Tehtävänhallinta ei toimi ja ei nettiin päästä

Viestiketju Virukset ja haittaohjelmat - HijackThis -logit -osiossa. Ketjun avasi R4ikiri 05.09.2008.

  1. R4ikiri

    R4ikiri Member

    Liittynyt:
    12.06.2013
    Viestejä:
    7
    Kiitokset:
    0
    Pisteet:
    11
    Elikkäs tehtävänhallinta ei toimi edes regillä ja taustakuva muuttuu siniseks ja kertoo että koneella ois viirus ja käskee ladata jotai anti spyware shittii ja tehtäväpalkissaki on joku kuva joka sanoo samaa ja ei kone päästä nettiin enään eli oisko joku niin kiltti ja kertois onko jotain tehtävissä kiitos ja tässä ois Hijack logi jonka tein safe modessa eli jos täytyy tehdä uus ni teen

    Logfile of Trend Micro HijackThis v2.0.2
    Scan saved at 12:39:17, on 5.9.2004
    Platform: Windows XP SP2 (WinNT 5.01.2600)
    MSIE: Internet Explorer v7.00 (7.00.6000.16544)
    Boot mode: Safe mode

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\system32\uoyzsydz.exe
    C:\WINDOWS\Explorer.EXE
    G:\HijackThis\HijackThis.exe

    R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
    R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Linkit
    F2 - REG:system.ini: UserInit=C:\WINDOWS\system32\userinit.exe,C:\WINDOWS\system32\uoyzsydz.exe,
    O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll (file missing)
    O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe
    O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe"
    O4 - HKLM\..\Run: [WinampAgent] "C:\Program Files\Winamp\winampa.exe"
    O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
    O4 - HKLM\..\Run: [MSPY2002] C:\WINDOWS\system32\IME\PINTLGNT\ImScInst.exe /SYNC
    O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC
    O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName
    O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
    O4 - HKLM\..\Run: [HP Component Manager] "C:\Program Files\HP\hpcoretech\hpcmpmgr.exe"
    O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
    O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
    O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
    O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
    O4 - HKLM\..\Run: [389c358a] rundll32.exe "C:\WINDOWS\system32\wwxwxokl.dll",b
    O4 - HKLM\..\Run: [BM3baf0616] Rundll32.exe "C:\WINDOWS\system32\qtdvqrkw.dll",s
    O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe"
    O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
    O4 - HKCU\..\Run: [NCLaunch] C:\WINDOWS\NCLAUNCH.EXe
    O4 - HKCU\..\Run: [Uniblue RegistryBooster 2] D:\Program Files\Uniblue\RegistryBooster 2\RegistryBooster.exe /S
    O4 - HKCU\..\Run: [Uniblue SpeedUpMyPC] D:\Program Files\Uniblue\SpeedUpMyPC 3\SpeedUpMyPC.exe -s
    O4 - HKCU\..\Run: [Uniblue SpyEraser] "D:\Program Files\Uniblue\SpyEraser\SpyEraser.exe" -m
    O4 - HKCU\..\Run: [Creative Detector] "D:\Program Files\Creative\MediaSource\Detector\CTDetect.exe" /R
    O4 - HKCU\..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe
    O4 - HKCU\..\Run: [uTorrent] "C:\Program Files\uTorrent\uTorrent.exe"
    O4 - HKCU\..\Run: [DownloadAccelerator] "D:\Program Files\DAP\DAP.EXE" /STARTUP
    O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Verkkopalve')
    O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
    O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
    O4 - Startup: Xfire.lnk = D:\Program Files\Xfire\Xfire.exe
    O8 - Extra context menu item: &Clean Traces - D:\Program Files\DAP\Privacy Package\dapcleanerie.htm
    O8 - Extra context menu item: &Download with &DAP - D:\Program Files\DAP\dapextie.htm
    O8 - Extra context menu item: Add to Windows &Live Favorites - http://favorites.live.com/quickadd.aspx
    O8 - Extra context menu item: Download &all with DAP - D:\Program Files\DAP\dapextie2.htm
    O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
    O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
    O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
    O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O10 - Broken Internet access because of LSP provider 'c:\program files\webhancer\programs\webhdll.dll' missing
    O16 - DPF: {5F5F9FB8-878E-4455-95E0-F64B2314288A} (ijjiPlugin2 Class) - http://gamedownload.ijjimax.com/gamedownload/dist/hgstart/HGPlugin11USA.cab
    O16 - DPF: {AA07EBD2-EBDD-4BD6-9F8F-114BD513492C} (NeffyLauncherCtl Class) - http://disteng.nefficient.com/disteng/neffy/NeffyLauncher.cab
    O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
    O16 - DPF: {CD995117-98E5-4169-9920-6C12D4C0B548} (HGPlugin9USA Class) - http://gamedownload.ijjimax.com/gamedownload/dist/hgstart/HGPlugin9USA.cab
    O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
    O23 - Service: ##Id_String1.6844F930_1628_4223_B5CC_5BB94B879762## (Bonjour Service) - Apple Computer, Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
    O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\system32\CTsvcCDA.EXE
    O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
    O23 - Service: MSSQL$SONY_MEDIAMGR - Unknown owner - C:\Program Files\Sony\Shared Plug-Ins\Media Manager\MSSQL$SONY_MEDIAMGR\Binn\sqlservr.exe (file missing)
    O23 - Service: MySql - Unknown owner - C:/Greengiant and chrispee's ascent repack/mysql/mysql/bin/mysqld-nt.exe (file missing)
    O23 - Service: MySQL4 - Unknown owner - (no file)
    O23 - Service: MySQL5 - Unknown owner - D:\Program.exe (file missing)
    O23 - Service: MySQL51 - Unknown owner - D:\Program.exe (file missing)
    O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe
    O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
    O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
    O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\system32\PnkBstrA.exe
    O23 - Service: PnkBstrB - Unknown owner - C:\WINDOWS\system32\PnkBstrB.exe
    O23 - Service: Remote Packet Capture Protocol v.0 (experimental) (rpcapd) - CACE Technologies - C:\Program Files\WinPcap\rpcapd.exe
    O23 - Service: ServiceLayer - Nokia. - C:\Program Files\PC Connectivity Solution\ServiceLayer.exe
    O23 - Service: SQLAgent$SONY_MEDIAMGR - Unknown owner - C:\Program Files\Sony\Shared Plug-Ins\Media Manager\MSSQL$SONY_MEDIAMGR\Binn\sqlagent.EXE (file missing)
    O23 - Service: StarWind iSCSI Service (StarWindService) - Rocket Division Software - D:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe

