp Remote
2008-04-20 11:44 . 2008-04-20 11:46 <KANSIO> d-------- C:\Users\Ahti\AppData\Roaming\Winamp
2008-04-20 11:44 . 2008-04-20 11:46 <KANSIO> d-------- C:\Program Files\Winamp
2008-04-20 11:44 . 2007-03-08 02:51 129,784 --------- C:\Windows\System32\pxafs.dll
2008-04-17 22:09 . 2008-04-17 22:09 <KANSIO> d-------- C:\PerfLogs
2008-04-17 21:25 . 2008-01-19 10:35 4,875,776 --a------ C:\Windows\System32\NlsData0009.dll
2008-04-17 21:24 . 2008-01-19 10:35 9,847,296 --a------ C:\Windows\System32\NlsData000a.dll
2008-04-17 21:23 . 2008-01-19 09:06 8,147,456 --a------ C:\Windows\System32\wmploc.DLL
2008-04-17 21:22 . 2008-01-19 10:33 599,552 --a------ C:\Windows\System32\vsp1cln.exe
2008-04-17 21:21 . 2008-01-19 10:36 704,512 --a------ C:\Windows\System32\SmiEngine.dll
2008-04-17 21:21 . 2008-01-19 10:36 218,624 --a------ C:\Windows\System32\wdscore.dll
2008-04-17 21:21 . 2008-01-19 10:36 139,264 --a------ C:\Windows\System32\SmiInstaller.dll
2008-04-17 21:21 . 2008-01-19 10:33 130,560 --a------ C:\Windows\System32\PkgMgr.exe
2008-04-17 21:20 . 2008-01-19 10:34 305,152 --a------ C:\Windows\System32\msdelta.dll
2008-04-17 21:20 . 2008-01-19 10:34 258,560 --a------ C:\Windows\System32\dpx.dll
2008-04-17 21:20 . 2008-01-19 10:34 246,784 --a------ C:\Windows\System32\drvstore.dll
2008-04-17 21:20 . 2008-01-19 10:35 35,328 --a------ C:\Windows\System32\mspatcha.dll
2008-04-15 17:44 . 2008-04-15 17:44 <KANSIO> d-------- C:\Program Files\DC++
2008-04-09 14:12 . 2008-02-22 05:50 1,383,424 --a------ C:\Windows\System32\mshtml.tlb
2008-04-09 14:12 . 2008-02-22 08:01 826,880 --a------ C:\Windows\System32\wininet.dll
2008-04-08 20:42 . 2008-04-08 20:42 <KANSIO> d-------- C:\Users\All Users\Age of Empires 3
2008-04-08 20:42 . 2008-04-08 20:42 <KANSIO> d-------- C:\ProgramData\Age of Empires 3
2008-04-08 20:09 . 2008-04-08 20:09 <KANSIO> d-------- C:\Program Files\Common Files\Microsoft Games
2008-04-04 21:40 . 2008-04-05 17:34 <KANSIO> d-------- C:\Users\Ahti\AppData\Roaming\gtk-2.0
2008-04-04 15:59 . 2008-04-04 15:59 <KANSIO> d-------- C:\Program Files\DAEMON Tools Lite
2008-04-04 15:54 . 2008-04-04 15:54 <KANSIO> d-------- C:\Users\Ahti\AppData\Roaming\DAEMON Tools
2008-04-04 15:54 . 2008-04-04 15:55 717,296 --a------ C:\Windows\System32\drivers\sptd.sys
2008-03-30 03:12 . 2008-03-30 03:12 <KANSIO> d-------- C:\Program Files\Common Files\INCA Shared
2008-03-30 01:43 . 2008-03-30 01:43 <KANSIO> d-------- C:\Program Files\Gpotato
2008-03-25 15:38 . 2008-03-25 15:38 <KANSIO> d--hsc--- C:\Program Files\Common Files\WindowsLiveInstaller
2008-03-25 15:37 . 2008-03-25 15:39 <KANSIO> d-------- C:\Program Files\Windows Live
2008-03-25 15:35 . 2008-03-25 15:35 <KANSIO> d-------- C:\Users\All Users\WLInstaller
2008-03-25 15:35 . 2008-03-25 15:35 <KANSIO> d-------- C:\ProgramData\WLInstaller
.