    --
    End of file - 7275 bytes
     
    R4ikiri, 05.09.2008
    #1
  2.  
  3. yaht

    yaht Regular member

    Liittynyt:
    07.12.2005
    Viestejä:
    2,261
    Kiitokset:
    0
    Pisteet:
    46
    1. Lataa Combofix.exe työpöydällesi jommastakummasta linkistä:
    Combofix.exe
    Combofix.exe

    Avaa Combofix.exe ja seuraa näyttöön tulevia ohjeita

    Huom! Älä klikkaile combofixin ikkunaa käytön aikana. Tämä saattaa aiheuttaa ohjelman jumiutumisen.
    Käynnistä kone uudelleen, jos niin pyydetään ja lähetä combofix.txt-tiedoston sisältö tänne.

    Tyhjennä roskakori ja käynnistä koneesi uudelleen.

    Postita tänne seuraavat lokit:
    * Tuore HijackThis loki (Otetaan viimeisenä ennen postitusta)
    * (C:\ComboFix.txt) raportti
    *


    Lataa Malwarebytes' Anti-Malware työpöydällesi.

    * Tuplaklikkaa mbam-setup.exe ja seuraa ohjeita asentaaksesi ohjelman.
    * Lopuksi varmistu, että seuraavat on valittu: Päivitä Malwarebytes' Anti-Malware ja Käynnistä Malwarebytes' Anti-Malware ja sen jälkeen klikkaa Lopeta.
    * Jos päivitys löytyy. ohjelma lataa ja asentaa uusimman version.
    * Kun ohjelma on latautunut, valitse Suorita täysi tarkistus ja klikkaa Tarkista.
    * Kun skanni on valmis, klikkaa OK ja sitten Näytä tulokset nähdäksesi tulokset.
    * Varmistu, että kaikki on merkitty ja klikkaa Poista valitut.
    * Tämän jälkeen loki avautuu muistioon. Tallenna se paikkaan, josta löydät sen helposti. Loki löytyy myös
    täältä: C:\Documents and Settings\Käyttäjänimi\Application Data\Malwarebytes\Malwarebytes' Anti-Malware\Logs\log-päiväys.txt
    * Lähetä lokin sisältö seuraavassa viestissäsi + uusi hjt-loki.
     
    yaht, 05.09.2008
    #2
  4. R4ikiri

    R4ikiri Member

    Liittynyt:
    12.06.2013
    Viestejä:
    7
    Kiitokset:
    0
    Pisteet:
    11
    nämä ovat ennen Malwarebytes' Anti-Malware:a otetut logfilet kohta tulevat ne

    ComboFix 08-09-04.09 - Tomi 2008-09-05 13:49:05.1 - NTFSx86
    Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1035.18.1044 [GMT 3:00]
    Running from: G:\ComboFix.exe
    * Created a new restore point

    WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
    .

    (((((((((((((((((((((((((((((((((((((( Muut poistot ))))))))))))))))))))))))))))))))))))))))))))))))))))))))
    .

    C:\Documents and Settings\Tomi\Application Data\Microsoft\dtsc\32001.exe
    C:\Documents and Settings\Tomi\Application Data\Microsoft\dtsc\s
    C:\Program Files\webhancer
    C:\Program Files\webhancer\Programs\sporder.dll
    C:\WINDOWS\BM3baf0616.txt
    C:\WINDOWS\BM3baf0616.xml
    C:\WINDOWS\default.htm
    C:\WINDOWS\faceback.exe
    C:\WINDOWS\pskt.ini
    C:\WINDOWS\system32\actskn43.ocx
    C:\WINDOWS\system32\btfunc.dll
    C:\WINDOWS\system32\drivers\npf.sys
    C:\WINDOWS\system32\getsn32.dll
    C:\WINDOWS\system32\hljwugsf.bin
    C:\WINDOWS\system32\lkoxwxww.ini
    C:\WINDOWS\system32\mcrh.tmp
    C:\WINDOWS\system32\Nppqttwa.ini
    C:\WINDOWS\system32\Nppqttwa.ini2
    C:\WINDOWS\system32\packet.dll
    C:\WINDOWS\system32\pthreadVC.dll
    C:\WINDOWS\system32\uoyzsydz.exe
    C:\WINDOWS\system32\wanpacket.dll
    C:\WINDOWS\system32\wpcap.dll

    .
    ((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
    .

    -------\Service_NPF


    ((((( Tiedostot, jotka on luotu seuraavalla aikav„lill„: 2008-08-05 to 2008-09-05 )))))))))))))))))
    .

    2008-08-28 00:03 . 2008-08-28 00:03 42,320 --a------ C:\WINDOWS\system32\xfcodec.dll

    .
    (((((((((((((((((((((((((((((((((((( Find3M-raportti ))))))))))))))))))))))))))))))))))))))))))))))))))))))
    .
    2008-09-05 10:59 --------- d---a-w C:\Documents and Settings\All Users\Application Data\TEMP
    2008-09-05 10:52 --------- d-----w C:\Documents and Settings\Tomi\Application Data\uTorrent
    2008-06-18 17:52 161,096 ----a-w C:\WINDOWS\system32\DivXCodecVersionChecker.exe
    2008-06-17 16:28 710,064 ----a-w C:\WINDOWS\system32\ijjiSetup.exe
    2008-06-11 20:01 58,800 ----a-w C:\WINDOWS\system32\ijjiPlugin2.dll
    2008-06-11 00:07 524,288 ----a-w C:\WINDOWS\system32\DivXsm.exe
    2008-06-11 00:07 3,596,288 ----a-w C:\WINDOWS\system32\qt-dx331.dll
    2008-06-11 00:04 200,704 ----a-w C:\WINDOWS\system32\ssldivx.dll
    2008-06-11 00:04 1,044,480 ----a-w C:\WINDOWS\system32\libdivx.dll
    .

    ------- Sigcheck -------

    2002-09-16 15:00 517120 20d3cba311f6d3852e78d999f8607457 C:\WINDOWS\$NtServicePackUninstall$\winlogon.exe
    2004-09-14 16:12 502784 5f0714b1447dc0262789c3cc43752418 C:\WINDOWS\ServicePackFiles\i386\winlogon.exe
    2006-10-04 14:55 502784 aac909dbc204a26146fdd31439c3f975 C:\WINDOWS\system32\winlogon.exe
    .
    (((((((((((((((((((((((((((((( Rekisterin k„ynnistyskohteet )))))))))))))))))))))))))))))))))))))))))))))
    .
    .
    *Huom* Tyhji„ arvoja ja laillisia oletusarvoja ei n„ytet„
    REGEDIT4

    [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{39B15A4A-8C87-43B7-9859-E98F429DDEBB}]
    2004-09-04 21:40 39424 --a------ C:\WINDOWS\system32\qoMcbyVo.dll

    [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{c2f97a16-1fda-4e24-8644-a462fe544213}]
    2004-09-04 21:46 107520 --a------ C:\WINDOWS\system32\yrsnkr.dll

    [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{D4B8AA24-5FF0-4366-B0D7-C88040029255}]
    2004-09-04 21:45 249856 --a------ C:\WINDOWS\system32\awttqppN.dll