(((((((((((((((((((((((((((((((((((( Find3M-raportti ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-04-24 13:28 --------- d-----w C:\Users\Ahti\AppData\Roaming\Skype
2008-04-24 13:11 --------- d-----w C:\Users\Ahti\AppData\Roaming\skypePM
2008-04-21 13:21 --------- d---a-w C:\ProgramData\TEMP
2008-04-19 18:39 --------- d-----w C:\Users\Ahti\AppData\Roaming\uTorrent
2008-04-17 19:25 --------- d-----w C:\ProgramData\NVIDIA
2008-04-17 19:21 174 --sha-w C:\Program Files\desktop.ini
2008-04-17 19:12 --------- d-----w C:\Program Files\Windows Sidebar
2008-04-17 19:12 --------- d-----w C:\Program Files\Windows Photo Gallery
2008-04-17 19:12 --------- d-----w C:\Program Files\Windows Mail
2008-04-17 19:12 --------- d-----w C:\Program Files\Windows Journal
2008-04-17 19:12 --------- d-----w C:\Program Files\Windows Defender
2008-04-17 19:12 --------- d-----w C:\Program Files\Windows Collaboration
2008-04-17 19:12 --------- d-----w C:\Program Files\Windows Calendar
2008-04-17 18:51 82,432 ----a-w C:\Windows\System32\axaltocm.dll
2008-04-17 18:51 101,888 ----a-w C:\Windows\System32\ifxcardm.dll
2008-04-17 07:05 --------- d-----w C:\Program Files\DownloadToolz
2008-04-14 14:19 --------- d-----w C:\ProgramData\Firefly Studios
2008-04-14 14:00 --------- d--h--w C:\Program Files\InstallShield Installation Information
2008-04-11 12:37 --------- d-----w C:\Users\Ahti\AppData\Roaming\LimeWire
2008-04-09 11:53 --------- d-----w C:\ProgramData\Microsoft Help
2008-04-08 13:15 --------- d-----w C:\Program Files\F-Secure
2008-04-07 16:26 --------- d-----w C:\Users\Ahti\AppData\Roaming\mIRC
2008-04-06 15:47 22,328 ----a-w C:\Windows\system32\drivers\PnkBstrK.sys
2008-04-06 15:47 107,832 ----a-w C:\Windows\System32\PnkBstrB.exe
2008-04-04 18:49 --------- d-----w C:\Program Files\mIRC
2008-03-22 16:27 --------- d-----w C:\Program Files\Java
2008-03-13 19:43 --------- d-----w C:\Program Files\Common Files\Adobe
2008-03-13 18:55 --------- d-----w C:\Program Files\Abcc Free
FLV to
AVI WMV MPEG MP4 MOV Converter
2008-03-04 20:00 --------- d-----w C:\Program Files\FDRLab
2008-02-29 07:14 19,000 ----a-w C:\Windows\System32\kd1394.dll
2008-02-29 07:11 988,216 ----a-w C:\Windows\System32\winload.exe
2008-02-29 07:11 927,288 ----a-w C:\Windows\System32\winresume.exe
2008-02-29 06:53 46,592 ----a-w C:\Windows\System32\setbcdlocale.dll
2008-02-29 06:53 40,960 ----a-w C:\Windows\System32\srclient.dll
2008-02-29 06:53 378,368 ----a-w C:\Windows\System32\srcore.dll
2008-02-29 06:35 6,656 ----a-w C:\Windows\System32\kbd106n.dll
2008-02-29 04:21 2,032,128 ----a-w C:\Windows\System32\win32k.sys
2008-02-29 04:12 318,464 ----a-w C:\Windows\System32\rstrui.exe
2008-02-29 04:12 14,848 ----a-w C:\Windows\System32\srdelayed.exe
2008-02-27 14:54 --------- d-----w C:\Program Files\Kuma Games
2008-02-22 05:05 615,992 ----a-w C:\Windows\System32\ci.dll
2008-02-22 04:57 295,936 ----a-w C:\Windows\System32\gdi32.dll
2008-02-16 19:42 691,545 ----a-w C:\Windows\unins000.exe
2008-02-03 12:09 12,632 ----a-w C:\Windows\System32\lsdelete.exe
2008-01-31 02:02 54,608 ----a-w C:\Windows\System32\xfcodec.dll
2008-01-18 13:11 32 ----a-w C:\Users\All Users\ezsid.dat
2008-01-18 13:11 32 ----a-w C:\ProgramData\ezsid.dat
2007-11-20 20:08 0 ----a-w C:\Users\Ahti\AppData\Roaming\wklnhst.dat
2007-11-01 19:08 16,384 --sha-w C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat
2007-11-01 19:08 32,768 --sha-w C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat
2007-11-01 19:08 16,384 --sha-w C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Cookies\index.dat
.
(((((((((((((((((((((((((((((( Rekisterin käynnistyskohteet )))))))))))))))))))))))))))))))))))))))))))))
.
.
REGEDIT4
*Huom* Tyhjiä arvoja ja laillisia oletusarvoja ei näytetä
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Sidebar"="C:\Program Files\Windows Sidebar\sidebar.exe" [2008-01-19 10:33 1233920]
"Skype"="C:\Program Files\Skype\Phone\Skype.exe" [2008-02-01 18:22 21898024]
"MsnMsgr"="C:\Program Files\Windows Live\Messenger\msnmsgr.exe" [2007-10-18 12:34 5724184]
"SweetIM"="C:\Program Files\Macrogaming\SweetIM\SweetIM.exe" [2007-08-12 11:02 103712]
"ehTray.exe"="C:\Windows\ehome\ehTray.exe" [2008-01-19 10:33 125952]
"updateMgr"="C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe" [ ]
"SpybotSD TeaTimer"="C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe" [2008-01-28 12:43 2097488]
"WindowsWelcomeCenter"="oobefldr.dll" [2008-01-19 10:36 2153472 C:\Windows\System32\oobefldr.dll]
"DAEMON Tools Lite"="C:\Program Files\DAEMON Tools Lite\daemon.exe" [2008-04-01 12:39 486856]
"WMPNSCFG"="C:\Program Files\Windows Media Player\WMPNSCFG.exe" [2008-01-19 10:33 202240]
"Orb"="C:\Program Files\Winamp Remote\bin\OrbTray.exe" [2008-04-01 04:54 507904]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Windows Defender"="C:\Program Files\Windows Defender\MSASCui.exe" [2008-01-19 10:38 1008184]
"RtHDVCpl"="RtHDVCpl.exe" [2007-03-23 14:04 4423680 C:\Windows\RtHDVCpl.exe]
"Acer Tour"="" []
"Acer Empowering Technology Monitor"="C:\Acer\Empowering Technology\SysMonitor.exe" [2007-01-24 10:27 319488]
"eDataSecurity Loader"="C:\Acer\Empowering Technology\eDataSecurity\eDSloader.exe" [2007-02-07 00:04 464168]
"WarReg_PopUp"="C:\Acer\WR_PopUp\WarReg_PopUp.exe" [2006-11-05 21:48 57344]
"eRecoveryService"="" []
"Acer Tour Reminder"="C:\Acer\AcerTour\Reminder.exe" [2007-02-15 18:39 151552]
"Symantec PIF AlertEng"="C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe" [2007-03-12 18:30 517768]
"SweetIM"="C:\Program Files\Macrogaming\SweetIM\SweetIM.exe" [2007-08-12 11:02 103712]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe" [2008-02-22 05:25 144784]
"ASUSGamerOSD"="C:\Program Files\ASUS\GamerOSD\GamerOSD.exe" [2007-07-23 12:48 380928]
"F-Secure Manager"="C:\Program Files\F-Secure\Common\FSM32.exe" [2007-06-01 16:19 183208]
"F-Secure TNB"="C:\Program Files\F-Secure\FSGUI\TNBUtil.exe" [2007-06-01 16:17 740208]
"V0220Mon.exe"="C:\Windows\V0220Mon.exe" [2006-11-17 02:02 32768]
"Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-01-11 23:16 39792]
"Skytel"="Skytel.exe" [2007-03-16 10:06 1822720 C:\Windows\SkyTel.exe]
"NvSvc"="C:\Windows\system32\nvsvc.dll" [2007-12-11 18:06 86016]
"NvCplDaemon"="C:\Windows\system32\NvCpl.dll" [2007-12-11 18:06 8530464]
"NvMediaCenter"="C:\Windows\system32\NvMcTray.dll" [2007-12-11 18:06 81920]
"WinampAgent"="C:\Program Files\Winamp\winampa.exe" [2008-04-01 21:49 36352]
"!