    [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe" [2006-11-16 139264]
    "ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-09-14 15360]
    "NCLaunch"="C:\WINDOWS\NCLAUNCH.EXe" [2007-01-04 40960]
    "Uniblue RegistryBooster 2"="D:\Program Files\Uniblue\RegistryBooster 2\RegistryBooster.exe" [2007-12-05 1885464]
    "Uniblue SpeedUpMyPC"="D:\Program Files\Uniblue\SpeedUpMyPC 3\SpeedUpMyPC.exe" [2007-12-07 9479448]
    "Uniblue SpyEraser"="D:\Program Files\Uniblue\SpyEraser\SpyEraser.exe" [2008-01-08 1260296]
    "Creative Detector"="D:\Program Files\Creative\MediaSource\Detector\CTDetect.exe" [2004-12-02 102400]
    "WMPNSCFG"="C:\Program Files\Windows Media Player\WMPNSCFG.exe" [2006-11-15 204288]
    "uTorrent"="C:\Program Files\uTorrent\uTorrent.exe" [2004-09-04 267056]
    "DownloadAccelerator"="D:\Program Files\DAP\DAP.EXE" [2004-09-04 3053056]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "NeroFilterCheck"="C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe" [2006-01-12 155648]
    "SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe" [2008-02-22 144784]
    "WinampAgent"="C:\Program Files\Winamp\winampa.exe" [2008-01-16 37376]
    "IMJPMIG8.1"="C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" [2004-08-03 208952]
    "MSPY2002"="C:\WINDOWS\system32\IME\PINTLGNT\ImScInst.exe" [2004-08-03 59392]
    "PHIME2002ASync"="C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE" [2004-08-03 455168]
    "PHIME2002A"="C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE" [2004-08-03 455168]
    "HP Component Manager"="C:\Program Files\HP\hpcoretech\hpcmpmgr.exe" [2003-12-22 241664]
    "TkBellExe"="C:\Program Files\Common Files\Real\Update_OB\realsched.exe" [2006-06-22 185896]
    "NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2008-05-16 13529088]
    "NvMediaCenter"="C:\WINDOWS\system32\NvMcTray.dll" [2008-05-16 86016]
    "389c358a"="C:\WINDOWS\system32\wwxwxokl.dll" [2004-09-04 86528]
    "BM3baf0616"="C:\WINDOWS\system32\qtdvqrkw.dll" [2004-09-04 94720]
    "SoundMan"="SOUNDMAN.EXE" [2007-04-16 C:\WINDOWS\soundman.exe]
    "nwiz"="nwiz.exe" [2008-05-16 C:\WINDOWS\system32\nwiz.exe]

    [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
    "CTFMON.EXE"="C:\WINDOWS\System32\CTFMON.EXE" [2004-09-14 15360]
    "Nokia.PCSync"="D:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe" [2007-03-27 1744896]

    [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]
    "NoTaskMng"= 1 (0x1)

    [hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
    "{39B15A4A-8C87-43B7-9859-E98F429DDEBB}"= "C:\WINDOWS\system32\qoMcbyVo.dll" [2004-09-04 39424]

    [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\qoMcbyVo]
    2004-09-04 21:40 39424 C:\WINDOWS\system32\qoMcbyVo.dll

    [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
    "VIDC.I420"= i420vfw.dll
    "msacm.l3acm"= l3codecp.acm
    "VIDC.X264"= x264vfw.dll
    "msacm.divxa32"= divxa32.acm
    "VIDC.XFR1"= xfcodec.dll
    "msacm.l3codec"= l3codecp.acm
    "vidc.ffds"= D:\PROGRA~1\COMBIN~1\Filters\FFDShow\ff_vfw.dll

    [HKEY_LOCAL_MACHINE\software\microsoft\security center]
    "AntiVirusOverride"=dword:00000001