AVG Anti-Spyware"="C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" [2007-06-11 12:25 6731312]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"Acer Tour Reminder"="C:\Acer\AcerTour\Reminder.exe" [2007-02-15 18:39 151552]
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\
Empowering Technology Launcher.lnk - C:\Acer\Empowering Technology\eAPLauncher.exe [2007-05-05 17:20:51 528384]
PCM Media Sharing.lnk - C:\Program Files\Acer Arcade Live\Acer HomeMedia Connect\Kernel\DMS\PCMMediaSharing.exe [2007-05-05 17:25:20 200812]
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"EnableUIADesktopToggle"= 0 (0x0)
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"VIDC.XFR1"= xfcodec.dll
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Steam]
--a------ 2007-12-07 16:21 1266936 C:\Program Files\Steam\Steam.exe
[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"UacDisableNotify"=dword:00000001
"InternetSettingsDisableNotify"=dword:00000001
"AutoUpdateDisableNotify"=dword:00000001
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]
"DisableMonitoring"=dword:00000001
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\DomainProfile]
"EnableFirewall"= 0 (0x0)
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\FirewallRules]
"{C55EB872-84AB-4CE4-94E2-D59F19B8B14D}"= UDP:C:\Program Files\Microsoft Office\Office12\ONENOTE.EXE:Microsoft Office OneNote
"{584F8E90-5B0B-419C-B103-F7866AF537F5}"= TCP:C:\Program Files\Microsoft Office\Office12\ONENOTE.EXE:Microsoft Office OneNote
"{D0E42B23-09E7-445F-A462-65075C499F49}"= C:\Program Files\Acer Arcade Live\Acer Arcade Live Main Page\Acer Arcade Live.exe:Acer Arcade Live
"{48A7AA93-CFD1-44A6-8932-38837E37135E}"= C:\Program Files\Acer Arcade Live\SlideShow DVD\Component\CLSLDVD.exe:SlideShow
DVD workprocess
"{057D057B-2E77-4902-B8DB-867531B8D7A8}"= C:\Program Files\Acer Arcade Live\Acer
DV Magician\Component\ARAWP.exe:DV Magician ARA workprocess
"{50279E87-82E9-414B-9C3E-F852377267E5}"= C:\Program Files\Acer Arcade Live\Acer DV Magician\Component\DVAX2Process.exe:DV Magician AVAX workprocess
"{BD0D0768-F85A-45DE-AB29-CCE02C0176BC}"= C:\Program Files\Acer Arcade Live\Acer DVDivine\DVDivine.exe:DVDivine
"{7016F49C-79B2-4647-9EB1-910983D6CAE9}"= C:\Program Files\Acer Arcade Live\Acer HomeMedia\HomeMedia.exe:HomeMedia
"{2BAC7F7D-7AB9-43C6-911E-474847D3ECF5}"= C:\Program Files\Acer Arcade Live\Acer HomeMedia Connect\HomeMedia Connect.exe:HomeMedia Connect
"{D5ECD7A4-1EAC-4181-9862-720EB00FAE19}"= C:\Program Files\Acer Arcade Live\Acer HomeMedia Connect\Kernel\DMS\CLMSServer.EXE:HomeMedia Connect Service
"{76BA5F31-C1DC-42D5-B5F4-D34D0F52C7AE}"= C:\Program Files\Acer Arcade Live\Acer VideoMagician\VideoMagician.exe:VideoMagician
"{C4BE1AD3-CA83-44A2-A16D-CA26B3A2D4C9}"= UDP:D:\Program files\StrongholdLegends.exe:Stronghold
Legends
"{E1D1C772-E858-46B5-987B-88BAB95D4759}"= TCP:D:\Program files\StrongholdLegends.exe:Stronghold Legends
"{FA7DB380-B6DE-47C1-9E19-E9059023031E}"= UDP:C:\Program Files\LucasArts\Star Wars Empire at War\GameData\sweaw.exe:Star Wars: Empire at War