    [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
    "%windir%\\system32\\sessmgr.exe"=
    "C:\\WINDOWS\\system32\\dpvsetup.exe"=
    "C:\\WINDOWS\\system32\\dplaysvr.exe"=
    "C:\\Program Files\\Mozilla Firefox\\firefox.exe"=
    "C:\\Program Files\\Messenger\\msmsgs.exe"=
    "%windir%\\Network Diagnostic\\xpnetdiag.exe"=
    "D:\\Program Files\\Steam\\steamapps\\r4ikiri\\half-life deathmatch source\\hl2.exe"=
    "D:\\Program Files\\Steam\\steamapps\\r4ikiri\\half-life 2 deathmatch\\hl2.exe"=
    "D:\\Program Files\\Steam\\steamapps\\r4ikiri\\source dedicated server\\srcds.exe"=
    "D:\\Program Files\\Steam\\steamapps\\r4ikiri\\counter-strike source\\hl2.exe"=
    "D:\\Program Files\\Steam\\steamapps\\r4ikiri\\day of defeat source\\hl2.exe"=
    "F:\\Pelit\\Quake III Arena\\quake3.exe"=
    "D:\\Program Files\\Steam\\steamapps\\r4ikiri\\source sdk base\\hl2.exe"=
    "C:\\WINDOWS\\system32\\mshta.exe"=
    "D:\\Program Files\\Xfire\\Xfire.exe"=
    "C:\\WINDOWS\\system32\\java.exe"=
    "F:\\Pelit\\World of Warcraft\\BackgroundDownloader.exe"=
    "F:\\Pelit\\Gunz\\GunzLauncher.exe"=
    "F:\\Pelit\\Gunz\\Gunz.exe"=
    "F:\\Pelit\\Gunz America\\Gunz.exe"=
    "F:\\Pelit\\Gunz America\\Gunz070721(ijji-GGAnnihilator).exe"=
    "F:\\Useless stuff\\Rose Server\\LoginServer.exe"=
    "F:\\Useless stuff\\Rose Server\\CharServer.exe"=
    "F:\\Useless stuff\\Rose Server\\WorldServer.exe"=
    "F:\\Useless stuff\\xampplite\\apache\\bin\\apache.exe"=
    "F:\\Pelit\\StepMania CVS\\Program\\StepMania.exe"=
    "D:\\Program Files\\DAP\\DAP.exe"=
    "D:\\Program Files\\Steam\\steam.exe"=
    "D:\\Program Files\\LimeWire\\LimeWire.exe"=
    "D:\\Program Files\\Nokia\\Carbide.ui Theme Edition 3.2\\JRE\\bin\\javaw.exe"=
    "C:\\Program Files\\MSN Messenger\\msnmsgr.exe"=
    "C:\\WINDOWS\\svchostr.exe"=
    "F:\\Pelit\\Star Wars Jedi Knight Jedi Academy\\GameData\\jamp.exe"=
    "C:\\ijji\\ENGLISH\\u_gunz.exe"=
    "C:\\Program Files\\Bonjour\\mDNSResponder.exe"=
    "C:\\Program Files\\uTorrent\\uTorrent.exe"=

    [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
    "8080:TCP"= 8080:TCP:wow4
    "8085:TCP"= 8085:TCP:wow5
    "3724:TCP"= 3724:TCP:wow6
    "554:TCP"= 554:TCP:SF-Anytime
    "1755:TCP"= 1755:TCP:SF-Anytime
    "1755:UDP"= 1755:UDP:SF-Anytime
    "5005:UDP"= 5005:UDP:SF-Anytime
    "5004:UDP"= 5004:UDP:SF-Anytime
    "3306:TCP"= 3306:TCP:MySQL
    "43594:TCP"= 43594:TCP:Runescape sucks ass!
    "43594:UDP"= 43594:UDP:Runescape sucks ass!!
    "6112:TCP"= 6112:TCP:Waaaarcraft
    "6112:UDP"= 6112:UDP:lol
    "8093:TCP"= 8093:TCP:haistakaaa paskaaa
    "8129:TCP"= 8129:TCP:haistakaaa paskaaaa
    "2093:TCP"= 2093:TCP:haistakaaaa paskaa
    "8050:TCP"= 8050:TCP:haistakaa kakkaa
    "8245:TCP"= 8245:TCP:haistakaa paskaa
    "80:TCP"= 80:TCP:haistakaaaaaaaa paskaa
    "3306:UDP"= 3306:UDP:teemu on manne
    "3724:UDP"= 3724:UDP:psoegmnpekg
    "8093:UDP"= 8093:UDP:rdhrh
    "8129:UDP"= 8129:UDP:rehreh
    "7700:TCP"= 7700:TCP:GUUUNZZZ
    "7700:UDP"= 7700:UDP:GUUUNNZZZZ
    "7701:TCP"= 7701:TCP:GUNZZZ
    "7701:UDP"= 7701:UDP:GUUUUNZZZZ

    R1 oreans32;oreans32;C:\WINDOWS\system32\drivers\oreans32.sys [2006-07-06 33824]
    R2 MySQL51;MySQL51;D:\Program Files\MySQL\MySQL Server 5.0\bin\mysqld-nt --defaults-file=D:\Program Files\MySQL\MySQL Server 5.0\my.ini MySQL51 [ ]
    S3 BRGSp50;BRGSp50 NDIS Protocol Driver;C:\WINDOWS\system32\Drivers\BRGSp50.sys [2005-06-08 20608]
    S3 LwAdiHid;Digitaaliset Logitech WingMan -laitteet (automaattinen tunnistus);C:\WINDOWS\system32\DRIVERS\LwAdiHid.sys [2004-08-03 20864]
    S3 MySQL5;MySQL5;D:\Program Files\MySQL\MySQL Server 4.1\bin\mysqld-nt --defaults-file=D:\Program Files\MySQL\MySQL Server 4.1\my.ini MySQL5 [ ]
    S3 puma1;puma1;F:\Pelit\LG Gunz\The_Lurker Hack Pack\puma.sys [ ]
    S3 XDva009;XDva009;C:\WINDOWS\system32\XDva009.sys [ ]
    S3 XDva019;XDva019;C:\WINDOWS\system32\XDva019.sys [ ]
    S3 ZD1211BU(ZyDAS);ZyDAS ZD1211B IEEE 802.11 b+g Wireless LAN Driver (USB)(ZyDAS);C:\WINDOWS\system32\DRIVERS\zd1211Bu.sys [2006-08-24 477696]