"{9A819DAD-8B3A-4B2D-AB4C-E43E2B901CE1}"= TCP:C:\Program Files\LucasArts\Star Wars Empire at War\GameData\sweaw.exe:Star Wars: Empire at War
"{262B0591-65FE-480C-8F26-6F4B524F2BEC}"= UDP:C:\Program Files\Firefly Studios\Stronghold Legends\StrongholdLegends.exe:Stronghold Legends
"{004A070A-AB67-42F1-8F9A-9C83A3819340}"= TCP:C:\Program Files\Firefly Studios\Stronghold Legends\StrongholdLegends.exe:Stronghold Legends
"{B1EB3ADF-81D6-49C9-98AD-A7BF6DAA0A6F}"= UDP:C:\Program Files\LucasArts\Star Wars Empire at War Forces of Corruption\swfoc.exe:Star Wars(TM): Empire at War(TM): Forces of Corruption(TM)
"{38C40BCA-3C72-4035-B98D-D045E785E406}"= TCP:C:\Program Files\LucasArts\Star Wars Empire at War Forces of Corruption\swfoc.exe:Star Wars(TM): Empire at War(TM): Forces of Corruption(TM)
"{3A7FE625-6918-4E06-B779-7924E718AF5E}"= UDP:C:\Program Files\Microsoft Office\Office12\ONENOTE.EXE:Microsoft Office OneNote
"{505A7CD1-2EEB-46A9-9547-44CD4F4210AF}"= TCP:C:\Program Files\Microsoft Office\Office12\ONENOTE.EXE:Microsoft Office OneNote
"{95AED395-5CE8-4742-A616-B2E2A35DB5A9}"= UDP:C:\Program Files\EA GAMES\Battlefield 2\BF2.exe:Battlefield 2
"{4E9D76CA-571D-45B6-96DC-AE24182537B4}"= TCP:C:\Program Files\EA GAMES\Battlefield 2\BF2.exe:Battlefield 2
"{2BF8734B-8328-4C91-8E71-7E35AF8A5EB2}"= UDP:C:\Program Files\uTorrent\uTorrent.exe:µTorrent
"{10D96557-4FD2-45FB-8EE6-2820324F824D}"= TCP:C:\Program Files\uTorrent\uTorrent.exe:µTorrent
"{B3969837-6C8B-4062-A396-DE076DD418D1}"= UDP:C:\Program Files\Electronic Arts\Battlefield 2142 Deluxe Edition\BF2142.exe:Battlefield 2142
"{1293048E-8FFC-4665-B8DD-705B167CCC4A}"= TCP:C:\Program Files\Electronic Arts\Battlefield 2142 Deluxe Edition\BF2142.exe:Battlefield 2142
"TCP Query User{5FD2D237-AADD-45C8-B90A-8C85205D5284}D:\\xfire\\xfire.exe"= UDP:D:\xfire\xfire.exe:Xfire
"UDP Query User{792C2367-B7F9-41F6-98DA-CEFA4A6D0CF8}D:\\xfire\\xfire.exe"= TCP:D:\xfire\xfire.exe:Xfire
"TCP Query User{8EA93901-1C42-4C25-B968-652D4B00910E}C:\\users\\ahti\\desktop\\utorrent.exe"= UDP:C:\users\ahti\desktop\utorrent.exe:utorrent.exe
"UDP Query User{7CC67A98-0557-4C74-825B-7F537C0BF97C}C:\\users\\ahti\\desktop\\utorrent.exe"= TCP:C:\users\ahti\desktop\utorrent.exe:utorrent.exe
"TCP Query User{AA7FC68F-56A5-42F2-A15A-C7A9976AD38E}D:\\game-masters.com\\cabal online (europe)\\launcher\\update\\estdnheadless.exe"= UDP:D:\game-masters.com\cabal online (europe)\launcher\update\estdnheadless.exe:EST! download engine
"UDP Query User{2E393D12-C500-402E-9559-9AC250B05CAE}D:\\game-masters.com\\cabal online (europe)\\launcher\\update\\estdnheadless.exe"= TCP:D:\game-masters.com\cabal online (europe)\launcher\update\estdnheadless.exe:EST! download engine
"{E90DCCEA-DFCE-410B-804A-2A4A679EEE0D}"= UDP:D:\GameSpy\Aphex.exe:GameSpy Arcade
"{AECED666-9676-462D-ACE8-8B484FD10A44}"= TCP:D:\GameSpy\Aphex.exe:GameSpy Arcade
"TCP Query User{944A5E05-6DC0-499D-BA21-02FE62B4C096}C:\\program files\\gamespy\\comrade\\comrade.exe"= UDP:C:\program files\gamespy\comrade\comrade.exe:Comrade