    [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\M]
    \Shell\AutoRun\command - M:\OblivionLauncher.exe

    [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\N]
    \Shell\AutoRun\command - N:\ResidentEvil2.exe

    [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{481426e2-02b4-11da-81b2-0002725a87a3}]
    \Shell\AutoRun\command - K:\ResidentEvil3_menu.exe
    .
    'Ajoitetut teht„v„t'-kansion sis„lt”
    .
    - - - - ORPHANS REMOVED - - - -

    HKLM-Run-ats - (no file)


    .
    ------- Supplementary Scan -------
    .
    FireFox -: Profile - C:\Documents and Settings\Tomi\Application Data\Mozilla\Firefox\Profiles\zlprpdee.default\
    FireFox -: prefs.js - STARTUP.HOMEPAGE - hxxp://fi.start.mozilla.com/firefox?client=firefox-a&rls=org.mozilla:fi:eek:fficial
    FF -: plugin - C:\Program Files\Adobe\Acrobat 7.0\Reader\browser\nppdf32.dll
    FF -: plugin - C:\Program Files\Mozilla Firefox\plugins\NPAdbESD.dll
    FF -: plugin - C:\Program Files\Mozilla Firefox\plugins\npijjiFFPlugin1.dll
    FF -: plugin - D:\Program Files\DivX\DivX Content Uploader\npUpload.dll
    FF -: plugin - D:\Program Files\DivX\DivX Player\npDivxPlayerPlugin.dll
    FF -: plugin - D:\Program Files\DivX\DivX Web Player\npdivx32.dll
    FF -: plugin - D:\Program Files\QuickTime\Plugins\npqtplugin.dll
    FF -: plugin - D:\Program Files\QuickTime\Plugins\npqtplugin2.dll
    FF -: plugin - D:\Program Files\QuickTime\Plugins\npqtplugin3.dll
    FF -: plugin - D:\Program Files\QuickTime\Plugins\npqtplugin4.dll
    FF -: plugin - D:\Program Files\QuickTime\Plugins\npqtplugin5.dll
    FF -: plugin - D:\Program Files\QuickTime\Plugins\npqtplugin6.dll
    FF -: plugin - D:\Program Files\QuickTime\Plugins\npqtplugin7.dll
    FF -: plugin - D:\Program Files\Real\RealPlayer\Netscape6\nppl3260.dll
    FF -: plugin - D:\Program Files\Real\RealPlayer\Netscape6\nprjplug.dll
    FF -: plugin - D:\Program Files\Real\RealPlayer\Netscape6\nprpjplug.dll
    .

    **************************************************************************

    catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
    Rootkit scan 2008-09-05 13:55:25
    Windows 5.1.2600 Service Pack 2 NTFS

    scanning hidden processes ...

    scanning hidden autostart entries ...

    scanning hidden files ...


    C:\WINDOWS\system32\lkoxwxww.ini 294 bytes

    scan completed successfully
    hidden files: 1

    **************************************************************************

    [HKEY_LOCAL_MACHINE\System\ControlSet003\Services\MySql]
    "ImagePath"="C:/Greengiant and chrispee's ascent repack/mysql/mysql/bin/mysqld-nt.exe"

    [HKEY_LOCAL_MACHINE\System\ControlSet003\Services\MySql]
    "ImagePath"="C:/Greengiant and chrispee's ascent repack/mysql/mysql/bin/mysqld-nt.exe"

    [HKEY_LOCAL_MACHINE\System\ControlSet003\Services\MySQL5]
    "ImagePath"="\"D:\Program Files\MySQL\MySQL Server 4.1\bin\mysqld-nt\" --defaults-file=\"D:\Program Files\MySQL\MySQL Server 4.1\my.ini\" MySQL5"