"UDP Query User{D4784195-637E-495D-8438-5C612BA840B7}C:\\program files\\gamespy\\comrade\\comrade.exe"= TCP:C:\program files\gamespy\comrade\comrade.exe:Comrade
"TCP Query User{474149F4-90B4-428F-99EF-59100FB147DC}C:\\program files\\age of empires ii\\age2_x1\\age2_x1.exe"= UDP:C:\program files\age of empires ii\age2_x1\age2_x1.exe:Age of Empires II Expansion
"UDP Query User{6ACA5FC6-0656-4F1B-9588-9D935C7B9941}C:\\program files\\age of empires ii\\age2_x1\\age2_x1.exe"= TCP:C:\program files\age of empires ii\age2_x1\age2_x1.exe:Age of Empires II Expansion
"TCP Query User{3E1A16E7-796D-4455-A3D8-A68132C13BE9}C:\\windows\\system32\\dplaysvr.exe"= UDP:C:\windows\system32\dplaysvr.exe:Microsoft DirectPlay Helper
"UDP Query User{3B38F9E3-F530-466D-BBFF-4BE8CA25AC70}C:\\windows\\system32\\dplaysvr.exe"= TCP:C:\windows\system32\dplaysvr.exe:Microsoft DirectPlay Helper
"TCP Query User{42170E3E-EE42-4626-95C2-29F5159A7B6F}D:\\stronghold crusader\\stronghold crusader\\stronghold crusader.exe"= UDP:D:\stronghold crusader\stronghold crusader\stronghold crusader.exe:Stronghold Crusader
"UDP Query User{FB22FDC3-895B-4521-AE85-771BA70F9757}D:\\stronghold crusader\\stronghold crusader\\stronghold crusader.exe"= TCP:D:\stronghold crusader\stronghold crusader\stronghold crusader.exe:Stronghold Crusader
"{A96BB879-577C-4372-A570-BC999BEEC21B}"= C:\Program Files\Windows Live\Messenger\livecall.exe:Windows Live Messenger (Phone)
"{40C3EF69-F963-4E81-8D86-42EFBDB7A235}"= UDP:D:\Game-masters.com\CABAL Online (Europe)\cabal.exe:Cabal
"{8B72A4C3-6069-40F5-BECD-595CFA91C9E6}"= TCP:D:\Game-masters.com\CABAL Online (Europe)\cabal.exe:Cabal
"TCP Query User{36772FFC-3EFD-4F98-915A-952019B47DB3}C:\\program files\\mirc\\mirc.exe"= UDP:C:\program files\mirc\mirc.exe:mIRC
"UDP Query User{81705128-5B2D-43DA-AA00-CF96037AFFE1}C:\\program files\\mirc\\mirc.exe"= TCP:C:\program files\mirc\mirc.exe:mIRC
"TCP Query User{D5CE03AF-EDE8-4529-B91F-37769EBE9B9A}D:\\stronghold 1\\stronghold.exe"= UDP:D:\stronghold 1\stronghold.exe:Stronghold
"UDP Query User{8E234D7D-15F6-4D1E-891E-F8A3352E78A8}D:\\stronghold 1\\stronghold.exe"= TCP:D:\stronghold 1\stronghold.exe:Stronghold
"{2E0AAC62-06BE-4F99-9264-065D440D33CE}"= UDP:D:\Age of empires III\age3x.exe:Age of Empires III - The WarChiefs
"{44B67A79-F451-4F33-84CB-796FF246DDD1}"= TCP:D:\Age of empires III\age3x.exe:Age of Empires III - The WarChiefs
"{2DA158D2-A316-4B12-A875-4B8B0F1047C9}"= UDP:D:\Age of empires III\age3y.exe:Age of Empires III - The Asian Dynasties
"{DCCF1C05-E4EC-4BED-BF55-576440C73D52}"= TCP:D:\Age of empires III\age3y.exe:Age of Empires III - The Asian Dynasties
"TCP Query User{EE127C60-AFB9-4EEA-9BF3-79E06DD95756}D:\\age of empires iii\\age3.exe"= UDP:D:\age of empires iii\age3.exe:Age of Empires 3
"UDP Query User{258A242C-8A33-4232-B98F-273B61A9E042}D:\\age of empires iii\\age3.exe"= TCP:D:\age of empires iii\age3.exe:Age of Empires 3
"TCP Query User{70F1887C-06D6-4F7C-8F01-87510FE9286B}C:\\program files\\limewire\\limewire.exe"= UDP:C:\program files\limewire\limewire.exe:LimeWire
"UDP Query User{372B343D-C6B6-4240-9864-745E87595DAF}C:\\program files\\limewire\\limewire.exe"= TCP:C:\program files\limewire\limewire.exe:LimeWire
"TCP Query User{050FB686-8B25-45D5-95B4-81084082D970}E:\\sh crusader+\\stronghold crusader.exe"= UDP:E:\sh crusader+\stronghold crusader.exe:Stronghold Crusader
"UDP Query User{1BCABFC9-3D2D-4EEA-9707-97F9898CE767}E:\\sh crusader+\\stronghold crusader.exe"= TCP:E:\sh crusader+\stronghold crusader.exe:Stronghold Crusader
"TCP Query User{C6B0CB10-CD6D-4F8B-AF03-B99BDFCC7456}D:\\jedi knight jedi academy\\gamedata\\jamp.exe"= UDP:D:\jedi knight jedi academy\gamedata\jamp.exe:Jedi Academy MultiPlayer
"UDP Query User{CECDB4BA-ED41-44BC-AE1C-38048609E140}D:\\jedi knight jedi academy\\gamedata\\jamp.exe"= TCP:D:\jedi knight jedi academy\gamedata\jamp.exe:Jedi Academy MultiPlayer
"{7262D5B7-52C8-43EC-BBE3-469FD6064260}"= UDP:D:\Stronghold 2 Deluxe\Stronghold2.exe:Stronghold 2
"{92864C0C-04CD-4606-A7D5-3762A94CF9F8}"= TCP:D:\Stronghold 2 Deluxe\Stronghold2.exe:Stronghold 2
"TCP Query User{B1E37B05-34F6-45CE-992B-F938E910EEF0}C:\\program files\\dc++\\dcplusplus.exe"= UDP:C:\program files\dc++\dcplusplus.exe:DC++
"UDP Query User{00CAC618-6762-411A-8777-989B902F64D4}C:\\program files\\dc++\\dcplusplus.exe"= TCP:C:\program files\dc++\dcplusplus.exe:DC++
"TCP Query User{AFBFA2D3-9760-41BA-AE65-E3A81CBD45AD}D:\\kotf jedi academy expansion pack\\gamedata\\jamp.exe"= UDP:D:\kotf jedi academy expansion pack\gamedata\jamp.exe:Jedi Academy MultiPlayer
"UDP Query User{C5CD3AB2-4730-4115-B367-FE721157E5DF}D:\\kotf jedi academy expansion pack\\gamedata\\jamp.exe"= TCP:D:\kotf jedi academy expansion pack\gamedata\jamp.exe:Jedi Academy MultiPlayer
"{A858EEA7-6D85-4E51-9760-6C51C1668850}"= UDP:C:\Program Files\Winamp Remote\bin\Orb.exe:Orb
"{20D4C095-D0D7-4E0C-BBC1-DB0AC9A22900}"= TCP:C:\Program Files\Winamp Remote\bin\Orb.exe:Orb
"{BF93FFF5-5135-40C8-8936-ED4235F847CA}"= UDP:C:\Program Files\Winamp Remote\bin\OrbTray.exe:OrbTray
"{99299AC6-5F64-4AB5-BD9C-45D7D95FC257}"= TCP:C:\Program Files\Winamp Remote\bin\OrbTray.exe:OrbTray
"{6F3B3C79-B323-4E86-A8B2-38BA3255DDCE}"= UDP:C:\Program Files\Winamp Remote\bin\OrbIR.exe:OrbIR
"{00B25B35-8BD3-46B4-BBF8-C5C0A32A57AF}"= TCP:C:\Program Files\Winamp Remote\bin\OrbIR.exe:OrbIR
"{05CE77B0-F876-44AF-A0AA-ECED1E875422}"= UDP:C:\Program Files\Winamp Remote\bin\OrbStreamerClient.exe:Orb Stream Client
"{4BE907A0-0E5A-4262-BDFB-540D7B752E7B}"= TCP:C:\Program Files\Winamp Remote\bin\OrbStreamerClient.exe:Orb Stream Client
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\PublicProfile]
"EnableFirewall"= 0 (0x0)
R0 AtiPcie;ATI PCI Express (3GIO) Filter;C:\Windows\system32\DRIVERS\AtiPcie.sys [2006-10-30 18:23]
R0 PSDFilter;PSDFilter;C:\Windows\system32\DRIVERS\psdfilter.sys [2007-02-07 00:04]
R0 PSDNServ;PSDNSERVER;C:\Windows\system32\drivers\PSDNServ.sys [2007-02-07 00:04]
R0 psdvdisk;psdvdisk;C:\Windows\system32\drivers\psdvdisk.sys [2007-02-07 00:04]
R1 F-Secure HIPS;F-Secure HIPS;C:\Program Files\F-Secure\HIPS\fshs.sys [2008-02-13 17:34]
R1 FSES;F-Secure Email Scanning Driver;C:\Windows\system32\drivers\fses.sys [2007-06-01 16:14]
R1 FSFW;F-Secure Firewall Driver;C:\Windows\system32\drivers\fsdfw.sys [2008-01-11 17:50]