    [HKEY_LOCAL_MACHINE\System\ControlSet003\Services\MySQL51]
    "ImagePath"="\"D:\Program Files\MySQL\MySQL Server 5.0\bin\mysqld-nt\" --defaults-file=\"D:\Program Files\MySQL\MySQL Server 5.0\my.ini\" MySQL51"
    .
    --------------------- DLLs Loaded Under Running Processes ---------------------

    PROCESS: C:\WINDOWS\system32\winlogon.exe
    -> C:\WINDOWS\system32\qoMcbyVo.dll

    PROCESS: C:\WINDOWS\explorer.exe
    -> C:\WINDOWS\system32\wwxwxokl.dll
    -> C:\WINDOWS\system32\qtdvqrkw.dll
    .
    ------------------------ Other Running Processes ------------------------
    .
    C:\Program Files\Bonjour\mDNSResponder.exe
    C:\WINDOWS\system32\CTSVCCDA.EXE
    D:\Program Files\MySQL\MySQL Server 5.0\bin\mysqld-nt.exe
    C:\WINDOWS\system32\nvsvc32.exe
    C:\WINDOWS\system32\PnkBstrA.exe
    C:\WINDOWS\system32\PnkBstrB.exe
    D:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe
    C:\Program Files\Windows Media Player\wmpnetwk.exe
    C:\WINDOWS\system32\rundll32.exe
    C:\WINDOWS\system32\rundll32.exe
    C:\WINDOWS\system32\rundll32.exe
    C:\Program Files\Common Files\Ahead\Lib\NMIndexStoreSvr.exe
    D:\Program Files\Xfire\Xfire.exe
    C:\Program Files\HP\hpcoretech\comp\hptskmgr.exe
    .
    **************************************************************************
    .
    Completion time: 2008-09-05 14:03:46 - machine was rebooted
    ComboFix-quarantined-files.txt 2008-09-05 11:03:38

    Pre-Run: 1,149,001,728 tavua vapaana
    Post-Run: 1,597,153,280 tavua vapaana

    270 --- E O F --- 2007-11-14 13:31:42

    Logfile of Trend Micro HijackThis v2.0.2
    Scan saved at 14:05:24, on 5.9.2008
    Platform: Windows XP SP2 (WinNT 5.01.2600)
    MSIE: Internet Explorer v7.00 (7.00.6000.16544)
    Boot mode: Normal

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\system32\spoolsv.exe
    C:\Program Files\Bonjour\mDNSResponder.exe
    C:\WINDOWS\system32\CTsvcCDA.EXE
    C:\WINDOWS\System32\svchost.exe
    D:\Program Files\MySQL\MySQL Server 5.0\bin\mysqld-nt.exe
    C:\WINDOWS\system32\nvsvc32.exe
    C:\WINDOWS\system32\PnkBstrA.exe
    C:\WINDOWS\system32\PnkBstrB.exe
    D:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\system32\ctfmon.exe
    C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe
    C:\Program Files\Winamp\winampa.exe
    C:\WINDOWS\SOUNDMAN.EXE
    C:\Program Files\HP\hpcoretech\hpcmpmgr.exe
    C:\Program Files\Common Files\Real\Update_OB\realsched.exe
    C:\WINDOWS\system32\RUNDLL32.EXE
    C:\WINDOWS\system32\rundll32.exe
    C:\WINDOWS\system32\Rundll32.exe
    C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe
    C:\WINDOWS\NCLAUNCH.EXe
    D:\Program Files\Uniblue\RegistryBooster 2\RegistryBooster.exe
    D:\Program Files\Uniblue\SpeedUpMyPC 3\SpeedUpMyPC.exe
    D:\Program Files\Uniblue\SpyEraser\SpyEraser.exe
    D:\Program Files\Creative\MediaSource\Detector\CTDetect.exe
    C:\Program Files\Windows Media Player\WMPNSCFG.exe
    C:\Program Files\uTorrent\uTorrent.exe
    C:\Program Files\Common Files\Ahead\Lib\NMIndexStoreSvr.exe
    D:\Program Files\DAP\DAP.EXE
    D:\Program Files\Xfire\Xfire.exe
    C:\Program Files\HP\hpcoretech\comp\hptskmgr.exe
    C:\WINDOWS\explorer.exe
    C:\WINDOWS\system32\notepad.exe
    C:\WINDOWS\system32\rundll32.exe
    G:\HijackThis\HijackThis.exe