R1 fsvista;F-Secure Vista Support Driver;C:\Program Files\F-Secure\Anti-Virus\minifilter\fsvista.sys [2007-05-28 12:15]
R2
Acer HomeMedia Connect Service;Acer HomeMedia Connect Service;"C:\Program Files\Acer Arcade Live\Acer HomeMedia Connect\Kernel\DMS\CLMSServer.exe" [2007-04-04 18:54]
R2 eDataSecurity Service;eDSService.exe;"C:\Acer\Empowering Technology\eDataSecurity\eDSService.exe" [2007-02-07 00:04]
R2 SBSDWSCService;SBSD Security Center Service;C:\Program Files\Spybot - Search & Destroy\SDWinSec.exe [2008-01-28 12:43]
R2 SQLWriter;SQL Server VSS Writer;"C:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe" [2007-02-10 06:29]
R3 asusgsb;ASUS Virtual Video
Capture Device Driver;C:\Windows\system32\drivers\asusgsb.sys [2007-07-23 12:48]
R3 atkdisplf;ASUS Kernel Mode Enhanced Driver;C:\Windows\system32\drivers\ATKDispLowFilter.sys [2007-07-23 13:01]
R3 F-Secure Gatekeeper;F-Secure Gatekeeper;C:\Program Files\F-Secure\Anti-Virus\minifilter\fsgk.sys [2007-05-28 12:15]
R3 V0220Dev;Live! Cam Video IM;C:\Windows\system32\DRIVERS\V0220Dev.sys [2007-08-15 11:50]
R3 V0220Vfx;V0220VFX;C:\Windows\system32\DRIVERS\V0220Vfx.sys [2007-03-05 19:45]
R3 yukonwlh;NDIS6.0 Miniport Driver for Marvell Yukon Ethernet Controller;C:\Windows\system32\DRIVERS\yk60x86.sys [2007-03-23 05:12]
S2 ATKFUSService;ATK Fast User Switch Service;C:\Windows\system32\ATKFUSService.exe [2007-07-23 12:48]
S3 atikmdag;atikmdag;C:\Windows\system32\DRIVERS\atikmdag.sys [2007-09-29 06:13]
S3 MSSQL$SONY_MEDIAMGR2;SQL Server (SONY_MEDIAMGR2);"C:\Program Files\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\sqlservr.exe" -sSONY_MEDIAMGR2 []
S3 Steam Client Service;Steam Client Service;C:\Program Files\Common Files\Steam\SteamService.exe [2008-02-24 00:42]
S4 F-Secure Filter;F-Secure File System Filter;C:\Program Files\F-Secure\Anti-Virus\Win2K\FSfilter.sys [2007-05-28 12:15]
S4 F-Secure Recognizer;F-Secure File System Recognizer;C:\Program Files\F-Secure\Anti-Virus\Win2K\FSrec.sys [2007-05-28 12:15]
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{8d56bdd2-0246-11dd-944e-001c2502cf13}]
\shell\AutoRun\command - K:\autorun.exe
*Newly Created Service* - CATCHME
.
'Ajoitetut tehtävät'-kansion sisältö
"2008-04-24 13:10:52 C:\Windows\Tasks\Scheduled scanning task.job"
- C:\PROGRA~1\F-Secure\ANTI-V~1\fsav.exeQ /HARD /POLICY /SCHED /NOBREAK /REPORT=C:\PROGRA~1\F-Secure\ANTI-V~1\report.txt
.
**************************************************************************
catchme 0.3.1353 W2K/XP/Vista - rootkit/stealth malware detector by
Gmer,
http://www.gmer.net
Rootkit scan 2008-04-24 16:32:04
Windows 6.0.6001 Service Pack 1 NTFS
scanning hidden processes ...
scanning hidden autostart entries ...
scanning hidden files ...
scan completed successfully
hidden files: 2
**************************************************************************
.
Completion time: 2008-04-24 16:34:05
ComboFix-quarantined-files.txt 2008-04-24 13:33:21
Pre-Run: 11,680,243,712 tavua vapaana
Post-Run: 14,072,401,920 tavua vapaana
301 --- E O F --- 2008-04-17 18:54:35