    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
    R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
    R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Linkit
    O3 - Toolbar: (no name) - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file)
    O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe
    O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe"
    O4 - HKLM\..\Run: [WinampAgent] "C:\Program Files\Winamp\winampa.exe"
    O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
    O4 - HKLM\..\Run: [MSPY2002] C:\WINDOWS\system32\IME\PINTLGNT\ImScInst.exe /SYNC
    O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC
    O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName
    O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
    O4 - HKLM\..\Run: [HP Component Manager] "C:\Program Files\HP\hpcoretech\hpcmpmgr.exe"
    O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
    O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
    O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
    O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
    O4 - HKLM\..\Run: [389c358a] rundll32.exe "C:\WINDOWS\system32\wwxwxokl.dll",b
    O4 - HKLM\..\Run: [BM3baf0616] Rundll32.exe "C:\WINDOWS\system32\qtdvqrkw.dll",s
    O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe"
    O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
    O4 - HKCU\..\Run: [NCLaunch] C:\WINDOWS\NCLAUNCH.EXe
    O4 - HKCU\..\Run: [Uniblue RegistryBooster 2] D:\Program Files\Uniblue\RegistryBooster 2\RegistryBooster.exe /S
    O4 - HKCU\..\Run: [Uniblue SpeedUpMyPC] D:\Program Files\Uniblue\SpeedUpMyPC 3\SpeedUpMyPC.exe -s
    O4 - HKCU\..\Run: [Uniblue SpyEraser] "D:\Program Files\Uniblue\SpyEraser\SpyEraser.exe" -m
    O4 - HKCU\..\Run: [Creative Detector] "D:\Program Files\Creative\MediaSource\Detector\CTDetect.exe" /R
    O4 - HKCU\..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe
    O4 - HKCU\..\Run: [uTorrent] "C:\Program Files\uTorrent\uTorrent.exe"
    O4 - HKCU\..\Run: [DownloadAccelerator] "D:\Program Files\DAP\DAP.EXE" /STARTUP
    O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Paikallinen palve')
    O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Verkkopalve')
    O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
    O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
    O4 - Startup: Xfire.lnk = D:\Program Files\Xfire\Xfire.exe
    O8 - Extra context menu item: &Clean Traces - D:\Program Files\DAP\Privacy Package\dapcleanerie.htm
    O8 - Extra context menu item: &Download with &DAP - D:\Program Files\DAP\dapextie.htm
    O8 - Extra context menu item: Add to Windows &Live Favorites - http://favorites.live.com/quickadd.aspx
    O8 - Extra context menu item: Download &all with DAP - D:\Program Files\DAP\dapextie2.htm
    O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
    O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O16 - DPF: {5F5F9FB8-878E-4455-95E0-F64B2314288A} (ijjiPlugin2 Class) - http://gamedownload.ijjimax.com/gamedownload/dist/hgstart/HGPlugin11USA.cab
    O16 - DPF: {AA07EBD2-EBDD-4BD6-9F8F-114BD513492C} - http://disteng.nefficient.com/disteng/neffy/NeffyLauncher.cab
    O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
    O16 - DPF: {CD995117-98E5-4169-9920-6C12D4C0B548} - http://gamedownload.ijjimax.com/gamedownload/dist/hgstart/HGPlugin9USA.cab
    O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
    O23 - Service: ##Id_String1.6844F930_1628_4223_B5CC_5BB94B879762## (Bonjour Service) - Apple Computer, Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
    O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\system32\CTsvcCDA.EXE
    O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
    O23 - Service: MSSQL$SONY_MEDIAMGR - Unknown owner - C:\Program Files\Sony\Shared Plug-Ins\Media Manager\MSSQL$SONY_MEDIAMGR\Binn\sqlservr.exe (file missing)
    O23 - Service: MySql - Unknown owner - C:/Greengiant and chrispee's ascent repack/mysql/mysql/bin/mysqld-nt.exe (file missing)
    O23 - Service: MySQL4 - Unknown owner - (no file)
    O23 - Service: MySQL5 - Unknown owner - D:\Program.exe (file missing)
    O23 - Service: MySQL51 - Unknown owner - D:\Program.exe (file missing)
    O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe
    O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
    O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
    O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\system32\PnkBstrA.exe
    O23 - Service: PnkBstrB - Unknown owner - C:\WINDOWS\system32\PnkBstrB.exe
    O23 - Service: Remote Packet Capture Protocol v.0 (experimental) (rpcapd) - CACE Technologies - C:\Program Files\WinPcap\rpcapd.exe
    O23 - Service: ServiceLayer - Nokia. - C:\Program Files\PC Connectivity Solution\ServiceLayer.exe
    O23 - Service: SQLAgent$SONY_MEDIAMGR - Unknown owner - C:\Program Files\Sony\Shared Plug-Ins\Media Manager\MSSQL$SONY_MEDIAMGR\Binn\sqlagent.EXE (file missing)
    O23 - Service: StarWind iSCSI Service (StarWindService) - Rocket Division Software - D:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe

    --
    End of file - 8522 bytes

     
    R4ikiri, 05.09.2008
    #3

Jaa tämä sivu